@ory/codex 0.6.1 → 0.7.0

package/README.md

@@ -20,16 +20,14 @@ npx @ory/codex install     # registers the Ory marketplace + plugin with `codex`
 npx @ory/codex uninstall   # removes both
 ```
 
-Under the hood the installer runs `codex plugin marketplace add <local-dir>` and `codex plugin add ory-codex@ory`, so the plugin is owned by Codex's plugin system — same as every other Codex marketplace plugin. Skills, slash commands, hooks, and the Ory MCP server are all part of the plugin payload. Re-running `install` is idempotent and refreshes the rendered skills + commands from the latest template.
-
-Verify the install with Codex's native tooling:
+Then confirm everything landed:
 
 ```bash
-codex plugin list      # shows ory-codex@ory installed + enabled
-codex mcp list         # shows the bundled `ory` MCP server
-codex doctor           # surfaces any config or MCP resolvability issues
+npx -y -p @ory/codex ory-codex status
 ```
 
+`status` is the single source of truth — it prints configuration, user and agent identity, per-tool permission coverage, plugin + skill registration, and a tail of recent debug logs. Unconfigured fields show inline as `(unset)`.
+
 ## Quickstart (≈ 3 minutes)
 
 From any project where you'd like Ory authentication, inside Codex:
@@ -44,13 +42,13 @@ From any project where you'd like Ory authentication, inside Codex:
 
 3. **Sign in.** Start your app, visit the login page Codex added, and sign in with the seeded credentials. You now have a real Ory session backed by a real Ory stack — locally, offline, with zero configuration.
 
-4. **Turn on Ory login for the Codex session itself.** *(Optional but recommended.)* Out of the box the plugin only governs your *app*. To also attach an Ory identity to *Codex's* session — so every tool call is attributed to you, not a fallback `session:<id>` subject — set:
+4. **Turn on Ory login for the Codex session itself.** *(Optional but recommended.)* Out of the box the plugin only governs your *app*. To also attach an Ory identity to *Codex's* session — so every tool call is attributed to you, not a fallback `session:<id>` subject — opt in to the user-login flow:
 
    ```bash
-   export ORY_AUTH_GATE=1
+   export ORY_USER_LOGIN=1
    ```
 
-   Then restart Codex. On next session start, Codex opens an Ory login in your browser; sign in with the same seeded credentials from step 1. This is what makes `permissions enforce` (see [Agent security](#agent-security)) deny on the right identity later.
+   User login is off by default. With it on, the next Codex session opens an Ory login in your browser; sign in with the same seeded credentials from step 1, and the token is reused on subsequent sessions until it expires. This is what makes `permissions enforce` (see [Agent security](#agent-security)) deny on the right identity later.
 
 That's the full Ory DX path. Stop here if you're just evaluating the plugin. Continue to [Agent security](#agent-security) when you're ready to enforce.
 
@@ -109,7 +107,7 @@ Without configuration the plugin still loads cleanly and runs in **pass-through
 
 Once the plugin is pointed at an Ory project (local or hosted), Codex's session and every tool call can be governed by Ory.
 
-- **Authentication.** Two identities. The human at the keyboard (the **user**) authenticates interactively via Ory Identities when `ORY_AUTH_GATE=1` is set. The Codex process (the **agent**) gets its own OAuth2 identity, self-registered via [Dynamic Client Registration (RFC 7591)](https://datatracker.ietf.org/doc/html/rfc7591) on first run.
+- **Authentication.** Two identities. The human at the keyboard (the **user**) authenticates interactively via Ory Identities when user login is enabled (`ORY_USER_LOGIN=1`, off by default — browser PKCE flow on first session, persisted token thereafter). The Codex process (the **agent**) gets its own OAuth2 identity, self-registered via [Dynamic Client Registration (RFC 7591)](https://datatracker.ietf.org/doc/html/rfc7591) on first run.
 - **Authorization.** Before any tool runs, the plugin checks [Ory Permissions](https://www.ory.com/docs/keto) (Zanzibar-style relation tuples) against the user's subject and blocks the call on `deny`. MCP tool calls additionally get a server-level check.
 - **Audit.** Every decision (allow, deny, fallback) is recorded as a structured trace span: NDJSON file output and/or OTLP/HTTP export to Jaeger, Honeycomb, Grafana, and similar collectors. The user → agent delegation is written to Ory as a relation tuple so *"agent X acting on behalf of user Y"* stays queryable after tokens expire.
 
@@ -119,10 +117,10 @@ The plugin is **fail-open** on its own infrastructure failures (network errors,
 
 After install the plugin runs in **observe mode**: every tool call is checked against Ory Permissions, but a deny is recorded as a `permission.observe_deny` audit span and the tool runs anyway. This lets you see what *would* be blocked before turning on hard blocking.
 
-1. **Turn on the user gate.** In your shell:
+1. **Turn on user login.** It's off by default. In your shell:
 
    ```bash
-   export ORY_AUTH_GATE=1
+   export ORY_USER_LOGIN=1
    ```
 
    The next Codex session opens a browser for PKCE login. Subsequent sessions reuse the persisted token until it expires.

package/dist/cli/setup.js

@@ -257,8 +257,8 @@ function printNextSteps() {
     console.log("");
     console.log("  2. Or spin up the local Ory stack from inside Codex (`/skills` -> `ory-local-up`).");
     console.log("");
-    console.log("  3. Turn on the interactive user login gate (opt-in):");
-    console.log("       export ORY_AUTH_GATE=1");
+    console.log("  3. Turn on the interactive user login (opt-in):");
+    console.log("       export ORY_USER_LOGIN=1");
     console.log("     Without this, Codex runs without a human Ory identity attached to the");
     console.log("     session and permission checks fall back to a session:<id> subject.");
     console.log("");

package/dist/handlers.d.ts

@@ -1,8 +1,8 @@
 import { OryAgentClient, ensureUserAuthenticated, ensureAgentIdentity } from "@ory/argus";
 import type { CodexHookInput, CodexHookOutput } from "./types.js";
 export interface HandleHookEventDeps {
-    /** Test injection point for the user auth gate. */
-    authGate?: typeof ensureUserAuthenticated;
+    /** Test injection point for the user login flow. */
+    userLogin?: typeof ensureUserAuthenticated;
     /** Test injection point for the agent identity gate. */
     agentGate?: typeof ensureAgentIdentity;
 }

package/dist/handlers.js

@@ -58,7 +58,7 @@ async function handleSessionStart(input, client, deps) {
     client.tracer.record("session.start", "ok", {
         attributes: { model: input.model },
     });
-    const userGate = deps.authGate ?? argus_1.ensureUserAuthenticated;
+    const userGate = deps.userLogin ?? argus_1.ensureUserAuthenticated;
     const decision = await userGate(client, {
         binName: "ory-codex",
         harness: "codex",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/codex",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "Ory plugin for Codex: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -66,7 +66,7 @@
     "marketplace"
   ],
   "dependencies": {
-    "@ory/argus": "0.6.1"
+    "@ory/argus": "0.7.0"
   },
   "engines": {
     "node": ">=22"