@ory/argus 0.12.1 → 0.13.1

package/dist/build-info.json

@@ -0,0 +1,9 @@
+{
+  "repo": "ory-agent-plugins",
+  "commit": "8a7c3508e54376b6dda634dc54f8c5891d499a7a",
+  "commitShort": "8a7c350",
+  "branch": "main",
+  "commitDate": "2026-07-14T12:09:14-07:00",
+  "dirty": false,
+  "builtAt": "2026-07-14T19:13:39.008Z"
+}

package/dist/dev.js

@@ -174,15 +174,27 @@ function buildInstallContext(harnessName, sandboxDir, binaryName) {
         npxCli(args, opts = {}) {
             const packageName = opts.packageName ?? defaultPackage;
             const binaryName = opts.binaryName ?? defaultBin;
-            console.log(`[ory-dev] npx --package=${packageName} ${binaryName} ${args.join(" ")}`);
+            // The dev launcher owns Ory configuration itself: it brings up (or
+            // reuses) the local Ory stack, seeds identities, and wires the harness
+            // env directly in `runDevLauncher`. The install CLI's interactive setup
+            // wizard must not run here — it inherits the launcher's real TTY, so it
+            // would prompt the developer and (on its local branch) try to stand up a
+            // second Ory stack, colliding with the one the launcher bootstraps right
+            // after. Force the wizard's `--no-configure` escape hatch on every
+            // `install` invocation so the launcher's install step stays
+            // non-interactive.
+            const finalArgs = args[0] === "install" && !args.includes("--no-configure")
+                ? [...args, "--no-configure"]
+                : args;
+            console.log(`[ory-dev] npx --package=${packageName} ${binaryName} ${finalArgs.join(" ")}`);
             const result = (0, node_child_process_1.spawnSync)("npx", [
                 "--yes",
                 `--package=${packageName}`,
                 binaryName,
-                ...args,
+                ...finalArgs,
             ], { cwd: sandboxDir, stdio: "inherit", env: npmEnv() });
             if (result.status !== 0) {
-                throw new Error(`npx --package=${packageName} ${binaryName} ${args.join(" ")} failed (exit ${result.status}).`);
+                throw new Error(`npx --package=${packageName} ${binaryName} ${finalArgs.join(" ")} failed (exit ${result.status}).`);
             }
         },
     };

package/dist/index.d.ts

@@ -13,6 +13,7 @@ export { oryNpx } from "./cli-invocation.js";
 export { runPermissionsCommand, isUserIdentityCached, maybeAutoBootstrap, printPermissionsOnboardingHelp, } from "./permissions-cli.js";
 export { runInteractiveSetup, runPostInstall, projectUrlFromSlug, LOOPBACK_REDIRECT_URIS, type OryCliRunner, type OryExecResult, type InteractiveSetupDeps, type InteractiveSetupOutcome, type InteractiveSetupResult, } from "./interactive-setup.js";
 export { runStatusCommand, printUserIdentitySection, printAgentIdentitySection, printPermissionsSection, type StatusCommandOptions, } from "./status-cli.js";
+export { runVersionCommand, collectVersionInfo, resolveBuildInfo, type BuildInfo, type VersionInfo, type VersionCommandOptions, } from "./version-cli.js";
 export { parseSetupArgs, readJsonFile, writeJsonFile, isOryHookCommand, resolveHookCommand, matcherHookEntry, mergeMatcherHooks, removeMatcherHooks, flatHookEntry, mergeFlatHooks, removeFlatHooks, printSetupHelp, printNextSteps, nextStepsSink, beginDeferNextSteps, emitDeferredNextSteps, resolveMcpServerCommand, mcpServerEntry, mergeMcpServer, removeMcpServer, registerPlugin, unregisterPlugin, type SetupArgs, type HookCommand, type MatcherEntry, } from "./setup.js";
 export { runDevLauncher, type DevLauncherConfig, type InstallContext, } from "./dev.js";
 export { renderOrySkills, renderOryCommands, commandToSkill, commandToToml, commandToFrontmatterMarkdown, commandToPlainMarkdown, toSkillMarkdown, writeSkillTree, removeSkillDirs, ORY_SKILL_NAMES, ORY_COMMAND_SKILL_NAMES, ORY_COMMAND_SLUGS, type RenderedSkill, type RenderedCommand, type RenderProfileOptions, } from "./skills.js";

package/dist/index.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runConfigureCommand = exports.clearCredentialsForUninstall = exports.AGENT_TOKEN_EXPIRY_SKEW_SEC = exports.revokeAgentDynamicClient = exports.clearSubAgentDynamicCredentials = exports.saveSubAgentDynamicCredentials = exports.loadSubAgentDynamicCredentials = exports.clearAgentDynamicCredentials = exports.saveAgentDynamicCredentials = exports.loadAgentDynamicCredentials = exports.registerAgentClient = exports.fetchClientCredentialsToken = exports.ensureSubAgentIdentity = exports.ensureAgentIdentity = exports.resolveAgentCredentials = exports.ensureAuthenticated = exports.ensureUserAuthenticated = exports.TOKEN_EXPIRY_SKEW_SEC = exports.waitForPeerTokensSync = exports.waitForPeerTokens = exports.clearPkceFlightLock = exports.tryAcquirePkceFlightLock = exports.refreshAndSave = exports.isExpired = exports.clearTokens = exports.saveTokens = exports.loadTokens = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.LOOPBACK_PORTS = exports.buildAuthorizeUrl = exports.sha256Base64Url = exports.generateCodeVerifier = exports.detectHeadless = exports.refreshAccessToken = exports.pkceLogin = exports.getHarnessDataDir = exports.getDataDir = exports.getConfigPath = exports.mutateConfig = exports.resolveConfig = exports.saveConfig = exports.loadConfig = exports.watchTraceFile = exports.formatSpan = exports.deriveTraceId = exports.ActiveSpan = exports.Tracer = exports.redactLogData = exports.DebugLogger = exports.OryAgentClient = void 0;
-exports.commandToSkill = exports.renderOryCommands = exports.renderOrySkills = exports.runDevLauncher = exports.unregisterPlugin = exports.registerPlugin = exports.removeMcpServer = exports.mergeMcpServer = exports.mcpServerEntry = exports.resolveMcpServerCommand = exports.emitDeferredNextSteps = exports.beginDeferNextSteps = exports.nextStepsSink = exports.printNextSteps = exports.printSetupHelp = exports.removeFlatHooks = exports.mergeFlatHooks = exports.flatHookEntry = exports.removeMatcherHooks = exports.mergeMatcherHooks = exports.matcherHookEntry = exports.resolveHookCommand = exports.isOryHookCommand = exports.writeJsonFile = exports.readJsonFile = exports.parseSetupArgs = exports.printPermissionsSection = exports.printAgentIdentitySection = exports.printUserIdentitySection = exports.runStatusCommand = exports.LOOPBACK_REDIRECT_URIS = exports.projectUrlFromSlug = exports.runPostInstall = exports.runInteractiveSetup = exports.printPermissionsOnboardingHelp = exports.maybeAutoBootstrap = exports.isUserIdentityCached = exports.runPermissionsCommand = exports.oryNpx = exports.interactiveConfigPrompt = exports.promptForProjectUrl = exports.promptOnTty = exports.isTtyAvailable = exports.runWatchCommand = exports.printTraceTail = exports.printEnvHelp = exports.printLogTail = exports.printEnvironment = exports.printOryConfig = exports.runAgentCommand = void 0;
-exports.sessionStart = exports.resolveNamespace = exports.parseKeyValueList = exports.otlpExporterFromEnv = exports.OtlpExporter = exports.summarizeToolOutput = exports.summarizeToolInput = exports.OryDenialError = exports.alertAttributes = exports.formatAlertSummary = exports.formatAlertMessage = exports.formatDenialSummary = exports.formatDenialMessage = exports.subjectLabel = exports.runWithUserSubject = exports.resolveUserSubject = exports.checkMcpPermission = exports.parseMcpToolGeneric = exports.parseGeminiMcpTool = exports.parseClaudeCodeMcpTool = exports.TOOL_EXECUTION_PHASES = exports.USER_FACING_PHASES = exports.HARNESS_LIFECYCLE_MAP = exports.isToolExecutionPhase = exports.isUserFacingPhase = exports.classifyLifecycle = exports.isInteractiveTool = exports.getInteractiveToolCatalog = exports.INTERACTIVE_TOOL_CATALOG = exports.getToolCatalog = exports.ALL_TOOLS = exports.KNOWN_HARNESSES = exports.HARNESS_TOOL_CATALOG = exports.gateToolCall = exports.applyPermissionMode = exports.checkAndDecide = exports.runRegistryCommand = exports.DEV_JAEGER_CONTAINER = exports.stopDevJaeger = exports.ensureDevJaeger = exports.runLocalCommand = exports.ORY_COMMAND_SLUGS = exports.ORY_COMMAND_SKILL_NAMES = exports.ORY_SKILL_NAMES = exports.removeSkillDirs = exports.writeSkillTree = exports.toSkillMarkdown = exports.commandToPlainMarkdown = exports.commandToFrontmatterMarkdown = exports.commandToToml = void 0;
-exports.wrapTool = exports.registerSubagent = exports.complete = exports.gate = void 0;
+exports.runDevLauncher = exports.unregisterPlugin = exports.registerPlugin = exports.removeMcpServer = exports.mergeMcpServer = exports.mcpServerEntry = exports.resolveMcpServerCommand = exports.emitDeferredNextSteps = exports.beginDeferNextSteps = exports.nextStepsSink = exports.printNextSteps = exports.printSetupHelp = exports.removeFlatHooks = exports.mergeFlatHooks = exports.flatHookEntry = exports.removeMatcherHooks = exports.mergeMatcherHooks = exports.matcherHookEntry = exports.resolveHookCommand = exports.isOryHookCommand = exports.writeJsonFile = exports.readJsonFile = exports.parseSetupArgs = exports.resolveBuildInfo = exports.collectVersionInfo = exports.runVersionCommand = exports.printPermissionsSection = exports.printAgentIdentitySection = exports.printUserIdentitySection = exports.runStatusCommand = exports.LOOPBACK_REDIRECT_URIS = exports.projectUrlFromSlug = exports.runPostInstall = exports.runInteractiveSetup = exports.printPermissionsOnboardingHelp = exports.maybeAutoBootstrap = exports.isUserIdentityCached = exports.runPermissionsCommand = exports.oryNpx = exports.interactiveConfigPrompt = exports.promptForProjectUrl = exports.promptOnTty = exports.isTtyAvailable = exports.runWatchCommand = exports.printTraceTail = exports.printEnvHelp = exports.printLogTail = exports.printEnvironment = exports.printOryConfig = exports.runAgentCommand = void 0;
+exports.otlpExporterFromEnv = exports.OtlpExporter = exports.summarizeToolOutput = exports.summarizeToolInput = exports.OryDenialError = exports.alertAttributes = exports.formatAlertSummary = exports.formatAlertMessage = exports.formatDenialSummary = exports.formatDenialMessage = exports.subjectLabel = exports.runWithUserSubject = exports.resolveUserSubject = exports.checkMcpPermission = exports.parseMcpToolGeneric = exports.parseGeminiMcpTool = exports.parseClaudeCodeMcpTool = exports.TOOL_EXECUTION_PHASES = exports.USER_FACING_PHASES = exports.HARNESS_LIFECYCLE_MAP = exports.isToolExecutionPhase = exports.isUserFacingPhase = exports.classifyLifecycle = exports.isInteractiveTool = exports.getInteractiveToolCatalog = exports.INTERACTIVE_TOOL_CATALOG = exports.getToolCatalog = exports.ALL_TOOLS = exports.KNOWN_HARNESSES = exports.HARNESS_TOOL_CATALOG = exports.gateToolCall = exports.applyPermissionMode = exports.checkAndDecide = exports.runRegistryCommand = exports.DEV_JAEGER_CONTAINER = exports.stopDevJaeger = exports.ensureDevJaeger = exports.runLocalCommand = exports.ORY_COMMAND_SLUGS = exports.ORY_COMMAND_SKILL_NAMES = exports.ORY_SKILL_NAMES = exports.removeSkillDirs = exports.writeSkillTree = exports.toSkillMarkdown = exports.commandToPlainMarkdown = exports.commandToFrontmatterMarkdown = exports.commandToToml = exports.commandToSkill = exports.renderOryCommands = exports.renderOrySkills = void 0;
+exports.wrapTool = exports.registerSubagent = exports.complete = exports.gate = exports.sessionStart = exports.resolveNamespace = exports.parseKeyValueList = void 0;
 var client_js_1 = require("./client.js");
 Object.defineProperty(exports, "OryAgentClient", { enumerable: true, get: function () { return client_js_1.OryAgentClient; } });
 var logger_js_1 = require("./logger.js");
@@ -92,6 +92,10 @@ Object.defineProperty(exports, "runStatusCommand", { enumerable: true, get: func
 Object.defineProperty(exports, "printUserIdentitySection", { enumerable: true, get: function () { return status_cli_js_1.printUserIdentitySection; } });
 Object.defineProperty(exports, "printAgentIdentitySection", { enumerable: true, get: function () { return status_cli_js_1.printAgentIdentitySection; } });
 Object.defineProperty(exports, "printPermissionsSection", { enumerable: true, get: function () { return status_cli_js_1.printPermissionsSection; } });
+var version_cli_js_1 = require("./version-cli.js");
+Object.defineProperty(exports, "runVersionCommand", { enumerable: true, get: function () { return version_cli_js_1.runVersionCommand; } });
+Object.defineProperty(exports, "collectVersionInfo", { enumerable: true, get: function () { return version_cli_js_1.collectVersionInfo; } });
+Object.defineProperty(exports, "resolveBuildInfo", { enumerable: true, get: function () { return version_cli_js_1.resolveBuildInfo; } });
 var setup_js_1 = require("./setup.js");
 Object.defineProperty(exports, "parseSetupArgs", { enumerable: true, get: function () { return setup_js_1.parseSetupArgs; } });
 Object.defineProperty(exports, "readJsonFile", { enumerable: true, get: function () { return setup_js_1.readJsonFile; } });

package/dist/interactive-setup.js

@@ -83,6 +83,7 @@ const tool_catalog_js_1 = require("./tool-catalog.js");
 const index_js_1 = require("./local/index.js");
 const subject_js_1 = require("./subject.js");
 const permissions_cli_js_1 = require("./permissions-cli.js");
+const version_cli_js_1 = require("./version-cli.js");
 const ui = __importStar(require("./ui.js"));
 /** Loopback redirect URIs the PKCE user login expects on the OAuth2 client. */
 exports.LOOPBACK_REDIRECT_URIS = auth_js_1.LOOPBACK_PORTS.map((port) => `http://127.0.0.1:${port}/callback`);
@@ -155,6 +156,17 @@ async function installOryCli() {
  * open-coded as a local `postInstallPermissions` helper.
  */
 async function runPostInstall(binName, harness, args = [], deps = {}) {
+    // Surface the running CLI version up front. `npx -p @ory/<harness>` (no
+    // version pin) will happily reuse a previously-cached install rather than
+    // re-resolve to latest, so a user can silently be running an old CLI whose
+    // install flow predates newer behavior (e.g. the interactive setup wizard)
+    // while believing they're on the current release. Printing the version makes
+    // that mismatch visible at a glance; the README's troubleshooting note
+    // explains how to clear a stale npx cache.
+    const cliVersion = (0, version_cli_js_1.resolveCoreVersion)();
+    if (cliVersion !== "unknown") {
+        ui.info(`${binName} v${cliVersion}`);
+    }
     const result = await runInteractiveSetup(binName, harness, args, deps);
     // The Ory Network wizard path bootstraps permissions itself (via the
     // admin-authenticated `ory` CLI). Only fall back to the DCR-token bootstrap

package/dist/local/configs.d.ts

@@ -12,9 +12,17 @@ export interface GatewayConfig {
 export interface ConsoleConfig {
     /** True when Console Lite source is available and the UI will be built. */
     enabled: boolean;
-    /** Build context for `docker compose build` (Console Lite only). */
+    /**
+     * Build context for `docker compose build` (Console Lite only). This is the
+     * cloud **monorepo root**, not the console app dir — the Dockerfile copies
+     * workspace files (`package.json`, `sdk/packages`, `console/console`, …)
+     * from the context root.
+     */
     buildContext?: string;
-    /** Dockerfile path relative to buildContext (Console Lite only). */
+    /**
+     * Dockerfile path relative to buildContext (Console Lite only). Because the
+     * build context is the monorepo root, this is `console/console/<Dockerfile>`.
+     */
     dockerfile?: string;
     /**
      * Absolute path to the `elements` workspace, passed to docker as a named
@@ -45,10 +53,14 @@ export declare function getGatewayConfig(): GatewayConfig;
  * `repoRoot` is the outermost `.git` ancestor of the given `projectRoot`).
  * Disabled when that path is missing or unreadable.
  *
- * `ORY_CONSOLE_LITE_PATH` is an explicit override. When set it must
- * point at a usable build context; downstream validation surfaces a hard
- * error if the path doesn't exist. Relative paths are resolved against
- * pnpm's `INIT_CWD` so they match the user's shell cwd.
+ * `ORY_CONSOLE_LITE_PATH` is an explicit override pointing at the console app
+ * source tree (`<monorepo>/console/console`). When set it must point at a
+ * usable tree; downstream validation surfaces a hard error if the derived
+ * build context or Dockerfile doesn't exist. Relative paths are resolved
+ * against pnpm's `INIT_CWD` so they match the user's shell cwd.
+ *
+ * In all cases the docker build context is the console app tree's **monorepo
+ * root** (two levels up) — see {@link monorepoRootForConsoleApp}.
  */
 export declare function getConsoleConfig(projectRoot?: string): ConsoleConfig;
 /**

package/dist/local/configs.js

@@ -58,11 +58,21 @@ exports.DEFAULT_CONSOLE_LITE_SUBPATH = path.join("..", "cloud", "console", "cons
  * `ENV PORT=3000`). Bound to the host on CONSOLE_PORT.
  */
 const CONSOLE_LITE_INTERNAL_PORT = 3000;
-function defaultElementsPath(buildContext) {
-    // Dockerfile expects `--build-context elements=<elements-dir>`, located at
-    // `<console-lite>/../../elements` (i.e. sibling of console/ inside the
-    // cloud monorepo).
-    return path.resolve(buildContext, "..", "..", "elements");
+/**
+ * The Console Lite Dockerfile builds from the **cloud monorepo root**, not the
+ * console app dir: it `COPY`s `package.json`, `pnpm-workspace.yaml`,
+ * `sdk/packages`, and `console/console` from the build-context root. Given the
+ * console app source tree (`<monorepo>/console/console`), the docker build
+ * context is two levels up.
+ */
+function monorepoRootForConsoleApp(consoleAppDir) {
+    return path.resolve(consoleAppDir, "..", "..");
+}
+function defaultElementsPath(monorepoRoot) {
+    // Dockerfile expects `--build-context elements=<elements-dir>`; the elements
+    // workspace lives at the monorepo root as `elements/` and is referenced via
+    // `COPY --from=elements`.
+    return path.resolve(monorepoRoot, "elements");
 }
 function consoleLiteUsable(buildContext, dockerfile, elementsContext) {
     try {
@@ -131,34 +141,52 @@ function getGatewayConfig() {
  * `repoRoot` is the outermost `.git` ancestor of the given `projectRoot`).
  * Disabled when that path is missing or unreadable.
  *
- * `ORY_CONSOLE_LITE_PATH` is an explicit override. When set it must
- * point at a usable build context; downstream validation surfaces a hard
- * error if the path doesn't exist. Relative paths are resolved against
- * pnpm's `INIT_CWD` so they match the user's shell cwd.
+ * `ORY_CONSOLE_LITE_PATH` is an explicit override pointing at the console app
+ * source tree (`<monorepo>/console/console`). When set it must point at a
+ * usable tree; downstream validation surfaces a hard error if the derived
+ * build context or Dockerfile doesn't exist. Relative paths are resolved
+ * against pnpm's `INIT_CWD` so they match the user's shell cwd.
+ *
+ * In all cases the docker build context is the console app tree's **monorepo
+ * root** (two levels up) — see {@link monorepoRootForConsoleApp}.
  */
 function getConsoleConfig(projectRoot) {
-    const dockerfile = process.env.ORY_CONSOLE_LITE_DOCKERFILE?.trim() || "Dockerfile";
+    const dockerfileName = process.env.ORY_CONSOLE_LITE_DOCKERFILE?.trim() || "Dockerfile";
     const elementsOverride = process.env.ORY_CONSOLE_LITE_ELEMENTS_PATH?.trim();
     const buildMode = process.env.ORY_CONSOLE_LITE_BUILD_MODE?.trim() || "oss";
+    // Resolve the console app source tree (`<monorepo>/console/console`) — what
+    // ORY_CONSOLE_LITE_PATH and the default sibling-checkout layout point at.
+    let consoleAppDir;
+    let source;
     const explicit = process.env.ORY_CONSOLE_LITE_PATH?.trim();
     if (explicit) {
-        const buildContext = resolveUserPath(explicit);
-        const elementsContext = elementsOverride
-            ? resolveUserPath(elementsOverride)
-            : defaultElementsPath(buildContext);
-        return consoleConfig(buildContext, dockerfile, elementsContext, buildMode, "env");
+        consoleAppDir = resolveUserPath(explicit);
+        source = "env";
     }
-    if (projectRoot) {
+    else if (projectRoot) {
         const repoRoot = findOutermostGitAncestor(projectRoot);
-        const def = path.resolve(repoRoot, exports.DEFAULT_CONSOLE_LITE_SUBPATH);
-        const elementsContext = elementsOverride
-            ? resolveUserPath(elementsOverride)
-            : defaultElementsPath(def);
-        if (consoleLiteUsable(def, dockerfile, elementsContext)) {
-            return consoleConfig(def, dockerfile, elementsContext, buildMode, "default");
-        }
+        consoleAppDir = path.resolve(repoRoot, exports.DEFAULT_CONSOLE_LITE_SUBPATH);
+        source = "default";
+    }
+    else {
+        return { enabled: false };
+    }
+    // The Dockerfile builds from the monorepo root, so the docker build context
+    // is two levels up and the Dockerfile is addressed relative to that root
+    // (e.g. `console/console/Dockerfile`).
+    const buildContext = monorepoRootForConsoleApp(consoleAppDir);
+    const dockerfile = path.join(path.relative(buildContext, consoleAppDir), dockerfileName);
+    const elementsContext = elementsOverride
+        ? resolveUserPath(elementsOverride)
+        : defaultElementsPath(buildContext);
+    // Auto-detected (default) Console is silently disabled when its inputs are
+    // absent; an explicit override is always enabled so validation can surface a
+    // hard error pointing the operator at the misconfiguration.
+    if (source === "default" &&
+        !consoleLiteUsable(buildContext, dockerfile, elementsContext)) {
+        return { enabled: false };
     }
-    return { enabled: false };
+    return consoleConfig(buildContext, dockerfile, elementsContext, buildMode, source);
 }
 // ─── Docker Compose ────────────────────────────────────────────────
 function nginxGatewayService() {

package/dist/local/manager.js

@@ -100,7 +100,7 @@ function validateConsoleConfig(cfg) {
     }
     if (!fs.existsSync(elements)) {
         return (`Elements context not found at ${elements}. ` +
-            `Console Lite's Dockerfile expects '../../elements' relative to the console dir; ` +
+            `Console Lite's Dockerfile expects an 'elements' workspace at the monorepo root; ` +
             `set ORY_CONSOLE_LITE_ELEMENTS_PATH to override.`);
     }
     return null;

package/dist/version-cli.d.ts

@@ -0,0 +1,59 @@
+/** Git + build metadata captured when `@ory/argus` was built. */
+export interface BuildInfo {
+    /** Full 40-char commit SHA, or `null` when git was unavailable at build. */
+    commit: string | null;
+    /** Abbreviated commit SHA. */
+    commitShort: string | null;
+    /** Branch the build was cut from. */
+    branch: string | null;
+    /** ISO-8601 commit date. */
+    commitDate: string | null;
+    /** Whether the working tree had uncommitted changes at build time. */
+    dirty: boolean | null;
+    /** ISO-8601 timestamp of when the build ran. */
+    builtAt: string | null;
+    /**
+     * Where the info came from: `embedded` (build-time file, authoritative
+     * for a release), `git` (live probe of a confirmed ory-agent-plugins
+     * checkout — dev/local), or `unknown` (neither available).
+     */
+    source: "embedded" | "git" | "unknown";
+}
+/**
+ * Resolve the ory-agent-plugins build/commit metadata: prefer the
+ * build-time embedded file (authoritative for published packages), fall
+ * back to a live git probe of a confirmed monorepo checkout, else report
+ * `unknown`.
+ */
+export declare function resolveBuildInfo(): BuildInfo;
+/**
+ * Resolve the `@ory/argus` core version from this module's own package.json.
+ * Exported so the install flow can surface the running CLI version — every
+ * `@ory/*` package releases in lockstep, so the core version is the release
+ * version of whatever plugin CLI is executing.
+ */
+export declare function resolveCoreVersion(): string;
+export interface VersionInfo {
+    plugin: {
+        name: string;
+        version: string;
+    };
+    core: {
+        name: string;
+        version: string;
+    };
+    node: string;
+    build: BuildInfo;
+}
+/** Assemble the full version report as structured data. */
+export declare function collectVersionInfo(packageRoot: string): VersionInfo;
+export interface VersionCommandOptions {
+    /** The plugin package root — `path.resolve(__dirname, "..", "..")` from `dist/cli/main.js`. */
+    packageRoot: string;
+}
+/**
+ * Render the `version` output. Supports `--json` for machine-readable
+ * output. Returns a numeric exit code (always 0 today) to match the shape
+ * of the other async CLI helpers.
+ */
+export declare function runVersionCommand(binName: string, args: string[], options: VersionCommandOptions): number;

package/dist/version-cli.js

@@ -0,0 +1,230 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveBuildInfo = resolveBuildInfo;
+exports.resolveCoreVersion = resolveCoreVersion;
+exports.collectVersionInfo = collectVersionInfo;
+exports.runVersionCommand = runVersionCommand;
+/**
+ * Unified `version` CLI implementation. Each harness's `cli/main.ts`
+ * `version` subcommand delegates here so `ory-<harness> version` prints a
+ * consistent report: the plugin package version, the `@ory/argus` core
+ * version, the Node runtime, and — the point of the command — the git
+ * commit of the internal `ory-agent-plugins` monorepo the build came from.
+ *
+ * The commit is *not* recovered by shelling out to `git` at runtime. A
+ * published npm package carries no `.git`, and running `git` from inside a
+ * user's `node_modules` would report the *user's* repo — the wrong commit.
+ * Instead the commit is embedded at build time into
+ * `@ory/argus`'s `dist/build-info.json` (see `scripts/gen-build-info.mjs`)
+ * and read back here. Because every `@ory/*` package releases in lockstep,
+ * core's embedded commit is authoritative for the whole monorepo release,
+ * so each plugin reads it through its `@ory/argus` dependency.
+ */
+const node_child_process_1 = require("node:child_process");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+/**
+ * Read the build-info embedded in `@ory/argus`'s `dist/`. This module
+ * compiles to `dist/version-cli.js`, so the sibling `dist/build-info.json`
+ * is `path.join(__dirname, "build-info.json")`.
+ */
+function readEmbeddedBuildInfo() {
+    try {
+        const file = path.join(__dirname, "build-info.json");
+        if (!fs.existsSync(file))
+            return undefined;
+        const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+        if (!raw.commit && !raw.builtAt)
+            return undefined;
+        return {
+            commit: raw.commit ?? null,
+            commitShort: raw.commitShort ?? null,
+            branch: raw.branch ?? null,
+            commitDate: raw.commitDate ?? null,
+            dirty: raw.dirty ?? null,
+            builtAt: raw.builtAt ?? null,
+            source: "embedded",
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+function git(args) {
+    try {
+        return ((0, node_child_process_1.execFileSync)("git", args, {
+            cwd: __dirname,
+            timeout: 500,
+            stdio: ["ignore", "pipe", "ignore"],
+            encoding: "utf8",
+        }).trim() || null);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Live git fallback for when no embedded build-info exists (a bare `tsc`
+ * build in a checkout). Guarded: we only trust the result when the
+ * enclosing git repo is confirmed to be `ory-agent-plugins`, so a
+ * published package accidentally sitting inside a user's repo never
+ * reports that repo's commit.
+ */
+function liveGitBuildInfo() {
+    const toplevel = git(["rev-parse", "--show-toplevel"]);
+    if (!toplevel)
+        return undefined;
+    try {
+        const rootPkg = path.join(toplevel, "package.json");
+        if (!fs.existsSync(rootPkg))
+            return undefined;
+        const name = JSON.parse(fs.readFileSync(rootPkg, "utf8")).name;
+        if (name !== "ory-agent-plugins")
+            return undefined;
+    }
+    catch {
+        return undefined;
+    }
+    const commit = git(["rev-parse", "HEAD"]);
+    if (!commit)
+        return undefined;
+    const statusOut = git(["status", "--porcelain"]);
+    return {
+        commit,
+        commitShort: git(["rev-parse", "--short", "HEAD"]),
+        branch: git(["rev-parse", "--abbrev-ref", "HEAD"]),
+        commitDate: git(["show", "-s", "--format=%cI", "HEAD"]),
+        dirty: statusOut !== null && statusOut.length > 0,
+        builtAt: null,
+        source: "git",
+    };
+}
+/**
+ * Resolve the ory-agent-plugins build/commit metadata: prefer the
+ * build-time embedded file (authoritative for published packages), fall
+ * back to a live git probe of a confirmed monorepo checkout, else report
+ * `unknown`.
+ */
+function resolveBuildInfo() {
+    return (readEmbeddedBuildInfo() ??
+        liveGitBuildInfo() ?? {
+        commit: null,
+        commitShort: null,
+        branch: null,
+        commitDate: null,
+        dirty: null,
+        builtAt: null,
+        source: "unknown",
+    });
+}
+function readPackageMeta(packageRoot) {
+    try {
+        const pkg = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8"));
+        return { name: pkg.name ?? "unknown", version: pkg.version ?? "0.0.0" };
+    }
+    catch {
+        return { name: "unknown", version: "0.0.0" };
+    }
+}
+/**
+ * Resolve the `@ory/argus` core version from this module's own package.json.
+ * Exported so the install flow can surface the running CLI version — every
+ * `@ory/*` package releases in lockstep, so the core version is the release
+ * version of whatever plugin CLI is executing.
+ */
+function resolveCoreVersion() {
+    let dir = __dirname;
+    for (let i = 0; i < 5; i++) {
+        const candidate = path.join(dir, "package.json");
+        try {
+            if (fs.existsSync(candidate)) {
+                const pkg = JSON.parse(fs.readFileSync(candidate, "utf8"));
+                if (pkg.version)
+                    return pkg.version;
+            }
+        }
+        catch {
+            /* keep walking */
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return "unknown";
+}
+/** Assemble the full version report as structured data. */
+function collectVersionInfo(packageRoot) {
+    return {
+        plugin: readPackageMeta(packageRoot),
+        core: { name: "@ory/argus", version: resolveCoreVersion() },
+        node: process.version,
+        build: resolveBuildInfo(),
+    };
+}
+function formatCommitLine(build) {
+    if (!build.commit)
+        return "unknown (git metadata was not embedded at build time)";
+    const short = build.commitShort ?? build.commit.slice(0, 7);
+    const dirty = build.dirty ? " (with uncommitted changes)" : "";
+    return `${short}${dirty}`;
+}
+/**
+ * Render the `version` output. Supports `--json` for machine-readable
+ * output. Returns a numeric exit code (always 0 today) to match the shape
+ * of the other async CLI helpers.
+ */
+function runVersionCommand(binName, args, options) {
+    const info = collectVersionInfo(options.packageRoot);
+    if (args.includes("--json")) {
+        console.log(JSON.stringify(info, null, 2));
+        return 0;
+    }
+    const { plugin, core, build } = info;
+    console.log(`${plugin.name} ${plugin.version}`);
+    console.log(`  core (@ory/argus):  ${core.version}`);
+    console.log(`  node:               ${info.node}`);
+    console.log("");
+    console.log("ory-agent-plugins build:");
+    console.log(`  short:    ${formatCommitLine(build)}`);
+    if (build.commitDate)
+        console.log(`  date:     ${build.commitDate}`);
+    if (build.builtAt)
+        console.log(`  built:    ${build.builtAt}`);
+    console.log("");
+    console.log(`Run "${binName} version --json" for machine-readable output.`);
+    return 0;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "0.12.1",
+  "version": "0.13.1",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -79,7 +79,7 @@
     "node": ">=22"
   },
   "scripts": {
-    "build": "tsc",
+    "build": "tsc && node ./scripts/gen-build-info.mjs",
     "clean": "rm -rf dist *.tsbuildinfo",
     "test": "vitest run",
     "test:watch": "vitest",