@ours.network/codex 1.2.0-nightly.6 → 1.2.0-nightly.8

package/dist/profile.mjs

@@ -1,115 +1,11 @@
 // src/profile.mjs
-import { join } from "node:path";
-import { homedir as homedir2 } from "node:os";
 import { randomUUID } from "node:crypto";
-import { assertDaemonStateDir, attachOursClient as attachOursClient2, resolveDaemonConfig } from "@ours.network/sdk";
+import { attachOursClient as attachOursClient2 } from "@ours.network/sdk";
 
 // ../core/src/host-profile.ts
-import { existsSync, lstatSync, readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { resolve } from "node:path";
-var PROFILE_KEYS = ["endpoint", "expectedInstanceId", "credentialPath"];
-var LEGACY_SELECTION_KEYS = ["port", "stateDir", "apiToken", "apiVisibility"];
-var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-var CONFLICTING_ENV = ["OURS_API_TOKEN", "OURS_PORT", "OURS_STATE_DIR", "OURS_DAEMON_ID"];
-function profileError(reason) {
-  return new Error(`Invalid external host profile: ${reason}`);
-}
-function validateHostProfile(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw profileError("expected a complete host profile object.");
-  }
-  const record = value;
-  const present = PROFILE_KEYS.filter((key) => Object.hasOwn(record, key));
-  if (present.length !== PROFILE_KEYS.length) {
-    throw profileError("expected a complete host profile tuple: endpoint, expectedInstanceId, credentialPath.");
-  }
-  const mixed = LEGACY_SELECTION_KEYS.filter((key) => Object.hasOwn(record, key));
-  if (mixed.length) throw profileError(`legacy selection keys cannot be mixed with a host profile (${mixed.join(", ")}).`);
-  const endpoint = record.endpoint;
-  const expectedInstanceId = record.expectedInstanceId;
-  const credentialPath = record.credentialPath;
-  if (typeof endpoint !== "string" || endpoint.trim() !== endpoint || endpoint === "") {
-    throw profileError("endpoint must be a non-empty HTTP or HTTPS origin.");
-  }
-  if (typeof expectedInstanceId !== "string" || !UUID.test(expectedInstanceId)) {
-    throw profileError("expectedInstanceId must be a lowercase UUID.");
-  }
-  if (typeof credentialPath !== "string" || credentialPath === "" || !credentialPath.startsWith("/") || resolve(credentialPath) !== credentialPath) {
-    throw profileError("credentialPath must be a normalized absolute path.");
-  }
-  let url;
-  try {
-    url = new URL(endpoint);
-  } catch {
-    throw profileError("endpoint must be an HTTP or HTTPS origin.");
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
-    throw profileError("endpoint must be an HTTP or HTTPS origin without credentials, path, query, or fragment.");
-  }
-  return { endpoint: url.origin, expectedInstanceId, credentialPath };
-}
-function readProfileObject(configPath) {
-  let text;
-  try {
-    text = readFileSync(configPath, "utf8");
-  } catch {
-    throw new Error(`Cannot read host profile ${JSON.stringify(configPath)}.`);
-  }
-  let value;
-  try {
-    value = JSON.parse(text);
-  } catch {
-    throw profileError(`config ${JSON.stringify(configPath)} is not valid JSON.`);
-  }
-  if (!value || typeof value !== "object" || Array.isArray(value)) throw profileError(`config ${JSON.stringify(configPath)} must be an object.`);
-  return value;
-}
-function assertPrivateRegularFile(configPath) {
-  let stat;
-  try {
-    stat = lstatSync(configPath);
-  } catch {
-    throw new Error(`Cannot read host profile ${JSON.stringify(configPath)}.`);
-  }
-  if (!stat.isFile()) throw profileError(`config ${JSON.stringify(configPath)} must be a regular file.`);
-  const currentUid = process.getuid?.();
-  if (currentUid === void 0 || stat.uid !== currentUid) throw profileError(`config ${JSON.stringify(configPath)} must be owned by the current user.`);
-  if ((stat.mode & 63) !== 0) throw profileError(`config ${JSON.stringify(configPath)} must have private permissions.`);
-}
-function readHostProfile(configPath) {
-  const record = readProfileObject(configPath);
-  const found = PROFILE_KEYS.filter((key) => Object.hasOwn(record, key));
-  if (found.length === 0) return null;
-  assertPrivateRegularFile(configPath);
-  return validateHostProfile(record);
-}
-function nonempty(env, key) {
-  return (env[key] ?? "").trim() !== "";
-}
+import { readGatewayClientProfile, validateGatewayClientProfile } from "@ours.network/sdk/client";
 function hostProfileSelectionFromEnv(env = process.env) {
-  const explicit = (env.OURS_CONFIG ?? "").trim();
-  const managedPath = resolve(env.HOME || homedir(), ".ours-client", "profile.json");
-  let configPath = explicit;
-  if (!configPath) {
-    try {
-      lstatSync(managedPath);
-      configPath = managedPath;
-    } catch (error) {
-      if (error.code !== "ENOENT") {
-        throw new Error(`Cannot read host profile ${JSON.stringify(managedPath)}.`);
-      }
-      configPath = resolve(homedir(), ".ours", "config.json");
-      if (!existsSync(configPath)) return null;
-    }
-  }
-  const profile = readHostProfile(configPath);
-  if (profile === null) {
-    if (resolve(configPath) === managedPath) throw profileError("managed client config must contain a complete host profile tuple.");
-    return null;
-  }
-  const conflicting = CONFLICTING_ENV.filter((key) => nonempty(env, key));
-  if (conflicting.length) throw profileError(`${conflicting.join(", ")} conflicts with host-profile mode.`);
+  const { configPath, ...profile } = readGatewayClientProfile(env);
   return { profile, configPath };
 }
 
@@ -141,53 +37,18 @@ function parseOursArgs(argv = []) {
 async function resolveDaemonProfile({ argv = [], env = process.env, fetch: fetchImpl = globalThis.fetch, attach = attachOursClient2 } = {}) {
   const parsed = parseOursArgs(argv);
   const hostSelection = hostProfileSelectionFromEnv(env);
-  if (hostSelection !== null) {
-    const { profile: hostProfile, configPath } = hostSelection;
-    if (parsed.port != null) throw new Error("ours: --ours-port conflicts with host-profile mode");
-    const client = await attach({ ...hostProfile, sessionMode: "external", leaseToken: randomUUID(), env: {} });
-    let info2;
-    try {
-      info2 = await client.version();
-      await client.identities();
-      await client.unread();
-    } finally {
-      await client.close();
-    }
-    return { profile: hostProfile, info: info2, baseUrl: hostProfile.endpoint, configPath, codexArgs: parsed.codexArgs };
-  }
-  const selection = resolveDaemonConfig({
-    ...parsed.port == null ? {} : { port: parsed.port },
-    env,
-    homeDir: env.HOME || homedir2()
-  });
-  await assertDaemonStateDir(selection, { fetch: fetchImpl, timeoutMs: 2e3 });
-  const baseUrl = selection.baseUrl.value;
-  const token = selection.token?.value ?? null;
-  const headers = token ? { "x-ours-api-token": token } : {};
-  const response = await fetchImpl(`${baseUrl}/info`, { signal: AbortSignal.timeout(2e3) });
-  if (!response.ok) throw new Error(`ours daemon at ${baseUrl} returned HTTP ${response.status}`);
-  const info = await response.json();
-  if (info?.name !== "ours" || !Number.isInteger(info?.protocol) || info.protocol < 1) {
-    throw new Error(`incompatible service at ${baseUrl}; expected an ours daemon with notification protocol 1`);
-  }
-  for (const path of ["/identities", "/unread"]) {
-    const capability = await fetchImpl(`${baseUrl}${path}`, { headers, signal: AbortSignal.timeout(2e3) });
-    if (capability.status === 401 || capability.status === 403) {
-      throw new Error(`ours daemon authentication failed at ${baseUrl}; supply the matching coherent selection`);
-    }
-    if (!capability.ok) throw new Error(`selected daemon lacks ${path} (HTTP ${capability.status})`);
+  const { profile: hostProfile, configPath } = hostSelection;
+  if (parsed.port != null) throw new Error("ours: --ours-port conflicts with host-profile mode");
+  const client = await attach({ ...hostProfile, sessionMode: "external", leaseToken: randomUUID(), env: {} });
+  let info;
+  try {
+    info = await client.version();
+    await client.identities();
+    await client.unread();
+  } finally {
+    await client.close();
   }
-  return {
-    port: selection.port.value,
-    stateDir: selection.expectStateDir,
-    token,
-    visibility: "owner",
-    source: selection.baseUrl.source,
-    info,
-    baseUrl,
-    configPath: selection.configPath?.value ?? join(selection.expectStateDir, "config.json"),
-    codexArgs: parsed.codexArgs
-  };
+  return { profile: hostProfile, info, baseUrl: hostProfile.endpoint, configPath, codexArgs: parsed.codexArgs };
 }
 export {
   parseOursArgs,

package/install.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Install the native ours.network plugin into the OpenAI Codex CLI:
-#   1. ensure the ours operator CLI and MCP adapter are installed; start the shared daemon
+#   1. verify the installed gateway client profile before modifying plugin configuration
 #   2. add/upgrade adapt-toolkit/ours-codex-marketplace
 #   3. install the native `ours` plugin (skills, MCP servers, and hooks)
 #   4. back up and remove installer-owned legacy config only after verification
@@ -10,7 +10,6 @@
 #   SKILLS_DIR                 skills root                (default ~/.agents/skills)
 #   CODEX_CONFIG               config.toml path           (default $CODEX_DIR/config.toml)
 #   CODEX_AGENTS               AGENTS.md path             (default $CODEX_DIR/AGENTS.md)
-#   OURS_INSTALL_SKIP_DAEMON=1 skip daemon install/start
 set -euo pipefail
 
 SELFDIR="$(cd "$(dirname "$0")" && pwd)"
@@ -21,33 +20,21 @@ SKILLS_DIR="${SKILLS_DIR:-$HOME/.agents/skills}"
 
 say(){ printf 'ours-install: %s\n' "$1"; }
 
-# Ensure the ours daemon is on @latest (UPGRADE, not install-if-missing): an already-present
-# daemon must still be pulled up to the newest published version. Record the CLI version
-# before/after; start if not running, restart only if the version actually changed.
-ensure_daemon_latest(){
-  if [ "${OURS_INSTALL_SKIP_DAEMON:-}" = "1" ]; then say "skipping daemon step (OURS_INSTALL_SKIP_DAEMON=1)"; return 0; fi
-  local before after
-  before="$(ours version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)"
-  say "ensuring @ours.network/cli@latest and @ours.network/mcp@latest…"
-  npm i -g @ours.network/cli@latest @ours.network/mcp@latest
-  after="$(ours version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)"
-  if ! ours daemon status >/dev/null 2>&1; then
-    say "starting the ours daemon…"
-    if ! ours daemon start; then say "could not start the ours daemon; installation stopped."; return 1; fi
-  elif [ -n "$before" ] && [ "$before" != "$after" ]; then
-    say "operator CLI upgraded (v${before} → v${after}) — restarting its daemon…"
-    if ! ours daemon restart; then
-      say "restart failed; trying a clean start…"
-      if ! ours daemon start; then say "could not restart or start the upgraded daemon; installation stopped."; return 1; fi
-    fi
-  else
-    say "daemon already current (v${after:-unknown})."
+# Client installation never installs, starts or restarts server services.
+require_gateway_client(){
+  if ! command -v ours >/dev/null 2>&1 || ! command -v ours-mcp >/dev/null 2>&1; then
+    say "Install gateway clients with ours-install client first; ours and ours-mcp are required."
+    return 1
+  fi
+  local contract
+  if ! contract="$(ours-mcp verify-client-profile)" || [ "$contract" != "ours.gateway-client-profile-v1" ]; then
+    say "Configure the shared gateway profile with ours-install client first; plugin setup was left unchanged."
+    return 1
   fi
-  say "operator CLI: $(command -v ours) (v${after:-unknown}); MCP adapter: $(command -v ours-mcp)"
 }
 
-# --- 1) daemon (ensure @latest + restart on change) ---
-ensure_daemon_latest
+# --- 1) shared gateway client preflight ---
+require_gateway_client
 
 # --- native Codex plugin ------------------------------------------------------
 # Codex owns the plugin cache and hook-trust workflow. Only remove the legacy
@@ -73,7 +60,7 @@ if [ "${OURS_CODEX_SKIP_NATIVE:-}" != "1" ]; then
   CODEX_DIR="$CODEX_DIR" SKILLS_DIR="$SKILLS_DIR" node "$SELFDIR/bin/codex-legacy-cleanup.mjs"
   say "native plugin installed. Review and trust its hooks in Codex, then start a new thread."
   say "standard mode: codex"
-  say "live mode:     ours-codex${OURS_PORT:+ --ours-port $OURS_PORT}"
+  say "live mode:     ours-codex"
   exit 0
 fi
 
@@ -93,11 +80,5 @@ CODEX_CONFIG="$CODEX_CONFIG" node "$SELFDIR/bin/codex-config-install.mjs"
 CODEX_AGENTS="$CODEX_AGENTS" node "$SELFDIR/bin/codex-agents-install.mjs"
 
 say "done. The ours MCP server + skill are live for the next Codex session."
-# --- version echo: show the user they are on latest ---
-if [ "${OURS_INSTALL_SKIP_DAEMON:-}" != "1" ]; then
-  say "versions:"
-  say "  MCP adapter: $(ours-mcp --version 2>/dev/null | head -1 || echo 'unknown')"
-  say "  plugin: $(npm ls -g @ours.network/codex 2>/dev/null | grep -oE '@ours\.network/codex@[0-9][0-9.]*' | head -1 || echo '@ours.network/codex (not a global install)')"
-fi
 say "next: bind (or create) an identity, then the ours skill tails ours-mcp watch (or polls"
 say "      get_messages) in-session so you react to new mail while you work."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/codex",
-  "version": "1.2.0-nightly.6",
+  "version": "1.2.0-nightly.8",
   "description": "Native Codex plugin for secure ours.network messaging and explicitly armed, session-scoped live mail wake.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -46,10 +46,10 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@ours.network/sdk": "3.8.1-nightly.10",
+    "@ours.network/sdk": "3.8.1-nightly.13",
     "ws": "^8.21.0",
     "zod": "^3.25.76",
-    "@ours.network/mcp": "1.2.0-nightly.6"
+    "@ours.network/mcp": "1.2.0-nightly.8"
   },
   "devDependencies": {
     "esbuild": "^0.24.2"

package/skills/ours/SKILL.md

@@ -108,12 +108,12 @@ existing file.
    **control-plane monitoring proxy is not available in this release** — there is no tool
    to call. See "Control plane" below.
 
-- **Configuration.** Port, state dir, broker, and GC interval are configurable.
-  More than one daemon may run when each uses a distinct port and state directory.
-  Select live mode with `ours-codex --ours-port <port>` or `OURS_CONFIG`. Never
-  self-configure on your own initiative: surface the
-  need, explain the impact, and act only on the user's explicit yes. Details:
-  `references/configuration.md`.
+- **Configuration.** Every client selects the HTTP gateway through
+  `~/.ours-client/profile.json` (or the whole-profile `OURS_CONFIG` override).
+  `serverUrl` is the base URL; daemon and Cowork use `/daemon` and `/cowork`
+  beneath it. Import the issued credential with `ours-install client`.
+  Local daemon ports, state directories, and Unix sockets are not client routes.
+  Missing or invalid configuration fails closed. See `references/configuration.md`.
 
 ## ours-fleet — persistent harness roles
 

package/skills/ours/references/configuration.md

@@ -1,26 +1,24 @@
-# ours daemon configuration
+# Shared gateway client configuration
 
-ours-mcp is a client of one already-running shared daemon. The operator CLI owns
-configuration and lifecycle:
+Fleet, ours CLI, MCP and harness hooks select one server through
+`~/.ours-client/profile.json`. `serverUrl` names the HTTP(S) gateway, with
+optional base path. Daemon operations use `/daemon`; Cowork uses `/cowork`.
+The profile also pins `expectedInstanceId` and an absolute `credentialPath`.
+An optional `endpoint` must equal `serverUrl + "/daemon"`.
 
-```sh
-ours config show --json
-ours config setup --port 3050 --state-dir "$HOME/.ours"
-ours daemon start
-ours daemon status --json
-```
+Import a prepared private profile with `ours-install client --config /absolute/profile.json`.
+Use `ours config show --json` to inspect connection metadata without reading the token.
+Keep the profile directory mode 0700 and files mode 0600. `OURS_CONFIG` may
+select the same whole profile for all clients. Remove legacy `OURS_PORT`,
+`OURS_STATE_DIR`, `OURS_API_TOKEN` and `OURS_DAEMON_ID` overrides.
 
-The MCP adapter and `ours-codex` use the published SDK's coherent selection. The
-wholly default selection is port 3050 with state directory `~/.ours`. For another
-daemon, set `OURS_CONFIG`, or set matching `OURS_PORT` and `OURS_STATE_DIR`. A
-token or endpoint selection must be paired with its state directory. `/state-dir`
-is verified before credentials are sent.
+Missing profiles, rejected credentials and unavailable gateways fail closed.
+Clients never read daemon state, start a daemon, or try a local port/socket.
+Hooks use the same gateway and return a harmless no-op on failure. Their
+application-local identity/session files do not select another server.
 
-The adapter never starts a daemon and never falls back to an embedded one.
-`OURS_INSTANCE`, `--application`, and old ours-mcp daemon variables are errors.
-Standard and live Codex mode use the same selection; live mode only adds an
-explicitly armed, session-scoped wake monitor.
-
-Changing daemon configuration or restarting the shared daemon affects every
-connected application. Explain that blast radius and obtain the user's consent
-before making operator-level changes.
+For full-stack setup, a custom public port (such as 4050), systemd propagation
+and migration, see the [gateway setup guide](https://github.com/adapt-toolkit/ours-network/blob/prerelease/packages/installer/GATEWAY_SETUP.md).
+The coordinated gateway changes require approved matching package releases;
+current npm nightly is not automatically evidence that these changes are installed.
+Server administration uses `ours-install server` on the server host.

package/src/hooks/runner.mjs

@@ -35,16 +35,6 @@ const safeUnread = (value) => (Array.isArray(value?.identities) ? value.identiti
   return [{ name: entry.name, count, files, recent }];
 });
 
-async function applicationIdentityNames(env, selection) {
-  const path = env.OURS_MCP_CONFIG || join(homedir(), '.ours-mcp', 'config.json');
-  const value = JSON.parse(await readFile(path, 'utf8'));
-  if (value?.version !== 1 || !value.daemons || typeof value.daemons !== 'object') return new Set();
-  const identities = selection.instanceId
-    ? value.instances?.[selection.instanceId]?.identities
-    : value.daemons[resolve(selection.stateDir)]?.identities;
-  return new Set(Array.isArray(identities) ? identities.filter((name) => typeof name === 'string') : []);
-}
-
 function renderContext(unread, pin) {
   const lines = [];
   if (unread.length) {
@@ -78,9 +68,6 @@ export async function handleHook(payload, { env = process.env, fetch: fetchImpl
     if (event === 'SessionStart' && socket && capability && payload.session_id && payload.cwd) {
       await send(socket, capability, { command: 'register_session', sessionId: payload.session_id, threadId: payload.session_id, cwd: payload.cwd });
     }
-    let port = env.OURS_PORT || '3050';
-    let selectedStateDir = resolve(env.OURS_STATE_DIR || join(homedir(), '.ours'));
-    let selectedToken = env.OURS_API_TOKEN || '';
     let hostProfile;
     try { hostProfile = hostProfileFromEnv(env); }
     catch { return { continue: true }; }
@@ -94,41 +81,7 @@ export async function handleHook(payload, { env = process.env, fetch: fetchImpl
       return context ? { continue: true, hookSpecificOutput: { hookEventName: event, additionalContext: context } } : { continue: true };
     }
 
-    // Standard Codex does not pass through ours-codex's resolved environment.
-    // Resolve the same coherent SDK selection here so SessionStart and
-    // UserPromptSubmit inspect the same daemon as the stdio proxy.
-    try {
-      const selected = await profileResolver({ env, fetch: fetchImpl });
-      if (selected.profile) {
-        let client;
-        try {
-          client = await clientFactory({ ...selected.profile, sessionMode: 'external', leaseToken: `codex-hook-${process.pid}`, env: {} });
-          const visible = await applicationIdentityNames(env, { instanceId: selected.profile.expectedInstanceId });
-          const unread = safeUnread(await client.unread()).filter((entry) => visible.has(entry.name));
-          const pin = await findPin(payload.cwd || process.cwd());
-          const context = renderContext(unread, pin);
-          return context ? { continue: true, hookSpecificOutput: { hookEventName: event, additionalContext: context } } : { continue: true };
-        } finally { await client?.close(); }
-      }
-      port = String(selected.port);
-      selectedToken = selected.token || '';
-      selectedStateDir = resolve(selected.stateDir);
-    } catch {
-      /* proxy/launcher owns legacy diagnostics; hooks emit a benign no-op */
-    }
-    const headers = selectedToken ? { 'x-ours-api-token': selectedToken } : {};
-    let unread = [];
-    try {
-      const response = await fetchImpl(`http://127.0.0.1:${port}/unread`, { headers, signal: AbortSignal.timeout(1500) });
-      if (response.ok) {
-        const visible = await applicationIdentityNames(env, { stateDir: selectedStateDir });
-        unread = safeUnread(await response.json()).filter((entry) => visible.has(entry.name));
-      }
-    } catch { /* daemon diagnostics belong to launcher/proxy */ }
-    const pin = await findPin(payload.cwd || process.cwd());
-    const context = renderContext(unread, pin);
-    if (!context) return { continue: true };
-    return { continue: true, hookSpecificOutput: { hookEventName: event, additionalContext: context } };
+    return { continue: true };
   } catch { return { continue: true }; }
 }
 

package/src/launcher.mjs

@@ -31,15 +31,7 @@ export function launcherEnvironment(env, profile, control) {
     // call. The bin shim preserves an explicit value instead of replacing it
     // with whichever child happened to spawn it.
   };
-  if (profile.profile) {
-    for (const key of ['OURS_PORT', 'OURS_API_TOKEN', 'OURS_STATE_DIR', 'OURS_CLIENT_PID', 'OURS_AUTOSTART', 'OURS_DAEMON_ID']) delete out[key];
-  } else {
-    out.OURS_PORT = String(profile.port);
-    out.OURS_AUTOSTART = '0';
-    out.OURS_CLIENT_PID = String(process.pid);
-    if (profile.token) out.OURS_API_TOKEN = profile.token;
-    else delete out.OURS_API_TOKEN;
-  }
+  for (const key of ['OURS_PORT', 'OURS_API_TOKEN', 'OURS_STATE_DIR', 'OURS_CLIENT_PID', 'OURS_AUTOSTART', 'OURS_DAEMON_ID', 'OURS_DAEMON_URL', 'OURS_DAEMON_CREDENTIAL_PATH']) delete out[key];
   return out;
 }
 

package/src/profile.mjs

@@ -1,8 +1,6 @@
-import { join } from 'node:path';
-import { homedir } from 'node:os';
 import { randomUUID } from 'node:crypto';
 
-import { assertDaemonStateDir, attachOursClient, resolveDaemonConfig } from '@ours.network/sdk';
+import { attachOursClient } from '@ours.network/sdk';
 import { hostProfileSelectionFromEnv } from '../../core/src/host-client/index.ts';
 
 function validPort(value) {
@@ -31,7 +29,6 @@ export function parseOursArgs(argv = []) {
 export async function resolveDaemonProfile({ argv = [], env = process.env, fetch: fetchImpl = globalThis.fetch, attach = attachOursClient } = {}) {
   const parsed = parseOursArgs(argv);
   const hostSelection = hostProfileSelectionFromEnv(env);
-  if (hostSelection !== null) {
     const { profile: hostProfile, configPath } = hostSelection;
     if (parsed.port != null) throw new Error('ours: --ours-port conflicts with host-profile mode');
     const client = await attach({ ...hostProfile, sessionMode: 'external', leaseToken: randomUUID(), env: {} });
@@ -42,40 +39,4 @@ export async function resolveDaemonProfile({ argv = [], env = process.env, fetch
       await client.unread();
     } finally { await client.close(); }
     return { profile: hostProfile, info, baseUrl: hostProfile.endpoint, configPath, codexArgs: parsed.codexArgs };
-  }
-  const selection = resolveDaemonConfig({
-    ...(parsed.port == null ? {} : { port: parsed.port }),
-    env,
-    homeDir: env.HOME || homedir(),
-  });
-  await assertDaemonStateDir(selection, { fetch: fetchImpl, timeoutMs: 2000 });
-
-  const baseUrl = selection.baseUrl.value;
-  const token = selection.token?.value ?? null;
-  const headers = token ? { 'x-ours-api-token': token } : {};
-  const response = await fetchImpl(`${baseUrl}/info`, { signal: AbortSignal.timeout(2000) });
-  if (!response.ok) throw new Error(`ours daemon at ${baseUrl} returned HTTP ${response.status}`);
-  const info = await response.json();
-  if (info?.name !== 'ours' || !Number.isInteger(info?.protocol) || info.protocol < 1) {
-    throw new Error(`incompatible service at ${baseUrl}; expected an ours daemon with notification protocol 1`);
-  }
-  for (const path of ['/identities', '/unread']) {
-    const capability = await fetchImpl(`${baseUrl}${path}`, { headers, signal: AbortSignal.timeout(2000) });
-    if (capability.status === 401 || capability.status === 403) {
-      throw new Error(`ours daemon authentication failed at ${baseUrl}; supply the matching coherent selection`);
-    }
-    if (!capability.ok) throw new Error(`selected daemon lacks ${path} (HTTP ${capability.status})`);
-  }
-
-  return {
-    port: selection.port.value,
-    stateDir: selection.expectStateDir,
-    token,
-    visibility: 'owner',
-    source: selection.baseUrl.source,
-    info,
-    baseUrl,
-    configPath: selection.configPath?.value ?? join(selection.expectStateDir, 'config.json'),
-    codexArgs: parsed.codexArgs,
-  };
 }