ory-agent-framework 0.13.9__tar.gz

ory_agent_framework-0.13.9/.gitignore

@@ -0,0 +1,36 @@
+node_modules/
+dist/
+*.tsbuildinfo
+.env
+.env.local
+
+# Python (uv workspace under python/)
+.venv/
+__pycache__/
+*.egg-info/
+.pytest_cache/
+.ruff_cache/
+build/
+*.pyc
+
+# Debug logs
+*.log
+
+# Harness sandbox dirs
+.sandbox/
+
+# Staged install-surface repo contents (see scripts/sync-install-surfaces.mjs)
+.install-surfaces/
+
+# Local dev environment (local Ory stack + Verdaccio registry)
+.ory-dev/
+
+# Worktrees for changes
+.worktrees/
+.claude/worktrees/
+
+# Gemini CLI extension assets — materialized at install time from
+# @ory/argus templates. The repo source is the canonical templates;
+# these subdirs are generated wherever the install runs.
+packages/gemini-cli/gemini-extension/skills/
+packages/gemini-cli/gemini-extension/commands/

ory_agent_framework-0.13.9/PKG-INFO

@@ -0,0 +1,43 @@
+Metadata-Version: 2.4
+Name: ory-agent-framework
+Version: 0.13.9
+Summary: Ory Agent Security for the Microsoft Agent Framework — per-tool authorization, tracing, and identity propagation via function middleware. Built on ory-argus.
+Author: Ory
+License-Expression: Apache-2.0
+Keywords: agent,agent-framework,ai,authorization,autogen,microsoft,ory
+Requires-Python: >=3.10
+Requires-Dist: agent-framework>=0.0.0a1
+Requires-Dist: ory-argus<1,>=0.8
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# ory-agent-framework
+
+Ory Agent Security for the [Microsoft Agent Framework](https://learn.microsoft.com/agent-framework/)
+(the successor to AutoGen + Semantic Kernel).
+
+Gates every function/tool call through Ory Permissions via **function middleware**, traces
+invocations, and propagates the user → agent identity — built on
+[`ory-argus`](https://pypi.org/project/ory-argus/).
+
+```bash
+pip install ory-agent-framework
+```
+
+```python
+from ory_agent_framework import ory_function_middleware
+
+agent = chat_client.create_agent(
+    instructions="…",
+    tools=[search, send_email],
+    middleware=[ory_function_middleware()],
+)
+```
+
+In **enforce** mode (`ORY_PERMISSION_MODE=enforce`) a denied call sets the result to the
+denial and terminates without invoking the function. In **observe** mode (default) the
+function runs and a `permission.observe_deny` span is recorded.
+
+Credentials come from the shared `~/.config/ory-agent-plugins/config.json`.

ory_agent_framework-0.13.9/README.md

@@ -0,0 +1,28 @@
+# ory-agent-framework
+
+Ory Agent Security for the [Microsoft Agent Framework](https://learn.microsoft.com/agent-framework/)
+(the successor to AutoGen + Semantic Kernel).
+
+Gates every function/tool call through Ory Permissions via **function middleware**, traces
+invocations, and propagates the user → agent identity — built on
+[`ory-argus`](https://pypi.org/project/ory-argus/).
+
+```bash
+pip install ory-agent-framework
+```
+
+```python
+from ory_agent_framework import ory_function_middleware
+
+agent = chat_client.create_agent(
+    instructions="…",
+    tools=[search, send_email],
+    middleware=[ory_function_middleware()],
+)
+```
+
+In **enforce** mode (`ORY_PERMISSION_MODE=enforce`) a denied call sets the result to the
+denial and terminates without invoking the function. In **observe** mode (default) the
+function runs and a `permission.observe_deny` span is recorded.
+
+Credentials come from the shared `~/.config/ory-agent-plugins/config.json`.

ory_agent_framework-0.13.9/pyproject.toml

@@ -0,0 +1,25 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "ory-agent-framework"
+version = "0.13.9"
+description = "Ory Agent Security for the Microsoft Agent Framework — per-tool authorization, tracing, and identity propagation via function middleware. Built on ory-argus."
+readme = "README.md"
+requires-python = ">=3.10"
+license = "Apache-2.0"
+authors = [{ name = "Ory" }]
+keywords = ["ory", "microsoft", "agent-framework", "autogen", "authorization", "agent", "ai"]
+dependencies = [
+    "ory-argus>=0.8,<1",
+    # The Microsoft Agent Framework currently ships pre-release builds on PyPI; the
+    # pre-release marker lets `pip install ory-agent-framework` resolve them.
+    "agent-framework>=0.0.0a1",
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=8", "ruff>=0.6"]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/ory_agent_framework"]

ory_agent_framework-0.13.9/src/ory_agent_framework/__init__.py

@@ -0,0 +1,18 @@
+"""Ory Agent Security for the Microsoft Agent Framework.
+
+    from ory_agent_framework import ory_function_middleware
+
+    agent = chat_client.create_agent(
+        instructions="…",
+        tools=[search, send_email],
+        middleware=[ory_function_middleware()],
+    )
+"""
+
+from __future__ import annotations
+
+from .middleware import guarded_process, ory_function_middleware
+
+__version__ = "0.13.9"
+
+__all__ = ["ory_function_middleware", "guarded_process", "__version__"]

ory_agent_framework-0.13.9/src/ory_agent_framework/middleware.py

@@ -0,0 +1,85 @@
+"""Ory Agent Security for the Microsoft Agent Framework.
+
+The Agent Framework's per-tool interceptor is **function middleware** — ``process(context,
+next)``. ``ory_function_middleware()`` authorizes each function/tool call against Ory
+Permissions, traces it, and (on first call) runs the Ory session gates:
+
+  - allow / observe / fail-open / interactive → call ``next`` (the function runs) and record
+    ``tool.complete``.
+  - deny (enforce) → set ``context.result`` to the denial and ``context.terminate = True``
+    *without* calling ``next``, so the function never runs.
+
+Gate logic lives in ``ory_argus``. ``agent_framework`` is imported lazily, so importing this
+module never requires it.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from ory_argus import GateResult, OryAgentClient, complete, gate, session_start
+
+HARNESS = "agent-framework"
+
+
+def _extract(context: Any) -> tuple[str, Any]:
+    fn = getattr(context, "function", None)
+    name = (
+        getattr(fn, "name", None)
+        or getattr(context, "function_name", None)
+        or getattr(context, "name", None)
+        or "unknown"
+    )
+    args = getattr(context, "arguments", None) or getattr(context, "args", None)
+    return name, args
+
+
+async def guarded_process(
+    client: OryAgentClient,
+    context: Any,
+    call_next: Any,
+    *,
+    can_block: bool = True,
+    project_url: str | None = None,
+    _session_state: dict | None = None,
+) -> Any:
+    """SDK-free guarded middleware body — testable with a fake context + next."""
+    state = _session_state if _session_state is not None else {}
+    if not state.get("started"):
+        state["started"] = True
+        try:
+            session_start(client, harness=HARNESS, project_url=project_url)
+        except Exception as err:  # noqa: BLE001
+            client.logger.warn("session_start.failed", {"message": str(err)})
+
+    name, args = _extract(context)
+    result: GateResult = gate(client, harness=HARNESS, tool_name=name, tool_args=args, can_block=can_block)
+    if result.blocked:
+        # Short-circuit: set the result and terminate without calling next.
+        context.result = result.denial_message or "Ory: permission denied"
+        try:
+            context.terminate = True
+        except Exception:  # noqa: BLE001 — some contexts may not expose terminate
+            pass
+        return None
+    out = await call_next(context)
+    complete(client, tool_name=name)
+    return out
+
+
+def ory_function_middleware(
+    *, client: OryAgentClient | None = None, can_block: bool = True, project_url: str | None = None
+):
+    """Return a function-middleware callable ``async (context, next)`` gated through Ory."""
+    c = client or OryAgentClient.from_env(HARNESS)
+    state: dict = {}
+
+    async def _middleware(context: Any, call_next: Any) -> Any:
+        return await guarded_process(
+            c, context, call_next, can_block=can_block, project_url=project_url, _session_state=state
+        )
+
+    return _middleware
+
+
+__all__ = ["HARNESS", "guarded_process", "ory_function_middleware"]

ory_agent_framework-0.13.9/tests/test_middleware.py

@@ -0,0 +1,95 @@
+"""Hermetic tests for the Microsoft Agent Framework Ory function middleware (SDK-free).
+
+Covers the native veto shape (``context.terminate`` + ``context.result`` without calling
+``next``) and request-shape extraction (``function.name`` and the ``function_name``
+fallback). The full permission decision matrix is core-owned
+(``ory-argus/tests/test_adapters.py``).
+"""
+
+from __future__ import annotations
+
+import asyncio
+from types import SimpleNamespace
+
+import pytest
+
+from ory_agent_framework import guarded_process  # type: ignore
+from ory_argus.client import PrincipalIdentity
+from ory_argus.testing import (
+    create_mock_client,
+    get_trace_spans,
+    stub_permission_allowed,
+    stub_permission_denied,
+)
+
+
+@pytest.fixture(autouse=True)
+def _isolate(monkeypatch, tmp_path):
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path))
+    monkeypatch.delenv("ORY_PERMISSION_MODE", raising=False)
+
+
+def client_with_user():
+    c = create_mock_client(harness="agent-framework")
+    c.set_user_principal(PrincipalIdentity(subject="user:alice"))
+    return c
+
+
+def make_context(name="search", args=None):
+    return SimpleNamespace(function=SimpleNamespace(name=name), arguments=args or {}, result=None, terminate=False)
+
+
+def run(coro):
+    return asyncio.run(coro)
+
+
+def test_allow_calls_next_and_completes():
+    c = client_with_user()
+    stub_permission_allowed(c)
+    ctx = make_context("search")
+    ran = {}
+
+    async def call_next(context):
+        ran["yes"] = True
+        return "ok"
+
+    out = run(guarded_process(c, ctx, call_next))
+    assert out == "ok"
+    assert ran.get("yes") is True
+    invoke = get_trace_spans(c, "tool.invoke")[0]
+    assert invoke.attributes["allowed"] is True
+    # Tool name pulled from the context's ``function.name``.
+    assert invoke.attributes["toolName"] == "search"
+    assert get_trace_spans(c, "tool.complete")
+
+
+def test_enforce_terminates_without_next(monkeypatch):
+    monkeypatch.setenv("ORY_PERMISSION_MODE", "enforce")
+    c = client_with_user()
+    stub_permission_denied(c)
+    ctx = make_context("rm")
+    ran = {}
+
+    async def call_next(context):
+        ran["yes"] = True
+        return "should-not-run"
+
+    out = run(guarded_process(c, ctx, call_next))
+    # Native veto shape: next() skipped, terminate flag set, denial in context.result.
+    assert out is None
+    assert "yes" not in ran  # next never called
+    assert ctx.terminate is True
+    assert "permission denied" in ctx.result
+    assert get_trace_spans(c, "tool.block")[0].attributes["blocked"] is True
+
+
+def test_extract_handles_function_name_field():
+    c = client_with_user()
+    stub_permission_allowed(c)
+    ctx = SimpleNamespace(function_name="edit", args={"a": 1}, result=None, terminate=False)
+
+    async def call_next(context):
+        return "ok"
+
+    run(guarded_process(c, ctx, call_next))
+    assert get_trace_spans(c, "tool.invoke")[0].attributes["toolName"] == "edit"

ory_agent_framework-0.13.9/tests/test_realsdk.py

@@ -0,0 +1,48 @@
+"""Real-SDK test: the Microsoft Agent Framework middleware builds + vetoes.
+
+Runs only when ``agent_framework`` is importable; the default workspace venv skips it. The
+framework's veto is plain attribute setting (no SDK type), so the real-SDK value here is that
+the module + middleware import and construct against the installed SDK. The permission
+decision is stubbed (no backend).
+"""
+
+from __future__ import annotations
+
+import asyncio
+from types import SimpleNamespace
+
+import pytest
+
+pytest.importorskip("agent_framework")
+
+from ory_agent_framework import guarded_process, ory_function_middleware  # noqa: E402
+from ory_agent_framework import middleware as m  # noqa: E402
+from ory_argus.adapters import GateResult  # noqa: E402
+from ory_argus.permissions import PermissionDecision  # noqa: E402
+from ory_argus.testing import create_mock_client  # noqa: E402
+
+
+def test_middleware_builds_against_real_sdk():
+    assert callable(ory_function_middleware(client=create_mock_client(harness="agent-framework")))
+
+
+def test_deny_terminates_without_next(monkeypatch):
+    monkeypatch.setattr(m, "session_start", lambda *a, **k: None)
+    monkeypatch.setattr(
+        m, "gate",
+        lambda client, **kw: GateResult(
+            proceed=False, blocked=True, decision=PermissionDecision(kind="deny"),
+            subject="User:t", namespace="AgentTools", denial_message="Ory: permission denied",
+        ),
+    )
+    ctx = SimpleNamespace(function=SimpleNamespace(name="MyRealTool"), arguments={}, result=None, terminate=False)
+    ran = {}
+
+    async def call_next(_ctx):
+        ran["yes"] = True
+        return "should-not-run"
+
+    asyncio.run(guarded_process(create_mock_client(harness="agent-framework"), ctx, call_next))
+    assert "yes" not in ran
+    assert ctx.terminate is True
+    assert "permission denied" in str(ctx.result)