@ory/pi 0.14.0 → 1.0.1

package/README.md

@@ -2,9 +2,12 @@
 
 Security and developer experience for [Pi](https://pi.dev), powered by [Ory](https://ory.com).
 
-**Security.** Pi runs real actions on your machine — editing files, running shell commands, calling APIs. The plugin gives every session a verifiable identity (you sign in once; Pi and any sub-agents it spawns each get their own), checks every tool call against permissions you control, and records each decision as an audit trace you can ship to your observability stack. It starts in watch mode so nothing is blocked on day one, and if Ory is ever unreachable it steps aside rather than locking you out.
+Pi runs real actions on your machine — editing files, running shell commands, calling APIs. This plugin gives those actions an identity, a permission check, and an audit trail.
 
-**Developer experience.** A single command installs the plugin and walks you through connecting — choose Ory Network, a local Docker stack, or audit-only, and it wires up the project, sign-in client, login, and permissions for you. It also helps you build Ory into your own app: ask in plain language to scaffold login, registration, and recovery pages, run a local Ory, or manage identities and permissions through the bundled MCP server.
+One command installs two independent halves:
+
+- **Developer experience** — the Ory skill catalog, the local Ory dev stack, and activity logging. No account, no keys, nothing to configure: it works the moment it's installed.
+- **Ory Agent Security** — browser sign-in, brokered permission checks before tool calls, and the delegation trail. Opt-in connection details from the [Ory Console](https://console.ory.sh) switch it on, and it takes nothing away from the half above. See [Connect to Ory Agent Security](#connect-to-ory-agent-security).
 
 ## What you'll need
 
@@ -21,29 +24,21 @@ npm install @ory/pi
 
 ## Get started
 
-Then run one command. It installs the plugin and walks you through connecting:
+Then run one command. It installs the plugin.:
 
 ```bash
 npx -y -p @ory/pi ory-pi install
 ```
 
-The installer drops a tiny loader at `<project>/.pi/extensions/ory.js` so Pi discovers the plugin, adds the Ory skills under `<project>/.pi/skills`, and then opens a guided setup **in your browser** where you pick how to connect — the default takes just a click:
-
-- **Ory Network** *(default)* — sign in, or create a free account, in your browser. The project, keys, permissions, and login are all set up for you. Nothing to configure by hand.
-- **Local** — run a complete Ory on your laptop with Docker. No account, no signup, no keys. Great for trying it out.
-- **Audit-only** — skip Ory entirely and just log what Pi does.
-
-> No browser available (CI, SSH, headless)? The same walkthrough runs right in your terminal instead — or force it with `--no-web`.
+The installer drops a tiny loader at `<project>/.pi/extensions/ory.js` so Pi discovers the plugin and adds the Ory skills under `<project>/.pi/skills`. Add `--global` to install the loader for all projects (at `~/.pi/agent/extensions/ory.js`) instead of just this one.
 
-That's it. Confirm everything landed with:
+Confirm everything landed with:
 
 ```bash
 npx -y -p @ory/pi ory-pi status
 ```
 
-`status` is your one-stop check: what's configured, who's signed in, which tools are covered by permissions, whether the loader is in place, and recent activity. Anything not set up yet shows as `(unset)`.
-
-Re-run install with `--reconfigure` to change your connection later, or `--no-configure` to skip the wizard. Add `--global` to install the loader for all projects (at `~/.pi/agent/extensions/ory.js`) instead of just this one.
+`status` is your one-stop check: what's configured, who's signed in, which tools are covered by permissions, whether the loader is in place, and recent activity. Until you connect Agent Security, the identity and permission rows say so and name what's missing.
 
 <details>
 <summary>Prefer to let Pi manage the plugin?</summary>
@@ -54,17 +49,47 @@ Point Pi's own package installer at the npm package:
 pi install npm:@ory/pi
 ```
 
-This registers the extension through Pi's package manifest, but skips the guided setup — run `npx -y -p @ory/pi ory-pi install` (or `configure`) in a terminal afterwards to connect.
+This registers the extension through Pi's package manifest. Run `npx -y -p @ory/pi ory-pi install` in a terminal afterwards to materialize the skills (and, later, `configure` if you want to connect).
 
 </details>
 
+## Skills and commands
+
+Installing the plugin drops the full Ory playbook catalog into Pi. **Skills** are model-invoked — just say what you want in plain language and the matching one takes over.
+
+| Skill | What it does for you |
+|---|---|
+| `ory-auth-setup` | Adds a complete auth system to your app — login, registration, recovery, verification, settings — on [Ory Elements](https://github.com/ory/elements) |
+| `ory-login-flow` | Builds just the pages, wired to Ory's self-service flows |
+| `ory-social-login` | "Sign in with…" for Google, GitHub, Apple, Microsoft, Discord, Slack, GitLab, Facebook |
+| `ory-local-dev` | Develops and tests login/permission flows against a local Ory — no project, no account, offline |
+| `ory-permissions-onboarding` | Walks a fresh install from observe mode to enforced per-tool permissions without getting blocked |
+| `ory-build-agent` | Drops `@ory/argus` into an agent *you* own — Claude Agent SDK, OpenAI Agents, Mastra, Vercel AI, LangGraph/PydanticAI |
+| `ory-build-integration` | Wires Ory into your app: Action webhooks, JWT validation at a gateway, live event streams |
+| `ory-contribute-integration` | Authors and submits an integration to the public `ory/integrates` registry |
+| `ory-e2b-sandbox` | Scaffolds an E2B sandbox template that boots with this plugin preinstalled |
+| `ory-temporal-worker` | Scaffolds a Temporal TypeScript worker where every Activity is authenticated, authorized, and audited |
+
+The local stack has its own playbooks — ask for them by name:
+
+| Command | What it does |
+|---|---|
+| `ory-local-up` | Starts a local Ory (Identities, OAuth2, Permissions) in Docker and seeds a test user — it prints the email + password to sign in with |
+| `ory-local-down` | Stops it, keeping your data volumes |
+| `ory-temporal-up` | Starts a local Temporal dev server for the `ory-temporal-worker` scaffold |
+
+The local stack runs entirely on your laptop: Ory APIs at `http://localhost:4000`, a login UI on `:4455` (not `:3000`, to dodge Next.js port clashes), and the Ory Console on `:4100`.
+
+So: ask Pi *"add Ory login to this app"* and it scaffolds the pages, starts a local Ory, and wires them together.
+
 ## What you get
 
-Once connected, every tool Pi runs is governed by Ory — three things happen automatically:
+Out of the box, every tool Pi runs produces a privacy-safe structured activity event in the unified local log.
 
-- **Who's driving.** You sign in once in your browser (a secure redirect flow — no passwords touch the plugin), and Pi gets its own identity that it registers automatically on first run. No tokens to copy around, and the "who did what" trail stays queryable later. (Pi's startup can't hard-block, so sign-in there is advisory — it still signs you in and logs it, but never stops the session.)
-- **What it's allowed to do.** Before a tool runs, Ory checks whether it's permitted. It starts in **watch mode** — nothing is blocked, you just *see* what would be — so it never gets in your way on day one.
-- **A record of everything.** Every decision (allowed, denied, skipped) is logged as a trace you can send to a viewer like Jaeger, or just a file.
+Once you connect to Ory Agent Security, two more things happen automatically:
+
+- **Who's driving.** You sign in once in your browser (a secure redirect flow — no passwords touch the plugin), and each Pi session gets its own identity that it registers automatically on first use. No tokens to copy around, and the "who did what" trail stays queryable later. (Pi's startup can't hard-block, so sign-in there is advisory — it still signs you in and logs it, but never stops the session.)
+- **What it's allowed to do.** Before a tool runs, Ory checks whether it's permitted. It starts in **observe mode** — nothing is blocked, you just *see* what would be — so it never gets in your way on day one.
 
 If Ory is ever unreachable, the plugin gets out of the way and lets Pi keep working — so it can't lock you out.
 
@@ -72,59 +97,63 @@ If Ory is ever unreachable, the plugin gets out of the way and lets Pi keep work
 
 ### See what's happening
 
-Everything the plugin does is observable out of the box — no configuration required:
+Everything the plugin does is observable out of the box:
 
-- **Status at a glance.** `npx -y -p @ory/pi ory-pi status` shows what's configured, who's signed in, how many built-in tools your permissions cover, and the most recent tool-call activity.
-- **Live dashboard.** `npx -y -p @ory/pi ory-pi dashboard` opens the same picture in your browser — configuration, identities, permission coverage, Ory service health, and the latest tool-call activity, all refreshing live. From there you can flip **enforcement** on or off, toggle **user login**, and use **Change stack** to reconnect to a different Ory — no CLI required.
-- **Live traces.** Every tool call is recorded as an OpenTelemetry-style span. Watch them stream as the agent works:
+- **Activity log.** Privacy-safe activity is always appended to `~/.config/ory-agent-plugins/pi/ory-agent-debug.log`. View events, decisions, and errors live with:
 
   ```bash
   npx -y -p @ory/pi ory-pi watch
   ```
 
-  Spans are also written to `~/.config/ory-agent-plugins/pi/ory-agent-trace.ndjson` (NDJSON, one span per line) — tail that file, or point `OTEL_EXPORTER_OTLP_ENDPOINT` at a collector to ship them straight to Jaeger, Honeycomb, or Grafana.
-- **Debug log.** For a verbose play-by-play, set `ORY_AGENT_DEBUG=true`; structured logs land in `~/.config/ory-agent-plugins/pi/ory-agent-debug.log`.
+  Set `ORY_AGENT_LOG_FILE` to override the path; set it empty to disable file persistence.
+- **Live debug.** Launch Pi with `ORY_AGENT_DEBUG=true` to add verbose local diagnostics, including raw shell commands, to the watched log and stderr. Secrets are recursively redacted; pass `watch --json` for NDJSON.
 
 ### Ready to enforce?
 
-When the watch-mode logs look right, turn on blocking with one command (setup already granted you the built-in tools):
+Once connected, the deny posture lives on the Ory project: when the observe-mode activity looks right, an admin promotes it to **enforce** in the **Ory Console** (Agent Security). Every session reads that posture live, so nothing has to be reinstalled.
 
 ```bash
-npx -y -p @ory/pi ory-pi permissions enforce
+npx -y -p @ory/pi ory-pi permissions   # what the project grants, and the live mode
 ```
 
-Now a denied tool is actually blocked and Pi shows why (the plugin returns `{ block: true, reason }` on Pi's `tool_call` event). Go back to watch mode anytime with `permissions observe`. Prefer clicking? The dashboard has the same **Enforce** switch — flip it on, or back to watch mode, without touching the CLI. Use `permissions status` to see what's covered and `permissions bootstrap` to (re-)grant the built-in tools.
-
-## Also: add login to your own app
+Then a denied tool is actually blocked and Pi shows why (the plugin returns `{ block: true, reason }` on Pi's `tool_call` event).
 
-Beyond securing Pi, the plugin helps you build Ory into whatever you're working on. Ask Pi *"add Ory login to this app"* and it scaffolds the login, registration, recovery, and settings pages (using [Ory Elements](https://github.com/ory/elements)) wired to a local Ory — no signup or keys needed. Start that local Ory by asking Pi *"start the local Ory stack"* (the `ory-local-up` skill) — it prints a test email + password to sign in with — and tear it down with `ory-local-down`.
+## Connect to Ory Agent Security
 
-Bundled **skills** (just ask in plain language) cover more: `ory-auth-setup`, `ory-login-flow`, `ory-social-login` (Google, GitHub, Apple…), `ory-permissions-onboarding`, and playbooks for wiring Ory into your own agents, E2B sandboxes, or Temporal workers.
+Copy the connection details from the [Ory Console](https://console.ory.sh) under **Agent Security**:
 
-## Configure by hand (CI / advanced)
-
-The guided setup covers most people. For scripted or CI setups, or to point at an existing Ory Network project, configure directly. Settings are saved to `~/.config/ory-agent-plugins/config.json` and shared across all your Ory agent plugins; environment variables win when both are set.
+| Value | Flag | Environment variable |
+|---|---|---|
+| Project URL | `--project-url` | `ORY_PROJECT_URL` |
+| Agent Security URL | `--agent-security-url` | `ORY_AGENT_SECURITY_URL` |
+| Sign-in client id override (default `ory-agent-security-login`) | `--oauth2-client-id` | `ORY_OAUTH2_CLIENT_ID` |
 
 ```bash
 npx -y -p @ory/pi ory-pi configure \
   --project-url https://<slug>.projects.oryapis.com \
-  --oauth2-client-id <sign-in client id>
+  --agent-security-url https://agents.console.ory.com
 ```
 
-Pi's own identity registers itself automatically on first run — nothing to create. The `--oauth2-client-id` is the one piece browser sign-in needs — the public sign-in client, registered with the four loopback URLs `http://127.0.0.1:47823..47826/callback`; the guided setup makes it for you. For logging-only with no checks, use `--audit-only`. The interactive user login runs every session (always on, non-blocking) and only needs `ORY_OAUTH2_CLIENT_ID` to complete the browser flow. The equivalent env vars are `ORY_PROJECT_URL` and `ORY_OAUTH2_CLIENT_ID`.
+`install` accepts the same flags, so you can register the plugin **and** connect in one shot (`install --project-url <URL> --agent-security-url <URL>`). The login client defaults to `ory-agent-security-login`; custom deployments can override it with `--oauth2-client-id`. Existing configurations fall back to the project URL when the Agent Security URL is unset. To turn sign-in and checks back off later, use `configure --disconnect`.
+
+**Ory Network or OEL.** Either works. For an Ory Network project the URL is `https://<slug>.projects.oryapis.com`; for a self-hosted **Ory Enterprise License** deployment, point `--project-url` at that deployment's base URL and use the sign-in client id from its Agent Security configuration. Everything downstream — sign-in, checks, delegation — is identical.
+
+**There is nothing else for you to create.** The sign-in client, the permission model, the per-tool grants and blocks, and the observe/enforce posture are all provisioned in the Console by someone with project access. At runtime the plugin only *reads* permissions — it has no write path into your project, which is why installing it needs no workspace privilege. Each Pi session registers its own identity automatically on first use.
+
+Sign-in runs at the start of every session and never blocks — a declined, skipped, or timed-out login simply leaves that session without a user identity.
 
-With nothing configured, the plugin still loads and runs in **pass-through mode**: skills and logging work, but no checks run and nothing is blocked. Perfectly fine if you only want the app-building features.
+Settings are saved to `~/.config/ory-agent-plugins/config.json` and shared across all your Ory agent plugins; environment variables win when both are set. Running headless with an OAuth2 access token already? Set `ORY_USER_OAUTH2_TOKEN` and the browser step is skipped entirely.
 
 ## Commands
 
 ```
-ory-pi install | uninstall        Install/remove; --reconfigure re-runs setup, --no-web forces the terminal wizard, --no-configure skips it
+ory-pi install | uninstall        Install (--global for all projects; add --project-url to also connect Agent Security) / remove
 ory-pi status                     Show configuration, identities, permission coverage, recent activity
-ory-pi dashboard                  Open the live browser dashboard (status + service health + Change stack)
-ory-pi watch                      Tail the live trace stream (OTel spans)
-ory-pi permissions <cmd>          status | bootstrap | observe (watch) | enforce (block)
-ory-pi configure <flags>          Point at a project by hand (--project-url, --oauth2-client-id, --audit-only)
+ory-pi permissions <cmd>          status  (read-only; grants + posture live in the Ory Console)
+ory-pi configure <flags>          Connect a project (--project-url) or --disconnect
 ory-pi agent <status|unregister>  Manage Pi's own auto-created identity
+ory-pi local <up|down|status|…>   Run / manage a local Ory in Docker
+ory-pi version                    Print plugin, core, and Node versions (--json for machine-readable)
 ```
 
 All prefixed with `npx -y -p @ory/pi`.
@@ -132,16 +161,14 @@ All prefixed with `npx -y -p @ory/pi`.
 ## Troubleshooting
 
 - **Local Ory won't start** — make sure Docker is running and ports `4000`, `4100`, `4455`, and `16686` are free.
-- **Browser sign-in loops** — reset with `ory-pi agent unregister` and try again.
-- **Install ran but never asked how to connect** — you're almost certainly on a stale `npx` cache. `npx -p @ory/pi` (no version pin) reuses a previously-downloaded copy instead of re-resolving to the latest, so an older CLI whose install predates the setup wizard can run while you believe you're on the current release. The install banner prints the running version; confirm it with `npx -y -p @ory/pi ory-pi version`. To force the current release, clear the cache and reinstall: `rm -rf ~/.npm/_npx` then `npx -y -p @ory/pi ory-pi install`. Pinning an exact version (`@ory/pi@<version>`) also bypasses the cached copy.
+- **Browser sign-in loops** (after connecting) — reset with `ory-pi agent unregister` and try again.
+- **Running an older CLI than expected** — `npx -p @ory/pi` (no version pin) reuses a previously-downloaded copy instead of re-resolving to the latest. The install banner prints the running version; confirm it with `npx -y -p @ory/pi ory-pi version`. To force the current release, clear the cache and reinstall: `rm -rf ~/.npm/_npx` then `npx -y -p @ory/pi ory-pi install`. Pinning an exact version (`@ory/pi@<version>`) also bypasses the cached copy.
 - **Pi can't find the plugin** — make sure `@ory/pi` is installed in the project (`npm install @ory/pi`) and the loader exists at `.pi/extensions/ory.js`; re-run the installer if not.
-- **Want to see what's happening** — `npx -y -p @ory/pi ory-pi status` for a snapshot, `npx -y -p @ory/pi ory-pi watch` for the live trace stream, or set `ORY_AGENT_DEBUG=true` for a verbose log. Traces and logs live under `~/.config/ory-agent-plugins/pi/` (see [See what's happening](#see-whats-happening)).
 
 ## Learn more
 
 - [Ory documentation](https://www.ory.com/docs/) · [Ory Console](https://console.ory.sh) · [Ory Elements](https://github.com/ory/elements)
 - [Pi repository](https://github.com/badlogic/pi-mono)
-- [Repo README](../../README.md) and [AGENTS.md](../../AGENTS.md) — full env-var and permission-mode reference
 
 ## License
 

package/dist/cli/loader.d.ts

@@ -6,16 +6,23 @@
  * placed there is loaded via jiti and its default export is invoked as the
  * extension factory. A bare module id in `settings.json`'s `extensions` array is
  * NOT loaded — those entries are resolved as filesystem paths. So we drop a
- * tiny loader file that re-exports the installed `@ory/pi` package's default
- * factory; Pi discovers the file, jiti resolves `@ory/pi` from `node_modules`,
- * and the factory runs. No `settings.json` entry is required.
+ * tiny loader file that re-exports the runtime's default factory by absolute
+ * path; Pi discovers the file and jiti loads that path directly. Re-exporting
+ * the bare module id would instead depend on `@ory/pi` being resolvable from
+ * wherever Pi happens to run, which a project-local `node_modules` does not
+ * guarantee. No `settings.json` entry is required.
  *
  * Verified against @earendil-works/pi-coding-agent v0.80.2 (the extension
  * loader's `discoverAndLoadExtensions` / `discoverExtensionsInDir`).
  */
 export declare const EXTENSION_MODULE = "@ory/pi";
 export declare const LOADER_FILENAME = "ory.js";
-export declare const LOADER_CONTENTS = "// Ory extension loader for Pi. Re-exports @ory/pi's default factory so Pi's\n// extension auto-discovery (which scans .pi/extensions/ for *.js files) can\n// load it. Generated by 'ory-pi install' / 'ory-pi-setup' \u2014 safe to delete.\nexport { default } from \"@ory/pi\";\n";
+/**
+ * Loader body: re-export the resolved runtime's default factory by absolute
+ * path, so Pi's auto-discovery (which scans `.pi/extensions/` for `*.js`)
+ * loads exactly the copy this install resolved.
+ */
+export declare function loaderContents(entryPath: string): string;
 /** Resolve the `.pi/extensions/` dir for the requested scope. */
 export declare function getExtensionsDir(opts: {
     global?: boolean;
@@ -30,6 +37,8 @@ export declare function getLoaderPath(opts: {
 export declare function writeOryLoader(opts: {
     global?: boolean;
     projectDir: string;
+    /** Absolute path to the runtime module the loader re-exports. */
+    entryPath: string;
 }): string;
 /**
  * Remove the loader file (and the `.pi/extensions/` dir if it's left empty).

package/dist/cli/loader.js

@@ -7,9 +7,11 @@
  * placed there is loaded via jiti and its default export is invoked as the
  * extension factory. A bare module id in `settings.json`'s `extensions` array is
  * NOT loaded — those entries are resolved as filesystem paths. So we drop a
- * tiny loader file that re-exports the installed `@ory/pi` package's default
- * factory; Pi discovers the file, jiti resolves `@ory/pi` from `node_modules`,
- * and the factory runs. No `settings.json` entry is required.
+ * tiny loader file that re-exports the runtime's default factory by absolute
+ * path; Pi discovers the file and jiti loads that path directly. Re-exporting
+ * the bare module id would instead depend on `@ory/pi` being resolvable from
+ * wherever Pi happens to run, which a project-local `node_modules` does not
+ * guarantee. No `settings.json` entry is required.
  *
  * Verified against @earendil-works/pi-coding-agent v0.80.2 (the extension
  * loader's `discoverAndLoadExtensions` / `discoverExtensionsInDir`).
@@ -48,7 +50,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LOADER_CONTENTS = exports.LOADER_FILENAME = exports.EXTENSION_MODULE = void 0;
+exports.LOADER_FILENAME = exports.EXTENSION_MODULE = void 0;
+exports.loaderContents = loaderContents;
 exports.getExtensionsDir = getExtensionsDir;
 exports.getLoaderPath = getLoaderPath;
 exports.writeOryLoader = writeOryLoader;
@@ -58,11 +61,19 @@ const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
 exports.EXTENSION_MODULE = "@ory/pi";
 exports.LOADER_FILENAME = "ory.js";
-exports.LOADER_CONTENTS = `// Ory extension loader for Pi. Re-exports @ory/pi's default factory so Pi's
-// extension auto-discovery (which scans .pi/extensions/ for *.js files) can
-// load it. Generated by 'ory-pi install' / 'ory-pi-setup' — safe to delete.
-export { default } from "@ory/pi";
+/**
+ * Loader body: re-export the resolved runtime's default factory by absolute
+ * path, so Pi's auto-discovery (which scans `.pi/extensions/` for `*.js`)
+ * loads exactly the copy this install resolved.
+ */
+function loaderContents(entryPath) {
+    return `// Ory extension loader for Pi. Re-exports the Ory runtime's default factory
+// so Pi's extension auto-discovery (which scans .pi/extensions/ for *.js
+// files) can load it. Generated by 'ory-pi install' / 'ory-pi-setup' — safe to
+// delete. Regenerate by re-running install.
+export { default } from ${JSON.stringify(entryPath)};
 `;
+}
 /** Resolve the `.pi/extensions/` dir for the requested scope. */
 function getExtensionsDir(opts) {
     return opts.global
@@ -78,7 +89,7 @@ function writeOryLoader(opts) {
     const dir = getExtensionsDir(opts);
     const loaderPath = path.join(dir, exports.LOADER_FILENAME);
     fs.mkdirSync(dir, { recursive: true });
-    fs.writeFileSync(loaderPath, exports.LOADER_CONTENTS);
+    fs.writeFileSync(loaderPath, loaderContents(opts.entryPath));
     return loaderPath;
 }
 /**

package/dist/cli/main.js

@@ -51,8 +51,18 @@ const loader_js_1 = require("./loader.js");
 const PACKAGE_ROOT = path.resolve(__dirname, "..", "..");
 function main() {
     const [command, ...args] = process.argv.slice(2);
+    // `--help` after a matched subcommand: print usage, do nothing else.
+    // Without this the switch below ignores the flag and `install --help`
+    // performs a real install (#221).
+    if ((0, argus_1.shouldPrintHelp)(command, args))
+        return help();
     switch (command) {
         case "install":
+            if (args.includes("--print")) {
+                process.argv = ["node", "setup.js", ...args];
+                require("./setup.js");
+                break;
+            }
             (0, argus_1.beginDeferNextSteps)();
             install(args);
             (0, argus_1.runPostInstall)("ory-pi", "pi", args).then(() => process.exit(0), (err) => {
@@ -62,7 +72,10 @@ function main() {
             break;
         case "uninstall":
             uninstall(args);
-            (0, argus_1.clearCredentialsForUninstall)().then(() => process.exit(0), (err) => {
+            (0, argus_1.clearCredentialsForUninstall)({
+                harness: "pi",
+                purge: args.includes("--purge"),
+            }).then(() => process.exit(0), (err) => {
                 console.error(err.message ?? err);
                 process.exit(1);
             });
@@ -71,7 +84,7 @@ function main() {
             (0, argus_1.runConfigureCommand)("ory-pi", args);
             break;
         case "agent":
-            (0, argus_1.runAgentCommand)("ory-pi", args).then((code) => process.exit(code), (err) => {
+            (0, argus_1.runAgentCommand)("ory-pi", "pi", args).then((code) => process.exit(code), (err) => {
                 console.error(err.message ?? err);
                 process.exit(1);
             });
@@ -88,17 +101,11 @@ function main() {
                 process.exit(1);
             });
             break;
-        case "local":
-            (0, argus_1.runLocalCommand)("ory-pi", args).catch((err) => {
-                console.error(err.message ?? err);
-                process.exit(1);
-            });
-            break;
         case "watch":
-            (0, argus_1.runWatchCommand)("pi", args);
+            (0, argus_1.runWatchCommand)("ory-pi", "pi", args).then((code) => process.exit(code), (err) => { console.error(err.message ?? err); process.exit(1); });
             break;
-        case "dashboard":
-            (0, argus_1.runDashboardCommand)("ory-pi", "pi", args).then((code) => process.exit(code), (err) => {
+        case "local":
+            (0, argus_1.runLocalCommand)("ory-pi", args).catch((err) => {
                 console.error(err.message ?? err);
                 process.exit(1);
             });
@@ -132,23 +139,48 @@ function isGlobal(args) {
 // Pi auto-discovers extensions from `<cwd>/.pi/extensions/` (project) and
 // `~/.pi/agent/extensions/` (global): each `*.js`/`*.ts` file there is loaded
 // via jiti and its default export is the factory. We drop a loader file that
-// re-exports @ory/pi's default factory. No settings.json entry is needed.
+// re-exports the resolved runtime's default factory by absolute path. No
+// settings.json entry is needed.
 // Verified against @earendil-works/pi-coding-agent v0.80.2. See ./loader.ts.
 function loaderOpts(args) {
     return { global: isGlobal(args), projectDir: parseProjectDir(args) };
 }
 function install(args) {
     const projectDir = parseProjectDir(args);
-    const loaderPath = (0, loader_js_1.writeOryLoader)(loaderOpts(args));
+    // Pi loads the extension in-process, so there is no hook subprocess and no
+    // hook shim: the loader re-exports the runtime's main module directly. Pi
+    // also excludes MCP by design, so no MCP server is registered.
+    const runtime = (0, argus_1.wireRuntime)({
+        harness: "pi",
+        packageName: loader_js_1.EXTENSION_MODULE,
+        packageRoot: PACKAGE_ROOT,
+        installCommand: "npx -y -p @ory/pi ory-pi install",
+        args,
+        entryRelPath: "dist/index.js",
+        inProcess: true,
+        includeMcp: false,
+    });
+    console.log(runtime.target.kind === "linked"
+        ? `Runtime: linked to ${runtime.target.packageDir} (dev)`
+        : `Runtime: ${runtime.target.packageName}@${runtime.target.version} in ${runtime.target.storeDir}`);
+    for (const pruned of runtime.prunedStores) {
+        console.log(`  Removed stale runtime: ${pruned}`);
+    }
+    const entryPath = path.join(runtime.target.packageDir, "dist", "index.js");
+    const loaderPath = (0, loader_js_1.writeOryLoader)({ ...loaderOpts(args), entryPath });
     (0, assets_js_1.installPiOryAssets)(projectDir);
     console.log(`Ory extension loader installed at ${loaderPath}`);
-    console.log(`  Re-exports the default factory from ${loader_js_1.EXTENSION_MODULE}`);
+    console.log(`  Re-exports the default factory from ${entryPath}`);
     console.log(`  Skills + commands installed under ${path.join(projectDir, ".pi", "skills")}`);
     (0, argus_1.printEnvHelp)("ory-pi");
 }
 function uninstall(args) {
     const projectDir = parseProjectDir(args);
     const removed = (0, loader_js_1.removeOryLoader)(loaderOpts(args));
+    (0, argus_1.removeRuntimeWiring)("pi");
+    for (const pruned of (0, argus_1.pruneRuntimeStores)()) {
+        console.log(`  Removed runtime: ${pruned}`);
+    }
     console.log(removed
         ? "Ory extension loader removed."
         : "No Ory extension loader found. Nothing to uninstall.");
@@ -183,24 +215,22 @@ Commands:
   uninstall [--project-dir <path>] [--global] Remove the Ory extension loader
   configure                        Set or view Ory project URL and API key
   agent <status|unregister>        Manage the agent's OAuth2 (DCR) identity
-  permissions <cmd>                Manage permission mode and tool permissions
-                                   (status, bootstrap, observe, enforce)
+  permissions                      Show the live permission mode and per-tool coverage
   local <cmd>                      Manage local Ory dev environment
                                    (up, down, status, seed, logs, env, configure, reset)
   status [--project-dir <path>]    Show plugin configuration and status
-  dashboard            Open the Ory Agent dashboard (system health + configuration)
-  watch [trace-file]               Watch live trace output
+  watch [--json] [--lines <count>] Follow the live activity/debug log
   version                          Show version and the ory-agent-plugins build commit
 
 After installing, the plugin hooks into these Pi lifecycle events:
   session-start (factory body)  Verify session / resolve agent identity via Ory
   tool_call                     Check tool permissions via Ory Permissions (can block)
-  tool_result                   Record tool completion trace
+  tool_result                   Record tool completion activity
 
 Examples:
   npx -y -p @ory/pi ory-pi install
-  npx -y -p @ory/pi ory-pi configure --project-url https://<slug>.projects.oryapis.com --api-key ory_pat_...
-  npx -y -p @ory/pi ory-pi permissions bootstrap
+  npx -y -p @ory/pi ory-pi configure --project-url https://<slug>.projects.oryapis.com --agent-security-url https://agents.console.ory.com
+  npx -y -p @ory/pi ory-pi permissions
   npx -y -p @ory/pi ory-pi local up
   npx -y -p @ory/pi ory-pi status
 `);

package/dist/cli/setup.js

@@ -77,11 +77,16 @@ function main() {
     }
     const args = (0, argus_1.parseSetupArgs)({ supportsGlobal: true });
     if (args.print) {
-        console.log(loader_js_1.LOADER_CONTENTS);
+        // Nothing is resolved or written on a --print run.
+        console.log((0, loader_js_1.loaderContents)("<resolved runtime>/dist/index.js"));
         return;
     }
     if (args.uninstall) {
         const removed = (0, loader_js_1.removeOryLoader)(args);
+        (0, argus_1.removeRuntimeWiring)("pi");
+        for (const pruned of (0, argus_1.pruneRuntimeStores)()) {
+            console.log(`  Removed runtime: ${pruned}`);
+        }
         console.log(removed
             ? "Removed Ory extension loader."
             : "No Ory extension loader found. Nothing to uninstall.");
@@ -89,7 +94,20 @@ function main() {
         console.log(`Removed Ory skills from ${path.join(args.projectDir, ".pi", "skills")}`);
         return;
     }
-    const loaderPath = (0, loader_js_1.writeOryLoader)(args);
+    const runtime = (0, argus_1.wireRuntime)({
+        harness: "pi",
+        packageName: "@ory/pi",
+        packageRoot: path.resolve(__dirname, "..", ".."),
+        installCommand: "npx -y -p @ory/pi ory-pi install",
+        args: process.argv.slice(2),
+        entryRelPath: "dist/index.js",
+        inProcess: true,
+        includeMcp: false,
+    });
+    const loaderPath = (0, loader_js_1.writeOryLoader)({
+        ...args,
+        entryPath: path.join(runtime.target.packageDir, "dist", "index.js"),
+    });
     (0, assets_js_1.installPiOryAssets)(args.projectDir);
     console.log(`Ory extension loader installed at ${loaderPath}`);
     console.log(`Ory skills installed to ${path.join(args.projectDir, ".pi", "skills")}`);
@@ -103,7 +121,10 @@ main();
 // stored Ory credentials. When required by the plugin's main CLI, that
 // command owns the purge, so the `require.main` guard prevents a double run.
 if (require.main === module && process.argv.includes("--uninstall")) {
-    (0, argus_1.clearCredentialsForUninstall)().then(() => process.exit(0), (err) => {
+    (0, argus_1.clearCredentialsForUninstall)({
+        harness: "pi",
+        purge: process.argv.includes("--purge"),
+    }).then(() => process.exit(0), (err) => {
         console.error(err.message ?? err);
         process.exit(1);
     });

package/dist/plugin.d.ts

@@ -1,43 +1,11 @@
-/**
- * Pi in-process extension (auth + blocking permission gate + tracing).
- *
- * Pi loads a default-exported factory `(pi) => void | Promise<void>` from a
- * TypeScript extension module (via jiti) and awaits it before startup
- * continues. We treat the factory body as the session-start hook: it runs the
- * user gate (which runs every session and never blocks — enforcement is
- * governed solely by permissionMode at tool-call time), the agent gate, and
- * writes the user→agent delegation tuple.
- *
- * The blocking permission decision lives in the `tool_call` hook, which CAN
- * block by returning `{ block: true, reason }` (like OpenClaw's
- * `before_tool_call`). The `tool_result` hook records the `tool.complete`
- * audit span after a tool runs.
- *
- * Pi excludes MCP and sub-agents by design, so there is NO MCP tool parsing
- * and NO sub-agent identity path.
- *
- * Contract verified against @earendil-works/pi-coding-agent v0.80.2 (dist
- * core/extensions/types.d.ts and the extension loader): the `tool_call`
- * handler returns `ToolCallEventResult { block?: boolean; reason? }`,
- * `tool_result` carries `isError`/`content`, and Pi awaits the async factory
- * default export.
- */
-import { OryAgentClient, ensureUserAuthenticated, ensureAgentIdentity } from "@ory/argus";
+import { OryAgentClient, ensureAgentIdentity, ensureUserAuthenticated } from "@ory/argus";
 import type { PiExtension } from "./types.js";
 export interface CreateOryPluginDeps {
-    /** Test injection point for the user login flow. */
     userLogin?: typeof ensureUserAuthenticated;
-    /** Test injection point for the agent identity gate. */
     agentGate?: typeof ensureAgentIdentity;
+    /** Pin the per-process id for deterministic tests. Production mints one. */
+    sessionId?: string;
 }
-/**
- * Create the Ory extension factory for Pi.
- *
- * Returns a function matching Pi's `PiExtension` contract: it receives the
- * ExtensionAPI, runs the session-start auth gates in the body, and registers
- * the `tool_call` (blocking) and `tool_result` (tracing) hooks.
- */
 export declare function createOryPlugin(clientOrConfig?: OryAgentClient | {
     projectUrl: string;
-    apiKey?: string;
 }, deps?: CreateOryPluginDeps): PiExtension;

package/dist/plugin.js

@@ -1,217 +1,64 @@
 "use strict";
-/**
- * Pi in-process extension (auth + blocking permission gate + tracing).
- *
- * Pi loads a default-exported factory `(pi) => void | Promise<void>` from a
- * TypeScript extension module (via jiti) and awaits it before startup
- * continues. We treat the factory body as the session-start hook: it runs the
- * user gate (which runs every session and never blocks — enforcement is
- * governed solely by permissionMode at tool-call time), the agent gate, and
- * writes the user→agent delegation tuple.
- *
- * The blocking permission decision lives in the `tool_call` hook, which CAN
- * block by returning `{ block: true, reason }` (like OpenClaw's
- * `before_tool_call`). The `tool_result` hook records the `tool.complete`
- * audit span after a tool runs.
- *
- * Pi excludes MCP and sub-agents by design, so there is NO MCP tool parsing
- * and NO sub-agent identity path.
- *
- * Contract verified against @earendil-works/pi-coding-agent v0.80.2 (dist
- * core/extensions/types.d.ts and the extension loader): the `tool_call`
- * handler returns `ToolCallEventResult { block?: boolean; reason? }`,
- * `tool_result` carries `isError`/`content`, and Pi awaits the async factory
- * default export.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createOryPlugin = createOryPlugin;
+const node_crypto_1 = require("node:crypto");
 const argus_1 = require("@ory/argus");
-/**
- * Create the Ory extension factory for Pi.
- *
- * Returns a function matching Pi's `PiExtension` contract: it receives the
- * ExtensionAPI, runs the session-start auth gates in the body, and registers
- * the `tool_call` (blocking) and `tool_result` (tracing) hooks.
- */
+const HARNESS = "pi";
 function createOryPlugin(clientOrConfig, deps = {}) {
     return async (pi) => {
         const client = clientOrConfig instanceof argus_1.OryAgentClient
             ? clientOrConfig
             : clientOrConfig
-                ? new argus_1.OryAgentClient({ ...clientOrConfig, harness: "pi" })
-                : argus_1.OryAgentClient.fromEnv("pi");
-        // The factory body IS the session-start hook: Pi awaits async extension
-        // factories before startup continues (verified against
-        // @earendil-works/pi-coding-agent v0.80.2). Pi also exposes a dedicated
-        // `session_start` event, but the factory body is sufficient and runs
-        // exactly once per process.
-        await runSessionStart(client, deps);
-        pi.on("tool_call", createToolCallHandler(client));
-        pi.on("tool_result", createToolResultHandler(client));
-    };
-}
-// ─── session start (factory body) ──────────────────────────────────
-async function runSessionStart(client, deps) {
-    client.logger.info("lifecycle.session_start", { harness: "pi" });
-    client.tracer.setContext({ traceId: (0, argus_1.deriveTraceId)("pi"), sessionId: "pi" });
-    client.tracer.record("session.start", "ok", { attributes: {} });
-    // Run the user login. It runs every session and never blocks the session
-    // from starting — the flow emits the user.auth audit span, refreshes tokens,
-    // and may prompt when interactive. Enforcement is governed solely by
-    // permissionMode at tool-call time.
-    const userGate = deps.userLogin ?? argus_1.ensureUserAuthenticated;
-    await userGate(client, {
-        binName: "ory-pi",
-        harness: "pi",
-    });
-    // Resolve the agent identity (machine credentials). Never blocks; attaches
-    // the agent's bearer token to outgoing Ory API calls.
-    const agentGate = deps.agentGate ?? argus_1.ensureAgentIdentity;
-    await agentGate(client, { projectUrl: (0, argus_1.resolveConfig)().projectUrl, harness: "pi" });
-    // Once both principals are populated, write the user→agent delegation tuple.
-    // Written at most once per install + fail-open: audit-trail data only.
-    await (0, argus_1.writeUserDelegatesAgent)(client);
-}
-// ─── tool_call (pre-execution, blocking) ───────────────────────────
-function createToolCallHandler(client) {
-    return async (event) => {
-        const toolName = event.toolName ?? "unknown";
-        // Pi does not put a session id on the tool_call event; the per-process
-        // trace context set at session start ("pi") carries correlation. We tag
-        // the span with the toolCallId so a tool_call lines up with its later
-        // tool_result.
-        client.logger.info("lifecycle.tool_call", { toolName, toolCallId: event.toolCallId });
-        client.tracer.setContext({ traceId: (0, argus_1.deriveTraceId)("pi"), sessionId: "pi" });
-        const inputSummary = (0, argus_1.summarizeToolInput)(toolName, event.input);
-        // In audit-only mode, log the invocation but skip permission checks.
-        if ((0, argus_1.resolveConfig)().auditOnly) {
-            client.tracer.record("tool.invoke", "ok", {
-                attributes: { toolName, ...inputSummary },
-            });
-            return;
-        }
-        // If Ory is not configured, pass through.
-        if (!(0, argus_1.resolveConfig)().projectUrl) {
-            client.tracer.record("tool.invoke", "skipped", {
-                attributes: { toolName, reason: "not_configured", ...inputSummary },
-            });
-            return;
-        }
-        const subject = (0, argus_1.resolveUserSubject)(client, "agent:pi");
-        const subjectId = (0, argus_1.subjectLabel)(subject);
-        const namespace = resolveNamespace();
-        try {
-            const outcome = await (0, argus_1.gateToolCall)(client, {
-                harness: "pi",
-                toolName,
-                check: { namespace, object: toolName, relation: "use", ...subject },
-                spanAttributes: { toolName },
+                ? new argus_1.OryAgentClient({ ...clientOrConfig, harness: HARNESS })
+                : argus_1.OryAgentClient.fromEnv(HARNESS);
+        // Pi events have no session id, so one process UUID identifies the run.
+        const sessionId = deps.sessionId ?? (0, node_crypto_1.randomUUID)();
+        await (0, argus_1.withHookContext)(client, { sessionId }, async () => {
+            client.logger.info("lifecycle.session_start", { harness: HARNESS });
+            await (0, argus_1.sessionStart)(client, {
+                harness: HARNESS,
+                binName: "ory-pi",
+                userLogin: deps.userLogin,
+                agentGate: deps.agentGate,
             });
-            // Interactive tools (operator-extensible via ORY_INTERACTIVE_TOOLS):
-            // the user.interaction span is already recorded; pass through.
-            if (outcome.kind === "interactive") {
-                return;
-            }
-            const decision = outcome;
-            if (decision.kind === "fail_open") {
-                handlePermissionError(decision.error, toolName, client);
-                return;
-            }
-            const attrs = { toolName, ...inputSummary };
-            const decisionAttrs = decision.spanAttributes;
-            if (decision.kind === "allow") {
-                client.tracer.record("tool.invoke", "ok", {
-                    attributes: { ...attrs, ...decisionAttrs, allowed: true },
-                });
-                return;
-            }
-            if (decision.kind === "observe") {
-                client.tracer.record("tool.block", "denied", {
-                    attributes: { ...attrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(false) },
-                });
-                client.tracer.record("tool.invoke", "ok", {
-                    attributes: { ...attrs, ...decisionAttrs, allowed: false, observed: true },
-                });
-                return;
-            }
-            // decision.kind === "deny" — enforce: block the tool call.
-            client.tracer.record("tool.block", "denied", {
-                attributes: { ...attrs, ...decisionAttrs, allowed: false, ...(0, argus_1.alertAttributes)(true) },
-            });
-            const reason = (0, argus_1.formatDenialMessage)({
-                tool: toolName,
-                subjectId,
-                namespace,
-            });
-            client.logger.warn("tool.denied", {
-                toolName,
-                subjectId,
-                message: reason,
-            });
-            return { block: true, reason };
-        }
-        catch (err) {
-            handlePermissionError(err, toolName, client);
-            // Fail open — allow the tool call.
-        }
+        });
+        pi.on("tool_call", createToolCallHandler(client, sessionId));
+        pi.on("tool_result", createToolResultHandler(client, sessionId));
     };
 }
-// ─── tool_result (post-execution, tracing) ─────────────────────────
-function createToolResultHandler(client) {
-    return async (event) => {
+function createToolCallHandler(client, sessionId) {
+    return (event) => (0, argus_1.withHookContext)(client, { sessionId }, async () => {
         const toolName = event.toolName ?? "unknown";
-        client.tracer.setContext({ traceId: (0, argus_1.deriveTraceId)("pi"), sessionId: "pi" });
-        // Pi reports failure via the `isError` boolean and the result payload via
-        // `content` (verified shape), not `error`/`result`.
-        const isError = event.isError === true;
-        client.logger.info("lifecycle.tool_result", {
+        client.logger.info("lifecycle.tool_call", {
             toolName,
             toolCallId: event.toolCallId,
-            isError,
         });
-        client.tracer.record("tool.complete", isError ? "error" : "ok", {
-            attributes: {
-                toolName,
-                ...(0, argus_1.summarizeToolInput)(toolName, event.input),
-                ...(0, argus_1.summarizeToolOutput)(toolName, event.content),
-                ...(isError ? { error: true } : {}),
-            },
+        const result = await (0, argus_1.gate)(client, {
+            harness: HARNESS,
+            toolName,
+            toolArgs: event.input,
+            subjectFallback: "agent:pi",
+            canBlock: true,
         });
-    };
-}
-// ─── Helpers ───────────────────────────────────────────────────────
-function resolveNamespace() {
-    return process.env.ORY_PERMISSION_NAMESPACE ?? "AgentTools";
-}
-function isOryError(err) {
-    return (typeof err === "object" &&
-        err !== null &&
-        "code" in err &&
-        "message" in err);
+        if (result.blocked)
+            return { block: true, reason: result.denialMessage };
+    });
 }
-function handlePermissionError(err, toolName, client) {
-    if (isOryError(err)) {
-        if (err.code === "network_error" || err.code === "rate_limited") {
-            client.logger.warn("permission.fallback", {
-                toolName,
-                code: err.code,
-                message: "Failing open",
-            });
-            return;
-        }
-        client.logger.error("permission.check.error", {
+function createToolResultHandler(client, sessionId) {
+    return (event) => (0, argus_1.withHookContext)(client, { sessionId }, async () => {
+        const toolName = event.toolName ?? "unknown";
+        const isError = event.isError === true;
+        client.logger.info("lifecycle.tool_result", {
             toolName,
-            code: err.code,
-            message: err.message,
+            toolCallId: event.toolCallId,
+            isError,
         });
-    }
-    else {
-        client.logger.error("permission.check.error", {
+        (0, argus_1.complete)(client, {
             toolName,
-            error: err instanceof Error ? err.message : String(err),
+            input: event.input,
+            output: event.content,
+            status: isError ? "error" : "ok",
+            extraActivityAttributes: isError ? { error: true } : undefined,
         });
-    }
-    // Fail-open is log-and-allow: no tool.invoke span, matching the core
-    // gate() vocabulary. The errored permission.check span carries the audit
-    // trail for the failed check itself.
+    });
 }

package/dist/types.d.ts

@@ -10,7 +10,7 @@
  * Tool hooks are registered with `pi.on(event, handler)`. The pre-execution
  * `tool_call` hook BLOCKS a tool by returning `{ block: true, reason }`;
  * returning nothing/undefined allows. A best-effort `tool_result` hook fires
- * after a tool completes and is used for audit tracing.
+ * after a tool completes and is used for activity auditing.
  *
  * Pi deliberately excludes MCP and sub-agents, so there is no MCP tool
  * parsing and no sub-agent identity path.

package/dist/types.js

@@ -11,7 +11,7 @@
  * Tool hooks are registered with `pi.on(event, handler)`. The pre-execution
  * `tool_call` hook BLOCKS a tool by returning `{ block: true, reason }`;
  * returning nothing/undefined allows. A best-effort `tool_result` hook fires
- * after a tool completes and is used for audit tracing.
+ * after a tool completes and is used for activity auditing.
  *
  * Pi deliberately excludes MCP and sub-agents, so there is no MCP tool
  * parsing and no sub-agent identity path.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/pi",
-  "version": "0.14.0",
+  "version": "1.0.1",
   "description": "Ory plugin for Pi (the minimal coding agent): scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -37,8 +37,7 @@
     "agent-security",
     "guardrails",
     "llm",
-    "tracing",
-    "distributed-tracing",
+    "activity-auditing",
     "observability",
     "kratos",
     "keto",
@@ -49,6 +48,10 @@
     "registry": "https://registry.npmjs.org/",
     "provenance": true
   },
+  "reova": {
+    "enabled": true,
+    "endpoint": "https://telemetry.reo.dev/data"
+  },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
@@ -68,12 +71,11 @@
   },
   "files": [
     "dist",
-    "!dist/dev",
     "!dist/**/*.tsbuildinfo"
   ],
   "dependencies": {
-    "reo-census": "^1.2.8",
-    "@ory/argus": "0.14.0"
+    "reova": "^0.7.0",
+    "@ory/argus": "1.0.1"
   },
   "devDependencies": {
     "typescript": "^6.0.2",
@@ -87,7 +89,6 @@
     "clean": "rm -rf dist *.tsbuildinfo",
     "test": "vitest run",
     "test:watch": "vitest",
-    "typecheck": "tsc --noEmit",
-    "dev": "node dist/dev/launcher.js"
+    "typecheck": "tsc --noEmit"
   }
 }