aria-code 0.72.0__tar.gz → 0.73.0__tar.gz

{aria_code-0.72.0/src/aria_code.egg-info → aria_code-0.73.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aria-code
-Version: 0.72.0
+Version: 0.73.0
 Summary: Open-source AI agent for logistics and finance work: numbers you can check, client data kept apart, actions a person approves
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/artheras/aria-code

{aria_code-0.72.0 → aria_code-0.73.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "aria-code"
-version = "0.72.0"
+version = "0.73.0"
 description = "Open-source AI agent for logistics and finance work: numbers you can check, client data kept apart, actions a person approves"
 readme = "README.md"
 license = { text = "Apache-2.0" }

{aria_code-0.72.0 → aria_code-0.73.0}/src/aria_code/_version.py

@@ -17,4 +17,4 @@ from __future__ import annotations
 
 __all__ = ["__version__"]
 
-__version__ = "0.72.0"
+__version__ = "0.73.0"

{aria_code-0.72.0 → aria_code-0.73.0}/src/aria_code/apps/cli/hooks.py

@@ -170,7 +170,7 @@ def create_example_hooks(path: Path) -> None:
         return
     path.parent.mkdir(parents=True, exist_ok=True)
     example = {
-        "_comment": "Aria Code hooks — https://aria.code/docs/hooks",
+        "_comment": "Aria Code hooks — schema: https://github.com/artheras/aria-code/blob/main/src/aria_code/apps/cli/hooks.py",
         "PreToolUse": [],
         "PostToolUse": [],
         "ResponseDone": [],

{aria_code-0.72.0 → aria_code-0.73.0}/src/aria_code/aria_cli.py

@@ -6067,17 +6067,6 @@ class ArtheraTerminal:
         """Run the interactive REPL loop."""
         self.print_header()
         await self._startup_health_check()
-        try:
-            from ui.banner import render_session_banner
-            render_session_banner(
-                self.session_id,
-                console=console,
-                has_rich=HAS_RICH,
-                lang=self.config.get("ui_lang", "en") or "en",
-                web_url=self.config.get("web_url", "https://arthera.finance"),
-            )
-        except Exception:
-            pass
 
         # Background: settle pending market calls (>24h) vs live prices so the
         # prediction track record + DPO signals accrue with zero user effort.

{aria_code-0.72.0 → aria_code-0.73.0}/src/aria_code/clients/aria_relay_client.py

@@ -10,7 +10,7 @@ aria_relay_client.py — 连接 Aria 中继服务器的 WebSocket 客户端
   python3 aria_relay_client.py --once       # 调试：收到第一条消息后退出
 
 所需环境变量（读取 ~/.aria/.env）:
-  ARIA_RELAY_URL        wss://relay.aria.ai（或自建服务器地址）
+  ARIA_RELAY_URL        中继地址，配置向导默认填 Arthera 运营的中继（见 OFFICIAL_RELAY_URL）
   ARIA_RELAY_CLIENT_ID  setup_wizard 生成的 12 位 hex id
 """
 
@@ -92,7 +92,44 @@ def ensure_credentials(env_file: Path = Path.home() / ".aria" / ".env") -> tuple
     return token, code
 
 
-_RELAY_URL = os.environ.get("ARIA_RELAY_URL", "wss://relay.aria.ai")
+# The relay Arthera runs. Offered as the setup wizard's default, never used as
+# a silent fallback.
+OFFICIAL_RELAY_URL = "wss://aria-code-741336310848.europe-west2.run.app/ws"
+
+# The default used to be wss://relay.aria.ai. aria.ai belongs to an unrelated
+# party (registered 2017); the subdomain does not resolve today, but its owner
+# could create it at any time, and every client left on the default would then
+# send its machine token, bind code and Feishu traffic there. Anyone who ran
+# the wizard before 2026-10-04 has it saved in ~/.aria/.env, so it is refused
+# by name, not merely no longer suggested.
+_UNOWNED_RELAY_HOSTS = {"relay.aria.ai"}
+
+
+def relay_url_problem(url: str) -> str:
+    """"" when the client may connect to `url`, otherwise why not."""
+    from urllib.parse import urlparse
+
+    if not url:
+        return "ARIA_RELAY_URL is not set — run the setup wizard (relay mode) to configure it"
+    parsed = urlparse(url)
+    host = (parsed.hostname or "").lower()
+    if host in _UNOWNED_RELAY_HOSTS or host.endswith(".aria.ai") or host == "aria.ai":
+        return (f"{host} is not run by Arthera; run the setup wizard again to switch to "
+                f"{OFFICIAL_RELAY_URL}")
+    if parsed.scheme == "wss" and host:
+        return ""
+    if parsed.scheme == "ws" and host in ("localhost", "127.0.0.1", "::1"):
+        return ""
+    return "ARIA_RELAY_URL must be wss:// — this machine's token is sent when it connects (ws:// only to localhost)"
+
+
+def default_relay_url(current: str) -> str:
+    """What the setup wizard offers: the saved URL, unless it is unusable."""
+    current = (current or "").strip()
+    return current if current and not relay_url_problem(current) else OFFICIAL_RELAY_URL
+
+
+_RELAY_URL = os.environ.get("ARIA_RELAY_URL", "").strip()
 _CLIENT_ID = os.environ.get("ARIA_RELAY_CLIENT_ID", "")
 _RECONNECT_DELAY_MAX = 60   # seconds
 _RECONNECT_DELAY_BASE = 3
@@ -191,6 +228,11 @@ async def _connect_and_serve(once: bool = False) -> None:
         logger.error("websockets package not installed — run: pip install websockets")
         sys.exit(1)
 
+    problem = relay_url_problem(_RELAY_URL)
+    if problem:
+        logger.error("Not connecting to the relay: %s", problem)
+        sys.exit(1)
+
     if not _CLIENT_ID:
         logger.error(
             "ARIA_RELAY_CLIENT_ID is not set. "

{aria_code-0.72.0 → aria_code-0.73.0}/src/aria_code/setup_wizard.py

@@ -371,8 +371,11 @@ def setup_feishu(env: dict[str, str]) -> None:
 
 def _setup_feishu_relay(env: dict[str, str]) -> None:
     """Connect via Aria Relay Server — no Feishu developer account needed."""
-    relay_url = env.get("ARIA_RELAY_URL", "wss://relay.aria.ai")
-    relay_url = _ask("中继服务器地址", default=relay_url)
+    from aria_code.clients.aria_relay_client import default_relay_url, relay_url_problem
+    relay_url = _ask("中继服务器地址", default=default_relay_url(env.get("ARIA_RELAY_URL", "")))
+    while relay_url_problem(relay_url):
+        print(f"  ✗ {relay_url_problem(relay_url)}")
+        relay_url = _ask("中继服务器地址", default=default_relay_url(""))
     env["ARIA_RELAY_URL"] = relay_url
     env["ARIA_RELAY_MODE"] = "relay"
 

{aria_code-0.72.0 → aria_code-0.73.0}/src/aria_code/ui/banner.py

@@ -375,37 +375,6 @@ def render_startup_dashboard(
     console.print(Panel(body, title=panel_title, title_align="left", box=panel_box, border_style=border_style, padding=(0, 1)))
 
 
-def render_session_banner(
-    session_id: str,
-    *,
-    console,
-    has_rich: bool,
-    lang: str = "en",
-    web_url: str = "https://arthera.finance",
-) -> None:
-    """Render the 'Keep working from anywhere' card with session sync link."""
-    is_zh = lang.lower().startswith("zh")
-    title = "随时随地继续工作" if is_zh else "Keep working from anywhere"
-    line1 = (
-        f"在网页端、移动 App 或飞书中查看或回复此会话："
-        if is_zh else
-        f"Check progress or reply to any session from mobile app, desktop app, or"
-    )
-    line2 = f"{web_url}/sessions/{session_id}"
-    line3 = "仅在本终端保留请运行 /remote-control" if is_zh else "To keep session in this terminal only, run /remote-control"
-
-    if has_rich:
-        console.print(f"[dim]│[/dim] [bold]{title}[/bold]")
-        console.print(f"[dim]│[/dim] [dim]{line1}[/dim]")
-        console.print(f"[dim]│[/dim] [underline]{line2}[/underline]. [dim]{line3}[/dim]")
-        console.print()
-    else:
-        print(f"| {title}")
-        print(f"| {line1}")
-        print(f"| {line2}. {line3}")
-        print()
-
-
 def render_compact_banner(
     *,
     version: str,

{aria_code-0.72.0 → aria_code-0.73.0/src/aria_code.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aria-code
-Version: 0.72.0
+Version: 0.73.0
 Summary: Open-source AI agent for logistics and finance work: numbers you can check, client data kept apart, actions a person approves
 License: Apache-2.0
 Project-URL: Homepage, https://github.com/artheras/aria-code

{aria_code-0.72.0 → aria_code-0.73.0}/src/aria_code.egg-info/SOURCES.txt

@@ -573,6 +573,7 @@ tests/test_google_cloud_routing.py
 tests/test_google_login.py
 tests/test_google_search_provider.py
 tests/test_headless_is_agentic.py
+tests/test_honest_surfaces.py
 tests/test_image_gen_tools.py
 tests/test_image_inputs.py
 tests/test_import_graph_budget.py
@@ -640,6 +641,7 @@ tests/test_relay_client_credentials.py
 tests/test_relay_event_verification.py
 tests/test_relay_sends_for_clients.py
 tests/test_relay_store.py
+tests/test_relay_url.py
 tests/test_release_chain.py
 tests/test_release_commit_identity.py
 tests/test_release_push_is_atomic.py

aria_code-0.73.0/tests/test_honest_surfaces.py

@@ -0,0 +1,76 @@
+"""What Aria shows users and where it sends them must be true and ours.
+
+Found in one sweep of every hardcoded host (2026-10-04):
+
+- Every interactive session opened with "Keep working from anywhere — check
+  progress or reply to any session from mobile app, desktop app, or
+  https://arthera.finance/sessions/<id>. To keep session in this terminal only,
+  run /remote-control". Sessions are stored only locally (session_jsonl.py),
+  the page is the site's catch-all (identical for any id), there is no mobile
+  app, and /remote-control does not exist.
+- The source installer switched to third-party package and Python mirrors on
+  any failed download, without asking, and fetched Python through ghfast.top,
+  a public GitHub proxy whose operator is unknown.
+- hooks.json's comment linked to https://aria.code/docs/hooks, which cannot
+  resolve (.code is not a top-level domain).
+- scripts/generate_demo_video.py rendered the same session-sync claim, on
+  arthera.ai — a domain no one has registered — plus "100% local-first,
+  zero telemetry", which the default cloud model contradicts. Nothing used it.
+"""
+
+from __future__ import annotations
+
+import json
+import pathlib
+import re
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+SRC = ROOT / "src" / "aria_code"
+
+
+def _source_files():
+    return sorted(SRC.rglob("*.py"))
+
+
+class TestNoFeatureThatDoesNotExist:
+    def test_no_session_sync_is_advertised(self):
+        offending = [str(p.relative_to(ROOT)) for p in _source_files()
+                     if re.search(r"Keep working from anywhere|随时随地继续工作|render_session_banner",
+                                  p.read_text(encoding="utf-8"))]
+        assert not offending, offending
+
+    def test_no_command_is_advertised_unless_it_is_registered(self):
+        cli = (SRC / "aria_cli.py").read_text(encoding="utf-8")
+        for path in _source_files():
+            for command in set(re.findall(r"/remote-control\b", path.read_text(encoding="utf-8"))):
+                assert f'"{command}"' in cli, f"{path.relative_to(ROOT)} tells users to run {command}"
+
+    def test_the_fake_demo_generator_is_gone(self):
+        assert not (ROOT / "scripts" / "generate_demo_video.py").exists()
+
+
+class TestTheSourceInstallerAsksBeforeUsingMirrors:
+    TEXT = (ROOT / "install.sh").read_text(encoding="utf-8")
+
+    def test_mirrors_only_when_the_user_opts_in(self):
+        calls = [line.strip() for line in self.TEXT.splitlines()
+                 if "enable_cn_mirror" in line and not line.strip().startswith(("#", "enable_cn_mirror()"))]
+        assert calls == ['[[ "$ARIA_CN" == "1" ]] && enable_cn_mirror'], calls
+
+    def test_failures_suggest_the_mirror_instead_of_switching(self):
+        assert self.TEXT.count("re-run with ARIA_CN=1") == 2
+
+    def test_python_builds_do_not_come_through_an_unknown_proxy(self):
+        mirror = re.search(r'^CN_PY_REPO="([^"]+)"', self.TEXT, re.M).group(1)
+        assert mirror == "https://registry.npmmirror.com/-/binary/python-build-standalone"
+        assert "ghfast" not in self.TEXT.replace("came through ghfast.top before", "")
+
+
+def test_the_hooks_example_links_somewhere_real(tmp_path):
+    from aria_code.apps.cli import hooks
+
+    target = tmp_path / "hooks.json"
+    hooks.create_example_hooks(target)
+    comment = json.loads(target.read_text(encoding="utf-8"))["_comment"]
+    assert "https://github.com/artheras/aria-code/" in comment
+    assert "aria.code/" not in comment

aria_code-0.73.0/tests/test_relay_url.py

@@ -0,0 +1,75 @@
+"""The relay client must only ever connect where the user chose — never to a default it does not own.
+
+The client, the setup wizard and docker-compose all defaulted to
+wss://relay.aria.ai. aria.ai belongs to an unrelated party; the subdomain does
+not resolve today, but its owner could create it, and every client left on
+the default would send its machine token, bind code and Feishu traffic there.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import pathlib
+from unittest import mock
+
+import pytest
+
+from aria_code.clients import aria_relay_client as client
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+
+
+class TestWhereTheClientMayConnect:
+    @pytest.mark.parametrize("url", [
+        client.OFFICIAL_RELAY_URL,
+        "wss://relay.example.com/ws",       # a self-hosted relay
+        "ws://localhost:8765/ws",           # local development
+        "ws://127.0.0.1:8765/ws",
+    ])
+    def test_allowed(self, url):
+        assert client.relay_url_problem(url) == ""
+
+    @pytest.mark.parametrize("url, why", [
+        ("", "not set"),
+        ("wss://relay.aria.ai", "not run by Arthera"),
+        ("wss://anything.aria.ai/ws", "not run by Arthera"),
+        ("ws://relay.example.com/ws", "wss://"),      # the token would travel in clear
+        ("https://relay.example.com/ws", "wss://"),
+    ])
+    def test_refused(self, url, why):
+        assert why in client.relay_url_problem(url)
+
+    def test_the_client_refuses_before_opening_a_connection(self, monkeypatch):
+        monkeypatch.setattr(client, "_RELAY_URL", "wss://relay.aria.ai")
+        monkeypatch.setattr(client, "_CLIENT_ID", "aria-x")
+        connect = mock.Mock(side_effect=AssertionError("must not connect"))
+        with mock.patch("websockets.connect", connect), pytest.raises(SystemExit):
+            asyncio.run(client._connect_and_serve(once=True))
+        connect.assert_not_called()
+
+
+class TestWhatTheWizardOffers:
+    def test_a_fresh_setup_is_offered_the_official_relay(self):
+        assert client.default_relay_url("") == client.OFFICIAL_RELAY_URL
+
+    def test_a_saved_foreign_default_is_replaced(self):
+        assert client.default_relay_url("wss://relay.aria.ai") == client.OFFICIAL_RELAY_URL
+
+    def test_a_saved_self_hosted_relay_is_kept(self):
+        assert client.default_relay_url("wss://relay.example.com/ws") == "wss://relay.example.com/ws"
+
+
+def test_nothing_still_defaults_to_the_foreign_domain():
+    """The domain may appear only in explanations and the refusal list."""
+    files = [ROOT / "docker-compose.yml", ROOT / ".env.daemon.template",
+             *sorted((ROOT / "src" / "aria_code").rglob("*.py"))]
+    offending = []
+    for path in files:
+        for number, line in enumerate(path.read_text(encoding="utf-8").splitlines(), 1):
+            if "aria.ai" not in line:
+                continue
+            stripped = line.strip()
+            if stripped.startswith("#") or "_UNOWNED_RELAY_HOSTS" in line or "endswith(\".aria.ai\")" in line:
+                continue
+            offending.append(f"{path.relative_to(ROOT)}:{number}: {stripped}")
+    assert not offending, "\n".join(offending)