@ory/argus 0.2.0 → 0.2.1

package/dist/dev.js

@@ -485,7 +485,7 @@ async function bootstrapLocalOry(localDir) {
         return { active: false };
     }
     console.log(`[ory-dev] Local Ory: agent ${seed.agent.identity.email}, user ${seed.user.identity.email}, ` +
-        `${seed.permissions.tuples} permission tuples in '${namespace}' for ${seed.permissions.subject}.`);
+        `${seed.permissions.tuples} permissions in '${namespace}' for ${seed.permissions.subject}.`);
     return { active: true, gatewayUrl, seed };
 }
 /**

package/dist/local/cli.js

@@ -63,7 +63,7 @@ Commands:
   up [--no-seed]     Start local Ory services (Kratos, Keto, Hydra, gateway)
   down               Stop all local services (preserves data)
   status             Show service health and container states
-  seed               Create test identity, session, and permission tuples
+  seed               Create test identity, session, and permissions
   logs [service] [-f]  View service logs (optionally follow, optionally filter)
   reset              Stop services and remove all data
   env                Print environment variables for connecting to local services

package/dist/local/manager.js

@@ -642,7 +642,7 @@ function printSeedResult(result) {
     console.log(`  User password:  ${result.user.password}`);
     console.log(`  User OAuth2:    ${result.user.client.clientId} (PKCE)`);
     console.log("");
-    console.log(`  Permissions: ${result.permissions.tuples} tuples in '${result.permissions.namespace}' for ${result.permissions.subject}`);
+    console.log(`  Permissions: ${result.permissions.tuples} entries in '${result.permissions.namespace}' for ${result.permissions.subject}`);
     console.log("");
     console.log("To use with any Ory agent plugin, set these environment variables:");
     console.log("");

package/dist/local/seed.js

@@ -110,7 +110,7 @@ async function seedPermissions(userId, namespace) {
         catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
             if (!msg.includes("409")) {
-                process.stderr.write(`  Warning: failed to create tuple for ${tool}: ${msg}\n`);
+                process.stderr.write(`  Warning: failed to create permission for ${tool}: ${msg}\n`);
             }
             else {
                 created++;
@@ -185,9 +185,9 @@ async function seedLocalEnvironment(namespace = "AgentTools") {
     //    Subject is a SubjectSet `User:<id>` so the Console UI can rewrite
     //    the same tuple shape by hand during the runbook demo.
     const subjectLabel = `${exports.USER_SUBJECT_NAMESPACE}:${userIdentity.id}`;
-    process.stderr.write(`  Creating permission tuples for ${COMMON_TOOLS.length} tools...\n`);
+    process.stderr.write(`  Creating permissions for ${COMMON_TOOLS.length} tools...\n`);
     const tupleCount = await seedPermissions(userIdentity.id, namespace);
-    process.stderr.write(`  Permissions: ${tupleCount} tuples in '${namespace}' for ${subjectLabel}\n`);
+    process.stderr.write(`  Permissions: ${tupleCount} entries in '${namespace}' for ${subjectLabel}\n`);
     // 3. User OAuth2 client (PKCE) — pre-registered so the user gate's
     //    PKCE flow has somewhere to authenticate against. The agent's
     //    OAuth2 client is intentionally NOT pre-registered; the harness

package/dist/permissions-cli.js

@@ -84,7 +84,7 @@ function printPermissionsHelp(binName) {
     console.log("");
     console.log("Subcommands:");
     console.log("  status      Show permission mode and tool coverage for the current user");
-    console.log("  bootstrap   Write 'use' tuples for the harness's built-in tools (idempotent)");
+    console.log("  bootstrap   Grant the current user 'use' on every built-in tool (idempotent)");
     console.log("  observe     Switch to observe mode (denies log but don't block)");
     console.log("  enforce     Switch to enforce mode (denies block — production posture)");
     console.log("");
@@ -104,7 +104,7 @@ function runPermissionsSetMode(binName, mode) {
         console.log("Denies will be logged and recorded as `permission.observe_deny` spans,");
         console.log("but tools will be allowed through. Run");
         console.log(`  ${binName} permissions enforce`);
-        console.log("once your tuple set is correct.");
+        console.log("once your permission set is correct.");
     }
     else {
         console.log("Denies will block tool execution. The plugin is now enforcing.");
@@ -121,9 +121,10 @@ async function runPermissionsStatus(binName, harness) {
     console.log(`Permission status (${harness})`);
     console.log("==========================================");
     console.log("");
-    console.log(`Mode:           ${resolved.permissionMode} [source: ${resolved.permissionModeSource}]`);
+    console.log(`Mode:           ${resolved.permissionMode}${formatModeSource(resolved.permissionModeSource)}`);
+    console.log(`  (other modes: ${otherModes(resolved.permissionMode).join(", ")})`);
     console.log(`Namespace:      ${namespace}`);
-    console.log(`Project URL:    ${resolved.projectUrl ?? "(not set)"} [source: ${resolved.projectUrlSource}]`);
+    console.log(`Project URL:    ${resolved.projectUrl ?? "(not set)"}${formatSourceSuffix(resolved.projectUrlSource)}`);
     console.log(`Audit-only:     ${resolved.auditOnly ? "yes (Ory disabled)" : "no"}`);
     console.log("");
     if (resolved.auditOnly) {
@@ -132,7 +133,7 @@ async function runPermissionsStatus(binName, harness) {
         return 0;
     }
     if (!resolved.projectUrl) {
-        console.log("No project URL configured — cannot probe tuple coverage.");
+        console.log("No project URL configured — cannot probe permission coverage.");
         console.log(`Configure first: ${binName} configure --project-url <URL> --api-key <KEY>`);
         return 0;
     }
@@ -214,7 +215,7 @@ async function runPermissionsBootstrap(binName, harness, args) {
         return 1;
     }
     if (!resolved.projectUrl) {
-        console.error("No ORY_PROJECT_URL configured — cannot write tuples.");
+        console.error("No ORY_PROJECT_URL configured — cannot write permissions.");
         console.error(`Configure first: ${binName} configure --project-url <URL> --api-key <KEY>`);
         return 1;
     }
@@ -231,14 +232,14 @@ async function runPermissionsBootstrap(binName, harness, args) {
     const subject = (0, subject_js_1.resolveUserSubject)(client);
     const subjectId = (0, subject_js_1.subjectLabel)(subject);
     if (subjectId === "agent:unknown") {
-        console.error("No user identity resolved — refusing to write tuples to an unknown subject.");
+        console.error("No user identity resolved — refusing to write permissions for an unknown subject.");
         console.error("");
         console.error("Either:");
         console.error("  - run the harness once with ORY_AUTH_GATE=1 so a user token is cached, or");
         console.error("  - set ORY_USER_SUBJECT_ID=<id> to target a known subject.");
         return 1;
     }
-    console.log(`Bootstrapping ${catalog.length} permission tuples for ${harness}`);
+    console.log(`Bootstrapping ${catalog.length} permissions for ${harness}`);
     console.log("==========================================");
     console.log("");
     console.log(`Namespace: ${namespace}`);
@@ -246,7 +247,7 @@ async function runPermissionsBootstrap(binName, harness, args) {
     console.log(`Tools:     ${catalog.join(", ")}`);
     if (dryRun) {
         console.log("");
-        console.log("(--dry-run) No tuples will be written.");
+        console.log("(--dry-run) No permissions will be written.");
     }
     console.log("");
     let created = 0;
@@ -285,7 +286,7 @@ async function runPermissionsBootstrap(binName, harness, args) {
     }
     console.log("");
     if (dryRun) {
-        console.log(`Dry run: ${catalog.length} tuples would be written.`);
+        console.log(`Dry run: ${catalog.length} permissions would be written.`);
         return 0;
     }
     console.log(`Created: ${created}    Already existed: ${existed}    Failed: ${failures.length}`);
@@ -296,7 +297,7 @@ async function runPermissionsBootstrap(binName, harness, args) {
             console.log("");
             console.log("Some writes were rejected — your current credentials may lack");
             console.log("write scope on the permission namespace. You can apply the");
-            console.log("tuples manually using the snippet below (one tuple per line):");
+            console.log("permissions manually using the snippet below (one per line):");
             console.log("");
             for (const tool of catalog) {
                 console.log(`  ${namespace}:${tool}#use@${subjectId}`);
@@ -309,7 +310,7 @@ async function runPermissionsBootstrap(binName, harness, args) {
         return failures.length === catalog.length ? 1 : 0;
     }
     console.log("");
-    console.log(`Permission tuples are in place. Promote to enforce mode when ready:`);
+    console.log(`Permissions are in place. Promote to enforce mode when ready:`);
     console.log(`  ${binName} permissions enforce`);
     return 0;
 }
@@ -342,21 +343,22 @@ function printPermissionsOnboardingHelp(binName, harness, opts = {}) {
     const catalog = (0, tool_catalog_js_1.getToolCatalog)(harness);
     console.log("");
     console.log("Permissions:");
-    console.log(`  Mode: ${resolved.permissionMode}  [source: ${resolved.permissionModeSource}]`);
+    console.log(`  Mode: ${resolved.permissionMode}${formatModeSource(resolved.permissionModeSource)}`);
+    console.log(`  Other modes: ${otherModes(resolved.permissionMode).join(", ")}`);
     if (resolved.auditOnly) {
         console.log("  Ory is in audit-only mode (kill switch). Permission checks are disabled.");
         return;
     }
     if (resolved.permissionMode === "observe") {
         console.log("  Observe mode: permission denies are logged + traced, but tools still run.");
-        console.log("  This is the safe default — promote once your tuple set is correct.");
+        console.log("  This is the safe default — promote to 'enforce' once your permission set is correct.");
     }
     else {
         console.log("  Enforce mode: permission denies block tool execution.");
     }
     if (opts.bootstrappedAutomatically) {
         console.log("");
-        console.log(`  Tuples bootstrapped for ${catalog.length} built-in tools.`);
+        console.log(`  Permissions bootstrapped for ${catalog.length} built-in tools.`);
     }
     else if (catalog.length > 0) {
         console.log("");
@@ -364,12 +366,52 @@ function printPermissionsOnboardingHelp(binName, harness, opts = {}) {
         console.log(`    npx ${binName} permissions bootstrap`);
     }
     console.log("");
-    console.log("  Inspect tuple coverage:");
+    console.log("  Inspect permission coverage:");
     console.log(`    npx ${binName} permissions status`);
     console.log("");
     console.log("  Promote to enforcing once observe-mode logs look right:");
     console.log(`    npx ${binName} permissions enforce`);
 }
+/**
+ * Render the trailing source annotation on a Mode line. Stays silent
+ * when the mode came from the built-in default, since saying "default"
+ * just adds noise. When the mode was overridden by env or config, name
+ * the override so the reader knows where to look.
+ */
+function formatModeSource(source) {
+    switch (source) {
+        case "env":
+            return `  (set via ${ENV_PERMISSION_MODE} env var)`;
+        case "config":
+            return "  (saved in config; change with: permissions observe|enforce)";
+        case "default":
+            return "  (built-in default)";
+    }
+}
+/**
+ * Generic source-suffix helper for other config fields (project URL,
+ * API key). Source 'none' means the value is unset — don't add a suffix.
+ */
+function formatSourceSuffix(source) {
+    switch (source) {
+        case "env":
+            return "  (from env)";
+        case "config":
+            return "  (from config)";
+        case "none":
+            return "";
+    }
+}
+/**
+ * Lists the modes other than the active one, in stable order, so the
+ * banner can hint "Other modes: …" without re-listing the active one.
+ * Audit-only is a separate kill switch (config.auditOnly), but we still
+ * mention it here so first-time readers learn the full set.
+ */
+function otherModes(active) {
+    const all = ["observe", "enforce", "audit-only"];
+    return all.filter((m) => m !== active);
+}
 /**
  * If a user identity is already cached and the plugin is configured,
  * opportunistically run `permissions bootstrap` so the user lands in a
@@ -391,7 +433,7 @@ async function maybeAutoBootstrap(binName, harness) {
         return false;
     try {
         console.log("");
-        console.log("Bootstrapping permission tuples (cached user identity detected)...");
+        console.log("Bootstrapping permissions (cached user identity detected)...");
         const code = await runPermissionsCommand(binName, harness, ["bootstrap"]);
         return code === 0;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",