@aria_asi/cli 0.2.33 → 0.2.35

package/dist/aria-connector/src/connectors/codex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../../../src/connectors/codex.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAw0B/C,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAkBxE"}
+{"version":3,"file":"codex.d.ts","sourceRoot":"","sources":["../../../../src/connectors/codex.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AA+3B/C,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAkBxE"}

package/dist/aria-connector/src/connectors/codex.js

@@ -68,6 +68,7 @@ function tomlString(value) {
 }
 function buildCodexHookRuntimeClient() {
     return `import { readFileSync, existsSync, mkdirSync, writeFileSync, unlinkSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
 import { createHash, randomUUID } from 'node:crypto';
 import { homedir } from 'node:os';
 import path from 'node:path';
@@ -76,6 +77,7 @@ import { HTTPHarnessClient } from '@aria_asi/harness-http-client';
 const HOME = homedir();
 const DEFAULT_RUNTIME_URL = (process.env.ARIA_RUNTIME_URL || 'http://127.0.0.1:4319').replace(/\\/+$/, '');
 const TURN_STATE_DIR = path.join(HOME, '.codex', 'tmp', 'aria-hook-turn-state');
+const GOVERNANCE_GATE_PATH = path.join(HOME, '.aria', 'bin', 'aria-governance-gate');
 
 function readToken() {
   const envToken = process.env.ARIA_API_KEY || process.env.ARIA_MASTER_TOKEN || process.env.OPENAI_API_KEY;
@@ -301,6 +303,22 @@ export function emitJson(payload, code = 0) {
   process.stdout.write(\`\${JSON.stringify(payload)}\\n\`);
   process.exit(code);
 }
+
+export function runGovernanceGate(payload = {}) {
+  if (!existsSync(GOVERNANCE_GATE_PATH)) return null;
+  const child = spawnSync(GOVERNANCE_GATE_PATH, {
+    input: \`\${JSON.stringify(payload)}\\n\`,
+    encoding: 'utf8',
+    maxBuffer: 1024 * 1024,
+  });
+  const stdout = String(child.stdout || '').trim();
+  let result = null;
+  try { result = stdout ? JSON.parse(stdout) : null; } catch {}
+  if (child.status !== 0 || result?.ok === false || result?.decision === 'block') {
+    throw new Error(stdout || child.stderr || 'aria-governance-gate blocked this Codex hook.');
+  }
+  return result;
+}
 `;
 }
 function buildCodexUserPromptHook() {
@@ -316,6 +334,7 @@ import {
   runtimePost,
   loadTurnState,
   saveTurnState,
+  runGovernanceGate,
   emitJson,
 } from './lib/runtime-client.mjs';
 
@@ -334,6 +353,13 @@ try {
     message: userText || 'codex turn start',
   });
   const packetRef = makeEvidenceRef('harness_packet', packet, { sessionId, platform: 'codex' });
+  runGovernanceGate({
+    sessionId,
+    sourceRuntime: 'codex',
+    surface: 'codex-userprompt-submit',
+    text: userText.slice(0, 8000),
+    evidence: packetRef,
+  });
   const result = await runtimePost('/mizan/pre', {
     sessionId,
     packet,
@@ -376,7 +402,6 @@ try {
 function buildCodexPreToolHook() {
     return `#!/usr/bin/env node
 import {
-  getHarnessClient,
   inferSessionId,
   classifyAction,
   summarizeTarget,
@@ -384,11 +409,11 @@ import {
   loadTurnState,
   makeEvidenceRef,
   saveTurnState,
+  runGovernanceGate,
   emitJson,
 } from './lib/runtime-client.mjs';
 
 const event = readEventFromStdin();
-const client = getHarnessClient();
 const sessionId = inferSessionId(event);
 const action = classifyAction(event);
 const target = summarizeTarget(event);
@@ -409,6 +434,17 @@ try {
     });
   }
   const toolName = String(event?.tool_name || event?.toolName || '').trim() || null;
+  runGovernanceGate({
+    sessionId,
+    sourceRuntime: 'codex',
+    surface: 'codex-pre-tool-use',
+    text: JSON.stringify(event).slice(0, 8000),
+    action,
+    toolName,
+    isDeploy: action === 'deploy',
+    isMutation: action === 'write' || action === 'delete',
+    evidence: makeEvidenceRef('codex_tool_request', { action, toolName, target }, { sessionId }),
+  });
   const tools = Array.isArray(state?.tools) ? state.tools.slice(-24) : [];
   tools.push({
     at: new Date().toISOString(),
@@ -470,7 +506,6 @@ try {
 function buildCodexStopHook() {
     return `#!/usr/bin/env node
 import {
-  getHarnessClient,
   inferSessionId,
   extractAssistantText,
   readEventFromStdin,
@@ -479,11 +514,11 @@ import {
   makeEvidenceRef,
   clearTurnState,
   formatValidationFailure,
+  runGovernanceGate,
   emitJson,
 } from './lib/runtime-client.mjs';
 
 const event = readEventFromStdin();
-const client = getHarnessClient();
 const sessionId = inferSessionId(event);
 const state = loadTurnState(sessionId);
 const text = extractAssistantText(event);
@@ -494,6 +529,14 @@ try {
   if (!text) {
     emitJson({ continue: true });
   }
+  runGovernanceGate({
+    sessionId,
+    sourceRuntime: 'codex',
+    surface: 'codex-stop',
+    text: text.slice(0, 8000),
+    isOutputCloseout: true,
+    evidence: outputRef,
+  });
   const validation = await runtimePost('/validate-output', {
     text,
     sessionId,
@@ -558,7 +601,19 @@ try {
     },
   });
   if (typeof state?.userText === 'string' && state.userText.trim()) {
-    await client.gardenTurn(sessionId, state.userText, text, state?.userId || undefined);
+    await runtimePost('/garden/turn', {
+      sessionId,
+      message: state.userText,
+      response: text,
+      userId: state?.userId || undefined,
+      requireCognitionBlock: false,
+      metadata: {
+        decision_type: 'codex-stop-garden-turn',
+        decision_category: 'codex-hooks',
+        trace_id: state?.traceId || null,
+        output_ref: outputRef,
+      },
+    });
   }
   clearTurnState(sessionId);
   emitJson({ continue: true });

package/dist/aria-connector/src/connectors/codex.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../../../src/connectors/codex.ts"],"names":[],"mappings":"AAAA,8HAA8H;AAE9H,OAAO,EACL,UAAU,EACV,SAAS,EACT,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,aAAa,EACb,YAAY,GACb,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEnE,SAAS,aAAa;IACpB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB,EAAE,IAAc;IAClD,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,yBAAyB,MAAM,sBAAsB,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE;YAAE,SAAS;QACtC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3C,MAAM,EAAE,CAAC;IACX,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,uBAAuB,MAAM,aAAa,MAAM,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB,EAAE,IAAc;IAC1D,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO;IAEhC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,qBAAqB,CAAC,CAAC;IACxF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5C,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEtD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE;YAAE,SAAS;QACtC,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,cAAc;YAAE,SAAS;QACjE,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAClC,IAAI,CAAC,SAAS,CAAC;QACb,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,qDAAqD;QAClE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE;YACP,GAAG,EAAE;gBACH,KAAK,EAAE,mBAAmB;gBAC1B,MAAM,EAAE,iBAAiB;aAC1B;SACF;QACD,OAAO,EAAE,KAAK;KACf,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAClB,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,kCAAkC,OAAO,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0OR,CAAC;AACF,CAAC;AAED,SAAS,wBAAwB;IAC/B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmER,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsDR,CAAC;AACF,CAAC;AAED,SAAS,sBAAsB;IAC7B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCR,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoGR,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAClF,OAAO;;gBAEO,UAAU,CAAC,QAAQ,CAAC;;;yCAGK,OAAO,CAAC,4BAA4B,CAAC;;;;yCAIrC,OAAO,CAAC,uBAAuB,CAAC;;;;yCAIhC,OAAO,CAAC,wBAAwB,CAAC;;;yCAGjC,OAAO,CAAC,eAAe,CAAC;;CAEhE,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB,EAAE,IAAc;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,gEAAgE,CAAC;IACrF,IAAI,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,IAAI,IAAI,IAAI,CAAC;QAC/C,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;IAC9B,CAAC;IACD,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,CAAC,0CAA0C,UAAU,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB,EAAE,IAAc;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAExE,MAAM,KAAK,GAA4B;QACrC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,oBAAoB,CAAC,EAAE,2BAA2B,EAAE,CAAC;QACjF,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,4BAA4B,CAAC,EAAE,wBAAwB,EAAE,CAAC;QAC/E,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,EAAE,qBAAqB,EAAE,CAAC;QACvE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,wBAAwB,CAAC,EAAE,sBAAsB,EAAE,CAAC;QACzE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,kBAAkB,EAAE,CAAC;KAC7D,CAAC;IAEF,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACxC,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC;YAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;IACxD,uBAAuB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,eAAe,CAAC,OAAmB;IAC1C,OAAO;;;;;;;;;;;6BAWoB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC;0BACvC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC;2BACzC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,qBAAqB,CAAC;oBACzF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,0BAA0B,EAAE,SAAS,EAAE,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCzG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,0BAA0B,EAAE,SAAS,EAAE,WAAW,CAAC;;;;;;OAM5F,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,0BAA0B,EAAE,SAAS,EAAE,WAAW,CAAC;;CAElG,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAkB;IAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;SACnD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,KAAK,EAAE,CAAC;SAC/C,IAAI,CAAC,MAAM,CAAC,CAAC;IAEhB,OAAO;;;;EAIP,aAAa,CAAC,OAAO,CAAC;;;EAGtB,QAAQ,IAAI,mBAAmB;;;EAG/B,UAAU,IAAI,iDAAiD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyChE,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+CR,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,MAAkB,EAAE,IAAc;IACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,0BAA0B,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACjD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEvD,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACpD,aAAa,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC;QAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAE7C,IAAI,CAAC,IAAI,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,MAAkB,EAAE,IAAc;IAC3E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACpD,aAAa,CAAC,UAAU,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC,IAAI,CAAC,+BAA+B,UAAU,EAAE,CAAC,CAAC;IAEvD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC9D,aAAa,CAAC,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,IAAI,CAAC,qCAAqC,YAAY,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAkB;IACnD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IAEhD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC3B,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnC,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACrC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAClC,0BAA0B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC3C,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../../../src/connectors/codex.ts"],"names":[],"mappings":"AAAA,8HAA8H;AAE9H,OAAO,EACL,UAAU,EACV,SAAS,EACT,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,aAAa,EACb,YAAY,GACb,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEnE,SAAS,aAAa;IACpB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB,EAAE,IAAc;IAClD,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,yBAAyB,MAAM,sBAAsB,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE;YAAE,SAAS;QACtC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3C,MAAM,EAAE,CAAC;IACX,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,uBAAuB,MAAM,aAAa,MAAM,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB,EAAE,IAAc;IAC1D,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO;IAEhC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,qBAAqB,CAAC,CAAC;IACxF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5C,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEtD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE;YAAE,SAAS;QACtC,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,cAAc;YAAE,SAAS;QACjE,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAClC,IAAI,CAAC,SAAS,CAAC;QACb,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,qDAAqD;QAClE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE;YACP,GAAG,EAAE;gBACH,KAAK,EAAE,mBAAmB;gBAC1B,MAAM,EAAE,iBAAiB;aAC1B;SACF;QACD,OAAO,EAAE,KAAK;KACf,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAClB,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,kCAAkC,OAAO,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4PR,CAAC;AACF,CAAC;AAED,SAAS,wBAAwB;IAC/B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2ER,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgER,CAAC;AACF,CAAC;AAED,SAAS,sBAAsB;IAC7B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkCR,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuHR,CAAC;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAClF,OAAO;;gBAEO,UAAU,CAAC,QAAQ,CAAC;;;yCAGK,OAAO,CAAC,4BAA4B,CAAC;;;;yCAIrC,OAAO,CAAC,uBAAuB,CAAC;;;;yCAIhC,OAAO,CAAC,wBAAwB,CAAC;;;yCAGjC,OAAO,CAAC,eAAe,CAAC;;CAEhE,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB,EAAE,IAAc;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,gEAAgE,CAAC;IACrF,IAAI,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,IAAI,IAAI,IAAI,CAAC;QAC/C,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;IAC9B,CAAC;IACD,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,CAAC,0CAA0C,UAAU,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB,EAAE,IAAc;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAExE,MAAM,KAAK,GAA4B;QACrC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,oBAAoB,CAAC,EAAE,2BAA2B,EAAE,CAAC;QACjF,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,4BAA4B,CAAC,EAAE,wBAAwB,EAAE,CAAC;QAC/E,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,EAAE,qBAAqB,EAAE,CAAC;QACvE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,wBAAwB,CAAC,EAAE,sBAAsB,EAAE,CAAC;QACzE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,kBAAkB,EAAE,CAAC;KAC7D,CAAC;IAEF,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACxC,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC;YAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;IACxD,uBAAuB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,eAAe,CAAC,OAAmB;IAC1C,OAAO;;;;;;;;;;;6BAWoB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC;0BACvC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC;2BACzC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,qBAAqB,CAAC;oBACzF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,0BAA0B,EAAE,SAAS,EAAE,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCzG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,0BAA0B,EAAE,SAAS,EAAE,WAAW,CAAC;;;;;;OAM5F,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,0BAA0B,EAAE,SAAS,EAAE,WAAW,CAAC;;CAElG,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAkB;IAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;SACnD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,KAAK,EAAE,CAAC;SAC/C,IAAI,CAAC,MAAM,CAAC,CAAC;IAEhB,OAAO;;;;EAIP,aAAa,CAAC,OAAO,CAAC;;;EAGtB,QAAQ,IAAI,mBAAmB;;;EAG/B,UAAU,IAAI,iDAAiD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyChE,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+CR,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,MAAkB,EAAE,IAAc;IACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,0BAA0B,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACjD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEvD,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACpD,aAAa,CAAC,SAAS,EAAE,gBAAgB,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC;QAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAE7C,IAAI,CAAC,IAAI,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,MAAkB,EAAE,IAAc;IAC3E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACpD,aAAa,CAAC,UAAU,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC,IAAI,CAAC,+BAA+B,UAAU,EAAE,CAAC,CAAC;IAEvD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC9D,aAAa,CAAC,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,IAAI,CAAC,qCAAqC,YAAY,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAkB;IACnD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IAEhD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC3B,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnC,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACrC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAClC,0BAA0B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC3C,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/assets/hooks/aria-harness-via-sdk.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// Aria harness fetch — via the canonical @aria/harness-http-client SDK.
+// Aria harness fetch — via the canonical @aria_asi/harness-http-client SDK.
 //
 // Why this exists: doctrine says "use harness http client to be Aria's
 // control plane so you don't mess up". The earlier hook (aria-harness-fetch.sh)
@@ -245,6 +245,10 @@ function sanitizeSessionId(sessionId) {
   return String(sessionId || 'claude-code').replace(/[^a-zA-Z0-9_-]/g, '_');
 }
 
+function currentHookSessionId() {
+  return HOOK_EVENT?.session_id || HOOK_EVENT?.sessionId || 'claude-code';
+}
+
 function lastUserMessageFromEvent() {
   const messages = Array.isArray(HOOK_EVENT?.messages) ? HOOK_EVENT.messages : [];
   for (let index = messages.length - 1; index >= 0; index -= 1) {
@@ -278,7 +282,7 @@ function persistMizanReceipt(sessionId, payload) {
 
 async function runMizanPre(apiKey, packet, sourceLabel) {
   if (!isTurn) return null;
-  const sessionId = HOOK_EVENT?.session_id || HOOK_EVENT?.sessionId || 'claude-code';
+  const sessionId = currentHookSessionId();
   const packetHash = createHash('sha256').update(JSON.stringify(packet || {})).digest('hex');
   const response = await fetch(`${DEFAULT_RUNTIME_URL.replace(/\/+$/, '')}/mizan/pre`, {
     method: 'POST',
@@ -342,12 +346,17 @@ async function tryViaSdk(baseUrl, apiKey) {
     // identifies owner tier from the Bearer token (isMasterTokenRequest).
     // Hardcoding isHamza:false in the body would override that server-side
     // signal and produce hamza:false in the packet even for master-token callers.
+      const sessionId = currentHookSessionId();
       const bodyOverride = {
       message: isTurn ? 'Claude turn refresh — harness via SDK' : 'Claude session start — harness via SDK',
       stage: isTurn ? 'checkpoint' : 'preflight',
+      sessionId,
       actor: 'claude-code',
       system: 'claude-coding-agent',
-      platform: 'harness-http-client',
+      platform: 'claude-code',
+      deliverySurface: 'claude_code_session',
+      userId: 'hamza',
+      isHamza: true,
       // Bonus #74: forward conversation history so codex handler can report
       // a non-zero conversation_history_count in the packet.
       ...(HOOK_EVENT_MESSAGES ? { messages: HOOK_EVENT_MESSAGES } : {}),
@@ -372,10 +381,14 @@ async function tryViaSdk(baseUrl, apiKey) {
     body: JSON.stringify({
       message: isTurn ? 'Claude turn refresh — harness via SDK' : 'Claude session start — harness via SDK',
       stage: isTurn ? 'checkpoint' : 'preflight',
+      sessionId: currentHookSessionId(),
       actor: 'claude-code',
       system: 'claude-coding-agent',
       roleProfile: 'general_worker',
+      platform: 'claude-code',
       deliverySurface: 'claude_code_session',
+      userId: 'hamza',
+      isHamza: true,
       // Bonus #74: forward conversation history (same field as SDK path above).
       ...(HOOK_EVENT_MESSAGES ? { messages: HOOK_EVENT_MESSAGES } : {}),
     }),

package/dist/assets/hooks/aria-pre-tool-gate.mjs

@@ -58,6 +58,24 @@ const HOME = process.env.HOME || '/tmp';
 const LOG = `${HOME}/.claude/aria-pre-tool-gate.log`;
 const HEARTBEAT = `${HOME}/.claude/aria-pre-tool-gate-heartbeat.jsonl`;
 const GATE_LOOP_STATE_PATH = `${HOME}/.claude/.aria-gate-loop-state.json`;
+const GOVERNANCE_GATE_PATH = `${HOME}/.aria/bin/aria-governance-gate`;
+
+function runUniversalGovernanceGate(payload) {
+  if (!existsSync(GOVERNANCE_GATE_PATH)) return null;
+  const child = spawnSync(GOVERNANCE_GATE_PATH, {
+    input: `${JSON.stringify(payload)}\n`,
+    encoding: 'utf8',
+    maxBuffer: 1024 * 1024,
+  });
+  const stdout = String(child.stdout || '').trim();
+  let result = null;
+  try { result = stdout ? JSON.parse(stdout) : null; } catch {}
+  if (child.status !== 0 || result?.ok === false || result?.decision === 'block') {
+    const reason = stdout || child.stderr || 'aria-governance-gate blocked this action.';
+    throw new Error(`=== ARIA UNIVERSAL GOVERNANCE GATE BLOCK ===\n\n${reason}`);
+  }
+  return result;
+}
 
 // ── Heartbeat OUTSIDE the crash boundary (doctrine #123) ───────────────
 // Per feedback_ledger_writes_outside_crash_boundary.md + doctrine #124
@@ -1305,6 +1323,25 @@ if (!skillGate.ok) {
   emitBlock(reason, { source: 'pre-tool/skill-autoload', tool: toolName, lensCount, requiredLenses: REQUIRED_LENSES });
   process.exit(2);
 }
+try {
+  runUniversalGovernanceGate({
+    sessionId,
+    sourceRuntime: 'claude-code',
+    surface: 'claude-pre-tool-gate',
+    text: [unionText, JSON.stringify(toolInput || {})].join('\n').slice(0, 8000),
+    action: cmd,
+    toolName,
+    filePath,
+    isDeploy: Boolean(deployMatched),
+    isMutation: toolName !== 'Bash',
+    loadedSkills: skillGate.loadedSkills,
+    evidence: { lensCount, hasVerify, hasCognition, hasSubstrateCite },
+  });
+} catch (err) {
+  audit('block-universal-governance', `${err instanceof Error ? err.message : String(err)}`.slice(0, 500));
+  emitBlock(err instanceof Error ? err.message : String(err), { source: 'pre-tool/universal-governance', tool: toolName, lensCount, requiredLenses: REQUIRED_LENSES });
+  process.exit(2);
+}
 
 function pushDecision(decision, reasonText) {
   pushCognitionEvent({
@@ -1459,6 +1496,7 @@ if (deployMatched) {
     //   reads the same file and computes the same HMAC.
     try {
       const justificationPath = `${HOME}/.claude/.aria-deploy-justification.json`;
+      const runtimeAgnosticJustificationPath = `${HOME}/.aria/.aria-deploy-justification.json`;
       const secretPath = `${HOME}/.claude/.aria-gate-secret`;
 
       // Lazy-generate per-installation secret if absent.
@@ -1500,6 +1538,8 @@ if (deployMatched) {
         signatureAlgo: 'HMAC-SHA256',
       };
       writeFileSync(justificationPath, JSON.stringify(justification, null, 2));
+      mkdirSync(dirname(runtimeAgnosticJustificationPath), { recursive: true });
+      writeFileSync(runtimeAgnosticJustificationPath, JSON.stringify(justification, null, 2), { mode: 0o600 });
     } catch (writeErr) {
       // Write failure is non-fatal for the gate decision (the gate itself
       // is the structural enforcement); log loudly per
@@ -2177,7 +2217,7 @@ Claude must either: (a) reframe action to fit allowedActions, OR (b) emit [PLAN_
 // every tool when substrate is down would brick the orchestrator, but the
 // failure is logged for telemetry.
 try {
-  const { HTTPHarnessClient } = await import('@aria/harness-http-client');
+  const { HTTPHarnessClient } = await import('@aria_asi/harness-http-client');
   const { readFileSync: __fsRead, existsSync: __fsExists } = await import('node:fs');
   const { homedir: __homedir } = await import('node:os');
   const __home = __homedir();

package/dist/assets/hooks/aria-stop-gate.mjs

@@ -49,6 +49,7 @@
 
 import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
+import { spawnSync } from 'node:child_process';
 import { appendGateAudit } from './lib/gate-audit.mjs';
 import {
   ALL_LENS_NAMES,
@@ -69,6 +70,24 @@ const LOG = `${HOME}/.claude/aria-stop-gate.log`;
 const AUDIT_PATH = `${HOME}/.claude/aria-stop-gate-audit.jsonl`;
 const GATE_LOOP_STATE_PATH = `${HOME}/.claude/.aria-gate-loop-state.json`;
 const MIZAN_RECEIPT_DIR = `${HOME}/.claude/.aria-mizan-receipts`;
+const GOVERNANCE_GATE_PATH = `${HOME}/.aria/bin/aria-governance-gate`;
+
+function runUniversalGovernanceGate(payload) {
+  if (!existsSync(GOVERNANCE_GATE_PATH)) return null;
+  const child = spawnSync(GOVERNANCE_GATE_PATH, {
+    input: `${JSON.stringify(payload)}\n`,
+    encoding: 'utf8',
+    maxBuffer: 1024 * 1024,
+  });
+  const stdout = String(child.stdout || '').trim();
+  let result = null;
+  try { result = stdout ? JSON.parse(stdout) : null; } catch {}
+  if (child.status !== 0 || result?.ok === false || result?.decision === 'block') {
+    const reason = stdout || child.stderr || 'aria-governance-gate blocked this output.';
+    throw new Error(`=== ARIA UNIVERSAL GOVERNANCE GATE BLOCK ===\n\n${reason}`);
+  }
+  return result;
+}
 
 // SDK loader — bundled at ~/.aria/sdk by `aria connect`, with client-local
 // fallbacks preserved for resilience.
@@ -640,6 +659,28 @@ if (!stopSkillGate.ok) {
   console.log(JSON.stringify({ decision: 'block', reason }));
   process.exit(2);
 }
+try {
+  runUniversalGovernanceGate({
+    sessionId: event.session_id || 'claude-code',
+    sourceRuntime: 'claude-code',
+    surface: 'claude-stop-gate',
+    text: assistantText.slice(0, 8000),
+    isOutputCloseout: true,
+    loadedSkills: stopSkillGate.loadedSkills,
+    evidence: { chars: assistantText.length, hasDecisionSignal, isLong },
+  });
+} catch (err) {
+  audit('block-universal-governance', `${err instanceof Error ? err.message : String(err)}`.slice(0, 500));
+  const reason = withLoopDirective(buildForceReauthorReason({
+    source: 'stop/universal-governance',
+    reason: err instanceof Error ? err.message : String(err),
+    violations: ['Universal governance gate blocked this output.'],
+    lensCount: 0,
+    requiredLenses: REQUIRED_LENSES,
+  }), 'stop:universal-governance', gateSessionId);
+  console.log(JSON.stringify({ decision: 'block', reason }));
+  process.exit(2);
+}
 
 // Non-trivial response — require substantive cognition.
 const cog = detectCognitionLenses(assistantText);
@@ -1398,7 +1439,7 @@ if (cog.count >= REQUIRED_LENSES) {
     let substrateViolations = [];
     let substrateGateTriggers = [];
     try {
-      const { HTTPHarnessClient } = await import('@aria/harness-http-client');
+      const { HTTPHarnessClient } = await import('@aria_asi/harness-http-client');
       const tokenPath = `${HOME}/.aria/owner-token`;
       // Tier-aware resolution: ARIA_HARNESS_TOKEN env first (both tiers).
       // ONLY on owner tier, fall back to master/api-key env or owner-token

package/dist/assets/hooks/doctrine_trigger_map.json

@@ -508,6 +508,49 @@
       "counter_action": "Create or reuse one turn substrate object containing embedding, perturb snapshot, ProjectAllDomains result, awakenAria Garden block, DeepSoul/Noor/shards/Mizan signals; pass it downstream.",
       "message": "Duplicate projection path detected. Replace with one per-turn cognition packet and shared consumption."
     },
+    {
+      "trigger_id": "premature_task_closeout",
+      "trigger": "(?:done|complete|completed|ready|verified|fixed).{0,120}(?:but|except|caveat|remaining|not yet|still|separate|later|blocked|skipped)",
+      "rx": "(?:done|complete|completed|ready|verified|fixed).{0,120}(?:but|except|caveat|remaining|not yet|still|separate|later|blocked|skipped)",
+      "doctrine": "memory:feedback_no_premature_task_closeout.md",
+      "memory": "feedback_no_premature_task_closeout.md",
+      "severity": "block",
+      "teaching": "A task is not complete while material blockers remain. Completion claims must match the verified scope.",
+      "counter_action": "Do not close the task. Fix the blocker now, or create an owner-visible durable task with the exact failing surface and verification gap.",
+      "message": "Premature closeout detected: completion language coexists with unresolved blockers. Fix or durably track before emitting."
+    },
+    {
+      "trigger_id": "narrow_e2e_overclaim",
+      "trigger": "(?:production-ready|ready for production|works in general|client packages?|npm packages?|SDKs?|runtimes?|harnesses?).{0,220}(?:deal|single flow|one flow|widget|one service|specific path|covered flow)",
+      "rx": "(?:production-ready|ready for production|works in general|client packages?|npm packages?|SDKs?|runtimes?|harnesses?).{0,220}(?:deal|single flow|one flow|widget|one service|specific path|covered flow)",
+      "doctrine": "memory:feedback_narrow_e2e_overclaim.md",
+      "memory": "feedback_narrow_e2e_overclaim.md",
+      "severity": "block",
+      "teaching": "A narrow e2e does not prove general production readiness for SDKs, npm packages, runtimes, clients, or harnesses.",
+      "counter_action": "Run the general readiness matrix or explicitly limit the claim to the verified surface. Do not imply general readiness from one app flow.",
+      "message": "Narrow proof overclaim detected. General readiness requires the client/package/runtime/harness matrix."
+    },
+    {
+      "trigger_id": "advisory_gate_not_gate",
+      "trigger": "(?:non-blocking|warn(?:ing)? only|advisory|falls? through|fail open|soft fail|log(?:ged)? and continue|quality gate warning)",
+      "rx": "(?:non-blocking|warn(?:ing)? only|advisory|falls? through|fail open|soft fail|log(?:ged)? and continue|quality gate warning)",
+      "doctrine": "memory:feedback_advisory_gate_is_not_gate.md",
+      "memory": "feedback_advisory_gate_is_not_gate.md",
+      "severity": "block",
+      "teaching": "A gate that only warns or falls through is not a gate. Enforcement must fail closed where quality or doctrine is required.",
+      "counter_action": "Convert advisory paths to blocking errors, add a self-test that proves rejection, and install the hardened gate into each consumer surface.",
+      "message": "Advisory gate bypass detected. Convert to fail-closed enforcement and prove it with a blocking self-test."
+    },
+    {
+      "trigger_id": "start_new_session_as_gate_fix",
+      "trigger": "(?:start|open|begin).{0,40}(?:new|fresh).{0,30}session.{0,120}(?:fix|gate|harness|enforcement)",
+      "rx": "(?:start|open|begin).{0,40}(?:new|fresh).{0,30}session.{0,120}(?:fix|gate|harness|enforcement)",
+      "doctrine": "memory:feedback_advisory_gate_is_not_gate.md",
+      "memory": "feedback_advisory_gate_is_not_gate.md",
+      "severity": "block",
+      "teaching": "A new session is not an enforcement fix. It only reloads whatever gate contract exists; broken gates remain broken.",
+      "counter_action": "Fix the runtime/plugin/hook contract, reinstall it, and run a live bad-action/bad-output self-test that proves blocking."
+    },
     {
       "trigger_id": "registry_image_drift",
       "trigger": "image.?pull|ErrImageNeverPull|ImagePullBackOff|registry gc|image.*missing|image.*not.*found",

package/dist/assets/hooks/lib/skill-autoload-gate.mjs

@@ -1 +1,14 @@
-export * from '../../../../ops/claude-hooks/lib/skill-autoload-gate.mjs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+const RECEIPT_ROOT = process.env.ARIA_SKILL_RECEIPT_DIR || join(tmpdir(), 'aria-skill-receipts');
+const ALIASES = new Map([['deploy', 'aria-harness-deploy'], ['output', 'aria-harness-output-discipline'], ['repo', 'aria-repo-doctrine'], ['forge', 'aria-forge-guardrails']]);
+const RX = { deploy: /deploy-service\.sh|kubectl\s+(?:apply|set|rollout|delete|scale)|helm\s+upgrade|terraform\s+apply|docker\s+push/i, mutationTool: /^(?:edit|write|notebookedit|patch|apply_patch)$/i, mutation: /apply_patch|write file|edit file|modify|delete file|migration|handler|route|runtime|hook|plugin|\btest\b|smoke script/i, strip: /remove|delete|strip|drop|omit|disable|bypass|skip|stub|mock|fake|placeholder|temporary|quick scaffold|band-aid/i, readiness: /production-ready|ready for production|works in general|general readiness|client packages?|npm packages?|SDKs?|runtimes?|harnesses?|release-ready|ship-ready/i, narrow: /single flow|one flow|narrow e2e|covered flow|specific path|widget flow/i, completion: /done|complete|completed|ready|verified|fixed|shipped|implemented|production-ready/i, badProof: /but|except|caveat|remaining|not yet|still|separate|later|blocked|skipped|unresolved|follow-up|failed|failing|error|red|not run|could not verify|untested|no proof|missing proof|without proof/i, advisory: /non-blocking|warning only|warn only|advisory|fall through|falls through|fail open|soft fail|logged and continue|quality gate warning/i, success: /(?:verified|passed|success|successful|green|ok)\s*[:=\-].{0,120}(?:npm|node|playwright|jest|vitest|build|test|lint|typecheck|curl|kubectl|self-test|e2e|probe|smoke)|(?:npm|node|playwright|jest|vitest|build|test|lint|typecheck|curl|kubectl).{0,120}(?:passed|success|successful|green|exit\s*0)/i, resubmit: /re-?submission|resubmit/i, rewrite: /re-?write|rewrite|fix/i, retest: /re-?test|retest|rerun/i, aria: /ARIA console|Aria console|\/chat|aria-pipeline-mcp|aria_chat|escalat(?:e|ion).{0,80}ARIA/i };
+function normalizeSkillName(skill) { return ALIASES.get(String(skill || '').trim()) || String(skill || '').trim(); }
+function sessionDir(sessionId) { return join(RECEIPT_ROOT, encodeURIComponent(String(sessionId || 'unknown'))); }
+function readReceiptSkills(sessionId) { const dir = sessionDir(sessionId); if (!existsSync(dir)) return new Set(); const skills = new Set(); for (const name of readdirSync(dir)) { if (!name.endsWith('.json')) continue; try { const receipt = JSON.parse(readFileSync(join(dir, name), 'utf8')); if (receipt?.skill) skills.add(normalizeSkillName(receipt.skill)); } catch {} } return skills; }
+function readInlineSkills(text) { const skills = new Set(); const value = String(text || ''); for (const match of value.matchAll(/<skill_content\s+name=["']([^"']+)["']/gi)) skills.add(normalizeSkillName(match[1])); return skills; }
+export function recordSkillLoaded({ sessionId, skill, surface = 'unknown', metadata = {} } = {}) { const normalized = normalizeSkillName(skill); if (!normalized) throw new Error('recordSkillLoaded requires a skill name'); const dir = sessionDir(sessionId); mkdirSync(dir, { recursive: true }); const receipt = { skill: normalized, surface, metadata, recordedAt: new Date().toISOString() }; writeFileSync(join(dir, `${encodeURIComponent(normalized)}.json`), `${JSON.stringify(receipt, null, 2)}\n`); return receipt; }
+export function classifyRequiredSkills({ text = '', action = '', toolName = '', filePath = '', isDeploy = false, isMutation = false, isOutputCloseout = false } = {}) { const combined = [text, action, toolName, filePath].filter(Boolean).join('\n'); const required = new Set(); const reasons = []; const recoveryMissing = []; if (isDeploy || RX.deploy.test(combined)) { required.add('aria-harness-deploy'); required.add('aria-forge-guardrails'); reasons.push('deploy/shared-infrastructure action requires fail-closed deploy and forge guardrails'); } if (isMutation || RX.mutationTool.test(toolName)) { required.add('aria-repo-doctrine'); reasons.push('repository/runtime mutation requires repo doctrine'); } if (RX.strip.test(combined)) { required.add('aria-harness-no-stripping'); reasons.push('strip/remove/bypass language requires no-stripping gate'); } if (isOutputCloseout && RX.completion.test(combined)) { required.add('aria-harness-output-discipline'); reasons.push('owner-facing completion/readiness claim requires output discipline'); if (!RX.success.test(combined)) recoveryMissing.push('successful proof from a concrete command/probe'); } if (RX.readiness.test(combined)) { required.add('architecture-decision'); required.add('testing-strategy'); required.add('aria-forge-guardrails'); required.add('aria-harness-output-discipline'); reasons.push('broad production/package/SDK/runtime readiness claim requires architecture, testing, and forge guardrails'); } if (RX.readiness.test(combined) && RX.narrow.test(combined)) { required.add('testing-strategy'); required.add('aria-forge-guardrails'); reasons.push('narrow e2e proof cannot support broad readiness claim without readiness-matrix discipline'); } if (RX.completion.test(combined) && RX.badProof.test(combined)) { required.add('aria-harness-output-discipline'); required.add('aria-forge-guardrails'); reasons.push('completion claim with unresolved or failed proof requires recovery cycle'); if (!RX.resubmit.test(combined)) recoveryMissing.push('re-submission'); if (!RX.rewrite.test(combined)) recoveryMissing.push('re-write'); if (!RX.retest.test(combined)) recoveryMissing.push('re-test'); if (!RX.aria.test(combined)) recoveryMissing.push('ARIA console escalation'); } if (RX.advisory.test(combined)) { required.add('aria-forge-guardrails'); required.add('aria-harness-output-discipline'); reasons.push('advisory/fail-open gate language requires fail-closed hardening discipline'); } return { requiredSkills: [...required].sort(), reasons, recoveryMissing }; }
+export function evaluateSkillGate(options = {}) { const classified = classifyRequiredSkills(options); const text = [options.text, options.action].filter(Boolean).join('\n'); const loaded = new Set([...readReceiptSkills(options.sessionId), ...readInlineSkills(text)]); const missingSkills = classified.requiredSkills.filter((skill) => !loaded.has(skill)); const recoveryMissing = classified.recoveryMissing || []; return { ok: missingSkills.length === 0 && recoveryMissing.length === 0, surface: options.surface || 'unknown', sessionId: options.sessionId || 'unknown', requiredSkills: classified.requiredSkills, loadedSkills: [...loaded].sort(), missingSkills, recoveryMissing, reasons: classified.reasons, autoLoadAvailable: options.autoLoadAvailable === true }; }
+export function formatSkillGateBlock(result = {}) { const missing = Array.isArray(result.missingSkills) ? result.missingSkills : []; const recovery = Array.isArray(result.recoveryMissing) ? result.recoveryMissing : []; const reasons = Array.isArray(result.reasons) ? result.reasons : []; return ['=== ARIA SKILL AUTOLOAD GATE BLOCK ===', `surface: ${result.surface || 'unknown'}`, `missing_skills: ${missing.length ? missing.join(', ') : '(none)'}`, `missing_recovery_cycle: ${recovery.length ? recovery.join(', ') : '(none)'}`, `required_skills: ${(result.requiredSkills || []).join(', ') || '(none)'}`, reasons.length ? `reasons: ${reasons.join(' | ')}` : 'reasons: no classifier reason recorded', 'counter_action: re-submit, re-write, re-test, and escalate through ARIA console until successful proof exists. Do not downgrade this to an advisory warning.'].join('\n'); }

package/dist/assets/opencode-plugins/harness-context/index.js

@@ -2,7 +2,7 @@
  * Aria Harness Context Plugin for OpenCode.
  *
  * Injects the live harness packet into OpenCode's system prompt on every
- * session start. Routes through the canonical @aria/harness-http-client SDK
+ * session start. Routes through the canonical @aria_asi/harness-http-client SDK
  * via the inject-context.mjs script that ships alongside this plugin.
  *
  * Distribution: this dir is installed by `aria connect` (via connectors/

package/dist/assets/opencode-plugins/harness-gate/index.js

@@ -4,6 +4,7 @@
  */
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { evaluateSkillGate, formatSkillGateBlock } from './lib/skill-autoload-gate.js';
@@ -16,6 +17,7 @@ const SDK_CANDIDATES = [
 ];
 const OWNER_TOKEN_PATH = join(HOME, '.aria', 'owner-token');
 const LICENSE_PATH = join(HOME, '.aria', 'license.json');
+const GOVERNANCE_GATE_PATH = join(HOME, '.aria', 'bin', 'aria-governance-gate');
 const RUNTIME_URL = (process.env.ARIA_RUNTIME_URL || 'http://127.0.0.1:4319').replace(/\/+$/, '');
 const RECEIPT_DIR = join(HOME, '.opencode', 'aria-mizan-receipts');
 
@@ -94,6 +96,25 @@ function countInlineCognitionLenses(text) {
   return seen.size;
 }
 
+function runUniversalGovernanceGate(payload) {
+  if (!existsSync(GOVERNANCE_GATE_PATH)) return null;
+  const child = spawnSync(GOVERNANCE_GATE_PATH, {
+    input: `${JSON.stringify(payload)}\n`,
+    encoding: 'utf8',
+    maxBuffer: 1024 * 1024,
+  });
+  const stdout = String(child.stdout || '').trim();
+  let result = null;
+  try { result = stdout ? JSON.parse(stdout) : null; } catch {}
+  if (child.status !== 0 || result?.ok === false || result?.decision === 'block') {
+    throw new Error(
+      `=== ARIA UNIVERSAL GOVERNANCE GATE BLOCK ===\n\n` +
+      `${stdout || child.stderr || 'aria-governance-gate blocked this action.'}`
+    );
+  }
+  return result;
+}
+
 function resolveToken() {
   if (process.env.ARIA_HARNESS_TOKEN) return process.env.ARIA_HARNESS_TOKEN;
   if (process.env.ARIA_API_KEY) return process.env.ARIA_API_KEY;
@@ -184,28 +205,48 @@ export default async function HarnessGatePlugin(ctx) {
 
   return {
     'tool.execute.before': async (input, output) => {
-      const toolName = input.tool;
+      const args = output?.args ?? input.args ?? {};
+      const rawToolName = String(input.tool || input.name || input.type || '');
+      const normalizedToolName = rawToolName.toLowerCase();
+      const toolName = normalizedToolName.includes('bash') ? 'Bash'
+        : normalizedToolName.includes('edit') ? 'Edit'
+          : normalizedToolName.includes('write') ? 'Write'
+            : rawToolName;
       if (!['Bash', 'Edit', 'Write', 'NotebookEdit'].includes(toolName)) return;
 
-      const cmd = toolName === 'Bash' ? String(input.args?.command ?? '') : '';
-      const filePath = toolName !== 'Bash' ? String(input.args?.file_path ?? input.args?.notebook_path ?? '') : '';
+      const cmd = toolName === 'Bash' ? String(args?.command ?? '') : '';
+      const filePath = toolName !== 'Bash' ? String(args?.file_path ?? args?.filePath ?? args?.notebook_path ?? args?.notebookPath ?? '') : '';
       const cmdPreview = toolName === 'Bash' ? cmd.slice(0, 80) : `${toolName} ${filePath || '(no path)'}`.slice(0, 80);
 
-      // Trivial reads pass
-      if (toolName === 'Bash' && TRIVIAL_BASH_RX.test(cmd) && cmd.length < 200) return;
-      if (toolName === 'Bash' && cmd.length < SHORT_BASH_LIMIT) return;
       const destructive = DESTRUCTIVE_PATTERNS.find(({ rx }) => rx.test(cmd));
       const deploy = DEPLOY_PATTERNS.find(({ rx }) => rx.test(cmd));
       const isFileMutation = ['Edit', 'Write', 'NotebookEdit'].includes(toolName) && filePath;
 
+      // Trivial reads pass only after high-risk patterns are classified.
+      if (!destructive && !deploy && toolName === 'Bash' && TRIVIAL_BASH_RX.test(cmd) && cmd.length < 200) return;
+      if (!destructive && !deploy && toolName === 'Bash' && cmd.length < SHORT_BASH_LIMIT) return;
+
       if (!destructive && !deploy && !isFileMutation) return;
 
       // Try SDK checkAction() first — substrate-backed validation
       const client = await getClient();
-      const sessionId = process.env.ARIA_SESSION_ID || 'opencode';
+      const sessionId = input.sessionID || process.env.ARIA_SESSION_ID || process.env.OPENCODE_SESSION_ID || 'opencode';
       const label = destructive?.name || deploy?.name || `${toolName}:${filePath?.split('/').pop() || ''}`;
       const action = toolName === 'Bash' ? 'bash' : 'edit';
       const target = toolName === 'Bash' ? cmd.slice(0, 200) : filePath.slice(0, 200);
+      const actionRef = makeEvidenceRef('opencode_tool_request', { toolName, action, target }, { sessionId, label });
+      runUniversalGovernanceGate({
+        sessionId,
+        sourceRuntime: 'opencode',
+        surface: 'opencode-harness-gate',
+        text: JSON.stringify({ toolName, action, target, args }).slice(0, 8000),
+        action: cmd,
+        toolName,
+        filePath,
+        isDeploy: Boolean(deploy),
+        isMutation: Boolean(isFileMutation),
+        evidence: actionRef,
+      });
       const skillGate = evaluateSkillGate({
         sessionId,
         surface: 'opencode-harness-gate',
@@ -224,7 +265,6 @@ export default async function HarnessGatePlugin(ctx) {
           `Required next step: call the skill loader for ${skillGate.missingSkills.join(', ')} before retrying this tool.`
         );
       }
-      const actionRef = makeEvidenceRef('opencode_tool_request', { toolName, action, target }, { sessionId, label });
       const rationale =
         destructive ? `High-risk action ${label} requested in OpenCode and must satisfy Mizan truth, protection, and quality before execution.`
           : deploy ? `Deployment action ${label} requested in OpenCode and must satisfy Mizan survivability before execution.`
@@ -299,7 +339,7 @@ export default async function HarnessGatePlugin(ctx) {
             roleProfile: process.env.OPENCODE_ARIA_ROLE_PROFILE || process.env.ARIA_ROLE_PROFILE || null,
             files: filePath ? [filePath] : [],
             requireVerify: Boolean(destructive || deploy),
-            verifyText: String(input.args?.verifyText || input.args?.verifyBlock || input.args?.verify || ''),
+            verifyText: String(args?.verifyText || args?.verifyBlock || args?.verify || ''),
           }).catch(() => client.checkAction(action, target));
           if (!check.allowed) {
             if (check.queued) {

package/dist/assets/opencode-plugins/harness-gate/lib/skill-autoload-gate.js

@@ -1 +1,14 @@
-export * from '../../../../../ops/claude-hooks/lib/skill-autoload-gate.mjs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+const RECEIPT_ROOT = process.env.ARIA_SKILL_RECEIPT_DIR || join(tmpdir(), 'aria-skill-receipts');
+const ALIASES = new Map([['deploy', 'aria-harness-deploy'], ['output', 'aria-harness-output-discipline'], ['repo', 'aria-repo-doctrine'], ['forge', 'aria-forge-guardrails']]);
+const RX = { deploy: /deploy-service\.sh|kubectl\s+(?:apply|set|rollout|delete|scale)|helm\s+upgrade|terraform\s+apply|docker\s+push/i, mutationTool: /^(?:edit|write|notebookedit|patch|apply_patch)$/i, mutation: /apply_patch|write file|edit file|modify|delete file|migration|handler|route|runtime|hook|plugin|\btest\b|smoke script/i, strip: /remove|delete|strip|drop|omit|disable|bypass|skip|stub|mock|fake|placeholder|temporary|quick scaffold|band-aid/i, readiness: /production-ready|ready for production|works in general|general readiness|client packages?|npm packages?|SDKs?|runtimes?|harnesses?|release-ready|ship-ready/i, narrow: /single flow|one flow|narrow e2e|covered flow|specific path|widget flow/i, completion: /done|complete|completed|ready|verified|fixed|shipped|implemented|production-ready/i, badProof: /but|except|caveat|remaining|not yet|still|separate|later|blocked|skipped|unresolved|follow-up|failed|failing|error|red|not run|could not verify|untested|no proof|missing proof|without proof/i, advisory: /non-blocking|warning only|warn only|advisory|fall through|falls through|fail open|soft fail|logged and continue|quality gate warning/i, success: /(?:verified|passed|success|successful|green|ok)\s*[:=\-].{0,120}(?:npm|node|playwright|jest|vitest|build|test|lint|typecheck|curl|kubectl|self-test|e2e|probe|smoke)|(?:npm|node|playwright|jest|vitest|build|test|lint|typecheck|curl|kubectl).{0,120}(?:passed|success|successful|green|exit\s*0)/i, resubmit: /re-?submission|resubmit/i, rewrite: /re-?write|rewrite|fix/i, retest: /re-?test|retest|rerun/i, aria: /ARIA console|Aria console|\/chat|aria-pipeline-mcp|aria_chat|escalat(?:e|ion).{0,80}ARIA/i };
+function normalizeSkillName(skill) { return ALIASES.get(String(skill || '').trim()) || String(skill || '').trim(); }
+function sessionDir(sessionId) { return join(RECEIPT_ROOT, encodeURIComponent(String(sessionId || 'unknown'))); }
+function readReceiptSkills(sessionId) { const dir = sessionDir(sessionId); if (!existsSync(dir)) return new Set(); const skills = new Set(); for (const name of readdirSync(dir)) { if (!name.endsWith('.json')) continue; try { const receipt = JSON.parse(readFileSync(join(dir, name), 'utf8')); if (receipt?.skill) skills.add(normalizeSkillName(receipt.skill)); } catch {} } return skills; }
+function readInlineSkills(text) { const skills = new Set(); const value = String(text || ''); for (const match of value.matchAll(/<skill_content\s+name=["']([^"']+)["']/gi)) skills.add(normalizeSkillName(match[1])); return skills; }
+export function recordSkillLoaded({ sessionId, skill, surface = 'unknown', metadata = {} } = {}) { const normalized = normalizeSkillName(skill); if (!normalized) throw new Error('recordSkillLoaded requires a skill name'); const dir = sessionDir(sessionId); mkdirSync(dir, { recursive: true }); const receipt = { skill: normalized, surface, metadata, recordedAt: new Date().toISOString() }; writeFileSync(join(dir, `${encodeURIComponent(normalized)}.json`), `${JSON.stringify(receipt, null, 2)}\n`); return receipt; }
+export function classifyRequiredSkills({ text = '', action = '', toolName = '', filePath = '', isDeploy = false, isMutation = false, isOutputCloseout = false } = {}) { const combined = [text, action, toolName, filePath].filter(Boolean).join('\n'); const required = new Set(); const reasons = []; const recoveryMissing = []; if (isDeploy || RX.deploy.test(combined)) { required.add('aria-harness-deploy'); required.add('aria-forge-guardrails'); reasons.push('deploy/shared-infrastructure action requires fail-closed deploy and forge guardrails'); } if (isMutation || RX.mutationTool.test(toolName)) { required.add('aria-repo-doctrine'); reasons.push('repository/runtime mutation requires repo doctrine'); } if (RX.strip.test(combined)) { required.add('aria-harness-no-stripping'); reasons.push('strip/remove/bypass language requires no-stripping gate'); } if (isOutputCloseout && RX.completion.test(combined)) { required.add('aria-harness-output-discipline'); reasons.push('owner-facing completion/readiness claim requires output discipline'); if (!RX.success.test(combined)) recoveryMissing.push('successful proof from a concrete command/probe'); } if (RX.readiness.test(combined)) { required.add('architecture-decision'); required.add('testing-strategy'); required.add('aria-forge-guardrails'); required.add('aria-harness-output-discipline'); reasons.push('broad production/package/SDK/runtime readiness claim requires architecture, testing, and forge guardrails'); } if (RX.readiness.test(combined) && RX.narrow.test(combined)) { required.add('testing-strategy'); required.add('aria-forge-guardrails'); reasons.push('narrow e2e proof cannot support broad readiness claim without readiness-matrix discipline'); } if (RX.completion.test(combined) && RX.badProof.test(combined)) { required.add('aria-harness-output-discipline'); required.add('aria-forge-guardrails'); reasons.push('completion claim with unresolved or failed proof requires recovery cycle'); if (!RX.resubmit.test(combined)) recoveryMissing.push('re-submission'); if (!RX.rewrite.test(combined)) recoveryMissing.push('re-write'); if (!RX.retest.test(combined)) recoveryMissing.push('re-test'); if (!RX.aria.test(combined)) recoveryMissing.push('ARIA console escalation'); } if (RX.advisory.test(combined)) { required.add('aria-forge-guardrails'); required.add('aria-harness-output-discipline'); reasons.push('advisory/fail-open gate language requires fail-closed hardening discipline'); } return { requiredSkills: [...required].sort(), reasons, recoveryMissing }; }
+export function evaluateSkillGate(options = {}) { const classified = classifyRequiredSkills(options); const text = [options.text, options.action].filter(Boolean).join('\n'); const loaded = new Set([...readReceiptSkills(options.sessionId), ...readInlineSkills(text)]); const missingSkills = classified.requiredSkills.filter((skill) => !loaded.has(skill)); const recoveryMissing = classified.recoveryMissing || []; return { ok: missingSkills.length === 0 && recoveryMissing.length === 0, surface: options.surface || 'unknown', sessionId: options.sessionId || 'unknown', requiredSkills: classified.requiredSkills, loadedSkills: [...loaded].sort(), missingSkills, recoveryMissing, reasons: classified.reasons, autoLoadAvailable: options.autoLoadAvailable === true }; }
+export function formatSkillGateBlock(result = {}) { const missing = Array.isArray(result.missingSkills) ? result.missingSkills : []; const recovery = Array.isArray(result.recoveryMissing) ? result.recoveryMissing : []; const reasons = Array.isArray(result.reasons) ? result.reasons : []; return ['=== ARIA SKILL AUTOLOAD GATE BLOCK ===', `surface: ${result.surface || 'unknown'}`, `missing_skills: ${missing.length ? missing.join(', ') : '(none)'}`, `missing_recovery_cycle: ${recovery.length ? recovery.join(', ') : '(none)'}`, `required_skills: ${(result.requiredSkills || []).join(', ') || '(none)'}`, reasons.length ? `reasons: ${reasons.join(' | ')}` : 'reasons: no classifier reason recorded', 'counter_action: re-submit, re-write, re-test, and escalate through ARIA console until successful proof exists. Do not downgrade this to an advisory warning.'].join('\n'); }