@ours.network/codex 1.1.1 → 1.2.0-nightly.10

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ours",
-  "version": "1.1.1",
+  "version": "1.2.0-nightly.10",
   "description": "Secure agent-to-agent messaging and explicitly armed live mail wake for Codex CLI.",
   "author": {
     "name": "Adapt Toolkit",

package/.mcp.json

@@ -4,14 +4,14 @@
       "command": "node",
       "args": ["bin/proxy.mjs"],
       "cwd": ".",
-      "env_vars": ["OURS_PORT", "OURS_CONFIG", "OURS_API_TOKEN", "OURS_STATE_DIR", "OURS_AUTOSTART", "OURS_CODEX_LIVE", "OURS_CLIENT_PID"]
+      "env_vars": ["OURS_PORT", "OURS_CONFIG", "OURS_MCP_CONFIG", "OURS_API_TOKEN", "OURS_STATE_DIR", "OURS_AUTOSTART", "OURS_CODEX_LIVE", "OURS_CLIENT_PID"]
     },
     "ours_monitor": {
       "command": "node",
       "args": ["bin/monitor-mcp.mjs"],
       "cwd": ".",
       "tool_timeout_sec": 86400,
-      "env_vars": ["OURS_CODEX_CONTROL_SOCKET", "OURS_CODEX_CAPABILITY", "OURS_PORT", "OURS_CONFIG", "OURS_API_TOKEN", "OURS_STATE_DIR"]
+      "env_vars": ["OURS_CODEX_CONTROL_SOCKET", "OURS_CODEX_CAPABILITY", "OURS_PORT", "OURS_CONFIG", "OURS_MCP_CONFIG", "OURS_API_TOKEN", "OURS_STATE_DIR"]
     }
   }
 }

package/README.md

@@ -51,23 +51,26 @@ The launcher never starts, stops, restarts, or reconfigures the ours daemon. If
 selected daemon is absent or incompatible, it exits with an error and leaves standard
 `codex` available.
 
-## Selecting a daemon
+## Selecting a gateway
 
-Multiple daemons may run on one host when each uses a distinct port and state directory.
-Selection precedence is:
-
-1. `ours-codex --ours-port <port>`
-2. `OURS_PORT`
-3. the config selected by `OURS_CONFIG`
-4. `~/.ours/config.json`
-5. port `3050`
-
-All MCP, hooks, unread, and watcher calls inherit the same selected profile. Example:
+Every client uses `~/.ours-client/profile.json`; `OURS_CONFIG` can select a complete
+alternate profile. It contains `serverUrl`, `expectedInstanceId`, and `credentialPath`.
+The daemon endpoint is derived as `serverUrl + /daemon`, including gateway path prefixes.
+Missing, unsafe, or invalid profiles fail closed. Remove legacy port/state/token
+selectors; `--ours-port` is rejected. Example after provisioning with `ours-install client`:
 
 ```sh
-OURS_CONFIG="$HOME/.ours/testing.json" ours-codex --ours-port 4050
+OURS_CONFIG="$HOME/.ours-client/testing.json" ours-codex
 ```
 
+MCP, hooks, unread and watcher requests inherit that profile. The SDK verifies the
+instance and rereads the issued credential for each request. Client installation and
+launch never install, start, restart or reconfigure server services.
+
+Native ownership is keyed by Codex's actual thread ID. A normal live TUI exit forwards
+that ID through the same `SessionEnd` input used by the hook. If Codex has not produced
+a logical thread ID, there is no native owner for the launcher to release.
+
 ## Hooks and consent
 
 The native plugin bundles `hooks/hooks.json` using Codex's default hook discovery.
@@ -77,9 +80,17 @@ lifecycle directly, while the hooks add standard-mode context and defensive stat
 - `SessionStart` surfaces body-free unread metadata and an advisory `.ours-identity` pin.
 - `UserPromptSubmit` can re-surface unresolved unread/pin context.
 - `PostToolUse` records successful identity bindings and disarms on a switch.
-- `SessionEnd` releases the session lease and waits for all session-owned temporary
-  roles to send best-effort removal notices and delete local state. Live mode also
-  invokes this cleanup directly when its TUI exits, so it does not depend on hook trust.
+- `SessionEnd`, when delivered, reads the native `session_id`, durably captures the
+  exact owner, releases its lease, and waits for all owner-scoped temporary roles to
+  send best-effort removal notices and delete local state. Live mode also invokes
+  this cleanup directly when its TUI exits.
+
+The ours MCP owner is allocated lazily from Codex's tool-call thread metadata, so
+`SessionStart` is not required for ownership and may be disabled. Stdio/MCP recycle
+does not end that owner; a later call in the same unended thread recovers it. If
+`SessionEnd` is disabled or never delivered, ours does not infer death from EOF,
+PID, or a timeout and does not claim automatic cleanup. The owner and protected
+resources remain available for ordinary resume until a terminal hook is delivered.
 
 Codex requires review and trust of the exact hook definitions before running them.
 Installation does not bypass hook trust, and live monitoring remains available when the

package/bin/codex-config-install.mjs

@@ -33,7 +33,7 @@ export function planTomlInstall(text) {
 }
 
 // Render the managed TOML block: the `ours` MCP server pointing at the globally-installed
-// daemon proxy (`ours-mcp proxy`). Equivalent to `codex mcp add ours -- ours-mcp proxy`.
+// gateway client (`ours-mcp proxy`). Equivalent to `codex mcp add ours -- ours-mcp proxy`.
 export function renderTomlBlock() {
   return `${SENTINEL}
 # Added by @ours.network/codex install.sh. Remove this whole block to uninstall.
@@ -41,9 +41,9 @@ export function renderTomlBlock() {
 [mcp_servers.ours]
 command = "ours-mcp"
 args = ["proxy"]
-# Optional per-server environment overrides go here, e.g.:
+# Optional whole shared gateway profile override:
 # [mcp_servers.ours.env]
-# OURS_PORT = "3050"
+# OURS_CONFIG = "/absolute/private/path/profile.json"
 ${SENTINEL_END}
 `;
 }

package/bin/container-file-transfer.mjs

@@ -0,0 +1,147 @@
+import { randomUUID } from 'node:crypto';
+import { createReadStream, createWriteStream, mkdirSync } from 'node:fs';
+import { basename, dirname, resolve } from 'node:path';
+import { spawn, spawnSync } from 'node:child_process';
+import { pipeline } from 'node:stream/promises';
+
+function helperInvocation(container, command, args) {
+  const entrypoint = container.args.indexOf('/opt/ours/node_modules/@ours.network/mcp/dist/container.js');
+  return { ...container, args: [...container.args.slice(0, entrypoint + 2), command, ...args] };
+}
+
+function helperJson(container, command, args) {
+  const call = helperInvocation(container, command, args);
+  const child = spawnSync(call.command, call.args, { env: call.env, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 5000, maxBuffer: 1024 * 1024 });
+  if (child.error) throw child.error;
+  if (child.status !== 0) throw new Error(child.stderr.trim() || `${command} exited ${child.status}`);
+  return JSON.parse(child.stdout);
+}
+
+async function runHelper(container, command, args, input, output) {
+  const call = helperInvocation(container, command, args);
+  const child = spawn(call.command, call.args, { env: call.env, stdio: ['pipe', 'pipe', 'pipe'] });
+  let stderr = '';
+  child.stderr.setEncoding('utf8');
+  child.stderr.on('data', (chunk) => { stderr += chunk; });
+  const exited = new Promise((resolveExit, reject) => {
+    child.once('error', reject);
+    child.once('close', (code, signal) => code === 0 ? resolveExit() : reject(new Error(stderr.trim() || `${command} exited ${signal ?? code}`)));
+  });
+  const streams = [];
+  if (input) streams.push(pipeline(input, child.stdin)); else child.stdin.end();
+  if (output) streams.push(pipeline(child.stdout, output)); else child.stdout.resume();
+  const results = await Promise.allSettled([...streams, exited]);
+  const failed = results.find((result) => result.status === 'rejected');
+  if (failed) throw failed.reason;
+}
+
+async function stageFile(container, id, hostPath) {
+  const abs = resolve(hostPath);
+  const call = helperInvocation(container, 'file-stage', [id, basename(abs)]);
+  const child = spawn(call.command, call.args, { env: call.env, stdio: ['pipe', 'pipe', 'pipe'] });
+  let stdout = '', stderr = '';
+  child.stdout.setEncoding('utf8'); child.stdout.on('data', (v) => { stdout += v; });
+  child.stderr.setEncoding('utf8'); child.stderr.on('data', (v) => { stderr += v; });
+  const exited = new Promise((resolveExit, reject) => {
+    child.once('error', reject);
+    child.once('close', (code, signal) => code === 0 ? resolveExit() : reject(new Error(stderr.trim() || `file-stage exited ${signal ?? code}`)));
+  });
+  const results = await Promise.allSettled([pipeline(createReadStream(abs), child.stdin), exited]);
+  const failed = results.find((result) => result.status === 'rejected');
+  if (failed) throw failed.reason;
+  return { path: JSON.parse(stdout).path, abs };
+}
+
+function toolError(id, error) {
+  return { jsonrpc: '2.0', id, result: { content: [{ type: 'text', text: `host file transfer failed: ${error instanceof Error ? error.message : String(error)}` }], isError: true } };
+}
+
+async function removeTransfer(container, id) {
+  try { await runHelper(container, 'file-remove', [id]); } catch { /* preserve the primary result */ }
+}
+
+async function eachLine(stream, visit) {
+  let pending = Buffer.alloc(0);
+  for await (const chunk of stream) {
+    pending = Buffer.concat([pending, chunk]);
+    let newline;
+    while ((newline = pending.indexOf(10)) !== -1) {
+      const line = pending.subarray(0, newline + 1);
+      pending = pending.subarray(newline + 1);
+      await visit(line);
+    }
+  }
+  if (pending.length) await visit(pending);
+}
+
+export function runContainerProxy(container) {
+  const child = spawn(container.command, container.args, { stdio: ['pipe', 'pipe', 'inherit'], env: container.env });
+  const pending = new Map();
+  let stopping = false;
+  const stopInput = () => { stopping = true; process.stdin.destroy(); };
+  child.stdin.on('error', stopInput);
+  let outputWrites = Promise.resolve();
+  const writeOutput = (bytes) => { outputWrites = outputWrites.then(() => new Promise((done) => process.stdout.write(bytes, done))); return outputWrites; };
+
+  const inputDone = eachLine(process.stdin, async (raw) => {
+    let message;
+    try { message = JSON.parse(raw.toString('utf8')); } catch { child.stdin.write(raw); return; }
+    // Forward cancellation unchanged. The upstream handler owns cancellation;
+    // keep transfer tracking until its actual response so a completed save is
+    // copied to the host and its staging directory is removed.
+    if (message?.method === 'notifications/cancelled') { child.stdin.write(raw); return; }
+    if (message?.method !== 'tools/call' || !message.params?.arguments) { child.stdin.write(raw); return; }
+    const name = message.params.name;
+    if (name !== 'send_file' && name !== 'save_file') { child.stdin.write(raw); return; }
+    const args = message.params.arguments;
+    if (name === 'send_file' && !args.path) { child.stdin.write(raw); return; }
+    const id = randomUUID();
+    try {
+      if (name === 'send_file') {
+        const staged = await stageFile(container, id, args.path);
+        message.params.arguments = { ...args, path: staged.path, filename: args.filename ?? basename(staged.abs) };
+        pending.set(message.id, { id, kind: name });
+      } else {
+        const hostPath = resolve(args.dest_path);
+        const target = helperJson(container, 'file-target', [id]);
+        message.params.arguments = { ...args, dest_path: target.path };
+        pending.set(message.id, { id, kind: name, hostPath, containerPath: target.path });
+      }
+      if (!stopping) child.stdin.write(`${JSON.stringify(message)}\n`);
+    } catch (error) {
+      await removeTransfer(container, id);
+      await writeOutput(`${JSON.stringify(toolError(message.id, error))}\n`);
+    }
+  }).catch((error) => {
+    if (!stopping) { process.stderr.write(`ours: container MCP input failed: ${error.message}\n`); process.exitCode = 1; child.kill(); }
+  }).finally(() => { if (!child.stdin.destroyed) child.stdin.end(); });
+
+  const outputDone = eachLine(child.stdout, async (raw) => {
+    let message;
+    try { message = JSON.parse(raw.toString('utf8')); } catch { await writeOutput(raw); return; }
+    const transfer = pending.get(message?.id);
+    if (!transfer) { await writeOutput(raw); return; }
+    pending.delete(message.id);
+    try {
+      if (transfer.kind === 'save_file' && !message.error && message.result?.isError !== true) {
+        mkdirSync(dirname(transfer.hostPath), { recursive: true });
+        await runHelper(container, 'file-read', [transfer.id], null, createWriteStream(transfer.hostPath));
+        for (const item of message.result?.content ?? []) {
+          if (item?.type === 'text' && typeof item.text === 'string') item.text = item.text.split(transfer.containerPath).join(transfer.hostPath);
+        }
+      }
+      await writeOutput(`${JSON.stringify(message)}\n`);
+    } catch (error) {
+      await writeOutput(`${JSON.stringify(toolError(message.id, error))}\n`);
+    } finally { await removeTransfer(container, transfer.id); }
+  });
+
+  child.on('error', (error) => { stopInput(); process.stderr.write(`ours: cannot launch container MCP: ${error.message}\n`); process.exitCode = 1; });
+  child.on('close', async (code, signal) => {
+    stopInput();
+    await Promise.allSettled([inputDone, outputDone, outputWrites]);
+    await Promise.allSettled([...pending.values()].map((v) => removeTransfer(container, v.id)));
+    if (signal) process.kill(process.pid, signal); else process.exitCode = process.exitCode || (code === null || code < 0 ? 1 : code);
+  });
+  return child;
+}

package/bin/network-watch.mjs

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import { runNetworkWatch } from '../dist/network-watch.mjs';
+
+const [identity, nativeSessionId] = process.argv.slice(2);
+runNetworkWatch({ identity, nativeSessionId }).catch((error) => {
+  process.stderr.write(`ours network watch: ${error.message}\n`);
+  process.exitCode = 1;
+});

package/bin/ours-codex-install.mjs

@@ -5,14 +5,7 @@
 //     npm i -g @ours.network/codex
 //     ours-codex-install
 //
-// SUPERSEDED BY `ours-install`: the unified `ours-install` is now the single front door for the
-// WHOLE stack (ours core + harness plugins + ours-fleet + Telegram). `ours-codex-install` is kept
-// as a THIN ALIAS — by default it hands off to `ours-install` when that's available, so an old
-// muscle-memory command still lands the user in the current, unified flow. Pass `--codex-only`
-// (or set OURS_CODEX_LEGACY=1) to force the legacy Codex-only install below.
-//
-// Usage:
-//   ours-codex-install [--codex-only] [--codex-dir DIR] [--skills-dir DIR] [--skip-daemon]
+// Installs client plugin wiring only after shared gateway profile validation.
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
@@ -33,38 +26,19 @@ for (let i = 0; i < argv.length; i++) {
   else { console.error(`ours-codex-install: unknown argument "${a}"`); help(); process.exit(2); }
 }
 
-// Thin-alias hand-off: unless the caller forced the legacy Codex-only path, run the unified
-// `ours-install` if we can find it — on PATH (published), or the monorepo sibling (dev/test).
-if (!opts.codexOnly && !process.env.OURS_CODEX_LEGACY) {
-  const onPath = spawnSync('bash', ['-c', 'command -v ours-install'], { encoding: 'utf8' });
-  const unified = (onPath.status === 0 && (onPath.stdout || '').trim())
-    ? { cmd: (onPath.stdout || '').trim(), args: argv }
-    : (() => {
-        const sib = join(PKG, '..', 'installer', 'install.mjs');
-        return existsSync(sib) ? { cmd: process.execPath, args: [sib, ...argv] } : null;
-      })();
-  if (unified) {
-    const r = spawnSync(unified.cmd, unified.args, { stdio: 'inherit', env: process.env });
-    if (r.error) { console.error(`ours-codex-install: ${r.error.message}`); process.exit(1); }
-    process.exit(r.status ?? 0);
-  }
-  // No unified installer found → fall through to the legacy Codex-only install (still never a dead end).
-}
-
 function help() {
   console.log(`ours-codex-install — set up the ours.network plugin for the OpenAI Codex CLI.
 
   ours-codex-install [options]
 
-By default this hands off to the unified \`ours-install\` (the single front door for the whole
-stack). Use --codex-only to run the legacy Codex-only install instead. Standard mode uses
+Requires clients and a shared gateway profile provisioned by \`ours-install client\`. Standard mode uses
 \`codex\`; live mode uses \`ours-codex\`. Live monitoring still requires explicit consent.
 
 Options:
-      --codex-only          run the legacy Codex-only install (skip the unified ours-install)
+      --codex-only          compatibility flag; plugin setup is always client-only
       --codex-dir <dir>     Codex config+AGENTS.md root (default ~/.codex)     [--codex-only]
       --skills-dir <dir>    skills root (default ~/.agents/skills — USER scope) [--codex-only]
-      --skip-daemon         do not install/start the ours daemon               [--codex-only]
+      --skip-daemon         compatibility flag; server lifecycle is never changed               [--codex-only]
   -h, --help                show this help
 
 Idempotent: safe to re-run. Start a new Codex thread after installation and review the
@@ -81,7 +55,6 @@ if (!existsSync(INSTALL)) {
 const env = { ...process.env };
 if (opts.codexDir) env.CODEX_DIR = opts.codexDir;
 if (opts.skillsDir) env.SKILLS_DIR = opts.skillsDir;
-if (opts.skipDaemon) env.OURS_INSTALL_SKIP_DAEMON = '1';
 
 const res = spawnSync('bash', [INSTALL], { stdio: 'inherit', env });
 if (res.error) { console.error(`ours-codex-install: ${res.error.message}`); process.exit(1); }

package/bin/proxy.mjs

@@ -5,29 +5,34 @@ import { existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
+const sessionEnd = process.argv[2] === 'session-end';
+const command = sessionEnd ? 'session-end' : 'proxy';
+const forwarded = process.argv.slice(sessionEnd ? 3 : 2);
 const require = createRequire(import.meta.url);
 const spec = '@ours.network/mcp/dist/cli.js';
 const here = dirname(fileURLToPath(import.meta.url));
-let cliPath;
-try { cliPath = require.resolve(spec); } catch { /* try plugin cache layouts */ }
-if (!cliPath) {
-  let dir = here;
-  for (let i = 0; i < 12 && !cliPath; i += 1) {
-    for (const base of [dir, join(dir, 'npm-cache')]) {
-      if (!existsSync(join(base, 'node_modules'))) continue;
-      try { cliPath = require.resolve(spec, { paths: [base] }); } catch { /* next */ }
+const env = { ...process.env };
+
+async function main() {
+  let cliPath;
+  try { cliPath = require.resolve(spec); } catch { /* try plugin cache layouts */ }
+  if (!cliPath) {
+    let dir = here;
+    for (let i = 0; i < 12 && !cliPath; i += 1) {
+      for (const base of [dir, join(dir, 'npm-cache')]) {
+        if (!existsSync(join(base, 'node_modules'))) continue;
+        try { cliPath = require.resolve(spec, { paths: [base] }); } catch { /* next */ }
+      }
+      const parent = dirname(dir); if (parent === dir) break; dir = parent;
     }
-    const parent = dirname(dir); if (parent === dir) break; dir = parent;
   }
+  if (env.OURS_CODEX_LIVE === '1') env.OURS_AUTOSTART = '0';
+  if (!env.OURS_CLIENT_PID && process.ppid > 1) env.OURS_CLIENT_PID = String(process.ppid);
+  const child = cliPath
+    ? spawn(process.execPath, [cliPath, command, ...forwarded], { stdio: 'inherit', env })
+    : spawn('ours-mcp', [command, ...forwarded], { stdio: 'inherit', env });
+  child.on('error', (error) => { process.stderr.write(`ours: cannot launch @ours.network/mcp proxy: ${error.message}\n`); process.exitCode = 1; });
+  child.on('exit', (code, signal) => { if (signal) process.kill(process.pid, signal); else process.exitCode = code ?? 0; });
 }
-const env = { ...process.env };
-if (env.OURS_CODEX_LIVE === '1') env.OURS_AUTOSTART = '0';
-if (!env.OURS_CLIENT_PID && process.ppid > 1) env.OURS_CLIENT_PID = String(process.ppid);
-const sessionEnd = process.argv[2] === 'session-end';
-const command = sessionEnd ? 'session-end' : 'proxy';
-const forwarded = process.argv.slice(sessionEnd ? 3 : 2);
-const child = cliPath
-  ? spawn(process.execPath, [cliPath, command, ...forwarded], { stdio: 'inherit', env })
-  : spawn('ours-mcp', [command, ...forwarded], { stdio: 'inherit', env });
-child.on('error', (error) => { process.stderr.write(`ours: cannot launch @ours.network/mcp proxy: ${error.message}\n`); process.exit(1); });
-child.on('exit', (code, signal) => { if (signal) process.kill(process.pid, signal); else process.exit(code ?? 0); });
+
+main().catch((error) => { process.stderr.write(`ours: ${error.message}\n`); process.exitCode = 1; });