@ory/openclaw 0.1.0

package/README.md

@@ -0,0 +1,91 @@
+# Ory Agent Plugin: OpenClaw
+
+[Ory](https://ory.com) bundled into [OpenClaw](https://github.com/openclaw/openclaw): skills that scaffold Ory authentication into your codebase, a local Ory stack you can spin up in one command, and (when pointed at an Ory project) authentication, authorization, and audit for every tool OpenClaw runs.
+
+## Install
+
+OpenClaw loads in-process plugins registered in `.openclaw/config.json`. Install and register in one step, with no prior `npm install` required:
+
+```bash
+npx @ory/openclaw install                          # registers in .openclaw/config.json
+npx @ory/openclaw install --project-dir <path>
+npx @ory/openclaw uninstall
+```
+
+`install` adds the Ory plugin and the Ory MCP server to your OpenClaw config non-destructively (existing entries are preserved) and drops the Ory skill catalog into `.openclaw/skills/`, registered under `skills.load.extraDirs` so OpenClaw discovers it.
+
+## Developer experience
+
+This plugin is a productivity layer for Ory itself. You don't need a real Ory project, an account, or any prior Ory experience to start using it.
+
+### Skills for scaffolding Ory into your application
+
+Ask OpenClaw to add Ory auth to your codebase, or invoke a skill directly. Each skill is a vetted, end-to-end playbook:
+
+- **`ory-auth-setup`**: full project setup. Install the Ory CLI, create an Ory Network project, add Ory Elements, configure the SDK, build the auth pages, wire session middleware.
+- **`ory-login-flow`**: login, registration, recovery, verification, and settings pages with Ory Elements. Next.js App Router and React SPA variants.
+- **`ory-social-login`**: Google, GitHub, Apple, Microsoft, Discord, and other OIDC providers with Jsonnet data mappers.
+- **`ory-local-dev`**: drive the local Ory stack (below) from within OpenClaw to prototype and test against without a remote project.
+
+Skills are versioned with the plugin so guidance stays in sync as Ory APIs evolve.
+
+### Ory MCP server
+
+Bundled and registered automatically. It exposes the Ory CLI and the Ory Network REST API as MCP tools so OpenClaw can manage identities, OAuth2 clients, projects, permission tuples, and configuration without ever leaving the chat. Useful for seeding test data, verifying a scaffolded integration, or running one-off admin tasks.
+
+### Local Ory stack in one command
+
+From OpenClaw's skill picker:
+
+```
+ory-local-up      # start a local Ory instance in Docker
+ory-local-down    # tear it all down
+```
+
+Or via the CLI: `npx ory-openclaw local up | down`.
+
+`local up` runs a local Ory instance in Docker, covering everything the plugin and your scaffolded application need. It also brings up a login UI on `:3000` and Jaeger on `:16686`, all reachable through `http://localhost:4000`. A test user identity is seeded and the credentials are printed for you. Use it to:
+
+- **Learn Ory hands-on** without signing up for a hosted project.
+- **Prototype** flows (login, social, MFA, recovery, permission tuples) against a real Ory backend in your local dev loop.
+- **Test** an auth integration end-to-end before pushing anything to a real environment.
+- **Develop** your application against the same identity, OAuth2, and permission surfaces you'll ship with.
+
+Point `ORY_PROJECT_URL` at `http://localhost:4000` (or run `npx ory-openclaw configure`) and the security features below run against the local stack.
+
+## Configure
+
+```bash
+npx ory-openclaw configure --project-url https://<id>.projects.oryapis.com --api-key ory_pat_...
+```
+
+Config is saved to `~/.config/ory-agent-plugins/config.json` and shared across every Ory agent plugin on the machine. Without it the plugin still loads cleanly and runs in **pass-through mode**: skills work, but nothing is blocked.
+
+## Agent security (Argus)
+
+Once the plugin is pointed at an Ory project (local or hosted), OpenClaw's session and every tool call are governed by Ory.
+
+- **Authentication.** Two identities. The human at the keyboard (the **user**) authenticates interactively via Ory Identities when `ORY_AUTH_GATE=1`; tokens refresh and a `user.auth` audit span is emitted at every session start. The OpenClaw process (the **agent**) gets its own OAuth2 identity, self-registered via Dynamic Client Registration on first run.
+- **Authorization.** Before any tool runs, the plugin checks Ory Permissions against the user's subject and blocks the tool call on `deny`. MCP tool calls additionally get a server-level check.
+- **Audit.** Every decision (allow, deny, fallback) is recorded as a structured trace span: NDJSON file output and/or OTLP/HTTP export to Jaeger, Honeycomb, Grafana, and similar collectors. The user-to-agent delegation is written to Ory as a Zanzibar tuple so "agent X acting on behalf of user Y" stays queryable after tokens expire.
+
+The plugin is **fail-open** on its own infrastructure failures (network errors, rate limits, missing config), so enforcement is only as strong as your tuples; grant explicit `invoke` relations for the tools each user should be able to run.
+
+## CLI
+
+```
+npx ory-openclaw install | uninstall              [--project-dir <path>]
+npx ory-openclaw configure                         [--project-url <url>] [--api-key <key>] [--audit-only]
+npx ory-openclaw agent <status|unregister>         Manage the agent's OAuth2 identity
+npx ory-openclaw local <up|down|status|seed|logs|env|configure|reset>
+npx ory-openclaw watch                             [<trace-file>]
+npx ory-openclaw status                            [--project-dir <path>]
+```
+
+## Links
+
+- [ory.com](https://ory.com)
+
+## License
+
+Apache-2.0

package/dist/cli/assets.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Materialize / clean the Ory skill catalog and command-skills for the
+ * OpenClaw plugin. The 4 guide skills (auth-setup, login-flow, social-login,
+ * local-dev) plus the 2 local-stack commands (rendered as user-invocable
+ * skills) land at `<projectDir>/.openclaw/skills/<name>/SKILL.md`.
+ *
+ * The skills directory's absolute path is registered in the OpenClaw config
+ * under `skills.load.extraDirs` so the harness picks the skills up even when
+ * its default workspace discovery doesn't cover this location.
+ */
+export declare function installOpenclawOryAssets(projectDir: string): void;
+export declare function uninstallOpenclawOryAssets(projectDir: string): void;

package/dist/cli/assets.js

@@ -0,0 +1,126 @@
+"use strict";
+/**
+ * Materialize / clean the Ory skill catalog and command-skills for the
+ * OpenClaw plugin. The 4 guide skills (auth-setup, login-flow, social-login,
+ * local-dev) plus the 2 local-stack commands (rendered as user-invocable
+ * skills) land at `<projectDir>/.openclaw/skills/<name>/SKILL.md`.
+ *
+ * The skills directory's absolute path is registered in the OpenClaw config
+ * under `skills.load.extraDirs` so the harness picks the skills up even when
+ * its default workspace discovery doesn't cover this location.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installOpenclawOryAssets = installOpenclawOryAssets;
+exports.uninstallOpenclawOryAssets = uninstallOpenclawOryAssets;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const argus_1 = require("@ory/argus");
+const RENDER_OPTS = {
+    binName: "ory-openclaw",
+    packageName: "@ory/openclaw",
+};
+const CONFIG_DIR = ".openclaw";
+function configDir(projectDir) {
+    return path.join(projectDir, CONFIG_DIR);
+}
+function configPath(projectDir) {
+    return path.join(configDir(projectDir), "config.json");
+}
+function skillsDir(projectDir) {
+    return path.join(configDir(projectDir), "skills");
+}
+/** Write the absolute skills dir into `skills.load.extraDirs` (deduped). */
+function addExtraDir(projectDir, absDir) {
+    const file = configPath(projectDir);
+    const config = (0, argus_1.readJsonFile)(file);
+    const skills = (config.skills ?? {});
+    const load = (skills.load ?? {});
+    const dirs = (load.extraDirs ?? []);
+    const next = [...dirs.filter((d) => d !== absDir), absDir];
+    load.extraDirs = next;
+    skills.load = load;
+    config.skills = skills;
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(config, null, 2) + "\n");
+}
+/** Remove the absolute skills dir from `skills.load.extraDirs`. */
+function removeExtraDir(projectDir, absDir) {
+    const file = configPath(projectDir);
+    if (!fs.existsSync(file))
+        return;
+    const config = (0, argus_1.readJsonFile)(file);
+    const skills = (config.skills ?? {});
+    const load = (skills.load ?? {});
+    const dirs = (load.extraDirs ?? []);
+    const next = dirs.filter((d) => d !== absDir);
+    if (next.length === 0) {
+        delete load.extraDirs;
+    }
+    else {
+        load.extraDirs = next;
+    }
+    if (Object.keys(load).length === 0)
+        delete skills.load;
+    if (Object.keys(skills).length === 0)
+        delete config.skills;
+    fs.writeFileSync(file, JSON.stringify(config, null, 2) + "\n");
+}
+function installOpenclawOryAssets(projectDir) {
+    const dir = skillsDir(projectDir);
+    fs.mkdirSync(dir, { recursive: true });
+    const guideSkills = (0, argus_1.renderOrySkills)("openclaw", RENDER_OPTS);
+    const commandSkills = (0, argus_1.renderOryCommands)("openclaw", RENDER_OPTS).map(argus_1.commandToSkill);
+    (0, argus_1.writeSkillTree)(dir, [...guideSkills, ...commandSkills]);
+    addExtraDir(projectDir, path.resolve(dir));
+}
+function safeRmEmpty(dir) {
+    try {
+        if (fs.existsSync(dir) && fs.readdirSync(dir).length === 0) {
+            fs.rmdirSync(dir);
+        }
+    }
+    catch {
+        /* ignore */
+    }
+}
+function uninstallOpenclawOryAssets(projectDir) {
+    const dir = skillsDir(projectDir);
+    if (fs.existsSync(dir)) {
+        (0, argus_1.removeSkillDirs)(dir, [...argus_1.ORY_SKILL_NAMES, ...argus_1.ORY_COMMAND_SKILL_NAMES]);
+        safeRmEmpty(dir);
+    }
+    removeExtraDir(projectDir, path.resolve(dir));
+}

package/dist/cli/main.d.ts

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+/**
+ * Main CLI for @ory/openclaw.
+ *
+ * Usage:
+ *   npx ory-openclaw install [--project-dir <path>]   Register plugin in OpenClaw config
+ *   npx ory-openclaw uninstall                         Remove plugin from OpenClaw config
+ *   npx ory-openclaw configure                         Set or view Ory project URL and API key
+ *   npx ory-openclaw status                            Show plugin status
+ *   npx ory-openclaw watch [trace-file]                Watch live trace output
+ */
+export {};

package/dist/cli/main.js

@@ -0,0 +1,203 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * Main CLI for @ory/openclaw.
+ *
+ * Usage:
+ *   npx ory-openclaw install [--project-dir <path>]   Register plugin in OpenClaw config
+ *   npx ory-openclaw uninstall                         Remove plugin from OpenClaw config
+ *   npx ory-openclaw configure                         Set or view Ory project URL and API key
+ *   npx ory-openclaw status                            Show plugin status
+ *   npx ory-openclaw watch [trace-file]                Watch live trace output
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const path = __importStar(require("node:path"));
+const fs = __importStar(require("node:fs"));
+const argus_1 = require("@ory/argus");
+const assets_js_1 = require("./assets.js");
+const PLUGIN_MODULE = "@ory/openclaw";
+const CONFIG_DIR = ".openclaw";
+function main() {
+    const [command, ...args] = process.argv.slice(2);
+    switch (command) {
+        case "install":
+            install(args);
+            break;
+        case "uninstall":
+            uninstall(args);
+            break;
+        case "configure":
+            (0, argus_1.runConfigureCommand)("ory-openclaw", args);
+            break;
+        case "agent":
+            (0, argus_1.runAgentCommand)("ory-openclaw", args).then((code) => process.exit(code), (err) => {
+                console.error(err.message ?? err);
+                process.exit(1);
+            });
+            break;
+        case "status":
+            status(args);
+            break;
+        case "local":
+            (0, argus_1.runLocalCommand)("ory-openclaw", args).catch((err) => {
+                console.error(err.message ?? err);
+                process.exit(1);
+            });
+            break;
+        case "watch":
+            (0, argus_1.runWatchCommand)(args);
+            break;
+        case "help":
+        case "--help":
+        case "-h":
+        case undefined:
+            help();
+            break;
+        default:
+            console.error(`Unknown command: ${command}`);
+            help();
+            process.exit(1);
+    }
+}
+function parseProjectDir(args) {
+    const idx = args.indexOf("--project-dir");
+    if (idx !== -1 && args[idx + 1])
+        return args[idx + 1];
+    return process.cwd();
+}
+function getOpenClawConfigPath(projectDir) {
+    return path.join(projectDir, CONFIG_DIR, "config.json");
+}
+function ensureConfigDir(projectDir) {
+    const dir = path.join(projectDir, CONFIG_DIR);
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+}
+function install(args) {
+    const projectDir = parseProjectDir(args);
+    const configPath = getOpenClawConfigPath(projectDir);
+    ensureConfigDir(projectDir);
+    const config = (0, argus_1.readJsonFile)(configPath);
+    const plugins = (config.plugins ?? []).filter((p) => p !== PLUGIN_MODULE);
+    plugins.push(PLUGIN_MODULE);
+    config.plugins = plugins;
+    fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+    (0, assets_js_1.installOpenclawOryAssets)(projectDir);
+    console.log(`Ory plugin registered in ${configPath}`);
+    console.log(`  Module: ${PLUGIN_MODULE}`);
+    console.log(`  Skills + commands installed under ${path.join(projectDir, CONFIG_DIR, "skills")}`);
+    (0, argus_1.printEnvHelp)("ory-openclaw");
+}
+function uninstall(args) {
+    const projectDir = parseProjectDir(args);
+    const configPath = getOpenClawConfigPath(projectDir);
+    if (!fs.existsSync(configPath)) {
+        console.log("No OpenClaw config found. Nothing to uninstall.");
+        return;
+    }
+    (0, assets_js_1.uninstallOpenclawOryAssets)(projectDir);
+    const config = (0, argus_1.readJsonFile)(configPath);
+    const plugins = (config.plugins ?? []).filter((p) => p !== PLUGIN_MODULE);
+    if (plugins.length === 0) {
+        delete config.plugins;
+    }
+    else {
+        config.plugins = plugins;
+    }
+    fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+    console.log(`Ory plugin and skills removed from ${configPath}`);
+}
+function status(args) {
+    const projectDir = parseProjectDir(args);
+    const configPath = getOpenClawConfigPath(projectDir);
+    console.log("Ory Agent Plugin Status (OpenClaw)");
+    console.log("===================================");
+    console.log("");
+    // OpenClaw-specific: check plugin registration
+    const config = (0, argus_1.readJsonFile)(configPath);
+    const plugins = (config.plugins ?? []);
+    const registered = plugins.includes(PLUGIN_MODULE);
+    console.log("Plugin Registration:");
+    console.log(`  Config file: ${configPath}`);
+    console.log(`  Plugin registered: ${registered ? "yes" : "NO"}`);
+    if (registered) {
+        console.log(`  Module: ${PLUGIN_MODULE}`);
+    }
+    // Shared Ory config
+    console.log("");
+    console.log("Ory Configuration:");
+    const resolved = (0, argus_1.resolveConfig)();
+    const oryConfigPath = (0, argus_1.getConfigPath)();
+    console.log(`  Config file: ${oryConfigPath}`);
+    console.log(`  Project URL: ${resolved.projectUrl ?? "NOT SET"} [source: ${resolved.projectUrlSource}]`);
+    console.log(`  API Key:     ${resolved.apiKey ? "(set)" : "NOT SET"} [source: ${resolved.apiKeySource}]`);
+    console.log("");
+    console.log("OpenClaw Integration:");
+    console.log("  Blocking support: YES (before_tool_call can deny tool execution)");
+    console.log("  Hooks registered: session_start, before_tool_call, after_tool_call");
+    (0, argus_1.printEnvironment)();
+    (0, argus_1.printLogTail)();
+}
+function help() {
+    console.log(`
+ory-openclaw — Ory plugin for OpenClaw
+
+Usage:
+  npx ory-openclaw <command> [options]
+
+Commands:
+  install [--project-dir <path>]   Register the Ory plugin in OpenClaw config
+  uninstall [--project-dir <path>] Remove the Ory plugin from OpenClaw config
+  configure                        Set or view Ory project URL and API key
+  status [--project-dir <path>]    Show plugin configuration and status
+  watch [trace-file]               Watch live trace output
+  local <cmd>                      Manage local Ory dev environment (up, down, status, seed, ...)
+
+After installing, the plugin hooks into these OpenClaw lifecycle events:
+  session_start        Verify agent session via Ory Identities
+  before_tool_call     Check tool permissions via Ory Permissions (can block)
+  after_tool_call      Record tool completion trace
+
+Examples:
+  npx ory-openclaw install           # Register in current directory
+  npx ory-openclaw configure --project-url https://my.oryapis.com --api-key ory_pat_...
+  npx ory-openclaw status            # Check configuration
+  npx ory-openclaw watch             # Watch trace output in real-time
+  npx ory-openclaw uninstall         # Remove plugin
+`);
+}
+main();

package/dist/cli/setup.d.ts

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+/**
+ * Setup CLI for the Ory OpenClaw plugin.
+ *
+ * Usage:
+ *   npx ory-openclaw-setup                    # Auto-detect and configure
+ *   npx ory-openclaw-setup --project-dir /path/to/repo
+ *   npx ory-openclaw-setup --print            # Print config to stdout without writing
+ *   npx ory-openclaw-setup --uninstall        # Remove Ory plugin from config
+ */
+export {};

package/dist/cli/setup.js

@@ -0,0 +1,112 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * Setup CLI for the Ory OpenClaw plugin.
+ *
+ * Usage:
+ *   npx ory-openclaw-setup                    # Auto-detect and configure
+ *   npx ory-openclaw-setup --project-dir /path/to/repo
+ *   npx ory-openclaw-setup --print            # Print config to stdout without writing
+ *   npx ory-openclaw-setup --uninstall        # Remove Ory plugin from config
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const argus_1 = require("@ory/argus");
+const assets_js_1 = require("./assets.js");
+const PLUGIN_MODULE = "@ory/openclaw";
+const CONFIG_DIR = ".openclaw";
+function getConfigPath(args) {
+    return path.join(args.projectDir, CONFIG_DIR, "config.json");
+}
+function ensureConfigDir(args) {
+    const dir = path.join(args.projectDir, CONFIG_DIR);
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+}
+function mergePlugin(existing) {
+    const merged = { ...existing };
+    const plugins = (merged.plugins ?? []).filter((p) => p !== PLUGIN_MODULE);
+    plugins.push(PLUGIN_MODULE);
+    merged.plugins = plugins;
+    return merged;
+}
+function removePlugin(existing) {
+    const merged = { ...existing };
+    const plugins = (merged.plugins ?? []).filter((p) => p !== PLUGIN_MODULE);
+    if (plugins.length === 0) {
+        delete merged.plugins;
+    }
+    else {
+        merged.plugins = plugins;
+    }
+    return merged;
+}
+function main() {
+    if (process.argv.includes("--help") || process.argv.includes("-h")) {
+        (0, argus_1.printSetupHelp)("ory-openclaw-setup", "OpenClaw");
+        process.exit(0);
+    }
+    const args = (0, argus_1.parseSetupArgs)();
+    if (args.print) {
+        console.log(JSON.stringify({ plugins: [PLUGIN_MODULE] }, null, 2));
+        return;
+    }
+    const configPath = getConfigPath(args);
+    const existing = (0, argus_1.readJsonFile)(configPath);
+    if (args.uninstall) {
+        if (!fs.existsSync(configPath)) {
+            console.log("No OpenClaw config found. Nothing to uninstall.");
+            return;
+        }
+        (0, assets_js_1.uninstallOpenclawOryAssets)(args.projectDir);
+        let updated = removePlugin(existing);
+        updated = (0, argus_1.removeMcpServer)(updated);
+        (0, argus_1.writeJsonFile)(configPath, updated);
+        console.log(`Removed Ory plugin, MCP server, and skills from ${configPath}`);
+        return;
+    }
+    ensureConfigDir(args);
+    let merged = mergePlugin(existing);
+    merged = (0, argus_1.mergeMcpServer)(merged);
+    (0, argus_1.writeJsonFile)(configPath, merged);
+    (0, assets_js_1.installOpenclawOryAssets)(args.projectDir);
+    console.log(`Ory plugin and MCP server configured in ${configPath}`);
+    console.log(`Ory skills installed to ${path.join(args.projectDir, CONFIG_DIR, "skills")}`);
+    (0, argus_1.printNextSteps)("OpenClaw", "npx ory-openclaw-setup --uninstall");
+}
+main();

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { createOryPlugin } from "./plugin.js";
+export type { OpenClawPluginEntry, OpenClawPluginApi, HookEvent, HookHandler, HookRegistrationOpts, HookResult, BeforeToolCallContext, AfterToolCallContext, SessionStartContext, BeforeAgentStartContext, SessionEndContext, } from "./types.js";
+declare const _default: import("./types.js").OpenClawPluginEntry;
+export default _default;

package/dist/index.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createOryPlugin = void 0;
+var plugin_js_1 = require("./plugin.js");
+Object.defineProperty(exports, "createOryPlugin", { enumerable: true, get: function () { return plugin_js_1.createOryPlugin; } });
+// Default export for OpenClaw plugin discovery.
+// When OpenClaw loads this module, it calls `register(api)` on the default export.
+const plugin_js_2 = require("./plugin.js");
+exports.default = (0, plugin_js_2.createOryPlugin)();

package/dist/plugin.d.ts

@@ -0,0 +1,28 @@
+import { OryAgentClient, ensureUserAuthenticated, ensureAgentIdentity, ensureSubAgentIdentity } from "@ory/argus";
+import type { OpenClawPluginEntry } from "./types.js";
+export interface CreateOryPluginDeps {
+    /** Test injection point for the user auth gate. */
+    authGate?: typeof ensureUserAuthenticated;
+    /** Test injection point for the agent identity gate. */
+    agentGate?: typeof ensureAgentIdentity;
+    /** Test injection point for the sub-agent identity resolver. */
+    subAgentGate?: typeof ensureSubAgentIdentity;
+}
+/**
+ * Create the Ory plugin entry for OpenClaw.
+ *
+ * OpenClaw plugins export { id, name, register(api) } where register
+ * receives a PluginApi for registering hooks. The `before_tool_call`
+ * hook can return `{ block: true }` to deny tool execution — this
+ * makes permission checks enforceable, unlike harnesses that can only
+ * log denials.
+ *
+ * The `session_start` hook returns `Promise<void>` so the auth gate is
+ * advisory at session start: the gate still runs to emit the audit span,
+ * refresh tokens, and prompt for the project URL when interactive, but
+ * cannot hard-block the session.
+ */
+export declare function createOryPlugin(clientOrConfig?: OryAgentClient | {
+    projectUrl: string;
+    apiKey?: string;
+}, deps?: CreateOryPluginDeps): OpenClawPluginEntry;