@ory/argus 1.2.3 → 1.3.0

package/dist/runtime.js

@@ -27,10 +27,10 @@
  *      wired where, so `status` can report the runtime a harness will actually
  *      load, upgrades can rewire, and unreferenced stores can be pruned.
  *
- * A **linked** runtime (`linkedRuntime`) points the shim straight at a
- * workspace build instead of a materialized store. That is the development
- * loop: `pnpm build` + relaunch, with no publish, no version bump, and no
- * registry involved.
+ * A **linked** runtime (`linkedRuntime`) points the shim straight at an
+ * explicit prebuilt package directory instead of a materialized store. This
+ * supports both administrator-managed runtimes and the workspace development
+ * loop (`pnpm build` + relaunch), with no registry involved.
  *
  * ## The shim must fail open
  *
@@ -93,6 +93,7 @@ exports.resolveMcpRuntimeEntry = resolveMcpRuntimeEntry;
 exports.hookShimBody = hookShimBody;
 exports.writeHookShim = writeHookShim;
 exports.writeMcpShim = writeMcpShim;
+exports.resolvePluginNodePath = resolvePluginNodePath;
 exports.hookCommand = hookCommand;
 exports.isOryRuntimeCommand = isOryRuntimeCommand;
 exports.mcpCommand = mcpCommand;
@@ -143,16 +144,19 @@ function getManifestPath() {
 // ─── Runtime targets ───────────────────────────────────────────────
 /** The npm package providing the MCP server, materialized alongside plugins. */
 exports.MCP_SERVER_PACKAGE = "@ory/mcp-server";
-/** Read a package version from a package directory, if present. */
-function readPackageVersion(packageDir) {
+/** Read package metadata from a package directory, if present. */
+function readPackageManifest(packageDir) {
     try {
-        const parsed = JSON.parse(fs.readFileSync(path.join(packageDir, "package.json"), "utf-8"));
-        return typeof parsed.version === "string" ? parsed.version : undefined;
+        return JSON.parse(fs.readFileSync(path.join(packageDir, "package.json"), "utf-8"));
     }
     catch {
         return undefined;
     }
 }
+function readPackageVersion(packageDir) {
+    const version = readPackageManifest(packageDir)?.version;
+    return typeof version === "string" ? version : undefined;
+}
 /**
  * Default installer: one `npm install --prefix <store> <spec>…`.
  *
@@ -259,18 +263,23 @@ function materializeRuntime(opts) {
     };
 }
 /**
- * Use an already-built package directory as the runtime — the development
- * path (`install --link <dir>`), where the workspace build *is* the artifact.
+ * Use an explicit prebuilt package directory as the runtime, including a
+ * managed installation or workspace build.
  *
  * Validates that the directory looks like a built package so a typo surfaces
  * at install time instead of as hooks that silently never run.
  */
 function linkedRuntime(opts) {
     const packageDir = path.resolve(opts.packageDir);
-    const version = readPackageVersion(packageDir);
+    const manifest = readPackageManifest(packageDir);
+    const version = manifest?.version;
     if (!version) {
         throw new Error(`Cannot link the Ory runtime: ${packageDir} has no readable package.json.`);
     }
+    if (manifest.name !== opts.packageName) {
+        throw new Error(`Cannot link the Ory runtime: ${packageDir}/package.json declares ` +
+            `${JSON.stringify(manifest.name)}; expected ${JSON.stringify(opts.packageName)}.`);
+    }
     if (!fs.existsSync(path.join(packageDir, "dist"))) {
         throw new Error(`Cannot link the Ory runtime: ${packageDir}/dist is missing. Build the ` +
             `package first (pnpm build).`);
@@ -458,14 +467,49 @@ function writeMcpShim(opts) {
     return shimPath;
 }
 // ─── Rendering into harness config ─────────────────────────────────
+/**
+ * Resolve the Node executable persisted in subprocess hook and MCP config.
+ * Managed installations can pin an administrator-approved absolute path;
+ * ordinary installations retain the portable `node` command lookup.
+ */
+function resolvePluginNodePath(env = process.env) {
+    const configured = env.ORY_PLUGIN_NODE_PATH;
+    if (configured === undefined)
+        return "node";
+    const nodePath = configured.trim();
+    if (!nodePath || !path.isAbsolute(nodePath)) {
+        throw new Error("ORY_PLUGIN_NODE_PATH must be a non-empty absolute path when set.");
+    }
+    let stat;
+    try {
+        stat = fs.statSync(nodePath);
+    }
+    catch {
+        throw new Error(`ORY_PLUGIN_NODE_PATH does not exist: ${nodePath}`);
+    }
+    if (!stat.isFile()) {
+        throw new Error(`ORY_PLUGIN_NODE_PATH must be a regular file: ${nodePath}`);
+    }
+    try {
+        fs.accessSync(nodePath, fs.constants.X_OK);
+    }
+    catch {
+        throw new Error(`ORY_PLUGIN_NODE_PATH must be executable: ${nodePath}`);
+    }
+    return nodePath;
+}
+function quoteShellArgument(value) {
+    return `"${value.replace(/["\\$`]/g, "\\$&")}"`;
+}
 /**
  * The hook command a harness config should carry: `node "<shim>"`.
  *
- * Quoted because a data dir can contain spaces, and several harnesses run the
- * command through a shell.
+ * Paths are shell-quoted because managed executables and data dirs can contain
+ * spaces or shell metacharacters, and several harnesses run this as a string.
  */
-function hookCommand(shimPath) {
-    return `node "${shimPath}"`;
+function hookCommand(shimPath, nodePath = resolvePluginNodePath()) {
+    const command = nodePath === "node" ? nodePath : quoteShellArgument(nodePath);
+    return `${command} ${quoteShellArgument(shimPath)}`;
 }
 /**
  * True when a command in a harness config is one of ours.
@@ -487,8 +531,8 @@ function isOryRuntimeCommand(command) {
         /\bory-[a-z0-9-]+-hook\b/.test(command));
 }
 /** The MCP server registration a harness config should carry. */
-function mcpCommand(shimPath) {
-    return { command: "node", args: [shimPath] };
+function mcpCommand(shimPath, nodePath = resolvePluginNodePath()) {
+    return { command: nodePath, args: [shimPath] };
 }
 /**
  * Module specifier for an *in-process* plugin: the absolute package directory.
@@ -602,8 +646,9 @@ function pruneRuntimeStores() {
  *   `ORY_PLUGIN_RUNTIME_DIR`    → link that directory
  *   otherwise                   → materialize the CLI's own version
  *
- * The flag and the env var support explicit source installs that point at an
- * already-built workspace package instead of materializing from a registry.
+ * The flag and the env var support explicit prebuilt runtime installs,
+ * including administrator-managed package directories and workspace builds,
+ * instead of materializing from a registry.
  *
  * The flag deliberately requires an explicit directory. A bare "link whatever
  * package I am running from" would resolve to npx's ephemeral cache dir under
@@ -733,6 +778,9 @@ function wireRuntime(opts) {
     return withRuntimeInstallLock(() => wireRuntimeUnlocked(opts));
 }
 function wireRuntimeUnlocked(opts) {
+    // Validate before npm or filesystem wiring so a managed install fails
+    // without side effects when its configured executable is unusable.
+    const nodePath = resolvePluginNodePath();
     const target = resolveRuntimeForInstall({
         packageName: opts.packageName,
         packageRoot: opts.packageRoot,
@@ -761,7 +809,7 @@ function wireRuntimeUnlocked(opts) {
             fallbackStdout: opts.fallbackStdout,
             mcpEntry,
         });
-        hookCmd = hookCommand(hookShim);
+        hookCmd = hookCommand(hookShim, nodePath);
     }
     const mcpShim = opts.includeMcp === false
         ? undefined
@@ -775,7 +823,7 @@ function wireRuntimeUnlocked(opts) {
         target,
         hookShim,
         ...(hookCmd ? { hookCommand: hookCmd } : {}),
-        ...(mcpShim ? { mcpShim, mcpServer: mcpCommand(mcpShim) } : {}),
+        ...(mcpShim ? { mcpShim, mcpServer: mcpCommand(mcpShim, nodePath) } : {}),
         prunedStores: pruneRuntimeStores(),
     };
 }

package/dist/setup.js

@@ -356,13 +356,13 @@ Options:
 Environment variables:
   ORY_PROJECT_URL       Your Ory project URL (required at runtime)
   ORY_AGENT_SECURITY_URL Canonical Agent Security origin (legacy fallback: project URL)
-  ORY_AGENT_CLIENT_ID   Static agent OAuth2 client_credentials (with
-  ORY_AGENT_CLIENT_SECRET   …SECRET) — otherwise the agent self-registers
+  ORY_AGENT_API_KEY     Explicit Talos runtime credential (otherwise session
+                        start loads or enrolls one in the OS credential store)
   ORY_OAUTH2_CLIENT_ID  Override the public OAuth2 client id for the user PKCE flow
                         (default: ory-agent-security-login)
   ORY_AGENT_DEBUG       Set to "true" for debug logging
   ORY_AGENT_LOG_FILE    Path to write debug logs
-  ORY_AGENT_SUBJECT_ID  Override the subject ID for permission checks
+  ORY_AGENT_SUBJECT_ID  Override the subject for injected/env credentials
 `);
 }
 let deferNextStepsActive = false;

package/dist/skills.d.ts

@@ -3,11 +3,9 @@
  *
  * The skill playbooks (auth-setup, login-flow, social-login, local-dev,
  * permissions-onboarding, contribute-integration, build-integration,
- * e2b-sandbox, build-agent) and the local-stack commands (local-up, local-down) live once,
- * as token-bearing templates under `packages/core/assets/`. Every harness plugin renders them
- * e2b-sandbox, temporal-worker) and the local-stack commands (local-up,
- * local-down, temporal-up) live once, as token-bearing templates under
- * `packages/core/assets/`. Every harness plugin renders them
+ * e2b-sandbox, build-agent, deploy-agent, deploy-openai-e2b, temporal-worker) and local-stack
+ * commands (local-up, local-down, temporal-up) live once as token-bearing
+ * templates under `packages/core/assets/`. Every harness plugin renders them
  * through {@link renderOrySkills} / {@link renderOryCommands}, substituting the
  * harness's CLI binary, package name, and the way it references sibling skills
  * and commands. Plugins then write the rendered docs into whatever location

package/dist/skills.js

@@ -4,11 +4,9 @@
  *
  * The skill playbooks (auth-setup, login-flow, social-login, local-dev,
  * permissions-onboarding, contribute-integration, build-integration,
- * e2b-sandbox, build-agent) and the local-stack commands (local-up, local-down) live once,
- * as token-bearing templates under `packages/core/assets/`. Every harness plugin renders them
- * e2b-sandbox, temporal-worker) and the local-stack commands (local-up,
- * local-down, temporal-up) live once, as token-bearing templates under
- * `packages/core/assets/`. Every harness plugin renders them
+ * e2b-sandbox, build-agent, deploy-agent, deploy-openai-e2b, temporal-worker) and local-stack
+ * commands (local-up, local-down, temporal-up) live once as token-bearing
+ * templates under `packages/core/assets/`. Every harness plugin renders them
  * through {@link renderOrySkills} / {@link renderOryCommands}, substituting the
  * harness's CLI binary, package name, and the way it references sibling skills
  * and commands. Plugins then write the rendered docs into whatever location
@@ -94,6 +92,16 @@ const SKILL_SOURCES = [
         name: "ory-build-agent",
         file: "skills/ory-build-agent/SKILL.md",
     },
+    {
+        id: "deploy-agent",
+        name: "ory-deploy-agent",
+        file: "skills/ory-deploy-agent/SKILL.md",
+    },
+    {
+        id: "deploy-openai-e2b",
+        name: "ory-deploy-openai-e2b",
+        file: "skills/ory-deploy-openai-e2b/SKILL.md",
+    },
     {
         id: "temporal-worker",
         name: "ory-temporal-worker",
@@ -181,6 +189,7 @@ function buildProfile(harness, opts) {
             "{{REF_SOCIAL_LOGIN}}": skillRef("ory-social-login"),
             "{{REF_LOCAL_DEV}}": skillRef("ory-local-dev"),
             "{{REF_PERMISSIONS_ONBOARDING}}": skillRef("ory-permissions-onboarding"),
+            "{{REF_DEPLOY_OPENAI_E2B}}": skillRef("ory-deploy-openai-e2b"),
             "{{REF_TEMPORAL_WORKER}}": skillRef("ory-temporal-worker"),
             "{{REF_LOCAL_UP}}": localUp,
             "{{REF_LOCAL_DOWN}}": localDown,

package/dist/subject.d.ts

@@ -114,8 +114,7 @@ export declare function validateSubjectOverride(raw: string | undefined, envVar?
  */
 export declare function readAgentSubjectOverride(env?: NodeJS.ProcessEnv, warnings?: string[]): string | undefined;
 /**
- * The registered agent credential subject: `Agent:<clientId>`. For DCR this
- * client belongs to one session; static credentials may be shared explicitly.
+ * The actor-bound agent credential subject: `Agent:<rootActor>`.
  *
  * `undefined` when no agent principal is populated — the agent gate never
  * blocks, so a session with no resolved machine identity is normal and callers
@@ -123,7 +122,7 @@ export declare function readAgentSubjectOverride(env?: NodeJS.ProcessEnv, warnin
  */
 export declare function resolveAgentSubject(client: OryAgentClient): UserSubjectRef | undefined;
 /**
- * The **session-level** agent subject: `Agent:<clientId>|<session>`, unique to
+ * The **session-level** agent subject: `Agent:<rootActor>|<session>`, unique to
  * one run. Used for a block that stops the session's narrower subject without
  * blocking its base credential subject.
  *

package/dist/subject.js

@@ -117,17 +117,17 @@ function subjectLabel(ref) {
 }
 // ─── Machine principals (agent / sub-agent) ──────────────────────────
 //
-// The agent's OAuth2 credential is session-scoped: one DCR client per
-// `(projectUrl, harness, session)`, plus one client per typed sub-agent in that
-// session. Sessionless integrations use a reserved persistent slot.
+// Runtime credentials are descriptor-scoped: one root actor per
+// `(projectUrl, harness, session)`, plus one child actor per stable sub-agent
+// spawn in that session. Sessionless integrations use a reserved persistent slot.
 //
-// The registered client id is the principal root. Session and spawn axes remain
+// The enrolled actor id is the principal root. Session and spawn axes remain
 // available as narrower broker subjects and are appended with `|`:
 //
-//     Agent:<clientId>                             session credential
-//     Agent:<clientId>|<session>                   one run
-//     SubAgent:<clientId>                          typed sub-agent credential
-//     SubAgent:<clientId>|<session>|<type>[|<spawn>]   one spawn
+//     Agent:<rootActor>                                session credential
+//     Agent:<rootActor>|<session>                      one run
+//     SubAgent:<childActor>                            child credential
+//     SubAgent:<childActor>|<session>|<type>[|<spawn>] one spawn
 //
 // Every one of these is computable locally, so a block can be written in the
 // Console against the exact string the plugin will check. Nothing here depends
@@ -207,8 +207,7 @@ function readAgentSubjectOverride(env = process.env, warnings) {
     return value;
 }
 /**
- * The registered agent credential subject: `Agent:<clientId>`. For DCR this
- * client belongs to one session; static credentials may be shared explicitly.
+ * The actor-bound agent credential subject: `Agent:<rootActor>`.
  *
  * `undefined` when no agent principal is populated — the agent gate never
  * blocks, so a session with no resolved machine identity is normal and callers
@@ -219,7 +218,7 @@ function resolveAgentSubject(client) {
     return subject ? subjectSet(exports.AGENT_NAMESPACE, subject) : undefined;
 }
 /**
- * The **session-level** agent subject: `Agent:<clientId>|<session>`, unique to
+ * The **session-level** agent subject: `Agent:<rootActor>|<session>`, unique to
  * one run. Used for a block that stops the session's narrower subject without
  * blocking its base credential subject.
  *

package/dist/testing.d.ts

@@ -10,6 +10,22 @@ import { OryAgentClient } from "./client.js";
 import type { ActivityEntry } from "./logger.js";
 import type { PermissionMode } from "./config.js";
 export { runHarnessContractSuite, type HarnessContractAdapter, type ContractContext, type ContractGates, type ContractOutcome, } from "./contract-suite.js";
+export interface SdkLazySessionContractAdapter {
+    name: string;
+    harness: string;
+    createSessionStarterMock: ReturnType<typeof vi.fn>;
+    ensureSessionMock: ReturnType<typeof vi.fn>;
+    createSubject(client: OryAgentClient, projectUrl?: string): {
+        invoke(index: number): Promise<unknown>;
+    };
+    expectedConcurrentResults: unknown[];
+    expectedSingleResult: unknown;
+}
+/**
+ * Verify the common lazy-start contract used by TypeScript SDK integrations.
+ * The package adapter supplies only its native invocation shape.
+ */
+export declare function runSdkLazySessionContract(adapter: SdkLazySessionContractAdapter): void;
 /**
  * Create an OryAgentClient with session caching disabled.
  * Pass overrides to customize (e.g. a different harness name).
@@ -30,6 +46,7 @@ export declare function spyRecordDelegation(client: OryAgentClient, result?: {
     agentToken?: string;
     runtimeCredential?: import("./runtime-credential.js").RuntimeCredential;
     signal?: AbortSignal;
+    preprovisionedRoot?: boolean;
 }) => Promise<import("./client.js").RecordDelegationResult>>;
 /**
  * Stub an internal API instance method on the client.

package/dist/testing.js

@@ -41,6 +41,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TEST_OAUTH2_CLIENT_ID = exports.TEST_AGENT_SECURITY_URL = exports.TEST_PROJECT_URL = exports.BATCH_SERVER_DENIED = exports.BATCH_SERVER_ALLOWED_TOOL_DENIED = exports.BATCH_BOTH_ALLOWED = exports.PERMISSION_DENIED = exports.PERMISSION_ALLOWED = exports.MOCK_INACTIVE_OAUTH2_RESPONSE = exports.MOCK_OAUTH2_RESPONSE = exports.MOCK_INACTIVE_SESSION_RESPONSE = exports.MOCK_SESSION_RESPONSE = exports.runHarnessContractSuite = void 0;
+exports.runSdkLazySessionContract = runSdkLazySessionContract;
 exports.createMockClient = createMockClient;
 exports.spyRecordDelegation = spyRecordDelegation;
 exports.stubApi = stubApi;
@@ -85,6 +86,58 @@ const permission_mode_js_1 = require("./permission-mode.js");
 // adapter shape.
 var contract_suite_js_1 = require("./contract-suite.js");
 Object.defineProperty(exports, "runHarnessContractSuite", { enumerable: true, get: function () { return contract_suite_js_1.runHarnessContractSuite; } });
+/**
+ * Verify the common lazy-start contract used by TypeScript SDK integrations.
+ * The package adapter supplies only its native invocation shape.
+ */
+function runSdkLazySessionContract(adapter) {
+    let cleanup;
+    (0, vitest_1.beforeEach)(() => {
+        cleanup = setOryEnv();
+        adapter.createSessionStarterMock.mockClear();
+        adapter.ensureSessionMock.mockReset();
+        adapter.ensureSessionMock.mockResolvedValue(undefined);
+    });
+    (0, vitest_1.afterEach)(() => {
+        cleanup?.();
+        clearOryEnv();
+    });
+    (0, vitest_1.describe)(`${adapter.name} - lazy session startup`, () => {
+        (0, vitest_1.it)("awaits the shared session starter for concurrent first calls", async () => {
+            const client = createMockClient({ harness: adapter.harness });
+            client.setUserPrincipal({ subject: "user:alice" });
+            stubPermissionAllowed(client);
+            let release;
+            adapter.ensureSessionMock.mockReturnValue(new Promise((resolve) => {
+                release = resolve;
+            }));
+            const subject = adapter.createSubject(client);
+            let settled = 0;
+            const calls = [0, 1].map((index) => subject.invoke(index).then((result) => {
+                settled += 1;
+                return result;
+            }));
+            await new Promise((resolve) => setTimeout(resolve, 0));
+            (0, vitest_1.expect)(adapter.createSessionStarterMock).toHaveBeenCalledTimes(1);
+            (0, vitest_1.expect)(adapter.ensureSessionMock).toHaveBeenCalledTimes(2);
+            (0, vitest_1.expect)(settled).toBe(0);
+            release();
+            await (0, vitest_1.expect)(Promise.all(calls)).resolves.toEqual(adapter.expectedConcurrentResults);
+            (0, vitest_1.expect)(settled).toBe(2);
+        });
+        (0, vitest_1.it)("passes the SDK harness and project URL to the shared starter", async () => {
+            const client = createMockClient({ harness: adapter.harness });
+            client.setUserPrincipal({ subject: "user:alice" });
+            stubPermissionAllowed(client);
+            const subject = adapter.createSubject(client, "https://ory.test");
+            await (0, vitest_1.expect)(subject.invoke(0)).resolves.toEqual(adapter.expectedSingleResult);
+            (0, vitest_1.expect)(adapter.createSessionStarterMock).toHaveBeenCalledWith(client, {
+                harness: adapter.harness,
+                projectUrl: "https://ory.test",
+            });
+        });
+    });
+}
 // ─── Client Helpers ────────────────────────────────────────────────
 /**
  * Create an OryAgentClient with session caching disabled.

package/dist/tool-catalog.d.ts

@@ -14,19 +14,19 @@
  * Built-in tool names known to ship with each supported harness.
  */
 export declare const HARNESS_TOOL_CATALOG: {
-    readonly "claude-code": readonly ["Read", "Write", "Edit", "Bash", "Glob", "Grep", "WebFetch", "WebSearch", "NotebookEdit", "ToolSearch", "Skill", "TodoWrite", "Agent", "Task"];
-    readonly "claude-agent-sdk": readonly ["Read", "Write", "Edit", "Bash", "Glob", "Grep", "WebFetch", "WebSearch", "NotebookEdit", "ToolSearch", "Skill", "TodoWrite", "Agent", "Task"];
-    readonly codex: readonly ["Bash", "apply_patch"];
-    readonly "gemini-cli": readonly ["read_file", "write_file", "edit_file", "list_files", "search_files", "shell", "web_search"];
-    readonly openclaw: readonly ["exec", "read", "write", "edit", "apply_patch", "web_search", "web_fetch", "browser"];
-    readonly opencode: readonly ["read", "write", "edit", "bash", "glob", "grep", "webfetch"];
-    readonly continue: readonly ["Bash", "Read", "Edit", "Write", "Grep", "Glob", "WebSearch"];
-    readonly goose: readonly ["shell", "text_editor", "read_file", "write_file", "list_windows", "screen_capture"];
-    readonly cline: readonly ["execute_command", "read_file", "write_to_file", "replace_in_file", "search_files", "list_files", "use_mcp_tool"];
-    readonly amp: readonly ["Bash", "Read", "create_file", "edit_file", "undo_edit", "glob", "Grep", "finder", "read_web_page", "web_search", "todo_read", "todo_write", "oracle", "Task"];
+    readonly "claude-code": readonly ["Read", "Write", "Edit", "Bash", "Monitor", "PowerShell", "Workflow", "Glob", "Grep", "WebFetch", "WebSearch", "NotebookEdit", "ToolSearch", "Skill", "TodoWrite", "Agent", "Task", "Artifact", "CronCreate", "CronDelete", "CronList", "EndConversation", "EnterPlanMode", "EnterWorktree", "ExitWorktree", "ListAgents", "ListMcpResourcesTool", "LSP", "PushNotification", "ReadMcpResourceTool", "RemoteTrigger", "ReportFindings", "ScheduleWakeup", "SendFeedback", "SendMessage", "SendUserFile", "ShareOnboardingGuide", "SubagentHandback", "TaskCreate", "TaskGet", "TaskList", "TaskOutput", "TaskStop", "TaskUpdate", "WaitForMcpServers"];
+    readonly "claude-agent-sdk": readonly ["Read", "Write", "Edit", "Bash", "Monitor", "PowerShell", "Workflow", "Glob", "Grep", "WebFetch", "WebSearch", "NotebookEdit", "ToolSearch", "Skill", "TodoWrite", "Agent", "Task", "Artifact", "CronCreate", "CronDelete", "CronList", "EndConversation", "EnterPlanMode", "EnterWorktree", "ExitWorktree", "ListAgents", "ListMcpResourcesTool", "LSP", "PushNotification", "ReadMcpResourceTool", "RemoteTrigger", "ReportFindings", "ScheduleWakeup", "SendFeedback", "SendMessage", "SendUserFile", "ShareOnboardingGuide", "SubagentHandback", "TaskCreate", "TaskGet", "TaskList", "TaskOutput", "TaskStop", "TaskUpdate", "WaitForMcpServers"];
+    readonly codex: readonly ["Bash", "apply_patch", "webrun", "spawn_agent"];
+    readonly "gemini-cli": readonly ["run_shell_command", "shell", "glob", "grep_search", "list_directory", "read_file", "read_many_files", "replace", "write_file", "write_todos", "tracker_create_task", "tracker_update_task", "tracker_get_task", "tracker_list_tasks", "tracker_add_dependency", "tracker_visualize", "list_mcp_resources", "read_mcp_resource", "activate_skill", "get_internal_docs", "enter_plan_mode", "update_topic", "complete_task", "invoke_agent", "google_web_search", "web_fetch"];
+    readonly openclaw: readonly ["exec", "read", "write", "edit", "apply_patch", "web_search", "web_fetch", "browser", "process", "code_execution", "x_search", "secrets", "message", "gateway", "plugins", "nodes", "computer", "screen", "theme", "dashboard", "terminal", "portal", "canvas", "show_widget", "sessions", "sessions_list", "sessions_history", "sessions_search", "sessions_send", "sessions_spawn", "sessions_yield", "subagents", "session_status", "memory_search", "memory_get", "agents_list", "get_goal", "create_goal", "update_goal", "progress_card", "view_image", "image_generate", "music_generate", "video_generate", "tts", "pdf"];
+    readonly opencode: readonly ["read", "write", "edit", "bash", "glob", "grep", "webfetch", "apply_patch", "skill", "todowrite", "websearch", "task", "lsp", "execute"];
+    readonly continue: readonly ["Edit", "Exit", "Fetch", "List", "MultiEdit", "Read", "ReportFailure", "Bash", "Search", "Status", "Subagent", "Skills", "UploadArtifact", "Diff", "Checklist", "Write"];
+    readonly goose: readonly ["analyze", "write", "edit", "shell", "tree", "read_image", "todo__todo_write", "apps__list_apps", "apps__create_app", "apps__iterate_app", "apps__delete_app", "extensionmanager__search_available_extensions", "extensionmanager__manage_extensions", "extensionmanager__list_resources", "extensionmanager__read_resource", "load", "delegate", "load_skill"];
+    readonly cline: readonly ["read_files", "search_codebase", "run_commands", "fetch_web_content", "apply_patch", "editor", "skills", "execute_command", "read_file", "write_to_file", "replace_in_file", "search_files", "list_files", "use_mcp_tool", "browser_action"];
+    readonly amp: readonly ["Bash", "Read", "create_file", "edit_file", "undo_edit", "glob", "Grep", "finder", "read_web_page", "web_search", "todo_read", "todo_write", "oracle", "Task", "create_thread", "list_agent_modes", "get_thread_status", "send_thread_message", "wait_for_threads"];
     readonly pi: readonly ["read", "write", "edit", "bash", "grep", "find", "ls"];
     readonly antigravity: readonly ["run_command", "view_file", "write_to_file", "replace_file_content", "multi_replace_file_content", "list_directory", "grep_search", "find", "read_url_content", "search_web", "call_mcp_tool"];
-    readonly cursor: readonly ["Read", "Write", "Edit", "Delete", "Shell", "List", "Search", "MCP", "Task"];
+    readonly cursor: readonly ["Read", "Write", "Grep", "Delete", "Shell", "Task"];
 };
 /** Names of the harnesses with a known tool catalog. */
 export type KnownHarness = keyof typeof HARNESS_TOOL_CATALOG;
@@ -109,10 +109,12 @@ export declare function getShellCommandCatalog(): readonly string[];
  */
 export declare function resolveShellCommandNamespace(): string;
 /**
- * Extract the shell command string from a harness's tool-args object — the same
+ * Extract shell command strings from a harness's tool-args object — the same
  * object the handler already passes to `summarizeToolInput`. Returns `undefined`
  * when the tool isn't a shell tool for this harness or no command field is
- * present (the gate then skips decomposition and degrades to the top-level
- * `Bash` check — it never breaks).
+ * present. Cline's `run_commands` is the exception: malformed command data is
+ * represented as an unresolvable command so enforce mode fails closed. Cline's
+ * command array remains an array so independently executed entries cannot
+ * change how neighboring entries parse.
  */
-export declare function extractShellCommand(harness: string, toolName: string, args: unknown): string | undefined;
+export declare function extractShellCommand(harness: string, toolName: string, args: unknown): string | readonly string[] | undefined;