@ory/claude-code 0.13.8 → 0.14.0

package/README.md

@@ -21,12 +21,14 @@ Run one command. It installs the plugin and walks you through connecting:
 npx -y -p @ory/claude-code ory-claude install
 ```
 
-You'll be asked how you want to connect — **press Enter for the default**:
+It opens a guided setup **in your browser** where you pick how to connect — the default takes just a click:
 
 - **Ory Network** *(default)* — sign in, or create a free account, in your browser. The project, keys, permissions, and login are all set up for you. Nothing to configure by hand.
 - **Local** — run a complete Ory on your laptop with Docker. No account, no signup, no keys. Great for trying it out.
 - **Audit-only** — skip Ory entirely and just log what Claude does.
 
+> No browser available (CI, SSH, headless)? The same walkthrough runs right in your terminal instead — or force it with `--no-web`.
+
 That's it. Confirm everything landed with:
 
 ```bash
@@ -52,6 +54,7 @@ If Ory is ever unreachable, the plugin gets out of the way and lets Claude keep
 Everything the plugin does is observable out of the box — no configuration required:
 
 - **Status at a glance.** `npx -y -p @ory/claude-code ory-claude status` shows what's configured, who's signed in, how many built-in tools your permissions cover, and the most recent tool-call activity.
+- **Live dashboard.** `npx -y -p @ory/claude-code ory-claude dashboard` opens the same picture in your browser — configuration, identities, permission coverage, Ory service health, and the latest tool-call activity, all refreshing live. From there you can flip **enforcement** on or off, toggle **user login**, and use **Change stack** to reconnect to a different Ory — no CLI required.
 - **Live traces.** Every tool call is recorded as an OpenTelemetry-style span. Watch them stream as the agent works:
 
   ```bash
@@ -69,7 +72,7 @@ When the watch-mode logs look right, turn on blocking with one command (setup al
 npx -y -p @ory/claude-code ory-claude permissions enforce
 ```
 
-Now a denied tool is actually blocked and Claude shows why. Go back to watch mode anytime with `permissions observe`. Use `permissions status` to see what's covered and `permissions bootstrap` to (re-)grant the built-in tools — or just ask Claude in chat, e.g. *"grant me use of the Bash tool."*
+Now a denied tool is actually blocked and Claude shows why. Go back to watch mode anytime with `permissions observe`. Prefer clicking? The dashboard has the same **Enforce** switch — flip it on, or back to watch mode, without touching the CLI. Use `permissions status` to see what's covered and `permissions bootstrap` to (re-)grant the built-in tools — or just ask Claude in chat, e.g. *"grant me use of the Bash tool."*
 
 ## Also: add login to your own app
 
@@ -84,8 +87,7 @@ The guided setup covers most people. For scripted or CI setups, or to point at a
 ```bash
 npx -y -p @ory/claude-code ory-claude configure \
   --project-url https://<slug>.projects.oryapis.com \
-  --oauth2-client-id <login client id> \
-  --user-login
+  --oauth2-client-id <login client id>
 ```
 
 Claude's own identity registers itself automatically on first run — nothing to create. The `--oauth2-client-id` is the one piece browser sign-in needs; the guided setup makes it for you, or see below to do it by hand. For logging-only with no checks, use `--audit-only`.
@@ -97,7 +99,7 @@ The guided setup normally does this. To do it yourself, create a **public** OAut
 
 ```bash
 ory create oauth2-client --project <project-id> \
-  --name "ory-agent-plugin" \
+  --name "Ory Agent Security · user login (PKCE)" \
   --grant-type authorization_code,refresh_token \
   --response-type code \
   --scope openid,offline_access \
@@ -117,11 +119,12 @@ With nothing configured, the plugin still loads and runs in **pass-through mode*
 ## Commands
 
 ```
-ory-claude install | uninstall        Install/remove; --reconfigure re-runs setup, --no-configure skips it
+ory-claude install | uninstall        Install/remove; --reconfigure re-runs setup, --no-web forces the terminal wizard, --no-configure skips it
 ory-claude status                     Show configuration, identities, permission coverage, recent activity
+ory-claude dashboard                  Open the live browser dashboard (status + service health + Change stack)
 ory-claude watch                      Tail the live trace stream (OTel spans)
 ory-claude permissions <cmd>          status | bootstrap | observe (watch) | enforce (block)
-ory-claude configure <flags>          Point at a project by hand (--project-url, --oauth2-client-id, --user-login, --audit-only)
+ory-claude configure <flags>          Point at a project by hand (--project-url, --oauth2-client-id, --audit-only)
 ory-claude agent <status|unregister>  Manage Claude's own auto-created identity
 ory-claude local <up|down|status|…>   Run / manage a local Ory in Docker
 ```

package/dist/cli/main.js

@@ -98,6 +98,12 @@ function main() {
         case "watch":
             (0, argus_1.runWatchCommand)("claude-code", args);
             break;
+        case "dashboard":
+            (0, argus_1.runDashboardCommand)("ory-claude", "claude-code", args).then((code) => process.exit(code), (err) => {
+                console.error(err.message ?? err);
+                process.exit(1);
+            });
+            break;
         case "version":
         case "--version":
         case "-v":
@@ -155,6 +161,7 @@ Commands:
   agent <cmd>          Manage the agent's OAuth2 (DCR) identity (status, unregister)
   permissions <cmd>    Manage permission mode and tool permissions (status, bootstrap, observe, enforce)
   status               Show plugin status and configuration
+  dashboard            Open a live web dashboard (stack health + configuration)
   watch [trace-file]   Tail the trace stream (OTel spans) live
   version              Show version and the ory-agent-plugins build commit
   local <cmd>          Manage local Ory dev environment (up, down, status, seed, ...)

package/dist/cli/setup.js

@@ -108,8 +108,18 @@ const RENDER_OPTS = {
  * fetches everything directly from the GitHub marketplace.
  */
 const PERSISTENT_DIR = (0, argus_1.getHarnessDataDir)("claude-code");
-/** Hook command that resolves the binary via the npm registry. */
-const HOOK_CMD_REMOTE = "npx -y -p @ory/claude-code ory-claude-hook";
+/**
+ * Hook command for a `--from-source` install fetched via npx. The plugin lives
+ * in an ephemeral `_npx` cache dir (cleaned between runs), so the hook must
+ * re-resolve `@ory/claude-code` at runtime rather than point at a soon-to-vanish
+ * path. `--from-source` is dev-only and always paired with the local Verdaccio
+ * registry, so the hook's npx is pinned to it (with `--min-release-age=0` so a
+ * just-published dev version isn't filtered out). Without the explicit
+ * `--registry`, a normally-launched `claude` (i.e. not via the dev launcher,
+ * which sets `npm_config_registry`) would resolve `@ory/claude-code` from
+ * npmjs.org and run the last *published* release instead of your local build.
+ */
+const HOOK_CMD_FROM_SOURCE_REMOTE = `npx -y --registry ${argus_1.REGISTRY_URL} --min-release-age=0 -p @ory/claude-code ory-claude-hook`;
 /**
  * Detect if we're running from a temporary npx/pnpm-dlx cache directory
  * rather than a proper local or global npm installation. Only consulted on
@@ -145,6 +155,25 @@ function assemblePluginDir(hookCommand) {
             });
         }
     }
+    // Stamp the assembled plugin manifest with this package's version. The
+    // committed manifest carries a frozen placeholder version, and the `claude`
+    // CLI keys its cached component inventory (commands, skills) on the plugin
+    // version — so without this, a release that adds a command would keep the
+    // stale command set until the user manually removed the plugin. Tracking the
+    // package version means every release advertises a new plugin version and
+    // Claude Code refreshes.
+    const manifestPath = path.join(PERSISTENT_DIR, ".claude-plugin", "plugin.json");
+    try {
+        const pkgVersion = JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT, "package.json"), "utf8")).version;
+        if (pkgVersion && fs.existsSync(manifestPath)) {
+            const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+            manifest.version = pkgVersion;
+            fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
+        }
+    }
+    catch {
+        /* best-effort — a missing/unreadable manifest just keeps its default version */
+    }
     // Skills — materialized fresh from the shared core templates.
     const skillsDir = path.join(PERSISTENT_DIR, "skills");
     fs.rmSync(skillsDir, { recursive: true, force: true });
@@ -318,10 +347,19 @@ function installFromSource(scope) {
     const remote = isRemoteContext();
     console.log("Assembling Ory plugin (skills, commands, hooks, MCP) at:");
     console.log(`  ${PERSISTENT_DIR}`);
-    const pluginRoot = assemblePluginDir(remote ? HOOK_CMD_REMOTE : localHookCommand());
+    const pluginRoot = assemblePluginDir(remote ? HOOK_CMD_FROM_SOURCE_REMOTE : localHookCommand());
     const marketplaceName = readLocalMarketplaceName();
     const pluginName = readLocalPluginName();
     console.log(`Source: ${pluginName}@${marketplaceName} (from ${pluginRoot})`);
+    // Force a clean slate before re-adding. The `claude` CLI caches an
+    // already-installed plugin by version and won't re-read its command/skill
+    // files on a same-version re-install — so a freshly-assembled command (e.g.
+    // `dashboard`) would be missing after a republish. Removing the plugin and
+    // its marketplace first guarantees the current command set is picked up on
+    // every dev iteration. Best-effort and quiet: a not-yet-installed plugin
+    // just no-ops here.
+    runClaude(["plugin", "uninstall", pluginName, "--scope", scope]);
+    runClaude(["plugin", "marketplace", "remove", marketplaceName]);
     console.log("Adding local Ory plugin marketplace...");
     const addResult = runClaude([
         "plugin",

package/dist/handlers.js

@@ -61,13 +61,12 @@ async function handleSessionStart(input, client, deps) {
         attributes: { model: input.model, source: input.source },
     });
     // Run the user login (interactive PKCE on first session, refresh
-    // when needed). When ORY_USER_LOGIN is unset this is a no-op and we
-    // fall through to the legacy verify path below.
+    // when needed). This runs every session and never blocks —
+    // enforcement is governed solely by permissionMode at tool-call time.
     const userGate = deps.userLogin ?? argus_1.ensureUserAuthenticated;
-    const decision = await userGate(client, {
+    await userGate(client, {
         binName: "ory-claude",
         harness: "claude-code",
-        allowBlock: true,
     });
     // Resolve the agent identity (machine credentials) regardless of how
     // user auth went — it never blocks and attaches the agent's bearer
@@ -76,88 +75,13 @@ async function handleSessionStart(input, client, deps) {
     const agentGate = deps.agentGate ?? argus_1.ensureAgentIdentity;
     await agentGate(client, { projectUrl: (0, argus_1.resolveConfig)().projectUrl, harness: "claude-code" });
     // Record the user→agent delegation so the audit trail captures that
-    // this user authorized this agent for this session. Best-effort:
-    // requires both principals to be populated, and any failure is logged
-    // and swallowed (fail-open — delegation tracking is for audit, not
-    // enforcement).
-    await recordUserDelegatesAgent(client);
-    if (!decision.proceed) {
-        return { decision: "block", reason: decision.reason };
-    }
-    if (decision.mode !== "disabled") {
-        return {};
-    }
-    const resolved = (0, argus_1.resolveConfig)();
-    if (resolved.auditOnly) {
-        client.logger.info("config.audit_only", {
-            message: "Audit-only mode enabled. Auth and permission checks are disabled.",
-        });
-        return {};
-    }
-    if (!resolved.projectUrl) {
-        client.logger.warn("config.not_configured", {
-            message: "Ory plugin is not configured. Auth and permission checks are disabled. " +
-                "Run 'npx ory-claude configure' to connect to an Ory project.",
-        });
-        return {};
-    }
-    // Try session token first, then OAuth2 token
-    const sessionToken = process.env.ORY_SESSION_TOKEN;
-    const oauth2Token = process.env.ORY_OAUTH2_TOKEN;
-    if (sessionToken) {
-        await verifySessionToken(sessionToken, client);
-        return {};
-    }
-    if (oauth2Token) {
-        await verifyOAuth2Token(oauth2Token, client);
-        return {};
-    }
-    client.logger.warn("session.no_credentials", {
-        message: "Neither ORY_SESSION_TOKEN nor ORY_OAUTH2_TOKEN is set. " +
-            "Skipping authentication.",
-    });
+    // this user authorized this agent for this session. Best-effort and
+    // written at most once per install: requires both principals to be
+    // populated, and any failure is logged and swallowed (fail-open —
+    // delegation tracking is for audit, not enforcement).
+    await (0, argus_1.writeUserDelegatesAgent)(client);
     return {};
 }
-async function verifySessionToken(token, client) {
-    try {
-        const session = await client.verifySession(token);
-        if (!session.active) {
-            client.logger.warn("session.inactive", {
-                message: "Ory session is not active. Re-authenticate to enable auth checks.",
-            });
-        }
-    }
-    catch (err) {
-        const oryErr = err;
-        client.logger.warn("session.verify_failed", {
-            code: oryErr.code,
-            message: oryErr.message,
-        });
-    }
-}
-async function verifyOAuth2Token(token, client) {
-    try {
-        const tokenInfo = await client.introspectToken(token);
-        if (!tokenInfo.active) {
-            client.logger.warn("oauth2.token_inactive", {
-                message: "Ory OAuth2 token is not active. Obtain a new token to enable auth checks.",
-            });
-            return;
-        }
-        client.logger.info("oauth2.session_authenticated", {
-            clientId: tokenInfo.clientId,
-            subject: tokenInfo.subject,
-            scope: tokenInfo.scope,
-        });
-    }
-    catch (err) {
-        const oryErr = err;
-        client.logger.warn("oauth2.introspect_failed", {
-            code: oryErr.code,
-            message: oryErr.message,
-        });
-    }
-}
 // ─── PreToolUse ─────────────────────────────────────────────────────
 async function handlePreToolUse(input, client, deps = {}) {
     const toolName = input.tool_name ?? "unknown";
@@ -478,45 +402,11 @@ function permissionRequestFallback(reason) {
 function resolveNamespace() {
     return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
 }
-/**
- * Write the user→agent delegation tuple. Idempotent and fail-open:
- * requires both principal subjects to be populated; any error (including
- * unconfigured projectUrl, which manifests as a network_error) is logged
- * and swallowed. The actual permission enforcement is unchanged — this
- * tuple is purely audit-trail data.
- */
-async function recordUserDelegatesAgent(client) {
-    const user = client.userPrincipal.subject;
-    const agent = client.agentPrincipal.subject;
-    if (!user || !agent) {
-        client.logger.debug("delegation.skip", {
-            reason: "missing principal",
-            hasUser: !!user,
-            hasAgent: !!agent,
-        });
-        return;
-    }
-    try {
-        await client.createRelationship({
-            namespace: resolveNamespace(),
-            object: `agent:${agent}`,
-            relation: "delegate",
-            subjectId: `user:${user}`,
-        }, { spanAttributes: { delegation: "user-to-agent" } });
-    }
-    catch (err) {
-        const oryErr = err;
-        client.logger.warn("delegation.user_to_agent.failed", {
-            code: oryErr.code,
-            message: oryErr.message,
-        });
-    }
-}
 /**
  * Register an OAuth2 identity for a sub-agent and write the
- * `agent → subagent` delegation tuple. Fail-open and idempotent:
- * `createRelationship` absorbs 409s, so multiple call paths
- * (SubagentStart event + Task-tool fallback) won't duplicate state.
+ * `agent → subagent` delegation tuple. Fail-open and written at most once
+ * per install, so the multiple call paths (SubagentStart event + Task-tool
+ * fallback) won't duplicate state.
  */
 async function registerSubAgent(subAgentType, client, deps) {
     const subAgentGate = deps.subAgentGate ?? argus_1.ensureSubAgentIdentity;
@@ -537,30 +427,7 @@ async function registerSubAgent(subAgentType, client, deps) {
     }
     if (identity.kind !== "dynamic" || !identity.subject)
         return;
-    const agent = client.agentPrincipal.subject;
-    if (!agent) {
-        client.logger.debug("delegation.skip", {
-            reason: "agent principal not populated",
-            subAgentType,
-        });
-        return;
-    }
-    try {
-        await client.createRelationship({
-            namespace: resolveNamespace(),
-            object: `subagent:${identity.subject}`,
-            relation: "delegate",
-            subjectId: `agent:${agent}`,
-        }, { spanAttributes: { delegation: "agent-to-subagent", subAgentType } });
-    }
-    catch (err) {
-        const oryErr = err;
-        client.logger.warn("delegation.agent_to_subagent.failed", {
-            subAgentType,
-            code: oryErr.code,
-            message: oryErr.message,
-        });
-    }
+    await (0, argus_1.writeAgentDelegatesSubagent)(client, identity.subject, subAgentType);
 }
 /**
  * Legacy fallback for older Claude Code versions that don't fire

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/claude-code",
-  "version": "0.13.8",
+  "version": "0.14.0",
   "description": "Ory plugin for Claude Code: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://github.com/ory/claude-plugins/tree/master/plugins/ory-agent-plugin",
@@ -76,7 +76,7 @@
   ],
   "dependencies": {
     "reo-census": "^1.2.8",
-    "@ory/argus": "0.13.8"
+    "@ory/argus": "0.14.0"
   },
   "engines": {
     "node": ">=22"