@ours.network/codex 0.17.0-nightly.9 → 0.18.0-nightly.1

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ours",
-  "version": "0.17.0-nightly.9",
+  "version": "0.18.0-nightly.1",
   "description": "Secure agent-to-agent messaging and explicitly armed live mail wake for Codex CLI.",
   "author": {
     "name": "Adapt Toolkit",

package/bin/proxy.mjs

@@ -24,7 +24,7 @@ const env = { ...process.env };
 if (env.OURS_CODEX_LIVE === '1') env.OURS_AUTOSTART = '0';
 if (process.ppid > 1) env.OURS_CLIENT_PID = String(process.ppid);
 const child = cliPath
-  ? spawn(process.execPath, [cliPath, 'proxy', '--application', 'codex', ...process.argv.slice(2)], { stdio: 'inherit', env })
-  : spawn('ours-mcp', ['proxy', '--application', 'codex', ...process.argv.slice(2)], { stdio: 'inherit', env });
+  ? spawn(process.execPath, [cliPath, 'proxy', ...process.argv.slice(2)], { stdio: 'inherit', env })
+  : spawn('ours-mcp', ['proxy', ...process.argv.slice(2)], { stdio: 'inherit', env });
 child.on('error', (error) => { process.stderr.write(`ours: cannot launch @ours.network/mcp proxy: ${error.message}\n`); process.exit(1); });
 child.on('exit', (code, signal) => { if (signal) process.kill(process.pid, signal); else process.exit(code ?? 0); });

package/dist/monitor-mcp.mjs

@@ -21156,9 +21156,9 @@ var foregroundOffer = (identity) => `IMPORTANT: Before offering the fallback, te
 function foregroundWatchProcess(identity) {
   try {
     const cliPath = require2.resolve("@ours.network/mcp/dist/cli.js");
-    return { command: process.execPath, args: [cliPath, "watch", "--application", "codex", identity] };
+    return { command: process.execPath, args: [cliPath, "watch", identity] };
   } catch {
-    return { command: "ours-mcp", args: ["watch", "--application", "codex", identity] };
+    return { command: "ours-mcp", args: ["watch", identity] };
   }
 }
 async function handleMonitorCommand(command, args = {}, { env = process.env, send = sendControlCommand } = {}) {

package/install.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Install the native ours.network plugin into the OpenAI Codex CLI:
-#   1. ensure the ours daemon (@ours.network/mcp) is installed + running
+#   1. ensure the ours operator CLI and MCP adapter are installed; start the shared daemon
 #   2. add/upgrade adapt-toolkit/ours-codex-marketplace
 #   3. install the native `ours` plugin (skills, MCP servers, and hooks)
 #   4. back up and remove installer-owned legacy config only after verification
@@ -27,18 +27,18 @@ say(){ printf 'ours-install: %s\n' "$1"; }
 ensure_daemon_latest(){
   if [ "${OURS_INSTALL_SKIP_DAEMON:-}" = "1" ]; then say "skipping daemon step (OURS_INSTALL_SKIP_DAEMON=1)"; return 0; fi
   local before after
-  before="$(ours-mcp --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)"
-  say "ensuring @ours.network/mcp@latest…"
-  npm i -g @ours.network/mcp@latest
-  after="$(ours-mcp --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)"
-  if ! ours-mcp status >/dev/null 2>&1; then
-    say "starting the ours daemon…"; ours-mcp start || say "could not auto-start; run 'ours-mcp start' if the tools error."
+  before="$(ours version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)"
+  say "ensuring @ours.network/cli@latest and @ours.network/mcp@latest…"
+  npm i -g @ours.network/cli@latest @ours.network/mcp@latest
+  after="$(ours version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)"
+  if ! ours daemon status >/dev/null 2>&1; then
+    say "starting the ours daemon…"; ours daemon start || say "could not start; run 'ours daemon start' if the tools error."
   elif [ -n "$before" ] && [ "$before" != "$after" ]; then
-    say "daemon upgraded (v${before} → v${after}) — restarting…"; ours-mcp restart || ours-mcp start || true
+    say "operator CLI upgraded (v${before} → v${after}) — restarting its daemon…"; ours daemon restart || ours daemon start || true
   else
     say "daemon already current (v${after:-unknown})."
   fi
-  say "daemon: $(command -v ours-mcp) (v${after:-unknown})"
+  say "operator CLI: $(command -v ours) (v${after:-unknown}); MCP adapter: $(command -v ours-mcp)"
 }
 
 # --- 1) daemon (ensure @latest + restart on change) ---
@@ -91,7 +91,7 @@ say "done. The ours MCP server + skill are live for the next Codex session."
 # --- version echo: show the user they are on latest ---
 if [ "${OURS_INSTALL_SKIP_DAEMON:-}" != "1" ]; then
   say "versions:"
-  say "  daemon: $(ours-mcp --version 2>/dev/null | head -1 || echo 'unknown')"
+  say "  MCP adapter: $(ours-mcp --version 2>/dev/null | head -1 || echo 'unknown')"
   say "  plugin: $(npm ls -g @ours.network/codex 2>/dev/null | grep -oE '@ours\.network/codex@[0-9][0-9.]*' | head -1 || echo '@ours.network/codex (not a global install)')"
 fi
 say "next: bind (or create) an identity, then the ours skill tails ours-mcp watch (or polls"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/codex",
-  "version": "0.17.0-nightly.9",
+  "version": "0.18.0-nightly.1",
   "description": "Native Codex plugin for secure ours.network messaging and explicitly armed, session-scoped live mail wake.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -46,7 +46,8 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@ours.network/mcp": "0.17.0-nightly.9",
+    "@ours.network/mcp": "0.18.0-nightly.1",
+    "@ours.network/sdk": "2.0.1",
     "ws": "^8.21.0",
     "zod": "^3.25.76"
   },

package/skills/ours/SKILL.md

@@ -79,19 +79,12 @@ allows it for legacy reasons; this skill does not.
 
 Walk the user through these, checking each. Stop and help at the first one that isn't done.
 
-1. **Daemon running.** The MCP tools talk to a local background daemon. Check it:
-   `ours-mcp status`. If the command is missing, install it: `npm i -g
-   @ours.network/mcp`, then `ours-mcp start`. For boot-persistence offer
-   `ours-mcp install-service`. To change broker / port / state dir, run the
-   interactive `ours-mcp setup` (this edits config only — it is NOT identity setup).
-   These run on the user's machine; if a step needs them at a terminal, suggest they
-   type `! ours-mcp status` etc.
-   Then check optional voice support with `ours-mcp voice-status --json`. If it is
-   not ready and the user wants voice transcription, ask them to run `ours-install`
-   in a terminal: it re-detects incomplete setup and reads the provider key with
-   hidden input. **Never ask for, paste, echo, or put the key in chat/tool arguments.**
-   Environment-only operators may set `OURS_STT_*` themselves. Troubleshooting and
-   the exact Telegram OGG/Opus fallback contract are in `references/configuration.md`.
+1. **Daemon running.** The MCP tools attach to the shared daemon. Check it with
+   `ours daemon status`. If the commands are missing, install
+   `@ours.network/cli@1.0.1` and `@ours.network/mcp`, then run `ours config setup`
+   and `ours daemon start`. For boot persistence offer
+   `ours daemon install-service`. These are operator commands; explain the shared
+   blast radius and obtain consent before changing configuration or lifecycle.
 2. **Plugin installed.** Install the native plugin from the ours Codex marketplace, or
    install `@ours.network/codex` globally and run `ours-codex-install`. Start a new
    Codex thread after installation. The native package bundles skills, the ours and
@@ -237,9 +230,8 @@ random public-safe `tmp-…` name), binds it to this session, and marks it **tem
 
 If a notice says your plugin and the running daemon are different
 versions, it is **advisory** — everything still works. Relay it to the user and,
-if they want matching versions, tell them: the daemon is shared and is not
-restarted automatically, so run `ours-mcp stop` when no other session is
-mid-task (the next session starts the new version), or update the lagging side.
+if they want matching versions, tell them to update the lagging package and run
+`ours daemon restart` only when no other session is mid-task.
 Do **not** stop work, refuse, or restart anything on your own over this.
 
 ### Workspace identity pin (`.ours-identity`)

package/skills/ours/references/configuration.md

@@ -1,76 +1,26 @@
-# ours configuration and daemon profiles
-
-Each ours daemon owns one port and one state directory. Multiple daemons can run on the
-same host when both values are distinct. Configuration resolves as environment variables,
-then the file named by `OURS_CONFIG` (otherwise `~/.ours/config.json`), then defaults:
-
-| Setting | Environment | JSON key | Default |
-|---|---|---|---|
-| HTTP port | `OURS_PORT` | `port` | `3050` |
-| State directory | `OURS_STATE_DIR` | `stateDir` | `~/.ours` |
-| Broker | `OURS_BROKER_URL` | `brokerUrl` | bundled public broker |
-| API token | `OURS_API_TOKEN` | `apiToken` | owner token file |
-| API visibility | `OURS_API_VISIBILITY` | `apiVisibility` | `owner` |
-| Auto-start | `OURS_AUTOSTART` | `autoStart` | `false` |
-
-For live Codex mode, `ours-codex --ours-port <port>` has highest precedence. The launcher
-queries `/info`, verifies the authenticated notification API, and propagates that exact
-profile to the plugin, hooks, and watcher. It never starts or changes the daemon. A stopped
-or incompatible selected daemon is an error.
-
-With no explicit `--ours-port`, `OURS_PORT`, `OURS_CONFIG`, or `OURS_STATE_DIR`, both standard
-Codex and `ours-codex` use Codex's association in `~/.ours/installer-profiles.json` before the
-historical default config. The selected config and daemon `/info.stateDir` must match the
-registry; drift/auth failures stop with rerun-Nightly guidance. The registry never stores tokens.
-
-Changing daemon configuration is separate operator work. Explain the impact and obtain
-explicit consent before editing or restarting anything. A changed state directory selects a
-different identity store. Use a distinct `OURS_CONFIG`, port, and state directory for a
-second daemon.
-
-Standard mode and live mode use the same MCP tools. Live mode only adds explicitly armed,
-session-scoped wake; it stops with the `ours-codex` session.
-
-## Voice-message transcription
-
-Run `ours-mcp voice-status --json` first. It reports only readiness, provider,
-key presence/source, and a missing-field reason; it never returns the key. A
-ready result is idempotent: keep it and do not ask for setup again. A not-ready
-result should be offered again on every interactive `ours-install` rerun.
-Headless/`OURS_ASSUME_YES` runs never prompt and never invent credentials.
-
-Safest guided setup: ask the user to run `ours-install` in their own terminal.
-Its API-key prompt is hidden, it writes `config.json` atomically with mode
-`0600`, and it restores the prior file if the daemon cannot reload the change.
-Never request a provider key in chat, pass one through an agent tool/command
-argument, print the `stt` config block, or test with a real key. Environment-only
-operators can set `OURS_STT_PROVIDER`, `OURS_STT_API_KEY`, `OURS_STT_MODEL`,
-`OURS_STT_BASE_URL`, and `OURS_STT_LANGUAGE`; environment values override the
-file field-by-field.
-
-Provider requirements:
-
-- `openai-compatible`: key + explicit `/v1` base URL + model.
-- `elevenlabs`: key + model; base URL is optional.
-- `deepgram`: key; model/base URL are optional provider defaults.
-- `custom`: key + `stt.custom.url`; model is required when the custom template
-  references it.
-
-Troubleshooting:
-
-- “not ready” names the missing field. Do not ask the user to reveal its value.
-- If a file edit appears ineffective, check the reported key source and
-  `OURS_STT_*`; an environment override may shadow the file.
-- Config changes require a daemon restart and active sessions may need to bind
-  their identity again.
-- Incoming voice is recognized strictly as an `audio/*` MIME carrying
-  `x-ours-kind=voice-message`, or the legacy `voice-message-…` audio filename.
-  Generic audio and connector-specific filename guesses remain ordinary files.
-- Telegram fallback preserves the original OGG/Opus bytes and `.ogg` filename.
-  Its `send_file` MIME and correlated v2 envelope `attachment.mime` must both be
-  `audio/ogg; x-ours-kind=voice-message`; `attachment.wire_id` identifies the
-  separately delivered file. Connector-local STT success may remain text-only.
-- Oversized audio is saved but not uploaded (daemon default: 5 MiB). Provider
-  HTTP, timeout, malformed-response, and network failures degrade to a precise
-  “transcription failed” line with the saved audio path; provider responses are
-  scrubbed if they echo the configured key.
+# ours daemon configuration
+
+ours-mcp is a client of one already-running shared daemon. The operator CLI owns
+configuration and lifecycle:
+
+```sh
+ours config show --json
+ours config setup --port 3050 --state-dir "$HOME/.ours"
+ours daemon start
+ours daemon status --json
+```
+
+The MCP adapter and `ours-codex` use the published SDK's coherent selection. The
+wholly default selection is port 3050 with state directory `~/.ours`. For another
+daemon, set `OURS_CONFIG`, or set matching `OURS_PORT` and `OURS_STATE_DIR`. A
+token or endpoint selection must be paired with its state directory. `/state-dir`
+is verified before credentials are sent.
+
+The adapter never starts a daemon and never falls back to an embedded one.
+`OURS_INSTANCE`, `--application`, and old ours-mcp daemon variables are errors.
+Standard and live Codex mode use the same selection; live mode only adds an
+explicitly armed, session-scoped wake monitor.
+
+Changing daemon configuration or restarting the shared daemon affects every
+connected application. Explain that blast radius and obtain the user's consent
+before making operator-level changes.

package/src/hooks/runner.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { sendControlCommand } from '../control-server.mjs';
@@ -30,6 +31,14 @@ const safeUnread = (value) => (Array.isArray(value?.identities) ? value.identiti
   return [{ name: entry.name, count, files, recent }];
 });
 
+async function applicationIdentityNames(env, stateDir) {
+  const path = env.OURS_MCP_CONFIG || join(homedir(), '.ours-mcp', 'config.json');
+  const value = JSON.parse(await readFile(path, 'utf8'));
+  if (value?.version !== 1 || !value.daemons || typeof value.daemons !== 'object') return new Set();
+  const identities = value.daemons[resolve(stateDir)]?.identities;
+  return new Set(Array.isArray(identities) ? identities.filter((name) => typeof name === 'string') : []);
+}
+
 function renderContext(unread, pin) {
   const lines = [];
   if (unread.length) {
@@ -64,22 +73,25 @@ export async function handleHook(payload, { env = process.env, fetch: fetchImpl
       await send(socket, capability, { command: 'register_session', sessionId: payload.session_id, threadId: payload.session_id, cwd: payload.cwd });
     }
     let port = env.OURS_PORT || '3050';
+    let selectedStateDir = resolve(env.OURS_STATE_DIR || join(homedir(), '.ours'));
     let selectedToken = env.OURS_API_TOKEN || '';
     // Standard Codex does not pass through ours-codex's resolved environment.
-    // Resolve its registry association here too so SessionStart/UserPromptSubmit
-    // inspect the same daemon as the stdio proxy. Hook failures remain benign.
-    if (!env.OURS_PORT && !env.OURS_CONFIG && !env.OURS_STATE_DIR) {
-      try {
-        const selected = await resolveDaemonProfile({ env, fetch: fetchImpl });
-        port = String(selected.port);
-        selectedToken = selected.token || '';
-      } catch { /* proxy/launcher owns diagnostics; hooks emit a benign no-op */ }
-    }
+    // Resolve the same coherent SDK selection here so SessionStart and
+    // UserPromptSubmit inspect the same daemon as the stdio proxy.
+    try {
+      const selected = await resolveDaemonProfile({ env, fetch: fetchImpl });
+      port = String(selected.port);
+      selectedToken = selected.token || '';
+      selectedStateDir = resolve(selected.stateDir);
+    } catch { /* proxy/launcher owns diagnostics; hooks emit a benign no-op */ }
     const headers = selectedToken ? { 'x-ours-api-token': selectedToken } : {};
     let unread = [];
     try {
       const response = await fetchImpl(`http://127.0.0.1:${port}/unread`, { headers, signal: AbortSignal.timeout(1500) });
-      if (response.ok) unread = safeUnread(await response.json());
+      if (response.ok) {
+        const visible = await applicationIdentityNames(env, selectedStateDir);
+        unread = safeUnread(await response.json()).filter((entry) => visible.has(entry.name));
+      }
     } catch { /* daemon diagnostics belong to launcher/proxy */ }
     const pin = await findPin(payload.cwd || process.cwd());
     const context = renderContext(unread, pin);

package/src/monitor-mcp.mjs

@@ -23,9 +23,9 @@ const foregroundOffer = (identity) =>
 export function foregroundWatchProcess(identity) {
   try {
     const cliPath = require.resolve('@ours.network/mcp/dist/cli.js');
-    return { command: process.execPath, args: [cliPath, 'watch', '--application', 'codex', identity] };
+    return { command: process.execPath, args: [cliPath, 'watch', identity] };
   } catch {
-    return { command: 'ours-mcp', args: ['watch', '--application', 'codex', identity] };
+    return { command: 'ours-mcp', args: ['watch', identity] };
   }
 }
 

package/src/profile.mjs

@@ -1,8 +1,7 @@
-import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { isAbsolute, join, normalize, resolve } from 'node:path';
 
-const DEFAULT_PORT = 3050;
+import { assertDaemonStateDir, resolveDaemonConfig } from '@ours.network/sdk';
 
 function validPort(value) {
   const port = Number(value);
@@ -13,11 +12,11 @@ function validPort(value) {
 export function parseOursArgs(argv = []) {
   const codexArgs = [];
   let port;
-  for (let i = 0; i < argv.length; i += 1) {
-    const arg = argv[i];
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
     if (arg === '--ours-port') {
-      if (argv[i + 1] == null) throw new Error('ours: --ours-port requires a value');
-      port = validPort(argv[++i]);
+      if (argv[index + 1] == null) throw new Error('ours: --ours-port requires a value');
+      port = validPort(argv[++index]);
     } else if (arg.startsWith('--ours-port=')) {
       port = validPort(arg.slice('--ours-port='.length));
     } else {
@@ -27,191 +26,41 @@ export function parseOursArgs(argv = []) {
   return { port, codexArgs };
 }
 
-async function readJson(path) {
-  try { return JSON.parse(await readFile(path, 'utf8')); } catch { return {}; }
-}
-
-async function readRequiredJson(path, kind) {
-  let text;
-  try { text = await readFile(path, 'utf8'); }
-  catch (error) { throw rerun(`cannot read ${kind} ${path}: ${error.message}`); }
-  try {
-    const value = JSON.parse(text);
-    if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('expected an object');
-    return value;
-  } catch (error) { throw rerun(`${kind} ${path} is corrupt JSON: ${error.message}`); }
-}
-
-async function readRegistryJson(path) {
-  let text;
-  try { text = await readFile(path, 'utf8'); }
-  catch (error) {
-    if (error?.code === 'ENOENT') return null;
-    throw error;
-  }
-  try { return JSON.parse(text); }
-  catch (error) { throw rerun(`registry ${path} is corrupt JSON: ${error.message}`); }
-}
-
-async function readOwnerToken(stateDir) {
-  try { return (await readFile(join(stateDir, 'daemon-token'), 'utf8')).trim() || null; } catch { return null; }
-}
-
-export class AssociationError extends Error {
-  constructor(message, code = 'INVALID_ASSOCIATION') {
-    super(`ours profile association: ${message}. Re-run the Nightly installer to repair this association`);
-    this.name = 'AssociationError';
-    this.code = code;
-  }
-}
-
-const rerun = (message, code) => new AssociationError(message, code);
-const PROFILE_ID = /^[A-Za-z0-9](?:[A-Za-z0-9_-]{0,30}[A-Za-z0-9])?$/;
-const APPLICATIONS = ['claude-code', 'codex', 'hermes'];
-
-function associatedPath(value, profileId, field) {
-  if (typeof value !== 'string' || !isAbsolute(value) || normalize(value) !== value || value === '/') {
-    throw rerun(`profile ${profileId} has unsafe ${field}`);
-  }
-  return value;
-}
-
-function validateProfile(profileId, value) {
-  if (!PROFILE_ID.test(profileId)) throw rerun(`invalid profile id ${JSON.stringify(profileId)}`);
-  if (!value || typeof value !== 'object' || Array.isArray(value)) throw rerun(`profile ${profileId} is not an object`);
-  for (const key of Object.keys(value)) {
-    if (!['label', 'host', 'port', 'configPath', 'stateDir', 'serviceName', 'ownership'].includes(key)) {
-      throw rerun(`profile ${profileId} contains unsupported field ${JSON.stringify(key)}`);
-    }
-  }
-  if (typeof value.label !== 'string' || !value.label.trim()) throw rerun(`profile ${profileId} has no label`);
-  const host = String(value.host || '').toLowerCase();
-  if (host !== 'localhost' && host !== '127.0.0.1') throw rerun(`profile ${profileId} uses non-loopback host ${JSON.stringify(value.host)}`);
-  if (typeof value.port !== 'number') throw rerun(`profile ${profileId} has invalid port`);
-  let port;
-  try { port = validPort(value.port); }
-  catch { throw rerun(`profile ${profileId} has invalid port`); }
-  const configPath = associatedPath(value.configPath, profileId, 'configPath');
-  const stateDir = associatedPath(value.stateDir, profileId, 'stateDir');
-  const serviceName = typeof value.serviceName === 'string' ? value.serviceName.trim() : '';
-  if ((profileId !== 'default' && !serviceName) || (serviceName && !PROFILE_ID.test(serviceName))) {
-    throw rerun(`profile ${profileId} has invalid serviceName`);
-  }
-  const ownership = value.ownership;
-  if (!ownership || typeof ownership !== 'object' || Array.isArray(ownership)) throw rerun(`profile ${profileId} has no explicit ownership`);
-  for (const key of Object.keys(ownership)) if (!['config', 'service', 'state'].includes(key)) throw rerun(`profile ${profileId} ownership contains unsupported field ${JSON.stringify(key)}`);
-  if (typeof ownership.config !== 'boolean' || typeof ownership.service !== 'boolean' || typeof ownership.state !== 'boolean') {
-    throw rerun(`profile ${profileId} has invalid ownership`);
-  }
-  return { ...value, label: value.label.trim(), host: '127.0.0.1', port, configPath, stateDir, serviceName };
-}
-
-function associatedProfile(registry, application) {
-  if (!registry || typeof registry !== 'object' || Array.isArray(registry)) throw rerun('registry is not an object');
-  for (const key of Object.keys(registry)) if (!['version', 'profiles', 'harnessAssociations'].includes(key)) throw rerun(`registry contains unsupported field ${JSON.stringify(key)}`);
-  if (registry.version !== 1) throw rerun(`unsupported registry version ${JSON.stringify(registry.version)}`);
-  if (!registry.profiles || typeof registry.profiles !== 'object' || Array.isArray(registry.profiles) ||
-      !registry.harnessAssociations || typeof registry.harnessAssociations !== 'object' || Array.isArray(registry.harnessAssociations)) {
-    throw rerun('registry profiles and harnessAssociations must be objects');
-  }
-  const profiles = Object.fromEntries(Object.entries(registry.profiles).map(([id, value]) => [id, validateProfile(id, value)]));
-  const profileEntries = Object.entries(profiles);
-  for (let index = 0; index < profileEntries.length; index += 1) {
-    const [id, profile] = profileEntries[index];
-    for (const [otherId, other] of profileEntries.slice(index + 1)) {
-      const collision = profile.port === other.port ? 'endpoint'
-        : resolve(profile.stateDir) === resolve(other.stateDir) ? 'stateDir'
-          : profile.configPath === other.configPath ? 'configPath'
-            : profile.serviceName === other.serviceName ? 'serviceName' : '';
-      if (collision) throw rerun(`profiles ${id} and ${otherId} collide on ${collision}`);
-    }
-  }
-  for (const [key, value] of Object.entries(registry.harnessAssociations)) {
-    if (!APPLICATIONS.includes(key) || typeof value !== 'string' || !profiles[value]) {
-      throw rerun(`invalid association ${JSON.stringify(key)} -> ${JSON.stringify(value)}`);
-    }
-  }
-  const profileId = registry.harnessAssociations[application];
-  if (profileId == null) return null;
-  return { profileId, ...profiles[profileId] };
-}
-
-export async function resolveDaemonProfile({ argv = [], env = process.env, readConfig, fetch: fetchImpl = globalThis.fetch } = {}) {
+export async function resolveDaemonProfile({ argv = [], env = process.env, fetch: fetchImpl = globalThis.fetch } = {}) {
   const parsed = parseOursArgs(argv);
-  const home = env.HOME || homedir();
-  const defaultConfigPath = join(home, '.ours', 'config.json');
-  const explicitPort = parsed.port != null || (env.OURS_PORT != null && env.OURS_PORT !== '');
-  const explicitConfig = !!env.OURS_CONFIG;
-  const explicitState = !!env.OURS_STATE_DIR;
-  let association = null;
-  if (!explicitPort && !explicitConfig && !explicitState) {
-    const registryPath = env.OURS_INSTALL_PROFILES || join(home, '.ours', 'installer-profiles.json');
-    if (env.OURS_INSTALL_PROFILES && (!isAbsolute(registryPath) || normalize(registryPath) !== registryPath || registryPath === '/')) {
-      throw rerun('OURS_INSTALL_PROFILES must be a normalized absolute path');
-    }
-    let registry;
-    try { registry = await readRegistryJson(registryPath); }
-    catch (error) {
-      if (String(error?.message || '').startsWith('ours profile association:')) throw error;
-      throw rerun(`cannot read registry ${registryPath}: ${error?.message || error}`);
-    }
-    if (registry) association = associatedProfile(registry, 'codex');
-  }
-  const configPath = env.OURS_CONFIG || association?.configPath || defaultConfigPath;
-  const config = await (readConfig ? readConfig(configPath) : association
-    ? readRequiredJson(configPath, `associated config for ${association.profileId}`)
-    : readJson(configPath));
-  let source = 'default';
-  let port = DEFAULT_PORT;
-  if (typeof config?.port === 'number' && Number.isFinite(config.port)) {
-    port = validPort(config.port);
-    source = env.OURS_CONFIG ? 'OURS_CONFIG' : association ? 'registry' : 'config';
-  }
-  if (association) {
-    const configState = resolve(typeof config?.stateDir === 'string' ? config.stateDir : join(home, '.ours'));
-    if (port !== association.port || configState !== resolve(association.stateDir)) {
-      throw rerun(`profile ${association.profileId} disagrees with ${configPath} on port/stateDir`, 'CONFIG_DRIFT');
-    }
-  }
-  if (env.OURS_PORT != null && env.OURS_PORT !== '') { port = validPort(env.OURS_PORT); source = 'OURS_PORT'; }
-  if (parsed.port != null) { port = parsed.port; source = '--ours-port'; }
+  const selection = resolveDaemonConfig({
+    ...(parsed.port == null ? {} : { port: parsed.port }),
+    env,
+    homeDir: env.HOME || homedir(),
+  });
+  await assertDaemonStateDir(selection, { fetch: fetchImpl, timeoutMs: 2000 });
 
-  const baseUrl = `http://127.0.0.1:${port}`;
-  let response;
-  try { response = await fetchImpl(`${baseUrl}/info`, { signal: AbortSignal.timeout(2000) }); }
-  catch (error) {
-    throw new Error(`ours daemon on port ${port} is not reachable; ours-codex never starts it. Start the selected daemon first. (${error?.message || error})`);
-  }
-  if (!response.ok) throw new Error(`ours daemon on port ${port} returned HTTP ${response.status}`);
+  const baseUrl = selection.baseUrl.value;
+  const token = selection.token?.value ?? null;
+  const headers = token ? { 'x-ours-api-token': token } : {};
+  const response = await fetchImpl(`${baseUrl}/info`, { signal: AbortSignal.timeout(2000) });
+  if (!response.ok) throw new Error(`ours daemon at ${baseUrl} returned HTTP ${response.status}`);
   const info = await response.json();
-  if (info?.name !== 'ours' || !Number.isInteger(info?.protocol) || info.protocol < 1 || typeof info?.stateDir !== 'string') {
-    throw new Error(`incompatible service on port ${port}; expected an ours daemon with notification protocol 1`);
+  if (info?.name !== 'ours' || !Number.isInteger(info?.protocol) || info.protocol < 1) {
+    throw new Error(`incompatible service at ${baseUrl}; expected an ours daemon with notification protocol 1`);
   }
-  const stateDir = resolve(info.stateDir);
-  const expectedStateDir = env.OURS_STATE_DIR ? resolve(env.OURS_STATE_DIR) : association ? resolve(association.stateDir) : null;
-  if (expectedStateDir && stateDir !== expectedStateDir) {
-    throw association
-      ? rerun(`profile ${association.profileId} expects stateDir ${expectedStateDir}, daemon reports ${stateDir}`)
-      : new Error(`ours daemon stateDir mismatch: expected ${expectedStateDir}, daemon reports ${stateDir}`);
+  for (const path of ['/identities', '/unread']) {
+    const capability = await fetchImpl(`${baseUrl}${path}`, { headers, signal: AbortSignal.timeout(2000) });
+    if (capability.status === 401 || capability.status === 403) {
+      throw new Error(`ours daemon authentication failed at ${baseUrl}; supply the matching coherent selection`);
+    }
+    if (!capability.ok) throw new Error(`selected daemon lacks ${path} (HTTP ${capability.status})`);
   }
-  const selectedStateDir = expectedStateDir || stateDir;
-  const token = env.OURS_API_TOKEN?.trim() || config?.apiToken?.trim() || await readOwnerToken(selectedStateDir);
-  const headers = token ? { 'x-ours-api-token': token } : {};
-  let capability;
-  try { capability = await fetchImpl(`${baseUrl}/identities`, { headers, signal: AbortSignal.timeout(2000) }); }
-  catch (error) { throw new Error(`ours daemon capability check failed: ${error?.message || error}`); }
-  if (capability.status === 401 || capability.status === 403) throw new Error(`ours daemon authentication failed on port ${port}; supply the matching OURS_API_TOKEN/config`);
-  if (!capability.ok) throw new Error(`selected daemon lacks the notification API (HTTP ${capability.status})`);
-  let unread;
-  try { unread = await fetchImpl(`${baseUrl}/unread`, { headers, signal: AbortSignal.timeout(2000) }); }
-  catch (error) { throw new Error(`ours daemon unread capability check failed: ${error?.message || error}`); }
-  if (unread.status === 401 || unread.status === 403) throw new Error(`ours daemon authentication failed on port ${port}; supply the matching OURS_API_TOKEN/config`);
-  if (!unread.ok) throw new Error(`selected daemon lacks the body-free unread API (HTTP ${unread.status}); install the testing daemon build and restart that daemon explicitly`);
 
   return {
-    port, stateDir: selectedStateDir, token: token || null,
-    visibility: env.OURS_API_VISIBILITY || config?.apiVisibility || 'owner',
-    source, info, baseUrl, configPath, codexArgs: parsed.codexArgs,
-    ...(association ? { profileId: association.profileId, association } : {}),
+    port: selection.port.value,
+    stateDir: selection.expectStateDir,
+    token,
+    visibility: 'owner',
+    source: selection.baseUrl.source,
+    info,
+    baseUrl,
+    configPath: selection.configPath?.value ?? join(selection.expectStateDir, 'config.json'),
+    codexArgs: parsed.codexArgs,
   };
 }