npm - @ory/openclaw - Versions diffs - 0.14.0 → 1.0.0 - Mend

@ory/openclaw 0.14.0 → 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (11) hide show

package/README.md +67 -105
package/dist/cli/main.d.ts +0 -1
package/dist/cli/main.js +51 -20
package/dist/cli/plugin-config.d.ts +12 -8
package/dist/cli/plugin-config.js +22 -16
package/dist/cli/setup.js +24 -5
package/dist/plugin.d.ts +1 -18
package/dist/plugin.js +128 -303
package/dist/types.d.ts +8 -1
package/openclaw.plugin.json +1 -1
package/package.json +9 -8

package/README.md CHANGED Viewed

@@ -2,9 +2,12 @@
 Security and developer experience for [OpenClaw](https://github.com/openclaw/openclaw), powered by [Ory](https://ory.com).
-**Security.** OpenClaw runs real actions on your machine — editing files, running shell commands, calling APIs. The plugin gives every session a verifiable identity (you sign in once; OpenClaw and any sub-agents it spawns each get their own), checks every tool call against permissions you control, and records each decision as an audit trace you can ship to your observability stack. It starts in watch mode so nothing is blocked on day one, and if Ory is ever unreachable it steps aside rather than locking you out.
+OpenClaw runs real actions on your machine — editing files, running shell commands, calling APIs. This plugin gives those actions an identity, a permission check, and an audit trail.
-**Developer experience.** A single command installs the plugin and walks you through connecting — choose Ory Network, a local Docker stack, or audit-only, and it wires up the project, sign-in client, login, and permissions for you. It also helps you build Ory into your own app: ask in plain language to scaffold login, registration, and recovery pages, run a local Ory, or manage identities and permissions through the bundled MCP server.
+One command installs two independent halves:
+- **Developer experience** — the Ory skill catalog, the local Ory dev stack, an MCP server, and activity logging. No account, no keys, nothing to configure: it works the moment it's installed.
+- **Ory Agent Security** — browser sign-in, brokered permission checks before tool calls, and the delegation trail. Opt-in connection details from the [Ory Console](https://console.ory.sh) switch it on, and it takes nothing away from the half above. See [Connect to Ory Agent Security](#connect-to-ory-agent-security).
 ## What you'll need
@@ -15,166 +18,126 @@ Security and developer experience for [OpenClaw](https://github.com/openclaw/ope
 ## Get started
-1. **Build auth into your app.** Have OpenClaw scaffold Ory login, registration, social sign-in, and permissions into the project you're working on, backed by the local stack. This is the Quickstart below — it needs nothing but Docker.
-2. **Govern the agent itself.** Authenticate OpenClaw's own session and authorize every tool it runs against Ory Permissions, with a full audit trail. See [Agent security](#agent-security).
-If you're just exploring, do the Quickstart first.
-## Prerequisites
-- [OpenClaw](https://github.com/openclaw/openclaw) installed and configured
-- Node.js **≥ 22**
-- [Docker](https://docs.docker.com/get-docker/) (only needed for the local Ory stack)
-- macOS or Linux. Windows works via WSL2.
-## Install
-OpenClaw discovers plugins by their manifest id (`ory-agent-security`) under the nested `plugins` object in `.openclaw/config.json` — it does not scan `node_modules`, so the plugin's location has to be registered. Two ways to do that:
-**Recommended — OpenClaw's plugin ecosystem.** Copies the plugin into OpenClaw's managed extensions directory and enables it by id:
+OpenClaw loads in-process plugins by module name plus an entry in `.openclaw/config.json` — it doesn't scan `node_modules`, so the plugin has to be registered. Install the package, then register it.:
 ```bash
-openclaw plugins install npm:@ory/openclaw
-openclaw plugins enable ory-agent-security
+npm install @ory/openclaw                       # so OpenClaw can resolve the package
+npx -y -p @ory/openclaw ory-openclaw install    # register + enable in .openclaw/config.json
 ```
-**Or let the Ory CLI write the config.** This registers the installed package directory on `plugins.load.paths` and sets `plugins.entries.ory-agent-security.enabled = true`, and also installs the Ory skills and MCP server. Install the package into the project first so it has a stable path for OpenClaw to load:
-```bash
-npm install @ory/openclaw                          # so OpenClaw can resolve the package
-npx @ory/openclaw install                          # register + enable in .openclaw/config.json
-npx @ory/openclaw install --project-dir <path>
-npx @ory/openclaw uninstall
-Run one command. It installs the plugin and walks you through connecting:
+Registering also lays down the Ory skills (via `skills.load.extraDirs`) and the Ory MCP server. Confirm everything landed with:
 ```bash
-npx -y -p @ory/openclaw ory-openclaw install
+npx -y -p @ory/openclaw ory-openclaw status
 ```
-OpenClaw loads plugins that run inside its own process, so the installer registers the plugin in `.openclaw/config.json` (along with its skills and the Ory MCP server), then opens a guided setup **in your browser** where you pick how to connect — the default takes just a click:
-- **Ory Network** *(default)* — sign in, or create a free account, in your browser. The project, keys, permissions, and login are all set up for you. Nothing to configure by hand.
-- **Local** — run a complete Ory on your laptop with Docker. No account, no signup, no keys. Great for trying it out.
-- **Audit-only** — skip Ory entirely and just log what OpenClaw does.
-> No browser available (CI, SSH, headless)? The same walkthrough runs right in your terminal instead — or force it with `--no-web`.
+`status` is your one-stop check: what's configured, who's signed in, which tools are covered by permissions, plugin and skill registration, and recent activity. Until you connect Agent Security, the identity and permission rows say so and name what's missing.
-That's it. Confirm everything landed with:
+> Prefer OpenClaw's plugin ecosystem? Run `openclaw plugins install npm:@ory/openclaw` then `openclaw plugins enable ory-agent-security`. That registers the plugin the same way, with Agent Security not connected. Run `npx -y -p @ory/openclaw ory-openclaw install` afterwards to lay down the Ory skills and MCP server. Point the installer at another project with `install --project-dir <path>`.
-```bash
-npx -y -p @ory/openclaw ory-openclaw status
-```
+## Skills and commands
-`status` is your one-stop check: what's configured, who's signed in, which tools are covered by permissions, plugin and skill registration, and recent activity. Anything not set up yet shows as `(unset)`.
+Installing the plugin drops the full Ory playbook catalog into OpenClaw. **Skills** are model-invoked — say what you want in plain language, or pick one from OpenClaw's skill picker.
-Re-run install with `--reconfigure` to change your connection later, or `--no-configure` to skip the wizard.
+| Skill | What it does for you |
+|---|---|
+| `ory-auth-setup` | Adds a complete auth system to your app — login, registration, recovery, verification, settings — on [Ory Elements](https://github.com/ory/elements) |
+| `ory-login-flow` | Builds just the pages, wired to Ory's self-service flows |
+| `ory-social-login` | "Sign in with…" for Google, GitHub, Apple, Microsoft, Discord, Slack, GitLab, Facebook |
+| `ory-local-dev` | Develops and tests login/permission flows against a local Ory — no project, no account, offline |
+| `ory-permissions-onboarding` | Walks a fresh install from observe mode to enforced per-tool permissions without getting blocked |
+| `ory-build-agent` | Drops `@ory/argus` into an agent *you* own — Claude Agent SDK, OpenAI Agents, Mastra, Vercel AI, LangGraph/PydanticAI |
+| `ory-build-integration` | Wires Ory into your app: Action webhooks, JWT validation at a gateway, live event streams |
+| `ory-contribute-integration` | Authors and submits an integration to the public `ory/integrates` registry |
+| `ory-e2b-sandbox` | Scaffolds an E2B sandbox template that boots with this plugin preinstalled |
+| `ory-temporal-worker` | Scaffolds a Temporal TypeScript worker where every Activity is authenticated, authorized, and audited |
-<details>
-<summary>Register the plugin by hand</summary>
+The local stack has its own playbooks — ask for them by name:
-OpenClaw finds in-process plugins by module name from `node_modules` plus an entry in `.openclaw/config.json`. To register it without the guided setup:
+| Command | What it does |
+|---|---|
+| `ory-local-up` | Starts a local Ory (Identities, OAuth2, Permissions) in Docker and seeds a test user — it prints the email + password to sign in with |
+| `ory-local-down` | Stops it, keeping your data volumes |
+| `ory-temporal-up` | Starts a local Temporal dev server for the `ory-temporal-worker` scaffold |
-```bash
-npx @ory/openclaw install                     # registers in .openclaw/config.json
-npx @ory/openclaw install --project-dir <path>
-npx @ory/openclaw uninstall
-```
+The local stack runs entirely on your laptop: Ory APIs at `http://localhost:4000`, a login UI on `:4455` (not `:3000`, to dodge Next.js port clashes), and the Ory Console on `:4100`.
-This registers the plugin and its skills but skips the connect step. Run `ory-openclaw install` (or `configure`) in a terminal afterwards to connect.
+A built-in **Ory MCP server** rounds it out — OpenClaw can manage identities, projects, and permissions straight from chat.
-</details>
+So: ask OpenClaw *"add Ory login to this app"* and it scaffolds the pages, starts a local Ory, and wires them together.
 ## What you get
-Once connected, every tool OpenClaw runs is governed by Ory — three things happen automatically:
+Out of the box, every tool OpenClaw runs produces a privacy-safe structured activity event in the unified local log.
+Once you connect to Ory Agent Security, two more things happen automatically:
-- **Who's driving.** You sign in once in your browser; the OpenClaw process gets its own identity too, registered automatically on first run. No tokens to copy around, and the "who acted on whose behalf" trail stays queryable later.
-- **What it's allowed to do.** Before a tool runs, Ory checks whether it's permitted. It starts in **watch mode** — nothing is blocked, you just *see* what would be — so it never gets in your way on day one.
-- **A record of everything.** Every decision (allowed, denied, skipped) is logged as a trace you can send to Jaeger, Honeycomb, Grafana, or just a file.
+- **Who's driving.** You sign in once in your browser; each OpenClaw session and typed sub-agent gets its own identity, registered automatically on first use. No tokens to copy around, and the "who acted on whose behalf" trail stays queryable later.
+- **What it's allowed to do.** Before a tool runs, Ory checks whether it's permitted. It starts in **observe mode** — nothing is blocked, you just *see* what would be — so it never gets in your way on day one.
 If Ory is ever unreachable, the plugin gets out of the way and lets OpenClaw keep working — so it can't lock you out.
-> **One nuance:** because the plugin runs inside OpenClaw's own process, it can't hard-block at the moment a session opens. Browser sign-in still runs there and the record stays correct — but the session always proceeds. Per-tool checks are unaffected: when a tool is about to run, a denial blocks it for real.
+> **One nuance:** because the plugin runs inside OpenClaw's own process, it can't hard-block at the moment a session opens. Browser sign-in still runs there and the record stays correct — but the session always proceeds. Per-tool checks are unaffected: when a tool is about to run, a denial blocks it for real (the plugin returns `{ block: true }`).
 ### See what's happening
-Everything the plugin does is observable out of the box — no configuration required:
+Everything the plugin does is observable out of the box:
-- **Status at a glance.** `npx -y -p @ory/openclaw ory-openclaw status` shows what's configured, who's signed in, how many built-in tools your permissions cover, and the most recent tool-call activity.
-- **Live dashboard.** `npx -y -p @ory/openclaw ory-openclaw dashboard` opens the same picture in your browser — configuration, identities, permission coverage, Ory service health, and the latest tool-call activity, all refreshing live. From there you can flip **enforcement** on or off, toggle **user login**, and use **Change stack** to reconnect to a different Ory — no CLI required.
-- **Live traces.** Every tool call is recorded as an OpenTelemetry-style span. Watch them stream as the agent works:
+- **Activity log.** Privacy-safe activity is always appended to `~/.config/ory-agent-plugins/openclaw/ory-agent-debug.log`. View events, decisions, and errors live with:
   ```bash
   npx -y -p @ory/openclaw ory-openclaw watch
   ```
-  Spans are also written to `~/.config/ory-agent-plugins/openclaw/ory-agent-trace.ndjson` (NDJSON, one span per line) — tail that file, or point `OTEL_EXPORTER_OTLP_ENDPOINT` at a collector to ship them straight to Jaeger, Honeycomb, or Grafana.
-- **Debug log.** For a verbose play-by-play, set `ORY_AGENT_DEBUG=true`; structured logs land in `~/.config/ory-agent-plugins/openclaw/ory-agent-debug.log`.
+  Set `ORY_AGENT_LOG_FILE` to override the path; set it empty to disable file persistence.
+- **Live debug.** Launch OpenClaw with `ORY_AGENT_DEBUG=true` to add verbose local diagnostics, including raw shell commands, to the watched log and stderr. Secrets are recursively redacted; pass `watch --json` for NDJSON.
 ### Ready to enforce?
-When the watch-mode logs look right, turn on blocking with one command (setup already granted you the built-in tools):
+Once connected, the deny posture lives on the Ory project: when the observe-mode activity looks right, an admin promotes it to **enforce** in the **Ory Console** (Agent Security). Every session reads that posture live, so nothing has to be reinstalled.
 ```bash
-npx -y -p @ory/openclaw ory-openclaw permissions enforce
+npx -y -p @ory/openclaw ory-openclaw permissions   # what the project grants, and the live mode
 ```
-Now a denied tool is actually blocked and OpenClaw shows why. Go back to watch mode anytime with `permissions observe`. Prefer clicking? The dashboard has the same **Enforce** switch — flip it on, or back to watch mode, without touching the CLI. Use `permissions status` to see what's covered and `permissions bootstrap` to (re-)grant the built-in tools — or just ask OpenClaw in chat, e.g. *"grant me use of the execute_command tool."*
+Then a denied tool is actually blocked and OpenClaw shows why.
-## Also: add login to your own app
+## Connect to Ory Agent Security
-Beyond securing OpenClaw, the plugin helps you build Ory into whatever you're working on. Ask OpenClaw *"add Ory login to this app"* and it scaffolds the login, registration, recovery, and settings pages (using [Ory Elements](https://github.com/ory/elements)) wired to a local Ory — no signup or keys needed. Start that local Ory with the `ory-local-up` skill (it prints a test email + password to sign in with) and tear it down with `ory-local-down`.
+Copy the connection details from the [Ory Console](https://console.ory.sh) under **Agent Security**:
-Bundled **skills** (just ask in plain language, or pick one from OpenClaw's skill picker) cover more: `ory-auth-setup`, `ory-login-flow`, `ory-social-login` (Google, GitHub, Apple…), `ory-permissions-onboarding`, and playbooks for wiring Ory into your own agents, E2B sandboxes, or Temporal workers. A built-in **Ory MCP server** lets OpenClaw manage identities, projects, and permissions straight from chat.
-## Configure by hand (CI / advanced)
-The guided setup covers most people. For scripted or CI setups, or to point at an existing Ory Network project, configure directly. Settings are saved to `~/.config/ory-agent-plugins/config.json` and shared across all your Ory agent plugins; environment variables win when both are set.
+| Value | Flag | Environment variable |
+|---|---|---|
+| Project URL | `--project-url` | `ORY_PROJECT_URL` |
+| Agent Security URL | `--agent-security-url` | `ORY_AGENT_SECURITY_URL` |
+| Sign-in client id override (default `ory-agent-security-login`) | `--oauth2-client-id` | `ORY_OAUTH2_CLIENT_ID` |
 ```bash
 npx -y -p @ory/openclaw ory-openclaw configure \
   --project-url https://<slug>.projects.oryapis.com \
-  --oauth2-client-id <sign-in client id>
+  --agent-security-url https://agents.console.ory.com
 ```
-OpenClaw's own identity registers itself automatically on first run — nothing to create. The `--oauth2-client-id` is the one piece browser sign-in needs; the guided setup makes it for you, or see below to do it by hand. For logging-only with no checks, use `--audit-only`.
-<details>
-<summary>Create the sign-in client by hand</summary>
+`install` accepts the same flags, so you can register the plugin **and** connect in one shot (`install --project-url <URL> --agent-security-url <URL>`). The login client defaults to `ory-agent-security-login`; custom deployments can override it with `--oauth2-client-id`. Existing configurations fall back to the project URL when the Agent Security URL is unset. To turn sign-in and checks back off later, use `configure --disconnect`.
-The guided setup normally does this. To do it yourself, create a **public** OAuth2 client (no secret) listing all four loopback URLs — the plugin tries each in turn so sign-in survives a busy port:
-```bash
-ory create oauth2-client --project <project-id> \
-  --name "Ory Agent Security · user login (PKCE)" \
-  --grant-type authorization_code,refresh_token \
-  --response-type code \
-  --scope openid,offline_access \
-  --token-endpoint-auth-method none \
-  --redirect-uri http://127.0.0.1:47823/callback \
-  --redirect-uri http://127.0.0.1:47824/callback \
-  --redirect-uri http://127.0.0.1:47825/callback \
-  --redirect-uri http://127.0.0.1:47826/callback
-```
+**Ory Network or OEL.** Either works. For an Ory Network project the URL is `https://<slug>.projects.oryapis.com`; for a self-hosted **Ory Enterprise License** deployment, point `--project-url` at that deployment's base URL and use the sign-in client id from its Agent Security configuration. Everything downstream — sign-in, checks, delegation — is identical.
-Pass the resulting id to `configure --oauth2-client-id`. Running headless with a session token already? Set `ORY_USER_SESSION_TOKEN` and skip the browser step entirely.
+**There is nothing else for you to create.** The sign-in client, the permission model, the per-tool grants and blocks, and the observe/enforce posture are all provisioned in the Console by someone with project access. At runtime the plugin only *reads* permissions — it has no write path into your project, which is why installing it needs no workspace privilege. Each OpenClaw session registers its own identity automatically on first use.
-</details>
+Sign-in runs at the start of every session and never blocks — a declined, skipped, or timed-out login simply leaves that session without a user identity.
-With nothing configured, the plugin still loads and runs in **pass-through mode**: skills and logging work, but no checks run and nothing is blocked. Perfectly fine if you only want the app-building features.
+Settings are saved to `~/.config/ory-agent-plugins/config.json` and shared across all your Ory agent plugins; environment variables win when both are set. Running headless with an OAuth2 access token already? Set `ORY_USER_OAUTH2_TOKEN` and the browser step is skipped entirely.
 ## Commands
 ```
-ory-openclaw install | uninstall        Install/remove; --reconfigure re-runs setup, --no-web forces the terminal wizard, --no-configure skips it
+ory-openclaw install | uninstall         Install (add --project-url to also connect Agent Security) / remove; --project-dir <path> targets another project
 ory-openclaw status                      Show configuration, identities, permission coverage, recent activity
-ory-openclaw dashboard                   Open the live browser dashboard (status + service health + Change stack)
-ory-openclaw watch                       Tail the live trace stream (OTel spans)
-ory-openclaw permissions <cmd>           status | bootstrap | observe (watch) | enforce (block)
-ory-openclaw configure <flags>           Point at a project by hand (--project-url, --oauth2-client-id, --audit-only)
+ory-openclaw permissions <cmd>           status  (read-only; grants + posture live in the Ory Console)
+ory-openclaw configure <flags>           Connect a project (--project-url) or --disconnect
 ory-openclaw agent <status|unregister>   Manage OpenClaw's own auto-created identity
 ory-openclaw local <up|down|status|…>    Run / manage a local Ory in Docker
-ory-openclaw watch [<trace-file>]        Live-tail the trace of decisions as they happen
+ory-openclaw version                     Print plugin, core, and Node versions (--json for machine-readable)
 ```
 All prefixed with `npx -y -p @ory/openclaw`.
@@ -182,9 +145,8 @@ All prefixed with `npx -y -p @ory/openclaw`.
 ## Troubleshooting
 - **`local-up` fails** — make sure Docker is running and ports `4000`, `4100`, `4455`, and `16686` are free.
-- **Browser sign-in loops** — reset with `ory-openclaw agent unregister` and try again.
-- **Install ran but never asked how to connect** — you're almost certainly on a stale `npx` cache. `npx -p @ory/openclaw` (no version pin) reuses a previously-downloaded copy instead of re-resolving to the latest, so an older CLI whose install predates the setup wizard can run while you believe you're on the current release. The install banner prints the running version; confirm it with `npx -y -p @ory/openclaw ory-openclaw version`. To force the current release, clear the cache and reinstall: `rm -rf ~/.npm/_npx` then `npx -y -p @ory/openclaw ory-openclaw install`. Pinning an exact version (`@ory/openclaw@<version>`) also bypasses the cached copy.
-- **Want to see what's happening** — `npx -y -p @ory/openclaw ory-openclaw status` for a snapshot, `npx -y -p @ory/openclaw ory-openclaw watch` for the live trace stream, or set `ORY_AGENT_DEBUG=true` for a verbose log. Traces and logs live under `~/.config/ory-agent-plugins/openclaw/` (see [See what's happening](#see-whats-happening)).
+- **Browser sign-in loops** (after connecting) — reset with `ory-openclaw agent unregister` and try again.
+- **Running an older CLI than expected** — `npx -p @ory/openclaw` (no version pin) reuses a previously-downloaded copy instead of re-resolving to the latest. The install banner prints the running version; confirm it with `npx -y -p @ory/openclaw ory-openclaw version`. To force the current release, clear the cache and reinstall: `rm -rf ~/.npm/_npx` then `npx -y -p @ory/openclaw ory-openclaw install`. Pinning an exact version (`@ory/openclaw@<version>`) also bypasses the cached copy.
 ## Learn more

package/dist/cli/main.d.ts CHANGED Viewed

@@ -7,6 +7,5 @@
  *   npx ory-openclaw uninstall                         Remove plugin from OpenClaw config
  *   npx ory-openclaw configure                         Set or view Ory project URL and API key
  *   npx ory-openclaw status                            Show plugin status
- *   npx ory-openclaw watch [trace-file]                Watch live trace output
  */
 export {};

package/dist/cli/main.js CHANGED Viewed

@@ -8,7 +8,6 @@
  *   npx ory-openclaw uninstall                         Remove plugin from OpenClaw config
  *   npx ory-openclaw configure                         Set or view Ory project URL and API key
  *   npx ory-openclaw status                            Show plugin status
- *   npx ory-openclaw watch [trace-file]                Watch live trace output
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -53,8 +52,18 @@ const CONFIG_DIR = ".openclaw";
 const PACKAGE_ROOT = path.resolve(__dirname, "..", "..");
 function main() {
     const [command, ...args] = process.argv.slice(2);
+    // `--help` after a matched subcommand: print usage, do nothing else.
+    // Without this the switch below ignores the flag and `install --help`
+    // performs a real install (#221).
+    if ((0, argus_1.shouldPrintHelp)(command, args))
+        return help();
     switch (command) {
         case "install":
+            if (args.includes("--print")) {
+                process.argv = ["node", "setup.js", ...args];
+                require("./setup.js");
+                break;
+            }
             (0, argus_1.beginDeferNextSteps)();
             install(args);
             (0, argus_1.runPostInstall)("ory-openclaw", "openclaw", args).then(() => process.exit(0), (err) => {
@@ -64,7 +73,10 @@ function main() {
             break;
         case "uninstall":
             uninstall(args);
-            (0, argus_1.clearCredentialsForUninstall)().then(() => process.exit(0), (err) => {
+            (0, argus_1.clearCredentialsForUninstall)({
+                harness: "openclaw",
+                purge: args.includes("--purge"),
+            }).then(() => process.exit(0), (err) => {
                 console.error(err.message ?? err);
                 process.exit(1);
             });
@@ -73,7 +85,7 @@ function main() {
             (0, argus_1.runConfigureCommand)("ory-openclaw", args);
             break;
         case "agent":
-            (0, argus_1.runAgentCommand)("ory-openclaw", args).then((code) => process.exit(code), (err) => {
+            (0, argus_1.runAgentCommand)("ory-openclaw", "openclaw", args).then((code) => process.exit(code), (err) => {
                 console.error(err.message ?? err);
                 process.exit(1);
             });
@@ -90,17 +102,11 @@ function main() {
                 process.exit(1);
             });
             break;
-        case "local":
-            (0, argus_1.runLocalCommand)("ory-openclaw", args).catch((err) => {
-                console.error(err.message ?? err);
-                process.exit(1);
-            });
-            break;
         case "watch":
-            (0, argus_1.runWatchCommand)("openclaw", args);
+            (0, argus_1.runWatchCommand)("ory-openclaw", "openclaw", args).then((code) => process.exit(code), (err) => { console.error(err.message ?? err); process.exit(1); });
             break;
-        case "dashboard":
-            (0, argus_1.runDashboardCommand)("ory-openclaw", "openclaw", args).then((code) => process.exit(code), (err) => {
+        case "local":
+            (0, argus_1.runLocalCommand)("ory-openclaw", args).catch((err) => {
                 console.error(err.message ?? err);
                 process.exit(1);
             });
@@ -142,11 +148,33 @@ function install(args) {
     const configPath = getOpenClawConfigPath(projectDir);
     ensureConfigDir(projectDir);
     const config = (0, argus_1.readJsonFile)(configPath);
-    const merged = (0, plugin_config_js_1.registerPluginInConfig)(config, projectDir);
+    // OpenClaw loads the plugin in-process from a directory on
+    // `plugins.load.paths`, so the runtime dir *is* the registration — there is
+    // no hook subprocess and no hook shim.
+    const runtime = (0, argus_1.wireRuntime)({
+        harness: "openclaw",
+        packageName: "@ory/openclaw",
+        packageRoot: PACKAGE_ROOT,
+        installCommand: "npx -y -p @ory/openclaw ory-openclaw install",
+        args,
+        entryRelPath: "dist/index.js",
+        inProcess: true,
+    });
+    console.log(runtime.target.kind === "linked"
+        ? `Runtime: linked to ${runtime.target.packageDir} (dev)`
+        : `Runtime: ${runtime.target.packageName}@${runtime.target.version} in ${runtime.target.storeDir}`);
+    for (const pruned of runtime.prunedStores) {
+        console.log(`  Removed stale runtime: ${pruned}`);
+    }
+    let merged = (0, plugin_config_js_1.registerPluginInConfig)(config, runtime.target.packageDir);
+    if (runtime.mcpServer) {
+        merged = (0, argus_1.mergeMcpServer)(merged, runtime.mcpServer);
+    }
     fs.writeFileSync(configPath, JSON.stringify(merged, null, 2) + "\n");
     (0, assets_js_1.installOpenclawOryAssets)(projectDir);
     console.log(`Ory plugin registered in ${configPath}`);
     console.log(`  Plugin id: ${plugin_config_js_1.PLUGIN_ID}`);
+    console.log(`  Loads from: ${runtime.target.packageDir}`);
     console.log(`  Skills + commands installed under ${path.join(projectDir, CONFIG_DIR, "skills")}`);
     (0, argus_1.printEnvHelp)("ory-openclaw");
 }
@@ -159,9 +187,14 @@ function uninstall(args) {
     }
     (0, assets_js_1.uninstallOpenclawOryAssets)(projectDir);
     const config = (0, argus_1.readJsonFile)(configPath);
-    const updated = (0, plugin_config_js_1.unregisterPluginFromConfig)(config, projectDir);
+    let updated = (0, plugin_config_js_1.unregisterPluginFromConfig)(config);
+    updated = (0, argus_1.removeMcpServer)(updated);
     fs.writeFileSync(configPath, JSON.stringify(updated, null, 2) + "\n");
     console.log(`Ory plugin and skills removed from ${configPath}`);
+    (0, argus_1.removeRuntimeWiring)("openclaw");
+    for (const pruned of (0, argus_1.pruneRuntimeStores)()) {
+        console.log(`  Removed runtime: ${pruned}`);
+    }
 }
 async function status(args) {
     const projectDir = parseProjectDir(args);
@@ -194,23 +227,21 @@ Commands:
   uninstall [--project-dir <path>] Remove the Ory plugin from OpenClaw config
   configure                        Set or view Ory project URL and API key
   agent <cmd>                      Manage the agent's OAuth2 (DCR) identity (status, unregister)
-  permissions <cmd>                Manage permission mode and tool permissions (status, bootstrap, observe, enforce)
+  permissions                      Show the live permission mode and per-tool coverage
   status [--project-dir <path>]    Show plugin configuration and status
-  dashboard            Open the Ory Agent dashboard (system health + configuration)
-  watch [trace-file]               Watch live trace output
+  watch [--json] [--lines <count>] Follow the live activity/debug log
   version                          Show version and the ory-agent-plugins build commit
   local <cmd>                      Manage local Ory dev environment (up, down, status, seed, ...)
 After installing, the plugin hooks into these OpenClaw lifecycle events:
   session_start        Verify agent session via Ory Identities
   before_tool_call     Check tool permissions via Ory Permissions (can block)
-  after_tool_call      Record tool completion trace
+  after_tool_call      Record tool completion activity
 Examples:
   npx -y -p @ory/openclaw ory-openclaw install           # Register in current directory
-  npx -y -p @ory/openclaw ory-openclaw configure --project-url https://my.oryapis.com --api-key ory_pat_...
+  npx -y -p @ory/openclaw ory-openclaw configure --project-url https://my.oryapis.com --agent-security-url https://agents.console.ory.com
   npx -y -p @ory/openclaw ory-openclaw status            # Check configuration
-  npx -y -p @ory/openclaw ory-openclaw watch             # Watch trace output in real-time
   npx -y -p @ory/openclaw ory-openclaw uninstall         # Remove plugin
 `);
 }

package/dist/cli/plugin-config.d.ts CHANGED Viewed

@@ -30,23 +30,27 @@ type Rec = Record<string, unknown>;
  * Resolve the directory that contains the plugin's `openclaw.plugin.json`
  * manifest, so it can be registered on `plugins.load.paths`.
  *
- * Prefer the copy installed in the target project's `node_modules` — that path
- * is stable across sessions. Fall back to the package root of the currently
- * running CLI (best effort; under a bare `npx` run this is the ephemeral npx
- * cache, which is why the README recommends `npm install` or the native
- * `openclaw plugins install` flow).
+ * This is the runtime directory the install resolved: a materialized store
+ * under the shared data dir, or a linked workspace build. Both are stable
+ * across sessions, which the previous candidates were not — the project's
+ * `node_modules` disappears with a `rm -rf`, and the running CLI's own package
+ * root is npx's ephemeral cache under the documented `npx -p @ory/openclaw`
+ * invocation.
+ *
+ * Falls back to the wiring recorded in the runtime manifest when no runtime is
+ * passed (the uninstall path, which must find the same path install wrote).
  */
-export declare function resolvePluginRoot(projectDir: string): string;
+export declare function resolvePluginRoot(runtimeDir?: string): string;
 /**
  * Non-destructively register + enable the Ory plugin in an OpenClaw config
  * object. Returns a new config; does not mutate the input.
  */
-export declare function registerPluginInConfig(config: Rec, projectDir: string): Rec;
+export declare function registerPluginInConfig(config: Rec, runtimeDir?: string): Rec;
 /**
  * Non-destructively remove the Ory plugin from an OpenClaw config object,
  * leaving any other plugins' config intact. Returns a new config.
  */
-export declare function unregisterPluginFromConfig(config: Rec, projectDir: string): Rec;
+export declare function unregisterPluginFromConfig(config: Rec, runtimeDir?: string): Rec;
 /** True when the plugin is enabled under the current nested schema. */
 export declare function isPluginRegistered(config: Rec): boolean;
 export {};

package/dist/cli/plugin-config.js CHANGED Viewed

@@ -61,8 +61,8 @@ exports.resolvePluginRoot = resolvePluginRoot;
 exports.registerPluginInConfig = registerPluginInConfig;
 exports.unregisterPluginFromConfig = unregisterPluginFromConfig;
 exports.isPluginRegistered = isPluginRegistered;
-const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
+const argus_1 = require("@ory/argus");
 /** Plugin manifest id (from `openclaw.plugin.json`). */
 exports.PLUGIN_ID = "ory-agent-security";
 /** npm module name — used only to migrate away the legacy flat-array shape. */
@@ -77,30 +77,36 @@ function asRec(value) {
  * Resolve the directory that contains the plugin's `openclaw.plugin.json`
  * manifest, so it can be registered on `plugins.load.paths`.
  *
- * Prefer the copy installed in the target project's `node_modules` — that path
- * is stable across sessions. Fall back to the package root of the currently
- * running CLI (best effort; under a bare `npx` run this is the ephemeral npx
- * cache, which is why the README recommends `npm install` or the native
- * `openclaw plugins install` flow).
+ * This is the runtime directory the install resolved: a materialized store
+ * under the shared data dir, or a linked workspace build. Both are stable
+ * across sessions, which the previous candidates were not — the project's
+ * `node_modules` disappears with a `rm -rf`, and the running CLI's own package
+ * root is npx's ephemeral cache under the documented `npx -p @ory/openclaw`
+ * invocation.
+ *
+ * Falls back to the wiring recorded in the runtime manifest when no runtime is
+ * passed (the uninstall path, which must find the same path install wrote).
  */
-function resolvePluginRoot(projectDir) {
-    const inProject = path.join(projectDir, "node_modules", exports.PLUGIN_MODULE);
-    if (fs.existsSync(path.join(inProject, "openclaw.plugin.json"))) {
-        return path.resolve(inProject);
-    }
-    // dist/cli/plugin-config.js -> package root
+function resolvePluginRoot(runtimeDir) {
+    if (runtimeDir)
+        return path.resolve(runtimeDir);
+    const wired = (0, argus_1.getRuntimeWiring)("openclaw");
+    if (wired)
+        return path.resolve(wired.packageDir);
+    // Nothing wired (uninstall before install, or a manifest that was wiped):
+    // fall back to the running CLI so an existing registration still matches.
     return path.resolve(__dirname, "..", "..");
 }
 /**
  * Non-destructively register + enable the Ory plugin in an OpenClaw config
  * object. Returns a new config; does not mutate the input.
  */
-function registerPluginInConfig(config, projectDir) {
+function registerPluginInConfig(config, runtimeDir) {
     const next = { ...config };
     // asRec drops any legacy flat `plugins: [...]` array — that shape was never
     // read by current OpenClaw, so nothing functional is lost by migrating it.
     const plugins = asRec(next.plugins);
-    const root = resolvePluginRoot(projectDir);
+    const root = resolvePluginRoot(runtimeDir);
     // 1. Discovery — add the package dir to plugins.load.paths (deduped).
     const load = asRec(plugins.load);
     const paths = Array.isArray(load.paths)
@@ -129,7 +135,7 @@ function registerPluginInConfig(config, projectDir) {
  * Non-destructively remove the Ory plugin from an OpenClaw config object,
  * leaving any other plugins' config intact. Returns a new config.
  */
-function unregisterPluginFromConfig(config, projectDir) {
+function unregisterPluginFromConfig(config, runtimeDir) {
     const next = { ...config };
     if (next.plugins == null)
         return next;
@@ -143,7 +149,7 @@ function unregisterPluginFromConfig(config, projectDir) {
         return next;
     }
     const plugins = asRec(next.plugins);
-    const root = resolvePluginRoot(projectDir);
+    const root = resolvePluginRoot(runtimeDir);
     // Remove our load path.
     const load = asRec(plugins.load);
     if (Array.isArray(load.paths)) {

package/dist/cli/setup.js CHANGED Viewed

@@ -65,7 +65,8 @@ function main() {
     }
     const args = (0, argus_1.parseSetupArgs)();
     if (args.print) {
-        console.log(JSON.stringify((0, plugin_config_js_1.registerPluginInConfig)({}, args.projectDir), null, 2));
+        // Nothing is resolved or written on a --print run.
+        console.log(JSON.stringify((0, plugin_config_js_1.registerPluginInConfig)({}, "<resolved runtime>"), null, 2));
         return;
     }
     const configPath = getConfigPath(args);
@@ -76,15 +77,30 @@ function main() {
             return;
         }
         (0, assets_js_1.uninstallOpenclawOryAssets)(args.projectDir);
-        let updated = (0, plugin_config_js_1.unregisterPluginFromConfig)(existing, args.projectDir);
+        let updated = (0, plugin_config_js_1.unregisterPluginFromConfig)(existing);
         updated = (0, argus_1.removeMcpServer)(updated);
         (0, argus_1.writeJsonFile)(configPath, updated);
         console.log(`Removed Ory plugin, MCP server, and skills from ${configPath}`);
+        (0, argus_1.removeRuntimeWiring)("openclaw");
+        for (const pruned of (0, argus_1.pruneRuntimeStores)()) {
+            console.log(`  Removed runtime: ${pruned}`);
+        }
         return;
     }
     ensureConfigDir(args);
-    let merged = (0, plugin_config_js_1.registerPluginInConfig)(existing, args.projectDir);
-    merged = (0, argus_1.mergeMcpServer)(merged);
+    const runtime = (0, argus_1.wireRuntime)({
+        harness: "openclaw",
+        packageName: "@ory/openclaw",
+        packageRoot: path.resolve(__dirname, "..", ".."),
+        installCommand: "npx -y -p @ory/openclaw ory-openclaw install",
+        args: process.argv.slice(2),
+        entryRelPath: "dist/index.js",
+        inProcess: true,
+    });
+    let merged = (0, plugin_config_js_1.registerPluginInConfig)(existing, runtime.target.packageDir);
+    if (runtime.mcpServer) {
+        merged = (0, argus_1.mergeMcpServer)(merged, runtime.mcpServer);
+    }
     (0, argus_1.writeJsonFile)(configPath, merged);
     (0, assets_js_1.installOpenclawOryAssets)(args.projectDir);
     console.log(`Ory plugin and MCP server configured in ${configPath}`);
@@ -99,7 +115,10 @@ main();
 // stored Ory credentials. When required by the plugin's main CLI, that
 // command owns the purge, so the `require.main` guard prevents a double run.
 if (require.main === module && process.argv.includes("--uninstall")) {
-    (0, argus_1.clearCredentialsForUninstall)().then(() => process.exit(0), (err) => {
+    (0, argus_1.clearCredentialsForUninstall)({
+        harness: "openclaw",
+        purge: process.argv.includes("--purge"),
+    }).then(() => process.exit(0), (err) => {
         console.error(err.message ?? err);
         process.exit(1);
     });

package/dist/plugin.d.ts CHANGED Viewed

@@ -1,27 +1,10 @@
-import { OryAgentClient, ensureUserAuthenticated, ensureAgentIdentity, ensureSubAgentIdentity } from "@ory/argus";
+import { OryAgentClient, ensureAgentIdentity, ensureSubAgentIdentity, ensureUserAuthenticated } from "@ory/argus";
 import type { OpenClawPluginEntry } from "./types.js";
 export interface CreateOryPluginDeps {
-    /** Test injection point for the user login flow. */
     userLogin?: typeof ensureUserAuthenticated;
-    /** Test injection point for the agent identity gate. */
     agentGate?: typeof ensureAgentIdentity;
-    /** Test injection point for the sub-agent identity resolver. */
     subAgentGate?: typeof ensureSubAgentIdentity;
 }
-/**
- * Create the Ory plugin entry for OpenClaw.
- *
- * OpenClaw plugins export { id, name, register(api) } where register
- * receives a PluginApi for registering hooks. The `before_tool_call`
- * hook can return `{ block: true }` to deny tool execution — this
- * makes permission checks enforceable, unlike harnesses that can only
- * log denials.
- *
- * The user login runs every session but never blocks: it emits the audit
- * span, refreshes tokens, and prompts for the project URL when interactive.
- * Enforcement is governed solely by permissionMode at tool-call time.
- */
 export declare function createOryPlugin(clientOrConfig?: OryAgentClient | {
     projectUrl: string;
-    apiKey?: string;
 }, deps?: CreateOryPluginDeps): OpenClawPluginEntry;

package/dist/plugin.js CHANGED Viewed

@@ -2,19 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createOryPlugin = createOryPlugin;
 const argus_1 = require("@ory/argus");
-/**
- * Create the Ory plugin entry for OpenClaw.
- *
- * OpenClaw plugins export { id, name, register(api) } where register
- * receives a PluginApi for registering hooks. The `before_tool_call`
- * hook can return `{ block: true }` to deny tool execution — this
- * makes permission checks enforceable, unlike harnesses that can only
- * log denials.
- *
- * The user login runs every session but never blocks: it emits the audit
- * span, refreshes tokens, and prompts for the project URL when interactive.
- * Enforcement is governed solely by permissionMode at tool-call time.
- */
+const HARNESS = "openclaw";
 function createOryPlugin(clientOrConfig, deps = {}) {
     return {
         id: "ory-agent-security",
@@ -23,195 +11,91 @@ function createOryPlugin(clientOrConfig, deps = {}) {
             const client = clientOrConfig instanceof argus_1.OryAgentClient
                 ? clientOrConfig
                 : clientOrConfig
-                    ? new argus_1.OryAgentClient({
-                        ...clientOrConfig,
-                        harness: "openclaw",
-                    })
-                    : argus_1.OryAgentClient.fromEnv("openclaw");
-            api.registerHook("session_start", createSessionStartHandler(client, deps), { name: "ory.session-verify", description: "Verify session via Ory Identities" });
-            api.registerHook("before_agent_run", createBeforeAgentRunHandler(client, deps), { name: "ory.user-login", description: "Block runs when the user login denies" });
-            api.registerHook("before_tool_call", createBeforeToolCallHandler(client), { name: "ory.permission-check", description: "Check tool permissions via Ory Permissions" });
-            api.registerHook("after_tool_call", createAfterToolCallHandler(client), { name: "ory.trace-complete", description: "Record tool completion trace" });
-            api.registerHook("subagent_spawning", createSubagentSpawningHandler(client, deps), { name: "ory.subagent-register", description: "Register Ory identity and write delegation tuple for spawned sub-agent" });
-            api.registerHook("subagent_spawned", createSubagentSpawnedHandler(client), { name: "ory.subagent-spawned", description: "Record sub-agent spawn audit span" });
-            api.registerHook("subagent_ended", createSubagentEndedHandler(client), { name: "ory.subagent-ended", description: "Record sub-agent termination audit span" });
+                    ? new argus_1.OryAgentClient({ ...clientOrConfig, harness: HARNESS })
+                    : argus_1.OryAgentClient.fromEnv(HARNESS);
+            const subagents = new Map();
+            api.registerHook("session_start", createSessionStartHandler(client, deps), {
+                name: "ory.session-verify",
+                description: "Verify session via Ory Identities",
+            });
+            api.registerHook("before_agent_run", createBeforeAgentRunHandler(client, deps), {
+                name: "ory.user-login",
+                description: "Block runs when the user login denies",
+            });
+            api.registerHook("before_tool_call", createBeforeToolCallHandler(client, subagents), {
+                name: "ory.permission-check",
+                description: "Check tool permissions via Ory Permissions",
+            });
+            api.registerHook("after_tool_call", createAfterToolCallHandler(client), {
+                name: "ory.activity-complete",
+                description: "Record tool completion activity",
+            });
+            api.registerHook("subagent_spawning", createSubagentSpawningHandler(client, deps, subagents), {
+                name: "ory.subagent-register",
+                description: "Register Ory identity and write delegation tuple for spawned sub-agent",
+            });
+            api.registerHook("subagent_spawned", createSubagentSpawnedHandler(client), {
+                name: "ory.subagent-spawned",
+                description: "Record sub-agent spawn activity",
+            });
+            api.registerHook("subagent_ended", createSubagentEndedHandler(client, subagents), {
+                name: "ory.subagent-ended",
+                description: "Record sub-agent termination activity",
+            });
         },
     };
 }
-// ─── session_start ─────────────────────────────────────────────────
 function createSessionStartHandler(client, deps) {
-    return async (ctx) => {
+    return (ctx) => (0, argus_1.withHookContext)(client, { sessionId: ctx.sessionId }, async () => {
         client.logger.info("lifecycle.session_start", {
             sessionId: ctx.sessionId,
             model: ctx.model,
         });
-        // Set trace context for this session
-        client.tracer.setContext({
-            traceId: (0, argus_1.deriveTraceId)(ctx.sessionId),
-            sessionId: ctx.sessionId,
-        });
-        // Run the user login every session. Authentication is non-blocking:
-        // the flow emits the user.auth audit span, refreshes tokens, and
-        // prompts for the project URL when interactive, but never prevents the
-        // session from starting — enforcement is governed solely by
-        // permissionMode at tool-call time.
-        const userGate = deps.userLogin ?? argus_1.ensureUserAuthenticated;
-        await userGate(client, {
+        await (0, argus_1.sessionStart)(client, {
+            harness: HARNESS,
             binName: "ory-openclaw",
-            harness: "openclaw",
+            userLogin: deps.userLogin,
+            agentGate: deps.agentGate,
+            activityAttributes: { model: ctx.model },
         });
-        // Resolve the agent identity (machine credentials). Never blocks;
-        // attaches the agent's bearer token to outgoing Ory API calls.
-        const agentGate = deps.agentGate ?? argus_1.ensureAgentIdentity;
-        await agentGate(client, { projectUrl: (0, argus_1.resolveConfig)().projectUrl, harness: "openclaw" });
-        // Record the user→agent delegation so the audit trail captures that
-        // this user authorized this agent for this session. Best-effort and
-        // written at most once per install: requires both principals to be
-        // populated, and any failure is logged and swallowed (fail-open —
-        // delegation tracking is for audit, not enforcement).
-        await (0, argus_1.writeUserDelegatesAgent)(client);
-    };
+    });
 }
-// ─── before_tool_call ──────────────────────────────────────────────
-function createBeforeToolCallHandler(client) {
-    return async (ctx) => {
+function createBeforeToolCallHandler(client, subagents) {
+    return (ctx) => (0, argus_1.withHookContext)(client, { sessionId: ctx.sessionId }, async () => {
         client.logger.info("lifecycle.before_tool_call", {
             toolId: ctx.toolId,
             toolName: ctx.toolName,
             sessionId: ctx.sessionId,
             callId: ctx.callId,
         });
-        // Set trace context for this tool invocation
-        client.tracer.setContext({
-            traceId: (0, argus_1.deriveTraceId)(ctx.sessionId),
-            sessionId: ctx.sessionId,
-        });
-        const inputSummary = (0, argus_1.summarizeToolInput)(ctx.toolId, ctx.args);
-        // In audit-only mode, log the invocation but skip permission checks
-        if ((0, argus_1.resolveConfig)().auditOnly) {
-            client.tracer.record("tool.invoke", "ok", {
-                attributes: { toolName: ctx.toolId, ...inputSummary },
-            });
-            return;
-        }
-        // If Ory is not configured, pass through
-        if (!(0, argus_1.resolveConfig)().projectUrl) {
-            client.tracer.record("tool.invoke", "skipped", {
-                attributes: { toolName: ctx.toolId, reason: "not_configured", ...inputSummary },
-            });
-            return;
-        }
-        const subject = (0, argus_1.resolveUserSubject)(client, ctx.sessionId ? `session:${ctx.sessionId}` : "agent:openclaw");
-        const subjectId = (0, argus_1.subjectLabel)(subject);
-        const mcpTool = (0, argus_1.parseMcpToolGeneric)(ctx.toolId);
-        try {
-            if (mcpTool) {
-                const mcpResult = await (0, argus_1.checkMcpPermission)(client, mcpTool, {
-                    subject,
-                    spanAttributes: { toolName: ctx.toolId },
-                });
-                const mcpAttrs = {
-                    toolName: ctx.toolId,
-                    mcpServer: mcpTool.serverName,
-                    mcpTool: mcpTool.toolName,
-                    ...inputSummary,
-                };
-                const decision = (0, argus_1.applyPermissionMode)(client, mcpResult.allowed, {
-                    object: mcpTool.serverName,
-                    relation: "use",
-                    subjectId,
-                    ...("subjectSet" in subject ? { subjectSet: subject.subjectSet } : {}),
-                    spanAttributes: mcpAttrs,
-                });
-                const decisionAttrs = decision.spanAttributes;
-                if (decision.kind === "allow") {
-                    client.tracer.record("tool.invoke", "ok", {
-                        attributes: { ...mcpAttrs, ...decisionAttrs },
-                    });
-                    return;
-                }
-                if (decision.kind === "observe") {
-                    client.tracer.record("tool.block", "denied", {
-                        attributes: { ...mcpAttrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
-                    });
-                    client.tracer.record("tool.invoke", "ok", {
-                        attributes: { ...mcpAttrs, ...decisionAttrs, allowed: false, observed: true },
-                    });
-                    return;
-                }
-                client.tracer.record("tool.block", "denied", {
-                    attributes: { ...mcpAttrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(true) },
-                });
-                const blockReason = (0, argus_1.formatDenialMessage)({
-                    tool: ctx.toolId,
-                    subjectId,
-                    mcp: mcpTool,
-                });
-                client.logger.warn("tool.denied", {
-                    toolId: ctx.toolId,
-                    subjectId,
-                    message: blockReason,
-                });
-                return { block: true, blockReason };
-            }
-            const namespace = resolveNamespace();
-            const outcome = await (0, argus_1.gateToolCall)(client, {
-                harness: "openclaw",
-                toolName: ctx.toolId,
-                check: { namespace, object: ctx.toolId, relation: "use", ...subject },
-                spanAttributes: { toolName: ctx.toolId },
-            });
-            // Interactive tools (operator-extensible via ORY_INTERACTIVE_TOOLS):
-            // the user.interaction span is already recorded; pass through.
-            if (outcome.kind === "interactive") {
-                return;
-            }
-            const decision = outcome;
-            if (decision.kind === "fail_open") {
-                handlePermissionError(decision.error, ctx.toolId, client);
-                return;
-            }
-            const attrs = { toolName: ctx.toolId, ...inputSummary };
-            const decisionAttrs = decision.spanAttributes;
-            if (decision.kind === "allow") {
-                client.tracer.record("tool.invoke", "ok", {
-                    attributes: { ...attrs, ...decisionAttrs, allowed: true },
-                });
-                return;
-            }
-            if (decision.kind === "observe") {
-                client.tracer.record("tool.block", "denied", {
-                    attributes: { ...attrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
-                });
-                client.tracer.record("tool.invoke", "ok", {
-                    attributes: { ...attrs, ...decisionAttrs, allowed: false, observed: true },
-                });
-                return;
-            }
-            client.tracer.record("tool.block", "denied", {
-                attributes: { ...attrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(true) },
-            });
-            const blockReason = (0, argus_1.formatDenialMessage)({
-                tool: ctx.toolId,
-                subjectId,
-                namespace,
-            });
-            client.logger.warn("tool.denied", {
-                toolId: ctx.toolId,
-                subjectId,
-                message: blockReason,
-            });
-            return { block: true, blockReason };
-        }
-        catch (err) {
-            handlePermissionError(err, ctx.toolId, client);
-            // Fail open — allow the tool call
+        const result = await (0, argus_1.gate)(client, {
+            harness: HARNESS,
+            toolName: ctx.toolId,
+            toolArgs: ctx.args,
+            subjectFallback: ctx.sessionId ? `session:${ctx.sessionId}` : "agent:openclaw",
+            canBlock: true,
+            mcpTool: (0, argus_1.parseMcpToolGeneric)(ctx.toolId) ?? undefined,
+            principals: openClawSubagentPrincipals(ctx, subagents),
+        });
+        if (result.blocked) {
+            return { block: true, blockReason: result.denialMessage };
         }
+    });
+}
+function openClawSubagentPrincipals(ctx, subagents) {
+    const childSession = ctx.sessionKey ?? ctx.sessionId;
+    const subagent = subagents.get(childSession);
+    if (!subagent)
+        return undefined;
+    return {
+        subAgentClientId: subagent.clientId,
+        subAgentType: subagent.type,
+        perSpawnId: childSession,
+        sessionId: subagent.parentSession,
     };
 }
-// ─── after_tool_call ───────────────────────────────────────────────
 function createAfterToolCallHandler(client) {
-    return async (ctx) => {
+    return (ctx) => (0, argus_1.withHookContext)(client, { sessionId: ctx.sessionId }, async () => {
         client.logger.info("lifecycle.after_tool_call", {
             toolId: ctx.toolId,
             toolName: ctx.toolName,
@@ -220,59 +104,40 @@ function createAfterToolCallHandler(client) {
             durationMs: ctx.durationMs,
             hasError: !!ctx.error,
         });
-        // Set trace context for this tool completion
-        client.tracer.setContext({
-            traceId: (0, argus_1.deriveTraceId)(ctx.sessionId),
-            sessionId: ctx.sessionId,
-        });
-        const status = ctx.error ? "error" : "ok";
-        client.tracer.record("tool.complete", status, {
-            attributes: {
+        if (ctx.error)
+            client.logger.debug("lifecycle.after_tool_call.error", { error: ctx.error });
+        if (ctx.error) {
+            (0, argus_1.fail)(client, {
                 toolName: ctx.toolId,
-                ...(0, argus_1.summarizeToolInput)(ctx.toolId, ctx.args),
-                ...(0, argus_1.summarizeToolOutput)(ctx.toolId, ctx.result),
-                durationMs: ctx.durationMs,
-                ...(ctx.error ? { error: ctx.error } : {}),
-            },
-        });
-    };
+                input: ctx.args,
+                error: ctx.error,
+                extraActivityAttributes: { durationMs: ctx.durationMs },
+            });
+        }
+        else {
+            (0, argus_1.complete)(client, {
+                toolName: ctx.toolId,
+                input: ctx.args,
+                output: ctx.result,
+                extraActivityAttributes: { durationMs: ctx.durationMs },
+            });
+        }
+    });
 }
-// ─── before_agent_run ──────────────────────────────────────────────
-//
-// Per-turn user login refresh. The user login runs at `session_start` and
-// again here; it never blocks (authentication is non-blocking — enforcement
-// is governed by permissionMode at tool-call time). `ensureUserAuthenticated`
-// reuses persisted tokens, so per-turn calls are non-interactive after the
-// first session.
+// OpenClaw refreshes the interactive user credential before every model turn.
 function createBeforeAgentRunHandler(client, deps) {
-    return async (ctx) => {
-        client.tracer.setContext({
-            traceId: (0, argus_1.deriveTraceId)(ctx.sessionKey ?? ctx.sessionId ?? "openclaw"),
-            sessionId: ctx.sessionKey ?? ctx.sessionId,
-        });
-        // Per-turn user-login refresh. Non-blocking: it reuses persisted tokens
-        // (non-interactive after the first session) and never stops the run —
-        // enforcement is governed by permissionMode at tool-call time.
-        const userGate = deps.userLogin ?? argus_1.ensureUserAuthenticated;
-        await userGate(client, {
-            binName: "ory-openclaw",
-            harness: "openclaw",
-        });
-        return;
-    };
+    return (ctx) => (0, argus_1.withHookContext)(client, {
+        sessionId: ctx.sessionKey ?? ctx.sessionId,
+    }, async () => {
+        const userLogin = deps.userLogin ?? argus_1.ensureUserAuthenticated;
+        await userLogin(client, { binName: "ory-openclaw", harness: HARNESS });
+    });
 }
-// ─── subagent_spawning ─────────────────────────────────────────────
-//
-// Fires before a child agent run starts. We resolve a distinct OAuth2
-// identity for the sub-agent (DCR) and write the agent→sub-agent
-// delegation tuple. Best-effort: failures here never abort the child run.
-function createSubagentSpawningHandler(client, deps) {
-    return async (ctx) => {
+function createSubagentSpawningHandler(client, deps, subagents) {
+    return (ctx) => (0, argus_1.withHookContext)(client, {
+        sessionId: ctx.sessionKey,
+    }, async () => {
         const subAgentType = ctx.agentId ?? ctx.label;
-        client.tracer.setContext({
-            traceId: (0, argus_1.deriveTraceId)(ctx.sessionKey ?? ctx.childSessionKey ?? "openclaw"),
-            sessionId: ctx.sessionKey,
-        });
         client.logger.info("lifecycle.subagent_spawning", {
             agentId: ctx.agentId,
             label: ctx.label,
@@ -280,7 +145,7 @@ function createSubagentSpawningHandler(client, deps) {
             mode: ctx.mode,
             requester: ctx.requester,
         });
-        client.tracer.record("subagent.start", "ok", {
+        client.logger.activity("subagent.prepare", "ok", {
             attributes: {
                 subAgentType,
                 agentId: ctx.agentId,
@@ -291,44 +156,40 @@ function createSubagentSpawningHandler(client, deps) {
         });
         if (!subAgentType) {
             client.logger.debug("subagent.no_type", {
-                message: "subagent_spawning event without agentId/label — skipping DCR.",
+                message: "subagent_spawning event without agentId/label; skipping DCR.",
             });
             return;
         }
-        const subAgentGate = deps.subAgentGate ?? argus_1.ensureSubAgentIdentity;
-        let identity;
-        try {
-            identity = await subAgentGate(client, {
-                subAgentType,
-                projectUrl: (0, argus_1.resolveConfig)().projectUrl,
-                harness: "openclaw",
-            });
-        }
-        catch (err) {
-            client.logger.warn("subagent.identity.failed", {
-                subAgentType,
-                message: err instanceof Error ? err.message : String(err),
-            });
-            return;
+        await (0, argus_1.registerSubagent)(client, {
+            harness: HARNESS,
+            subAgentType,
+            subAgentGate: deps.subAgentGate,
+            perSpawnId: ctx.childSessionKey,
+        });
+        if (ctx.childSessionKey) {
+            const credential = ctx.sessionKey
+                ? (0, argus_1.loadSubAgentDynamicCredentials)(HARNESS, ctx.sessionKey, subAgentType)
+                : (0, argus_1.loadSubAgentDynamicCredentials)(HARNESS, subAgentType);
+            if (credential) {
+                subagents.set(ctx.childSessionKey, {
+                    clientId: credential.clientId,
+                    type: subAgentType,
+                    parentSession: ctx.sessionKey,
+                });
+            }
         }
-        if (identity.kind !== "dynamic" || !identity.subject)
-            return;
-        await (0, argus_1.writeAgentDelegatesSubagent)(client, identity.subject, subAgentType);
-    };
+    });
 }
-// ─── subagent_spawned ──────────────────────────────────────────────
 function createSubagentSpawnedHandler(client) {
-    return async (ctx) => {
-        client.tracer.setContext({
-            traceId: (0, argus_1.deriveTraceId)(ctx.sessionKey ?? ctx.childSessionKey ?? "openclaw"),
-            sessionId: ctx.sessionKey,
-        });
+    return (ctx) => (0, argus_1.withHookContext)(client, {
+        sessionId: ctx.sessionKey,
+    }, async () => {
         client.logger.info("lifecycle.subagent_spawned", {
             agentId: ctx.agentId,
             childRunId: ctx.childRunId,
             childSessionKey: ctx.childSessionKey,
         });
-        client.tracer.record("subagent.start", "ok", {
+        client.logger.activity("subagent.start", "ok", {
             attributes: {
                 subAgentType: ctx.agentId ?? ctx.label,
                 agentId: ctx.agentId,
@@ -336,21 +197,21 @@ function createSubagentSpawnedHandler(client) {
                 stage: "spawned",
             },
         });
-    };
+    });
 }
-// ─── subagent_ended ────────────────────────────────────────────────
-function createSubagentEndedHandler(client) {
-    return async (ctx) => {
-        client.tracer.setContext({
-            traceId: (0, argus_1.deriveTraceId)(ctx.sessionKey ?? ctx.childSessionKey ?? "openclaw"),
-            sessionId: ctx.sessionKey,
-        });
+function createSubagentEndedHandler(client, subagents) {
+    return (ctx) => (0, argus_1.withHookContext)(client, {
+        sessionId: ctx.sessionKey,
+    }, async () => {
+        const childSessionKey = ctx.targetSessionKey ?? ctx.childSessionKey;
+        if (childSessionKey)
+            subagents.delete(childSessionKey);
         client.logger.info("lifecycle.subagent_ended", {
             agentId: ctx.agentId,
             childRunId: ctx.childRunId,
             reason: ctx.reason,
         });
-        client.tracer.record("subagent.stop", "ok", {
+        client.logger.activity("subagent.stop", "ok", {
             attributes: {
                 subAgentType: ctx.agentId ?? ctx.label,
                 agentId: ctx.agentId,
@@ -358,41 +219,5 @@ function createSubagentEndedHandler(client) {
                 reason: ctx.reason,
             },
         });
-    };
-}
-// ─── Helpers ───────────────────────────────────────────────────────
-function resolveNamespace() {
-    return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
-}
-function isOryError(err) {
-    return (typeof err === "object" &&
-        err !== null &&
-        "code" in err &&
-        "message" in err);
-}
-function handlePermissionError(err, toolId, client) {
-    if (isOryError(err)) {
-        if (err.code === "network_error" || err.code === "rate_limited") {
-            client.logger.warn("permission.fallback", {
-                toolId,
-                code: err.code,
-                message: "Failing open",
-            });
-            return;
-        }
-        client.logger.error("permission.check.error", {
-            toolId,
-            code: err.code,
-            message: err.message,
-        });
-    }
-    else {
-        client.logger.error("permission.check.error", {
-            toolId,
-            error: err instanceof Error ? err.message : String(err),
-        });
-    }
-    // Fail-open is log-and-allow: no tool.invoke span, matching the core
-    // gate() vocabulary. The errored permission.check span carries the audit
-    // trail for the failed check itself.
+    });
 }

package/dist/types.d.ts CHANGED Viewed

@@ -32,6 +32,11 @@ export interface BeforeToolCallContext {
     args: Record<string, unknown>;
     sessionId: string;
     callId: string;
+    /** Agent definition currently executing the tool, when supplied by OpenClaw. */
+    agentId?: string;
+    /** Session key currently executing the tool; child agents use their child key. */
+    sessionKey?: string;
+    runId?: string;
 }
 export interface AfterToolCallContext {
     toolId: string;
@@ -109,8 +114,10 @@ export interface SubagentSpawnedContext extends SubagentSpawningContext {
 }
 export interface SubagentEndedContext extends SubagentSpawningContext {
     childRunId?: string;
+    /** Canonical OpenClaw identifier for the child session that ended. */
+    targetSessionKey?: string;
     reason?: string;
-    /** Final response/output from the child run (audit-only). */
+    /** Final response/output from the child run (audit-trail only). */
     result?: unknown;
 }
 export interface HookResult {

package/openclaw.plugin.json CHANGED Viewed

@@ -2,6 +2,6 @@
   "id": "ory-agent-security",
   "name": "Ory Agent Security",
   "version": "0.1.0",
-  "description": "Authentication, authorization, and distributed tracing for OpenClaw via Ory",
+  "description": "Authentication, authorization, and activity auditing for OpenClaw via Ory",
   "entry": "./dist/index.js"
 }

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@ory/openclaw",
-  "version": "0.14.0",
+  "version": "1.0.0",
   "description": "Ory plugin for OpenClaw: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -33,8 +33,7 @@
     "agent-security",
     "guardrails",
     "llm",
-    "tracing",
-    "distributed-tracing",
+    "activity-auditing",
     "observability",
     "kratos",
     "keto",
@@ -45,6 +44,10 @@
     "registry": "https://registry.npmjs.org/",
     "provenance": true
   },
+  "reova": {
+    "enabled": true,
+    "endpoint": "https://telemetry.reo.dev/data"
+  },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
@@ -61,12 +64,11 @@
   "files": [
     "dist",
     "openclaw.plugin.json",
-    "!dist/dev",
     "!dist/**/*.tsbuildinfo"
   ],
   "dependencies": {
-    "reo-census": "^1.2.8",
-    "@ory/argus": "0.14.0"
+    "reova": "^0.7.0",
+    "@ory/argus": "1.0.0"
   },
   "engines": {
     "node": ">=22"
@@ -76,7 +78,6 @@
     "clean": "rm -rf dist *.tsbuildinfo",
     "test": "vitest run",
     "test:watch": "vitest",
-    "typecheck": "tsc --noEmit",
-    "dev": "node dist/dev/launcher.js"
+    "typecheck": "tsc --noEmit"
   }
 }