@ory/claude-code 0.13.7 → 0.13.9

package/dist/cli/main.js

@@ -125,7 +125,13 @@ async function status() {
             // local iteration). Run `claude plugin list` for an authoritative
             // view of what the `claude` CLI has registered.
             console.log("Hooks & plugin:");
-            const assembled = fs.existsSync(PERSISTENT_DIR);
+            // The data dir doubles as the default trace/debug-log home, so it exists
+            // after any session regardless of install path — its mere presence does
+            // NOT mean a plugin was assembled here. `isAssembledFromSource` keys off
+            // the `.claude-plugin` manifest, which only the `--from-source` path
+            // writes. Production installs delegate to the ory/claude-plugins
+            // marketplace and assemble nothing locally.
+            const assembled = (0, setup_js_1.isAssembledFromSource)(PERSISTENT_DIR);
             console.log(`  Local --from-source dir: ${assembled ? PERSISTENT_DIR : "(none — production installs use the ory/claude-plugins marketplace; run 'claude plugin list' to see registered plugins)"}`);
             if (assembled) {
                 console.log(`  Skills:      ${fs.existsSync(path.join(PERSISTENT_DIR, "skills")) ? "installed" : "not installed"}`);

package/dist/cli/setup.d.ts

@@ -8,6 +8,17 @@
  *   npx ory-claude-setup --from-source    # Install from the local source tree (dev only)
  *   npx ory-claude-setup --uninstall      # Remove plugin
  */
+/**
+ * Whether a `--from-source` plugin was assembled into `dir`.
+ *
+ * The data dir doubles as the default trace/debug-log home (`fromEnv` writes
+ * `ory-agent-trace.ndjson` / `ory-agent-debug.log` there on every session), so
+ * its mere existence does NOT indicate a local assembly — a production
+ * marketplace install that has run once already creates it. The plugin
+ * manifest (`.claude-plugin`) is written only by {@link assemblePluginDir}, so
+ * it's the reliable signal that this dir holds a from-source plugin.
+ */
+export declare function isAssembledFromSource(dir: string): boolean;
 /**
  * Install the Ory plugin via the `claude` CLI.
  *

package/dist/cli/setup.js

@@ -43,6 +43,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAssembledFromSource = isAssembledFromSource;
 exports.install = install;
 exports.uninstall = uninstall;
 const node_child_process_1 = require("node:child_process");
@@ -177,6 +178,19 @@ function assemblePluginDir(hookCommand) {
     }, null, 2) + "\n");
     return PERSISTENT_DIR;
 }
+/**
+ * Whether a `--from-source` plugin was assembled into `dir`.
+ *
+ * The data dir doubles as the default trace/debug-log home (`fromEnv` writes
+ * `ory-agent-trace.ndjson` / `ory-agent-debug.log` there on every session), so
+ * its mere existence does NOT indicate a local assembly — a production
+ * marketplace install that has run once already creates it. The plugin
+ * manifest (`.claude-plugin`) is written only by {@link assemblePluginDir}, so
+ * it's the reliable signal that this dir holds a from-source plugin.
+ */
+function isAssembledFromSource(dir) {
+    return fs.existsSync(path.join(dir, ".claude-plugin"));
+}
 /** Remove the persistent install directory if it exists. */
 function cleanPersistentDir() {
     if (fs.existsSync(PERSISTENT_DIR)) {

package/dist/handlers.js

@@ -76,11 +76,11 @@ async function handleSessionStart(input, client, deps) {
     const agentGate = deps.agentGate ?? argus_1.ensureAgentIdentity;
     await agentGate(client, { projectUrl: (0, argus_1.resolveConfig)().projectUrl, harness: "claude-code" });
     // Record the user→agent delegation so the audit trail captures that
-    // this user authorized this agent for this session. Best-effort:
-    // requires both principals to be populated, and any failure is logged
-    // and swallowed (fail-open — delegation tracking is for audit, not
-    // enforcement).
-    await recordUserDelegatesAgent(client);
+    // this user authorized this agent for this session. Best-effort and
+    // written at most once per install: requires both principals to be
+    // populated, and any failure is logged and swallowed (fail-open —
+    // delegation tracking is for audit, not enforcement).
+    await (0, argus_1.writeUserDelegatesAgent)(client);
     if (!decision.proceed) {
         return { decision: "block", reason: decision.reason };
     }
@@ -478,45 +478,11 @@ function permissionRequestFallback(reason) {
 function resolveNamespace() {
     return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
 }
-/**
- * Write the user→agent delegation tuple. Idempotent and fail-open:
- * requires both principal subjects to be populated; any error (including
- * unconfigured projectUrl, which manifests as a network_error) is logged
- * and swallowed. The actual permission enforcement is unchanged — this
- * tuple is purely audit-trail data.
- */
-async function recordUserDelegatesAgent(client) {
-    const user = client.userPrincipal.subject;
-    const agent = client.agentPrincipal.subject;
-    if (!user || !agent) {
-        client.logger.debug("delegation.skip", {
-            reason: "missing principal",
-            hasUser: !!user,
-            hasAgent: !!agent,
-        });
-        return;
-    }
-    try {
-        await client.createRelationship({
-            namespace: resolveNamespace(),
-            object: `agent:${agent}`,
-            relation: "delegate",
-            subjectId: `user:${user}`,
-        }, { spanAttributes: { delegation: "user-to-agent" } });
-    }
-    catch (err) {
-        const oryErr = err;
-        client.logger.warn("delegation.user_to_agent.failed", {
-            code: oryErr.code,
-            message: oryErr.message,
-        });
-    }
-}
 /**
  * Register an OAuth2 identity for a sub-agent and write the
- * `agent → subagent` delegation tuple. Fail-open and idempotent:
- * `createRelationship` absorbs 409s, so multiple call paths
- * (SubagentStart event + Task-tool fallback) won't duplicate state.
+ * `agent → subagent` delegation tuple. Fail-open and written at most once
+ * per install, so the multiple call paths (SubagentStart event + Task-tool
+ * fallback) won't duplicate state.
  */
 async function registerSubAgent(subAgentType, client, deps) {
     const subAgentGate = deps.subAgentGate ?? argus_1.ensureSubAgentIdentity;
@@ -537,30 +503,7 @@ async function registerSubAgent(subAgentType, client, deps) {
     }
     if (identity.kind !== "dynamic" || !identity.subject)
         return;
-    const agent = client.agentPrincipal.subject;
-    if (!agent) {
-        client.logger.debug("delegation.skip", {
-            reason: "agent principal not populated",
-            subAgentType,
-        });
-        return;
-    }
-    try {
-        await client.createRelationship({
-            namespace: resolveNamespace(),
-            object: `subagent:${identity.subject}`,
-            relation: "delegate",
-            subjectId: `agent:${agent}`,
-        }, { spanAttributes: { delegation: "agent-to-subagent", subAgentType } });
-    }
-    catch (err) {
-        const oryErr = err;
-        client.logger.warn("delegation.agent_to_subagent.failed", {
-            subAgentType,
-            code: oryErr.code,
-            message: oryErr.message,
-        });
-    }
+    await (0, argus_1.writeAgentDelegatesSubagent)(client, identity.subject, subAgentType);
 }
 /**
  * Legacy fallback for older Claude Code versions that don't fire

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/claude-code",
-  "version": "0.13.7",
+  "version": "0.13.9",
   "description": "Ory plugin for Claude Code: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://github.com/ory/claude-plugins/tree/master/plugins/ory-agent-plugin",
@@ -76,7 +76,7 @@
   ],
   "dependencies": {
     "reo-census": "^1.2.8",
-    "@ory/argus": "0.13.7"
+    "@ory/argus": "0.13.9"
   },
   "engines": {
     "node": ">=22"