@ory/antigravity 0.14.0 → 1.0.1

package/README.md

@@ -2,9 +2,12 @@
 
 Security and developer experience for [Google Antigravity](https://antigravity.google), powered by [Ory](https://ory.com).
 
-**Security.** Antigravity runs real actions on your machine — editing files, running shell commands, calling APIs. The plugin gives every session a verifiable identity (you sign in once; Antigravity and any sub-agents it spawns each get their own), checks every tool call against permissions you control, and records each decision as an audit trace you can ship to your observability stack. It starts in watch mode so nothing is blocked on day one, and if Ory is ever unreachable it steps aside rather than locking you out.
+Antigravity runs real actions on your machine — editing files, running shell commands, calling APIs. This plugin gives those actions an identity, a permission check, and an audit trail.
 
-**Developer experience.** A single command installs the plugin and walks you through connecting — choose Ory Network, a local Docker stack, or audit-only, and it wires up the project, sign-in client, login, and permissions for you. It also helps you build Ory into your own app: ask in plain language to scaffold login, registration, and recovery pages, run a local Ory, or manage identities and permissions through the bundled MCP server.
+One command installs two independent halves:
+
+- **Developer experience** — the Ory skill catalog, `/ory:` slash commands, the local Ory dev stack, an MCP server, and activity logging. No account, no keys, nothing to configure: it works the moment it's installed.
+- **Ory Agent Security** — browser sign-in, brokered permission checks before tool calls, and the delegation trail. Opt-in connection details from the [Ory Console](https://console.ory.sh) switch it on, and it takes nothing away from the half above. See [Connect to Ory Agent Security](#connect-to-ory-agent-security).
 
 > **Antigravity is the successor to Gemini CLI.** If you used the Ory Gemini CLI extension, this is its counterpart for the `agy` CLI and the Antigravity IDE. Your existing skills and commands carry over.
 
@@ -17,29 +20,19 @@ Security and developer experience for [Google Antigravity](https://antigravity.g
 
 ## Get started
 
-Run one command. It installs the plugin (registering it with Antigravity via `agy plugin install`) and walks you through connecting:
+Run one command It installs the plugin, registering it with Antigravity via `agy plugin install`:
 
 ```bash
 npx -y -p @ory/antigravity ory-agy install
 ```
 
-It opens a guided setup **in your browser** where you pick how to connect — the default takes just a click:
-
-- **Ory Network** *(default)* — sign in, or create a free account, in your browser. The project, keys, permissions, and login are all set up for you. Nothing to configure by hand.
-- **Local** — run a complete Ory on your laptop with Docker. No account, no signup, no keys. Great for trying it out.
-- **Audit-only** — skip Ory entirely and just log what the agent does.
-
-> No browser available (CI, SSH, headless)? The same walkthrough runs right in your terminal instead — or force it with `--no-web`.
-
-That's it. Confirm everything landed with:
+Confirm everything landed with:
 
 ```bash
 npx -y -p @ory/antigravity ory-agy status
 ```
 
-`status` is your one-stop check: what's configured, who's signed in, which tools are covered by permissions, plugin + skill registration, and recent activity. Anything not set up yet shows as `(unset)`.
-
-Re-run install with `--reconfigure` to change your connection later, or `--no-configure` to skip the wizard and configure by hand.
+`status` is your one-stop check: what's configured, who's signed in, which tools are covered by permissions, plugin + skill registration, and recent activity. Until you connect Agent Security, the identity and permission rows say so and name what's missing.
 
 <details>
 <summary>No <code>agy</code> binary? Install into <code>.agents/</code> directly</summary>
@@ -53,13 +46,47 @@ npx -y -p @ory/antigravity ory-agy uninstall
 
 </details>
 
+## Skills and commands
+
+Installing the plugin drops the full Ory playbook catalog into Antigravity. **Skills** are model-invoked — just say what you want in plain language and the matching one takes over.
+
+| Skill | What it does for you |
+|---|---|
+| `ory-auth-setup` | Adds a complete auth system to your app — login, registration, recovery, verification, settings — on [Ory Elements](https://github.com/ory/elements) |
+| `ory-login-flow` | Builds just the pages, wired to Ory's self-service flows |
+| `ory-social-login` | "Sign in with…" for Google, GitHub, Apple, Microsoft, Discord, Slack, GitLab, Facebook |
+| `ory-local-dev` | Develops and tests login/permission flows against a local Ory — no project, no account, offline |
+| `ory-permissions-onboarding` | Walks a fresh install from observe mode to enforced per-tool permissions without getting blocked |
+| `ory-build-agent` | Drops `@ory/argus` into an agent *you* own — Claude Agent SDK, OpenAI Agents, Mastra, Vercel AI, LangGraph/PydanticAI |
+| `ory-build-integration` | Wires Ory into your app: Action webhooks, JWT validation at a gateway, live event streams |
+| `ory-contribute-integration` | Authors and submits an integration to the public `ory/integrates` registry |
+| `ory-e2b-sandbox` | Scaffolds an E2B sandbox template that boots with this plugin preinstalled |
+| `ory-temporal-worker` | Scaffolds a Temporal TypeScript worker where every Activity is authenticated, authorized, and audited |
+
+**Slash commands** run the local stack directly:
+
+| Command | What it does |
+|---|---|
+| `/ory:local-up` | Starts a local Ory (Identities, OAuth2, Permissions) in Docker and seeds a test user — it prints the email + password to sign in with |
+| `/ory:local-down` | Stops it, keeping your data volumes |
+| `/ory:temporal-up` | Starts a local Temporal dev server for the `ory-temporal-worker` scaffold |
+
+The local stack runs entirely on your laptop: Ory APIs at `http://localhost:4000`, a login UI on `:4455` (not `:3000`, to dodge Next.js port clashes), and the Ory Console on `:4100`.
+
+A built-in **Ory MCP server** rounds it out — Antigravity can manage identities, projects, and permissions straight from chat.
+
+So: ask Antigravity *"add Ory login to this app"* and it scaffolds the pages, starts a local Ory, and wires them together.
+
 ## What you get
 
-Once connected, every tool the agent runs is governed by Ory — three things happen automatically:
+Out of the box, every tool the agent runs produces a privacy-safe structured activity event in the unified local log.
+
+Once you connect to Ory Agent Security, two more things happen automatically:
 
-- **Who's driving.** You sign in once in your browser (a secure sign-in flow, no tokens to copy around); the agent process gets its own identity, which it registers itself automatically on first run. The "who acted on whose behalf" trail stays queryable later.
-- **What it's allowed to do.** Before a tool runs, Ory checks whether it's permitted. It starts in **watch mode** — nothing is blocked, you just *see* what would be — so it never gets in your way on day one.
-- **A record of everything.** Every decision (allowed, denied, skipped) is logged as a trace you can send to Jaeger, Honeycomb, Grafana, or just a file.
+- **Who's driving.** You sign in once in your browser (a secure sign-in flow, no tokens to copy around); each agent session gets its own identity, which it registers automatically on first use. The "who acted on whose behalf" trail stays queryable later.
+- **What it's allowed to do.** Before a tool runs, Ory checks whether it's permitted. It starts in **observe mode** — nothing is blocked, you just *see* what would be — so it never gets in your way on day one.
+
+If Ory is ever unreachable, the plugin gets out of the way and lets the agent keep working — so it can't lock you out.
 
 The plugin hooks into these Antigravity lifecycle events: `SessionStart` (check who's signed in), `PreToolUse` (authorize the tool), `PostToolUse` (record it), `Notification`, and `SessionEnd`.
 
@@ -67,92 +94,63 @@ The plugin hooks into these Antigravity lifecycle events: `SessionStart` (check
 
 ### See what's happening
 
-Everything the plugin does is observable out of the box — no configuration required:
+Everything the plugin does is observable out of the box:
 
-- **Status at a glance.** `npx -y -p @ory/antigravity ory-agy status` shows what's configured, who's signed in, how many built-in tools your permissions cover, and the most recent tool-call activity.
-- **Live dashboard.** `npx -y -p @ory/antigravity ory-agy dashboard` opens the same picture in your browser — configuration, identities, permission coverage, Ory service health, and the latest tool-call activity, all refreshing live. From there you can flip **enforcement** on or off, toggle **user login**, and use **Change stack** to reconnect to a different Ory — no CLI required.
-- **Live traces.** Every tool call is recorded as an OpenTelemetry-style span. Watch them stream as the agent works:
+- **Activity log.** Privacy-safe activity is always appended to `~/.config/ory-agent-plugins/antigravity/ory-agent-debug.log`. View events, decisions, and errors live with:
 
   ```bash
   npx -y -p @ory/antigravity ory-agy watch
   ```
 
-  Spans are also written to `~/.config/ory-agent-plugins/antigravity/ory-agent-trace.ndjson` (NDJSON, one span per line) — tail that file, or point `OTEL_EXPORTER_OTLP_ENDPOINT` at a collector to ship them straight to Jaeger, Honeycomb, or Grafana.
-- **Debug log.** For a verbose play-by-play, set `ORY_AGENT_DEBUG=true`; structured logs land in `~/.config/ory-agent-plugins/antigravity/ory-agent-debug.log`.
+  Set `ORY_AGENT_LOG_FILE` to override the path; set it empty to disable file persistence.
+- **Live debug.** Launch Antigravity with `ORY_AGENT_DEBUG=true` to add verbose local diagnostics, including raw shell commands, to the watched log and stderr. Secrets are recursively redacted; pass `watch --json` for NDJSON.
 
 ### Ready to enforce?
 
-When the watch-mode logs look right, turn on blocking with one command (setup already granted you the built-in tools):
+Once connected, the deny posture lives on the Ory project: when the observe-mode activity looks right, an admin promotes it to **enforce** in the **Ory Console** (Agent Security). Every session reads that posture live, so nothing has to be reinstalled.
 
 ```bash
-npx -y -p @ory/antigravity ory-agy permissions enforce
+npx -y -p @ory/antigravity ory-agy permissions   # what the project grants, and the live mode
 ```
 
-Now a denied tool is actually blocked and Antigravity shows why (the `deny_reason`). Go back to watch mode anytime with `permissions observe`. Prefer clicking? The dashboard has the same **Enforce** switch — flip it on, or back to watch mode, without touching the CLI. Use `permissions status` to see what's covered and `permissions bootstrap` to (re-)grant the built-in tools (`run_command`, `view_file`, `write_to_file`, …) — or add permissions for MCP-server tools by hand, or via the Ory MCP server right from inside Antigravity.
-
-## Also: add login to your own app
-
-Beyond securing the agent, the plugin helps you build Ory into whatever you're working on. Ask Antigravity *"add Ory login to this app"* (or invoke the `ory-auth-setup` skill) and it scaffolds the login, registration, recovery, and settings pages (using [Ory Elements](https://github.com/ory/elements)) wired to a local Ory — no signup or keys needed. Start that local Ory with `/ory:local-up` (it prints a test email + password to sign in with) and tear it down with `/ory:local-down`.
-
-Bundled **skills** (just ask in plain language) cover more: `ory-auth-setup`, `ory-login-flow`, `ory-social-login` (Google, GitHub, Apple…), `ory-permissions-onboarding`, and playbooks for wiring Ory into your own agents, E2B sandboxes, or Temporal workers. A built-in **Ory MCP server** lets the agent manage identities, projects, and permissions straight from chat.
-
-The local Ory runs entirely on your laptop:
-
-```
-/ory:local-up      # start a local Ory instance in Docker
-/ory:local-down    # tear it all down
-/ory:temporal-up   # start a local Temporal dev server (for ory-temporal-worker)
-```
+Then a denied tool is actually blocked and Antigravity shows why (the `deny_reason`).
 
-`local-up` brings up the Ory APIs (Identities, OAuth2, Permissions) at `http://localhost:4000`, a login UI on `:4455` (not `:3000`, to dodge Next.js port clashes), and Jaeger (the trace viewer) on `:16686`. A test user is seeded and its credentials printed — learn Ory hands-on, prototype flows, and test end-to-end, all offline.
+## Connect to Ory Agent Security
 
-## Configure by hand (CI / advanced)
+Copy the connection details from the [Ory Console](https://console.ory.sh) under **Agent Security**:
 
-The guided setup covers most people. For scripted or CI setups, or to point at an existing Ory Network project, configure directly. Settings are saved to `~/.config/ory-agent-plugins/config.json` and shared across all your Ory agent plugins; environment variables win when both are set.
+| Value | Flag | Environment variable |
+|---|---|---|
+| Project URL | `--project-url` | `ORY_PROJECT_URL` |
+| Agent Security URL | `--agent-security-url` | `ORY_AGENT_SECURITY_URL` |
+| Sign-in client id override (default `ory-agent-security-login`) | `--oauth2-client-id` | `ORY_OAUTH2_CLIENT_ID` |
 
 ```bash
 npx -y -p @ory/antigravity ory-agy configure \
   --project-url https://<slug>.projects.oryapis.com \
-  --oauth2-client-id <login client id>
+  --agent-security-url https://agents.console.ory.com
 ```
 
-The agent's own identity registers itself automatically on first run — nothing to create. The `--oauth2-client-id` is the one piece browser sign-in needs; the guided setup makes it for you, or see below to do it by hand. For logging-only with no checks, use `--audit-only`. The interactive user login runs every session (always on, non-blocking) and only needs `ORY_OAUTH2_CLIENT_ID` to complete the browser flow. The matching env vars are `ORY_PROJECT_URL`, `ORY_OAUTH2_CLIENT_ID`, and `ORY_AGENT_API_KEY`.
+`install` accepts the same flags, so you can register the plugin **and** connect in one shot (`install --project-url <URL> --agent-security-url <URL>`). The login client defaults to `ory-agent-security-login`; custom deployments can override it with `--oauth2-client-id`. Existing configurations fall back to the project URL when the Agent Security URL is unset. To turn sign-in and checks back off later, use `configure --disconnect`.
 
-<details>
-<summary>Create the sign-in client by hand</summary>
+**Ory Network or OEL.** Either works. For an Ory Network project the URL is `https://<slug>.projects.oryapis.com`; for a self-hosted **Ory Enterprise License** deployment, point `--project-url` at that deployment's base URL and use the sign-in client id from its Agent Security configuration. Everything downstream — sign-in, checks, delegation — is identical.
 
-The guided setup normally does this. To do it yourself, create a **public** OAuth2 client (no secret) listing all four loopback URLs — the plugin tries each in turn so sign-in survives a busy port:
+**There is nothing else for you to create.** The sign-in client, the permission model, the per-tool grants and blocks, and the observe/enforce posture are all provisioned in the Console by someone with project access. At runtime the plugin only *reads* permissions — it has no write path into your project, which is why installing it needs no workspace privilege. Each Antigravity session registers its own identity automatically on first use.
 
-```bash
-ory create oauth2-client --project <project-id> \
-  --name "Ory Agent Security · user login (PKCE)" \
-  --grant-type authorization_code,refresh_token \
-  --response-type code \
-  --scope openid,offline_access \
-  --token-endpoint-auth-method none \
-  --redirect-uri http://127.0.0.1:47823/callback \
-  --redirect-uri http://127.0.0.1:47824/callback \
-  --redirect-uri http://127.0.0.1:47825/callback \
-  --redirect-uri http://127.0.0.1:47826/callback
-```
-
-Pass the resulting id to `configure --oauth2-client-id`. Running headless with a session token already? Set `ORY_USER_SESSION_TOKEN` and skip the browser step entirely.
-
-</details>
+Sign-in runs at the start of every session and never blocks — a declined, skipped, or timed-out login simply leaves that session without a user identity.
 
-With nothing configured, the plugin still loads and runs in **pass-through mode**: skills, commands, and logging work, but no checks run and nothing is blocked. Perfectly fine if you only want the app-building features.
+Settings are saved to `~/.config/ory-agent-plugins/config.json` and shared across all your Ory agent plugins; environment variables win when both are set. Running headless with an OAuth2 access token already? Set `ORY_USER_OAUTH2_TOKEN` and the browser step is skipped entirely.
 
 ## Commands
 
 ```
-ory-agy install | uninstall        Install/remove; --reconfigure re-runs setup, --no-web forces the terminal wizard, --no-configure skips it
-ory-agy status                      Show configuration, identities, permission coverage, recent activity
-ory-agy dashboard                   Open the live browser dashboard (status + service health + Change stack)
-ory-agy watch                       Tail the live trace stream (OTel spans)
-ory-agy permissions <cmd>           status | bootstrap | observe (watch) | enforce (block)
-ory-agy configure <flags>           Point at a project by hand (--project-url, --oauth2-client-id, --audit-only)
-ory-agy agent <status|unregister>   Manage the agent's own auto-created identity
-ory-agy local <up|down|status|…>    Run / manage a local Ory in Docker
+ory-agy install | uninstall          Install (add --project-url to also connect Agent Security) / remove
+ory-agy status                       Show configuration, identities, permission coverage, recent activity
+ory-agy permissions <cmd>            status  (read-only; grants + posture live in the Ory Console)
+ory-agy configure <flags>            Connect a project (--project-url) or --disconnect
+ory-agy agent <status|unregister>    Manage the agent's own auto-created identity
+ory-agy local <up|down|status|…>     Run / manage a local Ory in Docker
+ory-agy version                      Print plugin, core, and Node versions (--json for machine-readable)
 ory-agy-setup                        Install into .agents/ directly (no agy binary)
 ```
 
@@ -161,10 +159,9 @@ All prefixed with `npx -y -p @ory/antigravity`.
 ## Troubleshooting
 
 - **`/ory:local-up` fails** — make sure Docker is running and ports `4000`, `4455`, and `16686` are free.
-- **Browser sign-in loops** — reset with `ory-agy agent unregister` and try again.
-- **Install ran but never asked how to connect** — you're almost certainly on a stale `npx` cache. `npx -p @ory/antigravity` (no version pin) reuses a previously-downloaded copy instead of re-resolving to the latest, so an older CLI whose install predates the setup wizard can run while you believe you're on the current release. The install banner prints the running version; confirm it with `npx -y -p @ory/antigravity ory-agy version`. To force the current release, clear the cache and reinstall: `rm -rf ~/.npm/_npx` then `npx -y -p @ory/antigravity ory-agy install`. Pinning an exact version (`@ory/antigravity@<version>`) also bypasses the cached copy.
-- **A tool was unexpectedly blocked** — because Antigravity blocks by default, first confirm the hook is answering: set `ORY_AGENT_DEBUG=true` and check the logs for hook errors. Then verify the user has `use` on the tool with `permissions status`.
-- **Want to see what's happening** — `npx -y -p @ory/antigravity ory-agy status` for a snapshot, `npx -y -p @ory/antigravity ory-agy watch` for the live trace stream, or set `ORY_AGENT_DEBUG=true` for a verbose log. Traces and logs live under `~/.config/ory-agent-plugins/antigravity/` (see [See what's happening](#see-whats-happening)).
+- **Browser sign-in loops** (after connecting) — reset with `ory-agy agent unregister` and try again.
+- **Running an older CLI than expected** — `npx -p @ory/antigravity` (no version pin) reuses a previously-downloaded copy instead of re-resolving to the latest. The install banner prints the running version; confirm it with `npx -y -p @ory/antigravity ory-agy version`. To force the current release, clear the cache and reinstall: `rm -rf ~/.npm/_npx` then `npx -y -p @ory/antigravity ory-agy install`. Pinning an exact version (`@ory/antigravity@<version>`) also bypasses the cached copy.
+- **A tool was unexpectedly blocked** — because Antigravity blocks by default, first confirm the hook is answering: set `ORY_AGENT_DEBUG=true` and check the logs for hook errors. Then verify the user has `use` on the tool with `permissions`.
 
 ## Learn more
 

package/dist/cli/assets.d.ts

@@ -17,8 +17,19 @@
  * hooks.json shape (verified): top-level rule id → event name → array of
  * `{ matcher, hooks: [{ type, command, timeout }] }`.
  */
+import { type PreparedRuntime } from "@ory/argus";
 /** Plugin / rule / MCP-server id. */
 export declare const PLUGIN_NAME = "ory";
+/**
+ * Resolve this install's runtime and write its shims. Both entry points (the
+ * `agy plugin install` path in `main.ts` and the manual `.agents` fallback in
+ * `setup.ts`) go through here so they wire the same runtime.
+ *
+ * Antigravity **fails closed**: a hook that crashes or answers with malformed
+ * output blocks the tool. So the shim's runtime-missing path has to emit an
+ * explicit allow, matching what the hook itself returns on every error path.
+ */
+export declare function wireAntigravityRuntime(args: readonly string[]): PreparedRuntime;
 /**
  * Write the full Ory plugin bundle under `root`. Used both for the
  * bundle handed to `agy plugin install` and for the manual `.agents`
@@ -31,7 +42,7 @@ export declare const PLUGIN_NAME = "ory";
  * bundle dir the merge is a no-op over a fresh tree, so the same code
  * path is used everywhere.)
  */
-export declare function installAntigravityOryAssets(root: string): void;
+export declare function installAntigravityOryAssets(root: string, runtime: PreparedRuntime): void;
 /**
  * Remove every Ory skill, command, and bundle entry written under `root`.
  *

package/dist/cli/assets.js

@@ -53,17 +53,35 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PLUGIN_NAME = void 0;
+exports.wireAntigravityRuntime = wireAntigravityRuntime;
 exports.installAntigravityOryAssets = installAntigravityOryAssets;
 exports.uninstallAntigravityOryAssets = uninstallAntigravityOryAssets;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const argus_1 = require("@ory/argus");
 const PACKAGE_NAME = "@ory/antigravity";
-const HOOK_BIN_NAME = "ory-agy-hook";
-const MCP_PACKAGE_NAME = "@ory/mcp-server";
-const MCP_BIN_NAME = "ory-mcp-server";
 /** Plugin / rule / MCP-server id. */
 exports.PLUGIN_NAME = "ory";
+const PACKAGE_ROOT = path.resolve(__dirname, "..", "..");
+/**
+ * Resolve this install's runtime and write its shims. Both entry points (the
+ * `agy plugin install` path in `main.ts` and the manual `.agents` fallback in
+ * `setup.ts`) go through here so they wire the same runtime.
+ *
+ * Antigravity **fails closed**: a hook that crashes or answers with malformed
+ * output blocks the tool. So the shim's runtime-missing path has to emit an
+ * explicit allow, matching what the hook itself returns on every error path.
+ */
+function wireAntigravityRuntime(args) {
+    return (0, argus_1.wireRuntime)({
+        harness: "antigravity",
+        packageName: PACKAGE_NAME,
+        packageRoot: PACKAGE_ROOT,
+        installCommand: "npx -y -p @ory/antigravity ory-agy install",
+        args,
+        fallbackStdout: JSON.stringify({ allow_tool: true }),
+    });
+}
 const RENDER_OPTS = {
     binName: "ory-agy",
     packageName: PACKAGE_NAME,
@@ -82,23 +100,28 @@ function readPackageVersion() {
     return parsed.version;
 }
 /**
- * Render hooks.json. The hook command is a self-contained
- * `npx -y -p @ory/antigravity@<version> ory-agy-hook` so the
- * binary need not be on PATH after install. `matcher: ".*"` matches every
- * tool name on the tool events.
+ * Render hooks.json. The command points at the runtime shim resolved at
+ * install time, so no package resolution happens per tool call.
+ * `matcher: ".*"` matches every tool name on the tool events.
  */
-function renderHooks(version) {
-    const command = (0, argus_1.pinHookToLocalRegistry)(`npx -y -p ${PACKAGE_NAME}@${version} ${HOOK_BIN_NAME}`);
+function renderHooks(command) {
     const entry = (matcher, timeout) => [
         { matcher, hooks: [{ type: "command", command, timeout }] },
     ];
+    // Antigravity's hook timeout is in SECONDS and it *validates* the value —
+    // "timeout must be between 5 and 120 seconds". The previous 10000/5000 were
+    // both far outside that range, so the values were never what they looked
+    // like. Core clamps to the 120s ceiling and asserts the session-start window
+    // still outlasts the login (#220).
+    const sessionStartSec = (0, argus_1.sessionStartHookTimeout)("antigravity", "seconds");
+    const toolSec = (0, argus_1.toolHookTimeout)("antigravity", "seconds");
     return {
         [exports.PLUGIN_NAME]: {
-            SessionStart: entry(".*", 10000),
-            SessionEnd: entry(".*", 5000),
-            PreToolUse: entry(".*", 5000),
-            PostToolUse: entry(".*", 5000),
-            Notification: entry(".*", 5000),
+            SessionStart: entry(".*", sessionStartSec),
+            SessionEnd: entry(".*", toolSec),
+            PreToolUse: entry(".*", toolSec),
+            PostToolUse: entry(".*", toolSec),
+            Notification: entry(".*", toolSec),
         },
     };
 }
@@ -107,24 +130,16 @@ function renderManifest(version) {
     return {
         name: exports.PLUGIN_NAME,
         version,
-        description: "Ory authentication, authorization, and distributed tracing for Google Antigravity",
+        description: "Ory authentication, authorization, and activity auditing for Google Antigravity",
     };
 }
 /**
  * Render mcp_config.json. Antigravity uses the standard `mcpServers` map;
- * stdio servers use `command` + `args` (remote servers would use
- * `serverUrl`). The Ory MCP server is resolved via npx for the same
- * reason as the hook command.
+ * stdio servers use `command` + `args` (remote servers would use `serverUrl`).
+ * The server is started from the resolved runtime via its shim.
  */
-function renderMcpConfig(version) {
-    return {
-        mcpServers: {
-            [exports.PLUGIN_NAME]: {
-                command: "npx",
-                args: ["-y", "-p", `${MCP_PACKAGE_NAME}@${version}`, MCP_BIN_NAME],
-            },
-        },
-    };
+function renderMcpConfig(server) {
+    return { mcpServers: { [exports.PLUGIN_NAME]: server } };
 }
 /**
  * Read a JSON file as a plain object. Returns `undefined` when the file
@@ -162,7 +177,7 @@ function isOryManifest(manifest) {
  * bundle dir the merge is a no-op over a fresh tree, so the same code
  * path is used everywhere.)
  */
-function installAntigravityOryAssets(root) {
+function installAntigravityOryAssets(root, runtime) {
     const version = readPackageVersion();
     fs.mkdirSync(root, { recursive: true });
     const skillsDir = path.join(root, "skills");
@@ -178,19 +193,23 @@ function installAntigravityOryAssets(root) {
     // any rules the user has defined alongside it.
     const hooksPath = path.join(root, "hooks.json");
     const hooks = readJsonObject(hooksPath) ?? {};
-    hooks[exports.PLUGIN_NAME] = renderHooks(version)[exports.PLUGIN_NAME];
+    hooks[exports.PLUGIN_NAME] = renderHooks((0, argus_1.requireHookCommand)(runtime))[exports.PLUGIN_NAME];
     writeJson(hooksPath, hooks);
     // mcp_config.json — replace only the Ory server entry under `mcpServers`,
-    // preserving other servers and any unrelated top-level keys.
-    const mcpPath = path.join(root, "mcp_config.json");
-    const mcp = readJsonObject(mcpPath) ?? {};
-    const existingServers = mcp.mcpServers;
-    const servers = existingServers && typeof existingServers === "object" && !Array.isArray(existingServers)
-        ? existingServers
-        : {};
-    servers[exports.PLUGIN_NAME] = renderMcpConfig(version).mcpServers[exports.PLUGIN_NAME];
-    mcp.mcpServers = servers;
-    writeJson(mcpPath, mcp);
+    // preserving other servers and any unrelated top-level keys. Skipped when
+    // the runtime ships no MCP server: better no registration than one that
+    // cannot start.
+    if (runtime.mcpServer) {
+        const mcpPath = path.join(root, "mcp_config.json");
+        const mcp = readJsonObject(mcpPath) ?? {};
+        const existingServers = mcp.mcpServers;
+        const servers = existingServers && typeof existingServers === "object" && !Array.isArray(existingServers)
+            ? existingServers
+            : {};
+        servers[exports.PLUGIN_NAME] = renderMcpConfig(runtime.mcpServer).mcpServers[exports.PLUGIN_NAME];
+        mcp.mcpServers = servers;
+        writeJson(mcpPath, mcp);
+    }
     // plugin.json — only write over a manifest that is Ory's own (or absent).
     const manifestPath = path.join(root, "plugin.json");
     if (!fs.existsSync(manifestPath) || isOryManifest(readJsonObject(manifestPath))) {

package/dist/cli/main.js

@@ -61,8 +61,18 @@ function agyAvailable() {
 }
 function main() {
     const [command, ...args] = process.argv.slice(2);
+    // `--help` after a matched subcommand: print usage, do nothing else.
+    // Without this the switch below ignores the flag and `install --help`
+    // performs a real install (#221).
+    if ((0, argus_1.shouldPrintHelp)(command, args))
+        return help();
     switch (command) {
         case "install":
+            if (args.includes("--print")) {
+                process.argv = ["node", "setup.js", ...args];
+                require("./setup.js");
+                break;
+            }
             (0, argus_1.beginDeferNextSteps)();
             install(args);
             (0, argus_1.runPostInstall)("ory-agy", "antigravity", args).then(() => process.exit(0), (err) => {
@@ -72,7 +82,10 @@ function main() {
             break;
         case "uninstall":
             uninstall(args);
-            (0, argus_1.clearCredentialsForUninstall)().then(() => process.exit(0), (err) => {
+            (0, argus_1.clearCredentialsForUninstall)({
+                harness: "antigravity",
+                purge: args.includes("--purge"),
+            }).then(() => process.exit(0), (err) => {
                 console.error(err.message ?? err);
                 process.exit(1);
             });
@@ -81,7 +94,7 @@ function main() {
             (0, argus_1.runConfigureCommand)("ory-agy", args);
             break;
         case "agent":
-            (0, argus_1.runAgentCommand)("ory-agy", args).then((code) => process.exit(code), (err) => {
+            (0, argus_1.runAgentCommand)("ory-agy", "antigravity", args).then((code) => process.exit(code), (err) => {
                 console.error(err.message ?? err);
                 process.exit(1);
             });
@@ -101,17 +114,11 @@ function main() {
                 process.exit(1);
             });
             break;
-        case "local":
-            (0, argus_1.runLocalCommand)("ory-agy", args).catch((err) => {
-                console.error(err.message ?? err);
-                process.exit(1);
-            });
-            break;
         case "watch":
-            (0, argus_1.runWatchCommand)("antigravity", args);
+            (0, argus_1.runWatchCommand)("ory-agy", "antigravity", args).then((code) => process.exit(code), (err) => { console.error(err.message ?? err); process.exit(1); });
             break;
-        case "dashboard":
-            (0, argus_1.runDashboardCommand)("ory-agy", "antigravity", args).then((code) => process.exit(code), (err) => {
+        case "local":
+            (0, argus_1.runLocalCommand)("ory-agy", args).catch((err) => {
                 console.error(err.message ?? err);
                 process.exit(1);
             });
@@ -134,10 +141,19 @@ function main() {
     }
 }
 function install(args) {
+    // Resolve the runtime first: the bundle's hooks.json / mcp_config.json point
+    // at the shims it writes.
+    const runtime = (0, assets_js_1.wireAntigravityRuntime)(args);
+    console.log(runtime.target.kind === "linked"
+        ? `Runtime: linked to ${runtime.target.packageDir} (dev)`
+        : `Runtime: ${runtime.target.packageName}@${runtime.target.version} in ${runtime.target.storeDir}`);
+    for (const pruned of runtime.prunedStores) {
+        console.log(`  Removed stale runtime: ${pruned}`);
+    }
     // Materialize the bundle (plugin.json + hooks.json + mcp_config.json +
     // skills + commands) before handing it to `agy plugin install`.
     console.log("Materializing the Ory plugin bundle...");
-    (0, assets_js_1.installAntigravityOryAssets)(BUNDLE_DIR);
+    (0, assets_js_1.installAntigravityOryAssets)(BUNDLE_DIR, runtime);
     if (agyAvailable()) {
         console.log("Installing Ory plugin into Antigravity...");
         const result = (0, node_child_process_1.spawnSync)(AGY, ["plugin", "install", BUNDLE_DIR], {
@@ -208,11 +224,11 @@ Commands:
   uninstall              Remove the Ory plugin from Antigravity
   configure              Set or view Ory project URL and credentials
   agent <cmd>            Manage the agent's OAuth2 (DCR) identity (status, unregister)
-  permissions <cmd>      Manage permission mode and tool permissions (status, bootstrap, observe, enforce)
+  permissions            Show the live permission mode and per-tool coverage
   setup [--project-dir]  Write the plugin bundle into .agents directly (fallback)
   status                 Show plugin status and configuration
-  dashboard            Open the Ory Agent dashboard (system health + configuration)
-  watch [trace-file]     Tail the trace stream (OTel spans) live
+  watch [--json] [--lines <count>]
+                         Follow the live activity/debug log
   version                Show version and the ory-agent-plugins build commit
   local <cmd>            Manage local Ory dev environment (up, down, status, seed, ...)
 

package/dist/cli/setup.js

@@ -74,9 +74,13 @@ function main() {
         }
         (0, assets_js_1.uninstallAntigravityOryAssets)(agentsDir);
         console.log(`Removed Ory plugin bundle from ${agentsDir}`);
+        (0, argus_1.removeRuntimeWiring)("antigravity");
+        for (const pruned of (0, argus_1.pruneRuntimeStores)()) {
+            console.log(`  Removed runtime: ${pruned}`);
+        }
         return;
     }
-    (0, assets_js_1.installAntigravityOryAssets)(agentsDir);
+    (0, assets_js_1.installAntigravityOryAssets)(agentsDir, (0, assets_js_1.wireAntigravityRuntime)(process.argv.slice(2)));
     console.log(`Ory plugin bundle installed to ${agentsDir}`);
     (0, argus_1.printNextSteps)("Google Antigravity", "npx -y -p @ory/antigravity ory-agy-setup --uninstall", { binName: "ory-agy", harness: "antigravity" });
 }
@@ -85,7 +89,10 @@ main();
 // stored Ory credentials. When required by the plugin's main CLI, that
 // command owns the purge, so the `require.main` guard prevents a double run.
 if (require.main === module && process.argv.includes("--uninstall")) {
-    (0, argus_1.clearCredentialsForUninstall)().then(() => process.exit(0), (err) => {
+    (0, argus_1.clearCredentialsForUninstall)({
+        harness: "antigravity",
+        purge: process.argv.includes("--purge"),
+    }).then(() => process.exit(0), (err) => {
         console.error(err.message ?? err);
         process.exit(1);
     });

package/dist/emit.d.ts

@@ -2,9 +2,7 @@
  * Write-once stdout emitter for the Antigravity hook.
  *
  * Antigravity parses the hook's stdout as a single JSON document and
- * FAILS CLOSED on malformed output. If two code paths both write (e.g.
- * the main path writes the decision and then `tracer.shutdown()` rejects,
- * landing in the top-level catch which writes FAIL_OPEN again), stdout
+ * FAILS CLOSED on malformed output. If two code paths both write, stdout
  * carries two concatenated JSON documents and the harness blocks the
  * tool. This factory guarantees exactly one write ever reaches stdout.
  */

package/dist/emit.js

@@ -3,9 +3,7 @@
  * Write-once stdout emitter for the Antigravity hook.
  *
  * Antigravity parses the hook's stdout as a single JSON document and
- * FAILS CLOSED on malformed output. If two code paths both write (e.g.
- * the main path writes the decision and then `tracer.shutdown()` rejects,
- * landing in the top-level catch which writes FAIL_OPEN again), stdout
+ * FAILS CLOSED on malformed output. If two code paths both write, stdout
  * carries two concatenated JSON documents and the harness blocks the
  * tool. This factory guarantees exactly one write ever reaches stdout.
  */

package/dist/handlers.js

@@ -19,11 +19,7 @@ async function handleHookEvent(input, client, deps = {}) {
         sessionId: input.session_id,
         toolName: input.tool_name,
     });
-    client.tracer.setContext({
-        traceId: (0, argus_1.deriveTraceId)(input.session_id),
-        sessionId: input.session_id,
-    });
-    try {
+    return (0, argus_1.withHookContext)(client, { sessionId: input.session_id }, async () => {
         switch (event) {
             case "SessionStart":
                 return await handleSessionStart(input, client, deps);
@@ -38,15 +34,12 @@ async function handleHookEvent(input, client, deps = {}) {
                 return handleSessionEnd(input, client);
             default:
                 client.logger.debug("hook.passthrough", { event });
-                client.tracer.record("hook.passthrough", "skipped", {
+                client.logger.activity("hook.passthrough", "skipped", {
                     attributes: { event },
                 });
                 return ALLOW;
         }
-    }
-    finally {
-        client.tracer.clearContext();
-    }
+    });
 }
 // ─── SessionStart ───────────────────────────────────────────────────
 async function handleSessionStart(input, client, deps) {
@@ -55,25 +48,13 @@ async function handleSessionStart(input, client, deps) {
         model: input.model,
         source: input.source,
     });
-    client.tracer.record("session.start", "ok", {
-        attributes: { model: input.model, source: input.source },
-    });
-    // User login (interactive PKCE / token refresh). Runs every session and
-    // never blocks — it refreshes tokens, prompts if needed, and emits the
-    // audit span, but the session always proceeds. Enforcement happens at
-    // tool-call time and is governed solely by permissionMode.
-    const userGate = deps.userLogin ?? argus_1.ensureUserAuthenticated;
-    await userGate(client, {
+    await (0, argus_1.sessionStart)(client, {
         binName: "ory-agy",
         harness: HARNESS,
+        userLogin: deps.userLogin,
+        agentGate: deps.agentGate,
+        activityAttributes: { model: input.model, source: input.source },
     });
-    // Resolve the agent identity regardless of how user auth went — never
-    // blocks; attaches the agent's bearer token to outgoing Ory calls.
-    const agentGate = deps.agentGate ?? argus_1.ensureAgentIdentity;
-    await agentGate(client, { projectUrl: (0, argus_1.resolveConfig)().projectUrl, harness: HARNESS });
-    // Record the user→agent delegation (audit-trail only; fail-open).
-    // Written at most once per install.
-    await (0, argus_1.writeUserDelegatesAgent)(client);
     return {};
 }
 // ─── PreToolUse ─────────────────────────────────────────────────────
@@ -84,61 +65,19 @@ async function handlePreToolUse(input, client) {
         toolName,
         toolInput: input.tool_input,
     });
-    const inputSummary = (0, argus_1.summarizeToolInput)(toolName, input.tool_input);
-    // Audit-only mode: log the invocation, skip the permission check, allow.
-    if ((0, argus_1.resolveConfig)().auditOnly) {
-        client.tracer.record("tool.invoke", "ok", {
-            attributes: { toolName, ...inputSummary },
-        });
-        return ALLOW;
-    }
-    const subject = (0, argus_1.resolveUserSubject)(client, `session:${input.session_id}`);
-    const subjectId = (0, argus_1.subjectLabel)(subject);
-    const namespace = resolveNamespace();
-    try {
-        const outcome = await (0, argus_1.gateToolCall)(client, {
-            harness: HARNESS,
-            toolName,
-            check: { namespace, object: toolName, relation: "use", ...subject },
-            spanAttributes: { toolName },
-        });
-        // Interactive tools surface UI to the user; gateToolCall already
-        // recorded the user.interaction span. Let the harness prompt.
-        if (outcome.kind === "interactive") {
-            return ALLOW;
-        }
-        if (outcome.kind === "fail_open") {
-            return failOpen(outcome.error, toolName, client);
-        }
-        const attrs = { toolName, ...inputSummary };
-        const decisionAttrs = outcome.spanAttributes;
-        if (outcome.kind === "allow") {
-            client.tracer.record("tool.invoke", "ok", {
-                attributes: { ...attrs, ...decisionAttrs, allowed: true },
-            });
-            return ALLOW;
-        }
-        if (outcome.kind === "observe") {
-            client.tracer.record("tool.block", "denied", {
-                attributes: { ...attrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
-            });
-            client.tracer.record("tool.invoke", "ok", {
-                attributes: { ...attrs, ...decisionAttrs, allowed: false, observed: true },
-            });
-            return ALLOW;
-        }
-        // deny → block the tool (enforce mode).
-        client.tracer.record("tool.block", "denied", {
-            attributes: { ...attrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(true) },
-        });
+    const result = await (0, argus_1.gate)(client, {
+        harness: HARNESS,
+        toolName,
+        toolArgs: input.tool_input,
+        subjectFallback: `session:${input.session_id}`,
+    });
+    if (result.blocked) {
         return {
             allow_tool: false,
-            deny_reason: (0, argus_1.formatDenialMessage)({ tool: toolName, subjectId, namespace }),
+            deny_reason: result.denialMessage,
         };
     }
-    catch (err) {
-        return failOpen(err, toolName, client);
-    }
+    return ALLOW;
 }
 // ─── PostToolUse ────────────────────────────────────────────────────
 async function handlePostToolUse(input, client) {
@@ -149,36 +88,31 @@ async function handlePostToolUse(input, client) {
     });
     const failed = input.tool_error !== undefined && input.tool_error !== null;
     if (failed) {
-        client.tracer.record("tool.fail", "error", {
-            attributes: {
-                toolName,
-                toolError: typeof input.tool_error === "string"
-                    ? input.tool_error.slice(0, 500)
-                    : "[object]",
-                ...(0, argus_1.summarizeToolInput)(toolName, input.tool_input),
-            },
+        client.logger.debug("lifecycle.post_tool_use.error", { error: input.tool_error });
+        (0, argus_1.fail)(client, {
+            toolName,
+            input: input.tool_input,
+            error: input.tool_error,
         });
         return {};
     }
-    client.tracer.record("tool.complete", "ok", {
-        attributes: {
-            toolName,
-            ...(0, argus_1.summarizeToolInput)(toolName, input.tool_input),
-            ...(0, argus_1.summarizeToolOutput)(toolName, input.tool_response),
-        },
+    (0, argus_1.complete)(client, {
+        toolName,
+        input: input.tool_input,
+        output: input.tool_response,
     });
     return {};
 }
 // PreInvocation / PostInvocation bracket each agent turn (not user
 // prompts). We don't model them specially — they fall through to the
-// default `hook.passthrough` audit span in handleHookEvent.
+// default `hook.passthrough` activity event in handleHookEvent.
 // ─── Notification ───────────────────────────────────────────────────
 function handleNotification(input, client) {
     client.logger.info("lifecycle.notification", {
         sessionId: input.session_id,
         messageLen: input.message?.length,
     });
-    client.tracer.record("user.interaction", "ok", {
+    client.logger.activity("user.interaction", "ok", {
         attributes: { harness: HARNESS, kind: "notification" },
     });
     return {};
@@ -189,39 +123,8 @@ function handleSessionEnd(input, client) {
         sessionId: input.session_id,
         reason: input.reason,
     });
-    client.tracer.record("session.end", "ok", {
+    client.logger.activity("session.end", "ok", {
         attributes: { reason: input.reason },
     });
     return {};
 }
-// ─── Helpers ────────────────────────────────────────────────────────
-function resolveNamespace() {
-    return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
-}
-/**
- * Fail-open on a permission-check error: log and allow the tool. Critical
- * on Antigravity — returning anything other than `allow_tool: true` here
- * would block the user on a transient Ory/network blip.
- */
-function failOpen(oryErr, toolName, client) {
-    if (oryErr.code === "network_error") {
-        client.logger.warn("permission.network_error", {
-            toolName,
-            message: "Ory unreachable, failing open",
-        });
-    }
-    else if (oryErr.code === "rate_limited") {
-        client.logger.warn("permission.rate_limited", {
-            toolName,
-            message: "Ory rate limited, failing open",
-        });
-    }
-    else {
-        client.logger.error("permission.check.error", {
-            toolName,
-            code: oryErr.code,
-            message: oryErr.message,
-        });
-    }
-    return ALLOW;
-}

package/dist/hook.js

@@ -22,12 +22,21 @@ const emit_js_1 = require("./emit.js");
 const handlers_js_1 = require("./handlers.js");
 /** The fail-open response: explicitly allow, so a crash never blocks. */
 const FAIL_OPEN = { allow_tool: true };
+const EVENT_FLUSH_TIMEOUT_MS = 750;
+let client;
+async function flushEvents() {
+    try {
+        await client?.flushEvents(EVENT_FLUSH_TIMEOUT_MS);
+    }
+    catch {
+        // The hook decision must not depend on activity delivery.
+    }
+}
 /**
  * Single write-once gate shared by every exit path (normal, parse
  * failure, and the top-level catch). Because Antigravity fails closed on
  * malformed stdout, a double write (two concatenated JSON documents)
- * would BLOCK the tool — e.g. when the main path writes its decision and
- * `tracer.shutdown()` then rejects into the top-level catch.
+ * would BLOCK the tool.
  */
 const emit = (0, emit_js_1.createEmitOnce)();
 /**
@@ -60,7 +69,7 @@ function readStdin() {
     });
 }
 async function main() {
-    const client = argus_1.OryAgentClient.fromEnv("antigravity");
+    client = argus_1.OryAgentClient.fromEnv("antigravity");
     const raw = await readStdin();
     let input;
     try {
@@ -70,7 +79,6 @@ async function main() {
         client.logger.error("hook.stdin.parse_failed", { raw: raw.slice(0, 200) });
         // Can't tell the event; allow to avoid wedging a PreToolUse call.
         emit(FAIL_OPEN);
-        await client.tracer.shutdown();
         process.exit(0);
     }
     let output;
@@ -85,14 +93,15 @@ async function main() {
         output = FAIL_OPEN;
     }
     emit(output);
-    await client.tracer.shutdown();
+    await flushEvents();
     process.exit(0);
 }
-main().catch((err) => {
+main().catch(async (err) => {
     // Last-resort guard: allow rather than block, then exit cleanly. The
     // write-once emitter makes this a no-op when the decision was already
-    // written before the rejection (e.g. a failing tracer shutdown).
+    // written before the rejection.
     process.stderr.write(`[ory-agent] fatal: ${err}\n`);
     emit(FAIL_OPEN);
+    await flushEvents();
     process.exit(0);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/antigravity",
-  "version": "0.14.0",
+  "version": "1.0.1",
   "description": "Ory plugin for Google Antigravity: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://github.com/ory/ory-agent-plugins/tree/main/packages/antigravity",
@@ -41,8 +41,7 @@
     "llm",
     "mcp",
     "mcp-server",
-    "tracing",
-    "distributed-tracing",
+    "activity-auditing",
     "observability",
     "kratos",
     "keto",
@@ -53,6 +52,10 @@
     "registry": "https://registry.npmjs.org/",
     "provenance": true
   },
+  "reova": {
+    "enabled": true,
+    "endpoint": "https://telemetry.reo.dev/data"
+  },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
@@ -68,12 +71,11 @@
   },
   "files": [
     "dist",
-    "!dist/dev",
     "!dist/**/*.tsbuildinfo"
   ],
   "dependencies": {
-    "reo-census": "^1.2.8",
-    "@ory/argus": "0.14.0"
+    "reova": "^0.7.0",
+    "@ory/argus": "1.0.1"
   },
   "devDependencies": {
     "typescript": "^6.0.2",
@@ -87,7 +89,6 @@
     "clean": "rm -rf dist *.tsbuildinfo",
     "test": "vitest run",
     "test:watch": "vitest",
-    "typecheck": "tsc --noEmit",
-    "dev": "node dist/dev/launcher.js"
+    "typecheck": "tsc --noEmit"
   }
 }