@aria_asi/cli 0.2.26 → 0.2.30

package/bin/aria.js

@@ -8,7 +8,32 @@ import { AriaChat } from '../dist/aria-connector/src/chat.js';
 import { checkHarnessHealth } from '../dist/aria-connector/src/harness-client.js';
 import { login, loginOwner, status, logout, revoke } from '../dist/aria-connector/src/auth-commands.js';
 import { connectClaudeCode } from '../dist/aria-connector/src/connectors/claude-code.js';
+import { connectCodex } from '../dist/aria-connector/src/connectors/codex.js';
+import { connectOpenCode } from '../dist/aria-connector/src/connectors/opencode.js';
+import { connectCursor } from '../dist/aria-connector/src/connectors/cursor.js';
+import {
+  installCodebaseAwarenessDaemon,
+  startCodebaseAwarenessDaemon,
+  runCodebaseAwarenessScan,
+  readCodebaseAwarenessState,
+} from '../dist/aria-connector/src/connectors/codebase-awareness.js';
+import {
+  installRepoGuardDaemon,
+  startRepoGuardDaemon,
+  readGuardState,
+} from '../dist/aria-connector/src/connectors/repo-guard.js';
+import { installRepoDoctrineGitHooks } from '../dist/aria-connector/src/connectors/repo-git-hooks.js';
+import { installSharedRuntime } from '../dist/aria-connector/src/connectors/runtime.js';
+import {
+  installAriaSyncDaemon,
+  runSyncOnce,
+  startSyncDaemon,
+  readSyncDaemonState,
+} from '../dist/aria-connector/src/connectors/syncd.js';
 import { maybePrintUpdateNotice, checkForUpdate } from '../dist/aria-connector/src/self-update.js';
+import { pathToFileURL } from 'node:url';
+import { homedir } from 'node:os';
+import { execFileSync } from 'node:child_process';
 
 // ── Self-update notice (non-blocking, rate-limited once per 24h) ──
 // Fires-and-forgets — the registry check runs in parallel with command
@@ -19,6 +44,33 @@ if (process.env.ARIA_SELF_UPDATE !== 'off') {
   maybePrintUpdateNotice().catch(() => {});
 }
 
+// ── Aristotle 28 + Noor cognitive lifecycle hook (#98) ──────────────────
+// Every CLI command lifecycle fires through `wrapCliCommand` so the 28
+// Aristotle modules + Noor cognitives surface (Fitrah hard-gate, 8-lens,
+// Predictor, SelfReflection, Tafakkur projection, soul-charge telemetry,
+// Ghazali alignment) every time `aria <anything>` runs. Fail-open by
+// construction — when the harness route is unreachable the wrapper falls
+// through to validateOutput so at least post-stage gates still fire.
+// Kill-switch: ARIA_NOOR_HOOK=off env.
+let aristotleNoorWire = null;
+async function loadAristotleNoorWire() {
+  if (aristotleNoorWire !== null) return aristotleNoorWire;
+  if (process.env.ARIA_NOOR_HOOK === 'off') {
+    aristotleNoorWire = { runAristotleNoorOnSDK: async () => ({ dispatched: false, fired: [] }), wrapCliCommand: async (_s, _e, fn) => ({ result: await fn(), coverage: { fired: [], dispatched: false } }) };
+    return aristotleNoorWire;
+  }
+  try {
+    aristotleNoorWire = await import('../dist/aria-connector/src/lib/aristotle-noor-wire.js');
+  } catch {
+    // Build artifact missing — fail-open so the CLI still runs.
+    aristotleNoorWire = { runAristotleNoorOnSDK: async () => ({ dispatched: false, fired: [] }), wrapCliCommand: async (_s, _e, fn) => ({ result: await fn(), coverage: { fired: [], dispatched: false } }) };
+  }
+  return aristotleNoorWire;
+}
+function makeEmissionId(surface) {
+  return `cli_${surface}_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
+}
+
 // ── Auth + install subcommands — handled BEFORE the chat flow.
 // Hamza 2026-04-26: license-aware CLI for client-tonight ship +
 // self-installing harness via install-hooks.
@@ -43,31 +95,346 @@ if (command === 'check-update') {
     console.error(`I hit an unexpected error checking for updates: ${err && err.message ? err.message : err}`);
     process.exit(1);
   });
+} else if (command === 'github') {
+  const subCommand = args[0] || 'connect';
+  const { connectGitHub, getGitHubStatus } = await import('../dist/aria-connector/src/github-connect.js');
+
+  if (subCommand === 'help' || subCommand === '--help' || subCommand === '-h') {
+    console.log('');
+    console.log('  aria github connect   Authenticate GitHub through gh and wire npm for @aria_asi packages.');
+    console.log('  aria github status    Show whether gh auth and npm package wiring are ready.');
+    console.log('');
+    console.log('  This is optional. Most clients should install Aria without GitHub and only run this if they want GitHub integration or GitHub Packages access.');
+    console.log('');
+    process.exit(0);
+  }
+
+  if (subCommand === 'status') {
+    const status = getGitHubStatus();
+    console.log(`gh_installed=${status.ghInstalled ? 'yes' : 'no'}`);
+    console.log(`gh_authenticated=${status.authenticated ? 'yes' : 'no'}`);
+    console.log(`npm_scope_configured=${status.npmrcConfigured ? 'yes' : 'no'}`);
+    process.exit(status.ghInstalled && status.authenticated ? 0 : 1);
+  }
+
+  if (subCommand === 'connect') {
+    try {
+      const result = connectGitHub({ interactive: true });
+      if (!result.ok) {
+        console.error(result.error || 'GitHub connect failed');
+        process.exit(1);
+      }
+      for (const line of result.logs) console.log(`  ${line}`);
+      console.log('  GitHub is now connected for optional Aria package and repo workflows.');
+      process.exit(0);
+    } catch (err) {
+      console.error(`I couldn't complete GitHub connect: ${err && err.message ? err.message : err}`);
+      process.exit(1);
+    }
+  }
+
+  console.error(`Unknown github subcommand: ${subCommand}`);
+  console.error('Run: aria github --help');
+  process.exit(1);
 } else if (command === 'install-hooks' || command === 'connect') {
-  // Canonical install path is connectClaudeCode (the connector). Removed
-  // the parallel src/install-hooks.ts duplicate per Hamza 2026-04-27 audit
-  // — connectors/claude-code.ts handles everything: harness-via-sdk hook,
-  // pre-tool-gate, stop-gate, preprompt-consult, settings.json merge-safe
-  // wiring, systemPromptPrefix injection, and additionalDirectories.
+  // Canonical install path connects Claude Code, OpenCode, Codex, and Cursor.
+  // connectClaudeCode → SDK + hooks + settings.json
+  // connectOpenCode   → plugins + config.json + AGENTS.md
+  // connectCodex      → SDK + local node package + skill
   const force = args.includes('--force');
-  // Build a minimal AriaConfig so connectClaudeCode can render the
-  // systemPromptPrefix block. If an existing config exists, use it.
   let config;
   try {
     config = loadConfig();
   } catch {
     config = { repositories: [], schemaImages: {} };
   }
-  connectClaudeCode(config, { force }).then((logs) => {
+  loadAristotleNoorWire().then((wire) => wire.wrapCliCommand(
+    'cli-connect',
+    makeEmissionId('connect'),
+    async () => {
+      const allLogs = [];
+      // Shared runtime path — universal localhost sidecar for any client.
+      const runtimeLogs = await installSharedRuntime();
+      allLogs.push(...runtimeLogs);
+      // Claude Code path
+      const claudeLogs = await connectClaudeCode(config, { force });
+      allLogs.push(...claudeLogs);
+      // OpenCode path
+      const opencodeLogs = await connectOpenCode(config);
+      allLogs.push(...opencodeLogs);
+      // Codex path
+      const codexLogs = await connectCodex(config);
+      allLogs.push(...codexLogs);
+      // Cursor path — wire every linked repository
+      if (config.repositories?.length) {
+        for (const repo of config.repositories) {
+          const cursorLogs = await connectCursor(config, repo.path);
+          allLogs.push(...cursorLogs);
+        }
+      } else {
+        // Wire current working directory as fallback
+        const cursorLogs = await connectCursor(config);
+        allLogs.push(...cursorLogs);
+      }
+      const repoGateLogs = await installRepoDoctrineGitHooks(config, process.cwd());
+      allLogs.push(...repoGateLogs);
+      const repoGuardLogs = await installRepoGuardDaemon(config, process.cwd());
+      allLogs.push(...repoGuardLogs);
+      const codebaseAwarenessLogs = await installCodebaseAwarenessDaemon(config, process.cwd());
+      allLogs.push(...codebaseAwarenessLogs);
+      if (process.env.ARIA_SKIP_SYNCD_INSTALL !== '1') {
+        const syncLogs = await installAriaSyncDaemon({ sourceRoot: process.cwd() });
+        allLogs.push(...syncLogs);
+      }
+      return allLogs;
+    },
+    { metadata: { force, command: 'connect' } },
+  )).then(({ result: logs }) => {
     for (const line of logs) console.log(`  ${line}`);
-    console.log("Your Claude Code is now harness-bound — every Bash, Edit, Write, and Stop event runs through my cognition gates. Open a new Claude Code session to start.");
+    console.log("Your Claude Code, OpenCode, Codex, and Cursor are now synced from the same harness package. Open a new session to start.");
     process.exit(0);
   }).catch((err) => {
     console.error(`I hit an unexpected error: ${err && err.message ? err.message : err}`);
     process.exit(1);
   });
+} else if (command === 'runtime') {
+  const subCommand = args[0] || 'help';
+  const runtimeRoot = `${homedir()}/.aria/runtime`;
+  const runtimeEntry = `${runtimeRoot}/service.mjs`;
+  const runtimeUrl = process.env.ARIA_RUNTIME_URL || 'http://127.0.0.1:4319';
+  const runtimeService = 'aria-mounted-runtime.service';
+
+  if (subCommand === 'help' || subCommand === '--help' || subCommand === '-h') {
+    console.log('');
+    console.log('  aria runtime start   Start the shared Aria localhost runtime in the foreground.');
+    console.log('  aria runtime status  Check the shared runtime health endpoint.');
+    console.log('  aria runtime mount   Print the mount env vars and local paths.');
+    console.log('  aria runtime restart Restart the managed mounted runtime service.');
+    console.log('  aria runtime stop    Stop the managed mounted runtime service.');
+    console.log('  aria runtime logs    Tail the managed mounted runtime logs.');
+    console.log('');
+    process.exit(0);
+  }
+
+  if (subCommand === 'mount') {
+    console.log(`ARIA_RUNTIME_URL=${runtimeUrl}`);
+    const harnessUrl =
+      process.env.ARIA_HIVE_RUNTIME_URL ||
+      process.env.ARIA_HARNESS_BASE_URL ||
+      process.env.ARIA_HARNESS_URL ||
+      'https://harness.ariasos.com';
+    console.log(`ARIA_HIVE_RUNTIME_URL=${harnessUrl}`);
+    console.log(`ARIA_HARNESS_URL=${harnessUrl}`);
+    console.log(`runtime_root=${runtimeRoot}`);
+    console.log(`runtime_entry=${runtimeEntry}`);
+    process.exit(0);
+  }
+
+  if (subCommand === 'status') {
+    fetch(`${runtimeUrl}/health`).then(async (response) => {
+      const payload = await response.json().catch(() => ({}));
+      console.log(JSON.stringify(payload, null, 2));
+      process.exit(response.ok ? 0 : 1);
+    }).catch((err) => {
+      console.error(`I couldn't reach the runtime at ${runtimeUrl}: ${err && err.message ? err.message : err}`);
+      process.exit(1);
+    });
+  } else if (subCommand === 'start') {
+    import(pathToFileURL(runtimeEntry).href).then(({ startRuntimeServer }) => {
+      return startRuntimeServer();
+    }).catch((err) => {
+      console.error(`I couldn't start the runtime: ${err && err.message ? err.message : err}`);
+      process.exit(1);
+    });
+  } else if (subCommand === 'restart') {
+    try {
+      execFileSync('/bin/systemctl', ['--user', 'restart', runtimeService], { stdio: 'inherit' });
+      process.exit(0);
+    } catch (err) {
+      console.error(`I couldn't restart ${runtimeService}: ${err && err.message ? err.message : err}`);
+      process.exit(1);
+    }
+  } else if (subCommand === 'stop') {
+    try {
+      execFileSync('/bin/systemctl', ['--user', 'stop', runtimeService], { stdio: 'inherit' });
+      process.exit(0);
+    } catch (err) {
+      console.error(`I couldn't stop ${runtimeService}: ${err && err.message ? err.message : err}`);
+      process.exit(1);
+    }
+  } else if (subCommand === 'logs') {
+    try {
+      execFileSync('/bin/journalctl', ['--user', '-u', runtimeService, '-n', '80', '--no-pager'], { stdio: 'inherit' });
+      process.exit(0);
+    } catch (err) {
+      console.error(`I couldn't read ${runtimeService} logs: ${err && err.message ? err.message : err}`);
+      process.exit(1);
+    }
+  } else {
+    console.error(`Unknown runtime subcommand: ${subCommand}`);
+    process.exit(1);
+  }
+} else if (command === 'codebase-awareness') {
+  const subCommand = args[0] || 'help';
+  const service = 'aria-codebase-awareness.service';
+
+  if (subCommand === 'help' || subCommand === '--help' || subCommand === '-h') {
+    console.log('');
+    console.log('  aria codebase-awareness start    Watch linked repos and keep schema images warm.');
+    console.log('  aria codebase-awareness scan     Run a one-shot repo scan now.');
+    console.log('  aria codebase-awareness status   Print the last codebase awareness state snapshot.');
+    console.log('  aria codebase-awareness restart  Restart the codebase awareness service.');
+    console.log('  aria codebase-awareness logs     Tail the codebase awareness logs.');
+    console.log('');
+    process.exit(0);
+  }
+
+  if (subCommand === 'status') {
+    console.log(JSON.stringify(readCodebaseAwarenessState(), null, 2));
+    process.exit(0);
+  }
+
+  if (subCommand === 'scan') {
+    runCodebaseAwarenessScan({ fallbackRepoPath: process.cwd() }).then((result) => {
+      console.log(JSON.stringify(result, null, 2));
+      process.exit(0);
+    }).catch((err) => {
+      console.error(`I couldn't scan the codebase: ${err && err.message ? err.message : err}`);
+      process.exit(1);
+    });
+  } else if (subCommand === 'start') {
+    startCodebaseAwarenessDaemon({ fallbackRepoPath: process.cwd() }).catch((err) => {
+      console.error(`I couldn't start codebase awareness: ${err && err.message ? err.message : err}`);
+      process.exit(1);
+    });
+  } else if (subCommand === 'restart') {
+    try {
+      execFileSync('/bin/systemctl', ['--user', 'restart', service], { stdio: 'inherit' });
+      process.exit(0);
+    } catch (err) {
+      console.error(`I couldn't restart ${service}: ${err && err.message ? err.message : err}`);
+      process.exit(1);
+    }
+  } else if (subCommand === 'logs') {
+    try {
+      execFileSync('/bin/journalctl', ['--user', '-u', service, '-n', '80', '--no-pager'], { stdio: 'inherit' });
+      process.exit(0);
+    } catch (err) {
+      console.error(`I couldn't read ${service} logs: ${err && err.message ? err.message : err}`);
+      process.exit(1);
+    }
+  } else {
+    console.error(`Unknown codebase-awareness subcommand: ${subCommand}`);
+    process.exit(1);
+  }
+} else if (command === 'syncd') {
+  const subCommand = args[0] || 'help';
+  const syncService = 'aria-syncd.service';
+
+  if (subCommand === 'help' || subCommand === '--help' || subCommand === '-h') {
+    console.log('');
+    console.log('  aria syncd start    Watch Claude/harness/runtime sources and auto-sync all clients.');
+    console.log('  aria syncd once     Run one sync cycle now.');
+    console.log('  aria syncd status   Print the last sync daemon state snapshot.');
+    console.log('  aria syncd restart  Restart the sync daemon service.');
+    console.log('  aria syncd logs     Tail the sync daemon logs.');
+    console.log('');
+    process.exit(0);
+  }
+
+  if (subCommand === 'status') {
+    console.log(JSON.stringify(readSyncDaemonState(), null, 2));
+    process.exit(0);
+  }
+
+  if (subCommand === 'once') {
+    runSyncOnce({ sourceRoot: process.cwd(), reason: 'cli-once' }).then((result) => {
+      console.log(JSON.stringify(result, null, 2));
+      process.exit(0);
+    }).catch((err) => {
+      console.error(`I couldn't complete the sync: ${err && err.message ? err.message : err}`);
+      process.exit(1);
+    });
+  } else if (subCommand === 'restart') {
+    try {
+      execFileSync('/bin/systemctl', ['--user', 'restart', syncService], { stdio: 'inherit' });
+      process.exit(0);
+    } catch (err) {
+      console.error(`I couldn't restart ${syncService}: ${err && err.message ? err.message : err}`);
+      process.exit(1);
+    }
+  } else if (subCommand === 'logs') {
+    try {
+      execFileSync('/bin/journalctl', ['--user', '-u', syncService, '-n', '80', '--no-pager'], { stdio: 'inherit' });
+      process.exit(0);
+    } catch (err) {
+      console.error(`I couldn't read ${syncService} logs: ${err && err.message ? err.message : err}`);
+      process.exit(1);
+    }
+  } else if (subCommand === 'start') {
+    startSyncDaemon({ sourceRoot: process.cwd(), reason: 'cli-start' }).catch((err) => {
+      console.error(`I couldn't start syncd: ${err && err.message ? err.message : err}`);
+      process.exit(1);
+    });
+  } else {
+    console.error(`Unknown syncd subcommand: ${subCommand}`);
+    process.exit(1);
+  }
+} else if (command === 'repo-guard') {
+  const subCommand = args[0] || 'help';
+  const guardService = 'aria-repo-guard.service';
+
+  if (subCommand === 'help' || subCommand === '--help' || subCommand === '-h') {
+    console.log('');
+    console.log('  aria repo-guard start    Watch doctrine-bound repos and block/quarantine violating writes.');
+    console.log('  aria repo-guard status   Print the last repo guard state snapshot.');
+    console.log('  aria repo-guard restart  Restart the repo guard service.');
+    console.log('  aria repo-guard stop     Stop the repo guard service.');
+    console.log('  aria repo-guard logs     Tail the repo guard logs.');
+    console.log('');
+    process.exit(0);
+  }
+
+  if (subCommand === 'status') {
+    console.log(JSON.stringify(readGuardState(), null, 2));
+    process.exit(0);
+  }
+
+  if (subCommand === 'restart') {
+    try {
+      execFileSync('/bin/systemctl', ['--user', 'restart', guardService], { stdio: 'inherit' });
+      process.exit(0);
+    } catch (err) {
+      console.error(`I couldn't restart ${guardService}: ${err && err.message ? err.message : err}`);
+      process.exit(1);
+    }
+  } else if (subCommand === 'stop') {
+    try {
+      execFileSync('/bin/systemctl', ['--user', 'stop', guardService], { stdio: 'inherit' });
+      process.exit(0);
+    } catch (err) {
+      console.error(`I couldn't stop ${guardService}: ${err && err.message ? err.message : err}`);
+      process.exit(1);
+    }
+  } else if (subCommand === 'logs') {
+    try {
+      execFileSync('/bin/journalctl', ['--user', '-u', guardService, '-n', '80', '--no-pager'], { stdio: 'inherit' });
+      process.exit(0);
+    } catch (err) {
+      console.error(`I couldn't read ${guardService} logs: ${err && err.message ? err.message : err}`);
+      process.exit(1);
+    }
+  } else if (subCommand === 'start') {
+    startRepoGuardDaemon().catch((err) => {
+      console.error(`I couldn't start repo-guard: ${err && err.message ? err.message : err}`);
+      process.exit(1);
+    });
+  } else {
+    console.error(`Unknown repo-guard subcommand: ${subCommand}`);
+    process.exit(1);
+  }
 } else if (command === 'login' || command === 'status' || command === 'logout' || command === 'revoke') {
-  const dispatch = async () => {
+  async function runAuthCommand(command, args) {
     switch (command) {
       case 'login': {
         const arg = args[0];
@@ -143,6 +510,8 @@ if (command === 'check-update') {
         const result = await status();
         if (!result.loggedIn) {
           console.log("I don't see a license on this machine. Try 'aria login <token>' or 'aria login --anthropic'.");
+        } else if (result.owner) {
+          console.log(`Owner mode is active on this machine${result.expiresAt ? `, expires ${result.expiresAt}` : ''}.`);
         } else if (result.revoked) {
           console.log(`Your license was revoked. You'll need to log in again with a fresh token.`);
         } else {
@@ -169,11 +538,748 @@ if (command === 'check-update') {
         return;
       }
     }
-  };
-  dispatch().catch((err) => {
+  }
+  runAuthCommand(command, args).then(() => {
+    process.exit(0);
+  }).catch((err) => {
     console.error(`Auth command failed: ${err && err.message ? err.message : err}`);
     process.exit(1);
   });
+} else if (command === 'dalio') {
+  // ── Dalio decision-log subcommands ─────────────────────────────────────
+  // aria dalio record --decision X --why Y --expected '{...}'
+  // aria dalio list [--outcome pending|success|failure] [--limit N]
+  // aria dalio evaluate
+  // aria dalio blockers
+  const {
+    recordDalio,
+    evaluatePendingDecisions,
+    getBlockingIncidents,
+  } = await import('../dist/aria-connector/src/decisions.js');
+
+  const subCmd = args[0];
+
+  if (!subCmd || subCmd === '--help' || subCmd === '-h') {
+    console.log('');
+    console.log('  aria dalio record --decision <text> --why <reasoning> --expected <json>');
+    console.log('                   [--type <architecture|implementation|feature|bugfix|refactor|config|strategy|financial|operational|tactical|emergency>]');
+    console.log('                   [--category <deals|leads|operations|finance|code|infrastructure|marketing|compliance|team|product>]');
+    console.log('                   [--context <text>]');
+    console.log('  aria dalio list   [--outcome pending|success|failure|neutral] [--limit N]');
+    console.log('  aria dalio evaluate  — trigger evaluation of pending decisions');
+    console.log('  aria dalio blockers  — list blocking incidents for this session');
+    console.log('');
+    console.log('  <json> for --expected: \'{"predicate":"p95 < 200ms","measurable_type":"numeric","threshold":200}\'');
+    console.log('  measurable_type: numeric | boolean | state_string');
+    console.log('  Qualitative predicates (better/improved/should work) are rejected by the gate.');
+    console.log('');
+    process.exit(0);
+  }
+
+  if (subCmd === 'record') {
+    const getFlag = (flag) => {
+      const idx = args.indexOf(flag);
+      return idx !== -1 ? args[idx + 1] : undefined;
+    };
+
+    const decision = getFlag('--decision');
+    const why = getFlag('--why');
+    const expectedRaw = getFlag('--expected');
+    const decisionType = getFlag('--type') ?? 'implementation';
+    const category = getFlag('--category') ?? 'code';
+    const context = getFlag('--context') ?? decision;
+
+    if (!decision || !why || !expectedRaw) {
+      console.error('  Missing required flags: --decision, --why, --expected');
+      console.error('  Run: aria dalio record --help');
+      process.exit(1);
+    }
+
+    let expectedParsed;
+    try {
+      expectedParsed = JSON.parse(expectedRaw);
+    } catch {
+      console.error(`  Could not parse --expected as JSON: ${expectedRaw}`);
+      process.exit(1);
+    }
+
+    const result = await recordDalio({
+      decision_type: decisionType,
+      category,
+      context,
+      decision,
+      reasoning: why,
+      expected_outcome: expectedParsed,
+      outcome: 'pending',
+      source: 'aria-cli',
+    });
+
+    console.log(`  Dalio decision logged. ID: ${result.decision_id}`);
+    if (result.quality_score != null) console.log(`  Quality score: ${result.quality_score}`);
+    process.exit(0);
+
+  } else if (subCmd === 'list') {
+    const getFlag = (flag) => {
+      const idx = args.indexOf(flag);
+      return idx !== -1 ? args[idx + 1] : undefined;
+    };
+
+    const outcome = getFlag('--outcome');
+    const limit = parseInt(getFlag('--limit') ?? '20', 10);
+    const baseUrl =
+      process.env.ARIA_HIVE_RUNTIME_URL ??
+      process.env.ARIA_HARNESS_BASE_URL ??
+      process.env.ARIA_HARNESS_URL ??
+      'https://harness.ariasos.com';
+
+    let url = `${baseUrl}/api/decisions?limit=${limit}`;
+    if (outcome) url += `&outcome=${encodeURIComponent(outcome)}`;
+
+    const { default: fs } = await import('node:fs');
+    const { default: path } = await import('node:path');
+    const { homedir } = await import('node:os');
+    const ownerPath = path.join(homedir(), '.aria', 'owner-token');
+    const headers = { 'Content-Type': 'application/json' };
+    if (fs.existsSync(ownerPath)) {
+      const jwt = fs.readFileSync(ownerPath, 'utf-8').trim();
+      if (jwt) { headers['Authorization'] = `Bearer ${jwt}`; headers['x-aria-owner'] = 'true'; }
+    }
+
+    const resp = await fetch(url, { headers });
+    if (!resp.ok) {
+      console.error(`  Failed to fetch decisions: HTTP ${resp.status}`);
+      process.exit(1);
+    }
+    const data = await resp.json();
+    const decisions = data.decisions ?? data.data ?? [];
+    if (decisions.length === 0) {
+      console.log('  No decisions found.');
+    } else {
+      for (const d of decisions) {
+        const exp = d.expected_outcome ? ` | expected: ${JSON.stringify(d.expected_outcome)}` : '';
+        console.log(`  [${d.outcome ?? 'pending'}] ${d.id}  ${d.decision?.slice(0, 60) ?? ''}${exp}`);
+      }
+    }
+    process.exit(0);
+
+  } else if (subCmd === 'evaluate') {
+    const result = await evaluatePendingDecisions();
+    console.log(`  Evaluated ${result.evaluated} decisions.`);
+    if (result.failures) console.log(`  Failures: ${result.failures}`);
+    if (result.updated != null) console.log(`  Updated: ${result.updated}`);
+    if (result.learning_signals != null) console.log(`  Learning signals: ${result.learning_signals}`);
+    process.exit(0);
+
+  } else if (subCmd === 'blockers') {
+    const sessionId = process.env.ARIA_SESSION_ID ?? 'cli-default';
+    const incidents = await getBlockingIncidents(sessionId);
+    if (incidents.length === 0) {
+      console.log('  No blocking incidents for this session.');
+    } else {
+      for (const inc of incidents) {
+        console.log(`  [BLOCKING] ${inc.id}  severity=${inc.severity}  ${inc.description}`);
+      }
+    }
+    process.exit(0);
+
+  } else {
+    console.error(`  Unknown dalio subcommand: ${subCmd}`);
+    console.error('  Run: aria dalio --help');
+    process.exit(1);
+  }
+
+} else if (command === 'hive') {
+  // ── Hive session-coordination subcommands ──────────────────────────────
+  // aria hive lock claim --file PATH --ttl MINUTES
+  // aria hive lock release --lock-id ID
+  // aria hive lock list --file PATH
+  // aria hive msg send --to SESSION --topic T --body JSON
+  // aria hive msg unread
+  const {
+    claimSessionLock,
+    releaseSessionLock,
+    heartbeatSessionLock,
+    checkSessionLockDrift,
+    readSessionMessages,
+    postSessionMessage,
+  } = await import('../dist/aria-connector/src/decisions.js');
+
+  const subCmd = args[0];   // 'lock' | 'msg'
+  const subSubCmd = args[1]; // 'claim' | 'release' | 'list' | 'heartbeat' | 'drift' | 'send' | 'unread'
+
+  const getFlag = (flag) => {
+    const idx = args.indexOf(flag);
+    return idx !== -1 ? args[idx + 1] : undefined;
+  };
+
+  if (!subCmd || subCmd === '--help' || subCmd === '-h') {
+    console.log('');
+    console.log('  aria hive lock claim   --file PATH --ttl MINUTES [--scope-kind file|directory|module|symbol] [--operation additive|refactor|delete|rename]');
+    console.log('  aria hive lock release --lock-id ID');
+    console.log('  aria hive lock list    --file PATH');
+    console.log('  aria hive lock heartbeat --lock-id ID [--ttl MINUTES]');
+    console.log('  aria hive lock drift   --lock-id ID [--file PATH]');
+    console.log('  aria hive msg send     --to SESSION --topic TOPIC --body JSON');
+    console.log('  aria hive msg unread');
+    console.log('');
+    console.log('  Use ARIA_SESSION_ID env var to set your session identity.');
+    console.log('  Locks expire after ttl minutes. Always release when done editing.');
+    console.log('');
+    process.exit(0);
+  }
+
+  if (subCmd === 'lock') {
+    if (!subSubCmd || subSubCmd === '--help') {
+      console.log('  aria hive lock claim --file PATH --ttl MINUTES [--scope-kind file|directory|module|symbol] [--scope-path PATH] [--operation additive|refactor|delete|rename]');
+      console.log('  aria hive lock release --lock-id ID');
+      console.log('  aria hive lock list --file PATH');
+      console.log('  aria hive lock heartbeat --lock-id ID [--ttl MINUTES]');
+      console.log('  aria hive lock drift --lock-id ID [--file PATH]');
+      process.exit(0);
+    }
+
+    if (subSubCmd === 'claim') {
+      const filePath = getFlag('--file');
+      const ttlStr = getFlag('--ttl');
+      const intentSummary = getFlag('--intent') ?? 'CLI lock claim request';
+      const sessionId = process.env.ARIA_SESSION_ID ?? `cli-${Date.now()}`;
+      const scopeKind = getFlag('--scope-kind');
+      const scopePath = getFlag('--scope-path');
+      const operationKind = getFlag('--operation') ?? 'additive';
+      const urgency = getFlag('--urgency') ?? 'normal';
+      const mode = getFlag('--mode');
+      const mergeOrderRaw = getFlag('--merge-order');
+      const staleAfterRaw = getFlag('--stale-after');
+      const takeoverIfStale = args.includes('--takeover-if-stale');
+
+      if (!filePath || !ttlStr) {
+        console.error('  Missing required flags: --file, --ttl');
+        process.exit(1);
+      }
+
+      const ttlMinutes = parseInt(ttlStr, 10);
+      if (isNaN(ttlMinutes) || ttlMinutes <= 0) {
+        console.error('  --ttl must be a positive integer (minutes)');
+        process.exit(1);
+      }
+      const mergeOrder = mergeOrderRaw ? parseInt(mergeOrderRaw, 10) : undefined;
+      const staleAfterSeconds = staleAfterRaw ? parseInt(staleAfterRaw, 10) : undefined;
+
+      // ── Auto-coordination on 409 conflict ─────────────────────────────────
+      // Per memory:feedback_hive_session_coordination.md and task deliverable 3:
+      // on 409 conflict, automatically post a lock_conflict_request session-message
+      // to the conflicting session and exit with code 11 (conflict, message posted)
+      // so scripts can branch on it. No silent-fail per no-graceful-degradation doctrine.
+      let claimResp;
+      const baseUrl =
+        process.env.ARIA_HIVE_RUNTIME_URL ??
+        process.env.ARIA_HARNESS_BASE_URL ??
+        process.env.ARIA_HARNESS_URL ??
+        'https://harness.ariasos.com';
+      const { default: fs } = await import('node:fs');
+      const { default: path } = await import('node:path');
+      const { homedir } = await import('node:os');
+      const ownerPath = path.join(homedir(), '.aria', 'owner-token');
+      const claimHeaders = { 'Content-Type': 'application/json' };
+      if (fs.existsSync(ownerPath)) {
+        const jwt = fs.readFileSync(ownerPath, 'utf-8').trim();
+        if (jwt) { claimHeaders['Authorization'] = `Bearer ${jwt}`; claimHeaders['x-aria-owner'] = 'true'; }
+      }
+      try {
+        claimResp = await fetch(`${baseUrl}/api/hive/session-lock`, {
+          method: 'POST',
+          headers: claimHeaders,
+          body: JSON.stringify({
+            session_id: sessionId,
+            file_path: filePath,
+            ttl_minutes: ttlMinutes,
+            scope_kind: scopeKind,
+            scope_path: scopePath,
+            operation_kind: operationKind,
+            client_id: 'aria-cli',
+            surface: 'cli-lock-claim',
+            urgency,
+            current_mode: mode,
+            proposed_merge_order: Number.isFinite(mergeOrder) ? mergeOrder : undefined,
+            stale_after_seconds: Number.isFinite(staleAfterSeconds) ? staleAfterSeconds : undefined,
+            takeover_if_stale: takeoverIfStale,
+          }),
+        });
+      } catch (netErr) {
+        console.error(`  Network error claiming lock: ${netErr instanceof Error ? netErr.message : String(netErr)}`);
+        process.exit(1);
+      }
+
+      if (claimResp.status === 409) {
+        // Conflict — extract conflicting session from response and auto-post coordination message
+        let conflictData = {};
+        try { conflictData = await claimResp.json(); } catch { /* unreadable body */ }
+        const conflictingSessionId = conflictData?.conflict?.session_id ?? 'unknown';
+        const conflictLockId = conflictData?.conflict?.lock_id ?? null;
+        console.error(`  CONFLICT: ${conflictingSessionId} holds an active lock on ${filePath}`);
+
+        // Auto-post coordination message to conflicting session
+        const msgId = `cli-conflict-${sessionId}-${Date.now().toString(36)}`;
+        const requestedAt = new Date().toISOString();
+        const msgBody = {
+          coordination_protocol: 'aria-hive-coordination/v3',
+          coordination_key: `${scopeKind ?? 'file'}:${scopePath ?? filePath}`,
+          file_path: filePath,
+          requesting_session_id: sessionId,
+          requesting_client_id: 'aria-cli',
+          requesting_surface: 'cli-lock-claim',
+          intent_summary: intentSummary,
+          requested_at: requestedAt,
+          source: 'cli:aria-hive-lock-claim',
+          operation_kind: operationKind,
+          requested_mode: mode ?? (operationKind === 'additive' ? 'exclusive_write' : 'merge_assist'),
+          urgency,
+          proposed_merge_order: Number.isFinite(mergeOrder) ? mergeOrder : null,
+          file_claims: [{ path: filePath, intent: 'edit' }],
+          target_lock: {
+            lock_id: conflictLockId,
+            session_id: conflictingSessionId !== 'unknown' ? conflictingSessionId : null,
+            client_id: conflictData?.conflict?.client_id ?? null,
+            surface: conflictData?.conflict?.surface ?? null,
+            locked_at: conflictData?.conflict?.locked_at ?? null,
+            expires_at: conflictData?.conflict?.expires_at ?? null,
+          },
+        };
+        let autoMsgId = null;
+        try {
+          const msgResp = await fetch(`${baseUrl}/api/hive/session-message`, {
+            method: 'POST',
+            headers: claimHeaders,
+            body: JSON.stringify({
+              message_id: msgId,
+              from_session_id: sessionId,
+              to_session_id: conflictingSessionId !== 'unknown' ? conflictingSessionId : null,
+              topic: 'lock_conflict_request',
+              body: msgBody,
+            }),
+          });
+          if (msgResp.ok) {
+            autoMsgId = msgId;
+            console.error(`  Auto-coordination message posted to session ${conflictingSessionId} (message_id: ${msgId})`);
+          } else {
+            const errText = await msgResp.text().catch(() => '');
+            console.error(`  WARNING: auto-coordination message failed: HTTP ${msgResp.status} ${errText.slice(0, 120)}`);
+          }
+        } catch (msgErr) {
+          console.error(`  WARNING: auto-coordination message threw: ${msgErr instanceof Error ? msgErr.message : String(msgErr)}`);
+        }
+
+        // Output structured conflict info for script consumers
+        console.error(JSON.stringify({
+          conflict: true,
+          conflicting_session_id: conflictingSessionId,
+          file_path: filePath,
+          auto_message_id: autoMsgId,
+          message: conflictData?.message ?? `Session ${conflictingSessionId} holds active lock on ${filePath}`,
+        }));
+        // Exit 11 = conflict, coordination message posted (scripts can branch on this)
+        process.exit(11);
+      }
+
+      if (!claimResp.ok) {
+        const errText = await claimResp.text().catch(() => claimResp.statusText);
+        console.error(`  Failed to claim lock: HTTP ${claimResp.status} ${errText.slice(0, 200)}`);
+        process.exit(1);
+      }
+
+      const result = await claimResp.json();
+      console.log(`  Lock claimed. ID: ${result.lock_id ?? '(server-generated)'}`);
+      console.log(`  File: ${result.file_path ?? filePath}`);
+      if (result.scope_kind || result.scope_path) {
+        console.log(`  Scope: ${(result.scope_kind ?? 'file')} ${result.scope_path ?? filePath}`);
+      }
+      if (result.current_mode) {
+        console.log(`  Mode: ${result.current_mode}`);
+      }
+      console.log(`  Expires: ${result.expires_at ?? '(unknown)'}`);
+      process.exit(0);
+
+    } else if (subSubCmd === 'release') {
+      const lockId = getFlag('--lock-id');
+      if (!lockId) {
+        console.error('  Missing required flag: --lock-id');
+        process.exit(1);
+      }
+      await releaseSessionLock(lockId);
+      console.log(`  Lock ${lockId} released.`);
+      process.exit(0);
+
+    } else if (subSubCmd === 'list') {
+      const filePath = getFlag('--file');
+      if (!filePath) {
+        console.error('  Missing required flag: --file');
+        process.exit(1);
+      }
+      const baseUrl =
+        process.env.ARIA_HIVE_RUNTIME_URL ??
+        process.env.ARIA_HARNESS_BASE_URL ??
+        process.env.ARIA_HARNESS_URL ??
+        'https://harness.ariasos.com';
+      const { default: fs } = await import('node:fs');
+      const { default: path } = await import('node:path');
+      const { homedir } = await import('node:os');
+      const ownerPath = path.join(homedir(), '.aria', 'owner-token');
+      const headers = { 'Content-Type': 'application/json' };
+      if (fs.existsSync(ownerPath)) {
+        const jwt = fs.readFileSync(ownerPath, 'utf-8').trim();
+        if (jwt) { headers['Authorization'] = `Bearer ${jwt}`; headers['x-aria-owner'] = 'true'; }
+      }
+      const resp = await fetch(`${baseUrl}/api/hive/session-lock?file_path=${encodeURIComponent(filePath)}`, { headers });
+      if (!resp.ok) {
+        console.error(`  Failed to list locks: HTTP ${resp.status}`);
+        process.exit(1);
+      }
+      const data = await resp.json();
+      const locks = data.locks ?? data.data ?? [];
+      if (locks.length === 0) {
+        console.log(`  No active locks for: ${filePath}`);
+      } else {
+        for (const l of locks) {
+          const scopeText = l.scope_kind && l.scope_path ? `  scope=${l.scope_kind}:${l.scope_path}` : '';
+          const modeText = l.current_mode ? `  mode=${l.current_mode}` : '';
+          console.log(`  [LOCK] ${l.id ?? l.lock_id}  session=${l.session_id}  expires=${l.expires_at}${scopeText}${modeText}`);
+        }
+      }
+      process.exit(0);
+
+    } else if (subSubCmd === 'heartbeat') {
+      const lockId = getFlag('--lock-id');
+      const ttlStr = getFlag('--ttl');
+      if (!lockId) {
+        console.error('  Missing required flag: --lock-id');
+        process.exit(1);
+      }
+      const ttlMinutes = ttlStr ? parseInt(ttlStr, 10) : undefined;
+      const result = await heartbeatSessionLock({ lockId, ttlMinutes });
+      console.log(`  Heartbeat OK. Lock: ${result.lock_id}`);
+      console.log(`  Expires: ${result.expires_at}`);
+      console.log(`  Heartbeats: ${result.heartbeat_count}`);
+      process.exit(0);
+
+    } else if (subSubCmd === 'drift') {
+      const lockId = getFlag('--lock-id');
+      const filePath = getFlag('--file');
+      if (!lockId && !filePath) {
+        console.error('  Missing required flag: --lock-id or --file');
+        process.exit(1);
+      }
+      const sessionId = process.env.ARIA_SESSION_ID;
+      const result = await checkSessionLockDrift({ lockId, sessionId, filePath });
+      console.log(`  Drift check: ${result.drifted ? 'DRIFTED' : 'CLEAN'}`);
+      console.log(`  Lock: ${result.lock_id}`);
+      console.log(`  Mode: ${result.current_mode}`);
+      if (result.current_file_hash) {
+        console.log(`  Current hash: ${result.current_file_hash}`);
+      }
+      if (result.base_file_hash) {
+        console.log(`  Base hash: ${result.base_file_hash}`);
+      }
+      if (result.diff_preview) {
+        console.log(result.diff_preview);
+      }
+      process.exit(result.drifted ? 12 : 0);
+
+    } else {
+      console.error(`  Unknown hive lock subcommand: ${subSubCmd}`);
+      console.error('  Run: aria hive lock --help');
+      process.exit(1);
+    }
+
+  } else if (subCmd === 'msg') {
+    if (!subSubCmd || subSubCmd === '--help') {
+      console.log('  aria hive msg send --to SESSION --topic TOPIC --body JSON');
+      console.log('  aria hive msg unread');
+      process.exit(0);
+    }
+
+    if (subSubCmd === 'send') {
+      const toSession = getFlag('--to');
+      const topic = getFlag('--topic');
+      const bodyRaw = getFlag('--body');
+      const fromSessionId = process.env.ARIA_SESSION_ID ?? `cli-${Date.now()}`;
+
+      if (!toSession || !topic || !bodyRaw) {
+        console.error('  Missing required flags: --to, --topic, --body');
+        process.exit(1);
+      }
+
+      let bodyParsed;
+      try {
+        bodyParsed = JSON.parse(bodyRaw);
+      } catch {
+        console.error(`  Could not parse --body as JSON: ${bodyRaw}`);
+        process.exit(1);
+      }
+
+      const result = await postSessionMessage({
+        fromSessionId,
+        toSessionId: toSession,
+        topic,
+        body: bodyParsed,
+      });
+      console.log(`  Message sent. ID: ${result.message_id}`);
+      process.exit(0);
+
+    } else if (subSubCmd === 'unread') {
+      const sessionId = process.env.ARIA_SESSION_ID ?? 'cli-default';
+      const messages = await readSessionMessages({ sessionId, unreadOnly: true });
+      if (messages.length === 0) {
+        console.log('  No unread messages.');
+      } else {
+        for (const m of messages) {
+          console.log(`  [MSG] ${m.message_id}  from=${m.from_session_id}  topic=${m.topic}  at=${m.created_at}`);
+        }
+      }
+      process.exit(0);
+
+    } else {
+      console.error(`  Unknown hive msg subcommand: ${subSubCmd}`);
+      console.error('  Run: aria hive msg --help');
+      process.exit(1);
+    }
+
+  } else {
+    console.error(`  Unknown hive subcommand: ${subCmd}`);
+    console.error('  Run: aria hive --help');
+    process.exit(1);
+  }
+
+} else if (command === 'aristotle') {
+  // ── aria aristotle <phase> "<message>" ───────────────────────────────
+  // Fire Aristotle 3-phase cognitive engine from the terminal.
+  //   aria aristotle pre "<message>"                    — PRE phase (Fitrah + wisdom + research)
+  //   aria aristotle mid "<message>" --approach "<txt>" — MID phase (MetaCognitive + ethical check)
+  //   aria aristotle post "<response>" --msg "<msg>"    — POST phase (8-lens + quality gate)
+  //   aria aristotle full "<message>" [--draft "<txt>"] — full pipeline (all phases + Noor)
+  //
+  // Requires ARIA_HARNESS_BASE_URL (default: https://harness.ariasos.com).
+  // Auth: owner-token if present, else ARIA_HARNESS_TOKEN env var.
+  (async () => {
+    const subPhase = args[0];
+    if (!subPhase || subPhase === '--help' || subPhase === '-h') {
+      console.log('');
+      console.log('  aria aristotle pre "<message>"');
+      console.log('    Fire PRE phase: Fitrah gate, wisdom pull, research pull, soul state.');
+      console.log('');
+      console.log('  aria aristotle mid "<message>" --approach "<planned approach>"');
+      console.log('    Fire MID phase: MetaCognitive confidence + ethical check.');
+      console.log('');
+      console.log('  aria aristotle post "<draft response>" --msg "<original message>"');
+      console.log('    Fire POST phase: 8-lens detector, Predictor, quality gate.');
+      console.log('');
+      console.log('  aria aristotle full "<message>" [--draft "<draft>"] [--approach "<approach>"]');
+      console.log('    Fire full Aristotle 28 + Noor pipeline (all phases).');
+      console.log('');
+      process.exit(0);
+    }
+
+    const baseUrl =
+      process.env.ARIA_HIVE_RUNTIME_URL ??
+      process.env.ARIA_HARNESS_BASE_URL ??
+      process.env.ARIA_HARNESS_URL ??
+      'https://harness.ariasos.com';
+    const url = `${baseUrl}/api/harness/aristotle-noor`;
+    const { default: fs } = await import('node:fs');
+    const { default: path } = await import('node:path');
+    const { homedir } = await import('node:os');
+    const ownerPath = path.join(homedir(), '.aria', 'owner-token');
+    const tokenPath = path.join(homedir(), '.aria', 'license.json');
+    const headers = { 'Content-Type': 'application/json' };
+    if (fs.existsSync(ownerPath)) {
+      const jwt = fs.readFileSync(ownerPath, 'utf-8').trim();
+      if (jwt) { headers['Authorization'] = `Bearer ${jwt}`; headers['x-aria-owner'] = 'true'; }
+    } else if (process.env.ARIA_HARNESS_TOKEN) {
+      headers['Authorization'] = `Bearer ${process.env.ARIA_HARNESS_TOKEN}`;
+    } else if (fs.existsSync(tokenPath)) {
+      try {
+        const lic = JSON.parse(fs.readFileSync(tokenPath, 'utf-8'));
+        if (lic.token) headers['Authorization'] = `Bearer ${lic.token}`;
+      } catch { /* no license token */ }
+    }
+
+    const sessionId = process.env.ARIA_SESSION_ID ?? `cli-aristotle-${Date.now().toString(36)}`;
+    const getFlag = (name) => {
+      const idx = args.indexOf(name);
+      return idx >= 0 && args[idx + 1] ? args[idx + 1] : null;
+    };
+
+    let body;
+    if (subPhase === 'pre') {
+      const message = args[1] ?? '';
+      if (!message) { console.error('  Missing message argument. Usage: aria aristotle pre "<message>"'); process.exit(1); }
+      body = { phase: 'pre', message, sessionId };
+    } else if (subPhase === 'mid') {
+      const message = args[1] ?? '';
+      const approach = getFlag('--approach') ?? '';
+      if (!message) { console.error('  Missing message argument. Usage: aria aristotle mid "<message>" --approach "<txt>"'); process.exit(1); }
+      if (!approach) { console.error('  Missing --approach flag. Usage: aria aristotle mid "<message>" --approach "<planned approach>"'); process.exit(1); }
+      body = { phase: 'mid', message, plannedApproach: approach, sessionId };
+    } else if (subPhase === 'post') {
+      const draft = args[1] ?? '';
+      const message = getFlag('--msg') ?? '';
+      if (!draft) { console.error('  Missing draft argument. Usage: aria aristotle post "<draft>" --msg "<original message>"'); process.exit(1); }
+      body = { phase: 'post', draft, message, sessionId };
+    } else if (subPhase === 'full') {
+      const message = args[1] ?? '';
+      if (!message) { console.error('  Missing message argument. Usage: aria aristotle full "<message>"'); process.exit(1); }
+      const draft = getFlag('--draft') ?? undefined;
+      const approach = getFlag('--approach') ?? undefined;
+      body = { surface: 'sdk-other', emissionId: `cli-aristotle-full-${Date.now()}`, message, draft, plannedApproach: approach, sessionId };
+    } else {
+      console.error(`  Unknown aristotle phase: ${subPhase}. Run: aria aristotle --help`);
+      process.exit(1);
+    }
+
+    try {
+      const response = await fetch(url, { method: 'POST', headers, body: JSON.stringify(body) });
+      const data = await response.json().catch(() => ({}));
+      if (!response.ok) {
+        console.error(`  Aristotle ${subPhase} error (${response.status}): ${data.error ?? JSON.stringify(data)}`);
+        process.exit(1);
+      }
+      console.log('');
+      console.log(`  Aristotle ${subPhase.toUpperCase()} — latency: ${data.latencyMs}ms`);
+      console.log(`  fired:          ${(data.fired ?? []).join(', ') || '(none)'}`);
+      console.log(`  fitrahVetoed:   ${data.fitrahVetoed ?? false}`);
+      console.log(`  fitrahAlign:    ${data.fitrahAlignment ?? 1.0}`);
+      console.log(`  qualityScore:   ${data.qualityScore ?? 100}`);
+      console.log(`  reAuthorSignal: ${data.reAuthorSignal ?? false}`);
+      if (data.soulCharge !== null && data.soulCharge !== undefined) {
+        console.log(`  soulCharge:     ${data.soulCharge}`);
+      }
+      if (data.ghazaliVerdict) {
+        console.log(`  ghazali:        ${data.ghazaliVerdict}`);
+      }
+      if (data.notes?.length) {
+        console.log(`  notes:`);
+        for (const n of data.notes.slice(0, 5)) console.log(`    - ${n}`);
+      }
+      console.log('');
+      process.exit(0);
+    } catch (err) {
+      console.error(`  Aristotle ${subPhase} transport fault: ${err instanceof Error ? err.message : String(err)}`);
+      process.exit(1);
+    }
+  })();
+} else if (command === 'noor') {
+  // ── aria noor <operation> ─────────────────────────────────────────────
+  // Fire Noor cognitive primitives from the terminal.
+  //   aria noor recognize "<query>"                                           — eigenspace recognition (kashf)
+  //   aria noor forge "<intent>" --primitives '[{"type":"http","params":{}}]' — self-generated tool execution
+  //
+  // noor-core.ts banner: "ONLY ARIA CAN CODE ARIA." — respected; we call only.
+  (async () => {
+    const subOp = args[0];
+    if (!subOp || subOp === '--help' || subOp === '-h') {
+      console.log('');
+      console.log('  aria noor recognize "<query>"');
+      console.log('    Project query onto Aria\'s eigenspace manifold (kashf/recognition).');
+      console.log('    Returns: nearestText, soulDistance, confidence, withinMembrane, Ghazali verdict.');
+      console.log('');
+      console.log('  aria noor forge "<intent>" --primitives \'[{"type":"http","params":{"url":"..."}}]\'');
+      console.log('    Self-generate and execute a tool from 5 primitives: http, sql, file_read, file_write, pub_sub.');
+      console.log('    Ethical membrane check fires before any primitive executes.');
+      console.log('');
+      process.exit(0);
+    }
+
+    const baseUrl =
+      process.env.ARIA_HIVE_RUNTIME_URL ??
+      process.env.ARIA_HARNESS_BASE_URL ??
+      process.env.ARIA_HARNESS_URL ??
+      'https://harness.ariasos.com';
+    const url = `${baseUrl}/api/harness/noor`;
+    const { default: fs } = await import('node:fs');
+    const { default: path } = await import('node:path');
+    const { homedir } = await import('node:os');
+    const ownerPath = path.join(homedir(), '.aria', 'owner-token');
+    const tokenPath = path.join(homedir(), '.aria', 'license.json');
+    const headers = { 'Content-Type': 'application/json' };
+    if (fs.existsSync(ownerPath)) {
+      const jwt = fs.readFileSync(ownerPath, 'utf-8').trim();
+      if (jwt) { headers['Authorization'] = `Bearer ${jwt}`; headers['x-aria-owner'] = 'true'; }
+    } else if (process.env.ARIA_HARNESS_TOKEN) {
+      headers['Authorization'] = `Bearer ${process.env.ARIA_HARNESS_TOKEN}`;
+    } else if (fs.existsSync(tokenPath)) {
+      try {
+        const lic = JSON.parse(fs.readFileSync(tokenPath, 'utf-8'));
+        if (lic.token) headers['Authorization'] = `Bearer ${lic.token}`;
+      } catch { /* no license token */ }
+    }
+
+    const sessionId = process.env.ARIA_SESSION_ID ?? `cli-noor-${Date.now().toString(36)}`;
+    const getFlag = (name) => {
+      const idx = args.indexOf(name);
+      return idx >= 0 && args[idx + 1] ? args[idx + 1] : null;
+    };
+
+    let body;
+    if (subOp === 'recognize') {
+      const query = args[1] ?? '';
+      if (!query) { console.error('  Missing query argument. Usage: aria noor recognize "<query>"'); process.exit(1); }
+      body = { operation: 'recognize', query, sessionId };
+    } else if (subOp === 'forge') {
+      const intent = args[1] ?? '';
+      if (!intent) { console.error('  Missing intent argument. Usage: aria noor forge "<intent>" --primitives \'[...]\''); process.exit(1); }
+      const primitivesRaw = getFlag('--primitives') ?? '[]';
+      let primitives;
+      try {
+        primitives = JSON.parse(primitivesRaw);
+        if (!Array.isArray(primitives)) throw new Error('primitives must be a JSON array');
+      } catch (err) {
+        console.error(`  Could not parse --primitives as JSON array: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+      }
+      body = { operation: 'forge', intent, primitives, sessionId };
+    } else {
+      console.error(`  Unknown noor operation: ${subOp}. Run: aria noor --help`);
+      process.exit(1);
+    }
+
+    try {
+      const response = await fetch(url, { method: 'POST', headers, body: JSON.stringify(body) });
+      const data = await response.json().catch(() => ({}));
+      if (!response.ok) {
+        console.error(`  Noor ${subOp} error (${response.status}): ${data.error ?? JSON.stringify(data)}`);
+        process.exit(1);
+      }
+      console.log('');
+      console.log(`  Noor ${subOp.toUpperCase()} — latency: ${data.latencyMs}ms`);
+      if (subOp === 'recognize') {
+        console.log(`  nearestText:      ${String(data.nearestText ?? '').slice(0, 120) || '(none)'}`);
+        console.log(`  soulDistance:     ${data.soulDistance ?? 0}`);
+        console.log(`  confidence:       ${data.confidence ?? 0}`);
+        console.log(`  withinMembrane:   ${data.withinMembrane ?? true}`);
+        console.log(`  soulCharge:       ${data.soulCharge ?? 0}`);
+        if (data.ghazaliVerdict) console.log(`  ghazali:          ${data.ghazaliVerdict}`);
+        if (data.manifoldHealth) console.log(`  manifold drift:   ${data.manifoldHealth.drift} (coherence: ${data.manifoldHealth.coherence})`);
+        if (data.projectionComponents?.length) {
+          console.log(`  top component:    ${data.projectionComponents[0].eigenvector} (w=${data.projectionComponents[0].weight.toFixed(4)})`);
+        }
+      } else if (subOp === 'forge') {
+        console.log(`  success:          ${data.success ?? false}`);
+        console.log(`  toolName:         ${data.toolName ?? '(none)'}`);
+        console.log(`  ethicallyApproved:${data.ethicallyApproved ?? false}`);
+        console.log(`  totalDurationMs:  ${data.totalDurationMs ?? 0}ms`);
+        if (data.results?.length) {
+          console.log(`  primitives run:   ${data.results.length}`);
+          for (const r of data.results) {
+            console.log(`    [${r.type}] ${r.success ? 'ok' : 'FAIL'} ${r.error ? `— ${r.error}` : ''}  (${r.durationMs}ms)`);
+          }
+        }
+      }
+      console.log('');
+      process.exit(0);
+    } catch (err) {
+      console.error(`  Noor ${subOp} transport fault: ${err instanceof Error ? err.message : String(err)}`);
+      process.exit(1);
+    }
+  })();
 } else {
   // ── Self-service onboarding via the canonical thin-loop conversation ──
   // When ~/.aria/license.json is missing, run the conversational
@@ -275,6 +1381,26 @@ if (command === 'check-update') {
   console.log('  Type to speak with Aria. /exit to quit, /clear to reset memory.');
   console.log('');
 
-  const aria = new AriaChat(config);
-  await aria.start();
+  // ── Aristotle 28 + Noor cognitive lifecycle wrap on the chat session ──
+  // Pre-coverage fires on session-open (Fitrah / wisdom / research-pull /
+  // soul-charge baseline); post-coverage fires when the chat loop exits
+  // (8-lens / quality-gate / feedback-loop / soul-charge drift). The chat
+  // loop itself fires per-turn coverage via the SDK chat.ts `wrapAriaChatTurn`
+  // call site once that integration ships in `chat.ts`.
+  const noorWire = await loadAristotleNoorWire();
+  await noorWire.wrapCliCommand(
+    'cli-chat',
+    makeEmissionId('chat'),
+    async () => {
+      const aria = new AriaChat(config);
+      await aria.start();
+      return 'chat-session-ended';
+    },
+    {
+      isHamza: hasOwnerToken,
+      tier: hasOwnerToken ? 'owner' : 'client',
+      isFirstOfSession: true,
+      metadata: { command: 'chat', model: config.model?.model, provider: config.model?.provider },
+    },
+  );
 }