@ory/openclaw 0.2.0 → 0.3.0

package/dist/cli/main.js

@@ -199,7 +199,7 @@ Commands:
   install [--project-dir <path>]   Register the Ory plugin in OpenClaw config
   uninstall [--project-dir <path>] Remove the Ory plugin from OpenClaw config
   configure                        Set or view Ory project URL and API key
-  permissions <cmd>                Manage permission mode and tool tuples (status, bootstrap, observe, enforce)
+  permissions <cmd>                Manage permission mode and tool permissions (status, bootstrap, observe, enforce)
   status [--project-dir <path>]    Show plugin configuration and status
   watch [trace-file]               Watch live trace output
   local <cmd>                      Manage local Ory dev environment (up, down, status, seed, ...)

package/dist/plugin.js

@@ -229,23 +229,27 @@ function createBeforeToolCallHandler(client) {
                     object: mcpTool.serverName,
                     relation: "use",
                     subjectId,
+                    ...("subjectSet" in subject ? { subjectSet: subject.subjectSet } : {}),
                     spanAttributes: mcpAttrs,
                 });
+                const decisionAttrs = decision.spanAttributes;
                 if (decision.kind === "allow") {
-                    client.tracer.record("tool.invoke", "ok", { attributes: mcpAttrs });
+                    client.tracer.record("tool.invoke", "ok", {
+                        attributes: { ...mcpAttrs, ...decisionAttrs },
+                    });
                     return;
                 }
                 if (decision.kind === "observe") {
                     client.tracer.record("tool.block", "denied", {
-                        attributes: { ...mcpAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
+                        attributes: { ...mcpAttrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
                     });
                     client.tracer.record("tool.invoke", "ok", {
-                        attributes: { ...mcpAttrs, allowed: false, observed: true },
+                        attributes: { ...mcpAttrs, ...decisionAttrs, allowed: false, observed: true },
                     });
                     return;
                 }
                 client.tracer.record("tool.block", "denied", {
-                    attributes: { ...mcpAttrs, allowed: false, ...(0, argus_1.alertAttributes)(true) },
+                    attributes: { ...mcpAttrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(true) },
                 });
                 const blockReason = (0, argus_1.formatDenialMessage)({
                     tool: ctx.toolId,
@@ -266,21 +270,24 @@ function createBeforeToolCallHandler(client) {
                 return;
             }
             const attrs = { toolName: ctx.toolId, ...inputSummary };
+            const decisionAttrs = decision.spanAttributes;
             if (decision.kind === "allow") {
-                client.tracer.record("tool.invoke", "ok", { attributes: { ...attrs, allowed: true } });
+                client.tracer.record("tool.invoke", "ok", {
+                    attributes: { ...attrs, ...decisionAttrs, allowed: true },
+                });
                 return;
             }
             if (decision.kind === "observe") {
                 client.tracer.record("tool.block", "denied", {
-                    attributes: { ...attrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
+                    attributes: { ...attrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
                 });
                 client.tracer.record("tool.invoke", "ok", {
-                    attributes: { ...attrs, allowed: false, observed: true },
+                    attributes: { ...attrs, ...decisionAttrs, allowed: false, observed: true },
                 });
                 return;
             }
             client.tracer.record("tool.block", "denied", {
-                attributes: { ...attrs, allowed: false, ...(0, argus_1.alertAttributes)(true) },
+                attributes: { ...attrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(true) },
             });
             const blockReason = (0, argus_1.formatDenialMessage)({
                 tool: ctx.toolId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/openclaw",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Ory plugin for OpenClaw: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -65,7 +65,7 @@
     "!dist/**/*.tsbuildinfo"
   ],
   "dependencies": {
-    "@ory/argus": "0.2.0"
+    "@ory/argus": "0.3.0"
   },
   "engines": {
     "node": ">=24"