@ory/openclaw 0.13.8 → 0.13.9

package/dist/plugin.js

@@ -68,11 +68,11 @@ function createSessionStartHandler(client, deps) {
         const agentGate = deps.agentGate ?? argus_1.ensureAgentIdentity;
         await agentGate(client, { projectUrl: (0, argus_1.resolveConfig)().projectUrl, harness: "openclaw" });
         // Record the user→agent delegation so the audit trail captures that
-        // this user authorized this agent for this session. Best-effort:
-        // requires both principals to be populated, and any failure is logged
-        // and swallowed (fail-open — delegation tracking is for audit, not
-        // enforcement).
-        await recordUserDelegatesAgent(client);
+        // this user authorized this agent for this session. Best-effort and
+        // written at most once per install: requires both principals to be
+        // populated, and any failure is logged and swallowed (fail-open —
+        // delegation tracking is for audit, not enforcement).
+        await (0, argus_1.writeUserDelegatesAgent)(client);
         if (decision.mode !== "disabled") {
             return;
         }
@@ -440,30 +440,7 @@ function createSubagentSpawningHandler(client, deps) {
         }
         if (identity.kind !== "dynamic" || !identity.subject)
             return;
-        const agent = client.agentPrincipal.subject;
-        if (!agent) {
-            client.logger.debug("delegation.skip", {
-                reason: "agent principal not populated",
-                subAgentType,
-            });
-            return;
-        }
-        try {
-            await client.createRelationship({
-                namespace: resolveNamespace(),
-                object: `subagent:${identity.subject}`,
-                relation: "delegate",
-                subjectId: `agent:${agent}`,
-            }, { spanAttributes: { delegation: "agent-to-subagent", subAgentType } });
-        }
-        catch (err) {
-            const oryErr = err;
-            client.logger.warn("delegation.agent_to_subagent.failed", {
-                subAgentType,
-                code: oryErr.code,
-                message: oryErr.message,
-            });
-        }
+        await (0, argus_1.writeAgentDelegatesSubagent)(client, identity.subject, subAgentType);
     };
 }
 // ─── subagent_spawned ──────────────────────────────────────────────
@@ -514,40 +491,6 @@ function createSubagentEndedHandler(client) {
 function resolveNamespace() {
     return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
 }
-/**
- * Write the user→agent delegation tuple. Idempotent and fail-open:
- * requires both principal subjects to be populated; any error (including
- * an unconfigured projectUrl, which manifests as a network_error) is
- * logged and swallowed. Purely audit-trail data — does not affect
- * enforcement.
- */
-async function recordUserDelegatesAgent(client) {
-    const user = client.userPrincipal.subject;
-    const agent = client.agentPrincipal.subject;
-    if (!user || !agent) {
-        client.logger.debug("delegation.skip", {
-            reason: "missing principal",
-            hasUser: !!user,
-            hasAgent: !!agent,
-        });
-        return;
-    }
-    try {
-        await client.createRelationship({
-            namespace: resolveNamespace(),
-            object: `agent:${agent}`,
-            relation: "delegate",
-            subjectId: `user:${user}`,
-        }, { spanAttributes: { delegation: "user-to-agent" } });
-    }
-    catch (err) {
-        const oryErr = err;
-        client.logger.warn("delegation.user_to_agent.failed", {
-            code: oryErr.code,
-            message: oryErr.message,
-        });
-    }
-}
 function isOryError(err) {
     return (typeof err === "object" &&
         err !== null &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/openclaw",
-  "version": "0.13.8",
+  "version": "0.13.9",
   "description": "Ory plugin for OpenClaw: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -66,7 +66,7 @@
   ],
   "dependencies": {
     "reo-census": "^1.2.8",
-    "@ory/argus": "0.13.8"
+    "@ory/argus": "0.13.9"
   },
   "engines": {
     "node": ">=22"