aria-code 0.163.0__tar.gz → 0.164.0__tar.gz

{aria_code-0.163.0/src/aria_code.egg-info → aria_code-0.164.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aria-code
-Version: 0.163.0
+Version: 0.164.0
 Summary: Open-source AI agent for coding, financial analysis and logistics operations: numbers you can check, client data kept apart, actions a person approves
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/artheras/aria-code
@@ -172,7 +172,7 @@ Numbers you can check, client data kept apart, actions a person approves.</p>
 <p align="center">
   <a href="https://www.npmjs.com/package/@artheras/aria-code"><img src="https://img.shields.io/npm/v/@artheras/aria-code/latest?style=flat-square&logo=npm&label=npm" alt="npm version"></a>
   <!-- Release automation pins PyPI: the default endpoint still selects legacy 4.x. -->
-  <a href="https://pypi.org/project/aria-code/0.163.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.163.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
+  <a href="https://pypi.org/project/aria-code/0.164.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.164.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
   <a href="https://github.com/artheras/aria-code/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/artheras/aria-code/ci.yml?branch=main&style=flat-square&logo=githubactions&label=CI" alt="CI status"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache%202.0-64748b?style=flat-square" alt="Apache License 2.0"></a>
 </p>
@@ -271,7 +271,7 @@ aria-code -p "Fix the failing tests and run them" --format jsonl --allow-tools e
 | --- | --- |
 | Local Ollama | An installed and running Ollama model; no cloud account for local inference. |
 | Direct cloud provider | That provider's API credentials and network access. |
-| Direct Google Cloud Vertex AI | `GOOGLE_CLOUD_PROJECT` and either a `gcloud auth login` (Aria uses Vertex AI's OpenAI-compatible endpoint with that login's token) or Application Default Credentials with `aria-code[google]`. `GOOGLE_CLOUD_LOCATION` defaults to `global`. Any model your project can use works without an API key: `/model google/gemini-3.5-flash`, the Gemini 3 previews (served only from `global`), or Gemma and other Model Garden managed models by their id (`/model google/<id>`), which go through Vertex's OpenAI-compatible endpoint. |
+| Direct Google Cloud Vertex AI | `GOOGLE_CLOUD_PROJECT` and either a `gcloud auth login` (Aria uses Vertex AI's OpenAI-compatible endpoint with that login's token) or Application Default Credentials with `aria-code[google]`. `GOOGLE_CLOUD_LOCATION` defaults to `global`. Any model your project can use works without an API key: `/model google/gemini-3.8-flash`, the Gemini 3 previews (served only from `global`), or Gemma and other Model Garden managed models by their id (`/model google/<id>`), which go through Vertex's OpenAI-compatible endpoint. |
 | Arthera hosted service | Install `aria-code[google]` and sign in through `/login` in the CLI. Arthera account sign-in does not grant Vertex AI credentials to your own machine. |
 
 Install extras only for features you use; see [pyproject.toml](pyproject.toml) for the current package options. Local inference can work offline, but live market data, remote integrations, sign-in, and cloud models cannot.

{aria_code-0.163.0 → aria_code-0.164.0}/README.md

@@ -15,7 +15,7 @@ Numbers you can check, client data kept apart, actions a person approves.</p>
 <p align="center">
   <a href="https://www.npmjs.com/package/@artheras/aria-code"><img src="https://img.shields.io/npm/v/@artheras/aria-code/latest?style=flat-square&logo=npm&label=npm" alt="npm version"></a>
   <!-- Release automation pins PyPI: the default endpoint still selects legacy 4.x. -->
-  <a href="https://pypi.org/project/aria-code/0.163.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.163.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
+  <a href="https://pypi.org/project/aria-code/0.164.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.164.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
   <a href="https://github.com/artheras/aria-code/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/artheras/aria-code/ci.yml?branch=main&style=flat-square&logo=githubactions&label=CI" alt="CI status"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache%202.0-64748b?style=flat-square" alt="Apache License 2.0"></a>
 </p>
@@ -114,7 +114,7 @@ aria-code -p "Fix the failing tests and run them" --format jsonl --allow-tools e
 | --- | --- |
 | Local Ollama | An installed and running Ollama model; no cloud account for local inference. |
 | Direct cloud provider | That provider's API credentials and network access. |
-| Direct Google Cloud Vertex AI | `GOOGLE_CLOUD_PROJECT` and either a `gcloud auth login` (Aria uses Vertex AI's OpenAI-compatible endpoint with that login's token) or Application Default Credentials with `aria-code[google]`. `GOOGLE_CLOUD_LOCATION` defaults to `global`. Any model your project can use works without an API key: `/model google/gemini-3.5-flash`, the Gemini 3 previews (served only from `global`), or Gemma and other Model Garden managed models by their id (`/model google/<id>`), which go through Vertex's OpenAI-compatible endpoint. |
+| Direct Google Cloud Vertex AI | `GOOGLE_CLOUD_PROJECT` and either a `gcloud auth login` (Aria uses Vertex AI's OpenAI-compatible endpoint with that login's token) or Application Default Credentials with `aria-code[google]`. `GOOGLE_CLOUD_LOCATION` defaults to `global`. Any model your project can use works without an API key: `/model google/gemini-3.8-flash`, the Gemini 3 previews (served only from `global`), or Gemma and other Model Garden managed models by their id (`/model google/<id>`), which go through Vertex's OpenAI-compatible endpoint. |
 | Arthera hosted service | Install `aria-code[google]` and sign in through `/login` in the CLI. Arthera account sign-in does not grant Vertex AI credentials to your own machine. |
 
 Install extras only for features you use; see [pyproject.toml](pyproject.toml) for the current package options. Local inference can work offline, but live market data, remote integrations, sign-in, and cloud models cannot.

{aria_code-0.163.0 → aria_code-0.164.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "aria-code"
-version = "0.163.0"
+version = "0.164.0"
 description = "Open-source AI agent for coding, financial analysis and logistics operations: numbers you can check, client data kept apart, actions a person approves"
 readme = "README.md"
 license = { text = "Apache-2.0" }
@@ -45,7 +45,7 @@ classifiers = [
 # parsers, the SQL engine and chart renderer are optional extras below — the
 # code already lazy-imports them and degrades gracefully when absent.
 dependencies = [
-    # The default model's client. DEFAULT_MODEL is google/gemini-3.5-flash, and
+    # The default model's client. DEFAULT_MODEL is google/gemini-3.8-flash, and
     # this used to be the optional `google` extra — so a plain
     # `pip install aria-code` failed on the very first prompt with "Gemini/Vertex
     # AI 需要 google-genai，当前未安装". The comment above that extra said as

{aria_code-0.163.0 → aria_code-0.164.0}/src/aria_code/_version.py

@@ -17,4 +17,4 @@ from __future__ import annotations
 
 __all__ = ["__version__"]
 
-__version__ = "0.163.0"
+__version__ = "0.164.0"

{aria_code-0.163.0 → aria_code-0.164.0}/src/aria_code/adk_apps/aria_code_review/agent.py

@@ -12,7 +12,7 @@ from aria_code.packages.adk_bridge import CodeReviewTools
 _tools = CodeReviewTools()
 
 root_agent = Agent(
-    model=os.getenv("ARIA_ADK_MODEL", "gemini-3.5-flash"),
+    model=os.getenv("ARIA_ADK_MODEL", "gemini-3.8-flash"),
     name="aria_code_review",
     description="A read-only code reviewer for user-submitted source text.",
     instruction="""You are Aria Code Review, a careful software reviewer.

{aria_code-0.163.0 → aria_code-0.164.0}/src/aria_code/adk_apps/aria_research/agent.py

@@ -12,7 +12,7 @@ from aria_code.packages.adk_bridge import MarketResearchTools
 _tools = MarketResearchTools()
 
 root_agent = Agent(
-    model=os.getenv("ARIA_ADK_MODEL", "gemini-3.5-flash"),
+    model=os.getenv("ARIA_ADK_MODEL", "gemini-3.8-flash"),
     name="aria_research",
     description="A read-only market-research assistant for Aria Code and Arthera.",
     instruction="""You are Aria Research, a careful financial-research assistant.

{aria_code-0.163.0 → aria_code-0.164.0}/src/aria_code/apps/cli/app_server.py

@@ -106,10 +106,21 @@ class Server:
         # an index to it preserves deny lists, L4 ask-every-time, hooks, symbol
         # previews and the exact scope of session grants.
         choices = [[str(label), str(help_text)] for label, help_text in options]
+        extra = {}
+        picker = bool(kwargs.get("picker"))
+        if picker:
+            # A long list to search (models): the frontend draws a picker, not an approval.
+            extra["picker"] = True
+            groups = kwargs.get("groups")
+            if isinstance(groups, list) and len(groups) == len(choices):
+                extra["groups"] = [str(group) for group in groups]
+        if not picker and getattr(self, "approval_risk", None):
+            extra["risk"] = self.approval_risk
         answer = self.ask("approval.requested", title=str(title or "Approval / selection"),
                           choices=choices, selected=selected,
                           shortcuts=kwargs.get("shortcuts", {}),
-                          context=getattr(self, "approval_context", ""))
+                          context="" if picker else getattr(self, "approval_context", ""),
+                          **extra)
         chosen = answer.get("choice", -1)
         if type(chosen) is not int or not -1 <= chosen < len(choices):
             raise ValueError("Invalid menu response")
@@ -158,6 +169,11 @@ class Server:
                         continue
                     if kind == "shutdown":
                         break
+                    if kind == "completion.request":
+                        # Answered here, not queued behind a running turn: it is
+                        # a lookup, and the list it feeds should not wait.
+                        self.complete_reference(value)
+                        continue
                     self.requests.put_nowait(value)
                 except (ValueError, UnicodeError, queue.Full) as error:
                     self.emit("protocol.error", error=str(error))
@@ -237,10 +253,12 @@ class Server:
                     if isinstance(params.get(key), str):
                         context.append((cn if zh else en) + ": " + params[key])
                 server.approval_context = "\n".join(context)
+                server.approval_risk = server.assess_for_approval(tool_name, tool_params)
                 try:
                     return await super().approve(tool_name, tool_params, **kwargs)
                 finally:
                     server.approval_context = ""
+                    server.approval_risk = None
         cli.TerminalApprovalEventConsumer = Approvals
         config = cli.load_config()
         config["_session_workspace_root"] = str(Path.cwd().resolve())
@@ -350,6 +368,62 @@ class Server:
         config["last_session_id"] = self.terminal.session_id
         self.cli.save_config(config)
 
+    def complete_reference(self, value):
+        """Answer a completion request with candidates for the `@file` being typed."""
+        text = value.get("text")
+        if not isinstance(text, str) or len(text.encode("utf-8")) > MAX_INPUT:
+            raise ValueError("Completion text must be at most 65536 UTF-8 bytes")
+        from aria_code.apps.cli.file_references import reference_candidates
+
+        try:
+            candidates = reference_candidates(text, Path.cwd())
+        except Exception:
+            candidates = []
+        self.emit("completion.result", session_id=value.get("session_id", ""), text=text, candidates=candidates)
+
+    def assess_for_approval(self, tool_name, params):
+        """What the action reaches, for the approval card: level, files, hosts, why.
+
+        The same assessment the terminal's text card is built from, sent as data
+        so the frontend can draw it. None when it cannot be assessed; the dialog
+        then shows only the tool and its target.
+        """
+        try:
+            from aria_code.safety.risk import assess_tool
+            from aria_code.ui.render.output import _file_impact
+
+            assessment = assess_tool(tool_name, dict(params or {}), root=os.getcwd())
+            card = assessment.as_dict()
+            card["impact"] = _file_impact(assessment)
+            for key in ("hosts", "files", "systems", "reasons"):
+                card[key] = [str(x)[:200] for x in card.get(key, [])[:8]]
+            return card
+        except Exception:
+            return None
+
+    def commands_info(self):
+        """Every slash command with what it does, in the order the list shows them.
+
+        The frontend's list opens on a bare `/`, so what comes first matters: the
+        core commands and the entry points, then the rest alphabetically, the same
+        order the terminal completer has always used. Descriptions are localised.
+        """
+        from aria_code.apps.cli.commands.catalog import CORE_SLASH_COMMANDS, ENTRY_SLASH_COMMANDS, describe
+
+        t = self.terminal
+        registry = t.commands.commands
+        lang = t.config.get("ui_lang", "en")
+        first = [n for n in (*CORE_SLASH_COMMANDS, *ENTRY_SLASH_COMMANDS) if n in registry]
+        rest = [n for n in sorted(registry) if n not in set(first)]
+        info = []
+        for name in first + rest:
+            try:
+                detail = describe(name, registry[name][1], lang)
+            except Exception:
+                detail = ""
+            info.append({"name": name, "description": str(detail or "")[:160]})
+        return info
+
     def snapshot(self, kind):
         from aria_code.apps.cli.native_branding import robot_rows
         from aria_code.ui import robot
@@ -366,6 +440,7 @@ class Server:
                   robot=rows, robot_design="cream-block-v2" if rows else "",
                   model=t.config.get("model", ""), provider=t.config.get("local_provider", ""),
                   workspace=str(Path.cwd()), commands=sorted(t.commands.commands),
+                  commands_info=self.commands_info(), reference_completion=True,
                   permission=t.config.get("permission_mode", "workspace-write"),
                   network=bool(t.config.get("network_enabled", True)),
                   ui_lang=t.config.get("ui_lang", "en"),
@@ -453,11 +528,32 @@ class Server:
                 notice = get_update_notice(wait_ms=0)
                 if notice:
                     self.emit("update.available", turn_id=None, text=Text.from_markup(notice).plain)
+                    await self.install_update_quietly()
                     return
                 await asyncio.sleep(0.1)
         except Exception:
             pass  # A metadata failure must not interrupt the user's task.
 
+    async def install_update_quietly(self):
+        """Native installs update themselves; the header then asks for a restart."""
+        from aria_code.apps.cli import auto_update, updater
+        from aria_code.apps.cli.update_check import _install_channel, _newer
+
+        loop = asyncio.get_running_loop()
+        installed = await loop.run_in_executor(
+            None,
+            lambda: auto_update.install_if_newer(
+                self.cli.__version__, _install_channel(), self.terminal.config,
+                check=updater.check_update, install=updater.install_native,
+                newer=_newer, app_root=updater._app_root(),
+            ),
+        )
+        if installed:
+            zh = self.terminal.config.get("ui_lang", "en") == "zh"
+            text = (f"已更新到 {installed} · 重启 Aria 后生效" if zh
+                    else f"Updated to {installed} · restart Aria to use it")
+            self.emit("update.available", turn_id=None, text=text)
+
     async def serve(self):
         self.loop = asyncio.get_running_loop()
         threading.Thread(target=self.read_requests, daemon=True).start()

aria_code-0.164.0/src/aria_code/apps/cli/auto_update.py

@@ -0,0 +1,102 @@
+"""Install a verified update in the background, the way Claude Code does.
+
+The session keeps running on the version it started with. When a newer native
+release is out, it is downloaded, checked and switched in behind the scenes,
+and the header says "restart to use it". Nothing is interrupted: the new
+version only takes over the next time Aria starts.
+
+Only managed native installs update themselves. pip, npm and source checkouts
+belong to their own tools, so they keep the plain "update available" notice.
+Turn it off with `auto_update: false` in the config or `ARIA_AUTO_UPDATE=0`.
+A version that failed to install is not retried for a day, and two sessions
+never install at once.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import time
+from pathlib import Path
+from typing import Callable, Optional
+
+RETRY_AFTER_FAILURE_S = 86_400
+LOCK_STALE_S = 900
+
+
+def enabled(config: dict) -> bool:
+    if os.environ.get("ARIA_AUTO_UPDATE", "").lower() in {"0", "false", "no", "off"}:
+        return False
+    if os.environ.get("ARIA_OFFLINE", "").lower() in {"1", "true", "yes", "on"}:
+        return False
+    return bool(config.get("auto_update", True))
+
+
+def _state_path(app_root: Path) -> Path:
+    return app_root / "auto-update.json"
+
+
+def _recently_failed(app_root: Path, version: str, now: float) -> bool:
+    try:
+        data = json.loads(_state_path(app_root).read_text())
+    except (OSError, ValueError):
+        return False
+    return data.get("failed") == version and now - float(data.get("at", 0)) < RETRY_AFTER_FAILURE_S
+
+
+def _remember_failure(app_root: Path, version: str, now: float) -> None:
+    try:
+        _state_path(app_root).write_text(json.dumps({"failed": version, "at": now}))
+    except OSError:
+        pass
+
+
+def _take_lock(app_root: Path, now: float) -> Optional[Path]:
+    lock = app_root / "auto-update.lock"
+    try:
+        if lock.exists() and now - lock.stat().st_mtime > LOCK_STALE_S:
+            lock.unlink()
+        fd = os.open(lock, os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o600)
+    except OSError:
+        return None
+    os.close(fd)
+    return lock
+
+
+def install_if_newer(
+    current: str,
+    channel: str,
+    config: dict,
+    *,
+    check: Callable[..., tuple],
+    install: Callable[[str, dict], Path],
+    newer: Callable[[str, str], bool],
+    app_root: Path,
+    now: Optional[float] = None,
+) -> Optional[str]:
+    """Install the latest release when there is one; return its version, else None.
+
+    Blocking: run it off the event loop. Any failure leaves the installed
+    version untouched and returns None.
+    """
+    if channel != "native" or not enabled(config):
+        return None
+    stamp = time.time() if now is None else now
+    try:
+        app_root.mkdir(parents=True, exist_ok=True)
+        latest, release = check("native")
+        if not newer(latest, current) or _recently_failed(app_root, latest, stamp):
+            return None
+        lock = _take_lock(app_root, stamp)
+        if lock is None:
+            return None
+        try:
+            install(latest, release)
+        except Exception:
+            _remember_failure(app_root, latest, stamp)
+            return None
+        finally:
+            lock.unlink(missing_ok=True)
+        return latest
+    except Exception:
+        return None

{aria_code-0.163.0 → aria_code-0.164.0}/src/aria_code/apps/cli/bootstrap.py

@@ -146,7 +146,7 @@ def initialize_cli_environment() -> None:
 # Provider configuration is the user's to make (that is what `/model` and
 # `.ariarc` are for); the code's job is to have a sane default and then get
 # out of the way.
-DEFAULT_MODEL = os.getenv("ARIA_DEFAULT_MODEL", "google/gemini-3.5-flash")
+DEFAULT_MODEL = os.getenv("ARIA_DEFAULT_MODEL", "google/gemini-3.8-flash")
 # A stable model (Google: available until at least May 2027), not a short-term
 # one: an install that is rarely updated should not lose its default within
 # months. gemini-2.5-pro, the previous default, retires in October 2026.
@@ -160,7 +160,7 @@ def default_config() -> dict:
         "ollama_url": os.getenv("OLLAMA_URL", "http://localhost:11434"),
         # Which backend serves a bare, unprefixed model name. Only consulted
         # for names that do not name their own provider ("qwen2.5:7b"); a
-        # prefixed id like "google/gemini-3.5-flash" always wins.
+        # prefixed id like "google/gemini-3.8-flash" always wins.
         "local_provider": os.getenv("ARIA_LLM_PROVIDER", "ollama"),
         "provider_fallback": "configured",
         "model": DEFAULT_MODEL,
@@ -182,6 +182,8 @@ def default_config() -> dict:
         # Independent review of a turn's changes by a fresh-context reviewer
         # before it ends (runtime/review.py). Costs one extra model call.
         "review_gate": False,
+        # A different model for that review (provider/model); "" = the builder itself.
+        "review_model": "",
         # The runtime's DONE/INCOMPLETE report under coding answers.
         "delivery_report": True,
         "network_enabled": True,

aria_code-0.164.0/src/aria_code/apps/cli/cloud_models.py

@@ -0,0 +1,231 @@
+"""The models each cloud provider offers, read from the provider itself.
+
+`/model` used to list Aria's own catalogue and, for a cloud provider, only the
+model already selected: a hand-kept list is out of date within weeks (Google
+retired Gemini 3.5 Flash a month after this catalogue called it stable). So for
+every provider with a key, the model list endpoint is asked what it serves now.
+
+The answer is cached for a few hours. An expired cache is shown straight away
+and refreshed behind it, so opening the picker never waits on a slow provider;
+only a provider with no cache at all is waited for, and only for a few seconds.
+Offline, or when a provider is down, the cache (however old) is used, and a
+provider with neither simply has no section.
+
+Keys are used for the request and never written to the cache.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import threading
+import time
+import urllib.error
+import urllib.request
+from concurrent.futures import ThreadPoolExecutor
+from pathlib import Path
+from typing import Callable, Dict, List, Optional
+
+CACHE_TTL_S = 6 * 3600
+FETCH_TIMEOUT_S = 4.0
+MAX_PER_PROVIDER = 60
+
+#: provider -> (heading, kind, models URL). The URL for Google carries the key
+#: as a header, not in the query string.
+PROVIDERS: Dict[str, tuple] = {
+    "google": ("Google Gemini", "google", "https://generativelanguage.googleapis.com/v1beta/models?pageSize=200"),
+    "openai": ("OpenAI", "openai", "https://api.openai.com/v1/models"),
+    "anthropic": ("Anthropic Claude", "anthropic", "https://api.anthropic.com/v1/models?limit=100"),
+    "deepseek": ("DeepSeek", "openai", "https://api.deepseek.com/models"),
+    "groq": ("Groq", "openai", "https://api.groq.com/openai/v1/models"),
+    "together": ("Together AI", "openai", "https://api.together.xyz/v1/models"),
+    "dashscope": ("Alibaba DashScope", "openai", "https://dashscope.aliyuncs.com/compatible-mode/v1/models"),
+    "siliconflow": ("SiliconFlow", "openai", "https://api.siliconflow.cn/v1/models"),
+    "moonshot": ("Moonshot", "openai", "https://api.moonshot.cn/v1/models"),
+    "zhipu": ("Zhipu GLM", "openai", "https://open.bigmodel.cn/api/paas/v4/models"),
+}
+
+#: Not chat models: embeddings, speech, images, video, music, moderation, live audio.
+_NOT_CHAT = re.compile(
+    r"embed|whisper|tts|transcribe|speech|audio|realtime|dall-e|image|imagen|veo|lyria|"
+    r"omni-|nano-banana|moderation|rerank|guard|-live|robotics|computer-use|sora|deep-research|"
+    r"search-preview|davinci|babbage|aqa|text-bison|vision-preview",
+    re.IGNORECASE,
+)
+
+_refreshing: set = set()
+_lock = threading.Lock()
+
+
+def cache_dir() -> Path:
+    from aria_code.packages.aria_core.paths import aria_home
+
+    return Path(aria_home()) / "cloud_models"
+
+
+def _http_json(url: str, headers: Dict[str, str], timeout: float) -> object:
+    request = urllib.request.Request(url, headers={"User-Agent": "aria-code", "Accept": "application/json", **headers})
+    with urllib.request.urlopen(request, timeout=timeout) as response:  # noqa: S310 - fixed https endpoints above
+        return json.load(response)
+
+
+def _natural_key(text: str):
+    """Sort key where 3.10 follows 3.9 and a higher version sorts later."""
+    return [int(part) if part.isdigit() else part for part in re.split(r"(\d+)", text.lower())]
+
+
+def _ctx_label(tokens) -> str:
+    try:
+        n = int(tokens)
+    except (TypeError, ValueError):
+        return ""
+    if n >= 900_000:
+        return f"ctx {round(n / 1_048_576)}M"
+    return f"ctx {n // 1000}K" if n >= 1000 else ""
+
+
+def _date(epoch: int) -> str:
+    import datetime
+
+    try:
+        return datetime.date.fromtimestamp(epoch).isoformat()
+    except (OverflowError, OSError, ValueError):
+        return ""
+
+
+def _is_shut_down(value: object, today: Optional[float] = None) -> bool:
+    """True when a provider's `shutdown_date` (epoch seconds or ISO date) has passed."""
+    now = time.time() if today is None else today
+    if isinstance(value, (int, float)) and value > 0:
+        return float(value) < now
+    if isinstance(value, str) and value:
+        import datetime
+
+        try:
+            return datetime.date.fromisoformat(value[:10]) < datetime.date.fromtimestamp(now)
+        except ValueError:
+            return False
+    return False
+
+
+def parse(provider: str, payload: object) -> List[dict]:
+    """The chat models in a provider's list response, newest first: [{id, name, detail}]."""
+    kind = PROVIDERS[provider][1]
+    rows: List[dict] = []
+    if kind == "google":
+        for item in (payload or {}).get("models", []) if isinstance(payload, dict) else []:
+            methods = item.get("supportedGenerationMethods") or []
+            ident = str(item.get("name", "")).removeprefix("models/")
+            if "generateContent" not in methods or not ident or _NOT_CHAT.search(ident):
+                continue
+            detail = " · ".join(x for x in (_ctx_label(item.get("inputTokenLimit")),) if x)
+            rows.append({"id": ident, "name": item.get("displayName") or ident, "detail": detail})
+    elif kind == "anthropic":
+        for item in (payload or {}).get("data", []) if isinstance(payload, dict) else []:
+            ident = str(item.get("id", ""))
+            if ident:
+                rows.append({"id": ident, "name": item.get("display_name") or ident, "detail": ""})
+    else:
+        items = payload.get("data", []) if isinstance(payload, dict) else payload
+        for item in items if isinstance(items, list) else []:
+            ident = str(item.get("id", "")) if isinstance(item, dict) else ""
+            if not ident or _NOT_CHAT.search(ident) or _is_shut_down(item.get("shutdown_date")):
+                continue
+            created = item.get("created")
+            created = int(created) if isinstance(created, (int, float)) and created > 0 else 0
+            detail = _date(created) if created else ""
+            rows.append({"id": ident, "name": ident, "detail": detail, "created": created})
+    # Newest first by the provider's own creation date where it gives one (OpenAI does);
+    # otherwise by version number in the id, which is only a rough proxy.
+    rows.sort(key=lambda r: (r.get("created", 0), _natural_key(r["id"])), reverse=True)
+    return [{k: v for k, v in r.items() if k != "created"} for r in rows[:MAX_PER_PROVIDER]]
+
+
+def fetch(provider: str, key: str, timeout: float = FETCH_TIMEOUT_S) -> Optional[List[dict]]:
+    """Ask the provider; None when it cannot be reached or refuses the key."""
+    _heading, kind, url = PROVIDERS[provider]
+    if kind == "google":
+        headers = {"x-goog-api-key": key}
+    elif kind == "anthropic":
+        headers = {"x-api-key": key, "anthropic-version": "2023-06-01"}
+    else:
+        headers = {"Authorization": f"Bearer {key}"}
+    try:
+        return parse(provider, _http_json(url, headers, timeout))
+    except (OSError, urllib.error.URLError, ValueError):
+        return None
+
+
+def _read_cache(provider: str) -> Optional[dict]:
+    try:
+        data = json.loads((cache_dir() / f"{provider}.json").read_text(encoding="utf-8"))
+        if isinstance(data.get("models"), list):
+            return data
+    except (OSError, ValueError):
+        pass
+    return None
+
+
+def _write_cache(provider: str, models: List[dict], now: float) -> None:
+    try:
+        directory = cache_dir()
+        directory.mkdir(parents=True, exist_ok=True)
+        (directory / f"{provider}.json").write_text(json.dumps({"at": now, "models": models}), encoding="utf-8")
+    except OSError:
+        pass
+
+
+def _refresh_later(provider: str, key: str) -> None:
+    with _lock:
+        if provider in _refreshing:
+            return
+        _refreshing.add(provider)
+
+    def run() -> None:
+        try:
+            models = fetch(provider, key)
+            if models:
+                _write_cache(provider, models, time.time())
+        finally:
+            with _lock:
+                _refreshing.discard(provider)
+
+    threading.Thread(target=run, daemon=True, name=f"aria-models-{provider}").start()
+
+
+def models_for(provider: str, key: str, *, offline: bool = False, now: Optional[float] = None) -> List[dict]:
+    """The provider's models: fresh cache, else stale cache (refreshed behind), else a live request."""
+    stamp = time.time() if now is None else now
+    cached = _read_cache(provider)
+    if cached and (offline or stamp - float(cached.get("at", 0)) < CACHE_TTL_S):
+        return cached["models"]
+    if cached:
+        _refresh_later(provider, key)
+        return cached["models"]
+    if offline:
+        return []
+    models = fetch(provider, key)
+    if models:
+        _write_cache(provider, models, stamp)
+    return models or []
+
+
+def collect(key_for: Callable[[str], str], *, offline: Optional[bool] = None) -> Dict[str, List[dict]]:
+    """Models for every provider that has a key, looked up in parallel: {provider: [models]}."""
+    if offline is None:
+        offline = os.environ.get("ARIA_OFFLINE", "").lower() in {"1", "true", "yes", "on"}
+    keyed = {p: key for p in PROVIDERS if (key := key_for(p))}
+    if not keyed:
+        return {}
+    with ThreadPoolExecutor(max_workers=min(8, len(keyed))) as pool:
+        futures = {p: pool.submit(models_for, p, key, offline=offline) for p, key in keyed.items()}
+        out = {}
+        for provider, future in futures.items():
+            try:
+                models = future.result(timeout=FETCH_TIMEOUT_S + 2)
+            except Exception:
+                models = []
+            if models:
+                out[provider] = models
+    return out

{aria_code-0.163.0 → aria_code-0.164.0}/src/aria_code/apps/cli/commands/catalog.py

@@ -75,7 +75,8 @@ VISIBLE_SLASH_COMMANDS: FrozenSet[str] = frozenset({
     # Broker
     "/broker", "/account", "/positions", "/orders", "/paper", "/trade",
     # Code & project
-    "/project", "/init", "/review", "/code", "/plan", "/orchestrate", "/run", "/task", "/tasks", "/impact", "/workflow", "/delegate", "/canva", "/completions", "/lsp",
+    "/project", "/init", "/review", "/code", "/plan", "/orchestrate", "/run", "/task", "/tasks", "/impact", "/workflow", "/delegate",
+    "/diff", "/commit", "/pr", "/checkpoint", "/worktree", "/graph", "/agents", "/test", "/build", "/sim", "/consult", "/fix", "/canva", "/completions", "/lsp",
     # Research
     "/team", "/warehouse", "/deep",
     # Quant
@@ -120,7 +121,8 @@ class HelpTopic:
 HELP_TOPICS: Tuple[HelpTopic, ...] = (
     HelpTopic("code", "Code and projects", "代码与项目", (
         "/code", "/project", "/init", "/review", "/plan", "/run", "/read", "/write", "/edit", "/ls",
-        "/search", "/verify", "/scaffold", "/apply", "/changes", "/git")),
+        "/search", "/verify", "/scaffold", "/apply", "/changes", "/git",
+        "/diff", "/commit", "/pr", "/test", "/build", "/sim", "/consult", "/fix", "/graph", "/impact", "/agents", "/task", "/worktree", "/checkpoint")),
     HelpTopic("market", "Market research", "市场研究", (
         "/quote", "/analyze", "/ta", "/chart", "/tv", "/deep", "/team", "/report", "/news", "/markets",
         "/watch", "/alert")),
@@ -171,6 +173,10 @@ COMMAND_DESCRIPTIONS_ZH = {
     "/config": "查看与修改配置", "/doctor": "诊断安装、模型与 API Key", "/login": "登录",
     "/code": "生成并运行代码", "/ta": "技术指标", "/backtest": "回测并生成 HTML 报告",
     "/team": "多智能体研究团队", "/report": "研究报告", "/portfolio": "投资组合",
+    "/diff": "查看改动：摘要或补丁", "/commit": "提交所有改动", "/pr": "当前分支的 Pull Request",
+    "/checkpoint": "检查点与回合还原点", "/worktree": "编码任务的工作树", "/graph": "项目图谱与改动影响",
+    "/agents": "项目智能体与后台任务", "/test": "运行项目测试", "/build": "运行项目构建",
+    "/fix": "定位原因、最小改动、验证", "/sim": "运行项目声明的仿真", "/consult": "向另一个模型征求第二意见",
     "/inventory": "3PL 库存策略：补货点、安全库存、ABC/XYZ、呆滞库存",
     "/carriers": "3PL 承运商评分：按线路排名、成本异常与节省",
 }