@ory/opencode 0.2.0 → 0.3.0

package/dist/cli/main.js

@@ -201,7 +201,7 @@ Commands:
   install [--project-dir <path>]   Register the Ory plugin in opencode.json
   uninstall [--project-dir <path>] Remove the Ory plugin from opencode.json
   configure                        Set or view Ory project URL and API key
-  permissions <cmd>                Manage permission mode and tool tuples (status, bootstrap, observe, enforce)
+  permissions <cmd>                Manage permission mode and tool permissions (status, bootstrap, observe, enforce)
   status [--project-dir <path>]    Show plugin configuration and status
   local <cmd>                      Manage local Ory dev environment (up, down, status, seed, ...)
 

package/dist/plugin.js

@@ -205,6 +205,7 @@ function createPermissionHandler(client, _options) {
                     object: mcpTool.serverName,
                     relation: "use",
                     subjectId: (0, argus_1.subjectLabel)(subject),
+                    ...("subjectSet" in subject ? { subjectSet: subject.subjectSet } : {}),
                     spanAttributes: { toolName: input.toolID, mcpServer: mcpTool.serverName, mcpTool: mcpTool.toolName },
                 });
                 output.status = decision.kind === "deny" ? "deny" : "allow";
@@ -280,23 +281,27 @@ function createToolBeforeHandler(client) {
                     object: mcpTool.serverName,
                     relation: "use",
                     subjectId,
+                    ...("subjectSet" in subject ? { subjectSet: subject.subjectSet } : {}),
                     spanAttributes: mcpAttrs,
                 });
+                const decisionAttrs = decision.spanAttributes;
                 if (decision.kind === "allow") {
-                    client.tracer.record("tool.invoke", "ok", { attributes: mcpAttrs });
+                    client.tracer.record("tool.invoke", "ok", {
+                        attributes: { ...mcpAttrs, ...decisionAttrs },
+                    });
                     return;
                 }
                 if (decision.kind === "observe") {
                     client.tracer.record("tool.block", "denied", {
-                        attributes: { ...mcpAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
+                        attributes: { ...mcpAttrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
                     });
                     client.tracer.record("tool.invoke", "ok", {
-                        attributes: { ...mcpAttrs, allowed: false, observed: true },
+                        attributes: { ...mcpAttrs, ...decisionAttrs, allowed: false, observed: true },
                     });
                     return;
                 }
                 client.tracer.record("tool.block", "denied", {
-                    attributes: { ...mcpAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
+                    attributes: { ...mcpAttrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
                 });
                 const message = (0, argus_1.formatDenialMessage)({
                     tool: input.tool,
@@ -324,21 +329,24 @@ function createToolBeforeHandler(client) {
                 return;
             }
             const attrs = { toolName: input.tool, ...inputSummary };
+            const decisionAttrs = decision.spanAttributes;
             if (decision.kind === "allow") {
-                client.tracer.record("tool.invoke", "ok", { attributes: { ...attrs, allowed: true } });
+                client.tracer.record("tool.invoke", "ok", {
+                    attributes: { ...attrs, ...decisionAttrs, allowed: true },
+                });
                 return;
             }
             if (decision.kind === "observe") {
                 client.tracer.record("tool.block", "denied", {
-                    attributes: { ...attrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
+                    attributes: { ...attrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
                 });
                 client.tracer.record("tool.invoke", "ok", {
-                    attributes: { ...attrs, allowed: false, observed: true },
+                    attributes: { ...attrs, ...decisionAttrs, allowed: false, observed: true },
                 });
                 return;
             }
             client.tracer.record("tool.block", "denied", {
-                attributes: { ...attrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
+                attributes: { ...attrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
             });
             const message = (0, argus_1.formatDenialMessage)({
                 tool: input.tool,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/opencode",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Ory plugin for OpenCode: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -64,7 +64,7 @@
     "!dist/**/*.tsbuildinfo"
   ],
   "dependencies": {
-    "@ory/argus": "0.2.0"
+    "@ory/argus": "0.3.0"
   },
   "engines": {
     "node": ">=24"