@ory/argus 0.13.9 → 1.0.0

package/dist/index.js

@@ -1,29 +1,59 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.clearCredentialsForUninstall = exports.AGENT_TOKEN_EXPIRY_SKEW_SEC = exports.revokeAgentDynamicClient = exports.clearSubAgentDynamicCredentials = exports.saveSubAgentDynamicCredentials = exports.loadSubAgentDynamicCredentials = exports.clearAgentDynamicCredentials = exports.saveAgentDynamicCredentials = exports.loadAgentDynamicCredentials = exports.registerAgentClient = exports.fetchClientCredentialsToken = exports.ensureSubAgentIdentity = exports.ensureAgentIdentity = exports.resolveAgentCredentials = exports.ensureAuthenticated = exports.ensureUserAuthenticated = exports.TOKEN_EXPIRY_SKEW_SEC = exports.waitForPeerTokensSync = exports.waitForPeerTokens = exports.clearPkceFlightLock = exports.tryAcquirePkceFlightLock = exports.refreshAndSave = exports.isExpired = exports.clearTokens = exports.saveTokens = exports.loadTokens = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.LOOPBACK_PORTS = exports.buildAuthorizeUrl = exports.sha256Base64Url = exports.generateCodeVerifier = exports.detectHeadless = exports.refreshAccessToken = exports.pkceLogin = exports.getHarnessDataDir = exports.getDataDir = exports.getConfigPath = exports.mutateConfig = exports.resolveConfig = exports.saveConfig = exports.loadConfig = exports.watchTraceFile = exports.formatSpan = exports.deriveTraceId = exports.ActiveSpan = exports.Tracer = exports.withQuietStderr = exports.redactLogData = exports.DebugLogger = exports.OryAgentClient = void 0;
-exports.unregisterPlugin = exports.registerPlugin = exports.removeMcpServer = exports.mergeMcpServer = exports.mcpServerEntry = exports.resolveMcpServerCommand = exports.emitDeferredNextSteps = exports.beginDeferNextSteps = exports.nextStepsSink = exports.printNextSteps = exports.printSetupHelp = exports.removeFlatHooks = exports.mergeFlatHooks = exports.flatHookEntry = exports.removeMatcherHooks = exports.mergeMatcherHooks = exports.matcherHookEntry = exports.resolveHookCommand = exports.isOryHookCommand = exports.writeJsonFile = exports.readJsonFile = exports.parseSetupArgs = exports.resolveBuildInfo = exports.collectVersionInfo = exports.runVersionCommand = exports.printPermissionsSection = exports.printAgentIdentitySection = exports.printUserIdentitySection = exports.runStatusCommand = exports.LOOPBACK_REDIRECT_URIS = exports.projectUrlFromSlug = exports.runPostInstall = exports.runInteractiveSetup = exports.printPermissionsOnboardingHelp = exports.maybeAutoBootstrap = exports.isUserIdentityCached = exports.runPermissionsCommand = exports.oryNpx = exports.interactiveConfigPrompt = exports.promptForProjectUrl = exports.promptOnTty = exports.isTtyAvailable = exports.runWatchCommand = exports.printTraceTail = exports.printEnvHelp = exports.printLogTail = exports.printEnvironment = exports.printOryConfig = exports.runAgentCommand = exports.runConfigureCommand = void 0;
-exports.OtlpExporter = exports.summarizeToolOutput = exports.summarizeToolInput = exports.OryDenialError = exports.alertAttributes = exports.formatAlertSummary = exports.formatAlertMessage = exports.formatDenialSummary = exports.formatDenialMessage = exports.subjectLabel = exports.runWithUserSubject = exports.resolveUserSubject = exports.checkMcpPermission = exports.parseMcpToolGeneric = exports.parseGeminiMcpTool = exports.parseClaudeCodeMcpTool = exports.TOOL_EXECUTION_PHASES = exports.USER_FACING_PHASES = exports.HARNESS_LIFECYCLE_MAP = exports.isToolExecutionPhase = exports.isUserFacingPhase = exports.classifyLifecycle = exports.isInteractiveTool = exports.getInteractiveToolCatalog = exports.INTERACTIVE_TOOL_CATALOG = exports.getToolCatalog = exports.ALL_TOOLS = exports.KNOWN_HARNESSES = exports.HARNESS_TOOL_CATALOG = exports.gateToolCall = exports.applyPermissionMode = exports.checkAndDecide = exports.runRegistryCommand = exports.DEV_JAEGER_CONTAINER = exports.stopDevJaeger = exports.ensureDevJaeger = exports.runLocalCommand = exports.ORY_COMMAND_SLUGS = exports.ORY_COMMAND_SKILL_NAMES = exports.ORY_SKILL_NAMES = exports.removeSkillDirs = exports.writeSkillTree = exports.toSkillMarkdown = exports.commandToPlainMarkdown = exports.commandToFrontmatterMarkdown = exports.commandToToml = exports.commandToSkill = exports.renderOryCommands = exports.renderOrySkills = exports.runDevLauncher = void 0;
-exports.wrapTool = exports.writeAgentDelegatesSubagent = exports.writeUserDelegatesAgent = exports.registerSubagent = exports.complete = exports.gate = exports.sessionStart = exports.resolveNamespace = exports.parseKeyValueList = exports.otlpExporterFromEnv = void 0;
+exports.wantsHelp = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.LOOPBACK_PORTS = exports.buildAuthorizeUrl = exports.sha256Base64Url = exports.generateCodeVerifier = exports.detectHeadless = exports.refreshAccessToken = exports.pkceLogin = exports.resetPermissionModeCache = exports.warmPermissionModeCache = exports.resolvePermissionMode = exports.SESSIONLESS_KEY = exports.UNKNOWN_HARNESS_KEY = exports.unregisterInstalledHarness = exports.registerInstalledHarness = exports.listInstalledHarnesses = exports.getHarnessDataDir = exports.getDataDir = exports.getConfigPath = exports.mutateConfig = exports.describeSecurityGap = exports.isSecurityConnected = exports.resolveConfig = exports.saveConfig = exports.loadConfig = exports.clearSessionContext = exports.setSessionContext = exports.withSessionContext = exports.currentSessionContext = exports.projectActivityEntry = exports.SERVER_ACTIVITY_EVENTS = exports.AgentSecurityEventReporter = exports.withQuietStderr = exports.formatLogEntry = exports.redactLogData = exports.ActiveActivity = exports.DebugLogger = exports.talosRuntimeCredential = exports.runCredentialStoreCommand = exports.resolveRuntimeCredential = exports.enrollTalosRuntimeCredential = exports.enrollTalosChildRuntimeCredential = exports.createOsTalosCredentialStore = exports.configureSystemCaTrustForDefaultFetch = exports.credentialAccount = exports.canonicalProjectUrl = exports.canonicalCredentialIdentity = exports.authenticatedRuntimeRequest = exports.OryAgentClient = void 0;
+exports.clearRetiredCredentials = exports.loadRetiredCredentials = exports.saveDelegationNodeId = exports.loadDelegationNodeId = exports.claimSubAgentDynamicCredentials = exports.clearSubAgentDynamicCredentialsForHarness = exports.clearSubAgentDynamicCredentials = exports.saveSubAgentDynamicCredentials = exports.loadSubAgentDynamicCredentialsByHarness = exports.loadAllSubAgentDynamicCredentials = exports.loadSubAgentDynamicCredentials = exports.claimAgentDynamicCredentials = exports.countAgentSessions = exports.latestSubAgentSession = exports.latestAgentRegistration = exports.clearAgentDynamicCredentials = exports.saveAgentDynamicCredentials = exports.loadAgentDynamicCredentialsByHarness = exports.loadAgentDynamicCredentials = exports.registerAgentClient = exports.fetchClientCredentialsToken = exports.ensureSubAgentIdentity = exports.ensureAgentIdentity = exports.resolveRuntimeAgentCredentials = exports.resolveAgentCredentials = exports.ensureAuthenticated = exports.ensureUserAuthenticated = exports.TOKEN_EXPIRY_SKEW_SEC = exports.waitForPeerTokensSync = exports.waitForPeerTokens = exports.clearPkceFlightLock = exports.tryAcquirePkceFlightLock = exports.refreshAndSave = exports.isExpired = exports.clearTokens = exports.saveTokens = exports.loadTokens = exports.toolHookTimeout = exports.sessionStartHookTimeout = exports.HOOK_TIMEOUT_MAX_MS = exports.TOOL_HOOK_WINDOW_MS = exports.SESSION_START_HOOK_WINDOW_MS = exports.describeDanglingRegistration = exports.findDanglingRegistration = exports.deregisterExternalRegistrations = exports.clearAllExternalRegistrations = exports.clearExternalRegistration = exports.recordExternalRegistration = exports.loadExternalRegistrations = exports.shouldPrintHelp = void 0;
+exports.mergeMcpServer = exports.mcpServerEntry = exports.emitDeferredNextSteps = exports.beginDeferNextSteps = exports.nextStepsSink = exports.printNextSteps = exports.printSetupHelp = exports.removeFlatHooks = exports.mergeFlatHooks = exports.flatHookEntry = exports.removeMatcherHooks = exports.mergeMatcherHooks = exports.matcherHookEntry = exports.isOryHookCommand = exports.writeJsonFile = exports.readJsonFile = exports.parseSetupArgs = exports.resolveBuildInfo = exports.collectVersionInfo = exports.runVersionCommand = exports.probePermissionsCoverage = exports.collectStatusReport = exports.printPermissionsSection = exports.printAgentIdentitySection = exports.printUserIdentitySection = exports.runStatusCommand = exports.runPostInstall = exports.runWatchCommand = exports.runPermissionsCommand = exports.oryNpx = exports.interactiveConfigPrompt = exports.promptForProjectUrl = exports.promptOnTty = exports.isTtyAvailable = exports.printEnvHelp = exports.printLogTail = exports.printEnvironment = exports.printOryConfig = exports.runAgentCommand = exports.runConfigureCommand = exports.resolveInstalledHarnesses = exports.clearCredentialsForUninstall = exports.READ_CREDENTIAL_RETRY_MS = exports.resetReadCredentialBackoff = exports.ensureReadCredential = exports.DEFAULT_SESSION_RETENTION = exports.AGENT_TOKEN_EXPIRY_SKEW_SEC = exports.revokeAgentDynamicClient = exports.sessionRetention = exports.retireAgentSessions = void 0;
+exports.decomposeAndCheck = exports.gateToolCall = exports.applyPermissionMode = exports.checkAndDecide = exports.REGISTRY_URL = exports.runRegistryCommand = exports.runLocalCommand = exports.ORY_COMMAND_SLUGS = exports.ORY_COMMAND_SKILL_NAMES = exports.ORY_SKILL_NAMES = exports.removeSkillDirs = exports.writeSkillTree = exports.toSkillMarkdown = exports.commandToPlainMarkdown = exports.commandToFrontmatterMarkdown = exports.commandToToml = exports.commandToSkill = exports.renderOryCommands = exports.renderOrySkills = exports.renderMirrorBootstrap = exports.MCP_SERVER_PACKAGE = exports.defaultNpmInstaller = exports.describeRuntimeHealth = exports.checkRuntimeHealth = exports.pruneRuntimeStores = exports.removeRuntimeWiring = exports.getRuntimeWiring = exports.recordRuntimeWiring = exports.readRuntimeManifest = exports.getMcpShimPath = exports.getHookShimPath = exports.getShimDir = exports.getRuntimeStoreDir = exports.getRuntimeRoot = exports.moduleSpecifier = exports.requireHookCommand = exports.isOryRuntimeCommand = exports.mcpCommand = exports.hookCommand = exports.writeMcpShim = exports.writeHookShim = exports.resolveMcpRuntimeEntry = exports.resolveRuntimeEntry = exports.linkedRuntime = exports.materializeRuntime = exports.resolveRuntimeForInstall = exports.wireRuntime = exports.unregisterPlugin = exports.registerPlugin = exports.removeMcpServer = void 0;
+exports.isUserFacingPhase = exports.classifyLifecycle = exports.extractShellCommand = exports.resolveShellCommandNamespace = exports.getShellCommandCatalog = exports.SHELL_COMMAND_CATALOG = exports.isShellTool = exports.getShellToolCatalog = exports.SHELL_TOOL_CATALOG = exports.isInteractiveTool = exports.getInteractiveToolCatalog = exports.INTERACTIVE_TOOL_CATALOG = exports.getToolCatalog = exports.ALL_TOOLS = exports.KNOWN_HARNESSES = exports.HARNESS_TOOL_CATALOG = exports.DEFAULT_SHELL_NAMESPACE = exports.DEFAULT_NAMESPACE = exports.PERMIT_USE = exports.ENROLLMENT_NAMESPACE = exports.AGENT_ROLE_NAMESPACE = exports.DELEGATION_NAMESPACE = exports.PERMISSION_MODE_NAMESPACE = exports.PROJECT_POSTURE_OBJECT = exports.AUTO_ENROLL_OBJECT = exports.PERMISSION_MODE_OBJECT = exports.RELATION_OPTED_OUT_SUBJECTS = exports.RELATION_MEMBERS = exports.RELATION_ENFORCED_SUBJECTS = exports.RELATION_CREDENTIALS = exports.RELATION_DELEGATES = exports.RELATION_BLOCKED_SUBJECTS = exports.RELATION_USERS = exports.SUBAGENT_NODE_NAMESPACE = exports.AGENT_NODE_NAMESPACE = exports.NODE_REFERENCE_NAMESPACES = exports.PRINCIPAL_NAMESPACES = exports.OPL_IMPORT_SYMBOLS = exports.OPL_IMPORT_MODULE = exports.renderOplImport = exports.renderPrincipalClass = exports.renderEnrollmentNamespaceClass = exports.renderAgentRoleNamespaceClass = exports.renderPermissionModeNamespaceClass = exports.renderDelegationNamespaceClass = exports.renderToolNamespaceClass = exports.buildAgentSecurityOpl = exports.extractBashCommandWords = exports.extractShellCommands = exports.resolveCheckRelation = void 0;
+exports.collectSystemServices = exports.wrapTool = exports.writeAgentDelegatesSubagent = exports.writeUserDelegatesAgent = exports.registerSubagent = exports.fail = exports.complete = exports.gate = exports.decideTool = exports.withHookContext = exports.createSessionStarter = exports.sessionStart = exports.resolveNamespace = exports.summarizeToolOutput = exports.summarizeToolInput = exports.OryDenialError = exports.shellDenialFields = exports.alertAttributes = exports.formatAlertSummary = exports.formatAlertMessage = exports.formatDenialSummary = exports.formatDenialMessage = exports.DEFAULT_USER_SUBJECT_NAMESPACE = exports.SESSION_NAMESPACE = exports.SUBAGENT_NAMESPACE = exports.AGENT_NAMESPACE = exports.resolveSubAgentSpawnSubject = exports.resolveSubAgentSubject = exports.resolveAgentSessionSubject = exports.resolveAgentSubject = exports.subjectLabel = exports.runWithUserSubject = exports.resolveUserSubject = exports.checkMcpPermission = exports.parseMcpToolGeneric = exports.parseGeminiMcpTool = exports.parseClaudeCodeMcpTool = exports.TOOL_EXECUTION_PHASES = exports.USER_FACING_PHASES = exports.HARNESS_LIFECYCLE_MAP = exports.isToolExecutionPhase = void 0;
 var client_js_1 = require("./client.js");
 Object.defineProperty(exports, "OryAgentClient", { enumerable: true, get: function () { return client_js_1.OryAgentClient; } });
+var runtime_credential_js_1 = require("./runtime-credential.js");
+Object.defineProperty(exports, "authenticatedRuntimeRequest", { enumerable: true, get: function () { return runtime_credential_js_1.authenticatedRuntimeRequest; } });
+Object.defineProperty(exports, "canonicalCredentialIdentity", { enumerable: true, get: function () { return runtime_credential_js_1.canonicalCredentialIdentity; } });
+Object.defineProperty(exports, "canonicalProjectUrl", { enumerable: true, get: function () { return runtime_credential_js_1.canonicalProjectUrl; } });
+Object.defineProperty(exports, "credentialAccount", { enumerable: true, get: function () { return runtime_credential_js_1.credentialAccount; } });
+Object.defineProperty(exports, "configureSystemCaTrustForDefaultFetch", { enumerable: true, get: function () { return runtime_credential_js_1.configureSystemCaTrustForDefaultFetch; } });
+Object.defineProperty(exports, "createOsTalosCredentialStore", { enumerable: true, get: function () { return runtime_credential_js_1.createOsTalosCredentialStore; } });
+Object.defineProperty(exports, "enrollTalosChildRuntimeCredential", { enumerable: true, get: function () { return runtime_credential_js_1.enrollTalosChildRuntimeCredential; } });
+Object.defineProperty(exports, "enrollTalosRuntimeCredential", { enumerable: true, get: function () { return runtime_credential_js_1.enrollTalosRuntimeCredential; } });
+Object.defineProperty(exports, "resolveRuntimeCredential", { enumerable: true, get: function () { return runtime_credential_js_1.resolveRuntimeCredential; } });
+Object.defineProperty(exports, "runCredentialStoreCommand", { enumerable: true, get: function () { return runtime_credential_js_1.runCredentialStoreCommand; } });
+Object.defineProperty(exports, "talosRuntimeCredential", { enumerable: true, get: function () { return runtime_credential_js_1.talosRuntimeCredential; } });
 var logger_js_1 = require("./logger.js");
 Object.defineProperty(exports, "DebugLogger", { enumerable: true, get: function () { return logger_js_1.DebugLogger; } });
+Object.defineProperty(exports, "ActiveActivity", { enumerable: true, get: function () { return logger_js_1.ActiveActivity; } });
 Object.defineProperty(exports, "redactLogData", { enumerable: true, get: function () { return logger_js_1.redactLogData; } });
+Object.defineProperty(exports, "formatLogEntry", { enumerable: true, get: function () { return logger_js_1.formatLogEntry; } });
 Object.defineProperty(exports, "withQuietStderr", { enumerable: true, get: function () { return logger_js_1.withQuietStderr; } });
-var tracer_js_1 = require("./tracer.js");
-Object.defineProperty(exports, "Tracer", { enumerable: true, get: function () { return tracer_js_1.Tracer; } });
-Object.defineProperty(exports, "ActiveSpan", { enumerable: true, get: function () { return tracer_js_1.ActiveSpan; } });
-Object.defineProperty(exports, "deriveTraceId", { enumerable: true, get: function () { return tracer_js_1.deriveTraceId; } });
-Object.defineProperty(exports, "formatSpan", { enumerable: true, get: function () { return tracer_js_1.formatSpan; } });
-Object.defineProperty(exports, "watchTraceFile", { enumerable: true, get: function () { return tracer_js_1.watchTraceFile; } });
+var event_reporter_js_1 = require("./event-reporter.js");
+Object.defineProperty(exports, "AgentSecurityEventReporter", { enumerable: true, get: function () { return event_reporter_js_1.AgentSecurityEventReporter; } });
+Object.defineProperty(exports, "SERVER_ACTIVITY_EVENTS", { enumerable: true, get: function () { return event_reporter_js_1.SERVER_ACTIVITY_EVENTS; } });
+Object.defineProperty(exports, "projectActivityEntry", { enumerable: true, get: function () { return event_reporter_js_1.projectActivityEntry; } });
+var context_js_1 = require("./context.js");
+Object.defineProperty(exports, "currentSessionContext", { enumerable: true, get: function () { return context_js_1.currentSessionContext; } });
+Object.defineProperty(exports, "withSessionContext", { enumerable: true, get: function () { return context_js_1.withSessionContext; } });
+Object.defineProperty(exports, "setSessionContext", { enumerable: true, get: function () { return context_js_1.setSessionContext; } });
+Object.defineProperty(exports, "clearSessionContext", { enumerable: true, get: function () { return context_js_1.clearSessionContext; } });
 var config_js_1 = require("./config.js");
 Object.defineProperty(exports, "loadConfig", { enumerable: true, get: function () { return config_js_1.loadConfig; } });
 Object.defineProperty(exports, "saveConfig", { enumerable: true, get: function () { return config_js_1.saveConfig; } });
 Object.defineProperty(exports, "resolveConfig", { enumerable: true, get: function () { return config_js_1.resolveConfig; } });
+Object.defineProperty(exports, "isSecurityConnected", { enumerable: true, get: function () { return config_js_1.isSecurityConnected; } });
+Object.defineProperty(exports, "describeSecurityGap", { enumerable: true, get: function () { return config_js_1.describeSecurityGap; } });
 Object.defineProperty(exports, "mutateConfig", { enumerable: true, get: function () { return config_js_1.mutateConfig; } });
 Object.defineProperty(exports, "getConfigPath", { enumerable: true, get: function () { return config_js_1.getConfigPath; } });
 Object.defineProperty(exports, "getDataDir", { enumerable: true, get: function () { return config_js_1.getDataDir; } });
 Object.defineProperty(exports, "getHarnessDataDir", { enumerable: true, get: function () { return config_js_1.getHarnessDataDir; } });
+Object.defineProperty(exports, "listInstalledHarnesses", { enumerable: true, get: function () { return config_js_1.listInstalledHarnesses; } });
+Object.defineProperty(exports, "registerInstalledHarness", { enumerable: true, get: function () { return config_js_1.registerInstalledHarness; } });
+Object.defineProperty(exports, "unregisterInstalledHarness", { enumerable: true, get: function () { return config_js_1.unregisterInstalledHarness; } });
+Object.defineProperty(exports, "UNKNOWN_HARNESS_KEY", { enumerable: true, get: function () { return config_js_1.UNKNOWN_HARNESS_KEY; } });
+Object.defineProperty(exports, "SESSIONLESS_KEY", { enumerable: true, get: function () { return config_js_1.SESSIONLESS_KEY; } });
+var permission_mode_js_1 = require("./permission-mode.js");
+Object.defineProperty(exports, "resolvePermissionMode", { enumerable: true, get: function () { return permission_mode_js_1.resolvePermissionMode; } });
+Object.defineProperty(exports, "warmPermissionModeCache", { enumerable: true, get: function () { return permission_mode_js_1.warmPermissionModeCache; } });
+Object.defineProperty(exports, "resetPermissionModeCache", { enumerable: true, get: function () { return permission_mode_js_1.resetPermissionModeCache; } });
 var auth_js_1 = require("./auth.js");
 Object.defineProperty(exports, "pkceLogin", { enumerable: true, get: function () { return auth_js_1.pkceLogin; } });
 Object.defineProperty(exports, "refreshAccessToken", { enumerable: true, get: function () { return auth_js_1.refreshAccessToken; } });
@@ -33,6 +63,23 @@ Object.defineProperty(exports, "sha256Base64Url", { enumerable: true, get: funct
 Object.defineProperty(exports, "buildAuthorizeUrl", { enumerable: true, get: function () { return auth_js_1.buildAuthorizeUrl; } });
 Object.defineProperty(exports, "LOOPBACK_PORTS", { enumerable: true, get: function () { return auth_js_1.LOOPBACK_PORTS; } });
 Object.defineProperty(exports, "DEFAULT_LOGIN_TIMEOUT_MS", { enumerable: true, get: function () { return auth_js_1.DEFAULT_LOGIN_TIMEOUT_MS; } });
+var help_cli_js_1 = require("./help-cli.js");
+Object.defineProperty(exports, "wantsHelp", { enumerable: true, get: function () { return help_cli_js_1.wantsHelp; } });
+Object.defineProperty(exports, "shouldPrintHelp", { enumerable: true, get: function () { return help_cli_js_1.shouldPrintHelp; } });
+var external_registrations_js_1 = require("./external-registrations.js");
+Object.defineProperty(exports, "loadExternalRegistrations", { enumerable: true, get: function () { return external_registrations_js_1.loadExternalRegistrations; } });
+Object.defineProperty(exports, "recordExternalRegistration", { enumerable: true, get: function () { return external_registrations_js_1.recordExternalRegistration; } });
+Object.defineProperty(exports, "clearExternalRegistration", { enumerable: true, get: function () { return external_registrations_js_1.clearExternalRegistration; } });
+Object.defineProperty(exports, "clearAllExternalRegistrations", { enumerable: true, get: function () { return external_registrations_js_1.clearAllExternalRegistrations; } });
+Object.defineProperty(exports, "deregisterExternalRegistrations", { enumerable: true, get: function () { return external_registrations_js_1.deregisterExternalRegistrations; } });
+Object.defineProperty(exports, "findDanglingRegistration", { enumerable: true, get: function () { return external_registrations_js_1.findDanglingRegistration; } });
+Object.defineProperty(exports, "describeDanglingRegistration", { enumerable: true, get: function () { return external_registrations_js_1.describeDanglingRegistration; } });
+var hook_timeout_js_1 = require("./hook-timeout.js");
+Object.defineProperty(exports, "SESSION_START_HOOK_WINDOW_MS", { enumerable: true, get: function () { return hook_timeout_js_1.SESSION_START_HOOK_WINDOW_MS; } });
+Object.defineProperty(exports, "TOOL_HOOK_WINDOW_MS", { enumerable: true, get: function () { return hook_timeout_js_1.TOOL_HOOK_WINDOW_MS; } });
+Object.defineProperty(exports, "HOOK_TIMEOUT_MAX_MS", { enumerable: true, get: function () { return hook_timeout_js_1.HOOK_TIMEOUT_MAX_MS; } });
+Object.defineProperty(exports, "sessionStartHookTimeout", { enumerable: true, get: function () { return hook_timeout_js_1.sessionStartHookTimeout; } });
+Object.defineProperty(exports, "toolHookTimeout", { enumerable: true, get: function () { return hook_timeout_js_1.toolHookTimeout; } });
 var auth_store_js_1 = require("./auth-store.js");
 Object.defineProperty(exports, "loadTokens", { enumerable: true, get: function () { return auth_store_js_1.loadTokens; } });
 Object.defineProperty(exports, "saveTokens", { enumerable: true, get: function () { return auth_store_js_1.saveTokens; } });
@@ -49,20 +96,42 @@ Object.defineProperty(exports, "ensureUserAuthenticated", { enumerable: true, ge
 Object.defineProperty(exports, "ensureAuthenticated", { enumerable: true, get: function () { return user_login_js_1.ensureAuthenticated; } });
 var agent_auth_js_1 = require("./agent-auth.js");
 Object.defineProperty(exports, "resolveAgentCredentials", { enumerable: true, get: function () { return agent_auth_js_1.resolveAgentCredentials; } });
+Object.defineProperty(exports, "resolveRuntimeAgentCredentials", { enumerable: true, get: function () { return agent_auth_js_1.resolveRuntimeAgentCredentials; } });
 Object.defineProperty(exports, "ensureAgentIdentity", { enumerable: true, get: function () { return agent_auth_js_1.ensureAgentIdentity; } });
 Object.defineProperty(exports, "ensureSubAgentIdentity", { enumerable: true, get: function () { return agent_auth_js_1.ensureSubAgentIdentity; } });
 Object.defineProperty(exports, "fetchClientCredentialsToken", { enumerable: true, get: function () { return agent_auth_js_1.fetchClientCredentialsToken; } });
 Object.defineProperty(exports, "registerAgentClient", { enumerable: true, get: function () { return agent_auth_js_1.registerAgentClient; } });
 Object.defineProperty(exports, "loadAgentDynamicCredentials", { enumerable: true, get: function () { return agent_auth_js_1.loadAgentDynamicCredentials; } });
+Object.defineProperty(exports, "loadAgentDynamicCredentialsByHarness", { enumerable: true, get: function () { return agent_auth_js_1.loadAgentDynamicCredentialsByHarness; } });
 Object.defineProperty(exports, "saveAgentDynamicCredentials", { enumerable: true, get: function () { return agent_auth_js_1.saveAgentDynamicCredentials; } });
 Object.defineProperty(exports, "clearAgentDynamicCredentials", { enumerable: true, get: function () { return agent_auth_js_1.clearAgentDynamicCredentials; } });
+Object.defineProperty(exports, "latestAgentRegistration", { enumerable: true, get: function () { return agent_auth_js_1.latestAgentRegistration; } });
+Object.defineProperty(exports, "latestSubAgentSession", { enumerable: true, get: function () { return agent_auth_js_1.latestSubAgentSession; } });
+Object.defineProperty(exports, "countAgentSessions", { enumerable: true, get: function () { return agent_auth_js_1.countAgentSessions; } });
+Object.defineProperty(exports, "claimAgentDynamicCredentials", { enumerable: true, get: function () { return agent_auth_js_1.claimAgentDynamicCredentials; } });
 Object.defineProperty(exports, "loadSubAgentDynamicCredentials", { enumerable: true, get: function () { return agent_auth_js_1.loadSubAgentDynamicCredentials; } });
+Object.defineProperty(exports, "loadAllSubAgentDynamicCredentials", { enumerable: true, get: function () { return agent_auth_js_1.loadAllSubAgentDynamicCredentials; } });
+Object.defineProperty(exports, "loadSubAgentDynamicCredentialsByHarness", { enumerable: true, get: function () { return agent_auth_js_1.loadSubAgentDynamicCredentialsByHarness; } });
 Object.defineProperty(exports, "saveSubAgentDynamicCredentials", { enumerable: true, get: function () { return agent_auth_js_1.saveSubAgentDynamicCredentials; } });
 Object.defineProperty(exports, "clearSubAgentDynamicCredentials", { enumerable: true, get: function () { return agent_auth_js_1.clearSubAgentDynamicCredentials; } });
+Object.defineProperty(exports, "clearSubAgentDynamicCredentialsForHarness", { enumerable: true, get: function () { return agent_auth_js_1.clearSubAgentDynamicCredentialsForHarness; } });
+Object.defineProperty(exports, "claimSubAgentDynamicCredentials", { enumerable: true, get: function () { return agent_auth_js_1.claimSubAgentDynamicCredentials; } });
+Object.defineProperty(exports, "loadDelegationNodeId", { enumerable: true, get: function () { return agent_auth_js_1.loadDelegationNodeId; } });
+Object.defineProperty(exports, "saveDelegationNodeId", { enumerable: true, get: function () { return agent_auth_js_1.saveDelegationNodeId; } });
+Object.defineProperty(exports, "loadRetiredCredentials", { enumerable: true, get: function () { return agent_auth_js_1.loadRetiredCredentials; } });
+Object.defineProperty(exports, "clearRetiredCredentials", { enumerable: true, get: function () { return agent_auth_js_1.clearRetiredCredentials; } });
+Object.defineProperty(exports, "retireAgentSessions", { enumerable: true, get: function () { return agent_auth_js_1.retireAgentSessions; } });
+Object.defineProperty(exports, "sessionRetention", { enumerable: true, get: function () { return agent_auth_js_1.sessionRetention; } });
 Object.defineProperty(exports, "revokeAgentDynamicClient", { enumerable: true, get: function () { return agent_auth_js_1.revokeAgentDynamicClient; } });
 Object.defineProperty(exports, "AGENT_TOKEN_EXPIRY_SKEW_SEC", { enumerable: true, get: function () { return agent_auth_js_1.AGENT_TOKEN_EXPIRY_SKEW_SEC; } });
+Object.defineProperty(exports, "DEFAULT_SESSION_RETENTION", { enumerable: true, get: function () { return agent_auth_js_1.DEFAULT_SESSION_RETENTION; } });
+var read_credential_js_1 = require("./read-credential.js");
+Object.defineProperty(exports, "ensureReadCredential", { enumerable: true, get: function () { return read_credential_js_1.ensureReadCredential; } });
+Object.defineProperty(exports, "resetReadCredentialBackoff", { enumerable: true, get: function () { return read_credential_js_1.resetReadCredentialBackoff; } });
+Object.defineProperty(exports, "READ_CREDENTIAL_RETRY_MS", { enumerable: true, get: function () { return read_credential_js_1.READ_CREDENTIAL_RETRY_MS; } });
 var uninstall_js_1 = require("./uninstall.js");
 Object.defineProperty(exports, "clearCredentialsForUninstall", { enumerable: true, get: function () { return uninstall_js_1.clearCredentialsForUninstall; } });
+Object.defineProperty(exports, "resolveInstalledHarnesses", { enumerable: true, get: function () { return uninstall_js_1.resolveInstalledHarnesses; } });
 var cli_js_1 = require("./cli.js");
 Object.defineProperty(exports, "runConfigureCommand", { enumerable: true, get: function () { return cli_js_1.runConfigureCommand; } });
 Object.defineProperty(exports, "runAgentCommand", { enumerable: true, get: function () { return cli_js_1.runAgentCommand; } });
@@ -70,8 +139,6 @@ Object.defineProperty(exports, "printOryConfig", { enumerable: true, get: functi
 Object.defineProperty(exports, "printEnvironment", { enumerable: true, get: function () { return cli_js_1.printEnvironment; } });
 Object.defineProperty(exports, "printLogTail", { enumerable: true, get: function () { return cli_js_1.printLogTail; } });
 Object.defineProperty(exports, "printEnvHelp", { enumerable: true, get: function () { return cli_js_1.printEnvHelp; } });
-Object.defineProperty(exports, "printTraceTail", { enumerable: true, get: function () { return cli_js_1.printTraceTail; } });
-Object.defineProperty(exports, "runWatchCommand", { enumerable: true, get: function () { return cli_js_1.runWatchCommand; } });
 Object.defineProperty(exports, "isTtyAvailable", { enumerable: true, get: function () { return cli_js_1.isTtyAvailable; } });
 Object.defineProperty(exports, "promptOnTty", { enumerable: true, get: function () { return cli_js_1.promptOnTty; } });
 Object.defineProperty(exports, "promptForProjectUrl", { enumerable: true, get: function () { return cli_js_1.promptForProjectUrl; } });
@@ -80,19 +147,18 @@ var cli_invocation_js_1 = require("./cli-invocation.js");
 Object.defineProperty(exports, "oryNpx", { enumerable: true, get: function () { return cli_invocation_js_1.oryNpx; } });
 var permissions_cli_js_1 = require("./permissions-cli.js");
 Object.defineProperty(exports, "runPermissionsCommand", { enumerable: true, get: function () { return permissions_cli_js_1.runPermissionsCommand; } });
-Object.defineProperty(exports, "isUserIdentityCached", { enumerable: true, get: function () { return permissions_cli_js_1.isUserIdentityCached; } });
-Object.defineProperty(exports, "maybeAutoBootstrap", { enumerable: true, get: function () { return permissions_cli_js_1.maybeAutoBootstrap; } });
-Object.defineProperty(exports, "printPermissionsOnboardingHelp", { enumerable: true, get: function () { return permissions_cli_js_1.printPermissionsOnboardingHelp; } });
-var interactive_setup_js_1 = require("./interactive-setup.js");
-Object.defineProperty(exports, "runInteractiveSetup", { enumerable: true, get: function () { return interactive_setup_js_1.runInteractiveSetup; } });
-Object.defineProperty(exports, "runPostInstall", { enumerable: true, get: function () { return interactive_setup_js_1.runPostInstall; } });
-Object.defineProperty(exports, "projectUrlFromSlug", { enumerable: true, get: function () { return interactive_setup_js_1.projectUrlFromSlug; } });
-Object.defineProperty(exports, "LOOPBACK_REDIRECT_URIS", { enumerable: true, get: function () { return interactive_setup_js_1.LOOPBACK_REDIRECT_URIS; } });
+var watch_cli_js_1 = require("./watch-cli.js");
+Object.defineProperty(exports, "runWatchCommand", { enumerable: true, get: function () { return watch_cli_js_1.runWatchCommand; } });
+var post_install_js_1 = require("./post-install.js");
+Object.defineProperty(exports, "runPostInstall", { enumerable: true, get: function () { return post_install_js_1.runPostInstall; } });
 var status_cli_js_1 = require("./status-cli.js");
 Object.defineProperty(exports, "runStatusCommand", { enumerable: true, get: function () { return status_cli_js_1.runStatusCommand; } });
 Object.defineProperty(exports, "printUserIdentitySection", { enumerable: true, get: function () { return status_cli_js_1.printUserIdentitySection; } });
 Object.defineProperty(exports, "printAgentIdentitySection", { enumerable: true, get: function () { return status_cli_js_1.printAgentIdentitySection; } });
 Object.defineProperty(exports, "printPermissionsSection", { enumerable: true, get: function () { return status_cli_js_1.printPermissionsSection; } });
+var status_data_js_1 = require("./status-data.js");
+Object.defineProperty(exports, "collectStatusReport", { enumerable: true, get: function () { return status_data_js_1.collectStatusReport; } });
+Object.defineProperty(exports, "probePermissionsCoverage", { enumerable: true, get: function () { return status_data_js_1.probePermissionsCoverage; } });
 var version_cli_js_1 = require("./version-cli.js");
 Object.defineProperty(exports, "runVersionCommand", { enumerable: true, get: function () { return version_cli_js_1.runVersionCommand; } });
 Object.defineProperty(exports, "collectVersionInfo", { enumerable: true, get: function () { return version_cli_js_1.collectVersionInfo; } });
@@ -102,7 +168,6 @@ Object.defineProperty(exports, "parseSetupArgs", { enumerable: true, get: functi
 Object.defineProperty(exports, "readJsonFile", { enumerable: true, get: function () { return setup_js_1.readJsonFile; } });
 Object.defineProperty(exports, "writeJsonFile", { enumerable: true, get: function () { return setup_js_1.writeJsonFile; } });
 Object.defineProperty(exports, "isOryHookCommand", { enumerable: true, get: function () { return setup_js_1.isOryHookCommand; } });
-Object.defineProperty(exports, "resolveHookCommand", { enumerable: true, get: function () { return setup_js_1.resolveHookCommand; } });
 Object.defineProperty(exports, "matcherHookEntry", { enumerable: true, get: function () { return setup_js_1.matcherHookEntry; } });
 Object.defineProperty(exports, "mergeMatcherHooks", { enumerable: true, get: function () { return setup_js_1.mergeMatcherHooks; } });
 Object.defineProperty(exports, "removeMatcherHooks", { enumerable: true, get: function () { return setup_js_1.removeMatcherHooks; } });
@@ -114,14 +179,42 @@ Object.defineProperty(exports, "printNextSteps", { enumerable: true, get: functi
 Object.defineProperty(exports, "nextStepsSink", { enumerable: true, get: function () { return setup_js_1.nextStepsSink; } });
 Object.defineProperty(exports, "beginDeferNextSteps", { enumerable: true, get: function () { return setup_js_1.beginDeferNextSteps; } });
 Object.defineProperty(exports, "emitDeferredNextSteps", { enumerable: true, get: function () { return setup_js_1.emitDeferredNextSteps; } });
-Object.defineProperty(exports, "resolveMcpServerCommand", { enumerable: true, get: function () { return setup_js_1.resolveMcpServerCommand; } });
 Object.defineProperty(exports, "mcpServerEntry", { enumerable: true, get: function () { return setup_js_1.mcpServerEntry; } });
 Object.defineProperty(exports, "mergeMcpServer", { enumerable: true, get: function () { return setup_js_1.mergeMcpServer; } });
 Object.defineProperty(exports, "removeMcpServer", { enumerable: true, get: function () { return setup_js_1.removeMcpServer; } });
 Object.defineProperty(exports, "registerPlugin", { enumerable: true, get: function () { return setup_js_1.registerPlugin; } });
 Object.defineProperty(exports, "unregisterPlugin", { enumerable: true, get: function () { return setup_js_1.unregisterPlugin; } });
-var dev_js_1 = require("./dev.js");
-Object.defineProperty(exports, "runDevLauncher", { enumerable: true, get: function () { return dev_js_1.runDevLauncher; } });
+var runtime_js_1 = require("./runtime.js");
+// Runtime store — resolve the plugin runtime once, at install time.
+Object.defineProperty(exports, "wireRuntime", { enumerable: true, get: function () { return runtime_js_1.wireRuntime; } });
+Object.defineProperty(exports, "resolveRuntimeForInstall", { enumerable: true, get: function () { return runtime_js_1.resolveRuntimeForInstall; } });
+Object.defineProperty(exports, "materializeRuntime", { enumerable: true, get: function () { return runtime_js_1.materializeRuntime; } });
+Object.defineProperty(exports, "linkedRuntime", { enumerable: true, get: function () { return runtime_js_1.linkedRuntime; } });
+Object.defineProperty(exports, "resolveRuntimeEntry", { enumerable: true, get: function () { return runtime_js_1.resolveRuntimeEntry; } });
+Object.defineProperty(exports, "resolveMcpRuntimeEntry", { enumerable: true, get: function () { return runtime_js_1.resolveMcpRuntimeEntry; } });
+Object.defineProperty(exports, "writeHookShim", { enumerable: true, get: function () { return runtime_js_1.writeHookShim; } });
+Object.defineProperty(exports, "writeMcpShim", { enumerable: true, get: function () { return runtime_js_1.writeMcpShim; } });
+Object.defineProperty(exports, "hookCommand", { enumerable: true, get: function () { return runtime_js_1.hookCommand; } });
+Object.defineProperty(exports, "mcpCommand", { enumerable: true, get: function () { return runtime_js_1.mcpCommand; } });
+Object.defineProperty(exports, "isOryRuntimeCommand", { enumerable: true, get: function () { return runtime_js_1.isOryRuntimeCommand; } });
+Object.defineProperty(exports, "requireHookCommand", { enumerable: true, get: function () { return runtime_js_1.requireHookCommand; } });
+Object.defineProperty(exports, "moduleSpecifier", { enumerable: true, get: function () { return runtime_js_1.moduleSpecifier; } });
+Object.defineProperty(exports, "getRuntimeRoot", { enumerable: true, get: function () { return runtime_js_1.getRuntimeRoot; } });
+Object.defineProperty(exports, "getRuntimeStoreDir", { enumerable: true, get: function () { return runtime_js_1.getRuntimeStoreDir; } });
+Object.defineProperty(exports, "getShimDir", { enumerable: true, get: function () { return runtime_js_1.getShimDir; } });
+Object.defineProperty(exports, "getHookShimPath", { enumerable: true, get: function () { return runtime_js_1.getHookShimPath; } });
+Object.defineProperty(exports, "getMcpShimPath", { enumerable: true, get: function () { return runtime_js_1.getMcpShimPath; } });
+Object.defineProperty(exports, "readRuntimeManifest", { enumerable: true, get: function () { return runtime_js_1.readRuntimeManifest; } });
+Object.defineProperty(exports, "recordRuntimeWiring", { enumerable: true, get: function () { return runtime_js_1.recordRuntimeWiring; } });
+Object.defineProperty(exports, "getRuntimeWiring", { enumerable: true, get: function () { return runtime_js_1.getRuntimeWiring; } });
+Object.defineProperty(exports, "removeRuntimeWiring", { enumerable: true, get: function () { return runtime_js_1.removeRuntimeWiring; } });
+Object.defineProperty(exports, "pruneRuntimeStores", { enumerable: true, get: function () { return runtime_js_1.pruneRuntimeStores; } });
+Object.defineProperty(exports, "checkRuntimeHealth", { enumerable: true, get: function () { return runtime_js_1.checkRuntimeHealth; } });
+Object.defineProperty(exports, "describeRuntimeHealth", { enumerable: true, get: function () { return runtime_js_1.describeRuntimeHealth; } });
+Object.defineProperty(exports, "defaultNpmInstaller", { enumerable: true, get: function () { return runtime_js_1.defaultNpmInstaller; } });
+Object.defineProperty(exports, "MCP_SERVER_PACKAGE", { enumerable: true, get: function () { return runtime_js_1.MCP_SERVER_PACKAGE; } });
+var mirror_bootstrap_js_1 = require("./mirror-bootstrap.js");
+Object.defineProperty(exports, "renderMirrorBootstrap", { enumerable: true, get: function () { return mirror_bootstrap_js_1.renderMirrorBootstrap; } });
 var skills_js_1 = require("./skills.js");
 Object.defineProperty(exports, "renderOrySkills", { enumerable: true, get: function () { return skills_js_1.renderOrySkills; } });
 Object.defineProperty(exports, "renderOryCommands", { enumerable: true, get: function () { return skills_js_1.renderOryCommands; } });
@@ -137,15 +230,50 @@ Object.defineProperty(exports, "ORY_COMMAND_SKILL_NAMES", { enumerable: true, ge
 Object.defineProperty(exports, "ORY_COMMAND_SLUGS", { enumerable: true, get: function () { return skills_js_1.ORY_COMMAND_SLUGS; } });
 var index_js_1 = require("./local/index.js");
 Object.defineProperty(exports, "runLocalCommand", { enumerable: true, get: function () { return index_js_1.runLocalCommand; } });
-Object.defineProperty(exports, "ensureDevJaeger", { enumerable: true, get: function () { return index_js_1.ensureDevJaeger; } });
-Object.defineProperty(exports, "stopDevJaeger", { enumerable: true, get: function () { return index_js_1.stopDevJaeger; } });
-Object.defineProperty(exports, "DEV_JAEGER_CONTAINER", { enumerable: true, get: function () { return index_js_1.DEV_JAEGER_CONTAINER; } });
 var index_js_2 = require("./registry/index.js");
 Object.defineProperty(exports, "runRegistryCommand", { enumerable: true, get: function () { return index_js_2.runRegistryCommand; } });
+Object.defineProperty(exports, "REGISTRY_URL", { enumerable: true, get: function () { return index_js_2.REGISTRY_URL; } });
 var permissions_js_1 = require("./permissions.js");
 Object.defineProperty(exports, "checkAndDecide", { enumerable: true, get: function () { return permissions_js_1.checkAndDecide; } });
 Object.defineProperty(exports, "applyPermissionMode", { enumerable: true, get: function () { return permissions_js_1.applyPermissionMode; } });
 Object.defineProperty(exports, "gateToolCall", { enumerable: true, get: function () { return permissions_js_1.gateToolCall; } });
+Object.defineProperty(exports, "decomposeAndCheck", { enumerable: true, get: function () { return permissions_js_1.decomposeAndCheck; } });
+Object.defineProperty(exports, "resolveCheckRelation", { enumerable: true, get: function () { return permissions_js_1.resolveCheckRelation; } });
+var bash_parser_js_1 = require("./bash-parser.js");
+Object.defineProperty(exports, "extractShellCommands", { enumerable: true, get: function () { return bash_parser_js_1.extractShellCommands; } });
+Object.defineProperty(exports, "extractBashCommandWords", { enumerable: true, get: function () { return bash_parser_js_1.extractBashCommandWords; } });
+var opl_js_1 = require("./opl.js");
+Object.defineProperty(exports, "buildAgentSecurityOpl", { enumerable: true, get: function () { return opl_js_1.buildAgentSecurityOpl; } });
+Object.defineProperty(exports, "renderToolNamespaceClass", { enumerable: true, get: function () { return opl_js_1.renderToolNamespaceClass; } });
+Object.defineProperty(exports, "renderDelegationNamespaceClass", { enumerable: true, get: function () { return opl_js_1.renderDelegationNamespaceClass; } });
+Object.defineProperty(exports, "renderPermissionModeNamespaceClass", { enumerable: true, get: function () { return opl_js_1.renderPermissionModeNamespaceClass; } });
+Object.defineProperty(exports, "renderAgentRoleNamespaceClass", { enumerable: true, get: function () { return opl_js_1.renderAgentRoleNamespaceClass; } });
+Object.defineProperty(exports, "renderEnrollmentNamespaceClass", { enumerable: true, get: function () { return opl_js_1.renderEnrollmentNamespaceClass; } });
+Object.defineProperty(exports, "renderPrincipalClass", { enumerable: true, get: function () { return opl_js_1.renderPrincipalClass; } });
+Object.defineProperty(exports, "renderOplImport", { enumerable: true, get: function () { return opl_js_1.renderOplImport; } });
+Object.defineProperty(exports, "OPL_IMPORT_MODULE", { enumerable: true, get: function () { return opl_js_1.OPL_IMPORT_MODULE; } });
+Object.defineProperty(exports, "OPL_IMPORT_SYMBOLS", { enumerable: true, get: function () { return opl_js_1.OPL_IMPORT_SYMBOLS; } });
+Object.defineProperty(exports, "PRINCIPAL_NAMESPACES", { enumerable: true, get: function () { return opl_js_1.PRINCIPAL_NAMESPACES; } });
+Object.defineProperty(exports, "NODE_REFERENCE_NAMESPACES", { enumerable: true, get: function () { return opl_js_1.NODE_REFERENCE_NAMESPACES; } });
+Object.defineProperty(exports, "AGENT_NODE_NAMESPACE", { enumerable: true, get: function () { return opl_js_1.AGENT_NODE_NAMESPACE; } });
+Object.defineProperty(exports, "SUBAGENT_NODE_NAMESPACE", { enumerable: true, get: function () { return opl_js_1.SUBAGENT_NODE_NAMESPACE; } });
+Object.defineProperty(exports, "RELATION_USERS", { enumerable: true, get: function () { return opl_js_1.RELATION_USERS; } });
+Object.defineProperty(exports, "RELATION_BLOCKED_SUBJECTS", { enumerable: true, get: function () { return opl_js_1.RELATION_BLOCKED_SUBJECTS; } });
+Object.defineProperty(exports, "RELATION_DELEGATES", { enumerable: true, get: function () { return opl_js_1.RELATION_DELEGATES; } });
+Object.defineProperty(exports, "RELATION_CREDENTIALS", { enumerable: true, get: function () { return opl_js_1.RELATION_CREDENTIALS; } });
+Object.defineProperty(exports, "RELATION_ENFORCED_SUBJECTS", { enumerable: true, get: function () { return opl_js_1.RELATION_ENFORCED_SUBJECTS; } });
+Object.defineProperty(exports, "RELATION_MEMBERS", { enumerable: true, get: function () { return opl_js_1.RELATION_MEMBERS; } });
+Object.defineProperty(exports, "RELATION_OPTED_OUT_SUBJECTS", { enumerable: true, get: function () { return opl_js_1.RELATION_OPTED_OUT_SUBJECTS; } });
+Object.defineProperty(exports, "PERMISSION_MODE_OBJECT", { enumerable: true, get: function () { return opl_js_1.PERMISSION_MODE_OBJECT; } });
+Object.defineProperty(exports, "AUTO_ENROLL_OBJECT", { enumerable: true, get: function () { return opl_js_1.AUTO_ENROLL_OBJECT; } });
+Object.defineProperty(exports, "PROJECT_POSTURE_OBJECT", { enumerable: true, get: function () { return opl_js_1.PROJECT_POSTURE_OBJECT; } });
+Object.defineProperty(exports, "PERMISSION_MODE_NAMESPACE", { enumerable: true, get: function () { return opl_js_1.PERMISSION_MODE_NAMESPACE; } });
+Object.defineProperty(exports, "DELEGATION_NAMESPACE", { enumerable: true, get: function () { return opl_js_1.DELEGATION_NAMESPACE; } });
+Object.defineProperty(exports, "AGENT_ROLE_NAMESPACE", { enumerable: true, get: function () { return opl_js_1.AGENT_ROLE_NAMESPACE; } });
+Object.defineProperty(exports, "ENROLLMENT_NAMESPACE", { enumerable: true, get: function () { return opl_js_1.ENROLLMENT_NAMESPACE; } });
+Object.defineProperty(exports, "PERMIT_USE", { enumerable: true, get: function () { return opl_js_1.PERMIT_USE; } });
+Object.defineProperty(exports, "DEFAULT_NAMESPACE", { enumerable: true, get: function () { return opl_js_1.DEFAULT_NAMESPACE; } });
+Object.defineProperty(exports, "DEFAULT_SHELL_NAMESPACE", { enumerable: true, get: function () { return opl_js_1.DEFAULT_SHELL_NAMESPACE; } });
 var tool_catalog_js_1 = require("./tool-catalog.js");
 Object.defineProperty(exports, "HARNESS_TOOL_CATALOG", { enumerable: true, get: function () { return tool_catalog_js_1.HARNESS_TOOL_CATALOG; } });
 Object.defineProperty(exports, "KNOWN_HARNESSES", { enumerable: true, get: function () { return tool_catalog_js_1.KNOWN_HARNESSES; } });
@@ -154,6 +282,13 @@ Object.defineProperty(exports, "getToolCatalog", { enumerable: true, get: functi
 Object.defineProperty(exports, "INTERACTIVE_TOOL_CATALOG", { enumerable: true, get: function () { return tool_catalog_js_1.INTERACTIVE_TOOL_CATALOG; } });
 Object.defineProperty(exports, "getInteractiveToolCatalog", { enumerable: true, get: function () { return tool_catalog_js_1.getInteractiveToolCatalog; } });
 Object.defineProperty(exports, "isInteractiveTool", { enumerable: true, get: function () { return tool_catalog_js_1.isInteractiveTool; } });
+Object.defineProperty(exports, "SHELL_TOOL_CATALOG", { enumerable: true, get: function () { return tool_catalog_js_1.SHELL_TOOL_CATALOG; } });
+Object.defineProperty(exports, "getShellToolCatalog", { enumerable: true, get: function () { return tool_catalog_js_1.getShellToolCatalog; } });
+Object.defineProperty(exports, "isShellTool", { enumerable: true, get: function () { return tool_catalog_js_1.isShellTool; } });
+Object.defineProperty(exports, "SHELL_COMMAND_CATALOG", { enumerable: true, get: function () { return tool_catalog_js_1.SHELL_COMMAND_CATALOG; } });
+Object.defineProperty(exports, "getShellCommandCatalog", { enumerable: true, get: function () { return tool_catalog_js_1.getShellCommandCatalog; } });
+Object.defineProperty(exports, "resolveShellCommandNamespace", { enumerable: true, get: function () { return tool_catalog_js_1.resolveShellCommandNamespace; } });
+Object.defineProperty(exports, "extractShellCommand", { enumerable: true, get: function () { return tool_catalog_js_1.extractShellCommand; } });
 var lifecycle_js_1 = require("./lifecycle.js");
 Object.defineProperty(exports, "classifyLifecycle", { enumerable: true, get: function () { return lifecycle_js_1.classifyLifecycle; } });
 Object.defineProperty(exports, "isUserFacingPhase", { enumerable: true, get: function () { return lifecycle_js_1.isUserFacingPhase; } });
@@ -170,26 +305,42 @@ var subject_js_1 = require("./subject.js");
 Object.defineProperty(exports, "resolveUserSubject", { enumerable: true, get: function () { return subject_js_1.resolveUserSubject; } });
 Object.defineProperty(exports, "runWithUserSubject", { enumerable: true, get: function () { return subject_js_1.runWithUserSubject; } });
 Object.defineProperty(exports, "subjectLabel", { enumerable: true, get: function () { return subject_js_1.subjectLabel; } });
+// Machine credential subjects and their narrower session / spawn forms.
+// See docs/session-identity.md.
+Object.defineProperty(exports, "resolveAgentSubject", { enumerable: true, get: function () { return subject_js_1.resolveAgentSubject; } });
+Object.defineProperty(exports, "resolveAgentSessionSubject", { enumerable: true, get: function () { return subject_js_1.resolveAgentSessionSubject; } });
+Object.defineProperty(exports, "resolveSubAgentSubject", { enumerable: true, get: function () { return subject_js_1.resolveSubAgentSubject; } });
+Object.defineProperty(exports, "resolveSubAgentSpawnSubject", { enumerable: true, get: function () { return subject_js_1.resolveSubAgentSpawnSubject; } });
+Object.defineProperty(exports, "AGENT_NAMESPACE", { enumerable: true, get: function () { return subject_js_1.AGENT_NAMESPACE; } });
+Object.defineProperty(exports, "SUBAGENT_NAMESPACE", { enumerable: true, get: function () { return subject_js_1.SUBAGENT_NAMESPACE; } });
+Object.defineProperty(exports, "SESSION_NAMESPACE", { enumerable: true, get: function () { return subject_js_1.SESSION_NAMESPACE; } });
+Object.defineProperty(exports, "DEFAULT_USER_SUBJECT_NAMESPACE", { enumerable: true, get: function () { return subject_js_1.DEFAULT_USER_SUBJECT_NAMESPACE; } });
 var denial_js_1 = require("./denial.js");
 Object.defineProperty(exports, "formatDenialMessage", { enumerable: true, get: function () { return denial_js_1.formatDenialMessage; } });
 Object.defineProperty(exports, "formatDenialSummary", { enumerable: true, get: function () { return denial_js_1.formatDenialSummary; } });
 Object.defineProperty(exports, "formatAlertMessage", { enumerable: true, get: function () { return denial_js_1.formatAlertMessage; } });
 Object.defineProperty(exports, "formatAlertSummary", { enumerable: true, get: function () { return denial_js_1.formatAlertSummary; } });
 Object.defineProperty(exports, "alertAttributes", { enumerable: true, get: function () { return denial_js_1.alertAttributes; } });
+Object.defineProperty(exports, "shellDenialFields", { enumerable: true, get: function () { return denial_js_1.shellDenialFields; } });
 Object.defineProperty(exports, "OryDenialError", { enumerable: true, get: function () { return denial_js_1.OryDenialError; } });
 var tool_metadata_js_1 = require("./tool-metadata.js");
 Object.defineProperty(exports, "summarizeToolInput", { enumerable: true, get: function () { return tool_metadata_js_1.summarizeToolInput; } });
 Object.defineProperty(exports, "summarizeToolOutput", { enumerable: true, get: function () { return tool_metadata_js_1.summarizeToolOutput; } });
-var index_js_3 = require("./otel/index.js");
-Object.defineProperty(exports, "OtlpExporter", { enumerable: true, get: function () { return index_js_3.OtlpExporter; } });
-Object.defineProperty(exports, "otlpExporterFromEnv", { enumerable: true, get: function () { return index_js_3.otlpExporterFromEnv; } });
-Object.defineProperty(exports, "parseKeyValueList", { enumerable: true, get: function () { return index_js_3.parseKeyValueList; } });
 var adapters_js_1 = require("./adapters.js");
 Object.defineProperty(exports, "resolveNamespace", { enumerable: true, get: function () { return adapters_js_1.resolveNamespace; } });
 Object.defineProperty(exports, "sessionStart", { enumerable: true, get: function () { return adapters_js_1.sessionStart; } });
+Object.defineProperty(exports, "createSessionStarter", { enumerable: true, get: function () { return adapters_js_1.createSessionStarter; } });
+Object.defineProperty(exports, "withHookContext", { enumerable: true, get: function () { return adapters_js_1.withHookContext; } });
+Object.defineProperty(exports, "decideTool", { enumerable: true, get: function () { return adapters_js_1.decideTool; } });
 Object.defineProperty(exports, "gate", { enumerable: true, get: function () { return adapters_js_1.gate; } });
 Object.defineProperty(exports, "complete", { enumerable: true, get: function () { return adapters_js_1.complete; } });
+Object.defineProperty(exports, "fail", { enumerable: true, get: function () { return adapters_js_1.fail; } });
 Object.defineProperty(exports, "registerSubagent", { enumerable: true, get: function () { return adapters_js_1.registerSubagent; } });
 Object.defineProperty(exports, "writeUserDelegatesAgent", { enumerable: true, get: function () { return adapters_js_1.writeUserDelegatesAgent; } });
 Object.defineProperty(exports, "writeAgentDelegatesSubagent", { enumerable: true, get: function () { return adapters_js_1.writeAgentDelegatesSubagent; } });
 Object.defineProperty(exports, "wrapTool", { enumerable: true, get: function () { return adapters_js_1.wrapTool; } });
+// ─── Dashboard (status surface of the web app) ──────────────────────────────
+// Appended at EOF (outside the web-installer branch's edit region) so the two
+// branches merge without an index.ts conflict.
+var status_system_js_1 = require("./status-system.js");
+Object.defineProperty(exports, "collectSystemServices", { enumerable: true, get: function () { return status_system_js_1.collectSystemServices; } });

package/dist/lifecycle.d.ts

@@ -5,7 +5,7 @@
  * `PreToolUse`, Gemini's `BeforeTool`, OpenCode's `tool.execute.before`,
  * …). Mapping them onto a shared phase set lets the plugin code reason
  * about *what is happening* without first remembering *which harness
- * we're in*. Spans, logs, docs, and tests all reference the same set of
+ * we're in*. Activity logs, docs, and tests all reference the same set of
  * phases.
  *
  * Phases split into three buckets:
@@ -18,7 +18,7 @@
  * - **User-facing interactions.** `user.prompt`, `user.interaction`,
  *   `permission.ask`. The harness is communicating with the human:
  *   they typed a prompt, the harness is surfacing a confirmation,
- *   the harness is asking whether to allow a tool. These are *traced*
+ *   the harness is asking whether to allow a tool. These are *logged*
  *   but never gated by a tool permission check — the user is the
  *   final decision-maker. (`permission.ask` does consult Ory to
  *   inform the harness's UI, but the call is advisory.)
@@ -29,7 +29,7 @@
  *   the only phases that run a true `use` permission gate.
  *
  * `passthrough` is the explicit "nothing to do here" bucket — the
- * harness fired an event we don't model, and we record an audit span
+ * harness fired an event we don't model, and we record an audit event
  * and return.
  */
 export type LifecyclePhase = "session.start" | "session.stop" | "user.prompt" | "user.interaction" | "permission.ask" | "tool.before" | "tool.after" | "tool.failure" | "subagent.start" | "subagent.stop" | "compaction" | "passthrough";

package/dist/lifecycle.js

@@ -6,7 +6,7 @@
  * `PreToolUse`, Gemini's `BeforeTool`, OpenCode's `tool.execute.before`,
  * …). Mapping them onto a shared phase set lets the plugin code reason
  * about *what is happening* without first remembering *which harness
- * we're in*. Spans, logs, docs, and tests all reference the same set of
+ * we're in*. Activity logs, docs, and tests all reference the same set of
  * phases.
  *
  * Phases split into three buckets:
@@ -19,7 +19,7 @@
  * - **User-facing interactions.** `user.prompt`, `user.interaction`,
  *   `permission.ask`. The harness is communicating with the human:
  *   they typed a prompt, the harness is surfacing a confirmation,
- *   the harness is asking whether to allow a tool. These are *traced*
+ *   the harness is asking whether to allow a tool. These are *logged*
  *   but never gated by a tool permission check — the user is the
  *   final decision-maker. (`permission.ask` does consult Ory to
  *   inform the harness's UI, but the call is advisory.)
@@ -30,7 +30,7 @@
  *   the only phases that run a true `use` permission gate.
  *
  * `passthrough` is the explicit "nothing to do here" bucket — the
- * harness fired an event we don't model, and we record an audit span
+ * harness fired an event we don't model, and we record an audit event
  * and return.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
@@ -91,7 +91,7 @@ exports.HARNESS_LIFECYCLE_MAP = {
     },
     // Continue's `Stop` brackets a turn (not the session) and `ConfigChange`
     // carries no lifecycle meaning — both fall through to passthrough and are
-    // traced as audit spans by the handler.
+    // logged as audit activity by the handler.
     continue: {
         SessionStart: "session.start",
         SessionEnd: "session.stop",
@@ -105,7 +105,7 @@ exports.HARNESS_LIFECYCLE_MAP = {
         PreCompact: "compaction",
     },
     // Goose's file/shell notification hooks surface activity to the user and
-    // are trace-only — user-facing, never gated.
+    // are activity-only — user-facing, never gated.
     goose: {
         SessionStart: "session.start",
         SessionEnd: "session.stop",
@@ -149,7 +149,7 @@ exports.HARNESS_LIFECYCLE_MAP = {
     // Google Antigravity (`agy` CLI / IDE). Subprocess hooks with
     // Claude-Code-style snake_case payloads. PreInvocation/PostInvocation
     // bracket each agent turn (not user prompts), so they fall through to
-    // passthrough and are traced as audit spans by the handler.
+    // passthrough and are logged as audit activity by the handler.
     antigravity: {
         SessionStart: "session.start",
         SessionEnd: "session.stop",
@@ -158,6 +158,31 @@ exports.HARNESS_LIFECYCLE_MAP = {
         PostToolUse: "tool.after",
         Notification: "user.interaction",
     },
+    // Cursor (editor + CLI). Subprocess hooks read from `.cursor/hooks.json`.
+    // `preToolUse` is the single permission gate — it already fires for every
+    // tool category (Shell, Read, Write, MCP, Task). The more specific
+    // `beforeShellExecution` / `beforeMCPExecution` / `beforeReadFile` hooks and
+    // their `after*` counterparts surface activity to the user and are
+    // activity-only (`user.interaction`), so shell/MCP/file access isn't gated
+    // twice. `beforeSubmitPrompt` is the user typing (activity-only).
+    cursor: {
+        sessionStart: "session.start",
+        sessionEnd: "session.stop",
+        stop: "session.stop",
+        preToolUse: "tool.before",
+        postToolUse: "tool.after",
+        postToolUseFailure: "tool.failure",
+        beforeSubmitPrompt: "user.prompt",
+        preCompact: "compaction",
+        subagentStart: "subagent.start",
+        subagentStop: "subagent.stop",
+        beforeShellExecution: "user.interaction",
+        afterShellExecution: "user.interaction",
+        beforeMCPExecution: "user.interaction",
+        afterMCPExecution: "user.interaction",
+        beforeReadFile: "user.interaction",
+        afterFileEdit: "user.interaction",
+    },
     // ── Agent SDK integrations ── (parity with `ory_argus.lifecycle`; each
     // entry names the canonical extension point the integration hooks)
     langchain: {
@@ -218,6 +243,13 @@ exports.HARNESS_LIFECYCLE_MAP = {
         "execute.before": "tool.before",
         "execute.after": "tool.after",
     },
+    "openrouter-agent": {
+        SessionStart: "session.start",
+        PreToolUse: "tool.before",
+        PostToolUse: "tool.after",
+        PostToolUseFailure: "tool.failure",
+        SessionEnd: "session.stop",
+    },
 };
 /**
  * Resolve a harness event name to its canonical {@link LifecyclePhase}.

package/dist/local/cli.js

@@ -6,6 +6,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runLocalCommand = runLocalCommand;
+const configs_js_1 = require("./configs.js");
 const manager_js_1 = require("./manager.js");
 const cli_invocation_js_1 = require("../cli-invocation.js");
 /**
@@ -73,13 +74,17 @@ Commands:
 Requires Docker (Docker Desktop or docker engine + compose plugin).
 
 The local environment runs:
-  Ory Kratos    Identity & session management    :4433 / :4434
-  Ory Keto      Permission checks (Zanzibar)     :4466 / :4467
-  Ory Hydra     OAuth2 & OIDC                    :4444 / :4445
-  Nginx gateway Unified API (like Ory Network)   :4000
+  Ory Kratos    Identity & session management    :${configs_js_1.KRATOS_PUBLIC_PORT} / :${configs_js_1.KRATOS_ADMIN_PORT}
+  Ory Keto      Permission checks (Zanzibar)     :${configs_js_1.KETO_READ_PORT} / :${configs_js_1.KETO_WRITE_PORT}
+  Ory Hydra     OAuth2 & OIDC                    :${configs_js_1.HYDRA_PUBLIC_PORT} / :${configs_js_1.HYDRA_ADMIN_PORT}
+  Nginx gateway Unified API (like Ory Network)   :${configs_js_1.GATEWAY_PORT}
 
-After 'local up', set ORY_PROJECT_URL=http://localhost:4000 to point
-any Ory agent plugin at the local environment.
+Ports are the stock Ory defaults and are all overridable — shift the whole
+stack with ORY_LOCAL_PORT_OFFSET=<n>, or pin one with ORY_LOCAL_<SERVICE>_PORT.
+
+After 'local up', set ORY_PROJECT_URL=${configs_js_1.GATEWAY_URL} and
+ORY_AGENT_SECURITY_URL=https://agents.console.ory:8080 to point an Ory agent
+plugin at the local project and canonical local broker.
 
 Examples:
   ${(0, cli_invocation_js_1.oryNpx)(binName)} local up              # Start everything and seed test data