@ory/argus 1.4.6 → 1.4.7

package/assets/skills/ory-deploy-agent/SKILL.md

@@ -25,14 +25,14 @@ print, inspect, commit, or place in a prompt:
 
 - `ORY_USER_OAUTH2_TOKEN`
 - `ANTHROPIC_API_KEY`
-- any streamed deployment credential value
+- any deployment credential value
 - SPIFFE private keys or SVID file contents
 
 The user OAuth2 token administers deployments as the signed-in identity. The
 generated `ORY_AGENT_API_KEY` or customer-issued SVID is a separate runtime
-credential. Never exchange their roles. Do not revoke a deployment or workload
-registration that predates the current run. Always revoke the fresh deployment
-created for the current streamed-credential run during cleanup.
+credential. Never exchange their roles. A deployment package is the durable
+registered agent; reuse it across sessions and revoke it only when the user is
+retiring that agent and package.
 
 ## Prerequisites
 
@@ -146,8 +146,8 @@ to `0.0.0.0`, expose the application port, and define a health check. Ignore
 credentials, deployment state, dependencies, build output, and local environment
 files in Git and the Docker context.
 
-For Talos, the trusted deployment controller must inject the streamed values
-directly into the workload's runtime secret facility without creating a local
+For Talos, the trusted deployment controller must inject the stdin values
+directly into the workload's runtime secret facility without creating another
 credential file. For SPIFFE, use the file-backed environment contract in
 `examples/spiffe`: mount the parent of the atomically switched `current`
 generation read-only, and point `ORY_AGENT_SPIFFE_GENERATION_PATH` at `current`.
@@ -214,8 +214,8 @@ explicit owner must equal the authenticated identity.
 
 ## Create and deploy
 
-Let the CLI create a fresh deployment and launch the trusted deployment
-controller:
+Let the CLI create or validate the durable deployment and launch the trusted
+deployment controller for a session:
 
 ```bash
 ory-agent deployment run \
@@ -223,22 +223,21 @@ ory-agent deployment run \
   -- trusted-deployer --credentials-stdin
 ```
 
-The CLI sends the exact credential only to the child process's anonymous stdin,
-never public stdout, a shell variable, log, or intermediate file. It strips its
-deployment-administration credentials from the child environment. The optional
-mode-`0600` result is non-secret and contains the newly created deployment ID.
-Every invocation issues a new deployment and writes no credential, state,
-pending journal, plaintext stage, or age identity.
+The CLI stores the credential in a protected mode-`0600` file, sends it only to
+the child process's anonymous stdin, and never writes it to public stdout, a
+shell variable, or a log. It strips deployment-administration credentials from
+the child environment. The optional result identifies whether the deployment
+was created or reused. Later invocations validate the same registered agent and
+start another session with the same credential and policy.
 
 The trusted controller must load stdin in memory, inject the values into the
 workload secret facility, start and supervise the workload, verify `/healthz`,
 invoke the guarded `/probe`, and exit only when that bounded workload run is
 finished. For a long-running service, the controller must remain its supervisor;
 do not detach and exit while the workload still needs the credential. After a
-successful controller exit, the CLI waits for **Active** and automatically revokes.
-It also revokes after controller failure, and a revoke failure makes the command
-fail. Process termination before cleanup can still orphan a deployment; inventory
-and explicitly revoke it rather than assuming a rerun will recover or reuse it.
+successful controller exit, the CLI waits for **Active** and retains the
+deployment for future sessions. Controller failure also leaves the registered
+agent intact. Use `ory-agent deployment revoke` only to retire the package.
 
 ## Customer-operated SPIFFE
 
@@ -306,5 +305,5 @@ Report changed files, format/typecheck/test/build results, Docker health,
 non-secret deployment ID and status, fixed-query and user-query probe results,
 activation status, and blockers. Never report credentials, environment values,
 authorization headers, or credential-file contents. The trusted controller must
-clean up its bounded workload before exiting; `deployment run` then revokes the
-fresh Agent Security deployment automatically.
+clean up its bounded workload before exiting; `deployment run` then retains the
+same Agent Security deployment for the next session.

package/assets/skills/ory-deploy-openai-e2b/SKILL.md

@@ -16,9 +16,9 @@ Use this playbook to turn the user's intent into a complete, secured deployment:
 The user should be able to ask for an agent in product terms. Inspect the repository,
 preserve its package manager and conventions, scaffold the application and controller,
 run validation, and deploy it through the commands below. Ask before overwriting an
-existing application or revoking a deployment that predates the current run. Always
-revoke the fresh streamed-credential deployment during cleanup. Ask for missing
-credentials; never fabricate them.
+existing application or revoking a deployment. Reuse the deployment package across
+agent sessions and revoke it only when the user intends to retire that registered
+agent. Ask for missing credentials; never fabricate them.
 
 Use `ory-build-agent` for another SDK and `ory-deploy-agent` for the canonical Claude
 Agent SDK Docker/Kubernetes deployment. Use `ory-e2b-sandbox` only when installing an
@@ -29,7 +29,7 @@ SDK application deployment.
 
 Keep these components separate:
 
-1. The trusted controller holds `E2B_API_KEY`, `OPENAI_API_KEY`, and the streamed
+1. The trusted controller holds `E2B_API_KEY`, `OPENAI_API_KEY`, and the deployment
    deployment values in memory.
 2. The E2B template contains only source and pinned dependencies. It contains no
    credentials and no Agent start command.
@@ -42,7 +42,7 @@ Never print, inspect, commit, upload, or place in a prompt:
 
 - `OPENAI_API_KEY` or `E2B_API_KEY`
 - `ORY_AGENT_API_KEY`
-- any streamed deployment credential value
+- any deployment credential value
 - a user OAuth2 token
 
 Never inject `ORY_USER_OAUTH2_TOKEN` into E2B. The deployment package is a complete
@@ -223,8 +223,8 @@ package_recipe_version: v1
 credential_method: talos_api_key
 ```
 
-Review the plan. Then let the CLI create a fresh deployment and launch the
-trusted E2B controller:
+Review the plan. Then let the CLI create or validate the durable deployment and
+launch the trusted E2B controller for a session:
 
 ```bash
 ory-agent deployment run \
@@ -232,15 +232,13 @@ ory-agent deployment run \
   -- trusted-e2b-controller --credentials-stdin
 ```
 
-The CLI sends credentials only through the child process's anonymous stdin,
-never public stdout, a shell variable, log, or intermediate file. It strips
-deployment-administration credentials from the child environment. The atomic
-mode-`0600` result contains the non-secret new deployment ID. `run` writes no
-credential, state, pending journal, plaintext stage, or age identity. It waits
-for **Active** after the controller succeeds and automatically revokes on every
-normal success or failure path. A failed revoke fails the command. Process
-termination before cleanup can still orphan a deployment, so inventory and
-explicitly revoke it rather than assuming a rerun will recover it.
+The CLI stores the reusable credential in a protected mode-`0600` file and sends
+it only through the child process's anonymous stdin, never public stdout, a shell
+variable, or a log. It strips deployment-administration credentials from the
+child environment. The atomic result records whether the deployment was created
+or reused. `run` waits for **Active** after the controller succeeds and retains
+the registered agent on success or failure so later sessions use the same policy.
+Revoke explicitly only when retiring the deployment package.
 
 ## Launch through the trusted controller
 
@@ -279,7 +277,7 @@ runtime request. Therefore use this order:
 2. Run the fixed guarded probe inside it with command-scoped credentials.
 3. Verify the expected output files exist without dumping process environment.
 4. Run the user's page-generation prompt and validate the static output.
-5. Exit successfully so `ory-agent deployment run` verifies **Active** and revokes.
+5. Exit successfully so `ory-agent deployment run` verifies **Active** and retains the deployment for the next session.
 
 Start in Agent Security `observe`, review the recorded decision and activity, grant the
 expected tool, deliberately promote policy to `enforce`, and prove an explicit deny keeps

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
   "repo": "ory-agent-plugins",
-  "commit": "f34eac0951a7e0b6a839cc83702f331c9c5f9c0e",
-  "commitShort": "f34eac0",
+  "commit": "d63aedaf130bd1428bd62351c7f1918ec48f5aae",
+  "commitShort": "d63aeda",
   "branch": "main",
-  "commitDate": "2026-10-03T11:40:49-07:00",
+  "commitDate": "2026-10-03T12:37:35-07:00",
   "dirty": false,
-  "builtAt": "2026-10-03T18:44:11.795Z"
+  "builtAt": "2026-10-03T19:41:09.590Z"
 }

package/dist/event-reporter.js

@@ -319,10 +319,16 @@ class AgentSecurityEventReporter {
             return "retain";
         const controller = new AbortController();
         this.activeRequest = controller;
-        const remaining = this.flushDeadline === undefined
-            ? this.requestTimeoutMs
-            : Math.max(1, Math.min(this.requestTimeoutMs, this.flushDeadline - Date.now()));
-        const timeout = setTimeout(() => controller.abort(), remaining);
+        const flushRemaining = this.flushDeadline === undefined
+            ? undefined
+            : this.flushDeadline - Date.now();
+        const expiresWithFlush = flushRemaining !== undefined && flushRemaining <= this.requestTimeoutMs;
+        const remaining = Math.max(1, Math.min(this.requestTimeoutMs, flushRemaining ?? this.requestTimeoutMs));
+        const timeout = setTimeout(() => {
+            if (expiresWithFlush)
+                this.flushExpired = true;
+            controller.abort();
+        }, remaining);
         timeout.unref?.();
         try {
             const url = `${this.options.agentSecurityUrl.replace(/\/+$/, "")}/agent-security/v1/events:record`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "1.4.6",
+  "version": "1.4.7",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",