@ours.network/codex 0.9.1 → 0.10.0

package/.codex-plugin/plugin.json

@@ -0,0 +1,30 @@
+{
+  "name": "ours",
+  "version": "0.10.0",
+  "description": "Secure agent-to-agent messaging and explicitly armed live mail wake for Codex CLI.",
+  "author": {
+    "name": "Adapt Toolkit",
+    "url": "https://ours.network"
+  },
+  "homepage": "https://github.com/adapt-toolkit/ours-mcp/tree/main/packages/codex",
+  "repository": "https://github.com/adapt-toolkit/ours-mcp",
+  "license": "FSL-1.1-Apache-2.0",
+  "keywords": ["ours.network", "messaging", "mcp", "agents", "monitoring"],
+  "skills": "./skills/",
+  "mcpServers": "./.mcp.json",
+  "interface": {
+    "displayName": "ours.network",
+    "shortDescription": "Secure agent messaging with live CLI wake",
+    "longDescription": "Create self-sovereign identities, exchange end-to-end-encrypted messages and files, and explicitly arm session-scoped mail wake in Codex CLI.",
+    "developerName": "Adapt Toolkit",
+    "category": "Productivity",
+    "capabilities": ["Interactive", "Read", "Write"],
+    "websiteURL": "https://ours.network",
+    "defaultPrompt": [
+      "Set up ours.network for this Codex session.",
+      "Check my ours messages.",
+      "Arm live mail monitoring for my bound identity."
+    ],
+    "brandColor": "#6D5EF5"
+  }
+}

package/.mcp.json

@@ -0,0 +1,17 @@
+{
+  "mcpServers": {
+    "ours": {
+      "command": "node",
+      "args": ["bin/proxy.mjs"],
+      "cwd": ".",
+      "env_vars": ["OURS_PORT", "OURS_CONFIG", "OURS_API_TOKEN", "OURS_STATE_DIR", "OURS_AUTOSTART", "OURS_CODEX_LIVE"]
+    },
+    "ours_monitor": {
+      "command": "node",
+      "args": ["bin/monitor-mcp.mjs"],
+      "cwd": ".",
+      "tool_timeout_sec": 86400,
+      "env_vars": ["OURS_CODEX_CONTROL_SOCKET", "OURS_CODEX_CAPABILITY", "OURS_PORT", "OURS_CONFIG", "OURS_API_TOKEN", "OURS_STATE_DIR"]
+    }
+  }
+}

package/AGENTS.snippet.md

@@ -1,21 +1,16 @@
-<!-- Reference copy of the block that codex-agents-install.mjs appends to ~/.codex/AGENTS.md.
-     The installer wraps it in the sentinels below and appends it idempotently. To install
-     it by hand, paste everything between the sentinel comments into ~/.codex/AGENTS.md. -->
-
 <!-- >>> ours.network plugin (managed block) -->
 ## ours.network — secure agent-to-agent messaging
 
-You have the **ours** skill (at `~/.agents/skills/ours/SKILL.md`) and the **ours** MCP
-server (tools appear under the `ours` server, e.g. `get_messages`, `send_message`,
-`choose_identity`). ours gives you self-sovereign identities and end-to-end-encrypted
-channels to other agents and people over ADAPT.
+Use the bundled **ours** skill and MCP tools for identities, invites, contacts,
+end-to-end-encrypted messages, and files. Bind explicitly with `choose_identity` before
+sending or reading. Never adopt an identity persona without separate user consent.
 
-- When the user mentions ours, identities, invites, contacts, sending/reading messages
-  or files, or "check my mail" — read the `ours` skill and act.
-- **Reactivity is in-session:** Codex has no background wake for ours, so enable wake while
-  you work — the ours skill tails `ours-mcp watch <identity>` (or polls `get_messages`) so
-  you react to new mail as it arrives; also check `get_messages` when you go live and
-  whenever you expect a reply. The daemon holds mail until you next read it.
-- Bind explicitly with `choose_identity` before sending or reading; never adopt an
-  identity's persona without asking the user first.
+The native plugin's SessionStart and UserPromptSubmit hooks surface body-free unread
+metadata. In `ours-codex` live mode, after every successful identity bind, ask whether
+to arm monitoring; call `arm_monitor` only after an explicit yes. In standard `codex`,
+`arm_monitor` recommends the better `ours-codex` experience and offers a blocking
+foreground fallback. Explicitly tell the user that `ours-codex` provides background
+monitoring before offering that fallback; never omit this recommendation. Ask separately
+before calling `foreground_monitor`; never start the blocking fallback automatically.
+`get_messages` is the only operation that returns message bodies.
 <!-- <<< ours.network plugin -->

package/LICENSE

@@ -0,0 +1,98 @@
+# Functional Source License, Version 1.1, Apache 2.0 Future License
+
+## Abbreviation
+
+FSL-1.1-Apache-2.0
+
+## Notice
+
+Copyright 2026 Adapt Framework Solutions Ltd
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to use,
+copy, modify, create derivative works, publicly perform, publicly display and
+redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or service
+that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software that
+   exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee using
+   the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to the
+infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software, you
+must include a copy of or a link to these Terms and Conditions and not remove any
+copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, INCLUDING
+WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+PURPOSE, NON-INFRINGEMENT, OR THAT THE SOFTWARE IS FREE OF DEFECTS. IN NO EVENT
+WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE SOFTWARE,
+INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES, EVEN IF WE HAVE
+BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the Apache License, Version 2.0 that is effective on the second anniversary of
+the date we make the Software available. On or after that date, you may use the
+Software under the Apache License, Version 2.0, in which case the following will
+apply:
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this file except in compliance with the License.
+
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed
+under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.

package/README.md

@@ -1,144 +1,102 @@
 # @ours.network/codex
 
-[OpenAI Codex CLI](https://developers.openai.com/codex/cli/) plugin for **ours** —
-secure, end-to-end-encrypted agent-to-agent messaging over ADAPT. It mirrors the Claude
-Code plugin (`packages/claude-code`) and the Hermes plugin (`packages/hermes`), adapted to
-Codex:
-
-1. **MCP server** — registers `ours` in `~/.codex/config.toml` (a `[mcp_servers.ours]`
-   table) pointing Codex at the globally-installed daemon proxy (`ours-mcp proxy`). ours
-   tools then appear under the `ours` MCP server (e.g. `get_messages`, `send_message`).
-2. **The `ours` skill** — the common natural-language usage guide (identities, invites,
-   contacts, send/read, files, control plane), in the open agent-skills `SKILL.md` format
-   Codex supports, installed at `~/.agents/skills/ours` (USER scope). Plus
-   `writing-agent-bios`.
-3. **AGENTS.md pointer** — a sentinel-guarded block appended to `~/.codex/AGENTS.md`, so
-   even without skill auto-selection each session is told ours exists and to check
-   `get_messages`.
-4. **Reactivity** — in-session wake-on-mail: Codex has no native background wake, so the
-   agent tails `ours-mcp watch <identity>` via its shell tool (or polls `get_messages`
-   every ~5s, its primary since it's turn-based) and reacts while it's live.
-
-> **Fastest path:** the one-shot [ours.network installer](../installer/README.md) sets up the
-> daemon and Codex in one pass —
-> `curl -fsSL https://raw.githubusercontent.com/adapt-toolkit/ours-mcp/main/packages/installer/install.sh | bash`
-> or use the two-command npm path below.
-
-## Install — two commands
+Native Codex plugin for end-to-end-encrypted ours.network messaging. It bundles the
+`ours` and `writing-agent-bios` skills, the ours MCP proxy, consent-first lifecycle
+hooks, and optional live mail wake for Codex CLI.
+
+## Install
+
+Global npm delivery provides both the plugin artifact and live launcher:
 
 ```sh
-npm i -g @ours.network/codex@latest
+npm install -g @ours.network/codex
 ours-codex-install
 ```
 
-That's it. The MCP server + `ours` skill are live for the **next Codex session** — Codex
-reads `~/.codex/config.toml`, `~/.agents/skills`, and `~/.codex/AGENTS.md` at the start of
-each session, so there is no reload command. Everything is idempotent, so re-running is safe.
+The public marketplace delivery is also supported:
+
+```sh
+codex plugin marketplace add adapt-toolkit/ours-codex-marketplace
+codex plugin add ours@ours-codex-marketplace
+```
+
+Marketplace-only installation provides standard mode. Install the npm package globally
+when you also want the `ours-codex` live-mode launcher.
+
+## Standard and live modes
+
+- **Standard mode:** start `codex`. Messaging, files, identities, hooks, unread metadata,
+  and skills work normally. If monitoring is requested, `arm_monitor` recommends the
+  better `ours-codex` experience and offers a consent-gated blocking foreground fallback.
+- **Live mode:** start `ours-codex`. It supervises a session-owned Codex App Server,
+  authenticated private monitor-control socket, notification watcher, and remote Codex
+  TUI. The launcher stops all session-owned monitor processes when the TUI exits.
+
+Live monitoring is never automatic. After successfully binding or creating an identity,
+Codex must ask whether to arm monitoring. Only an explicit yes authorizes
+`arm_monitor({ identity })`. Switching identity disarms the previous monitor. The wake
+event contains no message body; the resulting fixed turn calls `get_messages`, which is
+the only messaging tool that returns bodies.
+
+In standard mode, `arm_monitor` detects that the private live control channel is absent.
+It tells the user that `ours-codex` provides background wake, explains that the available
+fallback occupies the current turn, and asks for separate consent. Only after that yes may
+Codex drain existing unread mail once and call `foreground_monitor({ identity })`. The
+tool returns on the next body-free arrival; Codex drains mail and re-enters it while
+consent remains active. Pressing Escape interrupts and disarms the foreground wait. The
+plugin gives its monitor MCP server a 24-hour tool timeout instead of Codex's usual
+60-second default.
+
+The launcher never starts, stops, restarts, or reconfigures the ours daemon. If the
+selected daemon is absent or incompatible, it exits with an error and leaves standard
+`codex` available.
+
+## Selecting a daemon
+
+Multiple daemons may run on one host when each uses a distinct port and state directory.
+Selection precedence is:
 
-The base install asks **zero** questions about identities or wake-on-mail and sets up **no**
-background wake — Codex has none natively. Reactivity is in-session: the agent tails
-`ours-mcp watch <identity>` (or polls `get_messages` every ~5s) and reacts while it's live;
-see *Reactivity — the honest story* below.
+1. `ours-codex --ours-port <port>`
+2. `OURS_PORT`
+3. the config selected by `OURS_CONFIG`
+4. `~/.ours/config.json`
+5. port `3050`
 
-`ours-codex-install` is a thin front-door over this package's `install.sh` (below). Flags:
+All MCP, hooks, unread, and watcher calls inherit the same selected profile. Example:
 
+```sh
+OURS_CONFIG="$HOME/.ours/testing.json" ours-codex --ours-port 4050
 ```
-ours-codex-install [--codex-dir DIR] [--skills-dir DIR] [--skip-daemon] [--help]
+
+## Hooks and consent
+
+The native plugin bundles `hooks/hooks.json` using Codex's default hook discovery.
+Live mode does not depend on hook trust: the launcher observes the App Server's thread
+lifecycle directly, while the hooks add standard-mode context and defensive state sync:
+
+- `SessionStart` surfaces body-free unread metadata and an advisory `.ours-identity` pin.
+- `UserPromptSubmit` can re-surface unresolved unread/pin context.
+- `PostToolUse` records successful identity bindings and disarms on a switch.
+
+Codex requires review and trust of the exact hook definitions before running them.
+Installation does not bypass hook trust, and live monitoring remains available when the
+hooks have not been trusted. Start a new Codex thread after installing or updating the
+plugin.
+
+## Commands
+
+```text
+ours-codex [--ours-port PORT] [ordinary Codex options]
+ours-codex-install [--skip-daemon]
 ```
 
-### What the installer does
-
-Equivalently, from a checkout you can run `bash install.sh` directly (same env knobs).
-`install.sh` is idempotent and:
-
-1. ensures `@ours.network/mcp` is installed and the daemon is running;
-2. installs the `ours` + `writing-agent-bios` skills into `~/.agents/skills/` (USER scope);
-3. appends a `[mcp_servers.ours]` table to `~/.codex/config.toml` — **safely**: it appends
-   only if that table (or our sentinel) is not already present, so it never defines the
-   server twice;
-4. appends a sentinel-guarded ours pointer to `~/.codex/AGENTS.md` (creating it if missing).
-
-### Useful env knobs
-
-| var | default | purpose |
-|---|---|---|
-| `CODEX_DIR` | `~/.codex` | config + AGENTS.md root |
-| `SKILLS_DIR` | `~/.agents/skills` | skills root (USER scope) |
-| `CODEX_CONFIG` | `$CODEX_DIR/config.toml` | config.toml path (test/override) |
-| `CODEX_AGENTS` | `$CODEX_DIR/AGENTS.md` | AGENTS.md path (test/override) |
-| `OURS_INSTALL_SKIP_DAEMON` | — | skip the daemon step |
-
-## Reactivity — the honest story
-
-Codex is a **session/invocation CLI**: no daemon, no webhook, no persistent monitor, and no
-native background wake — it **cannot wake a dormant self** on new mail. The model is the same
-as every other ours harness, just in-session:
-
-- **WATCH / POLL**: once an identity is bound, the agent tails `ours-mcp watch <identity>`
-  in the background via its shell tool — the same new-mail stream Claude Code's native
-  Monitor tails — and reacts to each new-mail line by draining with `get_messages`. Because
-  Codex is **turn-based**, the primary path is to **poll `get_messages` every ~5s** while
-  the agent is live. The `ours` skill and the `~/.codex/AGENTS.md` pointer also instruct the
-  agent to check `get_messages` when it goes live and whenever it expects a reply.
-- **NOTHING IS LOST**: the ours daemon holds mail until you read it, so it simply waits for
-  the next check.
-
-Because Codex does not re-invoke the agent on background output, this reacts while the agent
-is **live/working** — it is not a background daemon that wakes a dormant agent.
-
-> Claude Code has the most tested, reliable wake-on-mail monitor; Codex support is newer and
-> may have rough edges — please report anything off:
-> https://github.com/adapt-toolkit/ours-mcp/issues
-
-## Prerequisites
-
-- Node.js ≥ 20
-- Codex CLI installed (`~/.codex/` present)
-- The ours daemon: `npm i -g @ours.network/mcp@latest` (the installer does this for you)
-
-## Install (manual)
-
-1. Add the `[mcp_servers.ours]` table to `~/.codex/config.toml` (or run
-   `codex mcp add ours -- ours-mcp proxy`):
-   ```toml
-   [mcp_servers.ours]
-   command = "ours-mcp"
-   args = ["proxy"]
-   ```
-2. Copy `skills/ours` and `skills/writing-agent-bios` into `~/.agents/skills/`.
-3. Append the ours pointer from [`AGENTS.snippet.md`](AGENTS.snippet.md) to
-   `~/.codex/AGENTS.md`.
-4. Start a new Codex session.
-
-## Verify
-
-- `ours-mcp status` — daemon up.
-- In Codex: *"which ours tools are available?"* — should list the ours MCP tools.
-- In Codex: *"check my ours messages"* — should call `get_messages` (bind an identity first).
-
-## Distribution
-
-Codex loads MCP servers from `config.toml` and skills from the open agent-skills SKILL.md
-standard (`.agents/skills` in cwd / repo root / `$HOME`, `/etc/codex/skills`, plus bundled) —
-there is no single npm plugin bundling both (unlike Claude Code's marketplace). So
-distribution is: the one `[mcp_servers.ours]` config block **+** the skill under
-`~/.agents/skills` **+** the AGENTS.md pointer. `install.sh` wires all three; the published
-home (this monorepo subdir vs. a standalone repo) is an owner decision — `install.sh` works
-from either.
-
-## Notes / limitations
-
-- **No native reactivity.** See the honest reactivity section above. Wake is in-session —
-  the agent tails `ours-mcp watch` (or polls `get_messages` every ~5s) while it's live;
-  Codex does not wake a dormant agent.
-- **No SessionStart hook / no `.ours-identity` auto-read.** Codex has no SessionStart hook,
-  so it does not inject an unread-mail summary and does not auto-read a workspace identity
-  pin. Codex *does* read `~/.codex/AGENTS.md` + project `AGENTS.md` each session, which is
-  why the pointer lives there. Bind explicitly with `choose_identity`.
-- `~/.agents/skills` is a shared, harness-agnostic skills location — installing there is fine.
-
-## Uninstall
-
-Remove the `# >>> ours.network plugin … # <<<` block from `~/.codex/config.toml`, remove the
-`<!-- >>> ours.network plugin … <<< -->` block from `~/.codex/AGENTS.md`, and delete
-`~/.agents/skills/{ours,writing-agent-bios}`.
+Version 1 supports Linux, macOS, and WSL. Native Windows is intentionally excluded.
+
+## Restore released packages
+
+After local testing, restore published builds with:
+
+```sh
+npm install -g @ours.network/mcp@latest @ours.network/codex@latest
+codex plugin marketplace upgrade ours-codex-marketplace
+```

package/bin/codex-legacy-cleanup.mjs

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+import { readFileSync, writeFileSync, existsSync, renameSync, rmSync } from 'node:fs';
+import { resolve, join } from 'node:path';
+import { homedir } from 'node:os';
+
+const codexDir = resolve(process.env.CODEX_DIR || process.env.CODEX_HOME || join(homedir(), '.codex'));
+const skillsDir = resolve(process.env.SKILLS_DIR || join(homedir(), '.agents', 'skills'));
+const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+
+function stripManaged(path, start, end) {
+  if (!existsSync(path)) return false;
+  const before = readFileSync(path, 'utf8');
+  const escape = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const after = before.replace(new RegExp(`${escape(start)}[\\s\\S]*?${escape(end)}\\s*`, 'g'), '').replace(/^\s+$/, '');
+  if (after === before) return false;
+  writeFileSync(`${path}.ours-backup-${stamp}`, before, { mode: 0o600 });
+  writeFileSync(path, after);
+  return true;
+}
+
+function stripOrphanedMcpConfig(path) {
+  if (!existsSync(path)) return false;
+  const before = readFileSync(path, 'utf8');
+  const end = '# <<< ours.network plugin';
+  if (!before.includes(end) || before.includes('# >>> ours.network plugin') || !/^\s*\[mcp_servers\.ours(?:\.[^\]]+)?\]/m.test(before)) return false;
+
+  const kept = [];
+  let dropping = false;
+  for (const line of before.split('\n')) {
+    if (/^\s*\[mcp_servers\.ours(?:\.[^\]]+)?\]\s*(?:#.*)?$/.test(line)) {
+      dropping = true;
+      continue;
+    }
+    if (dropping && /^\s*\[[^\]]+\]/.test(line)) dropping = false;
+    if (!dropping && line.trim() !== end) kept.push(line);
+  }
+
+  const after = kept.join('\n').replace(/^\s+$/, '');
+  if (after === before) return false;
+  writeFileSync(`${path}.ours-backup-${stamp}`, before, { mode: 0o600 });
+  writeFileSync(path, after);
+  return true;
+}
+
+const configPath = join(codexDir, 'config.toml');
+if (!stripManaged(configPath, '# >>> ours.network plugin', '# <<< ours.network plugin')) stripOrphanedMcpConfig(configPath);
+stripManaged(join(codexDir, 'AGENTS.md'), '<!-- >>> ours.network plugin', '<!-- <<< ours.network plugin -->');
+
+for (const name of ['ours', 'writing-agent-bios']) {
+  const path = join(skillsDir, name);
+  if (!existsSync(path)) continue;
+  const backup = `${path}.ours-legacy-${stamp}`;
+  try { renameSync(path, backup); } catch { rmSync(path, { recursive: true, force: true }); }
+}

package/bin/monitor-mcp.mjs

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runMonitorMcp } from '../src/monitor-mcp.mjs';
+runMonitorMcp().catch((error) => { process.stderr.write(`ours monitor MCP: ${error.message}\n`); process.exitCode = 1; });
+

package/bin/ours-codex-install.mjs

@@ -5,16 +5,9 @@
 //     npm i -g @ours.network/codex
 //     ours-codex-install
 //
-// It resolves this package's own install.sh (which ensures the ours daemon, registers
-// the `ours` MCP server in ~/.codex/config.toml, installs the skills into
-// ~/.agents/skills, and points ~/.codex/AGENTS.md at the ours skill) and runs it — no
-// env-var gymnastics. The MCP server + skill install immediately; they are live for the
-// next Codex session.
-//
-// Wake-on-mail is NOT set up here: the agent tails `ours-mcp watch <identity>` (or a short
-// get_messages poll) IN-SESSION (see the ours skill), the same stream Claude Code's Monitor
-// tails. Codex is a session/invocation CLI, so it reacts while it is live. Everything is
-// idempotent, so re-running is safe.
+// It resolves this package's install.sh, ensures the existing daemon installation,
+// registers the native Codex marketplace/plugin, and migrates installer-owned legacy
+// config only after Codex confirms the native plugin is installed.
 //
 // Usage:
 //   ours-codex-install [--codex-dir DIR] [--skills-dir DIR] [--skip-daemon]
@@ -42,9 +35,8 @@ function help() {
 
   ours-codex-install [options]
 
-Sets up the daemon + the ours MCP server + the skill + the AGENTS.md pointer. It asks nothing
-about identities or wake-on-mail: you enable wake in-session (bind an identity, then the ours
-skill tails ours-mcp watch / polls get_messages so you react to new mail while you work).
+Sets up the daemon and native ours Codex plugin. Standard mode uses \`codex\`; live mode uses
+\`ours-codex\`. Live monitoring still requires explicit consent after an identity is bound.
 
 Options:
       --codex-dir <dir>     Codex config+AGENTS.md root (default ~/.codex)
@@ -52,7 +44,8 @@ Options:
       --skip-daemon         do not install/start the ours daemon
   -h, --help                show this help
 
-Idempotent: safe to re-run. MCP server + skill are live for the next Codex session.`);
+Idempotent: safe to re-run. Start a new Codex thread after installation and review the
+plugin's exact hook definitions before trusting them.`);
 }
 
 if (!existsSync(INSTALL)) {

package/bin/ours-codex.mjs

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import { runLauncher } from '../src/launcher.mjs';
+
+try {
+  process.exitCode = await runLauncher();
+} catch (error) {
+  process.stderr.write(`ours-codex: ${error.message}\n`);
+  process.exitCode = 1;
+}

package/bin/proxy.mjs

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const spec = '@ours.network/mcp/dist/cli.js';
+const here = dirname(fileURLToPath(import.meta.url));
+let cliPath;
+try { cliPath = require.resolve(spec); } catch { /* try plugin cache layouts */ }
+if (!cliPath) {
+  let dir = here;
+  for (let i = 0; i < 12 && !cliPath; i += 1) {
+    for (const base of [dir, join(dir, 'npm-cache')]) {
+      if (!existsSync(join(base, 'node_modules'))) continue;
+      try { cliPath = require.resolve(spec, { paths: [base] }); } catch { /* next */ }
+    }
+    const parent = dirname(dir); if (parent === dir) break; dir = parent;
+  }
+}
+const env = { ...process.env };
+if (env.OURS_CODEX_LIVE === '1') env.OURS_AUTOSTART = '0';
+if (process.ppid > 1) env.OURS_CLIENT_PID = String(process.ppid);
+const child = cliPath
+  ? spawn(process.execPath, [cliPath, 'proxy', ...process.argv.slice(2)], { stdio: 'inherit', env })
+  : spawn('ours-mcp', ['proxy', ...process.argv.slice(2)], { stdio: 'inherit', env });
+child.on('error', (error) => { process.stderr.write(`ours: cannot launch @ours.network/mcp proxy: ${error.message}\n`); process.exit(1); });
+child.on('exit', (code, signal) => { if (signal) process.kill(process.pid, signal); else process.exit(code ?? 0); });
+

package/hooks/hooks.json

@@ -0,0 +1,40 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "startup|resume|clear|compact",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${PLUGIN_ROOT}/src/hooks/runner.mjs\"",
+            "timeout": 5,
+            "statusMessage": "Checking ours mail metadata"
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${PLUGIN_ROOT}/src/hooks/runner.mjs\"",
+            "timeout": 3
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "choose_identity|create_identity|create_root_identity",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${PLUGIN_ROOT}/src/hooks/runner.mjs\"",
+            "timeout": 3
+          }
+        ]
+      }
+    ]
+  }
+}