@ory/opencode 0.14.0 → 1.0.1

package/dist/plugin.js

@@ -2,18 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createOryPlugin = createOryPlugin;
 const argus_1 = require("@ory/argus");
-/**
- * Create the Ory plugin module for OpenCode.
- *
- * OpenCode plugins export { server: Plugin } where Plugin receives
- * context and returns a Hooks object. Hook functions use a mutating
- * (input, output) => Promise<void> pattern.
- *
- * The user login runs on every session at startup — it emits the audit
- * span, refreshes tokens, and may launch a browser flow when interactive.
- * It never blocks the session; enforcement is governed solely by
- * permissionMode at tool-call time.
- */
+const HARNESS = "opencode";
+const SESSION_CACHE_LIMIT = 256;
 function createOryPlugin(clientOrConfig, deps = {}) {
     return {
         id: "ory",
@@ -21,45 +11,66 @@ function createOryPlugin(clientOrConfig, deps = {}) {
             const client = clientOrConfig instanceof argus_1.OryAgentClient
                 ? clientOrConfig
                 : clientOrConfig
-                    ? new argus_1.OryAgentClient({
-                        ...clientOrConfig,
-                        harness: "opencode",
-                    })
-                    : argus_1.OryAgentClient.fromEnv("opencode");
-            // Log session status on startup (never blocks)
-            await verifyOnStartup(client, deps);
+                    ? new argus_1.OryAgentClient({ ...clientOrConfig, harness: HARNESS })
+                    : argus_1.OryAgentClient.fromEnv(HARNESS);
+            const ensureSessionStarted = createSessionStarter(client, deps);
             return {
                 config: createConfigHandler(client),
-                "chat.message": createChatMessageHandler(client),
-                "permission.ask": createPermissionHandler(client, options),
-                "tool.execute.before": createToolBeforeHandler(client),
+                "chat.message": createChatMessageHandler(client, ensureSessionStarted),
+                "permission.ask": createPermissionHandler(client, ensureSessionStarted, options),
+                "tool.execute.before": createToolBeforeHandler(client, ensureSessionStarted),
                 "tool.execute.after": createToolAfterHandler(client),
             };
         },
     };
 }
-// ─── config ────────────────────────────────────────────────────────
 function createConfigHandler(client) {
     return async (_input) => {
+        const resolved = (0, argus_1.resolveConfig)();
         client.logger.info("lifecycle.config", {
-            projectUrl: (0, argus_1.resolveConfig)().projectUrl,
-            auditOnly: (0, argus_1.resolveConfig)().auditOnly,
+            projectUrl: resolved.projectUrl,
+            securityConnected: resolved.security.connected,
         });
-        client.tracer.record("config.resolve", "ok", {
+        client.logger.activity("config.resolve", "ok", {
             attributes: {
-                projectUrl: (0, argus_1.resolveConfig)().projectUrl,
-                auditOnly: (0, argus_1.resolveConfig)().auditOnly,
+                projectUrl: resolved.projectUrl,
+                securityConnected: resolved.security.connected,
             },
         });
     };
 }
-// ─── chat.message ──────────────────────────────────────────────────
-function createChatMessageHandler(client) {
-    return async (input, _output) => {
-        client.tracer.setContext({
-            traceId: (0, argus_1.deriveTraceId)(input.sessionID),
-            sessionId: input.sessionID,
-        });
+function createSessionStarter(client, deps) {
+    const sessions = new Map();
+    const completed = new Set();
+    return async (sessionId) => {
+        let start = sessions.get(sessionId);
+        if (!start) {
+            start = (0, argus_1.withHookContext)(client, { sessionId }, async () => {
+                await (0, argus_1.sessionStart)(client, {
+                    harness: HARNESS,
+                    binName: "ory-opencode",
+                    userLogin: deps.userLogin,
+                    agentGate: deps.agentGate,
+                });
+            });
+            sessions.set(sessionId, start);
+            start.then(() => {
+                completed.add(sessionId);
+                while (sessions.size > SESSION_CACHE_LIMIT) {
+                    const oldest = completed.values().next().value;
+                    if (oldest === undefined)
+                        break;
+                    completed.delete(oldest);
+                    sessions.delete(oldest);
+                }
+            }, () => sessions.delete(sessionId));
+        }
+        await start;
+    };
+}
+function createChatMessageHandler(client, ensureSessionStarted) {
+    return (input, _output) => (0, argus_1.withHookContext)(client, { sessionId: input.sessionID }, async () => {
+        await ensureSessionStarted(input.sessionID);
         client.logger.info("lifecycle.chat_message", {
             sessionID: input.sessionID,
             messageID: input.messageID,
@@ -67,7 +78,7 @@ function createChatMessageHandler(client) {
             providerID: input.model?.providerID,
             modelID: input.model?.modelID,
         });
-        client.tracer.record("user.prompt", "ok", {
+        client.logger.activity("user.prompt", "ok", {
             attributes: {
                 messageID: input.messageID,
                 agent: input.agent,
@@ -75,332 +86,66 @@ function createChatMessageHandler(client) {
                 modelID: input.model?.modelID,
             },
         });
-    };
-}
-// ─── Session verification on startup ────────────────────────────────
-async function verifyOnStartup(client, deps) {
-    // Run the user login on every session. The flow emits the user.auth
-    // audit span, refreshes tokens, and may prompt the user, but never
-    // prevents the session from starting — enforcement is governed solely
-    // by permissionMode at tool-call time.
-    const userGate = deps.userLogin ?? argus_1.ensureUserAuthenticated;
-    await userGate(client, {
-        binName: "ory-opencode",
-        harness: "opencode",
     });
-    // Resolve the agent identity (machine credentials). Never blocks;
-    // attaches the agent's bearer token to outgoing Ory API calls.
-    const agentGate = deps.agentGate ?? argus_1.ensureAgentIdentity;
-    await agentGate(client, { projectUrl: (0, argus_1.resolveConfig)().projectUrl, harness: "opencode" });
-    // Record the user→agent delegation so the audit trail captures that
-    // this user authorized this agent for this session. Written at most once
-    // per install. Best-effort: requires both principals to be populated, and
-    // any failure is logged and swallowed (fail-open — delegation tracking is
-    // for audit, not enforcement).
-    await (0, argus_1.writeUserDelegatesAgent)(client);
 }
-// ─── permission.ask ─────────────────────────────────────────────────
-function createPermissionHandler(client, _options) {
+function createPermissionHandler(client, ensureSessionStarted, _options) {
     return async (input, output) => {
-        // Canonical Permission uses `type`; older plugin versions read `toolID`.
-        // Coalesce so the handler works regardless of which the runtime populates.
-        const toolId = input.toolID ?? input.type ?? "unknown";
-        client.logger.info("lifecycle.permission_ask", {
-            toolID: toolId,
-            title: input.title,
-        });
-        // In audit-only mode, defer to user prompt
-        if ((0, argus_1.resolveConfig)().auditOnly) {
-            return;
-        }
-        // Interactive tools: leave output.status at "ask" so the user makes
-        // the final call. Pre-answering on Ory's behalf hides the prompt the
-        // user is meant to see.
-        if ((0, argus_1.isInteractiveTool)("opencode", toolId)) {
-            client.tracer.record("user.interaction", "ok", {
-                attributes: { harness: "opencode", toolName: toolId, kind: "permission-ask" },
+        const run = async () => {
+            if (input.sessionID)
+                await ensureSessionStarted(input.sessionID);
+            const toolName = input.toolID ?? input.type ?? "unknown";
+            client.logger.info("lifecycle.permission_ask", { toolID: toolName, title: input.title });
+            const result = await (0, argus_1.decideTool)(client, {
+                harness: HARNESS,
+                toolName,
+                subjectFallback: input.sessionID ? `session:${input.sessionID}` : undefined,
+                canBlock: true,
+                mcpTool: (0, argus_1.parseMcpToolGeneric)(toolName) ?? undefined,
+                extraActivityAttributes: { kind: "permission-ask" },
             });
-            return;
+            applyPermissionAskDecision(output, result.kind);
+        };
+        if (input.sessionID) {
+            await (0, argus_1.withHookContext)(client, { sessionId: input.sessionID }, run);
         }
-        // Use the session as the subject fallback, matching tool.execute.before.
-        // Letting this default to the agent's own subject (the prior behavior)
-        // would silently match the agent's tuples instead of the user's.
-        const subject = (0, argus_1.resolveUserSubject)(client, input.sessionID ? `session:${input.sessionID}` : undefined);
-        const mcpTool = (0, argus_1.parseMcpToolGeneric)(toolId);
-        try {
-            if (mcpTool) {
-                const mcpResult = await (0, argus_1.checkMcpPermission)(client, mcpTool, {
-                    subject,
-                    spanAttributes: { toolName: toolId },
-                });
-                const decision = (0, argus_1.applyPermissionMode)(client, mcpResult.allowed, {
-                    object: mcpTool.serverName,
-                    relation: "use",
-                    subjectId: (0, argus_1.subjectLabel)(subject),
-                    ...("subjectSet" in subject ? { subjectSet: subject.subjectSet } : {}),
-                    spanAttributes: { toolName: toolId, mcpServer: mcpTool.serverName, mcpTool: mcpTool.toolName },
-                });
-                applyPermissionAskDecision(output, decision.kind);
-                return;
-            }
-            const outcome = await (0, argus_1.gateToolCall)(client, {
-                harness: "opencode",
-                toolName: toolId,
-                check: { namespace: resolveNamespace(), object: toolId, relation: "use", ...subject },
-                spanAttributes: { toolName: toolId },
-            });
-            if (outcome.kind === "interactive" || outcome.kind === "audit_only") {
-                // Ory is disabled (audit-only kill switch) or this is a
-                // user-interaction primitive: leave output.status as "ask" (default)
-                // so the harness's native prompt reaches the user.
-                return;
-            }
-            const decision = outcome;
-            if (decision.kind === "fail_open") {
-                const code = decision.error.code;
-                if (code === "network_error" || code === "rate_limited") {
-                    client.logger.warn("permission.fallback", {
-                        toolID: toolId,
-                        code,
-                    });
-                    // Leave output.status as "ask" (default)
-                    return;
-                }
-                output.status = "ask";
-                return;
-            }
-            applyPermissionAskDecision(output, decision.kind);
-        }
-        catch (err) {
-            if (isOryError(err) && (err.code === "network_error" || err.code === "rate_limited")) {
-                client.logger.warn("permission.fallback", {
-                    toolID: toolId,
-                    code: err.code,
-                });
-                // Leave output.status as "ask" (default)
-                return;
-            }
-            // For other errors, also fall back to ask
-            output.status = "ask";
+        else {
+            await run();
         }
     };
 }
-// ─── tool.execute.before ────────────────────────────────────────────
-function createToolBeforeHandler(client) {
-    return async (input, output) => {
-        client.logger.info("lifecycle.tool_execute_before", {
-            tool: input.tool,
-            sessionID: input.sessionID,
-            callID: input.callID,
+function createToolBeforeHandler(client, ensureSessionStarted) {
+    return (input, output) => (0, argus_1.withHookContext)(client, { sessionId: input.sessionID }, async () => {
+        client.logger.info("lifecycle.tool_execute_before", input);
+        await ensureSessionStarted(input.sessionID);
+        const result = await (0, argus_1.gate)(client, {
+            harness: HARNESS,
+            toolName: input.tool,
+            toolArgs: output.args,
+            subjectFallback: `session:${input.sessionID}`,
+            canBlock: false,
+            mcpTool: (0, argus_1.parseMcpToolGeneric)(input.tool) ?? undefined,
         });
-        // Set trace context for this tool invocation
-        client.tracer.setContext({
-            traceId: (0, argus_1.deriveTraceId)(input.sessionID),
-            sessionId: input.sessionID,
-        });
-        const inputSummary = (0, argus_1.summarizeToolInput)(input.tool, output.args);
-        // In audit-only mode, log the invocation but skip permission checks
-        if ((0, argus_1.resolveConfig)().auditOnly) {
-            client.tracer.record("tool.invoke", "ok", {
-                attributes: { toolName: input.tool, ...inputSummary },
-            });
-            return;
-        }
-        const subject = (0, argus_1.resolveUserSubject)(client, input.sessionID ? `session:${input.sessionID}` : undefined);
-        const subjectId = (0, argus_1.subjectLabel)(subject);
-        const mcpTool = (0, argus_1.parseMcpToolGeneric)(input.tool);
-        try {
-            if (mcpTool) {
-                const mcpResult = await (0, argus_1.checkMcpPermission)(client, mcpTool, {
-                    subject,
-                    spanAttributes: { toolName: input.tool },
-                });
-                const mcpAttrs = {
-                    toolName: input.tool,
-                    mcpServer: mcpTool.serverName,
-                    mcpTool: mcpTool.toolName,
-                    ...inputSummary,
-                };
-                const decision = (0, argus_1.applyPermissionMode)(client, mcpResult.allowed, {
-                    object: mcpTool.serverName,
-                    relation: "use",
-                    subjectId,
-                    ...("subjectSet" in subject ? { subjectSet: subject.subjectSet } : {}),
-                    spanAttributes: mcpAttrs,
-                });
-                const decisionAttrs = decision.spanAttributes;
-                if (decision.kind === "allow") {
-                    client.tracer.record("tool.invoke", "ok", {
-                        attributes: { ...mcpAttrs, ...decisionAttrs },
-                    });
-                    return;
-                }
-                if (decision.kind === "observe") {
-                    client.tracer.record("tool.block", "denied", {
-                        attributes: { ...mcpAttrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
-                    });
-                    client.tracer.record("tool.invoke", "ok", {
-                        attributes: { ...mcpAttrs, ...decisionAttrs, allowed: false, observed: true },
-                    });
-                    return;
-                }
-                client.tracer.record("tool.block", "denied", {
-                    attributes: { ...mcpAttrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
-                });
-                const message = (0, argus_1.formatDenialMessage)({
-                    tool: input.tool,
-                    subjectId,
-                    mcp: mcpTool,
-                });
-                client.logger.warn("tool.denied", {
-                    tool: input.tool,
-                    subjectId,
-                    message,
-                });
-                // OpenCode has no native block signal in tool.execute.before;
-                // throwing aborts execution (documented .env-protection pattern)
-                // and surfaces error.message back to the agent.
-                throw new argus_1.OryDenialError({
-                    tool: input.tool,
-                    subjectId,
-                    mcp: mcpTool,
-                });
-            }
-            const namespace = resolveNamespace();
-            const outcome = await (0, argus_1.gateToolCall)(client, {
-                harness: "opencode",
-                toolName: input.tool,
-                check: { namespace, object: input.tool, relation: "use", ...subject },
-                spanAttributes: { toolName: input.tool },
-            });
-            // Interactive tools (operator-extensible via ORY_INTERACTIVE_TOOLS):
-            // user.interaction span is already recorded; pass through with no
-            // throw, no tool.invoke, no tool.block.
-            if (outcome.kind === "interactive") {
-                return;
-            }
-            const decision = outcome;
-            if (decision.kind === "fail_open") {
-                handlePermissionError(decision.error, input.tool, client);
-                return;
-            }
-            const attrs = { toolName: input.tool, ...inputSummary };
-            const decisionAttrs = decision.spanAttributes;
-            if (decision.kind === "allow") {
-                client.tracer.record("tool.invoke", "ok", {
-                    attributes: { ...attrs, ...decisionAttrs, allowed: true },
-                });
-                return;
-            }
-            if (decision.kind === "observe") {
-                client.tracer.record("tool.block", "denied", {
-                    attributes: { ...attrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
-                });
-                client.tracer.record("tool.invoke", "ok", {
-                    attributes: { ...attrs, ...decisionAttrs, allowed: false, observed: true },
-                });
-                return;
-            }
-            client.tracer.record("tool.block", "denied", {
-                attributes: { ...attrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
-            });
-            const message = (0, argus_1.formatDenialMessage)({
-                tool: input.tool,
-                subjectId,
-                namespace,
-            });
-            client.logger.warn("tool.denied", {
-                tool: input.tool,
-                subjectId,
-                message,
-            });
-            throw new argus_1.OryDenialError({
+        if (result.kind === "deny") {
+            throw new argus_1.OryDenialError(result.denialContext ?? {
                 tool: input.tool,
-                subjectId,
-                namespace,
+                subjectId: result.subject,
+                namespace: result.namespace,
             });
         }
-        catch (err) {
-            if (err instanceof argus_1.OryDenialError)
-                throw err;
-            handlePermissionError(err, input.tool, client);
-        }
-    };
+    });
 }
-// ─── tool.execute.after ─────────────────────────────────────────────
 function createToolAfterHandler(client) {
-    return async (input, output) => {
-        client.logger.info("lifecycle.tool_execute_after", {
-            tool: input.tool,
-            sessionID: input.sessionID,
-            callID: input.callID,
-        });
-        client.tracer.setContext({
-            traceId: (0, argus_1.deriveTraceId)(input.sessionID),
-            sessionId: input.sessionID,
+    return (input, output) => (0, argus_1.withHookContext)(client, { sessionId: input.sessionID }, async () => {
+        client.logger.info("lifecycle.tool_execute_after", input);
+        (0, argus_1.complete)(client, {
+            toolName: input.tool,
+            output: { title: output.title, output: output.output },
         });
-        // OpenCode's canonical tool.execute.after input has no `args`,
-        // so input summary is unavailable here; output summary only.
-        client.tracer.record("tool.complete", "ok", {
-            attributes: {
-                toolName: input.tool,
-                ...(0, argus_1.summarizeToolOutput)(input.tool, {
-                    title: output.title,
-                    output: output.output,
-                }),
-            },
-        });
-    };
-}
-// ─── Helpers ────────────────────────────────────────────────────────
-function resolveNamespace() {
-    return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
+    });
 }
-/**
- * Map an Ory permission decision onto OpenCode's `permission.ask` output.
- *
- * Only explicit outcomes answer the prompt: `deny` → `"deny"`,
- * `allow` → `"allow"`. An `observe`-mode deny leaves `output.status`
- * untouched (OpenCode's default is `"ask"`), so the harness's native
- * user prompt still appears — observe mode must never escalate a
- * policy-denied tool into an auto-approval. The observe deny is already
- * recorded as a `permission.observe_deny` audit span by the gate.
- */
 function applyPermissionAskDecision(output, kind) {
-    if (kind === "deny") {
+    if (kind === "deny")
         output.status = "deny";
-    }
-    else if (kind === "allow") {
+    else if (kind === "allow")
         output.status = "allow";
-    }
-    // kind === "observe": leave the harness's native prompt in place.
-}
-function isOryError(err) {
-    return (typeof err === "object" &&
-        err !== null &&
-        "code" in err &&
-        "message" in err);
-}
-function handlePermissionError(err, tool, client) {
-    if (isOryError(err)) {
-        if (err.code === "network_error" || err.code === "rate_limited") {
-            client.logger.warn("permission.fallback", {
-                tool,
-                code: err.code,
-                message: "Failing open",
-            });
-            return;
-        }
-        client.logger.error("permission.check.error", {
-            tool,
-            code: err.code,
-            message: err.message,
-        });
-    }
-    else {
-        client.logger.error("permission.check.error", {
-            tool,
-            error: err instanceof Error ? err.message : String(err),
-        });
-    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/opencode",
-  "version": "0.14.0",
+  "version": "1.0.1",
   "description": "Ory plugin for OpenCode: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -33,8 +33,7 @@
     "agent-security",
     "guardrails",
     "llm",
-    "tracing",
-    "distributed-tracing",
+    "activity-auditing",
     "observability",
     "kratos",
     "keto",
@@ -45,6 +44,10 @@
     "registry": "https://registry.npmjs.org/",
     "provenance": true
   },
+  "reova": {
+    "enabled": true,
+    "endpoint": "https://telemetry.reo.dev/data"
+  },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
@@ -59,12 +62,11 @@
   },
   "files": [
     "dist",
-    "!dist/dev",
     "!dist/**/*.tsbuildinfo"
   ],
   "dependencies": {
-    "reo-census": "^1.2.8",
-    "@ory/argus": "0.14.0"
+    "reova": "^0.7.0",
+    "@ory/argus": "1.0.1"
   },
   "engines": {
     "node": ">=22"
@@ -74,7 +76,6 @@
     "clean": "rm -rf dist *.tsbuildinfo",
     "test": "vitest run",
     "test:watch": "vitest",
-    "typecheck": "tsc --noEmit",
-    "dev": "node dist/dev/launcher.js"
+    "typecheck": "tsc --noEmit"
   }
 }