@ory/argus 1.4.2 → 1.4.4

package/assets/skills/ory-deploy-agent/SKILL.md

@@ -25,13 +25,14 @@ print, inspect, commit, or place in a prompt:
 
 - `ORY_USER_OAUTH2_TOKEN`
 - `ANTHROPIC_API_KEY`
-- any value from `.ory/credentials.env`
+- any streamed deployment credential value
 - SPIFFE private keys or SVID file contents
 
 The user OAuth2 token administers deployments as the signed-in identity. The
 generated `ORY_AGENT_API_KEY` or customer-issued SVID is a separate runtime
 credential. Never exchange their roles. Do not revoke a deployment or workload
-registration unless the user explicitly asks.
+registration that predates the current run. Always revoke the fresh deployment
+created for the current streamed-credential run during cleanup.
 
 ## Prerequisites
 
@@ -145,8 +146,9 @@ to `0.0.0.0`, expose the application port, and define a health check. Ignore
 credentials, deployment state, dependencies, build output, and local environment
 files in Git and the Docker context.
 
-For Talos, load `.ory/credentials.env` with Compose `env_file` or the equivalent
-Kubernetes Secret. For SPIFFE, use the file-backed environment contract in
+For Talos, the trusted deployment controller must inject the streamed values
+directly into the workload's runtime secret facility without creating a local
+credential file. For SPIFFE, use the file-backed environment contract in
 `examples/spiffe`: mount the parent of the atomically switched `current`
 generation read-only, and point `ORY_AGENT_SPIFFE_GENERATION_PATH` at `current`.
 TypeScript `OryAgentClient.fromEnv()` and Python `OryAgentClient.from_env()` use
@@ -212,39 +214,31 @@ explicit owner must equal the authenticated identity.
 
 ## Create and deploy
 
-Create and decrypt the one-time package:
+Let the CLI create a fresh deployment and launch the trusted deployment
+controller:
 
 ```bash
-ory-agent deployment ensure --credential-file .ory/credentials.env
+ory-agent deployment run \
+  --result-file "$RUNNER_TEMP/ory-agent-result.json" \
+  -- trusted-deployer --credentials-stdin
 ```
 
-The CLI creates an ephemeral age identity, verifies the package digest, and
-atomically writes `.ory/credentials.env` and `.ory/deployment.json` with mode
-`0600`. Verify only that the files exist, are non-empty, ignored by Git, and
-excluded from the Docker build context.
-
-If an existing deployment is reused but the credential file is absent, stop.
-For Talos, the one-time secret cannot be reissued. Explain that replacement
-requires an explicit revoke, but do not revoke without approval. SPIFFE key
-material is never issued by this command; a missing SVID is an operator-side
-workload identity problem and must not trigger Talos fallback.
-
-Start and validate:
-
-```bash
-docker compose up --build --detach
-```
-
-Verify `/healthz` and invoke `/probe` first. The guarded probe makes the first
-authenticated runtime request that activates a ready deployment. Then run:
-
-```bash
-ory-agent deployment wait --for active --timeout 10m
-ory-agent deployment status
-```
-
-Finally invoke `/run` with a prompt that calls `deployment_probe`. Diagnose
-failures with secret-redacted logs.
+The CLI sends the exact credential only to the child process's anonymous stdin,
+never public stdout, a shell variable, log, or intermediate file. It strips its
+deployment-administration credentials from the child environment. The optional
+mode-`0600` result is non-secret and contains the newly created deployment ID.
+Every invocation issues a new deployment and writes no credential, state,
+pending journal, plaintext stage, or age identity.
+
+The trusted controller must load stdin in memory, inject the values into the
+workload secret facility, start and supervise the workload, verify `/healthz`,
+invoke the guarded `/probe`, and exit only when that bounded workload run is
+finished. For a long-running service, the controller must remain its supervisor;
+do not detach and exit while the workload still needs the credential. After a
+successful controller exit, the CLI waits for **Active** and automatically revokes.
+It also revokes after controller failure, and a revoke failure makes the command
+fail. Process termination before cleanup can still orphan a deployment; inventory
+and explicitly revoke it rather than assuming a rerun will recover or reuse it.
 
 ## Customer-operated SPIFFE
 
@@ -257,7 +251,7 @@ customer exclusively owns and operates:
 - helper/CSI/sidecar availability and the permissions on mounted key material
 
 Ory records the expected workload identity and authenticates broker requests.
-Neither `ory-agent deployment ensure` nor the Ory packages install SPIRE, choose
+Neither `ory-agent deployment run` nor the Ory packages install SPIRE, choose
 selectors, create registrations, issue SVIDs, rotate files, or revoke workload
 entries.
 
@@ -311,5 +305,6 @@ in the customer's non-production identity domain:
 Report changed files, format/typecheck/test/build results, Docker health,
 non-secret deployment ID and status, fixed-query and user-query probe results,
 activation status, and blockers. Never report credentials, environment values,
-authorization headers, or credential-file contents. Leave resources running for
-inspection unless the user asks for cleanup.
+authorization headers, or credential-file contents. The trusted controller must
+clean up its bounded workload before exiting; `deployment run` then revokes the
+fresh Agent Security deployment automatically.

package/assets/skills/ory-deploy-openai-e2b/SKILL.md

@@ -16,8 +16,9 @@ Use this playbook to turn the user's intent into a complete, secured deployment:
 The user should be able to ask for an agent in product terms. Inspect the repository,
 preserve its package manager and conventions, scaffold the application and controller,
 run validation, and deploy it through the commands below. Ask before overwriting an
-existing application or revoking a deployment. Ask for missing credentials; never
-fabricate them.
+existing application or revoking a deployment that predates the current run. Always
+revoke the fresh streamed-credential deployment during cleanup. Ask for missing
+credentials; never fabricate them.
 
 Use `ory-build-agent` for another SDK and `ory-deploy-agent` for the canonical Claude
 Agent SDK Docker/Kubernetes deployment. Use `ory-e2b-sandbox` only when installing an
@@ -28,8 +29,8 @@ SDK application deployment.
 
 Keep these components separate:
 
-1. The trusted controller holds `E2B_API_KEY`, `OPENAI_API_KEY`, and the decrypted
-   `.ory/credentials.env` values.
+1. The trusted controller holds `E2B_API_KEY`, `OPENAI_API_KEY`, and the streamed
+   deployment values in memory.
 2. The E2B template contains only source and pinned dependencies. It contains no
    credentials and no Agent start command.
 3. The sandbox receives `OPENAI_API_KEY` and `ORY_*` only in the Agent command's
@@ -41,7 +42,7 @@ Never print, inspect, commit, upload, or place in a prompt:
 
 - `OPENAI_API_KEY` or `E2B_API_KEY`
 - `ORY_AGENT_API_KEY`
-- any value from `.ory/credentials.env`
+- any streamed deployment credential value
 - a user OAuth2 token
 
 Never inject `ORY_USER_OAUTH2_TOKEN` into E2B. The deployment package is a complete
@@ -222,22 +223,28 @@ package_recipe_version: v1
 credential_method: talos_api_key
 ```
 
-Review the plan. Then create the one-time package:
+Review the plan. Then let the CLI create a fresh deployment and launch the
+trusted E2B controller:
 
 ```bash
-ory-agent deployment ensure --credential-file .ory/credentials.env
+ory-agent deployment run \
+  --result-file "$RUNNER_TEMP/ory-agent-result.json" \
+  -- trusted-e2b-controller --credentials-stdin
 ```
 
-The CLI verifies the package and atomically writes `.ory/credentials.env` and the
-non-secret `.ory/deployment.json` with mode `0600`. Verify only existence, mode,
-non-empty size, Git ignore coverage, and exclusion from build contexts. Never read the
-credential file into chat or terminal output. If a deployment is reused but the one-time
-credential file is missing, stop and explain that replacement requires explicit
-revocation. Do not revoke without approval.
+The CLI sends credentials only through the child process's anonymous stdin,
+never public stdout, a shell variable, log, or intermediate file. It strips
+deployment-administration credentials from the child environment. The atomic
+mode-`0600` result contains the non-secret new deployment ID. `run` writes no
+credential, state, pending journal, plaintext stage, or age identity. It waits
+for **Active** after the controller succeeds and automatically revokes on every
+normal success or failure path. A failed revoke fails the command. Process
+termination before cleanup can still orphan a deployment, so inventory and
+explicitly revoke it rather than assuming a rerun will recover it.
 
 ## Launch through the trusted controller
 
-Load `.ory/credentials.env` into a validated in-memory map without logging it. Require
+Load credential stdin into a validated in-memory map without logging it. Require
 exactly the deployment variables emitted by Agent Security, including
 `ORY_AGENT_API_KEY`, `ORY_AGENT_SUBJECT_ID`, and `ORY_AGENT_ROOT_DELEGATION`. Add
 `OPENAI_API_KEY` only to the Agent command environment.
@@ -271,9 +278,8 @@ runtime request. Therefore use this order:
 1. Launch a canary sandbox from the immutable build.
 2. Run the fixed guarded probe inside it with command-scoped credentials.
 3. Verify the expected output files exist without dumping process environment.
-4. Run `ory-agent deployment wait --for active --timeout 10m`.
-5. Run `ory-agent deployment status`.
-6. Run the user's page-generation prompt and validate the static output.
+4. Run the user's page-generation prompt and validate the static output.
+5. Exit successfully so `ory-agent deployment run` verifies **Active** and revokes.
 
 Start in Agent Security `observe`, review the recorded decision and activity, grant the
 expected tool, deliberately promote policy to `enforce`, and prove an explicit deny keeps

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
   "repo": "ory-agent-plugins",
-  "commit": "42429b6ed5f9b4201bb43bedb7977e19b53783ac",
-  "commitShort": "42429b6",
+  "commit": "10e9a2152966a02218217738fe24ba4172efda7d",
+  "commitShort": "10e9a21",
   "branch": "main",
-  "commitDate": "2026-10-01T17:08:44-07:00",
+  "commitDate": "2026-10-02T19:52:18-07:00",
   "dirty": false,
-  "builtAt": "2026-10-02T00:12:26.601Z"
+  "builtAt": "2026-10-03T02:56:24.735Z"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "1.4.2",
+  "version": "1.4.4",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",