@ory/openclaw 0.13.9 → 1.0.0

package/dist/plugin.js

@@ -2,20 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createOryPlugin = createOryPlugin;
 const argus_1 = require("@ory/argus");
-/**
- * Create the Ory plugin entry for OpenClaw.
- *
- * OpenClaw plugins export { id, name, register(api) } where register
- * receives a PluginApi for registering hooks. The `before_tool_call`
- * hook can return `{ block: true }` to deny tool execution — this
- * makes permission checks enforceable, unlike harnesses that can only
- * log denials.
- *
- * The `session_start` hook returns `Promise<void>` so user login is
- * advisory at session start: the flow still runs to emit the audit span,
- * refresh tokens, and prompt for the project URL when interactive, but
- * cannot hard-block the session.
- */
+const HARNESS = "openclaw";
 function createOryPlugin(clientOrConfig, deps = {}) {
     return {
         id: "ory-agent-security",
@@ -24,309 +11,91 @@ function createOryPlugin(clientOrConfig, deps = {}) {
             const client = clientOrConfig instanceof argus_1.OryAgentClient
                 ? clientOrConfig
                 : clientOrConfig
-                    ? new argus_1.OryAgentClient({
-                        ...clientOrConfig,
-                        harness: "openclaw",
-                    })
-                    : argus_1.OryAgentClient.fromEnv("openclaw");
-            api.registerHook("session_start", createSessionStartHandler(client, deps), { name: "ory.session-verify", description: "Verify session via Ory Identities" });
-            api.registerHook("before_agent_run", createBeforeAgentRunHandler(client, deps), { name: "ory.user-login", description: "Block runs when the user login denies" });
-            api.registerHook("before_tool_call", createBeforeToolCallHandler(client), { name: "ory.permission-check", description: "Check tool permissions via Ory Permissions" });
-            api.registerHook("after_tool_call", createAfterToolCallHandler(client), { name: "ory.trace-complete", description: "Record tool completion trace" });
-            api.registerHook("subagent_spawning", createSubagentSpawningHandler(client, deps), { name: "ory.subagent-register", description: "Register Ory identity and write delegation tuple for spawned sub-agent" });
-            api.registerHook("subagent_spawned", createSubagentSpawnedHandler(client), { name: "ory.subagent-spawned", description: "Record sub-agent spawn audit span" });
-            api.registerHook("subagent_ended", createSubagentEndedHandler(client), { name: "ory.subagent-ended", description: "Record sub-agent termination audit span" });
-        },
-    };
-}
-// ─── session_start ─────────────────────────────────────────────────
-function createSessionStartHandler(client, deps) {
-    return async (ctx) => {
-        client.logger.info("lifecycle.session_start", {
-            sessionId: ctx.sessionId,
-            model: ctx.model,
-        });
-        // Set trace context for this session
-        client.tracer.setContext({
-            traceId: (0, argus_1.deriveTraceId)(ctx.sessionId),
-            sessionId: ctx.sessionId,
-        });
-        // Run the user login. session_start cannot hard-block in OpenClaw
-        // (handler returns void), so allowBlock is false — it still emits
-        // the user.auth audit span, refreshes tokens, and prompts for the
-        // project URL when interactive. When ORY_USER_LOGIN is unset this is
-        // a no-op (mode === "disabled") and we fall through to the legacy
-        // verification path.
-        const userGate = deps.userLogin ?? argus_1.ensureUserAuthenticated;
-        const decision = await userGate(client, {
-            binName: "ory-openclaw",
-            harness: "openclaw",
-            allowBlock: false,
-        });
-        // Resolve the agent identity (machine credentials). Never blocks;
-        // attaches the agent's bearer token to outgoing Ory API calls.
-        const agentGate = deps.agentGate ?? argus_1.ensureAgentIdentity;
-        await agentGate(client, { projectUrl: (0, argus_1.resolveConfig)().projectUrl, harness: "openclaw" });
-        // Record the user→agent delegation so the audit trail captures that
-        // this user authorized this agent for this session. Best-effort and
-        // written at most once per install: requires both principals to be
-        // populated, and any failure is logged and swallowed (fail-open —
-        // delegation tracking is for audit, not enforcement).
-        await (0, argus_1.writeUserDelegatesAgent)(client);
-        if (decision.mode !== "disabled") {
-            return;
-        }
-        const modelAttr = ctx.model ? { model: ctx.model } : {};
-        const resolved = (0, argus_1.resolveConfig)();
-        if (resolved.auditOnly) {
-            client.logger.info("config.audit_only", {
-                message: "Audit-only mode enabled. Auth and permission checks are disabled.",
+                    ? new argus_1.OryAgentClient({ ...clientOrConfig, harness: HARNESS })
+                    : argus_1.OryAgentClient.fromEnv(HARNESS);
+            const subagents = new Map();
+            api.registerHook("session_start", createSessionStartHandler(client, deps), {
+                name: "ory.session-verify",
+                description: "Verify session via Ory Identities",
             });
-            client.tracer.record("session.start", "ok", {
-                attributes: { sessionId: ctx.sessionId, mode: "audit-only", ...modelAttr },
+            api.registerHook("before_agent_run", createBeforeAgentRunHandler(client, deps), {
+                name: "ory.user-login",
+                description: "Block runs when the user login denies",
             });
-            return;
-        }
-        if (!resolved.projectUrl) {
-            client.logger.warn("config.not_configured", {
-                message: "Ory plugin is not configured. Auth and permission checks are disabled. " +
-                    "Run 'npx ory-openclaw configure' to connect to an Ory project.",
+            api.registerHook("before_tool_call", createBeforeToolCallHandler(client, subagents), {
+                name: "ory.permission-check",
+                description: "Check tool permissions via Ory Permissions",
             });
-            client.tracer.record("session.start", "skipped", {
-                attributes: { reason: "not_configured", ...modelAttr },
+            api.registerHook("after_tool_call", createAfterToolCallHandler(client), {
+                name: "ory.activity-complete",
+                description: "Record tool completion activity",
             });
-            return;
-        }
-        const sessionToken = process.env.ORY_SESSION_TOKEN;
-        const oauth2Token = process.env.ORY_OAUTH2_TOKEN;
-        if (sessionToken) {
-            await verifySessionToken(client, sessionToken, ctx.sessionId, ctx.model);
-            return;
-        }
-        if (oauth2Token) {
-            await verifyOAuth2Token(client, oauth2Token, ctx.sessionId, ctx.model);
-            return;
-        }
-        client.logger.warn("session.no_credentials", {
-            message: "Neither ORY_SESSION_TOKEN nor ORY_OAUTH2_TOKEN is set. " +
-                "Skipping authentication.",
-        });
-        client.tracer.record("session.start", "skipped", {
-            attributes: { reason: "no_credentials", ...modelAttr },
-        });
-    };
-}
-async function verifySessionToken(client, sessionToken, sessionId, model) {
-    const modelAttr = model ? { model } : {};
-    try {
-        const session = await client.verifySession(sessionToken);
-        if (!session.active) {
-            client.logger.warn("session.inactive", {
-                message: "Ory session is not active. Re-authenticate to enable auth checks.",
+            api.registerHook("subagent_spawning", createSubagentSpawningHandler(client, deps, subagents), {
+                name: "ory.subagent-register",
+                description: "Register Ory identity and write delegation tuple for spawned sub-agent",
             });
-            client.tracer.record("session.start", "skipped", {
-                attributes: { reason: "session_inactive", sessionId, ...modelAttr },
+            api.registerHook("subagent_spawned", createSubagentSpawnedHandler(client), {
+                name: "ory.subagent-spawned",
+                description: "Record sub-agent spawn activity",
             });
-        }
-        else {
-            client.tracer.record("session.start", "ok", {
-                attributes: {
-                    sessionId,
-                    identityId: session.identityId,
-                    aal: session.authenticatorAssuranceLevel,
-                    ...modelAttr,
-                },
+            api.registerHook("subagent_ended", createSubagentEndedHandler(client, subagents), {
+                name: "ory.subagent-ended",
+                description: "Record sub-agent termination activity",
             });
-        }
-    }
-    catch (err) {
-        const oryErr = err;
-        client.logger.warn("session.verify_failed", {
-            code: isOryError(err) ? oryErr.code : "unknown",
-            message: err instanceof Error ? err.message : String(err),
-        });
-        client.tracer.record("session.start", "error", {
-            attributes: { error: isOryError(err) ? oryErr.code : "unknown", ...modelAttr },
-        });
-    }
+        },
+    };
 }
-async function verifyOAuth2Token(client, oauth2Token, sessionId, model) {
-    const modelAttr = model ? { model } : {};
-    try {
-        const tokenInfo = await client.introspectToken(oauth2Token);
-        if (!tokenInfo.active) {
-            client.logger.warn("oauth2.token_inactive", {
-                message: "Ory OAuth2 token is not active. Obtain a new token to enable auth checks.",
-            });
-            client.tracer.record("session.start", "skipped", {
-                attributes: { reason: "token_inactive", sessionId, ...modelAttr },
-            });
-            return;
-        }
-        client.logger.info("oauth2.session_authenticated", {
-            clientId: tokenInfo.clientId,
-            subject: tokenInfo.subject,
-        });
-        client.tracer.record("session.start", "ok", {
-            attributes: {
-                sessionId,
-                clientId: tokenInfo.clientId,
-                subject: tokenInfo.subject,
-                ...modelAttr,
-            },
-        });
-    }
-    catch (err) {
-        const oryErr = err;
-        client.logger.warn("oauth2.introspect_failed", {
-            code: isOryError(err) ? oryErr.code : "unknown",
-            message: err instanceof Error ? err.message : String(err),
+function createSessionStartHandler(client, deps) {
+    return (ctx) => (0, argus_1.withHookContext)(client, { sessionId: ctx.sessionId }, async () => {
+        client.logger.info("lifecycle.session_start", {
+            sessionId: ctx.sessionId,
+            model: ctx.model,
         });
-        client.tracer.record("session.start", "error", {
-            attributes: { error: isOryError(err) ? oryErr.code : "unknown", ...modelAttr },
+        await (0, argus_1.sessionStart)(client, {
+            harness: HARNESS,
+            binName: "ory-openclaw",
+            userLogin: deps.userLogin,
+            agentGate: deps.agentGate,
+            activityAttributes: { model: ctx.model },
         });
-    }
+    });
 }
-// ─── before_tool_call ──────────────────────────────────────────────
-function createBeforeToolCallHandler(client) {
-    return async (ctx) => {
+function createBeforeToolCallHandler(client, subagents) {
+    return (ctx) => (0, argus_1.withHookContext)(client, { sessionId: ctx.sessionId }, async () => {
         client.logger.info("lifecycle.before_tool_call", {
             toolId: ctx.toolId,
             toolName: ctx.toolName,
             sessionId: ctx.sessionId,
             callId: ctx.callId,
         });
-        // Set trace context for this tool invocation
-        client.tracer.setContext({
-            traceId: (0, argus_1.deriveTraceId)(ctx.sessionId),
-            sessionId: ctx.sessionId,
+        const result = await (0, argus_1.gate)(client, {
+            harness: HARNESS,
+            toolName: ctx.toolId,
+            toolArgs: ctx.args,
+            subjectFallback: ctx.sessionId ? `session:${ctx.sessionId}` : "agent:openclaw",
+            canBlock: true,
+            mcpTool: (0, argus_1.parseMcpToolGeneric)(ctx.toolId) ?? undefined,
+            principals: openClawSubagentPrincipals(ctx, subagents),
         });
-        const inputSummary = (0, argus_1.summarizeToolInput)(ctx.toolId, ctx.args);
-        // In audit-only mode, log the invocation but skip permission checks
-        if ((0, argus_1.resolveConfig)().auditOnly) {
-            client.tracer.record("tool.invoke", "ok", {
-                attributes: { toolName: ctx.toolId, ...inputSummary },
-            });
-            return;
-        }
-        // If Ory is not configured, pass through
-        if (!(0, argus_1.resolveConfig)().projectUrl) {
-            client.tracer.record("tool.invoke", "skipped", {
-                attributes: { toolName: ctx.toolId, reason: "not_configured", ...inputSummary },
-            });
-            return;
-        }
-        const subject = (0, argus_1.resolveUserSubject)(client, ctx.sessionId ? `session:${ctx.sessionId}` : "agent:openclaw");
-        const subjectId = (0, argus_1.subjectLabel)(subject);
-        const mcpTool = (0, argus_1.parseMcpToolGeneric)(ctx.toolId);
-        try {
-            if (mcpTool) {
-                const mcpResult = await (0, argus_1.checkMcpPermission)(client, mcpTool, {
-                    subject,
-                    spanAttributes: { toolName: ctx.toolId },
-                });
-                const mcpAttrs = {
-                    toolName: ctx.toolId,
-                    mcpServer: mcpTool.serverName,
-                    mcpTool: mcpTool.toolName,
-                    ...inputSummary,
-                };
-                const decision = (0, argus_1.applyPermissionMode)(client, mcpResult.allowed, {
-                    object: mcpTool.serverName,
-                    relation: "use",
-                    subjectId,
-                    ...("subjectSet" in subject ? { subjectSet: subject.subjectSet } : {}),
-                    spanAttributes: mcpAttrs,
-                });
-                const decisionAttrs = decision.spanAttributes;
-                if (decision.kind === "allow") {
-                    client.tracer.record("tool.invoke", "ok", {
-                        attributes: { ...mcpAttrs, ...decisionAttrs },
-                    });
-                    return;
-                }
-                if (decision.kind === "observe") {
-                    client.tracer.record("tool.block", "denied", {
-                        attributes: { ...mcpAttrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
-                    });
-                    client.tracer.record("tool.invoke", "ok", {
-                        attributes: { ...mcpAttrs, ...decisionAttrs, allowed: false, observed: true },
-                    });
-                    return;
-                }
-                client.tracer.record("tool.block", "denied", {
-                    attributes: { ...mcpAttrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(true) },
-                });
-                const blockReason = (0, argus_1.formatDenialMessage)({
-                    tool: ctx.toolId,
-                    subjectId,
-                    mcp: mcpTool,
-                });
-                client.logger.warn("tool.denied", {
-                    toolId: ctx.toolId,
-                    subjectId,
-                    message: blockReason,
-                });
-                return { block: true, blockReason };
-            }
-            const namespace = resolveNamespace();
-            const outcome = await (0, argus_1.gateToolCall)(client, {
-                harness: "openclaw",
-                toolName: ctx.toolId,
-                check: { namespace, object: ctx.toolId, relation: "use", ...subject },
-                spanAttributes: { toolName: ctx.toolId },
-            });
-            // Interactive tools (operator-extensible via ORY_INTERACTIVE_TOOLS):
-            // the user.interaction span is already recorded; pass through.
-            if (outcome.kind === "interactive") {
-                return;
-            }
-            const decision = outcome;
-            if (decision.kind === "fail_open") {
-                handlePermissionError(decision.error, ctx.toolId, client);
-                return;
-            }
-            const attrs = { toolName: ctx.toolId, ...inputSummary };
-            const decisionAttrs = decision.spanAttributes;
-            if (decision.kind === "allow") {
-                client.tracer.record("tool.invoke", "ok", {
-                    attributes: { ...attrs, ...decisionAttrs, allowed: true },
-                });
-                return;
-            }
-            if (decision.kind === "observe") {
-                client.tracer.record("tool.block", "denied", {
-                    attributes: { ...attrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
-                });
-                client.tracer.record("tool.invoke", "ok", {
-                    attributes: { ...attrs, ...decisionAttrs, allowed: false, observed: true },
-                });
-                return;
-            }
-            client.tracer.record("tool.block", "denied", {
-                attributes: { ...attrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(true) },
-            });
-            const blockReason = (0, argus_1.formatDenialMessage)({
-                tool: ctx.toolId,
-                subjectId,
-                namespace,
-            });
-            client.logger.warn("tool.denied", {
-                toolId: ctx.toolId,
-                subjectId,
-                message: blockReason,
-            });
-            return { block: true, blockReason };
-        }
-        catch (err) {
-            handlePermissionError(err, ctx.toolId, client);
-            // Fail open — allow the tool call
+        if (result.blocked) {
+            return { block: true, blockReason: result.denialMessage };
         }
+    });
+}
+function openClawSubagentPrincipals(ctx, subagents) {
+    const childSession = ctx.sessionKey ?? ctx.sessionId;
+    const subagent = subagents.get(childSession);
+    if (!subagent)
+        return undefined;
+    return {
+        subAgentClientId: subagent.clientId,
+        subAgentType: subagent.type,
+        perSpawnId: childSession,
+        sessionId: subagent.parentSession,
     };
 }
-// ─── after_tool_call ───────────────────────────────────────────────
 function createAfterToolCallHandler(client) {
-    return async (ctx) => {
+    return (ctx) => (0, argus_1.withHookContext)(client, { sessionId: ctx.sessionId }, async () => {
         client.logger.info("lifecycle.after_tool_call", {
             toolId: ctx.toolId,
             toolName: ctx.toolName,
@@ -335,71 +104,40 @@ function createAfterToolCallHandler(client) {
             durationMs: ctx.durationMs,
             hasError: !!ctx.error,
         });
-        // Set trace context for this tool completion
-        client.tracer.setContext({
-            traceId: (0, argus_1.deriveTraceId)(ctx.sessionId),
-            sessionId: ctx.sessionId,
-        });
-        const status = ctx.error ? "error" : "ok";
-        client.tracer.record("tool.complete", status, {
-            attributes: {
+        if (ctx.error)
+            client.logger.debug("lifecycle.after_tool_call.error", { error: ctx.error });
+        if (ctx.error) {
+            (0, argus_1.fail)(client, {
                 toolName: ctx.toolId,
-                ...(0, argus_1.summarizeToolInput)(ctx.toolId, ctx.args),
-                ...(0, argus_1.summarizeToolOutput)(ctx.toolId, ctx.result),
-                durationMs: ctx.durationMs,
-                ...(ctx.error ? { error: ctx.error } : {}),
-            },
-        });
-    };
-}
-// ─── before_agent_run ──────────────────────────────────────────────
-//
-// Real per-turn enforcement gate. `session_start` cannot hard-block in
-// OpenClaw (handler returns void), so the user login runs there in
-// advisory mode. `before_agent_run` is the first hook OpenClaw exposes
-// that can return a block decision on the user prompt — we re-run the
-// login here so denied users can't drive the agent. `ensureUserAuthenticated`
-// reuses persisted tokens, so per-turn calls are non-interactive after
-// the first session.
-function createBeforeAgentRunHandler(client, deps) {
-    return async (ctx) => {
-        client.tracer.setContext({
-            traceId: (0, argus_1.deriveTraceId)(ctx.sessionKey ?? ctx.sessionId ?? "openclaw"),
-            sessionId: ctx.sessionKey ?? ctx.sessionId,
-        });
-        const userGate = deps.userLogin ?? argus_1.ensureUserAuthenticated;
-        const decision = await userGate(client, {
-            binName: "ory-openclaw",
-            harness: "openclaw",
-            allowBlock: true,
-        });
-        if (!decision.proceed) {
-            client.logger.warn("before_agent_run.blocked", {
-                reason: decision.reason,
-                mode: decision.mode,
+                input: ctx.args,
+                error: ctx.error,
+                extraActivityAttributes: { durationMs: ctx.durationMs },
             });
-            return {
-                outcome: "block",
-                reason: decision.reason ?? "User authentication required",
-                message: decision.reason,
-            };
         }
-        // Disabled gate or successful auth: let the run proceed.
-        return;
-    };
+        else {
+            (0, argus_1.complete)(client, {
+                toolName: ctx.toolId,
+                input: ctx.args,
+                output: ctx.result,
+                extraActivityAttributes: { durationMs: ctx.durationMs },
+            });
+        }
+    });
 }
-// ─── subagent_spawning ─────────────────────────────────────────────
-//
-// Fires before a child agent run starts. We resolve a distinct OAuth2
-// identity for the sub-agent (DCR) and write the agent→sub-agent
-// delegation tuple. Best-effort: failures here never abort the child run.
-function createSubagentSpawningHandler(client, deps) {
-    return async (ctx) => {
+// OpenClaw refreshes the interactive user credential before every model turn.
+function createBeforeAgentRunHandler(client, deps) {
+    return (ctx) => (0, argus_1.withHookContext)(client, {
+        sessionId: ctx.sessionKey ?? ctx.sessionId,
+    }, async () => {
+        const userLogin = deps.userLogin ?? argus_1.ensureUserAuthenticated;
+        await userLogin(client, { binName: "ory-openclaw", harness: HARNESS });
+    });
+}
+function createSubagentSpawningHandler(client, deps, subagents) {
+    return (ctx) => (0, argus_1.withHookContext)(client, {
+        sessionId: ctx.sessionKey,
+    }, async () => {
         const subAgentType = ctx.agentId ?? ctx.label;
-        client.tracer.setContext({
-            traceId: (0, argus_1.deriveTraceId)(ctx.sessionKey ?? ctx.childSessionKey ?? "openclaw"),
-            sessionId: ctx.sessionKey,
-        });
         client.logger.info("lifecycle.subagent_spawning", {
             agentId: ctx.agentId,
             label: ctx.label,
@@ -407,7 +145,7 @@ function createSubagentSpawningHandler(client, deps) {
             mode: ctx.mode,
             requester: ctx.requester,
         });
-        client.tracer.record("subagent.start", "ok", {
+        client.logger.activity("subagent.prepare", "ok", {
             attributes: {
                 subAgentType,
                 agentId: ctx.agentId,
@@ -418,44 +156,40 @@ function createSubagentSpawningHandler(client, deps) {
         });
         if (!subAgentType) {
             client.logger.debug("subagent.no_type", {
-                message: "subagent_spawning event without agentId/label — skipping DCR.",
+                message: "subagent_spawning event without agentId/label; skipping DCR.",
             });
             return;
         }
-        const subAgentGate = deps.subAgentGate ?? argus_1.ensureSubAgentIdentity;
-        let identity;
-        try {
-            identity = await subAgentGate(client, {
-                subAgentType,
-                projectUrl: (0, argus_1.resolveConfig)().projectUrl,
-                harness: "openclaw",
-            });
-        }
-        catch (err) {
-            client.logger.warn("subagent.identity.failed", {
-                subAgentType,
-                message: err instanceof Error ? err.message : String(err),
-            });
-            return;
+        await (0, argus_1.registerSubagent)(client, {
+            harness: HARNESS,
+            subAgentType,
+            subAgentGate: deps.subAgentGate,
+            perSpawnId: ctx.childSessionKey,
+        });
+        if (ctx.childSessionKey) {
+            const credential = ctx.sessionKey
+                ? (0, argus_1.loadSubAgentDynamicCredentials)(HARNESS, ctx.sessionKey, subAgentType)
+                : (0, argus_1.loadSubAgentDynamicCredentials)(HARNESS, subAgentType);
+            if (credential) {
+                subagents.set(ctx.childSessionKey, {
+                    clientId: credential.clientId,
+                    type: subAgentType,
+                    parentSession: ctx.sessionKey,
+                });
+            }
         }
-        if (identity.kind !== "dynamic" || !identity.subject)
-            return;
-        await (0, argus_1.writeAgentDelegatesSubagent)(client, identity.subject, subAgentType);
-    };
+    });
 }
-// ─── subagent_spawned ──────────────────────────────────────────────
 function createSubagentSpawnedHandler(client) {
-    return async (ctx) => {
-        client.tracer.setContext({
-            traceId: (0, argus_1.deriveTraceId)(ctx.sessionKey ?? ctx.childSessionKey ?? "openclaw"),
-            sessionId: ctx.sessionKey,
-        });
+    return (ctx) => (0, argus_1.withHookContext)(client, {
+        sessionId: ctx.sessionKey,
+    }, async () => {
         client.logger.info("lifecycle.subagent_spawned", {
             agentId: ctx.agentId,
             childRunId: ctx.childRunId,
             childSessionKey: ctx.childSessionKey,
         });
-        client.tracer.record("subagent.start", "ok", {
+        client.logger.activity("subagent.start", "ok", {
             attributes: {
                 subAgentType: ctx.agentId ?? ctx.label,
                 agentId: ctx.agentId,
@@ -463,21 +197,21 @@ function createSubagentSpawnedHandler(client) {
                 stage: "spawned",
             },
         });
-    };
+    });
 }
-// ─── subagent_ended ────────────────────────────────────────────────
-function createSubagentEndedHandler(client) {
-    return async (ctx) => {
-        client.tracer.setContext({
-            traceId: (0, argus_1.deriveTraceId)(ctx.sessionKey ?? ctx.childSessionKey ?? "openclaw"),
-            sessionId: ctx.sessionKey,
-        });
+function createSubagentEndedHandler(client, subagents) {
+    return (ctx) => (0, argus_1.withHookContext)(client, {
+        sessionId: ctx.sessionKey,
+    }, async () => {
+        const childSessionKey = ctx.targetSessionKey ?? ctx.childSessionKey;
+        if (childSessionKey)
+            subagents.delete(childSessionKey);
         client.logger.info("lifecycle.subagent_ended", {
             agentId: ctx.agentId,
             childRunId: ctx.childRunId,
             reason: ctx.reason,
         });
-        client.tracer.record("subagent.stop", "ok", {
+        client.logger.activity("subagent.stop", "ok", {
             attributes: {
                 subAgentType: ctx.agentId ?? ctx.label,
                 agentId: ctx.agentId,
@@ -485,41 +219,5 @@ function createSubagentEndedHandler(client) {
                 reason: ctx.reason,
             },
         });
-    };
-}
-// ─── Helpers ───────────────────────────────────────────────────────
-function resolveNamespace() {
-    return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
-}
-function isOryError(err) {
-    return (typeof err === "object" &&
-        err !== null &&
-        "code" in err &&
-        "message" in err);
-}
-function handlePermissionError(err, toolId, client) {
-    if (isOryError(err)) {
-        if (err.code === "network_error" || err.code === "rate_limited") {
-            client.logger.warn("permission.fallback", {
-                toolId,
-                code: err.code,
-                message: "Failing open",
-            });
-            return;
-        }
-        client.logger.error("permission.check.error", {
-            toolId,
-            code: err.code,
-            message: err.message,
-        });
-    }
-    else {
-        client.logger.error("permission.check.error", {
-            toolId,
-            error: err instanceof Error ? err.message : String(err),
-        });
-    }
-    // Fail-open is log-and-allow: no tool.invoke span, matching the core
-    // gate() vocabulary. The errored permission.check span carries the audit
-    // trail for the failed check itself.
+    });
 }