@ory/argus 1.5.2 → 1.5.3

package/dist/agent-auth.d.ts

@@ -401,6 +401,8 @@ export interface EnsureAgentIdentityOptions {
      * What prompted this resolution, recorded on the `agent.auth` activity event. Absent for
      * the session-start gate; `read_credential` when the tool gate resolved the
      * identity because it needed a credential to authenticate a permission read.
+     * A triggered resolution that cleanly loads a stored credential records no
+     * activity; only its failures and warnings do.
      */
     trigger?: string;
 }
@@ -408,8 +410,10 @@ export interface EnsureAgentIdentityOptions {
  * Resolve the agent's credentials and attach them to the client.
  *
  * Always returns the resolved credentials; never throws and never blocks.
- * Emits exactly one `agent.auth` activity event so the audit trail records whether
- * the agent identity was available for the session.
+ * Emits one `agent.auth` activity event so the audit trail records whether the
+ * agent identity was available for the session. A `trigger`ed (tool-path)
+ * resolution emits it only when the credential is missing or resolved with
+ * warnings; a clean reload of the stored credential is logged at debug level.
  */
 export declare function ensureAgentIdentity(client: OryAgentClient, options?: EnsureAgentIdentityOptions): Promise<AgentCredentials>;
 /**

package/dist/agent-auth.js

@@ -1288,8 +1288,10 @@ async function fetchClientCredentialsToken(args) {
  * Resolve the agent's credentials and attach them to the client.
  *
  * Always returns the resolved credentials; never throws and never blocks.
- * Emits exactly one `agent.auth` activity event so the audit trail records whether
- * the agent identity was available for the session.
+ * Emits one `agent.auth` activity event so the audit trail records whether the
+ * agent identity was available for the session. A `trigger`ed (tool-path)
+ * resolution emits it only when the credential is missing or resolved with
+ * warnings; a clean reload of the stored credential is logged at debug level.
  */
 async function ensureAgentIdentity(client, options = {}) {
     const sessionId = options.sessionId ?? client.sessionId;
@@ -1425,6 +1427,19 @@ async function ensureAgentIdentity(client, options = {}) {
     // resolver match" should not clear it. With nothing set, the read path falls
     // back to the rehydrated user token (see `buildApis`).
     const sessionKey = sessionId?.trim() || config_js_1.SESSIONLESS_KEY;
+    // Subprocess harnesses start a fresh process for every hook, so a tool-path
+    // resolution that merely reloads the stored credential would otherwise record
+    // one `agent.auth` per tool call. Only the session-start gate, a failure, or a
+    // partial resolution is an authentication outcome worth auditing.
+    if (options.trigger && creds.kind !== "none" && !creds.warnings?.length) {
+        client.logger.debug("agent.auth.loaded", {
+            kind: creds.kind,
+            sessionKey,
+            trigger: options.trigger,
+            ...(creds.subject ? { subject: creds.subject } : {}),
+        });
+        return creds;
+    }
     client.logger.activity("agent.auth", creds.kind === "none" ? "skipped" : "ok", {
         attributes: {
             kind: creds.kind,

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
   "repo": "ory-agent-plugins",
-  "commit": "b63441d792bda2410aab728652a6ca4ff633e418",
-  "commitShort": "b63441d7",
+  "commit": "6d5a4dd670531925d1a0807d25406ccc4db24bf5",
+  "commitShort": "6d5a4dd6",
   "branch": "main",
-  "commitDate": "2026-10-22T11:27:22-07:00",
+  "commitDate": "2026-10-22T14:21:25-07:00",
   "dirty": false,
-  "builtAt": "2026-10-22T18:31:32.704Z"
+  "builtAt": "2026-10-22T21:25:21.096Z"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "1.5.2",
+  "version": "1.5.3",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",