@ory/opencode 1.2.3 → 1.3.0

package/README.md

@@ -137,7 +137,7 @@ npx -y -p @ory/opencode ory-opencode configure \
 
 **Ory Network or OEL.** Either works. For an Ory Network project the URL is `https://<slug>.projects.oryapis.com`; for a self-hosted **Ory Enterprise License** deployment, point `--project-url` at that deployment's base URL and use the sign-in client id from its Agent Security configuration. Everything downstream — sign-in, checks, delegation — is identical.
 
-**There is nothing else for you to create.** The sign-in client, permission model, native-tool blocks, MCP grants, and observe/enforce posture are provisioned in the Console by someone with project access. At runtime the plugin only *reads* permissions, so installing it needs no workspace privilege. Each OpenCode session registers its own identity automatically on first use.
+**There is nothing else for you to create.** The sign-in client, permission model, native-tool blocks, MCP grants, and observe/enforce posture are provisioned in the Console by someone with project access. At session start the plugin loads or enrolls OpenCode's Talos runtime credential in the OS credential store; tool paths only read it. Installing needs no workspace privilege.
 
 Sign-in runs at the start of every session and never blocks — a declined, skipped, or timed-out login simply leaves that session without a user identity.
 
@@ -150,7 +150,7 @@ ory-opencode install | uninstall         Install (add --project-url to also conn
 ory-opencode status                      Show configuration, identities, native tool access, recent activity
 ory-opencode permissions <cmd>           status  (read-only; blocks + posture live in the Ory Console)
 ory-opencode configure <flags>           Connect a project (--project-url) or --disconnect
-ory-opencode agent <status|unregister>   Manage OpenCode's own auto-created identity
+ory-opencode agent <status|unregister>   Inspect runtime status / clear legacy OAuth state
 ory-opencode local <up|down|status|…>    Run / manage a local Ory in Docker
 ory-opencode version                     Print plugin, core, and Node versions (--json for machine-readable)
 ```
@@ -160,7 +160,7 @@ All prefixed with `npx -y -p @ory/opencode`.
 ## Troubleshooting
 
 - **`/ory:local-up` fails** — make sure Docker is running and ports `4000`, `4100`, `4455`, and `16686` are free.
-- **Browser sign-in loops** (after connecting) — reset with `ory-opencode agent unregister` and try again.
+- **Browser sign-in loops** (after connecting) — confirm the reserved login client has all four documented loopback redirect URIs; `agent unregister` only clears legacy agent OAuth state.
 - **Running an older CLI than expected** — `npx -p @ory/opencode` (no version pin) reuses a previously-downloaded copy instead of re-resolving to the latest. The install banner prints the running version; confirm it with `npx -y -p @ory/opencode ory-opencode version`. To force the current release, clear the cache and reinstall: `rm -rf ~/.npm/_npx` then `npx -y -p @ory/opencode ory-opencode install`. Pinning an exact version (`@ory/opencode@<version>`) also bypasses the cached copy.
 - **Hooks don't seem to run, but skills and `/ory:` commands are there** — OpenCode isn't loading the plugin. It fetches plugins itself, with npm, into its own cache (`~/.cache/opencode/packages/<spec>/`), and neither outcome is visible in OpenCode: an install that succeeded is never re-resolved (so an older cached copy keeps loading), and one that failed is retried and fails the same way every session. Run `npx -y -p @ory/opencode ory-opencode status` — it reports the copy OpenCode will actually load, says when an install was attempted and failed, explains why the spec can't be resolved, and flags stale cache directories.
 - **The plugin can't be installed from your registry** — OpenCode's plugin install uses the npm configuration its own process inherits, so it goes to the public registry unless `npm_config_registry` says otherwise, and any `min-release-age` in your `.npmrc` applies to it as well. A build that isn't on the registry OpenCode reaches (a private or local publish) or a version newer than your freshness gate can't be installed, and `install`/`status` will tell you so. Either launch OpenCode against the right registry — `npm_config_registry=<registry> npm_config_min_release_age=0 opencode` — or point it at a local copy, which skips the registry entirely: `ory-opencode install --plugin-spec file:///path/to/node_modules/@ory/opencode`.

package/dist/cli/main.js

@@ -260,7 +260,7 @@ Commands:
                                    a file:// path to load a local build instead of npm)
   uninstall [--project-dir <path>] Remove the Ory plugin and MCP server from opencode.json
   configure                        Set or view Ory project URL and API key
-  agent <status|unregister>        Manage the agent's OAuth2 (DCR) identity
+  agent <status|unregister>        Inspect runtime status or clear legacy OAuth state
   permissions                      Show live mode and native allowed/blocked state
   local <cmd>                      Manage local Ory dev environment
                                    (up, down, status, seed, logs, env, configure, reset)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/opencode",
-  "version": "1.2.3",
+  "version": "1.3.0",
   "description": "Ory plugin for OpenCode: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -66,7 +66,7 @@
   ],
   "dependencies": {
     "reova": "^0.7.0",
-    "@ory/argus": "1.2.3"
+    "@ory/argus": "1.3.0"
   },
   "engines": {
     "node": ">=22"