@ory/antigravity 0.10.0

package/dist/cli/main.js

@@ -0,0 +1,214 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * Main CLI for @ory/antigravity.
+ *
+ * Usage:
+ *   npx ory-antigravity install              Install the Ory plugin into Antigravity
+ *   npx ory-antigravity uninstall            Remove the plugin
+ *   npx ory-antigravity configure            Set or view Ory credentials
+ *   npx ory-antigravity setup [--project-dir]  Write the bundle into .agents (fallback)
+ *   npx ory-antigravity status               Show plugin status
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const path = __importStar(require("node:path"));
+const fs = __importStar(require("node:fs"));
+const node_child_process_1 = require("node:child_process");
+const argus_1 = require("@ory/argus");
+const assets_js_1 = require("./assets.js");
+/** Bundle dir handed to `agy plugin install`. */
+const BUNDLE_DIR = path.resolve(__dirname, "..", "..", "antigravity-plugin");
+const PACKAGE_ROOT = path.resolve(__dirname, "..", "..");
+/** Antigravity CLI binary name. */
+const AGY = "agy";
+/** On Windows, npm-installed CLIs are `.cmd` shims found only via the shell. */
+const SPAWN_VIA_SHELL = process.platform === "win32";
+function agyAvailable() {
+    return ((0, node_child_process_1.spawnSync)(AGY, ["--version"], { stdio: "pipe", shell: SPAWN_VIA_SHELL }).status === 0);
+}
+function main() {
+    const [command, ...args] = process.argv.slice(2);
+    switch (command) {
+        case "install":
+            install(args);
+            postInstallPermissions("ory-antigravity", "antigravity").then(() => process.exit(0), (err) => {
+                console.error(err.message ?? err);
+                process.exit(1);
+            });
+            break;
+        case "uninstall":
+            uninstall(args);
+            break;
+        case "configure":
+            (0, argus_1.runConfigureCommand)("ory-antigravity", args);
+            break;
+        case "agent":
+            (0, argus_1.runAgentCommand)("ory-antigravity", args).then((code) => process.exit(code), (err) => {
+                console.error(err.message ?? err);
+                process.exit(1);
+            });
+            break;
+        case "permissions":
+            (0, argus_1.runPermissionsCommand)("ory-antigravity", "antigravity", args).then((code) => process.exit(code), (err) => {
+                console.error(err.message ?? err);
+                process.exit(1);
+            });
+            break;
+        case "setup":
+            require("./setup.js");
+            break;
+        case "status":
+            status().then(() => process.exit(0), (err) => {
+                console.error(err.message ?? err);
+                process.exit(1);
+            });
+            break;
+        case "local":
+            (0, argus_1.runLocalCommand)("ory-antigravity", args).catch((err) => {
+                console.error(err.message ?? err);
+                process.exit(1);
+            });
+            break;
+        case "help":
+        case "--help":
+        case "-h":
+        case undefined:
+            help();
+            break;
+        default:
+            console.error(`Unknown command: ${command}`);
+            help();
+            process.exit(1);
+    }
+}
+function install(args) {
+    // Materialize the bundle (plugin.json + hooks.json + mcp_config.json +
+    // skills + commands) before handing it to `agy plugin install`.
+    console.log("Materializing the Ory plugin bundle...");
+    (0, assets_js_1.installAntigravityOryAssets)(BUNDLE_DIR);
+    if (agyAvailable()) {
+        console.log("Installing Ory plugin into Antigravity...");
+        const result = (0, node_child_process_1.spawnSync)(AGY, ["plugin", "install", BUNDLE_DIR], {
+            stdio: "inherit",
+            shell: SPAWN_VIA_SHELL,
+        });
+        if (result.status === 0) {
+            console.log("");
+            console.log("Ory plugin installed.");
+            printQuickstart();
+            (0, argus_1.printEnvHelp)("ory-antigravity");
+            return;
+        }
+        console.error("");
+        console.error("`agy plugin install` failed. Falling back to manual setup...");
+    }
+    else {
+        console.log("Antigravity CLI (agy) not found on PATH. Using manual setup...");
+    }
+    manualSetup(args);
+}
+function uninstall(args) {
+    if (agyAvailable()) {
+        console.log("Uninstalling Ory plugin from Antigravity...");
+        const result = (0, node_child_process_1.spawnSync)(AGY, ["plugin", "uninstall", "ory"], {
+            stdio: "inherit",
+            shell: SPAWN_VIA_SHELL,
+        });
+        if (result.status === 0)
+            return;
+        console.error("`agy plugin uninstall` failed. Falling back to manual removal...");
+    }
+    process.argv = ["node", "setup.js", "--uninstall", ...args];
+    require("./setup.js");
+}
+function manualSetup(args) {
+    process.argv = ["node", "setup.js", ...args];
+    require("./setup.js");
+}
+async function postInstallPermissions(binName, harness) {
+    const bootstrapped = await (0, argus_1.maybeAutoBootstrap)(binName, harness);
+    (0, argus_1.printPermissionsOnboardingHelp)(binName, harness, {
+        bootstrappedAutomatically: bootstrapped,
+    });
+}
+function printQuickstart() {
+    console.log("");
+    console.log("Quickstart:");
+    console.log("  1. Inside Antigravity, run /ory:local-up to start a local Ory stack.");
+    console.log('  2. Ask Antigravity "add Ory auth to this app" to scaffold login/signup.');
+    console.log("  3. Set ORY_USER_LOGIN=true to enable the interactive PKCE browser login.");
+}
+async function status() {
+    await (0, argus_1.runStatusCommand)("ory-antigravity", "antigravity", {
+        title: "Google Antigravity",
+        printPluginSection: () => {
+            console.log("Plugin bundle:");
+            console.log(`  Directory:   ${BUNDLE_DIR}`);
+            console.log(`  Manifest:    ${fs.existsSync(path.join(BUNDLE_DIR, "plugin.json")) ? "found" : "MISSING"}`);
+            console.log(`  Hook script: ${fs.existsSync(path.join(PACKAGE_ROOT, "dist", "hook.js")) ? "built" : "NOT BUILT (run pnpm build)"}`);
+            console.log(`  agy CLI:     ${agyAvailable() ? "found" : "not on PATH"}`);
+        },
+    });
+}
+function help() {
+    console.log(`
+ory-antigravity — Ory plugin for Google Antigravity
+
+Usage:
+  npx ory-antigravity <command> [options]
+
+Commands:
+  install                Install the Ory plugin into Antigravity (agy plugin install)
+  uninstall              Remove the Ory plugin from Antigravity
+  configure              Set or view Ory project URL and credentials
+  agent <cmd>            Manage the agent's OAuth2 (DCR) identity (status, unregister)
+  permissions <cmd>      Manage permission mode and tool permissions (status, bootstrap, observe, enforce)
+  setup [--project-dir]  Write the plugin bundle into .agents directly (fallback)
+  status                 Show plugin status and configuration
+  local <cmd>            Manage local Ory dev environment (up, down, status, seed, ...)
+
+After installing, the plugin hooks into these Antigravity lifecycle events:
+  SessionStart           Verify the user and agent identities via Ory
+  PreToolUse             Check tool permissions via Ory Permissions
+  PostToolUse            Audit log tool executions
+
+Examples:
+  npx ory-antigravity install       # Install plugin
+  npx ory-antigravity status        # Check configuration
+  npx ory-antigravity uninstall     # Remove plugin
+`);
+}
+main();

package/dist/cli/setup.d.ts

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+/**
+ * Setup CLI for the Ory Google Antigravity plugin (manual fallback).
+ *
+ * When the `agy` CLI isn't available to register the plugin natively,
+ * this writes the Ory plugin bundle directly into the workspace's
+ * `.agents/` directory — the verified workspace location Antigravity
+ * reads hooks, MCP config, skills, and commands from.
+ *
+ * Usage:
+ *   npx ory-antigravity-setup                    # write into ./.agents
+ *   npx ory-antigravity-setup --project-dir /repo
+ *   npx ory-antigravity-setup --print            # print bundle paths, don't write
+ *   npx ory-antigravity-setup --uninstall        # remove Ory bundle files
+ */
+export {};

package/dist/cli/setup.js

@@ -0,0 +1,83 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * Setup CLI for the Ory Google Antigravity plugin (manual fallback).
+ *
+ * When the `agy` CLI isn't available to register the plugin natively,
+ * this writes the Ory plugin bundle directly into the workspace's
+ * `.agents/` directory — the verified workspace location Antigravity
+ * reads hooks, MCP config, skills, and commands from.
+ *
+ * Usage:
+ *   npx ory-antigravity-setup                    # write into ./.agents
+ *   npx ory-antigravity-setup --project-dir /repo
+ *   npx ory-antigravity-setup --print            # print bundle paths, don't write
+ *   npx ory-antigravity-setup --uninstall        # remove Ory bundle files
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const argus_1 = require("@ory/argus");
+const assets_js_1 = require("./assets.js");
+function getAgentsDir(args) {
+    return path.join(args.projectDir, ".agents");
+}
+function main() {
+    if (process.argv.includes("--help") || process.argv.includes("-h")) {
+        (0, argus_1.printSetupHelp)("ory-antigravity-setup", "Google Antigravity");
+        process.exit(0);
+    }
+    const args = (0, argus_1.parseSetupArgs)();
+    const agentsDir = getAgentsDir(args);
+    if (args.print) {
+        console.log(`Would write the Ory plugin bundle to ${agentsDir}:`);
+        console.log("  plugin.json, hooks.json, mcp_config.json, skills/, commands/ory/");
+        return;
+    }
+    if (args.uninstall) {
+        if (!fs.existsSync(agentsDir)) {
+            console.log("No .agents directory found. Nothing to uninstall.");
+            return;
+        }
+        (0, assets_js_1.uninstallAntigravityOryAssets)(agentsDir);
+        console.log(`Removed Ory plugin bundle from ${agentsDir}`);
+        return;
+    }
+    (0, assets_js_1.installAntigravityOryAssets)(agentsDir);
+    console.log(`Ory plugin bundle installed to ${agentsDir}`);
+    (0, argus_1.printNextSteps)("Google Antigravity", "npx ory-antigravity-setup --uninstall");
+}
+main();

package/dist/handlers.d.ts

@@ -0,0 +1,16 @@
+import { OryAgentClient, ensureUserAuthenticated, ensureAgentIdentity } from "@ory/argus";
+import type { AntigravityHookInput, AntigravityHookOutput } from "./types.js";
+export interface HandleHookEventDeps {
+    /** Test injection point for the user login flow. */
+    userLogin?: typeof ensureUserAuthenticated;
+    /** Test injection point for the agent identity gate. */
+    agentGate?: typeof ensureAgentIdentity;
+}
+/**
+ * Route an Antigravity hook event to the appropriate Ory integration.
+ *
+ * Note: on `PreToolUse` the returned output ALWAYS sets `allow_tool`
+ * explicitly — Antigravity blocks the tool otherwise. All other events
+ * return `ALLOW` (harmless) or an empty/system-message output.
+ */
+export declare function handleHookEvent(input: AntigravityHookInput, client: OryAgentClient, deps?: HandleHookEventDeps): Promise<AntigravityHookOutput>;

package/dist/handlers.js

@@ -0,0 +1,321 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleHookEvent = handleHookEvent;
+const argus_1 = require("@ory/argus");
+const HARNESS = "antigravity";
+/** Allow a tool through (fail-closed harness ⇒ always be explicit). */
+const ALLOW = { allow_tool: true };
+/**
+ * Route an Antigravity hook event to the appropriate Ory integration.
+ *
+ * Note: on `PreToolUse` the returned output ALWAYS sets `allow_tool`
+ * explicitly — Antigravity blocks the tool otherwise. All other events
+ * return `ALLOW` (harmless) or an empty/system-message output.
+ */
+async function handleHookEvent(input, client, deps = {}) {
+    const event = input.hook_event_name;
+    client.logger.debug("hook.received", {
+        event,
+        sessionId: input.session_id,
+        toolName: input.tool_name,
+    });
+    client.tracer.setContext({
+        traceId: (0, argus_1.deriveTraceId)(input.session_id),
+        sessionId: input.session_id,
+    });
+    try {
+        switch (event) {
+            case "SessionStart":
+                return await handleSessionStart(input, client, deps);
+            case "PreToolUse":
+                return await handlePreToolUse(input, client);
+            case "PostToolUse":
+                return await handlePostToolUse(input, client);
+            case "Notification":
+                return handleNotification(input, client);
+            case "Stop":
+            case "SessionEnd":
+                return handleSessionEnd(input, client);
+            default:
+                client.logger.debug("hook.passthrough", { event });
+                client.tracer.record("hook.passthrough", "skipped", {
+                    attributes: { event },
+                });
+                return ALLOW;
+        }
+    }
+    finally {
+        client.tracer.clearContext();
+    }
+}
+// ─── SessionStart ───────────────────────────────────────────────────
+async function handleSessionStart(input, client, deps) {
+    client.logger.info("lifecycle.session_start", {
+        sessionId: input.session_id,
+        model: input.model,
+        source: input.source,
+    });
+    client.tracer.record("session.start", "ok", {
+        attributes: { model: input.model, source: input.source },
+    });
+    // User login (interactive PKCE / token refresh). Advisory on
+    // Antigravity: SessionStart has no verified hard-block channel
+    // (`allow_tool` only governs PreToolUse), so allowBlock is false — the
+    // gate runs, refreshes tokens, and emits the audit span, but the
+    // session always proceeds. Tool-call enforcement is unaffected.
+    const userGate = deps.userLogin ?? argus_1.ensureUserAuthenticated;
+    const decision = await userGate(client, {
+        binName: "ory-antigravity",
+        harness: HARNESS,
+        allowBlock: false,
+    });
+    // Resolve the agent identity regardless of how user auth went — never
+    // blocks; attaches the agent's bearer token to outgoing Ory calls.
+    const agentGate = deps.agentGate ?? argus_1.ensureAgentIdentity;
+    await agentGate(client, { projectUrl: (0, argus_1.resolveConfig)().projectUrl, harness: HARNESS });
+    // Record the user→agent delegation (audit-trail only; fail-open).
+    await recordUserDelegatesAgent(client);
+    if (decision.mode !== "disabled") {
+        return {};
+    }
+    // Legacy fallthrough: honor pre-supplied tokens for backward compat.
+    const resolved = (0, argus_1.resolveConfig)();
+    if (resolved.auditOnly || !resolved.projectUrl) {
+        return {};
+    }
+    const sessionToken = process.env.ORY_SESSION_TOKEN;
+    const oauth2Token = process.env.ORY_OAUTH2_TOKEN;
+    if (sessionToken) {
+        await verifySessionToken(sessionToken, client);
+    }
+    else if (oauth2Token) {
+        await verifyOAuth2Token(oauth2Token, client);
+    }
+    else {
+        client.logger.warn("session.no_credentials", {
+            message: "No user login enabled and neither ORY_SESSION_TOKEN nor " +
+                "ORY_OAUTH2_TOKEN is set. Skipping authentication.",
+        });
+    }
+    return {};
+}
+async function verifySessionToken(token, client) {
+    try {
+        const session = await client.verifySession(token);
+        if (!session.active) {
+            client.logger.warn("session.inactive", {
+                message: "Ory session is not active. Re-authenticate to enable auth checks.",
+            });
+        }
+    }
+    catch (err) {
+        const oryErr = err;
+        client.logger.warn("session.verify_failed", {
+            code: oryErr.code,
+            message: oryErr.message,
+        });
+    }
+}
+async function verifyOAuth2Token(token, client) {
+    try {
+        const tokenInfo = await client.introspectToken(token);
+        if (!tokenInfo.active) {
+            client.logger.warn("oauth2.token_inactive", {
+                message: "Ory OAuth2 token is not active.",
+            });
+            return;
+        }
+        client.logger.info("oauth2.session_authenticated", {
+            clientId: tokenInfo.clientId,
+            subject: tokenInfo.subject,
+            scope: tokenInfo.scope,
+        });
+    }
+    catch (err) {
+        const oryErr = err;
+        client.logger.warn("oauth2.introspect_failed", {
+            code: oryErr.code,
+            message: oryErr.message,
+        });
+    }
+}
+// ─── PreToolUse ─────────────────────────────────────────────────────
+async function handlePreToolUse(input, client) {
+    const toolName = input.tool_name ?? "unknown";
+    client.logger.info("lifecycle.pre_tool_use", {
+        sessionId: input.session_id,
+        toolName,
+        toolInput: input.tool_input,
+    });
+    const inputSummary = (0, argus_1.summarizeToolInput)(toolName, input.tool_input);
+    // Audit-only mode: log the invocation, skip the permission check, allow.
+    if ((0, argus_1.resolveConfig)().auditOnly) {
+        client.tracer.record("tool.invoke", "ok", {
+            attributes: { toolName, ...inputSummary },
+        });
+        return ALLOW;
+    }
+    const subject = (0, argus_1.resolveUserSubject)(client, `session:${input.session_id}`);
+    const subjectId = (0, argus_1.subjectLabel)(subject);
+    const namespace = resolveNamespace();
+    try {
+        const outcome = await (0, argus_1.gateToolCall)(client, {
+            harness: HARNESS,
+            toolName,
+            check: { namespace, object: toolName, relation: "use", ...subject },
+            spanAttributes: { toolName },
+        });
+        // Interactive tools surface UI to the user; gateToolCall already
+        // recorded the user.interaction span. Let the harness prompt.
+        if (outcome.kind === "interactive") {
+            return ALLOW;
+        }
+        if (outcome.kind === "fail_open") {
+            return failOpen(outcome.error, toolName, client);
+        }
+        const attrs = { toolName, ...inputSummary };
+        const decisionAttrs = outcome.spanAttributes;
+        if (outcome.kind === "allow") {
+            client.tracer.record("tool.invoke", "ok", {
+                attributes: { ...attrs, ...decisionAttrs, allowed: true },
+            });
+            return ALLOW;
+        }
+        if (outcome.kind === "observe") {
+            client.tracer.record("tool.block", "denied", {
+                attributes: { ...attrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
+            });
+            client.tracer.record("tool.invoke", "ok", {
+                attributes: { ...attrs, ...decisionAttrs, allowed: false, observed: true },
+            });
+            return ALLOW;
+        }
+        // deny → block the tool (enforce mode).
+        client.tracer.record("tool.block", "denied", {
+            attributes: { ...attrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(true) },
+        });
+        return {
+            allow_tool: false,
+            deny_reason: (0, argus_1.formatDenialMessage)({ tool: toolName, subjectId, namespace }),
+        };
+    }
+    catch (err) {
+        return failOpen(err, toolName, client);
+    }
+}
+// ─── PostToolUse ────────────────────────────────────────────────────
+async function handlePostToolUse(input, client) {
+    const toolName = input.tool_name ?? "unknown";
+    client.logger.info("lifecycle.post_tool_use", {
+        sessionId: input.session_id,
+        toolName,
+    });
+    const failed = input.tool_error !== undefined && input.tool_error !== null;
+    if (failed) {
+        client.tracer.record("tool.fail", "error", {
+            attributes: {
+                toolName,
+                toolError: typeof input.tool_error === "string"
+                    ? input.tool_error.slice(0, 500)
+                    : "[object]",
+                ...(0, argus_1.summarizeToolInput)(toolName, input.tool_input),
+            },
+        });
+        return {};
+    }
+    client.tracer.record("tool.complete", "ok", {
+        attributes: {
+            toolName,
+            ...(0, argus_1.summarizeToolInput)(toolName, input.tool_input),
+            ...(0, argus_1.summarizeToolOutput)(toolName, input.tool_response),
+        },
+    });
+    return {};
+}
+// PreInvocation / PostInvocation bracket each agent turn (not user
+// prompts). We don't model them specially — they fall through to the
+// default `hook.passthrough` audit span in handleHookEvent.
+// ─── Notification ───────────────────────────────────────────────────
+function handleNotification(input, client) {
+    client.logger.info("lifecycle.notification", {
+        sessionId: input.session_id,
+        messageLen: input.message?.length,
+    });
+    client.tracer.record("user.interaction", "ok", {
+        attributes: { harness: HARNESS, kind: "notification" },
+    });
+    return {};
+}
+// ─── Stop / SessionEnd ──────────────────────────────────────────────
+function handleSessionEnd(input, client) {
+    client.logger.info("lifecycle.session_end", {
+        sessionId: input.session_id,
+        reason: input.reason,
+    });
+    client.tracer.record("session.end", "ok", {
+        attributes: { reason: input.reason },
+    });
+    return {};
+}
+// ─── Helpers ────────────────────────────────────────────────────────
+function resolveNamespace() {
+    return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
+}
+/**
+ * Write the user→agent delegation tuple. Idempotent and fail-open:
+ * needs both principal subjects; any error is logged and swallowed.
+ */
+async function recordUserDelegatesAgent(client) {
+    const user = client.userPrincipal.subject;
+    const agent = client.agentPrincipal.subject;
+    if (!user || !agent) {
+        client.logger.debug("delegation.skip", {
+            reason: "missing principal",
+            hasUser: !!user,
+            hasAgent: !!agent,
+        });
+        return;
+    }
+    try {
+        await client.createRelationship({
+            namespace: resolveNamespace(),
+            object: `agent:${agent}`,
+            relation: "delegate",
+            subjectId: `user:${user}`,
+        }, { spanAttributes: { delegation: "user-to-agent" } });
+    }
+    catch (err) {
+        const oryErr = err;
+        client.logger.warn("delegation.user_to_agent.failed", {
+            code: oryErr.code,
+            message: oryErr.message,
+        });
+    }
+}
+/**
+ * Fail-open on a permission-check error: log and allow the tool. Critical
+ * on Antigravity — returning anything other than `allow_tool: true` here
+ * would block the user on a transient Ory/network blip.
+ */
+function failOpen(oryErr, toolName, client) {
+    if (oryErr.code === "network_error") {
+        client.logger.warn("permission.network_error", {
+            toolName,
+            message: "Ory unreachable, failing open",
+        });
+    }
+    else if (oryErr.code === "rate_limited") {
+        client.logger.warn("permission.rate_limited", {
+            toolName,
+            message: "Ory rate limited, failing open",
+        });
+    }
+    else {
+        client.logger.error("permission.check.error", {
+            toolName,
+            code: oryErr.code,
+            message: oryErr.message,
+        });
+    }
+    return ALLOW;
+}

package/dist/hook.d.ts

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+/**
+ * Google Antigravity hook entry point.
+ *
+ * Antigravity invokes this script as a subprocess for each hook event.
+ *   Input:  JSON on stdin.
+ *   Output: JSON on stdout.
+ *
+ * FAIL-CLOSED CONTRACT (the reason this differs from every other plugin):
+ * on a `PreToolUse` event, Antigravity blocks the tool unless the hook
+ * returns `{"allow_tool": true}`. A crash, a timeout, malformed output, or
+ * a non-zero exit are all treated as "block". To preserve this repo's
+ * fail-open guarantee, EVERY error path here emits `{"allow_tool": true}`
+ * and exits 0 — a transient Ory/network failure must never wedge the
+ * user's tools. Emitting `allow_tool` on non-tool events is harmless
+ * (the harness ignores it), so the safe default works for all events.
+ */
+export {};