@aria_asi/cli 0.2.36 → 0.2.37

package/hooks/lib/skill-autoload-gate-impl.mjs

@@ -0,0 +1,103 @@
+// ARIA_ALLOW_STUB: this gate helper must match doctrine trigger words as data.
+const POST = /\b(?:post[_ -]?compact[_ -]?continuation|handoff[_ -]?resume|continuation[_ -]?handoff|post-compact|compact(?:ion)? handoff|post\s+commission)\b/i;
+const OFF = /\bGATEOFF\b/i;
+const SKILL_CONTENT_RX = /<skill_content\s+name=["']([^"']+)["']/gi;
+const DEPLOY_VERIFY_RX = /<verify>[\s\S]*?target\s*:[\s\S]*?role\s*:[\s\S]*?verified\s*:[\s\S]*?rollback\s*:[\s\S]*?axiom\s*:[\s\S]*?<\/verify>/i;
+const COGNITION_BLOCK_RX = /<cognition>[\s\S]*?nur\s*:[\s\S]*?mizan\s*:[\s\S]*?hikma\s*:[\s\S]*?tafakkur\s*:[\s\S]*?tadabbur\s*:[\s\S]*?ilham\s*:[\s\S]*?wahi\s*:[\s\S]*?firasah\s*:[\s\S]*?<\/cognition>/i;
+const EXPECTED_BLOCK_RX = /<expected>[\s\S]*?predicate\s*:[\s\S]*?measurable_type\s*:[\s\S]*?<\/expected>/i;
+const APPLIED_COGNITION_RX = /<applied_cognition>[\s\S]*?decision_delta\s*:[\s\S]*?dominant_domain\s*:[\s\S]*?binds_to\s*:[\s\S]*?expected_predicate\s*:[\s\S]*?artifact_change\s*:[\s\S]*?<\/applied_cognition>/i;
+const NO_STRIPPING_BLOCK_RX = /<no_stripping>[\s\S]*?preserved_contract\s*:[\s\S]*?root_mechanism\s*:[\s\S]*?removed_surface\s*:\s*none[\s\S]*?verification\s*:[\s\S]*?<\/no_stripping>/i;
+
+function bypass(text) {
+  return /^(?:1|true|yes|on)$/i.test(String(process.env.ARIA_GATES_OFF || process.env.ARIA_HARNESS_GATES_OFF || '')) || POST.test(String(text || '')) || OFF.test(String(text || ''));
+}
+
+function addSkill(set, skill) {
+  const normalized = String(skill || '').trim();
+  if (normalized) set.add(normalized);
+}
+
+function collectLoadedSkills(options = {}, body = '') {
+  const loaded = new Set();
+  for (const m of String(body || '').matchAll(SKILL_CONTENT_RX)) addSkill(loaded, m[1]);
+  for (const skill of Array.isArray(options.loadedSkills) ? options.loadedSkills : []) addSkill(loaded, skill);
+  return loaded;
+}
+
+function collectContractEvidence(options = {}, body = '') {
+  const evidence = new Set();
+  if (DEPLOY_VERIFY_RX.test(body) && COGNITION_BLOCK_RX.test(body) && EXPECTED_BLOCK_RX.test(body)) {
+    evidence.add('aria-harness-deploy');
+    evidence.add('aria-forge-guardrails');
+    evidence.add('aria-harness-output-discipline');
+  }
+  if (APPLIED_COGNITION_RX.test(body)) evidence.add('aria-forge-guardrails');
+  if (NO_STRIPPING_BLOCK_RX.test(body)) evidence.add('aria-harness-no-stripping');
+  if (options.repoDoctrineVerified === true) evidence.add('aria-repo-doctrine');
+  if (options.noStrippingVerified === true) evidence.add('aria-harness-no-stripping');
+  if (options.outputDisciplineVerified === true) evidence.add('aria-harness-output-discipline');
+  return evidence;
+}
+
+export function recordSkillLoaded({ skill } = {}) {
+  return { skill, recordedAt: new Date().toISOString() };
+}
+
+export function classifyRequiredSkills({ text = '', action = '', toolName = '', filePath = '', isDeploy = false, isMutation = false, isOutputCloseout = false } = {}) {
+  const c = [text, action, toolName, filePath].filter(Boolean).join('\n');
+  const required = new Set();
+  const reasons = [];
+  const recoveryMissing = [];
+  let redirectOnly = false;
+  if (bypass(c)) return { requiredSkills: [], recoveryMissing: [], reasons: ['post-compaction or emergency gate-off bypasses skill autoload classification'] };
+  if (isDeploy || /deploy-service\.sh|kubectl\s+(?:apply|set|rollout|delete|scale)|helm\s+upgrade|terraform\s+apply|docker\s+push/i.test(c)) {
+    required.add('aria-harness-deploy');
+    required.add('aria-forge-guardrails');
+    reasons.push('deploy/shared-infrastructure action requires fail-closed deploy and forge guardrails');
+  }
+  if (isMutation || /^(?:edit|write|notebookedit|patch|apply_patch)$/i.test(toolName)) {
+    required.add('aria-repo-doctrine');
+    reasons.push('repository/runtime mutation requires repo doctrine');
+  }
+  if (/remove|delete|strip|drop|omit|disable|bypass|skip|stub|mock|fake|placeholder|temporary|quick scaffold|band-aid/i.test(c)) {
+    required.add('aria-harness-no-stripping');
+    required.add('aria-forge-guardrails');
+    reasons.push('contract-reduction language requires no-stripping and forge guardrails');
+  }
+  if (isOutputCloseout && /done|complete|completed|ready|verified|fixed|shipped|implemented|production-ready/i.test(c)) {
+    required.add('aria-harness-output-discipline');
+    reasons.push('owner-facing completion/readiness claim requires output discipline');
+    if (!/(verified|passed|success|successful|green|ok|exit\s*0)/i.test(c)) recoveryMissing.push('successful proof from a concrete command/probe');
+  }
+  if (/production-ready|ready for production|first[- ]class|works in general|general readiness|client packages?|npm packages?|SDKs?|runtimes?|harnesses?|release-ready|ship-ready/i.test(c)) {
+    redirectOnly = true;
+    reasons.push('broad readiness language requires recovery guidance instead of a permanent skill block');
+  }
+  if (/done|complete|completed|ready|verified|fixed|shipped|implemented|production-ready/i.test(c) && /but|except|caveat|remaining|not yet|still|separate|later|blocked|skipped|unresolved|follow-up|failed|failing|error|\bred\b|not run|could not verify|untested|no proof|missing proof|without proof/i.test(c)) {
+    required.add('aria-harness-output-discipline');
+    required.add('aria-forge-guardrails');
+    redirectOnly = true;
+    reasons.push('completion claim with explicit unresolved state requires recovery guidance');
+  }
+  if (/non-blocking|warning only|warn only|advisory|fall through|falls through|fail open|soft fail|logged and continue|quality gate warning/i.test(c)) {
+    required.add('aria-forge-guardrails');
+    reasons.push('advisory/fail-open gate language requires fail-closed hardening discipline');
+  }
+  return { requiredSkills: [...required].sort(), recoveryMissing: [...new Set(recoveryMissing)], reasons, redirectOnly };
+}
+
+export function evaluateSkillGate(options = {}) {
+  const c = classifyRequiredSkills(options);
+  const body = [options.text, options.action].filter(Boolean).join('\n');
+  const loaded = collectLoadedSkills(options, body);
+  const contractEvidence = collectContractEvidence(options, body);
+  const satisfied = new Set([...loaded, ...contractEvidence]);
+  const missingSkills = c.requiredSkills.filter((skill) => !satisfied.has(skill));
+  const recoveryMissing = contractEvidence.has('aria-harness-deploy') && contractEvidence.has('aria-forge-guardrails') ? [] : c.recoveryMissing;
+  return { ok: c.redirectOnly === true || (missingSkills.length === 0 && recoveryMissing.length === 0), redirectOnly: c.redirectOnly === true, surface: options.surface || 'unknown', sessionId: options.sessionId || 'unknown', requiredSkills: c.requiredSkills, loadedSkills: [...loaded].sort(), contractEvidence: [...contractEvidence].sort(), missingSkills, recoveryMissing, reasons: c.reasons, autoLoadAvailable: options.autoLoadAvailable === true };
+}
+
+export function formatSkillGateBlock(result = {}) {
+  const m = result.missingSkills || [], r = result.recoveryMissing || [], reasons = result.reasons || [];
+  return ['=== ARIA SKILL AUTOLOAD GATE BLOCK ===', `surface: ${result.surface || 'unknown'}`, `missing_skills: ${m.length ? m.join(', ') : '(none)'}`, `missing_recovery_cycle: ${r.length ? r.join(', ') : '(none)'}`, `required_skills: ${(result.requiredSkills || []).join(', ') || '(none)'}`, reasons.length ? `reasons: ${reasons.join(' | ')}` : 'reasons: no classifier reason recorded', 'Recovery contract:', '1. Do not retry the same blocked text.', `2. Load missing skills first: ${m.length ? m.join(', ') : '(none)'}`, `3. Repair missing recovery cycle items: ${r.length ? r.join(', ') : '(none)'}`, '4. Re-write with concrete proof and an applied_cognition block:', '<applied_cognition>', 'decision_delta: <what changed after the block>', 'dominant_domain: <deploy|code|security|testing|ops|product|writing>', 'binds_to: <specific file, command, endpoint, or user instruction>', 'expected_predicate: <measurable condition such as exit=0, status=healthy, count=N>', 'artifact_change: <exact artifact changed or none>', '</applied_cognition>', '5. Re-test using the concrete command/probe named in the block.', '6. Re-submit only after the proof exists; if blocked twice, escalate through ARIA console/MCP with this full block.'].join('\n');
+}

package/hooks/lib/skill-autoload-gate.mjs

@@ -1,14 +1 @@
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { tmpdir } from 'node:os';
-const RECEIPT_ROOT = process.env.ARIA_SKILL_RECEIPT_DIR || join(tmpdir(), 'aria-skill-receipts');
-const ALIASES = new Map([['deploy', 'aria-harness-deploy'], ['output', 'aria-harness-output-discipline'], ['repo', 'aria-repo-doctrine'], ['forge', 'aria-forge-guardrails']]);
-const RX = { deploy: /deploy-service\.sh|kubectl\s+(?:apply|set|rollout|delete|scale)|helm\s+upgrade|terraform\s+apply|docker\s+push/i, mutationTool: /^(?:edit|write|notebookedit|patch|apply_patch)$/i, mutation: /apply_patch|write file|edit file|modify|delete file|migration|handler|route|runtime|hook|plugin|\btest\b|smoke script/i, strip: /remove|delete|strip|drop|omit|disable|bypass|skip|stub|mock|fake|placeholder|temporary|quick scaffold|band-aid/i, readiness: /production-ready|ready for production|works in general|general readiness|client packages?|npm packages?|SDKs?|runtimes?|harnesses?|release-ready|ship-ready/i, narrow: /single flow|one flow|narrow e2e|covered flow|specific path|widget flow/i, completion: /done|complete|completed|ready|verified|fixed|shipped|implemented|production-ready/i, badProof: /but|except|caveat|remaining|not yet|still|separate|later|blocked|skipped|unresolved|follow-up|failed|failing|error|red|not run|could not verify|untested|no proof|missing proof|without proof/i, advisory: /non-blocking|warning only|warn only|advisory|fall through|falls through|fail open|soft fail|logged and continue|quality gate warning/i, success: /(?:verified|passed|success|successful|green|ok)\s*[:=\-].{0,120}(?:npm|node|playwright|jest|vitest|build|test|lint|typecheck|curl|kubectl|self-test|e2e|probe|smoke)|(?:npm|node|playwright|jest|vitest|build|test|lint|typecheck|curl|kubectl).{0,120}(?:passed|success|successful|green|exit\s*0)/i, resubmit: /re-?submission|resubmit/i, rewrite: /re-?write|rewrite|fix/i, retest: /re-?test|retest|rerun/i, aria: /ARIA console|Aria console|\/chat|aria-pipeline-mcp|aria_chat|escalat(?:e|ion).{0,80}ARIA/i };
-function normalizeSkillName(skill) { return ALIASES.get(String(skill || '').trim()) || String(skill || '').trim(); }
-function sessionDir(sessionId) { return join(RECEIPT_ROOT, encodeURIComponent(String(sessionId || 'unknown'))); }
-function readReceiptSkills(sessionId) { const dir = sessionDir(sessionId); if (!existsSync(dir)) return new Set(); const skills = new Set(); for (const name of readdirSync(dir)) { if (!name.endsWith('.json')) continue; try { const receipt = JSON.parse(readFileSync(join(dir, name), 'utf8')); if (receipt?.skill) skills.add(normalizeSkillName(receipt.skill)); } catch {} } return skills; }
-function readInlineSkills(text) { const skills = new Set(); const value = String(text || ''); for (const match of value.matchAll(/<skill_content\s+name=["']([^"']+)["']/gi)) skills.add(normalizeSkillName(match[1])); return skills; }
-export function recordSkillLoaded({ sessionId, skill, surface = 'unknown', metadata = {} } = {}) { const normalized = normalizeSkillName(skill); if (!normalized) throw new Error('recordSkillLoaded requires a skill name'); const dir = sessionDir(sessionId); mkdirSync(dir, { recursive: true }); const receipt = { skill: normalized, surface, metadata, recordedAt: new Date().toISOString() }; writeFileSync(join(dir, `${encodeURIComponent(normalized)}.json`), `${JSON.stringify(receipt, null, 2)}\n`); return receipt; }
-export function classifyRequiredSkills({ text = '', action = '', toolName = '', filePath = '', isDeploy = false, isMutation = false, isOutputCloseout = false } = {}) { const combined = [text, action, toolName, filePath].filter(Boolean).join('\n'); const required = new Set(); const reasons = []; const recoveryMissing = []; if (isDeploy || RX.deploy.test(combined)) { required.add('aria-harness-deploy'); required.add('aria-forge-guardrails'); reasons.push('deploy/shared-infrastructure action requires fail-closed deploy and forge guardrails'); } if (isMutation || RX.mutationTool.test(toolName)) { required.add('aria-repo-doctrine'); reasons.push('repository/runtime mutation requires repo doctrine'); } if (RX.strip.test(combined)) { required.add('aria-harness-no-stripping'); reasons.push('strip/remove/bypass language requires no-stripping gate'); } if (isOutputCloseout && RX.completion.test(combined)) { required.add('aria-harness-output-discipline'); reasons.push('owner-facing completion/readiness claim requires output discipline'); if (!RX.success.test(combined)) recoveryMissing.push('successful proof from a concrete command/probe'); } if (RX.readiness.test(combined)) { required.add('architecture-decision'); required.add('testing-strategy'); required.add('aria-forge-guardrails'); required.add('aria-harness-output-discipline'); reasons.push('broad production/package/SDK/runtime readiness claim requires architecture, testing, and forge guardrails'); } if (RX.readiness.test(combined) && RX.narrow.test(combined)) { required.add('testing-strategy'); required.add('aria-forge-guardrails'); reasons.push('narrow e2e proof cannot support broad readiness claim without readiness-matrix discipline'); } if (RX.completion.test(combined) && RX.badProof.test(combined)) { required.add('aria-harness-output-discipline'); required.add('aria-forge-guardrails'); reasons.push('completion claim with unresolved or failed proof requires recovery cycle'); if (!RX.resubmit.test(combined)) recoveryMissing.push('re-submission'); if (!RX.rewrite.test(combined)) recoveryMissing.push('re-write'); if (!RX.retest.test(combined)) recoveryMissing.push('re-test'); if (!RX.aria.test(combined)) recoveryMissing.push('ARIA console escalation'); } if (RX.advisory.test(combined)) { required.add('aria-forge-guardrails'); required.add('aria-harness-output-discipline'); reasons.push('advisory/fail-open gate language requires fail-closed hardening discipline'); } return { requiredSkills: [...required].sort(), reasons, recoveryMissing }; }
-export function evaluateSkillGate(options = {}) { const classified = classifyRequiredSkills(options); const text = [options.text, options.action].filter(Boolean).join('\n'); const loaded = new Set([...readReceiptSkills(options.sessionId), ...readInlineSkills(text)]); const missingSkills = classified.requiredSkills.filter((skill) => !loaded.has(skill)); const recoveryMissing = classified.recoveryMissing || []; return { ok: missingSkills.length === 0 && recoveryMissing.length === 0, surface: options.surface || 'unknown', sessionId: options.sessionId || 'unknown', requiredSkills: classified.requiredSkills, loadedSkills: [...loaded].sort(), missingSkills, recoveryMissing, reasons: classified.reasons, autoLoadAvailable: options.autoLoadAvailable === true }; }
-export function formatSkillGateBlock(result = {}) { const missing = Array.isArray(result.missingSkills) ? result.missingSkills : []; const recovery = Array.isArray(result.recoveryMissing) ? result.recoveryMissing : []; const reasons = Array.isArray(result.reasons) ? result.reasons : []; return ['=== ARIA SKILL AUTOLOAD GATE BLOCK ===', `surface: ${result.surface || 'unknown'}`, `missing_skills: ${missing.length ? missing.join(', ') : '(none)'}`, `missing_recovery_cycle: ${recovery.length ? recovery.join(', ') : '(none)'}`, `required_skills: ${(result.requiredSkills || []).join(', ') || '(none)'}`, reasons.length ? `reasons: ${reasons.join(' | ')}` : 'reasons: no classifier reason recorded', 'counter_action: re-submit, re-write, re-test, and escalate through ARIA console until successful proof exists. Do not downgrade this to an advisory warning.'].join('\n'); }
+export * from './skill-autoload-gate-impl.mjs';

package/opencode-plugins/harness-context/auth-token.mjs

@@ -0,0 +1,126 @@
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const HOME = homedir();
+const ARIA_DIR = join(HOME, '.aria');
+const OWNER_TOKEN_PATH = join(ARIA_DIR, 'owner-token');
+const LICENSE_PATH = join(ARIA_DIR, 'license.json');
+const CLIENT_TOKEN_DIR = join(ARIA_DIR, 'harness-tokens');
+
+function nonEmpty(value) {
+  return typeof value === 'string' && value.trim() ? value.trim() : '';
+}
+
+function readJson(path) {
+  try {
+    if (!existsSync(path)) return null;
+    const parsed = JSON.parse(readFileSync(path, 'utf8'));
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+function readText(path) {
+  try {
+    if (!existsSync(path)) return '';
+    return readFileSync(path, 'utf8').trim();
+  } catch {
+    return '';
+  }
+}
+
+function sanitizeScope(value) {
+  const clean = String(value || '').trim().replace(/[^a-zA-Z0-9._-]/g, '_').slice(0, 96);
+  return clean || 'default';
+}
+
+function scopeFromBaseUrl(baseUrl) {
+  try {
+    const parsed = new URL(String(baseUrl || ''));
+    return `base-${createHash('sha256').update(`${parsed.protocol}//${parsed.host}`).digest('hex').slice(0, 16)}`;
+  } catch {
+    return 'default';
+  }
+}
+
+function hasExplicitClientScope(options) {
+  return Boolean(nonEmpty(options.clientId) || nonEmpty(options.tokenScope));
+}
+
+function inferScope(options, license) {
+  const explicit = nonEmpty(options.tokenScope) || nonEmpty(options.clientId);
+  if (explicit) return sanitizeScope(explicit);
+  const envScope = nonEmpty(process.env.ARIA_HARNESS_CLIENT_ID) || nonEmpty(process.env.ARIA_CLIENT_ID) || nonEmpty(process.env.ARIA_TENANT_ID);
+  if (envScope) return sanitizeScope(envScope);
+  const licenseScope = nonEmpty(license?.jti) || nonEmpty(license?.sub);
+  if (licenseScope) return sanitizeScope(licenseScope);
+  return sanitizeScope(scopeFromBaseUrl(nonEmpty(options.baseUrl)));
+}
+
+function persistedPath(scope) {
+  return join(CLIENT_TOKEN_DIR, `${sanitizeScope(scope)}.json`);
+}
+
+function readPersistedToken(scope) {
+  const parsed = readJson(persistedPath(scope));
+  return nonEmpty(parsed?.token);
+}
+
+function persistToken(scope, token, source) {
+  if (!token) return false;
+  try {
+    mkdirSync(CLIENT_TOKEN_DIR, { recursive: true, mode: 0o700 });
+    writeFileSync(
+      persistedPath(scope),
+      `${JSON.stringify({ scope, token, source, updatedAt: new Date().toISOString() }, null, 2)}\n`,
+      { encoding: 'utf8', mode: 0o600 },
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function resolveAriaAuthToken(options = {}) {
+  const license = readJson(LICENSE_PATH);
+  const scope = inferScope(options, license);
+  const persist = options.persistToken !== false;
+
+  const explicit = nonEmpty(options.explicitToken);
+  if (explicit) {
+    return { token: explicit, source: 'explicit', scope, persisted: persist ? persistToken(scope, explicit, 'explicit') : false };
+  }
+
+  const envSources = [
+    ['env:ARIA_HARNESS_TOKEN', process.env.ARIA_HARNESS_TOKEN],
+    ['env:ARIA_API_KEY', process.env.ARIA_API_KEY],
+    ['env:ARIA_MASTER_TOKEN', process.env.ARIA_MASTER_TOKEN],
+  ];
+  for (const [source, value] of envSources) {
+    const token = nonEmpty(value);
+    if (!token) continue;
+    return { token, source, scope, persisted: persist ? persistToken(scope, token, source) : false };
+  }
+
+  const stored = readPersistedToken(scope);
+  if (stored) return { token: stored, source: 'persisted-client-token', scope, persisted: true };
+
+  if (!hasExplicitClientScope(options) || process.env.ARIA_ALLOW_OWNER_TOKEN_FOR_CLIENT_SCOPE === 'true') {
+    const ownerToken = readText(OWNER_TOKEN_PATH);
+    if (ownerToken) return { token: ownerToken, source: 'owner-token-file', scope, persisted: false };
+  }
+
+  const harnessToken = nonEmpty(license?.harnessToken);
+  if (harnessToken) return { token: harnessToken, source: 'license:harnessToken', scope, persisted: false };
+  const token = nonEmpty(license?.token);
+  if (token) return { token, source: 'license:token', scope, persisted: false };
+  return { token: '', source: 'missing', scope, persisted: false };
+}
+
+export function resolveAriaAuthHeader(options = {}) {
+  const resolved = resolveAriaAuthToken(options);
+  return resolved.token ? { Authorization: `Bearer ${resolved.token}` } : {};
+}

package/opencode-plugins/harness-context/inject-context.mjs

@@ -16,16 +16,20 @@
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
+import {
+  formatTaskProjectLedgerContext,
+  updateTaskProjectLedger,
+} from './task-project-ledger.mjs';
+import { resolveAriaAuthToken } from './auth-token.mjs';
 
 const HOME = homedir();
-const LICENSE_PATH = join(HOME, '.aria', 'license.json');
-const OWNER_TOKEN_PATH = join(HOME, '.aria', 'owner-token');
 const SDK_CANDIDATES = [
   join(HOME, '.aria', 'sdk', 'index.js'),
   join(HOME, '.codex', 'aria-sdk', 'index.js'),
   join(HOME, '.claude', 'aria-sdk', 'index.js'),
 ];
 const RUNTIME_URL = (process.env.ARIA_RUNTIME_URL || 'http://127.0.0.1:4319').replace(/\/+$/, '');
+const CURRENT_RECOVERY_PATH = join(HOME, '.aria', 'governance-recovery-current.json');
 const PACKET_CACHE_PATHS = [
   join(HOME, '.aria', '.aria-harness-last-packet.json'),
   join(HOME, '.claude', '.aria-harness-last-packet.json'),
@@ -39,22 +43,7 @@ function fail(reason) {
 }
 
 function resolveApiKey() {
-  if (process.env.ARIA_API_KEY) return process.env.ARIA_API_KEY;
-  if (process.env.ARIA_HARNESS_TOKEN) return process.env.ARIA_HARNESS_TOKEN;
-  if (process.env.ARIA_MASTER_TOKEN) return process.env.ARIA_MASTER_TOKEN;
-  if (existsSync(OWNER_TOKEN_PATH)) {
-    try {
-      const v = readFileSync(OWNER_TOKEN_PATH, 'utf8').trim();
-      if (v) return v;
-    } catch {}
-  }
-  if (existsSync(LICENSE_PATH)) {
-    try {
-      const j = JSON.parse(readFileSync(LICENSE_PATH, 'utf8'));
-      if (j.token) return j.token;
-    } catch {}
-  }
-  return '';
+  return resolveAriaAuthToken({ baseUrl: resolveBaseUrl() }).token;
 }
 
 function resolveBaseUrl() {
@@ -98,6 +87,57 @@ function formatPacketAsContext(packet) {
   return '';
 }
 
+function currentGovernanceRecoveryContext() {
+  try {
+    if (!existsSync(CURRENT_RECOVERY_PATH)) return '';
+    const recovery = JSON.parse(readFileSync(CURRENT_RECOVERY_PATH, 'utf8'));
+    const mode = String(recovery.governanceMode || '').trim();
+    if (!mode || mode === 'allow') return '';
+    const loop = recovery.recoveryLoop && typeof recovery.recoveryLoop === 'object' ? recovery.recoveryLoop : {};
+    const contract = recovery.recoveryContract && typeof recovery.recoveryContract === 'object' ? recovery.recoveryContract : {};
+    return [
+      '--- CURRENT GOVERNANCE RECOVERY CONTEXT ---',
+      `Mode: ${mode}`,
+      `Decision: ${recovery.decision || 'warn'}`,
+      `Fingerprint: ${loop.fingerprint || 'unknown'}`,
+      `Allowed recovery attempts: ${loop.allowedRecoveryAttempts ?? 1}`,
+      `Prior recovery attempts: ${loop.priorRecoveryAttempts ?? 0}`,
+      `Remaining recovery attempts: ${loop.remainingRecoveryAttempts ?? 0}`,
+      `Next step: ${loop.nextStep || 'execute recovery contract before claiming completion'}`,
+      `Architect fallback: ${loop.architectFallback || contract.fallbackWhenAriaUnavailable || 'if Aria consult is unavailable, use the strongest available client LLM under the architect harness'}`,
+      `Load skills first: ${(contract.loadSkillsFirst || []).join(', ') || '(none)'}`,
+      `Repair recovery cycle: ${(contract.repairRecoveryCycle || []).join(', ') || '(none)'}`,
+      `Retest: ${contract.retest || 'run the concrete verification probe'}`,
+      'Mandatory behavior: this is system-prompt recovery state; execute it before final output.',
+    ].join('\n');
+  } catch (error) {
+    process.stderr.write(`[inject-context] governance recovery context ignored (${error.message})\n`);
+    return '';
+  }
+}
+
+function appendAllLocalGuidance(contextText) {
+  const ledgerResult = updateTaskProjectLedger({
+    platform: 'opencode',
+    phase: 'session_start',
+    source: 'opencode-harness-context',
+    event: {
+      sessionId: process.env.OPENCODE_SESSION_ID || process.env.ARIA_SESSION_ID || 'opencode',
+      cwd: process.cwd(),
+    },
+  });
+  return [
+    currentGovernanceRecoveryContext(),
+    formatTaskProjectLedgerContext({
+      ledger: ledgerResult.ledger,
+      paths: ledgerResult.paths,
+      platform: 'opencode',
+      phase: 'session_start',
+    }),
+    contextText,
+  ].filter(Boolean).join('\n');
+}
+
 async function fetchViaSdk(baseUrl, apiKey) {
   const sdkPath = resolveSdkPath();
   if (!sdkPath) {
@@ -146,7 +186,7 @@ async function main() {
     const stale = loadCachedPacket({ ignoreTtl: true });
     if (stale) {
       process.stderr.write('[inject-context] using stale cached packet (no API key)\n');
-      process.stdout.write(formatPacketAsContext(stale));
+      process.stdout.write(appendAllLocalGuidance(formatPacketAsContext(stale)));
       return;
     }
     fail('no API key — set ARIA_API_KEY or run `aria login`');
@@ -155,19 +195,19 @@ async function main() {
 
   try {
     const packet = await fetchViaRuntime(apiKey).catch(() => fetchViaSdk(baseUrl, apiKey));
-    process.stdout.write(formatPacketAsContext(packet));
+    process.stdout.write(appendAllLocalGuidance(formatPacketAsContext(packet)));
     return;
   } catch (err) {
     const fresh = loadCachedPacket();
     if (fresh) {
       process.stderr.write(`[inject-context] SDK fetch failed (${err.message}), using fresh cached packet\n`);
-      process.stdout.write(formatPacketAsContext(fresh));
+      process.stdout.write(appendAllLocalGuidance(formatPacketAsContext(fresh)));
       return;
     }
     const stale = loadCachedPacket({ ignoreTtl: true });
     if (stale) {
       process.stderr.write(`[inject-context] network failed (${err.message}), using stale cached packet\n`);
-      process.stdout.write(formatPacketAsContext(stale));
+      process.stdout.write(appendAllLocalGuidance(formatPacketAsContext(stale)));
       return;
     }
     fail(`SDK fetch failed: ${err && err.message ? err.message : String(err)}`);