@ours.network/codex 1.1.1 → 1.2.0-nightly.2

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ours",
-  "version": "1.1.1",
+  "version": "1.2.0-nightly.2",
   "description": "Secure agent-to-agent messaging and explicitly armed live mail wake for Codex CLI.",
   "author": {
     "name": "Adapt Toolkit",

package/.mcp.json

@@ -4,14 +4,14 @@
       "command": "node",
       "args": ["bin/proxy.mjs"],
       "cwd": ".",
-      "env_vars": ["OURS_PORT", "OURS_CONFIG", "OURS_API_TOKEN", "OURS_STATE_DIR", "OURS_AUTOSTART", "OURS_CODEX_LIVE", "OURS_CLIENT_PID"]
+      "env_vars": ["OURS_PORT", "OURS_CONFIG", "OURS_MCP_CONFIG", "OURS_API_TOKEN", "OURS_STATE_DIR", "OURS_AUTOSTART", "OURS_CODEX_LIVE", "OURS_CLIENT_PID"]
     },
     "ours_monitor": {
       "command": "node",
       "args": ["bin/monitor-mcp.mjs"],
       "cwd": ".",
       "tool_timeout_sec": 86400,
-      "env_vars": ["OURS_CODEX_CONTROL_SOCKET", "OURS_CODEX_CAPABILITY", "OURS_PORT", "OURS_CONFIG", "OURS_API_TOKEN", "OURS_STATE_DIR"]
+      "env_vars": ["OURS_CODEX_CONTROL_SOCKET", "OURS_CODEX_CAPABILITY", "OURS_PORT", "OURS_CONFIG", "OURS_MCP_CONFIG", "OURS_API_TOKEN", "OURS_STATE_DIR"]
     }
   }
 }

package/README.md

@@ -54,7 +54,11 @@ selected daemon is absent or incompatible, it exits with an error and leaves sta
 ## Selecting a daemon
 
 Multiple daemons may run on one host when each uses a distinct port and state directory.
-Selection precedence is:
+For network clients, explicit `OURS_CONFIG` takes precedence over the managed
+`~/.ours-client/profile.json`. When the managed file exists, ordinary `ours-codex`
+launches need no environment override. Invalid or unreadable managed profiles
+fail before selecting another daemon. With neither selection, the existing
+local-daemon precedence remains:
 
 1. `ours-codex --ours-port <port>`
 2. `OURS_PORT`
@@ -62,12 +66,28 @@ Selection precedence is:
 4. `~/.ours/config.json`
 5. port `3050`
 
-All MCP, hooks, unread, and watcher calls inherit the same selected profile. Example:
+All MCP, hooks, unread, and watcher calls inherit the same selected profile. Host-profile
+traffic goes directly to the selected daemon's authenticated `/mcp` endpoint through the
+Codex package; it does not require Docker or an installed `@ours.network/mcp` package.
+Example:
 
 ```sh
 OURS_CONFIG="$HOME/.ours/testing.json" ours-codex --ours-port 4050
 ```
 
+An operator-provisioned host profile uses the complete
+`endpoint`/`expectedInstanceId`/`credentialPath` tuple in the selected file. In this mode,
+do not combine the profile with `--ours-port`, `OURS_PORT`, `OURS_API_TOKEN`, or
+`OURS_STATE_DIR`. Codex forwards the actual selected path as `OURS_CONFIG` and the optional `OURS_MCP_CONFIG` host
+record location; the SDK verifies the expected
+daemon instance and rereads `credentialPath` for every request, so an operator token
+update takes effect in the running hook and live monitor without a restart or token
+snapshot in child process environments.
+
+Native ownership is keyed by Codex's actual thread ID. A normal live TUI exit forwards
+that ID through the same `SessionEnd` input used by the hook. If Codex has not produced
+a logical thread ID, there is no native owner for the launcher to release.
+
 ## Hooks and consent
 
 The native plugin bundles `hooks/hooks.json` using Codex's default hook discovery.
@@ -77,9 +97,17 @@ lifecycle directly, while the hooks add standard-mode context and defensive stat
 - `SessionStart` surfaces body-free unread metadata and an advisory `.ours-identity` pin.
 - `UserPromptSubmit` can re-surface unresolved unread/pin context.
 - `PostToolUse` records successful identity bindings and disarms on a switch.
-- `SessionEnd` releases the session lease and waits for all session-owned temporary
-  roles to send best-effort removal notices and delete local state. Live mode also
-  invokes this cleanup directly when its TUI exits, so it does not depend on hook trust.
+- `SessionEnd`, when delivered, reads the native `session_id`, durably captures the
+  exact owner, releases its lease, and waits for all owner-scoped temporary roles to
+  send best-effort removal notices and delete local state. Live mode also invokes
+  this cleanup directly when its TUI exits.
+
+The ours MCP owner is allocated lazily from Codex's tool-call thread metadata, so
+`SessionStart` is not required for ownership and may be disabled. Stdio/MCP recycle
+does not end that owner; a later call in the same unended thread recovers it. If
+`SessionEnd` is disabled or never delivered, ours does not infer death from EOF,
+PID, or a timeout and does not claim automatic cleanup. The owner and protected
+resources remain available for ordinary resume until a terminal hook is delivered.
 
 Codex requires review and trust of the exact hook definitions before running them.
 Installation does not bypass hook trust, and live monitoring remains available when the

package/bin/container-file-transfer.mjs

@@ -0,0 +1,147 @@
+import { randomUUID } from 'node:crypto';
+import { createReadStream, createWriteStream, mkdirSync } from 'node:fs';
+import { basename, dirname, resolve } from 'node:path';
+import { spawn, spawnSync } from 'node:child_process';
+import { pipeline } from 'node:stream/promises';
+
+function helperInvocation(container, command, args) {
+  const entrypoint = container.args.indexOf('/opt/ours/node_modules/@ours.network/mcp/dist/container.js');
+  return { ...container, args: [...container.args.slice(0, entrypoint + 2), command, ...args] };
+}
+
+function helperJson(container, command, args) {
+  const call = helperInvocation(container, command, args);
+  const child = spawnSync(call.command, call.args, { env: call.env, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 5000, maxBuffer: 1024 * 1024 });
+  if (child.error) throw child.error;
+  if (child.status !== 0) throw new Error(child.stderr.trim() || `${command} exited ${child.status}`);
+  return JSON.parse(child.stdout);
+}
+
+async function runHelper(container, command, args, input, output) {
+  const call = helperInvocation(container, command, args);
+  const child = spawn(call.command, call.args, { env: call.env, stdio: ['pipe', 'pipe', 'pipe'] });
+  let stderr = '';
+  child.stderr.setEncoding('utf8');
+  child.stderr.on('data', (chunk) => { stderr += chunk; });
+  const exited = new Promise((resolveExit, reject) => {
+    child.once('error', reject);
+    child.once('close', (code, signal) => code === 0 ? resolveExit() : reject(new Error(stderr.trim() || `${command} exited ${signal ?? code}`)));
+  });
+  const streams = [];
+  if (input) streams.push(pipeline(input, child.stdin)); else child.stdin.end();
+  if (output) streams.push(pipeline(child.stdout, output)); else child.stdout.resume();
+  const results = await Promise.allSettled([...streams, exited]);
+  const failed = results.find((result) => result.status === 'rejected');
+  if (failed) throw failed.reason;
+}
+
+async function stageFile(container, id, hostPath) {
+  const abs = resolve(hostPath);
+  const call = helperInvocation(container, 'file-stage', [id, basename(abs)]);
+  const child = spawn(call.command, call.args, { env: call.env, stdio: ['pipe', 'pipe', 'pipe'] });
+  let stdout = '', stderr = '';
+  child.stdout.setEncoding('utf8'); child.stdout.on('data', (v) => { stdout += v; });
+  child.stderr.setEncoding('utf8'); child.stderr.on('data', (v) => { stderr += v; });
+  const exited = new Promise((resolveExit, reject) => {
+    child.once('error', reject);
+    child.once('close', (code, signal) => code === 0 ? resolveExit() : reject(new Error(stderr.trim() || `file-stage exited ${signal ?? code}`)));
+  });
+  const results = await Promise.allSettled([pipeline(createReadStream(abs), child.stdin), exited]);
+  const failed = results.find((result) => result.status === 'rejected');
+  if (failed) throw failed.reason;
+  return { path: JSON.parse(stdout).path, abs };
+}
+
+function toolError(id, error) {
+  return { jsonrpc: '2.0', id, result: { content: [{ type: 'text', text: `host file transfer failed: ${error instanceof Error ? error.message : String(error)}` }], isError: true } };
+}
+
+async function removeTransfer(container, id) {
+  try { await runHelper(container, 'file-remove', [id]); } catch { /* preserve the primary result */ }
+}
+
+async function eachLine(stream, visit) {
+  let pending = Buffer.alloc(0);
+  for await (const chunk of stream) {
+    pending = Buffer.concat([pending, chunk]);
+    let newline;
+    while ((newline = pending.indexOf(10)) !== -1) {
+      const line = pending.subarray(0, newline + 1);
+      pending = pending.subarray(newline + 1);
+      await visit(line);
+    }
+  }
+  if (pending.length) await visit(pending);
+}
+
+export function runContainerProxy(container) {
+  const child = spawn(container.command, container.args, { stdio: ['pipe', 'pipe', 'inherit'], env: container.env });
+  const pending = new Map();
+  let stopping = false;
+  const stopInput = () => { stopping = true; process.stdin.destroy(); };
+  child.stdin.on('error', stopInput);
+  let outputWrites = Promise.resolve();
+  const writeOutput = (bytes) => { outputWrites = outputWrites.then(() => new Promise((done) => process.stdout.write(bytes, done))); return outputWrites; };
+
+  const inputDone = eachLine(process.stdin, async (raw) => {
+    let message;
+    try { message = JSON.parse(raw.toString('utf8')); } catch { child.stdin.write(raw); return; }
+    // Forward cancellation unchanged. The upstream handler owns cancellation;
+    // keep transfer tracking until its actual response so a completed save is
+    // copied to the host and its staging directory is removed.
+    if (message?.method === 'notifications/cancelled') { child.stdin.write(raw); return; }
+    if (message?.method !== 'tools/call' || !message.params?.arguments) { child.stdin.write(raw); return; }
+    const name = message.params.name;
+    if (name !== 'send_file' && name !== 'save_file') { child.stdin.write(raw); return; }
+    const args = message.params.arguments;
+    if (name === 'send_file' && !args.path) { child.stdin.write(raw); return; }
+    const id = randomUUID();
+    try {
+      if (name === 'send_file') {
+        const staged = await stageFile(container, id, args.path);
+        message.params.arguments = { ...args, path: staged.path, filename: args.filename ?? basename(staged.abs) };
+        pending.set(message.id, { id, kind: name });
+      } else {
+        const hostPath = resolve(args.dest_path);
+        const target = helperJson(container, 'file-target', [id]);
+        message.params.arguments = { ...args, dest_path: target.path };
+        pending.set(message.id, { id, kind: name, hostPath, containerPath: target.path });
+      }
+      if (!stopping) child.stdin.write(`${JSON.stringify(message)}\n`);
+    } catch (error) {
+      await removeTransfer(container, id);
+      await writeOutput(`${JSON.stringify(toolError(message.id, error))}\n`);
+    }
+  }).catch((error) => {
+    if (!stopping) { process.stderr.write(`ours: container MCP input failed: ${error.message}\n`); process.exitCode = 1; child.kill(); }
+  }).finally(() => { if (!child.stdin.destroyed) child.stdin.end(); });
+
+  const outputDone = eachLine(child.stdout, async (raw) => {
+    let message;
+    try { message = JSON.parse(raw.toString('utf8')); } catch { await writeOutput(raw); return; }
+    const transfer = pending.get(message?.id);
+    if (!transfer) { await writeOutput(raw); return; }
+    pending.delete(message.id);
+    try {
+      if (transfer.kind === 'save_file' && !message.error && message.result?.isError !== true) {
+        mkdirSync(dirname(transfer.hostPath), { recursive: true });
+        await runHelper(container, 'file-read', [transfer.id], null, createWriteStream(transfer.hostPath));
+        for (const item of message.result?.content ?? []) {
+          if (item?.type === 'text' && typeof item.text === 'string') item.text = item.text.split(transfer.containerPath).join(transfer.hostPath);
+        }
+      }
+      await writeOutput(`${JSON.stringify(message)}\n`);
+    } catch (error) {
+      await writeOutput(`${JSON.stringify(toolError(message.id, error))}\n`);
+    } finally { await removeTransfer(container, transfer.id); }
+  });
+
+  child.on('error', (error) => { stopInput(); process.stderr.write(`ours: cannot launch container MCP: ${error.message}\n`); process.exitCode = 1; });
+  child.on('close', async (code, signal) => {
+    stopInput();
+    await Promise.allSettled([inputDone, outputDone, outputWrites]);
+    await Promise.allSettled([...pending.values()].map((v) => removeTransfer(container, v.id)));
+    if (signal) process.kill(process.pid, signal); else process.exitCode = process.exitCode || (code === null || code < 0 ? 1 : code);
+  });
+  return child;
+}

package/bin/container-launch.mjs

@@ -0,0 +1,40 @@
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { isAbsolute, join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+// An explicit container selection is authoritative: failures never fall back
+// to a host MCP or host application-identity configuration.
+export function containerInvocation(command, args = [], env = process.env) {
+  const explicitPath = (env.OURS_CONFIG ?? '').trim();
+  const path = explicitPath || join(homedir(), '.ours', 'config.json');
+  let profile;
+  try { profile = JSON.parse(readFileSync(path, 'utf8')); }
+  catch (error) {
+    if (!explicitPath && error.code === 'ENOENT') return null;
+    throw new Error(`cannot read OURS_CONFIG profile ${path}: ${error.message}`);
+  }
+  if (!profile || !Object.hasOwn(profile, 'composeFile')) return null;
+  if (typeof profile.composeFile !== 'string' || !isAbsolute(profile.composeFile)) throw new Error('composeFile must be an absolute path');
+  if (typeof profile.expectedInstanceId !== 'string' || !profile.expectedInstanceId.trim()) throw new Error('container profile requires expectedInstanceId');
+  if (profile.composeProject !== undefined && (typeof profile.composeProject !== 'string' || !profile.composeProject.trim())) throw new Error('composeProject must be a nonempty string');
+  const dockerArgs = ['compose', '-f', profile.composeFile];
+  if (profile.composeProject !== undefined) dockerArgs.push('-p', profile.composeProject);
+  dockerArgs.push('exec', '-T');
+  for (const name of ['CLAUDE_CODE_SESSION_ID', 'OURS_BIND_IDENTITY']) {
+    if (env[name] !== undefined) dockerArgs.push('-e', `${name}=${env[name]}`);
+  }
+  dockerArgs.push('daemon', 'node', '/opt/ours/node_modules/@ours.network/mcp/dist/container.js', profile.expectedInstanceId, command, ...args);
+  return { command: 'docker', args: dockerArgs, env: { ...env, OURS_DAEMON_ID: profile.expectedInstanceId } };
+}
+
+export function readContainerJson(command, env = process.env) {
+  const invocation = containerInvocation(command, [], env);
+  if (!invocation) return null;
+  const child = spawnSync(invocation.command, invocation.args, { env: invocation.env, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 5000, maxBuffer: 1024 * 1024 });
+  if (child.error) throw child.error;
+  if (child.status !== 0) throw new Error(`ours container ${command} failed: ${child.stderr.trim() || child.status}`);
+  const value = JSON.parse(child.stdout);
+  if (value === null) throw new Error(`ours container ${command} returned null`);
+  return value;
+}

package/bin/network-watch.mjs

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import { runNetworkWatch } from '../dist/network-watch.mjs';
+
+const [identity, nativeSessionId] = process.argv.slice(2);
+runNetworkWatch({ identity, nativeSessionId }).catch((error) => {
+  process.stderr.write(`ours network watch: ${error.message}\n`);
+  process.exitCode = 1;
+});

package/bin/proxy.mjs

@@ -1,33 +1,54 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { spawn } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
+const sessionEnd = process.argv[2] === 'session-end';
+const command = sessionEnd ? 'session-end' : 'proxy';
+const forwarded = process.argv.slice(sessionEnd ? 3 : 2);
 const require = createRequire(import.meta.url);
 const spec = '@ours.network/mcp/dist/cli.js';
 const here = dirname(fileURLToPath(import.meta.url));
-let cliPath;
-try { cliPath = require.resolve(spec); } catch { /* try plugin cache layouts */ }
-if (!cliPath) {
-  let dir = here;
-  for (let i = 0; i < 12 && !cliPath; i += 1) {
-    for (const base of [dir, join(dir, 'npm-cache')]) {
-      if (!existsSync(join(base, 'node_modules'))) continue;
-      try { cliPath = require.resolve(spec, { paths: [base] }); } catch { /* next */ }
+const env = { ...process.env };
+
+async function main() {
+  const network = await import('../dist/network-proxy.mjs');
+  const profile = network.hostProfileFromEnv(env);
+  if (profile) {
+    const configPath = env.OURS_MCP_CONFIG || join(env.HOME || homedir(), '.ours-mcp', 'config.json');
+    const hostRecordRoot = dirname(configPath);
+    if (sessionEnd) {
+      const payload = JSON.parse(readFileSync(0, 'utf8') || '{}');
+      if (typeof payload.session_id !== 'string' || !payload.session_id) throw new Error('SessionEnd requires session_id.');
+      await network.endNetworkNativeSession({ profile, nativeSessionId: payload.session_id, hostRecordRoot });
+      return;
     }
-    const parent = dirname(dir); if (parent === dir) break; dir = parent;
+    await network.runNetworkProxy({ profile, hostRecordRoot, env });
+    return;
   }
+
+  let cliPath;
+  try { cliPath = require.resolve(spec); } catch { /* try plugin cache layouts */ }
+  if (!cliPath) {
+    let dir = here;
+    for (let i = 0; i < 12 && !cliPath; i += 1) {
+      for (const base of [dir, join(dir, 'npm-cache')]) {
+        if (!existsSync(join(base, 'node_modules'))) continue;
+        try { cliPath = require.resolve(spec, { paths: [base] }); } catch { /* next */ }
+      }
+      const parent = dirname(dir); if (parent === dir) break; dir = parent;
+    }
+  }
+  if (env.OURS_CODEX_LIVE === '1') env.OURS_AUTOSTART = '0';
+  if (!env.OURS_CLIENT_PID && process.ppid > 1) env.OURS_CLIENT_PID = String(process.ppid);
+  const child = cliPath
+    ? spawn(process.execPath, [cliPath, command, ...forwarded], { stdio: 'inherit', env })
+    : spawn('ours-mcp', [command, ...forwarded], { stdio: 'inherit', env });
+  child.on('error', (error) => { process.stderr.write(`ours: cannot launch @ours.network/mcp proxy: ${error.message}\n`); process.exitCode = 1; });
+  child.on('exit', (code, signal) => { if (signal) process.kill(process.pid, signal); else process.exitCode = code ?? 0; });
 }
-const env = { ...process.env };
-if (env.OURS_CODEX_LIVE === '1') env.OURS_AUTOSTART = '0';
-if (!env.OURS_CLIENT_PID && process.ppid > 1) env.OURS_CLIENT_PID = String(process.ppid);
-const sessionEnd = process.argv[2] === 'session-end';
-const command = sessionEnd ? 'session-end' : 'proxy';
-const forwarded = process.argv.slice(sessionEnd ? 3 : 2);
-const child = cliPath
-  ? spawn(process.execPath, [cliPath, command, ...forwarded], { stdio: 'inherit', env })
-  : spawn('ours-mcp', [command, ...forwarded], { stdio: 'inherit', env });
-child.on('error', (error) => { process.stderr.write(`ours: cannot launch @ours.network/mcp proxy: ${error.message}\n`); process.exit(1); });
-child.on('exit', (code, signal) => { if (signal) process.kill(process.pid, signal); else process.exit(code ?? 0); });
+
+main().catch((error) => { process.stderr.write(`ours: ${error.message}\n`); process.exitCode = 1; });