@ory/openclaw 0.9.1 → 0.10.0

package/README.md

@@ -106,7 +106,7 @@ ory-temporal-up   # start a local Temporal dev server (for ory-temporal-worker)
 
 Or via the CLI: `npx -y -p @ory/openclaw ory-openclaw local up | down`.
 
-`ory-local-up` runs a complete Ory on your laptop: the Ory APIs (Identities, OAuth2, Permissions) at `http://localhost:4000`, a login UI on `:3000`, and Jaeger (the trace viewer) on `:16686`. A test user identity is seeded and its credentials are printed for you. Use it to:
+`ory-local-up` runs a complete Ory on your laptop: the Ory APIs (Identities, OAuth2, Permissions) at `http://localhost:4000`, a login UI on `:4455` (not :3000, to avoid Next.js port conflicts), and Jaeger (the trace viewer) on `:16686`. A test user identity is seeded and its credentials are printed for you. Use it to:
 
 - **Learn Ory hands-on** without signing up for a hosted project.
 - **Prototype** flows (login, social, MFA, recovery, permissions) against a real Ory backend.
@@ -254,7 +254,7 @@ Highlights:
 
 ## Troubleshooting
 
-- **`ory-local-up` fails.** Make sure Docker is running and ports `3000`, `4000`, `4100`, and `16686` are free.
+- **`ory-local-up` fails.** Make sure Docker is running and ports `4455` (login UI), `4000`, `4100`, and `16686` are free.
 - **PKCE login loops.** Clear persisted state with `npx -y -p @ory/openclaw ory-openclaw agent unregister` and retry.
 - **`npx` fetches an old version.** Force a fresh fetch: `npx -y -p @ory/openclaw@latest ory-openclaw …`.
 - **Need more signal.** Set `ORY_AGENT_DEBUG=true` and `ORY_AGENT_LOG_FILE=/tmp/ory.log` to capture structured logs.

package/dist/plugin.js

@@ -522,9 +522,6 @@ function handlePermissionError(err, toolId, client) {
                 code: err.code,
                 message: "Failing open",
             });
-            client.tracer.record("tool.invoke", "ok", {
-                attributes: { toolName: toolId, failOpen: true, reason: err.code },
-            });
             return;
         }
         client.logger.error("permission.check.error", {
@@ -539,8 +536,7 @@ function handlePermissionError(err, toolId, client) {
             error: err instanceof Error ? err.message : String(err),
         });
     }
-    // Record fail-open trace for unknown errors too
-    client.tracer.record("tool.invoke", "ok", {
-        attributes: { toolName: toolId, failOpen: true },
-    });
+    // Fail-open is log-and-allow: no tool.invoke span, matching the core
+    // gate() vocabulary. The errored permission.check span carries the audit
+    // trail for the failed check itself.
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/openclaw",
-  "version": "0.9.1",
+  "version": "0.10.0",
   "description": "Ory plugin for OpenClaw: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -65,7 +65,7 @@
     "!dist/**/*.tsbuildinfo"
   ],
   "dependencies": {
-    "@ory/argus": "0.9.1"
+    "@ory/argus": "0.10.0"
   },
   "engines": {
     "node": ">=22"