@ory/claude-code 1.9.1 → 1.10.0

package/README.md

@@ -12,9 +12,11 @@ One command installs two independent halves:
 ## What you'll need
 
 - [Claude Code](https://docs.anthropic.com/en/docs/claude-code), installed and signed in
+<!-- BEGIN GENERATED requirements -->
 - Node.js **22 or newer**
 - [Docker](https://docs.docker.com/get-docker/) — only if you want to run Ory locally
 - macOS or Linux (Windows works via WSL2)
+<!-- END GENERATED requirements -->
 
 ## Get started
 
@@ -105,6 +107,7 @@ Then a denied tool is actually blocked and Claude shows why.
 
 ## Connect to Ory Agent Security
 
+<!-- BEGIN GENERATED connect -->
 Copy the connection details from the [Ory Console](https://console.ory.sh) under **Agent Security**:
 
 | Value | Flag | Environment variable |
@@ -128,6 +131,7 @@ npx -y -p @ory/claude-code ory-claude configure \
 Sign-in runs at the start of every session and never blocks — a declined, skipped, or timed-out login simply leaves that session without a user identity.
 
 Settings are saved to `~/.config/ory-agent-plugins/config.json` and shared across all your Ory agent plugins; environment variables win when both are set. Running headless with an OAuth2 access token already? Set `ORY_USER_OAUTH2_TOKEN` and the browser step is skipped entirely.
+<!-- END GENERATED connect -->
 
 ## Commands
 
@@ -145,14 +149,16 @@ All prefixed with `npx -y -p @ory/claude-code`.
 
 ## Troubleshooting
 
-- **`local-up` fails** — make sure Docker is running and ports `4000`, `4100`, and `4455` are free.
+- **`local-up` fails** — <!-- BEGIN GENERATED local-stack-ports -->make sure Docker is running and ports `4000`, `4100`, and `4455` are free.<!-- END GENERATED local-stack-ports -->
 - **Browser sign-in loops** (after connecting) — confirm the reserved login client has all four documented loopback redirect URIs; `agent unregister` only clears legacy agent OAuth state.
 - **Running an older CLI than expected** — `npx -p @ory/claude-code` (no version pin) reuses a previously-downloaded copy instead of re-resolving to the latest. The install banner prints the running version; confirm it with `npx -y -p @ory/claude-code ory-claude version`. To force the current release, clear the cache and reinstall: `rm -rf ~/.npm/_npx` then `npx -y -p @ory/claude-code ory-claude install`. Pinning an exact version (`@ory/claude-code@<version>`) also bypasses the cached copy.
 - **Hooks stuck on an old version** — run `/plugin marketplace update ory` inside Claude Code, or re-run the installer.
 
 ## Learn more
 
+<!-- BEGIN GENERATED ory-links -->
 - [Ory documentation](https://www.ory.com/docs/) · [Ory Console](https://console.ory.sh) · [Ory Elements](https://github.com/ory/elements)
+<!-- END GENERATED ory-links -->
 - [Claude Code documentation](https://docs.anthropic.com/en/docs/claude-code)
 
 ## License

package/dist/cli/main.js

@@ -47,100 +47,25 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const path = __importStar(require("node:path"));
 const fs = __importStar(require("node:fs"));
 const argus_1 = require("@ory/argus");
+const cli_1 = require("@ory/argus/cli");
+const install_1 = require("@ory/argus/install");
 const setup_js_1 = require("./setup.js");
 const PACKAGE_ROOT = path.resolve(__dirname, "..", "..");
 /** Resolved per call: see the note on `persistentDir()` in ./setup.ts. */
 function persistentDir() {
     return (0, argus_1.getHarnessDataDir)("claude-code");
 }
-function main() {
-    const [command, ...args] = process.argv.slice(2);
-    // `--help` after a matched subcommand: print usage, do nothing else.
-    // Without this the switch below ignores the flag and `install --help`
-    // performs a real install (#221).
-    if ((0, argus_1.shouldPrintHelp)(command, args))
-        return help();
-    switch (command) {
-        case "install":
-            if (args.includes("--print")) {
-                (0, setup_js_1.printInstallPlan)(args);
-                break;
-            }
-            (0, argus_1.beginDeferNextSteps)();
-            (0, setup_js_1.install)(args);
-            (0, argus_1.runPostInstall)("ory-claude", "claude-code", args).then(() => process.exit(0), (err) => {
-                console.error(err.message ?? err);
-                process.exit(1);
-            });
-            break;
-        case "uninstall":
-            (0, setup_js_1.uninstall)(args);
-            (0, argus_1.clearCredentialsForUninstall)({
-                harness: "claude-code",
-                purge: args.includes("--purge"),
-            }).then(() => process.exit(0), (err) => {
-                console.error(err.message ?? err);
-                process.exit(1);
-            });
-            break;
-        case "configure":
-            (0, argus_1.runConfigureCommand)("ory-claude", args);
-            break;
-        case "agent":
-            (0, argus_1.runAgentCommand)("ory-claude", "claude-code", args).then((code) => process.exit(code), (err) => {
-                console.error(err.message ?? err);
-                process.exit(1);
-            });
-            break;
-        case "permissions":
-            (0, argus_1.runPermissionsCommand)("ory-claude", "claude-code", args).then((code) => process.exit(code), (err) => {
-                console.error(err.message ?? err);
-                process.exit(1);
-            });
-            break;
-        case "status":
-            status().then(() => process.exit(0), (err) => {
-                console.error(err.message ?? err);
-                process.exit(1);
-            });
-            break;
-        case "watch":
-            (0, argus_1.runWatchCommand)("ory-claude", "claude-code", args).then((code) => process.exit(code), (err) => { console.error(err.message ?? err); process.exit(1); });
-            break;
-        case "local":
-            (0, argus_1.runLocalCommand)("ory-claude", args).catch((err) => {
-                console.error(err.message ?? err);
-                process.exit(1);
-            });
-            break;
-        case "version":
-        case "--version":
-        case "-v":
-            process.exit((0, argus_1.runVersionCommand)("ory-claude", args, { packageRoot: PACKAGE_ROOT }));
-            break;
-        case "help":
-        case "--help":
-        case "-h":
-        case undefined:
-            help();
-            break;
-        default:
-            console.error(`Unknown command: ${command}`);
-            help();
-            process.exit(1);
-    }
-}
 async function status() {
-    await (0, argus_1.runStatusCommand)("ory-claude", "claude-code", {
+    await (0, cli_1.runStatusCommand)("ory-claude", "claude-code", {
         title: "Claude Code",
         printPluginSection: () => {
             // A wiped data dir leaves the harness pointing at a marketplace root
             // that no longer exists, and its plugin surface then fails with an error
             // that never mentions Ory. Say so here, with the repair (#206).
-            const dangling = (0, argus_1.findDanglingRegistration)("claude-code");
+            const dangling = (0, install_1.findDanglingRegistration)("claude-code");
             if (dangling) {
                 console.log("");
-                console.log(`  ! ${(0, argus_1.describeDanglingRegistration)(dangling)}`);
+                console.log(`  ! ${(0, install_1.describeDanglingRegistration)(dangling)}`);
                 console.log("");
             }
             console.log("Hooks & plugin:");
@@ -148,7 +73,7 @@ async function status() {
             // install time, so the wired code and this CLI's own version can
             // legitimately differ — report the runtime, not our own version. Run
             // `claude plugin list` for the `claude` CLI's view of registrations.
-            console.log(`  Runtime:     ${(0, argus_1.describeRuntimeHealth)((0, argus_1.checkRuntimeHealth)("claude-code"))}`);
+            console.log(`  Runtime:     ${(0, install_1.describeRuntimeHealth)((0, install_1.checkRuntimeHealth)("claude-code"))}`);
             // The data dir doubles as the default activity/debug-log home, so it exists
             // after any session regardless of install state — its mere presence does
             // NOT mean a plugin was assembled here. `isPluginAssembled` keys off the
@@ -190,4 +115,13 @@ Examples:
   npx -y -p @ory/claude-code ory-claude uninstall                              # Remove plugin
 `);
 }
-main();
+(0, cli_1.runHarnessCli)({
+    bin: "ory-claude",
+    harness: "claude-code",
+    packageRoot: PACKAGE_ROOT,
+    help,
+    install: setup_js_1.install,
+    printInstallPlan: setup_js_1.printInstallPlan,
+    uninstall: setup_js_1.uninstall,
+    status: () => status(),
+});

package/dist/cli/setup.d.ts

@@ -17,7 +17,7 @@
  * cannot. The public `ory/claude-plugins` mirror stays a valid install route
  * on its own terms (it ships a bootstrap keyed off `${CLAUDE_PLUGIN_ROOT}`).
  */
-import { type PreparedRuntime } from "@ory/argus";
+import { type PreparedRuntime } from "@ory/argus/install";
 /**
  * Assemble the Claude Code plugin directory in the persistent location and
  * return its path (the marketplace root).

package/dist/cli/setup.js

@@ -61,6 +61,8 @@ const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const claude_command_js_1 = require("./claude-command.js");
 const argus_1 = require("@ory/argus");
+const cli_1 = require("@ory/argus/cli");
+const install_1 = require("@ory/argus/install");
 const PACKAGE_ROOT = path.resolve(__dirname, "..", "..");
 const PACKAGE_NAME = "@ory/claude-code";
 const HARNESS = "claude-code";
@@ -154,13 +156,13 @@ function assemblePluginDir(runtime) {
     // Skills — materialized fresh from the shared core templates.
     const skillsDir = path.join(persistentDir(), "skills");
     fs.rmSync(skillsDir, { recursive: true, force: true });
-    (0, argus_1.writeSkillTree)(skillsDir, (0, argus_1.renderOrySkills)("claude-code", RENDER_OPTS));
+    (0, install_1.writeSkillTree)(skillsDir, (0, install_1.renderOrySkills)("claude-code", RENDER_OPTS));
     // Commands — plain markdown command files (Claude Code's `/ory:<name>`).
     const commandsDir = path.join(persistentDir(), "commands");
     fs.rmSync(commandsDir, { recursive: true, force: true });
     fs.mkdirSync(commandsDir, { recursive: true });
-    for (const cmd of (0, argus_1.renderOryCommands)("claude-code", RENDER_OPTS)) {
-        fs.writeFileSync(path.join(commandsDir, `${cmd.slug}.md`), (0, argus_1.commandToPlainMarkdown)(cmd));
+    for (const cmd of (0, install_1.renderOryCommands)("claude-code", RENDER_OPTS)) {
+        fs.writeFileSync(path.join(commandsDir, `${cmd.slug}.md`), (0, install_1.commandToPlainMarkdown)(cmd));
     }
     // MCP server — points at the shim, so the server starts from the resolved
     // runtime. Omitted entirely when this runtime ships no MCP server, rather
@@ -182,7 +184,7 @@ function assemblePluginDir(runtime) {
     // window the interactive login needs, so leaving it undeclared let the hook
     // be killed mid-sign-in (#220). Both values come from core so they cannot
     // drift from the login timeout they have to outlast.
-    const command = (0, argus_1.requireHookCommand)(runtime);
+    const command = (0, install_1.requireHookCommand)(runtime);
     const entry = (timeout) => [
         { matcher: "", hooks: [{ type: "command", command, timeout }] },
     ];
@@ -249,7 +251,7 @@ function install(args) {
         process.exit(1);
     }
     installAssembled(scope, args);
-    (0, argus_1.printNextSteps)("Claude Code", "npx -y -p @ory/claude-code ory-claude uninstall", {
+    (0, install_1.printNextSteps)("Claude Code", "npx -y -p @ory/claude-code ory-claude uninstall", {
         binName: "ory-claude",
         harness: HARNESS,
     });
@@ -268,7 +270,7 @@ function printInstallPlan(args) {
  * tree with the `claude` CLI as a local-file marketplace.
  */
 function installAssembled(scope, args) {
-    const runtime = (0, argus_1.wireRuntime)({
+    const runtime = (0, install_1.wireRuntime)({
         harness: HARNESS,
         packageName: PACKAGE_NAME,
         packageRoot: PACKAGE_ROOT,
@@ -334,7 +336,7 @@ function installAssembled(scope, args) {
     // Claude Code stores this marketplace path and re-reads it, so a data-dir
     // wipe that skips uninstall would leave it pointing at nothing. Record how to
     // undo the registration so the destructive paths can replay it (#206).
-    (0, argus_1.recordExternalRegistration)({
+    (0, install_1.recordExternalRegistration)({
         harness: "claude-code",
         tool: "claude",
         description: `Claude Code marketplace "${marketplaceName}"`,
@@ -385,12 +387,12 @@ function uninstall(args) {
         console.log("  Marketplace removed.");
     }
     // Deregistered above, so nothing is left to undo.
-    (0, argus_1.clearExternalRegistration)("claude-code");
+    (0, install_1.clearExternalRegistration)("claude-code");
     cleanPersistentDir();
     // Drop the shim and GC the runtime store, unless another harness still
     // points at it.
-    (0, argus_1.removeRuntimeWiring)(HARNESS);
-    for (const pruned of (0, argus_1.pruneRuntimeStores)()) {
+    (0, install_1.removeRuntimeWiring)(HARNESS);
+    for (const pruned of (0, install_1.pruneRuntimeStores)()) {
         console.log(`  Removed runtime: ${pruned}`);
     }
 }
@@ -422,7 +424,7 @@ with the 'claude' CLI as a local-file marketplace.
         uninstall(args);
         // Direct `-setup --uninstall` path: also clear stored Ory credentials.
         // (The `ory-claude uninstall` command handles this itself.)
-        (0, argus_1.clearCredentialsForUninstall)({
+        (0, cli_1.clearCredentialsForUninstall)({
             harness: "claude-code",
             purge: process.argv.includes("--purge"),
         }).then(() => process.exit(0), (err) => {

package/dist/handlers.d.ts

@@ -1,9 +1,21 @@
 import { ensureAgentIdentity, ensureSubAgentIdentity, ensureUserAuthenticated } from "@ory/argus";
-import type { OryAgentClient } from "@ory/argus";
 import type { ClaudeCodeHookInput, ClaudeCodeHookOutput } from "./types.js";
 export interface HandleHookEventDeps {
     userLogin?: typeof ensureUserAuthenticated;
     agentGate?: typeof ensureAgentIdentity;
     subAgentGate?: typeof ensureSubAgentIdentity;
 }
-export declare function handleHookEvent(input: ClaudeCodeHookInput, client: OryAgentClient, deps?: HandleHookEventDeps): Promise<ClaudeCodeHookOutput>;
+export declare const handleHookEvent: import("@ory/argus").HookDispatcher<ClaudeCodeHookInput, ClaudeCodeHookOutput, HandleHookEventDeps>;
+/**
+ * Tell the user and the model when the Ory sign-in failed. The session still
+ * starts, but without a user identity, enforce mode can deny every tool call.
+ * Without this notice nothing would explain those denials. Skipped logins
+ * (headless runs, pre-provisioned agents) are expected and stay silent.
+ */
+export declare function signInFailureNotice(userMode: string, userReason: string): ClaudeCodeHookOutput;
+/**
+ * Deny a PreToolUse call. Claude Code shows `permissionDecisionReason` to the
+ * model, which is how the agent learns why the tool was stopped. This replaces
+ * the deprecated top-level `decision: "block"` / `reason` fields.
+ */
+export declare function preToolUseDeny(reason: string): ClaudeCodeHookOutput;

package/dist/handlers.js

@@ -1,60 +1,51 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.handleHookEvent = handleHookEvent;
+exports.handleHookEvent = void 0;
+exports.signInFailureNotice = signInFailureNotice;
+exports.preToolUseDeny = preToolUseDeny;
 const argus_1 = require("@ory/argus");
 const mcp_servers_js_1 = require("./mcp-servers.js");
 const HARNESS = "claude-code";
-function handleHookEvent(input, client, deps = {}) {
-    const event = input.hook_event_name;
-    client.logger.debug("hook.received", {
-        event,
+/**
+ * A tool event fired inside a sub-agent carries that sub-agent's id and type.
+ * Restore its runtime credential so the gate authenticates as the sub-agent,
+ * not as its parent. Never enrolls: `SubagentStart` owns registration.
+ */
+async function resolveActingSubagent(input, client, deps, event) {
+    const activeType = input.agent_type ?? input.subagent_type;
+    if (event === "SubagentStart" || !input.agent_id || !activeType || !(0, argus_1.isSecurityConnected)()) {
+        return { runtimeCredential: undefined };
+    }
+    const identity = await (deps.subAgentGate ?? argus_1.ensureSubAgentIdentity)(client, {
+        harness: HARNESS,
         sessionId: input.session_id,
-        toolName: input.tool_name,
-    });
-    return (0, argus_1.withHookContext)(client, { sessionId: input.session_id }, async () => {
-        const activeType = input.agent_type ?? input.subagent_type;
-        let runtimeCredential;
-        if (event !== "SubagentStart" && input.agent_id && activeType && (0, argus_1.isSecurityConnected)()) {
-            const identity = await (deps.subAgentGate ?? argus_1.ensureSubAgentIdentity)(client, {
-                harness: HARNESS,
-                sessionId: input.session_id,
-                subAgentType: activeType,
-                perSpawnId: input.agent_id,
-                allowEnrollment: false,
-                emitActivity: false,
-            });
-            if (identity.runtimeCredential) {
-                runtimeCredential = identity.runtimeCredential;
-            }
-        }
-        return (0, argus_1.withHookContext)(client, { runtimeCredential }, async () => {
-            switch (event) {
-                case "SessionStart":
-                    return handleSessionStart(input, client, deps);
-                case "PreToolUse":
-                    return handlePreToolUse(input, client, deps);
-                case "PostToolUse":
-                    return handlePostToolUse(input, client);
-                case "PostToolUseFailure":
-                    return handlePostToolUseFailure(input, client);
-                case "PermissionRequest":
-                    return handlePermissionRequest(input, client);
-                case "UserPromptSubmit":
-                    return handleUserPromptSubmit(input, client);
-                case "SubagentStart":
-                    return handleSubagentStart(input, client, deps);
-                case "SubagentStop":
-                    return handleSubagentStop(input, client);
-                case "SessionEnd":
-                    return handleSessionEnd(input, client);
-                default:
-                    client.logger.debug("hook.passthrough", { event });
-                    client.logger.activity("hook.passthrough", "skipped", { attributes: { event } });
-                    return { continue: true };
-            }
-        });
+        subAgentType: activeType,
+        perSpawnId: input.agent_id,
+        allowEnrollment: false,
+        emitActivity: false,
     });
+    return { runtimeCredential: identity.runtimeCredential };
 }
+const routes = {
+    SessionStart: handleSessionStart,
+    PreToolUse: handlePreToolUse,
+    PostToolUse: handlePostToolUse,
+    PostToolUseFailure: handlePostToolUseFailure,
+    PermissionRequest: handlePermissionRequest,
+    UserPromptSubmit: handleUserPromptSubmit,
+    SubagentStart: handleSubagentStart,
+    SubagentStop: handleSubagentStop,
+    SessionEnd: handleSessionEnd,
+};
+exports.handleHookEvent = (0, argus_1.createHookDispatcher)({
+    harness: HARNESS,
+    event: (input) => input.hook_event_name,
+    sessionId: (input) => input.session_id,
+    log: (input) => ({ sessionId: input.session_id, toolName: input.tool_name }),
+    context: resolveActingSubagent,
+    routes,
+    passthrough: () => ({ continue: true }),
+});
 async function handleSessionStart(input, client, deps) {
     client.logger.info("lifecycle.session_start", {
         sessionId: input.session_id,
@@ -62,7 +53,7 @@ async function handleSessionStart(input, client, deps) {
         source: input.source,
         cwd: input.cwd,
     });
-    await (0, argus_1.sessionStart)(client, {
+    const result = await (0, argus_1.sessionStart)(client, {
         harness: HARNESS,
         sessionId: input.session_id,
         binName: "ory-claude",
@@ -70,7 +61,27 @@ async function handleSessionStart(input, client, deps) {
         agentGate: deps.agentGate,
         activityAttributes: { model: input.model, source: input.source },
     });
-    return {};
+    return signInFailureNotice(result.userMode, result.userReason);
+}
+/**
+ * Tell the user and the model when the Ory sign-in failed. The session still
+ * starts, but without a user identity, enforce mode can deny every tool call.
+ * Without this notice nothing would explain those denials. Skipped logins
+ * (headless runs, pre-provisioned agents) are expected and stay silent.
+ */
+function signInFailureNotice(userMode, userReason) {
+    if (userMode !== "declined" && userMode !== "error")
+        return {};
+    const reason = userReason.replace(/[.\s]+$/, "");
+    return {
+        systemMessage: `Ory sign-in did not complete: ${reason}. Tool calls may be denied this session.`,
+        hookSpecificOutput: {
+            hookEventName: "SessionStart",
+            additionalContext: `Ory Agent Security sign-in did not complete for this session (${reason}). ` +
+                "If Ory denies a tool call, tell the user that starting a new session and " +
+                "signing in may resolve it. Do not retry the denied call.",
+        },
+    };
 }
 async function handlePreToolUse(input, client, deps) {
     const toolName = input.tool_name ?? "unknown";
@@ -87,9 +98,21 @@ async function handlePreToolUse(input, client, deps) {
         mcpTool: identifyMcpCall(toolName, input) ?? undefined,
         principals: actingSubagentPrincipals(input, client),
     });
-    return result.blocked
-        ? { decision: "block", reason: result.denialMessage }
-        : {};
+    return result.blocked ? preToolUseDeny(result.denialMessage ?? "Ory permission denied") : {};
+}
+/**
+ * Deny a PreToolUse call. Claude Code shows `permissionDecisionReason` to the
+ * model, which is how the agent learns why the tool was stopped. This replaces
+ * the deprecated top-level `decision: "block"` / `reason` fields.
+ */
+function preToolUseDeny(reason) {
+    return {
+        hookSpecificOutput: {
+            hookEventName: "PreToolUse",
+            permissionDecision: "deny",
+            permissionDecisionReason: reason,
+        },
+    };
 }
 function identifyMcpCall(toolName, input) {
     return ((0, mcp_servers_js_1.identifyClaudeCodeMcpTool)(toolName, input.cwd) ??
@@ -155,36 +178,48 @@ async function handlePermissionRequest(input, client) {
         mcpTool: mcpTool ?? undefined,
     });
     if (result.kind === "not_connected") {
-        return permissionRequestFallback("Ory Agent Security not connected — deferring to user");
+        return permissionRequestFallback(client, "Ory Agent Security not connected — deferring to user");
     }
     if (result.kind === "interactive") {
-        return permissionRequestFallback("Interactive tool — deferring to user");
+        return permissionRequestFallback(client, "Interactive tool — deferring to user");
     }
     if (result.kind === "fail_open") {
-        return permissionRequestFallback(permissionFailureReason(result.decision));
+        return permissionRequestFallback(client, permissionFailureReason(result.decision));
     }
     if (result.kind === "deny") {
-        return permissionRequestDecision("deny", result.denialMessage ?? "Ory permission denied");
+        return permissionRequestDeny(result.denialMessage ?? "Ory permission denied");
+    }
+    if (result.kind === "observe") {
+        // Policy denied the call but observe mode lets it through. Auto-approving
+        // here would also skip the user's own approval prompt, so defer to it.
+        return permissionRequestFallback(client, "Ory observe mode — denied by policy, deferring to user");
     }
-    return permissionRequestDecision("allow", result.kind === "observe"
-        ? "Ory observe mode — denied by policy but allowed through"
-        : mcpTool
-            ? "Ory MCP server permission granted"
-            : "Ory permission granted");
+    client.logger.debug("permission_request.allow", {
+        reason: mcpTool ? "Ory MCP server permission granted" : "Ory permission granted",
+    });
+    return {
+        hookSpecificOutput: { hookEventName: "PermissionRequest", decision: { behavior: "allow" } },
+    };
 }
-function permissionRequestDecision(behavior, reason) {
+/**
+ * Deny a PermissionRequest. Claude Code reads the reason from
+ * `decision.message` and shows it to the model.
+ */
+function permissionRequestDeny(message) {
     return {
         hookSpecificOutput: {
             hookEventName: "PermissionRequest",
-            decision: { behavior },
-            message: reason,
+            decision: { behavior: "deny", message },
         },
     };
 }
-function permissionRequestFallback(reason) {
-    return {
-        hookSpecificOutput: { hookEventName: "PermissionRequest", message: reason },
-    };
+/**
+ * Return no decision so Claude Code shows its normal permission prompt. Claude
+ * Code has no field for a fallback reason, so the reason goes to the debug log.
+ */
+function permissionRequestFallback(client, reason) {
+    client.logger.debug("permission_request.defer", { reason });
+    return {};
 }
 function permissionFailureReason(decision) {
     if (decision.kind !== "fail_open")

package/dist/hook.d.ts

@@ -4,6 +4,6 @@
  * This script is invoked by Claude Code for each hook event.
  * Input: JSON on stdin
  * Output: JSON on stdout
- * Exit code 2 = block the action
+ * Exit code 2 = PreToolUse deny (the reason is in the JSON and on stderr)
  */
 export {};

package/dist/hook.js

@@ -5,102 +5,32 @@
  * This script is invoked by Claude Code for each hook event.
  * Input: JSON on stdin
  * Output: JSON on stdout
- * Exit code 2 = block the action
+ * Exit code 2 = PreToolUse deny (the reason is in the JSON and on stderr)
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 const argus_1 = require("@ory/argus");
 const handlers_js_1 = require("./handlers.js");
-const EVENT_FLUSH_TIMEOUT_MS = 750;
-let client;
-async function flushEvents() {
-    try {
-        await client?.flushEvents(EVENT_FLUSH_TIMEOUT_MS);
-    }
-    catch {
-        // The hook decision must not depend on activity delivery.
-    }
-}
-/**
- * Read all of stdin as a string.
- *
- * Uses event listeners instead of `for await` so that we don't depend on the
- * parent process closing stdin (sending EOF). If no EOF arrives, we resolve
- * after a short idle gap once data has been received.
- */
-function readStdin() {
-    return new Promise((resolve, reject) => {
-        const chunks = [];
-        let resolved = false;
-        let idleTimer;
-        function cleanup() {
-            if (idleTimer)
-                clearTimeout(idleTimer);
-            process.stdin.off("data", onData);
-            process.stdin.off("end", done);
-            process.stdin.off("error", onError);
-            process.stdin.pause();
-        }
-        function done() {
-            if (!resolved) {
-                resolved = true;
-                cleanup();
-                resolve(Buffer.concat(chunks).toString("utf-8"));
-            }
-        }
-        function onData(chunk) {
-            chunks.push(chunk);
-            // Reset idle timer on every chunk. Once data stops arriving for 100 ms
-            // we assume the full payload has been delivered.
-            if (idleTimer)
-                clearTimeout(idleTimer);
-            idleTimer = setTimeout(done, 100);
+void (0, argus_1.runHookProcess)({
+    harness: "claude-code",
+    handle: handlers_js_1.handleHookEvent,
+    respond: (output, input) => {
+        if (input.hook_event_name === "SessionEnd") {
+            // Claude is already shutting down and may cancel hooks that remain alive.
+            // Activity enqueueing synchronously persists the event to the durable outbox,
+            // so a later hook can deliver it without delaying session termination.
+            return { exitNow: true };
         }
-        function onError(err) {
-            if (!resolved) {
-                resolved = true;
-                cleanup();
-                reject(err);
-            }
+        const specific = output.hookSpecificOutput;
+        if (specific?.permissionDecision === "deny") {
+            // Exit 2 blocks the tool even if Claude Code rejects the JSON. Claude Code
+            // gives the model the JSON deny reason when it parses, and stderr otherwise,
+            // so the same reason goes to both.
+            return {
+                stdout: JSON.stringify(output),
+                stderr: `${specific.permissionDecisionReason ?? ""}\n`,
+                exitCode: 2,
+            };
         }
-        process.stdin.on("data", onData);
-        process.stdin.on("end", done);
-        process.stdin.on("error", onError);
-    });
-}
-async function main() {
-    client = argus_1.OryAgentClient.fromEnv("claude-code");
-    const raw = await readStdin();
-    let input;
-    try {
-        input = JSON.parse(raw);
-    }
-    catch {
-        client.logger.error("hook.stdin.parse_failed", { raw: raw.slice(0, 200) });
-        process.exitCode = 0; // Don't block on parse errors
-        return;
-    }
-    const output = await (0, handlers_js_1.handleHookEvent)(input, client);
-    if (input.hook_event_name === "SessionEnd") {
-        // Claude is already shutting down and may cancel hooks that remain alive.
-        // Activity enqueueing synchronously persists the event to the durable outbox,
-        // so a later hook can deliver it without delaying session termination.
-        process.exit(0);
-    }
-    if (output.decision === "block") {
-        process.stdout.write(JSON.stringify(output));
-        await flushEvents();
-        process.exitCode = 2;
-        return;
-    }
-    if (output.hookSpecificOutput ||
-        output.updatedInput ||
-        output.decision === "approve") {
-        process.stdout.write(JSON.stringify(output));
-    }
-    await flushEvents();
-}
-main().catch(async (err) => {
-    process.stderr.write(`[ory-agent] fatal: ${err}\n`);
-    await flushEvents();
-    process.exitCode = 0; // Fail open
+        return Object.keys(output).length > 0 ? { stdout: JSON.stringify(output) } : {};
+    },
 });

package/dist/settings.js

@@ -37,7 +37,7 @@ exports.generateSettings = generateSettings;
 exports.generateInstalledSettings = generateInstalledSettings;
 exports.generateDevSettings = generateDevSettings;
 const path = __importStar(require("node:path"));
-const argus_1 = require("@ory/argus");
+const install_1 = require("@ory/argus/install");
 /**
  * Generate the .claude/settings.local.json that configures Ory hooks.
  */
@@ -45,10 +45,10 @@ function generateSettings(hookScriptPath) {
     const cmd = `node ${hookScriptPath}`;
     return {
         hooks: {
-            SessionStart: (0, argus_1.matcherHookEntry)(cmd),
-            PreToolUse: (0, argus_1.matcherHookEntry)(cmd),
-            PostToolUse: (0, argus_1.matcherHookEntry)(cmd),
-            PermissionRequest: (0, argus_1.matcherHookEntry)(cmd),
+            SessionStart: (0, install_1.matcherHookEntry)(cmd),
+            PreToolUse: (0, install_1.matcherHookEntry)(cmd),
+            PostToolUse: (0, install_1.matcherHookEntry)(cmd),
+            PermissionRequest: (0, install_1.matcherHookEntry)(cmd),
         },
     };
 }

package/dist/types.d.ts

@@ -30,29 +30,27 @@ export interface ClaudeCodeHookInput {
 }
 /**
  * Claude Code hook output written to stdout.
+ * See: https://code.claude.com/docs/en/hooks
  *
- * Top-level `decision: "block"` is honored on blocking-capable events
- * (PreToolUse, UserPromptSubmit, PostToolUse, Stop, …). PermissionRequest
- * uses the structured `hookSpecificOutput.decision.{behavior}` shape below
- * instead — the top-level `decision` is ignored there.
+ * `systemMessage` is shown to the user and never to the model. Decisions and
+ * model-facing text live in the per-event `hookSpecificOutput`.
  */
 export interface ClaudeCodeHookOutput {
     continue?: boolean;
-    decision?: "block";
-    reason?: string;
     stopReason?: string;
     suppressOutput?: boolean;
     systemMessage?: string;
-    updatedInput?: Record<string, unknown>;
     hookSpecificOutput?: ClaudeCodeHookSpecificOutput;
 }
 /**
  * Per-event structured output. Field shape depends on `hookEventName`:
- *   - PreToolUse: `permissionDecision` + `permissionDecisionReason`,
- *     plus optional `permissionRules` to persist a rule for future calls.
- *   - PermissionRequest: nested `decision: { behavior, updatedInput?, permissionRules? }`.
- *     Omit `decision` entirely to fall through to Claude's normal user prompt.
- *   - SessionStart / UserPromptSubmit: `additionalContext` for context injection.
+ *   - PreToolUse: `permissionDecision` + `permissionDecisionReason`. The
+ *     reason is shown to the model for `deny` and the user for `ask`.
+ *   - PermissionRequest: nested `decision: { behavior, message?, interrupt? }`.
+ *     `message` is the deny reason shown to the model. Omit `decision` to fall
+ *     through to Claude Code's normal user prompt.
+ *   - SessionStart: `additionalContext` is added to the model's context and is
+ *     not shown to the user.
  */
 export interface ClaudeCodeHookSpecificOutput {
     hookEventName?: string;
@@ -61,12 +59,10 @@ export interface ClaudeCodeHookSpecificOutput {
     decision?: {
         behavior: "allow" | "deny";
         updatedInput?: Record<string, unknown>;
-        permissionRules?: string[];
+        /** Deny only: the reason shown to the model. */
+        message?: string;
+        /** Deny only: stop Claude after denying. */
+        interrupt?: boolean;
     };
-    permissionRules?: string[];
     additionalContext?: string;
-    /** Set when the plugin needs the agent to prompt the user for config. */
-    oryConfigRequired?: boolean;
-    message?: string;
-    [key: string]: unknown;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/claude-code",
-  "version": "1.9.1",
+  "version": "1.10.0",
   "description": "Ory plugin for Claude Code: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://github.com/ory/claude-plugins/tree/master/plugins/ory-agent-plugin",
@@ -78,7 +78,7 @@
   ],
   "dependencies": {
     "reova": "^0.7.0",
-    "@ory/argus": "1.9.1"
+    "@ory/argus": "1.10.0"
   },
   "engines": {
     "node": ">=22"