@aria_asi/cli 0.2.26 → 0.2.29

package/hooks/aria-harness-via-sdk.mjs

@@ -25,6 +25,7 @@ const HOME = process.env.HOME || '/tmp';
 const LOG_FILE = `${HOME}/.claude/aria-harness-history.log`;
 const LAST_URL_CACHE = `${HOME}/.claude/.aria-harness-last-url`;
 const PACKET_CACHE = `${HOME}/.claude/.aria-harness-last-packet.json`;
+const SHARED_PACKET_CACHE = `${HOME}/.aria/.aria-harness-last-packet.json`;
 const HEADER_PREFIX = '🔐 Aria Harness';
 
 const args = process.argv.slice(2);
@@ -108,30 +109,36 @@ function saveCachedUrl(url) {
 
 function loadCachedPacket() {
   try {
-    if (existsSync(PACKET_CACHE)) {
-      const stat = readFileSync(PACKET_CACHE, 'utf8');
-      const ageSec = (Date.now() - (existsSync(PACKET_CACHE) ? statSync(PACKET_CACHE).mtimeMs : 0)) / 1000;
+    for (const packetPath of [SHARED_PACKET_CACHE, PACKET_CACHE]) {
+      if (!existsSync(packetPath)) continue;
+      const raw = readFileSync(packetPath, 'utf8');
+      const ageSec = (Date.now() - statSync(packetPath).mtimeMs) / 1000;
       if (ageSec < PACKET_CACHE_TTL_SEC) {
-        return { data: JSON.parse(stat), ageSec };
+        return { data: JSON.parse(raw), ageSec };
       }
     }
   } catch {}
   return null;
 }
 function saveCachedPacket(rawJson) {
-  try {
-    mkdirSync(dirname(PACKET_CACHE), { recursive: true });
-    writeFileSync(PACKET_CACHE, rawJson);
-  } catch {}
+  for (const packetPath of [PACKET_CACHE, SHARED_PACKET_CACHE]) {
+    try {
+      mkdirSync(dirname(packetPath), { recursive: true });
+      writeFileSync(packetPath, rawJson);
+    } catch {}
+  }
 }
 
 function buildUrlList() {
   const list = [];
   const cached = loadCachedUrl();
   if (cached) list.push(cached);
+  if (process.env.ARIA_HIVE_RUNTIME_URL) list.push(process.env.ARIA_HIVE_RUNTIME_URL.replace(/\/+$/, ''));
+  if (process.env.ARIA_HARNESS_BASE_URL) list.push(process.env.ARIA_HARNESS_BASE_URL.replace(/\/+$/, ''));
+  if (process.env.ARIA_HARNESS_URL) list.push(process.env.ARIA_HARNESS_URL.replace(/\/+$/, ''));
   if (process.env.ARIA_SOUL_URL) list.push(process.env.ARIA_SOUL_URL.replace(/\/+$/, ''));
-  list.push('http://localhost:30080', 'http://127.0.0.1:30080');
   list.push('http://aria-soul.aria.svc.cluster.local:8080');
+  list.push('http://localhost:30080', 'http://127.0.0.1:30080');
   // Direct ClusterIP from kubectl
   try {
     const r = spawnSync('kubectl', [
@@ -148,9 +155,9 @@ function buildUrlList() {
   return list.filter((u) => (seen.has(u) ? false : (seen.add(u), true)));
 }
 
-// SDK loader — dynamic-import the bundled HTTPHarnessClient from
-// ~/.claude/aria-sdk/index.js (installed by `aria connect claude-code`).
-// Module-cached after first load so we don't repeatedly read disk.
+// SDK loader — dynamic-import the bundled HTTPHarnessClient from the shared
+// ~/.aria/sdk bundle first, then client-local bundles. Module-cached after
+// first load so we don't repeatedly read disk.
 //
 // Doctrine (Hamza 2026-04-27): "isnt http harness client the fucking harness
 // we hsve been wprking on? YOU ARENT USING THAT AND BUILDING SPMETHING
@@ -159,19 +166,25 @@ function buildUrlList() {
 // (dev install without `aria connect claude-code`).
 let _SdkClassCache = null;
 let _SdkLookupAttempted = false;
+const SDK_CANDIDATES = [
+  `${HOME}/.aria/sdk/index.js`,
+  `${HOME}/.claude/aria-sdk/index.js`,
+  `${HOME}/.codex/aria-sdk/index.js`,
+];
 async function loadSdkClass() {
   if (_SdkClassCache) return _SdkClassCache;
   if (_SdkLookupAttempted) return null;
   _SdkLookupAttempted = true;
-  const sdkPath = `${HOME}/.claude/aria-sdk/index.js`;
-  if (!existsSync(sdkPath)) return null;
-  try {
-    const mod = await import(`file://${sdkPath}`);
-    if (mod.HTTPHarnessClient) {
-      _SdkClassCache = mod.HTTPHarnessClient;
-      return _SdkClassCache;
-    }
-  } catch {/* fall through to direct fetch */}
+  for (const sdkPath of SDK_CANDIDATES) {
+    if (!existsSync(sdkPath)) continue;
+    try {
+      const mod = await import(`file://${sdkPath}`);
+      if (mod.HTTPHarnessClient) {
+        _SdkClassCache = mod.HTTPHarnessClient;
+        return _SdkClassCache;
+      }
+    } catch {/* fall through to direct fetch */}
+  }
   return null;
 }
 

package/hooks/aria-import-resolution-gate.mjs

@@ -0,0 +1,330 @@
+#!/usr/bin/env node
+// Aria import-resolution gate — pre-deploy check that every TypeScript
+// import in the deploy candidate resolves against an actual exported
+// symbol on disk.
+//
+// Doctrine being enforced (memory:feedback_no_assumption_without_verification.md):
+//   "every behavioral claim must cite a verifiedAgainst source."
+//   The empty consciousness.ts crash on 2026-04-28 happened because
+//   event-bus.ts:11 imported `consciousness` from a file that existed
+//   but exported nothing. tsc allowed it (because the file matched as a
+//   module), the deploy passed admission policy, the runtime crashed.
+//
+//   This gate scans every import statement in the deploy candidate's
+//   source tree; for each, it verifies that the named symbol is
+//   actually exported from the resolved file. If any import targets a
+//   symbol that isn't exported, the gate fails and refuses the deploy.
+//
+// Runs as a PostToolUse hook on Edit/Write/NotebookEdit AND as a
+// pre-deploy assertion in scripts/deploy-service.sh.
+//
+// Mode 1 (post-tool-use): scan only the file just edited; report broken
+//   imports inline so the model sees them in the next turn's context.
+// Mode 2 (pre-deploy via CLI args): scan a whole subtree (passed as
+//   first positional arg); exit 13 if any broken import found.
+//
+// Audit log: ~/.claude/aria-import-resolution-gate.log
+
+import { readFileSync, existsSync, statSync, readdirSync, appendFileSync } from 'node:fs';
+import { dirname, resolve, join, extname } from 'node:path';
+import { homedir } from 'node:os';
+
+const HOME = process.env.HOME || homedir() || '/tmp';
+const LOG = `${HOME}/.claude/aria-import-resolution-gate.log`;
+
+function audit(decision, summary) {
+  try {
+    appendFileSync(LOG, `${new Date().toISOString()} ${decision} ${summary}\n`);
+  } catch {}
+}
+
+// Per feedback_no_timeouts_doctrine.md — no deadlines, real-error driven.
+// Per feedback_no_graceful_degradation.md — fail loudly, not silent-pass.
+
+const TS_IMPORT_RX =
+  /\bimport\s+(?:type\s+)?(?:(\w+)\s*,\s*)?(?:\{([^}]+)\}|\*\s+as\s+(\w+)|(\w+))\s+from\s+['"]([^'"]+)['"]/g;
+const TS_REEXPORT_RX =
+  /\bexport\s+(?:type\s+)?(?:\{([^}]+)\}|\*(?:\s+as\s+\w+)?)\s+from\s+['"]([^'"]+)['"]/g;
+
+const SOURCE_EXTS = ['.ts', '.tsx', '.js', '.mjs', '.cjs'];
+const INDEX_NAMES = SOURCE_EXTS.map((e) => `index${e}`);
+
+function resolveSpecifier(fromFile, specifier) {
+  // Skip node_modules / package imports — only resolve relative imports
+  // for now (those are the failure mode the consciousness.ts crash hit).
+  if (!specifier.startsWith('.') && !specifier.startsWith('/')) return null;
+
+  const baseDir = dirname(fromFile);
+  const abs = resolve(baseDir, specifier);
+
+  // Try exact path first.
+  if (existsSync(abs) && statSync(abs).isFile()) return abs;
+
+  // Try with each extension.
+  for (const ext of SOURCE_EXTS) {
+    const withExt = abs + ext;
+    if (existsSync(withExt) && statSync(withExt).isFile()) return withExt;
+    // Strip .js suffix and try .ts (TS resolution quirk).
+    if (specifier.endsWith('.js')) {
+      const tsCandidate = abs.replace(/\.js$/, '.ts');
+      if (existsSync(tsCandidate) && statSync(tsCandidate).isFile()) return tsCandidate;
+    }
+  }
+
+  // Try directory/index.{ts,tsx,...}.
+  if (existsSync(abs) && statSync(abs).isDirectory()) {
+    for (const idx of INDEX_NAMES) {
+      const indexPath = join(abs, idx);
+      if (existsSync(indexPath) && statSync(indexPath).isFile()) return indexPath;
+    }
+  }
+
+  return null;
+}
+
+function readFileSafe(path) {
+  try {
+    return readFileSync(path, 'utf-8');
+  } catch {
+    return null;
+  }
+}
+
+function extractExports(content) {
+  // Very conservative export extraction — matches:
+  //   export { foo, bar }
+  //   export const|let|var|function|class|interface|type|enum NAME
+  //   export default ...
+  //   export * from '...'
+  //   re-exports `export { foo } from '...'`
+  // Returns { named: Set<string>, hasDefault: boolean, hasStar: boolean }
+  const named = new Set();
+  let hasDefault = false;
+  let hasStar = false;
+
+  if (!content) return { named, hasDefault, hasStar };
+
+  // Strip block comments + line comments (rough; good enough for export detection).
+  const stripped = content
+    .replace(/\/\*[\s\S]*?\*\//g, '')
+    .replace(/\/\/[^\n]*/g, '');
+
+  // export { foo, bar as baz }
+  const namedListRx = /\bexport\s+(?:type\s+)?\{([^}]+)\}/g;
+  let m;
+  while ((m = namedListRx.exec(stripped))) {
+    for (const part of m[1].split(',')) {
+      const trimmed = part.trim();
+      if (!trimmed) continue;
+      const asMatch = trimmed.match(/^\S+\s+as\s+(\S+)$/);
+      const name = asMatch ? asMatch[1] : trimmed.split(/\s+/)[0];
+      if (name && /^\w+$/.test(name)) named.add(name);
+    }
+  }
+
+  // export const|let|var|function|async function|class|interface|type|enum NAME
+  const declRx =
+    /\bexport\s+(?:type\s+|async\s+)?(?:default\s+)?(?:const|let|var|function|class|interface|type|enum)\s+(\w+)/g;
+  while ((m = declRx.exec(stripped))) {
+    named.add(m[1]);
+  }
+
+  // export default
+  if (/\bexport\s+default\b/.test(stripped)) hasDefault = true;
+
+  // export * from '...'
+  if (/\bexport\s+\*(?:\s+as\s+\w+)?\s+from\b/.test(stripped)) hasStar = true;
+
+  return { named, hasDefault, hasStar };
+}
+
+function checkFileImports(filePath, visited = new Set()) {
+  if (visited.has(filePath)) return [];
+  visited.add(filePath);
+
+  const content = readFileSafe(filePath);
+  if (!content) return [];
+
+  // Skip non-source files.
+  if (!SOURCE_EXTS.includes(extname(filePath))) return [];
+
+  const violations = [];
+  let match;
+  TS_IMPORT_RX.lastIndex = 0;
+  while ((match = TS_IMPORT_RX.exec(content))) {
+    const [, defaultBinding, namedList, namespaceBinding, simpleNamed, specifier] = match;
+    const resolved = resolveSpecifier(filePath, specifier);
+    if (!resolved) continue; // package import — skip
+
+    const targetContent = readFileSafe(resolved);
+    if (!targetContent) {
+      violations.push({
+        file: filePath,
+        specifier,
+        resolved,
+        kind: 'unreadable',
+        message: `import '${specifier}' resolves to ${resolved} but file is unreadable`,
+      });
+      continue;
+    }
+
+    if (targetContent.trim().length === 0) {
+      violations.push({
+        file: filePath,
+        specifier,
+        resolved,
+        kind: 'empty_target',
+        message: `import '${specifier}' resolves to ${resolved} but file is EMPTY (no exports) — this is the consciousness.ts-class crash`,
+      });
+      continue;
+    }
+
+    const { named, hasDefault, hasStar } = extractExports(targetContent);
+
+    if (defaultBinding && !hasDefault && !hasStar) {
+      violations.push({
+        file: filePath,
+        specifier,
+        resolved,
+        kind: 'missing_default',
+        message: `import default '${defaultBinding}' from '${specifier}' but ${resolved} has no default export`,
+      });
+    }
+
+    if (namespaceBinding) {
+      // import * as ns — passes as long as the file has any exports.
+      if (named.size === 0 && !hasDefault && !hasStar) {
+        violations.push({
+          file: filePath,
+          specifier,
+          resolved,
+          kind: 'empty_namespace',
+          message: `import * as '${namespaceBinding}' from '${specifier}' but ${resolved} exports nothing`,
+        });
+      }
+    }
+
+    const explicitNamed = (namedList || simpleNamed || '').trim();
+    if (explicitNamed) {
+      const wantedNames = (namedList || simpleNamed)
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean)
+        .map((s) => {
+          const asMatch = s.match(/^(\S+)\s+as\s+\S+$/);
+          return asMatch ? asMatch[1] : s.split(/\s+/)[0];
+        })
+        .filter((s) => /^\w+$/.test(s));
+
+      for (const wanted of wantedNames) {
+        if (!named.has(wanted) && !hasStar) {
+          violations.push({
+            file: filePath,
+            specifier,
+            resolved,
+            kind: 'missing_named',
+            message: `import { ${wanted} } from '${specifier}' but ${resolved} does not export '${wanted}' (named exports: ${[...named].slice(0, 8).join(', ')}${named.size > 8 ? '…' : ''})`,
+          });
+        }
+      }
+    }
+  }
+
+  return violations;
+}
+
+function walkDir(dir, out = []) {
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  for (const ent of entries) {
+    if (ent.name === 'node_modules' || ent.name === 'dist' || ent.name.startsWith('.')) continue;
+    const p = join(dir, ent.name);
+    if (ent.isDirectory()) walkDir(p, out);
+    else if (SOURCE_EXTS.includes(extname(ent.name))) out.push(p);
+  }
+  return out;
+}
+
+// ── Mode dispatch ────────────────────────────────────────────────────────
+
+const args = process.argv.slice(2);
+
+if (args.length > 0) {
+  // Mode 2: pre-deploy CLI scan.
+  const target = resolve(args[0]);
+  const targetIsDir = existsSync(target) && statSync(target).isDirectory();
+  const files = targetIsDir ? walkDir(target) : [target];
+
+  let totalViolations = 0;
+  const allViolations = [];
+  for (const f of files) {
+    const violations = checkFileImports(f);
+    if (violations.length > 0) {
+      allViolations.push(...violations);
+      totalViolations += violations.length;
+    }
+  }
+
+  if (totalViolations > 0) {
+    console.error(`\n❌ aria-import-resolution-gate: ${totalViolations} broken imports across ${files.length} files`);
+    for (const v of allViolations) {
+      console.error(`  [${v.kind}] ${v.file}: ${v.message}`);
+    }
+    audit(`block-deploy violations=${totalViolations} target=${target}`, '');
+    process.exit(13);
+  }
+
+  console.log(`✓ aria-import-resolution-gate: ${files.length} files scanned, all imports resolve to real exports`);
+  audit(`allow-deploy files=${files.length} target=${target}`, '');
+  process.exit(0);
+}
+
+// Mode 1: PostToolUse hook on Edit/Write/NotebookEdit.
+let stdin = '';
+try {
+  for await (const chunk of process.stdin) stdin += chunk;
+} catch {}
+
+let event;
+try {
+  event = JSON.parse(stdin);
+} catch {
+  process.exit(0); // Malformed input — let it through; this gate is informational in hook mode.
+}
+
+const toolName = event.tool_name ?? event.toolName ?? '';
+if (!['Edit', 'Write', 'NotebookEdit'].includes(toolName)) process.exit(0);
+
+const filePath =
+  event.tool_input?.file_path ??
+  event.toolInput?.file_path ??
+  event.tool_input?.notebook_path ??
+  event.toolInput?.notebook_path;
+
+if (!filePath || !SOURCE_EXTS.includes(extname(filePath))) process.exit(0);
+if (!existsSync(filePath)) process.exit(0);
+
+const violations = checkFileImports(filePath);
+if (violations.length === 0) {
+  audit(`allow-edit ${filePath}`, '');
+  process.exit(0);
+}
+
+const message = [
+  `aria-import-resolution-gate detected ${violations.length} broken imports in ${filePath}:`,
+  ...violations.map((v) => `  [${v.kind}] ${v.message}`),
+  '',
+  'These imports compile under tsc but will crash at runtime — the consciousness.ts-class failure mode.',
+  'Per memory:feedback_no_assumption_without_verification.md, fix the export side BEFORE shipping.',
+].join('\n');
+
+audit(`flag-edit ${filePath} violations=${violations.length}`, '');
+console.error(message);
+// Hook mode is INFORMATIONAL (exit 0) so the model sees the message but
+// can decide whether to fix immediately or proceed. The pre-deploy mode
+// is the structural enforcement (exit 13 blocks the deploy).
+process.exit(0);

package/hooks/aria-outcome-record.mjs

@@ -39,7 +39,11 @@ if (toolName === 'Bash') {
 }
 
 // Tier-aware auth: client license.json overrides env vars
-const harnessUrl = process.env.ARIA_HARNESS_URL || 'http://192.168.4.25:30080';
+const harnessUrl =
+  process.env.ARIA_HIVE_RUNTIME_URL ||
+  process.env.ARIA_HARNESS_BASE_URL ||
+  process.env.ARIA_HARNESS_URL ||
+  'https://harness.ariasos.com';
 let harnessToken = process.env.ARIA_HARNESS_TOKEN || process.env.ARIA_API_KEY || '';
 let isClientTier = false;
 try {