@ory/argus 0.13.9 → 1.0.0

package/dist/uninstall.js

@@ -1,90 +1,265 @@
 "use strict";
 /**
- * Credential teardown shared by every plugin's `uninstall` command.
+ * Config teardown shared by every plugin's `uninstall` command.
  *
- * Uninstalling a plugin removes all *authentication* state from the shared
- * config file while preserving *configuration* (project URL, OAuth2 client
- * id, audit mode, permission mode, user-login flag). The intent is that a
- * later re-install re-authenticates from scratch — the user logs in again
- * and the agent registers a fresh dynamic client — rather than silently
- * inheriting stale credentials.
+ * `config.json` is a **single shared file** every installed harness plugin
+ * reads, so teardown is scoped: uninstalling one plugin must not knock the
+ * others back to an unconfigured state. Two scopes exist, and which one runs is
+ * decided from the install registry, not from a flag the caller guesses at:
  *
- * What is removed:
+ *   - **`harness` scope** — other plugins are still installed. Only the
+ *     departing harness's own identities go: the agent and sub-agent DCR
+ *     clients of **every session it retains** are revoked (RFC 7592), and its
+ *     entries are removed from `agent.dynamic` / `agent.subAgents`. Shared
+ *     state — `projectUrl`, `oauth2ClientId`, the user's tokens, the permission
+ *     mode — is left exactly as it was.
+ *   - **`all` scope** — the departing harness was the last one installed, or
+ *     the caller passed `purge: true`. Every harness's clients are revoked and
+ *     the config file is left as an empty object, so a re-install starts from a
+ *     clean slate rather than inheriting stale state.
+ *
+ * What an `all` teardown removes:
  *   - the user's persisted OAuth2 tokens (`user`)
- *   - the agent's dynamic-registration credentials and every sub-agent
- *     registration (`agent`)
- *   - the operator-supplied static agent API key (`apiKey`)
+ *   - every harness's agent and sub-agent registrations, across all sessions
+ *     (`agent`)
+ *   - all configuration values (`projectUrl`, `projectId`, `projectName`,
+ *     `workspaceName`, `oauth2ClientId`, `permissionModeCache`,
+ *     `userSubjectNamespace`, `installedHarnesses`)
  *   - any dangling PKCE-flight lock
  *
- * Before clearing local state, each dynamically-registered client (the
- * agent and each sub-agent) is revoked server-side via RFC 7592 so the
- * Ory project isn't left with orphaned OAuth2 clients accumulating across
- * install/uninstall cycles. Revocation is best-effort: failures warn and
- * local state is cleared regardless.
+ * Server-side teardown runs first, best-effort, and covers exactly the
+ * resources the plugin itself created: each dynamically-registered OAuth2
+ * client in scope (the agent and every sub-agent, for every retained session)
+ * is revoked via RFC 7592, so the Ory project isn't left with orphaned clients
+ * accumulating across install/uninstall cycles.
+ *
+ * Nothing in the project's **permission** state is touched. Grants, blocks,
+ * delegation edges, and the permission model are provisioned in the Ory
+ * Console (Agent Security) and owned there — the plugin has no Keto write
+ * path to unwind them with, and deleting an admin's grants on uninstall was
+ * never its call to make. The shared user-login PKCE OAuth2 client
+ * (`oauth2ClientId`) is likewise left in place: it is a public, identity-free
+ * client that every user and every harness install on the project reuses, so
+ * deleting it would break other installations. Both are only forgotten
+ * locally. Every server-side step is best-effort: failures warn and local
+ * state is cleared regardless.
  */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveInstalledHarnesses = resolveInstalledHarnesses;
 exports.clearCredentialsForUninstall = clearCredentialsForUninstall;
+const fs = __importStar(require("node:fs"));
 const config_js_1 = require("./config.js");
 const agent_auth_js_1 = require("./agent-auth.js");
 const auth_store_js_1 = require("./auth-store.js");
+const runtime_js_1 = require("./runtime.js");
+/**
+ * The harness plugins installed against the shared config, reconciled from
+ * every source that evidences one.
+ *
+ * The `installedHarnesses` registry is authoritative, but it only exists on
+ * configs written since it was introduced. Treating its absence as "nothing is
+ * installed" would make the first uninstall on an upgraded machine wipe the
+ * config every other plugin depends on — precisely the failure being fixed. So
+ * the runtime manifest (what each harness has wired) and the persisted
+ * credentials (which harnesses hold an identity) are folded in as evidence.
+ */
+function resolveInstalledHarnesses(config = (0, config_js_1.loadConfig)()) {
+    const names = new Set(config.installedHarnesses ?? []);
+    for (const harness of Object.keys((0, runtime_js_1.readRuntimeManifest)().harnesses))
+        names.add(harness);
+    for (const harness of Object.keys(config.agent?.dynamic ?? {}))
+        names.add(harness);
+    for (const harness of Object.keys(config.agent?.subAgents ?? {}))
+        names.add(harness);
+    return [...names].sort();
+}
 /**
- * Remove all authentication state from the shared config file, revoking
- * dynamically-registered clients server-side first. Preserves every
- * non-credential configuration value. Never throws.
+ * Tear down the departing harness's state, wiping the whole shared config only
+ * when nothing else still depends on it. Dynamically-registered clients in
+ * scope are revoked server-side first. Never throws.
  */
 async function clearCredentialsForUninstall(options = {}) {
     const log = options.log ?? ((msg) => console.log(msg));
     const revoke = options.revoke !== false;
+    const harness = options.harness?.trim() || undefined;
     const config = (0, config_js_1.loadConfig)();
-    const dynamic = config.agent?.dynamic;
+    // Drop the departing harness from the registry first, so what remains is
+    // exactly the set of plugins that still need the shared config. Without a
+    // harness to attribute this uninstall to, nothing can be scoped — fall back
+    // to a full wipe.
+    const remainingHarnesses = harness
+        ? resolveInstalledHarnesses(config).filter((h) => h !== harness)
+        : [];
+    // Only write when there is something to remove — an uninstall against an
+    // already-empty config should not create a config file just to say so.
+    if (harness && config.installedHarnesses?.includes(harness)) {
+        (0, config_js_1.unregisterInstalledHarness)(harness);
+    }
+    const scope = harness && !options.purge && remainingHarnesses.length > 0 ? "harness" : "all";
+    const dynamic = config.agent?.dynamic ?? {};
     const subAgents = config.agent?.subAgents ?? {};
-    const subAgentEntries = Object.entries(subAgents);
-    const hadCredentials = Boolean(config.user || dynamic || subAgentEntries.length > 0 || config.apiKey);
-    if (!hadCredentials) {
-        log("No stored Ory credentials to remove.");
-        return { hadCredentials: false, revoked: 0, revokeFailures: 0 };
+    const hadCredentials = Boolean(config.user ||
+        Object.keys(dynamic).length > 0 ||
+        Object.keys(subAgents).length > 0 ||
+        (config.agent?.retired?.length ?? 0) > 0);
+    if (Object.keys(config).length === 0) {
+        log("No Ory configuration to remove.");
+        return {
+            hadCredentials: false,
+            scope,
+            remainingHarnesses,
+            revoked: 0,
+            revokeFailures: 0,
+        };
+    }
+    // The clients this uninstall owns: this harness's on a scoped teardown, every
+    // harness's on a full one, across every retained session and child identity.
+    const inScope = (h) => scope === "all" || h === harness;
+    const targets = [];
+    for (const [h, bySession] of Object.entries(dynamic)) {
+        if (!inScope(h))
+            continue;
+        for (const [session, creds] of Object.entries(bySession)) {
+            targets.push({ label: `agent client (${h}/${session})`, creds });
+        }
+    }
+    for (const [h, bySession] of Object.entries(subAgents)) {
+        if (!inScope(h))
+            continue;
+        for (const [session, byType] of Object.entries(bySession)) {
+            for (const [type, creds] of Object.entries(byType)) {
+                targets.push({ label: `sub-agent client (${h}/${session}/${type})`, creds });
+            }
+        }
+    }
+    // Retention preserves the harness on retired records, so scoped teardown can
+    // revoke its own queue entries. Historical records without a harness remain
+    // unattributable and are swept only by a full teardown.
+    for (const creds of config.agent?.retired ?? []) {
+        if (scope === "all" || creds.harness === harness) {
+            targets.push({ label: "retired agent client", creds });
+        }
     }
     let revoked = 0;
     let revokeFailures = 0;
     if (revoke) {
-        const targets = [];
-        if (dynamic) {
-            targets.push({
-                label: "agent client",
-                clientId: dynamic.clientId,
-                result: () => (0, agent_auth_js_1.revokeAgentDynamicClient)(dynamic),
-            });
-        }
-        for (const [type, creds] of subAgentEntries) {
-            targets.push({
-                label: `sub-agent client (${type})`,
-                clientId: creds.clientId,
-                result: () => (0, agent_auth_js_1.revokeAgentDynamicClient)(creds),
-            });
-        }
         for (const target of targets) {
-            const outcome = await target.result();
+            const outcome = await (0, agent_auth_js_1.revokeAgentDynamicClient)(target.creds);
             if (outcome.status === "deleted") {
                 revoked++;
-                log(`  Revoked ${target.label} ${target.clientId}.`);
+                log(`  Revoked ${target.label} ${target.creds.clientId}.`);
             }
             else if (outcome.status === "skipped") {
                 // No management credentials to DELETE with — nothing we can do
                 // server-side. Not counted as a failure.
-                log(`  Could not revoke ${target.label} ${target.clientId} server-side (${outcome.message}). Clearing local state anyway.`);
+                log(`  Could not revoke ${target.label} ${target.creds.clientId} server-side (${outcome.message}). Clearing local state anyway.`);
             }
             else {
                 revokeFailures++;
                 const detail = typeof outcome.httpStatus === "number"
                     ? `HTTP ${outcome.httpStatus}`
                     : (outcome.message ?? "unknown error");
-                log(`  Warning: server-side revoke of ${target.label} ${target.clientId} failed (${detail}). Clearing local state anyway.`);
+                log(`  Warning: server-side revoke of ${target.label} ${target.creds.clientId} failed (${detail}). Clearing local state anyway.`);
             }
         }
     }
-    // Drop every credential block; keep all configuration values.
-    (0, config_js_1.saveConfig)({ user: null, agent: null, apiKey: null });
-    (0, auth_store_js_1.clearPkceFlightLock)();
-    log("Removed stored Ory credentials (user login, agent identity, API key).");
-    return { hadCredentials: true, revoked, revokeFailures };
+    // The departing harness's asset tree (its skill/command trees, plus its
+    // unified activity/debug log) is state uniquely attributable to it, so
+    // it goes with the harness in either scope. On a full teardown every
+    // harness's tree goes, since the config they belong to is being wiped.
+    for (const h of scope === "all" ? resolveInstalledHarnesses(config) : [harness]) {
+        removeHarnessDataDir(h, log);
+    }
+    if (scope === "all") {
+        // Wipe the entire config file — credentials and configuration alike.
+        (0, config_js_1.mutateConfig)(() => ({}));
+        (0, auth_store_js_1.clearPkceFlightLock)();
+        log("Removed all Ory configuration and credentials.");
+    }
+    else {
+        (0, agent_auth_js_1.clearAgentDynamicCredentials)(harness);
+        (0, agent_auth_js_1.clearSubAgentDynamicCredentialsForHarness)(harness);
+        (0, config_js_1.mutateConfig)((current) => {
+            const next = { ...current };
+            if (current.agent?.retired) {
+                const agent = { ...current.agent };
+                agent.retired = current.agent.retired.filter((creds) => creds.harness !== harness);
+                if (agent.retired.length === 0)
+                    delete agent.retired;
+                next.agent = agent;
+            }
+            if (current.delegationAnchors?.[harness]) {
+                const anchors = { ...current.delegationAnchors };
+                delete anchors[harness];
+                if (Object.keys(anchors).length > 0)
+                    next.delegationAnchors = anchors;
+                else
+                    delete next.delegationAnchors;
+            }
+            return next;
+        });
+        log(`Removed the ${harness} agent identities. Shared Ory configuration is kept for: ${remainingHarnesses.join(", ")}.`);
+        log("  Re-run with --purge to wipe the shared configuration and every harness's credentials.");
+    }
+    return {
+        hadCredentials,
+        scope,
+        remainingHarnesses,
+        revoked,
+        revokeFailures,
+    };
+}
+/**
+ * Remove a harness's asset tree under `<dataDir>/<harness>/`.
+ *
+ * Best-effort: the tree holds the harness's own skill/command assets plus its
+ * unified activity/debug log, and the log may still be open in this very
+ * process (or locked, on Windows). A failure to remove observability output is
+ * never a reason to fail an uninstall.
+ */
+function removeHarnessDataDir(harness, log) {
+    const dir = (0, config_js_1.getHarnessDataDir)(harness);
+    try {
+        if (!fs.existsSync(dir))
+            return;
+        fs.rmSync(dir, { recursive: true, force: true });
+        log(`  Removed ${harness} assets at ${dir}.`);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        log(`  Warning: could not remove ${dir} (${message}). Continuing.`);
+    }
 }

package/dist/user-login.d.ts

@@ -4,7 +4,7 @@
  *
  *   1. Resolve config (env + ~/.config/ory-agent-plugins/config.json).
  *   2. If no project URL, prompt for one when a TTY is available;
- *      otherwise skip with an audit span.
+ *      otherwise skip with an audit event.
  *   3. If a session/oauth2 token is already in env, short-circuit ok.
  *   4. If persisted tokens are valid, return ok.
  *   5. If they are expired with a refresh_token, refresh.
@@ -14,14 +14,20 @@
  *      paste the URL into any browser that can reach 127.0.0.1. Only
  *      truly unattended (CI=true) environments short-circuit early.
  *
- * Every terminal path emits exactly one `user.auth` trace span so that
+ * Every terminal path emits exactly one `user.auth` activity event so that
  * the audit trail is complete regardless of outcome.
  *
- * The whole flow is a no-op (mode `disabled`) unless user login is
- * enabled — either via the `ORY_USER_LOGIN` env var (values `1`, `true`,
- * `yes`, `on`) or persisted in the shared config file (`userLogin: true`,
- * set with `configure --user-login`). The env var overrides the config
- * file when set.
+ * The flow runs on **every** session and is **never** blocking: it
+ * establishes or refreshes the user identity for attribution, delegation,
+ * and permission-subject resolution, but a failure to authenticate never
+ * stops the session. Enforcement is governed solely by `permissionMode`
+ * (observe/enforce) at tool-call time — see `checkAndDecide`. The one
+ * exception is Agent Security not being connected at all (no project URL
+ * and OAuth2 client id), in which case there is nothing to sign in to and
+ * the flow no-ops with mode `not_connected`. When the user can't be
+ * authenticated the session still
+ * proceeds; under `enforce` a missing user identity naturally denies at
+ * the tool (no matching tuples), and under `observe` it is audited.
  *
  * This authenticates the *user* (the human at the keyboard). The
  * separate agent identity (the AI process making the calls) is resolved
@@ -30,16 +36,13 @@
  */
 import { OryAgentClient } from "./client.js";
 import { type OryOAuth2Tokens } from "./config.js";
-import { promptForProjectUrl } from "./cli.js";
 import { pkceLogin } from "./auth.js";
-export type UserLoginMode = "disabled" | "audit_only" | "env_token" | "ok" | "refreshed" | "skipped" | "declined" | "error";
+export type UserLoginMode = "not_connected" | "env_token" | "ok" | "refreshed" | "skipped" | "declined" | "error";
 export interface UserLoginOptions {
     /** Bin name used in user-facing prompts (e.g. "ory-claude"). */
     binName: string;
-    /** Logical harness name (used by the tracer). */
+    /** Logical harness name used for activity attribution. */
     harness: string;
-    /** Whether the caller can hard-block on auth failure. */
-    allowBlock: boolean;
     /**
      * Optional override of the PKCE login function — used by tests and by
      * harnesses that want to plug in a different flow.
@@ -47,13 +50,16 @@ export interface UserLoginOptions {
     loginFn?: typeof pkceLogin;
     /** Override TTY detection (for tests). */
     isTtyAvailableFn?: () => boolean;
-    /** Override the prompt-for-URL step (for tests). */
-    promptForProjectUrlFn?: typeof promptForProjectUrl;
 }
 export interface UserLoginDecision {
-    /** Whether the caller should let the session proceed. */
+    /**
+     * Whether the caller should let the session proceed. User authentication
+     * is non-blocking, so this is **always** `true` — it is retained so the
+     * session-start adapters keep a stable shape. Enforcement lives in
+     * `permissionMode` at tool-call time, not here.
+     */
     proceed: boolean;
-    /** Stable mode identifier for telemetry and tests. */
+    /** Stable mode identifier for activity logging and tests. */
     mode: UserLoginMode;
     /** Human-readable reason; safe to surface to the operator. */
     reason: string;