@ory/claude-code 0.9.1 → 0.11.0

package/README.md

@@ -116,7 +116,7 @@ Bundled and registered automatically. Exposes the Ory CLI and the Ory Network RE
 /ory-agent-plugin:temporal-up   # start a local Temporal dev server (for ory-temporal-worker)
 ```
 
-`local-up` runs a complete Ory on your laptop: the Ory APIs (Identities, OAuth2, Permissions) at `http://localhost:4000`, a login UI on `:3000`, and Jaeger (the trace viewer) on `:16686`. A test user identity is seeded and its credentials are printed for you. Use it to:
+`local-up` runs a complete Ory on your laptop: the Ory APIs (Identities, OAuth2, Permissions) at `http://localhost:4000`, a login UI on `:4455` (not :3000, to avoid Next.js port conflicts), and Jaeger (the trace viewer) on `:16686`. A test user identity is seeded and its credentials are printed for you. Use it to:
 
 - **Learn Ory hands-on** without signing up for a hosted project.
 - **Prototype** flows (login, social, MFA, recovery, permissions) against a real Ory backend.
@@ -263,7 +263,7 @@ Highlights:
 
 ## Troubleshooting
 
-- **`/ory-agent-plugin:local-up` fails.** Make sure Docker is running and ports `3000`, `4000`, `4100`, and `16686` are free.
+- **`/ory-agent-plugin:local-up` fails.** Make sure Docker is running and ports `4455` (login UI), `4000`, `4100`, and `16686` are free.
 - **PKCE login loops.** Clear persisted state with `npx -y -p @ory/claude-code ory-claude agent unregister` and retry.
 - **`npx` fetches an old version.** Force a fresh fetch: `npx -y -p @ory/claude-code@latest ory-claude …`.
 - **Hooks pinned to an old plugin version.** After a plugin upgrade, run `/plugin marketplace update ory` inside Claude Code (or re-run the npx installer) so the hook commands and MCP server pick up the new release.

package/dist/handlers.js

@@ -167,18 +167,19 @@ async function handlePreToolUse(input, client, deps = {}) {
         toolInput: input.tool_input,
     });
     const inputSummary = (0, argus_1.summarizeToolInput)(toolName, input.tool_input);
-    // If the agent is invoking a sub-agent (Claude Code's "Task"/"Agent"
-    // tool with a `subagent_type`), resolve a distinct OAuth2 identity for
-    // that sub-agent via DCR and record the agent→sub-agent delegation
-    // tuple. Best-effort — failures here never block the actual tool call.
-    await maybeRegisterSubAgent(toolName, input.tool_input, client, deps);
-    // In audit-only mode, log the invocation but skip permission checks
+    // In audit-only mode, log the invocation but skip permission checks —
+    // and skip sub-agent DCR/delegation writes too (Ory is disabled entirely).
     if ((0, argus_1.resolveConfig)().auditOnly) {
         client.tracer.record("tool.invoke", "ok", {
             attributes: { toolName, ...inputSummary },
         });
         return {};
     }
+    // If the agent is invoking a sub-agent (Claude Code's "Task"/"Agent"
+    // tool with a `subagent_type`), resolve a distinct OAuth2 identity for
+    // that sub-agent via DCR and record the agent→sub-agent delegation
+    // tuple. Best-effort — failures here never block the actual tool call.
+    await maybeRegisterSubAgent(toolName, input.tool_input, client, deps);
     const subject = (0, argus_1.resolveUserSubject)(client, `session:${input.session_id}`);
     const subjectId = (0, argus_1.subjectLabel)(subject);
     const mcpTool = (0, argus_1.parseClaudeCodeMcpTool)(toolName);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/claude-code",
-  "version": "0.9.1",
+  "version": "0.11.0",
   "description": "Ory plugin for Claude Code: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://github.com/ory/claude-plugins/tree/master/plugins/ory-agent-plugin",
@@ -75,7 +75,7 @@
     "!dist/**/*.tsbuildinfo"
   ],
   "dependencies": {
-    "@ory/argus": "0.9.1"
+    "@ory/argus": "0.11.0"
   },
   "engines": {
     "node": ">=22"