@ory/opencode 0.9.1 → 0.10.0

package/README.md

@@ -122,7 +122,7 @@ Bundled and registered by the Ory installer. Exposes the Ory CLI and the Ory Net
 /ory:temporal-up   # start a local Temporal dev server (for ory-temporal-worker)
 ```
 
-`local-up` runs a complete Ory on your laptop: the Ory APIs (Identities, OAuth2, Permissions) at `http://localhost:4000`, a login UI on `:3000`, and Jaeger (the trace viewer) on `:16686`. A test user identity is seeded and its credentials are printed for you. Use it to:
+`local-up` runs a complete Ory on your laptop: the Ory APIs (Identities, OAuth2, Permissions) at `http://localhost:4000`, a login UI on `:4455` (not :3000, to avoid Next.js port conflicts), and Jaeger (the trace viewer) on `:16686`. A test user identity is seeded and its credentials are printed for you. Use it to:
 
 - **Learn Ory hands-on** without signing up for a hosted project.
 - **Prototype** flows (login, social, MFA, recovery, permissions) against a real Ory backend.
@@ -205,7 +205,7 @@ Headless / CI runs that already hold a session token can skip this entirely by s
 Once the plugin is pointed at an Ory project (local or hosted), OpenCode's session and every tool call can be governed by Ory.
 
 - **Authentication.** Two identities. The human at the keyboard (the **user**) authenticates interactively via Ory Identities when user login is enabled (`ORY_USER_LOGIN=true`, off by default — browser PKCE flow on first session, persisted token thereafter). The OpenCode process (the **agent**) gets its own OAuth2 identity, self-registered via [Dynamic Client Registration (RFC 7591)](https://datatracker.ietf.org/doc/html/rfc7591) on first run.
-- **Authorization.** When OpenCode prompts for permission to use a tool, the plugin checks [Ory Permissions](https://www.ory.com/docs/keto) (Zanzibar-style relations) against the user's subject and returns `allow` / `deny`. A parallel pre-tool check is recorded as part of the audit trail. MCP tool calls additionally get a server-level check.
+- **Authorization.** When OpenCode prompts for permission to use a tool, the plugin checks [Ory Permissions](https://www.ory.com/docs/keto) (Zanzibar-style relations) against the user's subject. In **enforce** mode a deny blocks the tool by throwing an `OryDenialError` (OpenCode surfaces the denial reason); in **observe** mode (default) the deny is recorded as a `permission.observe_deny` span and the tool runs. A parallel pre-tool check is recorded as part of the audit trail. MCP tool calls additionally get a server-level check.
 - **Audit.** Every decision (allow, deny, fallback) is recorded as a structured trace span: NDJSON file output and/or OTLP/HTTP export to Jaeger, Honeycomb, Grafana, and similar collectors. The user → agent delegation is written to Ory as a relation so *"agent X acting on behalf of user Y"* stays queryable after tokens expire.
 
 The plugin is **fail-open** on its own infrastructure failures (network errors, rate limits, missing config), so enforcement is only as strong as your permission grants — grant explicit `use` on the tools each user should be able to run.
@@ -269,7 +269,7 @@ Highlights:
 
 ## Troubleshooting
 
-- **`/ory:local-up` fails.** Make sure Docker is running and ports `3000`, `4000`, `4100`, and `16686` are free.
+- **`/ory:local-up` fails.** Make sure Docker is running and ports `4455` (login UI), `4000`, `4100`, and `16686` are free.
 - **PKCE login loops.** Clear persisted state with `npx -y -p @ory/opencode ory-opencode agent unregister` and retry.
 - **`npx` fetches an old version.** Force a fresh fetch: `npx -y -p @ory/opencode@latest ory-opencode …`.
 - **`npm error code ENOVERSIONS` on install.** Your npm has a supply-chain freshness filter (`min-release-age`) that's hiding all `@ory/opencode` versions newer than its threshold. Either wait it out, or run the installer with `--min-release-age=0`: `npx -y --min-release-age=0 -p @ory/opencode ory-opencode install`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/opencode",
-  "version": "0.9.1",
+  "version": "0.10.0",
   "description": "Ory plugin for OpenCode: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -63,7 +63,7 @@
     "!dist/**/*.tsbuildinfo"
   ],
   "dependencies": {
-    "@ory/argus": "0.9.1"
+    "@ory/argus": "0.10.0"
   },
   "engines": {
     "node": ">=22"