@ory/claude-agent-sdk 0.10.0 → 0.11.1

package/README.md

@@ -24,7 +24,7 @@ query({ prompt, options: { canUseTool: oryCanUseTool() } });
 
 `createOryHooks` runs the Ory session gates on `SessionStart`, authorizes on `PreToolUse`
 (a deny returns `permissionDecision: "deny"`, blocking the tool), records `tool.complete` on
-`PostToolUse`, and writes an agent→subagent delegation tuple when the `Task` tool spawns a
+`PostToolUse`, and writes an agent→subagent delegation permission when the `Task` tool spawns a
 typed sub-agent. In **observe** mode (default) denies are logged but tools run; in **enforce**
 mode (`ORY_PERMISSION_MODE=enforce`) they're blocked.
 

package/dist/index.js

@@ -18,20 +18,36 @@ exports.createOryHooks = createOryHooks;
 exports.oryCanUseTool = oryCanUseTool;
 const argus_1 = require("@ory/argus");
 const HARNESS = "claude-agent-sdk";
+/**
+ * Extract the sub-agent type from a `Task`/`Agent` PreToolUse payload.
+ *
+ * In the real Claude PreToolUse contract `subagent_type` is a field of the
+ * Task tool's `tool_input`, so that is the primary location. A top-level
+ * `subagent_type` is kept as a harmless fallback for older payload shapes.
+ */
+function resolveSubAgentType(input) {
+    const toolInput = input.tool_input;
+    if (typeof toolInput === "object" &&
+        toolInput !== null &&
+        typeof toolInput.subagent_type === "string") {
+        return toolInput.subagent_type;
+    }
+    return typeof input.subagent_type === "string" ? input.subagent_type : undefined;
+}
 function lazySession(client, projectUrl) {
-    let started = false;
-    return async () => {
-        if (started)
-            return;
-        started = true;
-        try {
-            await (0, argus_1.sessionStart)(client, { harness: HARNESS, projectUrl });
-        }
-        catch (err) {
+    let sessionPromise;
+    // Cache the in-flight promise (not a boolean) so concurrent first calls all
+    // await the same session start instead of racing past a still-running gate.
+    // Fail-open: a rejection is logged, never rethrown, and clears the cache so
+    // a later call can retry.
+    return () => {
+        sessionPromise ??= (0, argus_1.sessionStart)(client, { harness: HARNESS, projectUrl }).then(() => undefined, (err) => {
+            sessionPromise = undefined;
             client.logger.warn("session_start.failed", {
                 message: err instanceof Error ? err.message : String(err),
             });
-        }
+        });
+        return sessionPromise;
     };
 }
 /**
@@ -49,12 +65,15 @@ function createOryHooks(options = {}) {
         await ensureSession();
         const input = raw;
         const toolName = input.tool_name;
-        if ((toolName === "Task" || toolName === "Agent") && typeof input.subagent_type === "string") {
-            await (0, argus_1.registerSubagent)(client, {
-                harness: HARNESS,
-                subAgentType: input.subagent_type,
-                projectUrl: options.projectUrl,
-            }).catch(() => undefined);
+        if (toolName === "Task" || toolName === "Agent") {
+            const subAgentType = resolveSubAgentType(input);
+            if (subAgentType) {
+                await (0, argus_1.registerSubagent)(client, {
+                    harness: HARNESS,
+                    subAgentType,
+                    projectUrl: options.projectUrl,
+                }).catch(() => undefined);
+            }
         }
         const result = await (0, argus_1.gate)(client, {
             harness: HARNESS,

package/dist/types.d.ts

@@ -8,8 +8,16 @@
 export interface PreToolUseHookInput {
     hook_event_name?: "PreToolUse";
     tool_name: string;
+    /**
+     * Tool arguments. For the `Task`/`Agent` sub-agent tool this carries the
+     * `subagent_type` field — sub-agent detection reads it from here.
+     */
     tool_input?: unknown;
-    /** Present on the `Task` sub-agent tool. */
+    /**
+     * Legacy fallback location for the sub-agent type. The real PreToolUse
+     * contract delivers `subagent_type` inside `tool_input`, not at the top
+     * level; this is only consulted when `tool_input` doesn't carry it.
+     */
     subagent_type?: string;
     session_id?: string;
     [key: string]: unknown;

package/package.json

@@ -1,8 +1,13 @@
 {
   "name": "@ory/claude-agent-sdk",
-  "version": "0.10.0",
+  "version": "0.11.1",
   "description": "Ory Agent Security for the Anthropic Claude Agent SDK — per-tool authorization, tracing, and identity propagation via PreToolUse hooks and canUseTool. Built on @ory/argus.",
   "license": "Apache-2.0",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/",
+    "provenance": true
+  },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
@@ -25,7 +30,7 @@
     "ai"
   ],
   "dependencies": {
-    "@ory/argus": "0.10.0"
+    "@ory/argus": "0.11.1"
   },
   "devDependencies": {
     "typescript": "^6.0.2",