@ory/argus 1.0.0 → 1.0.1

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
   "repo": "ory-agent-plugins",
-  "commit": "6f11a1695f60ec11e7905c6a73f8683235c5e4df",
-  "commitShort": "6f11a16",
+  "commit": "f803b3fe7be2cd6918652a082a7a4a3eb4ddab53",
+  "commitShort": "f803b3f",
   "branch": "main",
-  "commitDate": "2026-08-29T19:17:15-07:00",
+  "commitDate": "2026-08-30T11:50:10-07:00",
   "dirty": false,
-  "builtAt": "2026-08-30T02:20:53.108Z"
+  "builtAt": "2026-08-30T18:53:36.809Z"
 }

package/dist/runtime.d.ts

@@ -345,6 +345,11 @@ export interface PreparedRuntime {
     /** Store directories GC'd after rewiring — reported by `install`. */
     prunedStores: string[];
 }
+/** Serialize installs because npm mutates and prunes the shared prefix in place. */
+export declare function withRuntimeInstallLock<T>(action: () => T, options?: {
+    timeoutMs?: number;
+    pollMs?: number;
+}): T;
 /**
  * One call per plugin install: resolve the runtime, write the shims, record
  * the wiring, and GC stores nothing references any more.

package/dist/runtime.js

@@ -104,12 +104,14 @@ exports.removeRuntimeWiring = removeRuntimeWiring;
 exports.pruneRuntimeStores = pruneRuntimeStores;
 exports.resolveRuntimeForInstall = resolveRuntimeForInstall;
 exports.requireHookCommand = requireHookCommand;
+exports.withRuntimeInstallLock = withRuntimeInstallLock;
 exports.wireRuntime = wireRuntime;
 exports.checkRuntimeHealth = checkRuntimeHealth;
 exports.describeRuntimeHealth = describeRuntimeHealth;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
 const config_js_1 = require("./config.js");
 // ─── Paths ─────────────────────────────────────────────────────────
 /** Root of the runtime store: `<dataDir>/runtime`. */
@@ -120,6 +122,9 @@ function getRuntimeRoot() {
 function getRuntimeStoreDir(version) {
     return path.join(getRuntimeRoot(), version);
 }
+function getRuntimeInstallLockPath() {
+    return path.join(getRuntimeRoot(), ".install.lock");
+}
 /** Directory holding the generated entry shims: `<dataDir>/bin`. */
 function getShimDir() {
     return path.join((0, config_js_1.getDataDir)(), "bin");
@@ -222,7 +227,16 @@ function materializeRuntime(opts) {
     const storeDir = getRuntimeStoreDir(version);
     fs.mkdirSync(storeDir, { recursive: true });
     const extras = opts.extraPackages ?? [`${exports.MCP_SERVER_PACKAGE}@${version}`];
-    const specs = [`${packageName}@${version}`, ...extras];
+    // npm --no-save prunes packages omitted from a later install into the same
+    // prefix. Reinstall every runtime already wired to this shared store so
+    // adding one harness cannot remove another harness's package.
+    const retained = Object.values(readRuntimeManifest().harnesses)
+        .filter((wiring) => wiring.storeDir &&
+        path.resolve(wiring.storeDir) === path.resolve(storeDir))
+        .map((wiring) => `${wiring.packageName}@${wiring.version}`);
+    const specs = [
+        ...new Set([`${packageName}@${version}`, ...retained, ...extras]),
+    ];
     const installer = opts.installer ?? exports.defaultNpmInstaller;
     const result = installer({ prefix: storeDir, specs });
     if (!result.ok) {
@@ -648,6 +662,66 @@ function requireHookCommand(runtime) {
     }
     return runtime.hookCommand;
 }
+const RUNTIME_LOCK_TIMEOUT_MS = 5 * 60_000;
+const RUNTIME_LOCK_POLL_MS = 50;
+/** Serialize installs because npm mutates and prunes the shared prefix in place. */
+function withRuntimeInstallLock(action, options = {}) {
+    const root = getRuntimeRoot();
+    const lockPath = getRuntimeInstallLockPath();
+    const deadline = Date.now() + (options.timeoutMs ?? RUNTIME_LOCK_TIMEOUT_MS);
+    fs.mkdirSync(root, { recursive: true });
+    let fd;
+    const token = `${process.pid}:${(0, node_crypto_1.randomUUID)()}`;
+    for (;;) {
+        try {
+            fd = fs.openSync(lockPath, "wx", 0o600);
+            fs.writeSync(fd, token);
+            break;
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                throw err;
+            if (Date.now() > deadline) {
+                throw new Error(`Timed out waiting for the Ory runtime install lock at ${lockPath}. ` +
+                    "Remove it only if no other plugin install is running.");
+            }
+            sleepRuntimeLock(options.pollMs ?? RUNTIME_LOCK_POLL_MS);
+        }
+    }
+    try {
+        return action();
+    }
+    finally {
+        try {
+            fs.closeSync(fd);
+        }
+        catch {
+            /* best-effort */
+        }
+        try {
+            if (fs.readFileSync(lockPath, "utf8") === token)
+                fs.unlinkSync(lockPath);
+        }
+        catch {
+            /* best-effort */
+        }
+    }
+}
+let runtimeLockSleepBuffer;
+function sleepRuntimeLock(ms) {
+    if (runtimeLockSleepBuffer === undefined) {
+        try {
+            runtimeLockSleepBuffer = new Int32Array(new SharedArrayBuffer(4));
+        }
+        catch {
+            runtimeLockSleepBuffer = null;
+        }
+    }
+    if (!runtimeLockSleepBuffer) {
+        throw new Error("This runtime cannot wait for another Ory plugin install to finish.");
+    }
+    Atomics.wait(runtimeLockSleepBuffer, 0, 0, ms);
+}
 /**
  * One call per plugin install: resolve the runtime, write the shims, record
  * the wiring, and GC stores nothing references any more.
@@ -656,6 +730,9 @@ function requireHookCommand(runtime) {
  * harness is about to use is never a GC candidate.
  */
 function wireRuntime(opts) {
+    return withRuntimeInstallLock(() => wireRuntimeUnlocked(opts));
+}
+function wireRuntimeUnlocked(opts) {
     const target = resolveRuntimeForInstall({
         packageName: opts.packageName,
         packageRoot: opts.packageRoot,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",