@ory/argus 1.4.1 → 1.4.2

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
   "repo": "ory-agent-plugins",
-  "commit": "5901fea77c25766073ad2f41fab14875d20f4652",
-  "commitShort": "5901fea",
+  "commit": "42429b6ed5f9b4201bb43bedb7977e19b53783ac",
+  "commitShort": "42429b6",
   "branch": "main",
-  "commitDate": "2026-10-01T13:04:44-07:00",
+  "commitDate": "2026-10-01T17:08:44-07:00",
   "dirty": false,
-  "builtAt": "2026-10-01T20:08:53.706Z"
+  "builtAt": "2026-10-02T00:12:26.601Z"
 }

package/dist/client.js

@@ -44,6 +44,7 @@ const agent_auth_js_1 = require("./agent-auth.js");
 const context_js_1 = require("./context.js");
 const config_js_1 = require("./config.js");
 const auth_store_js_1 = require("./auth-store.js");
+const subject_js_1 = require("./subject.js");
 const runtime_credential_js_1 = require("./runtime-credential.js");
 const BROKER_PERMISSION_BATCH_SIZE = 10;
 function permissionCheckFromRequest(request) {
@@ -261,7 +262,13 @@ class OryAgentClient {
             || this.config.userSubjectNamespace
             || "User";
         if (subject.namespace === ownerNamespace) {
-            if (subject.object === this.userPrincipal.subject) {
+            const userSubject = this.userPrincipal.subject;
+            if (subject.object === userSubject) {
+                return { kind: "owner", namespace: subject.namespace };
+            }
+            // A preprovisioned runtime with no local user: the broker derives the
+            // owner from the authenticated runtime, and no owner ID is sent.
+            if (userSubject === undefined && subject.object === subject_js_1.RUNTIME_OWNER_SUBJECT && this._runtimeContext) {
                 return { kind: "owner", namespace: subject.namespace };
             }
             throw httpError(403, "Permission owner does not match the authenticated user");

package/dist/event-reporter.d.ts

@@ -43,7 +43,12 @@ export declare class AgentSecurityEventReporter {
     private scheduled;
     private activeRequest;
     private flushDeadline;
-    private suppressRetry;
+    /**
+     * Set when a flush deadline passes. The current delivery stops starting new
+     * requests so a short-lived hook process can exit on time; undelivered events
+     * stay queued (and in the durable outbox) for a later delivery.
+     */
+    private flushExpired;
     private retryTimer;
     private retryAttempt;
     private readonly retryBaseMs;
@@ -56,6 +61,11 @@ export declare class AgentSecurityEventReporter {
     enqueue(entry: ActivityEntry, principalKey?: string): void;
     /** Attempt all currently deliverable batches, bounded by the caller's deadline. */
     flush(timeoutMs?: number): Promise<void>;
+    /**
+     * The request timeout shares the flush deadline and can abort a request before
+     * the flush timer fires, so check the deadline itself as well as the flag.
+     */
+    private flushDeadlinePassed;
     private schedule;
     private startDelivery;
     private scheduleRetry;

package/dist/event-reporter.js

@@ -99,7 +99,12 @@ class AgentSecurityEventReporter {
     scheduled = false;
     activeRequest;
     flushDeadline;
-    suppressRetry = false;
+    /**
+     * Set when a flush deadline passes. The current delivery stops starting new
+     * requests so a short-lived hook process can exit on time; undelivered events
+     * stay queued (and in the durable outbox) for a later delivery.
+     */
+    flushExpired = false;
     retryTimer;
     retryAttempt = 0;
     retryBaseMs;
@@ -173,7 +178,7 @@ class AgentSecurityEventReporter {
             work,
             new Promise((resolve) => {
                 timer = setTimeout(() => {
-                    this.suppressRetry = true;
+                    this.flushExpired = true;
                     this.activeRequest?.abort();
                     resolve();
                 }, timeoutMs);
@@ -185,6 +190,13 @@ class AgentSecurityEventReporter {
         if (this.flushDeadline === deadline)
             this.flushDeadline = undefined;
     }
+    /**
+     * The request timeout shares the flush deadline and can abort a request before
+     * the flush timer fires, so check the deadline itself as well as the flag.
+     */
+    flushDeadlinePassed() {
+        return this.flushExpired || (this.flushDeadline !== undefined && Date.now() >= this.flushDeadline);
+    }
     schedule() {
         if (this.scheduled || this.delivery)
             return;
@@ -207,7 +219,7 @@ class AgentSecurityEventReporter {
         void work.finally(() => {
             if (this.delivery === work)
                 this.delivery = undefined;
-            this.suppressRetry = false;
+            this.flushExpired = false;
             if (this.queue.length === 0)
                 this.retryAttempt = 0;
             else if (shouldRetry)
@@ -236,6 +248,8 @@ class AgentSecurityEventReporter {
             this.prune();
             const retainedScopes = new Set();
             while (this.queue.length > 0) {
+                if (this.flushDeadlinePassed())
+                    return true;
                 const first = this.queue.find((pending) => !retainedScopes.has(scopeKey(pendingScope(pending))));
                 if (!first)
                     return shouldRetry;
@@ -280,6 +294,10 @@ class AgentSecurityEventReporter {
                 const remove = new Set();
                 let retry = false;
                 for (const event of batch) {
+                    if (this.flushDeadlinePassed()) {
+                        retry = true;
+                        break;
+                    }
                     const isolated = await this.deliver([event], scope);
                     for (const eventId of isolated.remove)
                         remove.add(eventId);

package/dist/subject.d.ts

@@ -23,6 +23,14 @@ import type { OryAgentClient } from "./client.js";
  * provisioning all use `User`, so it is the out-of-the-box default.
  */
 export declare const DEFAULT_USER_SUBJECT_NAMESPACE = "User";
+/**
+ * Owner object for a preprovisioned runtime (a Talos, SPIFFE or mTLS agent
+ * deployment) that has no local user principal. The client never knows that
+ * owner's identity; the broker derives it from the authenticated runtime, so
+ * this object is only ever sent as `{ kind: "owner" }`. It is not a UUID, so it
+ * cannot collide with a real identity ID.
+ */
+export declare const RUNTIME_OWNER_SUBJECT = "runtime-owner";
 /** Namespace the agent principal is addressed under (delegation subjects). */
 export declare const AGENT_NAMESPACE = "Agent";
 /** Namespace a sub-agent principal is addressed under. */
@@ -53,7 +61,8 @@ export declare function runWithUserSubject<T>(subject: string | undefined, fn: (
  * Resolve the user subject for permission checks. Prefers a per-call
  * override installed via {@link runWithUserSubject}, then the user
  * login's `userPrincipal.subject`, falls back to `ORY_USER_SUBJECT_ID`, then the
- * legacy `ORY_AGENT_SUBJECT_ID`, then the caller-supplied `fallback`
+ * legacy `ORY_AGENT_SUBJECT_ID`, then the deployment owner of a preprovisioned
+ * runtime ({@link RUNTIME_OWNER_SUBJECT}), then the caller-supplied `fallback`
  * (typically `session:<id>`).
  *
  * Always returns a SubjectSet. A resolved principal is addressed under the

package/dist/subject.js

@@ -18,7 +18,7 @@
  * toggles between SubjectSet and a legacy direct SubjectID.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AGENT_SUBJECT_ID_ENV_VAR = exports.SUBJECT_AXIS_SEPARATOR = exports.SESSION_NAMESPACE = exports.SUBAGENT_NAMESPACE = exports.AGENT_NAMESPACE = exports.DEFAULT_USER_SUBJECT_NAMESPACE = void 0;
+exports.AGENT_SUBJECT_ID_ENV_VAR = exports.SUBJECT_AXIS_SEPARATOR = exports.SESSION_NAMESPACE = exports.SUBAGENT_NAMESPACE = exports.AGENT_NAMESPACE = exports.RUNTIME_OWNER_SUBJECT = exports.DEFAULT_USER_SUBJECT_NAMESPACE = void 0;
 exports.runWithUserSubject = runWithUserSubject;
 exports.resolveUserSubject = resolveUserSubject;
 exports.subjectLabel = subjectLabel;
@@ -35,6 +35,14 @@ const node_async_hooks_1 = require("node:async_hooks");
  * provisioning all use `User`, so it is the out-of-the-box default.
  */
 exports.DEFAULT_USER_SUBJECT_NAMESPACE = "User";
+/**
+ * Owner object for a preprovisioned runtime (a Talos, SPIFFE or mTLS agent
+ * deployment) that has no local user principal. The client never knows that
+ * owner's identity; the broker derives it from the authenticated runtime, so
+ * this object is only ever sent as `{ kind: "owner" }`. It is not a UUID, so it
+ * cannot collide with a real identity ID.
+ */
+exports.RUNTIME_OWNER_SUBJECT = "runtime-owner";
 /** Namespace the agent principal is addressed under (delegation subjects). */
 exports.AGENT_NAMESPACE = "Agent";
 /** Namespace a sub-agent principal is addressed under. */
@@ -72,7 +80,8 @@ function subjectSet(namespace, object) {
  * Resolve the user subject for permission checks. Prefers a per-call
  * override installed via {@link runWithUserSubject}, then the user
  * login's `userPrincipal.subject`, falls back to `ORY_USER_SUBJECT_ID`, then the
- * legacy `ORY_AGENT_SUBJECT_ID`, then the caller-supplied `fallback`
+ * legacy `ORY_AGENT_SUBJECT_ID`, then the deployment owner of a preprovisioned
+ * runtime ({@link RUNTIME_OWNER_SUBJECT}), then the caller-supplied `fallback`
  * (typically `session:<id>`).
  *
  * Always returns a SubjectSet. A resolved principal is addressed under the
@@ -94,6 +103,11 @@ function resolveUserSubject(client, fallback) {
         || exports.DEFAULT_USER_SUBJECT_NAMESPACE;
     if (principal)
         return subjectSet(ns, principal);
+    // A preprovisioned runtime acts for its deployment's owner, whom only the
+    // broker knows. Without this, a headless deployment resolves no subject and
+    // every native tool is denied in enforce mode (#338).
+    if (client.runtimeContext)
+        return subjectSet(ns, exports.RUNTIME_OWNER_SUBJECT);
     // No principal — use the caller's fallback. A `session:<id>` fallback is
     // addressed under the Session namespace so it is a well-formed SubjectSet that
     // could match a Session-scoped grant, rather than being wrapped under `User`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "1.4.1",
+  "version": "1.4.2",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",