@ory/argus 0.13.9 → 1.0.0

package/dist/permissions-cli.js

@@ -1,76 +1,35 @@
 "use strict";
 /**
  * Shared `permissions` CLI implementation. Each harness's `cli/main.ts`
- * delegates to {@link runPermissionsCommand}, passing the harness's name
- * so subcommands can scope to that harness's tool catalog.
+ * delegates to {@link runPermissionsCommand}, passing the harness's name so the
+ * report can scope to that harness's tool catalog.
  *
- * Subcommands:
+ * `permissions` takes **no subcommand** — it is a single read-only report: the
+ * live permission mode (read from the Ory project), the subject being checked,
+ * and the allow / deny / blocked breakdown across the harness's known tool
+ * catalog. (`permissions status` is still accepted; it was the name through
+ * v0.14, and the report is the same.)
  *
- *   - `status`   — Print the configured {@link PermissionMode} and, when
- *                  the client can reach Ory, the allow/deny breakdown
- *                  across the harness's known tool catalog.
- *   - `bootstrap` — Idempotently write `<namespace>:<tool>#use@<userSubject>`
- *                  tuples for every tool in the harness's catalog. Run
- *                  automatically by `install` when a user identity is
- *                  cached; can be re-run by hand any time.
- *   - `observe`  — Persist `permissionMode = "observe"` in the shared
- *                  config (denies log but don't block).
- *   - `enforce`  — Persist `permissionMode = "enforce"` in the shared
- *                  config (denies block — the production posture).
- *
- * All four are non-destructive on existing config and idempotent on
- * Keto: re-running them is always safe.
+ * Everything that *writes* to the project is provisioned in the **Ory Console**
+ * (Agent Security), not from the plugin: the permission model, the per-tool
+ * grants, explicit blocks, and the observe/enforce posture. That is what lets a
+ * plugin be installed with nothing but a project URL — the public OAuth2 client
+ * id has a reserved default, with no workspace privilege, project API key, or admin write path. The
+ * plugin is a read-only client of the project's permission state.
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runPermissionsCommand = runPermissionsCommand;
-exports.isUserIdentityCached = isUserIdentityCached;
-exports.printPermissionsOnboardingHelp = printPermissionsOnboardingHelp;
-exports.maybeAutoBootstrap = maybeAutoBootstrap;
 const config_js_1 = require("./config.js");
+const permission_mode_js_1 = require("./permission-mode.js");
 const client_js_1 = require("./client.js");
 const logger_js_1 = require("./logger.js");
 const agent_auth_js_1 = require("./agent-auth.js");
-const auth_store_js_1 = require("./auth-store.js");
 const tool_catalog_js_1 = require("./tool-catalog.js");
 const subject_js_1 = require("./subject.js");
-const cli_invocation_js_1 = require("./cli-invocation.js");
-const ui = __importStar(require("./ui.js"));
-const ENV_PERMISSION_MODE = "ORY_PERMISSION_MODE";
+const permissions_js_1 = require("./permissions.js");
+const opl_js_1 = require("./opl.js");
 function resolveNamespace() {
-    return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
+    return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTool";
 }
 /**
  * Entry point invoked by each harness CLI's `permissions` case.
@@ -81,23 +40,28 @@ function resolveNamespace() {
  */
 async function runPermissionsCommand(binName, harness, args) {
     const sub = args[0];
-    if (!sub || sub === "--help" || sub === "-h") {
+    if (sub === "--help" || sub === "-h") {
         printPermissionsHelp(binName);
-        return sub ? 0 : 1;
+        return 0;
+    }
+    // No subcommand is the command: print the report. The report spins up a client
+    // and probes per tool, emitting debug/info events — quiet the stderr firehose
+    // so those don't interleave with the human-facing output under
+    // ORY_AGENT_DEBUG=true; the log file still captures everything.
+    //
+    // `status` is accepted as the v0.14 spelling of the same thing.
+    if (!sub || sub === "status") {
+        return await (0, logger_js_1.withQuietStderr)(() => runPermissionsStatus(binName, harness));
     }
     switch (sub) {
-        // `status` and `bootstrap` spin up a client and probe/grant per tool,
-        // emitting debug/info events. Quiet the stderr firehose so those don't
-        // interleave with the command's human-facing output under
-        // ORY_AGENT_DEBUG=true; the log file still captures everything.
-        case "status":
-            return await (0, logger_js_1.withQuietStderr)(() => runPermissionsStatus(binName, harness));
         case "bootstrap":
-            return await (0, logger_js_1.withQuietStderr)(() => runPermissionsBootstrap(binName, harness, args.slice(1)));
+        case "block":
+        case "unblock":
         case "observe":
-            return runPermissionsSetMode(binName, "observe");
         case "enforce":
-            return runPermissionsSetMode(binName, "enforce");
+        case "install-schema":
+            printProvisioningMovedToConsole(binName, sub);
+            return 1;
         default:
             console.error(`Unknown permissions subcommand: ${sub}`);
             console.error(`Run "${binName} permissions --help" for usage.`);
@@ -105,39 +69,40 @@ async function runPermissionsCommand(binName, harness, args) {
     }
 }
 function printPermissionsHelp(binName) {
-    console.log(`Usage: ${binName} permissions <subcommand>`);
+    console.log(`Usage: ${binName} permissions`);
     console.log("");
-    console.log("Subcommands:");
-    console.log("  status      Show permission mode and tool coverage for the current user");
-    console.log("  bootstrap   Grant the current user 'use' on every built-in tool (idempotent)");
-    console.log("  observe     Switch to observe mode (denies log but don't block)");
-    console.log("  enforce     Switch to enforce mode (denies block — production posture)");
+    console.log("Prints the live permission mode, the subject being checked, and the");
+    console.log("allow / deny / blocked breakdown across this harness's built-in tools.");
+    console.log("Read-only — it changes nothing.");
     console.log("");
     console.log("Permission mode controls what happens when an Ory check returns deny:");
-    console.log("  observe  — Log + audit-span, allow the tool through. The onboarding default.");
+    console.log("  observe  — Log an audit event and allow the tool through. The default.");
     console.log("  enforce  — Block the tool. The production posture.");
     console.log("");
-    console.log(`Mode is read from ${ENV_PERMISSION_MODE} env, then the shared config file.`);
-}
-function runPermissionsSetMode(binName, mode) {
-    (0, config_js_1.saveConfig)({ permissionMode: mode });
-    const configPath = (0, config_js_1.getConfigPath)();
-    console.log(`Permission mode set to '${mode}'.`);
-    console.log(`  Saved to: ${configPath}`);
+    console.log("The plugin only ever *reads* permissions. Tool grants, explicit blocks,");
+    console.log("the permission model, and the observe/enforce posture are all managed in");
+    console.log("the Ory Console (Agent Security) by someone with access to the project.");
     console.log("");
-    if (mode === "observe") {
-        console.log("Denies will be logged and recorded as `permission.observe_deny` spans,");
-        console.log("but tools will be allowed through. Run");
-        console.log(`  ${binName} permissions enforce`);
-        console.log("once your permission set is correct.");
-    }
-    else {
-        console.log("Denies will block tool execution. The plugin is now enforcing.");
-        console.log(`Switch back with: ${binName} permissions observe`);
-    }
-    console.log("");
-    console.log(`Note: the ${ENV_PERMISSION_MODE} environment variable, when set, overrides this.`);
-    return 0;
+    console.log(`A subject is in 'enforce' when granted ${opl_js_1.PERMISSION_MODE_NAMESPACE}:${opl_js_1.PERMISSION_MODE_OBJECT}#${opl_js_1.RELATION_ENFORCED_SUBJECTS},`);
+    console.log("otherwise 'observe'.");
+}
+/**
+ * The subcommands that used to write to the project — grants, explicit blocks,
+ * the deny posture, and the permission-model installer. All of that is now
+ * provisioned in the Ory Console, so these print where to go and exit non-zero
+ * rather than silently doing nothing.
+ */
+function printProvisioningMovedToConsole(binName, attempted) {
+    console.error(`'permissions ${attempted}' is no longer part of the plugin.`);
+    console.error("");
+    console.error("Permissions are provisioned in the Ory Console (Agent Security):");
+    console.error("  - the permission model applied to the project");
+    console.error("  - per-tool grants for a user, agent, or group");
+    console.error("  - explicit blocks (a deny that beats any grant)");
+    console.error("  - the observe / enforce posture, project-wide or per principal");
+    console.error("");
+    console.error("The plugin reads that state and enforces it. To see what it resolves:");
+    console.error(`  ${binName} permissions`);
 }
 async function runPermissionsStatus(binName, harness) {
     const resolved = (0, config_js_1.resolveConfig)();
@@ -146,20 +111,18 @@ async function runPermissionsStatus(binName, harness) {
     console.log(`Permission status (${harness})`);
     console.log("==========================================");
     console.log("");
-    console.log(`Mode:           ${resolved.permissionMode}${formatModeSource(resolved.permissionModeSource)}`);
-    console.log(`  (other modes: ${otherModes(resolved.permissionMode).join(", ")})`);
     console.log(`Namespace:      ${namespace}`);
     console.log(`Project URL:    ${resolved.projectUrl ?? "(not set)"}${formatSourceSuffix(resolved.projectUrlSource)}`);
-    console.log(`Audit-only:     ${resolved.auditOnly ? "yes (Ory disabled)" : "no"}`);
+    console.log(`OAuth2 Client:  ${resolved.oauth2ClientId ?? "(not set)"}${formatSourceSuffix(resolved.oauth2ClientIdSource)}`);
+    console.log(`Agent Security: ${resolved.security.connected ? "connected" : `not connected (${(0, config_js_1.describeSecurityGap)(resolved.security)})`}`);
+    console.log(`Permission model: checks route through the '${opl_js_1.PERMIT_USE}' permit (explicit blocks honored)`);
     console.log("");
-    if (resolved.auditOnly) {
-        console.log("Ory is disabled (audit-only). No permission checks run.");
-        console.log(`Re-enable with: ${binName} configure --project-url <URL> --oauth2-client-id <CLIENT_ID> [--api-key <KEY>]`);
-        return 0;
-    }
-    if (!resolved.projectUrl) {
-        console.log("No project URL configured — cannot probe permission coverage.");
-        console.log(`Configure first: ${binName} configure --project-url <URL> --oauth2-client-id <CLIENT_ID> [--api-key <KEY>]`);
+    if (!resolved.security.connected) {
+        console.log("Ory Agent Security is not connected, so no permission checks run and there");
+        console.log("is no coverage to report. The rest of the plugin is unaffected.");
+        console.log("");
+        console.log(`Connect with: ${binName} configure --project-url <URL>`);
+        console.log("The project URL comes from the Ory Console (Agent Security).");
         return 0;
     }
     if (catalog.length === 0) {
@@ -179,12 +142,22 @@ async function runPermissionsStatus(binName, harness) {
         console.log("ORY_USER_SUBJECT_ID to probe against a known subject.");
         return 0;
     }
+    // Resolve the LIVE mode (a Keto read) rather than the cached config value, so
+    // status reflects exactly what the gate would decide.
+    const agentSubject = (0, subject_js_1.resolveAgentSubject)(client);
+    const live = await (0, permission_mode_js_1.resolvePermissionMode)(client, subject, {
+        additionalSubjects: agentSubject ? [{ scope: "agent", subject: agentSubject }] : [],
+    });
     console.log(`Subject:        ${subjectId}`);
+    console.log(`Mode:           ${live.mode}${formatModeSource(live.source, resolved.permissionModeCache?.fetchedAt)}`);
+    console.log(`  (other modes: ${otherModes(live.mode).join(", ")})`);
+    console.log(`  Set in the Ory Console (Agent Security): grant ${opl_js_1.PERMISSION_MODE_NAMESPACE}:${opl_js_1.PERMISSION_MODE_OBJECT}#${opl_js_1.RELATION_ENFORCED_SUBJECTS} to enforce.`);
     console.log(`Tool catalog:   ${catalog.length} tools`);
     console.log("");
     const results = await probeCatalog(client, catalog, namespace, subject);
-    const allowed = results.filter((r) => r.allowed).length;
-    const denied = results.filter((r) => r.error === undefined && !r.allowed).length;
+    const allowed = results.filter((r) => r.error === undefined && r.allowed).length;
+    const blocked = results.filter((r) => r.blocked).length;
+    const denied = results.filter((r) => r.error === undefined && !r.allowed && !r.blocked).length;
     const errored = results.filter((r) => r.error !== undefined).length;
     const widest = Math.max(...catalog.map((t) => t.length), 4);
     console.log(`  ${"Tool".padEnd(widest)}  Status`);
@@ -192,34 +165,55 @@ async function runPermissionsStatus(binName, harness) {
     for (const r of results) {
         const status = r.error
             ? `error (${r.error})`
-            : r.allowed
-                ? "allowed"
-                : "denied";
+            : r.blocked
+                ? "blocked"
+                : r.allowed
+                    ? "allowed"
+                    : "denied";
         console.log(`  ${r.tool.padEnd(widest)}  ${status}`);
     }
     console.log("");
-    console.log(`Summary: ${allowed} allowed, ${denied} denied, ${errored} errored.`);
-    if (denied > 0) {
+    console.log(`Summary: ${allowed} allowed, ${denied} denied, ${blocked} blocked, ${errored} errored.`);
+    // Shell sub-tools (issue #76): a compact count rather than 100+ rows.
+    let shellDenied = 0;
+    if ((0, tool_catalog_js_1.getShellToolCatalog)(harness).length > 0) {
+        const shellNamespace = (0, tool_catalog_js_1.resolveShellCommandNamespace)();
+        const shellWords = (0, tool_catalog_js_1.getShellCommandCatalog)();
+        const shellResults = await probeCatalog(client, shellWords, shellNamespace, subject);
+        const sAllowed = shellResults.filter((r) => r.allowed).length;
+        shellDenied = shellResults.filter((r) => r.error === undefined && !r.allowed).length;
+        const sErrored = shellResults.filter((r) => r.error !== undefined).length;
+        console.log(`Shell commands (${shellNamespace}): ${sAllowed} allowed, ${shellDenied} denied, ` +
+            `${sErrored} errored of ${shellWords.length}.`);
+    }
+    if (denied > 0 || shellDenied > 0) {
+        console.log("");
+        console.log("Denied tools have no grant for this subject. Grant them in the Ory");
+        console.log("Console (Agent Security) — the plugin cannot write permissions.");
+    }
+    if (blocked > 0) {
         console.log("");
-        console.log(`Run "${binName} permissions bootstrap" to grant the current user`);
-        console.log("'use' on every tool in this harness's catalog (idempotent).");
+        console.log("'blocked' tools carry an explicit block that overrides any grant.");
+        console.log("Remove it in the Ory Console (Agent Security).");
     }
     return 0;
 }
 async function probeCatalog(client, catalog, namespace, subject) {
+    // Evaluate the effective `use` permit, exactly as the runtime gate does.
+    const relation = (0, permissions_js_1.resolveCheckRelation)("users");
     const rows = [];
     for (const tool of catalog) {
-        const check = {
-            namespace,
-            object: tool,
-            relation: "use",
-            ...subject,
-        };
         try {
-            const result = await client.checkPermission(check, {
-                spanAttributes: { toolName: tool, source: "permissions_status" },
-            });
-            rows.push({ tool, allowed: result.allowed });
+            const result = await client.checkPermission({ namespace, object: tool, relation, ...subject }, { activityAttributes: { toolName: tool, source: "permissions_status" } });
+            let blocked = false;
+            if (!result.allowed) {
+                // Distinguish an explicit block from a plain missing grant.
+                blocked = await client
+                    .checkPermission({ namespace, object: tool, relation: opl_js_1.RELATION_BLOCKED_SUBJECTS, ...subject }, { activityAttributes: { toolName: tool, source: "permissions_status_block" } })
+                    .then((r) => r.allowed)
+                    .catch(() => false);
+            }
+            rows.push({ tool, allowed: result.allowed, blocked });
         }
         catch (err) {
             const ory = err;
@@ -228,198 +222,39 @@ async function probeCatalog(client, catalog, namespace, subject) {
     }
     return rows;
 }
-async function runPermissionsBootstrap(binName, harness, args) {
-    const dryRun = args.includes("--dry-run") || args.includes("-n");
-    const resolved = (0, config_js_1.resolveConfig)();
-    const namespace = resolveNamespace();
-    const catalog = (0, tool_catalog_js_1.getToolCatalog)(harness);
-    if (resolved.auditOnly) {
-        console.error("Ory is in audit-only mode (kill-switch). Nothing to bootstrap.");
-        console.error(`Re-enable Ory: ${binName} configure --project-url <URL> --oauth2-client-id <CLIENT_ID> [--api-key <KEY>]`);
-        return 1;
-    }
-    if (!resolved.projectUrl) {
-        console.error("No ORY_PROJECT_URL configured — cannot write permissions.");
-        console.error(`Configure first: ${binName} configure --project-url <URL> --oauth2-client-id <CLIENT_ID> [--api-key <KEY>]`);
-        return 1;
-    }
-    if (catalog.length === 0) {
-        console.error(`No tool catalog known for harness "${harness}".`);
-        console.error(`Known harnesses: ${tool_catalog_js_1.KNOWN_HARNESSES.join(", ")}`);
-        return 1;
-    }
-    const client = client_js_1.OryAgentClient.fromEnv(harness);
-    await (0, agent_auth_js_1.ensureAgentIdentity)(client, { projectUrl: resolved.projectUrl }).catch(() => {
-        /* best-effort; the write may still succeed with the API key or no auth (local Keto) */
-    });
-    const subject = (0, subject_js_1.resolveUserSubject)(client);
-    const subjectId = (0, subject_js_1.subjectLabel)(subject);
-    if (subjectId === "agent:unknown") {
-        console.error("No user identity resolved — refusing to write permissions for an unknown subject.");
-        console.error("");
-        console.error("Either:");
-        console.error("  - run the harness once with ORY_USER_LOGIN=true so a user token is cached, or");
-        console.error("  - set ORY_USER_SUBJECT_ID=<id> to target a known subject.");
-        return 1;
-    }
-    console.log(`Bootstrapping ${catalog.length} permissions for ${harness}`);
-    console.log("==========================================");
-    console.log("");
-    console.log(`Namespace: ${namespace}`);
-    console.log(`Subject:   ${subjectId}`);
-    console.log(`Tools:     ${catalog.join(", ")}`);
-    if (dryRun) {
-        console.log("");
-        console.log("(--dry-run) No permissions will be written.");
-    }
-    console.log("");
-    let created = 0;
-    let existed = 0;
-    const failures = [];
-    for (const tool of catalog) {
-        const check = {
-            namespace,
-            object: tool,
-            relation: "use",
-            ...subject,
-        };
-        if (dryRun) {
-            console.log(`  ~ would write: ${namespace}:${tool}#use@${subjectId}`);
-            continue;
-        }
-        try {
-            // Read-before-write: Keto's create API is not idempotent (every PUT
-            // inserts a new row and never 409s), so a plain createRelationship on
-            // re-install would duplicate the whole catalog. ensureRelationship
-            // probes for the exact tuple first and only writes when it is absent.
-            const spanAttributes = { toolName: tool, source: "permissions_bootstrap" };
-            let res = await client.ensureRelationship(check, { spanAttributes });
-            if (res.probeError) {
-                // Couldn't confirm existence — fall back to a direct write so a
-                // needed grant is still created (bootstrap's job is to guarantee it).
-                res = await client.createRelationship(check, { spanAttributes });
-            }
-            if (res.alreadyExisted) {
-                existed++;
-                console.log(`  = ${tool}  (already exists)`);
-            }
-            else {
-                created++;
-                console.log(`  + ${tool}  (created)`);
-            }
-        }
-        catch (err) {
-            const ory = err;
-            const reason = `${ory.code ?? "unknown"}${ory.status ? ` (HTTP ${ory.status})` : ""}`;
-            failures.push({ tool, reason });
-            console.log(`  ! ${tool}  (failed: ${reason})`);
-        }
-    }
-    console.log("");
-    if (dryRun) {
-        console.log(`Dry run: ${catalog.length} permissions would be written.`);
-        return 0;
-    }
-    console.log(`Created: ${created}    Already existed: ${existed}    Failed: ${failures.length}`);
-    if (failures.length > 0) {
-        const writeAuthFailure = failures.some((f) => /(unknown|forbidden|session_inactive)/.test(f.reason) ||
-            /401|403/.test(f.reason));
-        if (writeAuthFailure) {
-            console.log("");
-            console.log("Some writes were rejected — your current credentials may lack");
-            console.log("write scope on the permission namespace. You can apply the");
-            console.log("permissions manually using the snippet below (one per line):");
-            console.log("");
-            for (const tool of catalog) {
-                console.log(`  ${namespace}:${tool}#use@${subjectId}`);
-            }
-            console.log("");
-            console.log("Or use the Ory Console: open the project, go to Permissions →");
-            console.log(`Relationships, set namespace='${namespace}', object=<tool>, relation='use',`);
-            console.log(`and subject='${subjectId}'.`);
-        }
-        return failures.length === catalog.length ? 1 : 0;
-    }
-    console.log("");
-    console.log(`Permissions are in place. Promote to enforce mode when ready:`);
-    console.log(`  ${binName} permissions enforce`);
-    return 0;
-}
 /**
- * Whether a user identity is cached locally — used by `install` to
- * decide whether to opportunistically bootstrap tuples without
- * prompting. Returns true when persisted tokens exist and are not
- * expired, or when ORY_USER_SUBJECT_ID is set explicitly.
+ * Render the trailing source annotation on a Mode line. `server` means a live
+ * read from the Ory project; `cache` means the server was unreachable and the
+ * last-read value is being used (annotated with when it was fetched); `default`
+ * means nothing has ever been read (so `observe`).
  */
-function isUserIdentityCached() {
-    if (process.env.ORY_USER_SUBJECT_ID)
-        return true;
-    const tokens = (0, auth_store_js_1.loadTokens)();
-    return !!tokens && !(0, auth_store_js_1.isExpired)(tokens);
-}
-/**
- * Print the "permission mode" section of the install banner.
- *
- * Tells the user what observe vs enforce mean, and prints the two
- * follow-up commands they'll typically reach for next:
- *
- *   - `<bin> permissions bootstrap` to seed tuples for the harness's
- *     built-in tools (the line is shown whether or not we just ran it
- *     ourselves, so the user can re-run after editing the catalog).
- *   - `<bin> permissions enforce` once they're satisfied with the
- *     observe-mode trace output and want denies to actually block.
- */
-function printPermissionsOnboardingHelp(binName, harness, opts = {}) {
-    const resolved = (0, config_js_1.resolveConfig)();
-    const catalog = (0, tool_catalog_js_1.getToolCatalog)(harness);
-    ui.heading("Permissions:");
-    ui.summary([
-        ["Mode", `${resolved.permissionMode}${formatModeSource(resolved.permissionModeSource)}`],
-        ["Other modes", otherModes(resolved.permissionMode).join(", ")],
-    ]);
-    if (resolved.auditOnly) {
-        ui.hint("Ory is in audit-only mode (kill switch). Permission checks are disabled.");
-        return;
-    }
-    if (resolved.permissionMode === "observe") {
-        ui.hint("Observe mode: permission denies are logged + traced, but tools still run.");
-        ui.hint("This is the safe default — promote to 'enforce' once your permission set is correct.");
-    }
-    else {
-        ui.hint("Enforce mode: permission denies block tool execution.");
-    }
-    if (opts.bootstrappedAutomatically) {
-        ui.blank();
-        ui.success(`Permissions bootstrapped for ${catalog.length} built-in tools.`);
-    }
-    else if (catalog.length > 0) {
-        ui.blank();
-        ui.bullet("Grant the current user 'use' on every built-in tool (idempotent):");
-        ui.command(`${(0, cli_invocation_js_1.oryNpx)(binName)} permissions bootstrap`);
-    }
-    ui.blank();
-    ui.bullet("Inspect permission coverage:");
-    ui.command(`${(0, cli_invocation_js_1.oryNpx)(binName)} permissions status`);
-    ui.blank();
-    ui.bullet("Promote to enforcing once observe-mode logs look right:");
-    ui.command(`${(0, cli_invocation_js_1.oryNpx)(binName)} permissions enforce`);
-}
-/**
- * Render the trailing source annotation on a Mode line. Stays silent
- * when the mode came from the built-in default, since saying "default"
- * just adds noise. When the mode was overridden by env or config, name
- * the override so the reader knows where to look.
- */
-function formatModeSource(source) {
+function formatModeSource(source, fetchedAt) {
     switch (source) {
-        case "env":
-            return `  (set via ${ENV_PERMISSION_MODE} env var)`;
-        case "config":
-            return "  (saved in config; change with: permissions observe|enforce)";
+        case "server":
+            return "  (read from the Ory project)";
+        case "cache":
+            return `  (cached — project unreachable${formatFetchedAt(fetchedAt)})`;
         case "default":
-            return "  (built-in default)";
+            return "  (default — not yet read from the project)";
     }
 }
+/** Human-readable "fetched N ago" suffix for the cached-mode annotation. */
+function formatFetchedAt(fetchedAt) {
+    if (!fetchedAt)
+        return "";
+    const ageMs = Date.now() - fetchedAt;
+    if (ageMs < 0)
+        return "";
+    const mins = Math.floor(ageMs / 60_000);
+    if (mins < 1)
+        return "; fetched <1m ago";
+    if (mins < 60)
+        return `; fetched ${mins}m ago`;
+    const hours = Math.floor(mins / 60);
+    if (hours < 24)
+        return `; fetched ${hours}h ago`;
+    return `; fetched ${Math.floor(hours / 24)}d ago`;
+}
 /**
  * Generic source-suffix helper for other config fields (project URL,
  * API key). Source 'none' means the value is unset — don't add a suffix.
@@ -430,48 +265,19 @@ function formatSourceSuffix(source) {
             return "  (from env)";
         case "config":
             return "  (from config)";
+        case "default":
+            return "  (default)";
         case "none":
             return "";
     }
 }
 /**
- * Lists the modes other than the active one, in stable order, so the
- * banner can hint "Other modes: …" without re-listing the active one.
- * Audit-only is a separate kill switch (config.auditOnly), but we still
- * mention it here so first-time readers learn the full set.
+ * Lists the deny postures other than the active one, in stable order, so the
+ * banner can hint "Other modes: …" without re-listing the active one. Only the
+ * two postures — whether Agent Security is connected at all is a separate
+ * question, and this is only reached once it is.
  */
 function otherModes(active) {
-    const all = ["observe", "enforce", "audit-only"];
+    const all = ["observe", "enforce"];
     return all.filter((m) => m !== active);
 }
-/**
- * If a user identity is already cached and the plugin is configured,
- * opportunistically run `permissions bootstrap` so the user lands in a
- * "tools work out of the box" state. Otherwise a no-op (the install
- * banner still prints the manual command).
- *
- * Always best-effort: any failure is logged and swallowed so install
- * never aborts because of a permissions write problem.
- */
-async function maybeAutoBootstrap(binName, harness) {
-    const resolved = (0, config_js_1.resolveConfig)();
-    if (resolved.auditOnly)
-        return false;
-    if (!resolved.projectUrl)
-        return false;
-    if (!isUserIdentityCached())
-        return false;
-    if ((0, tool_catalog_js_1.getToolCatalog)(harness).length === 0)
-        return false;
-    try {
-        console.log("");
-        console.log("Bootstrapping permissions (cached user identity detected)...");
-        const code = await runPermissionsCommand(binName, harness, ["bootstrap"]);
-        return code === 0;
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        console.warn(`Bootstrap skipped: ${msg}`);
-        return false;
-    }
-}