@ory/argus 0.9.0 → 0.10.0

package/dist/index.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.printOryConfig = exports.runAgentCommand = exports.runConfigureCommand = exports.AGENT_TOKEN_EXPIRY_SKEW_SEC = exports.clearSubAgentDynamicCredentials = exports.saveSubAgentDynamicCredentials = exports.loadSubAgentDynamicCredentials = exports.clearAgentDynamicCredentials = exports.saveAgentDynamicCredentials = exports.loadAgentDynamicCredentials = exports.registerAgentClient = exports.fetchClientCredentialsToken = exports.ensureSubAgentIdentity = exports.ensureAgentIdentity = exports.resolveAgentCredentials = exports.ensureAuthenticated = exports.ensureUserAuthenticated = exports.TOKEN_EXPIRY_SKEW_SEC = exports.waitForPeerTokensSync = exports.waitForPeerTokens = exports.clearPkceFlightLock = exports.tryAcquirePkceFlightLock = exports.refreshAndSave = exports.isExpired = exports.clearTokens = exports.saveTokens = exports.loadTokens = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.LOOPBACK_PORTS = exports.buildAuthorizeUrl = exports.sha256Base64Url = exports.generateCodeVerifier = exports.detectHeadless = exports.refreshAccessToken = exports.pkceLogin = exports.getHarnessDataDir = exports.getDataDir = exports.getConfigPath = exports.mutateConfig = exports.resolveConfig = exports.saveConfig = exports.loadConfig = exports.watchTraceFile = exports.formatSpan = exports.deriveTraceId = exports.ActiveSpan = exports.Tracer = exports.redactLogData = exports.DebugLogger = exports.OryAgentClient = void 0;
 exports.runLocalCommand = exports.ORY_COMMAND_SLUGS = exports.ORY_COMMAND_SKILL_NAMES = exports.ORY_SKILL_NAMES = exports.removeSkillDirs = exports.writeSkillTree = exports.toSkillMarkdown = exports.commandToPlainMarkdown = exports.commandToFrontmatterMarkdown = exports.commandToToml = exports.commandToSkill = exports.renderOryCommands = exports.renderOrySkills = exports.runDevLauncher = exports.unregisterPlugin = exports.registerPlugin = exports.removeMcpServer = exports.mergeMcpServer = exports.mcpServerEntry = exports.resolveMcpServerCommand = exports.printNextSteps = exports.printSetupHelp = exports.removeFlatHooks = exports.mergeFlatHooks = exports.flatHookEntry = exports.removeMatcherHooks = exports.mergeMatcherHooks = exports.matcherHookEntry = exports.resolveHookCommand = exports.isOryHookCommand = exports.writeJsonFile = exports.readJsonFile = exports.parseSetupArgs = exports.printPermissionsSection = exports.printAgentIdentitySection = exports.printUserIdentitySection = exports.runStatusCommand = exports.printPermissionsOnboardingHelp = exports.maybeAutoBootstrap = exports.isUserIdentityCached = exports.runPermissionsCommand = exports.interactiveConfigPrompt = exports.promptForProjectUrl = exports.promptOnTty = exports.isTtyAvailable = exports.runWatchCommand = exports.printTraceTail = exports.printEnvHelp = exports.printLogTail = exports.printEnvironment = void 0;
-exports.parseKeyValueList = exports.otlpExporterFromEnv = exports.OtlpExporter = exports.summarizeToolOutput = exports.summarizeToolInput = exports.OryDenialError = exports.alertAttributes = exports.formatAlertSummary = exports.formatAlertMessage = exports.formatDenialSummary = exports.formatDenialMessage = exports.subjectLabel = exports.resolveUserSubject = exports.checkMcpPermission = exports.parseMcpToolGeneric = exports.parseGeminiMcpTool = exports.parseClaudeCodeMcpTool = exports.TOOL_EXECUTION_PHASES = exports.USER_FACING_PHASES = exports.HARNESS_LIFECYCLE_MAP = exports.isToolExecutionPhase = exports.isUserFacingPhase = exports.classifyLifecycle = exports.isInteractiveTool = exports.getInteractiveToolCatalog = exports.INTERACTIVE_TOOL_CATALOG = exports.getToolCatalog = exports.ALL_TOOLS = exports.KNOWN_HARNESSES = exports.HARNESS_TOOL_CATALOG = exports.gateToolCall = exports.applyPermissionMode = exports.checkAndDecide = exports.runRegistryCommand = exports.DEV_JAEGER_CONTAINER = exports.stopDevJaeger = exports.ensureDevJaeger = void 0;
+exports.wrapTool = exports.registerSubagent = exports.complete = exports.gate = exports.sessionStart = exports.resolveNamespace = exports.parseKeyValueList = exports.otlpExporterFromEnv = exports.OtlpExporter = exports.summarizeToolOutput = exports.summarizeToolInput = exports.OryDenialError = exports.alertAttributes = exports.formatAlertSummary = exports.formatAlertMessage = exports.formatDenialSummary = exports.formatDenialMessage = exports.subjectLabel = exports.resolveUserSubject = exports.checkMcpPermission = exports.parseMcpToolGeneric = exports.parseGeminiMcpTool = exports.parseClaudeCodeMcpTool = exports.TOOL_EXECUTION_PHASES = exports.USER_FACING_PHASES = exports.HARNESS_LIFECYCLE_MAP = exports.isToolExecutionPhase = exports.isUserFacingPhase = exports.classifyLifecycle = exports.isInteractiveTool = exports.getInteractiveToolCatalog = exports.INTERACTIVE_TOOL_CATALOG = exports.getToolCatalog = exports.ALL_TOOLS = exports.KNOWN_HARNESSES = exports.HARNESS_TOOL_CATALOG = exports.gateToolCall = exports.applyPermissionMode = exports.checkAndDecide = exports.runRegistryCommand = exports.DEV_JAEGER_CONTAINER = exports.stopDevJaeger = exports.ensureDevJaeger = void 0;
 var client_js_1 = require("./client.js");
 Object.defineProperty(exports, "OryAgentClient", { enumerable: true, get: function () { return client_js_1.OryAgentClient; } });
 var logger_js_1 = require("./logger.js");
@@ -164,3 +164,10 @@ var index_js_3 = require("./otel/index.js");
 Object.defineProperty(exports, "OtlpExporter", { enumerable: true, get: function () { return index_js_3.OtlpExporter; } });
 Object.defineProperty(exports, "otlpExporterFromEnv", { enumerable: true, get: function () { return index_js_3.otlpExporterFromEnv; } });
 Object.defineProperty(exports, "parseKeyValueList", { enumerable: true, get: function () { return index_js_3.parseKeyValueList; } });
+var adapters_js_1 = require("./adapters.js");
+Object.defineProperty(exports, "resolveNamespace", { enumerable: true, get: function () { return adapters_js_1.resolveNamespace; } });
+Object.defineProperty(exports, "sessionStart", { enumerable: true, get: function () { return adapters_js_1.sessionStart; } });
+Object.defineProperty(exports, "gate", { enumerable: true, get: function () { return adapters_js_1.gate; } });
+Object.defineProperty(exports, "complete", { enumerable: true, get: function () { return adapters_js_1.complete; } });
+Object.defineProperty(exports, "registerSubagent", { enumerable: true, get: function () { return adapters_js_1.registerSubagent; } });
+Object.defineProperty(exports, "wrapTool", { enumerable: true, get: function () { return adapters_js_1.wrapTool; } });

package/dist/lifecycle.js

@@ -44,6 +44,7 @@ exports.isToolExecutionPhase = isToolExecutionPhase;
  * `passthrough` via {@link classifyLifecycle}.
  */
 exports.HARNESS_LIFECYCLE_MAP = {
+    // ── Coding-agent harnesses ──
     "claude-code": {
         SessionStart: "session.start",
         SessionEnd: "session.stop",
@@ -88,6 +89,134 @@ exports.HARNESS_LIFECYCLE_MAP = {
         "tool.execute.before": "tool.before",
         "tool.execute.after": "tool.after",
     },
+    // Continue's `Stop` brackets a turn (not the session) and `ConfigChange`
+    // carries no lifecycle meaning — both fall through to passthrough and are
+    // traced as audit spans by the handler.
+    continue: {
+        SessionStart: "session.start",
+        SessionEnd: "session.stop",
+        PreToolUse: "tool.before",
+        PostToolUse: "tool.after",
+        PostToolUseFailure: "tool.failure",
+        PermissionRequest: "permission.ask",
+        UserPromptSubmit: "user.prompt",
+        SubagentStart: "subagent.start",
+        SubagentStop: "subagent.stop",
+        PreCompact: "compaction",
+    },
+    // Goose's file/shell notification hooks surface activity to the user and
+    // are trace-only — user-facing, never gated.
+    goose: {
+        SessionStart: "session.start",
+        SessionEnd: "session.stop",
+        Stop: "session.stop",
+        PreToolUse: "tool.before",
+        PostToolUse: "tool.after",
+        PostToolUseFailure: "tool.failure",
+        UserPromptSubmit: "user.prompt",
+        BeforeReadFile: "user.interaction",
+        AfterFileEdit: "user.interaction",
+        BeforeShellExecution: "user.interaction",
+        AfterShellExecution: "user.interaction",
+    },
+    cline: {
+        agent_start: "session.start",
+        agent_resume: "session.start",
+        agent_abort: "session.stop",
+        agent_end: "session.stop",
+        agent_error: "session.stop",
+        session_shutdown: "session.stop",
+        tool_call: "tool.before",
+        tool_result: "tool.after",
+        prompt_submit: "user.prompt",
+        pre_compact: "compaction",
+    },
+    // Amp is hybrid: session.start / tool.result are in-process plugin events;
+    // tool.call is gated by the subprocess permission delegate. agent.start /
+    // agent.end bracket a turn and fall through to passthrough.
+    amp: {
+        "session.start": "session.start",
+        "tool.call": "tool.before",
+        "tool.result": "tool.after",
+    },
+    // Pi runs session start in the extension factory body (awaited before
+    // startup); `session_start` is the harness's equivalent event name.
+    pi: {
+        session_start: "session.start",
+        tool_call: "tool.before",
+        tool_result: "tool.after",
+    },
+    // Google Antigravity (`agy` CLI / IDE). Subprocess hooks with
+    // Claude-Code-style snake_case payloads. PreInvocation/PostInvocation
+    // bracket each agent turn (not user prompts), so they fall through to
+    // passthrough and are traced as audit spans by the handler.
+    antigravity: {
+        SessionStart: "session.start",
+        SessionEnd: "session.stop",
+        Stop: "session.stop",
+        PreToolUse: "tool.before",
+        PostToolUse: "tool.after",
+        Notification: "user.interaction",
+    },
+    // ── Agent SDK integrations ── (parity with `ory_argus.lifecycle`; each
+    // entry names the canonical extension point the integration hooks)
+    langchain: {
+        "wrap_tool_call.before": "tool.before",
+        "wrap_tool_call.after": "tool.after",
+        on_tool_start: "tool.before",
+        on_tool_end: "tool.after",
+        on_tool_error: "tool.failure",
+    },
+    "openai-agents": {
+        tool_input_guardrail: "tool.before",
+        tool_output_guardrail: "tool.after",
+        on_tool_start: "tool.before",
+        on_tool_end: "tool.after",
+        on_handoff: "subagent.start",
+    },
+    crewai: {
+        ToolUsageStartedEvent: "tool.before",
+        ToolUsageFinishedEvent: "tool.after",
+        ToolUsageErrorEvent: "tool.failure",
+    },
+    llamaindex: {
+        AgentToolCallEvent: "tool.before",
+        function_call: "tool.before",
+        function_call_result: "tool.after",
+    },
+    "pydantic-ai": {
+        "call_tool.before": "tool.before",
+        "call_tool.after": "tool.after",
+    },
+    "agent-framework": {
+        "function_middleware.before": "tool.before",
+        "function_middleware.after": "tool.after",
+    },
+    "vercel-ai": {
+        "execute.before": "tool.before",
+        "execute.after": "tool.after",
+    },
+    "claude-agent-sdk": {
+        PreToolUse: "tool.before",
+        PostToolUse: "tool.after",
+    },
+    "google-adk": {
+        before_tool_callback: "tool.before",
+        after_tool_callback: "tool.after",
+        transfer_to_agent: "subagent.start",
+    },
+    mastra: {
+        beforeToolCall: "tool.before",
+        afterToolCall: "tool.after",
+    },
+    strands: {
+        BeforeToolCallEvent: "tool.before",
+        AfterToolCallEvent: "tool.after",
+    },
+    "cloudflare-agents": {
+        "execute.before": "tool.before",
+        "execute.after": "tool.after",
+    },
 };
 /**
  * Resolve a harness event name to its canonical {@link LifecyclePhase}.

package/dist/local/configs.d.ts

@@ -73,8 +73,8 @@ export declare const GATEWAY_PORT = 4000;
 export declare const GATEWAY_URL = "http://localhost:4000";
 export declare const CONSOLE_PORT = 4100;
 export declare const CONSOLE_URL = "http://localhost:4100";
-export declare const LOGIN_UI_PORT = 3000;
-export declare const LOGIN_UI_URL = "http://localhost:3000";
+export declare const LOGIN_UI_PORT = 4455;
+export declare const LOGIN_UI_URL = "http://localhost:4455";
 export declare const KRATOS_PUBLIC_PORT = 4433;
 export declare const KRATOS_ADMIN_PORT = 4434;
 export declare const KETO_READ_PORT = 4466;

package/dist/local/configs.js

@@ -189,6 +189,14 @@ function nginxGatewayService() {
  * `COOKIE_SECRET` and `CSRF_COOKIE_SECRET` are required by the image —
  * the container exits at startup if they're missing. Both must be at
  * least 32 chars. Fixed dev-only values so launches are deterministic.
+ *
+ * `DANGEROUSLY_DISABLE_SECURE_CSRF_COOKIES=true` is required for local
+ * dev (HTTP, not HTTPS). Without it the csrf-csrf library sets `Secure`
+ * cookies, which the browser silently drops over plain HTTP. This causes
+ * every self-service flow (login, registration, settings) to fail with a
+ * 403 CSRF error, and the registration handler's redirectOnSoftError
+ * enters an infinite redirect loop — pegging CPU and making the UI
+ * unusable. Only safe for loopback-local dev.
  */
 function loginUiService() {
     return `  login-ui:
@@ -207,6 +215,7 @@ function loginUiService() {
       COOKIE_SECRET: "ory-agent-plugins-local-cookie-secret-32+"
       CSRF_COOKIE_NAME: "ory_agent_plugins_local_csrf"
       CSRF_COOKIE_SECRET: "ory-agent-plugins-local-csrf-secret-32+!"
+      DANGEROUSLY_DISABLE_SECURE_CSRF_COOKIES: "true"
     depends_on:
       - kratos
       - hydra
@@ -616,7 +625,7 @@ exports.GATEWAY_PORT = 4000;
 exports.GATEWAY_URL = `http://localhost:${exports.GATEWAY_PORT}`;
 exports.CONSOLE_PORT = 4100;
 exports.CONSOLE_URL = `http://localhost:${exports.CONSOLE_PORT}`;
-exports.LOGIN_UI_PORT = 3000;
+exports.LOGIN_UI_PORT = 4455;
 exports.LOGIN_UI_URL = `http://localhost:${exports.LOGIN_UI_PORT}`;
 exports.KRATOS_PUBLIC_PORT = 4433;
 exports.KRATOS_ADMIN_PORT = 4434;

package/dist/local/manager.d.ts

@@ -24,10 +24,12 @@ export interface EnsureLocalOryStackResult {
  * Bring up the local Ory stack and wait for the gateway to be healthy.
  *
  * Idempotent and fail-graceful: returns a typed result instead of exiting.
- * If the gateway is already healthy the function short-circuits without
- * touching Docker. When `quiet` is set, progress is logged to stderr only
- * (suitable for the dev launcher); otherwise it prints to stdout in the
- * format `localUp` historically used.
+ * If the gateway is already healthy AND the running stack's config matches
+ * what the current code generates (verified by a config fingerprint), the
+ * function short-circuits without touching Docker; otherwise it regenerates
+ * the config and runs `docker compose up -d --wait` to reconcile. When
+ * `quiet` is set, progress is logged to stderr only (suitable for the dev
+ * launcher); otherwise it prints to stdout in the format `localUp` historically used.
  */
 export declare function ensureLocalOryStack(opts?: {
     quiet?: boolean;

package/dist/local/manager.js

@@ -57,6 +57,7 @@ exports.localEnv = localEnv;
 exports.localConfigure = localConfigure;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
+const crypto = __importStar(require("node:crypto"));
 const node_child_process_1 = require("node:child_process");
 const configs_js_1 = require("./configs.js");
 const health_js_1 = require("./health.js");
@@ -196,28 +197,86 @@ function dumpCapturedOutput(label, result) {
     process.stderr.write(`── end ${label} output ──\n\n`);
 }
 // ─── Write config files ────────────────────────────────────────────
+/**
+ * Render the full set of local-stack config files as `{ relPath, content }`
+ * pairs. Pure function of the code, `projectRoot`, and `consoleCfg` — no I/O.
+ * `writeConfigs` writes these and `configFingerprint` hashes them, so the
+ * on-disk stack and its change-detection signal never drift.
+ */
+function renderConfigs(projectRoot, consoleCfg) {
+    return [
+        {
+            relPath: "docker-compose.yml",
+            content: (0, configs_js_1.dockerComposeYaml)(projectRoot, consoleCfg),
+        },
+        { relPath: "kratos/kratos.yml", content: (0, configs_js_1.kratosConfigYaml)() },
+        {
+            relPath: "kratos/identity-schema.json",
+            content: (0, configs_js_1.kratosIdentitySchema)(),
+        },
+        { relPath: "keto/keto.yml", content: (0, configs_js_1.ketoConfigYaml)() },
+        { relPath: "hydra/hydra.yml", content: (0, configs_js_1.hydraConfigYaml)() },
+        // nginx config is always emitted — the gateway is no longer optional.
+        { relPath: "nginx/nginx.conf", content: (0, configs_js_1.nginxConf)() },
+    ];
+}
+/**
+ * Stable content hash of the rendered config set. Used to decide whether an
+ * already-running stack still matches the config the current code would
+ * generate; a change (e.g. the login-UI port, a service env var) invalidates
+ * the fast-path short-circuit so the stack is reconciled instead of reused.
+ */
+function configFingerprint(projectRoot, consoleCfg) {
+    const hash = crypto.createHash("sha256");
+    for (const { relPath, content } of renderConfigs(projectRoot, consoleCfg)) {
+        hash.update(relPath);
+        hash.update("\0");
+        hash.update(content);
+        hash.update("\0");
+    }
+    return hash.digest("hex");
+}
+const CONFIG_FINGERPRINT_FILE = ".config-fingerprint";
+/** Read the fingerprint recorded after the last successful bring-up. */
+function readConfigFingerprint(localDir) {
+    try {
+        return fs
+            .readFileSync(path.join(localDir, CONFIG_FINGERPRINT_FILE), "utf8")
+            .trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Record the fingerprint of the config the running stack was brought up with. */
+function writeConfigFingerprint(localDir, fingerprint) {
+    try {
+        fs.writeFileSync(path.join(localDir, CONFIG_FINGERPRINT_FILE), fingerprint + "\n");
+    }
+    catch {
+        // Best-effort: a missing fingerprint only costs a reconcile next launch.
+    }
+}
 function writeConfigs(localDir, projectRoot, consoleCfg) {
     ensureDir(localDir);
     ensureDir(path.join(localDir, "kratos"));
     ensureDir(path.join(localDir, "keto"));
     ensureDir(path.join(localDir, "hydra"));
     ensureDir(path.join(localDir, "nginx"));
-    fs.writeFileSync(path.join(localDir, "docker-compose.yml"), (0, configs_js_1.dockerComposeYaml)(projectRoot, consoleCfg));
-    fs.writeFileSync(path.join(localDir, "kratos", "kratos.yml"), (0, configs_js_1.kratosConfigYaml)());
-    fs.writeFileSync(path.join(localDir, "kratos", "identity-schema.json"), (0, configs_js_1.kratosIdentitySchema)());
-    fs.writeFileSync(path.join(localDir, "keto", "keto.yml"), (0, configs_js_1.ketoConfigYaml)());
-    fs.writeFileSync(path.join(localDir, "hydra", "hydra.yml"), (0, configs_js_1.hydraConfigYaml)());
-    // nginx config is always emitted — the gateway is no longer optional.
-    fs.writeFileSync(path.join(localDir, "nginx", "nginx.conf"), (0, configs_js_1.nginxConf)());
+    for (const { relPath, content } of renderConfigs(projectRoot, consoleCfg)) {
+        fs.writeFileSync(path.join(localDir, relPath), content);
+    }
 }
 /**
  * Bring up the local Ory stack and wait for the gateway to be healthy.
  *
  * Idempotent and fail-graceful: returns a typed result instead of exiting.
- * If the gateway is already healthy the function short-circuits without
- * touching Docker. When `quiet` is set, progress is logged to stderr only
- * (suitable for the dev launcher); otherwise it prints to stdout in the
- * format `localUp` historically used.
+ * If the gateway is already healthy AND the running stack's config matches
+ * what the current code generates (verified by a config fingerprint), the
+ * function short-circuits without touching Docker; otherwise it regenerates
+ * the config and runs `docker compose up -d --wait` to reconcile. When
+ * `quiet` is set, progress is logged to stderr only (suitable for the dev
+ * launcher); otherwise it prints to stdout in the format `localUp` historically used.
  */
 async function ensureLocalOryStack(opts = {}) {
     const localDir = opts.localDir ?? getLocalDir();
@@ -232,13 +291,25 @@ async function ensureLocalOryStack(opts = {}) {
     }
     const gatewayCfg = (0, configs_js_1.getGatewayConfig)();
     const healthUrl = `${configs_js_1.GATEWAY_URL}${gatewayCfg.healthPath}`;
-    // Short-circuit if the gateway is already serving — keeps repeated dev
-    // launches fast and avoids re-pulling/restarting healthy containers.
-    // Skip the short-circuit when ORY_CONSOLE_LITE_PATH is explicitly set so
-    // a path change on a subsequent run actually triggers a rebuild (compose
-    // diffs the regenerated YAML and recreates the console when needed).
+    // Short-circuit if the gateway is already serving AND the running stack was
+    // brought up with the same config the current code would generate — keeps
+    // repeated dev launches fast without re-pulling/restarting healthy
+    // containers. Gateway health alone is not enough: a config change to any
+    // service (e.g. the login-UI port, a service env var) leaves the gateway
+    // healthy while the rest of the stack runs stale config, so we also require
+    // the config fingerprint to match. On a mismatch we fall through and let
+    // `docker compose up -d --wait` diff the regenerated YAML and recreate only
+    // the changed containers.
+    //
+    // Skip the short-circuit entirely when ORY_CONSOLE_LITE_PATH is explicitly
+    // set so a rebuild is forced even when the path is unchanged (the console
+    // source tree behind the path may have changed, which the fingerprint of the
+    // generated config can't see).
     const explicitConsoleLiteOverride = (process.env.ORY_CONSOLE_LITE_PATH ?? "").trim() !== "";
+    const fingerprint = configFingerprint(projectRoot, consoleCfg);
+    const configUnchanged = readConfigFingerprint(localDir) === fingerprint;
     if (!explicitConsoleLiteOverride &&
+        configUnchanged &&
         (await isGatewayHealthy(1_500, healthUrl))) {
         return { status: "already-running", gatewayUrl: configs_js_1.GATEWAY_URL, localDir };
     }
@@ -320,6 +391,10 @@ async function ensureLocalOryStack(opts = {}) {
             detail: "Gateway did not become healthy within 2 minutes.",
         };
     }
+    // Record the fingerprint of the config the stack was actually brought up
+    // with (consoleCfg may have fallen back to disabled above), so the next
+    // launch can short-circuit only while the config is unchanged.
+    writeConfigFingerprint(localDir, configFingerprint(projectRoot, consoleCfg));
     return { status: "started", gatewayUrl: configs_js_1.GATEWAY_URL, localDir };
 }
 async function localUp(opts = {}) {

package/dist/permissions.d.ts

@@ -118,12 +118,20 @@ export interface ApplyPermissionModeContext {
  */
 export declare function applyPermissionMode(client: OryAgentClient, allowed: boolean, context?: ApplyPermissionModeContext): ModeDecision;
 /**
- * Outcome of {@link gateToolCall}. Either the tool is a user-interaction
+ * Outcome of {@link gateToolCall}. Either Ory is disabled entirely
+ * (`config.auditOnly` kill switch), the tool is a user-interaction
  * primitive (`AskUserQuestion`, `ExitPlanMode`, `TodoWrite`, …) and we
  * pass through with a single audit span, or it's a real tool execution
  * and the caller gets the standard {@link PermissionDecision}.
  */
 export type ToolGateOutcome = {
+    kind: "audit_only";
+    /** Attributes to attach to the caller's pass-through trace, if any. */
+    spanAttributes: {
+        auditOnly: true;
+        toolName: string;
+    };
+} | {
     kind: "interactive";
     /** Attributes to attach to the caller's pass-through trace, if any. */
     spanAttributes: {
@@ -147,8 +155,12 @@ export interface GateToolCallArgs {
     modeOverride?: PermissionMode;
 }
 /**
- * Single entry point for the pre-tool-use gate. Splits the harness's
- * incoming "tool" into two semantic categories:
+ * Single entry point for the pre-tool-use gate. Applies the
+ * `config.auditOnly` kill switch first — when set, Ory is disabled
+ * entirely and the caller gets `{ kind: "audit_only" }` back without any
+ * permission check (record the invocation as an audit span and proceed).
+ * Otherwise splits the harness's incoming "tool" into two semantic
+ * categories:
  *
  *   - **Interactive** — the tool surfaces UI to the user
  *     (`AskUserQuestion`, `ExitPlanMode`, `TodoWrite`, plus anything

package/dist/permissions.js

@@ -78,8 +78,12 @@ function applyPermissionMode(client, allowed, context = {}) {
     return { kind: "deny", mode: "enforce", spanAttributes };
 }
 /**
- * Single entry point for the pre-tool-use gate. Splits the harness's
- * incoming "tool" into two semantic categories:
+ * Single entry point for the pre-tool-use gate. Applies the
+ * `config.auditOnly` kill switch first — when set, Ory is disabled
+ * entirely and the caller gets `{ kind: "audit_only" }` back without any
+ * permission check (record the invocation as an audit span and proceed).
+ * Otherwise splits the harness's incoming "tool" into two semantic
+ * categories:
  *
  *   - **Interactive** — the tool surfaces UI to the user
  *     (`AskUserQuestion`, `ExitPlanMode`, `TodoWrite`, plus anything
@@ -99,6 +103,17 @@ function applyPermissionMode(client, allowed, context = {}) {
  * semantics; the new `interactive` kind means "do nothing else."
  */
 async function gateToolCall(client, args) {
+    if ((0, config_js_1.resolveConfig)().auditOnly) {
+        client.logger.debug("tool.audit_only", {
+            harness: args.harness,
+            toolName: args.toolName,
+            note: "audit-only mode — skipping permission check",
+        });
+        return {
+            kind: "audit_only",
+            spanAttributes: { auditOnly: true, toolName: args.toolName },
+        };
+    }
     if ((0, tool_catalog_js_1.isInteractiveTool)(args.harness, args.toolName)) {
         client.logger.debug("tool.interactive", {
             harness: args.harness,