@ory/argus 0.14.0 → 1.0.1

package/dist/branding.js

@@ -8,10 +8,13 @@
  * The policy has two tiers, because many users install these plugins against
  * the **same** Ory project:
  *
- *  - **Shared** resources (one per project, reused by every user/harness) get a
- *    **stable, identity-free** name so all installs find and reuse the one
- *    resource instead of duplicating it: {@link USER_LOGIN_CLIENT_NAME} and the
- *    permission namespace ({@link PERMISSION_NAMESPACE}).
+ *  - **Shared** resources (one per project, reused by every user/harness) are
+ *    addressed by a **stable, reserved identifier** so all installs find and
+ *    reuse the one resource instead of duplicating it: the login client's
+ *    {@link USER_LOGIN_CLIENT_ID} and the permission namespace
+ *    ({@link PERMISSION_NAMESPACE}). An identifier, not a display name — see
+ *    {@link USER_LOGIN_CLIENT_ID} for why the distinction is a security
+ *    property and not a preference.
  *  - **Per-installer** resources (many per project by design — confidential
  *    per-machine DCR credentials, write-once API keys) get an **attributable**
  *    name carrying *who* and *where*, so a shared project's resource list stays
@@ -21,49 +24,116 @@
  * group together and are instantly recognizable in a shared Ory Console.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PERMISSION_NAMESPACE = exports.DEFAULT_PROJECT_NAME = exports.USER_LOGIN_CLIENT_NAMES = exports.LEGACY_USER_LOGIN_CLIENT_NAMES = exports.USER_LOGIN_CLIENT_NAME = exports.PRODUCT_NAME = void 0;
+exports.PERMISSION_NAMESPACE = exports.DEFAULT_PROJECT_NAME = exports.USER_LOGIN_SCOPE_CLI = exports.USER_LOGIN_SCOPE_OAUTH = exports.USER_LOGIN_SCOPES = exports.USER_LOGIN_BASE_SCOPES = exports.USER_LOGIN_CLIENT_NAME = exports.USER_LOGIN_CLIENT_ID = exports.PRODUCT_NAME = void 0;
+exports.isUserLoginClient = isUserLoginClient;
 exports.agentClientName = agentClientName;
+exports.shortSessionLabel = shortSessionLabel;
 exports.projectApiKeyName = projectApiKeyName;
 /** Human-readable umbrella name for everything this product creates. */
 exports.PRODUCT_NAME = "Ory Agent Security";
 /**
- * The public PKCE client the human's browser sign-in uses. It is a *public*
- * client (no secret), so every user on a project shares the one client — the
- * installer dedupes by this exact name. Stable and identity-free on purpose.
+ * The **reserved client id** of the shared user-login OAuth2 client — the one
+ * thing that identifies it. Every provisioning path (Ory Console setup, the
+ * local-dev Hydra seed) creates the client *at this id*, and every lookup
+ * addresses it by this id, so all of them converge on one client.
+ *
+ * It is an id rather than a name for a security reason. A project set up for
+ * Agent Security has public dynamic client registration enabled, and Hydra's DCR
+ * endpoint places no restriction on `client_name` — so anyone can register a
+ * client carrying {@link USER_LOGIN_CLIENT_NAME} verbatim with their own
+ * `redirect_uris`, and a name-based lookup can resolve to it (Hydra lists
+ * clients ordered by id, so re-registering until the assigned UUID sorts first
+ * is roughly a coin flip). Whoever then installs a plugin would complete a PKCE
+ * login — `offline_access` included — against the attacker's client. A
+ * `client_id` is not forgeable the same way: Hydra assigns a fresh UUID to a
+ * dynamically registered client and refuses a caller-chosen one, so only a
+ * caller holding the project's admin credentials can claim this id.
+ *
+ * There is deliberately **no name-based fallback** anywhere: a fallback reopens
+ * exactly that hole.
+ */
+exports.USER_LOGIN_CLIENT_ID = "ory-agent-security-login";
+/**
+ * The **display name** of the shared user-login client — a human-readable label
+ * for the Ory Console's client list, and nothing more. It is a *public* client
+ * (no secret) that every user on a project shares across every harness plugin,
+ * and the name says so plainly; no "PKCE" in it, since how it authenticates is
+ * an implementation detail, not what it is.
+ *
+ * Never resolve the client by this string. It is attacker-supplyable (see
+ * {@link USER_LOGIN_CLIENT_ID}); {@link USER_LOGIN_CLIENT_ID} is what dedupes
+ * installs onto one client, and {@link isUserLoginClient} is the only accepted
+ * test for "is this the login client".
+ */
+exports.USER_LOGIN_CLIENT_NAME = `${exports.PRODUCT_NAME} · shared user login (all plugins)`;
+/**
+ * Whether a client is *the* shared user-login client, decided **only** by its
+ * id. A client carrying {@link USER_LOGIN_CLIENT_NAME} under any other id is
+ * some other client — possibly one an attacker registered — and is rejected.
  */
-exports.USER_LOGIN_CLIENT_NAME = `${exports.PRODUCT_NAME} · user login (PKCE)`;
+function isUserLoginClient(client) {
+    return client.clientId === exports.USER_LOGIN_CLIENT_ID;
+}
 /**
- * Names an older installer may have given the shared user-login client. The
- * reuse probe matches these too, so renaming the client never orphans one
- * created by a previous install (which would then mint a duplicate).
+ * The single source of truth for the interactive user-login OAuth2 scopes.
+ * Every place that registers the client (`ory create/update oauth2-client`,
+ * the local-dev Hydra seed, the manual-setup help) and the PKCE flow that
+ * requests them must agree, or the flow fails with `invalid_scope` (or the
+ * requested scope is silently dropped). `openid`/`offline_access` are the
+ * baseline; `profile`/`email` populate the id_token's name claims so the
+ * signed-in user can be shown by name.
  */
-exports.LEGACY_USER_LOGIN_CLIENT_NAMES = ["ory-agent-plugin"];
-/** All names the shared user-login client may carry, newest first. */
-exports.USER_LOGIN_CLIENT_NAMES = [
-    exports.USER_LOGIN_CLIENT_NAME,
-    ...exports.LEGACY_USER_LOGIN_CLIENT_NAMES,
+exports.USER_LOGIN_BASE_SCOPES = ["openid", "offline_access"];
+exports.USER_LOGIN_SCOPES = [
+    ...exports.USER_LOGIN_BASE_SCOPES,
+    "profile",
+    "email",
 ];
+/** Space-delimited form for an OAuth2 `authorize` request / Hydra client `scope`. */
+exports.USER_LOGIN_SCOPE_OAUTH = exports.USER_LOGIN_SCOPES.join(" ");
+/** Comma-delimited form for the `ory … oauth2-client --scope` CLI flag. */
+exports.USER_LOGIN_SCOPE_CLI = exports.USER_LOGIN_SCOPES.join(",");
 /** Default name for a project the installer creates. Harness-agnostic, since a
  *  team typically points several harnesses at one shared project. */
 exports.DEFAULT_PROJECT_NAME = exports.PRODUCT_NAME;
 /** The shared permission-model namespace (an OPL class name, so it must stay a
  *  bare identifier — no spaces/branding — and stable across installs). */
-exports.PERMISSION_NAMESPACE = "AgentTools";
+exports.PERMISSION_NAMESPACE = "AgentTool";
 /**
  * The client_name for an agent's (or sub-agent's) OAuth2 identity registered
  * via DCR. These are confidential, per-machine credentials — many per shared
  * project by design — so the name is attributable: the harness it belongs to
- * and the host it was registered from (plus the sub-agent type, when it is one).
+ * and the host it was registered from, plus a short session label and the
+ * sub-agent type when applicable.
  */
 function agentClientName(opts) {
-    const { harness, host, subAgentType } = opts;
+    const { harness, host, subAgentType, sessionId } = opts;
+    const session = sessionId?.trim() ? ` · ${shortSessionLabel(sessionId)}` : "";
     if (subAgentType) {
         const scope = harness ? `${harness}/${subAgentType}` : subAgentType;
-        return `${exports.PRODUCT_NAME} · sub-agent · ${scope} @ ${host}`;
+        return `${exports.PRODUCT_NAME} · sub-agent · ${scope}${session} @ ${host}`;
     }
     return harness
-        ? `${exports.PRODUCT_NAME} · agent · ${harness} @ ${host}`
-        : `${exports.PRODUCT_NAME} · agent @ ${host}`;
+        ? `${exports.PRODUCT_NAME} · agent · ${harness}${session} @ ${host}`
+        : `${exports.PRODUCT_NAME} · agent${session} @ ${host}`;
+}
+/** How much of a session id goes into a display label. */
+const SESSION_LABEL_LENGTH = 8;
+/**
+ * A short, stable label for a session id, for **display only** — `status`
+ * output and log lines. Ids are usually UUIDs; the leading characters separate
+ * them well enough for a human scanning a list, and the full id is always
+ * recoverable from the delegation record and activity events.
+ *
+ * Never use this to build a permission subject. A derived session subject must
+ * carry the full session id (`Agent:<clientId>|<session>`) so it matches what an
+ * admin writes in the Console after reading the same id off the delegation graph.
+ */
+function shortSessionLabel(sessionId) {
+    const trimmed = sessionId.trim();
+    return trimmed.length > SESSION_LABEL_LENGTH
+        ? trimmed.slice(0, SESSION_LABEL_LENGTH)
+        : trimmed;
 }
 /**
  * The name for a project API key minted for runtime permission checks. Ory only

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
   "repo": "ory-agent-plugins",
-  "commit": "7568c163e59fba25d64ede49c092fcca108a43f2",
-  "commitShort": "7568c16",
+  "commit": "f803b3fe7be2cd6918652a082a7a4a3eb4ddab53",
+  "commitShort": "f803b3f",
   "branch": "main",
-  "commitDate": "2026-07-23T10:17:45-07:00",
+  "commitDate": "2026-08-30T11:50:10-07:00",
   "dirty": false,
-  "builtAt": "2026-07-23T17:21:55.389Z"
+  "builtAt": "2026-08-30T18:53:36.809Z"
 }

package/dist/cli-invocation.d.ts

@@ -7,7 +7,7 @@
  * package is already installed. In the common install flow the user runs
  * `npx @ory/<harness> install` — a one-shot npx invocation that leaves
  * nothing on `PATH` — so a follow-up banner that says `npx ory-claude
- * permissions bootstrap` fails: npm can't find a package literally named
+ * permissions status` fails: npm can't find a package literally named
  * `ory-claude` and errors out.
  *
  * The always-resolvable form is `npx -y -p @ory/<harness> ory-<short>

package/dist/cli-invocation.js

@@ -8,7 +8,7 @@
  * package is already installed. In the common install flow the user runs
  * `npx @ory/<harness> install` — a one-shot npx invocation that leaves
  * nothing on `PATH` — so a follow-up banner that says `npx ory-claude
- * permissions bootstrap` fails: npm can't find a package literally named
+ * permissions status` fails: npm can't find a package literally named
  * `ory-claude` and errors out.
  *
  * The always-resolvable form is `npx -y -p @ory/<harness> ory-<short>
@@ -36,6 +36,7 @@ const BIN_TO_PACKAGE = {
     "ory-amp": "@ory/amp",
     "ory-pi": "@ory/pi",
     "ory-agy": "@ory/antigravity",
+    "ory-cursor": "@ory/cursor",
 };
 /**
  * Render a copy-pasteable `npx` invocation prefix for a harness bin.

package/dist/cli.d.ts

@@ -1,20 +1,22 @@
 /**
  * Shared `configure` command implementation for all plugin CLIs.
  *
- * Parses --project-url, --api-key, and --oauth2-client-id from args.
- * If none is provided, shows the current configuration. Otherwise saves
- * the provided values.
+ * `configure` only ever touches the **security** half of a plugin. The
+ * developer-experience half — skills, commands, the local Ory stack, the MCP
+ * server, local activity logging — is installed unconditionally and has nothing to
+ * configure, so it is never mentioned here as an alternative or a fallback.
  *
- * When `--project-url` is provided, requires the OAuth2 client id to be
- * resolvable from one of: the `--oauth2-client-id` flag, the
- * `ORY_OAUTH2_CLIENT_ID` env var, or an already-persisted value in the
- * shared config. The PKCE browser flow (the user login runs every session)
- * can't self-register that client — surfacing the requirement here keeps
- * users from a silently-broken setup later.
+ * Connecting takes the project URL and canonical broker origin from the Ory
+ * Console (Agent Security). The public OAuth2 client id defaults to the reserved
+ * Agent Security login client and can be overridden for custom deployments.
+ * Existing configurations use the project URL as a legacy broker fallback.
+ * `--disconnect` clears all three stored connection values.
+ *
+ * With no arguments, prints what is currently resolved.
  */
 export declare function runConfigureCommand(binName: string, args: string[]): void;
 /**
- * Print the "Configuration:" block showing Ory project URL and API key status.
+ * Print the "Configuration:" block showing the resolved Ory connection.
  */
 export declare function printOryConfig(): void;
 /**
@@ -22,32 +24,17 @@ export declare function printOryConfig(): void;
  */
 export declare function printEnvironment(): void;
 /**
- * Print the last 5 debug log entries. When `harness` is given the path is
+ * Print the last 10 unified activity/debug log entries. When `harness` is given the path is
  * resolved the same way the plugin does at runtime — the default per-harness
  * data-dir location when `ORY_AGENT_LOG_FILE` is unset — so `status` finds the
- * log without the reader hand-setting env vars. The debug log only exists when
- * a session ran with `ORY_AGENT_DEBUG=true`; when it doesn't, this prints a
- * one-line pointer on how to turn it on rather than staying silent.
+ * log without the reader hand-setting env vars. Activity is always filed;
+ * verbose diagnostic entries are included only when `ORY_AGENT_DEBUG=true`.
  */
 export declare function printLogTail(harness?: string): void;
 /**
  * Print the "Configure your Ory credentials" help text.
  */
 export declare function printEnvHelp(binName: string): void;
-/**
- * Print the last 5 trace spans. When `harness` is given the path is resolved
- * the same way the plugin does at runtime — the default per-harness data-dir
- * location when `ORY_AGENT_TRACE_FILE` is unset — so `status` shows recent
- * activity out of the box (traces are written on every recorded span). When no
- * spans have been recorded yet, prints a one-line pointer at the trace file so
- * the reader knows where to look (and how to watch it live).
- */
-export declare function printTraceTail(harness?: string): void;
-/**
- * Run the live trace watcher. Tails the NDJSON trace file and prints
- * formatted spans to stdout as they arrive. Blocks until interrupted.
- */
-export declare function runWatchCommand(harness: string, args: string[]): void;
 /**
  * Returns true if `/dev/tty` can be opened for reading. Use this before
  * attempting to prompt the user — the harness has already taken stdin so
@@ -86,6 +73,10 @@ export declare function interactiveConfigPrompt(binName: string): Promise<boolea
  *   - `unregister` — best-effort RFC 7592 DELETE on the registered
  *                    client, then clear the persisted block.
  *
+ * Each installed harness owns its own agent identity, so both subcommands act
+ * on `harness`'s registration by default. `--all` widens them to every
+ * harness registered against the shared config.
+ *
  * Returns the process exit code (0 on success, non-zero on usage error).
  */
-export declare function runAgentCommand(binName: string, args: string[]): Promise<number>;
+export declare function runAgentCommand(binName: string, harness: string, args: string[]): Promise<number>;