aria-code 0.106.0__tar.gz → 0.108.0__tar.gz

{aria_code-0.106.0/src/aria_code.egg-info → aria_code-0.108.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aria-code
-Version: 0.106.0
+Version: 0.108.0
 Summary: Open-source AI agent for coding, financial analysis and logistics operations: numbers you can check, client data kept apart, actions a person approves
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/artheras/aria-code
@@ -246,11 +246,13 @@ aria-code --local
 Or run a single task in an existing project:
 
 ```bash
-aria-code -p "Inspect this project, fix the failing tests, run them, and summarize the diff."
+aria-code -C ~/Projects/my-app -p "Inspect this project, fix the failing tests, run them, and summarize the diff."
 ```
 
 Aria may request approval before editing files or running commands, according to the configured permission mode. Review changes and test results before committing them.
 
+Google Cloud models can use Aria's local file and command tools: inference stays in the cloud while edits and tests run on your computer. Use `--read-dir DIR` for additional file-reading locations and `--add-dir DIR` for additional writable directories. Command-line directory grants last for this invocation only. See [local projects and file access](docs/local-workspace.md) for permissions and Google authentication.
+
 In a script or CI job, `--json` prints one JSON result and `--format jsonl` prints one JSON event per line as the turn runs (`turn.started`, `tool.started`, `tool.completed`, `turn.completed`). Only JSON goes to stdout, and a failed turn exits 1. With no one there to approve, pass `--allow-tools edit_file,run_command` for the tools the job may use.
 
 ```bash

{aria_code-0.106.0 → aria_code-0.108.0}/README.md

@@ -90,11 +90,13 @@ aria-code --local
 Or run a single task in an existing project:
 
 ```bash
-aria-code -p "Inspect this project, fix the failing tests, run them, and summarize the diff."
+aria-code -C ~/Projects/my-app -p "Inspect this project, fix the failing tests, run them, and summarize the diff."
 ```
 
 Aria may request approval before editing files or running commands, according to the configured permission mode. Review changes and test results before committing them.
 
+Google Cloud models can use Aria's local file and command tools: inference stays in the cloud while edits and tests run on your computer. Use `--read-dir DIR` for additional file-reading locations and `--add-dir DIR` for additional writable directories. Command-line directory grants last for this invocation only. See [local projects and file access](docs/local-workspace.md) for permissions and Google authentication.
+
 In a script or CI job, `--json` prints one JSON result and `--format jsonl` prints one JSON event per line as the turn runs (`turn.started`, `tool.started`, `tool.completed`, `turn.completed`). Only JSON goes to stdout, and a failed turn exits 1. With no one there to approve, pass `--allow-tools edit_file,run_command` for the tools the job may use.
 
 ```bash

{aria_code-0.106.0 → aria_code-0.108.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "aria-code"
-version = "0.106.0"
+version = "0.108.0"
 description = "Open-source AI agent for coding, financial analysis and logistics operations: numbers you can check, client data kept apart, actions a person approves"
 readme = "README.md"
 license = { text = "Apache-2.0" }

{aria_code-0.106.0 → aria_code-0.108.0}/src/aria_code/_version.py

@@ -17,4 +17,4 @@ from __future__ import annotations
 
 __all__ = ["__version__"]
 
-__version__ = "0.106.0"
+__version__ = "0.108.0"

{aria_code-0.106.0 → aria_code-0.108.0}/src/aria_code/apps/cli/chat_turn.py

@@ -203,6 +203,8 @@ class ChatTurnMixin:
         # 识别公司名 → ticker 并调 get_market_data，不需要硬编码字典。
         # 本地小模型（<14B）工具调用不稳定，保留确定性路由作降级。
         _curr_model_id = self.config.get("model", "")
+        from aria_code.apps.cli.workspace_route import workspace_config
+        _runtime_config = workspace_config(message, _curr_model_id, self.config, self.api_url)
         _model_has_tools = False
         if _HAS_MODEL_CAP:
             try:
@@ -213,7 +215,7 @@ class ChatTurnMixin:
         if _model_has_tools:
             try:
                 from apps.cli.providers.chat_routing import model_receives_local_tools
-                _model_has_tools = model_receives_local_tools(_curr_model_id, self.config, self.api_url)
+                _model_has_tools = model_receives_local_tools(_curr_model_id, _runtime_config, self.api_url)
             except Exception:
                 pass
 
@@ -505,9 +507,8 @@ class ChatTurnMixin:
                 print(f"{_agent_name}{' · ' + _answer_model if _answer_model else ''}")
         # A task about this folder on a model that cannot open it gets a guess
         # that reads like a result (backend_chat answered "5" for a function
-        # that returns -1). Say so before the answer, once a session; the
-        # person can still read it, and knows what it is.
-        if not _model_has_tools and not getattr(self, "_no_tools_notice_shown", False):
+        # that returns -1). Stop this task before generating a guessed result.
+        if not _model_has_tools:
             from apps.cli.workspace_route import needs_workspace, no_tools_message
             if needs_workspace(message):
                 self._no_tools_notice_shown = True
@@ -518,6 +519,7 @@ class ChatTurnMixin:
                     print_hanging(console, "  ! ", _why, style="yellow")
                 else:
                     print(f"  ! {_why}")
+                return
         # ── Single-shot turn through the shared runtime Gateway ─────────────
         # The per-round inline agent loop that used to live here was removed
         # (2026-07) after the runtime path was validated with real turns:
@@ -619,7 +621,7 @@ class ChatTurnMixin:
                 _rt_turn = await run_chat_via_runtime(
                     prompt=current_message, history=self.conversation[:-1],
                     local_tools=LOCAL_TOOLS, tool_schemas=LOCAL_TOOL_SCHEMAS,
-                    model=model, config=self.config, api_url=self.api_url,
+                    model=model, config=_runtime_config, api_url=self.api_url,
                     ollama_url=self.config.get("ollama_url", "http://localhost:11434"),
                     cancel_event=self.cancel_event,
                     on_token=on_token, on_thinking=on_thinking,
@@ -686,8 +688,11 @@ class ChatTurnMixin:
                 or str(self.config.get("local_provider") or "ollama")
             )
             result = {
-                "success": True,
+                "success": bool(getattr(_rt_turn, "ok", False)),
                 "response": _rt_text,
+                "error": getattr(_rt_turn, "error", None) or getattr(_rt_final, "error", ""),
+                "stop_reason": getattr(_rt_final, "stop_reason", "completed"),
+                "acceptance": getattr(_rt_final, "acceptance", None),
                 "provider": _rt_provider,
                 "cancelled": False,
                 "usage": {

{aria_code-0.106.0 → aria_code-0.108.0}/src/aria_code/apps/cli/headless.py

@@ -100,8 +100,9 @@ class HeadlessMixin:
         # The route counts as much as the model: on backend_chat the model gets
         # no local tools whatever it could do with them. This only looked at the
         # model, so the deterministic chain skipped its data pre-fetch there.
-        from aria_code.apps.cli.workspace_route import no_tools_message, needs_workspace, route_has_tools
-        _model_has_tools_p = route_has_tools(_curr_model_id_p, self.config, self.api_url)
+        from aria_code.apps.cli.workspace_route import no_tools_message, needs_workspace, route_has_tools, workspace_config
+        _runtime_config = workspace_config(prompt, _curr_model_id_p, self.config, self.api_url)
+        _model_has_tools_p = route_has_tools(_curr_model_id_p, _runtime_config, self.api_url)
 
         # ── Broker guide intent: broad discovery should not start an add wizard ──
         if _is_broker_guide_intent(prompt):
@@ -171,7 +172,7 @@ class HeadlessMixin:
                 _turn = await run_chat_via_runtime(
                     prompt=prompt, history=[],
                     local_tools=LOCAL_TOOLS, tool_schemas=LOCAL_TOOL_SCHEMAS,
-                    model=model, config=self.config, api_url=self.api_url,
+                    model=model, config=_runtime_config, api_url=self.api_url,
                     ollama_url=self.config.get("ollama_url", "http://localhost:11434"),
                     thinking_mode=thinking_mode, user_context=user_context,
                     auth_token=auth_token, project_context=_PROJECT_CONTEXT,
@@ -194,13 +195,11 @@ class HeadlessMixin:
                     return_result=True,
                 )
                 _tools_used = list(getattr(_turn.final, "tools", []) or [])
-                # An empty closing message after the tools already ran is not a
-                # failed turn. The model did the work and then said nothing;
-                # exiting 1 there told a script the task failed while the edit
-                # sat finished on disk. Narrow on purpose — any other error,
-                # and a turn that ran no tools at all, still fails.
+                # A missing closing message can count as success only with
+                # passing acceptance evidence, never merely because a tool ran.
                 _empty_after_work = (
                     _turn.error == "empty_response" and bool(_tools_used)
+                    and (getattr(_turn.final, "acceptance", None) or {}).get("verified") is True
                 )
                 result = {
                     "success": _turn.ok or _empty_after_work,
@@ -213,6 +212,7 @@ class HeadlessMixin:
                     "provider": getattr(_turn.final, "provider", ""),
                     "tools_used": _tools_used,
                     "acceptance": getattr(_turn.final, "acceptance", None),
+                    "stop_reason": getattr(_turn.final, "stop_reason", "") or _turn.error or "completed",
                 }
             finally:
                 if _prompt_spinner is not None:
@@ -238,6 +238,10 @@ class HeadlessMixin:
         # its checks must say so on stderr rather than print a confident summary
         # and exit 0.
         _acceptance = (result or {}).get("acceptance") or {}
+        if _acceptance.get("verified") is False:
+            result["success"] = False
+            result["error"] = result.get("error") or "checks_failed"
+            result["stop_reason"] = "checks_failed"
         if _acceptance.get("verified") is False and not quiet:
             _zh = str(self.config.get("ui_lang", "en")).lower().startswith("zh")
             print(f"⚠ {'验收未通过' if _zh else 'Checks failed'}: {_acceptance.get('headline', '')}",

{aria_code-0.106.0 → aria_code-0.108.0}/src/aria_code/apps/cli/providers/base.py

@@ -253,6 +253,7 @@ class AriaSSEProvider:
         system_override: Optional[str] = None,
         project_context: str = "",
         use_react_gateway: bool = False,
+        local_tools: bool = False,
     ) -> None:
         self.api_url = api_url
         self.model = model
@@ -262,6 +263,7 @@ class AriaSSEProvider:
         self.system_override = system_override
         self.project_context = project_context
         self.use_react_gateway = use_react_gateway
+        self.local_tools = local_tools
 
     async def stream(
         self,
@@ -296,6 +298,8 @@ class AriaSSEProvider:
                 cancel_event=cancel_event,
                 project_context=self.project_context,
                 use_react_gateway=self.use_react_gateway,
+                tool_schemas=list(tools or []) if self.local_tools else None,
+                local_tool_execution=self.local_tools,
             )
 
         async for event in _stream_callback_provider(_invoke, done_provider="aria_sse"):

{aria_code-0.106.0 → aria_code-0.108.0}/src/aria_code/apps/cli/providers/chat_routing.py

@@ -97,15 +97,9 @@ def first_round_route(model: str, config: dict, api_url: Optional[str]) -> str:
 
 
 def model_receives_local_tools(model: str, config: dict, api_url: Optional[str]) -> bool:
-    """False when the turn goes to the Arthera backend (AriaSSEProvider).
-
-    That route sends the prompt and history but no local tool schemas, so the
-    model there cannot fetch market data through Aria's tools. Treating it as
-    tool-capable skipped the local market pre-fetch as well, and a question
-    like "分析苹果股票" reached the backend with no data at all — the
-    evidence gate then refused the answer.
-    """
-    return first_round_route(model, config, api_url) != "cloud"
+    """Legacy chat has no local tools; client execution requires an opt-in
+    protocol acknowledgement. Direct inference carries the local schemas."""
+    return first_round_route(model, config, api_url) != "cloud" or bool(config.get("backend_local_tools"))
 
 
 def is_placeholder_response(

{aria_code-0.106.0 → aria_code-0.108.0}/src/aria_code/apps/cli/providers/llm/sse_stream.py

@@ -19,18 +19,21 @@ def build_chat_payload(
     user_context: Optional[dict],
     project_context: str,
     use_react_gateway: bool,
+    tool_schemas: Optional[list] = None,
+    local_tool_execution: bool = False,
 ) -> tuple[str, dict]:
     """Build either the legacy chat payload or the shared ReAct envelope.
 
     This is deliberately pure: it gives CLI, desktop, and iOS an auditable
     parity point without forcing the local-first CLI to use cloud services.
     """
+    payload: dict
     if use_react_gateway:
         context = dict(user_context or {})
         if project_context:
             context["project_context"] = project_context
         mode = str(context.pop("workspace_mode", "code"))
-        return "/api/v2/chat/react", {
+        payload = {
             "message": {
                 "role": "user",
                 "content": [{"type": "text", "text": message}],
@@ -41,8 +44,11 @@ def build_chat_payload(
             "model": {"id": model or "auto", "effort": thinking_mode or "auto"},
             "context": context,
         }
+        if local_tool_execution:
+            payload.update(tools=list(tool_schemas or []), tool_execution="client", tool_protocol="aria-local-v1")
+        return "/api/v2/chat/react", payload
 
-    payload: dict = {
+    payload = {
         "message": message,
         "conversation_history": history[-20:],
         "model": model,
@@ -53,6 +59,10 @@ def build_chat_payload(
         if project_context:
             user_context = {**user_context, "project_context": project_context}
         payload["user_context"] = user_context
+    elif project_context:
+        payload["user_context"] = {"project_context": project_context}
+    if local_tool_execution:
+        payload.update(tools=list(tool_schemas or []), tool_execution="client", tool_protocol="aria-local-v1")
     return "/api/v2/ai/chat/stream", payload
 
 
@@ -72,6 +82,8 @@ async def stream_chat(
     cancel_event: Optional[asyncio.Event] = None,
     project_context: str = "",
     use_react_gateway: bool = False,
+    tool_schemas: Optional[list] = None,
+    local_tool_execution: bool = False,
 ) -> dict:
     """Stream AI chat via SSE with cancel support and user context.
 
@@ -88,6 +100,7 @@ async def stream_chat(
         message, history, model=model, thinking_mode=thinking_mode,
         user_context=user_context, project_context=project_context,
         use_react_gateway=use_react_gateway,
+        tool_schemas=tool_schemas, local_tool_execution=local_tool_execution,
     )
     url = f"{base_url.rstrip('/')}{endpoint}"
 
@@ -117,6 +130,7 @@ async def stream_chat(
         tools_used = []
         sources = []
         tool_calls_pending = []
+        local_tools_acknowledged = False
         usage = {"prompt_tokens": 0, "completion_tokens": 0, "thinking_tokens": 0}
 
         try:
@@ -178,6 +192,17 @@ async def stream_chat(
                                 return {"success": False, "error": f"Backend: {err_msg}"}
 
                             evt = data.get("type", event_type)
+                            if local_tool_execution:
+                                local_tools_acknowledged = local_tools_acknowledged or (
+                                    data.get("tool_protocol") == "aria-local-v1"
+                                    and data.get("tool_execution") == "client"
+                                )
+                                if evt == "tool_call" and not local_tools_acknowledged:
+                                    return {"success": False, "error": "backend_local_tools_unsupported",
+                                            "response": full_response}
+                                if evt == "tool_result":
+                                    return {"success": False, "error": "backend_executed_client_tool",
+                                            "response": full_response}
 
                             if evt == "delta":
                                 token = data.get("text", data.get("content", ""))
@@ -222,6 +247,9 @@ async def stream_chat(
                             elif evt == "error":
                                 return {"success": False, "error": data.get("message", data.get("error", "Unknown error"))}
 
+            if local_tool_execution and not local_tools_acknowledged:
+                return {"success": False, "error": "backend_local_tools_unsupported",
+                        "response": full_response}
             return {
                 "success": True,
                 "response": full_response,

{aria_code-0.106.0 → aria_code-0.108.0}/src/aria_code/apps/cli/providers/runtime_bridge.py

@@ -110,22 +110,23 @@ def build_acceptance_gate(executor, config: Optional[dict] = None, message: str
 
     import os
     from aria_code.runtime.acceptance import AcceptanceGate
+    from aria_code.runtime.approval import ApprovalDecision
 
     timeout = int(cfg.get("acceptance_timeout", 300) or 300)
+    root = cfg.get("_session_workspace_root") or cfg.get("workspace_root") or os.getcwd()
+    if getattr(executor, "execution_context", None) is not None:
+        root = dict(executor.execution_context() or {}).get("_workspace") or root
 
     def _runner(command: str) -> dict:
         return executor.execute_local("run_command", {
             "command": command,
-            "policy": "balanced",
-            "permission_mode": mode,
-            "network_enabled": bool(cfg.get("network_enabled", True)),
-            "user_approved": True,
+            "cwd": str(root),
             "timeout": timeout,
-        })
+        }, approval=ApprovalDecision.allow(policy="balanced", user_approved=True))
 
     return AcceptanceGate(
         runner=_runner,
-        root=os.getcwd(),
+        root=root,
         max_attempts=int(cfg.get("acceptance_max_attempts", 2) or 2),
         commands=_declared_acceptance_commands(cfg, message),
     )
@@ -259,6 +260,7 @@ def make_provider_fn(
                     user_context=_cloud_uctx, auth_token=auth_token,
                     project_context=project_context,
                     use_react_gateway=bool(config.get("arthera_react_gateway")),
+                    local_tools=bool(config.get("backend_local_tools")),
                 ),
                 _on_token,
             )
@@ -340,6 +342,9 @@ async def run_chat_via_runtime(
     usage metadata during final rendering.
     """
     from aria_code.runtime.gateway import run_turn
+    from aria_code.apps.cli.workspace_route import workspace_config
+
+    config = workspace_config(prompt, model, config, api_url)
 
     provider_fn = make_provider_fn(
         model=model, config=config, api_url=api_url, ollama_url=ollama_url,

{aria_code-0.106.0 → aria_code-0.108.0}/src/aria_code/apps/cli/runtime_consumer.py

@@ -455,6 +455,8 @@ class TerminalRuntimeEventConsumer:
         )
         if can_live:
             now = time.time()
+            if self.live_display is not None and now - self.last_live_update < self.live_update_interval:
+                return
             md = self.markdown_cls(self.strip_latex(self.response_text))
             if self.live_display is None:
                 self.live_display = self.live_cls(
@@ -611,6 +613,12 @@ class TerminalRuntimeEventConsumer:
             else:
                 print(f"  {'✓' if passed else '✗'} {message}")
             return
+        if state in {"max_rounds", "budget_exhausted", "loop_guard", "checks_failed"}:
+            if self.has_rich and self.console is not None:
+                self.console.print(f"  [yellow]Task incomplete: {message}[/yellow]")
+            else:
+                print(f"  Task incomplete: {message}")
+            return
         if state != "fallback":
             return
         match = re.search(r"(?:from\s+)?(\w+)\s*(?:→|->|to)\s*(\w+)", message or "", re.I)

{aria_code-0.106.0 → aria_code-0.108.0}/src/aria_code/apps/cli/tools/file_tools.py

@@ -28,7 +28,7 @@ from aria_code.workspace import WorkspaceFiles  # noqa: E402
 from aria_code.workspace.files import WorkspaceSecurity
 import os
 
-def _get_workspace_files():
+def _get_workspace_files(params=None):
     """Reads for the local CLI: cwd, home, and the temp dirs.
 
     ``allow_home=False`` used to be hardcoded here to "force restrict to the
@@ -42,7 +42,7 @@ def _get_workspace_files():
     everywhere else: ARIA_RUNTIME_SCOPE=remote, which Dockerfile.review sets.
     Leaving the flag unset here honours it without disabling the local paths.
     """
-    security = WorkspaceSecurity(cwd=os.getcwd())
+    security = WorkspaceSecurity.from_tool_params(params or {})
     return WorkspaceFiles(security=security)
 
 
@@ -57,7 +57,7 @@ def tool_read_file(params: dict) -> dict:
         limit  = int(params.get("limit",  0) or 0)
         if not offset and not limit:
             limit = 160
-        result = _get_workspace_files().read_file(path, offset=offset, limit=limit)
+        result = _get_workspace_files(params).read_file(path, offset=offset, limit=limit)
         content = result.content
         if limit and result.lines >= limit and "use offset/limit to read more" not in content:
             content += "\n... [default read limit applied — use offset/limit to read more]"
@@ -75,7 +75,7 @@ def tool_list_files(params: dict) -> dict:
     path    = params.get("path", ".")
     pattern = params.get("pattern", "*")
     try:
-        data = _get_workspace_files().list_files(path, pattern)
+        data = _get_workspace_files(params).list_files(path, pattern)
         return {"success": True, "data": {
             "path":    data["path"],
             "pattern": data["pattern"],
@@ -94,7 +94,7 @@ def tool_search_code(params: dict) -> dict:
     if not pattern:
         return {"success": False, "error": "Missing 'pattern' parameter"}
     try:
-        data = _get_workspace_files().search_code(pattern, path, file_glob)
+        data = _get_workspace_files(params).search_code(pattern, path, file_glob)
         return {"success": True, "data": {
             "pattern": data["pattern"],
             "path":    data["path"],
@@ -114,13 +114,14 @@ def tool_glob(params: dict) -> dict:
     root    = (params.get("path", ".") or ".").strip()
     limit   = min(int(params.get("limit", 200)), 1000)
     try:
-        p = pathlib.Path(root).expanduser().resolve()
+        security = WorkspaceSecurity.from_tool_params(params)
+        p = security.require_safe(root)
         if not p.is_dir():
             return {"success": False, "error": f"Directory not found: {p}"}
         results = sorted(
             str(fp.relative_to(p) if fp.is_relative_to(p) else fp)
             for fp in p.glob(pattern)
-            if fp.is_file()
+            if fp.is_file() and security.is_safe_path(fp)
         )[:limit]
         return {"success": True, "data": {
             "pattern": pattern,

{aria_code-0.106.0 → aria_code-0.108.0}/src/aria_code/apps/cli/tools/system_tools.py

@@ -218,6 +218,8 @@ def tool_run_command(
                 argv if (argv and not use_shell) else command,
                 use_shell=use_shell, mode=mode, network=network, cwd=cwd,
                 setting=params.get("os_sandbox"),
+                workspace=params.get("_workspace"),
+                extra=params.get("_allowed_write_roots", ()),
             )
             result = subprocess.run(
                 confined or (argv if (argv and not use_shell) else command),
@@ -285,7 +287,8 @@ def _start_background(params, command, argv, use_shell, cwd, mode, network, *, d
 
     target = argv if (argv and not use_shell) else command
     confined = _os_sandbox.wrap(target, use_shell=use_shell, mode=mode, network=network, cwd=cwd,
-                                setting=params.get("os_sandbox"))
+                                setting=params.get("os_sandbox"), workspace=params.get("_workspace"),
+                                extra=params.get("_allowed_write_roots", ()))
     result = processes.start(confined or target, shell=use_shell and not confined, cwd=cwd,
                              label=command, wait=min(float(params.get("wait_seconds", 3) or 0), 30.0),
                              until=params.get("until"))
@@ -639,4 +642,3 @@ def tool_ask_user(params: dict, *, console=None, has_rich: bool = True) -> dict:
             return {"success": False, "error": "User cancelled the input."}
             
     return {"success": True, "data": {"user_answer": answer}}
-

{aria_code-0.106.0 → aria_code-0.108.0}/src/aria_code/apps/cli/tools/write_tools.py

@@ -118,7 +118,10 @@ def _print_lsp_diags(diags: list, console, has_rich: bool, limit: int = 6) -> No
         console.print(f"  [dim]… +{extra} more[/dim]") if has_rich else print(f"  ... +{extra} more")
 
 
-def _is_safe(p: pathlib.Path) -> bool:
+def _is_safe(p: pathlib.Path, params: dict | None = None) -> bool:
+    if params and params.get("_workspace"):
+        from aria_code.workspace.files import WorkspaceSecurity
+        return WorkspaceSecurity.from_tool_params(params).is_safe_path(p, write=True)
     return _ac()._is_safe_path(p)
 
 
@@ -458,7 +461,7 @@ def tool_write_file(params: dict) -> dict:
         if not raw_path.is_absolute():
             raw_path = _relative_write_base() / raw_path
         p = raw_path.resolve()
-        if not _is_safe(p):
+        if not _is_safe(p, params):
             return {"success": False, "error": f"Access denied: path '{p}' is outside allowed directories"}
 
         existed = p.exists()
@@ -694,7 +697,7 @@ def tool_edit_file(params: dict) -> dict:
         p = pathlib.Path(path).expanduser().resolve()
         if not p.exists():
             return {"success": False, "error": f"File not found: {p}"}
-        if not _is_safe(p):
+        if not _is_safe(p, params):
             return {"success": False, "error": f"Access denied: path '{p}' is outside allowed directories"}
 
         content = p.read_text(errors="replace")
@@ -813,7 +816,7 @@ def tool_multi_edit(params: dict) -> dict:
         p = pathlib.Path(path).expanduser().resolve()
         if not p.exists():
             return {"success": False, "error": f"File not found: {p}"}
-        if not _is_safe(p):
+        if not _is_safe(p, params):
             return {"success": False, "error": f"Access denied: path '{p}' is outside allowed directories"}
 
         content = p.read_text(errors="replace")

{aria_code-0.106.0 → aria_code-0.108.0}/src/aria_code/apps/cli/workspace_route.py

@@ -31,7 +31,8 @@ _RUN_EN = re.compile(r"\b(?:run|execute)\s+(?:`|python3?\b|pytest\b|npm\b|npx\b|
 _RUN_ZH = re.compile(r"(?:运行|执行|跑一下|跑)\s*(?:`|python|pytest|npm|node|git|make|命令|脚本|测试)", re.I)
 _IMPORT = re.compile(r"\b(?:import|from)\s+([A-Za-z_]\w*)")
 _HERE_ZH = ("这个项目", "该项目", "当前项目", "这个仓库", "当前仓库", "这个目录", "当前目录", "这个文件夹",
-            "当前文件夹", "这个代码库", "本项目", "本仓库", "失败的测试", "我的代码")
+            "当前文件夹", "这个代码库", "本项目", "本仓库", "失败的测试", "我的代码",
+            "我的项目", "本地项目", "本地文件", "电脑文件", "桌面文件", "创建项目", "新建项目")
 
 
 def needs_workspace(text: str, cwd: Path | str | None = None) -> bool:
@@ -41,13 +42,18 @@ def needs_workspace(text: str, cwd: Path | str | None = None) -> bool:
         return True
     if _HERE_EN.search(message) or any(word in message for word in _HERE_ZH):
         return True
+    if re.search(r"\b(?:create|build|scaffold|initialize)\s+(?:a\s+|an\s+|new\s+)?(?:react\s+|next\.js\s+)?(?:app|project|website)\b", message, re.I):
+        return True
     if _RUN_EN.search(message) or _RUN_ZH.search(message):
         return True
     base = Path(cwd or Path.cwd())
     for module in _IMPORT.findall(message):
         if (base / f"{module}.py").is_file() or (base / module / "__init__.py").is_file():
             return True
-    for token in _PATH_TOKEN.findall(message):
+    tokens = _PATH_TOKEN.findall(message)
+    # Chinese prose can touch an ASCII filename without whitespace (修改calc.py).
+    tokens += re.findall(r"[A-Za-z0-9_./~-]+\.[A-Za-z0-9]{1,6}\b", message)
+    for token in tokens:
         candidate = token.strip("./") if token.startswith("./") else token
         try:
             if candidate and (base / candidate).exists():
@@ -92,4 +98,24 @@ def no_tools_message(config: dict, *, lang: str = "en") -> str:
             "qwen2.5-coder), or start with aria-code --local.")
 
 
-__all__ = ["needs_workspace", "route_has_tools", "no_tools_message"]
+def workspace_config(text: str, model: str, config: dict, api_url: str | None) -> dict:
+    """Choose authenticated Google inference with local tools for workspace tasks.
+
+    Change only this turn's inference transport, never the saved config or
+    the user's model. A backend chat setting must not turn edits into guesses.
+    """
+    from aria_code.apps.cli.providers.chat_routing import force_backend, model_provider, normalize_provider_name
+    if not needs_workspace(text) or not force_backend(config, api_url):
+        return config
+    if config.get("backend_local_tools"):
+        return config
+    provider = model_provider(model) or normalize_provider_name(config.get("local_provider", ""))
+    if provider not in {"google", "vertexai", "vertex-ai", "google-genai"}:
+        return config
+    from aria_code.apps.cli.providers.base import google_readiness
+    if google_readiness(config):
+        return config
+    return {**config, "backend_chat": False, "_workspace_transport": "google"}
+
+
+__all__ = ["needs_workspace", "route_has_tools", "no_tools_message", "workspace_config"]

{aria_code-0.106.0 → aria_code-0.108.0}/src/aria_code/aria_cli.py

@@ -4963,6 +4963,11 @@ Examples:
     parser.add_argument("--banner", choices=["full", "compact", "off"], help="Banner mode: full|compact|off")
     parser.add_argument("--resume", action="store_true", help="Resume last session")
     parser.add_argument("--session", help="Load specific session ID")
+    parser.add_argument("-C", "--cd", metavar="DIR", help="Open a local project directory")
+    parser.add_argument("--add-dir", action="append", default=[], metavar="DIR",
+                        help="Allow reads and writes in an additional directory (repeatable)")
+    parser.add_argument("--read-dir", action="append", default=[], metavar="DIR",
+                        help="Allow reads in an additional directory (repeatable)")
     parser.add_argument(
         "--dangerously-skip-permissions",
         action="store_true",
@@ -4977,6 +4982,14 @@ Examples:
     parser.add_argument("args", nargs="*", help="Command arguments")
 
     args = parser.parse_args()
+    # Resolve every path relative to the invocation directory before changing it.
+    _write_roots = [str(pathlib.Path(p).expanduser().resolve()) for p in args.add_dir]
+    _read_roots = [str(pathlib.Path(p).expanduser().resolve()) for p in args.read_dir]
+    if args.cd:
+        _project_dir = pathlib.Path(args.cd).expanduser().resolve()
+        if not _project_dir.is_dir():
+            parser.error(f"Project directory does not exist: {_project_dir}")
+        os.chdir(_project_dir)
 
     # Machine-readable -p output: stdout carries only JSON. Everything else —
     # banners, tool steps, warnings, anything a tool prints — goes to stderr.
@@ -4988,6 +5001,9 @@ Examples:
         sys.stdout = sys.stderr
 
     config = load_config()
+    config["_session_workspace_root"] = str(pathlib.Path.cwd().resolve())
+    config["_session_write_roots"] = _write_roots
+    config["_session_read_roots"] = _read_roots
 
     # ── Start background update check (non-blocking, daemon thread) ──────────
     try:
@@ -5006,9 +5022,13 @@ Examples:
         raw_model = str(args.model).strip()
         if "/" in raw_model and not raw_model.startswith("http"):
             provider_name, selected_model = raw_model.split("/", 1)
-            from apps.cli.providers.chat_routing import normalize_provider_name
+            from apps.cli.providers.chat_routing import normalize_provider_name, KNOWN_MODEL_PROVIDERS
 
             provider_name = normalize_provider_name(provider_name)
+            if provider_name in KNOWN_MODEL_PROVIDERS:
+                # --model names the inference provider explicitly, just as /model
+                # does. A stale backend_chat flag must not override that choice.
+                config["backend_chat"] = False
             config["local_provider"] = provider_name
             config["model"] = selected_model
             config["local_mode"] = provider_name in {

{aria_code-0.106.0 → aria_code-0.108.0}/src/aria_code/packages/aria_services/settings.py

@@ -27,7 +27,10 @@ from typing import Any, Optional
 STALE_ARIA_MODEL_PREFIXES = ("aria-opus", "aria-prelude", "aria-sonata:3", "aria-sonata:4")
 
 # Keys that are session state, not configuration — never persisted.
-NEVER_PERSIST = frozenset({"conversation_history"})
+NEVER_PERSIST = frozenset({
+    "conversation_history", "_session_workspace_root", "_session_write_roots",
+    "_session_read_roots", "_workspace_transport",
+})
 
 
 @dataclass