@ory/argus 1.4.0 → 1.4.2

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
   "repo": "ory-agent-plugins",
-  "commit": "e6bbb4cddd091bb9adade5a2b21f6064c68f4abb",
-  "commitShort": "e6bbb4c",
+  "commit": "42429b6ed5f9b4201bb43bedb7977e19b53783ac",
+  "commitShort": "42429b6",
   "branch": "main",
-  "commitDate": "2026-09-30T14:07:23-07:00",
+  "commitDate": "2026-10-01T17:08:44-07:00",
   "dirty": false,
-  "builtAt": "2026-09-30T21:11:41.105Z"
+  "builtAt": "2026-10-02T00:12:26.601Z"
 }

package/dist/client.js

@@ -44,6 +44,7 @@ const agent_auth_js_1 = require("./agent-auth.js");
 const context_js_1 = require("./context.js");
 const config_js_1 = require("./config.js");
 const auth_store_js_1 = require("./auth-store.js");
+const subject_js_1 = require("./subject.js");
 const runtime_credential_js_1 = require("./runtime-credential.js");
 const BROKER_PERMISSION_BATCH_SIZE = 10;
 function permissionCheckFromRequest(request) {
@@ -261,7 +262,13 @@ class OryAgentClient {
             || this.config.userSubjectNamespace
             || "User";
         if (subject.namespace === ownerNamespace) {
-            if (subject.object === this.userPrincipal.subject) {
+            const userSubject = this.userPrincipal.subject;
+            if (subject.object === userSubject) {
+                return { kind: "owner", namespace: subject.namespace };
+            }
+            // A preprovisioned runtime with no local user: the broker derives the
+            // owner from the authenticated runtime, and no owner ID is sent.
+            if (userSubject === undefined && subject.object === subject_js_1.RUNTIME_OWNER_SUBJECT && this._runtimeContext) {
                 return { kind: "owner", namespace: subject.namespace };
             }
             throw httpError(403, "Permission owner does not match the authenticated user");

package/dist/event-reporter.d.ts

@@ -43,7 +43,12 @@ export declare class AgentSecurityEventReporter {
     private scheduled;
     private activeRequest;
     private flushDeadline;
-    private suppressRetry;
+    /**
+     * Set when a flush deadline passes. The current delivery stops starting new
+     * requests so a short-lived hook process can exit on time; undelivered events
+     * stay queued (and in the durable outbox) for a later delivery.
+     */
+    private flushExpired;
     private retryTimer;
     private retryAttempt;
     private readonly retryBaseMs;
@@ -56,6 +61,11 @@ export declare class AgentSecurityEventReporter {
     enqueue(entry: ActivityEntry, principalKey?: string): void;
     /** Attempt all currently deliverable batches, bounded by the caller's deadline. */
     flush(timeoutMs?: number): Promise<void>;
+    /**
+     * The request timeout shares the flush deadline and can abort a request before
+     * the flush timer fires, so check the deadline itself as well as the flag.
+     */
+    private flushDeadlinePassed;
     private schedule;
     private startDelivery;
     private scheduleRetry;

package/dist/event-reporter.js

@@ -99,7 +99,12 @@ class AgentSecurityEventReporter {
     scheduled = false;
     activeRequest;
     flushDeadline;
-    suppressRetry = false;
+    /**
+     * Set when a flush deadline passes. The current delivery stops starting new
+     * requests so a short-lived hook process can exit on time; undelivered events
+     * stay queued (and in the durable outbox) for a later delivery.
+     */
+    flushExpired = false;
     retryTimer;
     retryAttempt = 0;
     retryBaseMs;
@@ -173,7 +178,7 @@ class AgentSecurityEventReporter {
             work,
             new Promise((resolve) => {
                 timer = setTimeout(() => {
-                    this.suppressRetry = true;
+                    this.flushExpired = true;
                     this.activeRequest?.abort();
                     resolve();
                 }, timeoutMs);
@@ -185,6 +190,13 @@ class AgentSecurityEventReporter {
         if (this.flushDeadline === deadline)
             this.flushDeadline = undefined;
     }
+    /**
+     * The request timeout shares the flush deadline and can abort a request before
+     * the flush timer fires, so check the deadline itself as well as the flag.
+     */
+    flushDeadlinePassed() {
+        return this.flushExpired || (this.flushDeadline !== undefined && Date.now() >= this.flushDeadline);
+    }
     schedule() {
         if (this.scheduled || this.delivery)
             return;
@@ -207,7 +219,7 @@ class AgentSecurityEventReporter {
         void work.finally(() => {
             if (this.delivery === work)
                 this.delivery = undefined;
-            this.suppressRetry = false;
+            this.flushExpired = false;
             if (this.queue.length === 0)
                 this.retryAttempt = 0;
             else if (shouldRetry)
@@ -236,6 +248,8 @@ class AgentSecurityEventReporter {
             this.prune();
             const retainedScopes = new Set();
             while (this.queue.length > 0) {
+                if (this.flushDeadlinePassed())
+                    return true;
                 const first = this.queue.find((pending) => !retainedScopes.has(scopeKey(pendingScope(pending))));
                 if (!first)
                     return shouldRetry;
@@ -280,6 +294,10 @@ class AgentSecurityEventReporter {
                 const remove = new Set();
                 let retry = false;
                 for (const event of batch) {
+                    if (this.flushDeadlinePassed()) {
+                        retry = true;
+                        break;
+                    }
                     const isolated = await this.deliver([event], scope);
                     for (const eventId of isolated.remove)
                         remove.add(eventId);

package/dist/permissions.js

@@ -394,49 +394,29 @@ function applyPrincipalBlock(client, ctx) {
  * must not hinge on the parser.
  */
 async function decomposeAndCheck(client, args) {
-    const top = await checkAndDecide(client, args.check, {
+    // The word checks do not depend on the top-level result until aggregation, so
+    // send them alongside the top-level check: one round trip instead of two.
+    const topPromise = checkAndDecide(client, args.check, {
         activityAttributes: args.activityAttributes,
         modeOverride: args.modeOverride,
     });
+    let parsed = await parseShellWords(args);
+    const subject = { subjectId: args.check.subjectId, subjectSet: args.check.subjectSet };
+    const namespace = (0, tool_catalog_js_1.resolveShellCommandNamespace)();
+    // Mirrors the mode checkAndDecide resolves, so a command that will be denied
+    // as too-complex in enforce sends no word checks, exactly as before.
+    const expectedMode = args.modeOverride ?? (0, config_js_1.resolveConfig)().permissionMode;
+    const wordsPromise = parsed.parserUnavailable
+        || parsed.words.length === 0
+        || parsed.words.length > MAX_SHELL_WORDS
+        || (parsed.tooComplex && expectedMode === "enforce")
+        ? undefined
+        : fetchShellWordResults(client, args, namespace, parsed.words, subject);
+    const [top, wordFetch] = await Promise.all([topPromise, wordsPromise]);
     // Top-level Bash denied (enforce) or unreachable → no point decomposing.
     if (top.kind === "deny" || top.kind === "fail_open")
         return top;
     const mode = top.mode;
-    // The parser is written to be total, but this is a security boundary: if it
-    // ever throws, treat it as too-complex (fail-closed in enforce) rather than
-    // letting the exception bubble to the harness catch, which fails open.
-    let parsed;
-    try {
-        const commands = typeof args.shellCommand === "string"
-            ? [args.shellCommand]
-            : args.shellCommand ?? [];
-        const words = [];
-        const seen = new Set();
-        let tooComplex = false;
-        let parserUnavailable = false;
-        for (const command of commands) {
-            const result = await (0, bash_parser_js_1.extractBashCommandWords)(command);
-            tooComplex ||= result.tooComplex;
-            parserUnavailable ||= result.parserUnavailable === true;
-            for (const word of result.words) {
-                if (!seen.has(word)) {
-                    seen.add(word);
-                    words.push(word);
-                }
-            }
-        }
-        parsed = { words, tooComplex, parserUnavailable };
-    }
-    catch {
-        parsed = { words: [], tooComplex: true };
-    }
-    if (args.toolName.toLowerCase() === "powershell"
-        || (args.harness === "cline" && args.toolName === "run_commands" && process.platform === "win32")) {
-        // The bundled grammar models POSIX shell syntax, not PowerShell. Retain its
-        // Never retain words parsed with the incompatible grammar: PowerShell
-        // literals could otherwise be persisted as if they were command names.
-        parsed = { words: [], tooComplex: true, parserUnavailable: false };
-    }
     if (parsed.parserUnavailable) {
         client.logger.warn("bash.parser_unavailable", {
             harness: args.harness,
@@ -453,7 +433,6 @@ async function decomposeAndCheck(client, args) {
     if (parsed.words.length > MAX_SHELL_WORDS) {
         parsed = { words: [], tooComplex: true };
     }
-    const subject = { subjectId: args.check.subjectId, subjectSet: args.check.subjectSet };
     const baseAttrs = buildDecisionAttributes(mode, subject.subjectId, subject.subjectSet);
     // Decomposition attributes attached to activity so the shell breakdown is
     // observable in real time — binary/builtin *names* only. The RAW command is
@@ -501,64 +480,34 @@ async function decomposeAndCheck(client, args) {
             modeOverride: args.modeOverride,
         });
     }
-    // Check each distinct command word. Chunk into batches no larger than Keto's
-    // `max_batch_check_size` (see DEFAULT_SHELL_BATCH_SIZE) so a word-heavy command
-    // never trips the server's batch limit into a fail-open fallback.
-    const namespace = (0, tool_catalog_js_1.resolveShellCommandNamespace)();
     const words = parsed.words;
     const deniedWords = [];
     const affectedWords = [];
     let sawObserve = false;
-    const matchedBlocks = new Map();
+    let matchedBlocks = new Map();
     if (words.length > 0) {
-        const batchSize = resolveShellBatchSize();
-        const results = [];
-        for (let start = 0; start < words.length; start += batchSize) {
-            const chunk = words.slice(start, start + batchSize);
-            const wordRelation = opl_js_1.PERMIT_USE;
-            const checks = chunk.map((word) => ({
-                namespace,
-                object: word,
-                relation: wordRelation,
-                ...subject,
-            }));
-            try {
-                const [batch, blocked] = await Promise.all([
-                    client.batchCheckPermissions(checks, {
-                        activityAttributes: { ...args.activityAttributes, ...decompAttrs, shellDecomposition: true },
-                    }),
-                    findBlockedPrincipals(client, {
-                        namespace,
-                        objects: chunk,
-                        principals: args.principals,
-                    }),
-                ]);
-                results.push(...batch.results);
-                for (const [word, principal] of blocked) {
-                    if (!matchedBlocks.has(word))
-                        matchedBlocks.set(word, principal);
-                }
-            }
-            catch (err) {
-                const oryErr = err;
-                if (mode === "enforce" && oryErr && CHECK_UNTRUSTED_CODES.has(oryErr.code)) {
-                    return {
-                        kind: "deny",
-                        result: { allowed: false, checkedAt: new Date().toISOString(), check: args.check },
-                        mode: "enforce",
-                        activityAttributes: { ...baseAttrs, checkRejected: oryErr.code },
-                    };
-                }
-                // Infrastructure error — fail open to the top-level decision.
-                client.logger.warn("bash.batch_check_failed", {
-                    harness: args.harness,
-                    toolName: args.toolName,
-                    code: oryErr?.code,
-                    note: "shell sub-tool batch check failed; falling back to top-level decision",
-                });
-                return top;
+        const fetched = wordFetch ?? await fetchShellWordResults(client, args, namespace, words, subject);
+        if (!fetched.ok) {
+            const oryErr = fetched.error;
+            if (mode === "enforce" && oryErr && CHECK_UNTRUSTED_CODES.has(oryErr.code)) {
+                return {
+                    kind: "deny",
+                    result: { allowed: false, checkedAt: new Date().toISOString(), check: args.check },
+                    mode: "enforce",
+                    activityAttributes: { ...baseAttrs, checkRejected: oryErr.code },
+                };
             }
+            // Infrastructure error — fail open to the top-level decision.
+            client.logger.warn("bash.batch_check_failed", {
+                harness: args.harness,
+                toolName: args.toolName,
+                code: oryErr?.code,
+                note: "shell sub-tool batch check failed; falling back to top-level decision",
+            });
+            return top;
         }
+        const results = fetched.results;
+        matchedBlocks = fetched.matchedBlocks;
         for (let i = 0; i < words.length; i++) {
             const word = words[i];
             const allowed = results[i]?.allowed ?? false;
@@ -653,6 +602,95 @@ async function decomposeAndCheck(client, args) {
         activityAttributes: { ...top.activityAttributes, ...decompAttrs },
     };
 }
+async function parseShellWords(args) {
+    // The parser is written to be total, but this is a security boundary: if it
+    // ever throws, treat it as too-complex (fail-closed in enforce) rather than
+    // letting the exception bubble to the harness catch, which fails open.
+    let parsed;
+    try {
+        const commands = typeof args.shellCommand === "string"
+            ? [args.shellCommand]
+            : args.shellCommand ?? [];
+        const words = [];
+        const seen = new Set();
+        let tooComplex = false;
+        let parserUnavailable = false;
+        for (const command of commands) {
+            const result = await (0, bash_parser_js_1.extractBashCommandWords)(command);
+            tooComplex ||= result.tooComplex;
+            parserUnavailable ||= result.parserUnavailable === true;
+            for (const word of result.words) {
+                if (!seen.has(word)) {
+                    seen.add(word);
+                    words.push(word);
+                }
+            }
+        }
+        parsed = { words, tooComplex, parserUnavailable };
+    }
+    catch {
+        parsed = { words: [], tooComplex: true };
+    }
+    if (args.toolName.toLowerCase() === "powershell"
+        || (args.harness === "cline" && args.toolName === "run_commands" && process.platform === "win32")) {
+        // The bundled grammar models POSIX shell syntax, not PowerShell. Never
+        // retain words parsed with the incompatible grammar: PowerShell literals
+        // could otherwise be persisted as if they were command names.
+        parsed = { words: [], tooComplex: true, parserUnavailable: false };
+    }
+    return parsed;
+}
+/**
+ * Check each distinct command word. Chunk into batches no larger than Keto's
+ * `max_batch_check_size` (see DEFAULT_SHELL_BATCH_SIZE) so a word-heavy command
+ * never trips the server's batch limit into a fail-open fallback. Chunks are
+ * sent concurrently and aggregated in order, so the first failing chunk decides
+ * the outcome exactly as a sequential pass would. Never rejects.
+ */
+async function fetchShellWordResults(client, args, namespace, words, subject) {
+    const decompAttrs = { shellWords: words, shellCommandCount: words.length };
+    const batchSize = resolveShellBatchSize();
+    const chunks = [];
+    for (let start = 0; start < words.length; start += batchSize) {
+        chunks.push(words.slice(start, start + batchSize));
+    }
+    const outcomes = await Promise.all(chunks.map(async (chunk) => {
+        const checks = chunk.map((word) => ({
+            namespace,
+            object: word,
+            relation: opl_js_1.PERMIT_USE,
+            ...subject,
+        }));
+        try {
+            const [batch, blocked] = await Promise.all([
+                client.batchCheckPermissions(checks, {
+                    activityAttributes: { ...args.activityAttributes, ...decompAttrs, shellDecomposition: true },
+                }),
+                findBlockedPrincipals(client, {
+                    namespace,
+                    objects: chunk,
+                    principals: args.principals,
+                }),
+            ]);
+            return { ok: true, results: batch.results, blocked };
+        }
+        catch (err) {
+            return { ok: false, error: err };
+        }
+    }));
+    const results = [];
+    const matchedBlocks = new Map();
+    for (const outcome of outcomes) {
+        if (!outcome.ok)
+            return outcome;
+        results.push(...outcome.results);
+        for (const [word, principal] of outcome.blocked) {
+            if (!matchedBlocks.has(word))
+                matchedBlocks.set(word, principal);
+        }
+    }
+    return { ok: true, results, matchedBlocks };
+}
 /**
  * Run a permission check and resolve the configured mode against the
  * result. Never throws — infrastructure errors surface as a typed

package/dist/subject.d.ts

@@ -23,6 +23,14 @@ import type { OryAgentClient } from "./client.js";
  * provisioning all use `User`, so it is the out-of-the-box default.
  */
 export declare const DEFAULT_USER_SUBJECT_NAMESPACE = "User";
+/**
+ * Owner object for a preprovisioned runtime (a Talos, SPIFFE or mTLS agent
+ * deployment) that has no local user principal. The client never knows that
+ * owner's identity; the broker derives it from the authenticated runtime, so
+ * this object is only ever sent as `{ kind: "owner" }`. It is not a UUID, so it
+ * cannot collide with a real identity ID.
+ */
+export declare const RUNTIME_OWNER_SUBJECT = "runtime-owner";
 /** Namespace the agent principal is addressed under (delegation subjects). */
 export declare const AGENT_NAMESPACE = "Agent";
 /** Namespace a sub-agent principal is addressed under. */
@@ -53,7 +61,8 @@ export declare function runWithUserSubject<T>(subject: string | undefined, fn: (
  * Resolve the user subject for permission checks. Prefers a per-call
  * override installed via {@link runWithUserSubject}, then the user
  * login's `userPrincipal.subject`, falls back to `ORY_USER_SUBJECT_ID`, then the
- * legacy `ORY_AGENT_SUBJECT_ID`, then the caller-supplied `fallback`
+ * legacy `ORY_AGENT_SUBJECT_ID`, then the deployment owner of a preprovisioned
+ * runtime ({@link RUNTIME_OWNER_SUBJECT}), then the caller-supplied `fallback`
  * (typically `session:<id>`).
  *
  * Always returns a SubjectSet. A resolved principal is addressed under the

package/dist/subject.js

@@ -18,7 +18,7 @@
  * toggles between SubjectSet and a legacy direct SubjectID.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AGENT_SUBJECT_ID_ENV_VAR = exports.SUBJECT_AXIS_SEPARATOR = exports.SESSION_NAMESPACE = exports.SUBAGENT_NAMESPACE = exports.AGENT_NAMESPACE = exports.DEFAULT_USER_SUBJECT_NAMESPACE = void 0;
+exports.AGENT_SUBJECT_ID_ENV_VAR = exports.SUBJECT_AXIS_SEPARATOR = exports.SESSION_NAMESPACE = exports.SUBAGENT_NAMESPACE = exports.AGENT_NAMESPACE = exports.RUNTIME_OWNER_SUBJECT = exports.DEFAULT_USER_SUBJECT_NAMESPACE = void 0;
 exports.runWithUserSubject = runWithUserSubject;
 exports.resolveUserSubject = resolveUserSubject;
 exports.subjectLabel = subjectLabel;
@@ -35,6 +35,14 @@ const node_async_hooks_1 = require("node:async_hooks");
  * provisioning all use `User`, so it is the out-of-the-box default.
  */
 exports.DEFAULT_USER_SUBJECT_NAMESPACE = "User";
+/**
+ * Owner object for a preprovisioned runtime (a Talos, SPIFFE or mTLS agent
+ * deployment) that has no local user principal. The client never knows that
+ * owner's identity; the broker derives it from the authenticated runtime, so
+ * this object is only ever sent as `{ kind: "owner" }`. It is not a UUID, so it
+ * cannot collide with a real identity ID.
+ */
+exports.RUNTIME_OWNER_SUBJECT = "runtime-owner";
 /** Namespace the agent principal is addressed under (delegation subjects). */
 exports.AGENT_NAMESPACE = "Agent";
 /** Namespace a sub-agent principal is addressed under. */
@@ -72,7 +80,8 @@ function subjectSet(namespace, object) {
  * Resolve the user subject for permission checks. Prefers a per-call
  * override installed via {@link runWithUserSubject}, then the user
  * login's `userPrincipal.subject`, falls back to `ORY_USER_SUBJECT_ID`, then the
- * legacy `ORY_AGENT_SUBJECT_ID`, then the caller-supplied `fallback`
+ * legacy `ORY_AGENT_SUBJECT_ID`, then the deployment owner of a preprovisioned
+ * runtime ({@link RUNTIME_OWNER_SUBJECT}), then the caller-supplied `fallback`
  * (typically `session:<id>`).
  *
  * Always returns a SubjectSet. A resolved principal is addressed under the
@@ -94,6 +103,11 @@ function resolveUserSubject(client, fallback) {
         || exports.DEFAULT_USER_SUBJECT_NAMESPACE;
     if (principal)
         return subjectSet(ns, principal);
+    // A preprovisioned runtime acts for its deployment's owner, whom only the
+    // broker knows. Without this, a headless deployment resolves no subject and
+    // every native tool is denied in enforce mode (#338).
+    if (client.runtimeContext)
+        return subjectSet(ns, exports.RUNTIME_OWNER_SUBJECT);
     // No principal — use the caller's fallback. A `session:<id>` fallback is
     // addressed under the Session namespace so it is a well-formed SubjectSet that
     // could match a Session-scoped grant, rather than being wrapped under `User`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",