aria-code 0.133.0__tar.gz → 0.134.0__tar.gz

{aria_code-0.133.0/src/aria_code.egg-info → aria_code-0.134.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aria-code
-Version: 0.133.0
+Version: 0.134.0
 Summary: Open-source AI agent for coding, financial analysis and logistics operations: numbers you can check, client data kept apart, actions a person approves
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/artheras/aria-code
@@ -172,7 +172,7 @@ Numbers you can check, client data kept apart, actions a person approves.</p>
 <p align="center">
   <a href="https://www.npmjs.com/package/@artheras/aria-code"><img src="https://img.shields.io/npm/v/@artheras/aria-code/latest?style=flat-square&logo=npm&label=npm" alt="npm version"></a>
   <!-- Release automation pins PyPI: the default endpoint still selects legacy 4.x. -->
-  <a href="https://pypi.org/project/aria-code/0.133.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.133.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
+  <a href="https://pypi.org/project/aria-code/0.134.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.134.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
   <a href="https://github.com/artheras/aria-code/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/artheras/aria-code/ci.yml?branch=main&style=flat-square&logo=githubactions&label=CI" alt="CI status"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache%202.0-64748b?style=flat-square" alt="Apache License 2.0"></a>
 </p>

{aria_code-0.133.0 → aria_code-0.134.0}/README.md

@@ -15,7 +15,7 @@ Numbers you can check, client data kept apart, actions a person approves.</p>
 <p align="center">
   <a href="https://www.npmjs.com/package/@artheras/aria-code"><img src="https://img.shields.io/npm/v/@artheras/aria-code/latest?style=flat-square&logo=npm&label=npm" alt="npm version"></a>
   <!-- Release automation pins PyPI: the default endpoint still selects legacy 4.x. -->
-  <a href="https://pypi.org/project/aria-code/0.133.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.133.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
+  <a href="https://pypi.org/project/aria-code/0.134.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.134.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
   <a href="https://github.com/artheras/aria-code/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/artheras/aria-code/ci.yml?branch=main&style=flat-square&logo=githubactions&label=CI" alt="CI status"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache%202.0-64748b?style=flat-square" alt="Apache License 2.0"></a>
 </p>

{aria_code-0.133.0 → aria_code-0.134.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "aria-code"
-version = "0.133.0"
+version = "0.134.0"
 description = "Open-source AI agent for coding, financial analysis and logistics operations: numbers you can check, client data kept apart, actions a person approves"
 readme = "README.md"
 license = { text = "Apache-2.0" }

{aria_code-0.133.0 → aria_code-0.134.0}/src/aria_code/_version.py

@@ -17,4 +17,4 @@ from __future__ import annotations
 
 __all__ = ["__version__"]
 
-__version__ = "0.133.0"
+__version__ = "0.134.0"

{aria_code-0.133.0 → aria_code-0.134.0}/src/aria_code/apps/cli/exec_events.py

@@ -98,6 +98,21 @@ class ExecEvents:
 
     def __init__(self, out: TextIO | None):
         self.out = out
+        # Preserve the established JSONL contract unless a streaming consumer
+        # opts in. Never emit provider reasoning; only visible answer tokens.
+        import os
+        self.streaming = out is not None and os.environ.get("ARIA_EVENTS_STREAM", "").strip().lower() in (
+            "1", "true", "yes",
+        )
+
+    def text_delta(self, text: str) -> None:
+        if self.streaming and text:
+            self.emit("answer.delta", text=text)
+
+    def status(self, state: str, message: str) -> None:
+        if self.streaming:
+            self.emit("turn.status", state=_redact_activity_text(state, limit=80),
+                      message=_redact_activity_text(message, limit=PARAM_CHARS))
 
     def emit(self, event_type: str, **fields: Any) -> None:
         if self.out is None:

{aria_code-0.133.0 → aria_code-0.134.0}/src/aria_code/apps/cli/headless.py

@@ -11,7 +11,7 @@ on whichever module loaded last.
 
 from __future__ import annotations
 
-def _headless_approval(config: dict, auto_approve, always_allow):
+def _headless_approval(config: dict, auto_approve, always_allow, *, on_denied=None):
     """Answer approvals with what the operator granted up front, and nothing more.
 
     ``auto_approve`` and ``always_allow`` are read at call time from the module
@@ -23,8 +23,10 @@ def _headless_approval(config: dict, auto_approve, always_allow):
 
     def decide(tool_name: str, params: dict):
         if not (auto_approve() or tool_name in (always_allow() or ())):
-            return ApprovalDecision.deny("no one is here to approve it; pass --allow-tools or "
-                                         "--dangerously-skip-permissions")
+            reason = "no one is here to approve it; pass --allow-tools or --dangerously-skip-permissions"
+            if on_denied is not None:
+                on_denied(tool_name, reason)
+            return ApprovalDecision.deny(reason)
         if tool_name == "run_command":
             return ApprovalDecision.allow(policy=config.get("command_policy", "safe"), user_approved=True)
         return ApprovalDecision.allow()
@@ -188,10 +190,13 @@ class HeadlessMixin:
                     # stays, and the pre-approval answers it the way the REPL would.
                     confirm_tools=frozenset(_CONFIRM_TOOLS),
                     approval_callback=_headless_approval(
-                        self.config, lambda: _auto_approve_session, lambda: _session_always_allow),
+                        self.config, lambda: _auto_approve_session, lambda: _session_always_allow,
+                        on_denied=lambda tool, reason: events.status("approval_denied", f"{tool}: {reason}")),
                     approval_applier=_apply_approval_decision,
                     on_tool_call=events.tool_started,
                     on_tool_result=events.tool_completed,
+                    on_token=events.text_delta if events.streaming else None,
+                    on_status=events.status if events.streaming else None,
                     return_result=True,
                 )
                 _tools_used = list(getattr(_turn.final, "tools", []) or [])

{aria_code-0.133.0 → aria_code-0.134.0/src/aria_code.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aria-code
-Version: 0.133.0
+Version: 0.134.0
 Summary: Open-source AI agent for coding, financial analysis and logistics operations: numbers you can check, client data kept apart, actions a person approves
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/artheras/aria-code
@@ -172,7 +172,7 @@ Numbers you can check, client data kept apart, actions a person approves.</p>
 <p align="center">
   <a href="https://www.npmjs.com/package/@artheras/aria-code"><img src="https://img.shields.io/npm/v/@artheras/aria-code/latest?style=flat-square&logo=npm&label=npm" alt="npm version"></a>
   <!-- Release automation pins PyPI: the default endpoint still selects legacy 4.x. -->
-  <a href="https://pypi.org/project/aria-code/0.133.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.133.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
+  <a href="https://pypi.org/project/aria-code/0.134.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.134.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
   <a href="https://github.com/artheras/aria-code/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/artheras/aria-code/ci.yml?branch=main&style=flat-square&logo=githubactions&label=CI" alt="CI status"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache%202.0-64748b?style=flat-square" alt="Apache License 2.0"></a>
 </p>

{aria_code-0.133.0 → aria_code-0.134.0}/src/aria_code.egg-info/SOURCES.txt

@@ -777,6 +777,7 @@ tests/test_runtime_worktrees.py
 tests/test_runway_video_client.py
 tests/test_rust_cli.py
 tests/test_rust_state.py
+tests/test_rust_stream.py
 tests/test_safety_permissions.py
 tests/test_safety_service.py
 tests/test_safety_service_adoption.py

{aria_code-0.133.0 → aria_code-0.134.0}/tests/test_exec_events.py

@@ -43,7 +43,61 @@ def test_a_file_body_is_reported_by_size():
 
 def test_no_stream_writes_nothing_and_odd_values_still_serialise():
     ExecEvents(None).emit("turn.started", prompt="x")
-    assert json_safe({"p": Path("/a"), "s": {1}}) == {"p": "/a", "s": "{1}"}
+    path = Path("/a")
+    assert json_safe({"p": path, "s": {1}}) == {"p": str(path), "s": "{1}"}
+
+
+def test_visible_answer_streaming_is_opt_in_and_status_is_redacted(monkeypatch):
+    monkeypatch.delenv("ARIA_EVENTS_STREAM", raising=False)
+    out = io.StringIO()
+    old = ExecEvents(out)
+    old.text_delta("invisible until completion")
+    old.status("thinking", "status")
+    assert not old.streaming and out.getvalue() == ""
+    monkeypatch.setenv("ARIA_EVENTS_STREAM", "1")
+    events = ExecEvents(out)
+    assert events.streaming and not ExecEvents(None).streaming
+    events.text_delta("你好\n```python\nprint(1)\n```\n")
+    events.status("working", "Authorization: Bearer abc123def456")
+    records = [json.loads(line) for line in out.getvalue().splitlines()]
+    assert records[0]["type"] == "answer.delta" and records[0]["text"].startswith("你好\n```")
+    assert records[1]["type"] == "turn.status" and "abc123def456" not in records[1]["message"]
+
+
+@pytest.mark.asyncio
+async def test_headless_runtime_streams_visible_text_and_retains_approval(monkeypatch):
+    from aria_code.aria_cli import ArtheraTerminal
+    from aria_code.apps.cli.providers import runtime_bridge
+
+    monkeypatch.setenv("ARIA_EVENTS_STREAM", "1")
+    terminal = ArtheraTerminal.__new__(ArtheraTerminal)
+    terminal.config = {"model": "google/gemini-3.5-flash", "permission_mode": "read-only"}
+    terminal.api_url = None
+    terminal.commands = SimpleNamespace(is_command=lambda _: False)
+    terminal._maybe_show_intent_preflight = lambda *a, **k: False
+    async def no_intercept(_):
+        return False
+    terminal._try_football_nl_intercept = no_intercept
+    namespace = terminal._run_prompt_turn.__func__.__globals__
+    monkeypatch.setitem(namespace, "_run_deterministic_chain", lambda *a, **k: {"success": False})
+    monkeypatch.setitem(namespace, "HAS_RICH", False)
+    monkeypatch.setitem(namespace, "_auto_approve_session", False)
+    monkeypatch.setitem(namespace, "_session_always_allow", set())
+    async def turn(**kwargs):
+        assert not kwargs["approval_callback"]("write_file", {"path": "a.py"}).approved
+        assert kwargs.get("on_thinking") is None
+        kwargs["on_token"]("你好")
+        kwargs["on_status"]("working", "Reading a project")
+        kwargs["on_token"]("世界")
+        return SimpleNamespace(ok=True, text="你好世界", error="", final=SimpleNamespace(provider="fake"))
+    monkeypatch.setattr(runtime_bridge, "run_chat_via_runtime", turn)
+    out = io.StringIO()
+    events = ExecEvents(out)
+    result = await terminal._run_prompt_turn("hello", quiet=True, events=events)
+    assert result["success"] and result["response"] == "你好世界"
+    records = [json.loads(line) for line in out.getvalue().splitlines()]
+    assert [e["type"] for e in records] == ["turn.status", "answer.delta", "turn.status", "answer.delta"]
+    assert records[0]["state"] == "approval_denied" and "write_file" in records[0]["message"]
 
 
 class _Terminal:

{aria_code-0.133.0 → aria_code-0.134.0}/tests/test_headless_command_approval.py

@@ -10,7 +10,9 @@ total) or stopped (no output file).
 from __future__ import annotations
 
 import inspect
+import os
 import shlex
+import subprocess
 import sys
 
 from aria_code.apps.cli.headless import _apply_approval_decision, _headless_approval
@@ -40,7 +42,9 @@ def test_an_approved_script_runs_under_the_safe_policy(tmp_path, monkeypatch):
 
     monkeypatch.setenv("ARIA_ARTIFACT_ROOT", str(tmp_path / "artifacts"))
     (tmp_path / "calc.py").write_text("print(2 + 3)\n")
-    params = {"command": f"{shlex.quote(sys.executable)} calc.py", "policy": "safe", "cwd": str(tmp_path),
+    argv = [sys.executable, "calc.py"]
+    command = subprocess.list2cmdline(argv) if os.name == "nt" else shlex.join(argv)
+    params = {"command": command, "policy": "safe", "cwd": str(tmp_path),
               "permission_mode": "workspace-write", "network_enabled": False}
     blocked = tool_run_command(dict(params), has_rich=False)
     assert not blocked["success"] and "blocked by policy" in blocked["error"]

aria_code-0.134.0/tests/test_rust_stream.py

@@ -0,0 +1,284 @@
+"""Real Rust executable: streaming, protocol failures and process cleanup."""
+import json
+import os
+from pathlib import Path
+import signal
+import subprocess
+import sys
+import time
+
+import pytest
+
+pytestmark = pytest.mark.skipif(not os.environ.get("ARIA_NATIVE_BINARY"), reason="build the Rust prototype first")
+
+
+def record(kind, **fields):
+    return {"type": kind, **fields}
+
+
+START = record("turn.started", prompt="hello", model="google/test")
+
+
+def end(text="done", success=True, **fields):
+    return record("turn.completed", response=text, success=success, **fields)
+
+
+def lines(*events):
+    return "".join(json.dumps(e, ensure_ascii=False) + "\n" for e in events).encode()
+
+
+@pytest.fixture
+def native(tmp_path):
+    env = dict(os.environ, ARIA_HOME=str(tmp_path / "state"), ARIA_USER_OUTPUT_ROOT=str(tmp_path / "outputs"))
+    binary = os.environ["ARIA_NATIVE_BINARY"]
+
+    def call(*args, **kwargs):
+        return subprocess.run([binary, "--python", sys.executable, "-C", str(tmp_path), *args],
+                              env=env, capture_output=True, timeout=10, **kwargs)
+    return binary, env, call
+
+
+def fake_runtime(tmp_path, env, body):
+    root = tmp_path / "fake"
+    package = root / "aria_code" / "apps" / "cli"
+    package.mkdir(parents=True)
+    for p in (root / "aria_code", root / "aria_code" / "apps", package):
+        (p / "__init__.py").write_text("")
+    code = "import json,os,sys,time,subprocess\nfrom pathlib import Path\n"
+    code += "def emit(event):\n    print(json.dumps(event, ensure_ascii=False), flush=True)\n"
+    code += "def main():\n" + "\n".join("    " + l for l in body.splitlines()) + "\n"
+    (package / "main.py").write_text(code, encoding="utf-8")
+    env["PYTHONPATH"] = str(root)
+
+
+def test_replay_needs_no_python_and_preserves_code_and_unicode(native):
+    binary, env, _ = native
+    response = "你好\n```rust\nfn main() {}\n```\n"
+    result = subprocess.run([binary, "--python", "missing-python", "render"],
+                            input=lines(START, record("answer.delta", text=response), end(response)),
+                            env=env, capture_output=True, timeout=3)
+    assert result.returncode == 0 and result.stdout.decode() == response
+    assert b"[Aria]" in result.stderr
+
+
+def test_machine_replay_preserves_extra_fields_and_failed_turn_exit(native):
+    _, _, call = native
+    events = [START, record("tool.started", tool="edit_file", params={"path": "你好.py"}),
+              record("tool.completed", tool="edit_file", success=False, error="permission_denied"),
+              end("", False, error="checks_failed", acceptance={"verified": False})]
+    result = call("render", "--jsonl", input=lines(*events))
+    assert result.returncode == 1
+    assert [json.loads(l) for l in result.stdout.splitlines()] == events
+    assert not result.stderr
+
+
+def test_exec_preserves_literal_args_workspace_and_relative_state(native, tmp_path):
+    binary, env, _ = native
+    literal = "你好; $(touch SHOULD_NOT_EXIST)"
+    fake_runtime(tmp_path, env, f"""
+prompt = next(a.split('=',1)[1] for a in sys.argv if a.startswith('--prompt='))
+emit({{'type':'turn.started','prompt':prompt,'model':'fake','args':sys.argv[1:],'cwd':os.getcwd(),
+      'home':os.environ['ARIA_HOME'],'full':os.environ['ARIA_EVENTS_FULL'],'stream':os.environ['ARIA_EVENTS_STREAM'],
+      'stdin':sys.stdin.read()}})
+emit({end('回答')!r})
+""")
+    env.update(ARIA_HOME="state", ARIA_EVENTS_FULL="1", PYTHONIOENCODING="cp1252")
+    workspace = tmp_path / "project"
+    workspace.mkdir()
+    result = subprocess.run([binary, "--python", sys.executable, "-C", str(workspace),
+                             "exec", "--jsonl", literal, "--", "--model", "google/test", "--allow-tools", "read_file"],
+                            cwd=tmp_path, env=env, capture_output=True, timeout=5)
+    assert result.returncode == 0, result.stderr.decode()
+    event = json.loads(result.stdout.splitlines()[0])
+    assert event["prompt"] == literal
+    assert event["args"] == ["--format=jsonl", "--quiet", "--no-banner", "--prompt="+literal,
+                              "--model", "google/test", "--allow-tools", "read_file"]
+    assert Path(event["cwd"]).resolve() == workspace.resolve()
+    assert Path(event["home"]).resolve() == (tmp_path / "state").resolve()
+    assert event["full"] == "0" and event["stream"] == "1" and event["stdin"] == ""
+    assert not (workspace / "SHOULD_NOT_EXIST").exists()
+
+
+def test_exec_flushes_answer_before_worker_finishes(native, tmp_path):
+    binary, env, _ = native
+    marker = tmp_path / "finished"
+    delta = record("answer.delta", text="实时回答\n")
+    completed = end("实时回答\n完整回答\n")
+    fake_runtime(tmp_path, env, f"""
+emit({START!r})
+emit({delta!r})
+time.sleep(1.5)
+Path({str(marker)!r}).touch()
+emit({completed!r})
+""")
+    process = subprocess.Popen([binary, "--python", sys.executable, "exec", "hello"],
+                               env=env, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+    try:
+        assert process.stdout.readline().decode() == "实时回答\n"
+        assert not marker.exists()
+        out, err = process.communicate(timeout=5)
+        assert process.returncode == 0 and out.decode() == "完整回答\n", err.decode()
+    finally:
+        if process.poll() is None:
+            process.kill()
+            process.wait()
+
+
+@pytest.mark.parametrize("exit_code,success", [(0, False), (9, True), (1, False)])
+def test_worker_and_turn_failures_do_not_become_success(native, tmp_path, exit_code, success):
+    _, env, call = native
+    fake_runtime(tmp_path, env, f"emit({START!r})\nemit({end('result', success, error='no_output' if not success else '')!r})\nsys.exit({exit_code})")
+    result = call("exec", "hello")
+    assert result.returncode == (exit_code or 1)
+    assert b"no_output" in result.stderr if not success else b"exited" in result.stderr
+
+
+@pytest.mark.parametrize("body", ["print('polluted stdout')", "emit({!r})".format(START),
+                                  "sys.stdout.buffer.write(b'\\xff\\n')", "print('x'*1048577)", "sys.exit(9)"])
+def test_malformed_oversized_or_truncated_live_stream_fails(native, tmp_path, body):
+    _, env, call = native
+    fake_runtime(tmp_path, env, body)
+    result = call("exec", "hello")
+    assert result.returncode == 2
+    assert b"aria-native:" in result.stderr
+
+
+@pytest.mark.parametrize("args", [("exec", ""), ("exec", "hello", "--format", "json"),
+                                  ("exec", "hello", "--watch", "1"), ("exec", "hello", "--prompt=override"),
+                                  ("exec", "hello", "--model"), ("exec", "hello", "--model", "--local"),
+                                  ("render", "extra")])
+def test_invalid_invocations_never_start_python(native, args):
+    binary, env, _ = native
+    result = subprocess.run([binary, "--python", "missing-python", *args], env=env, capture_output=True, timeout=3)
+    assert result.returncode == 2 and b"Python worker" not in result.stderr
+
+
+def delayed_child(marker):
+    return "import time; from pathlib import Path; time.sleep(1.5); Path(" + repr(str(marker)) + ").touch()"
+
+
+def test_timeout_kills_descendants_even_if_output_consumer_stops_reading(native, tmp_path):
+    binary, env, _ = native
+    marker = tmp_path / "survived"
+    fake_runtime(tmp_path, env, f"""
+subprocess.Popen([sys.executable,'-c',{delayed_child(marker)!r}])
+print('child started',file=sys.stderr,flush=True)
+emit({START!r})
+for i in range(50): emit({record('answer.delta', text='x'*16384)!r})
+time.sleep(60)
+""")
+    process = subprocess.Popen([binary, "--python", sys.executable, "--timeout-ms", "500", "exec", "hello"],
+                               env=env, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+    try:
+        # Intentionally do not drain stdout while waiting for the deadline.
+        process.wait(timeout=4)
+        _, err = process.communicate(timeout=2)
+        assert process.returncode == 2 and b"timed out" in err and b"child started" in err
+    finally:
+        if process.poll() is None:
+            process.kill()
+            process.wait()
+    time.sleep(1.6)
+    assert not marker.exists()
+
+
+@pytest.mark.skipif(sys.platform == "win32", reason="CI has no Windows console to deliver Ctrl+C")
+def test_cancel_live_turn_kills_descendants(native, tmp_path):
+    binary, env, _ = native
+    marker = tmp_path / "survived"
+    delta = record("answer.delta", text="ready\n")
+    fake_runtime(tmp_path, env, f"subprocess.Popen([sys.executable,'-c',{delayed_child(marker)!r}])\nemit({START!r})\nemit({delta!r})\ntime.sleep(60)")
+    process = subprocess.Popen([binary, "--python", sys.executable, "exec", "hello"],
+                               env=env, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+    try:
+        assert process.stdout.readline() == b"ready\n"
+        process.send_signal(signal.SIGINT)
+        _, err = process.communicate(timeout=4)
+        assert process.returncode == 130 and b"Cancelled" in err
+    finally:
+        if process.poll() is None:
+            process.kill()
+            process.wait()
+    time.sleep(1.6)
+    assert not marker.exists()
+
+
+def test_real_python_runtime_slash_command_uses_native_output(native):
+    _, _, call = native
+    result = call("exec", "--jsonl", "/help")
+    assert result.returncode == 0, result.stderr.decode(errors="replace")
+    events = [json.loads(l) for l in result.stdout.splitlines()]
+    assert [e["type"] for e in events] == ["turn.started", "turn.completed"]
+    assert events[-1]["success"] is True
+
+
+@pytest.mark.parametrize("approved", [False, True])
+def test_real_agent_loop_writes_only_with_operator_approval(native, tmp_path, approved):
+    """Only inference is stubbed; CLI, agent loop, policy and file tool are real."""
+    _, env, call = native
+    state = Path(env["ARIA_HOME"])
+    state.mkdir()
+    (state / "config.json").write_text(json.dumps({
+        "model": "google/gemini-3.5-flash", "local_provider": "google",
+        "check_for_update_on_startup": False,
+    }), encoding="utf-8")
+    hooks = tmp_path / "provider_fixture"
+    hooks.mkdir()
+    hook_source = r'''
+import socket
+from pathlib import Path
+from aria_code.apps.cli.providers import runtime_bridge
+_connect = socket.socket.connect
+_connect_ex = socket.socket.connect_ex
+def offline_connect(self, address):
+    # Windows asyncio implements socketpair with a loopback connection.
+    if isinstance(address, tuple) and address[0] in ("127.0.0.1", "::1"):
+        return _connect(self, address)
+    raise OSError("This fixture must not contact an external model")
+def offline_connect_ex(self, address):
+    if isinstance(address, tuple) and address[0] in ("127.0.0.1", "::1"):
+        return _connect_ex(self, address)
+    raise OSError("This fixture must not contact an external model")
+socket.socket.connect = offline_connect
+socket.socket.connect_ex = offline_connect_ex
+def provider_factory(**settings):
+    calls = 0
+    async def provider(prompt, history, *, on_token=None, **kwargs):
+        nonlocal calls
+        calls += 1
+        if calls == 1:
+            return {"success": True, "response": "", "provider": "fixture",
+                    "tool_calls_pending": [{"tool": "write_file", "params": {
+                        "path": "native-note.txt", "content": "A complete local file: 你好世界\n"}}]}
+        if not Path("native-note.txt").exists():
+            return {"success": False, "error": "approval_denied", "provider": "fixture"}
+        text = "已写入本地文件。\n"
+        if on_token is not None: on_token(text)
+        return {"success": True, "response": text, "provider": "fixture"}
+    return provider
+runtime_bridge.make_provider_fn = provider_factory
+'''
+    compile(hook_source, "sitecustomize.py", "exec")
+    (hooks / "sitecustomize.py").write_text(hook_source, encoding="utf-8")
+    env["PYTHONPATH"] = str(hooks) + os.pathsep + str(Path(__file__).resolve().parents[1] / "src")
+    env["ARIA_OFFLINE"] = "1"
+    args = ["exec", "--jsonl", "Create native-note.txt in this project"]
+    if approved:
+        args += ["--", "--allow-tools", "write_file"]
+    result = call(*args)
+    assert b"Error in sitecustomize" not in result.stderr
+    events = [json.loads(l) for l in result.stdout.splitlines()]
+    details = (result.stdout.decode(errors="replace"), result.stderr.decode(errors="replace"))
+    assert any(e["type"] == "tool.started" and e["tool"] == "write_file" for e in events), details
+    tools = [e for e in events if e["type"] == "tool.completed"]
+    if approved:
+        assert tools and tools[0]["tool"] == "write_file" and tools[0]["success"] is True, details
+    else:
+        assert not tools
+        assert any(e["type"] == "turn.status" and e["state"] == "approval_denied" for e in events), details
+    assert events[-1]["type"] == "turn.completed" and events[-1]["success"] is approved, details
+    assert result.returncode == (0 if approved else 1)
+    assert (tmp_path / "native-note.txt").exists() is approved
+    if approved:
+        assert "你好世界" in (tmp_path / "native-note.txt").read_text(encoding="utf-8")
+        assert any(e["type"] == "answer.delta" for e in events)