@ory/argus 0.6.1 → 0.7.0

package/assets/skills/ory-e2b-sandbox/SKILL.md

@@ -66,7 +66,7 @@ export const template = Template()
   // Sandbox runtime defaults. Per-tenant secrets (project URL, tokens, client
   // IDs) MUST be passed at Sandbox.create() time, never baked into the image.
   .setEnvs({
-    ORY_AUTH_GATE: "1",
+    ORY_USER_LOGIN: "1",
     ORY_PERMISSION_MODE: "observe",
     ORY_PERMISSION_NAMESPACE: "AgentTools",
     ORY_AGENT_DEBUG: "true",
@@ -198,7 +198,7 @@ await sbx.commands.run("{{BIN}} --version");  // sanity check
 ```
 
 Sandboxes are headless, so the user **must** pre-supply
-`ORY_USER_SESSION_TOKEN` or `ORY_USER_OAUTH2_TOKEN` — otherwise the auth gate's
+`ORY_USER_SESSION_TOKEN` or `ORY_USER_OAUTH2_TOKEN` — otherwise user login's
 PKCE browser flow has no target and hangs. See {{REF_AUTH_SETUP}} for the full
 env-var matrix.
 

package/assets/skills/permissions-onboarding/SKILL.md

@@ -92,9 +92,9 @@ out-of-band as they come into scope.
 Two common failure modes:
 
 1. **No user identity cached.** Bootstrap needs to know which subject
-   to grant tuples to. If the auth gate has never run (no PKCE login,
+   to grant tuples to. If user login has never run (no PKCE login,
    no `ORY_USER_SUBJECT_ID`), the command refuses. Run the harness once
-   with `ORY_AUTH_GATE=1` to cache a user token, or set
+   with `ORY_USER_LOGIN=1` to cache a user token, or set
    `ORY_USER_SUBJECT_ID=<id>` to target a known subject.
 2. **Credentials lack write scope on the permission namespace.** The
    command prints the full tuple list so you can apply them manually

package/dist/agent-auth.js

@@ -290,7 +290,7 @@ async function resolveAgentCredentials(options = {}) {
     }
     return {
         kind: "none",
-        reason: "No agent credentials configured. Run with a user session (ORY_AUTH_GATE=1) or set ORY_AGENT_API_KEY / ORY_AGENT_CLIENT_ID + ORY_AGENT_CLIENT_SECRET / ORY_AGENT_REGISTRATION_TOKEN.",
+        reason: "No agent credentials configured. Run with a user session (ORY_USER_LOGIN=1) or set ORY_AGENT_API_KEY / ORY_AGENT_CLIENT_ID + ORY_AGENT_CLIENT_SECRET / ORY_AGENT_REGISTRATION_TOKEN.",
         warnings,
     };
 }

package/dist/cli.js

@@ -146,7 +146,7 @@ function printEnvironment() {
     console.log("");
     console.log("Environment:");
     const vars = [
-        ["ORY_AUTH_GATE", process.env.ORY_AUTH_GATE, false],
+        ["ORY_USER_LOGIN", process.env.ORY_USER_LOGIN, false],
         [
             "ORY_AGENT_API_KEY",
             process.env.ORY_AGENT_API_KEY ? "(set)" : undefined,

package/dist/dev.js

@@ -403,9 +403,9 @@ function buildLocalOryEnv(gatewayUrl, seed) {
     return {
         ORY_PROJECT_URL: gatewayUrl,
         ORY_PERMISSION_NAMESPACE: seed.permissions.namespace,
-        // User gate — always on in local dev so the launcher demonstrates
+        // User login — always on in local dev so the launcher demonstrates
         // the interactive PKCE login UX end-to-end every session.
-        ORY_AUTH_GATE: "1",
+        ORY_USER_LOGIN: "1",
         // Agent identity — the harness self-registers via DCR on first run
         // using the user's bearer as the initial access token. No static
         // client_credentials are seeded; explicitly clear them so a leaking

package/dist/index.d.ts

@@ -4,7 +4,7 @@ export { Tracer, ActiveSpan, deriveTraceId, formatSpan, watchTraceFile, type Tra
 export { loadConfig, saveConfig, resolveConfig, mutateConfig, getConfigPath, getDataDir, getHarnessDataDir, type OryPluginConfig, type OryOAuth2Tokens, type OryUserCredentials, type OryAgentCredentialsBlock, type OryAgentDynamicCredentials, type PermissionMode, } from "./config.js";
 export { pkceLogin, refreshAccessToken, detectHeadless, generateCodeVerifier, sha256Base64Url, buildAuthorizeUrl, LOOPBACK_PORTS, DEFAULT_LOGIN_TIMEOUT_MS, type PkceLoginOptions, type PkceLoginOutcome, type PkceDeclineReason, } from "./auth.js";
 export { loadTokens, saveTokens, clearTokens, isExpired, refreshAndSave, tryAcquirePkceFlightLock, clearPkceFlightLock, waitForPeerTokens, waitForPeerTokensSync, TOKEN_EXPIRY_SKEW_SEC, type PkceFlightLock, } from "./auth-store.js";
-export { ensureUserAuthenticated, ensureAuthenticated, type AuthGateDecision, type AuthGateMode, type AuthGateOptions, } from "./auth-gate.js";
+export { ensureUserAuthenticated, ensureAuthenticated, type UserLoginDecision, type UserLoginMode, type UserLoginOptions, } from "./user-login.js";
 export { resolveAgentCredentials, ensureAgentIdentity, ensureSubAgentIdentity, fetchClientCredentialsToken, registerAgentClient, loadAgentDynamicCredentials, saveAgentDynamicCredentials, clearAgentDynamicCredentials, loadSubAgentDynamicCredentials, saveSubAgentDynamicCredentials, clearSubAgentDynamicCredentials, AGENT_TOKEN_EXPIRY_SKEW_SEC, type AgentCredentials, type AgentCredentialKind, type ResolveAgentCredentialsOptions, type EnsureAgentIdentityOptions, type RegisterAgentClientArgs, type SubAgentIdentity, type EnsureSubAgentIdentityOptions, } from "./agent-auth.js";
 export { type SessionInfo, type OAuth2TokenInfo, type PermissionCheck, type PermissionResult, type BatchPermissionResult, type OryError, type OryErrorCode, } from "./types.js";
 export { runConfigureCommand, runAgentCommand, printOryConfig, printEnvironment, printLogTail, printEnvHelp, printTraceTail, runWatchCommand, isTtyAvailable, promptOnTty, promptForProjectUrl, interactiveConfigPrompt, } from "./cli.js";

package/dist/index.js

@@ -42,9 +42,9 @@ Object.defineProperty(exports, "clearPkceFlightLock", { enumerable: true, get: f
 Object.defineProperty(exports, "waitForPeerTokens", { enumerable: true, get: function () { return auth_store_js_1.waitForPeerTokens; } });
 Object.defineProperty(exports, "waitForPeerTokensSync", { enumerable: true, get: function () { return auth_store_js_1.waitForPeerTokensSync; } });
 Object.defineProperty(exports, "TOKEN_EXPIRY_SKEW_SEC", { enumerable: true, get: function () { return auth_store_js_1.TOKEN_EXPIRY_SKEW_SEC; } });
-var auth_gate_js_1 = require("./auth-gate.js");
-Object.defineProperty(exports, "ensureUserAuthenticated", { enumerable: true, get: function () { return auth_gate_js_1.ensureUserAuthenticated; } });
-Object.defineProperty(exports, "ensureAuthenticated", { enumerable: true, get: function () { return auth_gate_js_1.ensureAuthenticated; } });
+var user_login_js_1 = require("./user-login.js");
+Object.defineProperty(exports, "ensureUserAuthenticated", { enumerable: true, get: function () { return user_login_js_1.ensureUserAuthenticated; } });
+Object.defineProperty(exports, "ensureAuthenticated", { enumerable: true, get: function () { return user_login_js_1.ensureAuthenticated; } });
 var agent_auth_js_1 = require("./agent-auth.js");
 Object.defineProperty(exports, "resolveAgentCredentials", { enumerable: true, get: function () { return agent_auth_js_1.resolveAgentCredentials; } });
 Object.defineProperty(exports, "ensureAgentIdentity", { enumerable: true, get: function () { return agent_auth_js_1.ensureAgentIdentity; } });

package/dist/local/manager.js

@@ -647,7 +647,7 @@ function printSeedResult(result) {
     console.log("To use with any Ory agent plugin, set these environment variables:");
     console.log("");
     console.log(`  export ORY_PROJECT_URL=${configs_js_1.GATEWAY_URL}`);
-    console.log(`  export ORY_AUTH_GATE=1`);
+    console.log(`  export ORY_USER_LOGIN=1`);
     console.log(`  export ORY_OAUTH2_CLIENT_ID=${result.user.client.clientId}`);
     console.log(`  export ORY_USER_SUBJECT_NAMESPACE=User`);
     console.log(`  export ORY_USER_SUBJECT_ID=${result.user.identity.id}`);

package/dist/permissions-cli.js

@@ -40,7 +40,7 @@ function resolveNamespace() {
  * Apply persisted user OAuth2 tokens (if any) to the client's user
  * principal so downstream subject resolution and tuple writes see a
  * concrete identity. Mirrors what `ensureUserAuthenticated` does on a
- * cache hit — but works whether or not `ORY_AUTH_GATE` is enabled.
+ * cache hit — but works whether or not `ORY_USER_LOGIN` is enabled.
  */
 function attachCachedUserPrincipal(client) {
     const tokens = (0, auth_store_js_1.loadTokens)();
@@ -151,7 +151,7 @@ async function runPermissionsStatus(binName, harness) {
     const subjectId = (0, subject_js_1.subjectLabel)(subject);
     if (subjectId === "agent:unknown") {
         console.log("No user identity resolved.");
-        console.log("Run the harness once (so the auth gate caches a token) or set");
+        console.log("Run the harness once (so user login caches a token) or set");
         console.log("ORY_USER_SUBJECT_ID to probe against a known subject.");
         return 0;
     }
@@ -235,7 +235,7 @@ async function runPermissionsBootstrap(binName, harness, args) {
         console.error("No user identity resolved — refusing to write permissions for an unknown subject.");
         console.error("");
         console.error("Either:");
-        console.error("  - run the harness once with ORY_AUTH_GATE=1 so a user token is cached, or");
+        console.error("  - run the harness once with ORY_USER_LOGIN=1 so a user token is cached, or");
         console.error("  - set ORY_USER_SUBJECT_ID=<id> to target a known subject.");
         return 1;
     }

package/dist/setup.js

@@ -374,7 +374,7 @@ Environment variables:
   ORY_PROJECT_URL       Your Ory project URL (required at runtime)
   ORY_AGENT_API_KEY     Agent API key / OAuth2 bearer (preferred name;
                         ORY_API_KEY is honored as a deprecated alias)
-  ORY_AUTH_GATE         Set to "1" to enable the interactive user login gate
+  ORY_USER_LOGIN        Set to "1" to enable the interactive user login
   ORY_PERMISSION_MODE   "observe" (default) or "enforce" — what to do on deny
   ORY_AGENT_DEBUG       Set to "true" for debug logging
   ORY_AGENT_LOG_FILE    Path to write debug logs
@@ -391,8 +391,8 @@ function printNextSteps(harnessName, uninstallCmd) {
     console.log("     export ORY_PROJECT_URL=https://your-project.projects.oryapis.com");
     console.log("     export ORY_AGENT_API_KEY=ory_pat_...");
     console.log("");
-    console.log("  2. Turn on the interactive user login gate (opt-in):");
-    console.log("     export ORY_AUTH_GATE=1");
+    console.log("  2. Turn on the interactive user login (opt-in):");
+    console.log("     export ORY_USER_LOGIN=1");
     console.log(`     Without this, ${harnessName} runs without a human Ory identity attached`);
     console.log("     to the session and permission checks fall back to a session:<id> subject.");
     console.log("");

package/dist/status-cli.d.ts

@@ -1,5 +1,5 @@
 /**
- * Render the "User identity" block. Shows the `ORY_AUTH_GATE` state and,
+ * Render the "User identity" block. Shows the `ORY_USER_LOGIN` state and,
  * when a PKCE token is cached, the resolved subject and expiry.
  */
 export declare function printUserIdentitySection(): void;

package/dist/status-cli.js

@@ -24,10 +24,10 @@ const cli_js_1 = require("./cli.js");
 function resolveNamespace() {
     return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
 }
-const AUTH_GATE_ENABLED = new Set(["1", "true", "yes", "on"]);
-function isAuthGateOn() {
-    const v = process.env.ORY_AUTH_GATE?.toLowerCase();
-    return !!v && AUTH_GATE_ENABLED.has(v);
+const USER_LOGIN_ENABLED = new Set(["1", "true", "yes", "on"]);
+function isUserLoginEnabled() {
+    const v = process.env.ORY_USER_LOGIN?.toLowerCase();
+    return !!v && USER_LOGIN_ENABLED.has(v);
 }
 /**
  * Format a relative duration like "4h 32m" or "12s" for a future deadline.
@@ -49,22 +49,22 @@ function formatExpiresIn(expiresAtSec, nowMs = Date.now()) {
     return `${remaining}s`;
 }
 /**
- * Render the "User identity" block. Shows the `ORY_AUTH_GATE` state and,
+ * Render the "User identity" block. Shows the `ORY_USER_LOGIN` state and,
  * when a PKCE token is cached, the resolved subject and expiry.
  */
 function printUserIdentitySection() {
-    const gateOn = isAuthGateOn();
+    const loginOn = isUserLoginEnabled();
     const tokens = (0, auth_store_js_1.loadTokens)();
     console.log("");
     console.log("User identity (interactive PKCE login):");
-    console.log(`  Gate:        ${gateOn ? "on (ORY_AUTH_GATE)" : "off (set ORY_AUTH_GATE=1 to enable)"}`);
+    console.log(`  Login:       ${loginOn ? "on (ORY_USER_LOGIN)" : "off (set ORY_USER_LOGIN=1 to enable)"}`);
     if (!tokens) {
         console.log("  Token cache: empty");
-        if (gateOn) {
+        if (loginOn) {
             console.log("  Subject:     (will resolve at next session start)");
         }
         else {
-            console.log("  Subject:     (gate disabled — no PKCE login will run)");
+            console.log("  Subject:     (login disabled — no PKCE flow will run)");
         }
         return;
     }
@@ -209,7 +209,7 @@ async function printPermissionsSection(binName, harness) {
     }
     const hasUser = !!process.env.ORY_USER_SUBJECT_ID || isUserTokenUsable();
     if (!hasUser) {
-        console.log(`  Coverage:    n/a (no cached user identity — run with ORY_AUTH_GATE=1 once,`);
+        console.log(`  Coverage:    n/a (no cached user identity — run with ORY_USER_LOGIN=1 once,`);
         console.log(`               or set ORY_USER_SUBJECT_ID to probe a known subject)`);
         return;
     }

package/dist/subject.d.ts

@@ -27,8 +27,8 @@ export type UserSubjectRef = {
     };
 };
 /**
- * Resolve the user subject for permission checks. Prefers the auth-gate's
- * `userPrincipal.subject`, falls back to `ORY_USER_SUBJECT_ID`, then the
+ * Resolve the user subject for permission checks. Prefers the user
+ * login's `userPrincipal.subject`, falls back to `ORY_USER_SUBJECT_ID`, then the
  * legacy `ORY_AGENT_SUBJECT_ID`, then the caller-supplied `fallback`
  * (typically `session:<id>`).
  *

package/dist/subject.js

@@ -21,8 +21,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveUserSubject = resolveUserSubject;
 exports.subjectLabel = subjectLabel;
 /**
- * Resolve the user subject for permission checks. Prefers the auth-gate's
- * `userPrincipal.subject`, falls back to `ORY_USER_SUBJECT_ID`, then the
+ * Resolve the user subject for permission checks. Prefers the user
+ * login's `userPrincipal.subject`, falls back to `ORY_USER_SUBJECT_ID`, then the
  * legacy `ORY_AGENT_SUBJECT_ID`, then the caller-supplied `fallback`
  * (typically `session:<id>`).
  *

package/dist/{auth-gate.d.ts → user-login.d.ts}

@@ -1,5 +1,5 @@
 /**
- * User authentication gate. Orchestrates the "first interaction must
+ * User login. Orchestrates the "first interaction must
  * authenticate the human user" requirement across all plugins:
  *
  *   1. Resolve config (env + ~/.config/ory-agent-plugins/config.json).
@@ -17,20 +17,20 @@
  * Every terminal path emits exactly one `user.auth` trace span so that
  * the audit trail is complete regardless of outcome.
  *
- * The whole gate is a no-op (mode `disabled`) unless the
- * `ORY_AUTH_GATE` env var is set to `1`/`true` — phased rollout.
+ * The whole flow is a no-op (mode `disabled`) unless the
+ * `ORY_USER_LOGIN` env var is set to `1`/`true`.
  *
- * This gate authenticates the *user* (the human at the keyboard). The
+ * This authenticates the *user* (the human at the keyboard). The
  * separate agent identity (the AI process making the calls) is resolved
  * non-interactively via env-configured machine credentials and is not
- * handled here — see `ensureAgentIdentity` (forthcoming).
+ * handled here — see `ensureAgentIdentity`.
  */
 import { OryAgentClient } from "./client.js";
 import { type OryOAuth2Tokens } from "./config.js";
 import { promptForProjectUrl } from "./cli.js";
 import { pkceLogin } from "./auth.js";
-export type AuthGateMode = "disabled" | "audit_only" | "env_token" | "ok" | "refreshed" | "skipped" | "declined" | "error";
-export interface AuthGateOptions {
+export type UserLoginMode = "disabled" | "audit_only" | "env_token" | "ok" | "refreshed" | "skipped" | "declined" | "error";
+export interface UserLoginOptions {
     /** Bin name used in user-facing prompts (e.g. "ory-claude"). */
     binName: string;
     /** Logical harness name (used by the tracer). */
@@ -47,11 +47,11 @@ export interface AuthGateOptions {
     /** Override the prompt-for-URL step (for tests). */
     promptForProjectUrlFn?: typeof promptForProjectUrl;
 }
-export interface AuthGateDecision {
+export interface UserLoginDecision {
     /** Whether the caller should let the session proceed. */
     proceed: boolean;
     /** Stable mode identifier for telemetry and tests. */
-    mode: AuthGateMode;
+    mode: UserLoginMode;
     /** Human-readable reason; safe to surface to the operator. */
     reason: string;
     /** Subject (sub claim) when authenticated. */
@@ -61,7 +61,7 @@ export interface AuthGateDecision {
  * The entry point that every plugin's session-start handler should call
  * to authenticate the human user. Always returns a decision; never throws.
  */
-export declare function ensureUserAuthenticated(client: OryAgentClient, options: AuthGateOptions): Promise<AuthGateDecision>;
+export declare function ensureUserAuthenticated(client: OryAgentClient, options: UserLoginOptions): Promise<UserLoginDecision>;
 /** Re-export so callers don't need to import auth.ts directly. */
 export type { OryOAuth2Tokens };
 /**

package/dist/{auth-gate.js → user-login.js}

@@ -1,6 +1,6 @@
 "use strict";
 /**
- * User authentication gate. Orchestrates the "first interaction must
+ * User login. Orchestrates the "first interaction must
  * authenticate the human user" requirement across all plugins:
  *
  *   1. Resolve config (env + ~/.config/ory-agent-plugins/config.json).
@@ -18,13 +18,13 @@
  * Every terminal path emits exactly one `user.auth` trace span so that
  * the audit trail is complete regardless of outcome.
  *
- * The whole gate is a no-op (mode `disabled`) unless the
- * `ORY_AUTH_GATE` env var is set to `1`/`true` — phased rollout.
+ * The whole flow is a no-op (mode `disabled`) unless the
+ * `ORY_USER_LOGIN` env var is set to `1`/`true`.
  *
- * This gate authenticates the *user* (the human at the keyboard). The
+ * This authenticates the *user* (the human at the keyboard). The
  * separate agent identity (the AI process making the calls) is resolved
  * non-interactively via env-configured machine credentials and is not
- * handled here — see `ensureAgentIdentity` (forthcoming).
+ * handled here — see `ensureAgentIdentity`.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ensureAuthenticated = void 0;
@@ -34,8 +34,8 @@ const cli_js_1 = require("./cli.js");
 const auth_store_js_1 = require("./auth-store.js");
 const auth_js_1 = require("./auth.js");
 const ENABLED_VALUES = new Set(["1", "true", "yes", "on"]);
-function isGateEnabled() {
-    const v = process.env.ORY_AUTH_GATE?.toLowerCase();
+function isUserLoginEnabled() {
+    const v = process.env.ORY_USER_LOGIN?.toLowerCase();
     return !!v && ENABLED_VALUES.has(v);
 }
 function clientId() {
@@ -63,17 +63,17 @@ function recordAuthSpan(client, decision) {
  * to authenticate the human user. Always returns a decision; never throws.
  */
 async function ensureUserAuthenticated(client, options) {
-    if (!isGateEnabled()) {
+    if (!isUserLoginEnabled()) {
         const decision = {
             proceed: true,
             mode: "disabled",
-            reason: "ORY_AUTH_GATE is not enabled",
+            reason: "ORY_USER_LOGIN is not enabled",
         };
         recordAuthSpan(client, decision);
         return decision;
     }
     try {
-        const decision = await runGate(client, options);
+        const decision = await runUserLogin(client, options);
         attachUserPrincipal(client, decision);
         recordAuthSpan(client, decision);
         return decision;
@@ -123,7 +123,7 @@ function attachUserPrincipal(client, decision) {
         });
     }
 }
-async function runGate(client, options) {
+async function runUserLogin(client, options) {
     const ttyCheck = options.isTtyAvailableFn ?? cli_js_1.isTtyAvailable;
     const tty = ttyCheck();
     let resolved = (0, config_js_1.resolveConfig)();
@@ -131,7 +131,7 @@ async function runGate(client, options) {
         return {
             proceed: true,
             mode: "audit_only",
-            reason: "Configured for audit-only mode; auth gate is a no-op",
+            reason: "Configured for audit-only mode; user login is a no-op",
         };
     }
     // 1. Project URL.
@@ -220,8 +220,8 @@ async function runGate(client, options) {
     // `-t`, `docker exec` without `-it`, IDE-integrated terminals) can still
     // complete sign-in by pasting the URL into any browser that can reach
     // 127.0.0.1. Truly unattended runs (CI=true) are short-circuited by
-    // `pkceLogin` itself via `detectHeadless`, and operators can bypass the
-    // gate entirely with `ORY_USER_SESSION_TOKEN` or `ORY_AUTH_GATE=0`.
+    // `pkceLogin` itself via `detectHeadless`, and operators can bypass
+    // login entirely with `ORY_USER_SESSION_TOKEN` or `ORY_USER_LOGIN=0`.
     // PKCE-flight lock so concurrent processes share a single browser flow.
     const lock = (0, auth_store_js_1.tryAcquirePkceFlightLock)();
     if (!lock) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",