@ory/argus 1.0.0 → 1.1.0

package/dist/opl.js

@@ -2,19 +2,14 @@
 /**
  * Ory Permission Language (OPL) schema for the Agent Security permission model.
  *
- * Argus relies on more than relation-tuple *existence*: a subject may be granted
- * a tool and separately **blocked** from it, and the block must win. Keto
- * permission is otherwise purely existence-based (no path ⇒ no access, any path
- * ⇒ access), so the deny-override is modeled natively in OPL as a permit:
+ * Native agent and shell tools are allowed by default and may be explicitly
+ * blocked. The deny is modeled natively in OPL as a permit:
  *
- *     use = users.includes(subject) && !blockedSubjects.includes(subject)
+ *     use = !blockedSubjects.includes(subject)
  *
- * Keto evaluates the permit in a single check, so a `blockedSubjects` relation
- * beats a `users` grant no matter how the grant was reached (direct subject or
- * subject-set expansion). Argus always checks the **`use` permit** (see
- * `resolveCheckRelation`), so this model must be applied to the project for
- * checks to resolve; with nothing blocked, `use` resolves identically to a bare
- * `users` existence check, so grants alone allow.
+ * Argus always checks the **`use` permit**, so a missing block allows and a
+ * matching `blockedSubjects` relation denies. This model must be applied to the
+ * project for checks to resolve.
  *
  * ## Naming conventions
  *
@@ -207,8 +202,7 @@ exports.PERMISSION_MODE_OBJECT = "mode";
  */
 exports.PROJECT_POSTURE_OBJECT = "project";
 /**
- * The permit Argus checks: `users && !blockedSubjects`, evaluated natively by
- * Keto. A verb, as Keto's own `view` is — it names the question the gate asks.
+ * The native-tool permit Argus checks: `!blockedSubjects`, evaluated by Keto.
  */
 exports.PERMIT_USE = "use";
 /** Conventional user namespace used for SubjectSet-addressed users (`User:<id>`). */
@@ -263,30 +257,25 @@ function renderPrincipalClass(name) {
     return `class ${name} implements Namespace {}`;
 }
 /**
- * Render a tool-namespace class body: the `users` grant, the `blockedSubjects`
- * deny-override, and the `use` permit (`users && !blockedSubjects`) Argus
- * checks. The single definition of that class, used for both tool namespaces.
+ * Render a native tool-namespace class body: the `blockedSubjects` relation and
+ * the default-allow `use` permit Argus checks. The single definition is used for
+ * both AgentTool and ShellTool; MCP namespaces remain grant-based elsewhere.
  */
 function renderToolNamespaceClass(namespace = exports.DEFAULT_NAMESPACE) {
     return `class ${namespace} implements Namespace {
   related: {
-    // Machine principals are grantable in their own right: \`${subject_js_1.AGENT_NAMESPACE}:<clientId>\` is
+    // Machine principals are blockable in their own right: \`${subject_js_1.AGENT_NAMESPACE}:<clientId>\` is
     // one session's registered agent credential and \`${subject_js_1.SUBAGENT_NAMESPACE}:<clientId>\` one
     // typed sub-agent credential in that session. Their narrower session- and spawn-scoped forms
     // (\`${subject_js_1.AGENT_NAMESPACE}:<clientId>|<session>\`, \`${subject_js_1.SUBAGENT_NAMESPACE}:<clientId>|<session>|<type>\`) are
     // members of the same namespaces, which is what lets a block name one run.
-    // A grant may also name the shared role, so one membership covers every
-    // tool in every tool namespace: \`@(${exports.AGENT_ROLE_NAMESPACE}:<role>#${exports.RELATION_MEMBERS})\`.
-    ${exports.RELATION_USERS}: (${USER_NAMESPACE} | ${subject_js_1.SESSION_NAMESPACE} | ${subject_js_1.AGENT_NAMESPACE} | ${subject_js_1.SUBAGENT_NAMESPACE} | SubjectSet<${exports.AGENT_ROLE_NAMESPACE}, "${exports.RELATION_MEMBERS}"> | SubjectSet<${namespace}, "${exports.RELATION_USERS}">)[]
+    // A block may also name the shared role's members.
     ${exports.RELATION_BLOCKED_SUBJECTS}: (${USER_NAMESPACE} | ${subject_js_1.SESSION_NAMESPACE} | ${subject_js_1.AGENT_NAMESPACE} | ${subject_js_1.SUBAGENT_NAMESPACE} | SubjectSet<${exports.AGENT_ROLE_NAMESPACE}, "${exports.RELATION_MEMBERS}"> | SubjectSet<${namespace}, "${exports.RELATION_BLOCKED_SUBJECTS}">)[]
   }
 
   permits = {
-    // Deny-override: any matching \`${exports.RELATION_BLOCKED_SUBJECTS}\` relation beats a
-    // \`${exports.RELATION_USERS}\` grant, regardless of how the grant was reached (direct or
-    // via a set).
+    // Native tools are allowed unless an explicit block matches.
     ${exports.PERMIT_USE}: (ctx: Context): boolean =>
-      this.related.${exports.RELATION_USERS}.includes(ctx.subject) &&
       !this.related.${exports.RELATION_BLOCKED_SUBJECTS}.includes(ctx.subject),
   }
 }`;
@@ -316,15 +305,13 @@ function renderDelegationNamespaceClass(namespace = exports.DELEGATION_NAMESPACE
 }`;
 }
 /**
- * Render the role class: the members of a shared role a project grants tools to.
- * One class, one relation — a role is a group of subjects and nothing else.
+ * Render the role class: a reusable group whose members can be blocked together.
  */
 function renderAgentRoleNamespaceClass(namespace = exports.AGENT_ROLE_NAMESPACE) {
     return `class ${namespace} implements Namespace {
   related: {
-    // The subjects that belong to the role. A tool grant names
-    // \`(${namespace}:<role>#${exports.RELATION_MEMBERS})\` as its subject, so adding a member grants
-    // every tool the role holds, in either tool namespace, from one relation.
+    // The subjects that belong to the role. A native-tool block can name
+    // \`(${namespace}:<role>#${exports.RELATION_MEMBERS})\` to block the group.
     ${exports.RELATION_MEMBERS}: (${USER_NAMESPACE} | ${subject_js_1.AGENT_NAMESPACE} | ${subject_js_1.SUBAGENT_NAMESPACE} | SubjectSet<${namespace}, "${exports.RELATION_MEMBERS}">)[]
   }
 }`;
@@ -408,20 +395,18 @@ function buildAgentSecurityOpl(namespace = exports.DEFAULT_NAMESPACE, shellNames
         "// that has no such relation, rather than storing a tuple that never matches.",
         ...exports.NODE_REFERENCE_NAMESPACES.map(renderPrincipalClass),
         "",
-        `// Harness tool objects (\`${namespace}:Bash\`). \`${exports.RELATION_USERS}\` is the set of subjects`,
-        `// granted the tool; \`${exports.RELATION_BLOCKED_SUBJECTS}\` is an explicit deny-override. The`,
-        `// \`${exports.PERMIT_USE}\` permit is the effective decision Argus checks: granted AND not`,
-        "// blocked.",
+        `// Harness tool objects (\`${namespace}:Bash\`). \`${exports.RELATION_BLOCKED_SUBJECTS}\` is an explicit`,
+        `// deny. The \`${exports.PERMIT_USE}\` permit is the effective decision Argus checks: allowed`,
+        "// unless blocked.",
         renderToolNamespaceClass(namespace),
         "",
         "// Shell command sub-tools (issue #76): each program/builtin word a shell",
         `// command runs is checked as \`${shellNamespace}:<word>#${exports.PERMIT_USE}\`, so a blocked`,
         '// binary (e.g. curl) can\'t be reached through `bash -c "curl …"`. Same',
-        "// grant / block / use model as the tool namespace above.",
+        "// default-allow / explicit-block model as the tool namespace above.",
         renderToolNamespaceClass(shellNamespace),
         "",
-        "// The shared role a project grants tools to, so an admin adds a member",
-        "// instead of re-granting every tool per identity.",
+        "// The shared role whose members can be blocked as a group.",
         renderAgentRoleNamespaceClass(),
         "",
         "// Delegation nodes: the current-state graph of who delegated to whom, written",

package/dist/permissions-cli.d.ts

@@ -10,8 +10,8 @@
  * v0.14, and the report is the same.)
  *
  * Everything that *writes* to the project is provisioned in the **Ory Console**
- * (Agent Security), not from the plugin: the permission model, the per-tool
- * grants, explicit blocks, and the observe/enforce posture. That is what lets a
+ * (Agent Security), not from the plugin: the permission model, explicit native
+ * blocks, MCP grants, and the observe/enforce posture. That is what lets a
  * plugin be installed with nothing but a project URL — the public OAuth2 client
  * id has a reserved default, with no workspace privilege, project API key, or admin write path. The
  * plugin is a read-only client of the project's permission state.

package/dist/permissions-cli.js

@@ -11,8 +11,8 @@
  * v0.14, and the report is the same.)
  *
  * Everything that *writes* to the project is provisioned in the **Ory Console**
- * (Agent Security), not from the plugin: the permission model, the per-tool
- * grants, explicit blocks, and the observe/enforce posture. That is what lets a
+ * (Agent Security), not from the plugin: the permission model, explicit native
+ * blocks, MCP grants, and the observe/enforce posture. That is what lets a
  * plugin be installed with nothing but a project URL — the public OAuth2 client
  * id has a reserved default, with no workspace privilege, project API key, or admin write path. The
  * plugin is a read-only client of the project's permission state.
@@ -26,7 +26,6 @@ const logger_js_1 = require("./logger.js");
 const agent_auth_js_1 = require("./agent-auth.js");
 const tool_catalog_js_1 = require("./tool-catalog.js");
 const subject_js_1 = require("./subject.js");
-const permissions_js_1 = require("./permissions.js");
 const opl_js_1 = require("./opl.js");
 function resolveNamespace() {
     return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTool";
@@ -79,7 +78,7 @@ function printPermissionsHelp(binName) {
     console.log("  observe  — Log an audit event and allow the tool through. The default.");
     console.log("  enforce  — Block the tool. The production posture.");
     console.log("");
-    console.log("The plugin only ever *reads* permissions. Tool grants, explicit blocks,");
+    console.log("The plugin only ever *reads* permissions. Native tool blocks, MCP grants,");
     console.log("the permission model, and the observe/enforce posture are all managed in");
     console.log("the Ory Console (Agent Security) by someone with access to the project.");
     console.log("");
@@ -97,8 +96,8 @@ function printProvisioningMovedToConsole(binName, attempted) {
     console.error("");
     console.error("Permissions are provisioned in the Ory Console (Agent Security):");
     console.error("  - the permission model applied to the project");
-    console.error("  - per-tool grants for a user, agent, or group");
-    console.error("  - explicit blocks (a deny that beats any grant)");
+    console.error("  - explicit native-tool blocks for a user, agent, or group");
+    console.error("  - MCP grants");
     console.error("  - the observe / enforce posture, project-wide or per principal");
     console.error("");
     console.error("The plugin reads that state and enforces it. To see what it resolves:");
@@ -119,7 +118,7 @@ async function runPermissionsStatus(binName, harness) {
     console.log("");
     if (!resolved.security.connected) {
         console.log("Ory Agent Security is not connected, so no permission checks run and there");
-        console.log("is no coverage to report. The rest of the plugin is unaffected.");
+        console.log("is no native tool access to report. The rest of the plugin is unaffected.");
         console.log("");
         console.log(`Connect with: ${binName} configure --project-url <URL>`);
         console.log("The project URL comes from the Ory Console (Agent Security).");
@@ -157,7 +156,6 @@ async function runPermissionsStatus(binName, harness) {
     const results = await probeCatalog(client, catalog, namespace, subject);
     const allowed = results.filter((r) => r.error === undefined && r.allowed).length;
     const blocked = results.filter((r) => r.blocked).length;
-    const denied = results.filter((r) => r.error === undefined && !r.allowed && !r.blocked).length;
     const errored = results.filter((r) => r.error !== undefined).length;
     const widest = Math.max(...catalog.map((t) => t.length), 4);
     console.log(`  ${"Tool".padEnd(widest)}  Status`);
@@ -167,53 +165,38 @@ async function runPermissionsStatus(binName, harness) {
             ? `error (${r.error})`
             : r.blocked
                 ? "blocked"
-                : r.allowed
-                    ? "allowed"
-                    : "denied";
+                : "allowed";
         console.log(`  ${r.tool.padEnd(widest)}  ${status}`);
     }
     console.log("");
-    console.log(`Summary: ${allowed} allowed, ${denied} denied, ${blocked} blocked, ${errored} errored.`);
+    console.log(`Summary: ${allowed} allowed, ${blocked} blocked, ${errored} errored.`);
     // Shell sub-tools (issue #76): a compact count rather than 100+ rows.
-    let shellDenied = 0;
+    let shellBlocked = 0;
     if ((0, tool_catalog_js_1.getShellToolCatalog)(harness).length > 0) {
         const shellNamespace = (0, tool_catalog_js_1.resolveShellCommandNamespace)();
         const shellWords = (0, tool_catalog_js_1.getShellCommandCatalog)();
         const shellResults = await probeCatalog(client, shellWords, shellNamespace, subject);
         const sAllowed = shellResults.filter((r) => r.allowed).length;
-        shellDenied = shellResults.filter((r) => r.error === undefined && !r.allowed).length;
+        shellBlocked = shellResults.filter((r) => r.blocked).length;
         const sErrored = shellResults.filter((r) => r.error !== undefined).length;
-        console.log(`Shell commands (${shellNamespace}): ${sAllowed} allowed, ${shellDenied} denied, ` +
+        console.log(`Shell commands (${shellNamespace}): ${sAllowed} allowed, ${shellBlocked} blocked, ` +
             `${sErrored} errored of ${shellWords.length}.`);
     }
-    if (denied > 0 || shellDenied > 0) {
-        console.log("");
-        console.log("Denied tools have no grant for this subject. Grant them in the Ory");
-        console.log("Console (Agent Security) — the plugin cannot write permissions.");
-    }
     if (blocked > 0) {
         console.log("");
-        console.log("'blocked' tools carry an explicit block that overrides any grant.");
+        console.log("'blocked' tools carry an explicit native-tool block.");
         console.log("Remove it in the Ory Console (Agent Security).");
     }
     return 0;
 }
 async function probeCatalog(client, catalog, namespace, subject) {
-    // Evaluate the effective `use` permit, exactly as the runtime gate does.
-    const relation = (0, permissions_js_1.resolveCheckRelation)("users");
+    // Evaluate the default-allow `use` permit, exactly as the runtime gate does.
+    const relation = opl_js_1.PERMIT_USE;
     const rows = [];
     for (const tool of catalog) {
         try {
             const result = await client.checkPermission({ namespace, object: tool, relation, ...subject }, { activityAttributes: { toolName: tool, source: "permissions_status" } });
-            let blocked = false;
-            if (!result.allowed) {
-                // Distinguish an explicit block from a plain missing grant.
-                blocked = await client
-                    .checkPermission({ namespace, object: tool, relation: opl_js_1.RELATION_BLOCKED_SUBJECTS, ...subject }, { activityAttributes: { toolName: tool, source: "permissions_status_block" } })
-                    .then((r) => r.allowed)
-                    .catch(() => false);
-            }
-            rows.push({ tool, allowed: result.allowed, blocked });
+            rows.push({ tool, allowed: result.allowed, blocked: !result.allowed });
         }
         catch (err) {
             const ory = err;

package/dist/permissions.d.ts

@@ -34,10 +34,10 @@ import type { OryError, OryErrorCode, PermissionCheck, PermissionResult } from "
  * Why a permission check came back denied, once the block-aware OPL schema is
  * in play:
  *
- *   - `not_granted` — the subject simply has no `use` grant on the object
- *     (the legacy "deny by absence" case).
- *   - `explicit_block` — a `blocked` relation matched the subject, so the
- *     `access` permit's deny-override fired even if a `use` grant exists.
+ *   - `not_granted` — compatibility for grant-based checks outside native
+ *     AgentTool/ShellTool policy (notably MCP).
+ *   - `explicit_block` — a native `use` permit denied because a
+ *     `blockedSubjects` relation matched.
  *
  * Threaded onto the decision's activity attributes and into the observe-mode
  * audit event so "explicitly blocked" is distinguishable from "never granted"
@@ -46,12 +46,9 @@ import type { OryError, OryErrorCode, PermissionCheck, PermissionResult } from "
  */
 export type BlockReason = "not_granted" | "explicit_block";
 /**
- * Map the logical grant relation a caller passes (`use`) onto the relation or
- * permit Argus actually checks. A `use` check always routes through the
- * block-aware `access` permit (`use && !blocked`), so an explicit block is
- * always respected — the permission model must therefore be applied to the
- * project (done in the Ory Console, Agent Security) for checks to resolve. Any
- * other relation passes through unchanged.
+ * Compatibility shim for callers that still pass the former native `users`
+ * relation. Native adapters now pass `use` directly; mapping `users` preserves
+ * the public helper contract without reintroducing grant-based native checks.
  */
 export declare function resolveCheckRelation(relation: string): string;
 /**

package/dist/permissions.js

@@ -42,12 +42,9 @@ const opl_js_1 = require("./opl.js");
 const subject_js_1 = require("./subject.js");
 const tool_catalog_js_1 = require("./tool-catalog.js");
 /**
- * Map the logical grant relation a caller passes (`use`) onto the relation or
- * permit Argus actually checks. A `use` check always routes through the
- * block-aware `access` permit (`use && !blocked`), so an explicit block is
- * always respected — the permission model must therefore be applied to the
- * project (done in the Ory Console, Agent Security) for checks to resolve. Any
- * other relation passes through unchanged.
+ * Compatibility shim for callers that still pass the former native `users`
+ * relation. Native adapters now pass `use` directly; mapping `users` preserves
+ * the public helper contract without reintroducing grant-based native checks.
  */
 function resolveCheckRelation(relation) {
     return relation === opl_js_1.RELATION_USERS ? opl_js_1.PERMIT_USE : relation;
@@ -428,10 +425,7 @@ async function decomposeAndCheck(client, args) {
         const results = [];
         for (let start = 0; start < words.length; start += batchSize) {
             const chunk = words.slice(start, start + batchSize);
-            // Route each word through the block-aware `access` permit (like the
-            // top-level check), so an explicit `ShellTool:<word>#blocked` overrides
-            // a `use` grant. With no block present, `access` == bare `use`.
-            const wordRelation = resolveCheckRelation("users");
+            const wordRelation = opl_js_1.PERMIT_USE;
             const checks = chunk.map((word) => ({
                 namespace,
                 object: word,
@@ -482,7 +476,7 @@ async function decomposeAndCheck(client, args) {
             const decision = applyPermissionMode(client, blocked ? false : allowed, {
                 namespace,
                 object: word,
-                relation: blocked ? opl_js_1.RELATION_BLOCKED_SUBJECTS : opl_js_1.RELATION_USERS,
+                relation: blocked ? opl_js_1.RELATION_BLOCKED_SUBJECTS : opl_js_1.PERMIT_USE,
                 subjectId: blocked?.subject ?? subject.subjectId,
                 subjectSet: blocked ? undefined : subject.subjectSet,
                 activityAttributes: {
@@ -494,7 +488,7 @@ async function decomposeAndCheck(client, args) {
                     } : {}),
                 },
                 modeOverride: args.modeOverride,
-                blockReason: blocked ? "explicit_block" : undefined,
+                blockReason: blocked || !allowed ? "explicit_block" : undefined,
             });
             if (decision.kind === "deny") {
                 deniedWords.push(word);
@@ -510,17 +504,9 @@ async function decomposeAndCheck(client, args) {
     const primaryBlock = primaryBlockedWord ? matchedBlocks.get(primaryBlockedWord) : undefined;
     // Aggregate. Enforce: any denied word blocks. Observe: pass through.
     if (deniedWords.length > 0) {
-        // Disambiguate an explicit block from a plain missing grant on the first
-        // denied word, so the deny event and denial message say "explicitly blocked".
+        // A native `use` deny can only be an explicit block.
         const primaryWord = primaryBlockedWord ?? deniedWords[0];
-        const blockReason = primaryBlock
-            ? "explicit_block"
-            : await probeBlockReason(client, {
-                namespace,
-                object: primaryWord,
-                relation: opl_js_1.RELATION_USERS,
-                ...subject,
-            });
+        const blockReason = "explicit_block";
         return {
             kind: "deny",
             result: {
@@ -533,7 +519,7 @@ async function decomposeAndCheck(client, args) {
                         relation: opl_js_1.RELATION_BLOCKED_SUBJECTS,
                         subjectId: primaryBlock.subject,
                     }
-                    : { namespace, object: primaryWord, relation: opl_js_1.RELATION_USERS, ...subject },
+                    : { namespace, object: primaryWord, relation: opl_js_1.PERMIT_USE, ...subject },
             },
             mode: "enforce",
             activityAttributes: {
@@ -588,8 +574,8 @@ async function checkAndDecide(client, check, opts = {}) {
     const resolved = (0, config_js_1.resolveConfig)();
     const mode = opts.modeOverride ?? resolved.permissionMode;
     const activityAttributes = buildDecisionAttributes(mode, check.subjectId, check.subjectSet);
-    // Route a `use` grant check through the block-aware `access` permit so
-    // explicit blocks are always respected.
+    // Native adapters pass `use`; `resolveCheckRelation` keeps older public
+    // callers that pass `users` on the same default-allow permit.
     const effectiveCheck = {
         ...check,
         relation: resolveCheckRelation(check.relation),
@@ -624,11 +610,13 @@ async function checkAndDecide(client, check, opts = {}) {
     // Report the decision against the caller's original check (relation `use`),
     // not the internal permit rewrite, so callers see the coordinates they passed.
     result = { ...result, check };
-    // On a deny, disambiguate "explicitly blocked" from "never granted" so the
-    // audit trail and denial messaging can tell them apart. Best-effort.
+    // A deny from the native `use` permit is necessarily an explicit block.
+    // Retain the diagnostic probe only for other grant-based public checks.
     const blockReason = result.allowed
         ? undefined
-        : await probeBlockReason(client, check);
+        : effectiveCheck.relation === opl_js_1.PERMIT_USE
+            ? "explicit_block"
+            : await probeBlockReason(client, check);
     const inner = applyPermissionMode(client, result.allowed, {
         namespace: check.namespace,
         object: check.object,

package/dist/post-install.d.ts

@@ -16,7 +16,7 @@
  * plugin logs activity locally and gates nothing. Nothing else changes either way.
  *
  * Everything *else* an Ory project needs to serve Agent Security — the login
- * OAuth2 client, the permission model, the per-tool grants, explicit blocks,
+ * OAuth2 client, the permission model, native-tool blocks, MCP grants,
  * and the observe/enforce posture — is provisioned in the **Ory Console**
  * (Agent Security), by someone with access to the project. The plugin never
  * writes project configuration, which is why installing it needs only a

package/dist/post-install.js

@@ -17,7 +17,7 @@
  * plugin logs activity locally and gates nothing. Nothing else changes either way.
  *
  * Everything *else* an Ory project needs to serve Agent Security — the login
- * OAuth2 client, the permission model, the per-tool grants, explicit blocks,
+ * OAuth2 client, the permission model, native-tool blocks, MCP grants,
  * and the observe/enforce posture — is provisioned in the **Ory Console**
  * (Agent Security), by someone with access to the project. The plugin never
  * writes project configuration, which is why installing it needs only a
@@ -112,7 +112,7 @@ async function runPostInstall(binName, _harness, args = []) {
     if (security.connected) {
         ui.success("Ory Agent Security is connected.");
         ui.hint("Sign-in and permission checks run on the next session.");
-        ui.hint("Tool grants, explicit blocks, and the observe/enforce posture are managed in the Ory Console (Agent Security).");
+        ui.hint("Native-tool blocks, MCP grants, and the observe/enforce posture are managed in the Ory Console (Agent Security).");
         ui.hint(`Inspect what this machine resolves with \`${binName} permissions status\`.`);
     }
     else {

package/dist/runtime.d.ts

@@ -345,6 +345,11 @@ export interface PreparedRuntime {
     /** Store directories GC'd after rewiring — reported by `install`. */
     prunedStores: string[];
 }
+/** Serialize installs because npm mutates and prunes the shared prefix in place. */
+export declare function withRuntimeInstallLock<T>(action: () => T, options?: {
+    timeoutMs?: number;
+    pollMs?: number;
+}): T;
 /**
  * One call per plugin install: resolve the runtime, write the shims, record
  * the wiring, and GC stores nothing references any more.

package/dist/runtime.js

@@ -104,12 +104,14 @@ exports.removeRuntimeWiring = removeRuntimeWiring;
 exports.pruneRuntimeStores = pruneRuntimeStores;
 exports.resolveRuntimeForInstall = resolveRuntimeForInstall;
 exports.requireHookCommand = requireHookCommand;
+exports.withRuntimeInstallLock = withRuntimeInstallLock;
 exports.wireRuntime = wireRuntime;
 exports.checkRuntimeHealth = checkRuntimeHealth;
 exports.describeRuntimeHealth = describeRuntimeHealth;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
 const config_js_1 = require("./config.js");
 // ─── Paths ─────────────────────────────────────────────────────────
 /** Root of the runtime store: `<dataDir>/runtime`. */
@@ -120,6 +122,9 @@ function getRuntimeRoot() {
 function getRuntimeStoreDir(version) {
     return path.join(getRuntimeRoot(), version);
 }
+function getRuntimeInstallLockPath() {
+    return path.join(getRuntimeRoot(), ".install.lock");
+}
 /** Directory holding the generated entry shims: `<dataDir>/bin`. */
 function getShimDir() {
     return path.join((0, config_js_1.getDataDir)(), "bin");
@@ -222,7 +227,16 @@ function materializeRuntime(opts) {
     const storeDir = getRuntimeStoreDir(version);
     fs.mkdirSync(storeDir, { recursive: true });
     const extras = opts.extraPackages ?? [`${exports.MCP_SERVER_PACKAGE}@${version}`];
-    const specs = [`${packageName}@${version}`, ...extras];
+    // npm --no-save prunes packages omitted from a later install into the same
+    // prefix. Reinstall every runtime already wired to this shared store so
+    // adding one harness cannot remove another harness's package.
+    const retained = Object.values(readRuntimeManifest().harnesses)
+        .filter((wiring) => wiring.storeDir &&
+        path.resolve(wiring.storeDir) === path.resolve(storeDir))
+        .map((wiring) => `${wiring.packageName}@${wiring.version}`);
+    const specs = [
+        ...new Set([`${packageName}@${version}`, ...retained, ...extras]),
+    ];
     const installer = opts.installer ?? exports.defaultNpmInstaller;
     const result = installer({ prefix: storeDir, specs });
     if (!result.ok) {
@@ -648,6 +662,66 @@ function requireHookCommand(runtime) {
     }
     return runtime.hookCommand;
 }
+const RUNTIME_LOCK_TIMEOUT_MS = 5 * 60_000;
+const RUNTIME_LOCK_POLL_MS = 50;
+/** Serialize installs because npm mutates and prunes the shared prefix in place. */
+function withRuntimeInstallLock(action, options = {}) {
+    const root = getRuntimeRoot();
+    const lockPath = getRuntimeInstallLockPath();
+    const deadline = Date.now() + (options.timeoutMs ?? RUNTIME_LOCK_TIMEOUT_MS);
+    fs.mkdirSync(root, { recursive: true });
+    let fd;
+    const token = `${process.pid}:${(0, node_crypto_1.randomUUID)()}`;
+    for (;;) {
+        try {
+            fd = fs.openSync(lockPath, "wx", 0o600);
+            fs.writeSync(fd, token);
+            break;
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                throw err;
+            if (Date.now() > deadline) {
+                throw new Error(`Timed out waiting for the Ory runtime install lock at ${lockPath}. ` +
+                    "Remove it only if no other plugin install is running.");
+            }
+            sleepRuntimeLock(options.pollMs ?? RUNTIME_LOCK_POLL_MS);
+        }
+    }
+    try {
+        return action();
+    }
+    finally {
+        try {
+            fs.closeSync(fd);
+        }
+        catch {
+            /* best-effort */
+        }
+        try {
+            if (fs.readFileSync(lockPath, "utf8") === token)
+                fs.unlinkSync(lockPath);
+        }
+        catch {
+            /* best-effort */
+        }
+    }
+}
+let runtimeLockSleepBuffer;
+function sleepRuntimeLock(ms) {
+    if (runtimeLockSleepBuffer === undefined) {
+        try {
+            runtimeLockSleepBuffer = new Int32Array(new SharedArrayBuffer(4));
+        }
+        catch {
+            runtimeLockSleepBuffer = null;
+        }
+    }
+    if (!runtimeLockSleepBuffer) {
+        throw new Error("This runtime cannot wait for another Ory plugin install to finish.");
+    }
+    Atomics.wait(runtimeLockSleepBuffer, 0, 0, ms);
+}
 /**
  * One call per plugin install: resolve the runtime, write the shims, record
  * the wiring, and GC stores nothing references any more.
@@ -656,6 +730,9 @@ function requireHookCommand(runtime) {
  * harness is about to use is never a GC candidate.
  */
 function wireRuntime(opts) {
+    return withRuntimeInstallLock(() => wireRuntimeUnlocked(opts));
+}
+function wireRuntimeUnlocked(opts) {
     const target = resolveRuntimeForInstall({
         packageName: opts.packageName,
         packageRoot: opts.packageRoot,

package/dist/setup.js

@@ -441,7 +441,7 @@ function printConfiguredNextStepsNow(harnessName, uninstallCmd, opts) {
     else {
         ui.hint("It starts in observe mode: every tool call is checked, but nothing is blocked yet.");
         ui.blank();
-        ui.bullet("1. See what's happening — config and permission coverage:");
+        ui.bullet("1. See what's happening — config and native tool access:");
         ui.command(`${npx} status`);
         ui.blank();
         ui.bullet("2. Turn on enforcement once the activity log looks right:");

package/dist/status-cli.d.ts

@@ -20,7 +20,7 @@ export declare function printAgentIdentitySection(harness: string): void;
 export declare function printSubAgentIdentitiesSection(harness: string): void;
 /**
  * Render the "Permissions" block: the deny posture, the namespace, and the
- * coverage of the harness's built-in tool catalog.
+ * allowed/blocked state of the harness's built-in tool catalog.
  *
  * The network probe runs only when a project URL is configured *and* a user
  * identity is available (cached PKCE tokens or `ORY_USER_SUBJECT_ID`). When it

package/dist/status-cli.js

@@ -161,7 +161,7 @@ function printSubAgentIdentitiesSection(harness) {
 }
 /**
  * Render the "Permissions" block: the deny posture, the namespace, and the
- * coverage of the harness's built-in tool catalog.
+ * allowed/blocked state of the harness's built-in tool catalog.
  *
  * The network probe runs only when a project URL is configured *and* a user
  * identity is available (cached PKCE tokens or `ORY_USER_SUBJECT_ID`). When it
@@ -207,32 +207,32 @@ async function printPermissionsSection(binName, harness) {
     if (!probe) {
         return printNoCoverage(cachedMode, namespace, "unavailable (no user identity could be resolved)");
     }
-    const { total, allowed, denied, errored } = probe;
+    const { total, allowed, blocked, errored } = probe;
     console.log(`  Mode:        ${probe.mode}${formatModeSuffix(probe.modeSource)}`);
     console.log(`  Namespace:   ${namespace}`);
     console.log(`  Subject:     ${probe.subject}`);
-    if (errored > 0 && allowed === 0 && denied === 0) {
-        console.log(`  Coverage:    probe failed (${probe.errorCode ?? "unknown"})`);
+    if (errored > 0 && allowed === 0 && blocked === 0) {
+        console.log(`  Tool access: probe failed (${probe.errorCode ?? "unknown"})`);
         return;
     }
     const status = allowed === total
-        ? `fully granted (${allowed}/${total} built-in tools)`
+        ? `all allowed (${allowed}/${total} built-in tools)`
         : allowed === 0
-            ? `no grants (0/${total} built-in tools)`
-            : `partial (${allowed}/${total} built-in tools allowed)`;
-    console.log(`  Coverage:    ${status}`);
-    if (denied > 0) {
-        console.log("               grant the missing tools in the Ory Console (Agent Security)");
+            ? `all blocked (${blocked}/${total} built-in tools)`
+            : `${allowed} allowed, ${blocked} blocked of ${total} built-in tools`;
+    console.log(`  Tool access: ${status}`);
+    if (blocked > 0) {
+        console.log("               remove unwanted blocks in the Ory Console (Agent Security)");
     }
     else if (errored > 0) {
         console.log(`               ${errored} probe error(s) — run "${(0, cli_invocation_js_1.oryNpx)(binName)} permissions" for details`);
     }
 }
-/** The Mode / Namespace / Coverage lines for every path that can't probe. */
+/** The Mode / Namespace / Tool access lines for every path that can't probe. */
 function printNoCoverage(mode, namespace, coverage) {
     console.log(`  Mode:        ${mode}`);
     console.log(`  Namespace:   ${namespace}`);
-    console.log(`  Coverage:    ${coverage}`);
+    console.log(`  Tool access: ${coverage}`);
 }
 function isUserTokenUsable() {
     const tokens = (0, auth_store_js_1.loadTokens)();