@ours.network/codex 1.2.0-nightly.1 → 1.2.0-nightly.11

package/dist/host-hooks.mjs

@@ -0,0 +1,386 @@
+// src/host-hooks.mjs
+import { dirname as dirname3 } from "node:path";
+
+// ../core/src/application-identities.ts
+import { randomUUID } from "node:crypto";
+import { chmod, mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, resolve } from "node:path";
+var APPLICATION_IDENTITIES_VERSION = 1;
+var APPLICATION_IDENTITIES_ENV = "OURS_MCP_CONFIG";
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var emptyConfig = () => ({ version: 1, daemons: {}, instances: {} });
+function applicationIdentityConfigPath(env = process.env) {
+  const explicit = (env[APPLICATION_IDENTITIES_ENV] ?? "").trim();
+  return resolve(explicit || resolve(homedir(), ".ours-mcp", "config.json"));
+}
+function parseRows(raw, path, namespace, normalizeKey) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error(`Invalid ours-mcp application identity config at ${path}: "${namespace}s" must be an object.`);
+  }
+  const rows = {};
+  for (const [key, value] of Object.entries(raw)) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      throw new Error(`Invalid ours-mcp application identity config at ${path}: ${namespace} ${JSON.stringify(key)} must be an object.`);
+    }
+    const row = value;
+    if (!Array.isArray(row.identities) || row.identities.some((name) => typeof name !== "string" || name.length === 0)) {
+      throw new Error(`Invalid ours-mcp application identity config at ${path}: ${namespace} ${JSON.stringify(key)} has an invalid identity list.`);
+    }
+    rows[normalizeKey(key)] = { identities: [...new Set(row.identities)].sort() };
+  }
+  return rows;
+}
+function parseConfig(text, path) {
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch (error) {
+    throw new Error(`Invalid ours-mcp application identity config at ${path}: ${String(error)}`);
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`Invalid ours-mcp application identity config at ${path}: expected an object.`);
+  const record = value;
+  if (record.version !== APPLICATION_IDENTITIES_VERSION) {
+    throw new Error(`Unsupported ours-mcp application identity config version at ${path}: expected ${APPLICATION_IDENTITIES_VERSION}, found ${String(record.version)}.`);
+  }
+  const daemons = parseRows(record.daemons, path, "daemon", resolve);
+  const instances = record.instances === void 0 ? {} : parseRows(record.instances, path, "instance", (instanceId) => {
+    if (!UUID.test(instanceId)) throw new Error(`Invalid ours-mcp application identity config at ${path}: instance ${JSON.stringify(instanceId)} must be a lowercase UUID.`);
+    return instanceId;
+  });
+  return { version: 1, daemons, instances };
+}
+async function readConfig(path) {
+  try {
+    return parseConfig(await readFile(path, "utf8"), path);
+  } catch (error) {
+    if (error.code === "ENOENT") return emptyConfig();
+    throw error;
+  }
+}
+async function writeConfigAtomic(path, config) {
+  const parent = dirname(path);
+  await mkdir(parent, { recursive: true, mode: 448 });
+  const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(temporary, `${JSON.stringify(config, null, 2)}
+`, { mode: 384, flag: "wx" });
+    await rename(temporary, path);
+    await chmod(path, 384);
+  } catch (error) {
+    try {
+      await unlink(temporary);
+    } catch {
+    }
+    throw error;
+  }
+}
+var ApplicationIdentityStore = class {
+  stateDir;
+  instanceId;
+  path;
+  constructor(target, options = {}) {
+    if (typeof target === "string") {
+      this.stateDir = resolve(target);
+      this.instanceId = null;
+    } else {
+      if (!target || !UUID.test(target.instanceId)) throw new Error("Application identity instanceId must be a lowercase UUID.");
+      this.stateDir = null;
+      this.instanceId = target.instanceId;
+    }
+    this.path = resolve(options.path ?? applicationIdentityConfigPath(options.env));
+  }
+  rows(config) {
+    return this.instanceId === null ? config.daemons : config.instances;
+  }
+  key() {
+    return this.instanceId ?? this.stateDir;
+  }
+  async list() {
+    const config = await readConfig(this.path);
+    return [...this.rows(config)[this.key()]?.identities ?? []];
+  }
+  async has(name) {
+    return (await this.list()).includes(name);
+  }
+  async add(name) {
+    if (!name) throw new Error("Cannot add an empty identity name to ours-mcp.");
+    const config = await readConfig(this.path);
+    const rows = this.rows(config);
+    const key = this.key();
+    const identities = rows[key]?.identities ?? [];
+    if (identities.includes(name)) return;
+    rows[key] = { identities: [...identities, name].sort() };
+    await writeConfigAtomic(this.path, config);
+  }
+  async remove(name) {
+    const config = await readConfig(this.path);
+    const rows = this.rows(config);
+    const key = this.key();
+    const current = rows[key];
+    if (!current?.identities.includes(name)) return;
+    const identities = current.identities.filter((candidate) => candidate !== name);
+    if (identities.length === 0) delete rows[key];
+    else rows[key] = { identities };
+    await writeConfigAtomic(this.path, config);
+  }
+};
+
+// ../core/src/host-profile.ts
+import { readGatewayClientProfile, validateGatewayClientProfile } from "@ours.network/sdk/client";
+var validateHostProfile = validateGatewayClientProfile;
+
+// ../core/src/native-session.ts
+import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
+import { chmod as chmod2, mkdir as mkdir2, readFile as readFile2, rename as rename2, unlink as unlink2, writeFile as writeFile2 } from "node:fs/promises";
+import { dirname as dirname2, join as join2, resolve as resolve2 } from "node:path";
+import { attachOursClient } from "@ours.network/sdk";
+
+// ../core/src/session-guard.ts
+import { createHash } from "node:crypto";
+import { openSync, closeSync, lstatSync, mkdirSync, chmodSync, constants } from "node:fs";
+import { join } from "node:path";
+import { createRequire } from "node:module";
+var BUSY_TIMEOUT_MS = 5e3;
+var DatabaseSync = null;
+var resolveAttempted = false;
+function resolveDatabase() {
+  if (DatabaseSync) return DatabaseSync;
+  if (resolveAttempted) throw new Error("No SQLite implementation available for native session guard");
+  resolveAttempted = true;
+  try {
+    const mod = createRequire(import.meta.url)("node:sqlite");
+    DatabaseSync = mod.DatabaseSync;
+    return DatabaseSync;
+  } catch {
+    try {
+      const mod = createRequire(import.meta.url)("better-sqlite3");
+      DatabaseSync = mod.default ?? mod;
+      return DatabaseSync;
+    } catch {
+      throw new Error("Native session guard requires node:sqlite (Node >=22.13) or better-sqlite3");
+    }
+  }
+}
+function ensureGuardFile(guardPath) {
+  try {
+    const fd = openSync(guardPath, constants.O_RDWR | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
+    closeSync(fd);
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+  }
+  const stat = lstatSync(guardPath);
+  if (!stat.isFile() || stat.uid !== process.getuid() || (stat.mode & 63) !== 0 || stat.nlink !== 1) {
+    throw new Error("Native session guard file must be an owner-only regular file");
+  }
+}
+function acquireSessionGuard(recordPath) {
+  const uid = process.getuid();
+  const base = join(`/tmp/ours-${uid}`, "session-guards");
+  mkdirSync(base, { recursive: true, mode: 448 });
+  try {
+    chmodSync(base, 448);
+  } catch {
+  }
+  const hash = createHash("sha256").update(recordPath).digest("hex");
+  const guardPath = join(base, `${hash}.guard`);
+  ensureGuardFile(guardPath);
+  const before = lstatSync(guardPath);
+  const Database = resolveDatabase();
+  const db = new Database(guardPath);
+  try {
+    const after = lstatSync(guardPath);
+    if (before.dev !== after.dev || before.ino !== after.ino || before.mode !== after.mode || before.uid !== after.uid) {
+      throw new Error("Native session guard file changed during acquisition");
+    }
+    db.exec(`PRAGMA busy_timeout=${BUSY_TIMEOUT_MS}; BEGIN EXCLUSIVE`);
+    return () => {
+      try {
+        db.close();
+      } catch {
+      }
+    };
+  } catch (error) {
+    try {
+      db.close();
+    } catch {
+    }
+    throw error;
+  }
+}
+
+// ../core/src/native-session.ts
+var RECORD_VERSION = 1;
+var UUID2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var clients = /* @__PURE__ */ new Map();
+var operations = /* @__PURE__ */ new Map();
+function selector(value) {
+  if (typeof value !== "string" || value.length === 0 || value.length > 4096 || value.trim() !== value || value.includes("\0")) {
+    throw new Error("Native session metadata is missing or invalid for this host-profile tool call.");
+  }
+  return value;
+}
+function nativeSessionRecordPath(hostRecordRoot, instanceId, nativeSessionId) {
+  if (!hostRecordRoot || !hostRecordRoot.startsWith("/") || resolve2(hostRecordRoot) !== hostRecordRoot) {
+    throw new Error("Native session host record root must be a normalized absolute path.");
+  }
+  if (!UUID2.test(instanceId)) throw new Error("Native session daemon instance must be a lowercase UUID.");
+  const hash = createHash2("sha256").update(selector(nativeSessionId), "utf8").digest("hex");
+  return join2(hostRecordRoot, "sessions", instanceId, `${hash}.json`);
+}
+function parseRecord(text, path) {
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch (error) {
+    throw new Error(`Invalid native session record at ${path}: ${String(error)}`);
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`Invalid native session record at ${path}: expected an object.`);
+  }
+  const record = value;
+  const keys = Object.keys(record).sort();
+  if (keys.join(",") !== "ownerInstanceId,state,version" || record.version !== RECORD_VERSION || typeof record.ownerInstanceId !== "string" || !UUID2.test(record.ownerInstanceId) || !["active", "pending", "ended"].includes(String(record.state))) {
+    throw new Error(`Invalid native session record at ${path}.`);
+  }
+  return record;
+}
+async function readRecord(path) {
+  try {
+    return parseRecord(await readFile2(path, "utf8"), path);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+async function writeRecord(path, record) {
+  const parent = dirname2(path);
+  await mkdir2(parent, { recursive: true, mode: 448 });
+  await chmod2(parent, 448);
+  const temporary = `${path}.${process.pid}.${randomUUID2()}.tmp`;
+  try {
+    await writeFile2(temporary, `${JSON.stringify(record, null, 2)}
+`, { mode: 384, flag: "wx" });
+    await rename2(temporary, path);
+    await chmod2(path, 384);
+  } catch (error) {
+    try {
+      await unlink2(temporary);
+    } catch {
+    }
+    throw error;
+  }
+}
+async function serialized(key, operation) {
+  const predecessor = operations.get(key) ?? Promise.resolve();
+  let release;
+  const gate = new Promise((resolve3) => {
+    release = resolve3;
+  });
+  const tail = predecessor.catch(() => {
+  }).then(() => gate);
+  operations.set(key, tail);
+  await predecessor.catch(() => {
+  });
+  let releaseGuard;
+  try {
+    releaseGuard = acquireSessionGuard(key);
+    return await operation();
+  } finally {
+    try {
+      releaseGuard?.();
+    } finally {
+      release();
+      if (operations.get(key) === tail) operations.delete(key);
+    }
+  }
+}
+function attach(profile, ownerInstanceId) {
+  return attachOursClient({
+    endpoint: profile.endpoint,
+    expectedInstanceId: profile.expectedInstanceId,
+    credentialPath: profile.credentialPath,
+    sessionMode: "external",
+    leaseToken: ownerInstanceId,
+    env: {}
+  });
+}
+function cachedClient(path, profile, ownerInstanceId) {
+  const cached = clients.get(path);
+  if (cached?.ownerInstanceId === ownerInstanceId) return cached.promise;
+  if (cached) {
+    clients.delete(path);
+    void cached.promise.then((client) => client.close()).catch(() => {
+    });
+  }
+  const promise = attach(profile, ownerInstanceId);
+  const next = { ownerInstanceId, promise };
+  clients.set(path, next);
+  void promise.catch(() => {
+    if (clients.get(path) === next) clients.delete(path);
+  });
+  return promise;
+}
+async function releaseOwner(path, profile, ownerInstanceId) {
+  const cached = clients.get(path);
+  const client = cached?.ownerInstanceId === ownerInstanceId ? await cached.promise : await attach(profile, ownerInstanceId);
+  try {
+    await client.releaseLease();
+  } finally {
+    if (cached?.ownerInstanceId !== ownerInstanceId) await client.close();
+  }
+}
+async function finishPending(path, profile, ownerInstanceId) {
+  await releaseOwner(path, profile, ownerInstanceId);
+  const current = await readRecord(path);
+  if (current?.state === "pending" && current.ownerInstanceId === ownerInstanceId) {
+    await writeRecord(path, { version: RECORD_VERSION, ownerInstanceId, state: "ended" });
+  }
+  const cached = clients.get(path);
+  if (cached?.ownerInstanceId === ownerInstanceId) {
+    clients.delete(path);
+    void cached.promise.then((client) => client.close()).catch(() => {
+    });
+  }
+}
+async function nativeClientForAtRoot(profileValue, nativeSessionId, hostRecordRoot) {
+  const profile = validateHostProfile(profileValue);
+  const path = nativeSessionRecordPath(hostRecordRoot, profile.expectedInstanceId, nativeSessionId);
+  return serialized(path, async () => {
+    let record = await readRecord(path);
+    if (record?.state === "pending") {
+      await finishPending(path, profile, record.ownerInstanceId);
+      record = await readRecord(path);
+    }
+    if (record?.state === "active") return cachedClient(path, profile, record.ownerInstanceId);
+    const ownerInstanceId = randomUUID2();
+    await writeRecord(path, { version: RECORD_VERSION, ownerInstanceId, state: "active" });
+    return cachedClient(path, profile, ownerInstanceId);
+  });
+}
+
+// src/host-hooks.mjs
+async function readHostHookState({ profile, nativeSessionId, applicationPath, clientFor = nativeClientForAtRoot }) {
+  const store = new ApplicationIdentityStore({ instanceId: profile.expectedInstanceId }, { path: applicationPath });
+  const identities = await store.list();
+  const visible = new Set(identities);
+  const client = await clientFor(profile, nativeSessionId, dirname3(applicationPath));
+  try {
+    const [unread, rows] = await Promise.all([client.unread(), client.listIdentities()]);
+    const entries = (Array.isArray(unread?.identities) ? unread.identities : []).flatMap((entry) => {
+      if (!entry || !visible.has(entry.name)) return [];
+      const count = Number.isSafeInteger(entry.count) ? entry.count : 0;
+      const files = Number.isSafeInteger(entry.files) ? entry.files : 0;
+      if (count <= 0 && files <= 0) return [];
+      const recent = (Array.isArray(entry.recent) ? entry.recent.slice(-5) : []).flatMap((message) => message && typeof message.from === "string" ? [{ from: message.from, msg_id: String(message.msg_id ?? "?"), date: typeof message.date === "string" ? message.date : "" }] : []);
+      return [{ name: entry.name, count, files, recent }];
+    });
+    const bindings = (Array.isArray(rows) ? rows : []).flatMap((row) => row && visible.has(row.name) && ["mine", "other-live"].includes(row.session) ? [row.name] : []);
+    return { identities, unread: { identities: entries }, bindings };
+  } finally {
+    await client.close();
+  }
+}
+export {
+  readHostHookState
+};

package/dist/monitor-mcp.mjs

@@ -2979,7 +2979,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve2.call(this, root, ref);
+      let _sch = resolve.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a = root.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
@@ -3006,7 +3006,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve2(root, ref) {
+    function resolve(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -3831,7 +3831,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve2(baseURI, relativeURI, options) {
+    function resolve(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const {
         parsed: baseParsed,
@@ -4193,7 +4193,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve2,
+      resolve,
       resolveComponent,
       equal,
       serialize,
@@ -19274,7 +19274,7 @@ var Protocol = class {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-        await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
+        await new Promise((resolve) => setTimeout(resolve, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error2) {
@@ -19291,7 +19291,7 @@ var Protocol = class {
    */
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve, reject) => {
       const earlyReject = (error2) => {
         reject(error2);
       };
@@ -19369,7 +19369,7 @@ var Protocol = class {
           if (!parseResult.success) {
             reject(parseResult.error);
           } else {
-            resolve2(parseResult.data);
+            resolve(parseResult.data);
           }
         } catch (error2) {
           reject(error2);
@@ -19630,12 +19630,12 @@ var Protocol = class {
       }
     } catch {
     }
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve, reject) => {
       if (signal.aborted) {
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve2, interval);
+      const timeoutId = setTimeout(resolve, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -20735,7 +20735,7 @@ var McpServer = class {
     let task = createTaskResult.task;
     const pollInterval = task.pollInterval ?? 5e3;
     while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-      await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
+      await new Promise((resolve) => setTimeout(resolve, pollInterval));
       const updatedTask = await extra.taskStore.getTask(taskId);
       if (!updatedTask) {
         throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -21384,12 +21384,12 @@ var StdioServerTransport = class {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve2) => {
+    return new Promise((resolve) => {
       const json = serializeMessage(message);
       if (this._stdout.write(json)) {
-        resolve2();
+        resolve();
       } else {
-        this._stdout.once("drain", resolve2);
+        this._stdout.once("drain", resolve);
       }
     });
   }
@@ -21401,120 +21401,15 @@ import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
 
 // ../core/src/host-profile.ts
-import { existsSync, lstatSync, readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { resolve } from "node:path";
-var PROFILE_KEYS = ["endpoint", "expectedInstanceId", "credentialPath"];
-var LEGACY_SELECTION_KEYS = ["port", "stateDir", "apiToken", "apiVisibility"];
-var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-var CONFLICTING_ENV = ["OURS_API_TOKEN", "OURS_PORT", "OURS_STATE_DIR", "OURS_DAEMON_ID"];
-function profileError(reason) {
-  return new Error(`Invalid external host profile: ${reason}`);
-}
-function validateHostProfile(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw profileError("expected a complete host profile object.");
-  }
-  const record2 = value;
-  const present = PROFILE_KEYS.filter((key) => Object.hasOwn(record2, key));
-  if (present.length !== PROFILE_KEYS.length) {
-    throw profileError("expected a complete host profile tuple: endpoint, expectedInstanceId, credentialPath.");
-  }
-  const mixed = LEGACY_SELECTION_KEYS.filter((key) => Object.hasOwn(record2, key));
-  if (mixed.length) throw profileError(`legacy selection keys cannot be mixed with a host profile (${mixed.join(", ")}).`);
-  const endpoint = record2.endpoint;
-  const expectedInstanceId = record2.expectedInstanceId;
-  const credentialPath = record2.credentialPath;
-  if (typeof endpoint !== "string" || endpoint.trim() !== endpoint || endpoint === "") {
-    throw profileError("endpoint must be a non-empty HTTP origin.");
-  }
-  if (typeof expectedInstanceId !== "string" || !UUID.test(expectedInstanceId)) {
-    throw profileError("expectedInstanceId must be a lowercase UUID.");
-  }
-  if (typeof credentialPath !== "string" || credentialPath === "" || !credentialPath.startsWith("/") || resolve(credentialPath) !== credentialPath) {
-    throw profileError("credentialPath must be a normalized absolute path.");
-  }
-  let url;
-  try {
-    url = new URL(endpoint);
-  } catch {
-    throw profileError("endpoint must be an HTTP origin.");
-  }
-  if (url.protocol !== "http:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
-    throw profileError("endpoint must be an HTTP origin without credentials, path, query, or fragment.");
-  }
-  return { endpoint: url.origin, expectedInstanceId, credentialPath };
-}
-function readProfileObject(configPath) {
-  let text;
-  try {
-    text = readFileSync(configPath, "utf8");
-  } catch {
-    throw new Error(`Cannot read host profile ${JSON.stringify(configPath)}.`);
-  }
-  let value;
-  try {
-    value = JSON.parse(text);
-  } catch {
-    throw profileError(`config ${JSON.stringify(configPath)} is not valid JSON.`);
-  }
-  if (!value || typeof value !== "object" || Array.isArray(value)) throw profileError(`config ${JSON.stringify(configPath)} must be an object.`);
-  return value;
-}
-function assertPrivateRegularFile(configPath) {
-  let stat;
-  try {
-    stat = lstatSync(configPath);
-  } catch {
-    throw new Error(`Cannot read host profile ${JSON.stringify(configPath)}.`);
-  }
-  if (!stat.isFile()) throw profileError(`config ${JSON.stringify(configPath)} must be a regular file.`);
-  const currentUid = process.getuid?.();
-  if (currentUid === void 0 || stat.uid !== currentUid) throw profileError(`config ${JSON.stringify(configPath)} must be owned by the current user.`);
-  if ((stat.mode & 63) !== 0) throw profileError(`config ${JSON.stringify(configPath)} must have private permissions.`);
-}
-function readHostProfile(configPath) {
-  const record2 = readProfileObject(configPath);
-  const found = PROFILE_KEYS.filter((key) => Object.hasOwn(record2, key));
-  if (found.length === 0) return null;
-  assertPrivateRegularFile(configPath);
-  return validateHostProfile(record2);
-}
-function nonempty(env, key) {
-  return (env[key] ?? "").trim() !== "";
-}
+import { readGatewayClientProfile, validateGatewayClientProfile } from "@ours.network/sdk/client";
 function hostProfileSelectionFromEnv(env = process.env) {
-  const explicit = (env.OURS_CONFIG ?? "").trim();
-  const managedPath = resolve(env.HOME || homedir(), ".ours-client", "profile.json");
-  let configPath = explicit;
-  if (!configPath) {
-    try {
-      lstatSync(managedPath);
-      configPath = managedPath;
-    } catch (error2) {
-      if (error2.code !== "ENOENT") {
-        throw new Error(`Cannot read host profile ${JSON.stringify(managedPath)}.`);
-      }
-      configPath = resolve(homedir(), ".ours", "config.json");
-      if (!existsSync(configPath)) return null;
-    }
-  }
-  const profile = readHostProfile(configPath);
-  if (profile === null) {
-    if (resolve(configPath) === managedPath) throw profileError("managed client config must contain a complete host profile tuple.");
-    return null;
-  }
-  const conflicting = CONFLICTING_ENV.filter((key) => nonempty(env, key));
-  if (conflicting.length) throw profileError(`${conflicting.join(", ")} conflicts with host-profile mode.`);
+  const { configPath, ...profile } = readGatewayClientProfile(env);
   return { profile, configPath };
 }
 function hostProfileFromEnv(env = process.env) {
-  return hostProfileSelectionFromEnv(env)?.profile ?? null;
+  return hostProfileSelectionFromEnv(env).profile;
 }
 
-// ../core/src/host-client/files.ts
-import { buildIdentityFile, writeIdentityFile } from "@ours.network/sdk/connector";
-
 // ../core/src/native-session.ts
 import { attachOursClient } from "@ours.network/sdk";
 
@@ -21530,7 +21425,7 @@ function encodeControlResponse(value) {
 
 // src/control-server.mjs
 function sendControlCommand(socketPath, capability, message, timeoutMs = 2e3) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve, reject) => {
     const socket = createConnection(socketPath);
     let buffer = "";
     const timer = setTimeout(() => {
@@ -21551,7 +21446,7 @@ function sendControlCommand(socketPath, capability, message, timeoutMs = 2e3) {
       try {
         const response = JSON.parse(buffer);
         if (!response.ok) reject(new Error(response.error || "monitor control failed"));
-        else resolve2(response);
+        else resolve(response);
       } catch (error2) {
         reject(error2);
       }
@@ -21604,7 +21499,7 @@ function waitForForegroundMail(identity, nativeSessionId, {
   commandFor = foregroundWatchProcess
 } = {}) {
   if (typeof identity !== "string" || !identity.trim()) return Promise.reject(new Error("identity is required"));
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve, reject) => {
     const invocation = commandFor(identity, nativeSessionId, env);
     const child = spawnImpl(invocation.command, invocation.args, {
       env: invocation.env ?? env,
@@ -21636,7 +21531,7 @@ function waitForForegroundMail(identity, nativeSessionId, {
       const newline = stdout.indexOf("\n");
       if (newline === -1) return;
       const event = stdout.slice(0, newline).trim();
-      if (event) finish(resolve2, event);
+      if (event) finish(resolve, event);
     });
     child.once("exit", (code, childSignal) => {
       if (settled) return;