@ory/claude-code 0.14.0 → 1.0.1

package/dist/handlers.js

@@ -2,54 +2,58 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleHookEvent = handleHookEvent;
 const argus_1 = require("@ory/argus");
-/**
- * Route a Claude Code hook event to the appropriate Ory integration.
- */
-async function handleHookEvent(input, client, deps = {}) {
+const HARNESS = "claude-code";
+function handleHookEvent(input, client, deps = {}) {
     const event = input.hook_event_name;
     client.logger.debug("hook.received", {
         event,
         sessionId: input.session_id,
         toolName: input.tool_name,
     });
-    // Set trace context so all spans within this hook invocation correlate
-    client.tracer.setContext({
-        traceId: (0, argus_1.deriveTraceId)(input.session_id),
-        sessionId: input.session_id,
-    });
-    try {
-        switch (event) {
-            case "SessionStart":
-                return await handleSessionStart(input, client, deps);
-            case "PreToolUse":
-                return await handlePreToolUse(input, client, deps);
-            case "PostToolUse":
-                return await handlePostToolUse(input, client);
-            case "PostToolUseFailure":
-                return await handlePostToolUseFailure(input, client);
-            case "PermissionRequest":
-                return await handlePermissionRequest(input, client);
-            case "UserPromptSubmit":
-                return await handleUserPromptSubmit(input, client);
-            case "SubagentStart":
-                return await handleSubagentStart(input, client, deps);
-            case "SubagentStop":
-                return await handleSubagentStop(input, client);
-            case "SessionEnd":
-                return await handleSessionEnd(input, client);
-            default:
-                client.logger.debug("hook.passthrough", { event });
-                client.tracer.record("hook.passthrough", "skipped", {
-                    attributes: { event },
-                });
-                return { continue: true };
+    return (0, argus_1.withHookContext)(client, { sessionId: input.session_id }, async () => {
+        const activeType = input.agent_type ?? input.subagent_type;
+        let runtimeCredential;
+        if (event !== "SubagentStart" && input.agent_id && activeType && (0, argus_1.isSecurityConnected)()) {
+            const identity = await (deps.subAgentGate ?? argus_1.ensureSubAgentIdentity)(client, {
+                harness: HARNESS,
+                sessionId: input.session_id,
+                subAgentType: activeType,
+                perSpawnId: input.agent_id,
+                allowEnrollment: false,
+                emitActivity: false,
+            });
+            if (identity.runtimeCredential) {
+                runtimeCredential = identity.runtimeCredential;
+            }
         }
-    }
-    finally {
-        client.tracer.clearContext();
-    }
+        return (0, argus_1.withHookContext)(client, { runtimeCredential }, async () => {
+            switch (event) {
+                case "SessionStart":
+                    return handleSessionStart(input, client, deps);
+                case "PreToolUse":
+                    return handlePreToolUse(input, client, deps);
+                case "PostToolUse":
+                    return handlePostToolUse(input, client);
+                case "PostToolUseFailure":
+                    return handlePostToolUseFailure(input, client);
+                case "PermissionRequest":
+                    return handlePermissionRequest(input, client);
+                case "UserPromptSubmit":
+                    return handleUserPromptSubmit(input, client);
+                case "SubagentStart":
+                    return handleSubagentStart(input, client, deps);
+                case "SubagentStop":
+                    return handleSubagentStop(input, client);
+                case "SessionEnd":
+                    return handleSessionEnd(input, client);
+                default:
+                    client.logger.debug("hook.passthrough", { event });
+                    client.logger.activity("hook.passthrough", "skipped", { attributes: { event } });
+                    return { continue: true };
+            }
+        });
+    });
 }
-// ─── SessionStart ───────────────────────────────────────────────────
 async function handleSessionStart(input, client, deps) {
     client.logger.info("lifecycle.session_start", {
         sessionId: input.session_id,
@@ -57,148 +61,49 @@ async function handleSessionStart(input, client, deps) {
         source: input.source,
         cwd: input.cwd,
     });
-    client.tracer.record("session.start", "ok", {
-        attributes: { model: input.model, source: input.source },
-    });
-    // Run the user login (interactive PKCE on first session, refresh
-    // when needed). This runs every session and never blocks —
-    // enforcement is governed solely by permissionMode at tool-call time.
-    const userGate = deps.userLogin ?? argus_1.ensureUserAuthenticated;
-    await userGate(client, {
+    await (0, argus_1.sessionStart)(client, {
+        harness: HARNESS,
+        sessionId: input.session_id,
         binName: "ory-claude",
-        harness: "claude-code",
+        userLogin: deps.userLogin,
+        agentGate: deps.agentGate,
+        activityAttributes: { model: input.model, source: input.source },
     });
-    // Resolve the agent identity (machine credentials) regardless of how
-    // user auth went — it never blocks and attaches the agent's bearer
-    // token to outgoing Ory API calls so the audit trail records who
-    // acted on the user's behalf.
-    const agentGate = deps.agentGate ?? argus_1.ensureAgentIdentity;
-    await agentGate(client, { projectUrl: (0, argus_1.resolveConfig)().projectUrl, harness: "claude-code" });
-    // Record the user→agent delegation so the audit trail captures that
-    // this user authorized this agent for this session. Best-effort and
-    // written at most once per install: requires both principals to be
-    // populated, and any failure is logged and swallowed (fail-open —
-    // delegation tracking is for audit, not enforcement).
-    await (0, argus_1.writeUserDelegatesAgent)(client);
     return {};
 }
-// ─── PreToolUse ─────────────────────────────────────────────────────
-async function handlePreToolUse(input, client, deps = {}) {
+async function handlePreToolUse(input, client, deps) {
     const toolName = input.tool_name ?? "unknown";
     client.logger.info("lifecycle.pre_tool_use", {
         sessionId: input.session_id,
         toolName,
         toolInput: input.tool_input,
     });
-    const inputSummary = (0, argus_1.summarizeToolInput)(toolName, input.tool_input);
-    // In audit-only mode, log the invocation but skip permission checks —
-    // and skip sub-agent DCR/delegation writes too (Ory is disabled entirely).
-    if ((0, argus_1.resolveConfig)().auditOnly) {
-        client.tracer.record("tool.invoke", "ok", {
-            attributes: { toolName, ...inputSummary },
-        });
-        return {};
-    }
-    // If the agent is invoking a sub-agent (Claude Code's "Task"/"Agent"
-    // tool with a `subagent_type`), resolve a distinct OAuth2 identity for
-    // that sub-agent via DCR and record the agent→sub-agent delegation
-    // tuple. Best-effort — failures here never block the actual tool call.
-    await maybeRegisterSubAgent(toolName, input.tool_input, client, deps);
-    const subject = (0, argus_1.resolveUserSubject)(client, `session:${input.session_id}`);
-    const subjectId = (0, argus_1.subjectLabel)(subject);
-    const mcpTool = (0, argus_1.parseClaudeCodeMcpTool)(toolName);
-    try {
-        if (mcpTool) {
-            const mcpResult = await (0, argus_1.checkMcpPermission)(client, mcpTool, {
-                subject,
-                spanAttributes: { toolName },
-            });
-            const mcpAttrs = {
-                toolName,
-                mcpServer: mcpTool.serverName,
-                mcpTool: mcpTool.toolName,
-                ...inputSummary,
-            };
-            const decision = (0, argus_1.applyPermissionMode)(client, mcpResult.allowed, {
-                object: mcpTool.serverName,
-                relation: "use",
-                subjectId,
-                ...("subjectSet" in subject ? { subjectSet: subject.subjectSet } : {}),
-                spanAttributes: mcpAttrs,
-            });
-            const decisionAttrs = decision.spanAttributes;
-            if (decision.kind === "allow") {
-                client.tracer.record("tool.invoke", "ok", {
-                    attributes: { ...mcpAttrs, ...decisionAttrs },
-                });
-                return {};
-            }
-            if (decision.kind === "observe") {
-                client.tracer.record("tool.block", "denied", {
-                    attributes: { ...mcpAttrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
-                });
-                client.tracer.record("tool.invoke", "ok", {
-                    attributes: { ...mcpAttrs, ...decisionAttrs, allowed: false, observed: true },
-                });
-                return {};
-            }
-            client.tracer.record("tool.block", "denied", {
-                attributes: { ...mcpAttrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(true) },
-            });
-            return {
-                decision: "block",
-                reason: (0, argus_1.formatDenialMessage)({ tool: toolName, subjectId, mcp: mcpTool }),
-            };
-        }
-        const namespace = resolveNamespace();
-        const outcome = await (0, argus_1.gateToolCall)(client, {
-            harness: "claude-code",
-            toolName,
-            check: { namespace, object: toolName, relation: "use", ...subject },
-            spanAttributes: { toolName },
-        });
-        // Interactive tools (AskUserQuestion, ExitPlanMode, TodoWrite, …)
-        // surface UI to the user and aren't external-system tool executions.
-        // gateToolCall has already recorded the `user.interaction` audit span;
-        // we pass through with no `tool.invoke`/`tool.block` and let the
-        // harness deliver the prompt to the user.
-        if (outcome.kind === "interactive") {
-            return {};
-        }
-        const decision = outcome;
-        if (decision.kind === "fail_open") {
-            return handlePermissionError(decision.error, toolName, client);
-        }
-        const attrs = { toolName, ...inputSummary };
-        const decisionAttrs = decision.spanAttributes;
-        if (decision.kind === "allow") {
-            client.tracer.record("tool.invoke", "ok", {
-                attributes: { ...attrs, ...decisionAttrs, allowed: true },
-            });
-            return {};
-        }
-        if (decision.kind === "observe") {
-            client.tracer.record("tool.block", "denied", {
-                attributes: { ...attrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
-            });
-            client.tracer.record("tool.invoke", "ok", {
-                attributes: { ...attrs, ...decisionAttrs, allowed: false, observed: true },
-            });
-            return {};
-        }
-        client.tracer.record("tool.block", "denied", {
-            attributes: { ...attrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(true) },
-        });
-        return {
-            decision: "block",
-            reason: (0, argus_1.formatDenialMessage)({ tool: toolName, subjectId, namespace }),
-        };
-    }
-    catch (err) {
-        return handlePermissionError(err, toolName, client);
-    }
+    const result = await (0, argus_1.gate)(client, {
+        harness: HARNESS,
+        toolName,
+        toolArgs: input.tool_input,
+        subjectFallback: `session:${input.session_id}`,
+        mcpTool: (0, argus_1.parseClaudeCodeMcpTool)(toolName) ?? undefined,
+        principals: actingSubagentPrincipals(input, client),
+    });
+    return result.blocked
+        ? { decision: "block", reason: result.denialMessage }
+        : {};
+}
+function actingSubagentPrincipals(input, client) {
+    const type = input.agent_type;
+    if (!input.agent_id || !type)
+        return undefined;
+    const subject = client.agentPrincipal.subject;
+    if (!subject)
+        return undefined;
+    return {
+        subAgentClientId: subject,
+        subAgentType: type,
+        perSpawnId: input.agent_id,
+        sessionId: input.session_id,
+    };
 }
-// ─── PostToolUse ────────────────────────────────────────────────────
 async function handlePostToolUse(input, client) {
     const toolName = input.tool_name ?? "unknown";
     client.logger.info("lifecycle.post_tool_use", {
@@ -206,17 +111,14 @@ async function handlePostToolUse(input, client) {
         toolName,
         toolResponse: input.tool_response,
     });
-    client.tracer.record("tool.complete", "ok", {
-        attributes: {
-            toolName,
-            toolUseId: input.tool_use_id,
-            ...(0, argus_1.summarizeToolInput)(toolName, input.tool_input),
-            ...(0, argus_1.summarizeToolOutput)(toolName, input.tool_response),
-        },
+    (0, argus_1.complete)(client, {
+        toolName,
+        input: input.tool_input,
+        output: input.tool_response,
+        extraActivityAttributes: { toolUseId: input.tool_use_id },
     });
     return {};
 }
-// ─── PostToolUseFailure ─────────────────────────────────────────────
 async function handlePostToolUseFailure(input, client) {
     const toolName = input.tool_name ?? "unknown";
     client.logger.info("lifecycle.post_tool_use_failure", {
@@ -224,249 +126,121 @@ async function handlePostToolUseFailure(input, client) {
         toolName,
         toolUseId: input.tool_use_id,
     });
-    client.tracer.record("tool.fail", "error", {
-        attributes: {
-            toolName,
-            toolUseId: input.tool_use_id,
-            toolError: typeof input.tool_error === "string"
-                ? input.tool_error.slice(0, 500)
-                : input.tool_error
-                    ? "[object]"
-                    : undefined,
-            ...(0, argus_1.summarizeToolInput)(toolName, input.tool_input),
-        },
+    (0, argus_1.fail)(client, {
+        toolName,
+        input: input.tool_input,
+        error: input.tool_error,
+        extraActivityAttributes: { toolUseId: input.tool_use_id },
     });
     return {};
 }
-// ─── UserPromptSubmit ──────────────────────────────────────────────
+async function handlePermissionRequest(input, client) {
+    const toolName = input.tool_name ?? "unknown";
+    client.logger.info("lifecycle.permission_request", {
+        sessionId: input.session_id,
+        toolName,
+        toolInput: input.tool_input,
+    });
+    const mcpTool = (0, argus_1.parseClaudeCodeMcpTool)(toolName);
+    const result = await (0, argus_1.decideTool)(client, {
+        harness: HARNESS,
+        toolName,
+        toolArgs: input.tool_input,
+        subjectFallback: `session:${input.session_id}`,
+        mcpTool: mcpTool ?? undefined,
+    });
+    if (result.kind === "not_connected") {
+        return permissionRequestFallback("Ory Agent Security not connected — deferring to user");
+    }
+    if (result.kind === "interactive") {
+        return permissionRequestFallback("Interactive tool — deferring to user");
+    }
+    if (result.kind === "fail_open") {
+        return permissionRequestFallback(permissionFailureReason(result.decision));
+    }
+    if (result.kind === "deny") {
+        return permissionRequestDecision("deny", result.denialMessage ?? "Ory permission denied");
+    }
+    return permissionRequestDecision("allow", result.kind === "observe"
+        ? "Ory observe mode — denied by policy but allowed through"
+        : mcpTool
+            ? "Ory MCP server permission granted"
+            : "Ory permission granted");
+}
+function permissionRequestDecision(behavior, reason) {
+    return {
+        hookSpecificOutput: {
+            hookEventName: "PermissionRequest",
+            decision: { behavior },
+            message: reason,
+        },
+    };
+}
+function permissionRequestFallback(reason) {
+    return {
+        hookSpecificOutput: { hookEventName: "PermissionRequest", message: reason },
+    };
+}
+function permissionFailureReason(decision) {
+    if (decision.kind !== "fail_open")
+        return "Ory permission check failed";
+    const { code, message } = decision.error;
+    return code === "network_error" || code === "rate_limited"
+        ? `Ory unavailable (${code}), falling back to user prompt`
+        : `Ory permission check failed: ${message}`;
+}
 async function handleUserPromptSubmit(input, client) {
     client.logger.info("lifecycle.user_prompt_submit", {
         sessionId: input.session_id,
         promptLen: input.prompt?.length,
     });
-    client.tracer.record("user.prompt", "ok", {
+    client.logger.activity("user.prompt", "ok", {
         attributes: { promptLen: input.prompt?.length },
     });
     return {};
 }
-// ─── SubagentStart ─────────────────────────────────────────────────
-//
-// Dedicated sub-agent invocation event. Replaces the legacy path of
-// sniffing the `Task`/`Agent` tool name in PreToolUse — that still runs
-// as a fallback for older Claude Code versions, but registerSubAgent
-// is idempotent so duplicate registration is harmless.
 async function handleSubagentStart(input, client, deps) {
     const subAgentType = input.subagent_type ?? input.agent_type;
-    const agentId = input.agent_id;
     client.logger.info("lifecycle.subagent_start", {
         sessionId: input.session_id,
         subAgentType,
-        agentId,
+        agentId: input.agent_id,
     });
-    client.tracer.record("subagent.start", "ok", {
-        attributes: { subAgentType, agentId },
+    client.logger.activity("subagent.start", "ok", {
+        attributes: { subAgentType, agentId: input.agent_id },
     });
-    if (subAgentType) {
-        await registerSubAgent(subAgentType, client, deps);
-    }
-    else {
-        client.logger.debug("subagent_start.no_type", {
-            message: "SubagentStart event without subagent_type — skipping DCR.",
+    if (subAgentType && input.agent_id) {
+        await (0, argus_1.registerSubagent)(client, {
+            harness: HARNESS,
+            sessionId: input.session_id,
+            subAgentType,
+            perSpawnId: input.agent_id,
+            subAgentGate: deps.subAgentGate,
         });
     }
     return {};
 }
-// ─── SubagentStop ──────────────────────────────────────────────────
 async function handleSubagentStop(input, client) {
+    const subAgentType = input.subagent_type ?? input.agent_type;
     client.logger.info("lifecycle.subagent_stop", {
         sessionId: input.session_id,
-        subAgentType: input.subagent_type ?? input.agent_type,
+        subAgentType,
         agentId: input.agent_id,
     });
-    client.tracer.record("subagent.stop", "ok", {
+    client.logger.activity("subagent.stop", "ok", {
         attributes: {
-            subAgentType: input.subagent_type ?? input.agent_type,
+            subAgentType,
             agentId: input.agent_id,
             responseLen: input.subagent_response?.length,
         },
     });
     return {};
 }
-// ─── SessionEnd ────────────────────────────────────────────────────
 async function handleSessionEnd(input, client) {
     client.logger.info("lifecycle.session_end", {
         sessionId: input.session_id,
         reason: input.reason,
     });
-    client.tracer.record("session.end", "ok", {
-        attributes: { reason: input.reason },
-    });
-    return {};
-}
-// ─── PermissionRequest ──────────────────────────────────────────────
-async function handlePermissionRequest(input, client) {
-    const toolName = input.tool_name ?? "unknown";
-    client.logger.info("lifecycle.permission_request", {
-        sessionId: input.session_id,
-        toolName,
-        toolInput: input.tool_input,
-    });
-    // Audit-only mode: omit `decision` so Claude falls through to its normal
-    // user-permission prompt.
-    if ((0, argus_1.resolveConfig)().auditOnly) {
-        return permissionRequestFallback("Audit-only mode — deferring to user");
-    }
-    // Interactive tools: the harness is about to surface UI to the user
-    // (AskUserQuestion, ExitPlanMode, TodoWrite, …). Trace and fall through
-    // — Ory shouldn't pre-answer a prompt that's meant for the human.
-    if ((0, argus_1.isInteractiveTool)("claude-code", toolName)) {
-        client.tracer.record("user.interaction", "ok", {
-            attributes: { harness: "claude-code", toolName, kind: "permission-request" },
-        });
-        return permissionRequestFallback("Interactive tool — deferring to user");
-    }
-    const subject = (0, argus_1.resolveUserSubject)(client, `session:${input.session_id}`);
-    const subjectId = (0, argus_1.subjectLabel)(subject);
-    const mcpTool = (0, argus_1.parseClaudeCodeMcpTool)(toolName);
-    try {
-        if (mcpTool) {
-            const mcpResult = await (0, argus_1.checkMcpPermission)(client, mcpTool, {
-                subject,
-                spanAttributes: { toolName },
-            });
-            const decision = (0, argus_1.applyPermissionMode)(client, mcpResult.allowed, {
-                object: mcpTool.serverName,
-                relation: "use",
-                subjectId,
-                ...("subjectSet" in subject ? { subjectSet: subject.subjectSet } : {}),
-                spanAttributes: { toolName, mcpServer: mcpTool.serverName, mcpTool: mcpTool.toolName },
-            });
-            if (decision.kind === "deny") {
-                return permissionRequestDecision("deny", (0, argus_1.formatDenialMessage)({ tool: toolName, subjectId, mcp: mcpTool }));
-            }
-            return permissionRequestDecision("allow", decision.kind === "observe"
-                ? "Ory observe mode — denied by policy but allowed through"
-                : "Ory MCP server permission granted");
-        }
-        const namespace = resolveNamespace();
-        const outcome = await (0, argus_1.gateToolCall)(client, {
-            harness: "claude-code",
-            toolName,
-            check: { namespace, object: toolName, relation: "use", ...subject },
-            spanAttributes: { toolName },
-        });
-        if (outcome.kind === "interactive") {
-            return permissionRequestFallback("Interactive tool — deferring to user");
-        }
-        const decision = outcome;
-        if (decision.kind === "fail_open") {
-            const code = decision.error.code;
-            const fallbackReason = code === "network_error" || code === "rate_limited"
-                ? `Ory unavailable (${code}), falling back to user prompt`
-                : `Ory permission check failed: ${decision.error.message}`;
-            return permissionRequestFallback(fallbackReason);
-        }
-        if (decision.kind === "deny") {
-            return permissionRequestDecision("deny", (0, argus_1.formatDenialMessage)({ tool: toolName, subjectId, namespace }));
-        }
-        return permissionRequestDecision("allow", decision.kind === "observe"
-            ? "Ory observe mode — denied by policy but allowed through"
-            : "Ory permission granted");
-    }
-    catch (err) {
-        const oryErr = err;
-        const fallbackReason = oryErr.code === "network_error" || oryErr.code === "rate_limited"
-            ? `Ory unavailable (${oryErr.code}), falling back to user prompt`
-            : `Ory permission check failed: ${oryErr.message}`;
-        return permissionRequestFallback(fallbackReason);
-    }
-}
-function permissionRequestDecision(behavior, reason) {
-    return {
-        hookSpecificOutput: {
-            hookEventName: "PermissionRequest",
-            decision: { behavior },
-            message: reason,
-        },
-    };
-}
-function permissionRequestFallback(reason) {
-    return {
-        hookSpecificOutput: {
-            hookEventName: "PermissionRequest",
-            message: reason,
-        },
-    };
-}
-// ─── Helpers ────────────────────────────────────────────────────────
-function resolveNamespace() {
-    return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
-}
-/**
- * Register an OAuth2 identity for a sub-agent and write the
- * `agent → subagent` delegation tuple. Fail-open and written at most once
- * per install, so the multiple call paths (SubagentStart event + Task-tool
- * fallback) won't duplicate state.
- */
-async function registerSubAgent(subAgentType, client, deps) {
-    const subAgentGate = deps.subAgentGate ?? argus_1.ensureSubAgentIdentity;
-    let identity;
-    try {
-        identity = await subAgentGate(client, {
-            subAgentType,
-            projectUrl: (0, argus_1.resolveConfig)().projectUrl,
-            harness: "claude-code",
-        });
-    }
-    catch (err) {
-        client.logger.warn("subagent.identity.failed", {
-            subAgentType,
-            message: err instanceof Error ? err.message : String(err),
-        });
-        return;
-    }
-    if (identity.kind !== "dynamic" || !identity.subject)
-        return;
-    await (0, argus_1.writeAgentDelegatesSubagent)(client, identity.subject, subAgentType);
-}
-/**
- * Legacy fallback for older Claude Code versions that don't fire
- * `SubagentStart`: the sub-agent invocation appears as a `Task`/`Agent`
- * tool call in PreToolUse with a `subagent_type` field on tool_input.
- * `SubagentStart` is the preferred path; this is a no-op when both fire.
- */
-async function maybeRegisterSubAgent(toolName, toolInput, client, deps) {
-    if (toolName !== "Task" && toolName !== "Agent")
-        return;
-    const subAgentType = typeof toolInput === "object"
-        && toolInput !== null
-        && typeof toolInput.subagent_type === "string"
-        ? toolInput.subagent_type
-        : undefined;
-    if (!subAgentType)
-        return;
-    await registerSubAgent(subAgentType, client, deps);
-}
-function handlePermissionError(oryErr, toolName, client) {
-    if (oryErr.code === "network_error") {
-        client.logger.warn("permission.network_error", {
-            toolName,
-            message: "Ory unreachable, failing open",
-        });
-        return {};
-    }
-    if (oryErr.code === "rate_limited") {
-        client.logger.warn("permission.rate_limited", {
-            toolName,
-            message: "Ory rate limited, failing open",
-        });
-        return {};
-    }
-    // For other errors, also fail open but log prominently
-    client.logger.error("permission.check.error", {
-        toolName,
-        code: oryErr.code,
-        message: oryErr.message,
-    });
+    client.logger.activity("session.end", "ok", { attributes: { reason: input.reason } });
     return {};
 }