@ory/continue 0.13.7 → 0.13.9

package/dist/handlers.js

@@ -83,9 +83,9 @@ async function handleSessionStart(input, client, deps) {
     // Ory API calls.
     const agentGate = deps.agentGate ?? argus_1.ensureAgentIdentity;
     await agentGate(client, { projectUrl: (0, argus_1.resolveConfig)().projectUrl, harness: HARNESS });
-    // Record the user→agent delegation for the audit trail. Best-effort and
-    // fail-open.
-    await recordUserDelegatesAgent(client);
+    // Record the user→agent delegation for the audit trail. Best-effort,
+    // fail-open, and written at most once per install.
+    await (0, argus_1.writeUserDelegatesAgent)(client);
     if (!decision.proceed) {
         return { decision: "block", reason: decision.reason };
     }
@@ -450,40 +450,10 @@ function permissionRequestFallback(reason) {
 function resolveNamespace() {
     return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
 }
-/**
- * Write the user→agent delegation tuple. Idempotent and fail-open: requires
- * both principal subjects to be populated; any error is logged and swallowed.
- */
-async function recordUserDelegatesAgent(client) {
-    const user = client.userPrincipal.subject;
-    const agent = client.agentPrincipal.subject;
-    if (!user || !agent) {
-        client.logger.debug("delegation.skip", {
-            reason: "missing principal",
-            hasUser: !!user,
-            hasAgent: !!agent,
-        });
-        return;
-    }
-    try {
-        await client.createRelationship({
-            namespace: resolveNamespace(),
-            object: `agent:${agent}`,
-            relation: "delegate",
-            subjectId: `user:${user}`,
-        }, { spanAttributes: { delegation: "user-to-agent" } });
-    }
-    catch (err) {
-        const oryErr = err;
-        client.logger.warn("delegation.user_to_agent.failed", {
-            code: oryErr.code,
-            message: oryErr.message,
-        });
-    }
-}
 /**
  * Register an OAuth2 identity for a sub-agent and write the
- * `agent → subagent` delegation tuple. Fail-open and idempotent.
+ * `agent → subagent` delegation tuple. Fail-open and written at most once
+ * per install.
  */
 async function registerSubAgent(subAgentType, client, deps) {
     const subAgentGate = deps.subAgentGate ?? argus_1.ensureSubAgentIdentity;
@@ -504,30 +474,7 @@ async function registerSubAgent(subAgentType, client, deps) {
     }
     if (identity.kind !== "dynamic" || !identity.subject)
         return;
-    const agent = client.agentPrincipal.subject;
-    if (!agent) {
-        client.logger.debug("delegation.skip", {
-            reason: "agent principal not populated",
-            subAgentType,
-        });
-        return;
-    }
-    try {
-        await client.createRelationship({
-            namespace: resolveNamespace(),
-            object: `subagent:${identity.subject}`,
-            relation: "delegate",
-            subjectId: `agent:${agent}`,
-        }, { spanAttributes: { delegation: "agent-to-subagent", subAgentType } });
-    }
-    catch (err) {
-        const oryErr = err;
-        client.logger.warn("delegation.agent_to_subagent.failed", {
-            subAgentType,
-            code: oryErr.code,
-            message: oryErr.message,
-        });
-    }
+    await (0, argus_1.writeAgentDelegatesSubagent)(client, identity.subject, subAgentType);
 }
 /**
  * Fallback for the case where a sub-agent invocation appears as a Task/Agent

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/continue",
-  "version": "0.13.7",
+  "version": "0.13.9",
   "description": "Ory plugin for Continue CLI (cn): scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -68,7 +68,7 @@
   ],
   "dependencies": {
     "reo-census": "^1.2.8",
-    "@ory/argus": "0.13.7"
+    "@ory/argus": "0.13.9"
   },
   "engines": {
     "node": ">=22"