@ory/codex 0.13.9 → 1.0.0

package/dist/hook.js

@@ -10,6 +10,16 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const argus_1 = require("@ory/argus");
 const handlers_js_1 = require("./handlers.js");
+const EVENT_FLUSH_TIMEOUT_MS = 750;
+let client;
+async function flushEvents() {
+    try {
+        await client?.flushEvents(EVENT_FLUSH_TIMEOUT_MS);
+    }
+    catch {
+        // The hook decision must not depend on activity delivery.
+    }
+}
 /**
  * Read all of stdin as a string.
  *
@@ -21,29 +31,42 @@ function readStdin() {
     return new Promise((resolve, reject) => {
         const chunks = [];
         let resolved = false;
+        let idleTimer;
+        function cleanup() {
+            if (idleTimer)
+                clearTimeout(idleTimer);
+            process.stdin.off("data", onData);
+            process.stdin.off("end", done);
+            process.stdin.off("error", onError);
+            process.stdin.pause();
+        }
         function done() {
             if (!resolved) {
                 resolved = true;
+                cleanup();
                 resolve(Buffer.concat(chunks).toString("utf-8"));
             }
         }
-        process.stdin.on("data", (chunk) => {
+        function onData(chunk) {
             chunks.push(chunk);
-            clearTimeout(idleTimer);
+            if (idleTimer)
+                clearTimeout(idleTimer);
             idleTimer = setTimeout(done, 100);
-        });
-        process.stdin.on("end", done);
-        process.stdin.on("error", (err) => {
+        }
+        function onError(err) {
             if (!resolved) {
                 resolved = true;
+                cleanup();
                 reject(err);
             }
-        });
-        let idleTimer;
+        }
+        process.stdin.on("data", onData);
+        process.stdin.on("end", done);
+        process.stdin.on("error", onError);
     });
 }
 async function main() {
-    const client = argus_1.OryAgentClient.fromEnv("codex");
+    client = argus_1.OryAgentClient.fromEnv("codex");
     const raw = await readStdin();
     let input;
     try {
@@ -51,24 +74,26 @@ async function main() {
     }
     catch {
         client.logger.error("hook.stdin.parse_failed", { raw: raw.slice(0, 200) });
-        await client.tracer.shutdown();
-        process.exit(0); // Don't block on parse errors
+        process.exitCode = 0; // Don't block on parse errors
+        return;
     }
     const output = await (0, handlers_js_1.handleHookEvent)(input, client);
     if (output.decision === "block") {
         // Codex reads the block reason from stderr
         process.stderr.write(output.reason ?? "Blocked by Ory agent plugin");
         process.stdout.write(JSON.stringify(output));
-        await client.tracer.shutdown();
-        process.exit(2);
+        await flushEvents();
+        process.exitCode = 2;
+        return;
     }
     if ((0, handlers_js_1.shouldEmitOutput)(output)) {
         process.stdout.write(JSON.stringify(output));
     }
-    await client.tracer.shutdown();
-    process.exit(0);
+    await flushEvents();
+    process.exitCode = 0;
 }
-main().catch((err) => {
+main().catch(async (err) => {
     process.stderr.write(`[ory-agent] fatal: ${err}\n`);
-    process.exit(0); // Fail open
+    await flushEvents();
+    process.exitCode = 0; // Fail open
 });

package/dist/session-state.d.ts

@@ -0,0 +1,3 @@
+export declare function hasCodexSessionStarted(sessionId: string): boolean;
+export declare function markCodexSessionStarted(sessionId: string): void;
+export declare function clearCodexSessionStarts(): void;

package/dist/session-state.js

@@ -0,0 +1,61 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasCodexSessionStarted = hasCodexSessionStarted;
+exports.markCodexSessionStarted = markCodexSessionStarted;
+exports.clearCodexSessionStarts = clearCodexSessionStarts;
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const argus_1 = require("@ory/argus");
+const SESSION_START_DIR = "session-started";
+function sessionStartPath(sessionId) {
+    const digest = (0, node_crypto_1.createHash)("sha256").update(sessionId).digest("hex");
+    return path.join((0, argus_1.getHarnessDataDir)("codex"), SESSION_START_DIR, digest);
+}
+function hasCodexSessionStarted(sessionId) {
+    return fs.existsSync(sessionStartPath(sessionId));
+}
+function markCodexSessionStarted(sessionId) {
+    const marker = sessionStartPath(sessionId);
+    fs.mkdirSync(path.dirname(marker), { recursive: true });
+    fs.writeFileSync(marker, "", { flag: "a" });
+}
+function clearCodexSessionStarts() {
+    fs.rmSync(path.join((0, argus_1.getHarnessDataDir)("codex"), SESSION_START_DIR), {
+        recursive: true,
+        force: true,
+    });
+}

package/dist/types.d.ts

@@ -10,6 +10,7 @@
  *   - `"apply_patch"` — canonical name for file edits. `Write`/`Edit` are
  *     matcher aliases only; the serialized name is always `apply_patch`.
  *   - `"mcp__<server>__<tool>"` for MCP tools.
+ *   - `"collaborationspawn_agent"` for a Codex collaboration Sub-Agent spawn.
  *
  * Supported events: SessionStart, PreToolUse, PostToolUse, PermissionRequest,
  * UserPromptSubmit, Stop.

package/marketplace/plugins/ory-codex/.codex-plugin/plugin.json

@@ -24,7 +24,7 @@
   "interface": {
     "displayName": "Ory",
     "shortDescription": "Authn/authz and audit for every Codex tool call",
-    "longDescription": "Adds Ory Identities, Permissions, and audit logging to Codex. Auth gate on session start, per-tool permission checks before every invocation, structured trace spans on every decision, and a bundled Ory MCP server for managing identities, OAuth2 clients, and permission tuples from inside Codex.",
+    "longDescription": "Adds Ory Identities, Permissions, and audit logging to Codex. Auth gate on session start, per-tool permission checks before every invocation, privacy-safe activity events for every decision, and a bundled Ory MCP server for managing identities, OAuth2 clients, and permission tuples from inside Codex.",
     "developerName": "Ory",
     "category": "Security",
     "capabilities": ["Write"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/codex",
-  "version": "0.13.9",
+  "version": "1.0.0",
   "description": "Ory plugin for Codex: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -34,8 +34,7 @@
     "agent-security",
     "guardrails",
     "llm",
-    "tracing",
-    "distributed-tracing",
+    "activity-auditing",
     "observability",
     "kratos",
     "keto",
@@ -46,6 +45,10 @@
     "registry": "https://registry.npmjs.org/",
     "provenance": true
   },
+  "reova": {
+    "enabled": true,
+    "endpoint": "https://telemetry.reo.dev/data"
+  },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
@@ -61,13 +64,12 @@
   },
   "files": [
     "dist",
-    "!dist/dev",
     "!dist/**/*.tsbuildinfo",
     "marketplace"
   ],
   "dependencies": {
-    "reo-census": "^1.2.8",
-    "@ory/argus": "0.13.9"
+    "reova": "^0.7.0",
+    "@ory/argus": "1.0.0"
   },
   "engines": {
     "node": ">=22"
@@ -77,7 +79,6 @@
     "clean": "rm -rf dist *.tsbuildinfo",
     "test": "vitest run",
     "test:watch": "vitest",
-    "typecheck": "tsc --noEmit",
-    "dev": "node dist/dev/launcher.js"
+    "typecheck": "tsc --noEmit"
   }
 }