read‑only
No disk writes. No shell exec. Reads + network allowed. For audits, code reviews, and anything you don’t want mutating state.
- ✓ read_file, ls, rg
- ✓ fetch, browse
- ✗ write, exec, delete
developer hub
Reference, protocols, and patterns for the ARIA platform — skills, hooks, sandbox modes, WireGuard mesh, MCP compatibility, and the channel‑adapter contract powering the gateway.
01 · architecture
02 · hooks
Drop your existing Claude Code hook file at ~/.aria/hooks.json
and it works — same schema. Exit code 2 blocks the action.
// ~/.aria/hooks.json — PreToolUse
{
"hooks": {
"PreToolUse": [{
"matcher": { "tool": "bash", "argMatch": "rm -rf" },
"hooks": [{
"command": "echo 'no.'; exit 2",
"blocking": true
}]
}]
}
}
03 · sandbox
No disk writes. No shell exec. Reads + network allowed. For audits, code reviews, and anything you don’t want mutating state.
Writes confined to cwd. Shell gated by approval. The default for coding sessions.
$PWD/etc, home, …Power‑user. No sandbox. Must be explicit — never a silent default. Pair with hooks for safety.
# three equivalent ways to pick a mode
$ aria --sandbox read-only "review this diff"
$ ARIA_SANDBOX=workspace-write aria
$ echo '{"sandboxMode":"full-access"}' > ~/.aria/config.json
04 · skills
Skills are SKILL.md files with YAML front matter. ARIA finds them across Memoria, clawhub, skills.sh, GitHub, and the web — then ranks via RRF across 5 signals (semantic, keyword, trigger, recency, popularity).
05 · mesh
One token, two machines, encrypted P2P tunnel. Arions delegate across your laptop, homelab, and VM without ever touching someone else’s cloud.
$ aria /invite
🎫 share this token: aria-inv-7fk2...
# on the other machine
$ aria join aria-inv-7fk2...
✓ mesh up · WireGuard handshake 190ms · 10.0.0.3
# delegate across the mesh
$ aria > delegate to @vm1: run the eval suite
06 · gateway
The gateway is a thin router on top of a single ChannelAdapter
contract. Implement the interface, drop your adapter in, and the router
handles session keys, auth policy, chunking, and archival.
interface ChannelAdapter {
platform: "telegram" | "discord" | "imessage" | "whatsapp";
start(): Promise<void>;
stop(): Promise<void>;
incomingMessages(): AsyncIterable<InboundMessage>;
sendMessage(m: OutboundMessage): Promise<{ platformMessageId: string }>;
}
Proprietary product. Free to install and run.