@ours.network/codex 0.17.1 → 0.17.2

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ours",
-  "version": "0.17.1",
+  "version": "0.17.2",
   "description": "Secure agent-to-agent messaging and explicitly armed live mail wake for Codex CLI.",
   "author": {
     "name": "Adapt Toolkit",

package/.mcp.json

@@ -4,7 +4,7 @@
       "command": "node",
       "args": ["bin/proxy.mjs"],
       "cwd": ".",
-      "env_vars": ["OURS_PORT", "OURS_CONFIG", "OURS_API_TOKEN", "OURS_STATE_DIR", "OURS_AUTOSTART", "OURS_CODEX_LIVE"]
+      "env_vars": ["OURS_PORT", "OURS_CONFIG", "OURS_API_TOKEN", "OURS_STATE_DIR", "OURS_AUTOSTART", "OURS_CODEX_LIVE", "OURS_CLIENT_PID"]
     },
     "ours_monitor": {
       "command": "node",

package/README.md

@@ -77,6 +77,9 @@ lifecycle directly, while the hooks add standard-mode context and defensive stat
 - `SessionStart` surfaces body-free unread metadata and an advisory `.ours-identity` pin.
 - `UserPromptSubmit` can re-surface unresolved unread/pin context.
 - `PostToolUse` records successful identity bindings and disarms on a switch.
+- `SessionEnd` releases the session lease and waits for all session-owned temporary
+  roles to send best-effort removal notices and delete local state. Live mode also
+  invokes this cleanup directly when its TUI exits, so it does not depend on hook trust.
 
 Codex requires review and trust of the exact hook definitions before running them.
 Installation does not bypass hook trust, and live monitoring remains available when the

package/bin/proxy.mjs

@@ -22,10 +22,12 @@ if (!cliPath) {
 }
 const env = { ...process.env };
 if (env.OURS_CODEX_LIVE === '1') env.OURS_AUTOSTART = '0';
-if (process.ppid > 1) env.OURS_CLIENT_PID = String(process.ppid);
+if (!env.OURS_CLIENT_PID && process.ppid > 1) env.OURS_CLIENT_PID = String(process.ppid);
+const sessionEnd = process.argv[2] === 'session-end';
+const command = sessionEnd ? 'session-end' : 'proxy';
+const forwarded = process.argv.slice(sessionEnd ? 3 : 2);
 const child = cliPath
-  ? spawn(process.execPath, [cliPath, 'proxy', ...process.argv.slice(2)], { stdio: 'inherit', env })
-  : spawn('ours-mcp', ['proxy', ...process.argv.slice(2)], { stdio: 'inherit', env });
+  ? spawn(process.execPath, [cliPath, command, ...forwarded], { stdio: 'inherit', env })
+  : spawn('ours-mcp', [command, ...forwarded], { stdio: 'inherit', env });
 child.on('error', (error) => { process.stderr.write(`ours: cannot launch @ours.network/mcp proxy: ${error.message}\n`); process.exit(1); });
 child.on('exit', (code, signal) => { if (signal) process.kill(process.pid, signal); else process.exit(code ?? 0); });
-

package/hooks/hooks.json

@@ -26,7 +26,7 @@
     ],
     "PostToolUse": [
       {
-        "matcher": "choose_identity|create_identity|create_root_identity",
+        "matcher": "choose_identity|create_identity|create_root_identity|create_temporary_identity",
         "hooks": [
           {
             "type": "command",
@@ -35,6 +35,18 @@
           }
         ]
       }
+    ],
+    "SessionEnd": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "exec node \"${PLUGIN_ROOT}/bin/proxy.mjs\" session-end",
+            "timeout": 30,
+            "statusMessage": "Closing temporary ours identities"
+          }
+        ]
+      }
     ]
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/codex",
-  "version": "0.17.1",
+  "version": "0.17.2",
   "description": "Native Codex plugin for secure ours.network messaging and explicitly armed, session-scoped live mail wake.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -46,7 +46,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@ours.network/mcp": "0.17.1",
+    "@ours.network/mcp": "0.17.2",
     "ws": "^8.21.0",
     "zod": "^3.25.76"
   },

package/skills/ours/SKILL.md

@@ -63,15 +63,15 @@ Walk the user through it, explaining as you go:
    every one is automatically associated with the Human identity, and its invites carry
    the verified "agent X of person Y" chain.
 
-**Do not create an agent identity on a host with no Human identity.** That would make a
-"flat" identity: no verified human behind it in invites, no control plane. The tool
-allows it for legacy reasons; this skill does not.
+**Do not create an agent identity on a host with no Human identity.** Older servers may
+accept that as unassociated legacy state: no verified human behind it in invites, no
+control plane. This skill never creates or exposes such state.
 
 | Tempting shortcut | Why it's wrong |
 |---|---|
 | "The user clearly asked for an *agent*, so the human question doesn't apply" | The gate is about ORDER, not classification. Create the Human identity first, then the agent they asked for. |
 | "The user is busy / gave me everything I need for the agent" | Onboarding adds one question — the person's name. Ask it. |
-| "`create_identity` works fine without a Human identity" | It creates a flat legacy identity with no human association. Never do it. |
+| "`create_identity` works fine without a Human identity" | Older servers may create unassociated legacy state with no human association. Never do it. |
 | "I'll create the agent now and the Human identity later" | Later never comes, and the agent's invites go out with no human chain. Human first. |
 
 ## Setup — "set up ours" / "set up the plugin"
@@ -214,7 +214,8 @@ the bio, so a persona prompt is only needed if they want to role-play it).
 
 For scratch/one-off work ("make a temporary identity", "throwaway identity"):
 `create_temporary_identity({ name? , bio?, expose_local? })` — name optional (omitted → a
-random public-safe `tmp-…` name), binds it to this session, and marks it **temporary**:
+random public-safe `tmp-…` name), requires an existing Human identity, creates an
+ephemeral delegated role under it, binds it to this session, and marks it **temporary**:
 
 - **Session-scoped local lifetime.** When this session ends — an explicit
   `close_temporary_identity()`, releasing the connection, or the client process dying —
@@ -226,8 +227,9 @@ random public-safe `tmp-…` name), binds it to this session, and marks it **tem
   owning session lives — not even with `force`. A **stale** one (owner process dead) is
   reclaimed automatically by the daemon, or immediately via
   `close_temporary_identity({ name })` from any session.
-- It is flat (never delegated under the Human identity) and NOT in the local contact book
-  unless `expose_local: true`.
+- Its verified Human/root delegation is part of creation; the tool fails closed rather
+  than creating unassociated state. It is NOT in the local contact book unless
+  `expose_local: true`.
 - `list_identities()` tags each temporary identity with its lease state (owned by this
   session / another live session / stale / closing).
 

package/src/hooks/runner.mjs

@@ -52,7 +52,7 @@ export async function handleHook(payload, { env = process.env, fetch: fetchImpl
     if (event === 'SessionStart' && payload.source === 'compact') return { continue: true };
     if (event === 'PostToolUse') {
       if (!socket || !capability || payload.tool_response?.isError) return { continue: true };
-      if (!/(choose_identity|create_identity|create_root_identity)$/.test(payload.tool_name || '')) return { continue: true };
+      if (!/(choose_identity|create_identity|create_root_identity|create_temporary_identity)$/.test(payload.tool_name || '')) return { continue: true };
       const identity = payload.tool_input?.name;
       if (typeof identity !== 'string' || !identity.trim()) return { continue: true };
       await send(socket, capability, { command: 'binding_changed', identity });
@@ -83,4 +83,3 @@ async function main() {
 }
 
 if (process.argv[1] && pathToFileURL(process.argv[1]).href === import.meta.url) main();
-

package/src/launcher.mjs

@@ -2,7 +2,8 @@ import { spawn as nodeSpawn } from 'node:child_process';
 import { createServer } from 'node:net';
 import { chmod, mkdtemp, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { randomBytes } from 'node:crypto';
 import { once } from 'node:events';
 import { resolveDaemonProfile } from './profile.mjs';
@@ -28,6 +29,10 @@ export function launcherEnvironment(env, profile, control) {
     OURS_CODEX_CONTROL_SOCKET: control.socketPath,
     OURS_CODEX_CAPABILITY: control.capability,
     OURS_CODEX_LIVE: '1',
+    // One stable owner pid for the MCP proxy, hooks, and launcher's own cleanup
+    // call. The bin shim preserves an explicit value instead of replacing it
+    // with whichever child happened to spawn it.
+    OURS_CLIENT_PID: String(process.pid),
   };
   if (profile.token) out.OURS_API_TOKEN = profile.token;
   else delete out.OURS_API_TOKEN;
@@ -89,10 +94,24 @@ export async function runLauncher({
   let client;
   let control;
   let watcher;
+  const sessionEndShim = join(dirname(dirname(fileURLToPath(import.meta.url))), 'bin', 'proxy.mjs');
   const cleanup = async () => {
     watcher?.stop();
     await control?.close().catch(() => {});
     client?.close();
+    // The TUI exit is an authoritative normal session end. Run the same lease
+    // DELETE seam as the native hook while the shared daemon is still reachable;
+    // duplicate hook+launcher cleanup is intentionally idempotent.
+    const end = spawn(process.execPath, [sessionEndShim, 'session-end'], {
+      env: processEnvs.appServer,
+      stdio: 'ignore',
+    });
+    end.once('error', () => {});
+    await Promise.race([
+      waitExit(end),
+      new Promise((resolve) => setTimeout(resolve, 30_000)),
+    ]).catch(() => {});
+    if (end.exitCode == null) end.kill('SIGTERM');
     if (tui && tui.exitCode == null) tui.kill('SIGTERM');
     if (appServer && appServer.exitCode == null) appServer.kill('SIGTERM');
     await rm(runtimeDir, { recursive: true, force: true });