@aria_asi/cli 0.2.36 → 0.2.38

package/src/connectors/repo-guard.ts

@@ -1,13 +1,10 @@
 import chokidar from 'chokidar';
 import { execFileSync } from 'child_process';
-import { createHash } from 'crypto';
 import {
   existsSync,
   mkdirSync,
-  readdirSync,
   readFileSync,
   statSync,
-  renameSync,
   writeFileSync,
 } from 'fs';
 import { homedir } from 'os';
@@ -22,17 +19,10 @@ const ENV_PATH = path.join(ARIA_DIR, 'repo-guard.env');
 const STATE_PATH = path.join(ARIA_DIR, 'repo-guard-state.json');
 const EVENTS_PATH = path.join(ARIA_DIR, 'repo-guard-events.jsonl');
 const LAST_ALERT_PATH = path.join(ARIA_DIR, 'repo-guard-last-alert.json');
-const SHADOW_ROOT = path.join(ARIA_DIR, 'repo-guard', 'shadow');
+const APPROVALS_PATH = path.join(ARIA_DIR, 'repo-guard-approvals.json');
 const QUARANTINE_ROOT = path.join(ARIA_DIR, 'repo-guard', 'quarantine');
 const DEFAULT_DEBOUNCE_MS = Number(process.env.ARIA_REPO_GUARD_DEBOUNCE_MS || 350);
 const BLOCKING_MODE = !/^(0|false|no)$/i.test(process.env.ARIA_REPO_GUARD_BLOCKING || 'true');
-const DOCTRINE_PREFIXES = ['apps/', 'packages/', 'harness/', 'ops/', 'scripts/'];
-const DOCTRINE_EXTENSIONS = new Set([
-  '.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs',
-  '.py', '.sh', '.bash', '.zsh', '.rb', '.go',
-  '.rs', '.java', '.kt', '.cs', '.php', '.swift',
-  '.scala', '.yml', '.yaml',
-]);
 const IGNORED_SEGMENTS = new Set([
   '.git',
   'node_modules',
@@ -44,10 +34,13 @@ const IGNORED_SEGMENTS = new Set([
   'coverage',
   'archive',
   'generated',
+  'vendor',
   'telegram_env',
   'backup-opencode-config',
   'training-data',
 ]);
+const IGNORED_FILE_RX = /(?:^|\/)(?:package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb?|\.DS_Store)$/i;
+const DEFAULT_APPROVAL_TTL_MS = Number(process.env.ARIA_REPO_GUARD_APPROVAL_TTL_MS || 10 * 60 * 1000);
 
 type GuardStatus = 'idle' | 'watching' | 'violation' | 'error';
 
@@ -72,7 +65,16 @@ interface AlertPayload {
   relPath?: string;
   action?: string;
   detail?: string;
-  type: 'violation' | 'blocked-delete' | 'watcher-error' | 'status';
+  type: 'blocked-delete' | 'watcher-error' | 'status' | 'observed-change' | 'approved-delete' | 'ignored-delete';
+}
+
+interface DeleteApproval {
+  repoRoot: string;
+  relPath: string;
+  approvedBy: string;
+  approvedAt: string;
+  expiresAt: string;
+  reason: string;
 }
 
 function writeState(update: Partial<GuardState>): GuardState {
@@ -177,19 +179,6 @@ function normalizeRel(input: string): string {
   return input.split(path.sep).join('/');
 }
 
-function repoHash(repoRoot: string): string {
-  return createHash('sha256').update(repoRoot).digest('hex').slice(0, 16);
-}
-
-function shadowPath(repoRoot: string, relPath: string): string {
-  return path.join(SHADOW_ROOT, repoHash(repoRoot), relPath);
-}
-
-function quarantinePath(repoRoot: string, relPath: string): string {
-  const stamped = `${Date.now()}-${relPath.replace(/[\\/]/g, '__')}`;
-  return path.join(QUARANTINE_ROOT, repoHash(repoRoot), stamped);
-}
-
 function ensureParent(filePath: string): void {
   mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o755 });
 }
@@ -231,168 +220,150 @@ function resolveRepos(config?: AriaConfig, explicit?: string[], fallbackRepoPath
   return cwd ? [cwd] : [];
 }
 
-function isDoctrineBound(relPath: string): boolean {
+export function isRepoGuardedPath(relPath: string): boolean {
   const normalized = normalizeRel(relPath);
-  if (!DOCTRINE_PREFIXES.some((prefix) => normalized.startsWith(prefix))) return false;
-  if (!DOCTRINE_EXTENSIONS.has(path.extname(normalized))) return false;
   const parts = normalized.split('/');
   if (parts.some((part) => IGNORED_SEGMENTS.has(part))) return false;
-  if (normalized.endsWith('.map')) return false;
-  if (/package-lock\.json$|pnpm-lock\.yaml$|yarn\.lock$/i.test(normalized)) return false;
+  if (normalized.endsWith('.map') || IGNORED_FILE_RX.test(normalized)) return false;
   return true;
 }
 
-function walkDoctrineFiles(repoRoot: string): string[] {
-  const found: string[] = [];
-
-  function visit(absPath: string): void {
-    const stat = statSync(absPath);
-    if (stat.isDirectory()) {
-      const base = path.basename(absPath);
-      if (IGNORED_SEGMENTS.has(base)) return;
-      for (const child of readdirSync(absPath)) {
-        visit(path.join(absPath, child));
-      }
-      return;
-    }
-
-    const rel = path.relative(repoRoot, absPath);
-    if (isDoctrineBound(rel)) found.push(absPath);
-  }
-
-  for (const prefix of DOCTRINE_PREFIXES) {
-    const abs = path.join(repoRoot, prefix.slice(0, -1));
-    if (existsSync(abs)) visit(abs);
-  }
-
-  return found;
-}
-
-function gateFile(repoRoot: string, relPath: string): { ok: true } | { ok: false; detail: string } {
-  const hookPath = path.join(homedir(), '.claude', 'hooks', 'aria-repo-doctrine-gate.mjs');
+function isGitTracked(repoRoot: string, relPath: string): boolean {
   try {
-    execFileSync('node', [hookPath, '--repo', repoRoot, '--paths', relPath], {
-      stdio: ['ignore', 'pipe', 'pipe'],
-      encoding: 'utf8',
+    execFileSync('git', ['-C', repoRoot, 'ls-files', '--error-unmatch', normalizeRel(relPath)], {
+      stdio: ['ignore', 'ignore', 'ignore'],
     });
-    return { ok: true };
-  } catch (error) {
-    const detail = error instanceof Error && 'stderr' in error
-      ? String((error as { stderr?: string }).stderr || (error as { stdout?: string }).stdout || error.message)
-      : String(error);
-    return { ok: false, detail: detail.trim() || 'aria repo doctrine gate rejected the file' };
+    return true;
+  } catch {
+    return false;
   }
 }
 
-function writeShadow(repoRoot: string, relPath: string, content: string): void {
-  const dst = shadowPath(repoRoot, relPath);
-  ensureParent(dst);
-  writeFileSync(dst, content, { mode: 0o600 });
-}
-
-function readShadowContent(repoRoot: string, relPath: string): string | null {
-  const shadow = shadowPath(repoRoot, relPath);
-  if (!existsSync(shadow)) return null;
+function readTrackedContent(repoRoot: string, relPath: string): Buffer | null {
   try {
-    return readFileSync(shadow, 'utf8');
+    return execFileSync('git', ['-C', repoRoot, 'show', `HEAD:${normalizeRel(relPath)}`], {
+      stdio: ['ignore', 'pipe', 'ignore'],
+      encoding: 'buffer',
+    });
   } catch {
     return null;
   }
 }
 
-function readTrackedContent(repoRoot: string, relPath: string): string | null {
+function isGitDirectory(repoRoot: string, relPath: string): boolean {
   try {
-    return execFileSync('git', ['-C', repoRoot, 'show', `HEAD:${normalizeRel(relPath)}`], {
+    const output = execFileSync('git', ['-C', repoRoot, 'ls-files', `${normalizeRel(relPath).replace(/\/+$/, '')}/`], {
       stdio: ['ignore', 'pipe', 'ignore'],
       encoding: 'utf8',
     });
+    return output.trim().length > 0;
   } catch {
-    return null;
+    return false;
   }
 }
 
-function recoveryContent(repoRoot: string, relPath: string): string | null {
-  return readShadowContent(repoRoot, relPath) ?? readTrackedContent(repoRoot, relPath);
-}
-
-function restorePriorContent(repoRoot: string, absPath: string, relPath: string): 'restored' | 'moved' | 'none' {
-  const prior = recoveryContent(repoRoot, relPath);
+function restoreTrackedPath(repoRoot: string, absPath: string, relPath: string): 'file-restored' | 'tree-restored' | 'none' {
+  const prior = readTrackedContent(repoRoot, relPath);
   if (prior !== null) {
     ensureParent(absPath);
     writeFileSync(absPath, prior, { mode: 0o644 });
-    writeShadow(repoRoot, relPath, prior);
-    return 'restored';
+    return 'file-restored';
   }
 
-  if (!existsSync(absPath)) return 'none';
-
-  const movedDst = quarantinePath(repoRoot, relPath);
-  ensureParent(movedDst);
-  renameSync(absPath, movedDst);
-  return 'moved';
+  if (!isGitDirectory(repoRoot, relPath)) return 'none';
+  try {
+    execFileSync('git', ['-C', repoRoot, 'checkout', 'HEAD', '--', normalizeRel(relPath)], {
+      stdio: ['ignore', 'ignore', 'ignore'],
+    });
+    return 'tree-restored';
+  } catch {
+    return 'none';
+  }
 }
 
-function initializeBaseline(repoRoot: string): void {
-  for (const absPath of walkDoctrineFiles(repoRoot)) {
-    const relPath = path.relative(repoRoot, absPath);
-    try {
-      writeShadow(repoRoot, relPath, readFileSync(absPath, 'utf8'));
-    } catch {}
+function readApprovals(): DeleteApproval[] {
+  try {
+    const parsed = JSON.parse(readFileSync(APPROVALS_PATH, 'utf8')) as unknown;
+    if (!Array.isArray(parsed)) return [];
+    return parsed.filter((item): item is DeleteApproval => {
+      if (!item || typeof item !== 'object') return false;
+      const approval = item as Partial<DeleteApproval>;
+      return Boolean(approval.repoRoot && approval.relPath && approval.approvedBy && approval.expiresAt);
+    });
+  } catch {
+    return [];
   }
 }
 
-function handleViolation(repoRoot: string, absPath: string, relPath: string, detail: string): void {
-  const fileContent = existsSync(absPath) ? readFileSync(absPath, 'utf8') : '';
-  const quarantineDst = quarantinePath(repoRoot, relPath);
-  ensureParent(quarantineDst);
-  writeFileSync(quarantineDst, fileContent, { mode: 0o600 });
-
-  const action = BLOCKING_MODE ? restorePriorContent(repoRoot, absPath, relPath) : 'none';
+function writeApprovals(approvals: DeleteApproval[]): void {
+  mkdirSync(ARIA_DIR, { recursive: true, mode: 0o700 });
+  writeFileSync(APPROVALS_PATH, JSON.stringify(approvals, null, 2) + '\n', { mode: 0o600 });
+}
+
+function hasDeleteApproval(repoRoot: string, relPath: string): boolean {
+  const now = Date.now();
+  const approvals = readApprovals();
+  const active = approvals.filter((approval) => Date.parse(approval.expiresAt) > now);
+  if (active.length !== approvals.length) writeApprovals(active);
+  const normalizedRepo = path.resolve(repoRoot);
+  const normalizedPath = normalizeRel(relPath);
+  return active.some((approval) => path.resolve(approval.repoRoot) === normalizedRepo && normalizeRel(approval.relPath) === normalizedPath);
+}
+
+export function approveRepoGuardDelete(repoRoot: string, relPath: string, approvedBy = 'owner', reason = 'explicit owner approval', ttlMs = DEFAULT_APPROVAL_TTL_MS): DeleteApproval {
+  const approval: DeleteApproval = {
+    repoRoot: path.resolve(repoRoot),
+    relPath: normalizeRel(relPath),
+    approvedBy,
+    approvedAt: new Date().toISOString(),
+    expiresAt: new Date(Date.now() + ttlMs).toISOString(),
+    reason,
+  };
+  writeApprovals([...readApprovals(), approval]);
+  appendEvent({ type: 'delete-approved', ...approval });
+  return approval;
+}
+
+function handleDeletedGuardedPath(repoRoot: string, absPath: string, relPath: string): void {
+  const tracked = isGitTracked(repoRoot, relPath) || isGitDirectory(repoRoot, relPath);
+  if (!tracked) {
+    appendEvent({
+      type: 'ignored-delete',
+      repoRoot,
+      relPath,
+      detail: 'Untracked path deletion observed; nothing can be restored from git.',
+    });
+    writeState({ status: 'watching', lastEvent: `${repoRoot}:${relPath}`, lastError: null });
+    return;
+  }
 
-  const summary = `${repoRoot}:${relPath}`;
-  writeState({ status: 'violation', lastViolation: summary, lastEvent: summary, lastError: detail });
-  appendEvent({
-    type: 'violation',
-    repoRoot,
-    relPath,
-    quarantineDst,
-    blockingMode: BLOCKING_MODE,
-    action,
-    detail,
-  });
-  emitAlert({
-    type: 'violation',
-    title: 'Aria Repo Guard blocked a doctrine violation',
-    message: BLOCKING_MODE
-      ? 'The changed file was quarantined and the last known good content was restored.'
-      : 'A doctrine violation was detected while repo guard was in non-blocking mode.',
-    repoRoot,
-    relPath,
-    action,
-    detail,
-  });
-}
+  if (hasDeleteApproval(repoRoot, relPath)) {
+    appendEvent({ type: 'approved-delete', repoRoot, relPath });
+    writeState({ status: 'watching', lastEvent: `${repoRoot}:${relPath}`, lastError: null });
+    return;
+  }
 
-function handleDeletedDoctrineFile(repoRoot: string, absPath: string, relPath: string): void {
-  const action = BLOCKING_MODE ? restorePriorContent(repoRoot, absPath, relPath) : 'none';
-  if (action === 'none') return;
+  const action = BLOCKING_MODE ? restoreTrackedPath(repoRoot, absPath, relPath) : 'none';
   const summary = `${repoRoot}:${relPath}`;
-  writeState({ status: 'violation', lastViolation: summary, lastEvent: summary, lastError: 'Doctrine-bound deletion blocked.' });
+  writeState({ status: 'violation', lastViolation: summary, lastEvent: summary, lastError: 'Tracked path deletion requires explicit approval.' });
   appendEvent({
     type: 'blocked-delete',
     repoRoot,
     relPath,
     blockingMode: BLOCKING_MODE,
     action,
+    detail: 'Tracked path deletion restored from git because no active delete approval matched this path.',
   });
   emitAlert({
     type: 'blocked-delete',
-    title: 'Aria Repo Guard blocked a doctrine-bound deletion',
-    message: 'A doctrine-bound file deletion was intercepted and restored.',
+    title: 'Aria Repo Guard blocked an unapproved tracked deletion',
+    message: BLOCKING_MODE
+      ? 'A tracked repo path was deleted without active approval and was restored from git.'
+      : 'A tracked repo path was deleted without active approval while repo guard was non-blocking.',
     repoRoot,
     relPath,
     action,
-    detail: 'Doctrine-bound deletion blocked.',
+    detail: 'Tracked path deletion requires explicit approval.',
   });
 }
 
@@ -411,22 +382,14 @@ function findOwningRepo(repos: string[], absPath: string): string | null {
 
 function processChangedFile(repoRoot: string, absPath: string): void {
   const relPath = path.relative(repoRoot, absPath);
-  if (!isDoctrineBound(relPath)) return;
+  if (!isRepoGuardedPath(relPath)) return;
   if (!existsSync(absPath)) {
-    handleDeletedDoctrineFile(repoRoot, absPath, relPath);
+    handleDeletedGuardedPath(repoRoot, absPath, relPath);
     return;
   }
   if (statSync(absPath).isDirectory()) return;
-
-  const gate = gateFile(repoRoot, relPath);
-  if (gate.ok) {
-    writeShadow(repoRoot, relPath, readFileSync(absPath, 'utf8'));
-    const summary = `${repoRoot}:${relPath}`;
-    writeState({ status: 'watching', lastEvent: summary, lastError: null });
-    return;
-  }
-
-  handleViolation(repoRoot, absPath, relPath, gate.detail);
+  appendEvent({ type: 'observed-change', repoRoot, relPath });
+  writeState({ status: 'watching', lastEvent: `${repoRoot}:${relPath}`, lastError: null });
 }
 
 export async function startRepoGuardDaemon(options: RepoGuardOptions = {}): Promise<void> {
@@ -436,19 +399,16 @@ export async function startRepoGuardDaemon(options: RepoGuardOptions = {}): Prom
     throw new Error('No git repositories configured for repo guard.');
   }
 
-  mkdirSync(SHADOW_ROOT, { recursive: true, mode: 0o700 });
   mkdirSync(QUARANTINE_ROOT, { recursive: true, mode: 0o700 });
-  for (const repo of repos) initializeBaseline(repo);
 
   writeState({ status: 'watching', watchedRepos: repos, lastError: null });
   emitAlert({
     type: 'status',
     title: 'Aria Repo Guard watching repositories',
-    message: `Watching ${repos.length} repo(s) for doctrine-bound changes.`,
+    message: `Watching ${repos.length} repo(s) for unapproved tracked deletions.`,
   });
 
   const pending = new Map<string, NodeJS.Timeout>();
-  const restoring = new Map<string, number>();
   const debounceMs = options.debounceMs ?? DEFAULT_DEBOUNCE_MS;
 
   const watcher = chokidar.watch(repos, {
@@ -469,30 +429,16 @@ export async function startRepoGuardDaemon(options: RepoGuardOptions = {}): Prom
 
     const timer = setTimeout(() => {
       pending.delete(absPath);
-      const restoredAt = restoring.get(absPath);
-      if (restoredAt && Date.now() - restoredAt < 1500) {
-        restoring.delete(absPath);
-        return;
-      }
 
       const relPath = path.relative(repoRoot, absPath);
-      if (!isDoctrineBound(relPath)) return;
+      if (!isRepoGuardedPath(relPath)) return;
       if (!existsSync(absPath)) {
-        handleDeletedDoctrineFile(repoRoot, absPath, relPath);
-        return;
-      }
-
-      const gate = gateFile(repoRoot, relPath);
-      if (gate.ok) {
-        if (!statSync(absPath).isDirectory()) {
-          writeShadow(repoRoot, relPath, readFileSync(absPath, 'utf8'));
-        }
-        writeState({ status: 'watching', lastEvent: `${repoRoot}:${relPath}`, lastError: null });
+        handleDeletedGuardedPath(repoRoot, absPath, relPath);
         return;
       }
 
-      restoring.set(absPath, Date.now());
-      handleViolation(repoRoot, absPath, relPath, gate.detail);
+      if (!statSync(absPath).isDirectory()) appendEvent({ type: 'observed-change', repoRoot, relPath });
+      writeState({ status: 'watching', lastEvent: `${repoRoot}:${relPath}`, lastError: null });
     }, debounceMs);
 
     pending.set(absPath, timer);
@@ -576,7 +522,6 @@ export async function installRepoGuardDaemon(config?: AriaConfig, fallbackRepoPa
   }
 
   mkdirSync(BIN_DIR, { recursive: true, mode: 0o755 });
-  mkdirSync(SHADOW_ROOT, { recursive: true, mode: 0o700 });
   mkdirSync(QUARANTINE_ROOT, { recursive: true, mode: 0o700 });
   const envPath = writeRepoGuardEnv(repos);
   writeWrapper(path.join(BIN_DIR, 'aria-repo-guard'), ['repo-guard']);

package/src/connectors/runtime.ts

@@ -89,11 +89,14 @@ function writeRuntimeEnv(runtimeDst: string): string {
   const envPath = path.join(runtimeDst, 'runtime.env');
   const config = loadConfig();
   const runtimeProfiles = config.runtimeProfiles || {};
-  const defaultProvider = config.defaultProvider || config.model?.provider || 'deepseek';
-  const chatModel = runtimeProfiles.chatModel || 'deepseek-v4-flash';
+  const defaultProvider = config.defaultProvider || config.model?.provider || 'xai';
+  const chatModel = runtimeProfiles.chatModel || 'grok-4-3';
   const deepModel = runtimeProfiles.deepModel || 'deepseek-v4-pro';
-  const xaiFallbackModel = runtimeProfiles.xaiFallbackModel || 'grok-4-2-reasoning';
+  const xaiFallbackModel = runtimeProfiles.xaiFallbackModel || 'grok-4-3';
   const nimFallbackModel = runtimeProfiles.nimFallbackModel || 'qwen/qwen3.5-122b-a10b';
+  const localFallbackModel = runtimeProfiles.localFallbackModel || 'mlx-community/Qwen2.5-7B-Instruct-4bit';
+  const localFallbackBaseUrl =
+    runtimeProfiles.localFallbackBaseUrl || 'http://aria-lane-gateway.aria.svc.cluster.local:8089/v1/chat/completions';
   const localHarnessUrl = 'http://127.0.0.1:8790';
   const upstreamHarnessUrl = canonicalUpstreamHarnessUrl();
   const harnessFallbackUrls = [
@@ -141,8 +144,11 @@ function writeRuntimeEnv(runtimeDst: string): string {
       `ARIA_DEEP_MODEL=${deepModel}`,
       `ARIA_XAI_FALLBACK_MODEL=${xaiFallbackModel}`,
       `ARIA_NIM_FALLBACK_MODEL=${nimFallbackModel}`,
+      `ARIA_DEEPSEEK_FALLBACK_MODEL=${deepModel}`,
+      `ARIA_LOCAL_FALLBACK_MODEL=${localFallbackModel}`,
+      `ARIA_LOCAL_FALLBACK_BASE_URL=${localFallbackBaseUrl}`,
       'OPENAI_BASE_URL=http://127.0.0.1:4319/v1',
-      'ANTHROPIC_BASE_URL=http://127.0.0.1:4319/v1',
+      'ANTHROPIC_BASE_URL=http://127.0.0.1:4319',
       '',
     ].join('\n'),
     { mode: 0o600 },
@@ -176,16 +182,22 @@ function ensureRuntimeProviderDefaults(): void {
   const config = loadConfig();
   saveConfig({
     ...config,
-    defaultProvider: config.defaultProvider || config.model?.provider || 'deepseek',
+    defaultProvider: config.defaultProvider || config.model?.provider || 'xai',
     runtimeProfiles: {
-      chatModel: config.runtimeProfiles?.chatModel || 'deepseek-v4-flash',
+      chatModel: config.runtimeProfiles?.chatModel || 'grok-4-3',
       deepModel: config.runtimeProfiles?.deepModel || 'deepseek-v4-pro',
-      xaiFallbackModel: config.runtimeProfiles?.xaiFallbackModel || 'grok-4-2-reasoning',
+      xaiFallbackModel: config.runtimeProfiles?.xaiFallbackModel || 'grok-4-3',
       nimFallbackModel: config.runtimeProfiles?.nimFallbackModel || 'qwen/qwen3.5-122b-a10b',
       xaiApiKey: config.runtimeProfiles?.xaiApiKey || '',
+      deepseekApiKey: config.runtimeProfiles?.deepseekApiKey || '',
       nimApiKey: config.runtimeProfiles?.nimApiKey || '',
       xaiBaseUrl: config.runtimeProfiles?.xaiBaseUrl || 'https://api.x.ai/v1/chat/completions',
+      deepseekBaseUrl: config.runtimeProfiles?.deepseekBaseUrl || 'https://api.deepseek.com/v1/chat/completions',
       nimBaseUrl: config.runtimeProfiles?.nimBaseUrl || 'https://integrate.api.nvidia.com/v1/chat/completions',
+      localFallbackModel: config.runtimeProfiles?.localFallbackModel || 'mlx-community/Qwen2.5-7B-Instruct-4bit',
+      localFallbackBaseUrl:
+        config.runtimeProfiles?.localFallbackBaseUrl || 'http://aria-lane-gateway.aria.svc.cluster.local:8089/v1/chat/completions',
+      localFallbackApiKey: config.runtimeProfiles?.localFallbackApiKey || '',
     },
   });
 }

package/src/connectors/shell.ts

@@ -76,21 +76,25 @@ if [ -f "$RUNTIME_ENV" ]; then
   . "$RUNTIME_ENV"
   set +a
 fi
+ARIA_SECRETS_SH="$HOME/.aria/secrets/aria-secrets.sh"
+if [ -f "$ARIA_SECRETS_SH" ]; then
+  . "$ARIA_SECRETS_SH"
+fi
 export ARIA_RUNTIME_URL="\${ARIA_RUNTIME_URL:-http://127.0.0.1:4319}"
 export OPENAI_BASE_URL="\${OPENAI_BASE_URL:-$ARIA_RUNTIME_URL/v1}"
-export ANTHROPIC_BASE_URL="\${ANTHROPIC_BASE_URL:-$ARIA_RUNTIME_URL/v1}"
-if [ -z "\${ARIA_API_KEY:-}" ]; then
+export ANTHROPIC_BASE_URL="\${ANTHROPIC_BASE_URL:-$ARIA_RUNTIME_URL}"
+if [ -z "\${ARIA_HARNESS_TOKEN:-}" ]; then
   if [ -f "$HOME/.aria/owner-token" ]; then
-    export ARIA_API_KEY="$(tr -d '\\n' < "$HOME/.aria/owner-token")"
+    export ARIA_HARNESS_TOKEN="$(tr -d '\\n' < "$HOME/.aria/owner-token")"
   elif [ -f "$HOME/.aria/license.json" ]; then
-    export ARIA_API_KEY="$(sed -n 's/.*"harnessToken"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' "$HOME/.aria/license.json" | head -n 1)"
-    if [ -z "$ARIA_API_KEY" ]; then
-      export ARIA_API_KEY="$(sed -n 's/.*"token"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' "$HOME/.aria/license.json" | head -n 1)"
+    export ARIA_HARNESS_TOKEN="$(sed -n 's/.*"harnessToken"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' "$HOME/.aria/license.json" | head -n 1)"
+    if [ -z "$ARIA_HARNESS_TOKEN" ]; then
+      export ARIA_HARNESS_TOKEN="$(sed -n 's/.*"token"[[:space:]]*:[[:space:]]*"\\([^"]*\\)".*/\\1/p' "$HOME/.aria/license.json" | head -n 1)"
     fi
   fi
 fi
-if [ -n "\${ARIA_API_KEY:-}" ] && [ -z "\${OPENAI_API_KEY:-}" ]; then
-  export OPENAI_API_KEY="$ARIA_API_KEY"
+if [ -n "\${ARIA_HARNESS_TOKEN:-}" ] && [ -z "\${ARIA_API_KEY:-}" ]; then
+  export ARIA_API_KEY="$ARIA_HARNESS_TOKEN"
 fi
 `;
 }

package/src/harness-client.ts

@@ -1,5 +1,5 @@
-import type { AuthConfig, HarnessResponse, HarnessGateDecision } from './types.js';
-import { loadLicense } from './auth.js';
+import type { HarnessResponse, HarnessGateDecision } from './types.js';
+import { resolveHarnessToken } from './auth.js';
 import { pushCognitionLog } from './cognition-log.js';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
@@ -91,7 +91,9 @@ export class HarnessClient {
   }
 
   /**
-   * Resolve the bearer token: try loadLicense() first, fall back to env var.
+   * Resolve the bearer token through the shared survival resolver.
+   * Explicit/env tokens are persisted per client scope so later sessions do not
+   * silently lose auth when the process environment changes.
    * Cache the promise so we don't re-read the file on every call.
    */
   private async getToken(): Promise<string | null> {
@@ -103,25 +105,9 @@ export class HarnessClient {
   }
 
   private async resolveToken(): Promise<string | null> {
-    // 1. Try license file
-    try {
-      const license = await loadLicense();
-      if (license?.harnessToken) {
-        this.token = license.harnessToken;
-        return this.token;
-      }
-    } catch {
-      // file not found or parse error — fall through
-    }
-
-    // 2. Fallback to env var
-    const envToken = process.env.ARIA_HARNESS_TOKEN;
-    if (envToken) {
-      this.token = envToken;
-      return this.token;
-    }
-
-    return null;
+    const resolved = await resolveHarnessToken({ baseUrl: this.baseUrl });
+    this.token = resolved.token;
+    return this.token;
   }
 
   /**

package/src/model-context.ts

@@ -46,9 +46,14 @@ const MODEL_CONTEXT: Record<string, number> = {
   // DeepSeek
   'deepseek-v3': 64_000,
   'deepseek-chat': 64_000,
+  'deepseek-v4-pro': 128_000,
   'deepseek-r1': 128_000,
   'deepseek-coder': 128_000,
 
+  // xAI
+  'grok-4-3': 256_000,
+  'grok-4.3': 256_000,
+
   // Open / local
   'qwen2.5:7b-instruct': 32_000,
   'qwen3.5-122b-a10b': 128_000,
@@ -68,6 +73,7 @@ const PROVIDER_DEFAULT: Record<ProviderName, number> = {
   google: 1_000_000,
   deepseek: 64_000,
   openrouter: 32_000, // wide range routed through; conservative chunks safer
+  xai: 256_000,
   ollama: 32_000,    // local models vary wildly; default low
 };
 

package/src/providers/types.ts

@@ -23,7 +23,7 @@ export interface ChatResult {
   runtimeProof?: RuntimeProofSnapshot;
 }
 
-export type ProviderName = 'openai' | 'anthropic' | 'google' | 'deepseek' | 'openrouter' | 'ollama';
+export type ProviderName = 'openai' | 'anthropic' | 'google' | 'deepseek' | 'openrouter' | 'xai' | 'ollama';
 
 export type ChatFn = (
   messages: Message[],

package/src/providers/xai.ts

@@ -0,0 +1,55 @@
+import type { Message, ChatOptions, ChatResult } from './types.js';
+
+function xaiChatCompletionsUrl(): string {
+  const base = process.env.XAI_API_BASE || 'https://api.x.ai/v1/chat/completions';
+  const trimmed = base.replace(/\/+$/, '');
+  return trimmed.endsWith('/chat/completions') ? trimmed : `${trimmed}/chat/completions`;
+}
+
+function xaiApiModel(model: string): string {
+  return model === 'grok-4-3' ? 'grok-4.3' : model;
+}
+
+export async function chat(
+  messages: Message[],
+  apiKey: string,
+  model: string,
+  opts?: ChatOptions,
+): Promise<ChatResult> {
+  const token = apiKey || process.env.XAI_API_KEY || process.env.GROK_API_KEY || process.env.ARIA_XAI_KEY || '';
+  if (!token) {
+    throw new Error('xAI API key missing. Configure XAI_API_KEY, GROK_API_KEY, ARIA_XAI_KEY, or ~/.aria/config.json.');
+  }
+
+  const resp = await fetch(xaiChatCompletionsUrl(), {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: `Bearer ${token}`,
+    },
+    body: JSON.stringify({
+      model: xaiApiModel(model || 'grok-4-3'),
+      messages,
+      max_tokens: opts?.maxTokens ?? 4096,
+      stream: false,
+    }),
+    signal: opts?.signal,
+  });
+
+  if (!resp.ok) {
+    const err = await resp.text().catch(() => resp.statusText);
+    throw new Error(`xAI error ${resp.status}: ${err}`);
+  }
+
+  const data = (await resp.json()) as {
+    choices: { message: { content: string } }[];
+    usage?: { prompt_tokens: number; completion_tokens: number };
+  };
+
+  return {
+    text: data.choices[0]?.message?.content ?? '',
+    usage: data.usage
+      ? { promptTokens: data.usage.prompt_tokens, completionTokens: data.usage.completion_tokens }
+      : undefined,
+  };
+}