@ory/cline 0.10.0

package/README.md

@@ -0,0 +1,115 @@
+# Ory Agent Plugin: Cline
+
+[Ory](https://ory.com) bundled into [Cline](https://github.com/cline/cline): skills that scaffold Ory authentication into your codebase, a local Ory stack you can spin up in one command, and (when pointed at an Ory project) authentication, authorization, and audit for every tool Cline runs.
+
+You don't need an Ory account or any prior Ory experience to start.
+
+This integration uses Cline's **file-based hooks** (not the in-process SDK) and is verified against cline@3.0.29.
+
+## New to Ory?
+
+[Ory](https://www.ory.com/docs/) is an open-source identity and access platform — login, registration, sessions, social sign-in, multi-factor auth, and fine-grained permissions, so you don't have to build any of that yourself. Two things make it easy to try with no prior experience:
+
+- **Ory Elements** are prebuilt, themeable UI components for the auth pages. The scaffolding skills wire them into your app for you.
+- **The local Ory stack** is a complete Ory running on your laptop in Docker — no account, no signup, no API key.
+
+## What this plugin does
+
+Two independent things, and you can use either on its own:
+
+1. **Build auth into your app.** Have Cline scaffold Ory login, registration, social sign-in, and permissions into the project you're working on, backed by the local stack. This needs nothing but Docker.
+2. **Govern the agent itself.** Authenticate Cline's own session and authorize every tool it runs against Ory Permissions, with a full audit trail. See [Agent security](#agent-security).
+
+## Prerequisites
+
+- [Cline](https://github.com/cline/cline) installed
+- Node.js **≥ 22**
+- [Docker](https://docs.docker.com/get-docker/) (only needed for the local Ory stack)
+- macOS or Linux. Windows works via WSL2.
+
+## Install
+
+```bash
+npx -y -p @ory/cline ory-cline install
+```
+
+Cline discovers hooks by directory — the presence of an executable script named after the event *is* the registration. `install` writes one thin shell shim per event into the workspace hooks directory `<project>/.clinerules/hooks/` (or `~/.cline/hooks/` with `--global`), `chmod 0755`s each, and materializes the Ory skills. Each shim execs the published hook binary via `npx`.
+
+```bash
+npx -y -p @ory/cline ory-cline install --global   # install for all projects
+npx -y -p @ory/cline ory-cline status              # confirm what landed
+npx -y -p @ory/cline ory-cline uninstall           # remove only the Ory shims + skills
+```
+
+Uninstall removes only the scripts the Ory installer wrote (matched by a marker comment) — it never touches a hook script you authored that happens to share an event name.
+
+## Quickstart (≈ 3 minutes)
+
+From any project where you'd like Ory authentication, inside Cline:
+
+1. **Start a local Ory instance.** Ask Cline *"start the local Ory stack"* or run `/local-up`. A banner prints the seeded test user's email and password — note them.
+2. **Scaffold Ory into your project.** Ask Cline *"add Ory auth to this app"* (the `ory-auth-setup` skill). It installs Ory Elements, wires the SDK, and generates the login / registration / recovery / settings pages, all targeting the local stack.
+3. **Sign in.** Start your app, visit the login page, and sign in with the seeded credentials. You now have a real Ory session backed by a real Ory stack — locally, offline, zero configuration.
+
+Continue to [Agent security](#agent-security) when you're ready to enforce.
+
+## How the integration works
+
+Cline runs each hook script as a **subprocess**, passing the event payload as JSON on stdin and reading a JSON decision on stdout. A hook blocks a tool call by returning `{"cancel":true}`. Cline does **not** expose a separate approval-ask hook, so the plugin gates at the tool-call event. Hooks have a 30-second timeout.
+
+The hook script filenames are PascalCase (`TaskStart`, `PreToolUse`, …); the payload Cline delivers on stdin carries the matching snake_case event name (`agent_start`, `tool_call`, …) the plugin acts on. The shims wire into these phases:
+
+- **TaskStart** (`agent_start`) — run the user and agent auth gates.
+- **PreToolUse** (`tool_call`) — check the tool against Ory Permissions; deny blocks the call (`{"cancel":true}`) in enforce mode.
+- **PostToolUse / TaskComplete / TaskCancel / TaskError / UserPromptSubmit / PreCompact / SessionShutdown** — trace-only audit spans.
+
+The plugin is **fail-open** on its own infrastructure failures (network errors, rate limits, missing config): the agent always starts, and enforcement is only as strong as your permission grants.
+
+## Agent security
+
+Once pointed at an Ory project (local or hosted), Cline's task and every tool call can be governed by Ory.
+
+- **Authentication.** The human at the keyboard (the **user**) authenticates interactively via Ory Identities when user login is on (`ORY_USER_LOGIN=true`, off by default — browser PKCE flow on first session, persisted thereafter). The Cline process (the **agent**) gets its own OAuth2 identity via [Dynamic Client Registration (RFC 7591)](https://datatracker.ietf.org/doc/html/rfc7591) on first run.
+- **Authorization.** Before any tool runs, the plugin checks [Ory Permissions](https://www.ory.com/docs/keto) (Zanzibar-style relations) against the user's subject and blocks on `deny`.
+- **Audit.** Every decision is recorded as a structured trace span (NDJSON file and/or OTLP export).
+
+### Permission modes: observe → enforce
+
+After install the plugin runs in **observe mode**: every tool call is checked, but a deny is recorded as a `permission.observe_deny` audit span and the tool runs anyway.
+
+```bash
+# Grant the current user `use` on every built-in tool (idempotent):
+npx -y -p @ory/cline ory-cline permissions bootstrap
+
+# See allowed/denied per tool:
+npx -y -p @ory/cline ory-cline permissions status
+
+# Turn on hard blocking once the observe-mode logs look right:
+npx -y -p @ory/cline ory-cline permissions enforce
+```
+
+Switch back any time with `permissions observe`. To disable Ory entirely (audit logging only), run `ory-cline configure --audit-only`.
+
+## Pointing at a real Ory project
+
+The Quickstart uses the local stack. To point at a hosted [Ory Network](https://console.ory.sh) project:
+
+```bash
+npx -y -p @ory/cline ory-cline configure \
+  --project-url https://<id>.projects.oryapis.com \
+  --oauth2-client-id <public OAuth2 client id>
+```
+
+`--oauth2-client-id` is required whenever `--project-url` is set — the user PKCE flow needs a public OAuth2 client registered with the four loopback redirect URIs (`http://127.0.0.1:47823..47826/callback`). See the [repo README](../../README.md) and [`AGENTS.md`](../../AGENTS.md) for the full environment-variable reference and permission-mode semantics. Config is shared across every Ory agent plugin at `~/.config/ory-agent-plugins/config.json`.
+
+Without configuration the plugin still loads cleanly and runs in **pass-through mode**: skills work, but nothing is blocked.
+
+## Links
+
+- [Ory documentation](https://www.ory.com/docs/)
+- [Cline repository](https://github.com/cline/cline)
+- [Repo README](../../README.md) and [AGENTS.md](../../AGENTS.md) — full env-var and permission-mode reference
+
+## License
+
+Apache-2.0

package/dist/cli/assets.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Materialize / clean the Ory skill catalog and command-skills for the Cline
+ * plugin.
+ *
+ * Cline has no documented native slash-command system we can rely on, so we
+ * follow the Codex/OpenClaw pattern (AGENTS.md Step 7.5): the guide skills
+ * plus the local-stack commands (rendered as user-invocable skills) all land
+ * under a single `skills/<name>/SKILL.md` tree.
+ *
+ * Verified against cline@3.0.29: skills live alongside Cline's rules under
+ * `.clinerules/skills/` (workspace) or `~/.cline/skills/` (global).
+ */
+export declare function installClineOryAssets(rulesRoot: string): void;
+/** Remove every skill + command-skill this plugin installed under the root. */
+export declare function uninstallClineOryAssets(rulesRoot: string): void;

package/dist/cli/assets.js

@@ -0,0 +1,89 @@
+"use strict";
+/**
+ * Materialize / clean the Ory skill catalog and command-skills for the Cline
+ * plugin.
+ *
+ * Cline has no documented native slash-command system we can rely on, so we
+ * follow the Codex/OpenClaw pattern (AGENTS.md Step 7.5): the guide skills
+ * plus the local-stack commands (rendered as user-invocable skills) all land
+ * under a single `skills/<name>/SKILL.md` tree.
+ *
+ * Verified against cline@3.0.29: skills live alongside Cline's rules under
+ * `.clinerules/skills/` (workspace) or `~/.cline/skills/` (global).
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installClineOryAssets = installClineOryAssets;
+exports.uninstallClineOryAssets = uninstallClineOryAssets;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const argus_1 = require("@ory/argus");
+const RENDER_OPTS = {
+    binName: "ory-cline",
+    packageName: "@ory/cline",
+};
+/**
+ * Skills directory, relative to the Cline rules root the install CLI passes
+ * in (`.clinerules/` for workspace installs, `~/.cline/` for
+ * global). The guide skills and command-skills share this one tree.
+ */
+function skillsDir(rulesRoot) {
+    return path.join(rulesRoot, "skills");
+}
+function installClineOryAssets(rulesRoot) {
+    const dir = skillsDir(rulesRoot);
+    fs.mkdirSync(dir, { recursive: true });
+    const guideSkills = (0, argus_1.renderOrySkills)("cline", RENDER_OPTS);
+    const commandSkills = (0, argus_1.renderOryCommands)("cline", RENDER_OPTS).map(argus_1.commandToSkill);
+    (0, argus_1.writeSkillTree)(dir, [...guideSkills, ...commandSkills]);
+}
+function safeRmEmpty(dir) {
+    try {
+        if (fs.existsSync(dir) && fs.readdirSync(dir).length === 0) {
+            fs.rmdirSync(dir);
+        }
+    }
+    catch {
+        /* ignore — leave the dir if removal fails. */
+    }
+}
+/** Remove every skill + command-skill this plugin installed under the root. */
+function uninstallClineOryAssets(rulesRoot) {
+    const dir = skillsDir(rulesRoot);
+    if (fs.existsSync(dir)) {
+        (0, argus_1.removeSkillDirs)(dir, [...argus_1.ORY_SKILL_NAMES, ...argus_1.ORY_COMMAND_SKILL_NAMES]);
+        safeRmEmpty(dir);
+    }
+}

package/dist/cli/main.d.ts

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+/**
+ * Main CLI for @ory/cline.
+ *
+ * Usage:
+ *   npx ory-cline install [--global]     Install Ory hook scripts into Cline
+ *   npx ory-cline uninstall [--global]   Remove the Ory hook scripts
+ *   npx ory-cline configure              Set or view Ory credentials
+ *   npx ory-cline agent <cmd>            Manage the agent's OAuth2 (DCR) identity
+ *   npx ory-cline permissions <cmd>      Manage permission mode and tool permissions
+ *   npx ory-cline setup [options]        Write hook scripts directly (fallback)
+ *   npx ory-cline status                 Show plugin status
+ *   npx ory-cline local <cmd>            Manage the local Ory dev environment
+ */
+export {};

package/dist/cli/main.js

@@ -0,0 +1,176 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * Main CLI for @ory/cline.
+ *
+ * Usage:
+ *   npx ory-cline install [--global]     Install Ory hook scripts into Cline
+ *   npx ory-cline uninstall [--global]   Remove the Ory hook scripts
+ *   npx ory-cline configure              Set or view Ory credentials
+ *   npx ory-cline agent <cmd>            Manage the agent's OAuth2 (DCR) identity
+ *   npx ory-cline permissions <cmd>      Manage permission mode and tool permissions
+ *   npx ory-cline setup [options]        Write hook scripts directly (fallback)
+ *   npx ory-cline status                 Show plugin status
+ *   npx ory-cline local <cmd>            Manage the local Ory dev environment
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const path = __importStar(require("node:path"));
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const argus_1 = require("@ory/argus");
+const PACKAGE_ROOT = path.resolve(__dirname, "..", "..");
+function main() {
+    const [command, ...args] = process.argv.slice(2);
+    switch (command) {
+        case "install":
+            install(args);
+            postInstallPermissions("ory-cline", "cline").then(() => process.exit(0), (err) => {
+                console.error(err.message ?? err);
+                process.exit(1);
+            });
+            break;
+        case "uninstall":
+            uninstall(args);
+            break;
+        case "configure":
+            (0, argus_1.runConfigureCommand)("ory-cline", args);
+            break;
+        case "agent":
+            (0, argus_1.runAgentCommand)("ory-cline", args).then((code) => process.exit(code), (err) => {
+                console.error(err.message ?? err);
+                process.exit(1);
+            });
+            break;
+        case "permissions":
+            (0, argus_1.runPermissionsCommand)("ory-cline", "cline", args).then((code) => process.exit(code), (err) => {
+                console.error(err.message ?? err);
+                process.exit(1);
+            });
+            break;
+        case "setup":
+            runSetup(args);
+            break;
+        case "status":
+            status().then(() => process.exit(0), (err) => {
+                console.error(err.message ?? err);
+                process.exit(1);
+            });
+            break;
+        case "local":
+            (0, argus_1.runLocalCommand)("ory-cline", args).catch((err) => {
+                console.error(err.message ?? err);
+                process.exit(1);
+            });
+            break;
+        case "help":
+        case "--help":
+        case "-h":
+        case undefined:
+            help();
+            break;
+        default:
+            console.error(`Unknown command: ${command}`);
+            help();
+            process.exit(1);
+    }
+}
+/**
+ * Cline discovers hooks by directory, with no native plugin-install command,
+ * so install IS the setup step: write the per-event hook scripts and
+ * materialize the Ory skills. The setup module reads its arguments from
+ * `process.argv`.
+ */
+function install(args) {
+    console.log("Installing Ory hook scripts and skills for Cline...");
+    runSetup(args);
+    (0, argus_1.printEnvHelp)("ory-cline");
+}
+function uninstall(args) {
+    runSetup(["--uninstall", ...args]);
+}
+function runSetup(args) {
+    process.argv = ["node", "setup.js", ...args];
+    require("./setup.js");
+}
+async function postInstallPermissions(binName, harness) {
+    const bootstrapped = await (0, argus_1.maybeAutoBootstrap)(binName, harness);
+    (0, argus_1.printPermissionsOnboardingHelp)(binName, harness, {
+        bootstrappedAutomatically: bootstrapped,
+    });
+}
+async function status() {
+    await (0, argus_1.runStatusCommand)("ory-cline", "cline", {
+        title: "Cline",
+        printPluginSection: () => {
+            const workspaceHooks = path.join(process.cwd(), ".clinerules", "hooks");
+            const globalHooks = path.join(os.homedir(), ".cline", "hooks");
+            console.log("Hooks & plugin:");
+            console.log(`  Hook script:    ${fs.existsSync(path.join(PACKAGE_ROOT, "dist", "hook.js")) ? "built" : "NOT BUILT (run pnpm build)"}`);
+            console.log(`  Workspace dir:  ${fs.existsSync(workspaceHooks) ? `installed (${workspaceHooks})` : "not installed"}`);
+            console.log(`  Global dir:     ${fs.existsSync(globalHooks) ? `installed (${globalHooks})` : "not installed"}`);
+        },
+    });
+}
+function help() {
+    console.log(`
+ory-cline — Ory plugin for Cline
+
+Usage:
+  npx ory-cline <command> [options]
+
+Commands:
+  install [--global]     Install the Ory hook scripts into Cline
+  uninstall [--global]   Remove the Ory hook scripts from Cline
+  configure              Set or view Ory project URL and API key
+  agent <cmd>            Manage the agent's OAuth2 (DCR) identity (status, unregister)
+  permissions <cmd>      Manage permission mode and tool permissions (status, bootstrap, observe, enforce)
+  setup [options]        Write hook scripts directly to the hooks directory (fallback)
+  status                 Show plugin status and configuration
+  local <cmd>            Manage local Ory dev environment (up, down, status, seed, ...)
+
+After installing, the per-event hook scripts wire into these Cline lifecycle events:
+  TaskStart              Verify the user and agent identities via Ory
+  PreToolUse             Check tool permissions via Ory Permissions (blocking)
+  PostToolUse            Audit log tool executions
+
+Examples:
+  npx ory-cline install             # Install hook scripts into ./.clinerules/hooks
+  npx ory-cline install --global    # Install into ~/.cline/hooks
+  npx ory-cline status              # Check configuration
+  npx ory-cline uninstall           # Remove hook scripts
+`);
+}
+main();

package/dist/cli/setup.d.ts

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+/**
+ * Setup CLI for the Ory Cline plugin.
+ *
+ * Cline discovers hooks by directory: it runs executable scripts whose
+ * filename matches the event name, found in a hooks directory. There is no
+ * per-hook config file — presence of the script IS the registration. We
+ * therefore write one thin shell shim per event into the hooks directory and
+ * `chmod 0755` it. Each shim execs the published hook binary via npx,
+ * forwarding stdin so the JSON payload reaches the Node entry point.
+ *
+ * Hooks directory (verified against cline@3.0.29):
+ *   workspace : <projectDir>/.clinerules/hooks/
+ *   global    : ~/.cline/hooks/                  (--global, --hooks-dir default)
+ *
+ * Usage:
+ *   npx ory-cline-setup                     # workspace install (cwd)
+ *   npx ory-cline-setup --project-dir /repo
+ *   npx ory-cline-setup --global            # install to ~/.cline/hooks
+ *   npx ory-cline-setup --print             # print the shim scripts to stdout, write nothing
+ *   npx ory-cline-setup --uninstall         # remove only the Ory-written scripts
+ */
+export {};

package/dist/cli/setup.js

@@ -0,0 +1,215 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * Setup CLI for the Ory Cline plugin.
+ *
+ * Cline discovers hooks by directory: it runs executable scripts whose
+ * filename matches the event name, found in a hooks directory. There is no
+ * per-hook config file — presence of the script IS the registration. We
+ * therefore write one thin shell shim per event into the hooks directory and
+ * `chmod 0755` it. Each shim execs the published hook binary via npx,
+ * forwarding stdin so the JSON payload reaches the Node entry point.
+ *
+ * Hooks directory (verified against cline@3.0.29):
+ *   workspace : <projectDir>/.clinerules/hooks/
+ *   global    : ~/.cline/hooks/                  (--global, --hooks-dir default)
+ *
+ * Usage:
+ *   npx ory-cline-setup                     # workspace install (cwd)
+ *   npx ory-cline-setup --project-dir /repo
+ *   npx ory-cline-setup --global            # install to ~/.cline/hooks
+ *   npx ory-cline-setup --print             # print the shim scripts to stdout, write nothing
+ *   npx ory-cline-setup --uninstall         # remove only the Ory-written scripts
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const argus_1 = require("@ory/argus");
+const assets_js_1 = require("./assets.js");
+const PACKAGE_NAME = "@ory/cline";
+const HOOK_BIN = "ory-cline-hook";
+/**
+ * Cline hook events we register. Each maps to a script whose filename matches
+ * the PascalCase event name in the hooks directory (verified against
+ * cline@3.0.29). At runtime, the payload Cline writes to the script's stdin
+ * carries the snake_case `hookName` the handler switches on:
+ *
+ *   TaskStart        → agent_start       (auth gates)
+ *   TaskResume       → agent_resume      (trace-only)
+ *   TaskCancel       → agent_abort       (trace-only)
+ *   TaskComplete     → agent_end         (trace-only)
+ *   TaskError        → agent_error       (trace-only)
+ *   PreToolUse       → tool_call         (permission gate, blocking)
+ *   PostToolUse      → tool_result       (trace-only)
+ *   UserPromptSubmit → prompt_submit     (trace-only)
+ *   PreCompact       → pre_compact       (trace-only)
+ *   SessionShutdown  → session_shutdown  (trace-only)
+ */
+const HOOK_EVENTS = [
+    "TaskStart",
+    "TaskResume",
+    "TaskCancel",
+    "TaskComplete",
+    "TaskError",
+    "PreToolUse",
+    "PostToolUse",
+    "UserPromptSubmit",
+    "PreCompact",
+    "SessionShutdown",
+];
+/**
+ * The version-pinned npx command that each shim execs. Resolving via npx
+ * keeps the binary off the PATH requirement and pins the version the shim was
+ * generated with (read from this package's own package.json).
+ */
+function hookCommand() {
+    return `npx -y -p ${PACKAGE_NAME}@${readPackageVersion()} ${HOOK_BIN}`;
+}
+function readPackageVersion() {
+    // dist/cli/setup.js -> package root is two levels up.
+    const pkgPath = path.resolve(__dirname, "..", "..", "package.json");
+    try {
+        const parsed = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+        return parsed.version ?? "latest";
+    }
+    catch {
+        return "latest";
+    }
+}
+/**
+ * Body of a per-event shim. A POSIX shell script that execs the hook binary,
+ * forwarding stdin/stdout transparently. `exec` replaces the shell so the
+ * hook's exit status and stdout flow straight back to Cline.
+ */
+function shimBody() {
+    return `#!/bin/sh
+# Ory plugin hook shim for Cline. Generated by ${PACKAGE_NAME} — do not edit.
+# Forwards the event payload (stdin JSON) to the Ory hook and returns its
+# JSON decision on stdout.
+exec ${hookCommand()}
+`;
+}
+/**
+ * Resolve the hooks directory based on --global / --project-dir.
+ *
+ * Verified against `cline --help` (2026-06-28): the global hooks dir is
+ * `~/.cline/hooks` (the `--hooks-dir` default). The workspace hooks dir is
+ * `<projectDir>/.clinerules/hooks` (the string `clinerules/hooks` is present
+ * in the cline binary).
+ */
+function getHooksDir(args) {
+    if (args.global) {
+        return path.join(os.homedir(), ".cline", "hooks");
+    }
+    return path.join(args.projectDir, ".clinerules", "hooks");
+}
+/**
+ * Rules root (parent of the hooks dir) where skills are materialized:
+ * `.clinerules/` for workspace installs, `~/.cline/` for global installs.
+ * Verified against cline@3.0.29.
+ */
+function getRulesRoot(args) {
+    if (args.global) {
+        return path.join(os.homedir(), ".cline");
+    }
+    return path.join(args.projectDir, ".clinerules");
+}
+/**
+ * Marker so uninstall only removes scripts we wrote — never a hook script the
+ * user authored that happens to share an event name.
+ */
+const ORY_MARKER = `${PACKAGE_NAME}`;
+function isOryShim(file) {
+    try {
+        return fs.readFileSync(file, "utf-8").includes(ORY_MARKER);
+    }
+    catch {
+        return false;
+    }
+}
+function main() {
+    if (process.argv.includes("--help") || process.argv.includes("-h")) {
+        (0, argus_1.printSetupHelp)("ory-cline-setup", "Cline", {
+            supportsGlobal: true,
+            globalPath: "~/.cline/hooks",
+        });
+        process.exit(0);
+    }
+    const args = (0, argus_1.parseSetupArgs)({ supportsGlobal: true });
+    const body = shimBody();
+    if (args.print) {
+        for (const event of HOOK_EVENTS) {
+            console.log(`# ── ${event} ───────────────────────────────`);
+            console.log(body);
+        }
+        return;
+    }
+    const hooksDir = getHooksDir(args);
+    const rulesRoot = getRulesRoot(args);
+    if (args.uninstall) {
+        if (!fs.existsSync(hooksDir)) {
+            console.log("No hooks directory found. Nothing to uninstall.");
+        }
+        else {
+            let removed = 0;
+            for (const event of HOOK_EVENTS) {
+                const file = path.join(hooksDir, event);
+                if (fs.existsSync(file) && isOryShim(file)) {
+                    fs.unlinkSync(file);
+                    removed++;
+                }
+            }
+            console.log(`Removed ${removed} Ory hook script(s) from ${hooksDir}`);
+        }
+        (0, assets_js_1.uninstallClineOryAssets)(rulesRoot);
+        console.log(`Removed Ory skills from ${path.join(rulesRoot, "skills")}`);
+        return;
+    }
+    fs.mkdirSync(hooksDir, { recursive: true });
+    for (const event of HOOK_EVENTS) {
+        const file = path.join(hooksDir, event);
+        fs.writeFileSync(file, body, { mode: 0o755 });
+        // Re-assert the mode in case a pre-existing file ignored the create mode.
+        fs.chmodSync(file, 0o755);
+    }
+    (0, assets_js_1.installClineOryAssets)(rulesRoot);
+    console.log(`Ory hook scripts installed to ${hooksDir}`);
+    console.log(`  Scripts: ${HOOK_EVENTS.join(", ")}`);
+    console.log(`Ory skills installed to ${path.join(rulesRoot, "skills")}`);
+    (0, argus_1.printNextSteps)("Cline", "npx ory-cline-setup --uninstall");
+}
+main();

package/dist/handlers.d.ts

@@ -0,0 +1,20 @@
+import { OryAgentClient, ensureUserAuthenticated, ensureAgentIdentity } from "@ory/argus";
+import type { ClineHookInput, ClineHookOutput } from "./types.js";
+export interface HandleHookEventDeps {
+    /** Test injection point for the user login flow. */
+    userLogin?: typeof ensureUserAuthenticated;
+    /** Test injection point for the agent identity gate. */
+    agentGate?: typeof ensureAgentIdentity;
+}
+/**
+ * Route a Cline file-hook event to the appropriate Ory integration.
+ *
+ * Cline has no dedicated approval-ask hook, so authorization is enforced at
+ * the `tool_call` event. A deny becomes `{ cancel: true, errorMessage }`, which
+ * prevents the tool from running.
+ *
+ * The on-disk script filenames are PascalCase (TaskStart, PreToolUse, …) but
+ * the `hookName` field inside the stdin payload is the snake_case
+ * `HookEventName` enum (verified against cline@3.0.29) — we switch on that.
+ */
+export declare function handleHookEvent(input: ClineHookInput, client: OryAgentClient, deps?: HandleHookEventDeps): Promise<ClineHookOutput>;

package/dist/handlers.js

@@ -0,0 +1,367 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleHookEvent = handleHookEvent;
+const argus_1 = require("@ory/argus");
+/**
+ * Route a Cline file-hook event to the appropriate Ory integration.
+ *
+ * Cline has no dedicated approval-ask hook, so authorization is enforced at
+ * the `tool_call` event. A deny becomes `{ cancel: true, errorMessage }`, which
+ * prevents the tool from running.
+ *
+ * The on-disk script filenames are PascalCase (TaskStart, PreToolUse, …) but
+ * the `hookName` field inside the stdin payload is the snake_case
+ * `HookEventName` enum (verified against cline@3.0.29) — we switch on that.
+ */
+async function handleHookEvent(input, client, deps = {}) {
+    const event = input.hookName;
+    client.logger.debug("hook.received", {
+        event,
+        taskId: input.taskId,
+        toolName: input.preToolUse?.toolName ?? input.postToolUse?.toolName,
+    });
+    // Set trace context so all spans within this hook invocation correlate.
+    client.tracer.setContext({
+        traceId: (0, argus_1.deriveTraceId)(input.taskId),
+        sessionId: input.taskId,
+    });
+    try {
+        switch (event) {
+            case "agent_start":
+                return await handleTaskStart(input, client, deps);
+            case "agent_resume":
+                return await handleTaskResume(input, client);
+            case "agent_abort":
+                return await handleTaskCancel(input, client);
+            case "agent_end":
+                return await handleTaskComplete(input, client);
+            case "agent_error":
+                return await handleTaskError(input, client);
+            case "tool_call":
+                return await handlePreToolUse(input, client);
+            case "tool_result":
+                return await handlePostToolUse(input, client);
+            case "prompt_submit":
+                return await handleUserPromptSubmit(input, client);
+            case "pre_compact":
+                return await handlePreCompact(input, client);
+            case "session_shutdown":
+                return await handleSessionShutdown(input, client);
+            default:
+                client.logger.debug("hook.passthrough", { event });
+                client.tracer.record("hook.passthrough", "skipped", {
+                    attributes: { event },
+                });
+                return {};
+        }
+    }
+    finally {
+        client.tracer.clearContext();
+    }
+}
+// ─── agent_start (session.start) ───────────────────────────────────
+async function handleTaskStart(input, client, deps) {
+    client.logger.info("lifecycle.task_start", {
+        taskId: input.taskId,
+        workspaceRoots: input.workspaceRoots,
+    });
+    client.tracer.record("session.start", "ok", {
+        attributes: { clineVersion: input.clineVersion },
+    });
+    // 1. User gate. agent_start is a subprocess hook that can carry a hard block
+    // (cancel:true), so allowBlock:true.
+    const userGate = deps.userLogin ?? argus_1.ensureUserAuthenticated;
+    const decision = await userGate(client, {
+        binName: "ory-cline",
+        harness: "cline",
+        allowBlock: true,
+    });
+    // 2. Agent gate. Never blocks; attaches the agent's bearer token to
+    // outgoing Ory API calls.
+    const agentGate = deps.agentGate ?? argus_1.ensureAgentIdentity;
+    await agentGate(client, {
+        projectUrl: (0, argus_1.resolveConfig)().projectUrl,
+        harness: "cline",
+    });
+    // 3. User → agent delegation tuple. Best-effort; never blocks.
+    await writeDelegation(client);
+    if (!decision.proceed) {
+        return {
+            cancel: true,
+            errorMessage: decision.reason ?? "Ory user login was declined or could not complete.",
+        };
+    }
+    if (decision.mode !== "disabled") {
+        return {};
+    }
+    // Legacy verify/log path (ORY_USER_LOGIN unset).
+    const resolved = (0, argus_1.resolveConfig)();
+    if (resolved.auditOnly) {
+        client.logger.info("config.audit_only", {
+            message: "Audit-only mode enabled. Auth and permission checks are disabled.",
+        });
+        return {};
+    }
+    if (!resolved.projectUrl) {
+        client.logger.warn("config.not_configured", {
+            message: "Ory plugin is not configured. Auth and permission checks are disabled. " +
+                "Run 'npx ory-cline configure' to connect to an Ory project.",
+        });
+        return {};
+    }
+    const sessionToken = process.env.ORY_SESSION_TOKEN;
+    const oauth2Token = process.env.ORY_OAUTH2_TOKEN;
+    if (sessionToken) {
+        await verifySessionToken(sessionToken, client);
+        return {};
+    }
+    if (oauth2Token) {
+        await verifyOAuth2Token(oauth2Token, client);
+        return {};
+    }
+    client.logger.warn("session.no_credentials", {
+        message: "Neither ORY_SESSION_TOKEN nor ORY_OAUTH2_TOKEN is set. " +
+            "Skipping authentication.",
+    });
+    return {};
+}
+/**
+ * Write the user → agent delegation tuple once both principal subjects are
+ * populated. Idempotent (409s absorbed by the core). Failures are logged and
+ * swallowed — delegation tuples are audit-trail only.
+ */
+async function writeDelegation(client) {
+    const userSubject = client.userPrincipal?.subject;
+    const agentSubject = client.agentPrincipal?.subject;
+    if (!userSubject || !agentSubject)
+        return;
+    const namespace = resolveNamespace();
+    try {
+        await client.createRelationship({
+            namespace,
+            object: `agent:${agentSubject}`,
+            relation: "delegate",
+            subjectId: `user:${userSubject}`,
+        });
+    }
+    catch (err) {
+        client.logger.warn("delegation.write_failed", {
+            message: err?.message ?? String(err),
+        });
+    }
+}
+async function verifySessionToken(token, client) {
+    try {
+        const session = await client.verifySession(token);
+        if (!session.active) {
+            client.logger.warn("session.inactive", {
+                message: "Ory session is not active. Re-authenticate to enable auth checks.",
+            });
+        }
+    }
+    catch (err) {
+        const oryErr = err;
+        client.logger.warn("session.verify_failed", {
+            code: oryErr.code,
+            message: oryErr.message,
+        });
+    }
+}
+async function verifyOAuth2Token(token, client) {
+    try {
+        const tokenInfo = await client.introspectToken(token);
+        if (!tokenInfo.active) {
+            client.logger.warn("oauth2.token_inactive", {
+                message: "Ory OAuth2 token is not active. Obtain a new token to enable auth checks.",
+            });
+            return;
+        }
+        client.logger.info("oauth2.session_authenticated", {
+            clientId: tokenInfo.clientId,
+            subject: tokenInfo.subject,
+            scope: tokenInfo.scope,
+        });
+    }
+    catch (err) {
+        const oryErr = err;
+        client.logger.warn("oauth2.introspect_failed", {
+            code: oryErr.code,
+            message: oryErr.message,
+        });
+    }
+}
+// ─── tool_call (tool.before, blocking) ─────────────────────────────
+async function handlePreToolUse(input, client) {
+    const toolName = input.preToolUse?.toolName ?? "unknown";
+    const toolInput = input.preToolUse?.parameters;
+    client.logger.info("lifecycle.pre_tool_use", {
+        taskId: input.taskId,
+        toolName,
+        toolInput,
+    });
+    const inputSummary = (0, argus_1.summarizeToolInput)(toolName, toolInput);
+    // In audit-only mode, log the invocation but skip permission checks.
+    if ((0, argus_1.resolveConfig)().auditOnly) {
+        client.tracer.record("tool.invoke", "ok", {
+            attributes: { toolName, ...inputSummary },
+        });
+        return {};
+    }
+    const subject = (0, argus_1.resolveUserSubject)(client, `session:${input.taskId}`);
+    const subjectId = (0, argus_1.subjectLabel)(subject);
+    const namespace = resolveNamespace();
+    try {
+        const outcome = await (0, argus_1.gateToolCall)(client, {
+            harness: "cline",
+            toolName,
+            check: { namespace, object: toolName, relation: "use", ...subject },
+            spanAttributes: { toolName },
+        });
+        // Interactive tools (operator-extensible via ORY_INTERACTIVE_TOOLS):
+        // user.interaction span is already recorded; pass through.
+        if (outcome.kind === "interactive") {
+            return {};
+        }
+        const decision = outcome;
+        if (decision.kind === "fail_open") {
+            return handlePermissionError(decision.error, toolName, client);
+        }
+        const attrs = { toolName, ...inputSummary };
+        const decisionAttrs = decision.spanAttributes;
+        if (decision.kind === "allow") {
+            client.tracer.record("tool.invoke", "ok", {
+                attributes: { ...attrs, ...decisionAttrs, allowed: true },
+            });
+            return {};
+        }
+        if (decision.kind === "observe") {
+            client.tracer.record("tool.block", "denied", {
+                attributes: {
+                    ...attrs,
+                    ...decisionAttrs,
+                    allowed: false,
+                    ...(0, argus_1.alertAttributes)(false),
+                },
+            });
+            client.tracer.record("tool.invoke", "ok", {
+                attributes: { ...attrs, ...decisionAttrs, allowed: false, observed: true },
+            });
+            return {};
+        }
+        // deny → cancel the tool.
+        client.tracer.record("tool.block", "denied", {
+            attributes: {
+                ...attrs,
+                ...decisionAttrs,
+                allowed: false,
+                ...(0, argus_1.alertAttributes)(true),
+            },
+        });
+        return {
+            cancel: true,
+            errorMessage: (0, argus_1.formatDenialMessage)({ tool: toolName, subjectId, namespace }),
+        };
+    }
+    catch (err) {
+        return handlePermissionError(err, toolName, client);
+    }
+}
+// ─── tool_result (tool.after) ──────────────────────────────────────
+async function handlePostToolUse(input, client) {
+    const toolName = input.postToolUse?.toolName ?? "unknown";
+    const toolInput = input.postToolUse?.parameters;
+    const toolResult = input.postToolUse?.result;
+    client.logger.info("lifecycle.post_tool_use", {
+        taskId: input.taskId,
+        toolName,
+        success: input.postToolUse?.success,
+    });
+    client.tracer.record("tool.complete", "ok", {
+        attributes: {
+            toolName,
+            success: input.postToolUse?.success,
+            executionTimeMs: input.postToolUse?.executionTimeMs,
+            ...(0, argus_1.summarizeToolInput)(toolName, toolInput),
+            ...(0, argus_1.summarizeToolOutput)(toolName, toolResult),
+        },
+    });
+    return {};
+}
+// ─── Trace-only lifecycle events ───────────────────────────────────
+async function handleTaskResume(input, client) {
+    client.logger.info("lifecycle.task_resume", { taskId: input.taskId });
+    client.tracer.record("session.start", "ok", {
+        attributes: { resumed: true, clineVersion: input.clineVersion },
+    });
+    return {};
+}
+async function handleTaskCancel(input, client) {
+    client.logger.info("lifecycle.task_cancel", { taskId: input.taskId });
+    client.tracer.record("session.end", "ok", {
+        attributes: { reason: "abort" },
+    });
+    return {};
+}
+async function handleTaskComplete(input, client) {
+    client.logger.info("lifecycle.task_complete", { taskId: input.taskId });
+    client.tracer.record("session.end", "ok", {
+        attributes: { reason: "complete" },
+    });
+    return {};
+}
+async function handleTaskError(input, client) {
+    client.logger.info("lifecycle.task_error", { taskId: input.taskId });
+    client.tracer.record("session.end", "error", {
+        attributes: { reason: "error" },
+    });
+    return {};
+}
+async function handleSessionShutdown(input, client) {
+    client.logger.info("lifecycle.session_shutdown", { taskId: input.taskId });
+    client.tracer.record("session.end", "ok", {
+        attributes: { stage: "session_shutdown" },
+    });
+    return {};
+}
+async function handleUserPromptSubmit(input, client) {
+    client.logger.info("lifecycle.user_prompt_submit", { taskId: input.taskId });
+    // User-facing phase: the human is the decision-maker. Audit span only.
+    client.tracer.record("user.prompt", "ok", {
+        attributes: { stage: "user_prompt_submit" },
+    });
+    return {};
+}
+async function handlePreCompact(input, client) {
+    client.logger.info("lifecycle.pre_compact", { taskId: input.taskId });
+    client.tracer.record("compaction", "ok", {
+        attributes: { stage: "pre_compact" },
+    });
+    return {};
+}
+// ─── Helpers ────────────────────────────────────────────────────────
+function resolveNamespace() {
+    return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
+}
+function handlePermissionError(oryErr, toolName, client) {
+    if (oryErr.code === "network_error") {
+        client.logger.warn("permission.network_error", {
+            toolName,
+            message: "Ory unreachable, failing open",
+        });
+        return {};
+    }
+    if (oryErr.code === "rate_limited") {
+        client.logger.warn("permission.rate_limited", {
+            toolName,
+            message: "Ory rate limited, failing open",
+        });
+        return {};
+    }
+    // For other errors, also fail open but log prominently.
+    client.logger.error("permission.check.error", {
+        toolName,
+        code: oryErr.code,
+        message: oryErr.message,
+    });
+    return {};
+}

package/dist/hook.d.ts

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+/**
+ * Cline file-hook entry point.
+ *
+ * Cline invokes this script (named after the event, e.g. PreToolUse) for each
+ * hook event.
+ *   Input:  JSON on stdin
+ *   Output: JSON on stdout
+ *
+ * Blocking model: a tool_call response of `{ "cancel": true, ... }` prevents
+ * the tool from running. The `cancel` flag is the signal — exit code 0 is
+ * correct in all cases. (Cline also treats exit code 130 as a cancellation,
+ * but we deliberately do NOT rely on exit codes here.)
+ *
+ * Verified against cline@3.0.29.
+ */
+export {};

package/dist/hook.js

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * Cline file-hook entry point.
+ *
+ * Cline invokes this script (named after the event, e.g. PreToolUse) for each
+ * hook event.
+ *   Input:  JSON on stdin
+ *   Output: JSON on stdout
+ *
+ * Blocking model: a tool_call response of `{ "cancel": true, ... }` prevents
+ * the tool from running. The `cancel` flag is the signal — exit code 0 is
+ * correct in all cases. (Cline also treats exit code 130 as a cancellation,
+ * but we deliberately do NOT rely on exit codes here.)
+ *
+ * Verified against cline@3.0.29.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const argus_1 = require("@ory/argus");
+const handlers_js_1 = require("./handlers.js");
+/**
+ * Read all of stdin as a string.
+ *
+ * Uses event listeners instead of `for await` so that we don't depend on the
+ * parent process closing stdin (sending EOF). If no EOF arrives, we resolve
+ * after a short idle gap once data has been received.
+ */
+function readStdin() {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let resolved = false;
+        function done() {
+            if (!resolved) {
+                resolved = true;
+                resolve(Buffer.concat(chunks).toString("utf-8"));
+            }
+        }
+        process.stdin.on("data", (chunk) => {
+            chunks.push(chunk);
+            // Reset idle timer on every chunk. Once data stops arriving for 100 ms
+            // we assume the full payload has been delivered.
+            clearTimeout(idleTimer);
+            idleTimer = setTimeout(done, 100);
+        });
+        process.stdin.on("end", done);
+        process.stdin.on("error", (err) => {
+            if (!resolved) {
+                resolved = true;
+                reject(err);
+            }
+        });
+        let idleTimer;
+    });
+}
+async function main() {
+    const client = argus_1.OryAgentClient.fromEnv("cline");
+    const raw = await readStdin();
+    let input;
+    try {
+        input = JSON.parse(raw);
+    }
+    catch {
+        client.logger.error("hook.stdin.parse_failed", { raw: raw.slice(0, 200) });
+        await client.tracer.shutdown();
+        process.exit(0); // Don't block on parse errors
+    }
+    const output = await (0, handlers_js_1.handleHookEvent)(input, client);
+    // `cancel: true` is the block signal. Emit the decision and exit 0 — Cline
+    // reads the JSON, not the exit code.
+    if (output.cancel || output.contextModification || output.errorMessage) {
+        process.stdout.write(JSON.stringify(output));
+    }
+    await client.tracer.shutdown();
+    process.exit(0);
+}
+main().catch((err) => {
+    process.stderr.write(`[ory-agent] fatal: ${err}\n`);
+    process.exit(0); // Fail open
+});

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export { handleHookEvent, type HandleHookEventDeps } from "./handlers.js";
+export type { ClineHookInput, ClineHookOutput } from "./types.js";

package/dist/index.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleHookEvent = void 0;
+var handlers_js_1 = require("./handlers.js");
+Object.defineProperty(exports, "handleHookEvent", { enumerable: true, get: function () { return handlers_js_1.handleHookEvent; } });

package/dist/types.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Cline file-hook event payload delivered on stdin.
+ *
+ * Cline invokes hooks as executable scripts whose name matches the event in
+ * PascalCase (`TaskStart`, `PreToolUse`, …), placed in a hooks directory. Each
+ * script receives the event payload as JSON on stdin and may write a JSON
+ * decision to stdout. A tool-call decision of `{ "cancel": true }` prevents the
+ * tool. Hooks have a 30s timeout and `contextModification` is capped at 50k
+ * characters.
+ *
+ * The on-disk script filenames are PascalCase, but the `hookName` field
+ * carried *inside* the stdin payload is the snake_case `HookEventName` enum.
+ * Tool-specific fields are nested under per-event sub-objects, not flat.
+ *
+ * Verified against cline@3.0.29 (@cline/shared/dist/hooks/events.d.ts).
+ */
+/** Snake_case hook event names as delivered inside the stdin payload. */
+export type ClineHookEventName = "agent_start" | "agent_resume" | "agent_abort" | "agent_end" | "agent_error" | "tool_call" | "tool_result" | "prompt_submit" | "pre_compact" | "session_shutdown";
+/** Nested payload for the `tool_call` event. */
+export interface ClinePreToolUsePayload {
+    toolName: string;
+    parameters: Record<string, string>;
+}
+/** Nested payload for the `tool_result` event. */
+export interface ClinePostToolUsePayload {
+    toolName: string;
+    parameters: Record<string, string>;
+    result?: string;
+    success?: boolean;
+    executionTimeMs?: number;
+}
+/** Nested payload for the `prompt_submit` event. */
+export interface ClineUserPromptSubmitPayload {
+    prompt: string;
+    attachments?: unknown[];
+}
+/** Nested payload for the `pre_compact` event. */
+export interface ClinePreCompactPayload {
+    [key: string]: unknown;
+}
+export interface ClineHookInput {
+    /** Snake_case event name carried in the payload (NOT the script filename). */
+    hookName: ClineHookEventName | string;
+    /** Stable identifier for the current Cline task/session. */
+    taskId: string;
+    /** Workspace root paths Cline is operating against. */
+    workspaceRoots?: string[];
+    /** Version string reported by the Cline binary. */
+    clineVersion?: string;
+    /** ISO-8601 timestamp of the event. */
+    timestamp?: string;
+    /** Identity of the user driving the session, when known. */
+    userId?: string;
+    /** Identity of the agent, when known. */
+    agent_id?: string;
+    /** Parent agent identity for sub-agent invocations, when known. */
+    parent_agent_id?: string;
+    /** Present on `tool_call`. */
+    preToolUse?: ClinePreToolUsePayload;
+    /** Present on `tool_result`. */
+    postToolUse?: ClinePostToolUsePayload;
+    /** Present on `prompt_submit`. */
+    userPromptSubmit?: ClineUserPromptSubmitPayload;
+    /** Present on `pre_compact`. */
+    preCompact?: ClinePreCompactPayload;
+}
+/**
+ * Cline file-hook output written to stdout.
+ *
+ * For `tool_call`, `cancel: true` prevents the tool from running.
+ * `errorMessage` is surfaced to the user; `contextModification` is injected
+ * into the model context (50k char cap). All fields are optional — emitting
+ * `{}` (or nothing) lets the action proceed.
+ *
+ * Verified against cline@3.0.29.
+ */
+export interface ClineHookOutput {
+    cancel?: boolean;
+    errorMessage?: string;
+    contextModification?: string;
+}

package/dist/types.js

@@ -0,0 +1,18 @@
+"use strict";
+/**
+ * Cline file-hook event payload delivered on stdin.
+ *
+ * Cline invokes hooks as executable scripts whose name matches the event in
+ * PascalCase (`TaskStart`, `PreToolUse`, …), placed in a hooks directory. Each
+ * script receives the event payload as JSON on stdin and may write a JSON
+ * decision to stdout. A tool-call decision of `{ "cancel": true }` prevents the
+ * tool. Hooks have a 30s timeout and `contextModification` is capped at 50k
+ * characters.
+ *
+ * The on-disk script filenames are PascalCase, but the `hookName` field
+ * carried *inside* the stdin payload is the snake_case `HookEventName` enum.
+ * Tool-specific fields are nested under per-event sub-objects, not flat.
+ *
+ * Verified against cline@3.0.29 (@cline/shared/dist/hooks/events.d.ts).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/package.json

@@ -0,0 +1,86 @@
+{
+  "name": "@ory/cline",
+  "version": "0.10.0",
+  "description": "Ory plugin for Cline: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
+  "license": "Apache-2.0",
+  "homepage": "https://ory.com",
+  "keywords": [
+    "ory",
+    "cline",
+    "cline-cli",
+    "hooks",
+    "plugin",
+    "extension",
+    "identity",
+    "identity-management",
+    "iam",
+    "authentication",
+    "authorization",
+    "access-control",
+    "permissions",
+    "rbac",
+    "zanzibar",
+    "oauth",
+    "oauth2",
+    "openid-connect",
+    "oidc",
+    "session",
+    "mfa",
+    "sso",
+    "audit",
+    "audit-log",
+    "compliance",
+    "agent",
+    "ai-agent",
+    "agent-security",
+    "guardrails",
+    "llm",
+    "tracing",
+    "distributed-tracing",
+    "observability",
+    "kratos",
+    "keto",
+    "hydra"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/",
+    "provenance": true
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "ory-cline": "dist/cli/main.js",
+    "ory-cline-hook": "dist/hook.js",
+    "ory-cline-setup": "dist/cli/setup.js"
+  },
+  "files": [
+    "dist",
+    "!dist/dev",
+    "!dist/**/*.tsbuildinfo"
+  ],
+  "dependencies": {
+    "@ory/argus": "0.10.0"
+  },
+  "devDependencies": {
+    "typescript": "^6.0.2",
+    "vitest": "4.1.4"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "tsc",
+    "clean": "rm -rf dist *.tsbuildinfo",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "dev": "node dist/dev/launcher.js"
+  }
+}