@ory/pi 1.5.2 → 1.6.0

package/README.md

@@ -87,7 +87,9 @@ Once you connect to Ory Agent Security, two more things happen automatically:
 
 If Ory is ever unreachable, the plugin gets out of the way and lets Pi keep working — so it can't lock you out.
 
-The extension gates tools exposed through Pi's `tool_call` event and records `tool_result`. Extension-provided tools use their Pi tool names; the installer does not configure an MCP server, and this adapter does not translate MCP-specific grants or child-agent delegation. Calls that another extension executes outside Pi's tool lifecycle are outside this boundary.
+The extension gates tools exposed through Pi's `tool_call` event and records `tool_result`. Extension-provided tools use their Pi tool names; the installer does not configure an MCP server, and this adapter does not translate child-agent delegation. Calls that another extension executes outside Pi's tool lifecycle are outside this boundary.
+
+**MCP servers.** Pi (verified against `@earendil-works/pi-coding-agent` 0.87.1) documents no built-in MCP client, so the adapter sends no `McpServer` or `McpTool` checks. A tool that an extension backs with an MCP server reaches the `tool_call` event as an ordinary Pi tool without a server identity, and is checked as a native tool under its Pi tool name; Console MCP server and tool levels do not apply to it.
 
 Session authentication runs on `session_start`, using `ctx.sessionManager.getSessionId()` for identity and activity. Loading extension resources alone does not start authentication. SDK hosts that omit lifecycle binding still start authentication lazily before their first tool call.
 
@@ -184,7 +186,7 @@ npx -y -p @ory/pi ory-pi configure \
 
 **Ory Network or OEL.** Either works. For an Ory Network project the URL is `https://<slug>.projects.oryapis.com`; for a self-hosted **Ory Enterprise License** deployment, point `--project-url` at that deployment's base URL and use the sign-in client id from its Agent Security configuration. Everything downstream — sign-in, checks, delegation — is identical.
 
-**There is nothing else for you to create.** The sign-in client, permission model, native-tool blocks, MCP grants, and observe/enforce posture are provisioned in the Console by someone with project access. At session start the plugin loads or enrolls Pi's Talos runtime credential in the OS credential store; tool paths only read it. Installing needs no workspace privilege.
+**There is nothing else for you to create.** The sign-in client, permission model, native-tool blocks, MCP server access, and observe/enforce posture are provisioned in the Console by someone with project access. At session start the plugin loads or enrolls Pi's Talos runtime credential in the OS credential store; tool paths only read it. Installing needs no workspace privilege.
 
 Sign-in runs at the start of every session and never blocks — a declined, skipped, or timed-out login simply leaves that session without a user identity.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/pi",
-  "version": "1.5.2",
+  "version": "1.6.0",
   "description": "Ory plugin for Pi (the minimal coding agent): scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -75,10 +75,10 @@
   ],
   "dependencies": {
     "reova": "^0.7.0",
-    "@ory/argus": "1.5.2"
+    "@ory/argus": "1.6.0"
   },
   "devDependencies": {
-    "typescript": "^6.0.2"
+    "typescript": "^7.0.2"
   },
   "engines": {
     "node": ">=22"