@ory/goose 1.5.3 → 1.6.0

package/README.md

@@ -76,6 +76,24 @@ Once you connect to Ory Agent Security, two more things happen automatically:
 
 Under the hood, Goose runs the plugin as a small program for each thing it does, handing it the event and reading back a decision. The `hooks.json` file maps that: **SessionStart** signs you in (once connected), **PreToolUse** (the one point that can block) runs the permission check, and the rest — **PostToolUse, BeforeReadFile, AfterFileEdit, BeforeShellExecution, Stop, SessionEnd** — just record activity. If Ory is ever unreachable, the plugin gets out of the way and lets Goose keep working, so it can't lock you out.
 
+### MCP extensions
+
+Goose names an extension's tool `<extension>__<tool>`, the extension part
+being its configured name with whitespace dropped and other characters outside
+`[A-Za-z0-9_-]` replaced by `_` (verified against Goose v1.39.0,
+`crates/goose/src/agents/extension_manager.rs`). **PreToolUse** splits that
+name on its first `__` and checks `McpServer:<extension>` and
+`McpTool:<extension>:<tool>`; Agent Security resolves the reported name to a
+cataloged server. Goose's own platform extensions (Developer, Analyze, Summon,
+Code Mode, and Skills, which are unprefixed, plus Todo, Apps, Chat Recall,
+Extension Manager, Summarize, Orchestrator, and Top Of Mind) keep the native
+tool check.
+
+Limits: the hook payload does not say how an extension is launched, so no
+fingerprints are sent, and an extension name containing `__` splits at the
+wrong place. Goose's bundled `goose-mcp` servers (for example
+`computercontroller` or `memory`) are MCP servers and are checked as such.
+
 ### See what's happening
 
 Everything the plugin does is observable out of the box:
@@ -119,7 +137,7 @@ npx -y -p @ory/goose ory-goose configure \
 
 **Ory Network or OEL.** Either works. For an Ory Network project the URL is `https://<slug>.projects.oryapis.com`; for a self-hosted **Ory Enterprise License** deployment, point `--project-url` at that deployment's base URL and use the sign-in client id from its Agent Security configuration. Everything downstream — sign-in, checks, delegation — is identical.
 
-**There is nothing else for you to create.** The sign-in client, permission model, native-tool blocks, MCP grants, and observe/enforce posture are provisioned in the Console by someone with project access. At session start the plugin loads or enrolls Goose's Talos runtime credential in the OS credential store; tool paths only read it. Installing needs no workspace privilege.
+**There is nothing else for you to create.** The sign-in client, permission model, native-tool blocks, MCP server access, and observe/enforce posture are provisioned in the Console by someone with project access. At session start the plugin loads or enrolls Goose's Talos runtime credential in the OS credential store; tool paths only read it. Installing needs no workspace privilege.
 
 Sign-in runs at the start of every session and never blocks — a declined, skipped, or timed-out login simply leaves that session without a user identity.
 

package/dist/handlers.js

@@ -3,6 +3,41 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleHookEvent = handleHookEvent;
 const argus_1 = require("@ory/argus");
 const HARNESS = "goose";
+/**
+ * Goose's in-process platform extensions (`PLATFORM_EXTENSIONS` in
+ * `crates/goose/src/agents/platform_extensions/mod.rs`, v1.39.0). Developer,
+ * Analyze, Summon, Code Mode, and Skills expose unprefixed tools; the others
+ * expose `<key>__<tool>` like an MCP extension but are part of Goose itself,
+ * so they keep the native tool check. Listing the unprefixed ones too keeps
+ * builds that prefixed them (`developer__shell`) on the native check.
+ */
+const PLATFORM_EXTENSIONS = new Set([
+    "analyze",
+    "todo",
+    "apps",
+    "chatrecall",
+    "extensionmanager",
+    "summon",
+    "summarize",
+    "code_execution",
+    "developer",
+    "orchestrator",
+    "tom",
+    "skills",
+]);
+/**
+ * Goose names an extension's tool `<extensionKey>__<tool>`
+ * (`ExtensionManager::get_prefixed_tools`), the key being the configured
+ * extension name with whitespace dropped and characters outside
+ * `[A-Za-z0-9_-]` replaced by `_`. The first `__` splits it, as Goose's own
+ * tool dispatch does.
+ */
+function identifyMcpTool(toolName) {
+    const parsed = (0, argus_1.parseMcpToolWithSeparator)(toolName, "__");
+    if (!parsed || PLATFORM_EXTENSIONS.has(parsed.serverName.toLowerCase()))
+        return undefined;
+    return parsed;
+}
 /** Route a Goose hook event to the appropriate Ory integration. */
 async function handleHookEvent(input, client, deps = {}) {
     const event = input.event;
@@ -32,6 +67,7 @@ async function handleHookEvent(input, client, deps = {}) {
                     toolName,
                     toolArgs: input.tool_input,
                     subjectFallback: `session:${input.session_id}`,
+                    mcpTool: identifyMcpTool(toolName),
                 });
                 return result.blocked
                     ? { action: "block", message: result.denialMessage }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/goose",
-  "version": "1.5.3",
+  "version": "1.6.0",
   "description": "Ory plugin for Goose (Block's open-source agent CLI): scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -69,10 +69,10 @@
   ],
   "dependencies": {
     "reova": "^0.7.0",
-    "@ory/argus": "1.5.3"
+    "@ory/argus": "1.6.0"
   },
   "devDependencies": {
-    "typescript": "^6.0.2"
+    "typescript": "^7.0.2"
   },
   "engines": {
     "node": ">=22"