@ory/argus 1.3.1 → 1.4.1

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
   "repo": "ory-agent-plugins",
-  "commit": "850c169a0e1af835b8eeef9fba07c3e39dd7e8c1",
-  "commitShort": "850c169",
+  "commit": "5901fea77c25766073ad2f41fab14875d20f4652",
+  "commitShort": "5901fea",
   "branch": "main",
-  "commitDate": "2026-09-28T21:20:31-07:00",
+  "commitDate": "2026-10-01T13:04:44-07:00",
   "dirty": false,
-  "builtAt": "2026-09-29T04:24:31.448Z"
+  "builtAt": "2026-10-01T20:08:53.706Z"
 }

package/dist/lifecycle.js

@@ -139,8 +139,8 @@ exports.HARNESS_LIFECYCLE_MAP = {
         "tool.call": "tool.before",
         "tool.result": "tool.after",
     },
-    // Pi runs session start in the extension factory body (awaited before
-    // startup); `session_start` is the harness's equivalent event name.
+    // Pi's extension factory registers lifecycle handlers; session_start supplies
+    // the session manager shared by CLI and SDK tool events.
     pi: {
         session_start: "session.start",
         tool_call: "tool.before",

package/dist/permissions.js

@@ -394,49 +394,29 @@ function applyPrincipalBlock(client, ctx) {
  * must not hinge on the parser.
  */
 async function decomposeAndCheck(client, args) {
-    const top = await checkAndDecide(client, args.check, {
+    // The word checks do not depend on the top-level result until aggregation, so
+    // send them alongside the top-level check: one round trip instead of two.
+    const topPromise = checkAndDecide(client, args.check, {
         activityAttributes: args.activityAttributes,
         modeOverride: args.modeOverride,
     });
+    let parsed = await parseShellWords(args);
+    const subject = { subjectId: args.check.subjectId, subjectSet: args.check.subjectSet };
+    const namespace = (0, tool_catalog_js_1.resolveShellCommandNamespace)();
+    // Mirrors the mode checkAndDecide resolves, so a command that will be denied
+    // as too-complex in enforce sends no word checks, exactly as before.
+    const expectedMode = args.modeOverride ?? (0, config_js_1.resolveConfig)().permissionMode;
+    const wordsPromise = parsed.parserUnavailable
+        || parsed.words.length === 0
+        || parsed.words.length > MAX_SHELL_WORDS
+        || (parsed.tooComplex && expectedMode === "enforce")
+        ? undefined
+        : fetchShellWordResults(client, args, namespace, parsed.words, subject);
+    const [top, wordFetch] = await Promise.all([topPromise, wordsPromise]);
     // Top-level Bash denied (enforce) or unreachable → no point decomposing.
     if (top.kind === "deny" || top.kind === "fail_open")
         return top;
     const mode = top.mode;
-    // The parser is written to be total, but this is a security boundary: if it
-    // ever throws, treat it as too-complex (fail-closed in enforce) rather than
-    // letting the exception bubble to the harness catch, which fails open.
-    let parsed;
-    try {
-        const commands = typeof args.shellCommand === "string"
-            ? [args.shellCommand]
-            : args.shellCommand ?? [];
-        const words = [];
-        const seen = new Set();
-        let tooComplex = false;
-        let parserUnavailable = false;
-        for (const command of commands) {
-            const result = await (0, bash_parser_js_1.extractBashCommandWords)(command);
-            tooComplex ||= result.tooComplex;
-            parserUnavailable ||= result.parserUnavailable === true;
-            for (const word of result.words) {
-                if (!seen.has(word)) {
-                    seen.add(word);
-                    words.push(word);
-                }
-            }
-        }
-        parsed = { words, tooComplex, parserUnavailable };
-    }
-    catch {
-        parsed = { words: [], tooComplex: true };
-    }
-    if (args.toolName.toLowerCase() === "powershell"
-        || (args.harness === "cline" && args.toolName === "run_commands" && process.platform === "win32")) {
-        // The bundled grammar models POSIX shell syntax, not PowerShell. Retain its
-        // Never retain words parsed with the incompatible grammar: PowerShell
-        // literals could otherwise be persisted as if they were command names.
-        parsed = { words: [], tooComplex: true, parserUnavailable: false };
-    }
     if (parsed.parserUnavailable) {
         client.logger.warn("bash.parser_unavailable", {
             harness: args.harness,
@@ -453,7 +433,6 @@ async function decomposeAndCheck(client, args) {
     if (parsed.words.length > MAX_SHELL_WORDS) {
         parsed = { words: [], tooComplex: true };
     }
-    const subject = { subjectId: args.check.subjectId, subjectSet: args.check.subjectSet };
     const baseAttrs = buildDecisionAttributes(mode, subject.subjectId, subject.subjectSet);
     // Decomposition attributes attached to activity so the shell breakdown is
     // observable in real time — binary/builtin *names* only. The RAW command is
@@ -501,64 +480,34 @@ async function decomposeAndCheck(client, args) {
             modeOverride: args.modeOverride,
         });
     }
-    // Check each distinct command word. Chunk into batches no larger than Keto's
-    // `max_batch_check_size` (see DEFAULT_SHELL_BATCH_SIZE) so a word-heavy command
-    // never trips the server's batch limit into a fail-open fallback.
-    const namespace = (0, tool_catalog_js_1.resolveShellCommandNamespace)();
     const words = parsed.words;
     const deniedWords = [];
     const affectedWords = [];
     let sawObserve = false;
-    const matchedBlocks = new Map();
+    let matchedBlocks = new Map();
     if (words.length > 0) {
-        const batchSize = resolveShellBatchSize();
-        const results = [];
-        for (let start = 0; start < words.length; start += batchSize) {
-            const chunk = words.slice(start, start + batchSize);
-            const wordRelation = opl_js_1.PERMIT_USE;
-            const checks = chunk.map((word) => ({
-                namespace,
-                object: word,
-                relation: wordRelation,
-                ...subject,
-            }));
-            try {
-                const [batch, blocked] = await Promise.all([
-                    client.batchCheckPermissions(checks, {
-                        activityAttributes: { ...args.activityAttributes, ...decompAttrs, shellDecomposition: true },
-                    }),
-                    findBlockedPrincipals(client, {
-                        namespace,
-                        objects: chunk,
-                        principals: args.principals,
-                    }),
-                ]);
-                results.push(...batch.results);
-                for (const [word, principal] of blocked) {
-                    if (!matchedBlocks.has(word))
-                        matchedBlocks.set(word, principal);
-                }
-            }
-            catch (err) {
-                const oryErr = err;
-                if (mode === "enforce" && oryErr && CHECK_UNTRUSTED_CODES.has(oryErr.code)) {
-                    return {
-                        kind: "deny",
-                        result: { allowed: false, checkedAt: new Date().toISOString(), check: args.check },
-                        mode: "enforce",
-                        activityAttributes: { ...baseAttrs, checkRejected: oryErr.code },
-                    };
-                }
-                // Infrastructure error — fail open to the top-level decision.
-                client.logger.warn("bash.batch_check_failed", {
-                    harness: args.harness,
-                    toolName: args.toolName,
-                    code: oryErr?.code,
-                    note: "shell sub-tool batch check failed; falling back to top-level decision",
-                });
-                return top;
+        const fetched = wordFetch ?? await fetchShellWordResults(client, args, namespace, words, subject);
+        if (!fetched.ok) {
+            const oryErr = fetched.error;
+            if (mode === "enforce" && oryErr && CHECK_UNTRUSTED_CODES.has(oryErr.code)) {
+                return {
+                    kind: "deny",
+                    result: { allowed: false, checkedAt: new Date().toISOString(), check: args.check },
+                    mode: "enforce",
+                    activityAttributes: { ...baseAttrs, checkRejected: oryErr.code },
+                };
             }
+            // Infrastructure error — fail open to the top-level decision.
+            client.logger.warn("bash.batch_check_failed", {
+                harness: args.harness,
+                toolName: args.toolName,
+                code: oryErr?.code,
+                note: "shell sub-tool batch check failed; falling back to top-level decision",
+            });
+            return top;
         }
+        const results = fetched.results;
+        matchedBlocks = fetched.matchedBlocks;
         for (let i = 0; i < words.length; i++) {
             const word = words[i];
             const allowed = results[i]?.allowed ?? false;
@@ -653,6 +602,95 @@ async function decomposeAndCheck(client, args) {
         activityAttributes: { ...top.activityAttributes, ...decompAttrs },
     };
 }
+async function parseShellWords(args) {
+    // The parser is written to be total, but this is a security boundary: if it
+    // ever throws, treat it as too-complex (fail-closed in enforce) rather than
+    // letting the exception bubble to the harness catch, which fails open.
+    let parsed;
+    try {
+        const commands = typeof args.shellCommand === "string"
+            ? [args.shellCommand]
+            : args.shellCommand ?? [];
+        const words = [];
+        const seen = new Set();
+        let tooComplex = false;
+        let parserUnavailable = false;
+        for (const command of commands) {
+            const result = await (0, bash_parser_js_1.extractBashCommandWords)(command);
+            tooComplex ||= result.tooComplex;
+            parserUnavailable ||= result.parserUnavailable === true;
+            for (const word of result.words) {
+                if (!seen.has(word)) {
+                    seen.add(word);
+                    words.push(word);
+                }
+            }
+        }
+        parsed = { words, tooComplex, parserUnavailable };
+    }
+    catch {
+        parsed = { words: [], tooComplex: true };
+    }
+    if (args.toolName.toLowerCase() === "powershell"
+        || (args.harness === "cline" && args.toolName === "run_commands" && process.platform === "win32")) {
+        // The bundled grammar models POSIX shell syntax, not PowerShell. Never
+        // retain words parsed with the incompatible grammar: PowerShell literals
+        // could otherwise be persisted as if they were command names.
+        parsed = { words: [], tooComplex: true, parserUnavailable: false };
+    }
+    return parsed;
+}
+/**
+ * Check each distinct command word. Chunk into batches no larger than Keto's
+ * `max_batch_check_size` (see DEFAULT_SHELL_BATCH_SIZE) so a word-heavy command
+ * never trips the server's batch limit into a fail-open fallback. Chunks are
+ * sent concurrently and aggregated in order, so the first failing chunk decides
+ * the outcome exactly as a sequential pass would. Never rejects.
+ */
+async function fetchShellWordResults(client, args, namespace, words, subject) {
+    const decompAttrs = { shellWords: words, shellCommandCount: words.length };
+    const batchSize = resolveShellBatchSize();
+    const chunks = [];
+    for (let start = 0; start < words.length; start += batchSize) {
+        chunks.push(words.slice(start, start + batchSize));
+    }
+    const outcomes = await Promise.all(chunks.map(async (chunk) => {
+        const checks = chunk.map((word) => ({
+            namespace,
+            object: word,
+            relation: opl_js_1.PERMIT_USE,
+            ...subject,
+        }));
+        try {
+            const [batch, blocked] = await Promise.all([
+                client.batchCheckPermissions(checks, {
+                    activityAttributes: { ...args.activityAttributes, ...decompAttrs, shellDecomposition: true },
+                }),
+                findBlockedPrincipals(client, {
+                    namespace,
+                    objects: chunk,
+                    principals: args.principals,
+                }),
+            ]);
+            return { ok: true, results: batch.results, blocked };
+        }
+        catch (err) {
+            return { ok: false, error: err };
+        }
+    }));
+    const results = [];
+    const matchedBlocks = new Map();
+    for (const outcome of outcomes) {
+        if (!outcome.ok)
+            return outcome;
+        results.push(...outcome.results);
+        for (const [word, principal] of outcome.blocked) {
+            if (!matchedBlocks.has(word))
+                matchedBlocks.set(word, principal);
+        }
+    }
+    return { ok: true, results, matchedBlocks };
+}
 /**
  * Run a permission check and resolve the configured mode against the
  * result. Never throws — infrastructure errors surface as a typed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "1.3.1",
+  "version": "1.4.1",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",