@ory/argus 0.13.6 → 0.13.7

package/dist/agent-auth.d.ts

@@ -48,6 +48,14 @@ export interface AgentCredentials {
      * via deprecated alias). Never blocks resolution.
      */
     warnings: string[];
+    /**
+     * Set on a `kind: "none"` result when the token endpoint rejected the
+     * credentials for an auth reason (401/403) — i.e. the client is genuinely
+     * dead (revoked/invalid). A transient failure (network, rate-limit, 5xx)
+     * leaves this false so callers don't discard otherwise-good persisted
+     * credentials. See the persisted-DCR branch in {@link resolveAgentCredentials}.
+     */
+    authRejected?: boolean;
 }
 export interface ResolveAgentCredentialsOptions {
     /** Ory project URL — required for client_credentials grant + DCR. */

package/dist/agent-auth.js

@@ -275,10 +275,20 @@ async function resolveAgentCredentials(options = {}) {
             });
             if (result.kind !== "none")
                 return result;
-            // Server rejected the persisted creds — clear and fall through to
-            // a fresh registration attempt.
-            warnings.push(`Persisted dynamic agent credentials rejected (${result.reason}); re-registering.`);
-            clearDynamicFn();
+            // Only a genuine auth rejection (401/403 — client revoked/invalid) means
+            // the persisted creds are dead. Clear them and fall through to a fresh
+            // registration. A transient failure (network, rate-limit, 5xx) must NOT
+            // discard good creds: doing so would orphan the server-side client
+            // (clearDynamicFn never revokes it) and register a brand-new one on every
+            // blip. Keep the persisted creds and report the transient failure instead.
+            if (result.authRejected) {
+                warnings.push(`Persisted dynamic agent credentials rejected (${result.reason}); re-registering.`);
+                clearDynamicFn();
+            }
+            else {
+                warnings.push(`Persisted dynamic agent credentials temporarily unavailable (${result.reason}); keeping them for the next session.`);
+                return { ...result, warnings };
+            }
         }
     }
     // 4. Fresh dynamic registration — bootstrap using the user's bearer
@@ -377,11 +387,27 @@ async function resolveClientCredentials(args) {
     catch (err) {
         return {
             kind: "none",
+            authRejected: isAuthRejectionError(err),
             reason: `${reasonNoun} client_credentials grant failed: ${err instanceof Error ? err.message : String(err)}`,
             warnings: args.warnings,
         };
     }
 }
+/**
+ * Whether a token-grant error is an auth rejection (401/403) — meaning the
+ * credentials themselves are dead — as opposed to a transient failure
+ * (network, rate-limit, 5xx). Reads a `status` property when the thrower
+ * attaches one ({@link fetchClientCredentialsToken} does), and falls back to
+ * matching `HTTP 401`/`HTTP 403` in the message so injected/stubbed grant
+ * functions that throw a plain `Error` are classified correctly too.
+ */
+function isAuthRejectionError(err) {
+    const status = err?.status;
+    if (status === 401 || status === 403)
+        return true;
+    const msg = err instanceof Error ? err.message : String(err);
+    return /\bHTTP 40[13]\b/.test(msg);
+}
 // Kept as raw fetch (rather than @ory/client's OAuth2Api.oauth2TokenExchange)
 // because the SDK method's signature does not expose client_secret, audience,
 // or scope — all of which this grant needs. Ory's own SDK docstring on that
@@ -404,7 +430,9 @@ async function fetchClientCredentialsToken(args) {
         body: body.toString(),
     });
     if (!res.ok) {
-        throw new Error(`HTTP ${res.status}`);
+        const err = new Error(`HTTP ${res.status}`);
+        err.status = res.status;
+        throw err;
     }
     const json = (await res.json());
     const accessToken = typeof json.access_token === "string" ? json.access_token : "";

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
   "repo": "ory-agent-plugins",
-  "commit": "255043db833b8ebda7cbec0dee740eda045f064e",
-  "commitShort": "255043d",
+  "commit": "badfe6ff1166227b0eefaeb54018482631e0ce7b",
+  "commitShort": "badfe6f",
   "branch": "main",
-  "commitDate": "2026-07-15T09:35:21-07:00",
+  "commitDate": "2026-07-15T11:49:39-07:00",
   "dirty": false,
-  "builtAt": "2026-07-15T16:39:31.503Z"
+  "builtAt": "2026-07-15T18:53:45.680Z"
 }

package/dist/interactive-setup.js

@@ -568,10 +568,20 @@ async function configureNetwork(binName, harness, ctx) {
     //    self-register at runtime. Ory Network projects ship with DCR disabled,
     //    so without this the default agent-identity path would never resolve.
     await maybeEnableDcr(runner, prompt, project.id);
-    // 6. Create the public OAuth2 client for the PKCE user login.
+    // 6. Provision the public OAuth2 client for the PKCE user login. Reuse an
+    //    existing one on this project first — a re-run (`install --reconfigure`)
+    //    against the same project must not mint a duplicate public client and
+    //    orphan the old one (the CLI-created client is never cleaned up by
+    //    uninstall). Only create when no prior client is found.
     ui.heading("OAuth2 client");
-    ui.step("Creating the OAuth2 client for user login...");
-    const clientId = createOAuth2Client(runner, project.id);
+    let clientId = findExistingOAuth2Client(runner, project.id);
+    if (clientId) {
+        ui.step(`Reusing the existing OAuth2 client for user login (${clientId}).`);
+    }
+    else {
+        ui.step("Creating the OAuth2 client for user login...");
+        clientId = createOAuth2Client(runner, project.id);
+    }
     if (!clientId) {
         ui.warning("Could not create the OAuth2 client automatically.");
         ui.warnDetail(`Project URL resolved: ${projectUrl}`);
@@ -604,6 +614,14 @@ async function configureNetwork(binName, harness, ctx) {
     //    runtime agent/user tokens can't write relation tuples on a hosted
     //    project (that's a project-admin operation), but the `ory` session can.
     if (subject) {
+        // Persist the subject *shape* this grant used. If the install resolved a
+        // SubjectSet (ORY_USER_SUBJECT_NAMESPACE was set), a later runtime session
+        // that lacks the env var would otherwise resolve a direct subject_id and
+        // check/write a divergent tuple for the same user. Persisting the namespace
+        // keeps install-time and runtime writes on one canonical subject shape.
+        if ("subjectSet" in subject) {
+            (0, config_js_1.saveConfig)({ userSubjectNamespace: subject.subjectSet.namespace });
+        }
         await bootstrapPermissionsViaOry(runner, project.id, harness, subject, prompt);
     }
     // 10. Provision the project API key runtime permission *checks* need. Same
@@ -1166,6 +1184,31 @@ async function maybeEnableDcr(runner, prompt, projectId) {
         ui.warnDetail(`Enable it later with: ${manual}`);
     }
 }
+/** The `client_name` every plugin-provisioned public PKCE client carries. */
+const OAUTH2_CLIENT_NAME = "ory-agent-plugin";
+/**
+ * Look for an already-provisioned public PKCE client on the project so a
+ * re-run reuses it instead of minting a duplicate. Matches by the fixed
+ * `client_name` {@link createOAuth2Client} assigns. Best-effort: any CLI or
+ * parse failure returns null and the caller falls back to creating one.
+ */
+function findExistingOAuth2Client(runner, projectId) {
+    const r = runner.exec([
+        "list",
+        "oauth2-clients",
+        "--project",
+        projectId,
+        "--format",
+        "json",
+    ]);
+    if (r.status !== 0)
+        return null;
+    const clients = parseList(r.stdout, "items");
+    if (!clients)
+        return null;
+    const match = clients.find((c) => c.client_name === OAUTH2_CLIENT_NAME && c.client_id);
+    return match?.client_id ?? null;
+}
 function createOAuth2Client(runner, projectId) {
     const args = [
         "create",
@@ -1173,7 +1216,7 @@ function createOAuth2Client(runner, projectId) {
         "--project",
         projectId,
         "--name",
-        "ory-agent-plugin",
+        OAUTH2_CLIENT_NAME,
         "--grant-type",
         "authorization_code,refresh_token",
         "--response-type",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "0.13.6",
+  "version": "0.13.7",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",