aria-code 0.163.0__tar.gz → 0.165.0__tar.gz

{aria_code-0.163.0/src/aria_code.egg-info → aria_code-0.165.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aria-code
-Version: 0.163.0
+Version: 0.165.0
 Summary: Open-source AI agent for coding, financial analysis and logistics operations: numbers you can check, client data kept apart, actions a person approves
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/artheras/aria-code
@@ -157,8 +157,8 @@ Dynamic: license-file
 
 <p align="center">
   <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="docs/assets/aria-code-icon.png">
-    <img src="docs/assets/aria-code-icon-light.png" alt="Aria Code icon" width="88">
+    <source media="(prefers-color-scheme: dark)" srcset="docs/assets/aria-aplus-dark.png">
+    <img src="docs/assets/aria-aplus-light.png" alt="Aria Code icon" width="88">
   </picture>
 </p>
 
@@ -172,7 +172,7 @@ Numbers you can check, client data kept apart, actions a person approves.</p>
 <p align="center">
   <a href="https://www.npmjs.com/package/@artheras/aria-code"><img src="https://img.shields.io/npm/v/@artheras/aria-code/latest?style=flat-square&logo=npm&label=npm" alt="npm version"></a>
   <!-- Release automation pins PyPI: the default endpoint still selects legacy 4.x. -->
-  <a href="https://pypi.org/project/aria-code/0.163.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.163.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
+  <a href="https://pypi.org/project/aria-code/0.165.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.165.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
   <a href="https://github.com/artheras/aria-code/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/artheras/aria-code/ci.yml?branch=main&style=flat-square&logo=githubactions&label=CI" alt="CI status"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache%202.0-64748b?style=flat-square" alt="Apache License 2.0"></a>
 </p>
@@ -271,7 +271,7 @@ aria-code -p "Fix the failing tests and run them" --format jsonl --allow-tools e
 | --- | --- |
 | Local Ollama | An installed and running Ollama model; no cloud account for local inference. |
 | Direct cloud provider | That provider's API credentials and network access. |
-| Direct Google Cloud Vertex AI | `GOOGLE_CLOUD_PROJECT` and either a `gcloud auth login` (Aria uses Vertex AI's OpenAI-compatible endpoint with that login's token) or Application Default Credentials with `aria-code[google]`. `GOOGLE_CLOUD_LOCATION` defaults to `global`. Any model your project can use works without an API key: `/model google/gemini-3.5-flash`, the Gemini 3 previews (served only from `global`), or Gemma and other Model Garden managed models by their id (`/model google/<id>`), which go through Vertex's OpenAI-compatible endpoint. |
+| Direct Google Cloud Vertex AI | `GOOGLE_CLOUD_PROJECT` and either a `gcloud auth login` (Aria uses Vertex AI's OpenAI-compatible endpoint with that login's token) or Application Default Credentials with `aria-code[google]`. `GOOGLE_CLOUD_LOCATION` defaults to `global`. Any model your project can use works without an API key: `/model google/gemini-3.8-flash`, the Gemini 3 previews (served only from `global`), or Gemma and other Model Garden managed models by their id (`/model google/<id>`), which go through Vertex's OpenAI-compatible endpoint. |
 | Arthera hosted service | Install `aria-code[google]` and sign in through `/login` in the CLI. Arthera account sign-in does not grant Vertex AI credentials to your own machine. |
 
 Install extras only for features you use; see [pyproject.toml](pyproject.toml) for the current package options. Local inference can work offline, but live market data, remote integrations, sign-in, and cloud models cannot.

{aria_code-0.163.0 → aria_code-0.165.0}/README.md

@@ -1,7 +1,7 @@
 <p align="center">
   <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="docs/assets/aria-code-icon.png">
-    <img src="docs/assets/aria-code-icon-light.png" alt="Aria Code icon" width="88">
+    <source media="(prefers-color-scheme: dark)" srcset="docs/assets/aria-aplus-dark.png">
+    <img src="docs/assets/aria-aplus-light.png" alt="Aria Code icon" width="88">
   </picture>
 </p>
 
@@ -15,7 +15,7 @@ Numbers you can check, client data kept apart, actions a person approves.</p>
 <p align="center">
   <a href="https://www.npmjs.com/package/@artheras/aria-code"><img src="https://img.shields.io/npm/v/@artheras/aria-code/latest?style=flat-square&logo=npm&label=npm" alt="npm version"></a>
   <!-- Release automation pins PyPI: the default endpoint still selects legacy 4.x. -->
-  <a href="https://pypi.org/project/aria-code/0.163.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.163.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
+  <a href="https://pypi.org/project/aria-code/0.165.0/"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fpypi.org%2Fpypi%2Faria-code%2F0.165.0%2Fjson&amp;query=%24.info.version&amp;prefix=v&amp;style=flat-square&amp;logo=pypi&amp;label=PyPI&amp;color=blue&amp;cacheSeconds=300" alt="PyPI version"></a>
   <a href="https://github.com/artheras/aria-code/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/artheras/aria-code/ci.yml?branch=main&style=flat-square&logo=githubactions&label=CI" alt="CI status"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache%202.0-64748b?style=flat-square" alt="Apache License 2.0"></a>
 </p>
@@ -114,7 +114,7 @@ aria-code -p "Fix the failing tests and run them" --format jsonl --allow-tools e
 | --- | --- |
 | Local Ollama | An installed and running Ollama model; no cloud account for local inference. |
 | Direct cloud provider | That provider's API credentials and network access. |
-| Direct Google Cloud Vertex AI | `GOOGLE_CLOUD_PROJECT` and either a `gcloud auth login` (Aria uses Vertex AI's OpenAI-compatible endpoint with that login's token) or Application Default Credentials with `aria-code[google]`. `GOOGLE_CLOUD_LOCATION` defaults to `global`. Any model your project can use works without an API key: `/model google/gemini-3.5-flash`, the Gemini 3 previews (served only from `global`), or Gemma and other Model Garden managed models by their id (`/model google/<id>`), which go through Vertex's OpenAI-compatible endpoint. |
+| Direct Google Cloud Vertex AI | `GOOGLE_CLOUD_PROJECT` and either a `gcloud auth login` (Aria uses Vertex AI's OpenAI-compatible endpoint with that login's token) or Application Default Credentials with `aria-code[google]`. `GOOGLE_CLOUD_LOCATION` defaults to `global`. Any model your project can use works without an API key: `/model google/gemini-3.8-flash`, the Gemini 3 previews (served only from `global`), or Gemma and other Model Garden managed models by their id (`/model google/<id>`), which go through Vertex's OpenAI-compatible endpoint. |
 | Arthera hosted service | Install `aria-code[google]` and sign in through `/login` in the CLI. Arthera account sign-in does not grant Vertex AI credentials to your own machine. |
 
 Install extras only for features you use; see [pyproject.toml](pyproject.toml) for the current package options. Local inference can work offline, but live market data, remote integrations, sign-in, and cloud models cannot.

{aria_code-0.163.0 → aria_code-0.165.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "aria-code"
-version = "0.163.0"
+version = "0.165.0"
 description = "Open-source AI agent for coding, financial analysis and logistics operations: numbers you can check, client data kept apart, actions a person approves"
 readme = "README.md"
 license = { text = "Apache-2.0" }
@@ -45,7 +45,7 @@ classifiers = [
 # parsers, the SQL engine and chart renderer are optional extras below — the
 # code already lazy-imports them and degrades gracefully when absent.
 dependencies = [
-    # The default model's client. DEFAULT_MODEL is google/gemini-3.5-flash, and
+    # The default model's client. DEFAULT_MODEL is google/gemini-3.8-flash, and
     # this used to be the optional `google` extra — so a plain
     # `pip install aria-code` failed on the very first prompt with "Gemini/Vertex
     # AI 需要 google-genai，当前未安装". The comment above that extra said as

{aria_code-0.163.0 → aria_code-0.165.0}/src/aria_code/_version.py

@@ -17,4 +17,4 @@ from __future__ import annotations
 
 __all__ = ["__version__"]
 
-__version__ = "0.163.0"
+__version__ = "0.165.0"

aria_code-0.165.0/src/aria_code/account_memory.py

@@ -0,0 +1,296 @@
+"""Account-scoped durable memory: a cloud snapshot plus a retryable outbox.
+
+Only newly captured account facts are queued. Legacy files and repository
+instructions are never uploaded. A failed request never becomes a success.
+"""
+
+from __future__ import annotations
+
+import uuid
+import os
+from contextlib import contextmanager
+import json
+import threading
+import time
+from typing import Callable
+
+from aria_code.account_session import account_id, account_root, get_account_token, read_config
+from aria_code.cloud_memory import CloudMemoryClient
+from aria_code.packages.aria_core.secure_file import write_secret_json
+
+_LOCKS: dict[str, threading.RLock] = {}
+_SYNC_LOCKS: dict[str, threading.Lock] = {}
+_LOCK = threading.Lock()
+
+
+def _lock_for(table, key, factory):
+    with _LOCK:
+        return table.setdefault(str(key), factory())
+
+
+@contextmanager
+def _state_lock(path):
+    """Protect read-modify-write across CLI windows as well as threads."""
+    with _lock_for(_LOCKS, path, threading.RLock):
+        path.parent.mkdir(parents=True, exist_ok=True)
+        descriptor = os.open(str(path) + ".lock", os.O_CREAT | os.O_RDWR, 0o600)
+        with os.fdopen(descriptor, "r+b") as handle:
+            if os.name == "nt":
+                import msvcrt
+
+                handle.seek(0, 2)
+                if handle.tell() == 0:
+                    handle.write(b"0")
+                    handle.flush()
+                handle.seek(0)
+                msvcrt.locking(handle.fileno(), msvcrt.LK_LOCK, 1)
+                try:
+                    yield
+                finally:
+                    handle.seek(0)
+                    msvcrt.locking(handle.fileno(), msvcrt.LK_UNLCK, 1)
+            else:
+                import fcntl
+
+                fcntl.flock(handle, fcntl.LOCK_EX)
+                try:
+                    yield
+                finally:
+                    fcntl.flock(handle, fcntl.LOCK_UN)
+
+
+def _write_state(path, data):
+    temporary = path.with_name(f".{path.name}.{os.getpid()}.{threading.get_ident()}.tmp")
+    try:
+        write_secret_json(temporary, data)
+        os.replace(temporary, path)
+    finally:
+        temporary.unlink(missing_ok=True)
+
+
+class AccountMemory:
+    def __init__(self, config: dict | Callable[[], dict] | None = None, save=None):
+        self._config = config if config is not None else read_config
+        self.save = save
+
+    def config(self):
+        return self._config() if callable(self._config) else self._config
+
+    def _owner(self):
+        config = self.config()
+        uid = account_id(config)
+        return config, uid, account_root(config) / "cloud-memory.json"
+
+    @staticmethod
+    def _read(path):
+        try:
+            data = json.loads(path.read_text(encoding="utf-8"))
+            return data if isinstance(data, dict) else {}
+        except (OSError, ValueError):
+            return {}
+
+    def status(self):
+        config, uid, path = self._owner()
+        with _state_lock(path):
+            data = self._read(path)
+        return {
+            "account_id": uid,
+            "email": config.get("email") or "",
+            "enabled": data.get("preferences", {}).get("enabled", True),
+            "pending": len(data.get("outbox", [])),
+            "last_synced": data.get("last_synced"),
+            "error": data.get("error"),
+        }
+
+    def facts(self, *, include_disabled=False):
+        _, uid, path = self._owner()
+        if not uid:
+            return []
+        with _state_lock(path):
+            data = self._read(path)
+        if not include_disabled and data.get("preferences", {}).get("enabled") is False:
+            return []
+        outbox = data.get("outbox", [])
+        hidden = {op["id"] for op in outbox if op.get("op") == "delete"}
+        cancelled = set(data.get("cancelled_adds", []))
+        facts = [
+            f
+            for f in data.get("facts", [])
+            if f.get("id") not in hidden and (f.get("metadata") or {}).get("client_id") not in cancelled
+        ]
+        seen = {f.get("content") for f in facts}
+        for op in outbox:
+            if op.get("op") == "add" and op.get("content") not in seen:
+                facts.append({"id": op["id"], "content": op["content"], "pending": True})
+                seen.add(op["content"])
+        return facts
+
+    def context(self, max_chars=800):
+        _, uid, path = self._owner()
+        if not uid:
+            return ""
+        with _state_lock(path):
+            preferences = self._read(path).get("preferences", {})
+        if preferences.get("enabled") is False:
+            return ""
+        lines = [str(preferences[key]).strip() for key in ("nickname", "occupation", "about") if preferences.get(key)]
+        lines.extend(str(f.get("content", "")) for f in self.facts())
+        text = "\n".join(dict.fromkeys(lines))[:max_chars]
+        return f"## Account Memory\n{text}\n" if text else ""
+
+    def add(self, content: str):
+        config, uid, path = self._owner()
+        content = content.strip()[:4000]
+        if not uid or not content:
+            return False
+        # Stable per queued operation, so a retry is idempotent but an explicit
+        # re-add after deletion can create a new fact.
+        item_id = uuid.uuid4().hex
+        with _state_lock(path):
+            data = self._read(path)
+            if data.get("preferences", {}).get("enabled") is False or account_id(self.config()) != uid:
+                return False
+            if any(f.get("content") == content for f in data.get("facts", [])):
+                return True
+            outbox = data.setdefault("outbox", [])
+            if not any(op.get("op") == "add" and op.get("content") == content for op in outbox):
+                outbox.append({"op": "add", "id": item_id, "content": content})
+            _write_state(path, data)
+        return True
+
+    def forget(self, item_id):
+        _, uid, path = self._owner()
+        if not uid:
+            return False
+        with _state_lock(path):
+            data = self._read(path)
+            pending = data.setdefault("outbox", [])
+            local = any(op.get("id") == item_id and op.get("op") == "add" for op in pending)
+            if local:
+                data["cancelled_adds"] = list(set(data.get("cancelled_adds", [])) | {item_id})
+            data["outbox"] = [op for op in pending if op.get("id") != item_id]
+            if not local and any(f.get("id") == item_id for f in data.get("facts", [])):
+                data["outbox"].append({"op": "delete", "id": item_id})
+            _write_state(path, data)
+        return True
+
+    def sync(self, *, force=False):
+        config, uid, path = self._owner()
+        if not uid:
+            return {"ok": False, "reason": "sign-in-required"}
+        lock = _lock_for(_SYNC_LOCKS, path, threading.Lock)
+        if not lock.acquire(blocking=False):
+            return {"ok": False, "reason": "in-progress"}
+        state_lock = lambda: _state_lock(path)
+        original = config.get("auth_token")
+
+        def current():
+            now = self.config()
+            return account_id(now) == uid and now.get("auth_token") == original
+
+        def update(**fields):
+            if not current():
+                return
+            with state_lock():
+                data = self._read(path)
+                data.update(fields)
+                _write_state(path, data)
+
+        try:
+            with state_lock():
+                data = self._read(path)
+            if not force and time.time() - data.get("last_attempt", 0) < 60:
+                return {"ok": not data.get("error"), "cached": True}
+            update(last_attempt=time.time())
+            token = get_account_token(config, self.save)
+            if token:
+                original = token
+            if not token or not current():
+                update(error="sign-in-required")
+                return {"ok": False, "reason": "sign-in-required"}
+            from aria_code.apps.cli.endpoint_migration import PRODUCTION_API_URL
+
+            client = CloudMemoryClient(str(config.get("api_url") or PRODUCTION_API_URL), token)
+            preferences = client.get_preferences()
+            if not preferences or not current():
+                reason = "sign-in-required" if client.last_status == 401 else "service-unavailable"
+                update(error=reason)
+                return {"ok": False, "reason": reason}
+            # A newly disabled switch takes effect even if the next read fails.
+            update(preferences=preferences)
+            summary = client._request("GET", "/api/v2/memory/summary")
+            if summary is None:
+                update(error="service-unavailable")
+                return {"ok": False, "reason": "service-unavailable"}
+            if not current():
+                return {"ok": False, "reason": "account-changed"}
+            facts = summary.get("facts", [])
+            facts = [f for f in facts if isinstance(f, dict) and f.get("id") and isinstance(f.get("content"), str)]
+            update(preferences=preferences, facts=facts)
+            enabled = preferences.get("enabled") is not False
+            with state_lock():
+                latest = self._read(path)
+                cancelled = set(latest.get("cancelled_adds", []))
+                outbox = latest.setdefault("outbox", [])
+                for fact in facts:
+                    if (fact.get("metadata") or {}).get("client_id") in cancelled:
+                        deletion = {"op": "delete", "id": fact["id"]}
+                        if deletion not in outbox:
+                            outbox.append(deletion)
+                _write_state(path, latest)
+                pending = list(outbox)
+            failed = False
+            for op in pending[:10]:
+                if not enabled and op["op"] == "add":
+                    continue
+                if not current():
+                    return {"ok": False, "reason": "account-changed"}
+                if op["op"] == "add":
+                    existing = next(
+                        (
+                            f
+                            for f in facts
+                            if (f.get("metadata") or {}).get("client_id") == op["id"]
+                            or f.get("content") == op["content"]
+                        ),
+                        None,
+                    )
+                    item = existing or client._request(
+                        "POST",
+                        "/api/v2/memory/items",
+                        body={
+                            "content": op["content"],
+                            "client_id": op["id"],
+                            "scope": "user",
+                            "kind": "durable",
+                            "metadata": {"source": "aria-code", "client_id": op["id"]},
+                        },
+                    )
+                    success = isinstance(item, dict) and bool(item.get("id"))
+                    if success and not existing and not item.get("deleted_at"):
+                        facts.append(item)
+                else:
+                    success = client.delete_item(op["id"])
+                    if success:
+                        facts = [f for f in facts if f.get("id") != op["id"]]
+                if not current():
+                    return {"ok": False, "reason": "account-changed"}
+                if not success:
+                    failed = True
+                    break
+                with state_lock():
+                    latest = self._read(path)
+                    latest["outbox"] = [item for item in latest.get("outbox", []) if item != op]
+                    if op["op"] == "add" and op["id"] in latest.get("cancelled_adds", []) and item.get("id"):
+                        deletion = {"op": "delete", "id": item["id"]}
+                        if deletion not in latest["outbox"]:
+                            latest["outbox"].append(deletion)
+                    latest["facts"] = facts
+                    _write_state(path, latest)
+            update(last_synced=time.time(), error="pending-retry" if failed else None)
+            return {"ok": not failed, "pending": self.status()["pending"], "enabled": enabled}
+        except Exception:
+            update(error="service-unavailable")
+            return {"ok": False, "reason": "service-unavailable"}
+        finally:
+            lock.release()

aria_code-0.165.0/src/aria_code/account_session.py

@@ -0,0 +1,166 @@
+"""Firebase account identity and refresh shared by the CLI and memory client.
+
+JWT claims here are a local consistency check, never authorization: the API
+still verifies Firebase's signature/project on every request.
+"""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import json
+import time
+import urllib.parse
+import urllib.request
+from pathlib import Path
+from typing import Callable
+
+from aria_code.packages.aria_core.paths import aria_home
+from aria_code.packages.aria_core.secure_file import write_secret_json
+
+PROJECT_ID = "arthera-66e5b"
+
+
+def read_config() -> dict:
+    try:
+        value = json.loads((aria_home() / "config.json").read_text(encoding="utf-8"))
+        return value if isinstance(value, dict) else {}
+    except (OSError, ValueError):
+        return {}
+
+
+def claims_for(token: str) -> dict:
+    try:
+        encoded = token.split(".")[1]
+        claims = json.loads(base64.urlsafe_b64decode(encoded + "=" * (-len(encoded) % 4)))
+        if claims.get("aud") != PROJECT_ID or claims.get("iss") != f"https://securetoken.google.com/{PROJECT_ID}":
+            return {}
+        return claims if isinstance(claims.get("sub"), str) and claims["sub"] else {}
+    except (ValueError, IndexError, TypeError, AttributeError):
+        return {}
+
+
+def account_id(config: dict) -> str | None:
+    if not config.get("auth_token"):
+        return None
+    uid = str(config.get("user_id") or "")
+    claims = claims_for(str(config["auth_token"]))
+    # Never infer identity from email or reuse a different account's token.
+    return uid if uid and claims.get("sub") == uid else None
+
+
+def account_root(config: dict | None = None) -> Path:
+    config = read_config() if config is None else config
+    uid = account_id(config)
+    bucket = hashlib.sha256(uid.encode()).hexdigest() if uid else "anonymous"
+    return aria_home() / "accounts" / bucket
+
+
+def profile_path(config: dict | None = None) -> Path:
+    return account_root(config) / "ARIA.md"
+
+
+def persist_if_current(config: dict, original: tuple, updates: dict, save: Callable | None = None) -> bool:
+    if (config.get("user_id"), config.get("auth_token"), config.get("refresh_token")) != original:
+        return False
+    config.update(updates)
+    if save:
+        save(config)
+    else:
+        disk = read_config()
+        if (disk.get("user_id"), disk.get("auth_token"), disk.get("refresh_token")) != original:
+            return False
+        disk.update(updates)
+        write_secret_json(aria_home() / "config.json", disk)
+    return True
+
+
+def get_account_token(config: dict, save: Callable | None = None, *, force=False) -> str | None:
+    uid = account_id(config)
+    if not uid:
+        return None
+    token = str(config["auth_token"])
+    claims = claims_for(token)
+    try:
+        expires = float(claims.get("exp", 0))
+    except (ValueError, TypeError):
+        return None
+    if not force and expires > time.time() + 120:
+        return token
+    refresh = config.get("refresh_token")
+    if not refresh:
+        return token if expires > time.time() else None
+    original = (uid, token, refresh)
+    from aria_code.apps.cli.google_login import FIREBASE_WEB_API_KEY
+
+    request = urllib.request.Request(
+        f"https://securetoken.googleapis.com/v1/token?key={FIREBASE_WEB_API_KEY}",
+        data=urllib.parse.urlencode({"grant_type": "refresh_token", "refresh_token": refresh}).encode(),
+        headers={"Content-Type": "application/x-www-form-urlencoded"},
+        method="POST",
+    )
+    try:
+        with urllib.request.urlopen(request, timeout=8) as response:
+            result = json.loads(response.read())
+        fresh = result.get("id_token", "")
+        fresh_claims = claims_for(fresh)
+        if (
+            result.get("user_id") != uid
+            or fresh_claims.get("sub") != uid
+            or float(fresh_claims.get("exp", 0)) <= time.time()
+        ):
+            return None
+        updates = {"auth_token": fresh, "refresh_token": result.get("refresh_token") or refresh}
+        if isinstance(fresh_claims.get("email"), str):
+            updates["email"] = fresh_claims["email"].strip().lower()
+        from datetime import datetime, timezone
+
+        updates["token_expires_at"] = datetime.fromtimestamp(float(fresh_claims["exp"]), timezone.utc).isoformat()
+        if not persist_if_current(config, original, updates, save):
+            return None
+        return fresh
+    except Exception:
+        # Do not expose tokens, refresh tokens, HTTP bodies or URLs in errors.
+        return token if not force and expires > time.time() else None
+
+
+def password_session(email: str, password: str) -> dict:
+    """Browserless fallback, using the exact same Firebase account provider."""
+    from aria_code.apps.cli.google_login import FIREBASE_WEB_API_KEY
+
+    request = urllib.request.Request(
+        f"https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key={FIREBASE_WEB_API_KEY}",
+        data=json.dumps({"email": email, "password": password, "returnSecureToken": True}).encode(),
+        headers={"Content-Type": "application/json"},
+        method="POST",
+    )
+    with urllib.request.urlopen(request, timeout=15) as response:
+        result = json.loads(response.read())
+    token, uid = result.get("idToken"), result.get("localId")
+    if not token or claims_for(token).get("sub") != uid:
+        raise ValueError("Missing Firebase identity")
+    return {
+        "auth_token": token,
+        "user_id": uid,
+        "refresh_token": result.get("refreshToken"),
+        "email": result.get("email"),
+        "display_name": result.get("displayName"),
+        "provider": "password",
+    }
+
+
+async def prepare_account(config: dict, save=None) -> str | None:
+    """Refresh credentials, and give memory two seconds before using its cache.
+
+    The fenced sync may finish in the background; a slow memory service must
+    not hold up sending a chat turn. Its status/outbox remains inspectable.
+    """
+    import asyncio
+    from aria_code.account_memory import AccountMemory
+
+    token = await asyncio.to_thread(get_account_token, config, save)
+    try:
+        await asyncio.wait_for(asyncio.shield(asyncio.to_thread(AccountMemory(config, save=save).sync)), timeout=2)
+    except asyncio.TimeoutError:
+        pass
+    return token

{aria_code-0.163.0 → aria_code-0.165.0}/src/aria_code/adk_apps/aria_code_review/agent.py

@@ -12,7 +12,7 @@ from aria_code.packages.adk_bridge import CodeReviewTools
 _tools = CodeReviewTools()
 
 root_agent = Agent(
-    model=os.getenv("ARIA_ADK_MODEL", "gemini-3.5-flash"),
+    model=os.getenv("ARIA_ADK_MODEL", "gemini-3.8-flash"),
     name="aria_code_review",
     description="A read-only code reviewer for user-submitted source text.",
     instruction="""You are Aria Code Review, a careful software reviewer.

{aria_code-0.163.0 → aria_code-0.165.0}/src/aria_code/adk_apps/aria_research/agent.py

@@ -12,7 +12,7 @@ from aria_code.packages.adk_bridge import MarketResearchTools
 _tools = MarketResearchTools()
 
 root_agent = Agent(
-    model=os.getenv("ARIA_ADK_MODEL", "gemini-3.5-flash"),
+    model=os.getenv("ARIA_ADK_MODEL", "gemini-3.8-flash"),
     name="aria_research",
     description="A read-only market-research assistant for Aria Code and Arthera.",
     instruction="""You are Aria Research, a careful financial-research assistant.

aria_code-0.165.0/src/aria_code/agents/__init__.py

@@ -0,0 +1,49 @@
+"""
+agents/ — Aria Code 可组合多智能体系统
+=======================================
+用户可在项目根放置 aria_agents/ 目录，其中的 Agent 类自动被发现。
+
+内置 Agent:
+  macro       → 宏观环境、利率、行业周期
+  fundamental → 财务指标、估值、竞争壁垒
+  technical   → 图形形态、动量、关键价位
+  risk        → 风险评分、仓位建议
+  synthesis   → 汇总以上，输出可操作建议
+
+自定义 Agent 示例 (aria_agents/northbound_agent.py):
+    from agents.base import BaseAgent, AgentResult
+
+    class NorthboundAgent(BaseAgent):
+        name        = "northbound"
+        description = "北向资金分析专家"
+
+        async def analyze(self, symbol: str, data: dict) -> AgentResult:
+            ...
+"""
+
+# Keep the public analysis-agent API, without eager registration of every domain.
+# Task-agent capabilities must not initialize finance/vendor SDKs on import.
+from importlib import import_module
+
+_EXPORTS = {
+    "BaseAgent": (".base", "BaseAgent"), "AgentResult": (".base", "AgentResult"),
+    "AgentRegistry": (".registry", "AgentRegistry"), "get_registry": (".registry", "get_registry"),
+    "AgentTeam": (".team", "AgentTeam"), "run_team": (".team", "run_team"),
+    "SignalScheme": (".signal_scheme", "SignalScheme"),
+    "FINANCIAL_SCHEME": (".signal_scheme", "FINANCIAL_SCHEME"),
+    "REALTY_SCHEME": (".signal_scheme", "REALTY_SCHEME"),
+}
+__all__ = list(_EXPORTS)
+
+
+def __getattr__(name):
+    if name not in _EXPORTS:
+        raise AttributeError(name)
+    module, attribute = _EXPORTS[name]
+    value = getattr(import_module(module, __name__), attribute)
+    globals()[name] = value
+    return value
+
+
+def __dir__():
+    return sorted(set(globals()) | set(__all__))