@ory/argus 1.6.0 → 1.7.0

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
   "repo": "ory-agent-plugins",
-  "commit": "ebcd620c5f7cb4a27f47fd98bcb50b3d11d92b2e",
-  "commitShort": "ebcd620c",
+  "commit": "11290e2d19d1b0cabd49b94f8eaab8c3eb6f5f8e",
+  "commitShort": "11290e2d",
   "branch": "main",
-  "commitDate": "2026-10-28T20:25:41-07:00",
+  "commitDate": "2026-10-31T18:27:13-07:00",
   "dirty": false,
-  "builtAt": "2026-10-29T03:28:58.821Z"
+  "builtAt": "2026-11-01T01:30:26.563Z"
 }

package/dist/client.js

@@ -241,6 +241,9 @@ class OryAgentClient {
                     || (result.error !== undefined && typeof result.error !== "string"))) {
                 throw httpError(403, "Agent Security returned an invalid permission result");
             }
+            if (data.results.some((result) => result.error !== undefined)) {
+                throw httpError(503, "Agent Security could not complete a permission check");
+            }
             results.push(...data.results);
             headers = response.headers;
         }
@@ -720,6 +723,9 @@ class OryAgentClient {
                 ...(check.mcp ? { mcp: check.mcp } : {}),
             });
             const data = response.data;
+            if (data.error !== undefined && data.error !== null) {
+                throw httpError(503, "Agent Security could not complete a permission check");
+            }
             const oryRequestId = extractOryRequestId(response.headers);
             const result = {
                 allowed: data.allowed,
@@ -789,6 +795,9 @@ class OryAgentClient {
                 },
             });
             const data = response.data;
+            if (data.results.some((result) => result.error !== undefined && result.error !== null)) {
+                throw httpError(503, "Agent Security could not complete a permission check");
+            }
             const oryRequestId = extractOryRequestId(response.headers);
             const result = {
                 results: data.results.map((r) => ({
@@ -966,6 +975,9 @@ class OryAgentClient {
                 cause: err,
             };
         }
+        if (err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError")) {
+            return { code: "network_error", message: "Permission request timed out or was aborted", cause: err };
+        }
         const socketCode = findSocketErrorCode(err);
         if (socketCode) {
             return {
@@ -1257,6 +1269,10 @@ const SOCKET_ERROR_CODES = new Set([
     "ENETUNREACH",
     "EPIPE",
     "ECONNABORTED",
+    "UND_ERR_CONNECT_TIMEOUT",
+    "UND_ERR_HEADERS_TIMEOUT",
+    "UND_ERR_BODY_TIMEOUT",
+    "UND_ERR_SOCKET",
 ]);
 /**
  * The socket-level error code on `err`, walking `cause` the same way

package/dist/contract-suite.js

@@ -167,8 +167,8 @@ function runHarnessContractSuite(adapter) {
                 { check: "allowed", mode: "enforce", blocked: false, invoke: true, block: false },
                 { check: "denied", mode: "enforce", blocked: toolCanBlock, invoke: false, block: true },
                 { check: "denied", mode: "observe", blocked: false, invoke: true, block: true },
-                { check: "network_error", mode: "enforce", blocked: false, invoke: true, block: false },
-                { check: "rate_limited", mode: "enforce", blocked: false, invoke: true, block: false },
+                { check: "network_error", mode: "enforce", blocked: toolCanBlock, invoke: false, block: true },
+                { check: "rate_limited", mode: "enforce", blocked: toolCanBlock, invoke: false, block: true },
             ])("check=$check × $mode → blocked=$blocked", async ({ check, mode, blocked, invoke, block }) => {
                 const stubs = {
                     allowed: testing_js_1.stubPermissionAllowed,

package/dist/denial.d.ts

@@ -39,6 +39,8 @@ export interface DenialContext {
      * `activityAttributes.blockReason === "explicit_block"`.
      */
     blocked?: boolean;
+    /** The check failed before a trustworthy permission decision was available. */
+    checkRejected?: string;
 }
 /**
  * Activity attributes that mark a denial as a security alert.
@@ -82,7 +84,7 @@ export declare function formatAlertSummary(ctx: DenialContext): string;
  */
 export declare function shellDenialFields(decision: {
     activityAttributes?: unknown;
-}): Pick<DenialContext, "shellWord" | "shellDeniedWords" | "shellTooComplex" | "shellNamespace" | "blocked">;
+}): Pick<DenialContext, "shellWord" | "shellDeniedWords" | "shellTooComplex" | "shellNamespace" | "blocked" | "checkRejected">;
 /**
  * Human-facing denial reason. Shown in agent UIs (Claude Code's `decision`
  * reason, Gemini CLI's systemMessage, OpenClaw's blockReason, OpenCode's

package/dist/denial.js

@@ -70,6 +70,7 @@ function shellDenialFields(decision) {
         shellTooComplex: sa.shellTooComplex,
         shellNamespace: (0, tool_catalog_js_1.resolveShellCommandNamespace)(),
         blocked: sa.blockReason === "explicit_block",
+        checkRejected: sa.checkRejected,
     };
 }
 /**
@@ -78,6 +79,9 @@ function shellDenialFields(decision) {
  * thrown error message).
  */
 function formatDenialMessage(ctx) {
+    if (ctx.checkRejected) {
+        return `Ory: tool "${ctx.tool}" blocked because its permission check could not be completed (${ctx.checkRejected}). Check Agent Security availability and credentials, then retry.`;
+    }
     if (ctx.shellTooComplex) {
         return (`Ory: shell command blocked — it could not be safely parsed and is ` +
             `denied in enforce mode. Subject "${ctx.subjectId}". ` +
@@ -127,6 +131,8 @@ function formatDenialMessage(ctx) {
  * systemMessage which appears inline in the agent's TUI).
  */
 function formatDenialSummary(ctx) {
+    if (ctx.checkRejected)
+        return `Ory: permission check unavailable (${ctx.checkRejected}); tool blocked.`;
     if (ctx.shellTooComplex) {
         return `Ory: shell command blocked (could not be safely parsed). ${ADMIN_HINT}`;
     }

package/dist/permission-mode.d.ts

@@ -39,7 +39,7 @@
  *   3. **Persistent cache** — when the server is unreachable, fall back to the
  *      last value read from the server, persisted in `config.json`
  *      (`source: "cache"`).
- *   4. **`observe`** — nothing was ever cached (`source: "default"`).
+ *   4. **`enforce`** — a failed read and no applicable cache (`source: "default"`).
  *
  * The persistent cache is written by {@link warmPermissionModeCache} at session
  * start and when a gate first discovers a new acting-machine scope. It only
@@ -76,7 +76,7 @@ export declare function preparePermissionModeBatch(client: OryAgentClient, subje
 }): PermissionModeBatchPlan;
 /**
  * Resolve the current permission mode for `subject`. Never throws — a Keto
- * error falls back to the persistent cache, then `observe`. See the module
+ * error falls back to the persistent cache, then `enforce`. See the module
  * doc for the precedence. Does **not** persist (that is
  * {@link warmPermissionModeCache}'s job); `opts.now` is injectable for tests.
  */

package/dist/permission-mode.js

@@ -40,7 +40,7 @@
  *   3. **Persistent cache** — when the server is unreachable, fall back to the
  *      last value read from the server, persisted in `config.json`
  *      (`source: "cache"`).
- *   4. **`observe`** — nothing was ever cached (`source: "default"`).
+ *   4. **`enforce`** — a failed read and no applicable cache (`source: "default"`).
  *
  * The persistent cache is written by {@link warmPermissionModeCache} at session
  * start and when a gate first discovers a new acting-machine scope. It only
@@ -225,7 +225,7 @@ function fallbackPermissionMode(projectUrl, subjectKeys) {
         ? cache.mode
         : undefined;
     const mode = scopedMode ?? (legacyMode === "enforce" ? "enforce" : undefined);
-    return mode ? { mode, source: "cache" } : { mode: "observe", source: "default" };
+    return mode ? { mode, source: "cache" } : { mode: "enforce", source: "default" };
 }
 function persistPermissionModeMemo(client, projectUrl, now, requestedKeys) {
     const updates = {};
@@ -259,7 +259,7 @@ function persistPermissionModeMemo(client, projectUrl, now, requestedKeys) {
 }
 /**
  * Resolve the current permission mode for `subject`. Never throws — a Keto
- * error falls back to the persistent cache, then `observe`. See the module
+ * error falls back to the persistent cache, then `enforce`. See the module
  * doc for the precedence. Does **not** persist (that is
  * {@link warmPermissionModeCache}'s job); `opts.now` is injectable for tests.
  */
@@ -378,9 +378,9 @@ async function resolvePermissionMode(client, subject, opts = {}) {
         }
         client.logger.debug("permission.mode_default", {
             code: oryErr?.code,
-            note: "mode check failed and no cached value; defaulting to observe",
+            note: "mode check failed and no cached value; defaulting to enforce",
         });
-        return { mode: "observe", source: "default" };
+        return { mode: "enforce", source: "default" };
     }
 }
 /**

package/dist/permissions.d.ts

@@ -13,9 +13,8 @@
  *          tool through.
  *        - `enforce` — return `{ kind: "deny", … }` so the caller blocks.
  *   3. On a thrown {@link OryError}, inspects the classified code:
- *        - Infrastructure errors (`network_error`, `rate_limited`,
- *          `not_found`, `unknown`) — returns `{ kind: "fail_open", … }`.
- *          Callers should log and allow.
+ *        - Network, rate-limit and server failures deny in enforce mode;
+ *          observe mode remains permissive.
  *        - Auth-rejected check calls (`forbidden`, `session_inactive`,
  *          `session_aal2_required` — the check itself was rejected, so
  *          its result cannot be trusted) — in `enforce` mode returns
@@ -42,7 +41,7 @@ import type { OryError, OryErrorCode, PermissionCheck, PermissionResult } from "
  *
  * Threaded onto the decision's activity attributes and into the observe-mode
  * audit event so "explicitly blocked" is distinguishable from "never granted"
- * in activity logs, mirroring how `checkRejected` distinguishes an auth-rejected
+ * in activity logs, mirroring how `checkRejected` distinguishes a failed
  * deny.
  */
 export type BlockReason = "not_granted" | "explicit_block";
@@ -66,7 +65,7 @@ export interface DecisionActivityAttributes {
     /** SubjectSet rendered as `<namespace>:<object>#<relation>` when used. */
     subjectSet?: string;
     /**
-     * Set when the check call itself was auth-rejected and enforce mode
+     * Set when the check call itself failed and enforce mode
      * turned that into a deny — the classified {@link OryErrorCode} that
      * caused it. Makes the "denied because the check failed" case
      * distinguishable from a normal Keto deny in the audit trail.
@@ -305,16 +304,16 @@ export declare function mostRestrictiveDecision(decisions: PermissionDecision[])
  * Aggregation: **any deny → deny** (naming the offending word); else any observe
  * → observe (pass through, per-word `permission.observe_deny` events recorded);
  * else allow. A too-complex / unparseable command is **fail-closed** in enforce
- * (deny + alert) and logged-then-passed in observe. A parser-unavailable or
- * infrastructure error is **fail-open** (top-level decision only) — availability
- * must not hinge on the parser.
+ * (deny + alert) and logged-then-passed in observe. A parser-unavailable
+ * condition falls back to the top-level decision. Network, rate-limit, and
+ * server failures in word checks deny in enforce mode.
  */
 export declare function decomposeAndCheck(client: OryAgentClient, args: GateToolCallArgs): Promise<PermissionDecision>;
 /**
  * Run a permission check and resolve the configured mode against the
  * result. Never throws — infrastructure errors surface as a typed
- * `{ kind: "fail_open" }` decision, and auth-rejected check calls in
- * enforce mode as `{ kind: "deny" }` (see
+ * `{ kind: "fail_open" }` decision in observe mode, and untrusted or unavailable
+ * check calls in enforce mode as `{ kind: "deny" }` (see
  * {@link CHECK_UNTRUSTED_CODES}).
  */
 export declare function checkAndDecide(client: OryAgentClient, check: PermissionCheck, opts?: CheckAndDecideOptions): Promise<PermissionDecision>;

package/dist/permissions.js

@@ -14,9 +14,8 @@
  *          tool through.
  *        - `enforce` — return `{ kind: "deny", … }` so the caller blocks.
  *   3. On a thrown {@link OryError}, inspects the classified code:
- *        - Infrastructure errors (`network_error`, `rate_limited`,
- *          `not_found`, `unknown`) — returns `{ kind: "fail_open", … }`.
- *          Callers should log and allow.
+ *        - Network, rate-limit and server failures deny in enforce mode;
+ *          observe mode remains permissive.
  *        - Auth-rejected check calls (`forbidden`, `session_inactive`,
  *          `session_aal2_required` — the check itself was rejected, so
  *          its result cannot be trusted) — in `enforce` mode returns
@@ -57,8 +56,7 @@ function resolveCheckRelation(relation) {
  * authentication/authorization reasons — an expired or misconfigured
  * agent credential, an inactive session, or a missing MFA step. The
  * check result cannot be trusted, so `enforce` mode denies instead of
- * failing open. Infrastructure errors (`network_error`, `rate_limited`,
- * `not_found`, `unknown`) keep the fail-open posture.
+ * failing open. Network and rate-limit failures are likewise untrusted.
  */
 const CHECK_UNTRUSTED_CODES = new Set([
     // The check reached Ory and was refused — an expired or misconfigured agent
@@ -72,7 +70,27 @@ const CHECK_UNTRUSTED_CODES = new Set([
     // cert problem silently downgraded an `enforce` project to `observe`, and
     // breaking TLS was sufficient to disable all tool gating (#218).
     "tls_error",
+    "network_error",
+    "rate_limited",
 ]);
+function isUntrustedCheckError(error) {
+    return !!error && (CHECK_UNTRUSTED_CODES.has(error.code) || (error.status !== undefined && error.status >= 500));
+}
+function isUnavailableCheckError(error) {
+    return error.code === "network_error" || error.code === "rate_limited" || (error.status !== undefined && error.status >= 500);
+}
+function rejectedCheckDecision(check, error, mode) {
+    const attrs = buildDecisionAttributes(mode, check.subjectId, check.subjectSet);
+    if (mode === "enforce") {
+        return {
+            kind: "deny",
+            result: { allowed: false, checkedAt: new Date().toISOString(), check },
+            mode: "enforce",
+            activityAttributes: { ...attrs, checkRejected: error.code },
+        };
+    }
+    return { kind: "fail_open", error, mode, activityAttributes: attrs };
+}
 /**
  * Max distinct command words checked per shell command (issue #76). A command
  * with more than this is pathological (no legitimate command runs 100+ distinct
@@ -251,10 +269,13 @@ async function gateToolCall(client, args) {
             namespace: args.check.namespace,
             object: args.check.object,
             principals: args.principals,
-        }),
+            strict: mode === "enforce",
+        }).catch((error) => ({ error })),
     ]);
     if (!blocked)
         return decision;
+    if ("error" in blocked)
+        return rejectedCheckDecision(args.check, blocked.error, mode);
     // Already denied on the user's own check — nothing to add to the outcome, but
     // the block is worth recording as the stronger reason it would not have run.
     if (decision.kind === "deny") {
@@ -317,8 +338,12 @@ async function batchNonShellGate(client, args) {
         }
         return applyBlockedDecision(client, args, mode, decision, blocked);
     }
-    catch {
+    catch (err) {
         const mode = args.modeOverride ?? (await (0, permission_mode_js_1.warmPermissionModeCache)(client, modeSubject, { additionalSubjects })).mode;
+        const error = err?.status !== undefined || err?.code === "network_error" || err?.code === "rate_limited"
+            ? err : client.classifyError(err);
+        if (isUnavailableCheckError(error))
+            return rejectedCheckDecision(args.check, error, mode);
         const [decision, blocked] = await Promise.all([
             checkAndDecide(client, args.check, { activityAttributes: args.activityAttributes, modeOverride: mode }),
             findBlockedPrincipal(client, {
@@ -326,8 +351,11 @@ async function batchNonShellGate(client, args) {
                 object: args.check.object,
                 principals: args.principals,
                 mcp: args.check.mcp,
-            }),
+                strict: mode === "enforce",
+            }).catch((error) => ({ error })),
         ]);
+        if (blocked && "error" in blocked)
+            return rejectedCheckDecision(args.check, blocked.error, mode);
         return applyBlockedDecision(client, args, mode, decision, blocked);
     }
 }
@@ -441,9 +469,9 @@ function applyPrincipalBlock(client, ctx) {
  * Aggregation: **any deny → deny** (naming the offending word); else any observe
  * → observe (pass through, per-word `permission.observe_deny` events recorded);
  * else allow. A too-complex / unparseable command is **fail-closed** in enforce
- * (deny + alert) and logged-then-passed in observe. A parser-unavailable or
- * infrastructure error is **fail-open** (top-level decision only) — availability
- * must not hinge on the parser.
+ * (deny + alert) and logged-then-passed in observe. A parser-unavailable
+ * condition falls back to the top-level decision. Network, rate-limit, and
+ * server failures in word checks deny in enforce mode.
  */
 async function decomposeAndCheck(client, args) {
     // The word checks do not depend on the top-level result until aggregation, so
@@ -463,7 +491,7 @@ async function decomposeAndCheck(client, args) {
         || parsed.words.length > MAX_SHELL_WORDS
         || (parsed.tooComplex && expectedMode === "enforce")
         ? undefined
-        : fetchShellWordResults(client, args, namespace, parsed.words, subject);
+        : fetchShellWordResults(client, { ...args, modeOverride: expectedMode }, namespace, parsed.words, subject);
     const [top, wordFetch] = await Promise.all([topPromise, wordsPromise]);
     // Top-level Bash denied (enforce) or unreachable → no point decomposing.
     if (top.kind === "deny" || top.kind === "fail_open")
@@ -538,10 +566,10 @@ async function decomposeAndCheck(client, args) {
     let sawObserve = false;
     let matchedBlocks = new Map();
     if (words.length > 0) {
-        const fetched = wordFetch ?? await fetchShellWordResults(client, args, namespace, words, subject);
+        const fetched = wordFetch ?? await fetchShellWordResults(client, { ...args, modeOverride: mode }, namespace, words, subject);
         if (!fetched.ok) {
             const oryErr = fetched.error;
-            if (mode === "enforce" && oryErr && CHECK_UNTRUSTED_CODES.has(oryErr.code)) {
+            if (mode === "enforce" && isUntrustedCheckError(oryErr)) {
                 return {
                     kind: "deny",
                     result: { allowed: false, checkedAt: new Date().toISOString(), check: args.check },
@@ -722,6 +750,7 @@ async function fetchShellWordResults(client, args, namespace, words, subject) {
                     namespace,
                     objects: chunk,
                     principals: args.principals,
+                    strict: args.modeOverride === "enforce",
                 }),
             ]);
             return { ok: true, results: batch.results, blocked };
@@ -746,8 +775,8 @@ async function fetchShellWordResults(client, args, namespace, words, subject) {
 /**
  * Run a permission check and resolve the configured mode against the
  * result. Never throws — infrastructure errors surface as a typed
- * `{ kind: "fail_open" }` decision, and auth-rejected check calls in
- * enforce mode as `{ kind: "deny" }` (see
+ * `{ kind: "fail_open" }` decision in observe mode, and untrusted or unavailable
+ * check calls in enforce mode as `{ kind: "deny" }` (see
  * {@link CHECK_UNTRUSTED_CODES}).
  */
 async function checkAndDecide(client, check, opts = {}) {
@@ -768,9 +797,8 @@ async function checkAndDecide(client, check, opts = {}) {
     }
     catch (err) {
         const oryErr = err;
-        if (mode === "enforce" && oryErr && CHECK_UNTRUSTED_CODES.has(oryErr.code)) {
-            // The check call itself was rejected for auth reasons — the
-            // result cannot be trusted, so enforce mode must not fail open.
+        if (mode === "enforce" && isUntrustedCheckError(oryErr)) {
+            // The result cannot be trusted, so enforce mode must not fail open.
             client.logger.warn("permission.check_rejected", {
                 namespace: check.namespace,
                 object: check.object,
@@ -865,6 +893,7 @@ async function findBlockedPrincipal(client, args) {
         objects: [args.object],
         principals: args.principals,
         mcp: args.mcp,
+        strict: args.strict,
     })).get(args.object);
 }
 async function findBlockedPrincipals(client, args) {
@@ -910,6 +939,9 @@ async function findBlockedPrincipals(client, args) {
             }
         }
         catch (err) {
+            const classified = err?.code ? err : client.classifyError(err);
+            if (args.strict && isUntrustedCheckError(classified))
+                throw classified;
             client.logger.debug("permission.principal_block.failed", {
                 scope,
                 note: `${scope} principal block read failed; falling open for that scope`,

package/dist/types.d.ts

@@ -63,8 +63,7 @@ export type OryErrorCode = "session_inactive" | "session_aal2_required" | "forbi
 /**
  * TLS/certificate verification failed — an expired, self-signed, or otherwise
  * untrusted certificate on the project host. Distinct from `network_error`
- * because the posture differs: a socket-level blip is a transport failure and
- * fails open, whereas a certificate failure means we cannot establish *who we
+ * because a certificate failure means we cannot establish *who we
  * are talking to*, so the check result cannot be trusted at all. It is also
  * precisely the failure an active network attacker produces, so under
  * `enforce` it denies rather than passing the tool through.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/argus",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "Ory Argus: the core API for building authentication, authorization, and audit into AI agent harness plugins, extensions, and custom integrations",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",