@aria_asi/cli 0.2.33 → 0.2.34

package/dist/runtime/hooks/aria-import-resolution-gate.mjs

@@ -0,0 +1,330 @@
+#!/usr/bin/env node
+// Aria import-resolution gate — pre-deploy check that every TypeScript
+// import in the deploy candidate resolves against an actual exported
+// symbol on disk.
+//
+// Doctrine being enforced (memory:feedback_no_assumption_without_verification.md):
+//   "every behavioral claim must cite a verifiedAgainst source."
+//   The empty consciousness.ts crash on 2026-04-28 happened because
+//   event-bus.ts:11 imported `consciousness` from a file that existed
+//   but exported nothing. tsc allowed it (because the file matched as a
+//   module), the deploy passed admission policy, the runtime crashed.
+//
+//   This gate scans every import statement in the deploy candidate's
+//   source tree; for each, it verifies that the named symbol is
+//   actually exported from the resolved file. If any import targets a
+//   symbol that isn't exported, the gate fails and refuses the deploy.
+//
+// Runs as a PostToolUse hook on Edit/Write/NotebookEdit AND as a
+// pre-deploy assertion in scripts/deploy-service.sh.
+//
+// Mode 1 (post-tool-use): scan only the file just edited; report broken
+//   imports inline so the model sees them in the next turn's context.
+// Mode 2 (pre-deploy via CLI args): scan a whole subtree (passed as
+//   first positional arg); exit 13 if any broken import found.
+//
+// Audit log: ~/.claude/aria-import-resolution-gate.log
+
+import { readFileSync, existsSync, statSync, readdirSync, appendFileSync } from 'node:fs';
+import { dirname, resolve, join, extname } from 'node:path';
+import { homedir } from 'node:os';
+
+const HOME = process.env.HOME || homedir() || '/tmp';
+const LOG = `${HOME}/.claude/aria-import-resolution-gate.log`;
+
+function audit(decision, summary) {
+  try {
+    appendFileSync(LOG, `${new Date().toISOString()} ${decision} ${summary}\n`);
+  } catch {}
+}
+
+// Per feedback_no_timeouts_doctrine.md — no deadlines, real-error driven.
+// Per feedback_no_graceful_degradation.md — fail loudly, not silent-pass.
+
+const TS_IMPORT_RX =
+  /\bimport\s+(?:type\s+)?(?:(\w+)\s*,\s*)?(?:\{([^}]+)\}|\*\s+as\s+(\w+)|(\w+))\s+from\s+['"]([^'"]+)['"]/g;
+const TS_REEXPORT_RX =
+  /\bexport\s+(?:type\s+)?(?:\{([^}]+)\}|\*(?:\s+as\s+\w+)?)\s+from\s+['"]([^'"]+)['"]/g;
+
+const SOURCE_EXTS = ['.ts', '.tsx', '.js', '.mjs', '.cjs'];
+const INDEX_NAMES = SOURCE_EXTS.map((e) => `index${e}`);
+
+function resolveSpecifier(fromFile, specifier) {
+  // Skip node_modules / package imports — only resolve relative imports
+  // for now (those are the failure mode the consciousness.ts crash hit).
+  if (!specifier.startsWith('.') && !specifier.startsWith('/')) return null;
+
+  const baseDir = dirname(fromFile);
+  const abs = resolve(baseDir, specifier);
+
+  // Try exact path first.
+  if (existsSync(abs) && statSync(abs).isFile()) return abs;
+
+  // Try with each extension.
+  for (const ext of SOURCE_EXTS) {
+    const withExt = abs + ext;
+    if (existsSync(withExt) && statSync(withExt).isFile()) return withExt;
+    // Strip .js suffix and try .ts (TS resolution quirk).
+    if (specifier.endsWith('.js')) {
+      const tsCandidate = abs.replace(/\.js$/, '.ts');
+      if (existsSync(tsCandidate) && statSync(tsCandidate).isFile()) return tsCandidate;
+    }
+  }
+
+  // Try directory/index.{ts,tsx,...}.
+  if (existsSync(abs) && statSync(abs).isDirectory()) {
+    for (const idx of INDEX_NAMES) {
+      const indexPath = join(abs, idx);
+      if (existsSync(indexPath) && statSync(indexPath).isFile()) return indexPath;
+    }
+  }
+
+  return null;
+}
+
+function readFileSafe(path) {
+  try {
+    return readFileSync(path, 'utf-8');
+  } catch {
+    return null;
+  }
+}
+
+function extractExports(content) {
+  // Very conservative export extraction — matches:
+  //   export { foo, bar }
+  //   export const|let|var|function|class|interface|type|enum NAME
+  //   export default ...
+  //   export * from '...'
+  //   re-exports `export { foo } from '...'`
+  // Returns { named: Set<string>, hasDefault: boolean, hasStar: boolean }
+  const named = new Set();
+  let hasDefault = false;
+  let hasStar = false;
+
+  if (!content) return { named, hasDefault, hasStar };
+
+  // Strip block comments + line comments (rough; good enough for export detection).
+  const stripped = content
+    .replace(/\/\*[\s\S]*?\*\//g, '')
+    .replace(/\/\/[^\n]*/g, '');
+
+  // export { foo, bar as baz }
+  const namedListRx = /\bexport\s+(?:type\s+)?\{([^}]+)\}/g;
+  let m;
+  while ((m = namedListRx.exec(stripped))) {
+    for (const part of m[1].split(',')) {
+      const trimmed = part.trim();
+      if (!trimmed) continue;
+      const asMatch = trimmed.match(/^\S+\s+as\s+(\S+)$/);
+      const name = asMatch ? asMatch[1] : trimmed.split(/\s+/)[0];
+      if (name && /^\w+$/.test(name)) named.add(name);
+    }
+  }
+
+  // export const|let|var|function|async function|class|interface|type|enum NAME
+  const declRx =
+    /\bexport\s+(?:type\s+|async\s+)?(?:default\s+)?(?:const|let|var|function|class|interface|type|enum)\s+(\w+)/g;
+  while ((m = declRx.exec(stripped))) {
+    named.add(m[1]);
+  }
+
+  // export default
+  if (/\bexport\s+default\b/.test(stripped)) hasDefault = true;
+
+  // export * from '...'
+  if (/\bexport\s+\*(?:\s+as\s+\w+)?\s+from\b/.test(stripped)) hasStar = true;
+
+  return { named, hasDefault, hasStar };
+}
+
+function checkFileImports(filePath, visited = new Set()) {
+  if (visited.has(filePath)) return [];
+  visited.add(filePath);
+
+  const content = readFileSafe(filePath);
+  if (!content) return [];
+
+  // Skip non-source files.
+  if (!SOURCE_EXTS.includes(extname(filePath))) return [];
+
+  const violations = [];
+  let match;
+  TS_IMPORT_RX.lastIndex = 0;
+  while ((match = TS_IMPORT_RX.exec(content))) {
+    const [, defaultBinding, namedList, namespaceBinding, simpleNamed, specifier] = match;
+    const resolved = resolveSpecifier(filePath, specifier);
+    if (!resolved) continue; // package import — skip
+
+    const targetContent = readFileSafe(resolved);
+    if (!targetContent) {
+      violations.push({
+        file: filePath,
+        specifier,
+        resolved,
+        kind: 'unreadable',
+        message: `import '${specifier}' resolves to ${resolved} but file is unreadable`,
+      });
+      continue;
+    }
+
+    if (targetContent.trim().length === 0) {
+      violations.push({
+        file: filePath,
+        specifier,
+        resolved,
+        kind: 'empty_target',
+        message: `import '${specifier}' resolves to ${resolved} but file is EMPTY (no exports) — this is the consciousness.ts-class crash`,
+      });
+      continue;
+    }
+
+    const { named, hasDefault, hasStar } = extractExports(targetContent);
+
+    if (defaultBinding && !hasDefault && !hasStar) {
+      violations.push({
+        file: filePath,
+        specifier,
+        resolved,
+        kind: 'missing_default',
+        message: `import default '${defaultBinding}' from '${specifier}' but ${resolved} has no default export`,
+      });
+    }
+
+    if (namespaceBinding) {
+      // import * as ns — passes as long as the file has any exports.
+      if (named.size === 0 && !hasDefault && !hasStar) {
+        violations.push({
+          file: filePath,
+          specifier,
+          resolved,
+          kind: 'empty_namespace',
+          message: `import * as '${namespaceBinding}' from '${specifier}' but ${resolved} exports nothing`,
+        });
+      }
+    }
+
+    const explicitNamed = (namedList || simpleNamed || '').trim();
+    if (explicitNamed) {
+      const wantedNames = (namedList || simpleNamed)
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean)
+        .map((s) => {
+          const asMatch = s.match(/^(\S+)\s+as\s+\S+$/);
+          return asMatch ? asMatch[1] : s.split(/\s+/)[0];
+        })
+        .filter((s) => /^\w+$/.test(s));
+
+      for (const wanted of wantedNames) {
+        if (!named.has(wanted) && !hasStar) {
+          violations.push({
+            file: filePath,
+            specifier,
+            resolved,
+            kind: 'missing_named',
+            message: `import { ${wanted} } from '${specifier}' but ${resolved} does not export '${wanted}' (named exports: ${[...named].slice(0, 8).join(', ')}${named.size > 8 ? '…' : ''})`,
+          });
+        }
+      }
+    }
+  }
+
+  return violations;
+}
+
+function walkDir(dir, out = []) {
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  for (const ent of entries) {
+    if (ent.name === 'node_modules' || ent.name === 'dist' || ent.name.startsWith('.')) continue;
+    const p = join(dir, ent.name);
+    if (ent.isDirectory()) walkDir(p, out);
+    else if (SOURCE_EXTS.includes(extname(ent.name))) out.push(p);
+  }
+  return out;
+}
+
+// ── Mode dispatch ────────────────────────────────────────────────────────
+
+const args = process.argv.slice(2);
+
+if (args.length > 0) {
+  // Mode 2: pre-deploy CLI scan.
+  const target = resolve(args[0]);
+  const targetIsDir = existsSync(target) && statSync(target).isDirectory();
+  const files = targetIsDir ? walkDir(target) : [target];
+
+  let totalViolations = 0;
+  const allViolations = [];
+  for (const f of files) {
+    const violations = checkFileImports(f);
+    if (violations.length > 0) {
+      allViolations.push(...violations);
+      totalViolations += violations.length;
+    }
+  }
+
+  if (totalViolations > 0) {
+    console.error(`\n❌ aria-import-resolution-gate: ${totalViolations} broken imports across ${files.length} files`);
+    for (const v of allViolations) {
+      console.error(`  [${v.kind}] ${v.file}: ${v.message}`);
+    }
+    audit(`block-deploy violations=${totalViolations} target=${target}`, '');
+    process.exit(13);
+  }
+
+  console.log(`✓ aria-import-resolution-gate: ${files.length} files scanned, all imports resolve to real exports`);
+  audit(`allow-deploy files=${files.length} target=${target}`, '');
+  process.exit(0);
+}
+
+// Mode 1: PostToolUse hook on Edit/Write/NotebookEdit.
+let stdin = '';
+try {
+  for await (const chunk of process.stdin) stdin += chunk;
+} catch {}
+
+let event;
+try {
+  event = JSON.parse(stdin);
+} catch {
+  process.exit(0); // Malformed input — let it through; this gate is informational in hook mode.
+}
+
+const toolName = event.tool_name ?? event.toolName ?? '';
+if (!['Edit', 'Write', 'NotebookEdit'].includes(toolName)) process.exit(0);
+
+const filePath =
+  event.tool_input?.file_path ??
+  event.toolInput?.file_path ??
+  event.tool_input?.notebook_path ??
+  event.toolInput?.notebook_path;
+
+if (!filePath || !SOURCE_EXTS.includes(extname(filePath))) process.exit(0);
+if (!existsSync(filePath)) process.exit(0);
+
+const violations = checkFileImports(filePath);
+if (violations.length === 0) {
+  audit(`allow-edit ${filePath}`, '');
+  process.exit(0);
+}
+
+const message = [
+  `aria-import-resolution-gate detected ${violations.length} broken imports in ${filePath}:`,
+  ...violations.map((v) => `  [${v.kind}] ${v.message}`),
+  '',
+  'These imports compile under tsc but will crash at runtime — the consciousness.ts-class failure mode.',
+  'Per memory:feedback_no_assumption_without_verification.md, fix the export side BEFORE shipping.',
+].join('\n');
+
+audit(`flag-edit ${filePath} violations=${violations.length}`, '');
+console.error(message);
+// Hook mode is INFORMATIONAL (exit 0) so the model sees the message but
+// can decide whether to fix immediately or proceed. The pre-deploy mode
+// is the structural enforcement (exit 13 blocks the deploy).
+process.exit(0);

package/dist/runtime/hooks/aria-outcome-record.mjs

@@ -0,0 +1,84 @@
+#!/usr/bin/env node
+// aria-outcome-record.mjs — PostToolUse hook that records action outcomes
+// to /api/harness/outcome-record (Sonnet H's #76 endpoint). Composes with
+// aria-discovery-record + the regression sweeper to make the outcome ledger
+// actually accumulate rows.
+//
+// Fires on every Bash|Edit|Write|NotebookEdit tool completion.
+// Fire-and-forget: HTTP failures are swallowed — never blocks the tool pipeline.
+//
+// Tier-aware: reads license.json for client-tier token; falls back to env vars
+// for owner tier. Never carries master token in client-tier POST bodies.
+//
+// Doctrine: feedback_no_flag_without_fix.md — outcomes recorded, not deferred.
+//           feedback_implementation_coupled_cognition.md — POST IS the impl.
+
+import { readFileSync, existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+
+const HOME = homedir();
+const LICENSE_PATH = `${HOME}/.aria/license.json`;
+
+let input = '';
+for await (const chunk of process.stdin) input += chunk;
+let event;
+try { event = JSON.parse(input); } catch { process.exit(0); }
+
+const toolName = event.tool_name || event.toolName || '';
+if (!['Bash', 'Edit', 'Write', 'NotebookEdit'].includes(toolName)) process.exit(0);
+
+// Derive action_kind + action_target
+let actionKind, actionTarget;
+if (toolName === 'Bash') {
+  actionKind = 'bash';
+  const cmd = event.tool_input?.command || '';
+  actionTarget = (cmd.split(/\s+/)[0] || 'unknown').slice(0, 100);
+} else {
+  actionKind = 'edit';
+  actionTarget = (event.tool_input?.file_path || event.tool_input?.path || 'unknown').slice(0, 200);
+}
+
+// Tier-aware auth: client license.json overrides env vars
+const harnessUrl =
+  process.env.ARIA_HIVE_RUNTIME_URL ||
+  process.env.ARIA_HARNESS_BASE_URL ||
+  process.env.ARIA_HARNESS_URL ||
+  'https://harness.ariasos.com';
+let harnessToken = process.env.ARIA_HARNESS_TOKEN || process.env.ARIA_API_KEY || '';
+let isClientTier = false;
+try {
+  if (existsSync(LICENSE_PATH)) {
+    const lic = JSON.parse(readFileSync(LICENSE_PATH, 'utf8'));
+    if (lic.jti) {
+      isClientTier = true;
+      // Client tier: use their license token, never master token
+      harnessToken = lic.token || lic.license || harnessToken;
+    }
+  }
+} catch { /* non-fatal — fall back to env */ }
+
+const sessionId = event.session_id || event.sessionId || 'unknown';
+const success = !event.tool_response?.error && event.tool_response?.type !== 'error';
+
+// Fire-and-forget POST to outcome-record — never blocks, never throws
+fetch(`${harnessUrl}/api/harness/outcome-record`, {
+  method: 'POST',
+  headers: {
+    'Content-Type': 'application/json',
+    'Authorization': `Bearer ${harnessToken}`,
+  },
+  body: JSON.stringify({
+    sessionId,
+    actionKind,
+    actionTarget,
+    actionShape: {
+      tool: toolName,
+      success,
+      isClientTier,
+    },
+  }),
+}).catch(() => {/* fire-and-forget — HTTP failures are silently dropped */});
+
+// Exit immediately — don't await the fetch; this is a PostToolUse hook
+// and must not add meaningful latency to the tool pipeline.
+process.exit(0);