@ory/codex 0.14.0 → 1.0.0

package/dist/session-state.d.ts

@@ -0,0 +1,3 @@
+export declare function hasCodexSessionStarted(sessionId: string): boolean;
+export declare function markCodexSessionStarted(sessionId: string): void;
+export declare function clearCodexSessionStarts(): void;

package/dist/session-state.js

@@ -0,0 +1,61 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasCodexSessionStarted = hasCodexSessionStarted;
+exports.markCodexSessionStarted = markCodexSessionStarted;
+exports.clearCodexSessionStarts = clearCodexSessionStarts;
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const argus_1 = require("@ory/argus");
+const SESSION_START_DIR = "session-started";
+function sessionStartPath(sessionId) {
+    const digest = (0, node_crypto_1.createHash)("sha256").update(sessionId).digest("hex");
+    return path.join((0, argus_1.getHarnessDataDir)("codex"), SESSION_START_DIR, digest);
+}
+function hasCodexSessionStarted(sessionId) {
+    return fs.existsSync(sessionStartPath(sessionId));
+}
+function markCodexSessionStarted(sessionId) {
+    const marker = sessionStartPath(sessionId);
+    fs.mkdirSync(path.dirname(marker), { recursive: true });
+    fs.writeFileSync(marker, "", { flag: "a" });
+}
+function clearCodexSessionStarts() {
+    fs.rmSync(path.join((0, argus_1.getHarnessDataDir)("codex"), SESSION_START_DIR), {
+        recursive: true,
+        force: true,
+    });
+}

package/dist/types.d.ts

@@ -10,6 +10,7 @@
  *   - `"apply_patch"` — canonical name for file edits. `Write`/`Edit` are
  *     matcher aliases only; the serialized name is always `apply_patch`.
  *   - `"mcp__<server>__<tool>"` for MCP tools.
+ *   - `"collaborationspawn_agent"` for a Codex collaboration Sub-Agent spawn.
  *
  * Supported events: SessionStart, PreToolUse, PostToolUse, PermissionRequest,
  * UserPromptSubmit, Stop.

package/marketplace/plugins/ory-codex/.codex-plugin/plugin.json

@@ -24,7 +24,7 @@
   "interface": {
     "displayName": "Ory",
     "shortDescription": "Authn/authz and audit for every Codex tool call",
-    "longDescription": "Adds Ory Identities, Permissions, and audit logging to Codex. Auth gate on session start, per-tool permission checks before every invocation, structured trace spans on every decision, and a bundled Ory MCP server for managing identities, OAuth2 clients, and permission tuples from inside Codex.",
+    "longDescription": "Adds Ory Identities, Permissions, and audit logging to Codex. Auth gate on session start, per-tool permission checks before every invocation, privacy-safe activity events for every decision, and a bundled Ory MCP server for managing identities, OAuth2 clients, and permission tuples from inside Codex.",
     "developerName": "Ory",
     "category": "Security",
     "capabilities": ["Write"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/codex",
-  "version": "0.14.0",
+  "version": "1.0.0",
   "description": "Ory plugin for Codex: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -34,8 +34,7 @@
     "agent-security",
     "guardrails",
     "llm",
-    "tracing",
-    "distributed-tracing",
+    "activity-auditing",
     "observability",
     "kratos",
     "keto",
@@ -46,6 +45,10 @@
     "registry": "https://registry.npmjs.org/",
     "provenance": true
   },
+  "reova": {
+    "enabled": true,
+    "endpoint": "https://telemetry.reo.dev/data"
+  },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
@@ -61,13 +64,12 @@
   },
   "files": [
     "dist",
-    "!dist/dev",
     "!dist/**/*.tsbuildinfo",
     "marketplace"
   ],
   "dependencies": {
-    "reo-census": "^1.2.8",
-    "@ory/argus": "0.14.0"
+    "reova": "^0.7.0",
+    "@ory/argus": "1.0.0"
   },
   "engines": {
     "node": ">=22"
@@ -77,7 +79,6 @@
     "clean": "rm -rf dist *.tsbuildinfo",
     "test": "vitest run",
     "test:watch": "vitest",
-    "typecheck": "tsc --noEmit",
-    "dev": "node dist/dev/launcher.js"
+    "typecheck": "tsc --noEmit"
   }
 }