@ory/argus 1.2.3 → 1.3.0

package/dist/tool-catalog.js

@@ -35,6 +35,9 @@ exports.HARNESS_TOOL_CATALOG = {
         "Write",
         "Edit",
         "Bash",
+        "Monitor",
+        "PowerShell",
+        "Workflow",
         "Glob",
         "Grep",
         "WebFetch",
@@ -45,6 +48,34 @@ exports.HARNESS_TOOL_CATALOG = {
         "TodoWrite",
         "Agent",
         "Task",
+        "Artifact",
+        "CronCreate",
+        "CronDelete",
+        "CronList",
+        "EndConversation",
+        "EnterPlanMode",
+        "EnterWorktree",
+        "ExitWorktree",
+        "ListAgents",
+        "ListMcpResourcesTool",
+        "LSP",
+        "PushNotification",
+        "ReadMcpResourceTool",
+        "RemoteTrigger",
+        "ReportFindings",
+        "ScheduleWakeup",
+        "SendFeedback",
+        "SendMessage",
+        "SendUserFile",
+        "ShareOnboardingGuide",
+        "SubagentHandback",
+        "TaskCreate",
+        "TaskGet",
+        "TaskList",
+        "TaskOutput",
+        "TaskStop",
+        "TaskUpdate",
+        "WaitForMcpServers",
     ],
     // The Claude Agent SDK exposes the same built-in tool surface as Claude
     // Code (it is the embeddable form of the same runtime), so the catalog
@@ -54,6 +85,9 @@ exports.HARNESS_TOOL_CATALOG = {
         "Write",
         "Edit",
         "Bash",
+        "Monitor",
+        "PowerShell",
+        "Workflow",
         "Glob",
         "Grep",
         "WebFetch",
@@ -64,20 +98,67 @@ exports.HARNESS_TOOL_CATALOG = {
         "TodoWrite",
         "Agent",
         "Task",
+        "Artifact",
+        "CronCreate",
+        "CronDelete",
+        "CronList",
+        "EndConversation",
+        "EnterPlanMode",
+        "EnterWorktree",
+        "ExitWorktree",
+        "ListAgents",
+        "ListMcpResourcesTool",
+        "LSP",
+        "PushNotification",
+        "ReadMcpResourceTool",
+        "RemoteTrigger",
+        "ReportFindings",
+        "ScheduleWakeup",
+        "SendFeedback",
+        "SendMessage",
+        "SendUserFile",
+        "ShareOnboardingGuide",
+        "SubagentHandback",
+        "TaskCreate",
+        "TaskGet",
+        "TaskList",
+        "TaskOutput",
+        "TaskStop",
+        "TaskUpdate",
+        "WaitForMcpServers",
     ],
-    // Codex serializes its hook `tool_name` as `Bash` (shell) and `apply_patch`
-    // (file edits — `Write`/`Edit` are matcher aliases only); MCP tools arrive as
-    // `mcp__<server>__<tool>` and aren't enumerable here. Verified against
-    // codex 0.143 (see packages/codex/src/types.ts).
-    codex: ["Bash", "apply_patch"],
+    // Codex serializes its hook `tool_name` as `Bash` (shell), `apply_patch`
+    // (file edits — `Write`/`Edit` are matcher aliases only), and `webrun`
+    // (web access); MCP tools arrive as `mcp__<server>__<tool>` and aren't
+    // enumerable here. Verified against codex 0.155 (see packages/codex/src/types.ts).
+    codex: ["Bash", "apply_patch", "webrun", "spawn_agent"],
     "gemini-cli": [
+        "run_shell_command",
+        "shell",
+        "glob",
+        "grep_search",
+        "list_directory",
         "read_file",
+        "read_many_files",
+        "replace",
         "write_file",
-        "edit_file",
-        "list_files",
-        "search_files",
-        "shell",
-        "web_search",
+        "write_todos",
+        "tracker_create_task",
+        "tracker_update_task",
+        "tracker_get_task",
+        "tracker_list_tasks",
+        "tracker_add_dependency",
+        "tracker_visualize",
+        "list_mcp_resources",
+        "read_mcp_resource",
+        "activate_skill",
+        "get_internal_docs",
+        "enter_plan_mode",
+        "update_topic",
+        "complete_task",
+        "invoke_agent",
+        "google_web_search",
+        "web_fetch",
     ],
     // OpenClaw's built-in tool ids (docs.openclaw.ai/tools): shell is `exec`,
     // file ops are `read`/`write`/`edit`/`apply_patch`, plus web + browser.
@@ -90,18 +171,107 @@ exports.HARNESS_TOOL_CATALOG = {
         "web_search",
         "web_fetch",
         "browser",
+        "process",
+        "code_execution",
+        "x_search",
+        "secrets",
+        "message",
+        "gateway",
+        "plugins",
+        "nodes",
+        "computer",
+        "screen",
+        "theme",
+        "dashboard",
+        "terminal",
+        "portal",
+        "canvas",
+        "show_widget",
+        "sessions",
+        "sessions_list",
+        "sessions_history",
+        "sessions_search",
+        "sessions_send",
+        "sessions_spawn",
+        "sessions_yield",
+        "subagents",
+        "session_status",
+        "memory_search",
+        "memory_get",
+        "agents_list",
+        "get_goal",
+        "create_goal",
+        "update_goal",
+        "progress_card",
+        "view_image",
+        "image_generate",
+        "music_generate",
+        "video_generate",
+        "tts",
+        "pdf",
+    ],
+    opencode: [
+        "read",
+        "write",
+        "edit",
+        "bash",
+        "glob",
+        "grep",
+        "webfetch",
+        "apply_patch",
+        "skill",
+        "todowrite",
+        "websearch",
+        "task",
+        "lsp",
+        "execute",
+    ],
+    continue: [
+        "Edit",
+        "Exit",
+        "Fetch",
+        "List",
+        "MultiEdit",
+        "Read",
+        "ReportFailure",
+        "Bash",
+        "Search",
+        "Status",
+        "Subagent",
+        "Skills",
+        "UploadArtifact",
+        "Diff",
+        "Checklist",
+        "Write",
     ],
-    opencode: ["read", "write", "edit", "bash", "glob", "grep", "webfetch"],
-    continue: ["Bash", "Read", "Edit", "Write", "Grep", "Glob", "WebSearch"],
     goose: [
+        "analyze",
+        "write",
+        "edit",
         "shell",
-        "text_editor",
-        "read_file",
-        "write_file",
-        "list_windows",
-        "screen_capture",
+        "tree",
+        "read_image",
+        "todo__todo_write",
+        "apps__list_apps",
+        "apps__create_app",
+        "apps__iterate_app",
+        "apps__delete_app",
+        "extensionmanager__search_available_extensions",
+        "extensionmanager__manage_extensions",
+        "extensionmanager__list_resources",
+        "extensionmanager__read_resource",
+        "load",
+        "delegate",
+        "load_skill",
     ],
     cline: [
+        "read_files",
+        "search_codebase",
+        "run_commands",
+        "fetch_web_content",
+        "apply_patch",
+        "editor",
+        "skills",
         "execute_command",
         "read_file",
         "write_to_file",
@@ -109,6 +279,7 @@ exports.HARNESS_TOOL_CATALOG = {
         "search_files",
         "list_files",
         "use_mcp_tool",
+        "browser_action",
     ],
     amp: [
         "Bash",
@@ -125,8 +296,15 @@ exports.HARNESS_TOOL_CATALOG = {
         "todo_write",
         "oracle",
         "Task",
+        "create_thread",
+        "list_agent_modes",
+        "get_thread_status",
+        "send_thread_message",
+        "wait_for_threads",
     ],
     pi: ["read", "write", "edit", "bash", "grep", "find", "ls"],
+    // This adapter remains pinned to the agy 1.0.13 hook contract. Antigravity
+    // 2.0 changes both these names and the hook payload/response schema.
     antigravity: [
         "run_command",
         "view_file",
@@ -140,23 +318,9 @@ exports.HARNESS_TOOL_CATALOG = {
         "search_web",
         "call_mcp_tool",
     ],
-    // Cursor's `preToolUse` hook serializes `tool_name` as a coarse tool
-    // category (Shell, Read, Write, Edit, Delete, List, Search, MCP, Task);
-    // fine-grained shell commands and MCP tools arrive on the dedicated
-    // `beforeShellExecution` / `beforeMCPExecution` hooks (logged, not gated,
-    // to avoid double-gating). Bootstrap seeds the categories the agent gate
-    // actually checks. Best-effort — verify against your Cursor version.
-    cursor: [
-        "Read",
-        "Write",
-        "Edit",
-        "Delete",
-        "Shell",
-        "List",
-        "Search",
-        "MCP",
-        "Task",
-    ],
+    // Cursor's documented `preToolUse` matcher categories. MCP calls arrive as
+    // dynamic `MCP:<tool_name>` values and are intentionally omitted here.
+    cursor: ["Read", "Write", "Grep", "Delete", "Shell", "Task"],
 };
 exports.KNOWN_HARNESSES = Object.keys(exports.HARNESS_TOOL_CATALOG);
 /**
@@ -190,20 +354,20 @@ exports.ALL_TOOLS = Array.from(new Set(Object.values(exports.HARNESS_TOOL_CATALO
  * applied to every harness).
  */
 exports.INTERACTIVE_TOOL_CATALOG = {
-    "claude-code": ["AskUserQuestion", "ExitPlanMode", "TodoWrite"],
+    "claude-code": ["AskUserQuestion", "ExitPlanMode"],
     // Same runtime as Claude Code — the SDK delivers the same
     // user-interaction primitives through PreToolUse.
-    "claude-agent-sdk": ["AskUserQuestion", "ExitPlanMode", "TodoWrite"],
+    "claude-agent-sdk": ["AskUserQuestion", "ExitPlanMode"],
     codex: [],
-    "gemini-cli": [],
-    openclaw: [],
-    opencode: [],
-    continue: [],
+    "gemini-cli": ["ask_user", "exit_plan_mode"],
+    openclaw: ["ask_user"],
+    opencode: ["question", "plan_exit"],
+    continue: ["AskQuestion"],
     goose: [],
-    cline: [],
+    cline: ["ask_question", "submit_and_exit"],
     amp: [],
     pi: [],
-    antigravity: [],
+    antigravity: ["ask_question"],
     cursor: [],
 };
 function parseEnvInteractiveTools() {
@@ -245,21 +409,21 @@ function isInteractiveTool(harness, toolName) {
  * precise map is used rather than the {@link isBashLikeTool} heuristic.
  */
 exports.SHELL_TOOL_CATALOG = {
-    "claude-code": ["Bash"],
-    "claude-agent-sdk": ["Bash"],
+    "claude-code": ["Bash", "Monitor", "PowerShell"],
+    "claude-agent-sdk": ["Bash", "Monitor", "PowerShell"],
     codex: ["Bash"],
-    // Gemini CLI's hook payload has been observed with both the short `shell`
-    // name and the fuller `run_shell_command` id across versions; accept both so
-    // decomposition fires regardless. `ORY_SHELL_TOOLS` remains the escape hatch.
-    "gemini-cli": ["shell", "run_shell_command"],
+    // Current Gemini CLI releases emit the canonical `run_shell_command` id.
+    // `ORY_SHELL_TOOLS` remains the escape hatch for vendor renames.
+    "gemini-cli": ["run_shell_command", "shell"],
     openclaw: ["exec"],
     opencode: ["bash"],
     continue: ["Bash"],
     goose: ["shell"],
-    cline: ["execute_command"],
+    cline: ["run_commands", "execute_command"],
     amp: ["Bash"],
     pi: ["bash"],
     antigravity: ["run_command"],
+    cursor: ["Shell"],
 };
 function parseEnvList(raw) {
     if (!raw)
@@ -346,16 +510,39 @@ const SHELL_COMMAND_FIELDS = [
     "commandLine",
     "CommandLine",
 ];
+const UNRESOLVED_SHELL_COMMAND = "$ORY_UNRESOLVED_SHELL_COMMAND";
+function extractClineRunCommands(args) {
+    if (!args || typeof args !== "object")
+        return [UNRESOLVED_SHELL_COMMAND];
+    const value = args.commands;
+    if (typeof value !== "string")
+        return [UNRESOLVED_SHELL_COMMAND];
+    try {
+        const commands = JSON.parse(value);
+        if (!Array.isArray(commands) || !commands.every((command) => typeof command === "string")) {
+            return [UNRESOLVED_SHELL_COMMAND];
+        }
+        return commands.length > 0 ? commands : undefined;
+    }
+    catch {
+        return [UNRESOLVED_SHELL_COMMAND];
+    }
+}
 /**
- * Extract the shell command string from a harness's tool-args object — the same
+ * Extract shell command strings from a harness's tool-args object — the same
  * object the handler already passes to `summarizeToolInput`. Returns `undefined`
  * when the tool isn't a shell tool for this harness or no command field is
- * present (the gate then skips decomposition and degrades to the top-level
- * `Bash` check — it never breaks).
+ * present. Cline's `run_commands` is the exception: malformed command data is
+ * represented as an unresolvable command so enforce mode fails closed. Cline's
+ * command array remains an array so independently executed entries cannot
+ * change how neighboring entries parse.
  */
 function extractShellCommand(harness, toolName, args) {
     if (!isShellTool(harness, toolName))
         return undefined;
+    if (harness === "cline" && toolName === "run_commands") {
+        return extractClineRunCommands(args);
+    }
     if (!args || typeof args !== "object")
         return undefined;
     const obj = args;

package/dist/user-login.js

@@ -95,7 +95,7 @@ async function ensureUserAuthenticated(client, options) {
 function attachUserPrincipal(client, decision) {
     if (decision.mode === "ok" || decision.mode === "refreshed") {
         // Tokens were just persisted (or are still valid); pull them so
-        // downstream code (e.g. the agent gate's DCR flow) can use the
+        // downstream code (for example Talos enrollment) can use the
         // user's bearer as an initial access token.
         const tokens = (0, auth_store_js_1.loadTokens)();
         const subject = decision.subject ?? tokens?.subject;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "1.2.3",
+  "version": "1.3.0",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",