@ory/argus 0.10.0 → 0.11.1

package/README.md

@@ -1,6 +1,6 @@
 # Ory Argus: Agent and Developer Experience
 
-The core API behind every Ory Agent Plugin and Extension. Argus wraps [Ory Identities](https://www.ory.com/ory-ecosystem), [Ory Permissions](https://ory.com/permissions), MCP authorization, and distributed tracing into a single client. Each of the harness packages (`@ory/claude-code`, `@ory/codex`, `@ory/gemini-cli`, `@ory/openclaw`, `@ory/opencode`) is a thin adapter that maps one harness's hook contract onto Argus.
+The core API behind every Ory Agent Plugin and Extension. Argus wraps [Ory Identities](https://www.ory.com/ory-ecosystem), [Ory Permissions](https://ory.com/permissions), MCP authorization, and distributed tracing into a single client. Each harness package (`@ory/claude-code`, `@ory/codex`, `@ory/gemini-cli`, and the rest — see the [root README](../../README.md) for the full list) is a thin adapter that maps one harness's hook contract onto Argus.
 
 Argus is also published on its own so you can build new harness plugins or extensions, embed Ory into a custom agent runtime, or instrument any SDK that exposes event lifecycle hooks for session start, tool execution, and tool completion.
 

package/dist/adapters.js

@@ -128,10 +128,25 @@ async function gate(client, opts) {
     const label = (0, subject_js_1.subjectLabel)(subjectRef);
     const canBlock = opts.canBlock ?? true;
     const spanAttrs = { toolName: opts.toolName, ...(opts.extraSpanAttributes ?? {}) };
+    const check = { namespace, object: opts.toolName, relation: "use", ...subjectRef };
+    // Audit-only kill switch: Ory is disabled entirely — no permission check.
+    // Record only the audit `tool.invoke` span (same span semantics as the
+    // harness plugins' audit-only short-circuit) and pass the tool through.
+    const resolved = (0, config_js_1.resolveConfig)();
+    if (resolved.auditOnly) {
+        client.tracer.record("tool.invoke", "ok", { attributes: spanAttrs });
+        const decision = {
+            kind: "allow",
+            result: { allowed: true, checkedAt: new Date().toISOString(), check },
+            mode: resolved.permissionMode,
+            spanAttributes: { permissionMode: resolved.permissionMode },
+        };
+        return { proceed: true, blocked: false, kind: "allow", decision, subject: label, namespace };
+    }
     const outcome = await (0, permissions_js_1.gateToolCall)(client, {
         harness: opts.harness,
         toolName: opts.toolName,
-        check: { namespace, object: opts.toolName, relation: "use", ...subjectRef },
+        check,
         spanAttributes: spanAttrs,
     });
     if (outcome.kind === "audit_only") {

package/dist/agent-auth.js

@@ -384,12 +384,13 @@ async function fetchClientCredentialsToken(args) {
  * the agent identity was available for the session.
  */
 async function ensureAgentIdentity(client, options = {}) {
-    // Kill switch: audit-only mode disables Ory entirely — no agent auth,
-    // mirroring the user gate's audit_only short-circuit.
+    // Audit-only kill switch: Ory is disabled entirely — skip credential
+    // resolution (no DCR, no token grant) and record the no-op, shaped like
+    // the user gate's audit_only result.
     if ((0, config_js_1.resolveConfig)().auditOnly) {
         const creds = {
             kind: "none",
-            reason: "Configured for audit-only mode; agent identity is a no-op",
+            reason: "Configured for audit-only mode; agent identity resolution is a no-op",
             warnings: [],
         };
         client.tracer.record("agent.auth", "skipped", {
@@ -450,6 +451,25 @@ async function ensureAgentIdentity(client, options = {}) {
  * resolution.
  */
 async function ensureSubAgentIdentity(client, options) {
+    // Audit-only kill switch: same no-op as ensureAgentIdentity — no
+    // sub-agent DCR while Ory is disabled entirely.
+    if ((0, config_js_1.resolveConfig)().auditOnly) {
+        const identity = {
+            kind: "none",
+            subAgentType: options.subAgentType,
+            reason: "Configured for audit-only mode; sub-agent identity resolution is a no-op",
+            warnings: [],
+        };
+        client.tracer.record("agent.auth", "skipped", {
+            attributes: {
+                kind: "subagent_none",
+                subAgentType: identity.subAgentType,
+                reason: identity.reason,
+                auditOnly: true,
+            },
+        });
+        return identity;
+    }
     const env = options.env ?? process.env;
     const registerFn = options.registerAgentClientFn ?? registerAgentClient;
     const loadFn = options.loadFn ?? loadSubAgentDynamicCredentials;

package/dist/config.js

@@ -290,15 +290,47 @@ function acquireLock() {
                 throw new Error(`Timed out waiting for config lock at ${lockPath}. ` +
                     "Another process may be holding it; remove the file if you are sure no other process is running.");
             }
-            sleepSync(LOCK_POLL_MS);
+            if (!sleepSync(LOCK_POLL_MS)) {
+                // The runtime can't block synchronously (no SharedArrayBuffer /
+                // Atomics.wait — e.g. Cloudflare Workers). Rather than hot-spin
+                // until the deadline, proceed without the lock: the write itself
+                // stays atomic via write-temp + rename.
+                return { fd: null };
+            }
         }
     }
 }
-const SLEEP_BUF = new Int32Array(new SharedArrayBuffer(4));
+/**
+ * Lazily initialized buffer for `Atomics.wait`-based synchronous sleep.
+ * `undefined` = not yet probed; `null` = unavailable on this runtime.
+ * Never touched at module scope: constructing a SharedArrayBuffer eagerly
+ * would make merely importing this module throw on runtimes without it
+ * (e.g. Cloudflare Workers).
+ */
+let sleepBuf;
+/** Sleep synchronously. Returns false when the runtime can't sleep. */
 function sleepSync(ms) {
-    Atomics.wait(SLEEP_BUF, 0, 0, ms);
+    if (sleepBuf === undefined) {
+        try {
+            sleepBuf =
+                typeof SharedArrayBuffer === "function" &&
+                    typeof Atomics !== "undefined" &&
+                    typeof Atomics.wait === "function"
+                    ? new Int32Array(new SharedArrayBuffer(4))
+                    : null;
+        }
+        catch {
+            sleepBuf = null;
+        }
+    }
+    if (sleepBuf === null)
+        return false;
+    Atomics.wait(sleepBuf, 0, 0, ms);
+    return true;
 }
 function releaseLock(lock) {
+    if (lock.fd === null)
+        return; // lock-less fallback: nothing to release
     try {
         fs.closeSync(lock.fd);
     }

package/dist/index.d.ts

@@ -19,7 +19,7 @@ export { checkAndDecide, applyPermissionMode, gateToolCall, type PermissionDecis
 export { HARNESS_TOOL_CATALOG, KNOWN_HARNESSES, ALL_TOOLS, getToolCatalog, INTERACTIVE_TOOL_CATALOG, getInteractiveToolCatalog, isInteractiveTool, type KnownHarness, } from "./tool-catalog.js";
 export { classifyLifecycle, isUserFacingPhase, isToolExecutionPhase, HARNESS_LIFECYCLE_MAP, USER_FACING_PHASES, TOOL_EXECUTION_PHASES, type LifecyclePhase, } from "./lifecycle.js";
 export { parseClaudeCodeMcpTool, parseGeminiMcpTool, parseMcpToolGeneric, checkMcpPermission, type McpToolIdentifier, type McpPermissionCheckOptions, type McpPermissionResult, } from "./mcp.js";
-export { resolveUserSubject, subjectLabel, type UserSubjectRef, } from "./subject.js";
+export { resolveUserSubject, runWithUserSubject, subjectLabel, type UserSubjectRef, } from "./subject.js";
 export { formatDenialMessage, formatDenialSummary, formatAlertMessage, formatAlertSummary, alertAttributes, OryDenialError, type DenialContext, type AlertAttributes, } from "./denial.js";
 export { summarizeToolInput, summarizeToolOutput, type ToolInputSummary, type ToolOutputSummary, } from "./tool-metadata.js";
 export { OtlpExporter, otlpExporterFromEnv, parseKeyValueList, type SpanExporter, type OtlpExporterOptions, type OtlpProtocol, } from "./otel/index.js";

package/dist/index.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.printOryConfig = exports.runAgentCommand = exports.runConfigureCommand = exports.AGENT_TOKEN_EXPIRY_SKEW_SEC = exports.clearSubAgentDynamicCredentials = exports.saveSubAgentDynamicCredentials = exports.loadSubAgentDynamicCredentials = exports.clearAgentDynamicCredentials = exports.saveAgentDynamicCredentials = exports.loadAgentDynamicCredentials = exports.registerAgentClient = exports.fetchClientCredentialsToken = exports.ensureSubAgentIdentity = exports.ensureAgentIdentity = exports.resolveAgentCredentials = exports.ensureAuthenticated = exports.ensureUserAuthenticated = exports.TOKEN_EXPIRY_SKEW_SEC = exports.waitForPeerTokensSync = exports.waitForPeerTokens = exports.clearPkceFlightLock = exports.tryAcquirePkceFlightLock = exports.refreshAndSave = exports.isExpired = exports.clearTokens = exports.saveTokens = exports.loadTokens = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.LOOPBACK_PORTS = exports.buildAuthorizeUrl = exports.sha256Base64Url = exports.generateCodeVerifier = exports.detectHeadless = exports.refreshAccessToken = exports.pkceLogin = exports.getHarnessDataDir = exports.getDataDir = exports.getConfigPath = exports.mutateConfig = exports.resolveConfig = exports.saveConfig = exports.loadConfig = exports.watchTraceFile = exports.formatSpan = exports.deriveTraceId = exports.ActiveSpan = exports.Tracer = exports.redactLogData = exports.DebugLogger = exports.OryAgentClient = void 0;
 exports.runLocalCommand = exports.ORY_COMMAND_SLUGS = exports.ORY_COMMAND_SKILL_NAMES = exports.ORY_SKILL_NAMES = exports.removeSkillDirs = exports.writeSkillTree = exports.toSkillMarkdown = exports.commandToPlainMarkdown = exports.commandToFrontmatterMarkdown = exports.commandToToml = exports.commandToSkill = exports.renderOryCommands = exports.renderOrySkills = exports.runDevLauncher = exports.unregisterPlugin = exports.registerPlugin = exports.removeMcpServer = exports.mergeMcpServer = exports.mcpServerEntry = exports.resolveMcpServerCommand = exports.printNextSteps = exports.printSetupHelp = exports.removeFlatHooks = exports.mergeFlatHooks = exports.flatHookEntry = exports.removeMatcherHooks = exports.mergeMatcherHooks = exports.matcherHookEntry = exports.resolveHookCommand = exports.isOryHookCommand = exports.writeJsonFile = exports.readJsonFile = exports.parseSetupArgs = exports.printPermissionsSection = exports.printAgentIdentitySection = exports.printUserIdentitySection = exports.runStatusCommand = exports.printPermissionsOnboardingHelp = exports.maybeAutoBootstrap = exports.isUserIdentityCached = exports.runPermissionsCommand = exports.interactiveConfigPrompt = exports.promptForProjectUrl = exports.promptOnTty = exports.isTtyAvailable = exports.runWatchCommand = exports.printTraceTail = exports.printEnvHelp = exports.printLogTail = exports.printEnvironment = void 0;
-exports.wrapTool = exports.registerSubagent = exports.complete = exports.gate = exports.sessionStart = exports.resolveNamespace = exports.parseKeyValueList = exports.otlpExporterFromEnv = exports.OtlpExporter = exports.summarizeToolOutput = exports.summarizeToolInput = exports.OryDenialError = exports.alertAttributes = exports.formatAlertSummary = exports.formatAlertMessage = exports.formatDenialSummary = exports.formatDenialMessage = exports.subjectLabel = exports.resolveUserSubject = exports.checkMcpPermission = exports.parseMcpToolGeneric = exports.parseGeminiMcpTool = exports.parseClaudeCodeMcpTool = exports.TOOL_EXECUTION_PHASES = exports.USER_FACING_PHASES = exports.HARNESS_LIFECYCLE_MAP = exports.isToolExecutionPhase = exports.isUserFacingPhase = exports.classifyLifecycle = exports.isInteractiveTool = exports.getInteractiveToolCatalog = exports.INTERACTIVE_TOOL_CATALOG = exports.getToolCatalog = exports.ALL_TOOLS = exports.KNOWN_HARNESSES = exports.HARNESS_TOOL_CATALOG = exports.gateToolCall = exports.applyPermissionMode = exports.checkAndDecide = exports.runRegistryCommand = exports.DEV_JAEGER_CONTAINER = exports.stopDevJaeger = exports.ensureDevJaeger = void 0;
+exports.wrapTool = exports.registerSubagent = exports.complete = exports.gate = exports.sessionStart = exports.resolveNamespace = exports.parseKeyValueList = exports.otlpExporterFromEnv = exports.OtlpExporter = exports.summarizeToolOutput = exports.summarizeToolInput = exports.OryDenialError = exports.alertAttributes = exports.formatAlertSummary = exports.formatAlertMessage = exports.formatDenialSummary = exports.formatDenialMessage = exports.subjectLabel = exports.runWithUserSubject = exports.resolveUserSubject = exports.checkMcpPermission = exports.parseMcpToolGeneric = exports.parseGeminiMcpTool = exports.parseClaudeCodeMcpTool = exports.TOOL_EXECUTION_PHASES = exports.USER_FACING_PHASES = exports.HARNESS_LIFECYCLE_MAP = exports.isToolExecutionPhase = exports.isUserFacingPhase = exports.classifyLifecycle = exports.isInteractiveTool = exports.getInteractiveToolCatalog = exports.INTERACTIVE_TOOL_CATALOG = exports.getToolCatalog = exports.ALL_TOOLS = exports.KNOWN_HARNESSES = exports.HARNESS_TOOL_CATALOG = exports.gateToolCall = exports.applyPermissionMode = exports.checkAndDecide = exports.runRegistryCommand = exports.DEV_JAEGER_CONTAINER = exports.stopDevJaeger = exports.ensureDevJaeger = void 0;
 var client_js_1 = require("./client.js");
 Object.defineProperty(exports, "OryAgentClient", { enumerable: true, get: function () { return client_js_1.OryAgentClient; } });
 var logger_js_1 = require("./logger.js");
@@ -149,6 +149,7 @@ Object.defineProperty(exports, "parseMcpToolGeneric", { enumerable: true, get: f
 Object.defineProperty(exports, "checkMcpPermission", { enumerable: true, get: function () { return mcp_js_1.checkMcpPermission; } });
 var subject_js_1 = require("./subject.js");
 Object.defineProperty(exports, "resolveUserSubject", { enumerable: true, get: function () { return subject_js_1.resolveUserSubject; } });
+Object.defineProperty(exports, "runWithUserSubject", { enumerable: true, get: function () { return subject_js_1.runWithUserSubject; } });
 Object.defineProperty(exports, "subjectLabel", { enumerable: true, get: function () { return subject_js_1.subjectLabel; } });
 var denial_js_1 = require("./denial.js");
 Object.defineProperty(exports, "formatDenialMessage", { enumerable: true, get: function () { return denial_js_1.formatDenialMessage; } });

package/dist/lifecycle.js

@@ -197,6 +197,7 @@ exports.HARNESS_LIFECYCLE_MAP = {
         "execute.after": "tool.after",
     },
     "claude-agent-sdk": {
+        SessionStart: "session.start",
         PreToolUse: "tool.before",
         PostToolUse: "tool.after",
     },

package/dist/permissions.d.ts

@@ -12,8 +12,15 @@
  *          return `{ kind: "observe", … }` so the caller allows the
  *          tool through.
  *        - `enforce` — return `{ kind: "deny", … }` so the caller blocks.
- *   3. On a thrown {@link OryError} (network_error, rate_limited, etc.),
- *      returns `{ kind: "fail_open", … }`. Callers should log and allow.
+ *   3. On a thrown {@link OryError}, inspects the classified code:
+ *        - Infrastructure errors (`network_error`, `rate_limited`,
+ *          `not_found`, `unknown`) — returns `{ kind: "fail_open", … }`.
+ *          Callers should log and allow.
+ *        - Auth-rejected check calls (`forbidden`, `session_inactive`,
+ *          `session_aal2_required` — the check itself was rejected, so
+ *          its result cannot be trusted) — in `enforce` mode returns
+ *          `{ kind: "deny", … }` so the caller blocks; in `observe`
+ *          mode falls back to `fail_open` (observe never blocks).
  *
  * The discriminated `kind` lets plugins map cleanly to their native
  * decision shape (claude-code exit codes, openclaw `{ block: true }`,
@@ -22,7 +29,7 @@
  */
 import type { OryAgentClient } from "./client.js";
 import { type PermissionMode } from "./config.js";
-import type { OryError, PermissionCheck, PermissionResult } from "./types.js";
+import type { OryError, OryErrorCode, PermissionCheck, PermissionResult } from "./types.js";
 /**
  * Attributes describing *what was checked* and *under which posture*.
  * Plugins spread this onto their `tool.invoke` / `tool.block` spans so
@@ -36,6 +43,13 @@ export interface DecisionSpanAttributes {
     subjectId?: string;
     /** SubjectSet rendered as `<namespace>:<object>#<relation>` when used. */
     subjectSet?: string;
+    /**
+     * Set when the check call itself was auth-rejected and enforce mode
+     * turned that into a deny — the classified {@link OryErrorCode} that
+     * caused it. Makes the "denied because the check failed" case
+     * distinguishable from a normal Keto deny in the audit trail.
+     */
+    checkRejected?: OryErrorCode;
 }
 export type PermissionDecision = {
     kind: "allow";
@@ -182,7 +196,9 @@ export interface GateToolCallArgs {
 export declare function gateToolCall(client: OryAgentClient, args: GateToolCallArgs): Promise<ToolGateOutcome>;
 /**
  * Run a permission check and resolve the configured mode against the
- * result. Never throws — fail-open scenarios are surfaced as a typed
- * `{ kind: "fail_open" }` decision.
+ * result. Never throws — infrastructure errors surface as a typed
+ * `{ kind: "fail_open" }` decision, and auth-rejected check calls in
+ * enforce mode as `{ kind: "deny" }` (see
+ * {@link CHECK_AUTH_REJECTED_CODES}).
  */
 export declare function checkAndDecide(client: OryAgentClient, check: PermissionCheck, opts?: CheckAndDecideOptions): Promise<PermissionDecision>;

package/dist/permissions.js

@@ -13,8 +13,15 @@
  *          return `{ kind: "observe", … }` so the caller allows the
  *          tool through.
  *        - `enforce` — return `{ kind: "deny", … }` so the caller blocks.
- *   3. On a thrown {@link OryError} (network_error, rate_limited, etc.),
- *      returns `{ kind: "fail_open", … }`. Callers should log and allow.
+ *   3. On a thrown {@link OryError}, inspects the classified code:
+ *        - Infrastructure errors (`network_error`, `rate_limited`,
+ *          `not_found`, `unknown`) — returns `{ kind: "fail_open", … }`.
+ *          Callers should log and allow.
+ *        - Auth-rejected check calls (`forbidden`, `session_inactive`,
+ *          `session_aal2_required` — the check itself was rejected, so
+ *          its result cannot be trusted) — in `enforce` mode returns
+ *          `{ kind: "deny", … }` so the caller blocks; in `observe`
+ *          mode falls back to `fail_open` (observe never blocks).
  *
  * The discriminated `kind` lets plugins map cleanly to their native
  * decision shape (claude-code exit codes, openclaw `{ block: true }`,
@@ -27,6 +34,19 @@ exports.gateToolCall = gateToolCall;
 exports.checkAndDecide = checkAndDecide;
 const config_js_1 = require("./config.js");
 const tool_catalog_js_1 = require("./tool-catalog.js");
+/**
+ * Error codes meaning the check call itself was rejected for
+ * authentication/authorization reasons — an expired or misconfigured
+ * agent credential, an inactive session, or a missing MFA step. The
+ * check result cannot be trusted, so `enforce` mode denies instead of
+ * failing open. Infrastructure errors (`network_error`, `rate_limited`,
+ * `not_found`, `unknown`) keep the fail-open posture.
+ */
+const CHECK_AUTH_REJECTED_CODES = new Set([
+    "forbidden",
+    "session_inactive",
+    "session_aal2_required",
+]);
 function formatSubjectSet(set) {
     if (!set)
         return undefined;
@@ -140,8 +160,10 @@ async function gateToolCall(client, args) {
 }
 /**
  * Run a permission check and resolve the configured mode against the
- * result. Never throws — fail-open scenarios are surfaced as a typed
- * `{ kind: "fail_open" }` decision.
+ * result. Never throws — infrastructure errors surface as a typed
+ * `{ kind: "fail_open" }` decision, and auth-rejected check calls in
+ * enforce mode as `{ kind: "deny" }` (see
+ * {@link CHECK_AUTH_REJECTED_CODES}).
  */
 async function checkAndDecide(client, check, opts = {}) {
     const mode = opts.modeOverride ?? (0, config_js_1.resolveConfig)().permissionMode;
@@ -153,7 +175,25 @@ async function checkAndDecide(client, check, opts = {}) {
         });
     }
     catch (err) {
-        return { kind: "fail_open", error: err, mode, spanAttributes };
+        const oryErr = err;
+        if (mode === "enforce" && oryErr && CHECK_AUTH_REJECTED_CODES.has(oryErr.code)) {
+            // The check call itself was rejected for auth reasons — the
+            // result cannot be trusted, so enforce mode must not fail open.
+            client.logger.warn("permission.check_rejected", {
+                namespace: check.namespace,
+                object: check.object,
+                relation: check.relation,
+                code: oryErr.code,
+                note: `permission check rejected (${oryErr.code}); enforce mode denies when checks cannot be completed`,
+            });
+            return {
+                kind: "deny",
+                result: { allowed: false, checkedAt: new Date().toISOString(), check },
+                mode: "enforce",
+                spanAttributes: { ...spanAttributes, checkRejected: oryErr.code },
+            };
+        }
+        return { kind: "fail_open", error: oryErr, mode, spanAttributes };
     }
     const inner = applyPermissionMode(client, result.allowed, {
         namespace: check.namespace,

package/dist/subject.d.ts

@@ -27,7 +27,19 @@ export type UserSubjectRef = {
     };
 };
 /**
- * Resolve the user subject for permission checks. Prefers the user
+ * Run `fn` with a per-call user subject that takes precedence over the
+ * client's user principal and the env overrides in
+ * {@link resolveUserSubject}. The override only applies within `fn`'s
+ * async context, so concurrent calls cannot observe each other's subject.
+ * `ORY_USER_SUBJECT_NAMESPACE` SubjectSet shaping still applies.
+ *
+ * A missing/empty `subject` is a no-op: `fn` runs with the normal
+ * resolution chain.
+ */
+export declare function runWithUserSubject<T>(subject: string | undefined, fn: () => T): T;
+/**
+ * Resolve the user subject for permission checks. Prefers a per-call
+ * override installed via {@link runWithUserSubject}, then the user
  * login's `userPrincipal.subject`, falls back to `ORY_USER_SUBJECT_ID`, then the
  * legacy `ORY_AGENT_SUBJECT_ID`, then the caller-supplied `fallback`
  * (typically `session:<id>`).

package/dist/subject.js

@@ -18,10 +18,36 @@
  * falls back to the direct SubjectID chain.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.runWithUserSubject = runWithUserSubject;
 exports.resolveUserSubject = resolveUserSubject;
 exports.subjectLabel = subjectLabel;
+const node_async_hooks_1 = require("node:async_hooks");
 /**
- * Resolve the user subject for permission checks. Prefers the user
+ * Per-async-context user-subject override. Populated by
+ * {@link runWithUserSubject} so multi-user server integrations (Vercel AI
+ * SDK, Cloudflare Agents) can attribute each request to its own acting
+ * user without mutating the shared client or process env — both of which
+ * would race under concurrent requests.
+ */
+const perCallUserSubject = new node_async_hooks_1.AsyncLocalStorage();
+/**
+ * Run `fn` with a per-call user subject that takes precedence over the
+ * client's user principal and the env overrides in
+ * {@link resolveUserSubject}. The override only applies within `fn`'s
+ * async context, so concurrent calls cannot observe each other's subject.
+ * `ORY_USER_SUBJECT_NAMESPACE` SubjectSet shaping still applies.
+ *
+ * A missing/empty `subject` is a no-op: `fn` runs with the normal
+ * resolution chain.
+ */
+function runWithUserSubject(subject, fn) {
+    if (!subject)
+        return fn();
+    return perCallUserSubject.run(subject, fn);
+}
+/**
+ * Resolve the user subject for permission checks. Prefers a per-call
+ * override installed via {@link runWithUserSubject}, then the user
  * login's `userPrincipal.subject`, falls back to `ORY_USER_SUBJECT_ID`, then the
  * legacy `ORY_AGENT_SUBJECT_ID`, then the caller-supplied `fallback`
  * (typically `session:<id>`).
@@ -30,7 +56,8 @@ exports.subjectLabel = subjectLabel;
  * concrete subject is available; otherwise a direct SubjectID.
  */
 function resolveUserSubject(client, fallback) {
-    const subject = client.userPrincipal.subject
+    const subject = perCallUserSubject.getStore()
+        ?? client.userPrincipal.subject
         ?? process.env.ORY_USER_SUBJECT_ID
         ?? process.env.ORY_AGENT_SUBJECT_ID
         ?? fallback;

package/dist/tool-catalog.d.ts

@@ -16,6 +16,7 @@
  */
 export declare const HARNESS_TOOL_CATALOG: {
     readonly "claude-code": readonly ["Read", "Write", "Edit", "Bash", "Glob", "Grep", "WebFetch", "WebSearch", "NotebookEdit", "TodoWrite", "Task"];
+    readonly "claude-agent-sdk": readonly ["Read", "Write", "Edit", "Bash", "Glob", "Grep", "WebFetch", "WebSearch", "NotebookEdit", "TodoWrite", "Task"];
     readonly codex: readonly ["shell", "apply_patch", "read_file"];
     readonly "gemini-cli": readonly ["read_file", "write_file", "edit_file", "list_files", "search_files", "shell", "web_search"];
     readonly openclaw: readonly ["execute_command", "read_file", "write_file", "list_directory", "search_files", "browser"];

package/dist/tool-catalog.js

@@ -34,6 +34,22 @@ exports.HARNESS_TOOL_CATALOG = {
         "TodoWrite",
         "Task",
     ],
+    // The Claude Agent SDK exposes the same built-in tool surface as Claude
+    // Code (it is the embeddable form of the same runtime), so the catalog
+    // mirrors claude-code's and `permissions bootstrap` can seed it.
+    "claude-agent-sdk": [
+        "Read",
+        "Write",
+        "Edit",
+        "Bash",
+        "Glob",
+        "Grep",
+        "WebFetch",
+        "WebSearch",
+        "NotebookEdit",
+        "TodoWrite",
+        "Task",
+    ],
     codex: ["shell", "apply_patch", "read_file"],
     "gemini-cli": [
         "read_file",
@@ -136,6 +152,9 @@ exports.ALL_TOOLS = Array.from(new Set(Object.values(exports.HARNESS_TOOL_CATALO
  */
 exports.INTERACTIVE_TOOL_CATALOG = {
     "claude-code": ["AskUserQuestion", "ExitPlanMode", "TodoWrite"],
+    // Same runtime as Claude Code — the SDK delivers the same
+    // user-interaction primitives through PreToolUse.
+    "claude-agent-sdk": ["AskUserQuestion", "ExitPlanMode", "TodoWrite"],
     codex: [],
     "gemini-cli": [],
     openclaw: [],

package/dist/user-login.js

@@ -165,8 +165,13 @@ async function runUserLogin(client, options) {
             };
         }
     }
-    // 2. Pre-supplied env tokens short-circuit the browser flow (CI, scripted runs).
-    if (process.env.ORY_SESSION_TOKEN || process.env.ORY_OAUTH2_TOKEN) {
+    // 2. Pre-supplied env tokens short-circuit the browser flow (CI, scripted
+    //    runs). ORY_USER_* are the documented names; the legacy single-identity
+    //    ORY_SESSION_TOKEN / ORY_OAUTH2_TOKEN are still honored.
+    if (process.env.ORY_USER_SESSION_TOKEN ||
+        process.env.ORY_USER_OAUTH2_TOKEN ||
+        process.env.ORY_SESSION_TOKEN ||
+        process.env.ORY_OAUTH2_TOKEN) {
         return {
             proceed: true,
             mode: "env_token",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "0.10.0",
+  "version": "0.11.1",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",