@aria_asi/cli 0.2.26 → 0.2.30

package/src/runtime-proof.ts

@@ -0,0 +1,392 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { homedir } from 'node:os';
+
+export interface RuntimeProofTelemetry {
+  available: boolean;
+  source?: string;
+  reason?: string;
+  runtimeStatus?: string;
+  hiveCycleCount?: number;
+  hiveTasksCompleted?: number;
+  hiveTasksFailed?: number;
+  turns?: number;
+  interceptions?: number;
+  qualityGatedOutcomes?: number;
+  hallucinationStops?: number;
+  blockedUnsafeActions?: number;
+  qualityScore?: number;
+  qualityStatus?: string;
+  complianceState?: string;
+  packetHash?: string;
+  passRatePercentToday?: number;
+}
+
+export interface RuntimeProofSnapshot {
+  provider?: string;
+  model?: string;
+  promptTokens?: number;
+  completionTokens?: number;
+  totalTokens?: number;
+  latencyMs?: number;
+  harnessTurns?: number;
+  llmDispatches?: number;
+  toolDispatches?: number;
+  mcpToolCalls?: number;
+  gateSeverity?: 'pass' | 'warn' | 'block' | string;
+  capHit?: boolean;
+  telemetry?: RuntimeProofTelemetry;
+}
+
+interface RuntimeProofFetchArgs {
+  sessionId: string;
+}
+
+interface RuntimeProofFormatOpts {
+  mode?: 'ansi' | 'plain';
+}
+
+const ANSI_GREY_OPEN = '\x1b[90m';
+const ANSI_RESET = '\x1b[0m';
+const HARNESS_BASE_URL =
+  process.env.ARIA_HIVE_RUNTIME_URL ||
+  process.env.ARIA_HARNESS_BASE_URL ||
+  process.env.ARIA_HARNESS_URL ||
+  'https://harness.ariasos.com';
+const OWNER_TOKEN_PATH = path.join(homedir(), '.aria', 'owner-token');
+const LICENSE_PATH = path.join(homedir(), '.aria', 'license.json');
+
+export async function enrichRuntimeProof(
+  base: RuntimeProofSnapshot,
+  args: RuntimeProofFetchArgs,
+): Promise<RuntimeProofSnapshot> {
+  const telemetry = await fetchRuntimeProofTelemetry(args);
+  return {
+    ...base,
+    telemetry,
+  };
+}
+
+export async function fetchRuntimeProofTelemetry(
+  args: RuntimeProofFetchArgs,
+): Promise<RuntimeProofTelemetry> {
+  const authHeaders = resolveHarnessAuthHeaders();
+  const candidates = [
+    {
+      source: 'aria-telemetry-badge-metrics',
+      url: `${HARNESS_BASE_URL}/api/telemetry/badge-metrics?sessionId=${encodeURIComponent(args.sessionId)}&surface=aria-cli`,
+    },
+    {
+      source: 'aria-telemetry-public-proof',
+      url: `${HARNESS_BASE_URL}/api/telemetry/public-proof?sessionId=${encodeURIComponent(args.sessionId)}&surface=aria-cli`,
+    },
+    {
+      source: 'aria-telemetry-public-proof-path',
+      url: `${HARNESS_BASE_URL}/api/telemetry/public-proof/${encodeURIComponent(args.sessionId)}`,
+    },
+    {
+      source: 'hive-runtime-status',
+      url: `${HARNESS_BASE_URL}/hive/status`,
+    },
+    {
+      source: 'hive-runtime-status-api',
+      url: `${HARNESS_BASE_URL}/api/hive/status`,
+    },
+    {
+      source: 'proof-layer-summary',
+      url: `${HARNESS_BASE_URL}/api/metrics/proof-layer/summary?window=24h`,
+    },
+  ];
+
+  let lastReason = 'telemetry endpoint unavailable';
+
+  for (const candidate of candidates) {
+    try {
+      const response = await fetch(candidate.url, {
+        headers: authHeaders,
+      });
+
+      if (response.status === 401 || response.status === 403 || response.status === 404) {
+        lastReason = `${candidate.source}:${response.status}`;
+        continue;
+      }
+
+      if (!response.ok) {
+        lastReason = `${candidate.source}:${response.status}`;
+        continue;
+      }
+
+      const payload = await response.json() as Record<string, unknown>;
+      const parsed = parseTelemetryPayload(candidate.source, payload);
+      if (parsed.available) {
+        return parsed;
+      }
+      lastReason = parsed.reason || `${candidate.source}:no-proof-fields`;
+    } catch (error) {
+      lastReason = `${candidate.source}:${error instanceof Error ? error.message : String(error)}`;
+    }
+  }
+
+  return {
+    available: false,
+    reason: lastReason,
+  };
+}
+
+export function formatRuntimeProofLine(
+  proof: RuntimeProofSnapshot,
+  opts: RuntimeProofFormatOpts = {},
+): string {
+  const parts: string[] = [];
+  const surface = [proof.provider, proof.model].filter(Boolean).join('/');
+  if (surface) parts.push(`proof ${surface}`);
+  else parts.push('proof');
+
+  if (proof.promptTokens !== undefined || proof.completionTokens !== undefined || proof.totalTokens !== undefined) {
+    const prompt = proof.promptTokens ?? '?';
+    const completion = proof.completionTokens ?? '?';
+    const total = proof.totalTokens ?? deriveTotalTokens(proof.promptTokens, proof.completionTokens);
+    const totalSuffix = total !== undefined ? ` (${total})` : '';
+    parts.push(`tok ${prompt}/${completion}${totalSuffix}`);
+  }
+
+  if (proof.harnessTurns !== undefined) parts.push(`turns ${proof.harnessTurns}`);
+  if (proof.llmDispatches !== undefined) parts.push(`llm ${proof.llmDispatches}`);
+  if (proof.toolDispatches !== undefined) parts.push(`tools ${proof.toolDispatches}`);
+  if (proof.mcpToolCalls !== undefined) parts.push(`mcp ${proof.mcpToolCalls}`);
+  if (proof.gateSeverity) parts.push(`gate ${proof.gateSeverity}`);
+  if (proof.capHit) parts.push('cap hit');
+
+  if (proof.telemetry?.available) {
+    if (proof.telemetry.source) parts.push(`src ${proof.telemetry.source}`);
+    if (proof.telemetry.runtimeStatus) parts.push(`hive ${proof.telemetry.runtimeStatus}`);
+    if (proof.telemetry.hiveCycleCount !== undefined) parts.push(`cycles ${proof.telemetry.hiveCycleCount}`);
+    if (proof.telemetry.hiveTasksCompleted !== undefined) parts.push(`hive-ok ${proof.telemetry.hiveTasksCompleted}`);
+    if (proof.telemetry.hiveTasksFailed !== undefined) parts.push(`hive-fail ${proof.telemetry.hiveTasksFailed}`);
+    if (proof.telemetry.turns !== undefined && proof.harnessTurns === undefined) {
+      parts.push(`tele-turns ${proof.telemetry.turns}`);
+    }
+    if (proof.telemetry.interceptions !== undefined) parts.push(`intercepts ${proof.telemetry.interceptions}`);
+    if (proof.telemetry.qualityGatedOutcomes !== undefined) parts.push(`gated ${proof.telemetry.qualityGatedOutcomes}`);
+    if (proof.telemetry.blockedUnsafeActions !== undefined) parts.push(`unsafe ${proof.telemetry.blockedUnsafeActions}`);
+    if (proof.telemetry.hallucinationStops !== undefined) parts.push(`hallu ${proof.telemetry.hallucinationStops}`);
+    if (proof.telemetry.qualityScore !== undefined) parts.push(`quality ${formatQualityScore(proof.telemetry.qualityScore)}`);
+    if (proof.telemetry.qualityStatus) parts.push(`status ${proof.telemetry.qualityStatus}`);
+    if (proof.telemetry.passRatePercentToday !== undefined) parts.push(`pass24h ${proof.telemetry.passRatePercentToday}%`);
+    if (proof.telemetry.packetHash) parts.push(`packet ${proof.telemetry.packetHash.slice(0, 12)}`);
+    if (proof.telemetry.complianceState) parts.push(`compliance ${proof.telemetry.complianceState}`);
+  } else if (proof.telemetry?.reason) {
+    parts.push(`src ${proof.telemetry.reason}`);
+  }
+
+  if (proof.latencyMs !== undefined) parts.push(`${Math.round(proof.latencyMs)}ms`);
+
+  const body = parts.join(' | ');
+  if ((opts.mode ?? 'plain') === 'ansi') {
+    return `${ANSI_GREY_OPEN}${body}${ANSI_RESET}`;
+  }
+  return body;
+}
+
+function parseTelemetryPayload(source: string, payload: Record<string, unknown>): RuntimeProofTelemetry {
+  if (source === 'proof-layer-summary') {
+    return parseProofLayerSummary(payload);
+  }
+  if (source === 'hive-runtime-status' || source === 'hive-runtime-status-api') {
+    return parseHiveRuntimeStatus(source, payload);
+  }
+
+  const turns = findNumber(payload, ['turns', 'harnessed_turns', 'loop_turns']);
+  const interceptions = findNumber(payload, ['interceptions', 'intercepts', 'intercept_count']);
+  const qualityGatedOutcomes = findNumber(payload, ['quality_gated_outcomes', 'qualityGatedOutcomes', 'gated_outcomes']);
+  const hallucinationStops = findNumber(payload, ['hallucination_stops', 'hallucinationStops', 'hallucination_blocks']);
+  const blockedUnsafeActions = findNumber(payload, ['blocked_unsafe_actions', 'blockedUnsafeActions', 'unsafe_blocks']);
+  const qualityScore = findNumber(payload, ['quality_score', 'qualityScore']);
+  const qualityStatus = findString(payload, ['quality_status', 'qualityStatus']);
+  const complianceState = findString(payload, ['compliance_state', 'complianceState']);
+  const packetHash = findString(payload, ['packet_hash', 'packetHash', 'harness_packet_hash']);
+  const passRatePercentToday = normalizePercent(findNumber(payload, ['pass_rate_percent_today', 'passRatePercentToday', 'pass_rate']));
+
+  const available =
+    turns !== undefined ||
+    interceptions !== undefined ||
+    qualityGatedOutcomes !== undefined ||
+    hallucinationStops !== undefined ||
+    blockedUnsafeActions !== undefined ||
+    qualityScore !== undefined ||
+    qualityStatus !== undefined ||
+    complianceState !== undefined ||
+    packetHash !== undefined ||
+    passRatePercentToday !== undefined;
+
+  return {
+    available,
+    source,
+    reason: available ? undefined : `${source}:no-proof-fields`,
+    turns,
+    interceptions,
+    qualityGatedOutcomes,
+    hallucinationStops,
+    blockedUnsafeActions,
+    qualityScore,
+    qualityStatus,
+    complianceState,
+    packetHash,
+    passRatePercentToday,
+  };
+}
+
+function parseProofLayerSummary(payload: Record<string, unknown>): RuntimeProofTelemetry {
+  const decisions = readObject(payload.decisions);
+  const gateBlocks = readObject(payload.gate_blocks);
+  const recentIntercepts = Array.isArray(payload.recent_intercepts) ? payload.recent_intercepts : [];
+  const passRateRaw = readNumber(decisions?.pass_rate);
+  const passRatePercentToday = normalizePercent(passRateRaw);
+  const qualityGatedOutcomes = readNumber(gateBlocks?.total);
+  const blockedUnsafeActions = readNumber(gateBlocks?.open_blocking);
+
+  const available =
+    passRatePercentToday !== undefined ||
+    qualityGatedOutcomes !== undefined ||
+    blockedUnsafeActions !== undefined ||
+    recentIntercepts.length > 0;
+
+  return {
+    available,
+    source: 'proof-layer-summary',
+    reason: available ? undefined : 'proof-layer-summary:no-proof-fields',
+    interceptions: recentIntercepts.length > 0 ? recentIntercepts.length : undefined,
+    qualityGatedOutcomes,
+    blockedUnsafeActions,
+    passRatePercentToday,
+  };
+}
+
+function parseHiveRuntimeStatus(source: string, payload: Record<string, unknown>): RuntimeProofTelemetry {
+  const runtimeStatus = findString(payload, ['status']);
+  const hiveCycleCount = findNumber(payload, ['cycleCount']);
+  const hiveTasksCompleted = findNumber(payload, ['tasksCompleted']);
+  const hiveTasksFailed = findNumber(payload, ['tasksFailed']);
+  const available =
+    runtimeStatus !== undefined ||
+    hiveCycleCount !== undefined ||
+    hiveTasksCompleted !== undefined ||
+    hiveTasksFailed !== undefined;
+
+  return {
+    available,
+    source,
+    reason: available ? undefined : `${source}:no-runtime-fields`,
+    runtimeStatus,
+    hiveCycleCount,
+    hiveTasksCompleted,
+    hiveTasksFailed,
+  };
+}
+
+function resolveHarnessAuthHeaders(): Record<string, string> {
+  const ownerToken = readTrimmedFile(OWNER_TOKEN_PATH);
+  if (ownerToken) {
+    return {
+      Authorization: `Bearer ${ownerToken}`,
+      'x-aria-owner': 'true',
+    };
+  }
+
+  const licenseToken = readLicenseToken();
+  if (licenseToken) {
+    return {
+      Authorization: `Bearer ${licenseToken}`,
+    };
+  }
+
+  return {};
+}
+
+function readLicenseToken(): string {
+  if (!fs.existsSync(LICENSE_PATH)) return '';
+  try {
+    const raw = fs.readFileSync(LICENSE_PATH, 'utf-8');
+    const parsed = JSON.parse(raw) as { token?: unknown; jti?: unknown };
+    if (typeof parsed.token === 'string' && parsed.token.trim()) return parsed.token.trim();
+    if (typeof parsed.jti === 'string' && parsed.jti.trim()) return parsed.jti.trim();
+  } catch {
+    return '';
+  }
+  return '';
+}
+
+function readTrimmedFile(filePath: string): string {
+  if (!fs.existsSync(filePath)) return '';
+  try {
+    return fs.readFileSync(filePath, 'utf-8').trim();
+  } catch {
+    return '';
+  }
+}
+
+function deriveTotalTokens(promptTokens?: number, completionTokens?: number): number | undefined {
+  if (promptTokens === undefined && completionTokens === undefined) return undefined;
+  return (promptTokens ?? 0) + (completionTokens ?? 0);
+}
+
+function formatQualityScore(value: number): string {
+  if (value <= 1) {
+    return `${Math.round(value * 100)}%`;
+  }
+  return `${Math.round(value)}`;
+}
+
+function normalizePercent(value: number | undefined): number | undefined {
+  if (value === undefined) return undefined;
+  if (value <= 1) return Math.round(value * 100);
+  return Math.round(value);
+}
+
+function findNumber(root: unknown, keys: string[]): number | undefined {
+  const value = findValue(root, new Set(keys));
+  return readNumber(value);
+}
+
+function findString(root: unknown, keys: string[]): string | undefined {
+  const value = findValue(root, new Set(keys));
+  return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+
+function findValue(root: unknown, keys: Set<string>, seen = new Set<unknown>()): unknown {
+  if (!root || typeof root !== 'object') return undefined;
+  if (seen.has(root)) return undefined;
+  seen.add(root);
+
+  if (Array.isArray(root)) {
+    for (const item of root) {
+      const found = findValue(item, keys, seen);
+      if (found !== undefined) return found;
+    }
+    return undefined;
+  }
+
+  const record = root as Record<string, unknown>;
+  for (const [key, value] of Object.entries(record)) {
+    if (keys.has(key)) return value;
+  }
+  for (const value of Object.values(record)) {
+    const found = findValue(value, keys, seen);
+    if (found !== undefined) return found;
+  }
+  return undefined;
+}
+
+function readObject(value: unknown): Record<string, unknown> | undefined {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined;
+  return value as Record<string, unknown>;
+}
+
+function readNumber(value: unknown): number | undefined {
+  if (typeof value === 'number' && Number.isFinite(value)) return value;
+  if (typeof value === 'string' && value.trim()) {
+    const parsed = Number(value);
+    if (Number.isFinite(parsed)) return parsed;
+  }
+  return undefined;
+}

package/src/self-update.ts

@@ -1,13 +1,12 @@
 // self-update — checks the npm registry for newer @aria_asi/cli versions
-// and surfaces a one-line notice. Doesn't auto-install (clients control
-// their tooling); just informs.
+// and auto-installs them in the background by default.
 //
 // Direction: Hamza 2026-04-26 — "does the package auto update when we
 // enhance it on our enhance? so we can continually improve all night using
 // arias background work we should imrpove to do that once we finish".
 // This is the primitive that closes the overnight-improvement loop:
 // Aria publishes 0.2.5 / 0.3.0 / etc.; clients see the notice on their
-// next `aria <cmd>` invocation; they upgrade with one command.
+// next `aria <cmd>` invocation; Aria upgrades itself in the background.
 //
 // Doctrine bindings:
 //   - feedback_no_demos.md — real overnight evolution, real registry check
@@ -22,21 +21,30 @@
 //   - Reads ~/.aria/last-update-check timestamp; if checked <24h ago, skip
 //   - GET registry.npmjs.org/@aria_asi/cli for latest dist-tag
 //   - semver-compare; if newer, return {updateAvailable: true, latest, current, message}
+//   - Launches npm install -g @aria_asi/cli@latest in the background
+//     unless ARIA_SELF_UPDATE_MODE=notify|off
+//   - Tracks per-version attempts so it doesn't thrash on every invocation
 //   - Write timestamp on every check (success or skip-due-to-rate-limit)
 //   - Failures are silent (network down, registry blip — never block CLI startup)
 //
 // Privacy: the request to npmjs only sends User-Agent (npm registry public).
 // No client identity, no telemetry beyond what the public registry already logs.
 
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
+import { readFileSync, writeFileSync, existsSync, mkdirSync, openSync } from 'node:fs';
+import { spawn } from 'node:child_process';
 import { homedir } from 'node:os';
 import { join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const ARIA_DIR = join(homedir(), '.aria');
 const LAST_CHECK_PATH = join(ARIA_DIR, 'last-update-check');
+const AUTO_UPDATE_STATE_PATH = join(ARIA_DIR, 'self-update-state.json');
+const AUTO_UPDATE_LOG_PATH = join(ARIA_DIR, 'self-update.log');
 const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24h
+const AUTO_UPDATE_RETRY_MS = 6 * 60 * 60 * 1000; // 6h
 const REGISTRY_URL = 'https://registry.npmjs.org/@aria_asi%2Fcli';
+const PACKAGE_NAME = '@aria_asi/cli';
+const AUTO_UPDATE_MODE = (process.env.ARIA_SELF_UPDATE_MODE || 'auto').toLowerCase();
 
 export interface UpdateCheckResult {
   ok: boolean;
@@ -47,6 +55,11 @@ export interface UpdateCheckResult {
   reason?: string;
 }
 
+interface AutoUpdateState {
+  lastAttemptVersion?: string;
+  lastAttemptAt?: number;
+}
+
 /**
  * Find the package's own version by walking up from this file's runtime
  * path until we hit the package.json with name @aria_asi/cli.
@@ -94,6 +107,69 @@ function compareSemver(a: string, b: string): number {
   return pa.pre.localeCompare(pb.pre);
 }
 
+function loadAutoUpdateState(): AutoUpdateState {
+  try {
+    if (!existsSync(AUTO_UPDATE_STATE_PATH)) return {};
+    return JSON.parse(readFileSync(AUTO_UPDATE_STATE_PATH, 'utf-8')) as AutoUpdateState;
+  } catch {
+    return {};
+  }
+}
+
+function saveAutoUpdateState(state: AutoUpdateState): void {
+  try {
+    if (!existsSync(ARIA_DIR)) mkdirSync(ARIA_DIR, { recursive: true, mode: 0o700 });
+    writeFileSync(AUTO_UPDATE_STATE_PATH, JSON.stringify(state, null, 2) + '\n', { mode: 0o600 });
+  } catch {
+    // best effort only
+  }
+}
+
+function canRetryVersion(latest: string): boolean {
+  const state = loadAutoUpdateState();
+  if (state.lastAttemptVersion !== latest) return true;
+  if (!state.lastAttemptAt) return true;
+  return Date.now() - state.lastAttemptAt >= AUTO_UPDATE_RETRY_MS;
+}
+
+function launchAutoInstall(latest: string): { started: boolean; reason?: string } {
+  if (AUTO_UPDATE_MODE === 'off') {
+    return { started: false, reason: 'self-update disabled' };
+  }
+  if (AUTO_UPDATE_MODE === 'notify') {
+    return { started: false, reason: 'notify-only mode' };
+  }
+  if (!canRetryVersion(latest)) {
+    return { started: false, reason: 'recent attempt already made' };
+  }
+
+  try {
+    if (!existsSync(ARIA_DIR)) mkdirSync(ARIA_DIR, { recursive: true, mode: 0o700 });
+    const logFd = openSync(AUTO_UPDATE_LOG_PATH, 'a', 0o600);
+    const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+    const child = spawn(
+      npmCmd,
+      ['install', '-g', `${PACKAGE_NAME}@${latest}`],
+      {
+        detached: true,
+        stdio: ['ignore', logFd, logFd],
+        env: process.env,
+      },
+    );
+    child.unref();
+    saveAutoUpdateState({
+      lastAttemptVersion: latest,
+      lastAttemptAt: Date.now(),
+    });
+    return { started: true };
+  } catch (error) {
+    return {
+      started: false,
+      reason: error instanceof Error ? error.message : String(error),
+    };
+  }
+}
+
 /**
  * Check the registry for the latest @aria_asi/cli version. Rate-limited
  * to once per CHECK_INTERVAL_MS (24h) via a timestamp file in ~/.aria.
@@ -150,20 +226,25 @@ export async function checkForUpdate(opts: { force?: boolean } = {}): Promise<Up
     current,
     latest,
     updateAvailable: true,
-    message: `I have an update: v${latest} (you're on v${current}). Run 'npm update -g @aria_asi/cli' when you have a minute.`,
+    message: `I have an update: v${latest} (you're on v${current}).`,
   };
 }
 
 /**
- * Convenience: check + print the notice if available. Non-blocking, silent
+ * Convenience: check + auto-install if available. Falls back to notice-only
+ * when auto-upgrade is disabled or can't be launched. Non-blocking, silent
  * on errors. Called from bin/aria.js on startup.
  */
 export async function maybePrintUpdateNotice(): Promise<void> {
   try {
     const result = await checkForUpdate();
     if (result.ok && result.updateAvailable && result.message) {
-      // Print to stderr so it doesn't pollute stdout-piped CLI output
-      process.stderr.write(`  ${result.message}\n`);
+      const autoInstall = result.latest ? launchAutoInstall(result.latest) : { started: false, reason: 'missing latest version' };
+      if (autoInstall.started) {
+        process.stderr.write(`  ${result.message} Updating in the background now.\n`);
+      } else {
+        process.stderr.write(`  ${result.message} Run 'npm install -g ${PACKAGE_NAME}@latest' if you want it immediately.\n`);
+      }
     }
   } catch {/* never block startup */}
 }

package/src/setup-wizard.ts

@@ -22,8 +22,14 @@ import { loadConfig, updateConfig, type AriaConfig, type LinkedRepo } from './co
 import { scanCodebase, schemaImageToText } from './codebase-scanner.js';
 import { updatePersona } from './persona.js';
 import { connectClaudeCode } from './connectors/claude-code.js';
+import { connectCodex } from './connectors/codex.js';
+import { connectGitHub, getGitHubStatus } from './github-connect.js';
 
-const HARNESS_URL = process.env.ARIA_HARNESS_BASE_URL || process.env.ARIA_HARNESS_URL || 'https://harness.ariasos.com';
+const HARNESS_URL =
+  process.env.ARIA_HIVE_RUNTIME_URL ||
+  process.env.ARIA_HARNESS_BASE_URL ||
+  process.env.ARIA_HARNESS_URL ||
+  'https://harness.ariasos.com';
 const HARNESS_TOKEN = process.env.ARIA_HARNESS_TOKEN || '';
 const ARIA_DIR = join(homedir(), '.aria');
 const LICENSE_PATH = join(ARIA_DIR, 'license.json');
@@ -98,6 +104,8 @@ export async function runSetupWizard(): Promise<void> {
       if (!userMessage) userMessage = resp.depthOptions[0]?.signal ?? 'next';
     }
 
+    await maybeOfferGitHubConnect(ask);
+
     console.log('\n✅ Setup complete. Run `aria status` anytime.\n');
   } finally {
     rl.close();
@@ -134,6 +142,30 @@ async function callConverse(body: {
   }
 }
 
+async function maybeOfferGitHubConnect(ask: (q: string) => Promise<string>): Promise<void> {
+  const status = getGitHubStatus();
+  if (!status.ghInstalled || status.authenticated) {
+    return;
+  }
+
+  const raw = (await ask('\nOptional: connect GitHub now for repo workflows and private package access? [y/N] ')).trim().toLowerCase();
+  if (raw !== 'y' && raw !== 'yes') {
+    console.log('     skipping GitHub for now — you can run `aria github connect` later.');
+    return;
+  }
+
+  try {
+    const result = connectGitHub({ interactive: true });
+    if (!result.ok) {
+      console.warn(`     ⚠ GitHub connect did not complete: ${result.error || 'unknown error'}`);
+      return;
+    }
+    for (const line of result.logs) console.log(`     ${line}`);
+  } catch (err) {
+    console.warn(`     ⚠ GitHub connect hit an error: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+
 async function applyConfigWrites(writes: ConfigWrite[]): Promise<void> {
   for (const w of writes) {
     try {
@@ -218,7 +250,10 @@ async function applyConfigWrites(writes: ConfigWrite[]): Promise<void> {
         // canonical connector entry point.
         try {
           const config = loadConfig();
-          const logs = await connectClaudeCode(config, { force: w.force === true });
+          const logs = [
+            ...(await connectClaudeCode(config, { force: w.force === true })),
+            ...(await connectCodex(config)),
+          ];
           for (const line of logs) console.log(`     ${line}`);
         } catch (err) {
           console.warn(`     ⚠ Gate install hit an error: ${err instanceof Error ? err.message : String(err)}`);