@aria_asi/cli 0.2.26 → 0.2.29

package/dist/assets/opencode-plugins/harness-context/index.js

@@ -0,0 +1,60 @@
+/**
+ * Aria Harness Context Plugin for OpenCode.
+ *
+ * Injects the live harness packet into OpenCode's system prompt on every
+ * session start. Routes through the canonical @aria/harness-http-client SDK
+ * via the inject-context.mjs script that ships alongside this plugin.
+ *
+ * Distribution: this dir is installed by `aria connect` (via connectors/
+ * opencode.ts) into `~/.opencode/plugins/harness-context/`. The plugin's
+ * absolute install path is wired into ~/.opencode/config.json's `plugin`
+ * (singular) array. OpenCode loads it on session start.
+ *
+ * inject-context.mjs is resolved RELATIVE TO THIS FILE (via import.meta.url),
+ * so the same install layout works on every machine — no $HOME or repo-path
+ * assumptions.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const PLUGIN_DIR = dirname(fileURLToPath(import.meta.url));
+const INJECT_SCRIPT = join(PLUGIN_DIR, 'inject-context.mjs');
+
+function getHarnessContext() {
+  if (!existsSync(INJECT_SCRIPT)) {
+    process.stderr.write(`[harness-context] inject-context.mjs missing at ${INJECT_SCRIPT}\n`);
+    return null;
+  }
+  try {
+    // execFileSync — argv-safe (no shell injection surface even though the
+    // path is internal). 15s ceiling matches OpenCode's tolerance for
+    // session-start blocking. Stdout is the prepend-able context; stderr
+    // is the diagnostic surface.
+    const output = execFileSync(process.execPath, [INJECT_SCRIPT], {
+      encoding: 'utf-8',
+      timeout: 15000,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: process.env,
+    });
+    return output;
+  } catch (err) {
+    process.stderr.write(`[harness-context] inject-context failed: ${err && err.message ? err.message : String(err)}\n`);
+    return null;
+  }
+}
+
+export default async function HarnessContextPlugin(ctx) {
+  const context = getHarnessContext();
+  if (context) {
+    try {
+      ctx.system?.prepend?.(context.slice(0, 40000));
+    } catch (_) {
+      // ctx.system shape varies across OpenCode versions; if prepend isn't
+      // available we silently no-op rather than crash plugin load.
+    }
+  }
+  return {};
+}

package/dist/assets/opencode-plugins/harness-context/inject-context.mjs

@@ -0,0 +1,179 @@
+#!/usr/bin/env node
+// Aria harness context injector — bundled alongside the harness-context
+// OpenCode plugin. Resolved relative to the plugin (via import.meta.url),
+// so the install layout is portable across machines.
+//
+// Contract with the plugin:
+//   - stdin: ignored
+//   - stdout: text to prepend to OpenCode's system prompt
+//   - exit 0 on success; non-zero treated as failure (plugin returns null)
+//
+// SDK resolution: prefers ~/.aria/sdk/index.js (the shared SDK installed by
+// `aria connect`), then falls back to client-local bundles.
+// Cache fast-path prefers ~/.aria/.aria-harness-last-packet.json so OpenCode
+// session-start doesn't depend on Claude's local cache layout.
+
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const HOME = homedir();
+const LICENSE_PATH = join(HOME, '.aria', 'license.json');
+const OWNER_TOKEN_PATH = join(HOME, '.aria', 'owner-token');
+const SDK_CANDIDATES = [
+  join(HOME, '.aria', 'sdk', 'index.js'),
+  join(HOME, '.codex', 'aria-sdk', 'index.js'),
+  join(HOME, '.claude', 'aria-sdk', 'index.js'),
+];
+const RUNTIME_URL = (process.env.ARIA_RUNTIME_URL || 'http://127.0.0.1:4319').replace(/\/+$/, '');
+const PACKET_CACHE_PATHS = [
+  join(HOME, '.aria', '.aria-harness-last-packet.json'),
+  join(HOME, '.claude', '.aria-harness-last-packet.json'),
+];
+const PACKET_CACHE_TTL_SEC = Number(process.env.ARIA_HARNESS_CACHE_TTL_SEC || '300');
+const STALE_FALLBACK_MAX_AGE_SEC = Number(process.env.ARIA_HARNESS_STALE_FALLBACK_MAX_AGE_SEC || '86400');
+
+function fail(reason) {
+  process.stderr.write(`[inject-context] ${reason}\n`);
+  process.exit(1);
+}
+
+function resolveApiKey() {
+  if (process.env.ARIA_API_KEY) return process.env.ARIA_API_KEY;
+  if (process.env.ARIA_HARNESS_TOKEN) return process.env.ARIA_HARNESS_TOKEN;
+  if (process.env.ARIA_MASTER_TOKEN) return process.env.ARIA_MASTER_TOKEN;
+  if (existsSync(OWNER_TOKEN_PATH)) {
+    try {
+      const v = readFileSync(OWNER_TOKEN_PATH, 'utf8').trim();
+      if (v) return v;
+    } catch {}
+  }
+  if (existsSync(LICENSE_PATH)) {
+    try {
+      const j = JSON.parse(readFileSync(LICENSE_PATH, 'utf8'));
+      if (j.token) return j.token;
+    } catch {}
+  }
+  return '';
+}
+
+function resolveBaseUrl() {
+  if (process.env.ARIA_HIVE_RUNTIME_URL) return process.env.ARIA_HIVE_RUNTIME_URL.replace(/\/+$/, '');
+  if (process.env.ARIA_HARNESS_BASE_URL) return process.env.ARIA_HARNESS_BASE_URL.replace(/\/+$/, '');
+  if (process.env.ARIA_SOUL_URL) return process.env.ARIA_SOUL_URL.replace(/\/+$/, '');
+  return process.env.ARIA_HARNESS_URL || 'https://harness.ariasos.com';
+}
+
+function resolveSdkPath() {
+  return SDK_CANDIDATES.find((candidate) => existsSync(candidate)) || '';
+}
+
+function loadCachedPacket({ ignoreTtl = false } = {}) {
+  try {
+    for (const cachePath of PACKET_CACHE_PATHS) {
+      if (!existsSync(cachePath)) continue;
+      const ageSec = (Date.now() - statSync(cachePath).mtimeMs) / 1000;
+      if (ignoreTtl) {
+        if (ageSec > STALE_FALLBACK_MAX_AGE_SEC) continue;
+      } else if (ageSec > PACKET_CACHE_TTL_SEC) {
+        continue;
+      }
+      return JSON.parse(readFileSync(cachePath, 'utf8'));
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+
+function formatPacketAsContext(packet) {
+  if (typeof packet === 'string') return packet;
+  if (packet && typeof packet === 'object') {
+    if (packet.packet && typeof packet.packet === 'object') {
+      return JSON.stringify(packet.packet, null, 2);
+    }
+    if (packet.harness && typeof packet.harness === 'string') return packet.harness;
+    return JSON.stringify(packet, null, 2);
+  }
+  return '';
+}
+
+async function fetchViaSdk(baseUrl, apiKey) {
+  const sdkPath = resolveSdkPath();
+  if (!sdkPath) {
+    fail(`SDK not found in ${SDK_CANDIDATES.join(', ')} — run \`aria connect\` to install`);
+  }
+  const mod = await import(sdkPath);
+  const Client = mod.HTTPHarnessClient;
+  if (!Client) fail('SDK loaded but HTTPHarnessClient not exported — bundle is broken');
+  const client = new Client({ baseUrl, apiKey, workspaceRoot: process.cwd() });
+  return client.getHarnessPacket({
+    stage: 'session-start',
+    actor: 'opencode',
+    system: 'opencode',
+    platform: 'opencode',
+  });
+}
+
+async function fetchViaRuntime(apiKey) {
+  const response = await fetch(`${RUNTIME_URL}/packet`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: `Bearer ${apiKey}`,
+    },
+    body: JSON.stringify({
+      packetRequest: {
+        stage: 'session-start',
+        actor: 'opencode',
+        system: 'opencode',
+        platform: 'opencode',
+      },
+    }),
+  });
+  if (!response.ok) {
+    const body = await response.text().catch(() => response.statusText);
+    throw new Error(`runtime packet fetch failed ${response.status}: ${body}`);
+  }
+  const payload = await response.json();
+  return payload.packet || payload;
+}
+
+async function main() {
+  const apiKey = resolveApiKey();
+  if (!apiKey) {
+    // Stale-cache fallback: if network can't fix it, serve what we have
+    const stale = loadCachedPacket({ ignoreTtl: true });
+    if (stale) {
+      process.stderr.write('[inject-context] using stale cached packet (no API key)\n');
+      process.stdout.write(formatPacketAsContext(stale));
+      return;
+    }
+    fail('no API key — set ARIA_API_KEY or run `aria login`');
+  }
+  const baseUrl = resolveBaseUrl();
+
+  try {
+    const packet = await fetchViaRuntime(apiKey).catch(() => fetchViaSdk(baseUrl, apiKey));
+    process.stdout.write(formatPacketAsContext(packet));
+    return;
+  } catch (err) {
+    const fresh = loadCachedPacket();
+    if (fresh) {
+      process.stderr.write(`[inject-context] SDK fetch failed (${err.message}), using fresh cached packet\n`);
+      process.stdout.write(formatPacketAsContext(fresh));
+      return;
+    }
+    const stale = loadCachedPacket({ ignoreTtl: true });
+    if (stale) {
+      process.stderr.write(`[inject-context] network failed (${err.message}), using stale cached packet\n`);
+      process.stdout.write(formatPacketAsContext(stale));
+      return;
+    }
+    fail(`SDK fetch failed: ${err && err.message ? err.message : String(err)}`);
+  }
+}
+
+main().catch((err) => {
+  fail(`unexpected: ${err && err.message ? err.message : String(err)}`);
+});

package/dist/assets/opencode-plugins/harness-context/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "harness-context",
+  "version": "1.0.0",
+  "type": "module",
+  "main": "./index.js",
+  "exports": {
+    ".": "./index.js"
+  }
+}

package/dist/assets/opencode-plugins/harness-gate/index.js

@@ -0,0 +1,248 @@
+/**
+ * Aria Harness Gate — pre-tool cognition enforcement for OpenCode.
+ * Routes through HTTPHarnessClient SDK for substrate-backed validation.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const HOME = homedir();
+const SDK_CANDIDATES = [
+  join(HOME, '.aria', 'sdk', 'index.js'),
+  join(HOME, '.codex', 'aria-sdk', 'index.js'),
+  join(HOME, '.claude', 'aria-sdk', 'index.js'),
+];
+const OWNER_TOKEN_PATH = join(HOME, '.aria', 'owner-token');
+const LICENSE_PATH = join(HOME, '.aria', 'license.json');
+const RUNTIME_URL = (process.env.ARIA_RUNTIME_URL || 'http://127.0.0.1:4319').replace(/\/+$/, '');
+
+const DESTRUCTIVE_PATTERNS = [
+  { rx: /(?:^|[;&|]\s*|\$\(\s*|`\s*)sudo\s+\S/, name: 'sudo' },
+  { rx: /systemctl\s+(disable|stop|mask|reset-failed|kill)/, name: 'systemctl-state-change' },
+  { rx: /\brm\s+-[rRfF]+/, name: 'rm-recursive-or-force' },
+  { rx: /\bgit\s+push\b.*\b--force\b/, name: 'git-push-force' },
+  { rx: /\bgit\s+reset\s+--hard\b/, name: 'git-reset-hard' },
+  { rx: /\bgit\s+checkout\s+--\b/, name: 'git-checkout-discard' },
+  { rx: /\b--no-verify\b/, name: 'commit-no-verify' },
+  { rx: /\b--no-gpg-sign\b/, name: 'commit-no-gpg-sign' },
+  { rx: /\bkill\s+-(9|KILL|TERM|HUP|INT)\b/, name: 'kill-signal' },
+  { rx: /\bpkill\b/, name: 'pkill' },
+  { rx: /\b(DROP|TRUNCATE)\s+(TABLE|DATABASE|SCHEMA|INDEX)\b/i, name: 'sql-drop-or-truncate' },
+  { rx: /\bkubectl\s+delete\b/, name: 'kubectl-delete' },
+];
+
+const DEPLOY_PATTERNS = [
+  { rx: /\b(?:\.\/)?scripts\/deploy-/, name: 'deploy-script' },
+  { rx: /\bkubectl\s+apply\b/, name: 'kubectl-apply' },
+  { rx: /\bkubectl\s+set\s+image\b/, name: 'kubectl-set-image' },
+  { rx: /\bkubectl\s+rollout\s+restart\b/, name: 'kubectl-rollout-restart' },
+  { rx: /\bkubectl\s+rollout\s+undo\b/, name: 'kubectl-rollout-undo' },
+  { rx: /\bdocker\s+push\b/, name: 'docker-push' },
+  { rx: /\bdocker\s+build\b.*--push\b/, name: 'docker-build-push' },
+];
+
+const INLINE_LENS_RX = /^\s*#\s*(?:nur|mizan|hikma|tafakkur|tadabbur|ilham|wahi|firasah|perception|balance|wisdom|reflection|foresight|insight|revelation|discernment)\s*:\s*.{20,}/im;
+const VERIFY_BLOCK_RX = /<verify>[\s\S]*?target\s*:[\s\S]*?verified\s*:[\s\S]*?axiom\s*:[\s\S]*?<\/verify>/i;
+const TRIVIAL_BASH_RX = /^\s*(?:ls|cat|head|tail|grep|find|echo|wc|stat|which|pwd|date|file|du|df|ss|ps)\s/;
+const SHORT_BASH_LIMIT = 30;
+
+let _client = null;
+let _clientError = null;
+let _lastMizanReceipt = null;
+let _lastActionSummary = '';
+
+function resolveToken() {
+  if (process.env.ARIA_HARNESS_TOKEN) return process.env.ARIA_HARNESS_TOKEN;
+  if (process.env.ARIA_API_KEY) return process.env.ARIA_API_KEY;
+  if (process.env.ARIA_MASTER_TOKEN) return process.env.ARIA_MASTER_TOKEN;
+  try {
+    if (existsSync(OWNER_TOKEN_PATH)) {
+      const v = readFileSync(OWNER_TOKEN_PATH, 'utf8').trim();
+      if (v) return v;
+    }
+  } catch {}
+  try {
+    if (existsSync(LICENSE_PATH)) {
+      const j = JSON.parse(readFileSync(LICENSE_PATH, 'utf8'));
+      if (j.token) return j.token;
+    }
+  } catch {}
+  return '';
+}
+
+function resolveBaseUrl() {
+  if (process.env.ARIA_HIVE_RUNTIME_URL) return process.env.ARIA_HIVE_RUNTIME_URL.replace(/\/+$/, '');
+  if (process.env.ARIA_HARNESS_BASE_URL) return process.env.ARIA_HARNESS_BASE_URL.replace(/\/+$/, '');
+  if (process.env.ARIA_SOUL_URL) return process.env.ARIA_SOUL_URL.replace(/\/+$/, '');
+  return process.env.ARIA_HARNESS_URL || 'https://harness.ariasos.com';
+}
+
+function resolveSdkPath() {
+  return SDK_CANDIDATES.find((candidate) => existsSync(candidate)) || '';
+}
+
+async function getClient() {
+  if (_client) return _client;
+  if (_clientError) return null;
+  const sdkPath = resolveSdkPath();
+  if (!sdkPath) { _clientError = 'SDK not found'; return null; }
+  const token = resolveToken();
+  if (!token) { _clientError = 'no token'; return null; }
+  try {
+    const mod = await import(sdkPath);
+    const Client = mod.HTTPHarnessClient;
+    if (!Client) { _clientError = 'no HTTPHarnessClient export'; return null; }
+    _client = new Client({ baseUrl: resolveBaseUrl(), apiKey: token, workspaceRoot: process.cwd() });
+  } catch (e) {
+    _clientError = e.message;
+  }
+  return _client;
+}
+
+async function runtimeCheckAction(action, target) {
+  const token = resolveToken();
+  if (!token) throw new Error('no token');
+  const response = await fetch(`${RUNTIME_URL}/check-action`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: `Bearer ${token}`,
+    },
+    body: JSON.stringify({ action, target }),
+  });
+  if (!response.ok) {
+    const body = await response.text().catch(() => response.statusText);
+    throw new Error(`runtime check-action failed ${response.status}: ${body}`);
+  }
+  const payload = await response.json();
+  return payload.allowed == null && payload.ok && payload.reason == null ? payload.result || payload : payload;
+}
+
+async function runtimeMizan(phase, body) {
+  const token = resolveToken();
+  if (!token) throw new Error('no token');
+  const response = await fetch(`${RUNTIME_URL}/mizan/${phase}`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: `Bearer ${token}`,
+    },
+    body: JSON.stringify(body),
+  });
+  if (!response.ok) {
+    const raw = await response.text().catch(() => response.statusText);
+    throw new Error(`runtime mizan/${phase} failed ${response.status}: ${raw}`);
+  }
+  return response.json();
+}
+
+export default async function HarnessGatePlugin(ctx) {
+  process.stderr.write('[harness-gate] Active — SDK-backed cognition gate\n');
+
+  return {
+    'tool.execute.before': async (input, output) => {
+      const toolName = input.tool;
+      if (!['Bash', 'Edit', 'Write', 'NotebookEdit'].includes(toolName)) return;
+
+      const cmd = toolName === 'Bash' ? String(input.args?.command ?? '') : '';
+      const filePath = toolName !== 'Bash' ? String(input.args?.file_path ?? input.args?.notebook_path ?? '') : '';
+      const cmdPreview = toolName === 'Bash' ? cmd.slice(0, 80) : `${toolName} ${filePath || '(no path)'}`.slice(0, 80);
+
+      // Trivial reads pass
+      if (toolName === 'Bash' && TRIVIAL_BASH_RX.test(cmd) && cmd.length < 200) return;
+      if (toolName === 'Bash' && cmd.length < SHORT_BASH_LIMIT) return;
+      // Inline cognition in bash comments passes
+      if (toolName === 'Bash' && INLINE_LENS_RX.test(cmd)) return;
+
+      const destructive = DESTRUCTIVE_PATTERNS.find(({ rx }) => rx.test(cmd));
+      const deploy = DEPLOY_PATTERNS.find(({ rx }) => rx.test(cmd));
+      const isFileMutation = ['Edit', 'Write', 'NotebookEdit'].includes(toolName) && filePath;
+
+      if (!destructive && !deploy && !isFileMutation) return;
+
+      // Try SDK checkAction() first — substrate-backed validation
+      const client = await getClient();
+      const sessionId = process.env.ARIA_SESSION_ID || 'opencode';
+      const label = destructive?.name || deploy?.name || `${toolName}:${filePath?.split('/').pop() || ''}`;
+      const action = toolName === 'Bash' ? 'bash' : 'edit';
+      const target = toolName === 'Bash' ? cmd.slice(0, 200) : filePath.slice(0, 200);
+      const rationale =
+        destructive ? `High-risk action ${label} requested in OpenCode and must satisfy Mizan truth, protection, and quality before execution.`
+          : deploy ? `Deployment action ${label} requested in OpenCode and must satisfy Mizan survivability before execution.`
+            : `Repository mutation ${label} requested in OpenCode and must satisfy Mizan quality and doctrine before execution.`;
+
+      try {
+        const pre = await runtimeMizan('pre', {
+          sessionId,
+          context: {
+            sessionId,
+            message: cmdPreview,
+            intendedAction: target || cmdPreview,
+            rationale,
+          },
+        });
+        _lastMizanReceipt = pre.receipt || null;
+        _lastActionSummary = cmdPreview;
+        if (pre.receipt?.blocked || pre.result?.fitrahVetoed || pre.result?.reAuthorSignal) {
+          throw new Error(
+            `=== ARIA MIZAN PRE BLOCK: ${label} ===\n\n` +
+            `${(pre.result?.notes || ['Mizan pre-phase blocked this action.']).slice(0, 4).join('\n')}\n\n` +
+            `Required packs: ${(pre.operatorPlan?.requiredPacks || []).join(', ')}\n` +
+            `Required operators: ${(pre.operatorPlan?.priorityOperators || []).join(', ')}`
+          );
+        }
+        if (_lastMizanReceipt?.receiptId && _lastActionSummary && _lastActionSummary !== cmdPreview) {
+          await runtimeMizan('mid', {
+            sessionId,
+            parentReceiptId: _lastMizanReceipt.receiptId,
+            message: _lastActionSummary,
+            plannedApproach: cmdPreview,
+            context: {
+              sessionId,
+              message: _lastActionSummary,
+              plannedApproach: cmdPreview,
+              rationale,
+            },
+          }).catch(() => null);
+        }
+      } catch (e) {
+        if (String(e?.message || '').startsWith('=== ARIA MIZAN PRE BLOCK')) throw e;
+        process.stderr.write(`[harness-gate] mizan pre unavailable: ${e.message}\n`);
+      }
+
+      if (client) {
+        try {
+          const check = await runtimeCheckAction(action, target).catch(() => client.checkAction(action, target));
+          if (!check.allowed) {
+            throw new Error(
+              `=== ARIA SD GATE: ${label} ===\n\n` +
+              `Blocked by substrate gate: ${check.reason || 'no reason provided'}\n` +
+              `Required gates: ${(check.requiredGates || []).join(', ')}\n\n` +
+              `Complete a <cognition> block or inline cognition comments before this action.`
+            );
+          }
+          return;
+        } catch (e) {
+          if (e.message.startsWith('=== ARIA SD GATE')) throw e;
+          // SDK unreachable — fall through to local gate below
+          process.stderr.write(`[harness-gate] SDK checkAction failed: ${e.message} — falling through to local gate\n`);
+        }
+      }
+
+      // Local fallback gate
+      const msg = [
+        `=== ARIA GATE: ${label} ===`,
+        '',
+        `This tool (${label}) requires pre-action cognition. Add inline cognition comments:`,
+        '  # nur: [perception of current state, ≥20 chars]',
+        '  # mizan: [balance analysis, trade-offs, risks, ≥20 chars]',
+        '  # hikma: [wisdom — which doctrine applies, ≥20 chars]',
+        '  # tafakkur: [reflection — second-order effects, ≥20 chars]',
+        '',
+        `${deploy ? 'DEPLOY requires a <verify> block with target, verified, rollback, axiom fields.\n' : ''}`,
+        `Run \`aria connect\` to install the full SDK-backed gate (substrate checkAction).`,
+      ].filter(Boolean).join('\n');
+      throw new Error(msg);
+    },
+  };
+}

package/dist/assets/opencode-plugins/harness-outcome/index.js

@@ -0,0 +1,129 @@
+/**
+ * Aria Harness Outcome — post-tool recording via HTTPHarnessClient SDK.
+ * Routes through the canonical SDK for outcome/garden/ledger writes.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const HOME = homedir();
+const SDK_CANDIDATES = [
+  join(HOME, '.aria', 'sdk', 'index.js'),
+  join(HOME, '.codex', 'aria-sdk', 'index.js'),
+  join(HOME, '.claude', 'aria-sdk', 'index.js'),
+];
+const OWNER_TOKEN_PATH = join(HOME, '.aria', 'owner-token');
+const LICENSE_PATH = join(HOME, '.aria', 'license.json');
+
+let _client = null;
+let _clientError = null;
+
+function resolveToken() {
+  if (process.env.ARIA_HARNESS_TOKEN) return process.env.ARIA_HARNESS_TOKEN;
+  if (process.env.ARIA_API_KEY) return process.env.ARIA_API_KEY;
+  try {
+    if (existsSync(OWNER_TOKEN_PATH)) {
+      const v = readFileSync(OWNER_TOKEN_PATH, 'utf8').trim();
+      if (v) return v;
+    }
+  } catch {}
+  try {
+    if (existsSync(LICENSE_PATH)) {
+      const j = JSON.parse(readFileSync(LICENSE_PATH, 'utf8'));
+      if (j.token) return j.token;
+    }
+  } catch {}
+  return '';
+}
+
+function resolveBaseUrl() {
+  if (process.env.ARIA_HIVE_RUNTIME_URL) return process.env.ARIA_HIVE_RUNTIME_URL.replace(/\/+$/, '');
+  if (process.env.ARIA_HARNESS_BASE_URL) return process.env.ARIA_HARNESS_BASE_URL.replace(/\/+$/, '');
+  return process.env.ARIA_HARNESS_URL || 'https://harness.ariasos.com';
+}
+
+function resolveSdkPath() {
+  return SDK_CANDIDATES.find((candidate) => existsSync(candidate)) || '';
+}
+
+async function getClient() {
+  if (_client) return _client;
+  if (_clientError) return null;
+  const sdkPath = resolveSdkPath();
+  if (!sdkPath) { _clientError = 'SDK not found'; return null; }
+  const token = resolveToken();
+  if (!token) { _clientError = 'no token'; return null; }
+  try {
+    const mod = await import(sdkPath);
+    const Client = mod.HTTPHarnessClient;
+    if (!Client) { _clientError = 'no HTTPHarnessClient export'; return null; }
+    _client = new Client({ baseUrl: resolveBaseUrl(), apiKey: token, workspaceRoot: process.cwd() });
+  } catch (e) {
+    _clientError = e.message;
+  }
+  return _client;
+}
+
+export default async function HarnessOutcomePlugin(ctx) {
+  process.stderr.write('[harness-outcome] Active — SDK-backed outcome recording\n');
+
+  return {
+    'tool.execute.after': async (input, output) => {
+      const toolName = input.tool;
+      if (!['Bash', 'Edit', 'Write', 'NotebookEdit'].includes(toolName)) return;
+
+      const actionKind = toolName === 'Bash' ? 'bash' : 'edit';
+      const actionTarget = toolName === 'Bash'
+        ? String(input.args?.command ?? '').split(/\s+/)[0]?.slice(0, 100) || 'unknown'
+        : String(input.args?.file_path ?? input.args?.notebook_path ?? '').slice(0, 200) || 'unknown';
+      const success = !output?.error;
+      const sessionId = process.env.ARIA_SESSION_ID || 'opencode';
+
+      // Try SDK first
+      const client = await getClient();
+      if (client) {
+        try {
+          await client.recordDiscovery({
+            text: `${actionKind}: ${actionTarget} — ${success ? 'ok' : 'failed'}`,
+            kind: success ? 'observation' : 'defect',
+            source: 'opencode-outcome-plugin',
+            resolution_status: success ? 'resolved' : 'open',
+            sessionId,
+          });
+          return;
+        } catch (e) {
+          // Fire-and-forget — SDK unreachable is non-blocking
+          process.stderr.write(`[harness-outcome] SDK recordDiscovery failed: ${e.message} — falling through to raw fetch\n`);
+        }
+      }
+
+      // Fallback: raw fetch
+      const harnessUrl =
+        process.env.ARIA_HIVE_RUNTIME_URL ||
+        process.env.ARIA_HARNESS_BASE_URL ||
+        process.env.ARIA_HARNESS_URL ||
+        'https://harness.ariasos.com';
+      let harnessToken = process.env.ARIA_HARNESS_TOKEN || process.env.ARIA_API_KEY || '';
+      try {
+        if (!harnessToken) {
+          if (existsSync(OWNER_TOKEN_PATH)) harnessToken = readFileSync(OWNER_TOKEN_PATH, 'utf8').trim();
+        }
+      } catch {}
+      if (!harnessToken) return;
+
+      fetch(`${harnessUrl}/api/harness/outcome-record`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          Authorization: `Bearer ${harnessToken}`,
+        },
+        body: JSON.stringify({
+          sessionId,
+          actionKind,
+          actionTarget,
+          actionShape: { tool: toolName, success },
+        }),
+      }).catch(() => {});
+    },
+  };
+}