@ory/continue 0.10.0 → 0.11.0

package/README.md

@@ -33,7 +33,7 @@ Two independent things, and you can use either on its own:
 npx -y -p @ory/continue ory-continue install
 ```
 
-Continue has no native extension-install command, so `install` writes the Ory hooks directly into `<project>/.continue/settings.json` and materializes the Ory skills under `<project>/.continue/skills/`. Continue surfaces each skill as a slash command automatically, so the local-stack commands (`/local-up`, `/local-down`, `/temporal-up`) ship as skills too. Confirm everything landed:
+Continue has no native extension-install command, so `install` writes the Ory hooks directly into `<project>/.continue/settings.json` and materializes the Ory skills under `<project>/.continue/skills/`. Continue surfaces each skill as a slash command automatically, so the local-stack commands ship as skills too and surface as `/ory-local-up`, `/ory-local-down`, and `/ory-temporal-up`. Confirm everything landed:
 
 ```bash
 npx -y -p @ory/continue ory-continue status
@@ -51,7 +51,7 @@ npx -y -p @ory/continue ory-continue uninstall
 
 From any project where you'd like Ory authentication, inside Continue:
 
-1. **Start a local Ory instance.** Ask Continue *"start the local Ory stack"* or run `/local-up`. A banner prints the seeded test user's email and password — note them.
+1. **Start a local Ory instance.** Ask Continue *"start the local Ory stack"* or run `/ory-local-up`. A banner prints the seeded test user's email and password — note them.
 2. **Scaffold Ory into your project.** Ask Continue *"add Ory auth to this app"* (the `ory-auth-setup` skill). It installs Ory Elements, wires the SDK, and generates the login / registration / recovery / settings pages, all targeting the local stack.
 3. **Sign in.** Start your app, visit the login page, and sign in with the seeded credentials. You now have a real Ory session backed by a real Ory stack — locally, offline, zero configuration.
 
@@ -64,7 +64,7 @@ Continue runs the Ory plugin as a **subprocess hook**, the same way [Claude Code
 The hooks wire into these phases:
 
 - **SessionStart** — run the user and agent auth gates.
-- **PreToolUse / PermissionRequest** — check the tool against Ory Permissions; deny blocks the call (exit code 2) in enforce mode.
+- **PreToolUse / PermissionRequest** — check the tool against Ory Permissions. In enforce mode a `PreToolUse` deny blocks the call with exit code 2, while a `PermissionRequest` deny is returned as a structured deny decision in the hook output. In observe mode a permission-request deny is recorded as an audit span and falls through to Continue's native user prompt — it is never pre-approved on the user's behalf.
 - **SubagentStart / SubagentStop** — resolve a distinct identity for typed sub-agents and record their lifecycle.
 - **PostToolUse / Stop / SessionEnd** — trace-only audit spans.
 

package/dist/cli/assets.js

@@ -76,8 +76,11 @@ function safeRmEmpty(dir) {
  */
 function installContinueOryAssets(root) {
     fs.mkdirSync(root, { recursive: true });
+    // `skills/` is shared with user-authored skills, so never wipe the whole
+    // directory — surgically remove only the Ory-owned skill dirs (same list
+    // the uninstall path uses) before re-writing them fresh.
     const skillsDir = path.join(root, "skills");
-    fs.rmSync(skillsDir, { recursive: true, force: true });
+    (0, argus_1.removeSkillDirs)(skillsDir, [...argus_1.ORY_SKILL_NAMES, ...argus_1.ORY_COMMAND_SKILL_NAMES]);
     const guideSkills = (0, argus_1.renderOrySkills)(HARNESS, RENDER_OPTS);
     const commandSkills = (0, argus_1.renderOryCommands)(HARNESS, RENDER_OPTS).map(argus_1.commandToSkill);
     (0, argus_1.writeSkillTree)(skillsDir, [...guideSkills, ...commandSkills]);

package/dist/handlers.js

@@ -412,9 +412,14 @@ async function handlePermissionRequest(input, client) {
         if (decision.kind === "deny") {
             return permissionRequestDecision("deny", (0, argus_1.formatDenialMessage)({ tool: toolName, subjectId, namespace }));
         }
-        return permissionRequestDecision("allow", decision.kind === "observe"
-            ? "Ory observe mode — denied by policy but allowed through"
-            : "Ory permission granted");
+        if (decision.kind === "observe") {
+            // Observe-mode deny: the permission.observe_deny audit span is already
+            // recorded by the gate. Omit `decision` so Continue falls through to
+            // its native user prompt — observe mode must never escalate a
+            // policy-denied tool into an auto-approval.
+            return permissionRequestFallback("Ory observe mode — denied by policy, deferring to user");
+        }
+        return permissionRequestDecision("allow", "Ory permission granted");
     }
     catch (err) {
         const oryErr = err;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/continue",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Ory plugin for Continue CLI (cn): scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -67,7 +67,7 @@
     "!dist/**/*.tsbuildinfo"
   ],
   "dependencies": {
-    "@ory/argus": "0.10.0"
+    "@ory/argus": "0.11.0"
   },
   "engines": {
     "node": ">=22"