@ory/openclaw 0.6.2 → 0.7.0

package/README.md

@@ -43,13 +43,13 @@ From any project where you'd like Ory authentication, inside OpenClaw:
 
 3. **Sign in.** Start your app, visit the login page OpenClaw added, and sign in with the seeded credentials. You now have a real Ory session backed by a real Ory stack — locally, offline, with zero configuration.
 
-4. **Turn on Ory login for the OpenClaw session itself.** *(Optional but recommended.)* Out of the box the plugin only governs your *app*. To also attach an Ory identity to *OpenClaw's* session — so every tool call is attributed to you, not a fallback `session:<id>` subject — set:
+4. **Turn on Ory login for the OpenClaw session itself.** *(Optional but recommended.)* Out of the box the plugin only governs your *app*. To also attach an Ory identity to *OpenClaw's* session — so every tool call is attributed to you, not a fallback `session:<id>` subject — opt in to the user-login flow:
 
    ```bash
-   export ORY_AUTH_GATE=1
+   export ORY_USER_LOGIN=1
    ```
 
-   Then restart OpenClaw. On next session start, OpenClaw opens an Ory login in your browser; sign in with the same seeded credentials from step 1. This is what makes `permissions enforce` (see [Agent security](#agent-security)) deny on the right identity later. (Note: OpenClaw's session-start primitive can't hard-block, so the gate runs in advisory mode — auth still happens and the audit trail is correct, but the session always proceeds.)
+   User login is off by default. With it on, the next OpenClaw session opens an Ory login in your browser; sign in with the same seeded credentials from step 1, and the token is reused on subsequent sessions until it expires. This is what makes `permissions enforce` (see [Agent security](#agent-security)) deny on the right identity later. (Note: OpenClaw's session-start primitive can't hard-block, so the flow runs in advisory mode at session start — auth still happens and the audit trail is correct, but the session always proceeds. Tool-call enforcement is unaffected.)
 
 That's the full Ory DX path. Stop here if you're just evaluating the plugin. Continue to [Agent security](#agent-security) when you're ready to enforce.
 
@@ -108,7 +108,7 @@ Without configuration the plugin still loads cleanly and runs in **pass-through
 
 Once the plugin is pointed at an Ory project (local or hosted), OpenClaw's session and every tool call can be governed by Ory.
 
-- **Authentication.** Two identities. The human at the keyboard (the **user**) authenticates interactively via Ory Identities when `ORY_AUTH_GATE=1` is set. The OpenClaw process (the **agent**) gets its own OAuth2 identity, self-registered via [Dynamic Client Registration (RFC 7591)](https://datatracker.ietf.org/doc/html/rfc7591) on first run.
+- **Authentication.** Two identities. The human at the keyboard (the **user**) authenticates interactively via Ory Identities when user login is enabled (`ORY_USER_LOGIN=1`, off by default — browser PKCE flow on first session, persisted token thereafter). The OpenClaw process (the **agent**) gets its own OAuth2 identity, self-registered via [Dynamic Client Registration (RFC 7591)](https://datatracker.ietf.org/doc/html/rfc7591) on first run.
 - **Authorization.** Before any tool runs, the plugin checks [Ory Permissions](https://www.ory.com/docs/keto) (Zanzibar-style relation tuples) against the user's subject and blocks the call on `deny`. MCP tool calls additionally get a server-level check.
 - **Audit.** Every decision (allow, deny, fallback) is recorded as a structured trace span: NDJSON file output and/or OTLP/HTTP export to Jaeger, Honeycomb, Grafana, and similar collectors. The user → agent delegation is written to Ory as a relation tuple so *"agent X acting on behalf of user Y"* stays queryable after tokens expire.
 
@@ -118,10 +118,10 @@ The plugin is **fail-open** on its own infrastructure failures (network errors,
 
 After install the plugin runs in **observe mode**: every tool call is checked against Ory Permissions, but a deny is recorded as a `permission.observe_deny` audit span and the tool runs anyway. This lets you see what *would* be blocked before turning on hard blocking.
 
-1. **Turn on the user gate.** In your shell:
+1. **Turn on user login.** It's off by default. In your shell:
 
    ```bash
-   export ORY_AUTH_GATE=1
+   export ORY_USER_LOGIN=1
    ```
 
    The next OpenClaw session refreshes or prompts for PKCE login. Subsequent sessions reuse the persisted token until it expires.

package/dist/plugin.d.ts

@@ -1,8 +1,8 @@
 import { OryAgentClient, ensureUserAuthenticated, ensureAgentIdentity, ensureSubAgentIdentity } from "@ory/argus";
 import type { OpenClawPluginEntry } from "./types.js";
 export interface CreateOryPluginDeps {
-    /** Test injection point for the user auth gate. */
-    authGate?: typeof ensureUserAuthenticated;
+    /** Test injection point for the user login flow. */
+    userLogin?: typeof ensureUserAuthenticated;
     /** Test injection point for the agent identity gate. */
     agentGate?: typeof ensureAgentIdentity;
     /** Test injection point for the sub-agent identity resolver. */
@@ -17,8 +17,8 @@ export interface CreateOryPluginDeps {
  * makes permission checks enforceable, unlike harnesses that can only
  * log denials.
  *
- * The `session_start` hook returns `Promise<void>` so the auth gate is
- * advisory at session start: the gate still runs to emit the audit span,
+ * The `session_start` hook returns `Promise<void>` so user login is
+ * advisory at session start: the flow still runs to emit the audit span,
  * refresh tokens, and prompt for the project URL when interactive, but
  * cannot hard-block the session.
  */

package/dist/plugin.js

@@ -11,8 +11,8 @@ const argus_1 = require("@ory/argus");
  * makes permission checks enforceable, unlike harnesses that can only
  * log denials.
  *
- * The `session_start` hook returns `Promise<void>` so the auth gate is
- * advisory at session start: the gate still runs to emit the audit span,
+ * The `session_start` hook returns `Promise<void>` so user login is
+ * advisory at session start: the flow still runs to emit the audit span,
  * refresh tokens, and prompt for the project URL when interactive, but
  * cannot hard-block the session.
  */
@@ -30,7 +30,7 @@ function createOryPlugin(clientOrConfig, deps = {}) {
                     })
                     : argus_1.OryAgentClient.fromEnv("openclaw");
             api.registerHook("session_start", createSessionStartHandler(client, deps), { name: "ory.session-verify", description: "Verify session via Ory Identities" });
-            api.registerHook("before_agent_run", createBeforeAgentRunHandler(client, deps), { name: "ory.user-auth-gate", description: "Block runs when the user auth gate denies" });
+            api.registerHook("before_agent_run", createBeforeAgentRunHandler(client, deps), { name: "ory.user-login", description: "Block runs when the user login denies" });
             api.registerHook("before_tool_call", createBeforeToolCallHandler(client), { name: "ory.permission-check", description: "Check tool permissions via Ory Permissions" });
             api.registerHook("after_tool_call", createAfterToolCallHandler(client), { name: "ory.trace-complete", description: "Record tool completion trace" });
             api.registerHook("subagent_spawning", createSubagentSpawningHandler(client, deps), { name: "ory.subagent-register", description: "Register Ory identity and write delegation tuple for spawned sub-agent" });
@@ -51,13 +51,13 @@ function createSessionStartHandler(client, deps) {
             traceId: (0, argus_1.deriveTraceId)(ctx.sessionId),
             sessionId: ctx.sessionId,
         });
-        // Run the user auth gate. session_start cannot hard-block in OpenClaw
-        // (handler returns void), so allowBlock is false — the gate still emits
+        // Run the user login. session_start cannot hard-block in OpenClaw
+        // (handler returns void), so allowBlock is false — it still emits
         // the user.auth audit span, refreshes tokens, and prompts for the
-        // project URL when interactive. When ORY_AUTH_GATE is unset the gate is
+        // project URL when interactive. When ORY_USER_LOGIN is unset this is
         // a no-op (mode === "disabled") and we fall through to the legacy
         // verification path.
-        const userGate = deps.authGate ?? argus_1.ensureUserAuthenticated;
+        const userGate = deps.userLogin ?? argus_1.ensureUserAuthenticated;
         const decision = await userGate(client, {
             binName: "ory-openclaw",
             harness: "openclaw",
@@ -338,10 +338,10 @@ function createAfterToolCallHandler(client) {
 // ─── before_agent_run ──────────────────────────────────────────────
 //
 // Real per-turn enforcement gate. `session_start` cannot hard-block in
-// OpenClaw (handler returns void), so the user auth gate runs there in
+// OpenClaw (handler returns void), so the user login runs there in
 // advisory mode. `before_agent_run` is the first hook OpenClaw exposes
 // that can return a block decision on the user prompt — we re-run the
-// gate here so denied users can't drive the agent. `ensureUserAuthenticated`
+// login here so denied users can't drive the agent. `ensureUserAuthenticated`
 // reuses persisted tokens, so per-turn calls are non-interactive after
 // the first session.
 function createBeforeAgentRunHandler(client, deps) {
@@ -350,7 +350,7 @@ function createBeforeAgentRunHandler(client, deps) {
             traceId: (0, argus_1.deriveTraceId)(ctx.sessionKey ?? ctx.sessionId ?? "openclaw"),
             sessionId: ctx.sessionKey ?? ctx.sessionId,
         });
-        const userGate = deps.authGate ?? argus_1.ensureUserAuthenticated;
+        const userGate = deps.userLogin ?? argus_1.ensureUserAuthenticated;
         const decision = await userGate(client, {
             binName: "ory-openclaw",
             harness: "openclaw",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/openclaw",
-  "version": "0.6.2",
+  "version": "0.7.0",
   "description": "Ory plugin for OpenClaw: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -65,7 +65,7 @@
     "!dist/**/*.tsbuildinfo"
   ],
   "dependencies": {
-    "@ory/argus": "0.6.2"
+    "@ory/argus": "0.7.0"
   },
   "engines": {
     "node": ">=22"