@ory/opencode 0.10.0 → 0.11.1

package/README.md

@@ -205,14 +205,14 @@ Headless / CI runs that already hold a session token can skip this entirely by s
 Once the plugin is pointed at an Ory project (local or hosted), OpenCode's session and every tool call can be governed by Ory.
 
 - **Authentication.** Two identities. The human at the keyboard (the **user**) authenticates interactively via Ory Identities when user login is enabled (`ORY_USER_LOGIN=true`, off by default — browser PKCE flow on first session, persisted token thereafter). The OpenCode process (the **agent**) gets its own OAuth2 identity, self-registered via [Dynamic Client Registration (RFC 7591)](https://datatracker.ietf.org/doc/html/rfc7591) on first run.
-- **Authorization.** When OpenCode prompts for permission to use a tool, the plugin checks [Ory Permissions](https://www.ory.com/docs/keto) (Zanzibar-style relations) against the user's subject. In **enforce** mode a deny blocks the tool by throwing an `OryDenialError` (OpenCode surfaces the denial reason); in **observe** mode (default) the deny is recorded as a `permission.observe_deny` span and the tool runs. A parallel pre-tool check is recorded as part of the audit trail. MCP tool calls additionally get a server-level check.
+- **Authorization.** When OpenCode prompts for permission to use a tool, the plugin checks [Ory Permissions](https://www.ory.com/docs/keto) (Zanzibar-style relations) against the user's subject. In **enforce** mode a deny blocks the tool by throwing an `OryDenialError` (OpenCode surfaces the denial reason); in **observe** mode (default) the deny is recorded as a `permission.observe_deny` span and OpenCode's own permission prompt is left in place — the plugin only answers the prompt on an explicit Ory allow or an enforce-mode deny, never on an observe-mode deny or an infrastructure failure. A parallel pre-tool check is recorded as part of the audit trail. MCP tool calls additionally get a server-level check.
 - **Audit.** Every decision (allow, deny, fallback) is recorded as a structured trace span: NDJSON file output and/or OTLP/HTTP export to Jaeger, Honeycomb, Grafana, and similar collectors. The user → agent delegation is written to Ory as a relation so *"agent X acting on behalf of user Y"* stays queryable after tokens expire.
 
 The plugin is **fail-open** on its own infrastructure failures (network errors, rate limits, missing config), so enforcement is only as strong as your permission grants — grant explicit `use` on the tools each user should be able to run.
 
 ### Enable enforcement
 
-After install the plugin runs in **observe mode**: every tool call is checked against Ory Permissions, but a deny is recorded as a `permission.observe_deny` audit span and the tool runs anyway. This lets you see what *would* be blocked before turning on hard blocking.
+After install the plugin runs in **observe mode**: every tool call is checked against Ory Permissions, but a deny is recorded as a `permission.observe_deny` audit span and the tool runs anyway (and at OpenCode's permission prompt, the native ask is left for the user to answer). This lets you see what *would* be blocked before turning on hard blocking.
 
 1. **Turn on user login.** It's off by default. In your shell:
 

package/dist/cli/assets.js

@@ -56,8 +56,11 @@ function opencodeRoot(projectDir) {
 function installOpencodeOryAssets(projectDir) {
     const root = opencodeRoot(projectDir);
     fs.mkdirSync(root, { recursive: true });
+    // `.opencode/skills` is shared with user-authored skills, so never wipe
+    // the whole directory — surgically remove only the Ory-owned skill dirs
+    // (same list the uninstall path uses) before re-writing them fresh.
     const skillsDir = path.join(root, "skills");
-    fs.rmSync(skillsDir, { recursive: true, force: true });
+    (0, argus_1.removeSkillDirs)(skillsDir, argus_1.ORY_SKILL_NAMES);
     (0, argus_1.writeSkillTree)(skillsDir, (0, argus_1.renderOrySkills)("opencode", RENDER_OPTS));
     const cmdDir = path.join(root, "commands", CMD_SUBDIR);
     fs.rmSync(cmdDir, { recursive: true, force: true });

package/dist/plugin.js

@@ -95,6 +95,12 @@ async function verifyOnStartup(client, deps) {
     // attaches the agent's bearer token to outgoing Ory API calls.
     const agentGate = deps.agentGate ?? argus_1.ensureAgentIdentity;
     await agentGate(client, { projectUrl: (0, argus_1.resolveConfig)().projectUrl, harness: "opencode" });
+    // Record the user→agent delegation so the audit trail captures that
+    // this user authorized this agent for this session. Best-effort:
+    // requires both principals to be populated, and any failure is logged
+    // and swallowed (fail-open — delegation tracking is for audit, not
+    // enforcement).
+    await recordUserDelegatesAgent(client);
     if (decision.mode !== "disabled") {
         return;
     }
@@ -201,7 +207,7 @@ function createPermissionHandler(client, _options) {
                     ...("subjectSet" in subject ? { subjectSet: subject.subjectSet } : {}),
                     spanAttributes: { toolName: toolId, mcpServer: mcpTool.serverName, mcpTool: mcpTool.toolName },
                 });
-                output.status = decision.kind === "deny" ? "deny" : "allow";
+                applyPermissionAskDecision(output, decision.kind);
                 return;
             }
             const outcome = await (0, argus_1.gateToolCall)(client, {
@@ -210,8 +216,10 @@ function createPermissionHandler(client, _options) {
                 check: { namespace: resolveNamespace(), object: toolId, relation: "use", ...subject },
                 spanAttributes: { toolName: toolId },
             });
-            if (outcome.kind === "interactive") {
-                // Leave output.status as "ask" (default).
+            if (outcome.kind === "interactive" || outcome.kind === "audit_only") {
+                // Ory is disabled (audit-only kill switch) or this is a
+                // user-interaction primitive: leave output.status as "ask" (default)
+                // so the harness's native prompt reaches the user.
                 return;
             }
             const decision = outcome;
@@ -228,7 +236,7 @@ function createPermissionHandler(client, _options) {
                 output.status = "ask";
                 return;
             }
-            output.status = decision.kind === "deny" ? "deny" : "allow";
+            applyPermissionAskDecision(output, decision.kind);
         }
         catch (err) {
             if (isOryError(err) && (err.code === "network_error" || err.code === "rate_limited")) {
@@ -415,6 +423,59 @@ function createToolAfterHandler(client) {
 function resolveNamespace() {
     return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
 }
+/**
+ * Write the user→agent delegation tuple. Idempotent and fail-open:
+ * requires both principal subjects to be populated; any error (including
+ * an unconfigured projectUrl, which manifests as a network_error) is
+ * logged and swallowed. Purely audit-trail data — does not affect
+ * enforcement.
+ */
+async function recordUserDelegatesAgent(client) {
+    const user = client.userPrincipal.subject;
+    const agent = client.agentPrincipal.subject;
+    if (!user || !agent) {
+        client.logger.debug("delegation.skip", {
+            reason: "missing principal",
+            hasUser: !!user,
+            hasAgent: !!agent,
+        });
+        return;
+    }
+    try {
+        await client.createRelationship({
+            namespace: resolveNamespace(),
+            object: `agent:${agent}`,
+            relation: "delegate",
+            subjectId: `user:${user}`,
+        }, { spanAttributes: { delegation: "user-to-agent" } });
+    }
+    catch (err) {
+        const oryErr = err;
+        client.logger.warn("delegation.user_to_agent.failed", {
+            code: oryErr.code,
+            message: oryErr.message,
+        });
+    }
+}
+/**
+ * Map an Ory permission decision onto OpenCode's `permission.ask` output.
+ *
+ * Only explicit outcomes answer the prompt: `deny` → `"deny"`,
+ * `allow` → `"allow"`. An `observe`-mode deny leaves `output.status`
+ * untouched (OpenCode's default is `"ask"`), so the harness's native
+ * user prompt still appears — observe mode must never escalate a
+ * policy-denied tool into an auto-approval. The observe deny is already
+ * recorded as a `permission.observe_deny` audit span by the gate.
+ */
+function applyPermissionAskDecision(output, kind) {
+    if (kind === "deny") {
+        output.status = "deny";
+    }
+    else if (kind === "allow") {
+        output.status = "allow";
+    }
+    // kind === "observe": leave the harness's native prompt in place.
+}
 function isOryError(err) {
     return (typeof err === "object" &&
         err !== null &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/opencode",
-  "version": "0.10.0",
+  "version": "0.11.1",
   "description": "Ory plugin for OpenCode: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -63,7 +63,7 @@
     "!dist/**/*.tsbuildinfo"
   ],
   "dependencies": {
-    "@ory/argus": "0.10.0"
+    "@ory/argus": "0.11.1"
   },
   "engines": {
     "node": ">=22"