@ory/argus 0.14.0 → 1.0.0

package/dist/user-login.js

@@ -5,7 +5,7 @@
  *
  *   1. Resolve config (env + ~/.config/ory-agent-plugins/config.json).
  *   2. If no project URL, prompt for one when a TTY is available;
- *      otherwise skip with an audit span.
+ *      otherwise skip with an audit event.
  *   3. If a session/oauth2 token is already in env, short-circuit ok.
  *   4. If persisted tokens are valid, return ok.
  *   5. If they are expired with a refresh_token, refresh.
@@ -15,7 +15,7 @@
  *      paste the URL into any browser that can reach 127.0.0.1. Only
  *      truly unattended (CI=true) environments short-circuit early.
  *
- * Every terminal path emits exactly one `user.auth` trace span so that
+ * Every terminal path emits exactly one `user.auth` activity event so that
  * the audit trail is complete regardless of outcome.
  *
  * The flow runs on **every** session and is **never** blocking: it
@@ -23,8 +23,10 @@
  * and permission-subject resolution, but a failure to authenticate never
  * stops the session. Enforcement is governed solely by `permissionMode`
  * (observe/enforce) at tool-call time — see `checkAndDecide`. The one
- * exception is `auditOnly`, which disables auth entirely (mode
- * `audit_only`). When the user can't be authenticated the session still
+ * exception is Agent Security not being connected at all (no project URL
+ * and OAuth2 client id), in which case there is nothing to sign in to and
+ * the flow no-ops with mode `not_connected`. When the user can't be
+ * authenticated the session still
  * proceeds; under `enforce` a missing user identity naturally denies at
  * the tool (no matching tuples), and under `observe` it is audited.
  *
@@ -38,7 +40,6 @@ exports.ensureAuthenticated = void 0;
 exports.ensureUserAuthenticated = ensureUserAuthenticated;
 const config_js_1 = require("./config.js");
 const cli_js_1 = require("./cli.js");
-const cli_invocation_js_1 = require("./cli-invocation.js");
 const auth_store_js_1 = require("./auth-store.js");
 const auth_js_1 = require("./auth.js");
 function clientId() {
@@ -47,7 +48,7 @@ function clientId() {
     // status CLI, and configure command in lockstep on resolution order.
     return (0, config_js_1.resolveConfig)().oauth2ClientId;
 }
-function recordAuthSpan(client, decision) {
+function recordAuthActivity(client, decision) {
     const status = decision.mode === "ok" || decision.mode === "refreshed" || decision.mode === "env_token"
         ? "ok"
         : decision.mode === "declined"
@@ -55,7 +56,7 @@ function recordAuthSpan(client, decision) {
             : decision.mode === "error"
                 ? "error"
                 : "skipped";
-    client.tracer.record("user.auth", status, {
+    client.logger.activity("user.auth", status, {
         attributes: {
             mode: decision.mode,
             reason: decision.reason,
@@ -72,7 +73,7 @@ async function ensureUserAuthenticated(client, options) {
     try {
         const decision = await runUserLogin(client, options);
         attachUserPrincipal(client, decision);
-        recordAuthSpan(client, decision);
+        recordAuthActivity(client, decision);
         return decision;
     }
     catch (err) {
@@ -81,13 +82,13 @@ async function ensureUserAuthenticated(client, options) {
             mode: "error",
             reason: err instanceof Error ? err.message : String(err),
         };
-        recordAuthSpan(client, decision);
+        recordAuthActivity(client, decision);
         return decision;
     }
 }
 /**
  * Attach the resolved user identity to the client so downstream
- * permission checks and trace spans can reference it. Only fires for
+ * permission checks and activity events can reference it. Only fires for
  * modes that actually authenticated a user — declined/skipped/error
  * leave the principal alone.
  */
@@ -109,69 +110,43 @@ function attachUserPrincipal(client, decision) {
         return;
     }
     if (decision.mode === "env_token") {
-        const subject = process.env.ORY_USER_SUBJECT_ID;
-        const token = process.env.ORY_USER_SESSION_TOKEN ??
-            process.env.ORY_USER_OAUTH2_TOKEN ??
-            process.env.ORY_SESSION_TOKEN ??
-            process.env.ORY_OAUTH2_TOKEN;
-        client.setUserPrincipal({
-            ...(subject ? { subject } : {}),
-            ...(token ? { token } : {}),
-        });
+        // Same reader the per-client rehydration uses, so the credential this gate
+        // attaches is exactly the one later lifecycle events will pick up.
+        client.setUserPrincipal((0, auth_store_js_1.readEnvUserCredential)());
     }
 }
 async function runUserLogin(client, options) {
     const ttyCheck = options.isTtyAvailableFn ?? cli_js_1.isTtyAvailable;
     const tty = ttyCheck();
     let resolved = (0, config_js_1.resolveConfig)();
-    if (resolved.auditOnly) {
+    // Agent Security isn't connected, so there is no project to sign in to.
+    // Nothing is lost: the plugin's developer-experience half doesn't need an
+    // identity.
+    if (!resolved.security.connected) {
         return {
             proceed: true,
-            mode: "audit_only",
-            reason: "Configured for audit-only mode; user login is a no-op",
+            mode: "not_connected",
+            reason: `Ory Agent Security is not connected (${(0, config_js_1.describeSecurityGap)(resolved.security)}); user login is a no-op`,
         };
     }
-    // 1. Project URL.
-    if (!resolved.projectUrl) {
-        if (!tty) {
-            return {
-                proceed: true,
-                mode: "skipped",
-                reason: "No ORY_PROJECT_URL configured and no TTY to prompt",
-            };
-        }
-        const promptFn = options.promptForProjectUrlFn ?? cli_js_1.promptForProjectUrl;
-        const url = await promptFn(options.binName);
-        if (!url) {
-            return {
-                proceed: true,
-                mode: "declined",
-                reason: "User declined to enter an Ory project URL",
-            };
-        }
-        resolved = (0, config_js_1.resolveConfig)();
-        if (!resolved.projectUrl) {
-            return {
-                proceed: true,
-                mode: "error",
-                reason: "Project URL was entered but config did not persist",
-            };
-        }
-    }
-    // 2. Pre-supplied env tokens short-circuit the browser flow (CI, scripted
-    //    runs). ORY_USER_* are the documented names; the legacy single-identity
-    //    ORY_SESSION_TOKEN / ORY_OAUTH2_TOKEN are still honored.
-    if (process.env.ORY_USER_SESSION_TOKEN ||
-        process.env.ORY_USER_OAUTH2_TOKEN ||
-        process.env.ORY_SESSION_TOKEN ||
-        process.env.ORY_OAUTH2_TOKEN) {
+    // `security.connected` guarantees both values are non-empty; narrow once
+    // here so the rest of the flow doesn't re-check what the gate established.
+    const projectUrl = resolved.projectUrl;
+    // Past this point both connection values are present, which is why there is
+    // no "prompt for a project URL" or "missing client id" branch here: either
+    // one absent means not connected, and that is handled above as a normal
+    // state rather than something to interrupt the user about.
+    // 1. A pre-supplied OAuth2 access token short-circuits the browser flow
+    //    (CI, scripted runs). `ORY_USER_OAUTH2_TOKEN` is the only accepted
+    //    variable — see `readEnvUserCredential`.
+    if ((0, auth_store_js_1.readEnvUserCredential)().token) {
         return {
             proceed: true,
             mode: "env_token",
-            reason: "Session/OAuth2 token supplied via environment",
+            reason: "OAuth2 access token supplied via environment",
         };
     }
-    // 3. Persisted tokens.
+    // 2. Persisted tokens.
     const existing = (0, auth_store_js_1.loadTokens)();
     if (existing && !(0, auth_store_js_1.isExpired)(existing)) {
         return {
@@ -186,7 +161,7 @@ async function runUserLogin(client, options) {
         if (cid) {
             try {
                 const refreshed = await (0, auth_store_js_1.refreshAndSave)({
-                    projectUrl: resolved.projectUrl,
+                    projectUrl,
                     clientId: cid,
                     current: existing,
                 });
@@ -205,19 +180,9 @@ async function runUserLogin(client, options) {
             }
         }
     }
-    // 4. Browser flow. Requires a registered OAuth2 client id.
+    // 3. Browser flow. The client id is guaranteed present — it is half of what
+    //    "connected" means, checked at the top of this function.
     const cid = clientId();
-    if (!cid) {
-        return {
-            proceed: true,
-            mode: "skipped",
-            reason: "ORY_OAUTH2_CLIENT_ID is not set; cannot start browser login (run `" +
-                (0, cli_invocation_js_1.oryNpx)(options.binName) +
-                " configure --oauth2-client-id <id>` after registering a public OAuth2 client " +
-                "in your Ory project with all four loopback redirect URIs: " +
-                "http://127.0.0.1:47823..47826/callback)",
-        };
-    }
     // No TTY check here on purpose: PKCE only needs a browser that can reach
     // the loopback callback port, not stdin. `pkceLogin` prints the
     // authorize URL to stderr so users in non-TTY environments (SSH without
@@ -225,7 +190,7 @@ async function runUserLogin(client, options) {
     // complete sign-in by pasting the URL into any browser that can reach
     // 127.0.0.1. Truly unattended runs (CI=true) are short-circuited by
     // `pkceLogin` itself via `detectHeadless`, and operators can bypass
-    // login entirely by supplying `ORY_USER_SESSION_TOKEN`, and enforcement
+    // login entirely by supplying `ORY_USER_OAUTH2_TOKEN`, and enforcement
     // consequences are governed by `permissionMode`, not by this gate.
     // PKCE-flight lock so concurrent processes share a single browser flow.
     const lock = (0, auth_store_js_1.tryAcquirePkceFlightLock)();
@@ -249,7 +214,7 @@ async function runUserLogin(client, options) {
     try {
         const loginFn = options.loginFn ?? auth_js_1.pkceLogin;
         const outcome = await loginFn({
-            projectUrl: resolved.projectUrl,
+            projectUrl,
             clientId: cid,
         });
         if (outcome.kind === "ok") {
@@ -264,13 +229,17 @@ async function runUserLogin(client, options) {
         return {
             proceed: true,
             mode: declineToMode(outcome.reason),
-            reason: declineMessage(outcome.reason),
+            reason: appendDetail(declineMessage(outcome.reason), outcome.detail),
         };
     }
     finally {
         lock.release();
     }
 }
+/** Append a secret-free diagnostic to a decline message when one is present. */
+function appendDetail(message, detail) {
+    return detail ? `${message} — ${detail}` : message;
+}
 function declineToMode(reason) {
     switch (reason) {
         case "user_denied":
@@ -283,6 +252,8 @@ function declineToMode(reason) {
             return "skipped";
         case "state_mismatch":
         case "token_exchange_failed":
+        case "invalid_scope":
+        case "oauth_error":
             return "error";
     }
 }
@@ -291,7 +262,13 @@ function declineMessage(reason) {
         case "headless":
             return "Browser login skipped: environment is headless (CI/SSH/no DISPLAY)";
         case "timeout":
-            return "Browser login timed out before the user completed sign-in";
+            // Name the consequence, not just the event. This is the one decline the
+            // user can fix by simply retrying, and under `enforce` its after-effect
+            // (every tool denied, for want of a user identity) is otherwise
+            // unattributable to a sign-in that quietly ran out of time (#220).
+            return (`Browser login timed out after ${Math.round(auth_js_1.DEFAULT_LOGIN_TIMEOUT_MS / 1000)}s ` +
+                "before sign-in completed — the session has no Ory user identity. " +
+                "Start a new session to sign in again");
         case "user_denied":
             return "User declined the OAuth2 consent screen";
         case "state_mismatch":
@@ -304,6 +281,10 @@ function declineMessage(reason) {
             return "Login was aborted by the caller";
         case "token_exchange_failed":
             return "Authorization code exchange failed at /oauth2/token";
+        case "invalid_scope":
+            return "Ory rejected the requested OAuth2 scope (invalid_scope) — the login client isn't allowed it";
+        case "oauth_error":
+            return "Ory returned an OAuth2 error on the login redirect";
     }
 }
 /**

package/dist/watch-cli.d.ts

@@ -0,0 +1,6 @@
+export interface WatchCommandOptions {
+    signal?: AbortSignal;
+    pollIntervalMs?: number;
+}
+/** Follow one harness's unified activity/debug log until interrupted. */
+export declare function runWatchCommand(binName: string, harness: string, args: readonly string[], options?: WatchCommandOptions): Promise<number>;

package/dist/watch-cli.js

@@ -0,0 +1,217 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runWatchCommand = runWatchCommand;
+const fs = __importStar(require("node:fs"));
+const client_js_1 = require("./client.js");
+const logger_js_1 = require("./logger.js");
+const ui_js_1 = require("./ui.js");
+const DEFAULT_HISTORY_LINES = 10;
+const DEFAULT_POLL_INTERVAL_MS = 250;
+const MAX_HISTORY_BYTES = 64 * 1024;
+function parseWatchArgs(binName, args) {
+    let json = false;
+    let lines = DEFAULT_HISTORY_LINES;
+    for (let index = 0; index < args.length; index++) {
+        const arg = args[index];
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--lines") {
+            const value = Number(args[++index]);
+            if (Number.isInteger(value) && value >= 0) {
+                lines = value;
+                continue;
+            }
+        }
+        console.error(`Usage: ${binName} watch [--json] [--lines <count>]`);
+        return undefined;
+    }
+    return { json, lines };
+}
+const WATCH_LABEL_WIDTH = 13;
+const WATCH_EVENT_WIDTH = 30;
+function colorLabel(label) {
+    if (label === "ALLOW" || label === "OK")
+        return ui_js_1.brand.green(label);
+    if (label === "DENY" || label === "DENIED" || label === "ERROR")
+        return ui_js_1.brand.rose(label);
+    if (label === "OBSERVE" || label === "FAIL OPEN" || label === "WARN") {
+        return ui_js_1.brand.yellow(label);
+    }
+    return ui_js_1.style.gray(label);
+}
+function detailLabel(detail) {
+    const separator = detail.indexOf("=");
+    if (separator < 0)
+        return detail;
+    return `${ui_js_1.style.gray(detail.slice(0, separator))}=${detail.slice(separator + 1)}`;
+}
+function renderEntry(entry) {
+    const { time, event, marker, details } = (0, logger_js_1.formatLogEntryParts)(entry);
+    const decision = details.find((detail) => detail.startsWith("decision="))?.slice(9);
+    const status = details.find((detail) => detail.startsWith("status="))?.slice(7);
+    const label = (decision ?? status ?? marker.replaceAll(/[\[\]]/g, "")).replaceAll("_", " ").toUpperCase();
+    const remaining = details.filter((detail) => !detail.startsWith("decision=") && !detail.startsWith("status="));
+    const labelPadding = " ".repeat(Math.max(1, WATCH_LABEL_WIDTH - label.length));
+    const eventPadding = " ".repeat(Math.max(1, WATCH_EVENT_WIDTH - event.length));
+    const metadata = remaining.length > 0
+        ? remaining.map(detailLabel).join(ui_js_1.style.dim("  |  "))
+        : "";
+    console.log(`${ui_js_1.style.dim(time)}  ${colorLabel(label)}${labelPadding}${ui_js_1.style.bold(event)}` +
+        `${eventPadding}${metadata}`);
+}
+function renderLine(line, json) {
+    if (json) {
+        console.log(line);
+        return;
+    }
+    try {
+        renderEntry(JSON.parse(line));
+    }
+    catch {
+        console.log(ui_js_1.brand.rose("INVALID") + `  ${line.slice(0, 160)}`);
+    }
+}
+function readHistory(logFile, lines, json) {
+    const stat = fs.statSync(logFile);
+    if (lines === 0 || stat.size === 0)
+        return stat.size;
+    const start = Math.max(0, stat.size - MAX_HISTORY_BYTES);
+    const length = stat.size - start;
+    const buffer = Buffer.alloc(length);
+    const fd = fs.openSync(logFile, "r");
+    try {
+        fs.readSync(fd, buffer, 0, length, start);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    let history = buffer.toString("utf8").split("\n");
+    if (start > 0)
+        history = history.slice(1);
+    for (const line of history.filter(Boolean).slice(-lines))
+        renderLine(line, json);
+    return stat.size;
+}
+function readRange(logFile, start, end) {
+    const length = end - start;
+    const buffer = Buffer.alloc(length);
+    const fd = fs.openSync(logFile, "r");
+    try {
+        fs.readSync(fd, buffer, 0, length, start);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    return buffer.toString("utf8");
+}
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** Follow one harness's unified activity/debug log until interrupted. */
+async function runWatchCommand(binName, harness, args, options = {}) {
+    const parsed = parseWatchArgs(binName, args);
+    if (!parsed)
+        return 1;
+    const logFile = (0, client_js_1.resolveDebugLogPath)(harness);
+    if (!logFile) {
+        console.error("Activity/debug logging is disabled because ORY_AGENT_LOG_FILE is empty.");
+        return 1;
+    }
+    const controller = options.signal ? undefined : new AbortController();
+    const signal = options.signal ?? controller?.signal;
+    const stop = () => controller?.abort();
+    if (controller) {
+        process.once("SIGINT", stop);
+        process.once("SIGTERM", stop);
+    }
+    if (parsed.json) {
+        console.log(`Watching ${logFile} (Ctrl-C to stop)`);
+    }
+    else {
+        console.log(ui_js_1.style.bold("Watching plugin activity"));
+        console.log(`${ui_js_1.style.gray("file")}  ${logFile}`);
+        console.log(`${ui_js_1.style.gray("stop")}  Ctrl-C`);
+        console.log("");
+    }
+    let offset = 0;
+    let fileIdentity;
+    let remainder = "";
+    try {
+        try {
+            const stat = fs.statSync(logFile);
+            fileIdentity = `${stat.dev}:${stat.ino}`;
+            offset = readHistory(logFile, parsed.lines, parsed.json);
+        }
+        catch {
+            console.log("Waiting for the first plugin event...");
+        }
+        while (!signal?.aborted) {
+            await delay(options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS);
+            if (signal?.aborted || !fs.existsSync(logFile))
+                continue;
+            try {
+                const stat = fs.statSync(logFile);
+                const nextIdentity = `${stat.dev}:${stat.ino}`;
+                if (fileIdentity !== nextIdentity || stat.size < offset) {
+                    offset = 0;
+                    remainder = "";
+                    fileIdentity = nextIdentity;
+                }
+                if (stat.size === offset)
+                    continue;
+                const chunk = remainder + readRange(logFile, offset, stat.size);
+                offset = stat.size;
+                const complete = chunk.split("\n");
+                remainder = complete.pop() ?? "";
+                for (const line of complete)
+                    if (line)
+                        renderLine(line, parsed.json);
+            }
+            catch {
+                // The writer may replace the file between stat and read; retry next poll.
+            }
+        }
+        return 0;
+    }
+    finally {
+        if (controller) {
+            process.off("SIGINT", stop);
+            process.off("SIGTERM", stop);
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "0.14.0",
+  "version": "1.0.0",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -36,8 +36,6 @@
     "agent-security",
     "guardrails",
     "llm",
-    "tracing",
-    "distributed-tracing",
     "observability",
     "kratos",
     "keto",
@@ -61,40 +59,19 @@
   "files": [
     "dist",
     "assets",
-    "!dist/dev",
     "!dist/**/*.tsbuildinfo"
   ],
   "dependencies": {
-    "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/core": "^2.8.0",
-    "@opentelemetry/exporter-trace-otlp-http": "^0.219.0",
-    "@opentelemetry/exporter-trace-otlp-proto": "^0.219.0",
-    "@opentelemetry/resources": "^2.8.0",
-    "@opentelemetry/sdk-trace-base": "^2.8.0",
     "@ory/client": "^1.22.37",
+    "@vscode/tree-sitter-wasm": "^0.3.1",
     "open": "^11.0.0",
-    "reo-census": "^1.2.8"
-  },
-  "devDependencies": {
-    "@tailwindcss/vite": "^4.1.0",
-    "@types/react": "^19.0.0",
-    "@types/react-dom": "^19.0.0",
-    "@vitejs/plugin-react": "^4.3.0",
-    "class-variance-authority": "^0.7.1",
-    "clsx": "^2.1.1",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
-    "tailwind-merge": "^3.0.0",
-    "tailwindcss": "^4.1.0",
-    "vite": "^6.0.0"
+    "web-tree-sitter": "^0.26.11"
   },
   "engines": {
     "node": ">=22"
   },
   "scripts": {
-    "build": "tsc && node ./scripts/gen-build-info.mjs && pnpm run build:webapp",
-    "build:webapp": "vite build --config webapp/vite.config.ts",
-    "dev:webapp": "node webapp/dev-server.mjs",
+    "build": "tsc && node ./scripts/gen-build-info.mjs",
     "clean": "rm -rf dist *.tsbuildinfo",
     "test": "vitest run",
     "test:watch": "vitest",

package/assets/commands/dashboard.md

@@ -1,34 +0,0 @@
-# Open the Ory Plugin Dashboard
-
-Open a live, browser-based control panel for the Ory agent plugin. It shows
-the health of the core Ory services the plugin uses (Kratos, Hydra, Keto) and
-the plugin's current configuration (project URL, permission mode, audit mode,
-user-login flag, namespaces, and the resolved user/agent identities),
-refreshing the health status live.
-
-Run:
-
-```bash
-{{NPX}} dashboard
-```
-
-This will:
-
-1. Start a small local web server bound to `127.0.0.1`
-2. Open your default browser at the dashboard
-3. Refresh the service health live
-
-The dashboard is the read-only status view of the Ory Agent web app — the same
-local React UI, loopback server, and styleguide that power the guided web
-installer. It never changes configuration. Stop it with `Ctrl-C` in the
-terminal (or the "Close" button in the page).
-
-When no browser is available (CI, SSH, headless), or with `--json`, it prints a
-machine-readable status report instead:
-
-```bash
-{{NPX}} dashboard --json
-```
-
-If the core services show as unreachable, start the local stack with
-{{REF_LOCAL_UP}} (or check state with `{{NPX}} local status`).

package/dist/dashboard-cli.d.ts

@@ -1,8 +0,0 @@
-/**
- * Entry point invoked by each harness CLI's `dashboard` case. Returns the
- * intended process exit code; never throws. With `--json` (or when no browser
- * can be opened) it prints the report and resolves immediately; otherwise it
- * opens the web app in `status` mode and resolves when the SPA requests
- * shutdown or the user interrupts (Ctrl+C).
- */
-export declare function runDashboardCommand(binName: string, harness: string, args: string[]): Promise<number>;

package/dist/dashboard-cli.js

@@ -1,70 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runDashboardCommand = runDashboardCommand;
-/**
- * Shared `dashboard` CLI implementation. Each harness's `cli/main.ts`
- * delegates `<bin> dashboard` here.
- *
- * The dashboard is the live status view of the plugin, and one of the two
- * surfaces of the Ory Agent web app (the other being the guided installer): it
- * opens that app in `status` mode via {@link file://./web/launch.ts}'s
- * `launchWebDashboard`, reusing the same loopback server + React SPA. The data
- * it renders is the shared {@link file://./status-data.ts} `StatusReport`,
- * which the dashboard extends with a "System information" section — the health
- * of the core Ory services (Kratos, Hydra, Keto) from
- * {@link file://./status-system.ts}.
- *
- * Besides reading status, the dashboard exposes a "Change stack" action that
- * hands off to the same guided wizard the installer uses (embedded, starting on
- * the stack chooser) so the user can reconfigure which Ory stack the plugin runs
- * against — Ory Network, the local stack, or audit-only — without leaving the
- * browser. It reuses the shared install API and reloads status on return.
- *
- * Flags:
- *   --json   Print the status report as JSON and exit (no server). Also the
- *            automatic fallback when a browser can't be opened (headless / CI).
- */
-const launch_js_1 = require("./web/launch.js");
-const status_data_js_1 = require("./status-data.js");
-const cli_invocation_js_1 = require("./cli-invocation.js");
-function printDashboardHelp(binName) {
-    console.log(`Usage: ${binName} dashboard [options]`);
-    console.log("");
-    console.log("Open the Ory Agent dashboard in your browser — a live view of the");
-    console.log("plugin's configuration and the health of the core Ory services (Kratos,");
-    console.log("Hydra, Keto), refreshing live. It is the status surface of the same web");
-    console.log("app that powers the guided installer, and its \"Change stack\" action lets");
-    console.log("you reconfigure which Ory stack the plugin runs against.");
-    console.log("");
-    console.log("Options:");
-    console.log("  --json   Print the status report as JSON and exit (no server)");
-    console.log("");
-    console.log(`  ${(0, cli_invocation_js_1.oryNpx)(binName)} dashboard`);
-}
-/**
- * Entry point invoked by each harness CLI's `dashboard` case. Returns the
- * intended process exit code; never throws. With `--json` (or when no browser
- * can be opened) it prints the report and resolves immediately; otherwise it
- * opens the web app in `status` mode and resolves when the SPA requests
- * shutdown or the user interrupts (Ctrl+C).
- */
-async function runDashboardCommand(binName, harness, args) {
-    if (args.includes("--help") || args.includes("-h")) {
-        printDashboardHelp(binName);
-        return 0;
-    }
-    // `--json`, or any environment where we can't open a browser (CI, no TTY,
-    // no display), falls back to the machine-readable report on stdout.
-    if (args.includes("--json") || !(0, launch_js_1.canLaunchBrowser)()) {
-        const report = await (0, status_data_js_1.collectStatusReport)(harness);
-        console.log(JSON.stringify(report, null, 2));
-        return 0;
-    }
-    const launched = await (0, launch_js_1.launchWebDashboard)(binName, harness);
-    if (!launched) {
-        console.error("Could not start the dashboard server.");
-        console.error(`Use "${(0, cli_invocation_js_1.oryNpx)(binName)} dashboard --json" for the raw report instead.`);
-        return 1;
-    }
-    return 0;
-}