@ory/argus 1.4.1 → 1.4.3

package/assets/skills/ory-deploy-agent/SKILL.md

@@ -25,13 +25,14 @@ print, inspect, commit, or place in a prompt:
 
 - `ORY_USER_OAUTH2_TOKEN`
 - `ANTHROPIC_API_KEY`
-- any value from `.ory/credentials.env`
+- any streamed deployment credential value
 - SPIFFE private keys or SVID file contents
 
 The user OAuth2 token administers deployments as the signed-in identity. The
 generated `ORY_AGENT_API_KEY` or customer-issued SVID is a separate runtime
 credential. Never exchange their roles. Do not revoke a deployment or workload
-registration unless the user explicitly asks.
+registration that predates the current run. Always revoke the fresh deployment
+created for the current streamed-credential run during cleanup.
 
 ## Prerequisites
 
@@ -145,8 +146,9 @@ to `0.0.0.0`, expose the application port, and define a health check. Ignore
 credentials, deployment state, dependencies, build output, and local environment
 files in Git and the Docker context.
 
-For Talos, load `.ory/credentials.env` with Compose `env_file` or the equivalent
-Kubernetes Secret. For SPIFFE, use the file-backed environment contract in
+For Talos, the trusted deployment controller must inject the streamed values
+directly into the workload's runtime secret facility without creating a local
+credential file. For SPIFFE, use the file-backed environment contract in
 `examples/spiffe`: mount the parent of the atomically switched `current`
 generation read-only, and point `ORY_AGENT_SPIFFE_GENERATION_PATH` at `current`.
 TypeScript `OryAgentClient.fromEnv()` and Python `OryAgentClient.from_env()` use
@@ -212,39 +214,31 @@ explicit owner must equal the authenticated identity.
 
 ## Create and deploy
 
-Create and decrypt the one-time package:
+Let the CLI create a fresh deployment and launch the trusted deployment
+controller:
 
 ```bash
-ory-agent deployment ensure --credential-file .ory/credentials.env
+ory-agent deployment run \
+  --result-file "$RUNNER_TEMP/ory-agent-result.json" \
+  -- trusted-deployer --credentials-stdin
 ```
 
-The CLI creates an ephemeral age identity, verifies the package digest, and
-atomically writes `.ory/credentials.env` and `.ory/deployment.json` with mode
-`0600`. Verify only that the files exist, are non-empty, ignored by Git, and
-excluded from the Docker build context.
-
-If an existing deployment is reused but the credential file is absent, stop.
-For Talos, the one-time secret cannot be reissued. Explain that replacement
-requires an explicit revoke, but do not revoke without approval. SPIFFE key
-material is never issued by this command; a missing SVID is an operator-side
-workload identity problem and must not trigger Talos fallback.
-
-Start and validate:
-
-```bash
-docker compose up --build --detach
-```
-
-Verify `/healthz` and invoke `/probe` first. The guarded probe makes the first
-authenticated runtime request that activates a ready deployment. Then run:
-
-```bash
-ory-agent deployment wait --for active --timeout 10m
-ory-agent deployment status
-```
-
-Finally invoke `/run` with a prompt that calls `deployment_probe`. Diagnose
-failures with secret-redacted logs.
+The CLI sends the exact credential only to the child process's anonymous stdin,
+never public stdout, a shell variable, log, or intermediate file. It strips its
+deployment-administration credentials from the child environment. The optional
+mode-`0600` result is non-secret and contains the newly created deployment ID.
+Every invocation issues a new deployment and writes no credential, state,
+pending journal, plaintext stage, or age identity.
+
+The trusted controller must load stdin in memory, inject the values into the
+workload secret facility, start and supervise the workload, verify `/healthz`,
+invoke the guarded `/probe`, and exit only when that bounded workload run is
+finished. For a long-running service, the controller must remain its supervisor;
+do not detach and exit while the workload still needs the credential. After a
+successful controller exit, the CLI waits for **Active** and automatically revokes.
+It also revokes after controller failure, and a revoke failure makes the command
+fail. Process termination before cleanup can still orphan a deployment; inventory
+and explicitly revoke it rather than assuming a rerun will recover or reuse it.
 
 ## Customer-operated SPIFFE
 
@@ -257,7 +251,7 @@ customer exclusively owns and operates:
 - helper/CSI/sidecar availability and the permissions on mounted key material
 
 Ory records the expected workload identity and authenticates broker requests.
-Neither `ory-agent deployment ensure` nor the Ory packages install SPIRE, choose
+Neither `ory-agent deployment run` nor the Ory packages install SPIRE, choose
 selectors, create registrations, issue SVIDs, rotate files, or revoke workload
 entries.
 
@@ -311,5 +305,6 @@ in the customer's non-production identity domain:
 Report changed files, format/typecheck/test/build results, Docker health,
 non-secret deployment ID and status, fixed-query and user-query probe results,
 activation status, and blockers. Never report credentials, environment values,
-authorization headers, or credential-file contents. Leave resources running for
-inspection unless the user asks for cleanup.
+authorization headers, or credential-file contents. The trusted controller must
+clean up its bounded workload before exiting; `deployment run` then revokes the
+fresh Agent Security deployment automatically.

package/assets/skills/ory-deploy-openai-e2b/SKILL.md

@@ -16,8 +16,9 @@ Use this playbook to turn the user's intent into a complete, secured deployment:
 The user should be able to ask for an agent in product terms. Inspect the repository,
 preserve its package manager and conventions, scaffold the application and controller,
 run validation, and deploy it through the commands below. Ask before overwriting an
-existing application or revoking a deployment. Ask for missing credentials; never
-fabricate them.
+existing application or revoking a deployment that predates the current run. Always
+revoke the fresh streamed-credential deployment during cleanup. Ask for missing
+credentials; never fabricate them.
 
 Use `ory-build-agent` for another SDK and `ory-deploy-agent` for the canonical Claude
 Agent SDK Docker/Kubernetes deployment. Use `ory-e2b-sandbox` only when installing an
@@ -28,8 +29,8 @@ SDK application deployment.
 
 Keep these components separate:
 
-1. The trusted controller holds `E2B_API_KEY`, `OPENAI_API_KEY`, and the decrypted
-   `.ory/credentials.env` values.
+1. The trusted controller holds `E2B_API_KEY`, `OPENAI_API_KEY`, and the streamed
+   deployment values in memory.
 2. The E2B template contains only source and pinned dependencies. It contains no
    credentials and no Agent start command.
 3. The sandbox receives `OPENAI_API_KEY` and `ORY_*` only in the Agent command's
@@ -41,7 +42,7 @@ Never print, inspect, commit, upload, or place in a prompt:
 
 - `OPENAI_API_KEY` or `E2B_API_KEY`
 - `ORY_AGENT_API_KEY`
-- any value from `.ory/credentials.env`
+- any streamed deployment credential value
 - a user OAuth2 token
 
 Never inject `ORY_USER_OAUTH2_TOKEN` into E2B. The deployment package is a complete
@@ -222,22 +223,28 @@ package_recipe_version: v1
 credential_method: talos_api_key
 ```
 
-Review the plan. Then create the one-time package:
+Review the plan. Then let the CLI create a fresh deployment and launch the
+trusted E2B controller:
 
 ```bash
-ory-agent deployment ensure --credential-file .ory/credentials.env
+ory-agent deployment run \
+  --result-file "$RUNNER_TEMP/ory-agent-result.json" \
+  -- trusted-e2b-controller --credentials-stdin
 ```
 
-The CLI verifies the package and atomically writes `.ory/credentials.env` and the
-non-secret `.ory/deployment.json` with mode `0600`. Verify only existence, mode,
-non-empty size, Git ignore coverage, and exclusion from build contexts. Never read the
-credential file into chat or terminal output. If a deployment is reused but the one-time
-credential file is missing, stop and explain that replacement requires explicit
-revocation. Do not revoke without approval.
+The CLI sends credentials only through the child process's anonymous stdin,
+never public stdout, a shell variable, log, or intermediate file. It strips
+deployment-administration credentials from the child environment. The atomic
+mode-`0600` result contains the non-secret new deployment ID. `run` writes no
+credential, state, pending journal, plaintext stage, or age identity. It waits
+for **Active** after the controller succeeds and automatically revokes on every
+normal success or failure path. A failed revoke fails the command. Process
+termination before cleanup can still orphan a deployment, so inventory and
+explicitly revoke it rather than assuming a rerun will recover it.
 
 ## Launch through the trusted controller
 
-Load `.ory/credentials.env` into a validated in-memory map without logging it. Require
+Load credential stdin into a validated in-memory map without logging it. Require
 exactly the deployment variables emitted by Agent Security, including
 `ORY_AGENT_API_KEY`, `ORY_AGENT_SUBJECT_ID`, and `ORY_AGENT_ROOT_DELEGATION`. Add
 `OPENAI_API_KEY` only to the Agent command environment.
@@ -271,9 +278,8 @@ runtime request. Therefore use this order:
 1. Launch a canary sandbox from the immutable build.
 2. Run the fixed guarded probe inside it with command-scoped credentials.
 3. Verify the expected output files exist without dumping process environment.
-4. Run `ory-agent deployment wait --for active --timeout 10m`.
-5. Run `ory-agent deployment status`.
-6. Run the user's page-generation prompt and validate the static output.
+4. Run the user's page-generation prompt and validate the static output.
+5. Exit successfully so `ory-agent deployment run` verifies **Active** and revokes.
 
 Start in Agent Security `observe`, review the recorded decision and activity, grant the
 expected tool, deliberately promote policy to `enforce`, and prove an explicit deny keeps

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
   "repo": "ory-agent-plugins",
-  "commit": "5901fea77c25766073ad2f41fab14875d20f4652",
-  "commitShort": "5901fea",
+  "commit": "6c598d14487dbc18be2d815b2014776642150ca0",
+  "commitShort": "6c598d1",
   "branch": "main",
-  "commitDate": "2026-10-01T13:04:44-07:00",
+  "commitDate": "2026-10-02T18:32:54-07:00",
   "dirty": false,
-  "builtAt": "2026-10-01T20:08:53.706Z"
+  "builtAt": "2026-10-03T01:37:16.649Z"
 }

package/dist/client.js

@@ -44,6 +44,7 @@ const agent_auth_js_1 = require("./agent-auth.js");
 const context_js_1 = require("./context.js");
 const config_js_1 = require("./config.js");
 const auth_store_js_1 = require("./auth-store.js");
+const subject_js_1 = require("./subject.js");
 const runtime_credential_js_1 = require("./runtime-credential.js");
 const BROKER_PERMISSION_BATCH_SIZE = 10;
 function permissionCheckFromRequest(request) {
@@ -261,7 +262,13 @@ class OryAgentClient {
             || this.config.userSubjectNamespace
             || "User";
         if (subject.namespace === ownerNamespace) {
-            if (subject.object === this.userPrincipal.subject) {
+            const userSubject = this.userPrincipal.subject;
+            if (subject.object === userSubject) {
+                return { kind: "owner", namespace: subject.namespace };
+            }
+            // A preprovisioned runtime with no local user: the broker derives the
+            // owner from the authenticated runtime, and no owner ID is sent.
+            if (userSubject === undefined && subject.object === subject_js_1.RUNTIME_OWNER_SUBJECT && this._runtimeContext) {
                 return { kind: "owner", namespace: subject.namespace };
             }
             throw httpError(403, "Permission owner does not match the authenticated user");

package/dist/event-reporter.d.ts

@@ -43,7 +43,12 @@ export declare class AgentSecurityEventReporter {
     private scheduled;
     private activeRequest;
     private flushDeadline;
-    private suppressRetry;
+    /**
+     * Set when a flush deadline passes. The current delivery stops starting new
+     * requests so a short-lived hook process can exit on time; undelivered events
+     * stay queued (and in the durable outbox) for a later delivery.
+     */
+    private flushExpired;
     private retryTimer;
     private retryAttempt;
     private readonly retryBaseMs;
@@ -56,6 +61,11 @@ export declare class AgentSecurityEventReporter {
     enqueue(entry: ActivityEntry, principalKey?: string): void;
     /** Attempt all currently deliverable batches, bounded by the caller's deadline. */
     flush(timeoutMs?: number): Promise<void>;
+    /**
+     * The request timeout shares the flush deadline and can abort a request before
+     * the flush timer fires, so check the deadline itself as well as the flag.
+     */
+    private flushDeadlinePassed;
     private schedule;
     private startDelivery;
     private scheduleRetry;

package/dist/event-reporter.js

@@ -99,7 +99,12 @@ class AgentSecurityEventReporter {
     scheduled = false;
     activeRequest;
     flushDeadline;
-    suppressRetry = false;
+    /**
+     * Set when a flush deadline passes. The current delivery stops starting new
+     * requests so a short-lived hook process can exit on time; undelivered events
+     * stay queued (and in the durable outbox) for a later delivery.
+     */
+    flushExpired = false;
     retryTimer;
     retryAttempt = 0;
     retryBaseMs;
@@ -173,7 +178,7 @@ class AgentSecurityEventReporter {
             work,
             new Promise((resolve) => {
                 timer = setTimeout(() => {
-                    this.suppressRetry = true;
+                    this.flushExpired = true;
                     this.activeRequest?.abort();
                     resolve();
                 }, timeoutMs);
@@ -185,6 +190,13 @@ class AgentSecurityEventReporter {
         if (this.flushDeadline === deadline)
             this.flushDeadline = undefined;
     }
+    /**
+     * The request timeout shares the flush deadline and can abort a request before
+     * the flush timer fires, so check the deadline itself as well as the flag.
+     */
+    flushDeadlinePassed() {
+        return this.flushExpired || (this.flushDeadline !== undefined && Date.now() >= this.flushDeadline);
+    }
     schedule() {
         if (this.scheduled || this.delivery)
             return;
@@ -207,7 +219,7 @@ class AgentSecurityEventReporter {
         void work.finally(() => {
             if (this.delivery === work)
                 this.delivery = undefined;
-            this.suppressRetry = false;
+            this.flushExpired = false;
             if (this.queue.length === 0)
                 this.retryAttempt = 0;
             else if (shouldRetry)
@@ -236,6 +248,8 @@ class AgentSecurityEventReporter {
             this.prune();
             const retainedScopes = new Set();
             while (this.queue.length > 0) {
+                if (this.flushDeadlinePassed())
+                    return true;
                 const first = this.queue.find((pending) => !retainedScopes.has(scopeKey(pendingScope(pending))));
                 if (!first)
                     return shouldRetry;
@@ -280,6 +294,10 @@ class AgentSecurityEventReporter {
                 const remove = new Set();
                 let retry = false;
                 for (const event of batch) {
+                    if (this.flushDeadlinePassed()) {
+                        retry = true;
+                        break;
+                    }
                     const isolated = await this.deliver([event], scope);
                     for (const eventId of isolated.remove)
                         remove.add(eventId);

package/dist/subject.d.ts

@@ -23,6 +23,14 @@ import type { OryAgentClient } from "./client.js";
  * provisioning all use `User`, so it is the out-of-the-box default.
  */
 export declare const DEFAULT_USER_SUBJECT_NAMESPACE = "User";
+/**
+ * Owner object for a preprovisioned runtime (a Talos, SPIFFE or mTLS agent
+ * deployment) that has no local user principal. The client never knows that
+ * owner's identity; the broker derives it from the authenticated runtime, so
+ * this object is only ever sent as `{ kind: "owner" }`. It is not a UUID, so it
+ * cannot collide with a real identity ID.
+ */
+export declare const RUNTIME_OWNER_SUBJECT = "runtime-owner";
 /** Namespace the agent principal is addressed under (delegation subjects). */
 export declare const AGENT_NAMESPACE = "Agent";
 /** Namespace a sub-agent principal is addressed under. */
@@ -53,7 +61,8 @@ export declare function runWithUserSubject<T>(subject: string | undefined, fn: (
  * Resolve the user subject for permission checks. Prefers a per-call
  * override installed via {@link runWithUserSubject}, then the user
  * login's `userPrincipal.subject`, falls back to `ORY_USER_SUBJECT_ID`, then the
- * legacy `ORY_AGENT_SUBJECT_ID`, then the caller-supplied `fallback`
+ * legacy `ORY_AGENT_SUBJECT_ID`, then the deployment owner of a preprovisioned
+ * runtime ({@link RUNTIME_OWNER_SUBJECT}), then the caller-supplied `fallback`
  * (typically `session:<id>`).
  *
  * Always returns a SubjectSet. A resolved principal is addressed under the

package/dist/subject.js

@@ -18,7 +18,7 @@
  * toggles between SubjectSet and a legacy direct SubjectID.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AGENT_SUBJECT_ID_ENV_VAR = exports.SUBJECT_AXIS_SEPARATOR = exports.SESSION_NAMESPACE = exports.SUBAGENT_NAMESPACE = exports.AGENT_NAMESPACE = exports.DEFAULT_USER_SUBJECT_NAMESPACE = void 0;
+exports.AGENT_SUBJECT_ID_ENV_VAR = exports.SUBJECT_AXIS_SEPARATOR = exports.SESSION_NAMESPACE = exports.SUBAGENT_NAMESPACE = exports.AGENT_NAMESPACE = exports.RUNTIME_OWNER_SUBJECT = exports.DEFAULT_USER_SUBJECT_NAMESPACE = void 0;
 exports.runWithUserSubject = runWithUserSubject;
 exports.resolveUserSubject = resolveUserSubject;
 exports.subjectLabel = subjectLabel;
@@ -35,6 +35,14 @@ const node_async_hooks_1 = require("node:async_hooks");
  * provisioning all use `User`, so it is the out-of-the-box default.
  */
 exports.DEFAULT_USER_SUBJECT_NAMESPACE = "User";
+/**
+ * Owner object for a preprovisioned runtime (a Talos, SPIFFE or mTLS agent
+ * deployment) that has no local user principal. The client never knows that
+ * owner's identity; the broker derives it from the authenticated runtime, so
+ * this object is only ever sent as `{ kind: "owner" }`. It is not a UUID, so it
+ * cannot collide with a real identity ID.
+ */
+exports.RUNTIME_OWNER_SUBJECT = "runtime-owner";
 /** Namespace the agent principal is addressed under (delegation subjects). */
 exports.AGENT_NAMESPACE = "Agent";
 /** Namespace a sub-agent principal is addressed under. */
@@ -72,7 +80,8 @@ function subjectSet(namespace, object) {
  * Resolve the user subject for permission checks. Prefers a per-call
  * override installed via {@link runWithUserSubject}, then the user
  * login's `userPrincipal.subject`, falls back to `ORY_USER_SUBJECT_ID`, then the
- * legacy `ORY_AGENT_SUBJECT_ID`, then the caller-supplied `fallback`
+ * legacy `ORY_AGENT_SUBJECT_ID`, then the deployment owner of a preprovisioned
+ * runtime ({@link RUNTIME_OWNER_SUBJECT}), then the caller-supplied `fallback`
  * (typically `session:<id>`).
  *
  * Always returns a SubjectSet. A resolved principal is addressed under the
@@ -94,6 +103,11 @@ function resolveUserSubject(client, fallback) {
         || exports.DEFAULT_USER_SUBJECT_NAMESPACE;
     if (principal)
         return subjectSet(ns, principal);
+    // A preprovisioned runtime acts for its deployment's owner, whom only the
+    // broker knows. Without this, a headless deployment resolves no subject and
+    // every native tool is denied in enforce mode (#338).
+    if (client.runtimeContext)
+        return subjectSet(ns, exports.RUNTIME_OWNER_SUBJECT);
     // No principal — use the caller's fallback. A `session:<id>` fallback is
     // addressed under the Session namespace so it is a well-formed SubjectSet that
     // could match a Session-scoped grant, rather than being wrapped under `User`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "1.4.1",
+  "version": "1.4.3",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",