@aria_asi/cli 0.2.0

package/src/harness-client.ts

@@ -0,0 +1,454 @@
+import type { AuthConfig, HarnessResponse, HarnessGateDecision } from './types.js';
+import { loadLicense } from './auth.js';
+import { pushCognitionLog } from './cognition-log.js';
+
+// ── Public types ──────────────────────────────────────────────────────
+
+export interface HarnessChunk {
+  index: number;
+  priority: number;
+  label: 'identity' | 'rules' | 'gate-state' | 'metadata' | 'sources';
+  chars: number;
+  content: string;
+}
+
+export interface HarnessPacket {
+  ok: boolean;
+  stage?: string;
+  actor?: string;
+  system?: string;
+  harness?: string;
+  adapter?: string;
+  preStateGate?: { passed: boolean; score: number };
+  contractGate?: { passed: boolean; score: number };
+  missingCritical?: string[];
+  loadedByClass?: Record<string, number>;
+  // Phase 2/3 — chunked-mode fields (present when client passed
+  // modelContext < threshold and server returned chunks).
+  chunkSummary?: {
+    mode: 'full' | 'chunked';
+    totalChars: number;
+    approxTokens: number;
+    chunkCount: number;
+    modelContextRequested?: number;
+    thresholdTokens: number;
+    researchPullChars?: number;
+  };
+  chunks?: HarnessChunk[];
+}
+
+/**
+ * Harness API client.
+ *
+ * Reads license token from ~/.aria/license.json (via auth.ts loadLicense()),
+ * falls back to ARIA_HARNESS_TOKEN env var. No hardcoded master token.
+ *
+ * All /api/harness/* calls use Bearer auth. 401/403 surfaced to caller.
+ * No timeout on fetch — bare try/catch per no-timeouts requirement.
+ * Every gate decision pushes a cognition log entry.
+ */
+
+interface HarnessClientOptions {
+  baseUrl?: string;
+}
+
+interface GateContext {
+  gate: string;
+  passed: boolean;
+  reason?: string;
+  score?: number;
+  metadata?: Record<string, unknown>;
+}
+
+export class HarnessClient {
+  private baseUrl: string;
+  private token: string | null = null;
+  private tokenPromise: Promise<string | null> | null = null;
+
+  constructor(options: HarnessClientOptions = {}) {
+    this.baseUrl = options.baseUrl ?? process.env.ARIA_HARNESS_BASE_URL ?? 'https://harness.ariasos.com';
+  }
+
+  /**
+   * Resolve the bearer token: try loadLicense() first, fall back to env var.
+   * Cache the promise so we don't re-read the file on every call.
+   */
+  private async getToken(): Promise<string | null> {
+    if (this.token) return this.token;
+    if (this.tokenPromise) return this.tokenPromise;
+
+    this.tokenPromise = this.resolveToken();
+    return this.tokenPromise;
+  }
+
+  private async resolveToken(): Promise<string | null> {
+    // 1. Try license file
+    try {
+      const license = await loadLicense();
+      if (license?.harnessToken) {
+        this.token = license.harnessToken;
+        return this.token;
+      }
+    } catch {
+      // file not found or parse error — fall through
+    }
+
+    // 2. Fallback to env var
+    const envToken = process.env.ARIA_HARNESS_TOKEN;
+    if (envToken) {
+      this.token = envToken;
+      return this.token;
+    }
+
+    return null;
+  }
+
+  /**
+   * Perform a fetch against /api/harness/{path}.
+   * Returns the parsed JSON body on success.
+   * Throws a structured error on 401 (revoked) or 403 (forbidden).
+   * No timeout — bare try/catch.
+   */
+  async request<T = unknown>(
+    method: string,
+    path: string,
+    body?: unknown,
+    gateContext?: GateContext,
+  ): Promise<HarnessResponse<T>> {
+    const token = await this.getToken();
+
+    const headers: Record<string, string> = {
+      'Content-Type': 'application/json',
+    };
+
+    if (token) {
+      headers['Authorization'] = `Bearer ${token}`;
+    }
+
+    let response: Response;
+    try {
+      response = await fetch(`${this.baseUrl}/api/harness${path}`, {
+        method,
+        headers,
+        body: body ? JSON.stringify(body) : undefined,
+      });
+    } catch (err) {
+      // Push cognition log for the gate failure if we have context
+      if (gateContext) {
+        await this.pushGateLog({
+          ...gateContext,
+          passed: false,
+          reason: `network_error: ${(err as Error).message}`,
+        }).catch(() => {}); // fire-and-forget best effort
+      }
+      throw err;
+    }
+
+    // Surface 401/403 cleanly
+    if (response.status === 401) {
+      const detail = await this.tryExtractError(response);
+      const err = new Error(`Harness token revoked: ${detail}`);
+      (err as any).status = 401;
+      (err as any).code = 'TOKEN_REVOKED';
+      if (gateContext) {
+        await this.pushGateLog({
+          ...gateContext,
+          passed: false,
+          reason: `http_401: ${detail}`,
+        }).catch(() => {});
+      }
+      throw err;
+    }
+
+    if (response.status === 403) {
+      const detail = await this.tryExtractError(response);
+      const err = new Error(`Harness token forbidden: ${detail}`);
+      (err as any).status = 403;
+      (err as any).code = 'TOKEN_FORBIDDEN';
+      if (gateContext) {
+        await this.pushGateLog({
+          ...gateContext,
+          passed: false,
+          reason: `http_403: ${detail}`,
+        }).catch(() => {});
+      }
+      throw err;
+    }
+
+    if (!response.ok) {
+      const detail = await this.tryExtractError(response);
+      const err = new Error(`Harness request failed (${response.status}): ${detail}`);
+      (err as any).status = response.status;
+      if (gateContext) {
+        await this.pushGateLog({
+          ...gateContext,
+          passed: false,
+          reason: `http_${response.status}: ${detail}`,
+        }).catch(() => {});
+      }
+      throw err;
+    }
+
+    const data: T = await response.json();
+
+    // Push cognition log for passed gate
+    if (gateContext) {
+      await this.pushGateLog({
+        ...gateContext,
+        passed: true,
+      }).catch(() => {});
+    }
+
+    return { success: true, data };
+  }
+
+  /**
+   * Convenience: GET
+   */
+  async get<T = unknown>(path: string, gateContext?: GateContext): Promise<HarnessResponse<T>> {
+    return this.request<T>('GET', path, undefined, gateContext);
+  }
+
+  /**
+   * Convenience: POST
+   */
+  async post<T = unknown>(path: string, body?: unknown, gateContext?: GateContext): Promise<HarnessResponse<T>> {
+    return this.request<T>('POST', path, body, gateContext);
+  }
+
+  /**
+   * Convenience: PUT
+   */
+  async put<T = unknown>(path: string, body?: unknown, gateContext?: GateContext): Promise<HarnessResponse<T>> {
+    return this.request<T>('PUT', path, body, gateContext);
+  }
+
+  // ── Helpers ──────────────────────────────────────────────────────
+
+  private async tryExtractError(response: Response): Promise<string> {
+    try {
+      const json = await response.json();
+      return json?.error ?? json?.message ?? response.statusText;
+    } catch {
+      return response.statusText;
+    }
+  }
+
+  private async pushGateLog(context: GateContext): Promise<void> {
+    try {
+      await pushCognitionLog({
+        source: 'harness-client',
+        type: 'gate_decision',
+        gate: context.gate,
+        passed: context.passed,
+        reason: context.reason,
+        score: context.score,
+        metadata: context.metadata,
+      });
+    } catch {
+      // fire-and-forget: never let logging fail the request
+    }
+  }
+}
+
+// ── Default-instance singleton ────────────────────────────────────────
+// All top-level function exports share one HarnessClient so token
+// resolution and base-URL are looked up once and cached.
+
+let _defaultClient: HarnessClient | null = null;
+
+function getDefaultClient(): HarnessClient {
+  if (!_defaultClient) _defaultClient = new HarnessClient();
+  return _defaultClient;
+}
+
+/**
+ * Raw-fetch compatibility shim used by auth-commands.ts.
+ * Exposes .get() and .post() that make bare fetch() calls with the
+ * configured base URL. Callers receive the native Response object
+ * (so they can call .ok, .status, .json() etc. themselves).
+ * Paths are absolute from the base URL (e.g. '/api/license/heartbeat').
+ */
+export const harnessClient = {
+  get(path: string, init?: { headers?: Record<string, string> }): Promise<Response> {
+    const baseUrl = process.env.ARIA_HARNESS_BASE_URL ?? 'https://harness.ariasos.com';
+    return fetch(`${baseUrl}${path}`, {
+      method: 'GET',
+      headers: { 'Content-Type': 'application/json', ...(init?.headers ?? {}) },
+    });
+  },
+  post(path: string, init?: { body?: unknown; headers?: Record<string, string> }): Promise<Response> {
+    const baseUrl = process.env.ARIA_HARNESS_BASE_URL ?? 'https://harness.ariasos.com';
+    return fetch(`${baseUrl}${path}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...(init?.headers ?? {}) },
+      body: init?.body ? JSON.stringify(init.body) : undefined,
+    });
+  },
+};
+
+// ── fetchHarness ──────────────────────────────────────────────────────
+
+/**
+ * POST /api/harness/codex with the per-turn context.
+ * Returns the parsed HarnessPacket, or null on any error.
+ * No timeout — bare try/catch per no-timeouts doctrine.
+ */
+export async function fetchHarness(args: {
+  message: string;
+  sessionId: string;
+  userId?: string;
+  cwd?: string;
+  modelContext?: number;
+}): Promise<HarnessPacket | null> {
+  try {
+    const client = getDefaultClient();
+    const body: Record<string, unknown> = {
+      stage: 'preflight',
+      message: args.message,
+      actor: 'aria-cli',
+      system: 'aria-cli',
+      platform: 'cli',
+      sessionId: args.sessionId,
+      isHamza: args.userId === 'hamza',
+      userId: args.userId ?? 'user',
+      workingDirectory: args.cwd ?? process.cwd(),
+    };
+    if (args.modelContext !== undefined) {
+      body.modelContext = args.modelContext;
+    }
+    const result = await client.post<HarnessPacket>('/codex', body);
+    if (!result.success || !result.data) return null;
+    return result.data;
+  } catch {
+    return null;
+  }
+}
+
+// ── combineHarnessContext ─────────────────────────────────────────────
+
+/**
+ * Stitch a HarnessPacket into a single string for system-prompt injection.
+ *
+ * Full mode   — concat all harness text (harness field) or all chunk contents.
+ * Chunked mode — concat all chunks with a progressive-feed note appended.
+ *
+ * chat.ts:233: `blocks.push(combineHarnessContext(harness))`
+ * chat.ts:240-244: surfaces chunked-mode info to stdout (done in chat.ts, not here).
+ */
+export function combineHarnessContext(packet: HarnessPacket): string {
+  const mode = packet.chunkSummary?.mode ?? 'full';
+
+  if (mode === 'chunked' && packet.chunks && packet.chunks.length > 0) {
+    // In chunked mode we still surface all chunks in priority order so the
+    // model gets the full doctrine in one prompt. The chunk-per-turn feed
+    // is a Phase 3 CLI responsibility (chat.ts will split across turns).
+    const body = packet.chunks
+      .slice()
+      .sort((a, b) => a.priority - b.priority)
+      .map((c) => c.content)
+      .join('\n\n');
+    const total = packet.chunks.length;
+    const chars = packet.chunkSummary?.totalChars ?? body.length;
+    const tokens = packet.chunkSummary?.approxTokens ?? Math.ceil(chars / 4);
+    return (
+      `[ARIA_HARNESS — chunked mode: ${total} chunks, ${chars} chars, ~${tokens} tokens]\n\n` +
+      body
+    );
+  }
+
+  // Full mode — prefer the flat harness string; fall back to chunk concat.
+  if (packet.harness) return `[ARIA_HARNESS]\n${packet.harness}`;
+
+  if (packet.chunks && packet.chunks.length > 0) {
+    return packet.chunks
+      .slice()
+      .sort((a, b) => a.priority - b.priority)
+      .map((c) => c.content)
+      .join('\n\n');
+  }
+
+  return '';
+}
+
+// ── checkHarnessHealth ────────────────────────────────────────────────
+
+/**
+ * GET /api/health to verify aria-soul is reachable.
+ * Returns true on 200, false on any error or non-200.
+ * bin/aria.js uses this to display "Harness: connected" vs "running locally".
+ */
+export async function checkHarnessHealth(): Promise<boolean> {
+  try {
+    const client = getDefaultClient();
+    // HarnessClient.request() prefixes /api/harness — use fetch directly
+    // so we can hit /api/health without that prefix.
+    const baseUrl: string = (client as any).baseUrl ?? process.env.ARIA_HARNESS_BASE_URL ?? 'https://harness.ariasos.com';
+    const resp = await fetch(`${baseUrl}/api/health`);
+    return resp.ok;
+  } catch {
+    return false;
+  }
+}
+
+// ── validateOutput ────────────────────────────────────────────────────
+
+/**
+ * POST /api/harness/validate with the LLM response text.
+ * Returns severity verdict + violations, or null on error.
+ * chat.ts calls this after every LLM response to surface output-gate violations.
+ *
+ * Server response shape (server.ts:1167):
+ *   { passed, violations[], severity: 'pass'|'warn'|'block', rewritten?, gateTriggers[], eightLens? }
+ */
+export async function validateOutput(args: {
+  text: string;
+  sessionId: string;
+}): Promise<{ severity: 'pass' | 'warn' | 'block'; violations: string[]; rewritten?: string } | null> {
+  try {
+    const client = getDefaultClient();
+    type ValidateResp = {
+      passed: boolean;
+      violations: string[];
+      severity: 'pass' | 'warn' | 'block';
+      rewritten?: string;
+      gateTriggers?: string[];
+    };
+    const result = await client.post<ValidateResp>('/validate', {
+      text: args.text,
+      sessionId: args.sessionId,
+    });
+    if (!result.success || !result.data) return null;
+    const { severity, violations, rewritten } = result.data;
+    return { severity, violations: violations ?? [], rewritten };
+  } catch {
+    return null;
+  }
+}
+
+// ── getRecentTurns ────────────────────────────────────────────────────
+
+/**
+ * GET /api/garden/turns?userId=...&limit=... to rehydrate recent context.
+ * Returns chronologically-ordered turns (oldest first), empty array on error.
+ * chat.ts calls this on session start to restore working-set history.
+ *
+ * Server response shape (server.ts:1411):
+ *   { ok, count, turns: [{ session_id, user_message, aria_response, model, latency_ms, created_at, platform, user_id }] }
+ */
+export async function getRecentTurns(args: {
+  userId: string;
+  limit: number;
+}): Promise<Array<{ user_message: string; aria_response: string }>> {
+  try {
+    const client = getDefaultClient();
+    const baseUrl: string = (client as any).baseUrl ?? process.env.ARIA_HARNESS_BASE_URL ?? 'https://harness.ariasos.com';
+    const url = `${baseUrl}/api/garden/turns?userId=${encodeURIComponent(args.userId)}&limit=${args.limit}`;
+    const resp = await fetch(url);
+    if (!resp.ok) return [];
+    const json = await resp.json() as { ok?: boolean; turns?: Array<{ user_message: string; aria_response: string }> };
+    return Array.isArray(json.turns) ? json.turns : [];
+  } catch {
+    return [];
+  }
+}

package/src/hive-client.ts

@@ -0,0 +1,104 @@
+// Hive registration + heartbeat for ANY client using @aria/connector.
+//
+// Aria's vision: every CLI install, every customer hitting the harness
+// HTTP API, every IDE connector — all register in the Hive on session
+// start and heartbeat through their lifetime. Three goals (per Hamza,
+// 2026-04-26):
+//
+//   1. Compounding evolution — every session contributes signal back
+//      to Aria. Hive entries carry capability lists, platform, recent
+//      activity. Aria's evolution-engine aggregates across tenants.
+//
+//   2. Protect IP — the Hive endpoint is on aria-soul, behind multi-
+//      tenant auth (API keys + rate limit + concurrency guards from
+//      commit c68588302). Customers see their own session, not raw
+//      doctrine sources.
+//
+//   3. Protect from abuse — heartbeat-based throttling. A tenant
+//      whose session count or activity diverges from their tier gets
+//      rate-limited at the gate, not at the application layer.
+//
+// This module is decoupled from @aria/openclaw-shared (which is
+// internal-only) so external customers ship the connector with their
+// CLI/app and get hive integration with no internal Aria deps.
+
+const HARNESS_URL = process.env.ARIA_HARNESS_URL || 'http://192.168.4.25:30080';
+const HARNESS_TOKEN = process.env.ARIA_HARNESS_TOKEN || '';
+
+// Schema matches apps/arias-soul/api/hive/register.ts:
+//   POST { session_id, platform, user_id?, context?, capabilities? }
+//   → { status, session, hive: { active_sessions, message }, aria: { greeting } }
+
+export interface HiveRegisterConfig {
+  sessionId: string;
+  /** "aria-cli" | "claude-code" | "cursor" | "opencode" | tenant-chosen */
+  platform: string;
+  /** Tenant identity. Aria-soul correlates to API key on auth-resolved tenant. */
+  userId?: string;
+  /** What this client can do — surfaces to Aria + other sessions. */
+  capabilities?: string[];
+  /** Free-form metadata: cwd, version, git branch, etc. */
+  context?: Record<string, unknown>;
+}
+
+export interface HiveRegisterResult {
+  status: 'registered' | 'error';
+  session: { id: string; platform: string; last_active: string };
+  hive: { active_sessions: number; message: string };
+  aria: { greeting: string };
+}
+
+export async function registerWithHive(
+  cfg: HiveRegisterConfig,
+): Promise<HiveRegisterResult | null> {
+  // Doctrine: no policy timeouts. Real network errors arrive via fetch
+  // rejection. If the hive is unreachable, registration is best-effort
+  // and the CLI continues — the session works locally even when
+  // detached from the central registry.
+  try {
+    const resp = await fetch(`${HARNESS_URL}/api/hive/register`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        ...(HARNESS_TOKEN ? { Authorization: `Bearer ${HARNESS_TOKEN}` } : {}),
+      },
+      body: JSON.stringify({
+        session_id: cfg.sessionId,
+        platform: cfg.platform,
+        user_id: cfg.userId,
+        capabilities: cfg.capabilities ?? [],
+        context: cfg.context ?? {},
+      }),
+    });
+    if (!resp.ok) return null;
+    return (await resp.json()) as HiveRegisterResult;
+  } catch {
+    return null;
+  }
+}
+
+// Heartbeat = re-register the same payload. The hive endpoint is
+// idempotent (ON CONFLICT … DO UPDATE in the SQL). Default cadence
+// matches openclaw-shared's 45s — short enough for liveness, long
+// enough to avoid hammering the registry from many clients.
+export interface HeartbeatHandle {
+  stop: () => void;
+}
+
+export function startHeartbeat(
+  cfg: HiveRegisterConfig,
+  intervalMs: number = 45_000,
+): HeartbeatHandle {
+  // Fire one immediately so the hive has a fresh entry before the
+  // first interval tick. If it fails, schedule the next tick anyway —
+  // the hive may come back later.
+  registerWithHive(cfg).catch(() => {});
+  const timer = setInterval(() => {
+    registerWithHive(cfg).catch(() => {});
+  }, intervalMs);
+  // Don't keep the process alive just for heartbeats.
+  if (typeof timer.unref === 'function') timer.unref();
+  return {
+    stop: () => clearInterval(timer),
+  };
+}

package/src/index.ts

@@ -0,0 +1,26 @@
+export { loadConfig, saveConfig, updateConfig, getDefaultConfig, getConfigPath, getConfigDir } from './config.js';
+export type { AriaConfig, ModelConfig, LinkedRepo, DatabaseConfig, ConnectorState } from './config.js';
+
+export { scanCodebase, schemaImageToText } from './codebase-scanner.js';
+export type { SchemaImage, DirectoryNode, Dependency } from './codebase-scanner.js';
+
+export { runSetupWizard } from './setup-wizard.js';
+
+export { connectClaudeCode, disconnectClaudeCode } from './connectors/claude-code.js';
+export { connectCursor, disconnectCursor } from './connectors/cursor.js';
+export { connectOpenCode, disconnectOpenCode } from './connectors/opencode.js';
+export { connectShell, disconnectShell } from './connectors/shell.js';
+
+export { GardenClient } from './garden-client.js';
+export type { GardenStatus } from './garden-client.js';
+
+export { generateMcpServer, detectToolCandidates } from './auto-mcp.js';
+export type { ToolCandidate, ToolParameter, McpGenerationResult } from './auto-mcp.js';
+
+export { AriaChat } from './chat.js';
+
+export { fetchHarness, combineHarnessContext, checkHarnessHealth, validateOutput, getRecentTurns } from './harness-client.js';
+export type { HarnessPacket, HarnessChunk } from './harness-client.js';
+
+export { loadPersona, savePersona, updatePersona, buildPersonaBlock } from './persona.js';
+export type { PersonaContext } from './persona.js';