@ory/openclaw 0.13.8 → 0.14.0

package/README.md

@@ -51,12 +51,14 @@ Run one command. It installs the plugin and walks you through connecting:
 npx -y -p @ory/openclaw ory-openclaw install
 ```
 
-OpenClaw loads plugins that run inside its own process, so the installer registers the plugin in `.openclaw/config.json` (along with its skills and the Ory MCP server), then walks you through connecting. You'll be asked how you want to connect — **press Enter for the default**:
+OpenClaw loads plugins that run inside its own process, so the installer registers the plugin in `.openclaw/config.json` (along with its skills and the Ory MCP server), then opens a guided setup **in your browser** where you pick how to connect — the default takes just a click:
 
 - **Ory Network** *(default)* — sign in, or create a free account, in your browser. The project, keys, permissions, and login are all set up for you. Nothing to configure by hand.
 - **Local** — run a complete Ory on your laptop with Docker. No account, no signup, no keys. Great for trying it out.
 - **Audit-only** — skip Ory entirely and just log what OpenClaw does.
 
+> No browser available (CI, SSH, headless)? The same walkthrough runs right in your terminal instead — or force it with `--no-web`.
+
 That's it. Confirm everything landed with:
 
 ```bash
@@ -99,6 +101,7 @@ If Ory is ever unreachable, the plugin gets out of the way and lets OpenClaw kee
 Everything the plugin does is observable out of the box — no configuration required:
 
 - **Status at a glance.** `npx -y -p @ory/openclaw ory-openclaw status` shows what's configured, who's signed in, how many built-in tools your permissions cover, and the most recent tool-call activity.
+- **Live dashboard.** `npx -y -p @ory/openclaw ory-openclaw dashboard` opens the same picture in your browser — configuration, identities, permission coverage, Ory service health, and the latest tool-call activity, all refreshing live. From there you can flip **enforcement** on or off, toggle **user login**, and use **Change stack** to reconnect to a different Ory — no CLI required.
 - **Live traces.** Every tool call is recorded as an OpenTelemetry-style span. Watch them stream as the agent works:
 
   ```bash
@@ -116,7 +119,7 @@ When the watch-mode logs look right, turn on blocking with one command (setup al
 npx -y -p @ory/openclaw ory-openclaw permissions enforce
 ```
 
-Now a denied tool is actually blocked and OpenClaw shows why. Go back to watch mode anytime with `permissions observe`. Use `permissions status` to see what's covered and `permissions bootstrap` to (re-)grant the built-in tools — or just ask OpenClaw in chat, e.g. *"grant me use of the execute_command tool."*
+Now a denied tool is actually blocked and OpenClaw shows why. Go back to watch mode anytime with `permissions observe`. Prefer clicking? The dashboard has the same **Enforce** switch — flip it on, or back to watch mode, without touching the CLI. Use `permissions status` to see what's covered and `permissions bootstrap` to (re-)grant the built-in tools — or just ask OpenClaw in chat, e.g. *"grant me use of the execute_command tool."*
 
 ## Also: add login to your own app
 
@@ -131,8 +134,7 @@ The guided setup covers most people. For scripted or CI setups, or to point at a
 ```bash
 npx -y -p @ory/openclaw ory-openclaw configure \
   --project-url https://<slug>.projects.oryapis.com \
-  --oauth2-client-id <sign-in client id> \
-  --user-login
+  --oauth2-client-id <sign-in client id>
 ```
 
 OpenClaw's own identity registers itself automatically on first run — nothing to create. The `--oauth2-client-id` is the one piece browser sign-in needs; the guided setup makes it for you, or see below to do it by hand. For logging-only with no checks, use `--audit-only`.
@@ -144,7 +146,7 @@ The guided setup normally does this. To do it yourself, create a **public** OAut
 
 ```bash
 ory create oauth2-client --project <project-id> \
-  --name "ory-agent-plugin" \
+  --name "Ory Agent Security · user login (PKCE)" \
   --grant-type authorization_code,refresh_token \
   --response-type code \
   --scope openid,offline_access \
@@ -164,11 +166,12 @@ With nothing configured, the plugin still loads and runs in **pass-through mode*
 ## Commands
 
 ```
-ory-openclaw install | uninstall        Install/remove; --reconfigure re-runs setup, --no-configure skips it
+ory-openclaw install | uninstall        Install/remove; --reconfigure re-runs setup, --no-web forces the terminal wizard, --no-configure skips it
 ory-openclaw status                      Show configuration, identities, permission coverage, recent activity
+ory-openclaw dashboard                   Open the live browser dashboard (status + service health + Change stack)
 ory-openclaw watch                       Tail the live trace stream (OTel spans)
 ory-openclaw permissions <cmd>           status | bootstrap | observe (watch) | enforce (block)
-ory-openclaw configure <flags>           Point at a project by hand (--project-url, --oauth2-client-id, --user-login, --audit-only)
+ory-openclaw configure <flags>           Point at a project by hand (--project-url, --oauth2-client-id, --audit-only)
 ory-openclaw agent <status|unregister>   Manage OpenClaw's own auto-created identity
 ory-openclaw local <up|down|status|…>    Run / manage a local Ory in Docker
 ory-openclaw watch [<trace-file>]        Live-tail the trace of decisions as they happen

package/dist/cli/main.js

@@ -99,6 +99,12 @@ function main() {
         case "watch":
             (0, argus_1.runWatchCommand)("openclaw", args);
             break;
+        case "dashboard":
+            (0, argus_1.runDashboardCommand)("ory-openclaw", "openclaw", args).then((code) => process.exit(code), (err) => {
+                console.error(err.message ?? err);
+                process.exit(1);
+            });
+            break;
         case "version":
         case "--version":
         case "-v":
@@ -190,6 +196,7 @@ Commands:
   agent <cmd>                      Manage the agent's OAuth2 (DCR) identity (status, unregister)
   permissions <cmd>                Manage permission mode and tool permissions (status, bootstrap, observe, enforce)
   status [--project-dir <path>]    Show plugin configuration and status
+  dashboard            Open the Ory Agent dashboard (system health + configuration)
   watch [trace-file]               Watch live trace output
   version                          Show version and the ory-agent-plugins build commit
   local <cmd>                      Manage local Ory dev environment (up, down, status, seed, ...)

package/dist/plugin.d.ts

@@ -17,10 +17,9 @@ export interface CreateOryPluginDeps {
  * makes permission checks enforceable, unlike harnesses that can only
  * log denials.
  *
- * The `session_start` hook returns `Promise<void>` so user login is
- * advisory at session start: the flow still runs to emit the audit span,
- * refresh tokens, and prompt for the project URL when interactive, but
- * cannot hard-block the session.
+ * The user login runs every session but never blocks: it emits the audit
+ * span, refreshes tokens, and prompts for the project URL when interactive.
+ * Enforcement is governed solely by permissionMode at tool-call time.
  */
 export declare function createOryPlugin(clientOrConfig?: OryAgentClient | {
     projectUrl: string;

package/dist/plugin.js

@@ -11,10 +11,9 @@ const argus_1 = require("@ory/argus");
  * makes permission checks enforceable, unlike harnesses that can only
  * log denials.
  *
- * The `session_start` hook returns `Promise<void>` so user login is
- * advisory at session start: the flow still runs to emit the audit span,
- * refresh tokens, and prompt for the project URL when interactive, but
- * cannot hard-block the session.
+ * The user login runs every session but never blocks: it emits the audit
+ * span, refreshes tokens, and prompts for the project URL when interactive.
+ * Enforcement is governed solely by permissionMode at tool-call time.
  */
 function createOryPlugin(clientOrConfig, deps = {}) {
     return {
@@ -51,142 +50,28 @@ function createSessionStartHandler(client, deps) {
             traceId: (0, argus_1.deriveTraceId)(ctx.sessionId),
             sessionId: ctx.sessionId,
         });
-        // Run the user login. session_start cannot hard-block in OpenClaw
-        // (handler returns void), so allowBlock is false — it still emits
-        // the user.auth audit span, refreshes tokens, and prompts for the
-        // project URL when interactive. When ORY_USER_LOGIN is unset this is
-        // a no-op (mode === "disabled") and we fall through to the legacy
-        // verification path.
+        // Run the user login every session. Authentication is non-blocking:
+        // the flow emits the user.auth audit span, refreshes tokens, and
+        // prompts for the project URL when interactive, but never prevents the
+        // session from starting — enforcement is governed solely by
+        // permissionMode at tool-call time.
         const userGate = deps.userLogin ?? argus_1.ensureUserAuthenticated;
-        const decision = await userGate(client, {
+        await userGate(client, {
             binName: "ory-openclaw",
             harness: "openclaw",
-            allowBlock: false,
         });
         // Resolve the agent identity (machine credentials). Never blocks;
         // attaches the agent's bearer token to outgoing Ory API calls.
         const agentGate = deps.agentGate ?? argus_1.ensureAgentIdentity;
         await agentGate(client, { projectUrl: (0, argus_1.resolveConfig)().projectUrl, harness: "openclaw" });
         // Record the user→agent delegation so the audit trail captures that
-        // this user authorized this agent for this session. Best-effort:
-        // requires both principals to be populated, and any failure is logged
-        // and swallowed (fail-open — delegation tracking is for audit, not
-        // enforcement).
-        await recordUserDelegatesAgent(client);
-        if (decision.mode !== "disabled") {
-            return;
-        }
-        const modelAttr = ctx.model ? { model: ctx.model } : {};
-        const resolved = (0, argus_1.resolveConfig)();
-        if (resolved.auditOnly) {
-            client.logger.info("config.audit_only", {
-                message: "Audit-only mode enabled. Auth and permission checks are disabled.",
-            });
-            client.tracer.record("session.start", "ok", {
-                attributes: { sessionId: ctx.sessionId, mode: "audit-only", ...modelAttr },
-            });
-            return;
-        }
-        if (!resolved.projectUrl) {
-            client.logger.warn("config.not_configured", {
-                message: "Ory plugin is not configured. Auth and permission checks are disabled. " +
-                    "Run 'npx ory-openclaw configure' to connect to an Ory project.",
-            });
-            client.tracer.record("session.start", "skipped", {
-                attributes: { reason: "not_configured", ...modelAttr },
-            });
-            return;
-        }
-        const sessionToken = process.env.ORY_SESSION_TOKEN;
-        const oauth2Token = process.env.ORY_OAUTH2_TOKEN;
-        if (sessionToken) {
-            await verifySessionToken(client, sessionToken, ctx.sessionId, ctx.model);
-            return;
-        }
-        if (oauth2Token) {
-            await verifyOAuth2Token(client, oauth2Token, ctx.sessionId, ctx.model);
-            return;
-        }
-        client.logger.warn("session.no_credentials", {
-            message: "Neither ORY_SESSION_TOKEN nor ORY_OAUTH2_TOKEN is set. " +
-                "Skipping authentication.",
-        });
-        client.tracer.record("session.start", "skipped", {
-            attributes: { reason: "no_credentials", ...modelAttr },
-        });
+        // this user authorized this agent for this session. Best-effort and
+        // written at most once per install: requires both principals to be
+        // populated, and any failure is logged and swallowed (fail-open —
+        // delegation tracking is for audit, not enforcement).
+        await (0, argus_1.writeUserDelegatesAgent)(client);
     };
 }
-async function verifySessionToken(client, sessionToken, sessionId, model) {
-    const modelAttr = model ? { model } : {};
-    try {
-        const session = await client.verifySession(sessionToken);
-        if (!session.active) {
-            client.logger.warn("session.inactive", {
-                message: "Ory session is not active. Re-authenticate to enable auth checks.",
-            });
-            client.tracer.record("session.start", "skipped", {
-                attributes: { reason: "session_inactive", sessionId, ...modelAttr },
-            });
-        }
-        else {
-            client.tracer.record("session.start", "ok", {
-                attributes: {
-                    sessionId,
-                    identityId: session.identityId,
-                    aal: session.authenticatorAssuranceLevel,
-                    ...modelAttr,
-                },
-            });
-        }
-    }
-    catch (err) {
-        const oryErr = err;
-        client.logger.warn("session.verify_failed", {
-            code: isOryError(err) ? oryErr.code : "unknown",
-            message: err instanceof Error ? err.message : String(err),
-        });
-        client.tracer.record("session.start", "error", {
-            attributes: { error: isOryError(err) ? oryErr.code : "unknown", ...modelAttr },
-        });
-    }
-}
-async function verifyOAuth2Token(client, oauth2Token, sessionId, model) {
-    const modelAttr = model ? { model } : {};
-    try {
-        const tokenInfo = await client.introspectToken(oauth2Token);
-        if (!tokenInfo.active) {
-            client.logger.warn("oauth2.token_inactive", {
-                message: "Ory OAuth2 token is not active. Obtain a new token to enable auth checks.",
-            });
-            client.tracer.record("session.start", "skipped", {
-                attributes: { reason: "token_inactive", sessionId, ...modelAttr },
-            });
-            return;
-        }
-        client.logger.info("oauth2.session_authenticated", {
-            clientId: tokenInfo.clientId,
-            subject: tokenInfo.subject,
-        });
-        client.tracer.record("session.start", "ok", {
-            attributes: {
-                sessionId,
-                clientId: tokenInfo.clientId,
-                subject: tokenInfo.subject,
-                ...modelAttr,
-            },
-        });
-    }
-    catch (err) {
-        const oryErr = err;
-        client.logger.warn("oauth2.introspect_failed", {
-            code: isOryError(err) ? oryErr.code : "unknown",
-            message: err instanceof Error ? err.message : String(err),
-        });
-        client.tracer.record("session.start", "error", {
-            attributes: { error: isOryError(err) ? oryErr.code : "unknown", ...modelAttr },
-        });
-    }
-}
 // ─── before_tool_call ──────────────────────────────────────────────
 function createBeforeToolCallHandler(client) {
     return async (ctx) => {
@@ -354,37 +239,25 @@ function createAfterToolCallHandler(client) {
 }
 // ─── before_agent_run ──────────────────────────────────────────────
 //
-// Real per-turn enforcement gate. `session_start` cannot hard-block in
-// OpenClaw (handler returns void), so the user login runs there in
-// advisory mode. `before_agent_run` is the first hook OpenClaw exposes
-// that can return a block decision on the user prompt — we re-run the
-// login here so denied users can't drive the agent. `ensureUserAuthenticated`
-// reuses persisted tokens, so per-turn calls are non-interactive after
-// the first session.
+// Per-turn user login refresh. The user login runs at `session_start` and
+// again here; it never blocks (authentication is non-blocking — enforcement
+// is governed by permissionMode at tool-call time). `ensureUserAuthenticated`
+// reuses persisted tokens, so per-turn calls are non-interactive after the
+// first session.
 function createBeforeAgentRunHandler(client, deps) {
     return async (ctx) => {
         client.tracer.setContext({
             traceId: (0, argus_1.deriveTraceId)(ctx.sessionKey ?? ctx.sessionId ?? "openclaw"),
             sessionId: ctx.sessionKey ?? ctx.sessionId,
         });
+        // Per-turn user-login refresh. Non-blocking: it reuses persisted tokens
+        // (non-interactive after the first session) and never stops the run —
+        // enforcement is governed by permissionMode at tool-call time.
         const userGate = deps.userLogin ?? argus_1.ensureUserAuthenticated;
-        const decision = await userGate(client, {
+        await userGate(client, {
             binName: "ory-openclaw",
             harness: "openclaw",
-            allowBlock: true,
         });
-        if (!decision.proceed) {
-            client.logger.warn("before_agent_run.blocked", {
-                reason: decision.reason,
-                mode: decision.mode,
-            });
-            return {
-                outcome: "block",
-                reason: decision.reason ?? "User authentication required",
-                message: decision.reason,
-            };
-        }
-        // Disabled gate or successful auth: let the run proceed.
         return;
     };
 }
@@ -440,30 +313,7 @@ function createSubagentSpawningHandler(client, deps) {
         }
         if (identity.kind !== "dynamic" || !identity.subject)
             return;
-        const agent = client.agentPrincipal.subject;
-        if (!agent) {
-            client.logger.debug("delegation.skip", {
-                reason: "agent principal not populated",
-                subAgentType,
-            });
-            return;
-        }
-        try {
-            await client.createRelationship({
-                namespace: resolveNamespace(),
-                object: `subagent:${identity.subject}`,
-                relation: "delegate",
-                subjectId: `agent:${agent}`,
-            }, { spanAttributes: { delegation: "agent-to-subagent", subAgentType } });
-        }
-        catch (err) {
-            const oryErr = err;
-            client.logger.warn("delegation.agent_to_subagent.failed", {
-                subAgentType,
-                code: oryErr.code,
-                message: oryErr.message,
-            });
-        }
+        await (0, argus_1.writeAgentDelegatesSubagent)(client, identity.subject, subAgentType);
     };
 }
 // ─── subagent_spawned ──────────────────────────────────────────────
@@ -514,40 +364,6 @@ function createSubagentEndedHandler(client) {
 function resolveNamespace() {
     return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
 }
-/**
- * Write the user→agent delegation tuple. Idempotent and fail-open:
- * requires both principal subjects to be populated; any error (including
- * an unconfigured projectUrl, which manifests as a network_error) is
- * logged and swallowed. Purely audit-trail data — does not affect
- * enforcement.
- */
-async function recordUserDelegatesAgent(client) {
-    const user = client.userPrincipal.subject;
-    const agent = client.agentPrincipal.subject;
-    if (!user || !agent) {
-        client.logger.debug("delegation.skip", {
-            reason: "missing principal",
-            hasUser: !!user,
-            hasAgent: !!agent,
-        });
-        return;
-    }
-    try {
-        await client.createRelationship({
-            namespace: resolveNamespace(),
-            object: `agent:${agent}`,
-            relation: "delegate",
-            subjectId: `user:${user}`,
-        }, { spanAttributes: { delegation: "user-to-agent" } });
-    }
-    catch (err) {
-        const oryErr = err;
-        client.logger.warn("delegation.user_to_agent.failed", {
-            code: oryErr.code,
-            message: oryErr.message,
-        });
-    }
-}
 function isOryError(err) {
     return (typeof err === "object" &&
         err !== null &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/openclaw",
-  "version": "0.13.8",
+  "version": "0.14.0",
   "description": "Ory plugin for OpenClaw: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -66,7 +66,7 @@
   ],
   "dependencies": {
     "reo-census": "^1.2.8",
-    "@ory/argus": "0.13.8"
+    "@ory/argus": "0.14.0"
   },
   "engines": {
     "node": ">=22"