@ory/codex 0.8.1 → 0.8.2

package/dist/handlers.js

@@ -218,7 +218,18 @@ async function handlePreToolUse(input, client) {
             };
         }
         const namespace = resolveNamespace();
-        const decision = await (0, argus_1.checkAndDecide)(client, { namespace, object: toolName, relation: "use", ...subject }, { spanAttributes: { toolName } });
+        const outcome = await (0, argus_1.gateToolCall)(client, {
+            harness: "codex",
+            toolName,
+            check: { namespace, object: toolName, relation: "use", ...subject },
+            spanAttributes: { toolName },
+        });
+        // Interactive tools (operator-extensible via ORY_INTERACTIVE_TOOLS):
+        // pass through with the user.interaction span already recorded.
+        if (outcome.kind === "interactive") {
+            return {};
+        }
+        const decision = outcome;
         if (decision.kind === "fail_open") {
             return handlePermissionError(decision.error, toolName, client);
         }
@@ -294,6 +305,13 @@ async function handlePermissionRequest(input, client) {
     if ((0, argus_1.resolveConfig)().auditOnly) {
         return permissionRequestFallback("Audit-only mode — deferring to user");
     }
+    // Interactive tools: defer to the user instead of pre-answering.
+    if ((0, argus_1.isInteractiveTool)("codex", toolName)) {
+        client.tracer.record("user.interaction", "ok", {
+            attributes: { harness: "codex", toolName, kind: "permission-request" },
+        });
+        return permissionRequestFallback("Interactive tool — deferring to user");
+    }
     const subject = (0, argus_1.resolveUserSubject)(client, `session:${input.session_id}`);
     const subjectId = (0, argus_1.subjectLabel)(subject);
     const mcpTool = (0, argus_1.parseMcpToolGeneric)(toolName);
@@ -318,7 +336,16 @@ async function handlePermissionRequest(input, client) {
                 : "Ory MCP server permission granted");
         }
         const namespace = resolveNamespace();
-        const decision = await (0, argus_1.checkAndDecide)(client, { namespace, object: toolName, relation: "use", ...subject }, { spanAttributes: { toolName } });
+        const outcome = await (0, argus_1.gateToolCall)(client, {
+            harness: "codex",
+            toolName,
+            check: { namespace, object: toolName, relation: "use", ...subject },
+            spanAttributes: { toolName },
+        });
+        if (outcome.kind === "interactive") {
+            return permissionRequestFallback("Interactive tool — deferring to user");
+        }
+        const decision = outcome;
         if (decision.kind === "fail_open") {
             const code = decision.error.code;
             const reason = code === "network_error" || code === "rate_limited"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/codex",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "Ory plugin for Codex: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -66,7 +66,7 @@
     "marketplace"
   ],
   "dependencies": {
-    "@ory/argus": "0.8.1"
+    "@ory/argus": "0.8.2"
   },
   "engines": {
     "node": ">=22"