@ory/codex 0.10.0 → 0.11.0

package/README.md

@@ -30,8 +30,8 @@ If you're just exploring, do the Quickstart first.
 No prior `npm install` required:
 
 ```bash
-npx @ory/codex install     # registers the Ory marketplace + plugin with `codex`
-npx @ory/codex uninstall   # removes both
+npx -y -p @ory/codex ory-codex install     # registers the Ory marketplace + plugin with `codex`
+npx -y -p @ory/codex ory-codex uninstall   # removes both
 ```
 
 Then confirm everything landed:
@@ -255,7 +255,7 @@ Highlights:
 - **`ory-local-up` fails.** Make sure Docker is running and ports `4455` (login UI), `4000`, `4100`, and `16686` are free.
 - **PKCE login loops.** Clear persisted state with `npx -y -p @ory/codex ory-codex agent unregister` and retry.
 - **`npx` fetches an old version.** Force a fresh fetch: `npx -y -p @ory/codex@latest ory-codex …`.
-- **`npm install … ENOVERSIONS`.** If your `~/.npmrc` sets `min-release-age`, npm filters out package versions newer than that threshold. Override per-call with `npm_config_min_release_age=0 npx @ory/codex install`.
+- **`npm install … ENOVERSIONS`.** If your `~/.npmrc` sets `min-release-age`, npm filters out package versions newer than that threshold. Override per-call with `npm_config_min_release_age=0 npx -y -p @ory/codex ory-codex install`.
 - **`codex doctor` reports `ory-mcp-server is not resolvable`.** The bundled MCP server resolves via `npx -y -p @ory/mcp-server` on demand — make sure `npm`/`npx` is on PATH. The first session start fetches the server tarball; subsequent sessions reuse the cache.
 - **Need more signal.** Set `ORY_AGENT_DEBUG=true` and `ORY_AGENT_LOG_FILE=/tmp/ory.log` to capture structured logs.
 

package/dist/handlers.d.ts

@@ -14,3 +14,13 @@ export interface HandleHookEventDeps {
  * `[features] codex_hooks = true` in `~/.codex/config.toml`.
  */
 export declare function handleHookEvent(input: CodexHookInput, client: OryAgentClient, deps?: HandleHookEventDeps): Promise<CodexHookOutput>;
+/**
+ * Whether a hook output carries anything Codex needs to see on stdout.
+ *
+ * The hook entry point handles `decision === "block"` (exit code 2 + stdout)
+ * before consulting this. Everything else with at least one populated field
+ * must be written to stdout — most importantly `hookSpecificOutput`, which
+ * carries the PermissionRequest allow/deny decision. Empty outputs stay
+ * silent to keep stdout clean for the harness.
+ */
+export declare function shouldEmitOutput(output: CodexHookOutput): boolean;

package/dist/handlers.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleHookEvent = handleHookEvent;
+exports.shouldEmitOutput = shouldEmitOutput;
 const argus_1 = require("@ory/argus");
 /**
  * Route a Codex hook event to the appropriate Ory integration.
@@ -68,6 +69,12 @@ async function handleSessionStart(input, client, deps) {
     // attaches the agent's bearer token to outgoing Ory API calls.
     const agentGate = deps.agentGate ?? argus_1.ensureAgentIdentity;
     await agentGate(client, { projectUrl: (0, argus_1.resolveConfig)().projectUrl, harness: "codex" });
+    // Record the user→agent delegation so the audit trail captures that
+    // this user authorized this agent for this session. Best-effort:
+    // requires both principals to be populated, and any failure is logged
+    // and swallowed (fail-open — delegation tracking is for audit, not
+    // enforcement).
+    await recordUserDelegatesAgent(client);
     if (!decision.proceed) {
         return { decision: "block", reason: decision.reason };
     }
@@ -416,9 +423,55 @@ async function handleStop(input, client) {
     return {};
 }
 // ─── Helpers ────────────────────────────────────────────────────────
+/**
+ * Whether a hook output carries anything Codex needs to see on stdout.
+ *
+ * The hook entry point handles `decision === "block"` (exit code 2 + stdout)
+ * before consulting this. Everything else with at least one populated field
+ * must be written to stdout — most importantly `hookSpecificOutput`, which
+ * carries the PermissionRequest allow/deny decision. Empty outputs stay
+ * silent to keep stdout clean for the harness.
+ */
+function shouldEmitOutput(output) {
+    return Object.values(output).some((value) => value !== undefined);
+}
 function resolveNamespace() {
     return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
 }
+/**
+ * Write the user→agent delegation tuple. Idempotent and fail-open:
+ * requires both principal subjects to be populated; any error (including
+ * an unconfigured projectUrl, which manifests as a network_error) is
+ * logged and swallowed. Purely audit-trail data — does not affect
+ * enforcement.
+ */
+async function recordUserDelegatesAgent(client) {
+    const user = client.userPrincipal.subject;
+    const agent = client.agentPrincipal.subject;
+    if (!user || !agent) {
+        client.logger.debug("delegation.skip", {
+            reason: "missing principal",
+            hasUser: !!user,
+            hasAgent: !!agent,
+        });
+        return;
+    }
+    try {
+        await client.createRelationship({
+            namespace: resolveNamespace(),
+            object: `agent:${agent}`,
+            relation: "delegate",
+            subjectId: `user:${user}`,
+        }, { spanAttributes: { delegation: "user-to-agent" } });
+    }
+    catch (err) {
+        const oryErr = err;
+        client.logger.warn("delegation.user_to_agent.failed", {
+            code: oryErr.code,
+            message: oryErr.message,
+        });
+    }
+}
 function handlePermissionError(oryErr, toolName, client) {
     if (oryErr.code === "network_error") {
         client.logger.warn("permission.network_error", {

package/dist/hook.js

@@ -62,7 +62,7 @@ async function main() {
         await client.tracer.shutdown();
         process.exit(2);
     }
-    if (output.oryConfigRequired || output.message) {
+    if ((0, handlers_js_1.shouldEmitOutput)(output)) {
         process.stdout.write(JSON.stringify(output));
     }
     await client.tracer.shutdown();

package/dist/index.d.ts

@@ -1 +1 @@
-export { handleHookEvent } from "./handlers.js";
+export { handleHookEvent, shouldEmitOutput } from "./handlers.js";

package/dist/index.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.handleHookEvent = void 0;
+exports.shouldEmitOutput = exports.handleHookEvent = void 0;
 var handlers_js_1 = require("./handlers.js");
 Object.defineProperty(exports, "handleHookEvent", { enumerable: true, get: function () { return handlers_js_1.handleHookEvent; } });
+Object.defineProperty(exports, "shouldEmitOutput", { enumerable: true, get: function () { return handlers_js_1.shouldEmitOutput; } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/codex",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Ory plugin for Codex: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -66,7 +66,7 @@
     "marketplace"
   ],
   "dependencies": {
-    "@ory/argus": "0.10.0"
+    "@ory/argus": "0.11.0"
   },
   "engines": {
     "node": ">=22"