@ory/argus 0.14.0 → 1.0.0

package/dist/adapters.js

@@ -3,15 +3,18 @@
  * Shared adapter primitives for Agent SDK integrations (and harness plugins).
  *
  * These extract the session-start sequencing and the `tool.invoke` / `tool.block` /
- * `tool.complete` span boilerplate that each integration would otherwise re-implement, so
+ * `tool.complete` activity boilerplate that each integration would otherwise re-implement, so
  * an SDK binding is a thin translation between the SDK's hook signature and these calls.
  * They are the TypeScript twin of `ory_argus.adapters` in the Python core.
  *
+ *   - {@link withHookContext} — scope session state to one lifecycle invocation.
  *   - {@link sessionStart} — run the user + agent auth gates and write the user→agent
  *     delegation tuple; returns whether the session may proceed.
- *   - {@link gate} — resolve the subject, run {@link gateToolCall}, record the spans, and
+ *   - {@link createSessionStarter} — coalesce concurrent lazy SDK session starts.
+ *   - {@link decideTool} — normalize native/MCP policy without execution activity.
+ *   - {@link gate} — resolve the subject, run {@link gateToolCall}, record activity, and
  *     return a normalized {@link GateResult}.
- *   - {@link complete} — record the `tool.complete` span.
+ *   - {@link complete} / {@link fail} — record safe terminal tool activity.
  *   - {@link registerSubagent} — resolve a sub-agent identity + agent→subagent tuple.
  *   - {@link wrapTool} — wrap a plain `execute(args)` with gate+complete, for SDKs whose
  *     only veto point is the tool boundary (Vercel AI SDK, etc.).
@@ -20,26 +23,80 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveNamespace = resolveNamespace;
+exports.withHookContext = withHookContext;
 exports.sessionStart = sessionStart;
+exports.createSessionStarter = createSessionStarter;
 exports.writeUserDelegatesAgent = writeUserDelegatesAgent;
 exports.registerSubagent = registerSubagent;
 exports.writeAgentDelegatesSubagent = writeAgentDelegatesSubagent;
+exports.decideTool = decideTool;
 exports.gate = gate;
 exports.complete = complete;
+exports.fail = fail;
 exports.wrapTool = wrapTool;
+const node_os_1 = require("node:os");
 const config_js_1 = require("./config.js");
 const agent_auth_js_1 = require("./agent-auth.js");
 const user_login_js_1 = require("./user-login.js");
 const permissions_js_1 = require("./permissions.js");
+const permission_mode_js_1 = require("./permission-mode.js");
+const tool_catalog_js_1 = require("./tool-catalog.js");
 const subject_js_1 = require("./subject.js");
 const denial_js_1 = require("./denial.js");
+const mcp_js_1 = require("./mcp.js");
+const tool_metadata_js_1 = require("./tool-metadata.js");
 function resolveNamespace() {
-    return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
+    return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTool";
+}
+/** Scope ambient session state to one lifecycle invocation. */
+function withHookContext(client, opts, work) {
+    return client.withRuntimeContext(opts, work);
+}
+/** True when a thrown value is a classified {@link OryError} rather than an `Error`. */
+function isOryError(err) {
+    return (typeof err === "object" &&
+        err !== null &&
+        typeof err.code === "string" &&
+        typeof err.message === "string");
+}
+/**
+ * Describe a thrown value as structured log fields.
+ *
+ * The best-effort paths below swallow their failures, so the debug log is the
+ * only place the cause survives — it has to actually say something. Two shapes
+ * reach them: a real `Error`, and the **plain object** `classifyError` produces
+ * (`{ code, status, message, requestId }` — not an `Error` instance). A bare
+ * `String(err)` renders that second shape as `"[object Object]"`, which is how a
+ * broker returning HTTP 500 showed up as a log line naming no cause at all.
+ *
+ * Fields are returned separately rather than concatenated because
+ * {@link DebugLogger} emits JSON — `code` and `status` are worth grepping for.
+ */
+function describeThrown(err) {
+    if (isOryError(err)) {
+        return {
+            message: err.message,
+            code: err.code,
+            ...(err.status !== undefined ? { status: err.status } : {}),
+            ...(err.requestId ? { requestId: err.requestId } : {}),
+        };
+    }
+    if (err instanceof Error)
+        return { message: err.message };
+    if (typeof err === "string")
+        return { message: err };
+    // Anything else: serialize rather than let it stringify to "[object Object]".
+    try {
+        return { message: JSON.stringify(err) ?? String(err) };
+    }
+    catch {
+        return { message: String(err) };
+    }
 }
 /**
  * Run both auth gates and write the user→agent delegation tuple. The user gate
  * runs every session to establish/refresh the user identity, records the
- * `user.auth` span, and never blocks — enforcement is governed by
+  * `user.auth` activity event, and never blocks — enforcement is governed by
  * `permissionMode` at tool-call time. `SessionStartResult.proceed` is therefore
  * always `true`; it is retained only for a stable adapter shape.
  */
@@ -47,15 +104,54 @@ async function sessionStart(client, opts) {
     const projectUrl = opts.projectUrl ?? (0, config_js_1.resolveConfig)().projectUrl;
     const userLogin = opts.userLogin ?? user_login_js_1.ensureUserAuthenticated;
     const agentGate = opts.agentGate ?? agent_auth_js_1.ensureAgentIdentity;
-    const decision = await userLogin(client, {
-        binName: opts.binName ?? `ory-${opts.harness}`,
-        harness: opts.harness,
-    });
-    const creds = await agentGate(client, {
-        projectUrl,
-        harness: opts.harness,
+    let decision = {
+        proceed: true,
+        mode: "skipped",
+        reason: "User authentication failed open",
+    };
+    try {
+        decision = await userLogin(client, {
+            binName: opts.binName ?? `ory-${opts.harness}`,
+            harness: opts.harness,
+        });
+    }
+    catch (err) {
+        client.logger.warn("session_start.user_auth.failed", describeThrown(err));
+    }
+    let creds = {
+        kind: "none",
+        reason: "Agent authentication failed open",
+        warnings: [],
+    };
+    try {
+        creds = await agentGate(client, {
+            projectUrl,
+            harness: opts.harness,
+            sessionId: opts.sessionId ?? client.sessionId,
+        });
+    }
+    catch (err) {
+        client.logger.warn("session_start.agent_auth.failed", describeThrown(err));
+    }
+    await writeUserDelegatesAgent(client, opts.harness, opts.sessionId);
+    // Warm the permission-mode cache from the server once per session, so the
+    // synchronous `resolveConfig().permissionMode` read (the MCP
+    // `applyPermissionMode` path, display surfaces) reflects the current project
+    // posture even before the first `gateToolCall`. Best-effort; never blocks —
+    // a no-op when Agent Security isn't connected (no checks) and on any Keto error.
+    if ((0, config_js_1.isSecurityConnected)()) {
+        const subject = (0, subject_js_1.resolveUserSubject)(client);
+        const agentSubject = (0, subject_js_1.resolveAgentSubject)(client);
+        await (0, permission_mode_js_1.warmPermissionModeCache)(client, subject, {
+            additionalSubjects: agentSubject ? [{ scope: "agent", subject: agentSubject }] : [],
+        }).catch(() => {
+            /* best-effort cache warm; gate-time resolution retries */
+        });
+    }
+    client.logger.activity("session.start", "ok", {
+        attributes: { harness: opts.harness, ...(opts.activityAttributes ?? {}) },
+        sessionId: opts.sessionId,
     });
-    await writeUserDelegatesAgent(client);
     return {
         proceed: decision.proceed,
         userMode: decision.mode,
@@ -63,34 +159,22 @@ async function sessionStart(client, opts) {
         agentKind: creds.kind,
     };
 }
-/**
- * Write a delegation tuple at most once. The tuple is stable for a given
- * (namespace, object, subject), and Keto's create API is not idempotent, so
- * this goes through {@link OryAgentClient.ensureRelationship}: it reads the
- * exact tuple first and only writes when absent — no duplicate on repeated
- * session starts, and self-healing if the tuple was deleted. If the existence
- * probe fails we skip the write rather than risk a duplicate (delegation
- * tuples are audit-only, so a missed write is harmless and retried next
- * session). Best-effort: any failure is logged and swallowed.
- */
-async function writeDelegationOnce(client, check, options) {
-    try {
-        const res = await client.ensureRelationship(check, {
-            spanAttributes: options.spanAttributes,
+/** Build a concurrency-safe, retryable lazy session-start trigger. */
+function createSessionStarter(client, opts) {
+    const pending = new Map();
+    return () => {
+        const sessionId = opts.sessionId ?? client.sessionId;
+        const key = sessionId?.trim() || "sessionless";
+        const existing = pending.get(key);
+        if (existing)
+            return existing;
+        const started = sessionStart(client, { ...opts, sessionId }).then(() => undefined, (err) => {
+            pending.delete(key);
+            client.logger.warn("session_start.failed", describeThrown(err));
         });
-        if (res.probeError) {
-            client.logger.debug("delegation.probe_failed", {
-                ...options.failedContext,
-                message: res.probeError.message,
-            });
-        }
-    }
-    catch (err) {
-        client.logger.warn(options.failedEvent, {
-            ...options.failedContext,
-            message: err instanceof Error ? err.message : String(err),
-        });
-    }
+        pending.set(key, started);
+        return started;
+    };
 }
 /** Strip a `<ns>:` prefix from a namespaced subject, if present. */
 function unqualify(subject, ns) {
@@ -100,8 +184,8 @@ function unqualify(subject, ns) {
 /**
  * Resolve one end of a delegation edge, preferring the live principal but
  * falling back to the persisted delegation anchor (`delegation.delegatedBy`
- * on the DCR credentials in local config). This is what lets the tuple be
- * rebuilt from an authoritative source rather than from nothing when the
+ * on the DCR credentials in local config). This is what lets the edge be
+ * recorded from an authoritative source rather than from nothing when the
  * principal isn't populated for the session. A mismatch between the two is
  * logged for reconciliation visibility; the live principal wins.
  */
@@ -112,54 +196,61 @@ function reconcileEdgeEnd(client, principal, anchor, role) {
     return principal ?? anchor;
 }
 /**
- * Write the `user → agent` delegation tuple, at most once per install
- * (see {@link writeDelegationOnce}). Exported so harness plugins that run
- * their own session-start sequence (rather than {@link sessionStart}) share
- * the same write-once semantics instead of re-issuing the write every
- * session.
+ * Record the `user → agent` delegation edge through the agent-security broker
+ * (see {@link OryAgentClient.recordDelegation}). Exported so harness plugins
+ * that run their own session-start sequence (rather than {@link sessionStart})
+ * record the edge the same way.
  *
- * The tuple is a *derived projection* of the delegation anchor stamped into
- * the agent's OAuth2 client metadata at registration: the edge is resolved
- * from the live principals when populated, otherwise rebuilt from the persisted
- * anchor — so a tuple lost out of band can be self-healed from the identity
- * layer. No-op only when neither source yields both ends.
+ * The plugin supplies only the delegating user identity (resolved from the live
+ * principal, else the persisted delegation anchor) plus the harness and host;
+ * the broker owns the Keto tuple and its join-key encoding. The node id the
+ * broker returns (`agent:<join>`) is persisted so a later sub-agent
+ * registration — which may run in a separate subprocess with no live principal
+ * — can reference it verbatim as `delegated_by`. Best-effort and fail-open:
+ * any failure (including a 404 against the local stack, which has no broker) is
+ * logged and swallowed. No-op when Agent Security isn't connected (there is no
+ * broker to record against) and when no user identity resolves.
  */
-async function writeUserDelegatesAgent(client) {
-    // The anchor is the delegation *record* stamped into the agent client's
-    // metadata — not the mere existence of a persisted client. Only when a
-    // user-to-agent record is present do we know the delegator, so both ends of
-    // the edge are taken from the same record's client (agent = its clientId,
-    // user = its delegatedBy). Absent a record, fall back to live principals only.
-    const anchorCreds = (0, agent_auth_js_1.loadAgentDynamicCredentials)();
+async function writeUserDelegatesAgent(client, harness, sessionId) {
+    if (!(0, config_js_1.isSecurityConnected)())
+        return;
+    // Resolve the delegating user (the anchor of the edge). Prefer the live
+    // principal; fall back to the delegator persisted in the agent client's
+    // delegation anchor so the edge can still be recorded in a session where the
+    // user principal wasn't populated. The anchor is per-harness — reading a
+    // different harness's anchor would attribute this harness's delegation to
+    // another agent's client.
+    const harnessKey = harness ?? client.harness;
+    const sessionKey = (sessionId ?? client.sessionId)?.trim() || config_js_1.SESSIONLESS_KEY;
+    const anchorCreds = (0, agent_auth_js_1.loadAgentDynamicCredentials)(harnessKey, sessionKey);
     const anchor = anchorCreds?.delegation;
-    const hasUserAgentAnchor = anchor?.delegationType === "user-to-agent";
-    const anchorUser = hasUserAgentAnchor ? unqualify(anchor.delegatedBy, "user") : undefined;
-    // The agent principal's subject is `ORY_AGENT_SUBJECT_ID ?? clientId` (see
-    // resolveClientCredentials). The anchor rebuild must apply the *same*
-    // precedence, or a no-principal session would write `agent:<clientId>` while
-    // a live session wrote `agent:<override>` — two divergent tuples for one edge.
-    const anchorAgent = hasUserAgentAnchor
-        ? (process.env.ORY_AGENT_SUBJECT_ID || anchorCreds.clientId)
-        : undefined;
-    const user = reconcileEdgeEnd(client, client.userPrincipal.subject, anchorUser, "user");
-    const agent = reconcileEdgeEnd(client, client.agentPrincipal.subject, anchorAgent, "agent");
-    if (!user || !agent) {
+    const anchorUser = anchor?.delegationType === "user-to-agent" ? unqualify(anchor.delegatedBy, "user") : undefined;
+    const identityId = reconcileEdgeEnd(client, client.userPrincipalForSession(sessionKey).subject, anchorUser, "user");
+    if (!identityId) {
         client.logger.debug("delegation.skip", {
-            reason: "missing delegation edge (no principal and no anchor)",
-            hasUser: !!user,
-            hasAgent: !!agent,
+            reason: "no user delegation edge (no principal and no anchor)",
         });
         return;
     }
-    await writeDelegationOnce(client, {
-        namespace: resolveNamespace(),
-        object: `agent:${agent}`,
-        relation: "delegate",
-        subjectId: `user:${user}`,
-    }, {
-        spanAttributes: { delegation: "user-to-agent" },
-        failedEvent: "delegation.user_to_agent.failed",
-    });
+    // The broker derives the agent node from (identity, harness, host, session)
+    // and writes `AgentTool:agent:<join>#delegate@(User:<id>)`. Persist the
+    // returned node id under *this session* so the sub-agent edge can reference it
+    // without re-deriving the join key.
+    try {
+        const res = await client.recordDelegation({
+            kind: "agent",
+            identityId,
+            host: (0, node_os_1.hostname)(),
+            ...(sessionKey !== config_js_1.SESSIONLESS_KEY ? { sessionId: sessionKey } : {}),
+        }, {
+            activityAttributes: { delegation: "user-to-agent" },
+        });
+        if (res.nodeId)
+            (0, agent_auth_js_1.saveDelegationNodeId)(harnessKey, sessionKey, res.nodeId);
+    }
+    catch (err) {
+        client.logger.warn("delegation.user_to_agent.failed", describeThrown(err));
+    }
 }
 async function registerSubagent(client, opts) {
     const projectUrl = opts.projectUrl ?? (0, config_js_1.resolveConfig)().projectUrl;
@@ -170,128 +261,306 @@ async function registerSubagent(client, opts) {
             subAgentType: opts.subAgentType,
             projectUrl,
             harness: opts.harness,
+            sessionId: opts.sessionId ?? client.sessionId,
+            perSpawnId: opts.perSpawnId,
+            signal: opts.signal,
         });
     }
     catch (err) {
         client.logger.warn("subagent.identity.failed", {
             subAgentType: opts.subAgentType,
-            message: err instanceof Error ? err.message : String(err),
+            ...describeThrown(err),
         });
         return;
     }
-    if (identity.kind !== "dynamic" || !identity.subject)
+    if (identity.kind !== "runtime" && identity.kind !== "dynamic")
         return;
-    await writeAgentDelegatesSubagent(client, identity.subject, opts.subAgentType);
+    await writeAgentDelegatesSubagent(client, identity.subject ?? "", opts.subAgentType, {
+        harness: opts.harness,
+        sessionId: opts.sessionId,
+        perSpawnId: opts.perSpawnId,
+        signal: opts.signal,
+        runtimeCredential: identity.runtimeCredential,
+        agentToken: identity.token,
+    });
 }
 /**
- * Write the `agent → subagent` delegation tuple, at most once per install
- * (see {@link writeDelegationOnce}). Exported so harness plugins that
- * resolve the sub-agent identity through their own event plumbing (rather
- * than {@link registerSubagent}) still share the write-once semantics.
- * No-op until the agent principal is populated.
+ * Record the `agent → subagent` delegation edge through the agent-security
+ * broker. Exported so harness plugins that resolve the sub-agent identity
+ * through their own event plumbing (rather than {@link registerSubagent})
+ * record the edge the same way.
+ *
+ * The broker builds the sub-agent node from the parent agent's delegation node
+ * (`delegated_by`) and the sub-agent type — so the plugin passes the node id
+ * the broker assigned to the `user → agent` edge (persisted at session start),
+ * echoed verbatim, and never reconstructs the join-key encoding itself.
+ * Best-effort and fail-open. No-op when Agent Security isn't connected and until the
+ * `user → agent` edge has been
+ * recorded (so the parent node id is available).
  */
-async function writeAgentDelegatesSubagent(client, subAgentSubject, subAgentType) {
-    // The delegator (agent) is resolved from the live principal, falling back to
-    // the sub-agent client's persisted delegation anchor (`delegation.delegatedBy`
-    // = `agent:<agent>`) so the tuple can be rebuilt when no principal is present.
-    const anchor = (0, agent_auth_js_1.loadSubAgentDynamicCredentials)(subAgentType)?.delegation;
-    const anchorAgent = anchor?.delegationType === "agent-to-subagent"
-        ? unqualify(anchor.delegatedBy, "agent")
-        : undefined;
-    const agent = reconcileEdgeEnd(client, client.agentPrincipal.subject, anchorAgent, "agent");
-    if (!agent) {
+async function writeAgentDelegatesSubagent(client, subAgentSubject, subAgentType, opts = {}) {
+    if (!(0, config_js_1.isSecurityConnected)())
+        return;
+    // The parent agent's delegation node (`agent:<join>`) was assigned by the
+    // broker when the user→agent edge was recorded and persisted at session start.
+    // Echo it verbatim as `delegated_by`. It is read for *this harness and this
+    // session*: the parent of this sub-agent is this run's session credential, so
+    // the harness alone would not identify it.
+    const sessionKey = (opts.sessionId ?? client.sessionId)?.trim() || config_js_1.SESSIONLESS_KEY;
+    const delegatedBy = (0, agent_auth_js_1.loadDelegationNodeId)(opts.harness ?? client.harness, sessionKey);
+    if (!delegatedBy) {
         client.logger.debug("delegation.skip", {
-            reason: "no agent delegation edge (no principal and no anchor)",
+            reason: "no persisted agent delegation node (user→agent edge not recorded yet)",
             subAgentType,
+            sessionKey,
         });
         return;
     }
-    await writeDelegationOnce(client, {
-        namespace: resolveNamespace(),
-        object: `subagent:${subAgentSubject}`,
-        relation: "delegate",
-        subjectId: `agent:${agent}`,
-    }, {
-        spanAttributes: { delegation: "agent-to-subagent", subAgentType },
-        failedEvent: "delegation.agent_to_subagent.failed",
-        failedContext: { subAgentType },
-    });
+    try {
+        await client.recordDelegation({
+            kind: "subagent",
+            subAgentType,
+            delegatedBy,
+            ...(sessionKey !== config_js_1.SESSIONLESS_KEY ? { sessionId: sessionKey } : {}),
+            ...(opts.perSpawnId ? { perSpawnId: opts.perSpawnId } : {}),
+        }, {
+            signal: opts.signal,
+            agentToken: opts.agentToken,
+            runtimeCredential: opts.runtimeCredential,
+            activityAttributes: {
+                delegation: "agent-to-subagent",
+                subAgentType,
+                ...(subAgentSubject ? { subAgentSubject } : {}),
+                ...(opts.perSpawnId ? { perSpawnId: opts.perSpawnId } : {}),
+            },
+        });
+    }
+    catch (err) {
+        client.logger.warn("delegation.agent_to_subagent.failed", {
+            subAgentType,
+            ...describeThrown(err),
+        });
+    }
+}
+function gateActivityAttributes(opts) {
+    return {
+        toolName: opts.toolName,
+        ...(0, tool_metadata_js_1.summarizeToolInput)(opts.toolName, opts.toolArgs),
+        ...(opts.mcpTool
+            ? {
+                mcpServer: opts.mcpTool.serverName,
+                ...(opts.mcpTool.toolName ? { mcpTool: opts.mcpTool.toolName } : {}),
+            }
+            : {}),
+        ...(opts.extraActivityAttributes ?? {}),
+    };
 }
 /**
- * Authorize a tool call, record the spans, and return a normalized {@link GateResult}.
- * Records `tool.invoke` on allow/observe and `tool.block` on deny/observe — identical span
- * semantics to the harness plugins.
+ * Authorize a tool call and return a normalized {@link GateResult} without
+ * recording execution activity. Permission-ask hooks use this when the harness
+ * separately reports actual execution; {@link gate} adds the standard events.
  */
-async function gate(client, opts) {
+async function decideTool(client, opts) {
     const namespace = resolveNamespace();
     const subjectRef = (0, subject_js_1.resolveUserSubject)(client, opts.subjectFallback);
     const label = (0, subject_js_1.subjectLabel)(subjectRef);
     const canBlock = opts.canBlock ?? true;
-    const spanAttrs = { toolName: opts.toolName, ...(opts.extraSpanAttributes ?? {}) };
-    const check = { namespace, object: opts.toolName, relation: "use", ...subjectRef };
-    // Audit-only kill switch: Ory is disabled entirely — no permission check.
-    // Record only the audit `tool.invoke` span (same span semantics as the
-    // harness plugins' audit-only short-circuit) and pass the tool through.
-    const resolved = (0, config_js_1.resolveConfig)();
-    if (resolved.auditOnly) {
-        client.tracer.record("tool.invoke", "ok", { attributes: spanAttrs });
-        const decision = {
-            kind: "allow",
-            result: { allowed: true, checkedAt: new Date().toISOString(), check },
-            mode: resolved.permissionMode,
-            spanAttributes: { permissionMode: resolved.permissionMode },
+    const activityAttrs = gateActivityAttributes(opts);
+    const check = { namespace, object: opts.toolName, relation: "users", ...subjectRef };
+    if (!(0, config_js_1.isSecurityConnected)()) {
+        const outcome = {
+            kind: "not_connected",
+            activityAttributes: { securityConnected: false, toolName: opts.toolName },
+        };
+        return {
+            proceed: true,
+            blocked: false,
+            kind: outcome.kind,
+            decision: outcome,
+            subject: label,
+            namespace,
         };
-        return { proceed: true, blocked: false, kind: "allow", decision, subject: label, namespace };
     }
-    const outcome = await (0, permissions_js_1.gateToolCall)(client, {
-        harness: opts.harness,
-        toolName: opts.toolName,
-        check,
-        spanAttributes: spanAttrs,
-    });
-    if (outcome.kind === "audit_only") {
-        // Kill switch: Ory is disabled. Audit the invocation, skip the check.
-        client.tracer.record("tool.invoke", "ok", {
-            attributes: { ...spanAttrs, auditOnly: true },
-        });
-        return { proceed: true, blocked: false, kind: "audit_only", decision: outcome, subject: label, namespace };
+    let outcome;
+    try {
+        if (opts.mcpTool) {
+            const mcpResult = await (0, mcp_js_1.checkMcpPermission)(client, opts.mcpTool, {
+                subject: subjectRef,
+                activityAttributes: activityAttrs,
+            });
+            const agentSubject = (0, subject_js_1.resolveAgentSubject)(client);
+            const subagentSubject = (0, subject_js_1.resolveSubAgentSubject)(opts.principals?.subAgentClientId);
+            const mode = await (0, permission_mode_js_1.warmPermissionModeCache)(client, subjectRef, {
+                additionalSubjects: [
+                    ...(agentSubject ? [{ scope: "agent", subject: agentSubject }] : []),
+                    ...(subagentSubject ? [{ scope: "subagent", subject: subagentSubject }] : []),
+                ],
+            });
+            outcome = (0, permissions_js_1.applyPermissionMode)(client, mcpResult.allowed, {
+                namespace: process.env.ORY_MCP_SERVER_NAMESPACE ?? "mcp_servers",
+                object: opts.mcpTool.serverName,
+                relation: "users",
+                ...subjectRef,
+                activityAttributes: {
+                    ...activityAttrs,
+                    mcpServer: opts.mcpTool.serverName,
+                    ...(opts.mcpTool.toolName ? { mcpTool: opts.mcpTool.toolName } : {}),
+                },
+                modeOverride: mode.mode,
+            });
+        }
+        else {
+            outcome = await (0, permissions_js_1.gateToolCall)(client, {
+                harness: opts.harness,
+                toolName: opts.toolName,
+                check,
+                activityAttributes: activityAttrs,
+                shellCommand: (0, tool_catalog_js_1.extractShellCommand)(opts.harness, opts.toolName, opts.toolArgs),
+                principals: opts.principals,
+            });
+        }
+    }
+    catch (err) {
+        const error = client.classifyError(err);
+        client.logger.warn("permission.fail_open", { tool: opts.toolName, ...describeThrown(error) });
+        const outcome = {
+            kind: "fail_open",
+            error,
+            mode: (0, config_js_1.resolveConfig)().permissionMode,
+            activityAttributes: { permissionMode: (0, config_js_1.resolveConfig)().permissionMode },
+        };
+        return {
+            proceed: true,
+            blocked: false,
+            kind: outcome.kind,
+            decision: outcome,
+            subject: label,
+            namespace,
+        };
+    }
+    if (outcome.kind === "not_connected") {
+        return {
+            proceed: true,
+            blocked: false,
+            kind: "not_connected",
+            decision: outcome,
+            subject: label,
+            namespace,
+        };
     }
     if (outcome.kind === "interactive") {
         return { proceed: true, blocked: false, kind: "interactive", decision: outcome, subject: label, namespace };
     }
-    const decisionAttrs = outcome.spanAttributes;
+    const decisionAttrs = outcome.activityAttributes;
     if (outcome.kind === "fail_open") {
         client.logger.warn("permission.fail_open", { tool: opts.toolName, code: outcome.error.code });
         return { proceed: true, blocked: false, kind: "fail_open", decision: outcome, subject: label, namespace };
     }
     if (outcome.kind === "allow") {
-        client.tracer.record("tool.invoke", "ok", {
-            attributes: { ...spanAttrs, ...decisionAttrs, allowed: true },
-        });
         return { proceed: true, blocked: false, kind: "allow", decision: outcome, subject: label, namespace };
     }
     if (outcome.kind === "observe") {
-        client.tracer.record("tool.block", "denied", {
-            attributes: { ...spanAttrs, ...decisionAttrs, allowed: false, ...(0, denial_js_1.alertAttributes)(false) },
-        });
-        client.tracer.record("tool.invoke", "ok", {
-            attributes: { ...spanAttrs, ...decisionAttrs, allowed: false, observed: true },
-        });
         return { proceed: true, blocked: false, kind: "observe", decision: outcome, subject: label, namespace };
     }
-    // deny
-    client.tracer.record("tool.block", "denied", {
-        attributes: { ...spanAttrs, ...decisionAttrs, allowed: false, ...(0, denial_js_1.alertAttributes)(canBlock) },
-    });
-    const denialMessage = (0, denial_js_1.formatDenialMessage)({ tool: opts.toolName, subjectId: label, namespace });
+    const denialContext = {
+        tool: opts.toolName,
+        subjectId: label,
+        namespace,
+        ...(opts.mcpTool ? { mcp: opts.mcpTool } : {}),
+        ...(0, denial_js_1.shellDenialFields)(outcome),
+    };
+    const denialMessage = (0, denial_js_1.formatDenialMessage)(denialContext);
     client.logger.warn("tool.denied", { tool: opts.toolName, subjectId: label });
-    return { proceed: false, blocked: canBlock, kind: "deny", decision: outcome, subject: label, namespace, denialMessage };
+    return {
+        proceed: false,
+        blocked: canBlock,
+        kind: "deny",
+        decision: outcome,
+        subject: label,
+        namespace,
+        denialMessage,
+        denialContext,
+    };
+}
+async function gate(client, opts) {
+    const result = await decideTool(client, opts);
+    const activityAttrs = gateActivityAttributes(opts);
+    const decisionAttrs = result.decision.activityAttributes;
+    if (result.kind === "not_connected") {
+        client.logger.activity("tool.invoke", "ok", {
+            attributes: { ...activityAttrs, securityConnected: false, decision: result.kind },
+        });
+    }
+    else if (result.kind === "allow") {
+        client.logger.activity("tool.invoke", "ok", {
+            attributes: { ...activityAttrs, ...decisionAttrs, allowed: true, decision: result.kind },
+        });
+    }
+    else if (result.kind === "observe") {
+        client.logger.activity("tool.block", "denied", {
+            attributes: {
+                ...activityAttrs,
+                ...decisionAttrs,
+                allowed: false,
+                observed: true,
+                decision: result.kind,
+                ...(0, denial_js_1.alertAttributes)(false),
+            },
+        });
+        client.logger.activity("tool.invoke", "ok", {
+            attributes: {
+                ...activityAttrs,
+                ...decisionAttrs,
+                allowed: false,
+                observed: true,
+                decision: result.kind,
+            },
+        });
+    }
+    else if (result.kind === "deny") {
+        client.logger.activity("tool.block", "denied", {
+            attributes: {
+                ...activityAttrs,
+                ...decisionAttrs,
+                allowed: false,
+                decision: result.kind,
+                ...(0, denial_js_1.alertAttributes)(opts.canBlock ?? true),
+            },
+        });
+    }
+    else if (result.kind === "interactive" || result.kind === "fail_open") {
+        client.logger.activity("tool.invoke", "ok", {
+            attributes: { ...activityAttrs, ...decisionAttrs, decision: result.kind },
+        });
+    }
+    return result;
 }
 function complete(client, opts) {
-    const attributes = { toolName: opts.toolName, ...(opts.extraSpanAttributes ?? {}) };
+    const attributes = {
+        toolName: opts.toolName,
+        ...(0, tool_metadata_js_1.summarizeToolInput)(opts.toolName, opts.input),
+        ...(0, tool_metadata_js_1.summarizeToolOutput)(opts.toolName, opts.output),
+        ...(opts.extraActivityAttributes ?? {}),
+    };
     if (opts.output !== undefined)
         attributes.hasOutput = true;
-    client.tracer.record("tool.complete", opts.status ?? "ok", { attributes });
+    client.logger.activity("tool.complete", opts.status ?? "ok", { attributes });
+}
+function fail(client, opts) {
+    if (opts.error !== undefined) {
+        client.logger.debug("tool.failure.detail", {
+            toolName: opts.toolName,
+            ...describeThrown(opts.error),
+        });
+    }
+    client.logger.activity("tool.fail", "error", {
+        attributes: {
+            toolName: opts.toolName,
+            ...(0, tool_metadata_js_1.summarizeToolInput)(opts.toolName, opts.input),
+            ...(opts.error !== undefined ? { hasError: true } : {}),
+            ...(opts.extraActivityAttributes ?? {}),
+        },
+    });
 }
 /**
  * Wrap a plain `execute(args)` callable with gate + complete. On a hard deny it throws
@@ -307,10 +576,20 @@ function wrapTool(client, opts, execute) {
             canBlock: opts.canBlock ?? true,
         });
         if (result.blocked) {
-            throw new denial_js_1.OryDenialError({ tool: opts.toolName, subjectId: result.subject, namespace: result.namespace });
+            throw new denial_js_1.OryDenialError(result.denialContext ?? {
+                tool: opts.toolName,
+                subjectId: result.subject,
+                namespace: result.namespace,
+            });
+        }
+        try {
+            const output = await execute(args);
+            complete(client, { toolName: opts.toolName, input: args, output });
+            return output;
+        }
+        catch (error) {
+            fail(client, { toolName: opts.toolName, input: args, error });
+            throw error;
         }
-        const output = await execute(args);
-        complete(client, { toolName: opts.toolName, output });
-        return output;
     };
 }