@wrenai/genbi 0.0.1

package/dist/assets/index-Xs4q7pNo.css

@@ -0,0 +1 @@
+.xterm{cursor:text;-webkit-user-select:none;user-select:none;position:relative}.xterm.focus,.xterm:focus{outline:none}.xterm .xterm-helpers{z-index:5;position:absolute;top:0}.xterm .xterm-helper-textarea{opacity:0;z-index:-5;white-space:nowrap;resize:none;border:0;width:0;height:0;margin:0;padding:0;position:absolute;top:0;left:-9999em;overflow:hidden}.xterm .composition-view{color:#fff;white-space:nowrap;z-index:1;background:#000;display:none;position:absolute}.xterm .composition-view.active{display:block}.xterm .xterm-viewport{cursor:default;background-color:#000;position:absolute;inset:0;overflow-y:scroll}.xterm .xterm-screen{position:relative}.xterm .xterm-screen canvas{position:absolute;top:0;left:0}.xterm-char-measure-element{visibility:hidden;line-height:normal;display:inline-block;position:absolute;top:0;left:-9999em}.xterm.enable-mouse-events{cursor:default}.xterm.xterm-cursor-pointer,.xterm .xterm-cursor-pointer{cursor:pointer}.xterm.column-select.focus{cursor:crosshair}.xterm .xterm-accessibility:not(.debug),.xterm .xterm-message{z-index:10;color:#0000;pointer-events:none;position:absolute;inset:0}.xterm .xterm-accessibility-tree:not(.debug) ::selection{color:#0000}.xterm .xterm-accessibility-tree{-webkit-user-select:text;user-select:text;white-space:pre;font-family:monospace}.xterm .xterm-accessibility-tree>div{transform-origin:0;width:fit-content}.xterm .live-region{width:1px;height:1px;position:absolute;left:-9999px;overflow:hidden}.xterm-dim{opacity:1!important}.xterm-underline-1{text-decoration:underline}.xterm-underline-2{-webkit-text-decoration:underline double;text-decoration:underline double}.xterm-underline-3{-webkit-text-decoration:underline wavy;text-decoration:underline wavy}.xterm-underline-4{-webkit-text-decoration:underline dotted;text-decoration:underline dotted}.xterm-underline-5{-webkit-text-decoration:underline dashed;text-decoration:underline dashed}.xterm-overline{text-decoration:overline}.xterm-overline.xterm-underline-1{text-decoration:underline overline}.xterm-overline.xterm-underline-2{-webkit-text-decoration:overline double underline;text-decoration:overline double underline}.xterm-overline.xterm-underline-3{-webkit-text-decoration:overline wavy underline;text-decoration:overline wavy underline}.xterm-overline.xterm-underline-4{-webkit-text-decoration:overline dotted underline;text-decoration:overline dotted underline}.xterm-overline.xterm-underline-5{-webkit-text-decoration:overline dashed underline;text-decoration:overline dashed underline}.xterm-strikethrough{text-decoration:line-through}.xterm-screen .xterm-decoration-container .xterm-decoration{z-index:6;position:absolute}.xterm-screen .xterm-decoration-container .xterm-decoration.xterm-decoration-top-layer{z-index:7}.xterm-decoration-overview-ruler{z-index:8;pointer-events:none;position:absolute;top:0;right:0}.xterm-decoration-top{z-index:2;position:relative}.xterm .xterm-scrollable-element>.scrollbar{cursor:default}.xterm .xterm-scrollable-element>.scrollbar>.scra{cursor:pointer;font-size:11px!important}.xterm .xterm-scrollable-element>.visible{opacity:1;z-index:11;background:0 0;transition:opacity .1s linear}.xterm .xterm-scrollable-element>.invisible{opacity:0;pointer-events:none}.xterm .xterm-scrollable-element>.invisible.fade{transition:opacity .8s linear}.xterm .xterm-scrollable-element>.shadow{display:none;position:absolute}.xterm .xterm-scrollable-element>.shadow.top{width:100%;height:3px;box-shadow:var(--vscode-scrollbar-shadow,#000) 0 6px 6px -6px inset;display:block;top:0;left:3px}.xterm .xterm-scrollable-element>.shadow.left{width:3px;height:100%;box-shadow:var(--vscode-scrollbar-shadow,#000) 6px 0 6px -6px inset;display:block;top:3px;left:0}.xterm .xterm-scrollable-element>.shadow.top-left-corner{width:3px;height:3px;display:block;top:0;left:0}.xterm .xterm-scrollable-element>.shadow.top.left{box-shadow:var(--vscode-scrollbar-shadow,#000) 6px 0 6px -6px inset}.sessions-workbench{background:var(--ant-color-bg-container);flex-direction:column;height:100%;min-height:0;display:flex}.sessions-toolbar{border-bottom:1px solid var(--ant-color-border-secondary);background:var(--ant-color-bg-container);align-items:center;gap:10px;min-height:42px;padding:6px 12px;display:flex}.sessions-toolbar-title{flex:1;align-items:baseline;gap:8px;min-width:0;display:flex}.sessions-toolbar-title strong{white-space:nowrap;text-overflow:ellipsis;overflow:hidden}.sessions-toolbar-title span{color:var(--ant-color-text-tertiary);white-space:nowrap;text-overflow:ellipsis;font-size:12px;overflow:hidden}.sessions-toolbar-actions{gap:4px;display:flex}.sessions-toolbar-error{color:var(--ant-color-error);font-size:12px}.sessions-terminal-wrap{box-sizing:border-box;flex:1;min-height:0;padding:12px;position:relative;overflow:hidden}.sessions-terminal{outline:none;height:100%}.sessions-terminal .xterm{height:100%}.sessions-terminal .xterm-viewport{scrollbar-color:var(--ant-color-border) transparent;scrollbar-width:thin}.sessions-terminal .xterm:focus-within{outline:2px solid var(--ant-color-primary);outline-offset:-2px}.sessions-terminal-message{z-index:1;border:1px solid var(--ant-color-border-secondary);background:var(--ant-color-bg-elevated);max-width:340px;color:var(--ant-color-text-secondary);border-radius:4px;padding:6px 8px;font-size:12px;position:absolute;top:12px;right:12px}.sessions-terminal-state,.sessions-empty{flex:1;place-items:center;min-height:0;padding:24px;display:grid}.sessions-empty{text-align:center;color:var(--ant-color-text-secondary);align-content:center}.sessions-empty h1{color:var(--ant-color-text);margin:0}.sessions-sidebar{flex-direction:column;min-width:0;height:100%;display:flex;overflow:hidden auto}.sessions-sidebar-new{min-width:0;padding:12px 8px 4px}.sessions-sidebar-group{min-width:0;padding:12px 8px 0}.sessions-sidebar-heading{letter-spacing:.06em;text-transform:uppercase;padding:0 8px 6px;font-size:11px;display:block}.sessions-sidebar-item{box-sizing:border-box;width:100%;min-width:0;color:inherit;text-align:left;cursor:pointer;background:0 0;border:0;border-radius:6px;padding:7px 8px}.sessions-sidebar-item:hover,.sessions-sidebar-item.is-selected{background:var(--ant-color-fill-secondary)}.sessions-sidebar-item:focus-visible{outline:2px solid var(--ant-color-primary);outline-offset:-2px}.sessions-sidebar-title{overflow-wrap:anywhere;-webkit-line-clamp:2;-webkit-box-orient:vertical;min-width:0;font-size:13px;line-height:1.35;display:-webkit-box;overflow:hidden}.sessions-sidebar-title-row{align-items:start;gap:6px;display:flex}.sessions-sidebar-purpose{overflow-wrap:anywhere;-webkit-line-clamp:2;-webkit-box-orient:vertical;flex:auto;min-width:0;display:-webkit-box;overflow:hidden}.sessions-sidebar-id{color:var(--ant-color-text-tertiary);font-family:var(--ant-font-family-code);white-space:nowrap;flex:none;font-size:11px;line-height:1.6}.sessions-sidebar-meta{min-width:0;color:var(--ant-color-text-tertiary);flex-wrap:wrap;gap:0 5px;font-size:11px;line-height:1.4;display:flex}.sessions-sidebar-meta>span+span:before{content:"·";margin-right:5px}.sessions-sidebar-state{color:var(--ant-color-text-tertiary);padding:12px 16px;font-size:11px;line-height:1.45}.sessions-new-popover{max-width:calc(100vw - 16px)}.sessions-new-popover .ant-popover-content{box-sizing:border-box;width:min(220px,100vw - 16px);max-width:100%}.sessions-new-menu{flex-direction:column;gap:10px;width:100%;min-width:0;display:flex;overflow-x:hidden}.sessions-new-menu section,.sessions-new-menu .ant-space{min-width:0}.sessions-new-menu section{flex-direction:column;gap:6px;display:flex}.sessions-new-menu .ant-typography{overflow-wrap:anywhere}.sessions-new-menu .ant-btn{white-space:normal;text-align:left;justify-content:flex-start;width:100%;height:auto;min-height:32px;line-height:1.35}.sessions-new-menu .ant-btn>span{overflow-wrap:anywhere;min-width:0}.sessions-workbench.is-compact .sessions-toolbar{gap:6px;padding-inline:8px}.sessions-workbench.is-compact .sessions-toolbar-title span{display:none}.sessions-workbench.is-compact .sessions-terminal-wrap{padding:8px}.sessions-workbench.is-compact .sessions-toolbar-actions .ant-btn{padding-inline:6px}.genbi-page{box-sizing:border-box;width:100%;margin:0 auto;padding:24px 26px 40px}.genbi-page-head{align-items:flex-start;gap:12px;margin-bottom:16px;display:flex}.genbi-page-head-text{flex:1;min-width:0}.genbi-page-title.ant-typography{margin:0!important}.genbi-page-lead{max-width:64ch;color:var(--ant-color-text-tertiary);margin:4px 0 0;font-size:13.5px;line-height:1.5}.genbi-page-actions{flex:none;align-items:center;gap:8px;margin-left:auto;display:flex}.genbi-page-body{flex-direction:column;gap:16px;min-width:0;display:flex}.genbi-artifacts-list{min-width:0;margin:0;padding:8px 0;list-style:none}.genbi-arow{width:100%;min-width:0;font:inherit;color:var(--ant-color-text-secondary);text-align:left;cursor:pointer;border-radius:var(--ant-border-radius-sm);background:0 0;border:0;grid-template-columns:auto minmax(0,1fr);align-items:start;gap:8px;padding:7px 12px;font-size:13px;line-height:1.4;display:grid}.genbi-arow:hover{background:var(--genbi-surface-2)}.genbi-arow:focus-visible{outline:2px solid var(--ant-color-primary);outline-offset:-2px}.genbi-arow.is-sel{background:color-mix(in srgb, var(--ant-color-primary) 12%, transparent);color:var(--ant-color-primary);font-weight:500}.genbi-arow.is-sel .genbi-aicon{color:var(--ant-color-primary)}.genbi-aicon{color:var(--ant-color-text-tertiary);grid-row:1/span 2;align-items:center;margin-top:3px;font-size:14px;display:inline-flex}.genbi-atext{flex-direction:column;gap:2px;min-width:0;display:flex}.genbi-aname{overflow-wrap:anywhere;-webkit-line-clamp:2;-webkit-box-orient:vertical;min-width:0;line-height:1.35;display:-webkit-box;overflow:hidden}.genbi-abadges{flex-wrap:wrap;grid-column:2;align-items:center;gap:4px;min-width:0;display:flex}.genbi-canvas-er{border:1px solid var(--ant-color-border-secondary);border-radius:var(--ant-border-radius);box-shadow:var(--ant-box-shadow-tertiary);background:radial-gradient(circle at 1px 1px, var(--ant-color-border-secondary) 1px, transparent 0) 0 0 / 22px 22px, var(--ant-color-bg-container);position:relative;overflow:auto}.genbi-er-inner{position:relative}.genbi-er-edges{position:absolute;inset:0}.genbi-er-edges path{fill:none;stroke:var(--ant-color-border);stroke-width:1.5px}.genbi-er-edges circle{fill:var(--ant-color-link)}.genbi-er-edges text{fill:var(--ant-color-text-tertiary);font-size:10px}.genbi-er-edges.is-impact path.is-active{stroke:var(--ant-color-primary);stroke-width:2px}.genbi-er-edges.is-impact circle.is-active{fill:var(--ant-color-primary)}.genbi-mnode{background:var(--ant-color-bg-container);border:1px solid var(--ant-color-border);box-shadow:var(--ant-box-shadow-tertiary);font:inherit;text-align:left;color:inherit;border-radius:9px;margin:0;padding:0;position:absolute;overflow:hidden}.genbi-mnode.is-interactive{cursor:pointer}.genbi-mnode.is-interactive:hover{border-color:var(--ant-color-primary)}.genbi-mnode.is-interactive:focus-visible{outline:2px solid var(--ant-color-primary);outline-offset:2px}.genbi-mnode .genbi-mh{background:var(--genbi-surface-2);border-bottom:1px solid var(--ant-color-border-secondary);color:var(--ant-color-text);align-items:center;gap:6px;padding:8px 10px;font-size:12px;font-weight:600;display:flex}.genbi-mnode .genbi-cnt{color:var(--ant-color-text-tertiary);margin-left:auto;font-size:11px;font-weight:400}.genbi-mnode ul{margin:0;padding:0;list-style:none}.genbi-mnode li{font-family:var(--ant-font-family-code);border-top:1px solid var(--ant-color-border-secondary);align-items:center;gap:6px;padding:4px 10px;font-size:11px;display:flex}.genbi-mnode li:first-child{border-top:none}.genbi-mnode .genbi-fn{color:var(--ant-color-text-secondary);text-overflow:ellipsis;white-space:nowrap;overflow:hidden}.genbi-mnode .genbi-ft{color:var(--ant-color-text-tertiary);margin-left:auto}.genbi-mnode .genbi-key{border-radius:4px;flex:none;padding:0 5px;font-size:10px;font-weight:700;line-height:16px}.genbi-mnode .genbi-key-pk{background:color-mix(in srgb, var(--ant-color-primary) 16%, transparent);color:var(--ant-color-primary-active)}.genbi-mnode .genbi-key-fk{background:color-mix(in srgb, var(--ant-color-link) 16%, transparent);color:var(--ant-color-link)}.genbi-mnode.is-selected{outline:2px solid var(--ant-color-primary);outline-offset:1px;box-shadow:0 0 0 4px color-mix(in srgb, var(--ant-color-primary) 16%, transparent)}.genbi-mnode.is-affected{outline:2px solid color-mix(in srgb, var(--ant-color-warning) 72%, transparent);outline-offset:1px}.genbi-mdl-wrap{flex-direction:column;gap:16px;display:flex}.genbi-project-identity{align-items:baseline;gap:10px;font-size:13px;display:flex}.genbi-project-name{color:var(--ant-color-text);font-size:15px;font-weight:600}.genbi-project-path{color:var(--ant-color-text-secondary)}.genbi-project-path code{font-family:var(--ant-font-family-code);font-size:12px}.genbi-project-path-unbound{color:var(--ant-color-text-tertiary);font-style:italic}.genbi-mdl-toolbar{border:1px solid var(--ant-color-border-secondary);border-radius:var(--ant-border-radius);background:var(--ant-color-bg-container);color:var(--ant-color-text-secondary);align-items:center;gap:10px;padding:8px 12px;font-size:13px;display:flex}.genbi-mdl-stat b{color:var(--ant-color-text)}.genbi-mdl-stat-sep{color:var(--ant-color-border)}.genbi-mdl-layout{grid-template-columns:minmax(0,1fr) 296px;align-items:start;gap:16px;display:grid}@media (width<=900px){.genbi-mdl-layout{grid-template-columns:1fr}}.genbi-mdl-side{flex-direction:column;gap:14px;min-width:0;display:flex}.genbi-measure{border-top:1px solid var(--ant-color-border-secondary);align-items:flex-start;gap:8px;padding:8px 0;display:flex}.genbi-measure:first-child{border-top:none;padding-top:0}.genbi-mtxt{flex:1;min-width:0}.genbi-mname{color:var(--ant-color-text);font-size:13px;font-weight:600}.genbi-mexpr{font-family:var(--ant-font-family-code);color:var(--ant-color-text-tertiary);text-overflow:ellipsis;white-space:nowrap;margin-top:2px;font-size:11px;overflow:hidden}.genbi-measure-actions{flex-direction:column;flex:none;align-items:flex-end;gap:2px;display:flex}.genbi-relrow{border-top:1px solid var(--ant-color-border-secondary);justify-content:space-between;align-items:center;gap:8px;padding:6px 0;font-size:12px;display:flex}.genbi-relrow:first-child{border-top:none;padding-top:0}.genbi-relname{text-overflow:ellipsis;white-space:nowrap;min-width:0;overflow:hidden}.genbi-kstat{gap:20px;display:flex}.genbi-kstat-item .genbi-num{color:var(--ant-color-text);font-size:22px;font-weight:700;line-height:1.2}.genbi-kstat-item .genbi-lbl{color:var(--ant-color-text-tertiary);font-size:11px}.genbi-num-muted{color:var(--ant-color-text-tertiary);font-size:13px;font-style:italic;font-weight:400}.genbi-outscope{flex-direction:column;gap:8px;display:flex}.genbi-filetree{min-width:0;padding:10px 0}.genbi-rail-proj{border-bottom:1px solid var(--ant-color-border-secondary);min-width:0;color:var(--ant-color-text);align-items:center;gap:8px;margin-bottom:4px;padding:2px 12px 10px;font-size:13px;font-weight:600;display:flex}.genbi-rail-proj .genbi-tname{text-overflow:ellipsis;white-space:nowrap;flex:1;min-width:0;overflow:hidden}.genbi-ttree,.genbi-tchildren{min-width:0;margin:0;padding:0;list-style:none}.genbi-trow{width:100%;min-width:0;font:inherit;color:var(--ant-color-text-secondary);text-align:left;cursor:pointer;border-radius:var(--ant-border-radius-sm);background:0 0;border:0;align-items:center;gap:7px;padding:5px 12px;font-size:13px;line-height:1.4;display:flex}.genbi-trow:hover{background:var(--genbi-surface-2)}.genbi-trow:focus-visible{outline:2px solid var(--ant-color-primary);outline-offset:-2px}.genbi-tdirhdr{color:var(--ant-color-text);font-weight:500}.genbi-tfile.is-sel{background:color-mix(in srgb, var(--ant-color-primary) 12%, transparent);color:var(--ant-color-primary);font-weight:500}.genbi-tfile.is-sel .genbi-fi{color:var(--ant-color-primary)}.genbi-chev{color:var(--ant-color-text-tertiary);flex:none;align-items:center;font-size:10px;transition:transform .15s;display:inline-flex}.genbi-chev.is-open{transform:rotate(90deg)}.genbi-fi{color:var(--ant-color-text-tertiary);flex:none;align-items:center;font-size:14px;display:inline-flex}.genbi-tname{text-overflow:ellipsis;white-space:nowrap;flex:1;min-width:0;overflow:hidden}.harness-execution-path{grid-template-columns:repeat(auto-fit,minmax(150px,1fr));gap:12px;margin-bottom:8px;display:grid}.harness-execution-path>div{flex-direction:column;gap:2px;min-width:0;display:flex}.harness-execution-path strong{overflow-wrap:anywhere}.harness-diagnostic-grid{grid-template-columns:repeat(2,minmax(0,1fr));gap:24px;display:grid}@media (width<=640px){.harness-execution-path,.harness-diagnostic-grid{grid-template-columns:1fr;gap:8px}}html,body,#root{height:100%;margin:0}body{font-family:var(--ant-font-family);overflow:hidden}.ant-tag{border-radius:999px}.ant-table-thead>tr>th{text-transform:uppercase;letter-spacing:.04em;font-size:11px;font-weight:600}

package/dist/index.html

@@ -0,0 +1,14 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <link rel="icon" type="image/png" href="/wrenai_logo.png" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>GenBI</title>
+    <script type="module" crossorigin src="/assets/index-Bo--QMUN.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-Xs4q7pNo.css">
+  </head>
+  <body>
+    <div id="root"></div>
+  </body>
+</html>

package/dist-server/harness/auth/detect.d.ts

@@ -0,0 +1,18 @@
+import type { LoginProbe } from "./probe.js";
+import type { AuthChoice, AuthOption } from "./types.js";
+/**
+ * Enumerate the credential options available right now. A `subscription`
+ * entry for a given provider only appears when `probe` reports that
+ * provider's CLI as detected and logged in; `api-key`, `local`, and
+ * `gateway` are always offered. This only reports availability — it does
+ * not route requests through any option and does not apply any
+ * compliance/policy judgment on top of the raw signal (later milestones).
+ */
+export declare function detectAndPick(probe: LoginProbe): Promise<AuthOption[]>;
+/**
+ * Turn a selected `AuthOption` into an `AuthChoice`. `api-key`/`gateway`
+ * fields beyond `mode` are left as minimal placeholders — the routing layer
+ * (a later milestone) is responsible for filling in the concrete
+ * adapter/config.
+ */
+export declare function toAuthChoice(option: AuthOption): AuthChoice;

package/dist-server/harness/auth/detect.js

@@ -0,0 +1,37 @@
+/**
+ * Enumerate the credential options available right now. A `subscription`
+ * entry for a given provider only appears when `probe` reports that
+ * provider's CLI as detected and logged in; `api-key`, `local`, and
+ * `gateway` are always offered. This only reports availability — it does
+ * not route requests through any option and does not apply any
+ * compliance/policy judgment on top of the raw signal (later milestones).
+ */
+export async function detectAndPick(probe) {
+    const options = [];
+    if (await probe.claudeLoggedIn()) {
+        options.push({ mode: "subscription", provider: "claude" });
+    }
+    if (await probe.codexLoggedIn()) {
+        options.push({ mode: "subscription", provider: "codex" });
+    }
+    options.push({ mode: "api-key" }, { mode: "local" }, { mode: "gateway" });
+    return options;
+}
+/**
+ * Turn a selected `AuthOption` into an `AuthChoice`. `api-key`/`gateway`
+ * fields beyond `mode` are left as minimal placeholders — the routing layer
+ * (a later milestone) is responsible for filling in the concrete
+ * adapter/config.
+ */
+export function toAuthChoice(option) {
+    switch (option.mode) {
+        case "subscription":
+            return { mode: "subscription", provider: option.provider };
+        case "api-key":
+            return { mode: "api-key", adapter: "" };
+        case "local":
+            return { mode: "local" };
+        case "gateway":
+            return { mode: "gateway" };
+    }
+}

package/dist-server/harness/auth/index.d.ts

@@ -0,0 +1,4 @@
+export type { ApiKeyAuthChoice, AuthChoice, AuthOption, GatewayAuthChoice, LocalAuthChoice, SubscriptionAuthChoice, } from "./types.js";
+export { createDefaultLoginProbe } from "./probe.js";
+export type { LoginProbe } from "./probe.js";
+export { detectAndPick, toAuthChoice } from "./detect.js";

package/dist-server/harness/auth/index.js

@@ -0,0 +1,2 @@
+export { createDefaultLoginProbe } from "./probe.js";
+export { detectAndPick, toAuthChoice } from "./detect.js";

package/dist-server/harness/auth/probe.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Injectable "is this CLI usable right now" check for `detectAndPick`. Kept
+ * as an interface — rather than baked directly into `detectAndPick` — so
+ * tests can inject a mock and stay fully offline, never touching `PATH` or
+ * the filesystem.
+ */
+export interface LoginProbe {
+    claudeLoggedIn(): boolean | Promise<boolean>;
+    codexLoggedIn(): boolean | Promise<boolean>;
+}
+/**
+ * Real default `LoginProbe`. Best-effort and side-effect-light: it only
+ * resolves the CLI binary on `PATH` and checks whether a credential/config
+ * file exists next to it — it never invokes `claude`/`codex` and never
+ * makes a network call. Production callers use this; tests should inject a
+ * mock `LoginProbe` instead.
+ */
+export declare function createDefaultLoginProbe(): LoginProbe;

package/dist-server/harness/auth/probe.js

@@ -0,0 +1,52 @@
+import { accessSync, constants as fsConstants, existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { delimiter, join } from "node:path";
+const WINDOWS_EXECUTABLE_EXTENSIONS = [".exe", ".cmd", ".bat"];
+/** Best-effort, side-effect-light check that `binaryName` resolves on `PATH`. Never invokes the binary. */
+function resolvesOnPath(binaryName) {
+    const pathEnv = process.env.PATH ?? "";
+    const candidateNames = process.platform === "win32"
+        ? [binaryName, ...WINDOWS_EXECUTABLE_EXTENSIONS.map((ext) => `${binaryName}${ext}`)]
+        : [binaryName];
+    for (const dir of pathEnv.split(delimiter)) {
+        if (!dir)
+            continue;
+        for (const name of candidateNames) {
+            try {
+                accessSync(join(dir, name), fsConstants.X_OK);
+                return true;
+            }
+            catch {
+                // not in this directory — keep looking
+            }
+        }
+    }
+    return false;
+}
+/** Cheap "has this CLI ever logged in" signal: does its credential/config file exist? Never reads its contents. */
+function hasCredentialFile(relativePathFromHome) {
+    return existsSync(join(homedir(), relativePathFromHome));
+}
+/** Existence-only Codex login signal, honoring an explicitly isolated CODEX_HOME. */
+function hasCodexCredentialFile() {
+    const configuredHome = process.env.CODEX_HOME?.trim();
+    const codexHome = configuredHome ? configuredHome : join(homedir(), ".codex");
+    return existsSync(join(codexHome, "auth.json"));
+}
+/**
+ * Real default `LoginProbe`. Best-effort and side-effect-light: it only
+ * resolves the CLI binary on `PATH` and checks whether a credential/config
+ * file exists next to it — it never invokes `claude`/`codex` and never
+ * makes a network call. Production callers use this; tests should inject a
+ * mock `LoginProbe` instead.
+ */
+export function createDefaultLoginProbe() {
+    return {
+        claudeLoggedIn() {
+            return resolvesOnPath("claude") && hasCredentialFile(".claude.json");
+        },
+        codexLoggedIn() {
+            return resolvesOnPath("codex") && hasCodexCredentialFile();
+        },
+    };
+}

package/dist-server/harness/auth/types.d.ts

@@ -0,0 +1,42 @@
+/**
+ * The four credential modes an operator can pick between when a harness
+ * needs to talk to a model provider. This module only *models* the choice
+ * and enumerates which options are available (offline, from an injected
+ * `LoginProbe`) — it does not route requests through any of them (that's a
+ * later milestone) and does not apply any compliance/policy judgment on top
+ * of the raw availability signal.
+ */
+/** Reuse an existing CLI subscription session (e.g. an already-`claude login`'d shell). */
+export interface SubscriptionAuthChoice {
+    readonly mode: "subscription";
+    readonly provider: "claude" | "codex";
+}
+/** Call a provider directly with an API key. Adapter/config shape is filled in by routing (later milestone). */
+export interface ApiKeyAuthChoice {
+    readonly mode: "api-key";
+    readonly adapter: string;
+    readonly config?: Readonly<Record<string, unknown>>;
+}
+/** Talk to a model served on the local machine/network (e.g. Ollama). */
+export interface LocalAuthChoice {
+    readonly mode: "local";
+    readonly endpoint?: string;
+}
+/** Route through an operator-managed gateway. Config shape is filled in by routing (later milestone). */
+export interface GatewayAuthChoice {
+    readonly mode: "gateway";
+    readonly config?: Readonly<Record<string, unknown>>;
+}
+/** The full set of credential choices as an explicit, exhaustive union. */
+export type AuthChoice = SubscriptionAuthChoice | ApiKeyAuthChoice | LocalAuthChoice | GatewayAuthChoice;
+/** One entry in the menu `detectAndPick` enumerates: a mode plus whatever's needed to build its `AuthChoice`. */
+export type AuthOption = {
+    readonly mode: "subscription";
+    readonly provider: "claude" | "codex";
+} | {
+    readonly mode: "api-key";
+} | {
+    readonly mode: "local";
+} | {
+    readonly mode: "gateway";
+};

package/dist-server/harness/auth/types.js

@@ -0,0 +1,9 @@
+/**
+ * The four credential modes an operator can pick between when a harness
+ * needs to talk to a model provider. This module only *models* the choice
+ * and enumerates which options are available (offline, from an injected
+ * `LoginProbe`) — it does not route requests through any of them (that's a
+ * later milestone) and does not apply any compliance/policy judgment on top
+ * of the raw availability signal.
+ */
+export {};

package/dist-server/harness/bundle/loader.d.ts

@@ -0,0 +1,32 @@
+import { type Bundle } from "./schema.js";
+import { type HarnessSupport } from "./version.js";
+export declare class BundleValidationError extends Error {
+    constructor(message: string);
+}
+export declare function loadBundle(json: unknown, support?: HarnessSupport): Bundle;
+/**
+ * Which on-disk checkout actually produced (or would consume) a bundle — the piece a bare
+ * {@link BundleCompatError} is missing. `resolveWarbleBinary` (`harness/compile/resolve-binary.ts`)
+ * and `resolveDefaultProfileSource`/`resolveDefaultSetupIrPath` (`harness/route/profile-source.ts`)
+ * each walk this package's ancestor directories independently looking for a sibling `warble`
+ * checkout; nothing stops them from picking two DIFFERENT ones (a stale `warble` earlier on `PATH`
+ * while the profile/IR sibling-walk still finds a fresh checkout, or vice versa), and when that
+ * happens the resulting version mismatch is real IR-version friction, not a bug in the mismatch
+ * detection itself — but the bare error names neither side's checkout, so diagnosing it means
+ * reading `resolve-binary.ts`/`profile-source.ts` source to even know there's an ancestor walk to
+ * suspect. See {@link loadBundleWithProvenance}.
+ */
+export interface BundleProvenance {
+    /** The resolved `warble` binary path that compiled/dispatched this bundle, if known. */
+    readonly warbleBin?: string;
+    /** The resolved profile directory or pre-committed IR file this bundle was produced from, if known. */
+    readonly profileSource?: string;
+}
+/**
+ * {@link loadBundle}, but on a {@link BundleCompatError} names which on-disk checkout(s) produced
+ * the bundle before rethrowing — the fix for the "which warble checkout did this even come from"
+ * gap described on {@link BundleProvenance}. Every other error (malformed structure, unknown bundle
+ * format version) passes through unchanged: provenance only helps once you already know it's a
+ * version problem.
+ */
+export declare function loadBundleWithProvenance(json: unknown, provenance: BundleProvenance, support?: HarnessSupport): Bundle;

package/dist-server/harness/bundle/loader.js

@@ -0,0 +1,43 @@
+import { bundleSchema } from "./schema.js";
+import { assertCompat, BundleCompatError } from "./version.js";
+export class BundleValidationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "BundleValidationError";
+    }
+}
+export function loadBundle(json, support) {
+    const result = bundleSchema.safeParse(json);
+    if (!result.success) {
+        const issues = result.error.issues
+            .map((issue) => `  - ${issue.path.join(".") || "<root>"}: ${issue.message}`)
+            .join("\n");
+        throw new BundleValidationError(`invalid bundle structure:\n${issues}`);
+    }
+    assertCompat(result.data, support);
+    return result.data;
+}
+/**
+ * {@link loadBundle}, but on a {@link BundleCompatError} names which on-disk checkout(s) produced
+ * the bundle before rethrowing — the fix for the "which warble checkout did this even come from"
+ * gap described on {@link BundleProvenance}. Every other error (malformed structure, unknown bundle
+ * format version) passes through unchanged: provenance only helps once you already know it's a
+ * version problem.
+ */
+export function loadBundleWithProvenance(json, provenance, support) {
+    try {
+        return loadBundle(json, support);
+    }
+    catch (error) {
+        if (error instanceof BundleCompatError) {
+            const resolved = [
+                provenance.warbleBin !== undefined ? `warble binary resolved from "${provenance.warbleBin}"` : undefined,
+                provenance.profileSource !== undefined ? `profile/IR source resolved from "${provenance.profileSource}"` : undefined,
+            ].filter((part) => part !== undefined);
+            if (resolved.length > 0) {
+                throw new BundleCompatError(`${error.message} (${resolved.join("; ")})`);
+            }
+        }
+        throw error;
+    }
+}

package/dist-server/harness/bundle/schema.d.ts

@@ -0,0 +1,199 @@
+import { z } from "zod";
+declare const stepRealizationSchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        independent: "independent";
+        repair_fold: "repair_fold";
+    }>;
+    fold_into: z.ZodOptional<z.ZodString>;
+    max_attempts: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+declare const stepGuardSchema: z.ZodObject<{
+    guard: z.ZodString;
+    target: z.ZodString;
+}, z.core.$strip>;
+declare const stepSchema: z.ZodObject<{
+    name: z.ZodString;
+    tier: z.ZodString;
+    consumes: z.ZodArray<z.ZodString>;
+    produces: z.ZodString;
+    prompt: z.ZodString;
+    realization: z.ZodObject<{
+        kind: z.ZodEnum<{
+            independent: "independent";
+            repair_fold: "repair_fold";
+        }>;
+        fold_into: z.ZodOptional<z.ZodString>;
+        max_attempts: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>;
+    when: z.ZodOptional<z.ZodObject<{
+        guard: z.ZodString;
+        target: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+declare const guardrailSchema: z.ZodObject<{
+    enforcement: z.ZodString;
+    locked: z.ZodBoolean;
+    threshold: z.ZodOptional<z.ZodNumber>;
+    scope: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const toolSchema: z.ZodObject<{
+    name: z.ZodString;
+    source: z.ZodString;
+}, z.core.$strip>;
+declare const capabilitySchema: z.ZodObject<{
+    capability: z.ZodString;
+    outcome: z.ZodString;
+    provided_by: z.ZodString;
+    criticality: z.ZodString;
+}, z.core.$strip>;
+declare const outputSchemaSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+declare const agentSchema: z.ZodUnion<readonly [z.ZodObject<{
+    id: z.ZodString;
+    verb: z.ZodString;
+    component_type: z.ZodString;
+    realization_kind: z.ZodString;
+    trigger: z.ZodString;
+    outcome: z.ZodString;
+    steps: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        tier: z.ZodString;
+        consumes: z.ZodArray<z.ZodString>;
+        produces: z.ZodString;
+        prompt: z.ZodString;
+        realization: z.ZodObject<{
+            kind: z.ZodEnum<{
+                independent: "independent";
+                repair_fold: "repair_fold";
+            }>;
+            fold_into: z.ZodOptional<z.ZodString>;
+            max_attempts: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>;
+        when: z.ZodOptional<z.ZodObject<{
+            guard: z.ZodString;
+            target: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    guardrails: z.ZodRecord<z.ZodString, z.ZodObject<{
+        enforcement: z.ZodString;
+        locked: z.ZodBoolean;
+        threshold: z.ZodOptional<z.ZodNumber>;
+        scope: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    tools: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        source: z.ZodString;
+    }, z.core.$strip>>;
+    output_schema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    capabilities: z.ZodArray<z.ZodObject<{
+        capability: z.ZodString;
+        outcome: z.ZodString;
+        provided_by: z.ZodString;
+        criticality: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strict>, z.ZodObject<{
+    id: z.ZodString;
+    verb: z.ZodString;
+    component_type: z.ZodString;
+    realization_kind: z.ZodString;
+    trigger: z.ZodString;
+    outcome: z.ZodString;
+    steps: z.ZodTuple<[], null>;
+    guardrails: z.ZodObject<{}, z.core.$strict>;
+    tools: z.ZodTuple<[], null>;
+    output_schema: z.ZodObject<{}, z.core.$strict>;
+    capabilities: z.ZodTuple<[], null>;
+    availability: z.ZodObject<{
+        status: z.ZodLiteral<"unavailable">;
+        reason: z.ZodLiteral<"component is unavailable on the configured runtime">;
+    }, z.core.$strict>;
+}, z.core.$strict>]>;
+export declare const bundleSchema: z.ZodObject<{
+    vercel_bundle_version: z.ZodOptional<z.ZodString>;
+    manifest_version: z.ZodOptional<z.ZodString>;
+    compat: z.ZodObject<{
+        min_ir_version: z.ZodString;
+        max_ir_version: z.ZodString;
+    }, z.core.$strip>;
+    profile: z.ZodString;
+    target: z.ZodString;
+    agents: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        id: z.ZodString;
+        verb: z.ZodString;
+        component_type: z.ZodString;
+        realization_kind: z.ZodString;
+        trigger: z.ZodString;
+        outcome: z.ZodString;
+        steps: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            tier: z.ZodString;
+            consumes: z.ZodArray<z.ZodString>;
+            produces: z.ZodString;
+            prompt: z.ZodString;
+            realization: z.ZodObject<{
+                kind: z.ZodEnum<{
+                    independent: "independent";
+                    repair_fold: "repair_fold";
+                }>;
+                fold_into: z.ZodOptional<z.ZodString>;
+                max_attempts: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>;
+            when: z.ZodOptional<z.ZodObject<{
+                guard: z.ZodString;
+                target: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        guardrails: z.ZodRecord<z.ZodString, z.ZodObject<{
+            enforcement: z.ZodString;
+            locked: z.ZodBoolean;
+            threshold: z.ZodOptional<z.ZodNumber>;
+            scope: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        tools: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            source: z.ZodString;
+        }, z.core.$strip>>;
+        output_schema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        capabilities: z.ZodArray<z.ZodObject<{
+            capability: z.ZodString;
+            outcome: z.ZodString;
+            provided_by: z.ZodString;
+            criticality: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strict>, z.ZodObject<{
+        id: z.ZodString;
+        verb: z.ZodString;
+        component_type: z.ZodString;
+        realization_kind: z.ZodString;
+        trigger: z.ZodString;
+        outcome: z.ZodString;
+        steps: z.ZodTuple<[], null>;
+        guardrails: z.ZodObject<{}, z.core.$strict>;
+        tools: z.ZodTuple<[], null>;
+        output_schema: z.ZodObject<{}, z.core.$strict>;
+        capabilities: z.ZodTuple<[], null>;
+        availability: z.ZodObject<{
+            status: z.ZodLiteral<"unavailable">;
+            reason: z.ZodLiteral<"component is unavailable on the configured runtime">;
+        }, z.core.$strict>;
+    }, z.core.$strict>]>>;
+}, z.core.$strip>;
+export type StepRealization = z.infer<typeof stepRealizationSchema>;
+export type StepGuard = z.infer<typeof stepGuardSchema>;
+export type Step = z.infer<typeof stepSchema>;
+export type Guardrail = z.infer<typeof guardrailSchema>;
+export type Tool = z.infer<typeof toolSchema>;
+export type Capability = z.infer<typeof capabilitySchema>;
+export type OutputSchema = z.infer<typeof outputSchemaSchema>;
+export type Agent = z.infer<typeof agentSchema>;
+export type Bundle = z.infer<typeof bundleSchema>;
+/**
+ * A loaded bundle's format-version, regardless of which top-level key it
+ * arrived under (see `bundleSchema`'s doc comment) — the accessor `server/harness.ts`'s
+ * `HarnessProfile.bundleVersion` (and any other "what version is this bundle"
+ * caller) should use instead of reading either field name directly. Never
+ * throws in practice: `bundleSchema`'s `.refine` already guarantees at least
+ * one of the two fields is present on any `Bundle` that made it through
+ * `loadBundle`.
+ */
+export declare function bundleFormatVersion(bundle: Bundle): string;
+export {};

package/dist-server/harness/bundle/schema.js

@@ -0,0 +1,127 @@
+import { z } from "zod";
+const stepRealizationSchema = z.object({
+    kind: z.enum(["independent", "repair_fold"]),
+    fold_into: z.string().optional(),
+    max_attempts: z.number().int().nonnegative().optional(),
+});
+const stepGuardSchema = z.object({
+    guard: z.string(),
+    target: z.string(),
+});
+const stepSchema = z.object({
+    name: z.string(),
+    tier: z.string(),
+    consumes: z.array(z.string()),
+    produces: z.string(),
+    prompt: z.string(),
+    realization: stepRealizationSchema,
+    when: stepGuardSchema.optional(),
+});
+const guardrailSchema = z.object({
+    enforcement: z.string(),
+    locked: z.boolean(),
+    threshold: z.number().optional(),
+    scope: z.string().optional(),
+});
+const toolSchema = z.object({
+    name: z.string(),
+    source: z.string(),
+});
+const capabilitySchema = z.object({
+    capability: z.string(),
+    outcome: z.string(),
+    provided_by: z.string(),
+    criticality: z.string(),
+});
+// output_schema is a nested JSON Schema document. The harness stores it as-is
+// and does not interpret it until a later milestone validates output against it.
+const outputSchemaSchema = z.record(z.string(), z.unknown());
+// Keep these variants strict. In particular, an available component must not
+// silently discard an `availability` marker: doing so would turn a redacted
+// unavailable declaration into an executable-looking component downstream.
+//
+// Strictness has a cost worth naming, because it has already been paid once.
+// IR 0.5 added an optional component-level `brief`, and no key for it is
+// declared below. Warble omits the field entirely while no profile sets one, so
+// nothing fails today — but the first time a profile author writes `brief:` on a
+// component, the next dispatch emits that key, `loadBundle` rejects the bundle,
+// and `GET /api/harness` starts returning 500 for a reason that has nothing to
+// do with the annotation someone just added. That is a deliberate deferral, not
+// an oversight: adding a key for a field nothing populates would be guessing at
+// its shape. Declare it here when a profile first needs it.
+const availableAgentSchema = z.object({
+    id: z.string(),
+    verb: z.string(),
+    component_type: z.string(),
+    realization_kind: z.string(),
+    trigger: z.string(),
+    outcome: z.string(),
+    steps: z.array(stepSchema),
+    guardrails: z.record(z.string(), guardrailSchema),
+    tools: z.array(toolSchema),
+    output_schema: outputSchemaSchema,
+    capabilities: z.array(capabilitySchema),
+}).strict();
+/** Read-only manifest variant for a declared component this target cannot execute. */
+const unavailableAgentSchema = z.object({
+    id: z.string(),
+    verb: z.string(),
+    component_type: z.string(),
+    realization_kind: z.string(),
+    trigger: z.string(),
+    outcome: z.string(),
+    // Fixed empty executable surfaces: display may name the declaration, never
+    // carry an executable step, tool, capability, guardrail, or output contract.
+    steps: z.tuple([]),
+    guardrails: z.object({}).strict(),
+    tools: z.tuple([]),
+    output_schema: z.object({}).strict(),
+    capabilities: z.tuple([]),
+    availability: z.object({
+        status: z.literal("unavailable"),
+        reason: z.literal("component is unavailable on the configured runtime"),
+    }).strict(),
+}).strict();
+// The strict variants make this union a closed discriminator boundary: an
+// `availability` field cannot be stripped by the available branch, and only
+// the unavailable branch accepts the one supported status/reason pair.
+const agentSchema = z.union([availableAgentSchema, unavailableAgentSchema]);
+// The bundle's top-level format-version field is target-dependent: `warble
+// dispatch --target vercel` names it `vercel_bundle_version`, while the
+// claude-agent-sdk dispatcher's `manifest` command (otherwise structurally
+// identical — see its doc comment in `repos/warble/dispatcher/claude-agent-sdk`)
+// names the same field `manifest_version`. Both are accepted here (the
+// `.refine` below requires exactly one to be present) so `loadBundle` works
+// for whichever back-end actually produced the bundle; read the field back
+// through `bundleFormatVersion` rather than either name directly.
+export const bundleSchema = z
+    .object({
+    vercel_bundle_version: z.string().optional(),
+    manifest_version: z.string().optional(),
+    compat: z.object({
+        min_ir_version: z.string(),
+        max_ir_version: z.string(),
+    }),
+    profile: z.string(),
+    target: z.string(),
+    agents: z.array(agentSchema),
+})
+    .refine((bundle) => bundle.vercel_bundle_version !== undefined || bundle.manifest_version !== undefined, {
+    message: 'bundle must include either "vercel_bundle_version" (vercel target) or "manifest_version" (claude-agent-sdk target)',
+});
+/**
+ * A loaded bundle's format-version, regardless of which top-level key it
+ * arrived under (see `bundleSchema`'s doc comment) — the accessor `server/harness.ts`'s
+ * `HarnessProfile.bundleVersion` (and any other "what version is this bundle"
+ * caller) should use instead of reading either field name directly. Never
+ * throws in practice: `bundleSchema`'s `.refine` already guarantees at least
+ * one of the two fields is present on any `Bundle` that made it through
+ * `loadBundle`.
+ */
+export function bundleFormatVersion(bundle) {
+    const version = bundle.vercel_bundle_version ?? bundle.manifest_version;
+    if (version === undefined) {
+        throw new Error("bundle has neither vercel_bundle_version nor manifest_version");
+    }
+    return version;
+}