@ory/opencode 0.14.0 → 1.0.0

package/dist/cli/main.js

@@ -46,11 +46,22 @@ const path = __importStar(require("node:path"));
 const fs = __importStar(require("node:fs"));
 const argus_1 = require("@ory/argus");
 const assets_js_1 = require("./assets.js");
+const config_js_1 = require("./config.js");
 const PACKAGE_ROOT = path.resolve(__dirname, "..", "..");
 function main() {
     const [command, ...args] = process.argv.slice(2);
+    // `--help` after a matched subcommand: print usage, do nothing else.
+    // Without this the switch below ignores the flag and `install --help`
+    // performs a real install (#221).
+    if ((0, argus_1.shouldPrintHelp)(command, args))
+        return help();
     switch (command) {
-        case "install":
+        case "install": {
+            if (args.includes("--print")) {
+                process.argv = ["node", "setup.js", ...args];
+                require("./setup.js");
+                break;
+            }
             (0, argus_1.beginDeferNextSteps)();
             install(args);
             (0, argus_1.runPostInstall)("ory-opencode", "opencode", args).then(() => process.exit(0), (err) => {
@@ -58,9 +69,13 @@ function main() {
                 process.exit(1);
             });
             break;
+        }
         case "uninstall":
             uninstall(args);
-            (0, argus_1.clearCredentialsForUninstall)().then(() => process.exit(0), (err) => {
+            (0, argus_1.clearCredentialsForUninstall)({
+                harness: "opencode",
+                purge: args.includes("--purge"),
+            }).then(() => process.exit(0), (err) => {
                 console.error(err.message ?? err);
                 process.exit(1);
             });
@@ -69,7 +84,7 @@ function main() {
             (0, argus_1.runConfigureCommand)("ory-opencode", args);
             break;
         case "agent":
-            (0, argus_1.runAgentCommand)("ory-opencode", args).then((code) => process.exit(code), (err) => {
+            (0, argus_1.runAgentCommand)("ory-opencode", "opencode", args).then((code) => process.exit(code), (err) => {
                 console.error(err.message ?? err);
                 process.exit(1);
             });
@@ -86,17 +101,11 @@ function main() {
                 process.exit(1);
             });
             break;
-        case "local":
-            (0, argus_1.runLocalCommand)("ory-opencode", args).catch((err) => {
-                console.error(err.message ?? err);
-                process.exit(1);
-            });
-            break;
         case "watch":
-            (0, argus_1.runWatchCommand)("opencode", args);
+            (0, argus_1.runWatchCommand)("ory-opencode", "opencode", args).then((code) => process.exit(code), (err) => { console.error(err.message ?? err); process.exit(1); });
             break;
-        case "dashboard":
-            (0, argus_1.runDashboardCommand)("ory-opencode", "opencode", args).then((code) => process.exit(code), (err) => {
+        case "local":
+            (0, argus_1.runLocalCommand)("ory-opencode", args).catch((err) => {
                 console.error(err.message ?? err);
                 process.exit(1);
             });
@@ -124,39 +133,51 @@ function parseProjectDir(args) {
         return args[idx + 1];
     return process.cwd();
 }
-const PLUGIN_MODULE = "@ory/opencode";
-const MCP_SERVER_NAME = "ory";
-const MCP_SERVER_COMMAND = [
-    "npx",
-    "-y",
-    "--package=@ory/mcp-server",
-    "ory-mcp-server",
-];
-const OPENCODE_SCHEMA_URL = "https://opencode.ai/config.json";
 function install(args) {
     const projectDir = parseProjectDir(args);
     const configPath = path.join(projectDir, "opencode.json");
     const fileExists = fs.existsSync(configPath);
-    const config = (0, argus_1.readJsonFile)(configPath);
+    let config = (0, argus_1.readJsonFile)(configPath);
     // Set $schema for editor autocomplete on fresh configs only — don't
     // overwrite a user's existing schema reference.
     if (!fileExists && !config.$schema) {
-        config.$schema = OPENCODE_SCHEMA_URL;
+        config.$schema = config_js_1.OPENCODE_SCHEMA_URL;
+    }
+    // Resolve the runtime once, here. The spec written below is a path into it,
+    // so OpenCode imports this exact copy instead of running its own npm install
+    // into a cache it never re-checks.
+    const runtime = (0, argus_1.wireRuntime)({
+        harness: "opencode",
+        packageName: "@ory/opencode",
+        packageRoot: PACKAGE_ROOT,
+        installCommand: "npx -y -p @ory/opencode ory-opencode install",
+        args,
+        // OpenCode loads the plugin in-process, so there is no hook subprocess and
+        // no hook shim — the entry it imports is the package's main module.
+        entryRelPath: "dist/index.js",
+        inProcess: true,
+    });
+    const spec = (0, config_js_1.runtimePluginSpec)((0, argus_1.moduleSpecifier)(runtime.target));
+    config = (0, config_js_1.mergePlugin)(config, spec);
+    if (runtime.mcpServer) {
+        config = (0, config_js_1.mergeMcp)(config, [
+            runtime.mcpServer.command,
+            ...runtime.mcpServer.args,
+        ]);
     }
-    const plugin = (config.plugin ?? []).filter((p) => (typeof p === "string" ? p : p[0]) !== PLUGIN_MODULE);
-    plugin.push(PLUGIN_MODULE);
-    config.plugin = plugin;
-    // OpenCode's config schema uses `mcp` (singular) with a `local` connector
-    // shape `{ type: "local", command: [...] }` — not the generic
-    // `mcpServers` / `{command, args}` form used by Claude Code.
-    const mcp = (config.mcp ?? {});
-    mcp[MCP_SERVER_NAME] = { type: "local", command: MCP_SERVER_COMMAND };
-    config.mcp = mcp;
     fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
     (0, assets_js_1.installOpencodeOryAssets)(projectDir);
+    console.log(runtime.target.kind === "linked"
+        ? `Runtime: linked to ${runtime.target.packageDir} (dev)`
+        : `Runtime: ${runtime.target.packageName}@${runtime.target.version} in ${runtime.target.storeDir}`);
+    for (const pruned of runtime.prunedStores) {
+        console.log(`  Removed stale runtime: ${pruned}`);
+    }
     console.log(`Ory plugin and MCP server registered in ${configPath}`);
-    console.log(`  Plugin: ${PLUGIN_MODULE}`);
-    console.log(`  MCP server: ${MCP_SERVER_NAME} (${MCP_SERVER_COMMAND.join(" ")})`);
+    console.log(`  Plugin: ${spec}`);
+    if (runtime.mcpServer) {
+        console.log(`  MCP server: ${config_js_1.MCP_SERVER_NAME} (${runtime.mcpServer.command} ${runtime.mcpServer.args.join(" ")})`);
+    }
     console.log(`  Skills + commands installed under ${path.join(projectDir, ".opencode")}`);
     (0, argus_1.printEnvHelp)("ory-opencode");
 }
@@ -167,22 +188,9 @@ function uninstall(args) {
         console.log("No opencode.json found. Nothing to uninstall.");
         return;
     }
-    const config = (0, argus_1.readJsonFile)(configPath);
-    const plugin = (config.plugin ?? []).filter((p) => (typeof p === "string" ? p : p[0]) !== PLUGIN_MODULE);
-    if (plugin.length === 0) {
-        delete config.plugin;
-    }
-    else {
-        config.plugin = plugin;
-    }
-    const mcp = (config.mcp ?? {});
-    delete mcp[MCP_SERVER_NAME];
-    if (Object.keys(mcp).length === 0) {
-        delete config.mcp;
-    }
-    else {
-        config.mcp = mcp;
-    }
+    let config = (0, argus_1.readJsonFile)(configPath);
+    config = (0, config_js_1.removePlugin)(config);
+    config = (0, config_js_1.removeMcp)(config);
     // If the file is now effectively empty (we created it, only $schema left
     // from our own install) delete it instead of leaving `{}` behind. Keep
     // it if there's any user-authored content.
@@ -196,6 +204,10 @@ function uninstall(args) {
         console.log(`Ory plugin and MCP server removed from ${configPath}`);
     }
     (0, assets_js_1.uninstallOpencodeOryAssets)(projectDir);
+    (0, argus_1.removeRuntimeWiring)("opencode");
+    for (const pruned of (0, argus_1.pruneRuntimeStores)()) {
+        console.log(`  Removed runtime: ${pruned}`);
+    }
 }
 async function status(args) {
     const projectDir = parseProjectDir(args);
@@ -204,14 +216,32 @@ async function status(args) {
         title: "OpenCode",
         printPluginSection: () => {
             const config = (0, argus_1.readJsonFile)(configPath);
-            const moduleName = "@ory/opencode";
-            const plugin = (config.plugin ?? []);
-            const oryPlugin = plugin.find((p) => (typeof p === "string" ? p : p[0]) === moduleName);
+            const entry = (0, config_js_1.findOryPluginEntry)(config);
             console.log("Hooks & plugin:");
             console.log(`  Config file:       ${configPath}`);
-            console.log(`  Plugin registered: ${oryPlugin ? "yes" : "NO"}`);
-            if (oryPlugin) {
-                console.log(`  Module:            ${typeof oryPlugin === "string" ? oryPlugin : oryPlugin[0]}`);
+            console.log(`  Plugin registered: ${entry ? "yes" : "NO"}`);
+            console.log(`  Runtime:           ${(0, argus_1.describeRuntimeHealth)((0, argus_1.checkRuntimeHealth)("opencode"))}`);
+            if (!entry)
+                return;
+            const spec = (0, config_js_1.entrySpec)(entry);
+            console.log(`  Spec:              ${spec}`);
+            // Registration in opencode.json is not the same as the plugin loading.
+            // The spec is a path into the resolved runtime, so this reports whether
+            // that copy is actually there — the npm-cache failure modes (stale build,
+            // silently retried failed install) can no longer occur, but a runtime
+            // deleted out of band still can.
+            const resolved = (0, config_js_1.resolveInstalledPlugin)(spec);
+            if (resolved.version) {
+                console.log(`  Loads:             ${resolved.version} (${resolved.source})`);
+                console.log(`  From:              ${resolved.dir}`);
+            }
+            else {
+                console.log(`  Loads:             MISSING — no package at ${resolved.dir ?? spec}; re-run install`);
+            }
+            // Cache directories left behind by an earlier npm-spec install. Nothing
+            // reads them now, and OpenCode will not clean them up itself.
+            for (const other of resolved.otherCached) {
+                console.log(`  Stale cache:       ${other.spec}${other.version ? ` (${other.version})` : ""} — safe to delete`);
             }
         },
     });
@@ -225,29 +255,30 @@ Usage:
 
 Commands:
   install [--project-dir <path>]   Register the Ory plugin and MCP server in opencode.json
+                                   [--plugin-spec <spec>] override the plugin spec written
+                                   to opencode.json (defaults to this version, pinned; pass
+                                   a file:// path to load a local build instead of npm)
   uninstall [--project-dir <path>] Remove the Ory plugin and MCP server from opencode.json
   configure                        Set or view Ory project URL and API key
   agent <status|unregister>        Manage the agent's OAuth2 (DCR) identity
-  permissions <cmd>                Manage permission mode and tool permissions
-                                   (status, bootstrap, observe, enforce)
+  permissions                      Show the live permission mode and per-tool coverage
   local <cmd>                      Manage local Ory dev environment
                                    (up, down, status, seed, logs, env, configure, reset)
   status [--project-dir <path>]    Show plugin configuration and status
-  dashboard            Open the Ory Agent dashboard (system health + configuration)
-  watch [trace-file]               Tail the trace stream (OTel spans) live
+  watch [--json] [--lines <count>] Follow the live activity/debug log
   version                          Show version and the ory-agent-plugins build commit
 
 After installing, the plugin registers these OpenCode hooks:
   config                 Log resolved Ory config at startup
-  chat.message           Trace user prompts per turn
+  chat.message           Record user prompt activity per turn
   permission.ask         Authorize actions via Ory Permissions
   tool.execute.before    Check tool permissions via Ory Permissions
   tool.execute.after     Audit log tool executions
 
 Examples:
   npx -y -p @ory/opencode ory-opencode install
-  npx -y -p @ory/opencode ory-opencode configure --project-url https://<slug>.projects.oryapis.com --api-key ory_pat_...
-  npx -y -p @ory/opencode ory-opencode permissions bootstrap
+  npx -y -p @ory/opencode ory-opencode configure --project-url https://<slug>.projects.oryapis.com --agent-security-url https://agents.console.ory.com
+  npx -y -p @ory/opencode ory-opencode permissions
   npx -y -p @ory/opencode ory-opencode local up
   npx -y -p @ory/opencode ory-opencode status
 `);

package/dist/cli/setup.d.ts

@@ -7,5 +7,8 @@
  *   npx ory-opencode-setup --project-dir /path/to/repo
  *   npx ory-opencode-setup --print            # Print config to stdout without writing
  *   npx ory-opencode-setup --uninstall        # Remove Ory plugin from config
+ *   npx ory-opencode-setup --plugin-spec <s>  # Override the plugin spec written
+ *                                             # to opencode.json (defaults to
+ *                                             # this version, pinned)
  */
 export {};

package/dist/cli/setup.js

@@ -8,6 +8,9 @@
  *   npx ory-opencode-setup --project-dir /path/to/repo
  *   npx ory-opencode-setup --print            # Print config to stdout without writing
  *   npx ory-opencode-setup --uninstall        # Remove Ory plugin from config
+ *   npx ory-opencode-setup --plugin-spec <s>  # Override the plugin spec written
+ *                                             # to opencode.json (defaults to
+ *                                             # this version, pinned)
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -47,66 +50,21 @@ const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const argus_1 = require("@ory/argus");
 const assets_js_1 = require("./assets.js");
-const PLUGIN_MODULE = "@ory/opencode";
-const MCP_SERVER_NAME = "ory";
-const MCP_SERVER_COMMAND = [
-    "npx",
-    "-y",
-    "--package=@ory/mcp-server",
-    "ory-mcp-server",
-];
-const OPENCODE_SCHEMA_URL = "https://opencode.ai/config.json";
-// OpenCode's config schema uses `mcp` (singular) with a `local` connector
-// shape `{ type: "local", command: [...] }`, not the generic `mcpServers`
-// helper from core.
-function mergeOpencodeMcp(existing) {
-    const merged = { ...existing };
-    const mcp = (merged.mcp ?? {});
-    mcp[MCP_SERVER_NAME] = { type: "local", command: MCP_SERVER_COMMAND };
-    merged.mcp = mcp;
-    return merged;
-}
-function removeOpencodeMcp(existing) {
-    const merged = { ...existing };
-    const mcp = (merged.mcp ?? {});
-    delete mcp[MCP_SERVER_NAME];
-    if (Object.keys(mcp).length === 0) {
-        delete merged.mcp;
-    }
-    else {
-        merged.mcp = mcp;
-    }
-    return merged;
-}
+const config_js_1 = require("./config.js");
+const PACKAGE_ROOT = path.resolve(__dirname, "..", "..");
 function getConfigPath(args) {
     return path.join(args.projectDir, "opencode.json");
 }
-function mergePlugin(existing) {
-    const merged = { ...existing };
-    const plugin = (merged.plugin ?? []).filter((p) => (typeof p === "string" ? p : p[0]) !== PLUGIN_MODULE);
-    plugin.push(PLUGIN_MODULE);
-    merged.plugin = plugin;
-    return merged;
-}
-function removePlugin(existing) {
-    const merged = { ...existing };
-    const plugin = (merged.plugin ?? []).filter((p) => (typeof p === "string" ? p : p[0]) !== PLUGIN_MODULE);
-    if (plugin.length === 0) {
-        delete merged.plugin;
-    }
-    else {
-        merged.plugin = plugin;
-    }
-    return merged;
-}
 function main() {
     if (process.argv.includes("--help") || process.argv.includes("-h")) {
         (0, argus_1.printSetupHelp)("ory-opencode-setup", "OpenCode");
         process.exit(0);
     }
     const args = (0, argus_1.parseSetupArgs)();
+    const argv = process.argv.slice(2);
     if (args.print) {
-        console.log(JSON.stringify({ plugin: [PLUGIN_MODULE] }, null, 2));
+        // Nothing is resolved or written on a --print run: report the shape only.
+        console.log(JSON.stringify({ plugin: ["file://<resolved runtime>"] }, null, 2));
         return;
     }
     const configPath = getConfigPath(args);
@@ -117,8 +75,8 @@ function main() {
             console.log("No opencode.json found. Nothing to uninstall.");
             return;
         }
-        let updated = removePlugin(existing);
-        updated = removeOpencodeMcp(updated);
+        let updated = (0, config_js_1.removePlugin)(existing);
+        updated = (0, config_js_1.removeMcp)(updated);
         const remainingKeys = Object.keys(updated).filter((k) => k !== "$schema");
         if (remainingKeys.length === 0) {
             fs.unlinkSync(configPath);
@@ -130,18 +88,40 @@ function main() {
         }
         (0, assets_js_1.uninstallOpencodeOryAssets)(args.projectDir);
         console.log(`Removed Ory skills and commands from ${path.join(args.projectDir, ".opencode")}`);
+        (0, argus_1.removeRuntimeWiring)("opencode");
+        for (const pruned of (0, argus_1.pruneRuntimeStores)()) {
+            console.log(`  Removed runtime: ${pruned}`);
+        }
         return;
     }
-    let merged = mergePlugin(existing);
-    merged = mergeOpencodeMcp(merged);
+    // Resolve the runtime once, here, and point the plugin spec at it.
+    const runtime = (0, argus_1.wireRuntime)({
+        harness: "opencode",
+        packageName: "@ory/opencode",
+        packageRoot: PACKAGE_ROOT,
+        installCommand: "npx -y -p @ory/opencode ory-opencode install",
+        args: argv,
+        entryRelPath: "dist/index.js",
+        inProcess: true,
+    });
+    const spec = (0, config_js_1.runtimePluginSpec)((0, argus_1.moduleSpecifier)(runtime.target));
+    let merged = (0, config_js_1.mergePlugin)(existing, spec);
+    if (runtime.mcpServer) {
+        merged = (0, config_js_1.mergeMcp)(merged, [
+            runtime.mcpServer.command,
+            ...runtime.mcpServer.args,
+        ]);
+    }
     // Add $schema for editor autocomplete on fresh configs only.
     if (!fileExists && !merged.$schema) {
-        merged = { $schema: OPENCODE_SCHEMA_URL, ...merged };
+        merged = { $schema: config_js_1.OPENCODE_SCHEMA_URL, ...merged };
     }
     (0, argus_1.writeJsonFile)(configPath, merged);
     (0, assets_js_1.installOpencodeOryAssets)(args.projectDir);
     console.log(`Ory plugin and MCP server configured in ${configPath}`);
+    console.log(`  Plugin: ${spec}`);
     console.log(`Ory skills and commands installed to ${path.join(args.projectDir, ".opencode")}`);
+    console.log(`Verify what OpenCode will load: npx -y -p @ory/opencode ory-opencode status`);
     (0, argus_1.printNextSteps)("OpenCode", "npx -y -p @ory/opencode ory-opencode-setup --uninstall", {
         binName: "ory-opencode",
         harness: "opencode",
@@ -152,7 +132,10 @@ main();
 // stored Ory credentials. When required by the plugin's main CLI, that
 // command owns the purge, so the `require.main` guard prevents a double run.
 if (require.main === module && process.argv.includes("--uninstall")) {
-    (0, argus_1.clearCredentialsForUninstall)().then(() => process.exit(0), (err) => {
+    (0, argus_1.clearCredentialsForUninstall)({
+        harness: "opencode",
+        purge: process.argv.includes("--purge"),
+    }).then(() => process.exit(0), (err) => {
         console.error(err.message ?? err);
         process.exit(1);
     });

package/dist/plugin.d.ts

@@ -1,24 +1,9 @@
-import { OryAgentClient, ensureUserAuthenticated, ensureAgentIdentity } from "@ory/argus";
+import { OryAgentClient, ensureAgentIdentity, ensureUserAuthenticated } from "@ory/argus";
 import type { PluginModule } from "./types.js";
 export interface CreateOryPluginDeps {
-    /** Test injection point for the user login flow. */
     userLogin?: typeof ensureUserAuthenticated;
-    /** Test injection point for the agent identity gate. */
     agentGate?: typeof ensureAgentIdentity;
 }
-/**
- * Create the Ory plugin module for OpenCode.
- *
- * OpenCode plugins export { server: Plugin } where Plugin receives
- * context and returns a Hooks object. Hook functions use a mutating
- * (input, output) => Promise<void> pattern.
- *
- * The user login runs on every session at startup — it emits the audit
- * span, refreshes tokens, and may launch a browser flow when interactive.
- * It never blocks the session; enforcement is governed solely by
- * permissionMode at tool-call time.
- */
 export declare function createOryPlugin(clientOrConfig?: OryAgentClient | {
     projectUrl: string;
-    apiKey?: string;
 }, deps?: CreateOryPluginDeps): PluginModule;