@aria_asi/cli 0.2.36 → 0.2.37

package/dist/runtime/hooks/lib/skill-autoload-gate-impl.mjs

@@ -0,0 +1,103 @@
+// ARIA_ALLOW_STUB: this gate helper must match doctrine trigger words as data.
+const POST = /\b(?:post[_ -]?compact[_ -]?continuation|handoff[_ -]?resume|continuation[_ -]?handoff|post-compact|compact(?:ion)? handoff|post\s+commission)\b/i;
+const OFF = /\bGATEOFF\b/i;
+const SKILL_CONTENT_RX = /<skill_content\s+name=["']([^"']+)["']/gi;
+const DEPLOY_VERIFY_RX = /<verify>[\s\S]*?target\s*:[\s\S]*?role\s*:[\s\S]*?verified\s*:[\s\S]*?rollback\s*:[\s\S]*?axiom\s*:[\s\S]*?<\/verify>/i;
+const COGNITION_BLOCK_RX = /<cognition>[\s\S]*?nur\s*:[\s\S]*?mizan\s*:[\s\S]*?hikma\s*:[\s\S]*?tafakkur\s*:[\s\S]*?tadabbur\s*:[\s\S]*?ilham\s*:[\s\S]*?wahi\s*:[\s\S]*?firasah\s*:[\s\S]*?<\/cognition>/i;
+const EXPECTED_BLOCK_RX = /<expected>[\s\S]*?predicate\s*:[\s\S]*?measurable_type\s*:[\s\S]*?<\/expected>/i;
+const APPLIED_COGNITION_RX = /<applied_cognition>[\s\S]*?decision_delta\s*:[\s\S]*?dominant_domain\s*:[\s\S]*?binds_to\s*:[\s\S]*?expected_predicate\s*:[\s\S]*?artifact_change\s*:[\s\S]*?<\/applied_cognition>/i;
+const NO_STRIPPING_BLOCK_RX = /<no_stripping>[\s\S]*?preserved_contract\s*:[\s\S]*?root_mechanism\s*:[\s\S]*?removed_surface\s*:\s*none[\s\S]*?verification\s*:[\s\S]*?<\/no_stripping>/i;
+
+function bypass(text) {
+  return /^(?:1|true|yes|on)$/i.test(String(process.env.ARIA_GATES_OFF || process.env.ARIA_HARNESS_GATES_OFF || '')) || POST.test(String(text || '')) || OFF.test(String(text || ''));
+}
+
+function addSkill(set, skill) {
+  const normalized = String(skill || '').trim();
+  if (normalized) set.add(normalized);
+}
+
+function collectLoadedSkills(options = {}, body = '') {
+  const loaded = new Set();
+  for (const m of String(body || '').matchAll(SKILL_CONTENT_RX)) addSkill(loaded, m[1]);
+  for (const skill of Array.isArray(options.loadedSkills) ? options.loadedSkills : []) addSkill(loaded, skill);
+  return loaded;
+}
+
+function collectContractEvidence(options = {}, body = '') {
+  const evidence = new Set();
+  if (DEPLOY_VERIFY_RX.test(body) && COGNITION_BLOCK_RX.test(body) && EXPECTED_BLOCK_RX.test(body)) {
+    evidence.add('aria-harness-deploy');
+    evidence.add('aria-forge-guardrails');
+    evidence.add('aria-harness-output-discipline');
+  }
+  if (APPLIED_COGNITION_RX.test(body)) evidence.add('aria-forge-guardrails');
+  if (NO_STRIPPING_BLOCK_RX.test(body)) evidence.add('aria-harness-no-stripping');
+  if (options.repoDoctrineVerified === true) evidence.add('aria-repo-doctrine');
+  if (options.noStrippingVerified === true) evidence.add('aria-harness-no-stripping');
+  if (options.outputDisciplineVerified === true) evidence.add('aria-harness-output-discipline');
+  return evidence;
+}
+
+export function recordSkillLoaded({ skill } = {}) {
+  return { skill, recordedAt: new Date().toISOString() };
+}
+
+export function classifyRequiredSkills({ text = '', action = '', toolName = '', filePath = '', isDeploy = false, isMutation = false, isOutputCloseout = false } = {}) {
+  const c = [text, action, toolName, filePath].filter(Boolean).join('\n');
+  const required = new Set();
+  const reasons = [];
+  const recoveryMissing = [];
+  let redirectOnly = false;
+  if (bypass(c)) return { requiredSkills: [], recoveryMissing: [], reasons: ['post-compaction or emergency gate-off bypasses skill autoload classification'] };
+  if (isDeploy || /deploy-service\.sh|kubectl\s+(?:apply|set|rollout|delete|scale)|helm\s+upgrade|terraform\s+apply|docker\s+push/i.test(c)) {
+    required.add('aria-harness-deploy');
+    required.add('aria-forge-guardrails');
+    reasons.push('deploy/shared-infrastructure action requires fail-closed deploy and forge guardrails');
+  }
+  if (isMutation || /^(?:edit|write|notebookedit|patch|apply_patch)$/i.test(toolName)) {
+    required.add('aria-repo-doctrine');
+    reasons.push('repository/runtime mutation requires repo doctrine');
+  }
+  if (/remove|delete|strip|drop|omit|disable|bypass|skip|stub|mock|fake|placeholder|temporary|quick scaffold|band-aid/i.test(c)) {
+    required.add('aria-harness-no-stripping');
+    required.add('aria-forge-guardrails');
+    reasons.push('contract-reduction language requires no-stripping and forge guardrails');
+  }
+  if (isOutputCloseout && /done|complete|completed|ready|verified|fixed|shipped|implemented|production-ready/i.test(c)) {
+    required.add('aria-harness-output-discipline');
+    reasons.push('owner-facing completion/readiness claim requires output discipline');
+    if (!/(verified|passed|success|successful|green|ok|exit\s*0)/i.test(c)) recoveryMissing.push('successful proof from a concrete command/probe');
+  }
+  if (/production-ready|ready for production|first[- ]class|works in general|general readiness|client packages?|npm packages?|SDKs?|runtimes?|harnesses?|release-ready|ship-ready/i.test(c)) {
+    redirectOnly = true;
+    reasons.push('broad readiness language requires recovery guidance instead of a permanent skill block');
+  }
+  if (/done|complete|completed|ready|verified|fixed|shipped|implemented|production-ready/i.test(c) && /but|except|caveat|remaining|not yet|still|separate|later|blocked|skipped|unresolved|follow-up|failed|failing|error|\bred\b|not run|could not verify|untested|no proof|missing proof|without proof/i.test(c)) {
+    required.add('aria-harness-output-discipline');
+    required.add('aria-forge-guardrails');
+    redirectOnly = true;
+    reasons.push('completion claim with explicit unresolved state requires recovery guidance');
+  }
+  if (/non-blocking|warning only|warn only|advisory|fall through|falls through|fail open|soft fail|logged and continue|quality gate warning/i.test(c)) {
+    required.add('aria-forge-guardrails');
+    reasons.push('advisory/fail-open gate language requires fail-closed hardening discipline');
+  }
+  return { requiredSkills: [...required].sort(), recoveryMissing: [...new Set(recoveryMissing)], reasons, redirectOnly };
+}
+
+export function evaluateSkillGate(options = {}) {
+  const c = classifyRequiredSkills(options);
+  const body = [options.text, options.action].filter(Boolean).join('\n');
+  const loaded = collectLoadedSkills(options, body);
+  const contractEvidence = collectContractEvidence(options, body);
+  const satisfied = new Set([...loaded, ...contractEvidence]);
+  const missingSkills = c.requiredSkills.filter((skill) => !satisfied.has(skill));
+  const recoveryMissing = contractEvidence.has('aria-harness-deploy') && contractEvidence.has('aria-forge-guardrails') ? [] : c.recoveryMissing;
+  return { ok: c.redirectOnly === true || (missingSkills.length === 0 && recoveryMissing.length === 0), redirectOnly: c.redirectOnly === true, surface: options.surface || 'unknown', sessionId: options.sessionId || 'unknown', requiredSkills: c.requiredSkills, loadedSkills: [...loaded].sort(), contractEvidence: [...contractEvidence].sort(), missingSkills, recoveryMissing, reasons: c.reasons, autoLoadAvailable: options.autoLoadAvailable === true };
+}
+
+export function formatSkillGateBlock(result = {}) {
+  const m = result.missingSkills || [], r = result.recoveryMissing || [], reasons = result.reasons || [];
+  return ['=== ARIA SKILL AUTOLOAD GATE BLOCK ===', `surface: ${result.surface || 'unknown'}`, `missing_skills: ${m.length ? m.join(', ') : '(none)'}`, `missing_recovery_cycle: ${r.length ? r.join(', ') : '(none)'}`, `required_skills: ${(result.requiredSkills || []).join(', ') || '(none)'}`, reasons.length ? `reasons: ${reasons.join(' | ')}` : 'reasons: no classifier reason recorded', 'Recovery contract:', '1. Do not retry the same blocked text.', `2. Load missing skills first: ${m.length ? m.join(', ') : '(none)'}`, `3. Repair missing recovery cycle items: ${r.length ? r.join(', ') : '(none)'}`, '4. Re-write with concrete proof and an applied_cognition block:', '<applied_cognition>', 'decision_delta: <what changed after the block>', 'dominant_domain: <deploy|code|security|testing|ops|product|writing>', 'binds_to: <specific file, command, endpoint, or user instruction>', 'expected_predicate: <measurable condition such as exit=0, status=healthy, count=N>', 'artifact_change: <exact artifact changed or none>', '</applied_cognition>', '5. Re-test using the concrete command/probe named in the block.', '6. Re-submit only after the proof exists; if blocked twice, escalate through ARIA console/MCP with this full block.'].join('\n');
+}

package/dist/runtime/hooks/lib/skill-autoload-gate.mjs

@@ -1,14 +1 @@
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { tmpdir } from 'node:os';
-const RECEIPT_ROOT = process.env.ARIA_SKILL_RECEIPT_DIR || join(tmpdir(), 'aria-skill-receipts');
-const ALIASES = new Map([['deploy', 'aria-harness-deploy'], ['output', 'aria-harness-output-discipline'], ['repo', 'aria-repo-doctrine'], ['forge', 'aria-forge-guardrails']]);
-const RX = { deploy: /deploy-service\.sh|kubectl\s+(?:apply|set|rollout|delete|scale)|helm\s+upgrade|terraform\s+apply|docker\s+push/i, mutationTool: /^(?:edit|write|notebookedit|patch|apply_patch)$/i, mutation: /apply_patch|write file|edit file|modify|delete file|migration|handler|route|runtime|hook|plugin|\btest\b|smoke script/i, strip: /remove|delete|strip|drop|omit|disable|bypass|skip|stub|mock|fake|placeholder|temporary|quick scaffold|band-aid/i, readiness: /production-ready|ready for production|works in general|general readiness|client packages?|npm packages?|SDKs?|runtimes?|harnesses?|release-ready|ship-ready/i, narrow: /single flow|one flow|narrow e2e|covered flow|specific path|widget flow/i, completion: /done|complete|completed|ready|verified|fixed|shipped|implemented|production-ready/i, badProof: /but|except|caveat|remaining|not yet|still|separate|later|blocked|skipped|unresolved|follow-up|failed|failing|error|red|not run|could not verify|untested|no proof|missing proof|without proof/i, advisory: /non-blocking|warning only|warn only|advisory|fall through|falls through|fail open|soft fail|logged and continue|quality gate warning/i, success: /(?:verified|passed|success|successful|green|ok)\s*[:=\-].{0,120}(?:npm|node|playwright|jest|vitest|build|test|lint|typecheck|curl|kubectl|self-test|e2e|probe|smoke)|(?:npm|node|playwright|jest|vitest|build|test|lint|typecheck|curl|kubectl).{0,120}(?:passed|success|successful|green|exit\s*0)/i, resubmit: /re-?submission|resubmit/i, rewrite: /re-?write|rewrite|fix/i, retest: /re-?test|retest|rerun/i, aria: /ARIA console|Aria console|\/chat|aria-pipeline-mcp|aria_chat|escalat(?:e|ion).{0,80}ARIA/i };
-function normalizeSkillName(skill) { return ALIASES.get(String(skill || '').trim()) || String(skill || '').trim(); }
-function sessionDir(sessionId) { return join(RECEIPT_ROOT, encodeURIComponent(String(sessionId || 'unknown'))); }
-function readReceiptSkills(sessionId) { const dir = sessionDir(sessionId); if (!existsSync(dir)) return new Set(); const skills = new Set(); for (const name of readdirSync(dir)) { if (!name.endsWith('.json')) continue; try { const receipt = JSON.parse(readFileSync(join(dir, name), 'utf8')); if (receipt?.skill) skills.add(normalizeSkillName(receipt.skill)); } catch {} } return skills; }
-function readInlineSkills(text) { const skills = new Set(); const value = String(text || ''); for (const match of value.matchAll(/<skill_content\s+name=["']([^"']+)["']/gi)) skills.add(normalizeSkillName(match[1])); return skills; }
-export function recordSkillLoaded({ sessionId, skill, surface = 'unknown', metadata = {} } = {}) { const normalized = normalizeSkillName(skill); if (!normalized) throw new Error('recordSkillLoaded requires a skill name'); const dir = sessionDir(sessionId); mkdirSync(dir, { recursive: true }); const receipt = { skill: normalized, surface, metadata, recordedAt: new Date().toISOString() }; writeFileSync(join(dir, `${encodeURIComponent(normalized)}.json`), `${JSON.stringify(receipt, null, 2)}\n`); return receipt; }
-export function classifyRequiredSkills({ text = '', action = '', toolName = '', filePath = '', isDeploy = false, isMutation = false, isOutputCloseout = false } = {}) { const combined = [text, action, toolName, filePath].filter(Boolean).join('\n'); const required = new Set(); const reasons = []; const recoveryMissing = []; if (isDeploy || RX.deploy.test(combined)) { required.add('aria-harness-deploy'); required.add('aria-forge-guardrails'); reasons.push('deploy/shared-infrastructure action requires fail-closed deploy and forge guardrails'); } if (isMutation || RX.mutationTool.test(toolName)) { required.add('aria-repo-doctrine'); reasons.push('repository/runtime mutation requires repo doctrine'); } if (RX.strip.test(combined)) { required.add('aria-harness-no-stripping'); reasons.push('strip/remove/bypass language requires no-stripping gate'); } if (isOutputCloseout && RX.completion.test(combined)) { required.add('aria-harness-output-discipline'); reasons.push('owner-facing completion/readiness claim requires output discipline'); if (!RX.success.test(combined)) recoveryMissing.push('successful proof from a concrete command/probe'); } if (RX.readiness.test(combined)) { required.add('architecture-decision'); required.add('testing-strategy'); required.add('aria-forge-guardrails'); required.add('aria-harness-output-discipline'); reasons.push('broad production/package/SDK/runtime readiness claim requires architecture, testing, and forge guardrails'); } if (RX.readiness.test(combined) && RX.narrow.test(combined)) { required.add('testing-strategy'); required.add('aria-forge-guardrails'); reasons.push('narrow e2e proof cannot support broad readiness claim without readiness-matrix discipline'); } if (RX.completion.test(combined) && RX.badProof.test(combined)) { required.add('aria-harness-output-discipline'); required.add('aria-forge-guardrails'); reasons.push('completion claim with unresolved or failed proof requires recovery cycle'); if (!RX.resubmit.test(combined)) recoveryMissing.push('re-submission'); if (!RX.rewrite.test(combined)) recoveryMissing.push('re-write'); if (!RX.retest.test(combined)) recoveryMissing.push('re-test'); if (!RX.aria.test(combined)) recoveryMissing.push('ARIA console escalation'); } if (RX.advisory.test(combined)) { required.add('aria-forge-guardrails'); required.add('aria-harness-output-discipline'); reasons.push('advisory/fail-open gate language requires fail-closed hardening discipline'); } return { requiredSkills: [...required].sort(), reasons, recoveryMissing }; }
-export function evaluateSkillGate(options = {}) { const classified = classifyRequiredSkills(options); const text = [options.text, options.action].filter(Boolean).join('\n'); const loaded = new Set([...readReceiptSkills(options.sessionId), ...readInlineSkills(text)]); const missingSkills = classified.requiredSkills.filter((skill) => !loaded.has(skill)); const recoveryMissing = classified.recoveryMissing || []; return { ok: missingSkills.length === 0 && recoveryMissing.length === 0, surface: options.surface || 'unknown', sessionId: options.sessionId || 'unknown', requiredSkills: classified.requiredSkills, loadedSkills: [...loaded].sort(), missingSkills, recoveryMissing, reasons: classified.reasons, autoLoadAvailable: options.autoLoadAvailable === true }; }
-export function formatSkillGateBlock(result = {}) { const missing = Array.isArray(result.missingSkills) ? result.missingSkills : []; const recovery = Array.isArray(result.recoveryMissing) ? result.recoveryMissing : []; const reasons = Array.isArray(result.reasons) ? result.reasons : []; return ['=== ARIA SKILL AUTOLOAD GATE BLOCK ===', `surface: ${result.surface || 'unknown'}`, `missing_skills: ${missing.length ? missing.join(', ') : '(none)'}`, `missing_recovery_cycle: ${recovery.length ? recovery.join(', ') : '(none)'}`, `required_skills: ${(result.requiredSkills || []).join(', ') || '(none)'}`, reasons.length ? `reasons: ${reasons.join(' | ')}` : 'reasons: no classifier reason recorded', 'counter_action: re-submit, re-write, re-test, and escalate through ARIA console until successful proof exists. Do not downgrade this to an advisory warning.'].join('\n'); }
+export * from './skill-autoload-gate-impl.mjs';

package/dist/runtime/local-phase.mjs

@@ -622,6 +622,7 @@ export function buildRuntimeCognitionDirective(packet, bundle = {}) {
     '- For any non-trivial reply, include a readable <cognition> block using everyday labels, not internal lens codenames.',
     '- If you request any non-trivial tool call, place the <cognition> block BEFORE the tool request.',
     '- If the action is deploy, destructive, or state-mutating, include both <verify> and <expected> blocks before the tool request.',
+    '- For any non-trivial reply, also include <applied_cognition> so the runtime can verify that cognition changed the response.',
     '- The runtime will canonicalize the readable block into backend JSON automatically, so do not hide it behind private shorthand.',
     '',
     '<cognition>',
@@ -635,6 +636,13 @@ export function buildRuntimeCognitionDirective(packet, bundle = {}) {
     '  beauty: <what cleaner, more elegant, more durable path preserves the contract>',
     `  first_principle: ${firstPrincipleText}`,
     '</cognition>',
+    '<applied_cognition>',
+    '  decision_delta: <specific change this cognition made to the answer>',
+    '  dominant_domain: <primary domain pressure shaping the response>',
+    '  binds_to: <one visible substrate, evidence, axiom, or user constraint>',
+    '  expected_predicate: <observable predicate that would prove the answer held up>',
+    '  artifact_change: <what changed in the emitted answer because of cognition>',
+    '</applied_cognition>',
     '',
     dominantModules.length ? 'Current module insights:' : 'Current module insights: none yet',
     ...dominantModules.map((line) => `- ${line}`),

package/dist/runtime/manifest.json

@@ -1,6 +1,6 @@
 {
-  "bundledAt": "2026-05-03T03:55:56.404Z",
-  "sdkFiles": 9,
+  "bundledAt": "2026-05-04T03:02:47.930Z",
+  "sdkFiles": 12,
   "runtimeTemplate": "/home/hamzaibrahim1/rei-ai-brain/packages/aria-connector/runtime-src",
   "gateRuntimeSource": "/home/hamzaibrahim1/rei-ai-brain/packages/aria-gate-runtime/dist",
   "sdkGuideSource": "/home/hamzaibrahim1/rei-ai-brain/harness/packages/harness-http-client/CLAUDE.md",

package/dist/runtime/provider-proxy.mjs

@@ -7,6 +7,7 @@ import { join } from 'node:path';
 const CONFIG_PATH = join(homedir(), '.aria', 'config.json');
 const DEFAULT_OLLAMA_BASE_URL = process.env.OLLAMA_BASE_URL || 'http://127.0.0.1:11434';
 const DEFAULT_DEEPSEEK_BASE_URL = process.env.DEEPSEEK_API_BASE || 'https://api.deepseek.com/v1/chat/completions';
+const DEFAULT_XAI_BASE_URL = process.env.XAI_API_BASE || 'https://api.x.ai/v1/chat/completions';
 const DEFAULT_OLLAMA_MODEL =
   process.env.ARIA_RUNTIME_MODEL ||
   process.env.ARIA_LOCAL_MODEL ||
@@ -15,18 +16,32 @@ const DEFAULT_OLLAMA_MODEL =
 const DEFAULT_CHAT_MODEL =
   process.env.ARIA_CHAT_MODEL ||
   process.env.ARIA_CASUAL_MODEL ||
-  'deepseek-v4-flash';
+  process.env.ARIA_XAI_MODEL ||
+  process.env.GROK_MODEL ||
+  'grok-4-3';
 const DEFAULT_DEEP_MODEL =
   process.env.ARIA_DEEP_MODEL ||
+  process.env.ARIA_DEEPSEEK_FALLBACK_MODEL ||
   'deepseek-v4-pro';
-const DEFAULT_XAI_BASE_URL = process.env.XAI_API_BASE || 'https://api.x.ai/v1/chat/completions';
 const DEFAULT_XAI_FALLBACK_MODEL =
   process.env.ARIA_XAI_FALLBACK_MODEL ||
-  'grok-4-2-reasoning';
+  DEFAULT_CHAT_MODEL;
 const DEFAULT_NIM_BASE_URL = process.env.NIM_BASE_URL || 'https://integrate.api.nvidia.com/v1/chat/completions';
 const DEFAULT_NIM_FALLBACK_MODEL =
   process.env.ARIA_NIM_FALLBACK_MODEL ||
   'qwen/qwen3.5-122b-a10b';
+const LOCAL_VIRTUAL_MAC_PROVIDER = 'aria-local-virtual-mac-lane';
+const DEFAULT_LOCAL_FALLBACK_BASE_URL = normalizeChatCompletionsUrl(
+  process.env.ARIA_LOCAL_FALLBACK_BASE_URL ||
+  process.env.ARIA_VIRTUAL_MAC_LANE_BASE_URL ||
+  process.env.ARIA_LANE_GATEWAY_URL ||
+  'http://aria-lane-gateway.aria.svc.cluster.local:8089/v1',
+);
+const DEFAULT_LOCAL_FALLBACK_MODEL =
+  process.env.ARIA_LOCAL_FALLBACK_MODEL ||
+  process.env.ARIA_VIRTUAL_MAC_LANE_MODEL ||
+  process.env.ARIA_LOCAL_MAC_MODEL ||
+  'mlx-community/Qwen2.5-7B-Instruct-4bit';
 
 function safeJsonParse(raw, fallback = null) {
   try {
@@ -45,6 +60,36 @@ function coerceString(value) {
   return typeof value === 'string' && value.trim() ? value.trim() : '';
 }
 
+function secretEnv(...names) {
+  for (const name of names) {
+    const value = coerceString(process.env[name]);
+    if (value) return value;
+  }
+  return '';
+}
+
+function normalizeChatCompletionsUrl(value) {
+  const trimmed = coerceString(value).replace(/\/+$/, '');
+  if (!trimmed) return '';
+  return trimmed.endsWith('/chat/completions') ? trimmed : `${trimmed}/chat/completions`;
+}
+
+function isLocalVirtualMacProvider(provider) {
+  return provider === LOCAL_VIRTUAL_MAC_PROVIDER || provider === 'local-virtual-mac-lane' || provider === 'qwen-mac-lane';
+}
+
+function xaiApiModel(model) {
+  return model === 'grok-4-3' ? 'grok-4.3' : model;
+}
+
+function isAnthropicClientModel(model) {
+  return /^claude(?:-|$)/i.test(coerceString(model)) || /^anthropic\//i.test(coerceString(model));
+}
+
+function providerRequiresApiKey(provider) {
+  return provider !== 'ollama' && !isLocalVirtualMacProvider(provider);
+}
+
 function loadRuntimeProfiles(local) {
   const profiles = local?.runtimeProfiles && typeof local.runtimeProfiles === 'object' ? local.runtimeProfiles : {};
   return {
@@ -53,9 +98,14 @@ function loadRuntimeProfiles(local) {
     xaiFallbackModel: coerceString(profiles.xaiFallbackModel || local?.xaiFallbackModel || local?.model?.xaiFallbackModel) || DEFAULT_XAI_FALLBACK_MODEL,
     nimFallbackModel: coerceString(profiles.nimFallbackModel || local?.nimFallbackModel || local?.model?.nimFallbackModel) || DEFAULT_NIM_FALLBACK_MODEL,
     xaiApiKey: coerceString(profiles.xaiApiKey || local?.xaiApiKey),
+    deepseekApiKey: coerceString(profiles.deepseekApiKey || local?.deepseekApiKey),
     nimApiKey: coerceString(profiles.nimApiKey || local?.nimApiKey),
     xaiBaseUrl: coerceString(profiles.xaiBaseUrl || local?.xaiBaseUrl) || DEFAULT_XAI_BASE_URL,
+    deepseekBaseUrl: coerceString(profiles.deepseekBaseUrl || local?.deepseekBaseUrl) || DEFAULT_DEEPSEEK_BASE_URL,
     nimBaseUrl: coerceString(profiles.nimBaseUrl || local?.nimBaseUrl) || DEFAULT_NIM_BASE_URL,
+    localFallbackModel: coerceString(profiles.localFallbackModel || local?.localFallbackModel) || DEFAULT_LOCAL_FALLBACK_MODEL,
+    localFallbackBaseUrl: normalizeChatCompletionsUrl(profiles.localFallbackBaseUrl || local?.localFallbackBaseUrl) || DEFAULT_LOCAL_FALLBACK_BASE_URL,
+    localFallbackApiKey: coerceString(profiles.localFallbackApiKey || local?.localFallbackApiKey),
   };
 }
 
@@ -104,7 +154,11 @@ function resolveProviderApiKey(provider, overrideApiKey = '', localApiKey = '')
     case 'openrouter':
       return process.env.OPENROUTER_API_KEY || '';
     case 'xai':
-      return process.env.XAI_API_KEY || '';
+      return process.env.XAI_API_KEY || process.env.GROK_API_KEY || process.env.ARIA_XAI_KEY || '';
+    case LOCAL_VIRTUAL_MAC_PROVIDER:
+    case 'local-virtual-mac-lane':
+    case 'qwen-mac-lane':
+      return process.env.ARIA_LOCAL_FALLBACK_API_KEY || process.env.ARIA_LANE_GATEWAY_API_KEY || '';
     case 'nim':
     case 'nvidia-nim':
       return process.env.NVIDIA_NIM_API_KEY || process.env.NIM_API_KEY || '';
@@ -116,16 +170,30 @@ function resolveProviderApiKey(provider, overrideApiKey = '', localApiKey = '')
 function resolveDefaultModel(provider, body, localModel, runtimeProfiles) {
   const explicitModel = coerceString(body?.llm?.model || body?.providerConfig?.model || body?.model);
   if (explicitModel) return explicitModel;
-  if (provider === 'deepseek') {
-    return isDeepArchitectureIntent(body) ? runtimeProfiles.deepModel : runtimeProfiles.chatModel;
-  }
-  if (provider === 'xai') return runtimeProfiles.xaiFallbackModel;
+  if (provider === 'deepseek') return runtimeProfiles.deepModel;
+  if (provider === 'xai') return runtimeProfiles.chatModel || runtimeProfiles.xaiFallbackModel;
   if (provider === 'nim' || provider === 'nvidia-nim') return runtimeProfiles.nimFallbackModel;
-  if (coerceString(localModel?.model)) return coerceString(localModel.model);
+  if (isLocalVirtualMacProvider(provider)) return runtimeProfiles.localFallbackModel;
+  if (localModel?.provider === provider && coerceString(localModel?.model)) return coerceString(localModel.model);
   if (provider === 'ollama') return DEFAULT_OLLAMA_MODEL;
   return '';
 }
 
+function resolveProviderNativeModel(provider, body, localModel, runtimeProfiles, fallbackModel = '') {
+  const overrideModel = coerceString(body?.llm?.model || body?.providerConfig?.model);
+  const clientModel = coerceString(body?.model);
+  if (overrideModel && (!clientModel || overrideModel !== clientModel || !isAnthropicClientModel(overrideModel))) {
+    return overrideModel;
+  }
+  if (localModel?.provider === provider && coerceString(localModel?.model)) return coerceString(localModel.model);
+  if (provider === 'deepseek') return runtimeProfiles.deepModel;
+  if (provider === 'xai') return runtimeProfiles.chatModel || runtimeProfiles.xaiFallbackModel;
+  if (provider === 'nim' || provider === 'nvidia-nim') return runtimeProfiles.nimFallbackModel;
+  if (isLocalVirtualMacProvider(provider)) return runtimeProfiles.localFallbackModel;
+  if (provider === 'ollama') return DEFAULT_OLLAMA_MODEL;
+  return isAnthropicClientModel(fallbackModel) ? '' : coerceString(fallbackModel);
+}
+
 function buildFallbackChain(body, runtimeProfiles) {
   if (body.allowProviderFallback === false) return [];
   const explicitFallbacks = Array.isArray(body?.llm?.fallbacks)
@@ -136,24 +204,24 @@ function buildFallbackChain(body, runtimeProfiles) {
   if (explicitFallbacks.length > 0) return explicitFallbacks;
   return [
     {
-      provider: 'xai',
-      model: runtimeProfiles.xaiFallbackModel,
-      baseUrl: runtimeProfiles.xaiBaseUrl,
-      apiKey: runtimeProfiles.xaiApiKey || process.env.XAI_API_KEY || '',
-      reason: 'xai reasoning fallback',
+      provider: 'deepseek',
+      model: runtimeProfiles.deepModel,
+      baseUrl: runtimeProfiles.deepseekBaseUrl,
+      apiKey: runtimeProfiles.deepseekApiKey || secretEnv('DEEPSEEK_API_KEY', 'ARIA_DEEPSEEK_API_KEY'),
+      reason: 'deepseek-v4-pro fallback',
     },
     {
-      provider: 'nim',
-      model: runtimeProfiles.nimFallbackModel,
-      baseUrl: runtimeProfiles.nimBaseUrl,
-      apiKey: runtimeProfiles.nimApiKey || process.env.NVIDIA_NIM_API_KEY || process.env.NIM_API_KEY || '',
-      reason: 'nim qwen fallback',
+      provider: LOCAL_VIRTUAL_MAC_PROVIDER,
+      model: runtimeProfiles.localFallbackModel,
+      baseUrl: runtimeProfiles.localFallbackBaseUrl,
+      apiKey: runtimeProfiles.localFallbackApiKey || secretEnv('ARIA_LOCAL_FALLBACK_API_KEY', 'ARIA_LANE_GATEWAY_API_KEY'),
+      reason: 'aria local virtual mac lane fallback',
     },
-  ].filter((entry) => entry.apiKey && entry.model);
+  ].filter((entry) => entry.model && (!providerRequiresApiKey(entry.provider) || entry.apiKey));
 }
 
 async function callResolvedProvider(config, body, ariaSystemPrompt) {
-  const model = body.model || config.model || 'gpt-4o';
+  const model = config.model || body.model || 'gpt-4o';
   const messages = composeOpenAIMessages(Array.isArray(body.messages) ? body.messages : [], ariaSystemPrompt);
   const maxTokens = Number(body.max_tokens || body.max_completion_tokens || 4096);
 
@@ -235,16 +303,28 @@ async function callResolvedProvider(config, body, ariaSystemPrompt) {
     xai: config.baseUrl || DEFAULT_XAI_BASE_URL,
     nim: config.baseUrl || DEFAULT_NIM_BASE_URL,
     'nvidia-nim': config.baseUrl || DEFAULT_NIM_BASE_URL,
+    [LOCAL_VIRTUAL_MAC_PROVIDER]: config.baseUrl || DEFAULT_LOCAL_FALLBACK_BASE_URL,
+    'local-virtual-mac-lane': config.baseUrl || DEFAULT_LOCAL_FALLBACK_BASE_URL,
+    'qwen-mac-lane': config.baseUrl || DEFAULT_LOCAL_FALLBACK_BASE_URL,
   };
   const providerUrl = urlByProvider[config.provider] || urlByProvider.openai;
+  const providerModel = config.provider === 'xai' ? xaiApiModel(model) : model;
   const extraHeaders = config.provider === 'openrouter'
     ? {
         'HTTP-Referer': 'http://127.0.0.1',
         'X-Title': 'Aria Mounted Runtime',
       }
+    : isLocalVirtualMacProvider(config.provider)
+      ? {
+          'X-Aria-Surface': body?.aria_surface || body?.metadata?.surface || 'client_chat',
+          'X-Aria-Role-Profile': body?.metadata?.roleProfile || 'interactive_chat',
+          'X-Aria-Stage': body?.metadata?.stage || 'fallback',
+          'X-Aria-Actor': body?.metadata?.actor || 'aria-smart-cli',
+          'X-Aria-System': body?.metadata?.system || 'aria-connector',
+        }
     : {};
   const data = await callOpenAICompatible(providerUrl, config.apiKey, {
-    model,
+    model: providerModel,
     messages,
     max_tokens: maxTokens,
     stream: false,
@@ -274,25 +354,33 @@ export function resolveProviderConfig(body = {}) {
     body.provider ||
     localModel?.provider ||
     coerceString(local?.defaultProvider) ||
-    (process.env.DEEPSEEK_API_KEY ? 'deepseek' : 'ollama');
+    (runtimeProfiles.xaiApiKey || secretEnv('XAI_API_KEY', 'GROK_API_KEY', 'ARIA_XAI_KEY')
+      ? 'xai'
+      : runtimeProfiles.deepseekApiKey || secretEnv('DEEPSEEK_API_KEY', 'ARIA_DEEPSEEK_API_KEY')
+        ? 'deepseek'
+        : 'ollama');
+  const localApiKey = localModel?.provider === provider ? coerceString(localModel?.apiKey) : '';
+  const localBaseUrl = localModel?.provider === provider ? coerceString(localModel?.baseUrl) : '';
   const merged = {
     provider,
     model: resolveDefaultModel(provider, body, localModel, runtimeProfiles),
     apiKey: resolveProviderApiKey(
       provider,
       coerceString(override?.apiKey || body.providerApiKey),
-      coerceString(localModel?.apiKey),
+      localApiKey,
     ),
     baseUrl:
       override?.baseUrl ||
       body.providerBaseUrl ||
-      localModel?.baseUrl ||
+      localBaseUrl ||
       (provider === 'ollama'
         ? DEFAULT_OLLAMA_BASE_URL
         : provider === 'deepseek'
-          ? DEFAULT_DEEPSEEK_BASE_URL
+          ? runtimeProfiles.deepseekBaseUrl
           : provider === 'xai'
-            ? DEFAULT_XAI_BASE_URL
+            ? runtimeProfiles.xaiBaseUrl
+            : isLocalVirtualMacProvider(provider)
+              ? runtimeProfiles.localFallbackBaseUrl
             : provider === 'nim' || provider === 'nvidia-nim'
               ? DEFAULT_NIM_BASE_URL
           : ''),
@@ -302,7 +390,7 @@ export function resolveProviderConfig(body = {}) {
     throw new Error('No provider configured. Save one in ~/.aria/config.json or pass llm/providerConfig in the request body.');
   }
 
-  if (merged.provider !== 'ollama' && merged.provider !== 'google' && !merged.apiKey) {
+  if (providerRequiresApiKey(merged.provider) && merged.provider !== 'google' && !merged.apiKey) {
     throw new Error(`No API key configured for provider ${merged.provider}. Save one in ~/.aria/config.json or pass llm.apiKey.`);
   }
 
@@ -415,7 +503,7 @@ async function callOpenAICompatible(url, apiKey, payload, extraHeaders = {}) {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
-        Authorization: `Bearer ${apiKey}`,
+        ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
         ...extraHeaders,
       },
       body: JSON.stringify(payload),
@@ -537,8 +625,11 @@ export async function callProviderForOpenAI(body, ariaSystemPrompt) {
 }
 
 export async function callProviderForAnthropic(body, ariaSystemPrompt) {
+  const local = loadLocalConfig();
+  const localModel = local?.model && typeof local.model === 'object' ? local.model : null;
+  const runtimeProfiles = loadRuntimeProfiles(local);
   const config = resolveProviderConfig(body);
-  const model = body.model || config.model || 'claude-sonnet-4-20250514';
+  const model = coerceString(body.model) || config.model || 'claude-sonnet-4-20250514';
   const req = composeAnthropicRequest(body, ariaSystemPrompt);
   const maxTokens = Number(body.max_tokens || 4096);
 
@@ -569,13 +660,25 @@ export async function callProviderForAnthropic(body, ariaSystemPrompt) {
       content: flattenAnthropicContent(message.content),
     })),
   ];
-  return callProviderForOpenAI({
+  const providerModel = resolveProviderNativeModel(config.provider, body, localModel, runtimeProfiles, config.model);
+  if (!providerModel) {
+    throw new Error(`No native model configured for provider ${config.provider}; refusing to send Anthropic client model ${model} upstream.`);
+  }
+  const providerMeta = await callProviderForOpenAI({
     ...body,
     provider: config.provider,
-    model,
+    model: providerModel,
     messages: openAiMessages,
-    llm: config,
+    llm: {
+      ...config,
+      model: providerModel,
+    },
   }, req.system);
+  return {
+    ...providerMeta,
+    model,
+    upstreamModel: providerMeta.model,
+  };
 }
 
 export function chunkText(text, maxChunkChars = 120) {

package/dist/runtime/sdk/BUNDLED.json

@@ -1,5 +1,5 @@
 {
-  "bundledAt": "2026-05-03T03:55:56.398Z",
+  "bundledAt": "2026-05-04T03:02:47.924Z",
   "sdkSource": "/home/hamzaibrahim1/rei-ai-brain/harness/packages/harness-http-client/dist",
-  "files": 9
+  "files": 12
 }

package/dist/runtime/sdk/auth.d.ts

@@ -0,0 +1,17 @@
+export type HarnessAuthTokenSource = 'explicit' | 'env:ARIA_HARNESS_TOKEN' | 'env:ARIA_API_KEY' | 'env:ARIA_MASTER_TOKEN' | 'persisted-client-token' | 'owner-token-file' | 'license:harnessToken' | 'license:token' | 'missing';
+export interface HarnessAuthResolutionOptions {
+    explicitToken?: string | null;
+    baseUrl?: string;
+    clientId?: string;
+    tokenScope?: string;
+    persistToken?: boolean;
+}
+export interface HarnessAuthResolution {
+    token: string;
+    source: HarnessAuthTokenSource;
+    scope: string;
+    persisted: boolean;
+    tokenPresent: boolean;
+}
+export declare function resolveHarnessAuthToken(options?: HarnessAuthResolutionOptions): HarnessAuthResolution;
+export declare function getHarnessAuthStatus(options?: HarnessAuthResolutionOptions): Omit<HarnessAuthResolution, 'token'>;