@aria_asi/cli 0.2.7 → 0.2.8

package/hooks/aria-harness-via-sdk.mjs

@@ -121,30 +121,55 @@ function buildUrlList() {
   const list = [];
   const cached = loadCachedUrl();
   if (cached) list.push(cached);
+  // Explicit override takes priority — owner mode sets ARIA_SOUL_URL or
+  // ARIA_HARNESS_URL/ARIA_HARNESS_BASE_URL to a local cluster path.
   if (process.env.ARIA_SOUL_URL) list.push(process.env.ARIA_SOUL_URL.replace(/\/+$/, ''));
-  list.push('http://localhost:30080', 'http://127.0.0.1:30080');
-  list.push('http://aria-soul.aria.svc.cluster.local:8080');
-  // Direct ClusterIP from kubectl
-  try {
-    const r = spawnSync('kubectl', [
-      'get', 'svc', '-n', 'aria', 'aria-soul',
-      '-o', 'jsonpath={.spec.clusterIP}',
-    ], { encoding: 'utf8', timeout: 3_000 });
-    if (r.status === 0 && r.stdout && r.stdout !== 'None') {
-      list.push(`http://${r.stdout.trim()}:8080`);
-    }
-  } catch {}
+  if (process.env.ARIA_HARNESS_URL) list.push(process.env.ARIA_HARNESS_URL.replace(/\/+$/, ''));
+  if (process.env.ARIA_HARNESS_BASE_URL) list.push(process.env.ARIA_HARNESS_BASE_URL.replace(/\/+$/, ''));
+  // Public default — what every client install uses. Cloudflare tunnel routes
+  // to aria-soul-stateful inside the cluster. This must be FIRST in the
+  // public-facing path so client installs don't waste 1–2s timing out on
+  // localhost/127.0.0.1 before reaching anything real.
+  list.push('https://harness.ariasos.com');
   if (process.env.ARIA_PUBLIC_URL) list.push(process.env.ARIA_PUBLIC_URL.replace(/\/+$/, ''));
+  // Owner-mode fallbacks — only attempted when explicitly enabled, so client
+  // machines never burn time trying to reach Hamza's LAN. ARIA_OWNER_MODE=true
+  // is set in the dev box shell.
+  if ((process.env.ARIA_OWNER_MODE || '').toLowerCase() === 'true') {
+    list.push('http://localhost:30080', 'http://127.0.0.1:30080');
+    list.push('http://aria-soul.aria.svc.cluster.local:8080');
+    // Direct ClusterIP from kubectl — only relevant for in-cluster/owner runs.
+    try {
+      const r = spawnSync('kubectl', [
+        'get', 'svc', '-n', 'aria', 'aria-soul',
+        '-o', 'jsonpath={.spec.clusterIP}',
+      ], { encoding: 'utf8', timeout: 3_000 });
+      if (r.status === 0 && r.stdout && r.stdout !== 'None') {
+        list.push(`http://${r.stdout.trim()}:8080`);
+      }
+    } catch {}
+  }
   // Dedup preserving order
   const seen = new Set();
   return list.filter((u) => (seen.has(u) ? false : (seen.add(u), true)));
 }
 
 async function tryViaSdk(baseUrl, apiKey) {
-  // Dynamic import of the canonical SDK. The SDK is at a fixed path in the
-  // monorepo; resolve absolute so the hook works from any cwd.
-  const sdkPath = '/home/hamzaibrahim1/rei-ai-brain/harness/packages/harness-http-client/dist/index.js';
-  const { HTTPHarnessClient } = await import(sdkPath);
+  // Owner-mode dynamic import of the canonical SDK from the monorepo. Client
+  // installs do not have this path — they fall through to the raw-fetch path
+  // below (same network call, identical body shape). Prior code hard-coded the
+  // owner-only path and crashed on every client turn.
+  const ownerSdkPath = process.env.ARIA_HARNESS_SDK_PATH ||
+    '/home/hamzaibrahim1/rei-ai-brain/harness/packages/harness-http-client/dist/index.js';
+  let HTTPHarnessClient = null;
+  try {
+    ({ HTTPHarnessClient } = await import(ownerSdkPath));
+  } catch {
+    // SDK unavailable (the common case for client installs) — caller should
+    // catch this and fall through to the raw-fetch path. We surface a typed
+    // error instead of import-rejection noise so the caller can branch cleanly.
+    throw new Error('SDK_UNAVAILABLE');
+  }
   HTTPHarnessClient.resetInstance();
   const client = HTTPHarnessClient.getInstance({
     baseUrl,

package/hooks/aria-preprompt-consult.mjs

@@ -45,8 +45,18 @@ import { dirname } from 'node:path';
 const HOME = process.env.HOME || '/tmp';
 const LOG = `${HOME}/.claude/aria-preprompt-consult.log`;
 
-const HARNESS_URL = process.env.ARIA_HARNESS_URL || 'http://192.168.4.25:30080';
-const HARNESS_TOKEN = process.env.ARIA_HARNESS_TOKEN || '30b18f0a302b03ae862de8a75021238d23e47464fd5d8f6a9324240933745587';
+// Default to the public harness; client installs route to harness.ariasos.com.
+// Owner mode (Hamza dev box): set ARIA_HARNESS_URL=http://localhost:30080 in shell.
+const HARNESS_URL =
+  process.env.ARIA_HARNESS_URL ||
+  process.env.ARIA_HARNESS_BASE_URL ||
+  'https://harness.ariasos.com';
+// NEVER bake a default token. Client installs must inject their own license token
+// via ARIA_HARNESS_TOKEN (set by the connector after onboarding self-issue). If
+// absent we send no Authorization header — the server can decide whether to
+// allow anonymous preprompt consults or skip them. Prior code defaulted to the
+// master token, leaking Hamza's master credential into every npm install.
+const HARNESS_TOKEN = process.env.ARIA_HARNESS_TOKEN || '';
 const MIN_PROMPT_CHARS = 40;        // skip auto-consult on trivial prompts
 const MAX_DIRECTION_CHARS = 4000;   // cap injected chunk size
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aria_asi/cli",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "description": "Aria Smart CLI — the world's first harness-powered terminal companion",
   "bin": {
     "aria": "./bin/aria.js"