@ory/claude-code 0.8.1 → 0.8.2

package/dist/handlers.js

@@ -226,7 +226,21 @@ async function handlePreToolUse(input, client, deps = {}) {
             };
         }
         const namespace = resolveNamespace();
-        const decision = await (0, argus_1.checkAndDecide)(client, { namespace, object: toolName, relation: "use", ...subject }, { spanAttributes: { toolName } });
+        const outcome = await (0, argus_1.gateToolCall)(client, {
+            harness: "claude-code",
+            toolName,
+            check: { namespace, object: toolName, relation: "use", ...subject },
+            spanAttributes: { toolName },
+        });
+        // Interactive tools (AskUserQuestion, ExitPlanMode, TodoWrite, …)
+        // surface UI to the user and aren't external-system tool executions.
+        // gateToolCall has already recorded the `user.interaction` audit span;
+        // we pass through with no `tool.invoke`/`tool.block` and let the
+        // harness deliver the prompt to the user.
+        if (outcome.kind === "interactive") {
+            return {};
+        }
+        const decision = outcome;
         if (decision.kind === "fail_open") {
             return handlePermissionError(decision.error, toolName, client);
         }
@@ -377,6 +391,15 @@ async function handlePermissionRequest(input, client) {
     if ((0, argus_1.resolveConfig)().auditOnly) {
         return permissionRequestFallback("Audit-only mode — deferring to user");
     }
+    // Interactive tools: the harness is about to surface UI to the user
+    // (AskUserQuestion, ExitPlanMode, TodoWrite, …). Trace and fall through
+    // — Ory shouldn't pre-answer a prompt that's meant for the human.
+    if ((0, argus_1.isInteractiveTool)("claude-code", toolName)) {
+        client.tracer.record("user.interaction", "ok", {
+            attributes: { harness: "claude-code", toolName, kind: "permission-request" },
+        });
+        return permissionRequestFallback("Interactive tool — deferring to user");
+    }
     const subject = (0, argus_1.resolveUserSubject)(client, `session:${input.session_id}`);
     const subjectId = (0, argus_1.subjectLabel)(subject);
     const mcpTool = (0, argus_1.parseClaudeCodeMcpTool)(toolName);
@@ -401,7 +424,16 @@ async function handlePermissionRequest(input, client) {
                 : "Ory MCP server permission granted");
         }
         const namespace = resolveNamespace();
-        const decision = await (0, argus_1.checkAndDecide)(client, { namespace, object: toolName, relation: "use", ...subject }, { spanAttributes: { toolName } });
+        const outcome = await (0, argus_1.gateToolCall)(client, {
+            harness: "claude-code",
+            toolName,
+            check: { namespace, object: toolName, relation: "use", ...subject },
+            spanAttributes: { toolName },
+        });
+        if (outcome.kind === "interactive") {
+            return permissionRequestFallback("Interactive tool — deferring to user");
+        }
+        const decision = outcome;
         if (decision.kind === "fail_open") {
             const code = decision.error.code;
             const fallbackReason = code === "network_error" || code === "rate_limited"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/claude-code",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "Ory plugin for Claude Code: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://github.com/ory/claude-plugins/tree/master/plugins/ory-agent-plugin",
@@ -75,7 +75,7 @@
     "!dist/**/*.tsbuildinfo"
   ],
   "dependencies": {
-    "@ory/argus": "0.8.1"
+    "@ory/argus": "0.8.2"
   },
   "engines": {
     "node": ">=22"