@ory/amp 0.10.0 → 0.11.0

package/README.md

@@ -49,7 +49,7 @@ npx -y -p @ory/amp ory-amp uninstall   # remove the delegate, plugin, and skills
 
 From any project where you'd like Ory authentication, inside Amp:
 
-1. **Start a local Ory instance.** Ask Amp *"start the local Ory stack"* or run `/local-up`. A banner prints the seeded test user's email and password — note them.
+1. **Start a local Ory instance.** Ask Amp *"start the local Ory stack"* or invoke the `ory-local-up` skill. A banner prints the seeded test user's email and password — note them.
 2. **Scaffold Ory into your project.** Ask Amp *"add Ory auth to this app"* (the `ory-auth-setup` skill). It installs Ory Elements, wires the SDK, and generates the login / registration / recovery / settings pages, all targeting the local stack.
 3. **Sign in.** Start your app, visit the login page, and sign in with the seeded credentials. You now have a real Ory session backed by a real Ory stack — locally, offline, zero configuration.
 
@@ -59,7 +59,7 @@ Continue to [Agent security](#agent-security) when you're ready to enforce.
 
 Amp's Ory integration is a **hybrid** of two mechanisms:
 
-- **Blocking gate — a permission delegate helper (`ory-amp-permission`).** Registered in `amp.permissions`, Amp invokes it per tool call with the tool params on stdin and decides by **exit code**: `0` = allow, `1` = ask, `≥2` = reject (stderr is surfaced to the model). This is the only part that can block. Amp enforces a 10-second delegate timeout, so the Ory check fails open (allows) on slow or unreachable backends.
+- **Blocking gate — a permission delegate helper (`ory-amp-permission`).** Registered in `amp.permissions`, Amp invokes it per tool call with the tool params on stdin and decides by **exit code**: `0` = allow, `1` = ask, `≥2` = reject (stderr is surfaced to the model). This is the only part that can block. Amp enforces a 10-second delegate timeout and treats a delegate that outlives it as a reject, so the delegate applies its own deadline to the Ory permission check (default 5 seconds, configurable via `ORY_AMP_CHECK_TIMEOUT_MS`) and fails open (allows) when the check is slow, hanging, or unreachable.
 - **Advisory in-process plugin (`.amp/plugins/ory.ts`).** Discovered by Amp's Bun runtime, it handles session-start auth (advisory — it cannot hard-block at session start) and post-tool audit tracing.
 
 The phases map as:

package/dist/permission.d.ts

@@ -16,10 +16,11 @@
  * here a denial is exit 2 *plus a stderr message*, and stdout is unused.
  *
  * TIMEOUT: Amp enforces a 10-second delegate timeout. A delegate that does
- * not exit within 10s is treated as a reject, so every Ory call below
- * (session resolution + permission check) must complete well inside that
- * window; the fail-open arms below keep slow/unreachable Ory from wedging
- * the agent, but a hard 10s hang would still surface as a reject.
+ * not exit within 10s is treated as a reject, so a hanging Ory backend
+ * would otherwise surface as a block. To keep infra failures fail-open,
+ * the permission check below is raced against a local deadline (default
+ * 5000ms, override via ORY_AMP_CHECK_TIMEOUT_MS); on timeout the delegate
+ * logs a warning to stderr and allows (exit 0), well inside Amp's window.
  *
  * Fail-open: any error — parse failure, network error, rate limit, crash —
  * resolves to exit 0 (allow). The delegate must never wedge the agent.
@@ -35,6 +36,8 @@ export interface DelegateDecision {
     /** Reason to write to stderr (only set when rejecting). */
     reason?: string;
 }
+/** Resolve the check deadline, overridable via ORY_AMP_CHECK_TIMEOUT_MS. */
+export declare function resolveCheckTimeoutMs(): number;
 /** Pull the tool name out of the (undocumented) delegate payload. */
 export declare function extractToolName(input: AmpDelegateInput): string;
 /**

package/dist/permission.js

@@ -17,10 +17,11 @@
  * here a denial is exit 2 *plus a stderr message*, and stdout is unused.
  *
  * TIMEOUT: Amp enforces a 10-second delegate timeout. A delegate that does
- * not exit within 10s is treated as a reject, so every Ory call below
- * (session resolution + permission check) must complete well inside that
- * window; the fail-open arms below keep slow/unreachable Ory from wedging
- * the agent, but a hard 10s hang would still surface as a reject.
+ * not exit within 10s is treated as a reject, so a hanging Ory backend
+ * would otherwise surface as a block. To keep infra failures fail-open,
+ * the permission check below is raced against a local deadline (default
+ * 5000ms, override via ORY_AMP_CHECK_TIMEOUT_MS); on timeout the delegate
+ * logs a warning to stderr and allows (exit 0), well inside Amp's window.
  *
  * Fail-open: any error — parse failure, network error, rate limit, crash —
  * resolves to exit 0 (allow). The delegate must never wedge the agent.
@@ -29,6 +30,7 @@
  * and 10s timeout).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveCheckTimeoutMs = resolveCheckTimeoutMs;
 exports.extractToolName = extractToolName;
 exports.decideToolPermission = decideToolPermission;
 const argus_1 = require("@ory/argus");
@@ -36,6 +38,44 @@ const types_js_1 = require("./types.js");
 function resolveNamespace() {
     return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
 }
+/**
+ * Local deadline for the Ory permission check. Amp treats a delegate that
+ * does not exit within 10s as a REJECT, so a hanging backend must be cut
+ * off locally and resolved as allow (fail-open for infra failures). The
+ * default leaves ample headroom inside Amp's 10s window.
+ */
+const DEFAULT_CHECK_TIMEOUT_MS = 5000;
+/** Resolve the check deadline, overridable via ORY_AMP_CHECK_TIMEOUT_MS. */
+function resolveCheckTimeoutMs() {
+    const raw = process.env.ORY_AMP_CHECK_TIMEOUT_MS;
+    if (raw) {
+        const parsed = Number(raw);
+        if (Number.isFinite(parsed) && parsed > 0)
+            return parsed;
+    }
+    return DEFAULT_CHECK_TIMEOUT_MS;
+}
+/** Sentinel resolved by the deadline arm of the race below. */
+const CHECK_TIMED_OUT = Symbol("ory-amp-check-timeout");
+/**
+ * Race a promise against the local check deadline. The timer is unref'd
+ * (and cleared once the race settles) so it never keeps the process alive.
+ */
+async function raceCheckDeadline(work, timeoutMs) {
+    let timer;
+    try {
+        return await Promise.race([
+            work,
+            new Promise((resolve) => {
+                timer = setTimeout(() => resolve(CHECK_TIMED_OUT), timeoutMs);
+                timer.unref?.();
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 /** Pull the tool name out of the (undocumented) delegate payload. */
 function extractToolName(input) {
     return input.tool ?? input.toolName ?? input.name ?? "unknown";
@@ -68,7 +108,11 @@ async function decideToolPermission(input, client) {
     const subject = (0, argus_1.resolveUserSubject)(client, sessionId ? `session:${sessionId}` : undefined);
     const subjectId = (0, argus_1.subjectLabel)(subject);
     try {
-        const outcome = await (0, argus_1.gateToolCall)(client, {
+        // Race against a local deadline: core's checkPermission has no HTTP
+        // timeout, and Amp treats a delegate that outlives its 10s window as
+        // a reject — a hanging backend must fail OPEN, not closed.
+        const timeoutMs = resolveCheckTimeoutMs();
+        const raced = await raceCheckDeadline((0, argus_1.gateToolCall)(client, {
             harness: "amp",
             toolName,
             check: {
@@ -78,7 +122,13 @@ async function decideToolPermission(input, client) {
                 ...subject,
             },
             spanAttributes: { toolName },
-        });
+        }), timeoutMs);
+        if (raced === CHECK_TIMED_OUT) {
+            process.stderr.write(`[ory-agent] permission check for "${toolName}" timed out after ${timeoutMs}ms; allowing (fail-open)\n`);
+            client.logger.warn("delegate.check_timeout", { toolName, timeoutMs });
+            return { exitCode: types_js_1.AMP_DELEGATE_EXIT.ALLOW };
+        }
+        const outcome = raced;
         // Interactive tools (operator-extensible via ORY_INTERACTIVE_TOOLS):
         // the user.interaction span is already recorded; allow so Amp can
         // surface the prompt to the user.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/amp",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Ory plugin for Amp (Sourcegraph's coding agent): a permission delegate that authorizes every tool call plus an in-process plugin for session auth and audit tracing",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -67,7 +67,7 @@
     "!dist/**/*.tsbuildinfo"
   ],
   "dependencies": {
-    "@ory/argus": "0.10.0"
+    "@ory/argus": "0.11.0"
   },
   "devDependencies": {
     "typescript": "^6.0.2",