@ory/argus 1.2.3 → 1.3.0

package/dist/config.js

@@ -33,7 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LOCAL_AGENT_SECURITY_URL = exports.DEFAULT_AGENT_SECURITY_URL = exports.DEFAULT_OAUTH2_CLIENT_ID = exports.SESSIONLESS_KEY = exports.UNKNOWN_HARNESS_KEY = exports.DELEGATION_NODE_HISTORY = void 0;
+exports.LOCAL_AGENT_SECURITY_URL = exports.DEFAULT_AGENT_SECURITY_URL = exports.DEFAULT_OAUTH2_CLIENT_ID = exports.SESSIONLESS_KEY = exports.UNKNOWN_HARNESS_KEY = exports.AGENT_ROOT_DELEGATION_ENV_VAR = exports.DELEGATION_NODE_HISTORY = void 0;
+exports.validateAgentRootDelegation = validateAgentRootDelegation;
+exports.readAgentRootDelegation = readAgentRootDelegation;
 exports.getDataDir = getDataDir;
 exports.getHarnessDataDir = getHarnessDataDir;
 exports.getConfigPath = getConfigPath;
@@ -43,6 +45,7 @@ exports.registerInstalledHarness = registerInstalledHarness;
 exports.unregisterInstalledHarness = unregisterInstalledHarness;
 exports.saveConfig = saveConfig;
 exports.mutateConfig = mutateConfig;
+exports.mutateConfigAsync = mutateConfigAsync;
 exports.looksLikeProjectId = looksLikeProjectId;
 exports.isSecurityConnected = isSecurityConnected;
 exports.describeSecurityGap = describeSecurityGap;
@@ -51,6 +54,7 @@ exports.configPromptMessage = configPromptMessage;
 const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
+const node_crypto_1 = require("node:crypto");
 const cli_invocation_js_1 = require("./cli-invocation.js");
 /**
  * How many sessions' delegation node ids to keep per credential. Only the
@@ -58,6 +62,29 @@ const cli_invocation_js_1 = require("./cli-invocation.js");
  * bounded so a long-lived install's config doesn't grow without limit.
  */
 exports.DELEGATION_NODE_HISTORY = 10;
+/** Opaque, administrator-provisioned root delegation node for headless agents. */
+exports.AGENT_ROOT_DELEGATION_ENV_VAR = "ORY_AGENT_ROOT_DELEGATION";
+/** Validate an opaque broker node without interpreting its server-owned format. */
+function validateAgentRootDelegation(raw) {
+    if (raw === undefined)
+        return {};
+    const value = raw.trim();
+    if (!value) {
+        return { warning: `${exports.AGENT_ROOT_DELEGATION_ENV_VAR} is set but empty; ignoring it.` };
+    }
+    if (Buffer.byteLength(value, "utf8") > 255 || /[\0\r\n]/.test(raw)) {
+        return {
+            warning: `${exports.AGENT_ROOT_DELEGATION_ENV_VAR} must be at most 255 UTF-8 bytes and contain no NUL or newline characters; ignoring it.`,
+        };
+    }
+    return { value };
+}
+function readAgentRootDelegation(env = process.env, warnings) {
+    const { value, warning } = validateAgentRootDelegation(env[exports.AGENT_ROOT_DELEGATION_ENV_VAR]);
+    if (warning)
+        warnings?.push(warning);
+    return value;
+}
 /**
  * Key used when a credential record carries no harness of its own — only
  * reachable by migrating a config written before credentials were keyed by
@@ -78,7 +105,7 @@ exports.UNKNOWN_HARNESS_KEY = "unknown";
 exports.SESSIONLESS_KEY = "sessionless";
 /**
  * Single OS-agnostic data directory for *all* Ory agent plugin state:
- * the shared config file, persisted DCR credentials, and any harness
+ * the shared config file, persisted legacy DCR credentials, and any harness
  * asset directories. One place per platform — never split across
  * `~/.ory/` and `~/.config/`.
  *
@@ -118,8 +145,11 @@ function configFile() {
 function configLockFile() {
     return configFile() + ".lock";
 }
-/** A lock that is older than this is considered stale and may be broken. */
-const LOCK_STALE_MS = 30_000;
+/** Age fallback for malformed or definitely cross-host lock owners. */
+const LOCK_STALE_FALLBACK_MS = 5 * 60_000;
+/** Lease used by nonce-bearing locks; async transactions refresh it. */
+const LOCK_LEASE_MS = 5_000;
+const LOCK_HEARTBEAT_MS = 1_000;
 /** Polling interval while waiting to acquire the lock. */
 const LOCK_POLL_MS = 25;
 /** Maximum total time to wait for the lock before giving up. */
@@ -507,6 +537,7 @@ function parseOAuth2(value) {
         refreshToken: typeof v.refreshToken === "string" ? v.refreshToken : undefined,
         expiresAt: v.expiresAt,
         subject: typeof v.subject === "string" ? v.subject : undefined,
+        clientId: typeof v.clientId === "string" ? v.clientId : undefined,
     };
 }
 /**
@@ -540,6 +571,25 @@ function mutateConfig(mutator) {
         releaseLock(lock);
     }
 }
+/**
+ * Async read-modify-write transaction using the same config.json.lock as
+ * mutateConfig. The lock remains held while the callback awaits, which lets
+ * token refresh serialize its read/check/network/write sequence across
+ * JavaScript and Go processes without blocking the JavaScript event loop.
+ */
+async function mutateConfigAsync(mutator) {
+    ensureConfigDir();
+    const lock = await acquireLockAsync();
+    try {
+        const mutation = await mutator(loadConfig());
+        if (mutation.config)
+            writeConfigAtomic(mutation.config);
+        return mutation.value;
+    }
+    finally {
+        releaseLock(lock);
+    }
+}
 function mergeConfig(existing, update) {
     const result = { ...existing };
     for (const key of Object.keys(update)) {
@@ -568,23 +618,16 @@ function acquireLock() {
     for (;;) {
         try {
             const fd = fs.openSync(lockPath, "wx", 0o600);
-            fs.writeSync(fd, String(process.pid));
-            return { fd };
+            const nonce = (0, node_crypto_1.randomBytes)(16).toString("hex");
+            fs.writeSync(fd, configLockOwner(nonce));
+            return { fd, nonce };
         }
         catch (err) {
             if (err.code !== "EEXIST")
                 throw err;
-            // Lock exists — check if it's stale.
             try {
-                const stat = fs.statSync(lockPath);
-                if (Date.now() - stat.mtimeMs > LOCK_STALE_MS) {
-                    // Best-effort break; if another process beats us, we'll retry.
-                    try {
-                        fs.unlinkSync(lockPath);
-                    }
-                    catch {
-                        /* ignore */
-                    }
+                const observed = inspectConfigLock(lockPath);
+                if (observed.stale && removeObservedLock(lockPath, observed)) {
                     continue;
                 }
             }
@@ -606,6 +649,142 @@ function acquireLock() {
         }
     }
 }
+async function acquireLockAsync() {
+    const deadline = Date.now() + LOCK_TIMEOUT_MS;
+    const lockPath = configLockFile();
+    for (;;) {
+        try {
+            const fd = fs.openSync(lockPath, "wx", 0o600);
+            const nonce = (0, node_crypto_1.randomBytes)(16).toString("hex");
+            fs.writeSync(fd, configLockOwner(nonce));
+            const lock = { fd, nonce };
+            lock.heartbeat = setInterval(() => heartbeatLock(lock), LOCK_HEARTBEAT_MS);
+            lock.heartbeat.unref?.();
+            return lock;
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                throw err;
+            try {
+                const observed = inspectConfigLock(lockPath);
+                if (observed.stale && removeObservedLock(lockPath, observed)) {
+                    continue;
+                }
+            }
+            catch {
+                continue;
+            }
+            if (Date.now() > deadline) {
+                throw new Error(`Timed out waiting for config lock at ${lockPath}. ` +
+                    "Another process may be holding it; remove the file if you are sure no other process is running.");
+            }
+            await new Promise((resolve) => setTimeout(resolve, LOCK_POLL_MS));
+        }
+    }
+}
+function configLockOwner(nonce, now = Date.now()) {
+    return `${process.pid} ${os.hostname()} ${nonce} ${now + LOCK_LEASE_MS}`;
+}
+function inspectConfigLock(lockPath) {
+    const stat = fs.statSync(lockPath);
+    let raw = "";
+    try {
+        raw = fs.readFileSync(lockPath, "utf8").trim();
+    }
+    catch {
+        return {
+            stale: Date.now() - stat.mtimeMs > LOCK_STALE_FALLBACK_MS,
+            raw,
+            dev: stat.dev,
+            ino: stat.ino,
+        };
+    }
+    const [pidText, hostname, nonce, leaseText] = raw.split(/\s+/, 4);
+    const pid = Number.parseInt(pidText ?? "", 10);
+    const leaseExpiresAt = Number.parseInt(leaseText ?? "", 10);
+    const hasLease = Boolean(nonce) && Number.isFinite(leaseExpiresAt);
+    if (hasLease && Date.now() > leaseExpiresAt) {
+        return { stale: true, raw, dev: stat.dev, ino: stat.ino };
+    }
+    if (Number.isInteger(pid) && pid > 0 && (!hostname || hostname === os.hostname())) {
+        try {
+            process.kill(pid, 0);
+            return {
+                stale: !hasLease && Date.now() - stat.mtimeMs > LOCK_STALE_FALLBACK_MS,
+                raw,
+                dev: stat.dev,
+                ino: stat.ino,
+            };
+        }
+        catch (err) {
+            if (err.code === "EPERM") {
+                return {
+                    stale: !hasLease && Date.now() - stat.mtimeMs > LOCK_STALE_FALLBACK_MS,
+                    raw,
+                    dev: stat.dev,
+                    ino: stat.ino,
+                };
+            }
+            if (err.code === "ESRCH") {
+                return { stale: true, raw, dev: stat.dev, ino: stat.ino };
+            }
+        }
+    }
+    return {
+        stale: Date.now() - stat.mtimeMs > LOCK_STALE_FALLBACK_MS,
+        raw,
+        dev: stat.dev,
+        ino: stat.ino,
+    };
+}
+function removeObservedLock(lockPath, observed) {
+    try {
+        const stat = fs.statSync(lockPath);
+        if (stat.dev !== observed.dev || stat.ino !== observed.ino)
+            return false;
+        if (fs.readFileSync(lockPath, "utf8").trim() !== observed.raw)
+            return false;
+        fs.unlinkSync(lockPath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function ownsLock(lock) {
+    if (lock.fd === null || !lock.nonce)
+        return false;
+    try {
+        const held = fs.fstatSync(lock.fd);
+        const current = fs.statSync(configLockFile());
+        if (held.dev !== current.dev || held.ino !== current.ino)
+            return false;
+        const [, , nonce] = fs.readFileSync(configLockFile(), "utf8").trim().split(/\s+/, 4);
+        return nonce === lock.nonce;
+    }
+    catch {
+        return false;
+    }
+}
+function heartbeatLock(lock) {
+    if (lock.fd === null || !lock.nonce || !ownsLock(lock)) {
+        if (lock.heartbeat)
+            clearInterval(lock.heartbeat);
+        lock.heartbeat = undefined;
+        return;
+    }
+    const record = configLockOwner(lock.nonce);
+    try {
+        fs.ftruncateSync(lock.fd, 0);
+        fs.writeSync(lock.fd, record, 0, "utf8");
+        fs.fsyncSync(lock.fd);
+    }
+    catch {
+        if (lock.heartbeat)
+            clearInterval(lock.heartbeat);
+        lock.heartbeat = undefined;
+    }
+}
 /**
  * Lazily initialized buffer for `Atomics.wait`-based synchronous sleep.
  * `undefined` = not yet probed; `null` = unavailable on this runtime.
@@ -637,14 +816,18 @@ function sleepSync(ms) {
 function releaseLock(lock) {
     if (lock.fd === null)
         return; // lock-less fallback: nothing to release
+    if (lock.heartbeat)
+        clearInterval(lock.heartbeat);
+    lock.heartbeat = undefined;
     try {
-        fs.closeSync(lock.fd);
+        if (ownsLock(lock))
+            fs.unlinkSync(configLockFile());
     }
     catch {
         /* ignore */
     }
     try {
-        fs.unlinkSync(configLockFile());
+        fs.closeSync(lock.fd);
     }
     catch {
         /* ignore */
@@ -672,6 +855,7 @@ function compactPersistedConfig(config) {
                 ...(userTokens.refreshToken ? { refreshToken: userTokens.refreshToken } : {}),
                 expiresAt: userTokens.expiresAt,
                 ...(userTokens.subject ? { subject: userTokens.subject } : {}),
+                ...(userTokens.clientId ? { clientId: userTokens.clientId } : {}),
             },
         }
         : undefined;

package/dist/contract-suite.d.ts

@@ -17,7 +17,6 @@
  * runHarnessContractSuite({
  *   harness: "claude-code",
  *   tool: "Bash",
- *   sessionCanBlock: true,
  *   sessionStart: async ({ client, gates }) => {
  *     const out = await handleHookEvent(sessionInput(), client, gates);
  *     return { blocked: out.decision === "block", reason: out.reason };
@@ -60,13 +59,6 @@ export interface HarnessContractAdapter {
     harness: string;
     /** A real, non-interactive tool from this harness's catalog. */
     tool: string;
-    /**
-     * @deprecated Ignored. Session start is now uniformly non-blocking on every
-     * harness (authentication never blocks; enforcement is governed by
-     * `permissionMode` at tool-call time). Kept optional so existing adapters
-     * that still pass it type-check.
-     */
-    sessionCanBlock?: boolean;
     /** Whether the tool gate can hard-block. Defaults to true. */
     toolCanBlock?: boolean;
     /** Drive the session-start phase through the plugin's real entry point. */

package/dist/contract-suite.js

@@ -18,7 +18,6 @@
  * runHarnessContractSuite({
  *   harness: "claude-code",
  *   tool: "Bash",
- *   sessionCanBlock: true,
  *   sessionStart: async ({ client, gates }) => {
  *     const out = await handleHookEvent(sessionInput(), client, gates);
  *     return { blocked: out.decision === "block", reason: out.reason };

package/dist/event-reporter.d.ts

@@ -49,6 +49,7 @@ export declare class AgentSecurityEventReporter {
     private readonly retryBaseMs;
     private readonly retryMaxMs;
     private readonly random;
+    private readonly reportedAuthFailures;
     constructor(options: EventReporterOptions);
     get pending(): number;
     get pendingScopes(): ReadonlyArray<PendingEventScope>;

package/dist/event-reporter.js

@@ -105,6 +105,7 @@ class AgentSecurityEventReporter {
     retryBaseMs;
     retryMaxMs;
     random;
+    reportedAuthFailures = new Set();
     constructor(options) {
         this.options = options;
         this.fetcher = options.fetch ?? globalThis.fetch;
@@ -328,14 +329,27 @@ class AgentSecurityEventReporter {
                 this.diagnostic("events.batch_rejected", new Error(`HTTP ${response.status}`));
                 return "reject";
             }
-            if (response.status === 401) {
+            if (response.status === 401 || response.status === 403) {
                 try {
-                    if (token)
+                    if (response.status === 401 && token) {
                         this.options.onUnauthorized?.(scope.sessionId, scope.principalKey, token);
+                    }
                 }
                 catch (error) {
                     this.diagnostic("events.credential_invalidation_failed", error);
                 }
+                const failureKey = `${scopeKey(scope)}:${response.status}`;
+                if (!this.reportedAuthFailures.has(failureKey)) {
+                    this.reportedAuthFailures.add(failureKey);
+                    this.options.logger?.activity("events.record", "error", {
+                        sessionId: scope.sessionId,
+                        attributes: {
+                            failureType: "authentication",
+                            reasonCode: response.status === 401 ? "session_inactive" : "forbidden",
+                            count: batch.length,
+                        },
+                    });
+                }
                 return "retain";
             }
             if (response.status === 429 || (response.status >= 500 && response.status <= 599)) {
@@ -359,6 +373,9 @@ class AgentSecurityEventReporter {
                 this.diagnostic("events.invalid_response", new Error("response event IDs did not match request order"));
                 return "retain";
             }
+            const acceptedScope = scopeKey(scope);
+            this.reportedAuthFailures.delete(`${acceptedScope}:401`);
+            this.reportedAuthFailures.delete(`${acceptedScope}:403`);
             return "accepted";
         }
         finally {

package/dist/hook-timeout.d.ts

@@ -29,8 +29,8 @@
  * can be given — which is why the login window has to fit inside 120s.
  */
 /**
- * Wall-clock budget for a session-start hook: the interactive login, plus the
- * agent DCR registration and delegation record that follow it.
+ * Wall-clock budget for a session-start hook: the interactive login, plus Talos
+ * credential loading or enrollment and the delegation record that follow it.
  *
  * Generous on purpose. It is an upper bound on a hook that is *waiting*, not a
  * latency target — nothing is spinning, and the login gives up on its own well

package/dist/hook-timeout.js

@@ -35,8 +35,8 @@ exports.sessionStartHookTimeout = sessionStartHookTimeout;
 exports.toolHookTimeout = toolHookTimeout;
 const auth_js_1 = require("./auth.js");
 /**
- * Wall-clock budget for a session-start hook: the interactive login, plus the
- * agent DCR registration and delegation record that follow it.
+ * Wall-clock budget for a session-start hook: the interactive login, plus Talos
+ * credential loading or enrollment and the delegation record that follow it.
  *
  * Generous on purpose. It is an upper bound on a hook that is *waiting*, not a
  * latency target — nothing is spinning, and the login gives up on its own well

package/dist/index.d.ts

@@ -1,9 +1,9 @@
-export { OryAgentClient, type OryAgentConfig, type PrincipalIdentity, type RecordDelegationInput, type RecordDelegationResult, } from "./client.js";
-export { authenticatedRuntimeRequest, canonicalCredentialIdentity, canonicalProjectUrl, credentialAccount, configureSystemCaTrustForDefaultFetch, createOsTalosCredentialStore, enrollTalosChildRuntimeCredential, enrollTalosRuntimeCredential, resolveRuntimeCredential, runCredentialStoreCommand, talosRuntimeCredential, type CredentialStoreCommandOptions, type CredentialStoreCommandRunner, type ResolveRuntimeCredentialOptions, type EnrollTalosChildRuntimeCredentialOptions, type EnrollTalosRuntimeCredentialOptions, type EnrolledRuntimeCredential, type OsTalosCredentialStoreOptions, type NodeTlsCaProvider, type StoredTalosCredential, type TalosCredentialStore, type TalosCredentialIdentity, type RuntimeAuthenticatedRequest, type RuntimeAuthorizationHeader, type RuntimeCredential, type RuntimeCredentialKind, type RuntimeRequestAuthenticator, } from "./runtime-credential.js";
+export { OryAgentClient, type OryAgentConfig, type PrincipalIdentity, type RecordDelegationInput, type RecordDelegationResult, type RuntimeContext, } from "./client.js";
+export { authenticatedRuntimeRequest, canonicalCredentialIdentity, canonicalProjectUrl, credentialAccount, configureSystemCaTrustForDefaultFetch, createSpiffeFileRequestAuthenticator, createOsTalosCredentialStore, enrollTalosChildRuntimeCredential, enrollTalosRuntimeCredential, resolveRuntimeCredential, runCredentialStoreCommand, talosRuntimeCredential, type CredentialStoreCommandOptions, type CredentialStoreCommandRunner, type ResolveRuntimeCredentialOptions, type SpiffeFileRequestAuthenticatorOptions, type EnrollTalosChildRuntimeCredentialOptions, type EnrollTalosRuntimeCredentialOptions, type EnrolledRuntimeCredential, type OsTalosCredentialStoreOptions, type NodeTlsCaProvider, type StoredTalosCredential, type TalosCredentialStore, type TalosCredentialIdentity, type RuntimeAuthenticatedRequest, type RuntimeAuthorizationHeader, type RuntimeCredential, type RuntimeCredentialKind, type RuntimeRequestAuthenticator, } from "./runtime-credential.js";
 export { DebugLogger, ActiveActivity, redactLogData, formatLogEntry, withQuietStderr, type LogEntry, type LogLevel, type ActivityEntry, type ActivityStatus, type UnifiedLogEntry, type ActivityEnricher, type ActivitySink, } from "./logger.js";
 export { AgentSecurityEventReporter, SERVER_ACTIVITY_EVENTS, projectActivityEntry, type EventReporterOptions, type ServerActivityEvent, } from "./event-reporter.js";
 export { currentSessionContext, withSessionContext, setSessionContext, clearSessionContext, type SessionContext, } from "./context.js";
-export { loadConfig, saveConfig, resolveConfig, isSecurityConnected, describeSecurityGap, type SecurityConnection, mutateConfig, getConfigPath, getDataDir, getHarnessDataDir, listInstalledHarnesses, registerInstalledHarness, unregisterInstalledHarness, UNKNOWN_HARNESS_KEY, SESSIONLESS_KEY, type OryPluginConfig, type OryOAuth2Tokens, type OryUserCredentials, type OryAgentCredentialsBlock, type OryAgentDynamicCredentials, type OryDelegationRecord, type PermissionMode, type PermissionModeCache, } from "./config.js";
+export { loadConfig, saveConfig, resolveConfig, isSecurityConnected, describeSecurityGap, readAgentRootDelegation, validateAgentRootDelegation, AGENT_ROOT_DELEGATION_ENV_VAR, type SecurityConnection, mutateConfig, mutateConfigAsync, getConfigPath, getDataDir, getHarnessDataDir, listInstalledHarnesses, registerInstalledHarness, unregisterInstalledHarness, UNKNOWN_HARNESS_KEY, SESSIONLESS_KEY, type OryPluginConfig, type AsyncConfigMutation, type OryOAuth2Tokens, type OryUserCredentials, type OryAgentCredentialsBlock, type OryAgentDynamicCredentials, type OryDelegationRecord, type PermissionMode, type PermissionModeCache, } from "./config.js";
 export { resolvePermissionMode, warmPermissionModeCache, resetPermissionModeCache, type PermissionModeSource, type ResolvedPermissionMode, type ModeSubject, } from "./permission-mode.js";
 export { pkceLogin, refreshAccessToken, detectHeadless, generateCodeVerifier, sha256Base64Url, buildAuthorizeUrl, LOOPBACK_PORTS, DEFAULT_LOGIN_TIMEOUT_MS, type PkceLoginOptions, type PkceLoginOutcome, type PkceDeclineReason, } from "./auth.js";
 export { wantsHelp, shouldPrintHelp } from "./help-cli.js";
@@ -11,7 +11,7 @@ export { loadExternalRegistrations, recordExternalRegistration, clearExternalReg
 export { SESSION_START_HOOK_WINDOW_MS, TOOL_HOOK_WINDOW_MS, HOOK_TIMEOUT_MAX_MS, sessionStartHookTimeout, toolHookTimeout, type HookTimeoutUnit, } from "./hook-timeout.js";
 export { loadTokens, saveTokens, clearTokens, isExpired, refreshAndSave, tryAcquirePkceFlightLock, clearPkceFlightLock, waitForPeerTokens, waitForPeerTokensSync, TOKEN_EXPIRY_SKEW_SEC, type PkceFlightLock, } from "./auth-store.js";
 export { ensureUserAuthenticated, ensureAuthenticated, type UserLoginDecision, type UserLoginMode, type UserLoginOptions, } from "./user-login.js";
-export { resolveAgentCredentials, resolveRuntimeAgentCredentials, ensureAgentIdentity, ensureSubAgentIdentity, fetchClientCredentialsToken, registerAgentClient, loadAgentDynamicCredentials, loadAgentDynamicCredentialsByHarness, saveAgentDynamicCredentials, clearAgentDynamicCredentials, latestAgentRegistration, latestSubAgentSession, countAgentSessions, claimAgentDynamicCredentials, loadSubAgentDynamicCredentials, loadAllSubAgentDynamicCredentials, loadSubAgentDynamicCredentialsByHarness, saveSubAgentDynamicCredentials, clearSubAgentDynamicCredentials, clearSubAgentDynamicCredentialsForHarness, claimSubAgentDynamicCredentials, loadDelegationNodeId, saveDelegationNodeId, loadRetiredCredentials, clearRetiredCredentials, retireAgentSessions, sessionRetention, revokeAgentDynamicClient, AGENT_TOKEN_EXPIRY_SKEW_SEC, DEFAULT_SESSION_RETENTION, type AgentRegistrationClaim, type AgentCredentials, type AgentCredentialKind, type ResolveAgentCredentialsOptions, type ResolveRuntimeAgentCredentialsOptions, type EnsureAgentIdentityOptions, type RegisterAgentClientArgs, type DelegationInput, type RevokeAgentClientResult, type SubAgentIdentity, type EnsureSubAgentIdentityOptions, } from "./agent-auth.js";
+export { resolveAgentCredentials, resolvePreprovisionedRuntimeContext, resolveRuntimeAgentCredentials, ensureAgentIdentity, ensureSubAgentIdentity, fetchClientCredentialsToken, registerAgentClient, loadAgentDynamicCredentials, loadAgentDynamicCredentialsByHarness, saveAgentDynamicCredentials, clearAgentDynamicCredentials, latestAgentRegistration, latestSubAgentSession, countAgentSessions, claimAgentDynamicCredentials, loadSubAgentDynamicCredentials, loadAllSubAgentDynamicCredentials, loadSubAgentDynamicCredentialsByHarness, saveSubAgentDynamicCredentials, clearSubAgentDynamicCredentials, clearSubAgentDynamicCredentialsForHarness, claimSubAgentDynamicCredentials, loadDelegationNodeId, resolvePreprovisionedRootDelegation, saveDelegationNodeId, loadRetiredCredentials, clearRetiredCredentials, retireAgentSessions, sessionRetention, revokeAgentDynamicClient, AGENT_TOKEN_EXPIRY_SKEW_SEC, DEFAULT_SESSION_RETENTION, type AgentRegistrationClaim, type AgentCredentials, type AgentCredentialKind, type ResolveAgentCredentialsOptions, type ResolveRuntimeAgentCredentialsOptions, type EnsureAgentIdentityOptions, type RegisterAgentClientArgs, type DelegationInput, type RevokeAgentClientResult, type SubAgentIdentity, type EnsureSubAgentIdentityOptions, } from "./agent-auth.js";
 export { ensureReadCredential, resetReadCredentialBackoff, READ_CREDENTIAL_RETRY_MS, type EnsureReadCredentialOptions, type ReadCredentialOutcome, } from "./read-credential.js";
 export { clearCredentialsForUninstall, resolveInstalledHarnesses, type ClearCredentialsOptions, type ClearCredentialsResult, } from "./uninstall.js";
 export { type SessionInfo, type OAuth2TokenInfo, type PermissionCheck, type PermissionResult, type BatchPermissionResult, type OryError, type OryErrorCode, } from "./types.js";

package/dist/index.js

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.wantsHelp = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.LOOPBACK_PORTS = exports.buildAuthorizeUrl = exports.sha256Base64Url = exports.generateCodeVerifier = exports.detectHeadless = exports.refreshAccessToken = exports.pkceLogin = exports.resetPermissionModeCache = exports.warmPermissionModeCache = exports.resolvePermissionMode = exports.SESSIONLESS_KEY = exports.UNKNOWN_HARNESS_KEY = exports.unregisterInstalledHarness = exports.registerInstalledHarness = exports.listInstalledHarnesses = exports.getHarnessDataDir = exports.getDataDir = exports.getConfigPath = exports.mutateConfig = exports.describeSecurityGap = exports.isSecurityConnected = exports.resolveConfig = exports.saveConfig = exports.loadConfig = exports.clearSessionContext = exports.setSessionContext = exports.withSessionContext = exports.currentSessionContext = exports.projectActivityEntry = exports.SERVER_ACTIVITY_EVENTS = exports.AgentSecurityEventReporter = exports.withQuietStderr = exports.formatLogEntry = exports.redactLogData = exports.ActiveActivity = exports.DebugLogger = exports.talosRuntimeCredential = exports.runCredentialStoreCommand = exports.resolveRuntimeCredential = exports.enrollTalosRuntimeCredential = exports.enrollTalosChildRuntimeCredential = exports.createOsTalosCredentialStore = exports.configureSystemCaTrustForDefaultFetch = exports.credentialAccount = exports.canonicalProjectUrl = exports.canonicalCredentialIdentity = exports.authenticatedRuntimeRequest = exports.OryAgentClient = void 0;
-exports.clearRetiredCredentials = exports.loadRetiredCredentials = exports.saveDelegationNodeId = exports.loadDelegationNodeId = exports.claimSubAgentDynamicCredentials = exports.clearSubAgentDynamicCredentialsForHarness = exports.clearSubAgentDynamicCredentials = exports.saveSubAgentDynamicCredentials = exports.loadSubAgentDynamicCredentialsByHarness = exports.loadAllSubAgentDynamicCredentials = exports.loadSubAgentDynamicCredentials = exports.claimAgentDynamicCredentials = exports.countAgentSessions = exports.latestSubAgentSession = exports.latestAgentRegistration = exports.clearAgentDynamicCredentials = exports.saveAgentDynamicCredentials = exports.loadAgentDynamicCredentialsByHarness = exports.loadAgentDynamicCredentials = exports.registerAgentClient = exports.fetchClientCredentialsToken = exports.ensureSubAgentIdentity = exports.ensureAgentIdentity = exports.resolveRuntimeAgentCredentials = exports.resolveAgentCredentials = exports.ensureAuthenticated = exports.ensureUserAuthenticated = exports.TOKEN_EXPIRY_SKEW_SEC = exports.waitForPeerTokensSync = exports.waitForPeerTokens = exports.clearPkceFlightLock = exports.tryAcquirePkceFlightLock = exports.refreshAndSave = exports.isExpired = exports.clearTokens = exports.saveTokens = exports.loadTokens = exports.toolHookTimeout = exports.sessionStartHookTimeout = exports.HOOK_TIMEOUT_MAX_MS = exports.TOOL_HOOK_WINDOW_MS = exports.SESSION_START_HOOK_WINDOW_MS = exports.describeDanglingRegistration = exports.findDanglingRegistration = exports.deregisterExternalRegistrations = exports.clearAllExternalRegistrations = exports.clearExternalRegistration = exports.recordExternalRegistration = exports.loadExternalRegistrations = exports.shouldPrintHelp = void 0;
-exports.mergeMcpServer = exports.mcpServerEntry = exports.emitDeferredNextSteps = exports.beginDeferNextSteps = exports.nextStepsSink = exports.printNextSteps = exports.printSetupHelp = exports.removeFlatHooks = exports.mergeFlatHooks = exports.flatHookEntry = exports.removeMatcherHooks = exports.mergeMatcherHooks = exports.matcherHookEntry = exports.isOryHookCommand = exports.writeJsonFile = exports.readJsonFile = exports.parseSetupArgs = exports.resolveBuildInfo = exports.collectVersionInfo = exports.runVersionCommand = exports.probePermissionsCoverage = exports.collectStatusReport = exports.printPermissionsSection = exports.printAgentIdentitySection = exports.printUserIdentitySection = exports.runStatusCommand = exports.runPostInstall = exports.runWatchCommand = exports.runPermissionsCommand = exports.oryNpx = exports.interactiveConfigPrompt = exports.promptForProjectUrl = exports.promptOnTty = exports.isTtyAvailable = exports.printEnvHelp = exports.printLogTail = exports.printEnvironment = exports.printOryConfig = exports.runAgentCommand = exports.runConfigureCommand = exports.resolveInstalledHarnesses = exports.clearCredentialsForUninstall = exports.READ_CREDENTIAL_RETRY_MS = exports.resetReadCredentialBackoff = exports.ensureReadCredential = exports.DEFAULT_SESSION_RETENTION = exports.AGENT_TOKEN_EXPIRY_SKEW_SEC = exports.revokeAgentDynamicClient = exports.sessionRetention = exports.retireAgentSessions = void 0;
-exports.decomposeAndCheck = exports.gateToolCall = exports.applyPermissionMode = exports.checkAndDecide = exports.REGISTRY_URL = exports.runRegistryCommand = exports.runLocalCommand = exports.ORY_COMMAND_SLUGS = exports.ORY_COMMAND_SKILL_NAMES = exports.ORY_SKILL_NAMES = exports.removeSkillDirs = exports.writeSkillTree = exports.toSkillMarkdown = exports.commandToPlainMarkdown = exports.commandToFrontmatterMarkdown = exports.commandToToml = exports.commandToSkill = exports.renderOryCommands = exports.renderOrySkills = exports.renderMirrorBootstrap = exports.MCP_SERVER_PACKAGE = exports.defaultNpmInstaller = exports.describeRuntimeHealth = exports.checkRuntimeHealth = exports.pruneRuntimeStores = exports.removeRuntimeWiring = exports.getRuntimeWiring = exports.recordRuntimeWiring = exports.readRuntimeManifest = exports.getMcpShimPath = exports.getHookShimPath = exports.getShimDir = exports.getRuntimeStoreDir = exports.getRuntimeRoot = exports.moduleSpecifier = exports.requireHookCommand = exports.isOryRuntimeCommand = exports.mcpCommand = exports.hookCommand = exports.writeMcpShim = exports.writeHookShim = exports.resolveMcpRuntimeEntry = exports.resolveRuntimeEntry = exports.linkedRuntime = exports.materializeRuntime = exports.resolveRuntimeForInstall = exports.wireRuntime = exports.unregisterPlugin = exports.registerPlugin = exports.removeMcpServer = void 0;
-exports.isUserFacingPhase = exports.classifyLifecycle = exports.extractShellCommand = exports.resolveShellCommandNamespace = exports.getShellCommandCatalog = exports.SHELL_COMMAND_CATALOG = exports.isShellTool = exports.getShellToolCatalog = exports.SHELL_TOOL_CATALOG = exports.isInteractiveTool = exports.getInteractiveToolCatalog = exports.INTERACTIVE_TOOL_CATALOG = exports.getToolCatalog = exports.ALL_TOOLS = exports.KNOWN_HARNESSES = exports.HARNESS_TOOL_CATALOG = exports.DEFAULT_SHELL_NAMESPACE = exports.DEFAULT_NAMESPACE = exports.PERMIT_USE = exports.ENROLLMENT_NAMESPACE = exports.AGENT_ROLE_NAMESPACE = exports.DELEGATION_NAMESPACE = exports.PERMISSION_MODE_NAMESPACE = exports.PROJECT_POSTURE_OBJECT = exports.AUTO_ENROLL_OBJECT = exports.PERMISSION_MODE_OBJECT = exports.RELATION_OPTED_OUT_SUBJECTS = exports.RELATION_MEMBERS = exports.RELATION_ENFORCED_SUBJECTS = exports.RELATION_CREDENTIALS = exports.RELATION_DELEGATES = exports.RELATION_BLOCKED_SUBJECTS = exports.RELATION_USERS = exports.SUBAGENT_NODE_NAMESPACE = exports.AGENT_NODE_NAMESPACE = exports.NODE_REFERENCE_NAMESPACES = exports.PRINCIPAL_NAMESPACES = exports.OPL_IMPORT_SYMBOLS = exports.OPL_IMPORT_MODULE = exports.renderOplImport = exports.renderPrincipalClass = exports.renderEnrollmentNamespaceClass = exports.renderAgentRoleNamespaceClass = exports.renderPermissionModeNamespaceClass = exports.renderDelegationNamespaceClass = exports.renderToolNamespaceClass = exports.buildAgentSecurityOpl = exports.extractBashCommandWords = exports.extractShellCommands = exports.resolveCheckRelation = void 0;
-exports.collectSystemServices = exports.wrapTool = exports.writeAgentDelegatesSubagent = exports.writeUserDelegatesAgent = exports.registerSubagent = exports.fail = exports.complete = exports.gate = exports.decideTool = exports.withHookContext = exports.createSessionStarter = exports.sessionStart = exports.resolveNamespace = exports.summarizeToolOutput = exports.summarizeToolInput = exports.OryDenialError = exports.shellDenialFields = exports.alertAttributes = exports.formatAlertSummary = exports.formatAlertMessage = exports.formatDenialSummary = exports.formatDenialMessage = exports.DEFAULT_USER_SUBJECT_NAMESPACE = exports.SESSION_NAMESPACE = exports.SUBAGENT_NAMESPACE = exports.AGENT_NAMESPACE = exports.resolveSubAgentSpawnSubject = exports.resolveSubAgentSubject = exports.resolveAgentSessionSubject = exports.resolveAgentSubject = exports.subjectLabel = exports.runWithUserSubject = exports.resolveUserSubject = exports.checkMcpPermission = exports.parseMcpToolGeneric = exports.parseGeminiMcpTool = exports.parseClaudeCodeMcpTool = exports.TOOL_EXECUTION_PHASES = exports.USER_FACING_PHASES = exports.HARNESS_LIFECYCLE_MAP = exports.isToolExecutionPhase = void 0;
+exports.generateCodeVerifier = exports.detectHeadless = exports.refreshAccessToken = exports.pkceLogin = exports.resetPermissionModeCache = exports.warmPermissionModeCache = exports.resolvePermissionMode = exports.SESSIONLESS_KEY = exports.UNKNOWN_HARNESS_KEY = exports.unregisterInstalledHarness = exports.registerInstalledHarness = exports.listInstalledHarnesses = exports.getHarnessDataDir = exports.getDataDir = exports.getConfigPath = exports.mutateConfigAsync = exports.mutateConfig = exports.AGENT_ROOT_DELEGATION_ENV_VAR = exports.validateAgentRootDelegation = exports.readAgentRootDelegation = exports.describeSecurityGap = exports.isSecurityConnected = exports.resolveConfig = exports.saveConfig = exports.loadConfig = exports.clearSessionContext = exports.setSessionContext = exports.withSessionContext = exports.currentSessionContext = exports.projectActivityEntry = exports.SERVER_ACTIVITY_EVENTS = exports.AgentSecurityEventReporter = exports.withQuietStderr = exports.formatLogEntry = exports.redactLogData = exports.ActiveActivity = exports.DebugLogger = exports.talosRuntimeCredential = exports.runCredentialStoreCommand = exports.resolveRuntimeCredential = exports.enrollTalosRuntimeCredential = exports.enrollTalosChildRuntimeCredential = exports.createOsTalosCredentialStore = exports.createSpiffeFileRequestAuthenticator = exports.configureSystemCaTrustForDefaultFetch = exports.credentialAccount = exports.canonicalProjectUrl = exports.canonicalCredentialIdentity = exports.authenticatedRuntimeRequest = exports.OryAgentClient = void 0;
+exports.clearSubAgentDynamicCredentials = exports.saveSubAgentDynamicCredentials = exports.loadSubAgentDynamicCredentialsByHarness = exports.loadAllSubAgentDynamicCredentials = exports.loadSubAgentDynamicCredentials = exports.claimAgentDynamicCredentials = exports.countAgentSessions = exports.latestSubAgentSession = exports.latestAgentRegistration = exports.clearAgentDynamicCredentials = exports.saveAgentDynamicCredentials = exports.loadAgentDynamicCredentialsByHarness = exports.loadAgentDynamicCredentials = exports.registerAgentClient = exports.fetchClientCredentialsToken = exports.ensureSubAgentIdentity = exports.ensureAgentIdentity = exports.resolveRuntimeAgentCredentials = exports.resolvePreprovisionedRuntimeContext = exports.resolveAgentCredentials = exports.ensureAuthenticated = exports.ensureUserAuthenticated = exports.TOKEN_EXPIRY_SKEW_SEC = exports.waitForPeerTokensSync = exports.waitForPeerTokens = exports.clearPkceFlightLock = exports.tryAcquirePkceFlightLock = exports.refreshAndSave = exports.isExpired = exports.clearTokens = exports.saveTokens = exports.loadTokens = exports.toolHookTimeout = exports.sessionStartHookTimeout = exports.HOOK_TIMEOUT_MAX_MS = exports.TOOL_HOOK_WINDOW_MS = exports.SESSION_START_HOOK_WINDOW_MS = exports.describeDanglingRegistration = exports.findDanglingRegistration = exports.deregisterExternalRegistrations = exports.clearAllExternalRegistrations = exports.clearExternalRegistration = exports.recordExternalRegistration = exports.loadExternalRegistrations = exports.shouldPrintHelp = exports.wantsHelp = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.LOOPBACK_PORTS = exports.buildAuthorizeUrl = exports.sha256Base64Url = void 0;
+exports.removeFlatHooks = exports.mergeFlatHooks = exports.flatHookEntry = exports.removeMatcherHooks = exports.mergeMatcherHooks = exports.matcherHookEntry = exports.isOryHookCommand = exports.writeJsonFile = exports.readJsonFile = exports.parseSetupArgs = exports.resolveBuildInfo = exports.collectVersionInfo = exports.runVersionCommand = exports.probePermissionsCoverage = exports.collectStatusReport = exports.printPermissionsSection = exports.printAgentIdentitySection = exports.printUserIdentitySection = exports.runStatusCommand = exports.runPostInstall = exports.runWatchCommand = exports.runPermissionsCommand = exports.oryNpx = exports.interactiveConfigPrompt = exports.promptForProjectUrl = exports.promptOnTty = exports.isTtyAvailable = exports.printEnvHelp = exports.printLogTail = exports.printEnvironment = exports.printOryConfig = exports.runAgentCommand = exports.runConfigureCommand = exports.resolveInstalledHarnesses = exports.clearCredentialsForUninstall = exports.READ_CREDENTIAL_RETRY_MS = exports.resetReadCredentialBackoff = exports.ensureReadCredential = exports.DEFAULT_SESSION_RETENTION = exports.AGENT_TOKEN_EXPIRY_SKEW_SEC = exports.revokeAgentDynamicClient = exports.sessionRetention = exports.retireAgentSessions = exports.clearRetiredCredentials = exports.loadRetiredCredentials = exports.saveDelegationNodeId = exports.resolvePreprovisionedRootDelegation = exports.loadDelegationNodeId = exports.claimSubAgentDynamicCredentials = exports.clearSubAgentDynamicCredentialsForHarness = void 0;
+exports.ORY_COMMAND_SLUGS = exports.ORY_COMMAND_SKILL_NAMES = exports.ORY_SKILL_NAMES = exports.removeSkillDirs = exports.writeSkillTree = exports.toSkillMarkdown = exports.commandToPlainMarkdown = exports.commandToFrontmatterMarkdown = exports.commandToToml = exports.commandToSkill = exports.renderOryCommands = exports.renderOrySkills = exports.renderMirrorBootstrap = exports.MCP_SERVER_PACKAGE = exports.defaultNpmInstaller = exports.describeRuntimeHealth = exports.checkRuntimeHealth = exports.pruneRuntimeStores = exports.removeRuntimeWiring = exports.getRuntimeWiring = exports.recordRuntimeWiring = exports.readRuntimeManifest = exports.getMcpShimPath = exports.getHookShimPath = exports.getShimDir = exports.getRuntimeStoreDir = exports.getRuntimeRoot = exports.moduleSpecifier = exports.requireHookCommand = exports.isOryRuntimeCommand = exports.mcpCommand = exports.hookCommand = exports.writeMcpShim = exports.writeHookShim = exports.resolveMcpRuntimeEntry = exports.resolveRuntimeEntry = exports.linkedRuntime = exports.materializeRuntime = exports.resolveRuntimeForInstall = exports.wireRuntime = exports.unregisterPlugin = exports.registerPlugin = exports.removeMcpServer = exports.mergeMcpServer = exports.mcpServerEntry = exports.emitDeferredNextSteps = exports.beginDeferNextSteps = exports.nextStepsSink = exports.printNextSteps = exports.printSetupHelp = void 0;
+exports.getShellToolCatalog = exports.SHELL_TOOL_CATALOG = exports.isInteractiveTool = exports.getInteractiveToolCatalog = exports.INTERACTIVE_TOOL_CATALOG = exports.getToolCatalog = exports.ALL_TOOLS = exports.KNOWN_HARNESSES = exports.HARNESS_TOOL_CATALOG = exports.DEFAULT_SHELL_NAMESPACE = exports.DEFAULT_NAMESPACE = exports.PERMIT_USE = exports.ENROLLMENT_NAMESPACE = exports.AGENT_ROLE_NAMESPACE = exports.DELEGATION_NAMESPACE = exports.PERMISSION_MODE_NAMESPACE = exports.PROJECT_POSTURE_OBJECT = exports.AUTO_ENROLL_OBJECT = exports.PERMISSION_MODE_OBJECT = exports.RELATION_OPTED_OUT_SUBJECTS = exports.RELATION_MEMBERS = exports.RELATION_ENFORCED_SUBJECTS = exports.RELATION_CREDENTIALS = exports.RELATION_DELEGATES = exports.RELATION_BLOCKED_SUBJECTS = exports.RELATION_USERS = exports.SUBAGENT_NODE_NAMESPACE = exports.AGENT_NODE_NAMESPACE = exports.NODE_REFERENCE_NAMESPACES = exports.PRINCIPAL_NAMESPACES = exports.OPL_IMPORT_SYMBOLS = exports.OPL_IMPORT_MODULE = exports.renderOplImport = exports.renderPrincipalClass = exports.renderEnrollmentNamespaceClass = exports.renderAgentRoleNamespaceClass = exports.renderPermissionModeNamespaceClass = exports.renderDelegationNamespaceClass = exports.renderToolNamespaceClass = exports.buildAgentSecurityOpl = exports.extractBashCommandWords = exports.extractShellCommands = exports.resolveCheckRelation = exports.decomposeAndCheck = exports.gateToolCall = exports.applyPermissionMode = exports.checkAndDecide = exports.REGISTRY_URL = exports.runRegistryCommand = exports.runLocalCommand = void 0;
+exports.collectSystemServices = exports.wrapTool = exports.writeAgentDelegatesSubagent = exports.writeUserDelegatesAgent = exports.registerSubagent = exports.fail = exports.complete = exports.gate = exports.decideTool = exports.withHookContext = exports.createSessionStarter = exports.sessionStart = exports.resolveNamespace = exports.summarizeToolOutput = exports.summarizeToolInput = exports.OryDenialError = exports.shellDenialFields = exports.alertAttributes = exports.formatAlertSummary = exports.formatAlertMessage = exports.formatDenialSummary = exports.formatDenialMessage = exports.DEFAULT_USER_SUBJECT_NAMESPACE = exports.SESSION_NAMESPACE = exports.SUBAGENT_NAMESPACE = exports.AGENT_NAMESPACE = exports.resolveSubAgentSpawnSubject = exports.resolveSubAgentSubject = exports.resolveAgentSessionSubject = exports.resolveAgentSubject = exports.subjectLabel = exports.runWithUserSubject = exports.resolveUserSubject = exports.checkMcpPermission = exports.parseMcpToolGeneric = exports.parseGeminiMcpTool = exports.parseClaudeCodeMcpTool = exports.TOOL_EXECUTION_PHASES = exports.USER_FACING_PHASES = exports.HARNESS_LIFECYCLE_MAP = exports.isToolExecutionPhase = exports.isUserFacingPhase = exports.classifyLifecycle = exports.extractShellCommand = exports.resolveShellCommandNamespace = exports.getShellCommandCatalog = exports.SHELL_COMMAND_CATALOG = exports.isShellTool = void 0;
 var client_js_1 = require("./client.js");
 Object.defineProperty(exports, "OryAgentClient", { enumerable: true, get: function () { return client_js_1.OryAgentClient; } });
 var runtime_credential_js_1 = require("./runtime-credential.js");
@@ -14,6 +14,7 @@ Object.defineProperty(exports, "canonicalCredentialIdentity", { enumerable: true
 Object.defineProperty(exports, "canonicalProjectUrl", { enumerable: true, get: function () { return runtime_credential_js_1.canonicalProjectUrl; } });
 Object.defineProperty(exports, "credentialAccount", { enumerable: true, get: function () { return runtime_credential_js_1.credentialAccount; } });
 Object.defineProperty(exports, "configureSystemCaTrustForDefaultFetch", { enumerable: true, get: function () { return runtime_credential_js_1.configureSystemCaTrustForDefaultFetch; } });
+Object.defineProperty(exports, "createSpiffeFileRequestAuthenticator", { enumerable: true, get: function () { return runtime_credential_js_1.createSpiffeFileRequestAuthenticator; } });
 Object.defineProperty(exports, "createOsTalosCredentialStore", { enumerable: true, get: function () { return runtime_credential_js_1.createOsTalosCredentialStore; } });
 Object.defineProperty(exports, "enrollTalosChildRuntimeCredential", { enumerable: true, get: function () { return runtime_credential_js_1.enrollTalosChildRuntimeCredential; } });
 Object.defineProperty(exports, "enrollTalosRuntimeCredential", { enumerable: true, get: function () { return runtime_credential_js_1.enrollTalosRuntimeCredential; } });
@@ -41,7 +42,11 @@ Object.defineProperty(exports, "saveConfig", { enumerable: true, get: function (
 Object.defineProperty(exports, "resolveConfig", { enumerable: true, get: function () { return config_js_1.resolveConfig; } });
 Object.defineProperty(exports, "isSecurityConnected", { enumerable: true, get: function () { return config_js_1.isSecurityConnected; } });
 Object.defineProperty(exports, "describeSecurityGap", { enumerable: true, get: function () { return config_js_1.describeSecurityGap; } });
+Object.defineProperty(exports, "readAgentRootDelegation", { enumerable: true, get: function () { return config_js_1.readAgentRootDelegation; } });
+Object.defineProperty(exports, "validateAgentRootDelegation", { enumerable: true, get: function () { return config_js_1.validateAgentRootDelegation; } });
+Object.defineProperty(exports, "AGENT_ROOT_DELEGATION_ENV_VAR", { enumerable: true, get: function () { return config_js_1.AGENT_ROOT_DELEGATION_ENV_VAR; } });
 Object.defineProperty(exports, "mutateConfig", { enumerable: true, get: function () { return config_js_1.mutateConfig; } });
+Object.defineProperty(exports, "mutateConfigAsync", { enumerable: true, get: function () { return config_js_1.mutateConfigAsync; } });
 Object.defineProperty(exports, "getConfigPath", { enumerable: true, get: function () { return config_js_1.getConfigPath; } });
 Object.defineProperty(exports, "getDataDir", { enumerable: true, get: function () { return config_js_1.getDataDir; } });
 Object.defineProperty(exports, "getHarnessDataDir", { enumerable: true, get: function () { return config_js_1.getHarnessDataDir; } });
@@ -96,6 +101,7 @@ Object.defineProperty(exports, "ensureUserAuthenticated", { enumerable: true, ge
 Object.defineProperty(exports, "ensureAuthenticated", { enumerable: true, get: function () { return user_login_js_1.ensureAuthenticated; } });
 var agent_auth_js_1 = require("./agent-auth.js");
 Object.defineProperty(exports, "resolveAgentCredentials", { enumerable: true, get: function () { return agent_auth_js_1.resolveAgentCredentials; } });
+Object.defineProperty(exports, "resolvePreprovisionedRuntimeContext", { enumerable: true, get: function () { return agent_auth_js_1.resolvePreprovisionedRuntimeContext; } });
 Object.defineProperty(exports, "resolveRuntimeAgentCredentials", { enumerable: true, get: function () { return agent_auth_js_1.resolveRuntimeAgentCredentials; } });
 Object.defineProperty(exports, "ensureAgentIdentity", { enumerable: true, get: function () { return agent_auth_js_1.ensureAgentIdentity; } });
 Object.defineProperty(exports, "ensureSubAgentIdentity", { enumerable: true, get: function () { return agent_auth_js_1.ensureSubAgentIdentity; } });
@@ -117,6 +123,7 @@ Object.defineProperty(exports, "clearSubAgentDynamicCredentials", { enumerable:
 Object.defineProperty(exports, "clearSubAgentDynamicCredentialsForHarness", { enumerable: true, get: function () { return agent_auth_js_1.clearSubAgentDynamicCredentialsForHarness; } });
 Object.defineProperty(exports, "claimSubAgentDynamicCredentials", { enumerable: true, get: function () { return agent_auth_js_1.claimSubAgentDynamicCredentials; } });
 Object.defineProperty(exports, "loadDelegationNodeId", { enumerable: true, get: function () { return agent_auth_js_1.loadDelegationNodeId; } });
+Object.defineProperty(exports, "resolvePreprovisionedRootDelegation", { enumerable: true, get: function () { return agent_auth_js_1.resolvePreprovisionedRootDelegation; } });
 Object.defineProperty(exports, "saveDelegationNodeId", { enumerable: true, get: function () { return agent_auth_js_1.saveDelegationNodeId; } });
 Object.defineProperty(exports, "loadRetiredCredentials", { enumerable: true, get: function () { return agent_auth_js_1.loadRetiredCredentials; } });
 Object.defineProperty(exports, "clearRetiredCredentials", { enumerable: true, get: function () { return agent_auth_js_1.clearRetiredCredentials; } });

package/dist/lifecycle.js

@@ -160,7 +160,8 @@ exports.HARNESS_LIFECYCLE_MAP = {
     },
     // Cursor (editor + CLI). Subprocess hooks read from `.cursor/hooks.json`.
     // `preToolUse` is the single permission gate — it already fires for every
-    // tool category (Shell, Read, Write, MCP, Task). The more specific
+    // documented tool category (Shell, Read, Write, Grep, Delete, Task) and
+    // dynamic MCP calls. The more specific
     // `beforeShellExecution` / `beforeMCPExecution` / `beforeReadFile` hooks and
     // their `after*` counterparts surface activity to the user and are
     // activity-only (`user.interaction`), so shell/MCP/file access isn't gated

package/dist/local/configs.d.ts

@@ -76,10 +76,8 @@ export interface OathkeeperConfig {
  * contract: an Oathkeeper service configured like the hosted
  * `ory-corp:cloud:keto:read:user-token` rule — `oauth2_introspection`
  * authenticator against Hydra, `allow` authorizer, `noop` mutator, `strip_path:/user`
- * upstream to keto-read — so a valid plugin OAuth2 access token is *required* to
- * read permissions locally, exactly as it is on a hosted Ory project. (The
- * plugin's agent DCR / user PKCE tokens are populated before any permission read
- * runs, so this is transparent in the normal flow.)
+ * upstream to keto-read — so a valid OAuth2 access token is *required* to use
+ * this direct local read path, exactly as it is on a hosted Ory project.
  *
  * Set `ORY_LOCAL_OATHKEEPER=0` (also `false`/`no`/`off`) to opt out and fall back
  * to a transparent nginx passthrough that strips `/user` and forwards straight to

package/dist/local/configs.js

@@ -201,10 +201,8 @@ function getConsoleConfig(projectRoot) {
  * contract: an Oathkeeper service configured like the hosted
  * `ory-corp:cloud:keto:read:user-token` rule — `oauth2_introspection`
  * authenticator against Hydra, `allow` authorizer, `noop` mutator, `strip_path:/user`
- * upstream to keto-read — so a valid plugin OAuth2 access token is *required* to
- * read permissions locally, exactly as it is on a hosted Ory project. (The
- * plugin's agent DCR / user PKCE tokens are populated before any permission read
- * runs, so this is transparent in the normal flow.)
+ * upstream to keto-read — so a valid OAuth2 access token is *required* to use
+ * this direct local read path, exactly as it is on a hosted Ory project.
  *
  * Set `ORY_LOCAL_OATHKEEPER=0` (also `false`/`no`/`off`) to opt out and fall back
  * to a transparent nginx passthrough that strips `/user` and forwards straight to

package/dist/local/manager.js

@@ -843,7 +843,7 @@ function printSeedResult(result) {
     console.log("Seed complete!");
     console.log("==============");
     console.log("");
-    console.log(`  Agent identity: self-registers on first run via DCR (nothing seeded)`);
+    console.log(`  Agent identity: Talos enrollment runs at session start (nothing seeded)`);
     console.log("");
     console.log(`  User identity:  ${result.user.identity.email} (${result.user.identity.id})`);
     console.log(`  User password:  ${result.user.password}`);
@@ -860,9 +860,9 @@ function printSeedResult(result) {
     console.log(`  export ORY_USER_SUBJECT_ID=${result.user.identity.id}`);
     console.log("");
     console.log("The user gate runs PKCE in the browser — sign in with the email and");
-    console.log("password printed above. The agent OAuth2 client is registered");
-    console.log("automatically via Dynamic Client Registration (RFC 7591) on first");
-    console.log("session using the user's bearer as the initial access token.");
+    console.log("password printed above. At first session start, the authenticated user");
+    console.log("enrolls an actor-bound Talos credential. It is stored in the native OS");
+    console.log("credential store; tool hooks only load the existing credential.");
     console.log("");
     console.log("Or save the project URL to the shared config (persists across sessions):");
     console.log("");

package/dist/local/seed.d.ts

@@ -7,10 +7,10 @@
  * redirect URIs. The launcher always runs the real PKCE browser flow; the
  * user types these credentials into the login UI to complete the flow.
  *
- * No agent principal is seeded: the harness self-registers a DCR OAuth2
- * client for the agent on first session start (using the user's bearer as
- * the initial access token), and permission checks are made against the
- * user subject — so a pre-seeded agent Kratos identity would be unused.
+ * No agent principal is seeded: Agent Security enrolls a Talos runtime
+ * credential at session start using the authenticated user's bearer, and
+ * permission checks are made against the user subject. A pre-seeded agent
+ * Kratos identity would be unused.
  *
  * Permission tuples are written as SubjectSet `User:<identity.id>` so
  * the Console's *Add relationship* dialog (which always emits SubjectSet