@ory/argus 1.2.3 → 1.2.4

package/dist/bash-parser.js

@@ -46,12 +46,75 @@ const LITERAL_LEAF_TYPES = new Set(["word", "string_content", "raw_string"]);
  */
 const WRAPPERS = new Set([
     "sudo", "doas", "env", "nohup", "setsid", "command", "exec", "nice",
-    "ionice", "chrt", "stdbuf", "time", "timeout", "xargs",
+    "ionice", "chrt", "stdbuf", "time", "timeout", "xargs", "builtin",
 ]);
-/** Wrappers that take a numeric positional operand before the wrapped command. */
-const OPERAND_WRAPPERS = new Set(["timeout", "nice", "ionice", "chrt"]);
-/** A numeric operand (`5`, `5s`, `1.5`) consumed by an {@link OPERAND_WRAPPERS}. */
-const NUMERIC_OPERAND = /^\d+(\.\d+)?[smhdSMHD]?$/;
+/** Wrapper options whose following token is an option value, not a command. */
+const WRAPPER_OPTIONS_WITH_VALUES = {
+    doas: new Set(["-a", "-C", "-u"]),
+    sudo: new Set([
+        "-u", "--user", "-g", "--group", "-h", "--host", "-p", "--prompt",
+        "-C", "--close-from", "-T", "--command-timeout", "-R", "--chroot",
+        "-D", "--chdir", "-r", "--role", "-t", "--type",
+    ]),
+    env: new Set([
+        "-u", "--unset", "-C", "--chdir",
+    ]),
+    nice: new Set(["-n", "--adjustment"]),
+    exec: new Set(["-a"]),
+    ionice: new Set([
+        "-c", "--class", "-n", "--classdata", "-p", "--pid", "-P", "--pgid",
+        "-u", "--uid",
+    ]),
+    timeout: new Set(["-s", "--signal", "-k", "--kill-after"]),
+    stdbuf: new Set(["-i", "--input", "-o", "--output", "-e", "--error"]),
+    xargs: new Set([
+        "-a", "--arg-file", "-E", "--eof", "-I", "--replace", "-L",
+        "--max-lines", "-n", "--max-args", "-P", "--max-procs", "-s",
+        "--max-chars",
+    ]),
+};
+/** Common standalone options that do not consume the following command token. */
+const WRAPPER_OPTIONS_WITHOUT_VALUES = {
+    doas: new Set(["-L", "-n", "-s"]),
+    sudo: new Set([
+        "-A", "--askpass", "-b", "--background", "-E", "--preserve-env",
+        "-H", "--set-home", "-K", "-k", "--reset-timestamp", "-N",
+        "--no-update", "-n", "--non-interactive", "-S", "--stdin", "-V",
+        "--version", "-v", "--validate",
+    ]),
+    env: new Set([
+        "-i", "--ignore-environment", "-0", "--null", "-v", "--debug",
+        "--ignore-signal", "--default-signal", "--block-signal",
+    ]),
+    command: new Set(["-p", "-v", "-V"]),
+    chrt: new Set([
+        "-a", "--all-tasks", "-b", "--batch", "-d", "--deadline", "-f", "--fifo",
+        "-i", "--idle", "-m", "--max", "-o", "--other", "-r", "--rr",
+    ]),
+    exec: new Set(["-c", "-l"]),
+    setsid: new Set(["-c", "--ctty", "-f", "--fork", "-w", "--wait"]),
+    time: new Set(["-p"]),
+    timeout: new Set(["--foreground", "--preserve-status", "-v", "--verbose"]),
+    xargs: new Set([
+        "-0", "--null", "-r", "--no-run-if-empty", "-t", "--verbose", "-x",
+        "--exit",
+    ]),
+};
+const WRAPPER_OPTIONS_WITH_ATTACHED_VALUES = {
+    doas: /^-[aCu].+/,
+    sudo: /^-[ughCpTDRrt].+/,
+    nice: /^-(?:n.+|\d+)$/,
+    exec: /^-a.+/,
+    ionice: /^-[cnpPu].+/,
+    timeout: /^-[sk].+/,
+    stdbuf: /^-[ioe].+/,
+    xargs: /^-[ELnPs].+/,
+};
+/** Wrappers with a required positional operand before the wrapped command. */
+const WRAPPER_POSITIONAL_OPERANDS = {
+    timeout: 1,
+    chrt: 1,
+};
 /** Shells whose `-c "<script>"` argument is re-parsed as a nested command. */
 const SHELL_DASH_C = new Set(["sh", "bash", "dash", "zsh", "ksh", "ash"]);
 /** Cap re-parse recursion (`sh -c "sh -c …"`) so a pathological input can't loop. */
@@ -122,6 +185,8 @@ function lastLeaf(node) {
 function literalText(node) {
     switch (node.type) {
         case "word":
+            // Unquoted globs depend on the runtime filesystem and are not literal.
+            return /[*?[]/.test(node.text) ? null : node.text;
         case "number":
             return node.text;
         case "raw_string":
@@ -150,10 +215,10 @@ function literalText(node) {
 function resolveCommandName(nameNode) {
     const child = nameNode.namedChild(0);
     if (!child)
-        return basename(nameNode.text);
+        return /[*?[]/.test(nameNode.text) ? null : basename(nameNode.text);
     switch (child.type) {
         case "word":
-            return basename(child.text);
+            return /[*?[]/.test(child.text) ? null : basename(child.text);
         case "raw_string":
             return basename(stripQuotes(child.text));
         case "simple_expansion":
@@ -227,20 +292,55 @@ function collectRedirects(cmd) {
  * {@link ShellCommand} for that command (and recursing through nested wrappers,
  * e.g. `sudo env A=1 curl`).
  */
-function descendWrapper(wrapper, args, pipeline, state) {
-    const skipsNumeric = OPERAND_WRAPPERS.has(wrapper);
+function descendWrapper(wrapper, args, pipeline, parser, depth, state) {
+    let positionalOperands = WRAPPER_POSITIONAL_OPERANDS[wrapper] ?? 0;
+    let optionsEnded = false;
     for (let i = 0; i < args.length; i++) {
         const txt = literalText(args[i]);
         if (txt === null) {
             state.tooComplex = true;
             return;
         }
-        if (txt.startsWith("-"))
+        if (wrapper === "env" && /^--s[^=]*=/.test(txt)) {
+            state.tooComplex = true;
+            return;
+        }
+        if (wrapper === "env" && (txt === "-S" || txt === "--split-string")) {
+            // env's split-string language is not shell syntax. Parsing it with the
+            // Bash grammar can reinterpret comments and quoting, so fail closed.
+            state.tooComplex = true;
+            return;
+        }
+        if (!optionsEnded && txt.startsWith("-")) {
+            if (txt === "--") {
+                optionsEnded = true;
+                continue;
+            }
+            if (txt.includes("="))
+                continue;
+            if (WRAPPER_OPTIONS_WITH_ATTACHED_VALUES[wrapper]?.test(txt))
+                continue;
+            if (WRAPPER_OPTIONS_WITH_VALUES[wrapper]?.has(txt)) {
+                if (!args[i + 1] || literalText(args[i + 1]) === null) {
+                    state.tooComplex = true;
+                    return;
+                }
+                i++;
+                continue;
+            }
+            if (!WRAPPER_OPTIONS_WITHOUT_VALUES[wrapper]?.has(txt)) {
+                // An unknown option may consume the next token. Do not guess which
+                // token is the command because a wrong guess would silently bypass it.
+                state.tooComplex = true;
+            }
             continue;
+        }
         if (/^[A-Za-z_]\w*=/.test(txt))
             continue;
-        if (skipsNumeric && NUMERIC_OPERAND.test(txt))
+        if (positionalOperands > 0) {
+            positionalOperands--;
             continue;
+        }
         const wrapped = basename(txt);
         if (wrapped.length === 0)
             return;
@@ -252,11 +352,92 @@ function descendWrapper(wrapper, args, pipeline, state) {
             redirects: [],
             pipeline,
         });
-        if (WRAPPERS.has(wrapped))
-            descendWrapper(wrapped, rest, pipeline, state);
+        if (SHELL_DASH_C.has(wrapped) && state.pipelineIds.has(pipeline)) {
+            if (shellReadsPipelineInput(rest))
+                state.tooComplex = true;
+        }
+        if (WRAPPERS.has(wrapped)) {
+            descendWrapper(wrapped, rest, pipeline, parser, depth, state);
+        }
+        inspectLiteralScriptInvocation(wrapped, rest, parser, state, depth);
         return;
     }
 }
+function shellReadsPipelineInput(args) {
+    for (let i = 0; i < args.length; i++) {
+        const arg = literalText(args[i]);
+        if (arg === null)
+            return true;
+        if (arg === "--")
+            return i + 1 >= args.length;
+        if (arg === "-O" || arg === "-o" || arg === "--init-file" || arg === "--rcfile") {
+            i++;
+            continue;
+        }
+        if (arg.startsWith("-")) {
+            if (/^-[^-]*c/.test(arg))
+                return false;
+            if (/^-[^-]*s/.test(arg))
+                return true;
+            continue;
+        }
+        const normalized = arg.startsWith("/")
+            ? `/${arg.split("/").reduce((parts, part) => {
+                if (!part || part === ".")
+                    return parts;
+                if (part === "..")
+                    parts.pop();
+                else
+                    parts.push(part);
+                return parts;
+            }, []).join("/")}`
+            : arg;
+        if (arg === "-"
+            || normalized === "/dev/stdin"
+            || /^\/dev\/fd\/0+$/.test(normalized)
+            || /^\/proc\/self\/fd\/0+$/.test(normalized))
+            return true;
+        // A positional operand is a script file, so pipeline stdin is data rather
+        // than shell source and does not hide additional command words.
+        return false;
+    }
+    return true;
+}
+function inspectLiteralScriptInvocation(name, args, parser, state, depth) {
+    if (SHELL_DASH_C.has(name)) {
+        for (let i = 0; i < args.length; i++) {
+            const text = literalText(args[i]);
+            if (text === null) {
+                state.tooComplex = true;
+                break;
+            }
+            if (text === "--" || !text.startsWith("-"))
+                break;
+            if (text === "-O" || text === "-o" || text === "--init-file" || text === "--rcfile") {
+                i++;
+                continue;
+            }
+            if (/^-[^-]*c/.test(text)) {
+                const target = args[i + 1];
+                const script = target ? literalText(target) : null;
+                if (script === null)
+                    state.tooComplex = true;
+                else
+                    reparse(script, parser, state, depth + 1);
+                break;
+            }
+        }
+    }
+    if (name === "eval") {
+        const parts = args.map(literalText);
+        if (parts.length === 0 || parts.some((part) => part === null)) {
+            state.tooComplex = true;
+        }
+        else {
+            reparse(parts.join(" "), parser, state, depth + 1);
+        }
+    }
+}
 /** Recursively walk the tree, building the command model. */
 function walk(node, pipeline, parser, state, depth, treeDepth) {
     // Bound recursion so a maliciously deep AST can't overflow the stack (which
@@ -267,6 +448,7 @@ function walk(node, pipeline, parser, state, depth, treeDepth) {
     }
     if (node.type === "pipeline") {
         const id = state.pipelineCounter++;
+        state.pipelineIds.add(id);
         for (const child of node.children)
             walk(child, id, parser, state, depth, treeDepth + 1);
         return;
@@ -291,41 +473,15 @@ function walk(node, pipeline, parser, state, depth, treeDepth) {
             redirects: collectRedirects(node),
             pipeline: pid,
         });
-        if (name && WRAPPERS.has(name))
-            descendWrapper(name, args, pid, state);
-        if (name && SHELL_DASH_C.has(name)) {
-            const flagIdx = args.findIndex((a) => {
-                const t = literalText(a);
-                return t !== null && t.startsWith("-") && t.includes("c");
-            });
-            if (flagIdx >= 0) {
-                const target = args[flagIdx + 1];
-                if (!target)
-                    state.tooComplex = true;
-                else {
-                    const script = literalText(target);
-                    if (script === null)
-                        state.tooComplex = true;
-                    else
-                        reparse(script, parser, state, depth + 1);
-                }
-            }
+        if (name && WRAPPERS.has(name)) {
+            descendWrapper(name, args, pid, parser, depth, state);
         }
-        if (name === "eval") {
-            const parts = [];
-            let dynamic = false;
-            for (const a of args) {
-                const t = literalText(a);
-                if (t === null)
-                    dynamic = true;
-                else
-                    parts.push(t);
-            }
-            if (dynamic || parts.length === 0)
+        if (name && SHELL_DASH_C.has(name) && state.pipelineIds.has(pid)) {
+            if (shellReadsPipelineInput(args))
                 state.tooComplex = true;
-            else
-                reparse(parts.join(" "), parser, state, depth + 1);
         }
+        if (name)
+            inspectLiteralScriptInvocation(name, args, parser, state, depth);
         // Descend into arguments for nested command substitutions ($(curl …)).
         for (const child of node.children)
             walk(child, -1, parser, state, depth, treeDepth + 1);
@@ -337,7 +493,11 @@ function walk(node, pipeline, parser, state, depth, treeDepth) {
 }
 /** Parse a nested script string and fold its commands into `state`. */
 function reparse(script, parser, state, depth) {
-    if (depth > MAX_REPARSE_DEPTH || script.trim().length === 0)
+    if (depth > MAX_REPARSE_DEPTH) {
+        state.tooComplex = true;
+        return;
+    }
+    if (script.trim().length === 0)
         return;
     const tree = parser.parse(script);
     if (!tree) {
@@ -370,7 +530,12 @@ async function extractShellCommands(command) {
     }
     if (!tree)
         return { commands: [], tooComplex: true };
-    const state = { commands: [], tooComplex: false, pipelineCounter: 0 };
+    const state = {
+        commands: [],
+        tooComplex: false,
+        pipelineCounter: 0,
+        pipelineIds: new Set(),
+    };
     if (command.includes("\\\n"))
         state.tooComplex = true;
     if (tree.rootNode.hasError)

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
   "repo": "ory-agent-plugins",
-  "commit": "bce419a80533136b9877d3cd33e0a03e1e585f52",
-  "commitShort": "bce419a",
+  "commit": "8e70fe38343bc8599c65c5e1bd4af54861f633be",
+  "commitShort": "8e70fe3",
   "branch": "main",
-  "commitDate": "2026-09-11T13:08:35-07:00",
+  "commitDate": "2026-09-14T08:17:01-07:00",
   "dirty": false,
-  "builtAt": "2026-09-11T20:11:58.706Z"
+  "builtAt": "2026-09-14T15:20:26.275Z"
 }

package/dist/permissions.d.ts

@@ -231,13 +231,13 @@ export interface GateToolCallArgs {
     /** Override the resolved {@link PermissionMode}. Tests use this. */
     modeOverride?: PermissionMode;
     /**
-     * Raw shell command string when {@link toolName} is the harness's shell tool
+     * Raw shell command string(s) when {@link toolName} is the harness's shell tool
      * (issue #76). When present and the tool is a shell tool, the gate decomposes
-     * the command into `ShellTool:<word>#use` sub-checks in addition to the
+     * each command into `ShellTool:<word>#use` sub-checks in addition to the
      * top-level tool check. Absent / undefined ⇒ decomposition is skipped and the
      * gate behaves exactly as before.
      */
-    shellCommand?: string;
+    shellCommand?: string | readonly string[];
     /**
      * The acting machine principals, so an explicit block on the agent install,
      * this session, the sub-agent kind, or this spawn can deny the call. Omitted ⇒

package/dist/permissions.js

@@ -407,11 +407,36 @@ async function decomposeAndCheck(client, args) {
     // letting the exception bubble to the harness catch, which fails open.
     let parsed;
     try {
-        parsed = await (0, bash_parser_js_1.extractBashCommandWords)(args.shellCommand ?? "");
+        const commands = typeof args.shellCommand === "string"
+            ? [args.shellCommand]
+            : args.shellCommand ?? [];
+        const words = [];
+        const seen = new Set();
+        let tooComplex = false;
+        let parserUnavailable = false;
+        for (const command of commands) {
+            const result = await (0, bash_parser_js_1.extractBashCommandWords)(command);
+            tooComplex ||= result.tooComplex;
+            parserUnavailable ||= result.parserUnavailable === true;
+            for (const word of result.words) {
+                if (!seen.has(word)) {
+                    seen.add(word);
+                    words.push(word);
+                }
+            }
+        }
+        parsed = { words, tooComplex, parserUnavailable };
     }
     catch {
         parsed = { words: [], tooComplex: true };
     }
+    if (args.toolName.toLowerCase() === "powershell"
+        || (args.harness === "cline" && args.toolName === "run_commands" && process.platform === "win32")) {
+        // The bundled grammar models POSIX shell syntax, not PowerShell. Retain its
+        // Never retain words parsed with the incompatible grammar: PowerShell
+        // literals could otherwise be persisted as if they were command names.
+        parsed = { words: [], tooComplex: true, parserUnavailable: false };
+    }
     if (parsed.parserUnavailable) {
         client.logger.warn("bash.parser_unavailable", {
             harness: args.harness,

package/dist/tool-catalog.d.ts

@@ -14,17 +14,17 @@
  * Built-in tool names known to ship with each supported harness.
  */
 export declare const HARNESS_TOOL_CATALOG: {
-    readonly "claude-code": readonly ["Read", "Write", "Edit", "Bash", "Glob", "Grep", "WebFetch", "WebSearch", "NotebookEdit", "ToolSearch", "Skill", "TodoWrite", "Agent", "Task"];
-    readonly "claude-agent-sdk": readonly ["Read", "Write", "Edit", "Bash", "Glob", "Grep", "WebFetch", "WebSearch", "NotebookEdit", "ToolSearch", "Skill", "TodoWrite", "Agent", "Task"];
+    readonly "claude-code": readonly ["Read", "Write", "Edit", "Bash", "Monitor", "PowerShell", "Workflow", "Glob", "Grep", "WebFetch", "WebSearch", "NotebookEdit", "ToolSearch", "Skill", "TodoWrite", "Agent", "Task"];
+    readonly "claude-agent-sdk": readonly ["Read", "Write", "Edit", "Bash", "Monitor", "PowerShell", "Workflow", "Glob", "Grep", "WebFetch", "WebSearch", "NotebookEdit", "ToolSearch", "Skill", "TodoWrite", "Agent", "Task"];
     readonly codex: readonly ["Bash", "apply_patch"];
     readonly "gemini-cli": readonly ["read_file", "write_file", "edit_file", "list_files", "search_files", "shell", "web_search"];
     readonly openclaw: readonly ["exec", "read", "write", "edit", "apply_patch", "web_search", "web_fetch", "browser"];
     readonly opencode: readonly ["read", "write", "edit", "bash", "glob", "grep", "webfetch"];
     readonly continue: readonly ["Bash", "Read", "Edit", "Write", "Grep", "Glob", "WebSearch"];
     readonly goose: readonly ["shell", "text_editor", "read_file", "write_file", "list_windows", "screen_capture"];
-    readonly cline: readonly ["execute_command", "read_file", "write_to_file", "replace_in_file", "search_files", "list_files", "use_mcp_tool"];
+    readonly cline: readonly ["execute_command", "run_commands", "read_file", "write_to_file", "replace_in_file", "search_files", "list_files", "use_mcp_tool"];
     readonly amp: readonly ["Bash", "Read", "create_file", "edit_file", "undo_edit", "glob", "Grep", "finder", "read_web_page", "web_search", "todo_read", "todo_write", "oracle", "Task"];
-    readonly pi: readonly ["read", "write", "edit", "bash", "grep", "find", "ls"];
+    readonly pi: readonly ["read", "write", "edit", "bash", "powershell", "grep", "find", "ls"];
     readonly antigravity: readonly ["run_command", "view_file", "write_to_file", "replace_file_content", "multi_replace_file_content", "list_directory", "grep_search", "find", "read_url_content", "search_web", "call_mcp_tool"];
     readonly cursor: readonly ["Read", "Write", "Edit", "Delete", "Shell", "List", "Search", "MCP", "Task"];
 };
@@ -109,10 +109,12 @@ export declare function getShellCommandCatalog(): readonly string[];
  */
 export declare function resolveShellCommandNamespace(): string;
 /**
- * Extract the shell command string from a harness's tool-args object — the same
+ * Extract shell command strings from a harness's tool-args object — the same
  * object the handler already passes to `summarizeToolInput`. Returns `undefined`
  * when the tool isn't a shell tool for this harness or no command field is
- * present (the gate then skips decomposition and degrades to the top-level
- * `Bash` check — it never breaks).
+ * present. Cline's `run_commands` is the exception: malformed command data is
+ * represented as an unresolvable command so enforce mode fails closed. Cline's
+ * command array remains an array so independently executed entries cannot
+ * change how neighboring entries parse.
  */
-export declare function extractShellCommand(harness: string, toolName: string, args: unknown): string | undefined;
+export declare function extractShellCommand(harness: string, toolName: string, args: unknown): string | readonly string[] | undefined;

package/dist/tool-catalog.js

@@ -35,6 +35,9 @@ exports.HARNESS_TOOL_CATALOG = {
         "Write",
         "Edit",
         "Bash",
+        "Monitor",
+        "PowerShell",
+        "Workflow",
         "Glob",
         "Grep",
         "WebFetch",
@@ -54,6 +57,9 @@ exports.HARNESS_TOOL_CATALOG = {
         "Write",
         "Edit",
         "Bash",
+        "Monitor",
+        "PowerShell",
+        "Workflow",
         "Glob",
         "Grep",
         "WebFetch",
@@ -103,6 +109,7 @@ exports.HARNESS_TOOL_CATALOG = {
     ],
     cline: [
         "execute_command",
+        "run_commands",
         "read_file",
         "write_to_file",
         "replace_in_file",
@@ -126,7 +133,7 @@ exports.HARNESS_TOOL_CATALOG = {
         "oracle",
         "Task",
     ],
-    pi: ["read", "write", "edit", "bash", "grep", "find", "ls"],
+    pi: ["read", "write", "edit", "bash", "powershell", "grep", "find", "ls"],
     antigravity: [
         "run_command",
         "view_file",
@@ -245,8 +252,8 @@ function isInteractiveTool(harness, toolName) {
  * precise map is used rather than the {@link isBashLikeTool} heuristic.
  */
 exports.SHELL_TOOL_CATALOG = {
-    "claude-code": ["Bash"],
-    "claude-agent-sdk": ["Bash"],
+    "claude-code": ["Bash", "Monitor", "PowerShell"],
+    "claude-agent-sdk": ["Bash", "Monitor", "PowerShell"],
     codex: ["Bash"],
     // Gemini CLI's hook payload has been observed with both the short `shell`
     // name and the fuller `run_shell_command` id across versions; accept both so
@@ -256,10 +263,11 @@ exports.SHELL_TOOL_CATALOG = {
     opencode: ["bash"],
     continue: ["Bash"],
     goose: ["shell"],
-    cline: ["execute_command"],
+    cline: ["execute_command", "run_commands"],
     amp: ["Bash"],
-    pi: ["bash"],
+    pi: ["bash", "powershell"],
     antigravity: ["run_command"],
+    cursor: ["Shell"],
 };
 function parseEnvList(raw) {
     if (!raw)
@@ -346,16 +354,39 @@ const SHELL_COMMAND_FIELDS = [
     "commandLine",
     "CommandLine",
 ];
+const UNRESOLVED_SHELL_COMMAND = "$ORY_UNRESOLVED_SHELL_COMMAND";
+function extractClineRunCommands(args) {
+    if (!args || typeof args !== "object")
+        return [UNRESOLVED_SHELL_COMMAND];
+    const value = args.commands;
+    if (typeof value !== "string")
+        return [UNRESOLVED_SHELL_COMMAND];
+    try {
+        const commands = JSON.parse(value);
+        if (!Array.isArray(commands) || !commands.every((command) => typeof command === "string")) {
+            return [UNRESOLVED_SHELL_COMMAND];
+        }
+        return commands.length > 0 ? commands : undefined;
+    }
+    catch {
+        return [UNRESOLVED_SHELL_COMMAND];
+    }
+}
 /**
- * Extract the shell command string from a harness's tool-args object — the same
+ * Extract shell command strings from a harness's tool-args object — the same
  * object the handler already passes to `summarizeToolInput`. Returns `undefined`
  * when the tool isn't a shell tool for this harness or no command field is
- * present (the gate then skips decomposition and degrades to the top-level
- * `Bash` check — it never breaks).
+ * present. Cline's `run_commands` is the exception: malformed command data is
+ * represented as an unresolvable command so enforce mode fails closed. Cline's
+ * command array remains an array so independently executed entries cannot
+ * change how neighboring entries parse.
  */
 function extractShellCommand(harness, toolName, args) {
     if (!isShellTool(harness, toolName))
         return undefined;
+    if (harness === "cline" && toolName === "run_commands") {
+        return extractClineRunCommands(args);
+    }
     if (!args || typeof args !== "object")
         return undefined;
     const obj = args;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "1.2.3",
+  "version": "1.2.4",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",