@ory/argus 0.8.0 → 0.8.2

package/dist/client.js

@@ -658,10 +658,8 @@ function attachOtlpExporterFromEnv(client, harness) {
         return;
     client.tracer.setExporter(exporter);
     client.logger.info("otel.export.enabled", {
-        endpoint: process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT ??
-            process.env.OTEL_EXPORTER_OTLP_ENDPOINT ??
-            process.env.ORY_OTLP_ENDPOINT,
-        serviceName: process.env.OTEL_SERVICE_NAME ?? `ory-agent-plugin-${harness}`,
+        endpoint: exporter.endpoint,
+        serviceName: exporter.resource.attributes["service.name"],
     });
 }
 /**

package/dist/dev.js

@@ -322,16 +322,7 @@ async function runDevLauncher(config) {
             ? buildLocalOryEnv(localOry.gatewayUrl, localOry.seed)
             : { ORY_AGENT_SUBJECT_ID: sessionName }),
         ...(otelEndpoint
-            ? {
-                OTEL_EXPORTER_OTLP_ENDPOINT: otelEndpoint,
-                // ORY-prefixed alias for harnesses (e.g. Claude Code) that
-                // filter the env passed to hook subprocesses and drop
-                // OTEL_*-prefixed vars. The OTLP exporter reads this as a
-                // fallback so traces still reach Jaeger when OTEL_* is stripped.
-                ORY_OTLP_ENDPOINT: otelEndpoint,
-                OTEL_SERVICE_NAME: process.env.OTEL_SERVICE_NAME ??
-                    `ory-agent-plugin-${config.harnessName}`,
-            }
+            ? buildOtelEnv(otelEndpoint, config.harnessName)
             : {}),
     };
     const result = (0, node_child_process_1.spawnSync)(config.command, forwardedArgs, {
@@ -488,10 +479,53 @@ async function bootstrapLocalOry(localDir) {
         `${seed.permissions.tuples} permissions in '${namespace}' for ${seed.permissions.subject}.`);
     return { active: true, gatewayUrl, seed };
 }
+/**
+ * OTel env vars the dev launcher propagates into the harness child. Each
+ * entry pairs the standard `OTEL_*` name with its `ORY_OTLP_*` alias; the
+ * alias is set in lockstep so harnesses (notably Claude Code) that sanitize
+ * `OTEL_*` out of the hook-subprocess env still receive the configuration.
+ *
+ * Keep this list in sync with `ORY_ENV_ALIAS` in
+ * `packages/core/src/otel/otlp.ts` — the exporter consults the same aliases
+ * on the read side.
+ */
+const OTEL_FORWARDED_VARS = [
+    ["OTEL_EXPORTER_OTLP_ENDPOINT", "ORY_OTLP_ENDPOINT"],
+    ["OTEL_EXPORTER_OTLP_TRACES_ENDPOINT", "ORY_OTLP_TRACES_ENDPOINT"],
+    ["OTEL_EXPORTER_OTLP_HEADERS", "ORY_OTLP_HEADERS"],
+    ["OTEL_EXPORTER_OTLP_TRACES_HEADERS", "ORY_OTLP_TRACES_HEADERS"],
+    ["OTEL_EXPORTER_OTLP_PROTOCOL", "ORY_OTLP_PROTOCOL"],
+    ["OTEL_EXPORTER_OTLP_TRACES_PROTOCOL", "ORY_OTLP_TRACES_PROTOCOL"],
+    ["OTEL_SERVICE_NAME", "ORY_OTLP_SERVICE_NAME"],
+    ["OTEL_RESOURCE_ATTRIBUTES", "ORY_OTLP_RESOURCE_ATTRIBUTES"],
+];
+/**
+ * Compose the OTLP env block for the harness child process. The resolved
+ * endpoint is always written under both `OTEL_EXPORTER_OTLP_ENDPOINT` and
+ * `ORY_OTLP_ENDPOINT`; every other OTel knob inherited from the parent
+ * shell (and `OTEL_SERVICE_NAME`, which we default when unset) is mirrored
+ * to its `ORY_OTLP_*` alias on the way through.
+ */
+function buildOtelEnv(endpoint, harnessName) {
+    const out = {};
+    const defaults = {
+        OTEL_EXPORTER_OTLP_ENDPOINT: endpoint,
+        OTEL_SERVICE_NAME: process.env.OTEL_SERVICE_NAME ?? `ory-agent-plugin-${harnessName}`,
+    };
+    for (const [standardName, aliasName] of OTEL_FORWARDED_VARS) {
+        const value = defaults[standardName] ?? process.env[standardName];
+        if (!value)
+            continue;
+        out[standardName] = value;
+        out[aliasName] = value;
+    }
+    return out;
+}
 /**
  * Determine the OTLP endpoint for the dev launch:
  *   1. Honor OTEL_EXPORTER_OTLP_ENDPOINT / OTEL_EXPORTER_OTLP_TRACES_ENDPOINT
- *      from the parent shell (Honeycomb, custom collector, etc.).
+ *      (or their ORY_OTLP_* aliases) from the parent shell (Honeycomb,
+ *      custom collector, etc.).
  *   2. Otherwise auto-launch a local Jaeger container and use it. If Jaeger
  *      is already reachable (from `local up` or a prior dev launch), reuse
  *      it without spawning another container.
@@ -500,7 +534,9 @@ async function bootstrapLocalOry(localDir) {
  */
 async function resolveOtelEndpoint() {
     const fromEnv = process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT ??
-        process.env.OTEL_EXPORTER_OTLP_ENDPOINT;
+        process.env.OTEL_EXPORTER_OTLP_ENDPOINT ??
+        process.env.ORY_OTLP_TRACES_ENDPOINT ??
+        process.env.ORY_OTLP_ENDPOINT;
     if (fromEnv)
         return fromEnv;
     console.log("[ory-dev] Ensuring Jaeger is running for trace viewing...");

package/dist/index.d.ts

@@ -15,8 +15,9 @@ export { runDevLauncher, type DevLauncherConfig, type InstallContext, } from "./
 export { renderOrySkills, renderOryCommands, commandToSkill, commandToToml, commandToFrontmatterMarkdown, commandToPlainMarkdown, toSkillMarkdown, writeSkillTree, removeSkillDirs, ORY_SKILL_NAMES, ORY_COMMAND_SKILL_NAMES, ORY_COMMAND_SLUGS, type RenderedSkill, type RenderedCommand, type RenderProfileOptions, } from "./skills.js";
 export { runLocalCommand, ensureDevJaeger, stopDevJaeger, DEV_JAEGER_CONTAINER, type EnsureDevJaegerResult, type StopDevJaegerResult, } from "./local/index.js";
 export { runRegistryCommand } from "./registry/index.js";
-export { checkAndDecide, applyPermissionMode, type PermissionDecision, type ModeDecision, type DecisionSpanAttributes, type CheckAndDecideOptions, type ApplyPermissionModeContext, } from "./permissions.js";
-export { HARNESS_TOOL_CATALOG, KNOWN_HARNESSES, ALL_TOOLS, getToolCatalog, type KnownHarness, } from "./tool-catalog.js";
+export { checkAndDecide, applyPermissionMode, gateToolCall, type PermissionDecision, type ModeDecision, type DecisionSpanAttributes, type CheckAndDecideOptions, type ApplyPermissionModeContext, type GateToolCallArgs, type ToolGateOutcome, } from "./permissions.js";
+export { HARNESS_TOOL_CATALOG, KNOWN_HARNESSES, ALL_TOOLS, getToolCatalog, INTERACTIVE_TOOL_CATALOG, getInteractiveToolCatalog, isInteractiveTool, type KnownHarness, } from "./tool-catalog.js";
+export { classifyLifecycle, isUserFacingPhase, isToolExecutionPhase, HARNESS_LIFECYCLE_MAP, USER_FACING_PHASES, TOOL_EXECUTION_PHASES, type LifecyclePhase, } from "./lifecycle.js";
 export { parseClaudeCodeMcpTool, parseGeminiMcpTool, parseMcpToolGeneric, checkMcpPermission, type McpToolIdentifier, type McpPermissionCheckOptions, type McpPermissionResult, } from "./mcp.js";
 export { resolveUserSubject, subjectLabel, type UserSubjectRef, } from "./subject.js";
 export { formatDenialMessage, formatDenialSummary, formatAlertMessage, formatAlertSummary, alertAttributes, OryDenialError, type DenialContext, type AlertAttributes, } from "./denial.js";

package/dist/index.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.printOryConfig = exports.runAgentCommand = exports.runConfigureCommand = exports.AGENT_TOKEN_EXPIRY_SKEW_SEC = exports.clearSubAgentDynamicCredentials = exports.saveSubAgentDynamicCredentials = exports.loadSubAgentDynamicCredentials = exports.clearAgentDynamicCredentials = exports.saveAgentDynamicCredentials = exports.loadAgentDynamicCredentials = exports.registerAgentClient = exports.fetchClientCredentialsToken = exports.ensureSubAgentIdentity = exports.ensureAgentIdentity = exports.resolveAgentCredentials = exports.ensureAuthenticated = exports.ensureUserAuthenticated = exports.TOKEN_EXPIRY_SKEW_SEC = exports.waitForPeerTokensSync = exports.waitForPeerTokens = exports.clearPkceFlightLock = exports.tryAcquirePkceFlightLock = exports.refreshAndSave = exports.isExpired = exports.clearTokens = exports.saveTokens = exports.loadTokens = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.LOOPBACK_PORTS = exports.buildAuthorizeUrl = exports.sha256Base64Url = exports.generateCodeVerifier = exports.detectHeadless = exports.refreshAccessToken = exports.pkceLogin = exports.getHarnessDataDir = exports.getDataDir = exports.getConfigPath = exports.mutateConfig = exports.resolveConfig = exports.saveConfig = exports.loadConfig = exports.watchTraceFile = exports.formatSpan = exports.deriveTraceId = exports.ActiveSpan = exports.Tracer = exports.redactLogData = exports.DebugLogger = exports.OryAgentClient = void 0;
 exports.runLocalCommand = exports.ORY_COMMAND_SLUGS = exports.ORY_COMMAND_SKILL_NAMES = exports.ORY_SKILL_NAMES = exports.removeSkillDirs = exports.writeSkillTree = exports.toSkillMarkdown = exports.commandToPlainMarkdown = exports.commandToFrontmatterMarkdown = exports.commandToToml = exports.commandToSkill = exports.renderOryCommands = exports.renderOrySkills = exports.runDevLauncher = exports.unregisterPlugin = exports.registerPlugin = exports.removeMcpServer = exports.mergeMcpServer = exports.mcpServerEntry = exports.resolveMcpServerCommand = exports.printNextSteps = exports.printSetupHelp = exports.removeFlatHooks = exports.mergeFlatHooks = exports.flatHookEntry = exports.removeMatcherHooks = exports.mergeMatcherHooks = exports.matcherHookEntry = exports.resolveHookCommand = exports.isOryHookCommand = exports.writeJsonFile = exports.readJsonFile = exports.parseSetupArgs = exports.printPermissionsSection = exports.printAgentIdentitySection = exports.printUserIdentitySection = exports.runStatusCommand = exports.printPermissionsOnboardingHelp = exports.maybeAutoBootstrap = exports.isUserIdentityCached = exports.runPermissionsCommand = exports.interactiveConfigPrompt = exports.promptForProjectUrl = exports.promptOnTty = exports.isTtyAvailable = exports.runWatchCommand = exports.printTraceTail = exports.printEnvHelp = exports.printLogTail = exports.printEnvironment = void 0;
-exports.parseKeyValueList = exports.otlpExporterFromEnv = exports.OtlpExporter = exports.summarizeToolOutput = exports.summarizeToolInput = exports.OryDenialError = exports.alertAttributes = exports.formatAlertSummary = exports.formatAlertMessage = exports.formatDenialSummary = exports.formatDenialMessage = exports.subjectLabel = exports.resolveUserSubject = exports.checkMcpPermission = exports.parseMcpToolGeneric = exports.parseGeminiMcpTool = exports.parseClaudeCodeMcpTool = exports.getToolCatalog = exports.ALL_TOOLS = exports.KNOWN_HARNESSES = exports.HARNESS_TOOL_CATALOG = exports.applyPermissionMode = exports.checkAndDecide = exports.runRegistryCommand = exports.DEV_JAEGER_CONTAINER = exports.stopDevJaeger = exports.ensureDevJaeger = void 0;
+exports.parseKeyValueList = exports.otlpExporterFromEnv = exports.OtlpExporter = exports.summarizeToolOutput = exports.summarizeToolInput = exports.OryDenialError = exports.alertAttributes = exports.formatAlertSummary = exports.formatAlertMessage = exports.formatDenialSummary = exports.formatDenialMessage = exports.subjectLabel = exports.resolveUserSubject = exports.checkMcpPermission = exports.parseMcpToolGeneric = exports.parseGeminiMcpTool = exports.parseClaudeCodeMcpTool = exports.TOOL_EXECUTION_PHASES = exports.USER_FACING_PHASES = exports.HARNESS_LIFECYCLE_MAP = exports.isToolExecutionPhase = exports.isUserFacingPhase = exports.classifyLifecycle = exports.isInteractiveTool = exports.getInteractiveToolCatalog = exports.INTERACTIVE_TOOL_CATALOG = exports.getToolCatalog = exports.ALL_TOOLS = exports.KNOWN_HARNESSES = exports.HARNESS_TOOL_CATALOG = exports.gateToolCall = exports.applyPermissionMode = exports.checkAndDecide = exports.runRegistryCommand = exports.DEV_JAEGER_CONTAINER = exports.stopDevJaeger = exports.ensureDevJaeger = void 0;
 var client_js_1 = require("./client.js");
 Object.defineProperty(exports, "OryAgentClient", { enumerable: true, get: function () { return client_js_1.OryAgentClient; } });
 var logger_js_1 = require("./logger.js");
@@ -126,11 +126,22 @@ Object.defineProperty(exports, "runRegistryCommand", { enumerable: true, get: fu
 var permissions_js_1 = require("./permissions.js");
 Object.defineProperty(exports, "checkAndDecide", { enumerable: true, get: function () { return permissions_js_1.checkAndDecide; } });
 Object.defineProperty(exports, "applyPermissionMode", { enumerable: true, get: function () { return permissions_js_1.applyPermissionMode; } });
+Object.defineProperty(exports, "gateToolCall", { enumerable: true, get: function () { return permissions_js_1.gateToolCall; } });
 var tool_catalog_js_1 = require("./tool-catalog.js");
 Object.defineProperty(exports, "HARNESS_TOOL_CATALOG", { enumerable: true, get: function () { return tool_catalog_js_1.HARNESS_TOOL_CATALOG; } });
 Object.defineProperty(exports, "KNOWN_HARNESSES", { enumerable: true, get: function () { return tool_catalog_js_1.KNOWN_HARNESSES; } });
 Object.defineProperty(exports, "ALL_TOOLS", { enumerable: true, get: function () { return tool_catalog_js_1.ALL_TOOLS; } });
 Object.defineProperty(exports, "getToolCatalog", { enumerable: true, get: function () { return tool_catalog_js_1.getToolCatalog; } });
+Object.defineProperty(exports, "INTERACTIVE_TOOL_CATALOG", { enumerable: true, get: function () { return tool_catalog_js_1.INTERACTIVE_TOOL_CATALOG; } });
+Object.defineProperty(exports, "getInteractiveToolCatalog", { enumerable: true, get: function () { return tool_catalog_js_1.getInteractiveToolCatalog; } });
+Object.defineProperty(exports, "isInteractiveTool", { enumerable: true, get: function () { return tool_catalog_js_1.isInteractiveTool; } });
+var lifecycle_js_1 = require("./lifecycle.js");
+Object.defineProperty(exports, "classifyLifecycle", { enumerable: true, get: function () { return lifecycle_js_1.classifyLifecycle; } });
+Object.defineProperty(exports, "isUserFacingPhase", { enumerable: true, get: function () { return lifecycle_js_1.isUserFacingPhase; } });
+Object.defineProperty(exports, "isToolExecutionPhase", { enumerable: true, get: function () { return lifecycle_js_1.isToolExecutionPhase; } });
+Object.defineProperty(exports, "HARNESS_LIFECYCLE_MAP", { enumerable: true, get: function () { return lifecycle_js_1.HARNESS_LIFECYCLE_MAP; } });
+Object.defineProperty(exports, "USER_FACING_PHASES", { enumerable: true, get: function () { return lifecycle_js_1.USER_FACING_PHASES; } });
+Object.defineProperty(exports, "TOOL_EXECUTION_PHASES", { enumerable: true, get: function () { return lifecycle_js_1.TOOL_EXECUTION_PHASES; } });
 var mcp_js_1 = require("./mcp.js");
 Object.defineProperty(exports, "parseClaudeCodeMcpTool", { enumerable: true, get: function () { return mcp_js_1.parseClaudeCodeMcpTool; } });
 Object.defineProperty(exports, "parseGeminiMcpTool", { enumerable: true, get: function () { return mcp_js_1.parseGeminiMcpTool; } });

package/dist/lifecycle.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Canonical lifecycle vocabulary for harness plugins.
+ *
+ * Each harness exposes a different set of hook event names (Claude Code's
+ * `PreToolUse`, Gemini's `BeforeTool`, OpenCode's `tool.execute.before`,
+ * …). Mapping them onto a shared phase set lets the plugin code reason
+ * about *what is happening* without first remembering *which harness
+ * we're in*. Spans, logs, docs, and tests all reference the same set of
+ * phases.
+ *
+ * Phases split into three buckets:
+ *
+ * - **Session / agent lifecycle.** `session.start`, `session.stop`,
+ *   `compaction`. The session begins or ends, or the harness compacts
+ *   context. Plugins authenticate here (start) and may flush state
+ *   (stop).
+ *
+ * - **User-facing interactions.** `user.prompt`, `user.interaction`,
+ *   `permission.ask`. The harness is communicating with the human:
+ *   they typed a prompt, the harness is surfacing a confirmation,
+ *   the harness is asking whether to allow a tool. These are *traced*
+ *   but never gated by a tool permission check — the user is the
+ *   final decision-maker. (`permission.ask` does consult Ory to
+ *   inform the harness's UI, but the call is advisory.)
+ *
+ * - **Tool execution.** `tool.before`, `tool.after`, `tool.failure`,
+ *   `subagent.start`, `subagent.stop`. The agent is reaching into an
+ *   external system (or spawning a child agent that will). These are
+ *   the only phases that run a true `use` permission gate.
+ *
+ * `passthrough` is the explicit "nothing to do here" bucket — the
+ * harness fired an event we don't model, and we record an audit span
+ * and return.
+ */
+export type LifecyclePhase = "session.start" | "session.stop" | "user.prompt" | "user.interaction" | "permission.ask" | "tool.before" | "tool.after" | "tool.failure" | "subagent.start" | "subagent.stop" | "compaction" | "passthrough";
+/**
+ * Per-harness map from the harness's native event name to a canonical
+ * {@link LifecyclePhase}. Event names that don't appear here resolve to
+ * `passthrough` via {@link classifyLifecycle}.
+ */
+export declare const HARNESS_LIFECYCLE_MAP: Record<string, Record<string, LifecyclePhase>>;
+/**
+ * Resolve a harness event name to its canonical {@link LifecyclePhase}.
+ * Unknown harnesses or unknown event names both yield `passthrough`.
+ */
+export declare function classifyLifecycle(harness: string, event: string): LifecyclePhase;
+/**
+ * Phases that surface to the human (prompts, confirmations, notifications,
+ * advisory permission asks). Tool-call permission gates must never fire
+ * on these — the user is the decision-maker.
+ */
+export declare const USER_FACING_PHASES: ReadonlySet<LifecyclePhase>;
+/**
+ * Phases that represent actual tool execution against external systems.
+ * Only these run a real `use` permission check.
+ */
+export declare const TOOL_EXECUTION_PHASES: ReadonlySet<LifecyclePhase>;
+export declare function isUserFacingPhase(phase: LifecyclePhase): boolean;
+export declare function isToolExecutionPhase(phase: LifecyclePhase): boolean;

package/dist/lifecycle.js

@@ -0,0 +1,123 @@
+"use strict";
+/**
+ * Canonical lifecycle vocabulary for harness plugins.
+ *
+ * Each harness exposes a different set of hook event names (Claude Code's
+ * `PreToolUse`, Gemini's `BeforeTool`, OpenCode's `tool.execute.before`,
+ * …). Mapping them onto a shared phase set lets the plugin code reason
+ * about *what is happening* without first remembering *which harness
+ * we're in*. Spans, logs, docs, and tests all reference the same set of
+ * phases.
+ *
+ * Phases split into three buckets:
+ *
+ * - **Session / agent lifecycle.** `session.start`, `session.stop`,
+ *   `compaction`. The session begins or ends, or the harness compacts
+ *   context. Plugins authenticate here (start) and may flush state
+ *   (stop).
+ *
+ * - **User-facing interactions.** `user.prompt`, `user.interaction`,
+ *   `permission.ask`. The harness is communicating with the human:
+ *   they typed a prompt, the harness is surfacing a confirmation,
+ *   the harness is asking whether to allow a tool. These are *traced*
+ *   but never gated by a tool permission check — the user is the
+ *   final decision-maker. (`permission.ask` does consult Ory to
+ *   inform the harness's UI, but the call is advisory.)
+ *
+ * - **Tool execution.** `tool.before`, `tool.after`, `tool.failure`,
+ *   `subagent.start`, `subagent.stop`. The agent is reaching into an
+ *   external system (or spawning a child agent that will). These are
+ *   the only phases that run a true `use` permission gate.
+ *
+ * `passthrough` is the explicit "nothing to do here" bucket — the
+ * harness fired an event we don't model, and we record an audit span
+ * and return.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TOOL_EXECUTION_PHASES = exports.USER_FACING_PHASES = exports.HARNESS_LIFECYCLE_MAP = void 0;
+exports.classifyLifecycle = classifyLifecycle;
+exports.isUserFacingPhase = isUserFacingPhase;
+exports.isToolExecutionPhase = isToolExecutionPhase;
+/**
+ * Per-harness map from the harness's native event name to a canonical
+ * {@link LifecyclePhase}. Event names that don't appear here resolve to
+ * `passthrough` via {@link classifyLifecycle}.
+ */
+exports.HARNESS_LIFECYCLE_MAP = {
+    "claude-code": {
+        SessionStart: "session.start",
+        SessionEnd: "session.stop",
+        PreToolUse: "tool.before",
+        PostToolUse: "tool.after",
+        PostToolUseFailure: "tool.failure",
+        PermissionRequest: "permission.ask",
+        UserPromptSubmit: "user.prompt",
+        SubagentStart: "subagent.start",
+        SubagentStop: "subagent.stop",
+    },
+    codex: {
+        SessionStart: "session.start",
+        Stop: "session.stop",
+        PreToolUse: "tool.before",
+        PostToolUse: "tool.after",
+        PermissionRequest: "permission.ask",
+        UserPromptSubmit: "user.prompt",
+    },
+    "gemini-cli": {
+        SessionStart: "session.start",
+        SessionEnd: "session.stop",
+        BeforeTool: "tool.before",
+        AfterTool: "tool.after",
+        BeforeToolSelection: "tool.before",
+        Notification: "user.interaction",
+        PreCompress: "compaction",
+    },
+    openclaw: {
+        session_start: "session.start",
+        before_agent_run: "user.prompt",
+        before_tool_call: "tool.before",
+        after_tool_call: "tool.after",
+        subagent_spawning: "subagent.start",
+        subagent_spawned: "subagent.start",
+        subagent_ended: "subagent.stop",
+    },
+    opencode: {
+        config: "session.start",
+        "chat.message": "user.prompt",
+        "permission.ask": "permission.ask",
+        "tool.execute.before": "tool.before",
+        "tool.execute.after": "tool.after",
+    },
+};
+/**
+ * Resolve a harness event name to its canonical {@link LifecyclePhase}.
+ * Unknown harnesses or unknown event names both yield `passthrough`.
+ */
+function classifyLifecycle(harness, event) {
+    return exports.HARNESS_LIFECYCLE_MAP[harness]?.[event] ?? "passthrough";
+}
+/**
+ * Phases that surface to the human (prompts, confirmations, notifications,
+ * advisory permission asks). Tool-call permission gates must never fire
+ * on these — the user is the decision-maker.
+ */
+exports.USER_FACING_PHASES = new Set([
+    "user.prompt",
+    "user.interaction",
+    "permission.ask",
+]);
+/**
+ * Phases that represent actual tool execution against external systems.
+ * Only these run a real `use` permission check.
+ */
+exports.TOOL_EXECUTION_PHASES = new Set([
+    "tool.before",
+    "tool.after",
+    "tool.failure",
+]);
+function isUserFacingPhase(phase) {
+    return exports.USER_FACING_PHASES.has(phase);
+}
+function isToolExecutionPhase(phase) {
+    return exports.TOOL_EXECUTION_PHASES.has(phase);
+}

package/dist/otel/otlp.d.ts

@@ -7,16 +7,22 @@
  * is converted to a `ReadableSpan` shape and handed to the SDK exporter,
  * which serializes (JSON or protobuf) and POSTs to an OTLP HTTP endpoint.
  *
- * Standard OTel env vars consumed by `otlpExporterFromEnv()`:
- *   - OTEL_EXPORTER_OTLP_ENDPOINT          base URL (we append /v1/traces)
- *   - OTEL_EXPORTER_OTLP_TRACES_ENDPOINT   full traces URL (overrides base)
- *   - OTEL_EXPORTER_OTLP_HEADERS           `k=v,k=v` pairs
- *   - OTEL_EXPORTER_OTLP_TRACES_HEADERS    traces-specific headers
- *   - OTEL_EXPORTER_OTLP_PROTOCOL          `http/protobuf` (default) or `http/json`
- *   - OTEL_EXPORTER_OTLP_TRACES_PROTOCOL   traces-specific protocol
- *   - OTEL_SERVICE_NAME                    service.name resource attribute
- *   - OTEL_RESOURCE_ATTRIBUTES             additional resource attributes
- *   - ORY_OTLP_ENDPOINT                    Ory-prefixed alias for the dev launcher
+ * Standard OTel env vars consumed by `otlpExporterFromEnv()`. Each one has
+ * an `ORY_OTLP_*`-prefixed alias that is consulted as a fallback when the
+ * standard name is unset. Some harnesses (notably Claude Code) sanitize the
+ * env passed to hook subprocesses and drop every `OTEL_*` var, so the dev
+ * launcher mirrors each setting under the Ory prefix to survive the strip.
+ *
+ *   Standard name                          Ory-prefixed fallback
+ *   ─────────────────────────────────────  ─────────────────────────────────
+ *   OTEL_EXPORTER_OTLP_ENDPOINT            ORY_OTLP_ENDPOINT
+ *   OTEL_EXPORTER_OTLP_TRACES_ENDPOINT     ORY_OTLP_TRACES_ENDPOINT
+ *   OTEL_EXPORTER_OTLP_HEADERS             ORY_OTLP_HEADERS
+ *   OTEL_EXPORTER_OTLP_TRACES_HEADERS      ORY_OTLP_TRACES_HEADERS
+ *   OTEL_EXPORTER_OTLP_PROTOCOL            ORY_OTLP_PROTOCOL
+ *   OTEL_EXPORTER_OTLP_TRACES_PROTOCOL     ORY_OTLP_TRACES_PROTOCOL
+ *   OTEL_SERVICE_NAME                      ORY_OTLP_SERVICE_NAME
+ *   OTEL_RESOURCE_ATTRIBUTES               ORY_OTLP_RESOURCE_ATTRIBUTES
  *
  * Failures are swallowed (callers receive a resolved Promise) so trace
  * export can never break the agent session. Transport errors surface
@@ -80,6 +86,12 @@ export declare function otlpExporterFromEnv(opts: {
     onError?: (err: unknown) => void;
     env?: NodeJS.ProcessEnv;
 }): OtlpExporter | undefined;
+/**
+ * Read an OTel env var, falling back to its `ORY_OTLP_*`-prefixed alias when
+ * the standard name is unset. Trims whitespace and treats empty strings as
+ * absent so a propagated-but-blank var doesn't shadow the alias.
+ */
+export declare function readEnvWithAlias(env: NodeJS.ProcessEnv, standardName: string): string | undefined;
 /**
  * Parse the OTel `k=v,k2=v2` env-var format. Values may be URL-encoded.
  */

package/dist/otel/otlp.js

@@ -8,16 +8,22 @@
  * is converted to a `ReadableSpan` shape and handed to the SDK exporter,
  * which serializes (JSON or protobuf) and POSTs to an OTLP HTTP endpoint.
  *
- * Standard OTel env vars consumed by `otlpExporterFromEnv()`:
- *   - OTEL_EXPORTER_OTLP_ENDPOINT          base URL (we append /v1/traces)
- *   - OTEL_EXPORTER_OTLP_TRACES_ENDPOINT   full traces URL (overrides base)
- *   - OTEL_EXPORTER_OTLP_HEADERS           `k=v,k=v` pairs
- *   - OTEL_EXPORTER_OTLP_TRACES_HEADERS    traces-specific headers
- *   - OTEL_EXPORTER_OTLP_PROTOCOL          `http/protobuf` (default) or `http/json`
- *   - OTEL_EXPORTER_OTLP_TRACES_PROTOCOL   traces-specific protocol
- *   - OTEL_SERVICE_NAME                    service.name resource attribute
- *   - OTEL_RESOURCE_ATTRIBUTES             additional resource attributes
- *   - ORY_OTLP_ENDPOINT                    Ory-prefixed alias for the dev launcher
+ * Standard OTel env vars consumed by `otlpExporterFromEnv()`. Each one has
+ * an `ORY_OTLP_*`-prefixed alias that is consulted as a fallback when the
+ * standard name is unset. Some harnesses (notably Claude Code) sanitize the
+ * env passed to hook subprocesses and drop every `OTEL_*` var, so the dev
+ * launcher mirrors each setting under the Ory prefix to survive the strip.
+ *
+ *   Standard name                          Ory-prefixed fallback
+ *   ─────────────────────────────────────  ─────────────────────────────────
+ *   OTEL_EXPORTER_OTLP_ENDPOINT            ORY_OTLP_ENDPOINT
+ *   OTEL_EXPORTER_OTLP_TRACES_ENDPOINT     ORY_OTLP_TRACES_ENDPOINT
+ *   OTEL_EXPORTER_OTLP_HEADERS             ORY_OTLP_HEADERS
+ *   OTEL_EXPORTER_OTLP_TRACES_HEADERS      ORY_OTLP_TRACES_HEADERS
+ *   OTEL_EXPORTER_OTLP_PROTOCOL            ORY_OTLP_PROTOCOL
+ *   OTEL_EXPORTER_OTLP_TRACES_PROTOCOL     ORY_OTLP_TRACES_PROTOCOL
+ *   OTEL_SERVICE_NAME                      ORY_OTLP_SERVICE_NAME
+ *   OTEL_RESOURCE_ATTRIBUTES               ORY_OTLP_RESOURCE_ATTRIBUTES
  *
  * Failures are swallowed (callers receive a resolved Promise) so trace
  * export can never break the agent session. Transport errors surface
@@ -26,6 +32,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OtlpExporter = void 0;
 exports.otlpExporterFromEnv = otlpExporterFromEnv;
+exports.readEnvWithAlias = readEnvWithAlias;
 exports.parseKeyValueList = parseKeyValueList;
 exports.toReadableSpan = toReadableSpan;
 const api_1 = require("@opentelemetry/api");
@@ -124,9 +131,10 @@ function otlpExporterFromEnv(opts) {
     const protocol = resolveProtocol(env, opts.onError);
     if (!protocol)
         return undefined;
-    const headers = mergeHeaders(parseKeyValueList(env.OTEL_EXPORTER_OTLP_HEADERS), parseKeyValueList(env.OTEL_EXPORTER_OTLP_TRACES_HEADERS));
+    const headers = mergeHeaders(parseKeyValueList(readEnvWithAlias(env, "OTEL_EXPORTER_OTLP_HEADERS")), parseKeyValueList(readEnvWithAlias(env, "OTEL_EXPORTER_OTLP_TRACES_HEADERS")));
     const resource = {
-        "service.name": env.OTEL_SERVICE_NAME ?? `ory-agent-plugin-${opts.harness}`,
+        "service.name": readEnvWithAlias(env, "OTEL_SERVICE_NAME") ??
+            `ory-agent-plugin-${opts.harness}`,
         "service.namespace": "ory.agent_plugins",
         "ory.harness": opts.harness,
         "process.pid": process.pid,
@@ -145,7 +153,7 @@ function otlpExporterFromEnv(opts) {
         resource["ory.git.branch"] = opts.gitBranch;
     if (opts.gitCommit)
         resource["ory.git.commit"] = opts.gitCommit;
-    for (const [k, v] of Object.entries(parseKeyValueList(env.OTEL_RESOURCE_ATTRIBUTES))) {
+    for (const [k, v] of Object.entries(parseKeyValueList(readEnvWithAlias(env, "OTEL_RESOURCE_ATTRIBUTES")))) {
         resource[k] = v;
     }
     return new OtlpExporter({
@@ -157,22 +165,20 @@ function otlpExporterFromEnv(opts) {
     });
 }
 function resolveEndpoint(env) {
-    const tracesUrl = env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT?.trim();
+    // ORY_OTLP_*-prefixed aliases survive harnesses (e.g. Claude Code) that
+    // sanitize the env passed to hook subprocesses and drop OTEL_*-prefixed
+    // vars. The standard OTel name still wins when present.
+    const tracesUrl = readEnvWithAlias(env, "OTEL_EXPORTER_OTLP_TRACES_ENDPOINT");
     if (tracesUrl)
         return tracesUrl;
-    // ORY_OTLP_ENDPOINT is an Ory-prefixed alias used by the dev launcher.
-    // Some harnesses (e.g. Claude Code) filter the env they pass to hook
-    // subprocesses and drop OTEL_*-prefixed vars, but allow ORY_*-prefixed
-    // ones through. The alias lets the launcher hand the OTLP endpoint to
-    // the hook process without depending on OTEL_* propagation.
-    const base = env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim() || env.ORY_OTLP_ENDPOINT?.trim();
+    const base = readEnvWithAlias(env, "OTEL_EXPORTER_OTLP_ENDPOINT");
     if (!base)
         return undefined;
     return base.replace(/\/+$/, "") + TRACES_PATH;
 }
 function resolveProtocol(env, onError) {
-    const raw = (env.OTEL_EXPORTER_OTLP_TRACES_PROTOCOL ??
-        env.OTEL_EXPORTER_OTLP_PROTOCOL ??
+    const raw = (readEnvWithAlias(env, "OTEL_EXPORTER_OTLP_TRACES_PROTOCOL") ??
+        readEnvWithAlias(env, "OTEL_EXPORTER_OTLP_PROTOCOL") ??
         "http/protobuf")
         .trim()
         .toLowerCase();
@@ -181,6 +187,37 @@ function resolveProtocol(env, onError) {
     onError?.(new Error(`OTEL_EXPORTER_OTLP_PROTOCOL=${raw} not supported (only http/protobuf and http/json). Skipping OTel export.`));
     return undefined;
 }
+/**
+ * Standard OTel env var name → Ory-prefixed fallback. Standard wins when set;
+ * the alias is consulted only when the standard name is empty/missing. The
+ * historical `ORY_OTLP_ENDPOINT` alias for `OTEL_EXPORTER_OTLP_ENDPOINT` is
+ * preserved verbatim for compatibility with existing dev-launcher envs.
+ */
+const ORY_ENV_ALIAS = {
+    OTEL_EXPORTER_OTLP_ENDPOINT: "ORY_OTLP_ENDPOINT",
+    OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: "ORY_OTLP_TRACES_ENDPOINT",
+    OTEL_EXPORTER_OTLP_HEADERS: "ORY_OTLP_HEADERS",
+    OTEL_EXPORTER_OTLP_TRACES_HEADERS: "ORY_OTLP_TRACES_HEADERS",
+    OTEL_EXPORTER_OTLP_PROTOCOL: "ORY_OTLP_PROTOCOL",
+    OTEL_EXPORTER_OTLP_TRACES_PROTOCOL: "ORY_OTLP_TRACES_PROTOCOL",
+    OTEL_SERVICE_NAME: "ORY_OTLP_SERVICE_NAME",
+    OTEL_RESOURCE_ATTRIBUTES: "ORY_OTLP_RESOURCE_ATTRIBUTES",
+};
+/**
+ * Read an OTel env var, falling back to its `ORY_OTLP_*`-prefixed alias when
+ * the standard name is unset. Trims whitespace and treats empty strings as
+ * absent so a propagated-but-blank var doesn't shadow the alias.
+ */
+function readEnvWithAlias(env, standardName) {
+    const primary = env[standardName]?.trim();
+    if (primary)
+        return primary;
+    const aliasName = ORY_ENV_ALIAS[standardName];
+    if (!aliasName)
+        return undefined;
+    const alias = env[aliasName]?.trim();
+    return alias || undefined;
+}
 // ─── Env parsing helpers ───────────────────────────────────────────
 /**
  * Parse the OTel `k=v,k2=v2` env-var format. Values may be URL-encoded.

package/dist/permissions.d.ts

@@ -117,6 +117,57 @@ export interface ApplyPermissionModeContext {
  * proceed despite the deny.
  */
 export declare function applyPermissionMode(client: OryAgentClient, allowed: boolean, context?: ApplyPermissionModeContext): ModeDecision;
+/**
+ * Outcome of {@link gateToolCall}. Either the tool is a user-interaction
+ * primitive (`AskUserQuestion`, `ExitPlanMode`, `TodoWrite`, …) and we
+ * pass through with a single audit span, or it's a real tool execution
+ * and the caller gets the standard {@link PermissionDecision}.
+ */
+export type ToolGateOutcome = {
+    kind: "interactive";
+    /** Attributes to attach to the caller's pass-through trace, if any. */
+    spanAttributes: {
+        interactive: true;
+        toolName: string;
+    };
+} | PermissionDecision;
+export interface GateToolCallArgs {
+    /** Harness name (`claude-code`, `codex`, …). Used to look up the interactive-tool catalog. */
+    harness: string;
+    /** The tool the agent is invoking. */
+    toolName: string;
+    /** Permission check to run when the tool is a real execution. */
+    check: PermissionCheck;
+    /**
+     * Attributes merged into the permission span (real path) and the
+     * `user.interaction` span (interactive path).
+     */
+    spanAttributes?: Record<string, unknown>;
+    /** Override the resolved {@link PermissionMode}. Tests use this. */
+    modeOverride?: PermissionMode;
+}
+/**
+ * Single entry point for the pre-tool-use gate. Splits the harness's
+ * incoming "tool" into two semantic categories:
+ *
+ *   - **Interactive** — the tool surfaces UI to the user
+ *     (`AskUserQuestion`, `ExitPlanMode`, `TodoWrite`, plus anything
+ *     listed in `ORY_INTERACTIVE_TOOLS`). The plugin must not gate these
+ *     through Ory: the user is the decision-maker, and blocking them in
+ *     enforce mode (or logging a misleading observe-deny) hides the very
+ *     prompt the user needs to see. We record one `user.interaction`
+ *     audit span and return — no permission check, no `tool.invoke`,
+ *     no `tool.block`.
+ *
+ *   - **Execution** — every other tool. Delegates to
+ *     {@link checkAndDecide} so observe/enforce/fail-open behavior is
+ *     identical to the legacy code path.
+ *
+ * The caller branches on `outcome.kind`. The four execution kinds
+ * (`allow`, `deny`, `observe`, `fail_open`) keep their existing
+ * semantics; the new `interactive` kind means "do nothing else."
+ */
+export declare function gateToolCall(client: OryAgentClient, args: GateToolCallArgs): Promise<ToolGateOutcome>;
 /**
  * Run a permission check and resolve the configured mode against the
  * result. Never throws — fail-open scenarios are surfaced as a typed

package/dist/permissions.js

@@ -23,8 +23,10 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.applyPermissionMode = applyPermissionMode;
+exports.gateToolCall = gateToolCall;
 exports.checkAndDecide = checkAndDecide;
 const config_js_1 = require("./config.js");
+const tool_catalog_js_1 = require("./tool-catalog.js");
 function formatSubjectSet(set) {
     if (!set)
         return undefined;
@@ -75,6 +77,52 @@ function applyPermissionMode(client, allowed, context = {}) {
     }
     return { kind: "deny", mode: "enforce", spanAttributes };
 }
+/**
+ * Single entry point for the pre-tool-use gate. Splits the harness's
+ * incoming "tool" into two semantic categories:
+ *
+ *   - **Interactive** — the tool surfaces UI to the user
+ *     (`AskUserQuestion`, `ExitPlanMode`, `TodoWrite`, plus anything
+ *     listed in `ORY_INTERACTIVE_TOOLS`). The plugin must not gate these
+ *     through Ory: the user is the decision-maker, and blocking them in
+ *     enforce mode (or logging a misleading observe-deny) hides the very
+ *     prompt the user needs to see. We record one `user.interaction`
+ *     audit span and return — no permission check, no `tool.invoke`,
+ *     no `tool.block`.
+ *
+ *   - **Execution** — every other tool. Delegates to
+ *     {@link checkAndDecide} so observe/enforce/fail-open behavior is
+ *     identical to the legacy code path.
+ *
+ * The caller branches on `outcome.kind`. The four execution kinds
+ * (`allow`, `deny`, `observe`, `fail_open`) keep their existing
+ * semantics; the new `interactive` kind means "do nothing else."
+ */
+async function gateToolCall(client, args) {
+    if ((0, tool_catalog_js_1.isInteractiveTool)(args.harness, args.toolName)) {
+        client.logger.debug("tool.interactive", {
+            harness: args.harness,
+            toolName: args.toolName,
+            note: "user-interaction primitive — skipping permission check",
+        });
+        client.tracer.record("user.interaction", "ok", {
+            attributes: {
+                harness: args.harness,
+                toolName: args.toolName,
+                kind: "tool",
+                ...args.spanAttributes,
+            },
+        });
+        return {
+            kind: "interactive",
+            spanAttributes: { interactive: true, toolName: args.toolName },
+        };
+    }
+    return checkAndDecide(client, args.check, {
+        spanAttributes: args.spanAttributes,
+        modeOverride: args.modeOverride,
+    });
+}
 /**
  * Run a permission check and resolve the configured mode against the
  * result. Never throws — fail-open scenarios are surfaced as a typed

package/dist/tool-catalog.d.ts

@@ -36,3 +36,34 @@ export declare function getToolCatalog(harness: string): readonly string[];
  * broad access so the same launcher can run every harness end-to-end.
  */
 export declare const ALL_TOOLS: readonly string[];
+/**
+ * Per-harness tool names whose semantics are "ask / inform the user"
+ * rather than "act on an external system". These reach the pre-tool-use
+ * hook the same way real tools do (e.g. Claude Code's `AskUserQuestion`
+ * arrives via `PreToolUse`), but they aren't tool *executions* — gating
+ * them through Ory would either block the user from being asked or, in
+ * observe mode, log a misleading `permission.observe_deny` for an event
+ * the user is about to handle directly.
+ *
+ * Plugins consult this list in their pre-tool gate and short-circuit to
+ * a single `user.interaction` audit span when a match is found. See
+ * `gateToolCall` in `permissions.ts`.
+ *
+ * The list is best-effort and additive: operators can extend it at
+ * runtime via the `ORY_INTERACTIVE_TOOLS` env var (comma-separated names
+ * applied to every harness).
+ */
+export declare const INTERACTIVE_TOOL_CATALOG: Record<string, readonly string[]>;
+/**
+ * Names from {@link INTERACTIVE_TOOL_CATALOG} for the given harness,
+ * merged with any operator-supplied names from `ORY_INTERACTIVE_TOOLS`.
+ * Unknown harnesses still respect the env-var extension.
+ */
+export declare function getInteractiveToolCatalog(harness: string): readonly string[];
+/**
+ * Does the named tool, for the given harness, represent a user-facing
+ * interaction (ask / inform / confirm) rather than an external-system
+ * tool execution? Treats unknown harnesses the same as known ones — the
+ * env-var extension still applies.
+ */
+export declare function isInteractiveTool(harness: string, toolName: string): boolean;

package/dist/tool-catalog.js

@@ -13,8 +13,10 @@
  * catalog update is safe.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ALL_TOOLS = exports.KNOWN_HARNESSES = exports.HARNESS_TOOL_CATALOG = void 0;
+exports.INTERACTIVE_TOOL_CATALOG = exports.ALL_TOOLS = exports.KNOWN_HARNESSES = exports.HARNESS_TOOL_CATALOG = void 0;
 exports.getToolCatalog = getToolCatalog;
+exports.getInteractiveToolCatalog = getInteractiveToolCatalog;
+exports.isInteractiveTool = isInteractiveTool;
 /**
  * Built-in tool names known to ship with each supported harness.
  */
@@ -67,3 +69,58 @@ function getToolCatalog(harness) {
  * broad access so the same launcher can run every harness end-to-end.
  */
 exports.ALL_TOOLS = Array.from(new Set(Object.values(exports.HARNESS_TOOL_CATALOG).flat()));
+/**
+ * Per-harness tool names whose semantics are "ask / inform the user"
+ * rather than "act on an external system". These reach the pre-tool-use
+ * hook the same way real tools do (e.g. Claude Code's `AskUserQuestion`
+ * arrives via `PreToolUse`), but they aren't tool *executions* — gating
+ * them through Ory would either block the user from being asked or, in
+ * observe mode, log a misleading `permission.observe_deny` for an event
+ * the user is about to handle directly.
+ *
+ * Plugins consult this list in their pre-tool gate and short-circuit to
+ * a single `user.interaction` audit span when a match is found. See
+ * `gateToolCall` in `permissions.ts`.
+ *
+ * The list is best-effort and additive: operators can extend it at
+ * runtime via the `ORY_INTERACTIVE_TOOLS` env var (comma-separated names
+ * applied to every harness).
+ */
+exports.INTERACTIVE_TOOL_CATALOG = {
+    "claude-code": ["AskUserQuestion", "ExitPlanMode", "TodoWrite"],
+    codex: [],
+    "gemini-cli": [],
+    openclaw: [],
+    opencode: [],
+};
+function parseEnvInteractiveTools() {
+    const raw = process.env.ORY_INTERACTIVE_TOOLS;
+    if (!raw)
+        return [];
+    return raw
+        .split(",")
+        .map((name) => name.trim())
+        .filter((name) => name.length > 0);
+}
+/**
+ * Names from {@link INTERACTIVE_TOOL_CATALOG} for the given harness,
+ * merged with any operator-supplied names from `ORY_INTERACTIVE_TOOLS`.
+ * Unknown harnesses still respect the env-var extension.
+ */
+function getInteractiveToolCatalog(harness) {
+    const builtIn = exports.INTERACTIVE_TOOL_CATALOG[harness] ?? [];
+    const envExtra = parseEnvInteractiveTools();
+    if (envExtra.length === 0)
+        return builtIn;
+    // Stable order: built-ins first, then env additions, deduplicated.
+    return Array.from(new Set([...builtIn, ...envExtra]));
+}
+/**
+ * Does the named tool, for the given harness, represent a user-facing
+ * interaction (ask / inform / confirm) rather than an external-system
+ * tool execution? Treats unknown harnesses the same as known ones — the
+ * env-var extension still applies.
+ */
+function isInteractiveTool(harness, toolName) {
+    return getInteractiveToolCatalog(harness).includes(toolName);
+}

package/dist/tracer.d.ts

@@ -18,7 +18,7 @@
  */
 import { EventEmitter } from "node:events";
 import type { SpanExporter } from "./otel/exporter.js";
-export type TraceEvent = "session.start" | "session.end" | "session.verify" | "user.auth" | "user.prompt" | "agent.auth" | "oauth2.introspect" | "oauth2.login" | "oauth2.refresh" | "permission.check" | "permission.batch_check" | "permission.observe_deny" | "tool.invoke" | "tool.complete" | "tool.block" | "tool.fail" | "turn.stop" | "subagent.start" | "subagent.stop" | "notification" | "compaction" | "relationship.create" | "relationship.delete" | "relationship.patch" | "hook.receive" | "hook.passthrough" | "config.resolve";
+export type TraceEvent = "session.start" | "session.end" | "session.verify" | "user.auth" | "user.prompt" | "user.interaction" | "agent.auth" | "oauth2.introspect" | "oauth2.login" | "oauth2.refresh" | "permission.check" | "permission.batch_check" | "permission.observe_deny" | "tool.invoke" | "tool.complete" | "tool.block" | "tool.fail" | "turn.stop" | "subagent.start" | "subagent.stop" | "notification" | "compaction" | "relationship.create" | "relationship.delete" | "relationship.patch" | "hook.receive" | "hook.passthrough" | "config.resolve";
 export type SpanStatus = "ok" | "error" | "denied" | "skipped";
 export interface TraceSpan {
     traceId: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",