@aria_asi/cli 0.2.26 → 0.2.30

package/src/auth-commands.ts

@@ -8,6 +8,12 @@ import { homedir } from 'node:os';
 const LICENSE_PATH = path.join(homedir(), '.aria', 'license.json');
 /** Separate credential file for owner-mode JWT. Never holds the master token — only the signed JWT issued by /auth/owner. */
 export const OWNER_TOKEN_PATH = path.join(homedir(), '.aria', 'owner-token');
+const DEFAULT_HARNESS_URL =
+  process.env.ARIA_HIVE_RUNTIME_URL ||
+  process.env.ARIA_HARNESS_BASE_URL ||
+  process.env.ARIA_HARNESS_URL ||
+  'https://harness.ariasos.com';
+const DEFAULT_RUNTIME_URL = (process.env.ARIA_RUNTIME_URL || 'http://127.0.0.1:4319').replace(/\/+$/, '');
 
 interface LicenseClaims {
   jti: string;
@@ -35,6 +41,7 @@ interface StatusResult {
   tier?: string;
   expiresAt?: string;
   revoked?: boolean;
+  owner?: boolean;
 }
 
 interface LogoutResult {
@@ -47,6 +54,67 @@ interface RevokeResult {
   error?: string;
 }
 
+interface HeartbeatResponseBody {
+  ok?: boolean;
+  error?: string;
+  reason?: string;
+  tenant_id?: string;
+  tier?: string;
+  expires_at?: string | null;
+  lease?: {
+    claims?: {
+      tenant_id?: string | null;
+      tier?: string | null;
+      expires_at?: string | null;
+    };
+  };
+}
+
+async function heartbeatViaRuntime(token: string, runtimeId: string, allowOwnerBypass = false): Promise<HeartbeatResponseBody> {
+  const response = await fetch(`${DEFAULT_RUNTIME_URL}/heartbeat`, {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${token}`,
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify({
+      surface: 'aria-cli',
+      runtime_id: runtimeId,
+      allowOwnerBypass,
+    }),
+  });
+  const body = await response.json().catch(() => ({})) as HeartbeatResponseBody;
+  if (!response.ok) {
+    throw new Error(body.reason || body.error || `Runtime heartbeat failed (${response.status})`);
+  }
+  return body;
+}
+
+async function heartbeatDirect(token: string, runtimeId: string): Promise<HeartbeatResponseBody> {
+  const response = await harnessClient.post('/api/license/heartbeat', {
+    headers: { Authorization: `Bearer ${token}` },
+    body: {
+      surface: 'aria-cli',
+      runtime_id: runtimeId,
+    },
+  });
+
+  if (!response.ok) {
+    const errBody = await response.json().catch(() => ({}));
+    throw new Error(errBody.error || 'License heartbeat failed');
+  }
+
+  return await response.json() as HeartbeatResponseBody;
+}
+
+async function heartbeatBestEffort(token: string, runtimeId: string, allowOwnerBypass = false): Promise<HeartbeatResponseBody> {
+  try {
+    return await heartbeatViaRuntime(token, runtimeId, allowOwnerBypass);
+  } catch {
+    return await heartbeatDirect(token, runtimeId);
+  }
+}
+
 /**
  * Log in to the Aria harness with a license token, OR authenticate via
  * Anthropic's console (browser-paste flow) when token === '--anthropic' or
@@ -73,33 +141,27 @@ export async function login(token: string): Promise<LoginResult> {
 
   // ── Original harness-license branch (preserved verbatim) ────────────────────
   try {
-    // Validate token via heartbeat; if unverified, issue endpoint
-    let response;
-    try {
-      response = await harnessClient.get('/api/license/heartbeat', {
-        headers: { Authorization: `Bearer ${token}` },
-      });
-    } catch {
-      // If heartbeat fails (unverified token), try issue
-      response = await harnessClient.post('/api/license/issue', {
-        body: { token },
-      });
-    }
-
-    if (!response.ok) {
-      const errBody = await response.json().catch(() => ({}));
-      return { ok: false, error: errBody.error || 'Login failed' };
-    }
-
-    const body = await response.json();
-    const claims: LicenseClaims = body.claims || body;
+    // Prefer the mounted runtime for validation so same-device installs stay
+    // local-first, but fall back to the upstream heartbeat if needed.
+    const body = await heartbeatBestEffort(token, 'aria-cli-login');
+    const expiresAt = body.lease?.claims?.expires_at || body.expires_at || null;
+    const claims: LicenseClaims = {
+      jti: body.lease?.claims?.tenant_id || body.tenant_id || 'unknown',
+      sub: body.lease?.claims?.tenant_id || body.tenant_id || 'unknown',
+      tier: body.lease?.claims?.tier || body.tier || 'unknown',
+      exp: expiresAt ? Math.floor(Date.parse(expiresAt) / 1000) : Math.floor(Date.now() / 1000),
+      iat: Math.floor(Date.now() / 1000),
+    };
 
     // Persist to ~/.aria/license.json with mode 0600
     const dir = path.dirname(LICENSE_PATH);
     if (!fs.existsSync(dir)) {
       fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
     }
-    fs.writeFileSync(LICENSE_PATH, JSON.stringify(claims, null, 2), {
+    fs.writeFileSync(LICENSE_PATH, JSON.stringify({
+      harnessToken: token,
+      ...claims,
+    }, null, 2), {
       mode: 0o600,
       encoding: 'utf-8',
     });
@@ -126,7 +188,7 @@ export async function login(token: string): Promise<LoginResult> {
  * fs.existsSync(OWNER_TOKEN_PATH).
  */
 export async function loginOwner(masterToken: string): Promise<LoginResult> {
-  const baseUrl = process.env.ARIA_HARNESS_BASE_URL ?? 'https://harness.ariasos.com';
+  const baseUrl = DEFAULT_HARNESS_URL;
   let response: Response;
   try {
     response = await fetch(`${baseUrl}/auth/owner`, {
@@ -163,34 +225,38 @@ export async function loginOwner(masterToken: string): Promise<LoginResult> {
 }
 
 export async function status(): Promise<StatusResult> {
-  try {
-    const license = await loadLicense();
-    if (!license || !license.jti) {
-      return { loggedIn: false };
-    }
-
-    // Verify with server
-    const response = await harnessClient.get('/api/license/heartbeat', {
-      headers: { Authorization: `Bearer ${license.jti}` },
-    });
-
-    if (response.status === 410) {
-      // Gone = revoked
-      return {
-        loggedIn: true,
-        jti: license.jti,
-        tier: license.tier,
-        expiresAt: license.exp ? new Date(license.exp * 1000).toISOString() : undefined,
-        revoked: true,
-      };
+  if (fs.existsSync(OWNER_TOKEN_PATH)) {
+    try {
+      const ownerToken = fs.readFileSync(OWNER_TOKEN_PATH, 'utf-8').trim();
+      if (ownerToken) {
+        return {
+          loggedIn: true,
+          owner: true,
+          jti: 'owner-local',
+          tier: 'owner',
+          revoked: undefined,
+        };
+      }
+    } catch {
+      // fall through to license status
     }
+  }
 
-    if (!response.ok) {
+  try {
+    const license = await loadLicense();
+    if (!license || !license.jti || !license.harnessToken) {
       return { loggedIn: false };
     }
 
-    const body = await response.json();
-    const claims: LicenseClaims = body.claims || body;
+    const body = await heartbeatBestEffort(license.harnessToken, 'aria-cli-status');
+    const expiresAt = body.lease?.claims?.expires_at || body.expires_at || null;
+    const claims: LicenseClaims = {
+      jti: body.lease?.claims?.tenant_id || body.tenant_id || license.jti,
+      sub: body.lease?.claims?.tenant_id || body.tenant_id || license.sub || license.jti,
+      tier: body.lease?.claims?.tier || body.tier || license.tier || 'unknown',
+      exp: expiresAt ? Math.floor(Date.parse(expiresAt) / 1000) : (license.exp || 0),
+      iat: license.iat || Math.floor(Date.now() / 1000),
+    };
 
     return {
       loggedIn: true,

package/src/chat.ts

@@ -6,8 +6,15 @@ import { loadPersona, buildPersonaBlock } from './persona.js';
 import type { PersonaContext } from './persona.js';
 import { fetchHarness, combineHarnessContext, checkHarnessHealth, validateOutput, getRecentTurns } from './harness-client.js';
 import { gardenTurnCycle } from './garden-control-plane.js';
-import { registerWithHive, startHeartbeat, type HeartbeatHandle } from './hive-client.js';
+import {
+  emitRuntimeProofMetric,
+  registerWithHive,
+  startHeartbeat,
+  type HeartbeatHandle,
+  type HiveRegisterConfig,
+} from './hive-client.js';
 import { getModelContextTokens } from './model-context.js';
+import { enrichRuntimeProof, formatRuntimeProofLine, type RuntimeProofSnapshot } from './runtime-proof.js';
 
 // Soft display/inject cap — for full-mode injects into models with finite
 // context windows. Garden is the perpetual context engine (aria_conversation_log,
@@ -31,6 +38,8 @@ export class AriaChat {
   private sessionId: string;
   private harnessOnline = false;
   private heartbeat?: HeartbeatHandle;
+  private hiveCfg?: HiveRegisterConfig;
+  private lastRuntimeProof: RuntimeProofSnapshot | null = null;
 
   constructor(config: AriaConfig) {
     this.config = config;
@@ -46,7 +55,7 @@ export class AriaChat {
     // Decoupled from internal-only @aria/openclaw-shared via local
     // hive-client.ts, so customers ship the connector and get hive
     // integration with no internal Aria deps.
-    const hiveCfg = {
+    const hiveCfg: HiveRegisterConfig = {
       sessionId: this.sessionId,
       platform: 'aria-cli',
       userId: this.config.userId || 'user',
@@ -57,6 +66,7 @@ export class AriaChat {
         nodeVersion: process.version,
       },
     };
+    this.hiveCfg = hiveCfg;
     const hiveResult = await registerWithHive(hiveCfg).catch(() => null);
     if (hiveResult && hiveResult.status === 'registered') {
       const others = Math.max(0, hiveResult.hive.active_sessions - 1);
@@ -113,6 +123,9 @@ export class AriaChat {
       if (input === '/model') {
         console.log(`  Provider: ${this.config.model?.provider ?? 'none'}`);
         console.log(`  Model:    ${this.config.model?.model ?? 'none'}\n`);
+        if (this.lastRuntimeProof) {
+          console.log(`  ${formatRuntimeProofLine(this.lastRuntimeProof, { mode: process.stdout.isTTY ? 'ansi' : 'plain' })}\n`);
+        }
         rl.prompt();
         continue;
       }
@@ -174,6 +187,25 @@ export class AriaChat {
         }
       }
 
+      const runtimeProof = await enrichRuntimeProof(
+        {
+          ...(result.runtimeProof ?? {}),
+          provider: result.runtimeProof?.provider ?? result.provider,
+          model: result.runtimeProof?.model ?? result.model,
+          promptTokens: result.runtimeProof?.promptTokens ?? result.usage?.promptTokens,
+          completionTokens: result.runtimeProof?.completionTokens ?? result.usage?.completionTokens,
+          totalTokens:
+            result.runtimeProof?.totalTokens ??
+            ((result.usage?.promptTokens ?? 0) + (result.usage?.completionTokens ?? 0) || undefined),
+          latencyMs: result.runtimeProof?.latencyMs ?? result.latencyMs,
+          gateSeverity: gateVerdict?.severity ?? result.runtimeProof?.gateSeverity,
+        },
+        { sessionId: this.sessionId },
+      );
+      this.lastRuntimeProof = runtimeProof;
+      this.pushRuntimeProofToHive(runtimeProof).catch(() => {});
+      process.stdout.write(`  ${formatRuntimeProofLine(runtimeProof, { mode: process.stdout.isTTY ? 'ansi' : 'plain' })}\n`);
+
       this.history.push({ role: 'assistant', content: displayResponse });
       this.trimHistory();
 
@@ -402,18 +434,46 @@ You are present in this shell, fully aware, ready to serve.`;
       if (!ownerRes.ok) {
         throw new Error(`/chat ${ownerRes.status}: ${await ownerRes.text().catch(() => '<no body>')}`);
       }
-      const ownerData = (await ownerRes.json()) as { ok?: boolean; response?: string; error?: string };
+      const ownerData = (await ownerRes.json()) as {
+        ok?: boolean;
+        response?: string;
+        error?: string;
+        modelUsed?: string;
+        latencyMs?: number;
+        usage?: { promptTokens?: number; completionTokens?: number };
+        telemetry?: Record<string, unknown>;
+      };
       if (ownerData.ok === false) {
         throw new Error(`/chat error: ${ownerData.error || 'unknown'}`);
       }
       const ownerText = String(ownerData.response || '').trim();
       process.stdout.write(ownerText);
+      const promptTokens = ownerData.usage?.promptTokens;
+      const completionTokens = ownerData.usage?.completionTokens;
       return {
         text: ownerText,
-        provider: 'aria-streamconversation' as never,
-        tokensIn: 0,
-        tokensOut: 0,
-      } as unknown as ChatResult;
+        provider: 'aria-streamconversation',
+        model: ownerData.modelUsed || 'streamConversation',
+        latencyMs: ownerData.latencyMs,
+        usage:
+          promptTokens !== undefined || completionTokens !== undefined
+            ? {
+                promptTokens: promptTokens ?? 0,
+                completionTokens: completionTokens ?? 0,
+              }
+            : undefined,
+        runtimeProof: {
+          provider: 'aria-streamconversation',
+          model: ownerData.modelUsed || 'streamConversation',
+          promptTokens,
+          completionTokens,
+          totalTokens:
+            promptTokens !== undefined || completionTokens !== undefined
+              ? (promptTokens ?? 0) + (completionTokens ?? 0)
+              : undefined,
+          latencyMs: ownerData.latencyMs,
+        },
+      };
     }
 
     // ── CLIENT TIER: route to /api/aria/speak (orchestrate + their key) ──
@@ -456,6 +516,7 @@ You are present in this shell, fully aware, ready to serve.`;
       modelUsed?: string;
       ariaActions?: unknown[];
       mizanVerdict?: { passed: boolean; severity: string; violations: string[] };
+      latencyMs?: number;
       error?: string;
     };
 
@@ -473,10 +534,20 @@ You are present in this shell, fully aware, ready to serve.`;
 
     return {
       text,
-      provider: `aria-controller (${body.modelUsed || 'unknown'})` as never,
-      tokensIn: 0,
-      tokensOut: 0,
-    } as unknown as ChatResult;
+      provider: 'aria-controller',
+      model: body.modelUsed || 'unknown',
+      latencyMs: body.latencyMs,
+      runtimeProof: {
+        provider: 'aria-controller',
+        model: body.modelUsed || 'unknown',
+        harnessTurns: Array.isArray(body.ariaActions) ? body.ariaActions.length : undefined,
+        llmDispatches: countAriaActions(body.ariaActions, 'dispatch_llm'),
+        toolDispatches: countAriaActions(body.ariaActions, 'dispatch_llm', 'mcp_tool'),
+        mcpToolCalls: countAriaActions(body.ariaActions, 'mcp_tool'),
+        gateSeverity: body.mizanVerdict?.severity,
+        latencyMs: body.latencyMs,
+      },
+    };
   }
 
   private async sendToProvider(messages: Message[]): Promise<ChatResult> {
@@ -507,10 +578,20 @@ You are present in this shell, fully aware, ready to serve.`;
         },
         { stream: true },
       );
-      return { ...result, text: fullText || result.text };
+      return {
+        ...result,
+        text: fullText || result.text,
+        provider: model.provider,
+        model: model.model,
+      };
     }
 
-    return provider(messages, model.apiKey, model.model);
+    const result = await provider(messages, model.apiKey, model.model);
+    return {
+      ...result,
+      provider: model.provider,
+      model: model.model,
+    };
   }
 
   private getProvider(provider: ProviderName): (messages: Message[], apiKey: string, model: string, opts?: ChatOptions) => Promise<ChatResult> {
@@ -562,4 +643,84 @@ You are present in this shell, fully aware, ready to serve.`;
   private trimHistory(): void {
     // Intentional no-op — see comment above.
   }
+
+  private async pushRuntimeProofToHive(runtimeProof: RuntimeProofSnapshot): Promise<void> {
+    if (!this.hiveCfg) return;
+
+    this.hiveCfg.context = {
+      ...(this.hiveCfg.context ?? {}),
+      runtime_proof: {
+        provider: runtimeProof.provider,
+        model: runtimeProof.model,
+        prompt_tokens: runtimeProof.promptTokens,
+        completion_tokens: runtimeProof.completionTokens,
+        total_tokens: runtimeProof.totalTokens,
+        latency_ms: runtimeProof.latencyMs,
+        harness_turns: runtimeProof.harnessTurns,
+        llm_dispatches: runtimeProof.llmDispatches,
+        tool_dispatches: runtimeProof.toolDispatches,
+        mcp_tool_calls: runtimeProof.mcpToolCalls,
+        gate_severity: runtimeProof.gateSeverity,
+        cap_hit: runtimeProof.capHit,
+        proof_source: runtimeProof.telemetry?.source,
+        proof_reason: runtimeProof.telemetry?.reason,
+        hive_runtime_status: runtimeProof.telemetry?.runtimeStatus,
+        hive_cycle_count: runtimeProof.telemetry?.hiveCycleCount,
+        hive_tasks_completed: runtimeProof.telemetry?.hiveTasksCompleted,
+        hive_tasks_failed: runtimeProof.telemetry?.hiveTasksFailed,
+        interceptions: runtimeProof.telemetry?.interceptions,
+        quality_gated_outcomes: runtimeProof.telemetry?.qualityGatedOutcomes,
+        blocked_unsafe_actions: runtimeProof.telemetry?.blockedUnsafeActions,
+        hallucination_stops: runtimeProof.telemetry?.hallucinationStops,
+        quality_score: runtimeProof.telemetry?.qualityScore,
+        quality_status: runtimeProof.telemetry?.qualityStatus,
+        pass_rate_percent_today: runtimeProof.telemetry?.passRatePercentToday,
+        packet_hash: runtimeProof.telemetry?.packetHash,
+        compliance_state: runtimeProof.telemetry?.complianceState,
+      },
+      runtime_proof_at: new Date().toISOString(),
+    };
+
+    await Promise.allSettled([
+      registerWithHive(this.hiveCfg),
+      emitRuntimeProofMetric({
+        sessionId: this.hiveCfg.sessionId,
+        platform: this.hiveCfg.platform,
+        actor: this.hiveCfg.platform,
+        surface: 'aria-cli',
+        provider: runtimeProof.provider,
+        model: runtimeProof.model,
+        promptTokens: runtimeProof.promptTokens,
+        completionTokens: runtimeProof.completionTokens,
+        totalTokens: runtimeProof.totalTokens,
+        latencyMs: runtimeProof.latencyMs,
+        turnCount: runtimeProof.harnessTurns,
+        llmDispatches: runtimeProof.llmDispatches,
+        toolDispatches: runtimeProof.toolDispatches,
+        mcpToolCalls: runtimeProof.mcpToolCalls,
+        gateSeverity: runtimeProof.gateSeverity,
+        qualityScore: runtimeProof.telemetry?.qualityScore,
+        qualityStatus: runtimeProof.telemetry?.qualityStatus,
+        complianceState: runtimeProof.telemetry?.complianceState,
+        packetHash: runtimeProof.telemetry?.packetHash,
+        blockedUnsafeActions: runtimeProof.telemetry?.blockedUnsafeActions,
+        interceptions: runtimeProof.telemetry?.interceptions,
+        hallucinationStops: runtimeProof.telemetry?.hallucinationStops,
+        passRatePercentToday: runtimeProof.telemetry?.passRatePercentToday,
+        hiveRuntimeStatus: runtimeProof.telemetry?.runtimeStatus,
+        hiveCycleCount: runtimeProof.telemetry?.hiveCycleCount,
+        hiveTasksCompleted: runtimeProof.telemetry?.hiveTasksCompleted,
+        hiveTasksFailed: runtimeProof.telemetry?.hiveTasksFailed,
+      }),
+    ]);
+  }
+}
+
+function countAriaActions(actions: unknown[] | undefined, ...kinds: string[]): number | undefined {
+  if (!Array.isArray(actions)) return undefined;
+  return actions.filter((action) => {
+    if (!action || typeof action !== 'object') return false;
+    const kind = (action as { kind?: unknown }).kind;
+    return typeof kind === 'string' && kinds.includes(kind);
+  }).length;
 }

package/src/codebase-scanner.ts

@@ -6,6 +6,7 @@
 export {
   scanCodebase,
   schemaImageToText,
+  watchCodebase,
 } from '../../aria-web/src/lib/codebase-scanner.js';
 
 export type {
@@ -15,4 +16,7 @@ export type {
   ArchitecturePattern,
   DirectoryPurpose,
   ProjectSize,
+  WatchHandle,
+  WatchOptions,
+  WatchMode,
 } from '../../aria-web/src/lib/codebase-scanner.js';

package/src/config.ts

@@ -9,12 +9,25 @@ export interface ModelConfig {
   baseUrl?: string;
 }
 
+export interface RuntimeProfilesConfig {
+  chatModel?: string;
+  deepModel?: string;
+  xaiFallbackModel?: string;
+  nimFallbackModel?: string;
+  xaiApiKey?: string;
+  nimApiKey?: string;
+  xaiBaseUrl?: string;
+  nimBaseUrl?: string;
+}
+
 export interface AriaConfig {
   version: string;
   purpose: string;
   userId: string;
   userName: string;
   model: ModelConfig | null;
+  defaultProvider?: ModelConfig['provider'];
+  runtimeProfiles?: RuntimeProfilesConfig;
   garden: boolean;
   repositories: LinkedRepo[];
   database: DatabaseConfig | null;
@@ -51,6 +64,8 @@ export function getDefaultConfig(): AriaConfig {
     userId: process.env.USER || 'user',
     userName: process.env.USER || 'User',
     model: null,
+    defaultProvider: undefined,
+    runtimeProfiles: {},
     garden: false,
     repositories: [],
     database: null,