@ory/openclaw 0.1.0

package/dist/plugin.js

@@ -0,0 +1,502 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createOryPlugin = createOryPlugin;
+const argus_1 = require("@ory/argus");
+/**
+ * Create the Ory plugin entry for OpenClaw.
+ *
+ * OpenClaw plugins export { id, name, register(api) } where register
+ * receives a PluginApi for registering hooks. The `before_tool_call`
+ * hook can return `{ block: true }` to deny tool execution — this
+ * makes permission checks enforceable, unlike harnesses that can only
+ * log denials.
+ *
+ * The `session_start` hook returns `Promise<void>` so the auth gate is
+ * advisory at session start: the gate still runs to emit the audit span,
+ * refresh tokens, and prompt for the project URL when interactive, but
+ * cannot hard-block the session.
+ */
+function createOryPlugin(clientOrConfig, deps = {}) {
+    return {
+        id: "ory-agent-security",
+        name: "Ory Agent Security",
+        register(api) {
+            const client = clientOrConfig instanceof argus_1.OryAgentClient
+                ? clientOrConfig
+                : clientOrConfig
+                    ? new argus_1.OryAgentClient({
+                        ...clientOrConfig,
+                        harness: "openclaw",
+                    })
+                    : argus_1.OryAgentClient.fromEnv("openclaw");
+            api.registerHook("session_start", createSessionStartHandler(client, deps), { name: "ory.session-verify", description: "Verify session via Ory Identities" });
+            api.registerHook("before_agent_run", createBeforeAgentRunHandler(client, deps), { name: "ory.user-auth-gate", description: "Block runs when the user auth gate denies" });
+            api.registerHook("before_tool_call", createBeforeToolCallHandler(client), { name: "ory.permission-check", description: "Check tool permissions via Ory Permissions" });
+            api.registerHook("after_tool_call", createAfterToolCallHandler(client), { name: "ory.trace-complete", description: "Record tool completion trace" });
+            api.registerHook("subagent_spawning", createSubagentSpawningHandler(client, deps), { name: "ory.subagent-register", description: "Register Ory identity and write delegation tuple for spawned sub-agent" });
+            api.registerHook("subagent_spawned", createSubagentSpawnedHandler(client), { name: "ory.subagent-spawned", description: "Record sub-agent spawn audit span" });
+            api.registerHook("subagent_ended", createSubagentEndedHandler(client), { name: "ory.subagent-ended", description: "Record sub-agent termination audit span" });
+        },
+    };
+}
+// ─── session_start ─────────────────────────────────────────────────
+function createSessionStartHandler(client, deps) {
+    return async (ctx) => {
+        client.logger.info("lifecycle.session_start", {
+            sessionId: ctx.sessionId,
+            model: ctx.model,
+        });
+        // Set trace context for this session
+        client.tracer.setContext({
+            traceId: (0, argus_1.deriveTraceId)(ctx.sessionId),
+            sessionId: ctx.sessionId,
+        });
+        // Run the user auth gate. session_start cannot hard-block in OpenClaw
+        // (handler returns void), so allowBlock is false — the gate still emits
+        // the user.auth audit span, refreshes tokens, and prompts for the
+        // project URL when interactive. When ORY_AUTH_GATE is unset the gate is
+        // a no-op (mode === "disabled") and we fall through to the legacy
+        // verification path.
+        const userGate = deps.authGate ?? argus_1.ensureUserAuthenticated;
+        const decision = await userGate(client, {
+            binName: "ory-openclaw",
+            harness: "openclaw",
+            allowBlock: false,
+        });
+        // Resolve the agent identity (machine credentials). Never blocks;
+        // attaches the agent's bearer token to outgoing Ory API calls.
+        const agentGate = deps.agentGate ?? argus_1.ensureAgentIdentity;
+        await agentGate(client, { projectUrl: (0, argus_1.resolveConfig)().projectUrl, harness: "openclaw" });
+        if (decision.mode !== "disabled") {
+            return;
+        }
+        const modelAttr = ctx.model ? { model: ctx.model } : {};
+        const resolved = (0, argus_1.resolveConfig)();
+        if (resolved.auditOnly) {
+            client.logger.info("config.audit_only", {
+                message: "Audit-only mode enabled. Auth and permission checks are disabled.",
+            });
+            client.tracer.record("session.start", "ok", {
+                attributes: { sessionId: ctx.sessionId, mode: "audit-only", ...modelAttr },
+            });
+            return;
+        }
+        if (!resolved.projectUrl) {
+            client.logger.warn("config.not_configured", {
+                message: "Ory plugin is not configured. Auth and permission checks are disabled. " +
+                    "Run 'npx ory-openclaw configure' to connect to an Ory project.",
+            });
+            client.tracer.record("session.start", "skipped", {
+                attributes: { reason: "not_configured", ...modelAttr },
+            });
+            return;
+        }
+        const sessionToken = process.env.ORY_SESSION_TOKEN;
+        const oauth2Token = process.env.ORY_OAUTH2_TOKEN;
+        if (sessionToken) {
+            await verifySessionToken(client, sessionToken, ctx.sessionId, ctx.model);
+            return;
+        }
+        if (oauth2Token) {
+            await verifyOAuth2Token(client, oauth2Token, ctx.sessionId, ctx.model);
+            return;
+        }
+        client.logger.warn("session.no_credentials", {
+            message: "Neither ORY_SESSION_TOKEN nor ORY_OAUTH2_TOKEN is set. " +
+                "Skipping authentication.",
+        });
+        client.tracer.record("session.start", "skipped", {
+            attributes: { reason: "no_credentials", ...modelAttr },
+        });
+    };
+}
+async function verifySessionToken(client, sessionToken, sessionId, model) {
+    const modelAttr = model ? { model } : {};
+    try {
+        const session = await client.verifySession(sessionToken);
+        if (!session.active) {
+            client.logger.warn("session.inactive", {
+                message: "Ory session is not active. Re-authenticate to enable auth checks.",
+            });
+            client.tracer.record("session.start", "skipped", {
+                attributes: { reason: "session_inactive", sessionId, ...modelAttr },
+            });
+        }
+        else {
+            client.tracer.record("session.start", "ok", {
+                attributes: {
+                    sessionId,
+                    identityId: session.identityId,
+                    aal: session.authenticatorAssuranceLevel,
+                    ...modelAttr,
+                },
+            });
+        }
+    }
+    catch (err) {
+        const oryErr = err;
+        client.logger.warn("session.verify_failed", {
+            code: isOryError(err) ? oryErr.code : "unknown",
+            message: err instanceof Error ? err.message : String(err),
+        });
+        client.tracer.record("session.start", "error", {
+            attributes: { error: isOryError(err) ? oryErr.code : "unknown", ...modelAttr },
+        });
+    }
+}
+async function verifyOAuth2Token(client, oauth2Token, sessionId, model) {
+    const modelAttr = model ? { model } : {};
+    try {
+        const tokenInfo = await client.introspectToken(oauth2Token);
+        if (!tokenInfo.active) {
+            client.logger.warn("oauth2.token_inactive", {
+                message: "Ory OAuth2 token is not active. Obtain a new token to enable auth checks.",
+            });
+            client.tracer.record("session.start", "skipped", {
+                attributes: { reason: "token_inactive", sessionId, ...modelAttr },
+            });
+            return;
+        }
+        client.logger.info("oauth2.session_authenticated", {
+            clientId: tokenInfo.clientId,
+            subject: tokenInfo.subject,
+        });
+        client.tracer.record("session.start", "ok", {
+            attributes: {
+                sessionId,
+                clientId: tokenInfo.clientId,
+                subject: tokenInfo.subject,
+                ...modelAttr,
+            },
+        });
+    }
+    catch (err) {
+        const oryErr = err;
+        client.logger.warn("oauth2.introspect_failed", {
+            code: isOryError(err) ? oryErr.code : "unknown",
+            message: err instanceof Error ? err.message : String(err),
+        });
+        client.tracer.record("session.start", "error", {
+            attributes: { error: isOryError(err) ? oryErr.code : "unknown", ...modelAttr },
+        });
+    }
+}
+// ─── before_tool_call ──────────────────────────────────────────────
+function createBeforeToolCallHandler(client) {
+    return async (ctx) => {
+        client.logger.info("lifecycle.before_tool_call", {
+            toolId: ctx.toolId,
+            toolName: ctx.toolName,
+            sessionId: ctx.sessionId,
+            callId: ctx.callId,
+        });
+        // Set trace context for this tool invocation
+        client.tracer.setContext({
+            traceId: (0, argus_1.deriveTraceId)(ctx.sessionId),
+            sessionId: ctx.sessionId,
+        });
+        const inputSummary = (0, argus_1.summarizeToolInput)(ctx.toolId, ctx.args);
+        // In audit-only mode, log the invocation but skip permission checks
+        if ((0, argus_1.resolveConfig)().auditOnly) {
+            client.tracer.record("tool.invoke", "ok", {
+                attributes: { toolName: ctx.toolId, ...inputSummary },
+            });
+            return;
+        }
+        // If Ory is not configured, pass through
+        if (!(0, argus_1.resolveConfig)().projectUrl) {
+            client.tracer.record("tool.invoke", "skipped", {
+                attributes: { toolName: ctx.toolId, reason: "not_configured", ...inputSummary },
+            });
+            return;
+        }
+        const subject = (0, argus_1.resolveUserSubject)(client, ctx.sessionId ? `session:${ctx.sessionId}` : "agent:openclaw");
+        const subjectId = (0, argus_1.subjectLabel)(subject);
+        const mcpTool = (0, argus_1.parseMcpToolGeneric)(ctx.toolId);
+        try {
+            if (mcpTool) {
+                const mcpResult = await (0, argus_1.checkMcpPermission)(client, mcpTool, {
+                    subject,
+                    spanAttributes: { toolName: ctx.toolId },
+                });
+                if (!mcpResult.allowed) {
+                    client.tracer.record("tool.block", "denied", {
+                        attributes: { toolName: ctx.toolId, mcpServer: mcpTool.serverName, mcpTool: mcpTool.toolName, ...inputSummary, ...(0, argus_1.alertAttributes)(true) },
+                    });
+                    const blockReason = (0, argus_1.formatDenialMessage)({
+                        tool: ctx.toolId,
+                        subjectId,
+                        mcp: mcpTool,
+                    });
+                    client.logger.warn("tool.denied", {
+                        toolId: ctx.toolId,
+                        subjectId,
+                        message: blockReason,
+                    });
+                    return { block: true, blockReason };
+                }
+                client.tracer.record("tool.invoke", "ok", {
+                    attributes: { toolName: ctx.toolId, mcpServer: mcpTool.serverName, mcpTool: mcpTool.toolName, ...inputSummary },
+                });
+                return;
+            }
+            const namespace = resolveNamespace();
+            const result = await client.checkPermission({
+                namespace,
+                object: ctx.toolId,
+                relation: "use",
+                ...subject,
+            }, { spanAttributes: { toolName: ctx.toolId } });
+            if (!result.allowed) {
+                client.tracer.record("tool.block", "denied", {
+                    attributes: { toolName: ctx.toolId, ...inputSummary, allowed: result.allowed, ...(0, argus_1.alertAttributes)(true) },
+                });
+                const blockReason = (0, argus_1.formatDenialMessage)({
+                    tool: ctx.toolId,
+                    subjectId,
+                    namespace,
+                });
+                client.logger.warn("tool.denied", {
+                    toolId: ctx.toolId,
+                    subjectId,
+                    message: blockReason,
+                });
+                // OpenClaw supports blocking — return { block: true, blockReason }
+                return { block: true, blockReason };
+            }
+            client.tracer.record("tool.invoke", "ok", {
+                attributes: { toolName: ctx.toolId, ...inputSummary, allowed: result.allowed },
+            });
+        }
+        catch (err) {
+            handlePermissionError(err, ctx.toolId, client);
+            // Fail open — allow the tool call
+        }
+    };
+}
+// ─── after_tool_call ───────────────────────────────────────────────
+function createAfterToolCallHandler(client) {
+    return async (ctx) => {
+        client.logger.info("lifecycle.after_tool_call", {
+            toolId: ctx.toolId,
+            toolName: ctx.toolName,
+            sessionId: ctx.sessionId,
+            callId: ctx.callId,
+            durationMs: ctx.durationMs,
+            hasError: !!ctx.error,
+        });
+        // Set trace context for this tool completion
+        client.tracer.setContext({
+            traceId: (0, argus_1.deriveTraceId)(ctx.sessionId),
+            sessionId: ctx.sessionId,
+        });
+        const status = ctx.error ? "error" : "ok";
+        client.tracer.record("tool.complete", status, {
+            attributes: {
+                toolName: ctx.toolId,
+                ...(0, argus_1.summarizeToolInput)(ctx.toolId, ctx.args),
+                ...(0, argus_1.summarizeToolOutput)(ctx.toolId, ctx.result),
+                durationMs: ctx.durationMs,
+                ...(ctx.error ? { error: ctx.error } : {}),
+            },
+        });
+    };
+}
+// ─── before_agent_run ──────────────────────────────────────────────
+//
+// Real per-turn enforcement gate. `session_start` cannot hard-block in
+// OpenClaw (handler returns void), so the user auth gate runs there in
+// advisory mode. `before_agent_run` is the first hook OpenClaw exposes
+// that can return a block decision on the user prompt — we re-run the
+// gate here so denied users can't drive the agent. `ensureUserAuthenticated`
+// reuses persisted tokens, so per-turn calls are non-interactive after
+// the first session.
+function createBeforeAgentRunHandler(client, deps) {
+    return async (ctx) => {
+        client.tracer.setContext({
+            traceId: (0, argus_1.deriveTraceId)(ctx.sessionKey ?? ctx.sessionId ?? "openclaw"),
+            sessionId: ctx.sessionKey ?? ctx.sessionId,
+        });
+        const userGate = deps.authGate ?? argus_1.ensureUserAuthenticated;
+        const decision = await userGate(client, {
+            binName: "ory-openclaw",
+            harness: "openclaw",
+            allowBlock: true,
+        });
+        if (!decision.proceed) {
+            client.logger.warn("before_agent_run.blocked", {
+                reason: decision.reason,
+                mode: decision.mode,
+            });
+            return {
+                outcome: "block",
+                reason: decision.reason ?? "User authentication required",
+                message: decision.reason,
+            };
+        }
+        // Disabled gate or successful auth: let the run proceed.
+        return;
+    };
+}
+// ─── subagent_spawning ─────────────────────────────────────────────
+//
+// Fires before a child agent run starts. We resolve a distinct OAuth2
+// identity for the sub-agent (DCR) and write the agent→sub-agent
+// delegation tuple. Best-effort: failures here never abort the child run.
+function createSubagentSpawningHandler(client, deps) {
+    return async (ctx) => {
+        const subAgentType = ctx.agentId ?? ctx.label;
+        client.tracer.setContext({
+            traceId: (0, argus_1.deriveTraceId)(ctx.sessionKey ?? ctx.childSessionKey ?? "openclaw"),
+            sessionId: ctx.sessionKey,
+        });
+        client.logger.info("lifecycle.subagent_spawning", {
+            agentId: ctx.agentId,
+            label: ctx.label,
+            childSessionKey: ctx.childSessionKey,
+            mode: ctx.mode,
+            requester: ctx.requester,
+        });
+        client.tracer.record("subagent.start", "ok", {
+            attributes: {
+                subAgentType,
+                agentId: ctx.agentId,
+                childSessionKey: ctx.childSessionKey,
+                mode: ctx.mode,
+                requester: ctx.requester,
+            },
+        });
+        if (!subAgentType) {
+            client.logger.debug("subagent.no_type", {
+                message: "subagent_spawning event without agentId/label — skipping DCR.",
+            });
+            return;
+        }
+        const subAgentGate = deps.subAgentGate ?? argus_1.ensureSubAgentIdentity;
+        let identity;
+        try {
+            identity = await subAgentGate(client, {
+                subAgentType,
+                projectUrl: (0, argus_1.resolveConfig)().projectUrl,
+                harness: "openclaw",
+            });
+        }
+        catch (err) {
+            client.logger.warn("subagent.identity.failed", {
+                subAgentType,
+                message: err instanceof Error ? err.message : String(err),
+            });
+            return;
+        }
+        if (identity.kind !== "dynamic" || !identity.subject)
+            return;
+        const agent = client.agentPrincipal.subject;
+        if (!agent) {
+            client.logger.debug("delegation.skip", {
+                reason: "agent principal not populated",
+                subAgentType,
+            });
+            return;
+        }
+        try {
+            await client.createRelationship({
+                namespace: resolveNamespace(),
+                object: `subagent:${identity.subject}`,
+                relation: "delegate",
+                subjectId: `agent:${agent}`,
+            }, { spanAttributes: { delegation: "agent-to-subagent", subAgentType } });
+        }
+        catch (err) {
+            const oryErr = err;
+            client.logger.warn("delegation.agent_to_subagent.failed", {
+                subAgentType,
+                code: oryErr.code,
+                message: oryErr.message,
+            });
+        }
+    };
+}
+// ─── subagent_spawned ──────────────────────────────────────────────
+function createSubagentSpawnedHandler(client) {
+    return async (ctx) => {
+        client.tracer.setContext({
+            traceId: (0, argus_1.deriveTraceId)(ctx.sessionKey ?? ctx.childSessionKey ?? "openclaw"),
+            sessionId: ctx.sessionKey,
+        });
+        client.logger.info("lifecycle.subagent_spawned", {
+            agentId: ctx.agentId,
+            childRunId: ctx.childRunId,
+            childSessionKey: ctx.childSessionKey,
+        });
+        client.tracer.record("subagent.start", "ok", {
+            attributes: {
+                subAgentType: ctx.agentId ?? ctx.label,
+                agentId: ctx.agentId,
+                childRunId: ctx.childRunId,
+                stage: "spawned",
+            },
+        });
+    };
+}
+// ─── subagent_ended ────────────────────────────────────────────────
+function createSubagentEndedHandler(client) {
+    return async (ctx) => {
+        client.tracer.setContext({
+            traceId: (0, argus_1.deriveTraceId)(ctx.sessionKey ?? ctx.childSessionKey ?? "openclaw"),
+            sessionId: ctx.sessionKey,
+        });
+        client.logger.info("lifecycle.subagent_ended", {
+            agentId: ctx.agentId,
+            childRunId: ctx.childRunId,
+            reason: ctx.reason,
+        });
+        client.tracer.record("subagent.stop", "ok", {
+            attributes: {
+                subAgentType: ctx.agentId ?? ctx.label,
+                agentId: ctx.agentId,
+                childRunId: ctx.childRunId,
+                reason: ctx.reason,
+            },
+        });
+    };
+}
+// ─── Helpers ───────────────────────────────────────────────────────
+function resolveNamespace() {
+    return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
+}
+function isOryError(err) {
+    return (typeof err === "object" &&
+        err !== null &&
+        "code" in err &&
+        "message" in err);
+}
+function handlePermissionError(err, toolId, client) {
+    if (isOryError(err)) {
+        if (err.code === "network_error" || err.code === "rate_limited") {
+            client.logger.warn("permission.fallback", {
+                toolId,
+                code: err.code,
+                message: "Failing open",
+            });
+            client.tracer.record("tool.invoke", "ok", {
+                attributes: { toolName: toolId, failOpen: true, reason: err.code },
+            });
+            return;
+        }
+        client.logger.error("permission.check.error", {
+            toolId,
+            code: err.code,
+            message: err.message,
+        });
+    }
+    else {
+        client.logger.error("permission.check.error", {
+            toolId,
+            error: err instanceof Error ? err.message : String(err),
+        });
+    }
+    // Record fail-open trace for unknown errors too
+    client.tracer.record("tool.invoke", "ok", {
+        attributes: { toolName: toolId, failOpen: true },
+    });
+}

package/dist/types.d.ts

@@ -0,0 +1,132 @@
+/**
+ * OpenClaw plugin types.
+ *
+ * OpenClaw plugins export a plugin entry with { id, name, register(api) }.
+ * The `register` function receives a PluginApi that allows registering
+ * hooks, tools, and other extensions.
+ *
+ * Key difference from other harnesses: the `before_tool_call` hook can
+ * return `{ block: true }` to deny tool execution, making permission
+ * checks enforceable rather than advisory.
+ *
+ * See: OpenClaw plugin SDK docs for canonical types.
+ */
+export interface OpenClawPluginEntry {
+    id: string;
+    name: string;
+    version?: string;
+    register(api: OpenClawPluginApi): void;
+}
+export interface OpenClawPluginApi {
+    registerHook<E extends HookEvent>(event: E, handler: HookHandler<E>, opts?: HookRegistrationOpts): void;
+}
+export interface HookRegistrationOpts {
+    name?: string;
+    description?: string;
+}
+export type HookEvent = "session_start" | "session_end" | "before_tool_call" | "after_tool_call" | "before_agent_start" | "before_agent_run" | "subagent_spawning" | "subagent_spawned" | "subagent_ended";
+export type HookHandler<E extends HookEvent> = E extends "before_tool_call" ? (ctx: BeforeToolCallContext) => Promise<HookResult | void> : E extends "after_tool_call" ? (ctx: AfterToolCallContext) => Promise<void> : E extends "session_start" ? (ctx: SessionStartContext) => Promise<void> : E extends "before_agent_start" ? (ctx: BeforeAgentStartContext) => Promise<void> : E extends "before_agent_run" ? (ctx: BeforeAgentRunContext) => Promise<BeforeAgentRunResult | void> : E extends "session_end" ? (ctx: SessionEndContext) => Promise<void> : E extends "subagent_spawning" ? (ctx: SubagentSpawningContext) => Promise<SubagentSpawningResult | void> : E extends "subagent_spawned" ? (ctx: SubagentSpawnedContext) => Promise<void> : E extends "subagent_ended" ? (ctx: SubagentEndedContext) => Promise<void> : never;
+export interface BeforeToolCallContext {
+    toolId: string;
+    toolName: string;
+    args: Record<string, unknown>;
+    sessionId: string;
+    callId: string;
+}
+export interface AfterToolCallContext {
+    toolId: string;
+    toolName: string;
+    args: Record<string, unknown>;
+    result: unknown;
+    sessionId: string;
+    callId: string;
+    durationMs: number;
+    error?: string;
+}
+export interface SessionStartContext {
+    sessionId: string;
+    model?: string;
+    gateway?: {
+        version: string;
+    };
+}
+export interface BeforeAgentStartContext {
+    sessionId: string;
+    model?: string;
+    config?: Record<string, unknown>;
+}
+export interface SessionEndContext {
+    sessionId: string;
+    reason?: string;
+}
+/**
+ * Context for `before_agent_run` — fires before each model submission
+ * with the final prompt and session messages assembled. Unlike
+ * `session_start`, this hook can hard-block via a `BeforeAgentRunResult`.
+ */
+export interface BeforeAgentRunContext {
+    sessionId?: string;
+    sessionKey?: string;
+    runId?: string;
+    agentId?: string;
+    model?: string;
+    /** Final user prompt / message text, when available. */
+    prompt?: string;
+    /** Assembled message list (shape varies — treat as opaque). */
+    messages?: unknown[];
+    [key: string]: unknown;
+}
+/**
+ * Return shape for `before_agent_run`. `outcome: "block"` aborts the
+ * run before the model is called. Returning void (or no outcome) lets
+ * the run proceed.
+ */
+export interface BeforeAgentRunResult {
+    outcome?: "block";
+    reason?: string;
+    message?: string;
+}
+export interface SubagentSpawningContext {
+    /** Stable identifier of the child agent definition (e.g. "Explore"). */
+    agentId?: string;
+    /** Human-readable label for the child invocation. */
+    label?: string;
+    /** Session key of the spawning (parent) session. */
+    sessionKey?: string;
+    /** Session key the child will run under. */
+    childSessionKey?: string;
+    /** Invocation mode (e.g. "thread"/"foreground"). */
+    mode?: string;
+    /** Subject that requested the spawn (e.g. user vs. tool-driven). */
+    requester?: string;
+    /** Whether a separate thread was requested for the child run. */
+    threadRequested?: boolean;
+    [key: string]: unknown;
+}
+export interface SubagentSpawnedContext extends SubagentSpawningContext {
+    /** Resolved session/run identifier for the child. */
+    childRunId?: string;
+}
+export interface SubagentEndedContext extends SubagentSpawningContext {
+    childRunId?: string;
+    reason?: string;
+    /** Final response/output from the child run (audit-only). */
+    result?: unknown;
+}
+export interface HookResult {
+    /** Set to true to block tool execution. */
+    block?: boolean;
+    /**
+     * Human-readable reason shown to the user when the tool call is blocked.
+     * Maps to OpenClaw's PluginHookBeforeToolCallResult.blockReason.
+     */
+    blockReason?: string;
+}
+/**
+ * Return shape for `subagent_spawning`. Returning `{ status: "error" }`
+ * aborts the child run before it starts.
+ */
+export interface SubagentSpawningResult {
+    status?: "error";
+    error?: string;
+}

package/dist/types.js

@@ -0,0 +1,15 @@
+"use strict";
+/**
+ * OpenClaw plugin types.
+ *
+ * OpenClaw plugins export a plugin entry with { id, name, register(api) }.
+ * The `register` function receives a PluginApi that allows registering
+ * hooks, tools, and other extensions.
+ *
+ * Key difference from other harnesses: the `before_tool_call` hook can
+ * return `{ block: true }` to deny tool execution, making permission
+ * checks enforceable rather than advisory.
+ *
+ * See: OpenClaw plugin SDK docs for canonical types.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/openclaw.plugin.json

@@ -0,0 +1,7 @@
+{
+  "id": "ory-agent-security",
+  "name": "Ory Agent Security",
+  "version": "0.1.0",
+  "description": "Authentication, authorization, and distributed tracing for OpenClaw via Ory",
+  "entry": "./dist/index.js"
+}