@ory/amp 0.13.9 → 1.0.0

package/README.md

@@ -2,9 +2,12 @@
 
 Security and developer experience for [Amp](https://ampcode.com) (Sourcegraph's coding agent), powered by [Ory](https://ory.com).
 
-**Security.** Amp runs real actions on your machine — editing files, running shell commands, calling APIs. The plugin gives every session a verifiable identity (you sign in once; Amp and any sub-agents it spawns each get their own), checks every tool call against permissions you control, and records each decision as an audit trace you can ship to your observability stack. It starts in watch mode so nothing is blocked on day one, and if Ory is ever unreachable it steps aside rather than locking you out.
+Amp runs real actions on your machine — editing files, running shell commands, calling APIs. This plugin gives those actions an identity, a permission check, and an audit trail.
 
-**Developer experience.** A single command installs the plugin and walks you through connecting — choose Ory Network, a local Docker stack, or audit-only, and it wires up the project, sign-in client, login, and permissions for you. It also helps you build Ory into your own app: ask in plain language to scaffold login, registration, and recovery pages, run a local Ory, or manage identities and permissions through the bundled MCP server.
+One command installs two independent halves:
+
+- **Developer experience** — the Ory skill catalog, the local Ory dev stack, and activity logging. No account, no keys, nothing to configure: it works the moment it's installed.
+- **Ory Agent Security** — browser sign-in, brokered permission checks before tool calls, and the delegation trail. Opt-in connection details from the [Ory Console](https://console.ory.sh) switch it on, and it takes nothing away from the half above. See [Connect to Ory Agent Security](#connect-to-ory-agent-security).
 
 ## What you'll need
 
@@ -15,69 +18,90 @@ Security and developer experience for [Amp](https://ampcode.com) (Sourcegraph's
 
 ## Get started
 
-Run one command. It installs the plugin and walks you through connecting:
+Run one command:
 
 ```bash
 npx -y -p @ory/amp ory-amp install
 ```
 
-You'll be asked how you want to connect — **press Enter for the default**:
-
-- **Ory Network** *(default)* — sign in, or create a free account, in your browser. The project, keys, permissions, and login are all set up for you. Nothing to configure by hand.
-- **Local** — run a complete Ory on your laptop with Docker. No account, no signup, no keys. Great for trying it out.
-- **Audit-only** — skip Ory entirely and just log what Amp does.
-
-That's it. Confirm everything landed with:
+Confirm everything landed with:
 
 ```bash
 npx -y -p @ory/amp ory-amp status
 ```
 
-`status` is your one-stop check: what's configured, who's signed in, which tools are covered by permissions, whether the plugin is wired into Amp, and recent activity.
+`status` is your one-stop check: what's configured, who's signed in, which tools are covered by permissions, whether the plugin is wired into Amp, and recent activity. Until you connect Agent Security, the identity and permission rows say so and name what's missing.
+
+## Skills and commands
+
+Installing the plugin drops the full Ory playbook catalog into Amp. **Skills** are model-invoked — just say what you want in plain language and the matching one takes over.
+
+| Skill | What it does for you |
+|---|---|
+| `ory-auth-setup` | Adds a complete auth system to your app — login, registration, recovery, verification, settings — on [Ory Elements](https://github.com/ory/elements) |
+| `ory-login-flow` | Builds just the pages, wired to Ory's self-service flows |
+| `ory-social-login` | "Sign in with…" for Google, GitHub, Apple, Microsoft, Discord, Slack, GitLab, Facebook |
+| `ory-local-dev` | Develops and tests login/permission flows against a local Ory — no project, no account, offline |
+| `ory-permissions-onboarding` | Walks a fresh install from observe mode to enforced per-tool permissions without getting blocked |
+| `ory-build-agent` | Drops `@ory/argus` into an agent *you* own — Claude Agent SDK, OpenAI Agents, Mastra, Vercel AI, LangGraph/PydanticAI |
+| `ory-build-integration` | Wires Ory into your app: Action webhooks, JWT validation at a gateway, live event streams |
+| `ory-contribute-integration` | Authors and submits an integration to the public `ory/integrates` registry |
+| `ory-e2b-sandbox` | Scaffolds an E2B sandbox template that boots with this plugin preinstalled |
+| `ory-temporal-worker` | Scaffolds a Temporal TypeScript worker where every Activity is authenticated, authorized, and audited |
+
+The local stack has its own playbooks — ask for them by name:
+
+| Command | What it does |
+|---|---|
+| `ory-local-up` | Starts a local Ory (Identities, OAuth2, Permissions) in Docker and seeds a test user — it prints the email + password to sign in with |
+| `ory-local-down` | Stops it, keeping your data volumes |
+| `ory-temporal-up` | Starts a local Temporal dev server for the `ory-temporal-worker` scaffold |
 
-Re-run install with `--reconfigure` to change your connection later, or `--no-configure` to skip the wizard and configure by hand.
+The local stack runs entirely on your laptop: Ory APIs at `http://localhost:4000`, a login UI on `:4455` (not `:3000`, to dodge Next.js port clashes), and the Ory Console on `:4100`.
+
+So: ask Amp *"add Ory login to this app"* and it scaffolds the pages, starts a local Ory, and wires them together.
 
 ## What you get
 
-Once connected, every tool Amp runs is governed by Ory — three things happen automatically:
+Out of the box, every tool Amp runs produces a privacy-safe structured activity event in the unified local log.
+
+Once you connect to Ory Agent Security, two more things happen automatically:
 
-- **Who's driving.** You sign in once in your browser; Amp gets its own identity too, and registers it automatically on first run. No tokens to copy around, and the "who acted on whose behalf" trail stays queryable later.
-- **What it's allowed to do.** Before a tool runs, Ory checks whether it's permitted. It starts in **watch mode** — nothing is blocked, you just *see* what would be — so it never gets in your way on day one.
-- **A record of everything.** Every decision (allowed, denied, skipped) is logged as a trace you can send to a viewer like Jaeger or Honeycomb, or just a file.
+- **Who's driving.** You sign in once in your browser; each Amp session gets its own identity and registers it automatically on first use. No tokens to copy around, and the "who acted on whose behalf" trail stays queryable later.
+- **What it's allowed to do.** Before a tool runs, Ory checks whether it's permitted. It starts in **observe mode** — nothing is blocked, you just *see* what would be — so it never gets in your way on day one.
 
 If Ory is ever slow or unreachable, the plugin gets out of the way and lets Amp keep working — so it can't lock you out.
 
 ### See what's happening
 
-Everything the plugin does is observable out of the box — no configuration required:
+Everything the plugin does is observable out of the box:
 
-- **Status at a glance.** `npx -y -p @ory/amp ory-amp status` shows what's configured, who's signed in, how many built-in tools your permissions cover, and the most recent tool-call activity.
-- **Live traces.** Every tool call is recorded as an OpenTelemetry-style span. Watch them stream as the agent works:
+- **Activity log.** Privacy-safe activity is always appended to `~/.config/ory-agent-plugins/amp/ory-agent-debug.log`. View events, decisions, and errors live with:
 
   ```bash
   npx -y -p @ory/amp ory-amp watch
   ```
 
-  Spans are also written to `~/.config/ory-agent-plugins/amp/ory-agent-trace.ndjson` (NDJSON, one span per line) — tail that file, or point `OTEL_EXPORTER_OTLP_ENDPOINT` at a collector to ship them straight to Jaeger, Honeycomb, or Grafana.
-- **Debug log.** For a verbose play-by-play, set `ORY_AGENT_DEBUG=true`; structured logs land in `~/.config/ory-agent-plugins/amp/ory-agent-debug.log`.
+  Set `ORY_AGENT_LOG_FILE` to override the path; set it empty to disable file persistence.
+- **Live debug.** Launch Amp with `ORY_AGENT_DEBUG=true` to add verbose local diagnostics, including raw shell commands, to the watched log and stderr. Secrets are recursively redacted; pass `watch --json` for NDJSON.
 
 ### Ready to enforce?
 
-When the watch-mode logs look right, turn on blocking with one command (setup already granted you the built-in tools):
+Once connected, the deny posture lives on the Ory project: when the observe-mode activity looks right, an admin promotes it to **enforce** in the **Ory Console** (Agent Security). Every session reads that posture live, so nothing has to be reinstalled.
 
 ```bash
-npx -y -p @ory/amp ory-amp permissions enforce
+npx -y -p @ory/amp ory-amp permissions   # what the project grants, and the live mode
 ```
 
-Now a denied tool is actually blocked and Amp shows why. Go back to watch mode anytime with `permissions observe`. Use `permissions status` to see what's covered and `permissions bootstrap` to (re-)grant the built-in tools.
+Then a denied tool is actually blocked and Amp shows why.
 
 <details>
 <summary>How the plugin plugs into Amp</summary>
 
 Amp gets the plugin in two pieces that work together:
 
-- **A permission gate** registered in Amp's settings (`~/.config/amp/settings.json`) under the `amp.permissions` key. Before every tool call, Amp hands the tool and its params to this gate and reads the answer from its **exit code**: `0` = allow, `1` = ask, `≥2` = reject (the reason on stderr is shown to Amp). This is the piece that can actually block.
-- **An in-process plugin** at `<project>/.amp/plugins/ory.ts`, which Amp's built-in TypeScript runtime loads to sign you in at the start of a session and record what happened after each tool runs. It can't block from there, so it's advisory only — the gate above does the blocking.
+- **A permission gate** registered in Amp's settings (`~/.config/amp/settings.json`) under the `amp.permissions` key. Before every tool call, Amp hands the tool and its params to this compatibility gate and reads the answer from its **exit code**: `0` = allow, `1` = ask, `≥2` = reject (the reason on stderr is shown to Amp).
+- **An in-process plugin** at `<project>/.amp/plugins/ory.ts`, which Amp's built-in TypeScript runtime loads to sign you in, authorize tool calls with Amp's exact thread ID, and record results. Its native `tool.call` response can block with `reject-and-continue`.
 
 Amp gives the gate 10 seconds to answer and treats a slower gate as a reject, so the plugin sets its own shorter deadline (5 seconds, adjustable with `ORY_AMP_CHECK_TIMEOUT_MS`) and lets the tool through if the Ory check is slow, stuck, or unreachable — it never leaves you hanging.
 
@@ -85,38 +109,42 @@ The Ory skills land under `<project>/.agents/skills/`. `uninstall` removes the g
 
 </details>
 
-## Also: add login to your own app
-
-Beyond securing Amp, the plugin helps you build Ory into whatever you're working on. The Ory skills are **model-invoked** — just ask Amp in plain language and the right one takes over (Amp doesn't use slash commands for these). Ask Amp *"add Ory login to this app"* and it scaffolds the login, registration, recovery, and settings pages (using [Ory Elements](https://github.com/ory/elements)) wired to a local Ory — no signup or keys needed. Start that local Ory by asking *"start the local Ory stack"* (it prints a test email + password to sign in with).
-
-More bundled **skills** cover login and social sign-in (Google, GitHub, Apple…), permissions onboarding, and playbooks for wiring Ory into your own agents, E2B sandboxes, or Temporal workers.
+## Connect to Ory Agent Security
 
-The local Ory runs entirely on your laptop: the Ory APIs at `http://localhost:4000`, a login UI on `:4455` (not `:3000`, to avoid clashing with Next.js dev servers), the Ory Console on `:4100`, and a trace viewer (Jaeger) on `:16686`.
+Copy the connection details from the [Ory Console](https://console.ory.sh) under **Agent Security**:
 
-## Configure by hand (CI / advanced)
-
-The guided setup covers most people. For scripted or CI setups, or to point at an existing Ory Network project, configure directly. Settings are saved to `~/.config/ory-agent-plugins/config.json` and shared across all your Ory agent plugins; environment variables win when both are set.
+| Value | Flag | Environment variable |
+|---|---|---|
+| Project URL | `--project-url` | `ORY_PROJECT_URL` |
+| Agent Security URL | `--agent-security-url` | `ORY_AGENT_SECURITY_URL` |
+| Sign-in client id override (default `ory-agent-security-login`) | `--oauth2-client-id` | `ORY_OAUTH2_CLIENT_ID` |
 
 ```bash
 npx -y -p @ory/amp ory-amp configure \
   --project-url https://<slug>.projects.oryapis.com \
-  --oauth2-client-id <sign-in client id> \
-  --user-login
+  --agent-security-url https://agents.console.ory.com
 ```
 
-Amp's own identity registers itself automatically on first run — nothing to create. The `--oauth2-client-id` is the one piece browser sign-in needs (the public client registered with the four loopback callback URLs `http://127.0.0.1:47823..47826/callback`); the guided setup makes it for you. Pass `--api-key ory_pat_...` only to override Amp's auto-created identity with a static token. For logging-only with no checks, use `--audit-only`. The matching env vars are `ORY_PROJECT_URL`, `ORY_OAUTH2_CLIENT_ID`, `ORY_USER_LOGIN`, and `ORY_AGENT_API_KEY`.
+`install` accepts the same flags, so you can register the plugin **and** connect in one shot (`install --project-url <URL> --agent-security-url <URL>`). The login client defaults to `ory-agent-security-login`; custom deployments can override it with `--oauth2-client-id`. Existing configurations fall back to the project URL when the Agent Security URL is unset. To turn sign-in and checks back off later, use `configure --disconnect`.
+
+**Ory Network or OEL.** Either works. For an Ory Network project the URL is `https://<slug>.projects.oryapis.com`; for a self-hosted **Ory Enterprise License** deployment, point `--project-url` at that deployment's base URL and use the sign-in client id from its Agent Security configuration. Everything downstream — sign-in, checks, delegation — is identical.
+
+**There is nothing else for you to create.** The sign-in client, the permission model, the per-tool grants and blocks, and the observe/enforce posture are all provisioned in the Console by someone with project access. At runtime the plugin only *reads* permissions — it has no write path into your project, which is why installing it needs no workspace privilege. Each Amp session registers its own identity automatically on first use.
+
+Sign-in runs at the start of every session and never blocks — a declined, skipped, or timed-out login simply leaves that session without a user identity.
 
-With nothing configured, the plugin still loads and runs in **pass-through mode**: skills and logging work, but no checks run and nothing is blocked. Perfectly fine if you only want the app-building features.
+Settings are saved to `~/.config/ory-agent-plugins/config.json` and shared across all your Ory agent plugins; environment variables win when both are set. Running headless with an OAuth2 access token already? Set `ORY_USER_OAUTH2_TOKEN` and the browser step is skipped entirely.
 
 ## Commands
 
 ```
-ory-amp install | uninstall        Install/remove; --reconfigure re-runs setup, --no-configure skips it
+ory-amp install | uninstall        Install (add --project-url to also connect Agent Security) / remove
 ory-amp status                     Show configuration, identities, permission coverage, and recent activity
-ory-amp watch                      Tail the live trace stream (OTel spans)
-ory-amp permissions <cmd>          status | bootstrap | observe (watch) | enforce (block)
-ory-amp configure <flags>          Point at a project by hand (--project-url, --oauth2-client-id, --user-login, --audit-only)
+ory-amp permissions <cmd>          status  (read-only; grants + posture live in the Ory Console)
+ory-amp configure <flags>          Connect a project (--project-url) or --disconnect
 ory-amp agent <status|unregister>  Manage Amp's own auto-created identity
+ory-amp local <up|down|status|…>   Run / manage a local Ory in Docker
+ory-amp version                    Print plugin, core, and Node versions (--json for machine-readable)
 ```
 
 All prefixed with `npx -y -p @ory/amp`.
@@ -124,16 +152,14 @@ All prefixed with `npx -y -p @ory/amp`.
 ## Troubleshooting
 
 - **Local Ory fails to start** — make sure Docker is running and ports `4000`, `4100`, `4455`, and `16686` are free.
-- **Browser sign-in loops** — reset with `ory-amp agent unregister` and try again.
-- **Install ran but never asked how to connect** — you're almost certainly on a stale `npx` cache. `npx -p @ory/amp` (no version pin) reuses a previously-downloaded copy instead of re-resolving to the latest, so an older CLI whose install predates the setup wizard can run while you believe you're on the current release. The install banner prints the running version; confirm it with `npx -y -p @ory/amp ory-amp version`. To force the current release, clear the cache and reinstall: `rm -rf ~/.npm/_npx` then `npx -y -p @ory/amp ory-amp install`. Pinning an exact version (`@ory/amp@<version>`) also bypasses the cached copy.
+- **Browser sign-in loops** (after connecting) — reset with `ory-amp agent unregister` and try again.
+- **Running an older CLI than expected** — `npx -p @ory/amp` (no version pin) reuses a previously-downloaded copy instead of re-resolving to the latest. The install banner prints the running version; confirm it with `npx -y -p @ory/amp ory-amp version`. To force the current release, clear the cache and reinstall: `rm -rf ~/.npm/_npx` then `npx -y -p @ory/amp ory-amp install`. Pinning an exact version (`@ory/amp@<version>`) also bypasses the cached copy.
 - **A tool check feels slow** — the plugin gives up on a stalled Ory check and lets the tool through; tune the deadline with `ORY_AMP_CHECK_TIMEOUT_MS`.
-- **Want to see what's happening** — `npx -y -p @ory/amp ory-amp status` for a snapshot, `npx -y -p @ory/amp ory-amp watch` for the live trace stream, or set `ORY_AGENT_DEBUG=true` for a verbose log. Traces and logs live under `~/.config/ory-agent-plugins/amp/` (see [See what's happening](#see-whats-happening)).
 
 ## Learn more
 
 - [Ory documentation](https://www.ory.com/docs/) · [Ory Console](https://console.ory.sh) · [Ory Elements](https://github.com/ory/elements)
 - [Amp documentation](https://ampcode.com)
-- [Repo README](../../README.md) and [AGENTS.md](../../AGENTS.md) — full env-var and permission-mode reference
 
 ## License
 

package/dist/cli/main.js

@@ -51,6 +51,11 @@ const argus_1 = require("@ory/argus");
 const PACKAGE_ROOT = path.resolve(__dirname, "..", "..");
 function main() {
     const [command, ...args] = process.argv.slice(2);
+    // `--help` after a matched subcommand: print usage, do nothing else.
+    // Without this the switch below ignores the flag and `install --help`
+    // performs a real install (#221).
+    if ((0, argus_1.shouldPrintHelp)(command, args))
+        return help();
     switch (command) {
         case "install":
             (0, argus_1.beginDeferNextSteps)();
@@ -62,7 +67,10 @@ function main() {
             break;
         case "uninstall":
             uninstall(args);
-            (0, argus_1.clearCredentialsForUninstall)().then(() => process.exit(0), (err) => {
+            (0, argus_1.clearCredentialsForUninstall)({
+                harness: "amp",
+                purge: args.includes("--purge"),
+            }).then(() => process.exit(0), (err) => {
                 console.error(err.message ?? err);
                 process.exit(1);
             });
@@ -71,7 +79,7 @@ function main() {
             (0, argus_1.runConfigureCommand)("ory-amp", args);
             break;
         case "agent":
-            (0, argus_1.runAgentCommand)("ory-amp", args).then((code) => process.exit(code), (err) => {
+            (0, argus_1.runAgentCommand)("ory-amp", "amp", args).then((code) => process.exit(code), (err) => {
                 console.error(err.message ?? err);
                 process.exit(1);
             });
@@ -91,15 +99,15 @@ function main() {
                 process.exit(1);
             });
             break;
+        case "watch":
+            (0, argus_1.runWatchCommand)("ory-amp", "amp", args).then((code) => process.exit(code), (err) => { console.error(err.message ?? err); process.exit(1); });
+            break;
         case "local":
             (0, argus_1.runLocalCommand)("ory-amp", args).catch((err) => {
                 console.error(err.message ?? err);
                 process.exit(1);
             });
             break;
-        case "watch":
-            (0, argus_1.runWatchCommand)("amp", args);
-            break;
         case "version":
         case "--version":
         case "-v":
@@ -156,13 +164,15 @@ async function status(args) {
                     const perms = Array.isArray(raw["amp.permissions"])
                         ? raw["amp.permissions"]
                         : [];
-                    delegateRegistered = perms.some((p) => p?.to === "ory-amp-permission");
+                    delegateRegistered = perms.some((p) => p?.to === "ory-amp-permission" ||
+                        /ory-hook-amp\.(js|cjs|mjs)$/.test(String(p?.to ?? "")));
                 }
             }
             catch {
                 /* ignore parse errors */
             }
-            console.log(`  Delegate:         ${delegateRegistered ? "registered (ory-amp-permission)" : "NOT registered"}`);
+            console.log(`  Delegate:         ${delegateRegistered ? "registered" : "NOT registered"}`);
+            console.log(`  Runtime:          ${(0, argus_1.describeRuntimeHealth)((0, argus_1.checkRuntimeHealth)("amp"))}`);
             console.log(`  In-process plugin: ${fs.existsSync(pluginFile) ? `installed (${pluginFile})` : "not installed"}`);
         },
     });
@@ -179,23 +189,22 @@ Commands:
   uninstall [--project-dir <path>] Remove the Ory delegate, plugin, and skills
   configure                        Set or view Ory project URL and API key
   agent <status|unregister>        Manage the agent's OAuth2 (DCR) identity
-  permissions <cmd>                Manage permission mode and tool permissions
-                                   (status, bootstrap, observe, enforce)
+  permissions                      Show the live permission mode and per-tool coverage
   setup [--project-dir <path>]     Write config directly (fallback)
   status [--project-dir <path>]    Show plugin configuration and status
-  watch [trace-file]               Tail the trace stream (OTel spans) live
+  watch [--json] [--lines <count>] Follow the live activity/debug log
   version                          Show version and the ory-agent-plugins build commit
   local <cmd>                      Manage local Ory dev environment
                                    (up, down, status, seed, logs, env, configure, reset)
 
 After installing, the Ory integration runs in two parts:
   Permission delegate (ory-amp-permission)   Authorize each tool call (blocking)
-  In-process plugin (.amp/plugins/ory.ts)    Session auth + audit tracing
+  In-process plugin (.amp/plugins/ory.ts)    Session auth + activity auditing
 
 Examples:
   npx -y -p @ory/amp ory-amp install
-  npx -y -p @ory/amp ory-amp configure --project-url https://<slug>.projects.oryapis.com
-  npx -y -p @ory/amp ory-amp permissions bootstrap
+  npx -y -p @ory/amp ory-amp configure --project-url https://<slug>.projects.oryapis.com --agent-security-url https://agents.console.ory.com
+  npx -y -p @ory/amp ory-amp permissions
   npx -y -p @ory/amp ory-amp status
 `);
 }

package/dist/cli/setup.d.ts

@@ -4,11 +4,12 @@
  *
  * Performs two installs:
  *   (a) Registers the permission delegate in Amp's settings under
- *       `amp.permissions` as `{ tool: "*", action: "delegate",
- *       to: "ory-amp-permission" }` — this is the blocking gate.
+ *       `amp.permissions` as `{ tool: "*", action: "delegate", to: <path> }`,
+ *       where the path is the Ory runtime shim resolved at install time — this
+ *       is the blocking gate.
  *   (b) Writes the in-process plugin loader at
  *       `<projectDir>/.amp/plugins/ory.ts` so Amp's Bun TypeScript runtime
- *       discovers it for session auth + audit tracing.
+ *       discovers it for session auth + activity auditing.
  *
  * Usage:
  *   npx ory-amp-setup                    # Auto-detect and configure

package/dist/cli/setup.js

@@ -5,11 +5,12 @@
  *
  * Performs two installs:
  *   (a) Registers the permission delegate in Amp's settings under
- *       `amp.permissions` as `{ tool: "*", action: "delegate",
- *       to: "ory-amp-permission" }` — this is the blocking gate.
+ *       `amp.permissions` as `{ tool: "*", action: "delegate", to: <path> }`,
+ *       where the path is the Ory runtime shim resolved at install time — this
+ *       is the blocking gate.
  *   (b) Writes the in-process plugin loader at
  *       `<projectDir>/.amp/plugins/ory.ts` so Amp's Bun TypeScript runtime
- *       discovers it for session auth + audit tracing.
+ *       discovers it for session auth + activity auditing.
  *
  * Usage:
  *   npx ory-amp-setup                    # Auto-detect and configure
@@ -70,22 +71,26 @@ const path = __importStar(require("node:path"));
 const argus_1 = require("@ory/argus");
 const assets_js_1 = require("./assets.js");
 const PACKAGE_NAME = "@ory/amp";
-const DELEGATE_BIN = "ory-amp-permission";
+const PACKAGE_ROOT = path.resolve(__dirname, "..", "..");
 /** Direct *.ts loader Amp's Bun runtime discovers under .amp/plugins/. */
 const PLUGIN_FILE = "ory.ts";
 /**
- * Read the plugin's own version, walking up from dist/cli to the package
- * root. Used to version-pin the npx invocation written into the in-process
- * plugin loader and any delegate references.
+ * Resolve this install's runtime and write its shims.
+ *
+ * Amp needs both halves: the permission delegate is a *program* Amp executes
+ * (so it gets the hook shim), while activity auditing is an in-process
+ * plugin Amp's Bun runtime imports (so the loader re-exports the runtime's main
+ * module by absolute path).
  */
-function readPackageVersion() {
-    const pkgPath = path.resolve(__dirname, "..", "..", "package.json");
-    const raw = fs.readFileSync(pkgPath, "utf-8");
-    const parsed = JSON.parse(raw);
-    if (!parsed.version) {
-        throw new Error(`Could not read version from ${pkgPath}`);
-    }
-    return parsed.version;
+function wireAmpRuntime(args) {
+    return (0, argus_1.wireRuntime)({
+        harness: "amp",
+        packageName: PACKAGE_NAME,
+        packageRoot: PACKAGE_ROOT,
+        installCommand: "npx -y -p @ory/amp ory-amp install",
+        args,
+        entryRelPath: path.join("dist", "permission.js"),
+    });
 }
 function getSettingsPath(_args) {
     // Verified: Amp's default settings file is the user-global
@@ -100,23 +105,31 @@ function getSettingsPath(_args) {
  * params on stdin and reads the decision from the exit code.
  *
  * Verified against the binary: a flat top-level `amp.permissions` array of
- * `{ tool, action, to }` entries.
+ * `{ tool, action, to }` entries, and `to` accepts an **absolute path** — its
+ * help text says the helper "must be on $PATH", but a path works and is what
+ * we write. That matters beyond consistency: a bare bin name only resolves
+ * from a shell-initialized PATH, which a GUI-launched Amp does not have.
  */
-function delegateEntry() {
-    return { tool: "*", action: "delegate", to: DELEGATE_BIN };
+function delegateEntry(to) {
+    return { tool: "*", action: "delegate", to };
 }
 function isOryDelegate(entry) {
-    return (typeof entry === "object" &&
-        entry !== null &&
-        entry.action === "delegate" &&
-        entry.to === DELEGATE_BIN);
+    if (typeof entry !== "object" || entry === null)
+        return false;
+    const rec = entry;
+    if (rec.action !== "delegate")
+        return false;
+    const to = typeof rec.to === "string" ? rec.to : "";
+    // Match the shim we write now and the bare bin name earlier releases wrote,
+    // so an install replaces a stale entry instead of leaving both in place.
+    return to === "ory-amp-permission" || /ory-hook-amp\.(js|cjs|mjs)$/.test(to);
 }
-function mergePermissions(existing) {
+function mergePermissions(existing, to) {
     const merged = { ...existing };
     const perms = (Array.isArray(merged["amp.permissions"])
         ? merged["amp.permissions"]
         : []).filter((e) => !isOryDelegate(e));
-    perms.push(delegateEntry());
+    perms.push(delegateEntry(to));
     merged["amp.permissions"] = perms;
     return merged;
 }
@@ -136,14 +149,15 @@ function removePermissions(existing) {
 /**
  * The in-process plugin loader written at `.amp/plugins/ory.ts`. Amp's Bun
  * TypeScript runtime discovers direct `*.ts` files under `.amp/plugins/`, so
- * this re-exports the installed `@ory/amp` package's default-exported plugin
- * factory. Version-pinned in the header so the on-disk loader is traceable to
- * the package the settings were written against.
+ * this re-exports the resolved runtime's default-exported plugin factory by
+ * absolute path — a bare module id would depend on `@ory/amp` being resolvable
+ * from wherever Amp runs.
  */
-function pluginLoaderSource(version) {
-    return (`// Generated by ${PACKAGE_NAME}@${version} — do not edit by hand.\n` +
+function pluginLoaderSource(runtime) {
+    const entry = path.join(runtime.target.packageDir, "dist", "index.js");
+    return (`// Generated by ${PACKAGE_NAME}@${runtime.target.version} — do not edit by hand.\n` +
         `// Re-exports the Ory in-process plugin for Amp's .amp/plugins/ loader.\n` +
-        `export { default } from "${PACKAGE_NAME}";\n`);
+        `export { default } from ${JSON.stringify(entry)};\n`);
 }
 function getPluginFile(args) {
     return path.join(args.projectDir, ".amp", "plugins", PLUGIN_FILE);
@@ -154,9 +168,9 @@ function main() {
         process.exit(0);
     }
     const args = (0, argus_1.parseSetupArgs)();
-    const version = readPackageVersion();
     if (args.print) {
-        console.log(JSON.stringify({ "amp.permissions": [delegateEntry()] }, null, 2));
+        // Nothing is resolved or written on a --print run.
+        console.log(JSON.stringify({ "amp.permissions": [delegateEntry("<resolved runtime shim>")] }, null, 2));
         return;
     }
     const settingsPath = getSettingsPath(args);
@@ -178,18 +192,29 @@ function main() {
         }
         (0, assets_js_1.uninstallAmpOryAssets)(args.projectDir);
         console.log(`Removed Ory skills from ${skillsDir}`);
+        (0, argus_1.removeRuntimeWiring)("amp");
+        for (const pruned of (0, argus_1.pruneRuntimeStores)()) {
+            console.log(`  Removed runtime: ${pruned}`);
+        }
         return;
     }
+    const runtime = wireAmpRuntime(process.argv.slice(2));
+    console.log(runtime.target.kind === "linked"
+        ? `Runtime: linked to ${runtime.target.packageDir} (dev)`
+        : `Runtime: ${runtime.target.packageName}@${runtime.target.version} in ${runtime.target.storeDir}`);
+    for (const pruned of runtime.prunedStores) {
+        console.log(`  Removed stale runtime: ${pruned}`);
+    }
     // (a) Register the permission delegate (blocking gate).
-    const merged = mergePermissions(existing);
+    const merged = mergePermissions(existing, runtime.hookShim);
     (0, argus_1.writeJsonFile)(settingsPath, merged);
-    // (b) Write the in-process plugin loader (auth + tracing).
+    // (b) Write the in-process plugin loader (auth + activity auditing).
     fs.mkdirSync(path.dirname(pluginFile), { recursive: true });
-    fs.writeFileSync(pluginFile, pluginLoaderSource(version));
+    fs.writeFileSync(pluginFile, pluginLoaderSource(runtime));
     // (c) Materialize the Ory skill catalog.
     (0, assets_js_1.installAmpOryAssets)(args.projectDir);
     console.log(`Ory permission delegate registered in ${settingsPath}`);
-    console.log(`  Delegate: ${DELEGATE_BIN} (tool: "*", action: delegate)`);
+    console.log(`  Delegate: ${runtime.hookShim} (tool: "*", action: delegate)`);
     console.log(`Ory in-process plugin written to ${pluginFile}`);
     console.log(`Ory skills installed under ${skillsDir}`);
     (0, argus_1.printNextSteps)("Amp", "npx -y -p @ory/amp ory-amp-setup --uninstall", {
@@ -202,7 +227,10 @@ main();
 // stored Ory credentials. When required by the plugin's main CLI, that
 // command owns the purge, so the `require.main` guard prevents a double run.
 if (require.main === module && process.argv.includes("--uninstall")) {
-    (0, argus_1.clearCredentialsForUninstall)().then(() => process.exit(0), (err) => {
+    (0, argus_1.clearCredentialsForUninstall)({
+        harness: "amp",
+        purge: process.argv.includes("--purge"),
+    }).then(() => process.exit(0), (err) => {
         console.error(err.message ?? err);
         process.exit(1);
     });

package/dist/permission.d.ts

@@ -47,3 +47,19 @@ export declare function extractToolName(input: AmpDelegateInput): string;
  * error resolves to ALLOW.
  */
 export declare function decideToolPermission(input: AmpDelegateInput, client: OryAgentClient): Promise<DelegateDecision>;
+/**
+ * The stdin→exit-code delegate pipeline.
+ *
+ * **Exported on purpose.** This module must stay side-effect-free on import —
+ * tests call `decideToolPermission` directly, and `main()` ends in
+ * `process.exit` — but it also has to run when the generated hook shim loads it
+ * with `require()`. Under `require()` the old `require.main === module` guard was
+ * false (`require.main` is the *shim*), so `main()` never ran, the process exited
+ * 0, and Amp reads exit 0 as **allow** — every tool call passed unchecked, with
+ * no activity event and no log (#217).
+ *
+ * So the entry point is explicit in both directions: the guard below still runs
+ * it when this file *is* the process entry, and the shim calls this export when
+ * it is not. Neither fires on a bare import.
+ */
+export declare function main(): Promise<void>;

package/dist/permission.js

@@ -33,11 +33,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveCheckTimeoutMs = resolveCheckTimeoutMs;
 exports.extractToolName = extractToolName;
 exports.decideToolPermission = decideToolPermission;
+exports.main = main;
 const argus_1 = require("@ory/argus");
 const types_js_1 = require("./types.js");
-function resolveNamespace() {
-    return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
-}
 /**
  * Local deadline for the Ory permission check. Amp treats a delegate that
  * does not exit within 10s as a REJECT, so a hanging backend must be cut
@@ -45,6 +43,16 @@ function resolveNamespace() {
  * default leaves ample headroom inside Amp's 10s window.
  */
 const DEFAULT_CHECK_TIMEOUT_MS = 5000;
+const EVENT_FLUSH_TIMEOUT_MS = 750;
+let entrypointClient;
+async function flushEvents() {
+    try {
+        await entrypointClient?.flushEvents(EVENT_FLUSH_TIMEOUT_MS);
+    }
+    catch {
+        // The delegate decision must not depend on activity delivery.
+    }
+}
 /** Resolve the check deadline, overridable via ORY_AMP_CHECK_TIMEOUT_MS. */
 function resolveCheckTimeoutMs() {
     const raw = process.env.ORY_AMP_CHECK_TIMEOUT_MS;
@@ -93,96 +101,39 @@ function extractSessionId(input) {
 async function decideToolPermission(input, client) {
     const toolName = extractToolName(input);
     const sessionId = extractSessionId(input);
-    client.tracer.setContext({
-        traceId: (0, argus_1.deriveTraceId)(sessionId ?? toolName),
-        sessionId,
-    });
-    client.logger.info("delegate.received", { toolName, sessionId });
-    // Audit-only mode: never block, just record the invocation.
-    if ((0, argus_1.resolveConfig)().auditOnly) {
-        client.tracer.record("tool.invoke", "ok", {
-            attributes: { toolName, mode: "audit-only" },
-        });
-        return { exitCode: types_js_1.AMP_DELEGATE_EXIT.ALLOW };
-    }
-    const subject = (0, argus_1.resolveUserSubject)(client, sessionId ? `session:${sessionId}` : undefined);
-    const subjectId = (0, argus_1.subjectLabel)(subject);
-    try {
-        // Race against a local deadline: core's checkPermission has no HTTP
-        // timeout, and Amp treats a delegate that outlives its 10s window as
-        // a reject — a hanging backend must fail OPEN, not closed.
-        const timeoutMs = resolveCheckTimeoutMs();
-        const raced = await raceCheckDeadline((0, argus_1.gateToolCall)(client, {
-            harness: "amp",
-            toolName,
-            check: {
-                namespace: resolveNamespace(),
-                object: toolName,
-                relation: "use",
-                ...subject,
-            },
-            spanAttributes: { toolName },
-        }), timeoutMs);
-        if (raced === CHECK_TIMED_OUT) {
-            process.stderr.write(`[ory-agent] permission check for "${toolName}" timed out after ${timeoutMs}ms; allowing (fail-open)\n`);
-            client.logger.warn("delegate.check_timeout", { toolName, timeoutMs });
-            return { exitCode: types_js_1.AMP_DELEGATE_EXIT.ALLOW };
-        }
-        const outcome = raced;
-        // Interactive tools (operator-extensible via ORY_INTERACTIVE_TOOLS):
-        // the user.interaction span is already recorded; allow so Amp can
-        // surface the prompt to the user.
-        if (outcome.kind === "interactive") {
-            return { exitCode: types_js_1.AMP_DELEGATE_EXIT.ALLOW };
-        }
-        const decision = outcome;
-        const attrs = { toolName };
-        const decisionAttrs = decision.spanAttributes;
-        if (decision.kind === "fail_open") {
-            // network_error / rate_limited / unknown → allow.
-            client.logger.warn("delegate.fail_open", {
+    return (0, argus_1.withHookContext)(client, { sessionId }, async () => {
+        client.logger.info("delegate.received", { toolName, sessionId });
+        try {
+            // Amp rejects delegates that exceed ten seconds, so retain a shorter
+            // local deadline that turns a hanging backend into an allow.
+            const timeoutMs = resolveCheckTimeoutMs();
+            const raced = await raceCheckDeadline((0, argus_1.gate)(client, {
+                harness: "amp",
                 toolName,
-                code: decision.error.code,
-                message: "Ory unreachable or errored, failing open",
-            });
-            return { exitCode: types_js_1.AMP_DELEGATE_EXIT.ALLOW };
-        }
-        if (decision.kind === "allow") {
-            client.tracer.record("tool.invoke", "ok", {
-                attributes: { ...attrs, ...decisionAttrs, allowed: true },
-            });
-            return { exitCode: types_js_1.AMP_DELEGATE_EXIT.ALLOW };
+                toolArgs: input.input ?? input.params ?? input.arguments ?? input.args,
+                subjectFallback: sessionId ? `session:${sessionId}` : undefined,
+                canBlock: true,
+            }), timeoutMs);
+            if (raced === CHECK_TIMED_OUT) {
+                process.stderr.write(`[ory-agent] permission check for "${toolName}" timed out after ${timeoutMs}ms; allowing (fail-open)\n`);
+                client.logger.warn("delegate.check_timeout", { toolName, timeoutMs });
+                return { exitCode: types_js_1.AMP_DELEGATE_EXIT.ALLOW };
+            }
+            return raced.blocked
+                ? {
+                    exitCode: types_js_1.AMP_DELEGATE_EXIT.REJECT,
+                    reason: raced.denialMessage ?? "Tool denied by Ory",
+                }
+                : { exitCode: types_js_1.AMP_DELEGATE_EXIT.ALLOW };
         }
-        if (decision.kind === "observe") {
-            // Observe mode: log the would-be denial but let the tool through.
-            client.tracer.record("tool.block", "denied", {
-                attributes: { ...attrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
-            });
-            client.tracer.record("tool.invoke", "ok", {
-                attributes: { ...attrs, ...decisionAttrs, allowed: false, observed: true },
+        catch (err) {
+            client.logger.error("delegate.error", {
+                toolName,
+                message: err instanceof Error ? err.message : String(err),
             });
             return { exitCode: types_js_1.AMP_DELEGATE_EXIT.ALLOW };
         }
-        // decision.kind === "deny" → enforce mode hard block.
-        client.tracer.record("tool.block", "denied", {
-            attributes: { ...attrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(true) },
-        });
-        const reason = (0, argus_1.formatDenialMessage)({
-            tool: toolName,
-            subjectId,
-            namespace: resolveNamespace(),
-        });
-        client.logger.warn("tool.denied", { toolName, subjectId, message: reason });
-        return { exitCode: types_js_1.AMP_DELEGATE_EXIT.REJECT, reason };
-    }
-    catch (err) {
-        // Fail open on any unexpected error.
-        client.logger.error("delegate.error", {
-            toolName,
-            message: err instanceof Error ? err.message : String(err),
-        });
-        return { exitCode: types_js_1.AMP_DELEGATE_EXIT.ALLOW };
-    }
+    });
 }
 /**
  * Read all of stdin as a string.
@@ -217,8 +168,24 @@ function readStdin() {
         });
     });
 }
+/**
+ * The stdin→exit-code delegate pipeline.
+ *
+ * **Exported on purpose.** This module must stay side-effect-free on import —
+ * tests call `decideToolPermission` directly, and `main()` ends in
+ * `process.exit` — but it also has to run when the generated hook shim loads it
+ * with `require()`. Under `require()` the old `require.main === module` guard was
+ * false (`require.main` is the *shim*), so `main()` never ran, the process exited
+ * 0, and Amp reads exit 0 as **allow** — every tool call passed unchecked, with
+ * no activity event and no log (#217).
+ *
+ * So the entry point is explicit in both directions: the guard below still runs
+ * it when this file *is* the process entry, and the shim calls this export when
+ * it is not. Neither fires on a bare import.
+ */
 async function main() {
     const client = argus_1.OryAgentClient.fromEnv("amp");
+    entrypointClient = client;
     const raw = await readStdin();
     let input;
     try {
@@ -227,7 +194,6 @@ async function main() {
     catch {
         // Parse failure — fail open (allow) rather than wedging the agent.
         client.logger.error("delegate.stdin.parse_failed", { raw: raw.slice(0, 200) });
-        await client.tracer.shutdown();
         process.exit(types_js_1.AMP_DELEGATE_EXIT.ALLOW);
     }
     const { exitCode, reason } = await decideToolPermission(input, client);
@@ -235,17 +201,18 @@ async function main() {
         // stderr is forwarded to the model as the rejection reason.
         process.stderr.write(reason + "\n");
     }
-    await client.tracer.shutdown();
+    await flushEvents();
     process.exit(exitCode);
 }
-// Only run the stdin→exit-code pipeline when invoked as the CLI entry
-// point. Tests import this module to call `decideToolPermission` directly,
-// so guarding here keeps `main()` (and its `process.exit`) from firing on
-// import. `module` exists under CJS output (module: nodenext → CJS).
+// Run when this file IS the process entry (`node …/permission.js`). When the
+// generated shim `require()`s it instead, `require.main` is the shim, so this is
+// false and the shim calls the exported `main` above. Tests import the module and
+// trigger neither. `module` exists under CJS output (module: nodenext → CJS).
 if (require.main === module) {
-    main().catch((err) => {
+    main().catch(async (err) => {
         // Top-level safety net: never block on an unexpected crash.
         process.stderr.write(`[ory-agent] delegate fatal: ${err}\n`);
+        await flushEvents();
         process.exit(types_js_1.AMP_DELEGATE_EXIT.ALLOW);
     });
 }

package/dist/plugin.d.ts

@@ -1,42 +1,9 @@
-/**
- * Amp in-process plugin (SECONDARY: session auth + post-tool tracing).
- *
- * Amp loads a default-exported factory from `.amp/plugins/*.ts` modules and
- * calls it with a `PluginAPI` (the `@ampcode/plugin` contract, Bun runtime).
- * Each handler receives the event payload and a `PluginEventContext`. We
- * subscribe to:
- *
- *   session.start → run the user gate (advisory, allowBlock:false), the
- *                   agent gate, and write the user→agent delegation tuple.
- *   tool.result   → record a `tool.complete` audit span.
- *
- * The BLOCKING permission decision deliberately does NOT live here. Amp's
- * in-process `tool.call` event *can* block (via a `reject-and-continue`
- * result), but we route blocking through the standalone permission delegate
- * helper (`permission.ts`) instead — that gives the same subprocess parity
- * as the other harnesses and keeps the in-process module purely
- * observational. The delegate runs as its own process and decides by exit
- * code; this module only authenticates and traces.
- *
- * Because Amp's `session.start` handler has no return-value channel for
- * blocking, the user login runs in advisory mode (allowBlock:false), like
- * the OpenCode / OpenClaw factory plugins.
- */
-import { OryAgentClient, ensureUserAuthenticated, ensureAgentIdentity } from "@ory/argus";
+import { OryAgentClient, ensureAgentIdentity, ensureUserAuthenticated } from "@ory/argus";
 import type { AmpPlugin } from "./types.js";
 export interface CreateOryPluginDeps {
-    /** Test injection point for the user login flow. */
     userLogin?: typeof ensureUserAuthenticated;
-    /** Test injection point for the agent identity gate. */
     agentGate?: typeof ensureAgentIdentity;
 }
-/**
- * Create the Amp in-process plugin factory.
- *
- * Returns a function matching Amp's `AmpPlugin` contract: it receives the
- * PluginAPI and registers event handlers via `api.on(...)`.
- */
 export declare function createOryPlugin(clientOrConfig?: OryAgentClient | {
     projectUrl: string;
-    apiKey?: string;
 }, deps?: CreateOryPluginDeps): AmpPlugin;

package/dist/plugin.js

@@ -1,181 +1,62 @@
 "use strict";
-/**
- * Amp in-process plugin (SECONDARY: session auth + post-tool tracing).
- *
- * Amp loads a default-exported factory from `.amp/plugins/*.ts` modules and
- * calls it with a `PluginAPI` (the `@ampcode/plugin` contract, Bun runtime).
- * Each handler receives the event payload and a `PluginEventContext`. We
- * subscribe to:
- *
- *   session.start → run the user gate (advisory, allowBlock:false), the
- *                   agent gate, and write the user→agent delegation tuple.
- *   tool.result   → record a `tool.complete` audit span.
- *
- * The BLOCKING permission decision deliberately does NOT live here. Amp's
- * in-process `tool.call` event *can* block (via a `reject-and-continue`
- * result), but we route blocking through the standalone permission delegate
- * helper (`permission.ts`) instead — that gives the same subprocess parity
- * as the other harnesses and keeps the in-process module purely
- * observational. The delegate runs as its own process and decides by exit
- * code; this module only authenticates and traces.
- *
- * Because Amp's `session.start` handler has no return-value channel for
- * blocking, the user login runs in advisory mode (allowBlock:false), like
- * the OpenCode / OpenClaw factory plugins.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createOryPlugin = createOryPlugin;
 const argus_1 = require("@ory/argus");
-/**
- * Create the Amp in-process plugin factory.
- *
- * Returns a function matching Amp's `AmpPlugin` contract: it receives the
- * PluginAPI and registers event handlers via `api.on(...)`.
- */
+const permission_js_1 = require("./permission.js");
+const HARNESS = "amp";
 function createOryPlugin(clientOrConfig, deps = {}) {
     return (api) => {
         const client = clientOrConfig instanceof argus_1.OryAgentClient
             ? clientOrConfig
             : clientOrConfig
-                ? new argus_1.OryAgentClient({ ...clientOrConfig, harness: "amp" })
-                : argus_1.OryAgentClient.fromEnv("amp");
+                ? new argus_1.OryAgentClient({ ...clientOrConfig, harness: HARNESS })
+                : argus_1.OryAgentClient.fromEnv(HARNESS);
         api.on("session.start", createSessionStartHandler(client, deps));
+        api.on("tool.call", createToolCallHandler(client));
         api.on("tool.result", createToolResultHandler(client));
     };
 }
-// ─── session.start ─────────────────────────────────────────────────
 function createSessionStartHandler(client, deps) {
-    return async (event, _ctx) => {
+    return (event, _ctx) => (0, argus_1.withHookContext)(client, { sessionId: event.thread?.id }, async () => {
         const sessionId = event.thread?.id;
         client.logger.info("lifecycle.session_start", { sessionId });
-        client.tracer.setContext({
-            traceId: (0, argus_1.deriveTraceId)(sessionId ?? "amp"),
-            sessionId,
-        });
-        client.tracer.record("session.start", "ok", {
-            attributes: sessionId ? { sessionId } : {},
-        });
-        // Run the user login. Amp's session.start has no block primitive, so
-        // allowBlock is false — the flow emits the user.auth audit span,
-        // refreshes tokens, and may prompt when interactive, but never
-        // prevents the session from starting. When ORY_USER_LOGIN is unset it
-        // is a no-op (mode === "disabled") and we fall through to legacy
-        // logging.
-        const userGate = deps.userLogin ?? argus_1.ensureUserAuthenticated;
-        const decision = await userGate(client, {
+        await (0, argus_1.sessionStart)(client, {
+            harness: HARNESS,
             binName: "ory-amp",
-            harness: "amp",
-            allowBlock: false,
+            userLogin: deps.userLogin,
+            agentGate: deps.agentGate,
         });
-        // Resolve the agent identity (machine credentials). Never blocks;
-        // attaches the agent's bearer token to outgoing Ory API calls.
-        const agentGate = deps.agentGate ?? argus_1.ensureAgentIdentity;
-        await agentGate(client, { projectUrl: (0, argus_1.resolveConfig)().projectUrl, harness: "amp" });
-        // Once both principals are populated, write the user→agent delegation
-        // tuple. Written at most once per install + fail-open: audit-trail data
-        // only.
-        await (0, argus_1.writeUserDelegatesAgent)(client);
-        if (decision.mode !== "disabled") {
-            return;
-        }
-        const resolved = (0, argus_1.resolveConfig)();
-        if (resolved.auditOnly) {
-            client.logger.info("config.audit_only", {
-                message: "Audit-only mode enabled. Auth and permission checks are disabled.",
-            });
-            return;
-        }
-        if (!resolved.projectUrl) {
-            client.logger.warn("config.not_configured", {
-                message: "Ory plugin is not configured. Auth and permission checks are disabled. " +
-                    "Run 'npx ory-amp configure' to connect to an Ory project.",
-            });
-            return;
-        }
-        const sessionToken = process.env.ORY_SESSION_TOKEN;
-        const oauth2Token = process.env.ORY_OAUTH2_TOKEN;
-        if (sessionToken) {
-            await verifySessionToken(client, sessionToken);
-            return;
-        }
-        if (oauth2Token) {
-            await verifyOAuth2Token(client, oauth2Token);
-            return;
-        }
-        client.logger.warn("session.no_credentials", {
-            message: "Neither ORY_SESSION_TOKEN nor ORY_OAUTH2_TOKEN is set. " +
-                "Skipping authentication.",
-        });
-    };
+    });
 }
-async function verifySessionToken(client, token) {
-    try {
-        const session = await client.verifySession(token);
-        if (!session.active) {
-            client.logger.warn("session.inactive", {
-                message: "Ory session is not active. Re-authenticate to enable auth checks.",
-            });
-        }
-    }
-    catch (err) {
-        client.logger.warn("session.verify_failed", {
-            code: isOryError(err) ? err.code : "unknown",
-            message: err instanceof Error ? err.message : String(err),
-        });
-    }
-}
-async function verifyOAuth2Token(client, token) {
-    try {
-        const tokenInfo = await client.introspectToken(token);
-        if (!tokenInfo.active) {
-            client.logger.warn("oauth2.token_inactive", {
-                message: "Ory OAuth2 token is not active. Obtain a new token to enable auth checks.",
-            });
-            return;
-        }
-        client.logger.info("oauth2.session_authenticated", {
-            clientId: tokenInfo.clientId,
-            subject: tokenInfo.subject,
-        });
-    }
-    catch (err) {
-        client.logger.warn("oauth2.introspect_failed", {
-            code: isOryError(err) ? err.code : "unknown",
-            message: err instanceof Error ? err.message : String(err),
-        });
-    }
+function createToolCallHandler(client) {
+    return async (event) => {
+        const decision = await (0, permission_js_1.decideToolPermission)({ tool: event.tool, input: event.input, threadID: event.thread.id }, client);
+        return decision.exitCode >= 2
+            ? { action: "reject-and-continue", message: decision.reason ?? "Tool denied by Ory" }
+            : { action: "allow" };
+    };
 }
-// ─── tool.result ───────────────────────────────────────────────────
 function createToolResultHandler(client) {
-    return async (event, _ctx) => {
+    return (event, _ctx) => (0, argus_1.withHookContext)(client, { sessionId: event.thread?.id }, async () => {
         const toolName = event.tool ?? "unknown";
-        const sessionId = event.thread?.id;
         const hasError = event.status === "error";
-        client.tracer.setContext({
-            traceId: (0, argus_1.deriveTraceId)(sessionId ?? "amp"),
-            sessionId,
-        });
         client.logger.info("lifecycle.tool_result", {
             toolName,
-            sessionId,
+            sessionId: event.thread?.id,
             status: event.status,
             hasError,
         });
-        client.tracer.record("tool.complete", hasError ? "error" : "ok", {
-            attributes: {
-                toolName,
+        if (event.error)
+            client.logger.debug("lifecycle.tool_result.error", { error: event.error });
+        (0, argus_1.complete)(client, {
+            toolName,
+            input: event.input,
+            output: event.output,
+            status: hasError ? "error" : "ok",
+            extraActivityAttributes: {
                 status: event.status,
-                ...(0, argus_1.summarizeToolInput)(toolName, event.input),
-                ...(0, argus_1.summarizeToolOutput)(toolName, event.output),
-                ...(event.error ? { error: event.error } : {}),
+                ...(event.error ? { hasError: true } : {}),
             },
         });
-    };
-}
-// ─── Helpers ───────────────────────────────────────────────────────
-function isOryError(err) {
-    return (typeof err === "object" &&
-        err !== null &&
-        "code" in err &&
-        "message" in err);
+    });
 }

package/dist/types.d.ts

@@ -13,11 +13,11 @@
  *      A 10-second delegate timeout applies (a timed-out delegate is
  *      treated as a reject). See `AmpDelegateInput` below.
  *
- *   2. In-process plugin (SECONDARY, tracing/auth) — a default-exported
+ *   2. In-process plugin (SECONDARY, activity auditing/auth) — a default-exported
  *      factory placed under `.amp/plugins/*.ts` that receives a `PluginAPI`
  *      (the `@ampcode/plugin` contract). Runs under Bun's TypeScript
  *      runtime. Used here ONLY for advisory session-start auth and
- *      post-tool tracing; the blocking decision lives in the delegate
+ *      post-tool activity logging; the blocking decision lives in the delegate
  *      helper for cleaner subprocess parity.
  *
  * We model the `@ampcode/plugin` API surface locally (the plugin package
@@ -133,7 +133,7 @@ export interface AmpAgentEndEvent {
 /**
  * Context (`PluginEventContext`) passed as the SECOND argument to every
  * handler. Carries Amp's UI helpers, a shell runner (`$`), etc. Modeled as
- * an open object — this plugin only authenticates and traces, so it does
+ * an open object — this plugin only authenticates and records activity, so it does
  * not depend on any specific context member.
  */
 export interface AmpPluginEventContext {

package/dist/types.js

@@ -14,11 +14,11 @@
  *      A 10-second delegate timeout applies (a timed-out delegate is
  *      treated as a reject). See `AmpDelegateInput` below.
  *
- *   2. In-process plugin (SECONDARY, tracing/auth) — a default-exported
+ *   2. In-process plugin (SECONDARY, activity auditing/auth) — a default-exported
  *      factory placed under `.amp/plugins/*.ts` that receives a `PluginAPI`
  *      (the `@ampcode/plugin` contract). Runs under Bun's TypeScript
  *      runtime. Used here ONLY for advisory session-start auth and
- *      post-tool tracing; the blocking decision lives in the delegate
+ *      post-tool activity logging; the blocking decision lives in the delegate
  *      helper for cleaner subprocess parity.
  *
  * We model the `@ampcode/plugin` API surface locally (the plugin package

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ory/amp",
-  "version": "0.13.9",
-  "description": "Ory plugin for Amp (Sourcegraph's coding agent): a permission delegate that authorizes every tool call plus an in-process plugin for session auth and audit tracing",
+  "version": "1.0.0",
+  "description": "Ory plugin for Amp (Sourcegraph's coding agent): a permission delegate that authorizes every tool call plus an in-process plugin for session auth and activity auditing",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
   "keywords": [
@@ -36,8 +36,7 @@
     "agent-security",
     "guardrails",
     "llm",
-    "tracing",
-    "distributed-tracing",
+    "activity-auditing",
     "observability",
     "kratos",
     "keto",
@@ -48,6 +47,10 @@
     "registry": "https://registry.npmjs.org/",
     "provenance": true
   },
+  "reova": {
+    "enabled": true,
+    "endpoint": "https://telemetry.reo.dev/data"
+  },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
@@ -63,12 +66,11 @@
   },
   "files": [
     "dist",
-    "!dist/dev",
     "!dist/**/*.tsbuildinfo"
   ],
   "dependencies": {
-    "reo-census": "^1.2.8",
-    "@ory/argus": "0.13.9"
+    "reova": "^0.7.0",
+    "@ory/argus": "1.0.0"
   },
   "devDependencies": {
     "typescript": "^6.0.2",
@@ -82,7 +84,6 @@
     "clean": "rm -rf dist *.tsbuildinfo",
     "test": "vitest run",
     "test:watch": "vitest",
-    "typecheck": "tsc --noEmit",
-    "dev": "node dist/dev/launcher.js"
+    "typecheck": "tsc --noEmit"
   }
 }