@aria_asi/cli 0.2.25 → 0.2.29

package/opencode-plugins/harness-gate/index.js

@@ -0,0 +1,248 @@
+/**
+ * Aria Harness Gate — pre-tool cognition enforcement for OpenCode.
+ * Routes through HTTPHarnessClient SDK for substrate-backed validation.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const HOME = homedir();
+const SDK_CANDIDATES = [
+  join(HOME, '.aria', 'sdk', 'index.js'),
+  join(HOME, '.codex', 'aria-sdk', 'index.js'),
+  join(HOME, '.claude', 'aria-sdk', 'index.js'),
+];
+const OWNER_TOKEN_PATH = join(HOME, '.aria', 'owner-token');
+const LICENSE_PATH = join(HOME, '.aria', 'license.json');
+const RUNTIME_URL = (process.env.ARIA_RUNTIME_URL || 'http://127.0.0.1:4319').replace(/\/+$/, '');
+
+const DESTRUCTIVE_PATTERNS = [
+  { rx: /(?:^|[;&|]\s*|\$\(\s*|`\s*)sudo\s+\S/, name: 'sudo' },
+  { rx: /systemctl\s+(disable|stop|mask|reset-failed|kill)/, name: 'systemctl-state-change' },
+  { rx: /\brm\s+-[rRfF]+/, name: 'rm-recursive-or-force' },
+  { rx: /\bgit\s+push\b.*\b--force\b/, name: 'git-push-force' },
+  { rx: /\bgit\s+reset\s+--hard\b/, name: 'git-reset-hard' },
+  { rx: /\bgit\s+checkout\s+--\b/, name: 'git-checkout-discard' },
+  { rx: /\b--no-verify\b/, name: 'commit-no-verify' },
+  { rx: /\b--no-gpg-sign\b/, name: 'commit-no-gpg-sign' },
+  { rx: /\bkill\s+-(9|KILL|TERM|HUP|INT)\b/, name: 'kill-signal' },
+  { rx: /\bpkill\b/, name: 'pkill' },
+  { rx: /\b(DROP|TRUNCATE)\s+(TABLE|DATABASE|SCHEMA|INDEX)\b/i, name: 'sql-drop-or-truncate' },
+  { rx: /\bkubectl\s+delete\b/, name: 'kubectl-delete' },
+];
+
+const DEPLOY_PATTERNS = [
+  { rx: /\b(?:\.\/)?scripts\/deploy-/, name: 'deploy-script' },
+  { rx: /\bkubectl\s+apply\b/, name: 'kubectl-apply' },
+  { rx: /\bkubectl\s+set\s+image\b/, name: 'kubectl-set-image' },
+  { rx: /\bkubectl\s+rollout\s+restart\b/, name: 'kubectl-rollout-restart' },
+  { rx: /\bkubectl\s+rollout\s+undo\b/, name: 'kubectl-rollout-undo' },
+  { rx: /\bdocker\s+push\b/, name: 'docker-push' },
+  { rx: /\bdocker\s+build\b.*--push\b/, name: 'docker-build-push' },
+];
+
+const INLINE_LENS_RX = /^\s*#\s*(?:nur|mizan|hikma|tafakkur|tadabbur|ilham|wahi|firasah|perception|balance|wisdom|reflection|foresight|insight|revelation|discernment)\s*:\s*.{20,}/im;
+const VERIFY_BLOCK_RX = /<verify>[\s\S]*?target\s*:[\s\S]*?verified\s*:[\s\S]*?axiom\s*:[\s\S]*?<\/verify>/i;
+const TRIVIAL_BASH_RX = /^\s*(?:ls|cat|head|tail|grep|find|echo|wc|stat|which|pwd|date|file|du|df|ss|ps)\s/;
+const SHORT_BASH_LIMIT = 30;
+
+let _client = null;
+let _clientError = null;
+let _lastMizanReceipt = null;
+let _lastActionSummary = '';
+
+function resolveToken() {
+  if (process.env.ARIA_HARNESS_TOKEN) return process.env.ARIA_HARNESS_TOKEN;
+  if (process.env.ARIA_API_KEY) return process.env.ARIA_API_KEY;
+  if (process.env.ARIA_MASTER_TOKEN) return process.env.ARIA_MASTER_TOKEN;
+  try {
+    if (existsSync(OWNER_TOKEN_PATH)) {
+      const v = readFileSync(OWNER_TOKEN_PATH, 'utf8').trim();
+      if (v) return v;
+    }
+  } catch {}
+  try {
+    if (existsSync(LICENSE_PATH)) {
+      const j = JSON.parse(readFileSync(LICENSE_PATH, 'utf8'));
+      if (j.token) return j.token;
+    }
+  } catch {}
+  return '';
+}
+
+function resolveBaseUrl() {
+  if (process.env.ARIA_HIVE_RUNTIME_URL) return process.env.ARIA_HIVE_RUNTIME_URL.replace(/\/+$/, '');
+  if (process.env.ARIA_HARNESS_BASE_URL) return process.env.ARIA_HARNESS_BASE_URL.replace(/\/+$/, '');
+  if (process.env.ARIA_SOUL_URL) return process.env.ARIA_SOUL_URL.replace(/\/+$/, '');
+  return process.env.ARIA_HARNESS_URL || 'https://harness.ariasos.com';
+}
+
+function resolveSdkPath() {
+  return SDK_CANDIDATES.find((candidate) => existsSync(candidate)) || '';
+}
+
+async function getClient() {
+  if (_client) return _client;
+  if (_clientError) return null;
+  const sdkPath = resolveSdkPath();
+  if (!sdkPath) { _clientError = 'SDK not found'; return null; }
+  const token = resolveToken();
+  if (!token) { _clientError = 'no token'; return null; }
+  try {
+    const mod = await import(sdkPath);
+    const Client = mod.HTTPHarnessClient;
+    if (!Client) { _clientError = 'no HTTPHarnessClient export'; return null; }
+    _client = new Client({ baseUrl: resolveBaseUrl(), apiKey: token, workspaceRoot: process.cwd() });
+  } catch (e) {
+    _clientError = e.message;
+  }
+  return _client;
+}
+
+async function runtimeCheckAction(action, target) {
+  const token = resolveToken();
+  if (!token) throw new Error('no token');
+  const response = await fetch(`${RUNTIME_URL}/check-action`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: `Bearer ${token}`,
+    },
+    body: JSON.stringify({ action, target }),
+  });
+  if (!response.ok) {
+    const body = await response.text().catch(() => response.statusText);
+    throw new Error(`runtime check-action failed ${response.status}: ${body}`);
+  }
+  const payload = await response.json();
+  return payload.allowed == null && payload.ok && payload.reason == null ? payload.result || payload : payload;
+}
+
+async function runtimeMizan(phase, body) {
+  const token = resolveToken();
+  if (!token) throw new Error('no token');
+  const response = await fetch(`${RUNTIME_URL}/mizan/${phase}`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: `Bearer ${token}`,
+    },
+    body: JSON.stringify(body),
+  });
+  if (!response.ok) {
+    const raw = await response.text().catch(() => response.statusText);
+    throw new Error(`runtime mizan/${phase} failed ${response.status}: ${raw}`);
+  }
+  return response.json();
+}
+
+export default async function HarnessGatePlugin(ctx) {
+  process.stderr.write('[harness-gate] Active — SDK-backed cognition gate\n');
+
+  return {
+    'tool.execute.before': async (input, output) => {
+      const toolName = input.tool;
+      if (!['Bash', 'Edit', 'Write', 'NotebookEdit'].includes(toolName)) return;
+
+      const cmd = toolName === 'Bash' ? String(input.args?.command ?? '') : '';
+      const filePath = toolName !== 'Bash' ? String(input.args?.file_path ?? input.args?.notebook_path ?? '') : '';
+      const cmdPreview = toolName === 'Bash' ? cmd.slice(0, 80) : `${toolName} ${filePath || '(no path)'}`.slice(0, 80);
+
+      // Trivial reads pass
+      if (toolName === 'Bash' && TRIVIAL_BASH_RX.test(cmd) && cmd.length < 200) return;
+      if (toolName === 'Bash' && cmd.length < SHORT_BASH_LIMIT) return;
+      // Inline cognition in bash comments passes
+      if (toolName === 'Bash' && INLINE_LENS_RX.test(cmd)) return;
+
+      const destructive = DESTRUCTIVE_PATTERNS.find(({ rx }) => rx.test(cmd));
+      const deploy = DEPLOY_PATTERNS.find(({ rx }) => rx.test(cmd));
+      const isFileMutation = ['Edit', 'Write', 'NotebookEdit'].includes(toolName) && filePath;
+
+      if (!destructive && !deploy && !isFileMutation) return;
+
+      // Try SDK checkAction() first — substrate-backed validation
+      const client = await getClient();
+      const sessionId = process.env.ARIA_SESSION_ID || 'opencode';
+      const label = destructive?.name || deploy?.name || `${toolName}:${filePath?.split('/').pop() || ''}`;
+      const action = toolName === 'Bash' ? 'bash' : 'edit';
+      const target = toolName === 'Bash' ? cmd.slice(0, 200) : filePath.slice(0, 200);
+      const rationale =
+        destructive ? `High-risk action ${label} requested in OpenCode and must satisfy Mizan truth, protection, and quality before execution.`
+          : deploy ? `Deployment action ${label} requested in OpenCode and must satisfy Mizan survivability before execution.`
+            : `Repository mutation ${label} requested in OpenCode and must satisfy Mizan quality and doctrine before execution.`;
+
+      try {
+        const pre = await runtimeMizan('pre', {
+          sessionId,
+          context: {
+            sessionId,
+            message: cmdPreview,
+            intendedAction: target || cmdPreview,
+            rationale,
+          },
+        });
+        _lastMizanReceipt = pre.receipt || null;
+        _lastActionSummary = cmdPreview;
+        if (pre.receipt?.blocked || pre.result?.fitrahVetoed || pre.result?.reAuthorSignal) {
+          throw new Error(
+            `=== ARIA MIZAN PRE BLOCK: ${label} ===\n\n` +
+            `${(pre.result?.notes || ['Mizan pre-phase blocked this action.']).slice(0, 4).join('\n')}\n\n` +
+            `Required packs: ${(pre.operatorPlan?.requiredPacks || []).join(', ')}\n` +
+            `Required operators: ${(pre.operatorPlan?.priorityOperators || []).join(', ')}`
+          );
+        }
+        if (_lastMizanReceipt?.receiptId && _lastActionSummary && _lastActionSummary !== cmdPreview) {
+          await runtimeMizan('mid', {
+            sessionId,
+            parentReceiptId: _lastMizanReceipt.receiptId,
+            message: _lastActionSummary,
+            plannedApproach: cmdPreview,
+            context: {
+              sessionId,
+              message: _lastActionSummary,
+              plannedApproach: cmdPreview,
+              rationale,
+            },
+          }).catch(() => null);
+        }
+      } catch (e) {
+        if (String(e?.message || '').startsWith('=== ARIA MIZAN PRE BLOCK')) throw e;
+        process.stderr.write(`[harness-gate] mizan pre unavailable: ${e.message}\n`);
+      }
+
+      if (client) {
+        try {
+          const check = await runtimeCheckAction(action, target).catch(() => client.checkAction(action, target));
+          if (!check.allowed) {
+            throw new Error(
+              `=== ARIA SD GATE: ${label} ===\n\n` +
+              `Blocked by substrate gate: ${check.reason || 'no reason provided'}\n` +
+              `Required gates: ${(check.requiredGates || []).join(', ')}\n\n` +
+              `Complete a <cognition> block or inline cognition comments before this action.`
+            );
+          }
+          return;
+        } catch (e) {
+          if (e.message.startsWith('=== ARIA SD GATE')) throw e;
+          // SDK unreachable — fall through to local gate below
+          process.stderr.write(`[harness-gate] SDK checkAction failed: ${e.message} — falling through to local gate\n`);
+        }
+      }
+
+      // Local fallback gate
+      const msg = [
+        `=== ARIA GATE: ${label} ===`,
+        '',
+        `This tool (${label}) requires pre-action cognition. Add inline cognition comments:`,
+        '  # nur: [perception of current state, ≥20 chars]',
+        '  # mizan: [balance analysis, trade-offs, risks, ≥20 chars]',
+        '  # hikma: [wisdom — which doctrine applies, ≥20 chars]',
+        '  # tafakkur: [reflection — second-order effects, ≥20 chars]',
+        '',
+        `${deploy ? 'DEPLOY requires a <verify> block with target, verified, rollback, axiom fields.\n' : ''}`,
+        `Run \`aria connect\` to install the full SDK-backed gate (substrate checkAction).`,
+      ].filter(Boolean).join('\n');
+      throw new Error(msg);
+    },
+  };
+}

package/opencode-plugins/harness-outcome/index.js

@@ -0,0 +1,129 @@
+/**
+ * Aria Harness Outcome — post-tool recording via HTTPHarnessClient SDK.
+ * Routes through the canonical SDK for outcome/garden/ledger writes.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const HOME = homedir();
+const SDK_CANDIDATES = [
+  join(HOME, '.aria', 'sdk', 'index.js'),
+  join(HOME, '.codex', 'aria-sdk', 'index.js'),
+  join(HOME, '.claude', 'aria-sdk', 'index.js'),
+];
+const OWNER_TOKEN_PATH = join(HOME, '.aria', 'owner-token');
+const LICENSE_PATH = join(HOME, '.aria', 'license.json');
+
+let _client = null;
+let _clientError = null;
+
+function resolveToken() {
+  if (process.env.ARIA_HARNESS_TOKEN) return process.env.ARIA_HARNESS_TOKEN;
+  if (process.env.ARIA_API_KEY) return process.env.ARIA_API_KEY;
+  try {
+    if (existsSync(OWNER_TOKEN_PATH)) {
+      const v = readFileSync(OWNER_TOKEN_PATH, 'utf8').trim();
+      if (v) return v;
+    }
+  } catch {}
+  try {
+    if (existsSync(LICENSE_PATH)) {
+      const j = JSON.parse(readFileSync(LICENSE_PATH, 'utf8'));
+      if (j.token) return j.token;
+    }
+  } catch {}
+  return '';
+}
+
+function resolveBaseUrl() {
+  if (process.env.ARIA_HIVE_RUNTIME_URL) return process.env.ARIA_HIVE_RUNTIME_URL.replace(/\/+$/, '');
+  if (process.env.ARIA_HARNESS_BASE_URL) return process.env.ARIA_HARNESS_BASE_URL.replace(/\/+$/, '');
+  return process.env.ARIA_HARNESS_URL || 'https://harness.ariasos.com';
+}
+
+function resolveSdkPath() {
+  return SDK_CANDIDATES.find((candidate) => existsSync(candidate)) || '';
+}
+
+async function getClient() {
+  if (_client) return _client;
+  if (_clientError) return null;
+  const sdkPath = resolveSdkPath();
+  if (!sdkPath) { _clientError = 'SDK not found'; return null; }
+  const token = resolveToken();
+  if (!token) { _clientError = 'no token'; return null; }
+  try {
+    const mod = await import(sdkPath);
+    const Client = mod.HTTPHarnessClient;
+    if (!Client) { _clientError = 'no HTTPHarnessClient export'; return null; }
+    _client = new Client({ baseUrl: resolveBaseUrl(), apiKey: token, workspaceRoot: process.cwd() });
+  } catch (e) {
+    _clientError = e.message;
+  }
+  return _client;
+}
+
+export default async function HarnessOutcomePlugin(ctx) {
+  process.stderr.write('[harness-outcome] Active — SDK-backed outcome recording\n');
+
+  return {
+    'tool.execute.after': async (input, output) => {
+      const toolName = input.tool;
+      if (!['Bash', 'Edit', 'Write', 'NotebookEdit'].includes(toolName)) return;
+
+      const actionKind = toolName === 'Bash' ? 'bash' : 'edit';
+      const actionTarget = toolName === 'Bash'
+        ? String(input.args?.command ?? '').split(/\s+/)[0]?.slice(0, 100) || 'unknown'
+        : String(input.args?.file_path ?? input.args?.notebook_path ?? '').slice(0, 200) || 'unknown';
+      const success = !output?.error;
+      const sessionId = process.env.ARIA_SESSION_ID || 'opencode';
+
+      // Try SDK first
+      const client = await getClient();
+      if (client) {
+        try {
+          await client.recordDiscovery({
+            text: `${actionKind}: ${actionTarget} — ${success ? 'ok' : 'failed'}`,
+            kind: success ? 'observation' : 'defect',
+            source: 'opencode-outcome-plugin',
+            resolution_status: success ? 'resolved' : 'open',
+            sessionId,
+          });
+          return;
+        } catch (e) {
+          // Fire-and-forget — SDK unreachable is non-blocking
+          process.stderr.write(`[harness-outcome] SDK recordDiscovery failed: ${e.message} — falling through to raw fetch\n`);
+        }
+      }
+
+      // Fallback: raw fetch
+      const harnessUrl =
+        process.env.ARIA_HIVE_RUNTIME_URL ||
+        process.env.ARIA_HARNESS_BASE_URL ||
+        process.env.ARIA_HARNESS_URL ||
+        'https://harness.ariasos.com';
+      let harnessToken = process.env.ARIA_HARNESS_TOKEN || process.env.ARIA_API_KEY || '';
+      try {
+        if (!harnessToken) {
+          if (existsSync(OWNER_TOKEN_PATH)) harnessToken = readFileSync(OWNER_TOKEN_PATH, 'utf8').trim();
+        }
+      } catch {}
+      if (!harnessToken) return;
+
+      fetch(`${harnessUrl}/api/harness/outcome-record`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          Authorization: `Bearer ${harnessToken}`,
+        },
+        body: JSON.stringify({
+          sessionId,
+          actionKind,
+          actionTarget,
+          actionShape: { tool: toolName, success },
+        }),
+      }).catch(() => {});
+    },
+  };
+}

package/opencode-plugins/harness-stop/index.js

@@ -0,0 +1,241 @@
+/**
+ * Aria Harness Stop — text-emission gate via HTTPHarnessClient SDK.
+ * Routes text through Mizan validateOutput() for substrate-backed QC.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const HOME = homedir();
+const SDK_CANDIDATES = [
+  join(HOME, '.aria', 'sdk', 'index.js'),
+  join(HOME, '.codex', 'aria-sdk', 'index.js'),
+  join(HOME, '.claude', 'aria-sdk', 'index.js'),
+];
+const OWNER_TOKEN_PATH = join(HOME, '.aria', 'owner-token');
+const LICENSE_PATH = join(HOME, '.aria', 'license.json');
+const RUNTIME_URL = (process.env.ARIA_RUNTIME_URL || 'http://127.0.0.1:4319').replace(/\/+$/, '');
+
+const LENS_NAMES = [
+  'nur', 'mizan', 'hikma', 'tafakkur', 'tadabbur', 'ilham', 'wahi', 'firasah',
+  'perception', 'balance', 'wisdom', 'reflection', 'foresight', 'insight', 'revelation', 'discernment',
+];
+
+const COGNITION_BLOCK_RX = /<cognition>([\s\S]*?)<\/cognition>/i;
+const REQUIRED_LENSES = 4;
+const SUBSTANCE_MIN_CHARS = 20;
+const NON_TRIVIAL_MIN_CHARS = 300;
+const DECISION_SIGNAL_RX = /(?:should|recommend|propose|suggest|let'?s|go with|i'd|i would|here'?s the plan|i'll|next step|action item|ship it|yes do|let me)/i;
+const TRIVIAL_ACK_RX = /^(?:got it|on it|ok|sure|yes|no|done|ack)\b/i;
+const PLACEHOLDER_RX = /^\s*<[^<>]+>\s*$/;
+
+let _client = null;
+let _clientError = null;
+let _lastMizanReceipt = null;
+
+function resolveToken() {
+  if (process.env.ARIA_HARNESS_TOKEN) return process.env.ARIA_HARNESS_TOKEN;
+  if (process.env.ARIA_API_KEY) return process.env.ARIA_API_KEY;
+  if (process.env.ARIA_MASTER_TOKEN) return process.env.ARIA_MASTER_TOKEN;
+  try {
+    if (existsSync(OWNER_TOKEN_PATH)) {
+      const v = readFileSync(OWNER_TOKEN_PATH, 'utf8').trim();
+      if (v) return v;
+    }
+  } catch {}
+  try {
+    if (existsSync(LICENSE_PATH)) {
+      const j = JSON.parse(readFileSync(LICENSE_PATH, 'utf8'));
+      if (j.token) return j.token;
+    }
+  } catch {}
+  return '';
+}
+
+function resolveBaseUrl() {
+  if (process.env.ARIA_HIVE_RUNTIME_URL) return process.env.ARIA_HIVE_RUNTIME_URL.replace(/\/+$/, '');
+  if (process.env.ARIA_HARNESS_BASE_URL) return process.env.ARIA_HARNESS_BASE_URL.replace(/\/+$/, '');
+  return process.env.ARIA_HARNESS_URL || 'https://harness.ariasos.com';
+}
+
+function resolveSdkPath() {
+  return SDK_CANDIDATES.find((candidate) => existsSync(candidate)) || '';
+}
+
+async function getClient() {
+  if (_client) return _client;
+  if (_clientError) return null;
+  const sdkPath = resolveSdkPath();
+  if (!sdkPath) { _clientError = 'SDK not found'; return null; }
+  const token = resolveToken();
+  if (!token) { _clientError = 'no token'; return null; }
+  try {
+    const mod = await import(sdkPath);
+    const Client = mod.HTTPHarnessClient;
+    if (!Client) { _clientError = 'no HTTPHarnessClient export'; return null; }
+    _client = new Client({ baseUrl: resolveBaseUrl(), apiKey: token, workspaceRoot: process.cwd() });
+  } catch (e) {
+    _clientError = e.message;
+  }
+  return _client;
+}
+
+async function runtimeValidateOutput(text, sessionId) {
+  const token = resolveToken();
+  if (!token) throw new Error('no token');
+  const response = await fetch(`${RUNTIME_URL}/validate-output`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: `Bearer ${token}`,
+    },
+    body: JSON.stringify({ text, sessionId }),
+  });
+  if (!response.ok) {
+    const body = await response.text().catch(() => response.statusText);
+    throw new Error(`runtime validate-output failed ${response.status}: ${body}`);
+  }
+  const payload = await response.json();
+  return payload.validation || payload.result || payload;
+}
+
+async function runtimeMizanPost(text, sessionId, context = {}) {
+  const token = resolveToken();
+  if (!token) throw new Error('no token');
+  const response = await fetch(`${RUNTIME_URL}/mizan/post`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: `Bearer ${token}`,
+    },
+    body: JSON.stringify({
+      sessionId,
+      text,
+      context: {
+        sessionId,
+        ...context,
+      },
+      parentReceiptId: _lastMizanReceipt?.receiptId || null,
+    }),
+  });
+  if (!response.ok) {
+    const body = await response.text().catch(() => response.statusText);
+    throw new Error(`runtime mizan/post failed ${response.status}: ${body}`);
+  }
+  return response.json();
+}
+
+function detectCognitionLenses(text) {
+  if (!text) return { count: 0, names: [] };
+  const block = text.match(COGNITION_BLOCK_RX);
+  const searchSpace = block ? block[1] : text;
+  const names = [];
+  for (const lens of LENS_NAMES) {
+    const lensRx = new RegExp(
+      `\\b${lens}\\s*:\\s*([^\\n]*(?:\\n(?!\\s*(?:${LENS_NAMES.join('|')})\\s*:|<\\/cognition>)[^\\n]*)*)`,
+      'i',
+    );
+    const m = searchSpace.match(lensRx);
+    if (!m) continue;
+    const content = (m[1] || '').trim();
+    if (content.length < SUBSTANCE_MIN_CHARS) continue;
+    if (PLACEHOLDER_RX.test(content)) continue;
+    names.push(lens);
+  }
+  return { count: names.length, names };
+}
+
+export default async function HarnessStopPlugin(ctx) {
+  process.stderr.write('[harness-stop] Active — SDK-backed text-emission gate\n');
+
+  return {
+    'session.idle': async (event) => {
+      process.stderr.write('  [strip gate registed — session i\n');
+    },
+
+    event: async ({ event }) => {
+      if (event.type !== 'message.updated') return;
+      const parts = event.properties?.parts || [];
+      const text = parts
+        .filter(p => p.type === 'text')
+        .map(p => p.text || '')
+        .join('\n');
+
+      if (!text || text.length < NON_TRIVIAL_MIN_CHARS) return;
+      if (TRIVIAL_ACK_RX.test(text.trim())) return;
+
+      const cog = detectCognitionLenses(text);
+      const sessionId = process.env.ARIA_SESSION_ID || 'opencode';
+      try {
+        const mizan = await runtimeMizanPost(text.slice(0, 8000), sessionId, {
+          message: text.slice(0, 1000),
+          plannedApproach: 'OpenCode stop gate output review',
+        });
+        _lastMizanReceipt = mizan.receipt || _lastMizanReceipt;
+        if (mizan.receipt?.blocked || mizan.result?.fitrahVetoed || mizan.result?.reAuthorSignal) {
+          process.stderr.write(
+            `[harness-stop] MIZAN POST BLOCK — ${(mizan.result?.notes || ['post-phase blocked']).slice(0, 4).join(' | ')}\n`
+          );
+        }
+      } catch (e) {
+        process.stderr.write(`[harness-stop] mizan/post unavailable: ${e.message}\n`);
+      }
+
+      // Try SDK validateOutput() — Mizan classifier-backed validation
+      const client = await getClient();
+      if (client) {
+        try {
+          const result = await runtimeValidateOutput(
+            text.slice(0, 8000),
+            sessionId,
+          ).catch(() => client.validateOutput(
+            text.slice(0, 8000),
+            sessionId,
+          ));
+          if (result.severity === 'block') {
+            process.stderr.write(
+              `[harness-stop] SDK BLOCK — ${result.violations.length} violations: ${result.violations.join('; ').slice(0, 300)}\n`
+            );
+          } else if (result.severity === 'warn') {
+            process.stderr.write(
+              `[harness-stop] SDK WARN — ${result.violations.length} violations (non-blocking)\n`
+            );
+          }
+          // Log gate triggers
+          if (result.gateTriggers?.length) {
+            process.stderr.write(`[harness-stop] SDK triggers: ${result.gateTriggers.join(', ')}\n`);
+          }
+          return;
+        } catch (e) {
+          process.stderr.write(`[harness-stop] SDK validateOutput failed: ${e.message} — falling through to local gate\n`);
+        }
+      }
+
+      // Local fallback gate
+      // Scan drift triggers
+      const triggerMapPath = `${HOME}/.claude/hooks/doctrine_trigger_map.json`;
+      let driftHits = [];
+      try {
+        if (existsSync(triggerMapPath)) {
+          const triggerMap = JSON.parse(readFileSync(triggerMapPath, 'utf8'));
+          const lower = text.toLowerCase();
+          for (const t of triggerMap.triggers || []) {
+            try {
+              const rx = new RegExp(t.trigger, 'i');
+              if (rx.test(lower)) {
+                const memCited = t.memory && lower.includes(t.memory.replace(/\.md$/, '').toLowerCase());
+                if (!memCited) driftHits.push(t.trigger);
+              }
+            } catch {}
+          }
+        }
+      } catch {}
+
+      if (cog.count < REQUIRED_LENSES || driftHits.length >= 2) {
+        process.stderr.write(
+          `[harness-stop] LOCAL GATE — cognition=${cog.count}/${REQUIRED_LENSES} drift=${driftHits.length}\n`
+        );
+      }
+    },
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aria_asi/cli",
-  "version": "0.2.25",
+  "version": "0.2.29",
   "description": "Aria Smart CLI — the world's first harness-powered terminal companion",
   "bin": {
     "aria": "./bin/aria.js"
@@ -18,6 +18,8 @@
   },
   "scripts": {
     "build": "tsc && node scripts/bundle-sdk.mjs",
+    "check:hooks": "node scripts/validate-hook-contracts.mjs",
+    "check:skills": "node scripts/validate-skill-prompts.mjs",
     "prepare": "npm run build",
     "dev": "tsc --watch",
     "publish:all": "bash scripts/publish-all.sh",
@@ -37,8 +39,12 @@
     "bin",
     "dist",
     "src",
+    "runtime-src",
+    "scripts",
+    "skills",
     "hooks",
-    "opencode-plugins"
+    "opencode-plugins",
+    "CLIENT-ONBOARDING.md"
   ],
   "engines": {
     "node": ">=20.0.0"

package/runtime-src/doctor.mjs

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+
+const runtimeUrl = process.env.ARIA_RUNTIME_URL || 'http://127.0.0.1:4319';
+
+try {
+  const response = await fetch(`${runtimeUrl}/health`);
+  const payload = await response.json();
+  process.stdout.write(JSON.stringify(payload, null, 2) + '\n');
+  process.exit(response.ok ? 0 : 1);
+} catch (error) {
+  process.stderr.write(
+    JSON.stringify(
+      {
+        ok: false,
+        runtimeUrl,
+        error: error instanceof Error ? error.message : String(error),
+      },
+      null,
+      2,
+    ) + '\n',
+  );
+  process.exit(1);
+}