aria-code 0.126.0__tar.gz → 0.127.0__tar.gz

{aria_code-0.126.0/src/aria_code.egg-info → aria_code-0.127.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aria-code
-Version: 0.126.0
+Version: 0.127.0
 Summary: Open-source AI agent for coding, financial analysis and logistics operations: numbers you can check, client data kept apart, actions a person approves
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/artheras/aria-code
@@ -172,7 +172,7 @@ Numbers you can check, client data kept apart, actions a person approves.</p>
 <p align="center">
   <a href="https://www.npmjs.com/package/@artheras/aria-code"><img src="https://img.shields.io/npm/v/@artheras/aria-code/latest?style=flat-square&logo=npm&label=npm" alt="npm version"></a>
   <!-- Release automation pins PyPI: the default endpoint still selects legacy 4.x. -->
-  <a href="https://pypi.org/project/aria-code/0.126.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.126.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
+  <a href="https://pypi.org/project/aria-code/0.127.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.127.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
   <a href="https://github.com/artheras/aria-code/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/artheras/aria-code/ci.yml?branch=main&style=flat-square&logo=githubactions&label=CI" alt="CI status"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache%202.0-64748b?style=flat-square" alt="Apache License 2.0"></a>
 </p>
@@ -281,6 +281,7 @@ Install extras only for features you use; see [pyproject.toml](pyproject.toml) f
 | Topic | Start here |
 | --- | --- |
 | Architecture and runtime | [Architecture](docs/architecture.md) |
+| Opt-in Rust CLI prototype and migration stages | [Rust CLI migration](docs/rust-cli-migration.md) |
 | Tool permissions and data boundaries | [Safety notes](docs/aria-code-safety.md) |
 | Warehouse agents and their read-only data contract | [Warehouse ERP agents](docs/warehouse-erp-agents.md) |
 | Strategy and backtesting workflows | [Strategy workspace](docs/strategy_workspace.md) |

{aria_code-0.126.0 → aria_code-0.127.0}/README.md

@@ -15,7 +15,7 @@ Numbers you can check, client data kept apart, actions a person approves.</p>
 <p align="center">
   <a href="https://www.npmjs.com/package/@artheras/aria-code"><img src="https://img.shields.io/npm/v/@artheras/aria-code/latest?style=flat-square&logo=npm&label=npm" alt="npm version"></a>
   <!-- Release automation pins PyPI: the default endpoint still selects legacy 4.x. -->
-  <a href="https://pypi.org/project/aria-code/0.126.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.126.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
+  <a href="https://pypi.org/project/aria-code/0.127.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.127.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
   <a href="https://github.com/artheras/aria-code/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/artheras/aria-code/ci.yml?branch=main&style=flat-square&logo=githubactions&label=CI" alt="CI status"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache%202.0-64748b?style=flat-square" alt="Apache License 2.0"></a>
 </p>
@@ -124,6 +124,7 @@ Install extras only for features you use; see [pyproject.toml](pyproject.toml) f
 | Topic | Start here |
 | --- | --- |
 | Architecture and runtime | [Architecture](docs/architecture.md) |
+| Opt-in Rust CLI prototype and migration stages | [Rust CLI migration](docs/rust-cli-migration.md) |
 | Tool permissions and data boundaries | [Safety notes](docs/aria-code-safety.md) |
 | Warehouse agents and their read-only data contract | [Warehouse ERP agents](docs/warehouse-erp-agents.md) |
 | Strategy and backtesting workflows | [Strategy workspace](docs/strategy_workspace.md) |

{aria_code-0.126.0 → aria_code-0.127.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "aria-code"
-version = "0.126.0"
+version = "0.127.0"
 description = "Open-source AI agent for coding, financial analysis and logistics operations: numbers you can check, client data kept apart, actions a person approves"
 readme = "README.md"
 license = { text = "Apache-2.0" }

{aria_code-0.126.0 → aria_code-0.127.0}/src/aria_code/__init__.py

@@ -66,12 +66,20 @@ class _OneModulePerFile(_importlib_abc.MetaPathFinder, _importlib_abc.Loader):
     def __init__(self, root: str) -> None:
         self._own: dict = {}
         self.root = _os.path.normcase(root) + _os.sep
-        self.names = {
-            entry[:-3] if entry.endswith(".py") else entry
-            for entry in _os.listdir(root)
-            if entry != "__init__.py" and not entry.startswith(("_", "."))
-            and (entry.endswith(".py") or _os.path.isfile(_os.path.join(root, entry, "__init__.py")))
-        }
+        if not getattr(_sys, "frozen", False) and _os.path.isdir(root):
+            self.names = {
+                entry[:-3] if entry.endswith(".py") else entry
+                for entry in _os.listdir(root)
+                if entry != "__init__.py" and not entry.startswith(("_", "."))
+                and (entry.endswith(".py") or _os.path.isfile(_os.path.join(root, entry, "__init__.py")))
+            }
+        else:
+            # Frozen Python modules live in PYZ, not a physical source tree.
+            # PyInstaller's pkgutil hook enumerates that archive even when the
+            # package directory is absent, or contains only bundled data files.
+            from pkgutil import iter_modules
+            self.names = {module.name for module in iter_modules([root])
+                          if not module.name.startswith(("_", "."))}
 
     def find_spec(self, fullname, path=None, target=None):
         if fullname.partition(".")[0] not in self.names:

{aria_code-0.126.0 → aria_code-0.127.0}/src/aria_code/_version.py

@@ -17,4 +17,4 @@ from __future__ import annotations
 
 __all__ = ["__version__"]
 
-__version__ = "0.126.0"
+__version__ = "0.127.0"

aria_code-0.127.0/src/aria_code/apps/cli/native_bridge.py

@@ -0,0 +1,118 @@
+"""Experimental, workspace-confined JSON-RPC worker for the Rust CLI.
+
+The host selects the workspace and approves one named write via process flags.
+Request parameters never establish permissions. Existing CLI handlers retain
+their diff, change-store and verification behavior; stdout is protocol only.
+"""
+from __future__ import annotations
+
+import argparse
+import contextlib
+import json
+import sys
+from pathlib import Path
+from typing import Any
+
+MAX_MESSAGE = 1_048_576
+READ_TOOLS = frozenset({"read_file", "list_files", "search_code"})
+WRITE_TOOLS = frozenset({"write_file", "edit_file"})
+
+
+def error(code: int, message: str, request_id: Any = None) -> dict:
+    return {"jsonrpc": "2.0", "id": request_id, "error": {"code": code, "message": message}}
+
+
+def execute(name: str, arguments: dict, workspace: Path, approved_tool: str | None) -> dict:
+    from aria_code.runtime.approval import ApprovalDecision
+    from aria_code.runtime.tool_executor import ToolExecutor
+    from aria_code.runtime.tool_policy import check_tool_policy
+
+    if name not in READ_TOOLS | WRITE_TOOLS:
+        return {"success": False, "error": f"Tool not exposed by native bridge: {name}"}
+    verdict = check_tool_policy(name)
+    if verdict == "deny":
+        return {"success": False, "error": "Blocked by persistent tool policy"}
+    approved = name in WRITE_TOOLS and name == approved_tool
+    if verdict == "ask" and not approved:
+        return {"success": False, "error": "Tool requires explicit approval; use the interactive Python CLI"}
+    if name in WRITE_TOOLS and not approved:
+        return {"success": False, "error": "Writes require host --approve-write for this invocation"}
+    def handler(params: dict) -> dict:
+        # Load UI-dependent write code only after ToolExecutor grants the path.
+        if name in READ_TOOLS:
+            from aria_code.apps.cli.tools import file_tools
+            return getattr(file_tools, "tool_" + name)(params)
+        from aria_code.apps.cli.tools import write_tools
+        cli = write_tools._ac()
+        console = getattr(cli, "console", None)
+        previous = console.file if console is not None else None
+        try:
+            if console is not None:
+                console.file = sys.stderr
+            return getattr(write_tools, "tool_" + name)(params)
+        finally:
+            if console is not None:
+                console.file = previous
+    executor = ToolExecutor(
+        {name: (handler,)},
+        config={"workspace_root": str(workspace), "permission_mode": "workspace-write" if approved else "read-only"},
+        execution_context=lambda: {"_workspace_restricted": True},
+    )
+    decision = ApprovalDecision.allow(user_approved=True, tool_scope=name) if approved else None
+    return executor.execute_local(name, arguments, approval=decision)
+
+
+def dispatch(request: Any, workspace: Path, approved_tool: str | None = None) -> dict | None:
+    if not isinstance(request, dict):
+        return error(-32600, "Expected a single JSON-RPC request object")
+    request_id = request.get("id")
+    valid_id = request_id is None or isinstance(request_id, str) or type(request_id) is int
+    if request.get("jsonrpc") != "2.0" or not isinstance(request.get("method"), str) or not valid_id:
+        return error(-32600, "Invalid JSON-RPC request")
+    # This bridge only executes requests with an ID. Notifications never cause
+    # file changes and never produce a response, including unknown methods.
+    if "id" not in request:
+        return None
+    if request["method"] != "tools.call":
+        return error(-32601, "Method not found", request_id)
+    params = request.get("params")
+    if not isinstance(params, dict) or not isinstance(params.get("name"), str) or not isinstance(params.get("arguments"), dict):
+        return error(-32602, "Expected name and arguments object", request_id)
+    try:
+        with contextlib.redirect_stdout(sys.stderr):
+            result = execute(params["name"], params["arguments"], workspace, approved_tool)
+        return {"jsonrpc": "2.0", "id": request_id, "result": result}
+    except Exception as exc:
+        return error(-32603, f"Python tool failed: {exc}", request_id)
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--workspace", type=Path, required=True)
+    parser.add_argument("--approve-tool", choices=sorted(WRITE_TOOLS))
+    args = parser.parse_args()
+    workspace = args.workspace.expanduser().resolve(strict=True)
+    if not workspace.is_dir():
+        parser.error("workspace must be a directory")
+    # One request per process bounds trace memory and approval lifetime. Read
+    # size is bounded before JSON decoding; no unbounded readline allocation.
+    raw = sys.stdin.buffer.readline(MAX_MESSAGE + 1)
+    if len(raw) > MAX_MESSAGE:
+        response = error(-32600, "Request exceeds 1 MiB")
+    else:
+        try:
+            request = json.loads(raw)
+        except (ValueError, UnicodeDecodeError):
+            response = error(-32700, "Parse error")
+        else:
+            response = dispatch(request, workspace, args.approve_tool)
+    if response is not None:
+        encoded = json.dumps(response, ensure_ascii=True, allow_nan=False).encode("ascii")
+        if len(encoded) + 1 > MAX_MESSAGE:
+            encoded = json.dumps(error(-32603, "Response exceeds 1 MiB", response["id"])).encode("ascii")
+        sys.stdout.buffer.write(encoded + b"\n")
+        sys.stdout.buffer.flush()
+
+
+if __name__ == "__main__":
+    main()

{aria_code-0.126.0 → aria_code-0.127.0}/src/aria_code/apps/cli/tools/write_tools.py

@@ -302,7 +302,7 @@ def _write_policy_confirm(p: pathlib.Path, content: str, existed: bool) -> tuple
     if has_rich and console:
         console.print()
         if existed:
-            old_content = p.read_text(errors="replace")
+            old_content = p.read_text(encoding="utf-8", errors="replace")
             diff = list(difflib.unified_diff(
                 old_content.splitlines(keepends=True),
                 content.splitlines(keepends=True),
@@ -723,7 +723,7 @@ def tool_edit_file(params: dict) -> dict:
         if not _is_safe(p, params):
             return {"success": False, "error": f"Access denied: path '{p}' is outside allowed directories"}
 
-        content = p.read_text(errors="replace")
+        content = p.read_text(encoding="utf-8", errors="replace")
         before_mode = _stat.S_IMODE(p.stat().st_mode)
         if content.count(old_str) == 0:
             preview = "\n".join(content.splitlines()[:10])
@@ -845,7 +845,7 @@ def tool_multi_edit(params: dict) -> dict:
         if not _is_safe(p, params):
             return {"success": False, "error": f"Access denied: path '{p}' is outside allowed directories"}
 
-        content = p.read_text(errors="replace")
+        content = p.read_text(encoding="utf-8", errors="replace")
         before_mode = _stat.S_IMODE(p.stat().st_mode)
         working = content
         applied_count = 0

{aria_code-0.126.0 → aria_code-0.127.0}/src/aria_code/workspace/files.py

@@ -147,7 +147,7 @@ class WorkspaceFiles:
                 f"File too large: {size:,} bytes (max 2 MB). "
                 "Use offset/limit parameters to read sections."
             )
-        text = target.read_text(errors="replace")
+        text = target.read_text(encoding="utf-8", errors="replace")
         lines = text.splitlines()
         total_lines = len(lines)
         if not offset and not limit and size > self.LARGE_FILE_BYTES:
@@ -202,7 +202,7 @@ class WorkspaceFiles:
             if not safe_file.is_file() or safe_file.stat().st_size > self.MAX_SEARCH_BYTES:
                 continue
             try:
-                lines = safe_file.read_text(errors="replace").splitlines()
+                lines = safe_file.read_text(encoding="utf-8", errors="replace").splitlines()
             except Exception:
                 continue
             for line_number, line in enumerate(lines, 1):

{aria_code-0.126.0 → aria_code-0.127.0/src/aria_code.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aria-code
-Version: 0.126.0
+Version: 0.127.0
 Summary: Open-source AI agent for coding, financial analysis and logistics operations: numbers you can check, client data kept apart, actions a person approves
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/artheras/aria-code
@@ -172,7 +172,7 @@ Numbers you can check, client data kept apart, actions a person approves.</p>
 <p align="center">
   <a href="https://www.npmjs.com/package/@artheras/aria-code"><img src="https://img.shields.io/npm/v/@artheras/aria-code/latest?style=flat-square&logo=npm&label=npm" alt="npm version"></a>
   <!-- Release automation pins PyPI: the default endpoint still selects legacy 4.x. -->
-  <a href="https://pypi.org/project/aria-code/0.126.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.126.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
+  <a href="https://pypi.org/project/aria-code/0.127.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.127.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
   <a href="https://github.com/artheras/aria-code/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/artheras/aria-code/ci.yml?branch=main&style=flat-square&logo=githubactions&label=CI" alt="CI status"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache%202.0-64748b?style=flat-square" alt="Apache License 2.0"></a>
 </p>
@@ -281,6 +281,7 @@ Install extras only for features you use; see [pyproject.toml](pyproject.toml) f
 | Topic | Start here |
 | --- | --- |
 | Architecture and runtime | [Architecture](docs/architecture.md) |
+| Opt-in Rust CLI prototype and migration stages | [Rust CLI migration](docs/rust-cli-migration.md) |
 | Tool permissions and data boundaries | [Safety notes](docs/aria-code-safety.md) |
 | Warehouse agents and their read-only data contract | [Warehouse ERP agents](docs/warehouse-erp-agents.md) |
 | Strategy and backtesting workflows | [Strategy workspace](docs/strategy_workspace.md) |

{aria_code-0.126.0 → aria_code-0.127.0}/src/aria_code.egg-info/SOURCES.txt

@@ -187,6 +187,7 @@ src/aria_code/apps/cli/mixin_binding.py
 src/aria_code/apps/cli/model_catalog.py
 src/aria_code/apps/cli/model_probe.py
 src/aria_code/apps/cli/model_retirement.py
+src/aria_code/apps/cli/native_bridge.py
 src/aria_code/apps/cli/pdf_report.py
 src/aria_code/apps/cli/plan_mode.py
 src/aria_code/apps/cli/plotly_html.py
@@ -636,6 +637,7 @@ tests/test_first_run_output.py
 tests/test_first_run_works.py
 tests/test_football_agent.py
 tests/test_football_prediction_output.py
+tests/test_frozen_module_aliases.py
 tests/test_gemini_retirement.py
 tests/test_google_cloud_models.py
 tests/test_google_cloud_routing.py
@@ -679,6 +681,7 @@ tests/test_model_probe.py
 tests/test_model_selection_state.py
 tests/test_narrow_chinese_output.py
 tests/test_native_binary_entrypoints.py
+tests/test_native_bridge.py
 tests/test_native_installer.py
 tests/test_natural_language_routing.py
 tests/test_new_modules.py
@@ -768,6 +771,7 @@ tests/test_runtime_run_store.py
 tests/test_runtime_tool_executor.py
 tests/test_runtime_worktrees.py
 tests/test_runway_video_client.py
+tests/test_rust_cli.py
 tests/test_safety_permissions.py
 tests/test_safety_service.py
 tests/test_safety_service_adoption.py

{aria_code-0.126.0 → aria_code-0.127.0}/tests/test_edit_and_command_safety.py

@@ -65,6 +65,27 @@ def test_replace_all_changes_every_match(workspace):
     assert "return None" not in workspace.read_text()
 
 
+def test_single_and_multi_edit_preserve_utf8_under_legacy_locale(workspace, monkeypatch):
+    from aria_code.apps.cli.tools.write_tools import tool_multi_edit
+
+    source = "# 中文注释\nvalue = '你好'\n"
+    workspace.write_text(source, encoding="utf-8")
+    original = pathlib.Path.read_text
+
+    def legacy_default(path, *args, **kwargs):
+        if path == workspace:
+            kwargs.setdefault("encoding", "cp1252")
+        return original(path, *args, **kwargs)
+
+    monkeypatch.setattr(pathlib.Path, "read_text", legacy_default)
+    result = edit({"path": str(workspace), "old_string": "你好", "new_string": "世界"})
+    assert result["success"], result
+    assert workspace.read_text(encoding="utf-8") == source.replace("你好", "世界")
+    result = tool_multi_edit({"path": str(workspace), "edits": [{"old_string": "世界", "new_string": "再见"}]})
+    assert result["success"], result
+    assert workspace.read_text(encoding="utf-8") == source.replace("你好", "再见")
+
+
 def test_the_schema_offers_replace_all():
     from aria_code.apps.cli.local_tool_schemas import build_local_tool_schemas
 

aria_code-0.127.0/tests/test_frozen_module_aliases.py

@@ -0,0 +1,56 @@
+"""Run the package alias finder inside a real PYZ archive, without source files."""
+import importlib.util
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+
+import pytest
+
+
+@pytest.mark.skipif(importlib.util.find_spec("PyInstaller") is None, reason="requires the native packaging test environment")
+@pytest.mark.timeout(120)
+def test_frozen_aliases_work_without_a_physical_package_directory(tmp_path):
+    root = Path(__file__).resolve().parents[1]
+    source = tmp_path / "src"
+    package = source / "aria_code"
+    nested = package / "compat_pkg"
+    nested.mkdir(parents=True)
+    (package / "__init__.py").write_text((root / "src/aria_code/__init__.py").read_text(encoding="utf-8"), encoding="utf-8")
+    (package / "helper.py").write_text("sentinel = object()\n", encoding="utf-8")
+    (nested / "__init__.py").write_text("", encoding="utf-8")
+    (nested / "state.py").write_text("items = []\n", encoding="utf-8")
+    entry = tmp_path / "smoke.py"
+    entry.write_text("""
+import json
+from pathlib import Path
+import aria_code
+import helper
+import aria_code.helper
+import compat_pkg.state
+import aria_code.compat_pkg.state
+assert helper is aria_code.helper
+assert compat_pkg.state is aria_code.compat_pkg.state
+compat_pkg.state.items.append('shared')
+assert aria_code.compat_pkg.state.items == ['shared']
+root = Path(aria_code.__file__).parent
+print(json.dumps({'root': str(root), 'root_exists': root.is_dir(), 'aliases_shared': True}))
+""", encoding="utf-8")
+    env = {**os.environ, "PYTHONPATH": str(source)}
+    build = subprocess.run([sys.executable, "-m", "PyInstaller", "--clean", "--noconfirm", "--onedir",
+                            "--name", "alias-smoke", "--distpath", str(tmp_path / "dist"),
+                            "--workpath", str(tmp_path / "build"), "--specpath", str(tmp_path),
+                            "--paths", str(source), "--hidden-import", "aria_code.helper",
+                            "--hidden-import", "aria_code.compat_pkg.state", str(entry)],
+                           cwd=tmp_path, env=env, capture_output=True, timeout=90)
+    assert build.returncode == 0, build.stderr.decode(errors="replace")[-5000:]
+    binary = tmp_path / "dist" / "alias-smoke" / ("alias-smoke.exe" if os.name == "nt" else "alias-smoke")
+    for physical_directory in (False, True):
+        run = subprocess.run([str(binary)], cwd=tmp_path, capture_output=True, timeout=10)
+        assert run.returncode == 0, run.stderr.decode(errors="replace")
+        result = json.loads(run.stdout)
+        assert result["aliases_shared"]
+        assert result["root_exists"] is physical_directory
+        Path(result["root"]).mkdir(exist_ok=True)
+

aria_code-0.127.0/tests/test_native_bridge.py

@@ -0,0 +1,99 @@
+"""Contract and authority regressions for the opt-in Rust/Python boundary."""
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+
+import pytest
+
+from aria_code.apps.cli.native_bridge import MAX_MESSAGE, dispatch
+
+
+@pytest.fixture(autouse=True)
+def isolated_state(tmp_path, monkeypatch):
+    monkeypatch.setenv("ARIA_HOME", str(tmp_path / "state"))
+    monkeypatch.setenv("ARIA_USER_OUTPUT_ROOT", str(tmp_path / "outputs"))
+
+
+def request(name="read_file", **arguments):
+    return {"jsonrpc": "2.0", "id": "request-你好", "method": "tools.call",
+            "params": {"name": name, "arguments": arguments}}
+
+
+def test_protocol_errors_and_notifications(tmp_path):
+    for invalid in (None, [], {"jsonrpc": "1.0", "method": "tools.call"},
+                    {"jsonrpc": "2.0", "id": True, "method": "tools.call"}):
+        assert dispatch(invalid, tmp_path)["error"]["code"] == -32600
+    assert dispatch({"jsonrpc": "2.0", "id": 1, "method": "unknown"}, tmp_path)["error"]["code"] == -32601
+    assert dispatch({"jsonrpc": "2.0", "id": None, "method": "tools.call", "params": []}, tmp_path)["error"]["code"] == -32602
+    note = request("write_file", path="note.txt", content="a notification cannot write this")
+    del note["id"]
+    assert dispatch(note, tmp_path, "write_file") is None
+    assert not (tmp_path / "note.txt").exists()
+
+
+def test_reads_use_existing_handler_and_preserve_id(tmp_path):
+    cli_loaded_before = "aria_code.aria_cli" in sys.modules
+    (tmp_path / "你好.txt").write_text("hello 你好\n", encoding="utf-8")
+    result = dispatch(request(path="你好.txt"), tmp_path)
+    assert result["id"] == "request-你好"
+    assert result["result"]["success"]
+    assert "hello 你好" in result["result"]["data"]["content"]
+    assert cli_loaded_before or "aria_code.aria_cli" not in sys.modules
+
+
+def test_request_cannot_expand_workspace_or_grant_approval(tmp_path):
+    workspace = tmp_path / "project"
+    workspace.mkdir()
+    outside = tmp_path / "private.txt"
+    outside.write_text("private")
+    arguments = {"path": "../private.txt", "_workspace": str(tmp_path),
+                 "_allowed_read_roots": [str(tmp_path)], "_permission_mode": "full-access"}
+    result = dispatch(request(**arguments), workspace)
+    assert not result["result"]["success"]
+    assert "private" not in result["result"].get("data", {}).get("content", "")
+    forged = dispatch(request("write_file", path="new.txt", content="a complete text file to write",
+                              _skip_confirm=True, approved=True), workspace)
+    assert not forged["result"]["success"]
+    assert not (workspace / "new.txt").exists()
+
+
+def test_symlinks_cannot_escape_workspace(tmp_path):
+    workspace = tmp_path / "project"
+    workspace.mkdir()
+    outside = tmp_path / "outside.txt"
+    outside.write_text("secret")
+    try:
+        (workspace / "link.txt").symlink_to(outside)
+    except OSError:
+        pytest.skip("symlink privilege unavailable")
+    result = dispatch(request(path="link.txt"), workspace)
+    assert not result["result"]["success"]
+
+
+def test_persistent_deny_wins_over_host_approval(tmp_path):
+    state = Path(os.environ["ARIA_HOME"])
+    state.mkdir()
+    (state / "tool_policy.json").write_text(json.dumps({"denied": ["write_file", "read_file"]}))
+    assert not dispatch(request(path="README.md"), tmp_path)["result"]["success"]
+    result = dispatch(request("write_file", path="new.txt", content="a complete text file to write"), tmp_path, "write_file")
+    assert not result["result"]["success"]
+    assert not (tmp_path / "new.txt").exists()
+
+
+def test_ask_always_does_not_execute_without_host_approval(tmp_path):
+    state = Path(os.environ["ARIA_HOME"])
+    state.mkdir()
+    (state / "tool_policy.json").write_text(json.dumps({"ask_always": ["read_file"]}))
+    result = dispatch(request(path="README.md"), tmp_path)
+    assert not result["result"]["success"]
+    assert "approval" in result["result"]["error"]
+
+
+@pytest.mark.parametrize("raw,code", [(b"{bad\n", -32700), (b"x" * (MAX_MESSAGE + 1), -32600)], ids=["malformed", "oversized"])
+def test_worker_bounds_input_and_stdout_is_protocol(tmp_path, raw, code):
+    proc = subprocess.run([sys.executable, "-m", "aria_code.apps.cli.native_bridge", "--workspace", str(tmp_path)],
+                          input=raw, capture_output=True, timeout=10)
+    assert proc.returncode == 0, proc.stderr
+    assert json.loads(proc.stdout)["error"]["code"] == code