@ory/amp 1.6.0 → 1.7.0

package/dist/permission.d.ts

@@ -17,13 +17,14 @@
  *
  * TIMEOUT: Amp enforces a 10-second delegate timeout. A delegate that does
  * not exit within 10s is treated as a reject, so a hanging Ory backend
- * would otherwise surface as a block. To keep infra failures fail-open,
+ * would otherwise surface as a block. To return a clear reason,
  * the permission check below is raced against a local deadline (default
  * 5000ms, override via ORY_AMP_CHECK_TIMEOUT_MS); on timeout the delegate
- * logs a warning to stderr and allows (exit 0), well inside Amp's window.
+ * rejects with a reason, well inside Amp's window. At that point the gate may
+ * not have resolved the applicable posture, so it conservatively blocks.
  *
- * Fail-open: any error — parse failure, network error, rate limit, crash —
- * resolves to exit 0 (allow). The delegate must never wedge the agent.
+ * Parse and unexpected delegate errors remain best-effort. Classified permission
+ * failures are handled by the shared gate and deny in enforce mode.
  *
  * Verified against the installed `amp` binary (delegate exit-code contract
  * and 10s timeout).

package/dist/permission.js

@@ -18,13 +18,14 @@
  *
  * TIMEOUT: Amp enforces a 10-second delegate timeout. A delegate that does
  * not exit within 10s is treated as a reject, so a hanging Ory backend
- * would otherwise surface as a block. To keep infra failures fail-open,
+ * would otherwise surface as a block. To return a clear reason,
  * the permission check below is raced against a local deadline (default
  * 5000ms, override via ORY_AMP_CHECK_TIMEOUT_MS); on timeout the delegate
- * logs a warning to stderr and allows (exit 0), well inside Amp's window.
+ * rejects with a reason, well inside Amp's window. At that point the gate may
+ * not have resolved the applicable posture, so it conservatively blocks.
  *
- * Fail-open: any error — parse failure, network error, rate limit, crash —
- * resolves to exit 0 (allow). The delegate must never wedge the agent.
+ * Parse and unexpected delegate errors remain best-effort. Classified permission
+ * failures are handled by the shared gate and deny in enforce mode.
  *
  * Verified against the installed `amp` binary (delegate exit-code contract
  * and 10s timeout).
@@ -39,7 +40,7 @@ const types_js_1 = require("./types.js");
 /**
  * Local deadline for the Ory permission check. Amp treats a delegate that
  * does not exit within 10s as a REJECT, so a hanging backend must be cut
- * off locally and resolved as allow (fail-open for infra failures). The
+ * off locally and resolved as a denial when posture is unknown. The
  * default leaves ample headroom inside Amp's 10s window.
  */
 const DEFAULT_CHECK_TIMEOUT_MS = 5000;
@@ -105,7 +106,7 @@ async function decideToolPermission(input, client) {
         client.logger.info("delegate.received", { toolName, sessionId });
         try {
             // Amp rejects delegates that exceed ten seconds, so retain a shorter
-            // local deadline that turns a hanging backend into an allow.
+            // local deadline so a hanging backend produces an explicit decision.
             const timeoutMs = resolveCheckTimeoutMs();
             const raced = await raceCheckDeadline((0, argus_1.gate)(client, {
                 harness: "amp",
@@ -118,9 +119,9 @@ async function decideToolPermission(input, client) {
                 mcpTool: (0, argus_1.parseMcpToolName)(toolName) ?? undefined,
             }), timeoutMs);
             if (raced === CHECK_TIMED_OUT) {
-                process.stderr.write(`[ory-agent] permission check for "${toolName}" timed out after ${timeoutMs}ms; allowing (fail-open)\n`);
+                process.stderr.write(`[ory-agent] permission check for "${toolName}" timed out after ${timeoutMs}ms; blocking because posture is unknown\n`);
                 client.logger.warn("delegate.check_timeout", { toolName, timeoutMs });
-                return { exitCode: types_js_1.AMP_DELEGATE_EXIT.ALLOW };
+                return { exitCode: types_js_1.AMP_DELEGATE_EXIT.REJECT, reason: "Ory permission check timed out; retry when Agent Security is available." };
             }
             return raced.blocked
                 ? {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/amp",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "Ory plugin for Amp (Sourcegraph's coding agent): a permission delegate that authorizes every tool call plus an in-process plugin for session auth and activity auditing",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -70,7 +70,7 @@
   ],
   "dependencies": {
     "reova": "^0.7.0",
-    "@ory/argus": "1.6.0"
+    "@ory/argus": "1.7.0"
   },
   "devDependencies": {
     "typescript": "^7.0.2"