@ory/opencode 0.11.1 → 0.12.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +74 -199
- package/dist/cli/main.js +11 -8
- package/dist/cli/setup.js +13 -1
- package/package.json +3 -2
package/README.md
CHANGED
|
@@ -1,52 +1,46 @@
|
|
|
1
1
|
# Ory Agent Plugin: OpenCode
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
Security and developer experience for [OpenCode](https://opencode.ai), powered by [Ory](https://ory.com).
|
|
4
4
|
|
|
5
|
-
|
|
5
|
+
**Security.** OpenCode runs real actions on your machine — editing files, running shell commands, calling APIs. The plugin gives every session a verifiable identity (you sign in once; OpenCode and any sub-agents it spawns each get their own), checks every tool call against permissions you control, and records each decision as an audit trace you can ship to your observability stack. It starts in watch mode so nothing is blocked on day one, and if Ory is ever unreachable it steps aside rather than locking you out.
|
|
6
6
|
|
|
7
|
-
|
|
7
|
+
**Developer experience.** A single command installs the plugin and walks you through connecting — choose Ory Network, a local Docker stack, or audit-only, and it wires up the project, sign-in client, login, and permissions for you. It also helps you build Ory into your own app: ask in plain language to scaffold login, registration, and recovery pages, run a local Ory, or manage identities and permissions through the bundled MCP server.
|
|
8
8
|
|
|
9
|
-
|
|
9
|
+
## What you'll need
|
|
10
10
|
|
|
11
|
-
-
|
|
12
|
-
- **
|
|
11
|
+
- [OpenCode](https://opencode.ai), installed
|
|
12
|
+
- Node.js **22 or newer**
|
|
13
|
+
- [Docker](https://docs.docker.com/get-docker/) — only if you want to run Ory locally
|
|
14
|
+
- macOS or Linux (Windows works via WSL2)
|
|
13
15
|
|
|
14
|
-
|
|
16
|
+
## Get started
|
|
15
17
|
|
|
16
|
-
|
|
17
|
-
2. **Govern the agent itself.** Authenticate OpenCode's own session and authorize every tool it runs against Ory Permissions, with a full audit trail. See [Agent security](#agent-security).
|
|
18
|
-
|
|
19
|
-
If you're just exploring, do the Quickstart first.
|
|
20
|
-
|
|
21
|
-
## Prerequisites
|
|
22
|
-
|
|
23
|
-
- [OpenCode](https://opencode.ai) installed
|
|
24
|
-
- Node.js **≥ 22**
|
|
25
|
-
- [Docker](https://docs.docker.com/get-docker/) (only needed for the local Ory stack)
|
|
26
|
-
- macOS or Linux. Windows works via WSL2.
|
|
27
|
-
|
|
28
|
-
## Install
|
|
29
|
-
|
|
30
|
-
Run the installer from your project directory:
|
|
18
|
+
Run one command. It installs the plugin and walks you through connecting:
|
|
31
19
|
|
|
32
20
|
```bash
|
|
33
21
|
npx -y -p @ory/opencode ory-opencode install
|
|
34
22
|
```
|
|
35
23
|
|
|
36
|
-
|
|
24
|
+
You'll be asked how you want to connect — **press Enter for the default**:
|
|
25
|
+
|
|
26
|
+
- **Ory Network** *(default)* — sign in, or create a free account, in your browser. The project, keys, permissions, and login are all set up for you. Nothing to configure by hand.
|
|
27
|
+
- **Local** — run a complete Ory on your laptop with Docker. No account, no signup, no keys. Great for trying it out.
|
|
28
|
+
- **Audit-only** — skip Ory entirely and just log what OpenCode does.
|
|
37
29
|
|
|
38
|
-
|
|
30
|
+
That's it. Confirm everything landed with:
|
|
39
31
|
|
|
40
32
|
```bash
|
|
41
33
|
npx -y -p @ory/opencode ory-opencode status
|
|
42
34
|
```
|
|
43
35
|
|
|
44
|
-
`status` is
|
|
36
|
+
`status` is your one-stop check: what's configured, who's signed in, which tools are covered by permissions, and recent activity. Anything not set up yet shows as `(unset)`.
|
|
37
|
+
|
|
38
|
+
The installer registers the plugin in OpenCode's config (`opencode.json`) along with the Ory MCP server, a set of skills in `.opencode/skills/`, and the local-stack slash commands. Re-run install with `--reconfigure` to change your connection later, or `--no-configure` to skip the wizard. `ory-opencode uninstall` reverses it all.
|
|
45
39
|
|
|
46
40
|
<details>
|
|
47
|
-
<summary>
|
|
41
|
+
<summary>Prefer to register the plugin by hand?</summary>
|
|
48
42
|
|
|
49
|
-
If you want
|
|
43
|
+
OpenCode loads the plugin in-process from `opencode.json`. If you only want the plugin — no MCP server, skills, or slash commands, and no guided setup — add it directly:
|
|
50
44
|
|
|
51
45
|
```json
|
|
52
46
|
{
|
|
@@ -55,120 +49,67 @@ If you want only the plugin (no MCP server, no skills, no slash commands), add i
|
|
|
55
49
|
}
|
|
56
50
|
```
|
|
57
51
|
|
|
58
|
-
OpenCode fetches
|
|
52
|
+
OpenCode fetches it from npm on next launch. Connect afterwards by running `ory-opencode install` (or `configure`) in a terminal — that's also what lands the skills and `/ory:` commands on disk.
|
|
59
53
|
|
|
60
54
|
</details>
|
|
61
55
|
|
|
62
|
-
##
|
|
63
|
-
|
|
64
|
-
From any project where you'd like Ory authentication, inside OpenCode:
|
|
65
|
-
|
|
66
|
-
1. **Start a local Ory instance.** Ask OpenCode *"start the local Ory stack"* or run:
|
|
67
|
-
|
|
68
|
-
```
|
|
69
|
-
/ory:local-up
|
|
70
|
-
```
|
|
71
|
-
|
|
72
|
-
A banner prints the seeded test user's email and password. Note them — you'll log in with them in step 3.
|
|
73
|
-
|
|
74
|
-
2. **Scaffold Ory into your project.** Ask OpenCode *"add Ory auth to this app"* or invoke the `ory-auth-setup` skill.
|
|
75
|
-
|
|
76
|
-
OpenCode installs Ory Elements, wires the SDK, generates the login / registration / recovery / verification / settings pages, and sets up session middleware. It targets the local stack from step 1, so no signup or API key is needed.
|
|
77
|
-
|
|
78
|
-
3. **Sign in.** Start your app, visit the login page OpenCode added, and sign in with the seeded credentials. You now have a real Ory session backed by a real Ory stack — locally, offline, with zero configuration.
|
|
79
|
-
|
|
80
|
-
4. **Turn on Ory login for the OpenCode session itself.** *(Optional but recommended.)* Out of the box the plugin only governs your *app*. To also attach an Ory identity to *OpenCode's* session — so every tool call is attributed to you, not a fallback `session:<id>` subject — opt in to the user-login flow:
|
|
56
|
+
## What you get
|
|
81
57
|
|
|
82
|
-
|
|
83
|
-
export ORY_USER_LOGIN=true
|
|
84
|
-
export ORY_OAUTH2_CLIENT_ID=<value printed by `local up`>
|
|
85
|
-
```
|
|
58
|
+
Once connected, every tool OpenCode runs is governed by Ory — three things happen automatically:
|
|
86
59
|
|
|
87
|
-
|
|
60
|
+
- **Who's driving.** You sign in once in your browser; OpenCode gets its own identity too. No tokens to copy around, and the "who acted on whose behalf" trail stays queryable later — even after tokens expire. (One nuance: OpenCode can't hard-block at session start, so browser sign-in there is advisory — it still runs and records correctly, the session just always proceeds. Per-tool checks are unaffected.)
|
|
61
|
+
- **What it's allowed to do.** When OpenCode asks to use a tool, Ory checks whether it's permitted. It starts in **watch mode** — nothing is blocked, you just *see* what would be — so it never gets in your way on day one.
|
|
62
|
+
- **A record of everything.** Every decision (allowed, denied, skipped) is logged as a trace you can send to Jaeger, Honeycomb, Grafana, or just a file.
|
|
88
63
|
|
|
89
|
-
|
|
64
|
+
If Ory is ever unreachable, the plugin gets out of the way and lets OpenCode keep working — so it can't lock you out.
|
|
90
65
|
|
|
91
|
-
|
|
66
|
+
### See what's happening
|
|
92
67
|
|
|
93
|
-
|
|
68
|
+
Everything the plugin does is observable out of the box — no configuration required:
|
|
94
69
|
|
|
95
|
-
|
|
70
|
+
- **Status at a glance.** `npx -y -p @ory/opencode ory-opencode status` shows what's configured, who's signed in, how many built-in tools your permissions cover, and the most recent tool-call activity.
|
|
71
|
+
- **Live traces.** Every tool call is recorded as an OpenTelemetry-style span. Watch them stream as the agent works:
|
|
96
72
|
|
|
97
|
-
|
|
73
|
+
```bash
|
|
74
|
+
npx -y -p @ory/opencode ory-opencode watch
|
|
75
|
+
```
|
|
98
76
|
|
|
99
|
-
|
|
100
|
-
-
|
|
101
|
-
- **`ory-social-login`** — Google, GitHub, Apple, Microsoft, Discord, and other OIDC providers with Jsonnet data mappers.
|
|
102
|
-
- **`ory-local-dev`** — drive the local Ory stack from within OpenCode to prototype and test without a remote project.
|
|
77
|
+
Spans are also written to `~/.config/ory-agent-plugins/opencode/ory-agent-trace.ndjson` (NDJSON, one span per line) — tail that file, or point `OTEL_EXPORTER_OTLP_ENDPOINT` at a collector to ship them straight to Jaeger, Honeycomb, or Grafana.
|
|
78
|
+
- **Debug log.** For a verbose play-by-play, set `ORY_AGENT_DEBUG=true`; structured logs land in `~/.config/ory-agent-plugins/opencode/ory-agent-debug.log`.
|
|
103
79
|
|
|
104
|
-
|
|
80
|
+
### Ready to enforce?
|
|
105
81
|
|
|
106
|
-
|
|
107
|
-
- **`ory-build-integration`** — pull the runnable subset of an `ory/integrates` template (webhook / config / http-event) into your own app and wire it to your Ory project — no contribution/registry concerns.
|
|
108
|
-
- **`ory-contribute-integration`** — author a brand-new integration as a contribution to `ory/integrates`, including `registry.entry.yaml`, the `Maintained by:` footer, DCO sign-off, and registry regeneration.
|
|
109
|
-
- **`ory-e2b-sandbox`** — scaffold an [E2B](https://e2b.dev) sandbox template that boots with this plugin preinstalled and registered, so every sandbox session is gated by Ory auth, permissions, and tracing without any per-sandbox setup.
|
|
110
|
-
- **`ory-build-agent`** — drop `@ory/argus` directly into a custom agent you own (Claude Agent SDK, OpenAI Agents SDK, Mastra, Vercel AI SDK, PydanticAI, LangGraph, Mistral AI, or Salesforce Agentforce) so the user is authenticated, every tool call is authorized against Ory Permissions, and the lifecycle emits trace spans.
|
|
111
|
-
- **`ory-temporal-worker`** — scaffold a [Temporal](https://temporal.io) TypeScript worker per the [official local-dev guide](https://docs.temporal.io/develop/typescript/set-up-your-local-typescript), with every Activity gated by an Ory permission check, the worker's agent identity resolved via DCR, and the full lifecycle emitting trace spans.
|
|
82
|
+
When the watch-mode logs look right, turn on blocking with one command (setup already granted you the built-in tools):
|
|
112
83
|
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
Bundled and registered by the Ory installer. Exposes the Ory CLI and the Ory Network REST API as MCP tools so OpenCode can manage identities, OAuth2 clients, projects, permissions, and configuration without ever leaving the chat. Useful for seeding test data, verifying a scaffolded integration, or running one-off admin tasks.
|
|
116
|
-
|
|
117
|
-
### Local Ory stack
|
|
118
|
-
|
|
119
|
-
```
|
|
120
|
-
/ory:local-up # start a local Ory instance in Docker
|
|
121
|
-
/ory:local-down # tear it all down
|
|
122
|
-
/ory:temporal-up # start a local Temporal dev server (for ory-temporal-worker)
|
|
84
|
+
```bash
|
|
85
|
+
npx -y -p @ory/opencode ory-opencode permissions enforce
|
|
123
86
|
```
|
|
124
87
|
|
|
125
|
-
|
|
88
|
+
Now a denied tool is actually blocked and OpenCode shows why. In watch mode, OpenCode's own permission prompt is left in place for you to answer; only an explicit allow or a block-mode deny changes that. Go back to watch mode anytime with `permissions observe`. Use `permissions status` to see what's covered and `permissions bootstrap` to (re-)grant the built-in tools — or just ask OpenCode in chat, e.g. *"grant me use of the bash tool."*
|
|
126
89
|
|
|
127
|
-
|
|
128
|
-
- **Prototype** flows (login, social, MFA, recovery, permissions) against a real Ory backend.
|
|
129
|
-
- **Test** an auth integration end-to-end before pushing anything to a real environment.
|
|
130
|
-
- **Develop** your application against the same identity, OAuth2, and permission surfaces you'll ship with.
|
|
90
|
+
## Also: add login to your own app
|
|
131
91
|
|
|
132
|
-
|
|
92
|
+
Beyond securing OpenCode, the plugin helps you build Ory into whatever you're working on. Ask OpenCode *"add Ory login to this app"* and it scaffolds the login, registration, recovery, verification, and settings pages (using [Ory Elements](https://github.com/ory/elements)) wired to a local Ory — no signup or keys needed. Start that local Ory with `/ory:local-up` (it prints a test email + password to sign in with) and tear it down with `/ory:local-down`.
|
|
133
93
|
|
|
134
|
-
|
|
94
|
+
Bundled **skills** (just ask in plain language) cover more: `ory-auth-setup`, `ory-login-flow`, `ory-social-login` (Google, GitHub, Apple…), `ory-permissions-onboarding`, and playbooks for wiring Ory into your own agents, E2B sandboxes, or Temporal workers. A built-in **Ory MCP server** lets OpenCode manage identities, projects, and permissions straight from chat.
|
|
135
95
|
|
|
136
|
-
|
|
137
|
-
npx -y -p @ory/opencode ory-opencode configure \
|
|
138
|
-
--project-url https://<id>.projects.oryapis.com \
|
|
139
|
-
--oauth2-client-id <public OAuth2 client id>
|
|
140
|
-
```
|
|
96
|
+
## Configure by hand (CI / advanced)
|
|
141
97
|
|
|
142
|
-
|
|
143
|
-
- **`--oauth2-client-id`** is required because the **user** PKCE browser flow (triggered by `ORY_USER_LOGIN=true`) cannot self-register — you must register a public OAuth2 client ahead of time and supply its id here. The configure command refuses to save a project URL without it, so you don't end up with a silently-broken setup later. See [Register the user OAuth2 client](#register-the-user-oauth2-client) below for the exact CLI / Console steps.
|
|
144
|
-
- **`--api-key ory_pat_...`** is optional — pass it only if you want to override the auto-registered agent identity with a static personal access token (operator override; rarely needed).
|
|
145
|
-
|
|
146
|
-
If you only want audit logging (no auth or permission checks), substitute `--audit-only` — the OAuth2 client id is not required in that mode:
|
|
98
|
+
The guided setup covers most people. For scripted or CI setups, or to point at an existing Ory Network project, configure directly. Settings are saved to `~/.config/ory-agent-plugins/config.json` and shared across all your Ory agent plugins; environment variables win when both are set.
|
|
147
99
|
|
|
148
100
|
```bash
|
|
149
|
-
npx -y -p @ory/opencode ory-opencode configure
|
|
101
|
+
npx -y -p @ory/opencode ory-opencode configure \
|
|
102
|
+
--project-url https://<slug>.projects.oryapis.com \
|
|
103
|
+
--oauth2-client-id <sign-in client id> \
|
|
104
|
+
--user-login
|
|
150
105
|
```
|
|
151
106
|
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
Config is saved to `~/.config/ory-agent-plugins/config.json` and shared across every Ory agent plugin on the machine.
|
|
155
|
-
|
|
156
|
-
Without configuration the plugin still loads cleanly and runs in **pass-through mode**: skills and commands work, but nothing is blocked. You can stay in pass-through mode indefinitely if you only want the DX features.
|
|
157
|
-
|
|
158
|
-
### Register the user OAuth2 client
|
|
159
|
-
|
|
160
|
-
If you plan to turn on `ORY_USER_LOGIN=true` (recommended — it's what attributes every tool call to *you* rather than a fallback `session:<id>` subject), your hosted Ory project needs a **public** OAuth2 client (no client secret) registered ahead of time. The local stack provisions this for you automatically; against a hosted project you have to register it once yourself.
|
|
161
|
-
|
|
162
|
-
The client must list **all four** loopback ports as redirect URIs:
|
|
107
|
+
OpenCode's own identity registers itself automatically on first run — nothing to create. The `--oauth2-client-id` is the one piece browser sign-in needs; the guided setup makes it for you, or see below to do it by hand. For logging-only with no checks, use `--audit-only`. The equivalent env vars are `ORY_PROJECT_URL`, `ORY_OAUTH2_CLIENT_ID`, `ORY_USER_LOGIN`, and `ORY_AGENT_API_KEY`.
|
|
163
108
|
|
|
164
|
-
|
|
165
|
-
-
|
|
166
|
-
- `http://127.0.0.1:47825/callback`
|
|
167
|
-
- `http://127.0.0.1:47826/callback`
|
|
168
|
-
|
|
169
|
-
The plugin walks the four ports at runtime so the login can survive any one of them being occupied — Ory rejects the callback if the port it lands on isn't on the registered list, so register all four.
|
|
109
|
+
<details>
|
|
110
|
+
<summary>Create the sign-in client by hand</summary>
|
|
170
111
|
|
|
171
|
-
|
|
112
|
+
The guided setup normally does this. To do it yourself, create a **public** OAuth2 client (no secret) listing all four loopback URLs — the plugin tries each in turn so sign-in survives a busy port:
|
|
172
113
|
|
|
173
114
|
```bash
|
|
174
115
|
ory create oauth2-client --project <project-id> \
|
|
@@ -183,103 +124,37 @@ ory create oauth2-client --project <project-id> \
|
|
|
183
124
|
--redirect-uri http://127.0.0.1:47826/callback
|
|
184
125
|
```
|
|
185
126
|
|
|
186
|
-
…or in the [Ory Console](https://console.ory.sh) under *OAuth2* → *Clients* → *Create client* (pick "Public client",
|
|
187
|
-
|
|
188
|
-
```bash
|
|
189
|
-
npx -y -p @ory/opencode ory-opencode configure \
|
|
190
|
-
--project-url https://<id>.projects.oryapis.com \
|
|
191
|
-
--oauth2-client-id <client-id from the step above>
|
|
192
|
-
```
|
|
193
|
-
|
|
194
|
-
…or set it in the environment alongside `ORY_USER_LOGIN`:
|
|
195
|
-
|
|
196
|
-
```bash
|
|
197
|
-
export ORY_USER_LOGIN=true
|
|
198
|
-
export ORY_OAUTH2_CLIENT_ID=<client-id from the step above>
|
|
199
|
-
```
|
|
200
|
-
|
|
201
|
-
Headless / CI runs that already hold a session token can skip this entirely by setting `ORY_USER_SESSION_TOKEN` instead — no browser flow runs, so no OAuth2 client is needed.
|
|
202
|
-
|
|
203
|
-
## Agent security
|
|
204
|
-
|
|
205
|
-
Once the plugin is pointed at an Ory project (local or hosted), OpenCode's session and every tool call can be governed by Ory.
|
|
206
|
-
|
|
207
|
-
- **Authentication.** Two identities. The human at the keyboard (the **user**) authenticates interactively via Ory Identities when user login is enabled (`ORY_USER_LOGIN=true`, off by default — browser PKCE flow on first session, persisted token thereafter). The OpenCode process (the **agent**) gets its own OAuth2 identity, self-registered via [Dynamic Client Registration (RFC 7591)](https://datatracker.ietf.org/doc/html/rfc7591) on first run.
|
|
208
|
-
- **Authorization.** When OpenCode prompts for permission to use a tool, the plugin checks [Ory Permissions](https://www.ory.com/docs/keto) (Zanzibar-style relations) against the user's subject. In **enforce** mode a deny blocks the tool by throwing an `OryDenialError` (OpenCode surfaces the denial reason); in **observe** mode (default) the deny is recorded as a `permission.observe_deny` span and OpenCode's own permission prompt is left in place — the plugin only answers the prompt on an explicit Ory allow or an enforce-mode deny, never on an observe-mode deny or an infrastructure failure. A parallel pre-tool check is recorded as part of the audit trail. MCP tool calls additionally get a server-level check.
|
|
209
|
-
- **Audit.** Every decision (allow, deny, fallback) is recorded as a structured trace span: NDJSON file output and/or OTLP/HTTP export to Jaeger, Honeycomb, Grafana, and similar collectors. The user → agent delegation is written to Ory as a relation so *"agent X acting on behalf of user Y"* stays queryable after tokens expire.
|
|
210
|
-
|
|
211
|
-
The plugin is **fail-open** on its own infrastructure failures (network errors, rate limits, missing config), so enforcement is only as strong as your permission grants — grant explicit `use` on the tools each user should be able to run.
|
|
127
|
+
…or in the [Ory Console](https://console.ory.sh) under *OAuth2* → *Clients* → *Create client* (pick "Public client", "Authorization Code" + "Refresh Token" grants, scopes `openid offline_access`, and paste the four redirect URIs). Pass the resulting id to `configure --oauth2-client-id`. Running headless with a session token already? Set `ORY_USER_SESSION_TOKEN` and skip the browser step entirely.
|
|
212
128
|
|
|
213
|
-
|
|
214
|
-
|
|
215
|
-
After install the plugin runs in **observe mode**: every tool call is checked against Ory Permissions, but a deny is recorded as a `permission.observe_deny` audit span and the tool runs anyway (and at OpenCode's permission prompt, the native ask is left for the user to answer). This lets you see what *would* be blocked before turning on hard blocking.
|
|
216
|
-
|
|
217
|
-
1. **Turn on user login.** It's off by default. In your shell:
|
|
218
|
-
|
|
219
|
-
```bash
|
|
220
|
-
export ORY_USER_LOGIN=true
|
|
221
|
-
export ORY_OAUTH2_CLIENT_ID=<public OAuth2 client id>
|
|
222
|
-
```
|
|
223
|
-
|
|
224
|
-
The next OpenCode session refreshes or prompts for PKCE login. Subsequent sessions reuse the persisted token until it expires.
|
|
225
|
-
|
|
226
|
-
`ORY_OAUTH2_CLIENT_ID` is required when `ORY_USER_LOGIN` is on: PKCE needs a public OAuth2 client registered with the four loopback redirect URIs (`http://127.0.0.1:47823..47826/callback`) to exchange the authorization code for a token. The local stack provisions one and prints the export in its `local up` banner; for a hosted Ory project see [Register the user OAuth2 client](#register-the-user-oauth2-client) for the exact CLI / Console steps. Headless / CI runs can skip the browser flow entirely by pre-supplying `ORY_USER_SESSION_TOKEN` instead.
|
|
227
|
-
|
|
228
|
-
2. **Bootstrap permissions for the built-in tools.** One idempotent command grants the current user `use` on every tool OpenCode ships with (read, write, edit, bash, …):
|
|
229
|
-
|
|
230
|
-
```bash
|
|
231
|
-
npx -y -p @ory/opencode ory-opencode permissions bootstrap
|
|
232
|
-
```
|
|
233
|
-
|
|
234
|
-
If a user identity is already cached at install time, the installer runs this for you automatically — re-run after adding tools, switching subjects, or changing the namespace.
|
|
235
|
-
|
|
236
|
-
3. **Check coverage.** `permissions status` probes every tool in the harness's catalog and prints allowed / denied per tool:
|
|
237
|
-
|
|
238
|
-
```bash
|
|
239
|
-
npx -y -p @ory/opencode ory-opencode permissions status
|
|
240
|
-
```
|
|
241
|
-
|
|
242
|
-
Add permissions for any MCP server tools or custom commands by hand, or via the Ory MCP server from inside OpenCode (*"grant me use on the bash tool"*).
|
|
243
|
-
|
|
244
|
-
4. **Promote to enforce.** Once the observe-mode logs look right, switch over:
|
|
245
|
-
|
|
246
|
-
```bash
|
|
247
|
-
npx -y -p @ory/opencode ory-opencode permissions enforce
|
|
248
|
-
```
|
|
129
|
+
</details>
|
|
249
130
|
|
|
250
|
-
|
|
131
|
+
With nothing configured, the plugin still loads and runs in **pass-through mode**: skills, commands, and logging work, but no checks run and nothing is blocked. Perfectly fine if you only want the app-building features.
|
|
251
132
|
|
|
252
|
-
##
|
|
133
|
+
## Commands
|
|
253
134
|
|
|
254
135
|
```
|
|
255
|
-
|
|
256
|
-
|
|
257
|
-
|
|
258
|
-
|
|
259
|
-
|
|
260
|
-
|
|
136
|
+
ory-opencode install | uninstall Install/remove; --reconfigure re-runs setup, --no-configure skips it
|
|
137
|
+
ory-opencode status Show configuration, identities, permission coverage, recent activity
|
|
138
|
+
ory-opencode watch Tail the live trace stream (OTel spans)
|
|
139
|
+
ory-opencode permissions <cmd> status | bootstrap | observe (watch) | enforce (block)
|
|
140
|
+
ory-opencode configure <flags> Point at a project by hand (--project-url, --oauth2-client-id, --user-login, --audit-only)
|
|
141
|
+
ory-opencode agent <status|unregister> Manage OpenCode's own auto-created identity
|
|
142
|
+
ory-opencode local <up|down|status|…> Run / manage a local Ory in Docker
|
|
261
143
|
```
|
|
262
144
|
|
|
263
|
-
|
|
264
|
-
|
|
265
|
-
- `agent status` — show the current persisted DCR identity for the agent.
|
|
266
|
-
- `permissions observe` / `permissions enforce` — switch between "log denies, allow through" (the install default) and "block denies." `permissions bootstrap` writes `use` permissions for the harness's built-in tools so the promotion path doesn't require hand-writing relations.
|
|
267
|
-
- `configure --audit-only` — kill switch that disables Ory entirely (no auth, no permission checks; only audit logging of tool invocations). For phased rollouts, prefer `permissions observe` over `--audit-only`.
|
|
268
|
-
- `local seed` / `local env` — reseed the test user, or print env vars for pointing other tools at the local stack.
|
|
145
|
+
All prefixed with `npx -y -p @ory/opencode`.
|
|
269
146
|
|
|
270
147
|
## Troubleshooting
|
|
271
148
|
|
|
272
|
-
- **`/ory:local-up` fails
|
|
273
|
-
- **
|
|
274
|
-
- **`npx`
|
|
275
|
-
- **`npm error code ENOVERSIONS` on install
|
|
276
|
-
- **
|
|
149
|
+
- **`/ory:local-up` fails** — make sure Docker is running and ports `4000`, `4100`, `4455`, and `16686` are free.
|
|
150
|
+
- **Browser sign-in loops** — reset with `ory-opencode agent unregister` and try again.
|
|
151
|
+
- **`npx` grabbed an old version** — force the latest: `npx -y -p @ory/opencode@latest ory-opencode …`.
|
|
152
|
+
- **`npm error code ENOVERSIONS` on install** — your npm has a freshness filter hiding brand-new versions. Wait it out, or run `npx -y --min-release-age=0 -p @ory/opencode ory-opencode install`.
|
|
153
|
+
- **Want to see what's happening** — `npx -y -p @ory/opencode ory-opencode status` for a snapshot, `npx -y -p @ory/opencode ory-opencode watch` for the live trace stream, or set `ORY_AGENT_DEBUG=true` for a verbose log. Traces and logs live under `~/.config/ory-agent-plugins/opencode/` (see [See what's happening](#see-whats-happening)).
|
|
277
154
|
|
|
278
|
-
##
|
|
155
|
+
## Learn more
|
|
279
156
|
|
|
280
|
-
- [Ory documentation](https://www.ory.com/docs/)
|
|
281
|
-
- [Ory Network console](https://console.ory.sh)
|
|
282
|
-
- [Ory Elements](https://github.com/ory/elements)
|
|
157
|
+
- [Ory documentation](https://www.ory.com/docs/) · [Ory Console](https://console.ory.sh) · [Ory Elements](https://github.com/ory/elements)
|
|
283
158
|
- [OpenCode documentation](https://opencode.ai)
|
|
284
159
|
|
|
285
160
|
## License
|
package/dist/cli/main.js
CHANGED
|
@@ -50,14 +50,19 @@ function main() {
|
|
|
50
50
|
const [command, ...args] = process.argv.slice(2);
|
|
51
51
|
switch (command) {
|
|
52
52
|
case "install":
|
|
53
|
+
(0, argus_1.beginDeferNextSteps)();
|
|
53
54
|
install(args);
|
|
54
|
-
|
|
55
|
+
(0, argus_1.runPostInstall)("ory-opencode", "opencode", args).then(() => process.exit(0), (err) => {
|
|
55
56
|
console.error(err.message ?? err);
|
|
56
57
|
process.exit(1);
|
|
57
58
|
});
|
|
58
59
|
break;
|
|
59
60
|
case "uninstall":
|
|
60
61
|
uninstall(args);
|
|
62
|
+
(0, argus_1.clearCredentialsForUninstall)().then(() => process.exit(0), (err) => {
|
|
63
|
+
console.error(err.message ?? err);
|
|
64
|
+
process.exit(1);
|
|
65
|
+
});
|
|
61
66
|
break;
|
|
62
67
|
case "configure":
|
|
63
68
|
(0, argus_1.runConfigureCommand)("ory-opencode", args);
|
|
@@ -86,6 +91,9 @@ function main() {
|
|
|
86
91
|
process.exit(1);
|
|
87
92
|
});
|
|
88
93
|
break;
|
|
94
|
+
case "watch":
|
|
95
|
+
(0, argus_1.runWatchCommand)("opencode", args);
|
|
96
|
+
break;
|
|
89
97
|
case "help":
|
|
90
98
|
case "--help":
|
|
91
99
|
case "-h":
|
|
@@ -98,12 +106,6 @@ function main() {
|
|
|
98
106
|
process.exit(1);
|
|
99
107
|
}
|
|
100
108
|
}
|
|
101
|
-
async function postInstallPermissions(binName, harness) {
|
|
102
|
-
const bootstrapped = await (0, argus_1.maybeAutoBootstrap)(binName, harness);
|
|
103
|
-
(0, argus_1.printPermissionsOnboardingHelp)(binName, harness, {
|
|
104
|
-
bootstrappedAutomatically: bootstrapped,
|
|
105
|
-
});
|
|
106
|
-
}
|
|
107
109
|
function parseProjectDir(args) {
|
|
108
110
|
const idx = args.indexOf("--project-dir");
|
|
109
111
|
if (idx !== -1 && args[idx + 1])
|
|
@@ -219,6 +221,7 @@ Commands:
|
|
|
219
221
|
local <cmd> Manage local Ory dev environment
|
|
220
222
|
(up, down, status, seed, logs, env, configure, reset)
|
|
221
223
|
status [--project-dir <path>] Show plugin configuration and status
|
|
224
|
+
watch [trace-file] Tail the trace stream (OTel spans) live
|
|
222
225
|
|
|
223
226
|
After installing, the plugin registers these OpenCode hooks:
|
|
224
227
|
config Log resolved Ory config at startup
|
|
@@ -229,7 +232,7 @@ After installing, the plugin registers these OpenCode hooks:
|
|
|
229
232
|
|
|
230
233
|
Examples:
|
|
231
234
|
npx -y -p @ory/opencode ory-opencode install
|
|
232
|
-
npx -y -p @ory/opencode ory-opencode configure --project-url https://<
|
|
235
|
+
npx -y -p @ory/opencode ory-opencode configure --project-url https://<slug>.projects.oryapis.com --api-key ory_pat_...
|
|
233
236
|
npx -y -p @ory/opencode ory-opencode permissions bootstrap
|
|
234
237
|
npx -y -p @ory/opencode ory-opencode local up
|
|
235
238
|
npx -y -p @ory/opencode ory-opencode status
|
package/dist/cli/setup.js
CHANGED
|
@@ -142,6 +142,18 @@ function main() {
|
|
|
142
142
|
(0, assets_js_1.installOpencodeOryAssets)(args.projectDir);
|
|
143
143
|
console.log(`Ory plugin and MCP server configured in ${configPath}`);
|
|
144
144
|
console.log(`Ory skills and commands installed to ${path.join(args.projectDir, ".opencode")}`);
|
|
145
|
-
(0, argus_1.printNextSteps)("OpenCode", "npx ory-opencode-setup --uninstall"
|
|
145
|
+
(0, argus_1.printNextSteps)("OpenCode", "npx -y -p @ory/opencode ory-opencode-setup --uninstall", {
|
|
146
|
+
binName: "ory-opencode",
|
|
147
|
+
harness: "opencode",
|
|
148
|
+
});
|
|
146
149
|
}
|
|
147
150
|
main();
|
|
151
|
+
// When invoked directly as the `-setup` bin with `--uninstall`, also clear
|
|
152
|
+
// stored Ory credentials. When required by the plugin's main CLI, that
|
|
153
|
+
// command owns the purge, so the `require.main` guard prevents a double run.
|
|
154
|
+
if (require.main === module && process.argv.includes("--uninstall")) {
|
|
155
|
+
(0, argus_1.clearCredentialsForUninstall)().then(() => process.exit(0), (err) => {
|
|
156
|
+
console.error(err.message ?? err);
|
|
157
|
+
process.exit(1);
|
|
158
|
+
});
|
|
159
|
+
}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@ory/opencode",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.12.1",
|
|
4
4
|
"description": "Ory plugin for OpenCode: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"homepage": "https://ory.com",
|
|
@@ -63,7 +63,8 @@
|
|
|
63
63
|
"!dist/**/*.tsbuildinfo"
|
|
64
64
|
],
|
|
65
65
|
"dependencies": {
|
|
66
|
-
"
|
|
66
|
+
"reo-census": "^1.2.8",
|
|
67
|
+
"@ory/argus": "0.12.1"
|
|
67
68
|
},
|
|
68
69
|
"engines": {
|
|
69
70
|
"node": ">=22"
|