ory-crewai 0.13.9__tar.gz

ory_crewai-0.13.9/.gitignore

@@ -0,0 +1,36 @@
+node_modules/
+dist/
+*.tsbuildinfo
+.env
+.env.local
+
+# Python (uv workspace under python/)
+.venv/
+__pycache__/
+*.egg-info/
+.pytest_cache/
+.ruff_cache/
+build/
+*.pyc
+
+# Debug logs
+*.log
+
+# Harness sandbox dirs
+.sandbox/
+
+# Staged install-surface repo contents (see scripts/sync-install-surfaces.mjs)
+.install-surfaces/
+
+# Local dev environment (local Ory stack + Verdaccio registry)
+.ory-dev/
+
+# Worktrees for changes
+.worktrees/
+.claude/worktrees/
+
+# Gemini CLI extension assets — materialized at install time from
+# @ory/argus templates. The repo source is the canonical templates;
+# these subdirs are generated wherever the install runs.
+packages/gemini-cli/gemini-extension/skills/
+packages/gemini-cli/gemini-extension/commands/

ory_crewai-0.13.9/PKG-INFO

@@ -0,0 +1,45 @@
+Metadata-Version: 2.4
+Name: ory-crewai
+Version: 0.13.9
+Summary: Ory Agent Security for CrewAI — per-tool authorization, tracing, and identity propagation by wrapping tools. Built on ory-argus.
+Author: Ory
+License-Expression: Apache-2.0
+Keywords: agent,ai,authorization,crewai,ory,permissions
+Requires-Python: >=3.10
+Requires-Dist: crewai>=0.80
+Requires-Dist: ory-argus<1,>=0.8
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# ory-crewai
+
+Ory Agent Security for [CrewAI](https://docs.crewai.com).
+
+Wraps your CrewAI tools so every call is authorized against Ory Permissions, traced, and
+tied to the user → agent identity — built on [`ory-argus`](https://pypi.org/project/ory-argus/).
+
+```bash
+pip install ory-crewai
+```
+
+```python
+from crewai import Agent
+from ory_crewai import guard_tools
+
+agent = Agent(role="researcher", tools=guard_tools([search, send_email]))
+```
+
+In **enforce** mode (`ORY_PERMISSION_MODE=enforce`) a denied tool raises an error that CrewAI
+surfaces to the LLM; the tool never runs. In **observe** mode (default) the tool runs and a
+`permission.observe_deny` span is recorded.
+
+For tracing across paths that bypass the wrapped tools, also register the event listener:
+
+```python
+from ory_crewai import ory_event_listener
+listener = ory_event_listener()  # traces ToolUsage events
+```
+
+Credentials come from the shared `~/.config/ory-agent-plugins/config.json`.

ory_crewai-0.13.9/README.md

@@ -0,0 +1,30 @@
+# ory-crewai
+
+Ory Agent Security for [CrewAI](https://docs.crewai.com).
+
+Wraps your CrewAI tools so every call is authorized against Ory Permissions, traced, and
+tied to the user → agent identity — built on [`ory-argus`](https://pypi.org/project/ory-argus/).
+
+```bash
+pip install ory-crewai
+```
+
+```python
+from crewai import Agent
+from ory_crewai import guard_tools
+
+agent = Agent(role="researcher", tools=guard_tools([search, send_email]))
+```
+
+In **enforce** mode (`ORY_PERMISSION_MODE=enforce`) a denied tool raises an error that CrewAI
+surfaces to the LLM; the tool never runs. In **observe** mode (default) the tool runs and a
+`permission.observe_deny` span is recorded.
+
+For tracing across paths that bypass the wrapped tools, also register the event listener:
+
+```python
+from ory_crewai import ory_event_listener
+listener = ory_event_listener()  # traces ToolUsage events
+```
+
+Credentials come from the shared `~/.config/ory-agent-plugins/config.json`.

ory_crewai-0.13.9/pyproject.toml

@@ -0,0 +1,23 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "ory-crewai"
+version = "0.13.9"
+description = "Ory Agent Security for CrewAI — per-tool authorization, tracing, and identity propagation by wrapping tools. Built on ory-argus."
+readme = "README.md"
+requires-python = ">=3.10"
+license = "Apache-2.0"
+authors = [{ name = "Ory" }]
+keywords = ["ory", "crewai", "authorization", "agent", "ai", "permissions"]
+dependencies = [
+    "ory-argus>=0.8,<1",
+    "crewai>=0.80",
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=8", "ruff>=0.6"]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/ory_crewai"]

ory_crewai-0.13.9/src/ory_crewai/__init__.py

@@ -0,0 +1,14 @@
+"""Ory Agent Security for CrewAI.
+
+    from ory_crewai import guard_tools
+
+    agent = Agent(role="…", tools=guard_tools([search, send_email]))
+"""
+
+from __future__ import annotations
+
+from .tools import guard_tool_arun, guard_tool_run, guard_tools, ory_event_listener
+
+__version__ = "0.13.9"
+
+__all__ = ["guard_tools", "guard_tool_run", "guard_tool_arun", "ory_event_listener", "__version__"]

ory_crewai-0.13.9/src/ory_crewai/tools.py

@@ -0,0 +1,199 @@
+"""Ory Agent Security for CrewAI.
+
+CrewAI has no global before-tool veto — the per-tool gate points are the tool's ``_run``
+(sync, via ``run``) and ``_arun`` (async, via ``arun``). ``guard_tools(tools)`` wraps both
+so every call is authorized against Ory Permissions, traced, and (on first call) preceded
+by the Ory session gates:
+
+  - allow / observe / fail-open / interactive → run the tool and record ``tool.complete``.
+  - deny (enforce) → raise ``OryDenialError`` so CrewAI surfaces the denial to the LLM and
+    the tool never runs.
+
+For agents/tasks that bypass the wrapped tools, pair this with :func:`ory_event_listener`
+(trace-only, via CrewAI's event bus). Gate logic lives in ``ory_argus``; ``crewai`` is
+imported lazily.
+"""
+
+from __future__ import annotations
+
+import inspect
+import sys
+from typing import Any
+
+from ory_argus import (
+    DenialContext,
+    GateResult,
+    OryAgentClient,
+    OryDenialError,
+    complete,
+    gate,
+    session_start,
+)
+
+HARNESS = "crewai"
+
+
+def _gate_or_deny(
+    client: OryAgentClient,
+    *,
+    tool_name: str,
+    args: tuple,
+    kwargs: dict,
+    can_block: bool,
+    project_url: str | None,
+    state: dict,
+) -> None:
+    """Run session-start (once) + the permission gate; raise OryDenialError on enforce-deny."""
+    if not state.get("started"):
+        state["started"] = True
+        try:
+            session_start(client, harness=HARNESS, project_url=project_url)
+        except Exception as err:  # noqa: BLE001
+            client.logger.warn("session_start.failed", {"message": str(err)})
+
+    result: GateResult = gate(
+        client, harness=HARNESS, tool_name=tool_name, tool_args={"args": args, "kwargs": kwargs}, can_block=can_block
+    )
+    if result.blocked:
+        raise OryDenialError(
+            DenialContext(tool=tool_name, subject_id=result.subject, namespace=result.namespace)
+        )
+
+
+def guard_tool_run(
+    client: OryAgentClient,
+    *,
+    tool_name: str,
+    run: Any,
+    args: tuple,
+    kwargs: dict,
+    can_block: bool = True,
+    project_url: str | None = None,
+    _session_state: dict | None = None,
+) -> Any:
+    """SDK-free gate-then-run for a single tool ``_run`` call."""
+    state = _session_state if _session_state is not None else {}
+    _gate_or_deny(
+        client, tool_name=tool_name, args=args, kwargs=kwargs,
+        can_block=can_block, project_url=project_url, state=state,
+    )
+    output = run(*args, **kwargs)
+    complete(client, tool_name=tool_name, output=output)
+    return output
+
+
+async def guard_tool_arun(
+    client: OryAgentClient,
+    *,
+    tool_name: str,
+    run: Any,
+    args: tuple,
+    kwargs: dict,
+    can_block: bool = True,
+    project_url: str | None = None,
+    _session_state: dict | None = None,
+) -> Any:
+    """SDK-free gate-then-run for a single tool ``_arun`` call (async path via ``arun``).
+
+    Same semantics as :func:`guard_tool_run` — the gate runs (and an enforce-deny raises
+    ``OryDenialError``) BEFORE the tool body executes; observe/fail-open proceed with spans.
+    """
+    state = _session_state if _session_state is not None else {}
+    _gate_or_deny(
+        client, tool_name=tool_name, args=args, kwargs=kwargs,
+        can_block=can_block, project_url=project_url, state=state,
+    )
+    output = run(*args, **kwargs)
+    if inspect.isawaitable(output):
+        output = await output
+    complete(client, tool_name=tool_name, output=output)
+    return output
+
+
+def _warn_wrap_failed(client: OryAgentClient, event: str, tool_name: str, err: Exception) -> None:
+    """Wrapping failed: the tool will run UNGATED. Log + always warn on stderr (never stdout)."""
+    client.logger.warn(event, {"tool": tool_name, "message": str(err)})
+    print(
+        f"[ory] WARNING: failed to wrap tool '{tool_name}' ({err}); "
+        "it will run UNGATED by Ory permission checks.",
+        file=sys.stderr,
+    )
+
+
+def guard_tools(
+    tools: list,
+    *,
+    client: OryAgentClient | None = None,
+    can_block: bool = True,
+    project_url: str | None = None,
+) -> list:
+    """Wrap each CrewAI tool's ``_run`` and ``_arun`` with the Ory gate. Returns the same list (mutated)."""
+    c = client or OryAgentClient.from_env(HARNESS)
+    state: dict = {}
+    for tool in tools:
+        tool_name = getattr(tool, "name", None) or type(tool).__name__
+
+        def _make(run, name):
+            def _wrapped(*args, **kwargs):
+                return guard_tool_run(
+                    c, tool_name=name, run=run, args=args, kwargs=kwargs,
+                    can_block=can_block, project_url=project_url, _session_state=state,
+                )
+
+            return _wrapped
+
+        def _make_async(run, name):
+            async def _awrapped(*args, **kwargs):
+                return await guard_tool_arun(
+                    c, tool_name=name, run=run, args=args, kwargs=kwargs,
+                    can_block=can_block, project_url=project_url, _session_state=state,
+                )
+
+            return _awrapped
+
+        # Sync path: BaseTool.run() → _run.
+        original = getattr(tool, "_run", None)
+        if callable(original):
+            try:
+                tool._run = _make(original, tool_name)  # type: ignore[attr-defined]
+            except Exception as err:  # noqa: BLE001 — some tool models are frozen
+                _warn_wrap_failed(c, "crewai.wrap_tool.failed", tool_name, err)
+
+        # Async path: BaseTool.arun() awaits _arun — a tool overriding _arun would
+        # otherwise execute ungated (wrapping _run alone doesn't cover it).
+        original_arun = getattr(tool, "_arun", None)
+        if callable(original_arun):
+            try:
+                tool._arun = _make_async(original_arun, tool_name)  # type: ignore[attr-defined]
+            except Exception as err:  # noqa: BLE001 — some tool models are frozen
+                _warn_wrap_failed(c, "crewai.wrap_async_tool.failed", tool_name, err)
+    return tools
+
+
+def ory_event_listener(*, client: OryAgentClient | None = None):
+    """Build a CrewAI event-bus listener that traces tool usage (observation only)."""
+    from crewai.utilities.events import (  # type: ignore
+        ToolUsageFinishedEvent,
+        ToolUsageStartedEvent,
+    )
+    from crewai.utilities.events.base_event_listener import BaseEventListener  # type: ignore
+
+    c = client or OryAgentClient.from_env(HARNESS)
+
+    class _OryEventListener(BaseEventListener):  # type: ignore[misc]
+        def setup_listeners(self, bus):
+            @bus.on(ToolUsageStartedEvent)
+            def _started(source, event):  # noqa: ANN001
+                c.tracer.record(
+                    "tool.invoke", "ok",
+                    attributes={"toolName": getattr(event, "tool_name", "unknown"), "source": "event"},
+                )
+
+            @bus.on(ToolUsageFinishedEvent)
+            def _finished(source, event):  # noqa: ANN001
+                c.tracer.record("tool.complete", "ok", attributes={"source": "event"})
+
+    return _OryEventListener()
+
+
+__all__ = ["HARNESS", "guard_tool_arun", "guard_tool_run", "guard_tools", "ory_event_listener"]

ory_crewai-0.13.9/tests/test_realsdk.py

@@ -0,0 +1,89 @@
+"""Real-SDK test: wrap an actual CrewAI ``BaseTool`` and enforce.
+
+Runs only when ``crewai`` is importable (``pytest.importorskip``), so the default workspace
+venv skips it; the driver (``scripts/realsdk-tests.sh`` / ``pnpm test:realsdk``) runs it in an
+isolated env that installs CrewAI. Complements ``test_tools.py`` (which uses a fake tool):
+this validates the thing a fake can't — that wrapping a *real* (pydantic-based) ``BaseTool``
+instance and short-circuiting its ``_run`` actually works. The permission decision is stubbed
+(no backend) so the test isolates the SDK translation.
+"""
+
+from __future__ import annotations
+
+import asyncio
+
+import pytest
+
+pytest.importorskip("crewai")
+
+from crewai.tools import BaseTool  # noqa: E402
+
+from ory_argus.adapters import GateResult  # noqa: E402
+from ory_argus.denial import OryDenialError  # noqa: E402
+from ory_argus.permissions import PermissionDecision  # noqa: E402
+from ory_argus.testing import create_mock_client  # noqa: E402
+from ory_crewai import guard_tools  # noqa: E402
+from ory_crewai import tools as tools_mod  # noqa: E402
+
+
+class MyRealTool(BaseTool):
+    name: str = "MyRealTool"
+    description: str = "a real crewai tool"
+
+    def _run(self, *args, **kwargs):
+        return "RAN"
+
+
+class MyRealAsyncTool(BaseTool):
+    name: str = "MyRealAsyncTool"
+    description: str = "a real crewai tool with an async _arun"
+
+    def _run(self, *args, **kwargs):
+        return "RAN"
+
+    async def _arun(self, *args, **kwargs):
+        return "ARAN"
+
+
+def _stub_gate(monkeypatch, *, blocked):
+    monkeypatch.setattr(tools_mod, "session_start", lambda *a, **k: None)
+    monkeypatch.setattr(
+        tools_mod, "gate",
+        lambda client, **kw: GateResult(
+            proceed=not blocked, blocked=blocked,
+            decision=PermissionDecision(kind="deny" if blocked else "allow"),
+            subject="User:t", namespace="AgentTools",
+            denial_message="Ory: permission denied" if blocked else None,
+        ),
+    )
+
+
+def test_real_basetool_blocked_on_deny(monkeypatch):
+    _stub_gate(monkeypatch, blocked=True)
+    tool = MyRealTool()
+    guard_tools([tool], client=create_mock_client(harness="crewai"))
+    with pytest.raises(OryDenialError):
+        tool._run()  # wrapper must have replaced _run on the real BaseTool
+
+
+def test_real_basetool_runs_on_allow(monkeypatch):
+    _stub_gate(monkeypatch, blocked=False)
+    tool = MyRealTool()
+    guard_tools([tool], client=create_mock_client(harness="crewai"))
+    assert tool._run() == "RAN"
+
+
+def test_real_basetool_arun_blocked_on_deny(monkeypatch):
+    # BaseTool.arun awaits self._arun — a tool overriding _arun must be gated too.
+    _stub_gate(monkeypatch, blocked=True)
+    tool = MyRealAsyncTool()
+    guard_tools([tool], client=create_mock_client(harness="crewai"))
+    with pytest.raises(OryDenialError):
+        asyncio.run(tool._arun())  # wrapper must have replaced _arun on the real BaseTool
+
+
+def test_real_basetool_arun_runs_on_allow(monkeypatch):
+    _stub_gate(monkeypatch, blocked=False)
+    tool = MyRealAsyncTool()
+    guard_tools([tool], client=create_mock_client(harness="crewai"))
+    assert asyncio.run(tool._arun()) == "ARAN"

ory_crewai-0.13.9/tests/test_tools.py

@@ -0,0 +1,146 @@
+"""Hermetic tests for the CrewAI tool-wrap gate (SDK-free).
+
+Covers the native veto shape (``OryDenialError`` raised from the wrapped ``_run``) and
+request-shape delegation (``tool.name`` + verbatim args), plus the shared session sequence
+across a guarded tool list. The full permission decision matrix is core-owned
+(``ory-argus/tests/test_adapters.py``).
+"""
+
+from __future__ import annotations
+
+import asyncio
+
+import pytest
+
+from ory_argus.client import PrincipalIdentity
+from ory_argus.denial import OryDenialError
+from ory_argus.testing import (
+    create_mock_client,
+    get_trace_spans,
+    stub_permission_allowed,
+    stub_permission_denied,
+)
+from ory_crewai import guard_tools  # type: ignore
+
+
+@pytest.fixture(autouse=True)
+def _isolate(monkeypatch, tmp_path):
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path))
+    monkeypatch.delenv("ORY_PERMISSION_MODE", raising=False)
+
+
+class FakeTool:
+    def __init__(self, name):
+        self.name = name
+        self.ran = []
+
+    def _run(self, *args, **kwargs):
+        self.ran.append((args, kwargs))
+        return f"ran:{self.name}"
+
+
+class FakeAsyncTool(FakeTool):
+    """Mirrors a CrewAI BaseTool that overrides _arun (the arun() path)."""
+
+    def __init__(self, name):
+        super().__init__(name)
+        self.aran = []
+
+    async def _arun(self, *args, **kwargs):
+        self.aran.append((args, kwargs))
+        return f"aran:{self.name}"
+
+
+def client_with_user():
+    c = create_mock_client(harness="crewai")
+    c.set_user_principal(PrincipalIdentity(subject="user:alice"))
+    return c
+
+
+def test_allow_runs_and_completes():
+    c = client_with_user()
+    stub_permission_allowed(c)
+    tool = FakeTool("search")
+    guard_tools([tool], client=c)
+    out = tool._run("q", k=1)
+    assert out == "ran:search"
+    assert tool.ran == [(("q",), {"k": 1})]
+    invoke = get_trace_spans(c, "tool.invoke")[0]
+    assert invoke.attributes["allowed"] is True
+    # Tool name pulled from the BaseTool-shaped ``name`` attribute.
+    assert invoke.attributes["toolName"] == "search"
+    assert get_trace_spans(c, "tool.complete")
+
+
+def test_enforce_raises_and_skips(monkeypatch):
+    monkeypatch.setenv("ORY_PERMISSION_MODE", "enforce")
+    c = client_with_user()
+    stub_permission_denied(c)
+    tool = FakeTool("rm")
+    guard_tools([tool], client=c)
+    # Native veto shape: the wrapped _run raises OryDenialError at the tool boundary.
+    with pytest.raises(OryDenialError):
+        tool._run()
+    assert tool.ran == []  # underlying tool never invoked
+    assert get_trace_spans(c, "tool.block")[0].attributes["blocked"] is True
+
+
+def test_async_enforce_raises_and_skips(monkeypatch):
+    monkeypatch.setenv("ORY_PERMISSION_MODE", "enforce")
+    c = client_with_user()
+    stub_permission_denied(c)
+    tool = FakeAsyncTool("rm")
+    guard_tools([tool], client=c)
+    with pytest.raises(OryDenialError):
+        asyncio.run(tool._arun())
+    assert tool.aran == []
+    assert get_trace_spans(c, "tool.block")[0].attributes["blocked"] is True
+
+
+def test_async_allow_runs_and_completes():
+    c = client_with_user()
+    stub_permission_allowed(c)
+    tool = FakeAsyncTool("search")
+    guard_tools([tool], client=c)
+    out = asyncio.run(tool._arun("q", k=1))
+    assert out == "aran:search"
+    assert tool.aran == [(("q",), {"k": 1})]
+    assert get_trace_spans(c, "tool.invoke")[0].attributes["allowed"] is True
+    assert get_trace_spans(c, "tool.complete")
+
+
+def test_async_observe_runs_tool():
+    c = client_with_user()
+    stub_permission_denied(c)
+    tool = FakeAsyncTool("rm")
+    guard_tools([tool], client=c)
+    assert asyncio.run(tool._arun()) == "aran:rm"
+    assert get_trace_spans(c, "permission.observe_deny")
+
+
+def test_wrap_failure_warns_on_stderr(capsys):
+    c = client_with_user()
+    stub_permission_allowed(c)
+
+    class FrozenTool:
+        name = "frozen"
+
+        @property
+        def _run(self):
+            return lambda: "x"
+
+    guard_tools([FrozenTool()], client=c)
+    err = capsys.readouterr().err
+    assert "UNGATED" in err
+    assert "frozen" in err
+
+
+def test_session_start_once_across_tools():
+    c = client_with_user()
+    stub_permission_allowed(c)
+    t1, t2 = FakeTool("a"), FakeTool("b")
+    guard_tools([t1, t2], client=c)
+    t1._run()
+    t2._run()
+    # Two invoke spans, but the gate sequence is shared (no crash on second).
+    assert len(get_trace_spans(c, "tool.invoke")) == 2