@ory/argus 1.2.3 → 1.3.0

package/dist/bash-parser.js

@@ -46,12 +46,75 @@ const LITERAL_LEAF_TYPES = new Set(["word", "string_content", "raw_string"]);
  */
 const WRAPPERS = new Set([
     "sudo", "doas", "env", "nohup", "setsid", "command", "exec", "nice",
-    "ionice", "chrt", "stdbuf", "time", "timeout", "xargs",
+    "ionice", "chrt", "stdbuf", "time", "timeout", "xargs", "builtin",
 ]);
-/** Wrappers that take a numeric positional operand before the wrapped command. */
-const OPERAND_WRAPPERS = new Set(["timeout", "nice", "ionice", "chrt"]);
-/** A numeric operand (`5`, `5s`, `1.5`) consumed by an {@link OPERAND_WRAPPERS}. */
-const NUMERIC_OPERAND = /^\d+(\.\d+)?[smhdSMHD]?$/;
+/** Wrapper options whose following token is an option value, not a command. */
+const WRAPPER_OPTIONS_WITH_VALUES = {
+    doas: new Set(["-a", "-C", "-u"]),
+    sudo: new Set([
+        "-u", "--user", "-g", "--group", "-h", "--host", "-p", "--prompt",
+        "-C", "--close-from", "-T", "--command-timeout", "-R", "--chroot",
+        "-D", "--chdir", "-r", "--role", "-t", "--type",
+    ]),
+    env: new Set([
+        "-u", "--unset", "-C", "--chdir",
+    ]),
+    nice: new Set(["-n", "--adjustment"]),
+    exec: new Set(["-a"]),
+    ionice: new Set([
+        "-c", "--class", "-n", "--classdata", "-p", "--pid", "-P", "--pgid",
+        "-u", "--uid",
+    ]),
+    timeout: new Set(["-s", "--signal", "-k", "--kill-after"]),
+    stdbuf: new Set(["-i", "--input", "-o", "--output", "-e", "--error"]),
+    xargs: new Set([
+        "-a", "--arg-file", "-E", "--eof", "-I", "--replace", "-L",
+        "--max-lines", "-n", "--max-args", "-P", "--max-procs", "-s",
+        "--max-chars",
+    ]),
+};
+/** Common standalone options that do not consume the following command token. */
+const WRAPPER_OPTIONS_WITHOUT_VALUES = {
+    doas: new Set(["-L", "-n", "-s"]),
+    sudo: new Set([
+        "-A", "--askpass", "-b", "--background", "-E", "--preserve-env",
+        "-H", "--set-home", "-K", "-k", "--reset-timestamp", "-N",
+        "--no-update", "-n", "--non-interactive", "-S", "--stdin", "-V",
+        "--version", "-v", "--validate",
+    ]),
+    env: new Set([
+        "-i", "--ignore-environment", "-0", "--null", "-v", "--debug",
+        "--ignore-signal", "--default-signal", "--block-signal",
+    ]),
+    command: new Set(["-p", "-v", "-V"]),
+    chrt: new Set([
+        "-a", "--all-tasks", "-b", "--batch", "-d", "--deadline", "-f", "--fifo",
+        "-i", "--idle", "-m", "--max", "-o", "--other", "-r", "--rr",
+    ]),
+    exec: new Set(["-c", "-l"]),
+    setsid: new Set(["-c", "--ctty", "-f", "--fork", "-w", "--wait"]),
+    time: new Set(["-p"]),
+    timeout: new Set(["--foreground", "--preserve-status", "-v", "--verbose"]),
+    xargs: new Set([
+        "-0", "--null", "-r", "--no-run-if-empty", "-t", "--verbose", "-x",
+        "--exit",
+    ]),
+};
+const WRAPPER_OPTIONS_WITH_ATTACHED_VALUES = {
+    doas: /^-[aCu].+/,
+    sudo: /^-[ughCpTDRrt].+/,
+    nice: /^-(?:n.+|\d+)$/,
+    exec: /^-a.+/,
+    ionice: /^-[cnpPu].+/,
+    timeout: /^-[sk].+/,
+    stdbuf: /^-[ioe].+/,
+    xargs: /^-[ELnPs].+/,
+};
+/** Wrappers with a required positional operand before the wrapped command. */
+const WRAPPER_POSITIONAL_OPERANDS = {
+    timeout: 1,
+    chrt: 1,
+};
 /** Shells whose `-c "<script>"` argument is re-parsed as a nested command. */
 const SHELL_DASH_C = new Set(["sh", "bash", "dash", "zsh", "ksh", "ash"]);
 /** Cap re-parse recursion (`sh -c "sh -c …"`) so a pathological input can't loop. */
@@ -122,6 +185,8 @@ function lastLeaf(node) {
 function literalText(node) {
     switch (node.type) {
         case "word":
+            // Unquoted globs depend on the runtime filesystem and are not literal.
+            return /[*?[]/.test(node.text) ? null : node.text;
         case "number":
             return node.text;
         case "raw_string":
@@ -150,10 +215,10 @@ function literalText(node) {
 function resolveCommandName(nameNode) {
     const child = nameNode.namedChild(0);
     if (!child)
-        return basename(nameNode.text);
+        return /[*?[]/.test(nameNode.text) ? null : basename(nameNode.text);
     switch (child.type) {
         case "word":
-            return basename(child.text);
+            return /[*?[]/.test(child.text) ? null : basename(child.text);
         case "raw_string":
             return basename(stripQuotes(child.text));
         case "simple_expansion":
@@ -227,20 +292,55 @@ function collectRedirects(cmd) {
  * {@link ShellCommand} for that command (and recursing through nested wrappers,
  * e.g. `sudo env A=1 curl`).
  */
-function descendWrapper(wrapper, args, pipeline, state) {
-    const skipsNumeric = OPERAND_WRAPPERS.has(wrapper);
+function descendWrapper(wrapper, args, pipeline, parser, depth, state) {
+    let positionalOperands = WRAPPER_POSITIONAL_OPERANDS[wrapper] ?? 0;
+    let optionsEnded = false;
     for (let i = 0; i < args.length; i++) {
         const txt = literalText(args[i]);
         if (txt === null) {
             state.tooComplex = true;
             return;
         }
-        if (txt.startsWith("-"))
+        if (wrapper === "env" && /^--s[^=]*=/.test(txt)) {
+            state.tooComplex = true;
+            return;
+        }
+        if (wrapper === "env" && (txt === "-S" || txt === "--split-string")) {
+            // env's split-string language is not shell syntax. Parsing it with the
+            // Bash grammar can reinterpret comments and quoting, so fail closed.
+            state.tooComplex = true;
+            return;
+        }
+        if (!optionsEnded && txt.startsWith("-")) {
+            if (txt === "--") {
+                optionsEnded = true;
+                continue;
+            }
+            if (txt.includes("="))
+                continue;
+            if (WRAPPER_OPTIONS_WITH_ATTACHED_VALUES[wrapper]?.test(txt))
+                continue;
+            if (WRAPPER_OPTIONS_WITH_VALUES[wrapper]?.has(txt)) {
+                if (!args[i + 1] || literalText(args[i + 1]) === null) {
+                    state.tooComplex = true;
+                    return;
+                }
+                i++;
+                continue;
+            }
+            if (!WRAPPER_OPTIONS_WITHOUT_VALUES[wrapper]?.has(txt)) {
+                // An unknown option may consume the next token. Do not guess which
+                // token is the command because a wrong guess would silently bypass it.
+                state.tooComplex = true;
+            }
             continue;
+        }
         if (/^[A-Za-z_]\w*=/.test(txt))
             continue;
-        if (skipsNumeric && NUMERIC_OPERAND.test(txt))
+        if (positionalOperands > 0) {
+            positionalOperands--;
             continue;
+        }
         const wrapped = basename(txt);
         if (wrapped.length === 0)
             return;
@@ -252,11 +352,92 @@ function descendWrapper(wrapper, args, pipeline, state) {
             redirects: [],
             pipeline,
         });
-        if (WRAPPERS.has(wrapped))
-            descendWrapper(wrapped, rest, pipeline, state);
+        if (SHELL_DASH_C.has(wrapped) && state.pipelineIds.has(pipeline)) {
+            if (shellReadsPipelineInput(rest))
+                state.tooComplex = true;
+        }
+        if (WRAPPERS.has(wrapped)) {
+            descendWrapper(wrapped, rest, pipeline, parser, depth, state);
+        }
+        inspectLiteralScriptInvocation(wrapped, rest, parser, state, depth);
         return;
     }
 }
+function shellReadsPipelineInput(args) {
+    for (let i = 0; i < args.length; i++) {
+        const arg = literalText(args[i]);
+        if (arg === null)
+            return true;
+        if (arg === "--")
+            return i + 1 >= args.length;
+        if (arg === "-O" || arg === "-o" || arg === "--init-file" || arg === "--rcfile") {
+            i++;
+            continue;
+        }
+        if (arg.startsWith("-")) {
+            if (/^-[^-]*c/.test(arg))
+                return false;
+            if (/^-[^-]*s/.test(arg))
+                return true;
+            continue;
+        }
+        const normalized = arg.startsWith("/")
+            ? `/${arg.split("/").reduce((parts, part) => {
+                if (!part || part === ".")
+                    return parts;
+                if (part === "..")
+                    parts.pop();
+                else
+                    parts.push(part);
+                return parts;
+            }, []).join("/")}`
+            : arg;
+        if (arg === "-"
+            || normalized === "/dev/stdin"
+            || /^\/dev\/fd\/0+$/.test(normalized)
+            || /^\/proc\/self\/fd\/0+$/.test(normalized))
+            return true;
+        // A positional operand is a script file, so pipeline stdin is data rather
+        // than shell source and does not hide additional command words.
+        return false;
+    }
+    return true;
+}
+function inspectLiteralScriptInvocation(name, args, parser, state, depth) {
+    if (SHELL_DASH_C.has(name)) {
+        for (let i = 0; i < args.length; i++) {
+            const text = literalText(args[i]);
+            if (text === null) {
+                state.tooComplex = true;
+                break;
+            }
+            if (text === "--" || !text.startsWith("-"))
+                break;
+            if (text === "-O" || text === "-o" || text === "--init-file" || text === "--rcfile") {
+                i++;
+                continue;
+            }
+            if (/^-[^-]*c/.test(text)) {
+                const target = args[i + 1];
+                const script = target ? literalText(target) : null;
+                if (script === null)
+                    state.tooComplex = true;
+                else
+                    reparse(script, parser, state, depth + 1);
+                break;
+            }
+        }
+    }
+    if (name === "eval") {
+        const parts = args.map(literalText);
+        if (parts.length === 0 || parts.some((part) => part === null)) {
+            state.tooComplex = true;
+        }
+        else {
+            reparse(parts.join(" "), parser, state, depth + 1);
+        }
+    }
+}
 /** Recursively walk the tree, building the command model. */
 function walk(node, pipeline, parser, state, depth, treeDepth) {
     // Bound recursion so a maliciously deep AST can't overflow the stack (which
@@ -267,6 +448,7 @@ function walk(node, pipeline, parser, state, depth, treeDepth) {
     }
     if (node.type === "pipeline") {
         const id = state.pipelineCounter++;
+        state.pipelineIds.add(id);
         for (const child of node.children)
             walk(child, id, parser, state, depth, treeDepth + 1);
         return;
@@ -291,41 +473,15 @@ function walk(node, pipeline, parser, state, depth, treeDepth) {
             redirects: collectRedirects(node),
             pipeline: pid,
         });
-        if (name && WRAPPERS.has(name))
-            descendWrapper(name, args, pid, state);
-        if (name && SHELL_DASH_C.has(name)) {
-            const flagIdx = args.findIndex((a) => {
-                const t = literalText(a);
-                return t !== null && t.startsWith("-") && t.includes("c");
-            });
-            if (flagIdx >= 0) {
-                const target = args[flagIdx + 1];
-                if (!target)
-                    state.tooComplex = true;
-                else {
-                    const script = literalText(target);
-                    if (script === null)
-                        state.tooComplex = true;
-                    else
-                        reparse(script, parser, state, depth + 1);
-                }
-            }
+        if (name && WRAPPERS.has(name)) {
+            descendWrapper(name, args, pid, parser, depth, state);
         }
-        if (name === "eval") {
-            const parts = [];
-            let dynamic = false;
-            for (const a of args) {
-                const t = literalText(a);
-                if (t === null)
-                    dynamic = true;
-                else
-                    parts.push(t);
-            }
-            if (dynamic || parts.length === 0)
+        if (name && SHELL_DASH_C.has(name) && state.pipelineIds.has(pid)) {
+            if (shellReadsPipelineInput(args))
                 state.tooComplex = true;
-            else
-                reparse(parts.join(" "), parser, state, depth + 1);
         }
+        if (name)
+            inspectLiteralScriptInvocation(name, args, parser, state, depth);
         // Descend into arguments for nested command substitutions ($(curl …)).
         for (const child of node.children)
             walk(child, -1, parser, state, depth, treeDepth + 1);
@@ -337,7 +493,11 @@ function walk(node, pipeline, parser, state, depth, treeDepth) {
 }
 /** Parse a nested script string and fold its commands into `state`. */
 function reparse(script, parser, state, depth) {
-    if (depth > MAX_REPARSE_DEPTH || script.trim().length === 0)
+    if (depth > MAX_REPARSE_DEPTH) {
+        state.tooComplex = true;
+        return;
+    }
+    if (script.trim().length === 0)
         return;
     const tree = parser.parse(script);
     if (!tree) {
@@ -370,7 +530,12 @@ async function extractShellCommands(command) {
     }
     if (!tree)
         return { commands: [], tooComplex: true };
-    const state = { commands: [], tooComplex: false, pipelineCounter: 0 };
+    const state = {
+        commands: [],
+        tooComplex: false,
+        pipelineCounter: 0,
+        pipelineIds: new Set(),
+    };
     if (command.includes("\\\n"))
         state.tooComplex = true;
     if (tree.rootNode.hasError)

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
   "repo": "ory-agent-plugins",
-  "commit": "bce419a80533136b9877d3cd33e0a03e1e585f52",
-  "commitShort": "bce419a",
+  "commit": "7f6431efd4116e683b164cf2c7300cb44d0c4dcb",
+  "commitShort": "7f6431e",
   "branch": "main",
-  "commitDate": "2026-09-11T13:08:35-07:00",
+  "commitDate": "2026-09-28T11:06:31-07:00",
   "dirty": false,
-  "builtAt": "2026-09-11T20:11:58.706Z"
+  "builtAt": "2026-09-28T18:10:11.171Z"
 }

package/dist/cli.js

@@ -300,6 +300,11 @@ function printEnvironment() {
         ],
         ["ORY_USER_SUBJECT_ID", process.env.ORY_USER_SUBJECT_ID, false],
         ["ORY_AGENT_SUBJECT_ID", process.env.ORY_AGENT_SUBJECT_ID, false],
+        [
+            "ORY_AGENT_ROOT_DELEGATION",
+            process.env.ORY_AGENT_ROOT_DELEGATION ? "(set)" : undefined,
+            false,
+        ],
         ["ORY_AGENT_DEBUG", process.env.ORY_AGENT_DEBUG, false],
         ["ORY_AGENT_LOG_FILE", process.env.ORY_AGENT_LOG_FILE, false],
     ];

package/dist/client.d.ts

@@ -93,6 +93,14 @@ export interface RecordDelegationResult {
     /** Root-first chain, e.g. `["User:<id>", "agent:<join>"]`. */
     delegationChain: string[];
 }
+/** Administrator-provisioned runtime metadata resolved from Agent Security. */
+export interface RuntimeContext {
+    authenticated: true;
+    subjectId: string;
+    rootDelegation: string;
+    deploymentId: string;
+    agentType: string;
+}
 /**
  * A principal known to the client. Either the human user (interactive
  * PKCE login) or the agent (machine credentials).
@@ -111,6 +119,7 @@ export declare class OryAgentClient {
     readonly logger: DebugLogger;
     private readonly eventReporter?;
     private _runtimeCredential?;
+    private _runtimeContext?;
     private readonly _runtimeCredentialsBySession;
     private readonly _runtimeCredentialsByPrincipalKey;
     private sessionCache;
@@ -146,6 +155,10 @@ export declare class OryAgentClient {
     /** Active noninteractive broker credential. It is process memory only. */
     get runtimeCredential(): RuntimeCredential | undefined;
     get hasRuntimeCredential(): boolean;
+    /** Process-local deployment context. It is never persisted or copied to the environment. */
+    get runtimeContext(): RuntimeContext | undefined;
+    get runtimeRootDelegation(): string | undefined;
+    setRuntimeContext(context: RuntimeContext): void;
     setRuntimeCredential(credential: RuntimeCredential | undefined): void;
     /** Retain an actor-scoped credential for deferred event delivery without activating it globally. */
     rememberRuntimeCredential(credential: RuntimeCredential): void;
@@ -251,6 +264,8 @@ export declare class OryAgentClient {
         agentToken?: string;
         runtimeCredential?: RuntimeCredential;
         signal?: AbortSignal;
+        /** Authenticate without a user bearer for a preprovisioned root lineage. */
+        preprovisionedRoot?: boolean;
     }): Promise<RecordDelegationResult>;
     /**
      * Activity attributes describing which principals are attached to the

package/dist/client.js

@@ -81,6 +81,7 @@ class OryAgentClient {
     logger;
     eventReporter;
     _runtimeCredential;
+    _runtimeContext;
     _runtimeCredentialsBySession = new Map();
     _runtimeCredentialsByPrincipalKey = new Map();
     sessionCache = new Map();
@@ -341,6 +342,17 @@ class OryAgentClient {
     get hasRuntimeCredential() {
         return this.runtimeCredential !== undefined;
     }
+    /** Process-local deployment context. It is never persisted or copied to the environment. */
+    get runtimeContext() {
+        return this._runtimeContext ? { ...this._runtimeContext } : undefined;
+    }
+    get runtimeRootDelegation() {
+        return this._runtimeContext?.rootDelegation;
+    }
+    setRuntimeContext(context) {
+        this._runtimeContext = { ...context };
+        this.setAgentPrincipal({ subject: context.subjectId });
+    }
     setRuntimeCredential(credential) {
         const sessionId = this.sessionId?.trim();
         if (sessionId) {
@@ -441,7 +453,10 @@ class OryAgentClient {
                             emitActivity: false,
                             signal: controller.signal,
                         }));
-                        if (identity.subject && identity.token) {
+                        if (identity.runtimeCredential) {
+                            this.rememberRuntimeCredential(identity.runtimeCredential);
+                        }
+                        else if (identity.subject && identity.token) {
                             this._eventPrincipalsByKey.set((0, event_reporter_js_1.eventPrincipalKey)(identity.subject), {
                                 subject: identity.subject,
                                 token: identity.token,
@@ -814,28 +829,30 @@ class OryAgentClient {
         };
         const activity = this.logger.startActivity("delegation.record", { delegationKind: input.kind, ...options?.activityAttributes }, sessionId);
         const url = `${this.agentSecurityUrl.replace(/\/+$/, "")}/agent-security/v1/delegations:record`;
-        // The user bearer authenticates who delegated; the agent or sub-agent bearer
-        // separately proves the principal being attached to the delegation edge.
+        // Interactive lineage uses separate user and runtime proofs. A validated
+        // preprovisioned root has no user bearer; its acting runtime authenticates
+        // directly in Authorization.
         const userToken = this.userPrincipalForSession(sessionId).token;
         const runtimeCredential = options?.runtimeCredential ?? (options?.agentToken
             ? (0, runtime_credential_js_1.talosRuntimeCredential)(options.agentToken)
             : this.runtimeCredential);
         try {
-            if (!userToken || !runtimeCredential) {
+            if (!runtimeCredential || (!userToken && !options?.preprovisionedRoot)) {
                 throw httpError(403, "User token and runtime credential are required");
             }
+            const runtimeOnly = options?.preprovisionedRoot === true;
             const res = await (0, runtime_credential_js_1.authenticatedRuntimeRequest)(runtimeCredential, {
                 url,
                 init: {
                     method: "POST",
                     headers: {
                         "content-type": "application/json",
-                        authorization: `Bearer ${userToken}`,
+                        ...(!runtimeOnly && userToken ? { authorization: `Bearer ${userToken}` } : {}),
                     },
                     body: JSON.stringify(body),
                     signal: options?.signal ?? AbortSignal.timeout(30_000),
                 },
-                authorizationHeader: "x-ory-agent-authorization",
+                authorizationHeader: runtimeOnly ? "authorization" : "x-ory-agent-authorization",
                 fetch: options?.fetchImpl,
             });
             if (!res.ok) {
@@ -1104,7 +1121,7 @@ function rehydrateUserPrincipal(client) {
     // without persisting it — so without this branch `ORY_USER_OAUTH2_TOKEN`
     // authenticated the session and then silently stopped
     // applying on every subsequent event. On a subprocess harness that left the
-    // tool-call client with no user credential for delegation or DCR bootstrap.
+    // tool-call client with no user credential for delegation or Talos enrollment.
     const env = (0, auth_store_js_1.readEnvUserCredential)();
     const tokens = (0, auth_store_js_1.loadTokens)();
     if (env.token) {

package/dist/config.d.ts

@@ -12,7 +12,7 @@ export interface OryOAuth2Tokens {
     expiresAt: number;
     /** Subject (sub claim) the token was issued for. */
     subject?: string;
-    /** Client ID the token was issued under. In-memory only. */
+    /** Client ID the token was issued under. Persisted to bind refreshes to that client. */
     clientId?: string;
     /** @deprecated Accepted in memory for older callers; never persisted. */
     idToken?: string;
@@ -104,6 +104,14 @@ export interface OryAgentDynamicCredentials {
  * bounded so a long-lived install's config doesn't grow without limit.
  */
 export declare const DELEGATION_NODE_HISTORY = 10;
+/** Opaque, administrator-provisioned root delegation node for headless agents. */
+export declare const AGENT_ROOT_DELEGATION_ENV_VAR = "ORY_AGENT_ROOT_DELEGATION";
+/** Validate an opaque broker node without interpreting its server-owned format. */
+export declare function validateAgentRootDelegation(raw: string | undefined): {
+    value?: string;
+    warning?: string;
+};
+export declare function readAgentRootDelegation(env?: NodeJS.ProcessEnv, warnings?: string[]): string | undefined;
 /**
  * Credentials for the AI agent principal (machine identity). Every harness
  * session owns a distinct DCR client, and every typed sub-agent in that session
@@ -183,7 +191,7 @@ export interface OryPluginConfig {
     projectUrl?: string;
     /**
      * Canonical Ory Agent Security broker URL. Broker calls resolve this value
-     * independently from {@link projectUrl}, which remains the OAuth2/DCR origin.
+     * independently from {@link projectUrl}, which remains the project and user-login origin.
      * Older configs fall back to `projectUrl` until this key is persisted.
      */
     agentSecurityUrl?: string;
@@ -250,7 +258,7 @@ export interface OryPluginConfig {
 }
 /**
  * Single OS-agnostic data directory for *all* Ory agent plugin state:
- * the shared config file, persisted DCR credentials, and any harness
+ * the shared config file, persisted legacy DCR credentials, and any harness
  * asset directories. One place per platform — never split across
  * `~/.ory/` and `~/.config/`.
  *
@@ -317,6 +325,18 @@ export declare function saveConfig(update: Partial<{
  * atomic via write-temp + rename.
  */
 export declare function mutateConfig(mutator: (current: OryPluginConfig) => OryPluginConfig | undefined): void;
+export interface AsyncConfigMutation<T> {
+    /** New config to persist while the lock is still held. Omit for a read-only result. */
+    config?: OryPluginConfig;
+    value: T;
+}
+/**
+ * Async read-modify-write transaction using the same config.json.lock as
+ * mutateConfig. The lock remains held while the callback awaits, which lets
+ * token refresh serialize its read/check/network/write sequence across
+ * JavaScript and Go processes without blocking the JavaScript event loop.
+ */
+export declare function mutateConfigAsync<T>(mutator: (current: OryPluginConfig) => Promise<AsyncConfigMutation<T>>): Promise<T>;
 /**
  * True when `value` looks like an Ory project **id** (a UUID) rather than a
  * project **slug**. Project slugs are human-readable tokens (e.g.