@wrenai/genbi 0.0.4 → 0.0.5

package/dist-server/harness/route/codex-host-query.d.ts

@@ -0,0 +1,52 @@
+import type { ComponentAccess } from "../components/broker.js";
+import { type GovernedErrorClass } from "../components/wren-access.js";
+/**
+ * One query the host executed for a codex:local turn, in the component runner's observation
+ * shape (`input.sql`, `output` carrying a host `query_id`), so the shared grounding predicate
+ * reads it unchanged.
+ */
+export interface HostQueryObservation {
+    readonly tool: "run_sql";
+    readonly input: {
+        readonly sql: string;
+        readonly limit: number;
+    };
+    readonly output: unknown;
+}
+/**
+ * Per-turn bounds. Count, request and per-result bytes reuse the component runner's limits;
+ * the total caps what the host keeps in memory for one turn until its answer is grounded.
+ * Rows default to 1000 like `run_sql`. Like `run_sql`, the host probes one row past the limit to
+ * report truncation; the cap is 9999 so the probe stays within governed-stdio's 10000-row bound.
+ */
+export declare const CODEX_HOST_QUERY_LIMITS: Readonly<{
+    queries: 32;
+    requestBytes: 65536;
+    resultBytes: 1048576;
+    totalResultBytes: number;
+    defaultRows: 1000;
+    maxRows: 9999;
+    timeoutMs: 120000;
+}>;
+/** Error classes the socket may return; the proxy owns the sentence the model sees for each. */
+export type HostQueryErrorClass = GovernedErrorClass | "unauthorized" | "budget_exhausted";
+export interface CodexHostQueryService {
+    /** A 0600 file holding this turn's socket path and token. Its own path carries no secret. */
+    readonly credentialFile: string;
+    /** This turn's recorded observations, in execution order. Empty after `close()`. */
+    observations(): readonly HostQueryObservation[];
+    /** Stops accepting queries, discards observations, closes governed access, removes the credential. */
+    close(): Promise<void>;
+}
+export interface CodexHostQueryServiceOptions {
+    /** Opens governed access for this turn; called at most once, on the first query. */
+    readonly openAccess: (signal: AbortSignal) => Promise<ComponentAccess>;
+    readonly signal?: AbortSignal;
+}
+/**
+ * The host side of codex:local's `run_sql`: a per-turn unix socket in a fresh 0700 directory
+ * that answers only requests carrying this turn's random token. Every query runs through
+ * governed access (`wren governed-stdio`), gets a turn-unique host `query_id`, and is recorded
+ * as an observation of this turn only.
+ */
+export declare function openCodexHostQueryService(options: CodexHostQueryServiceOptions): Promise<CodexHostQueryService>;

package/dist-server/harness/route/codex-host-query.js

@@ -0,0 +1,191 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { createServer } from "node:net";
+import os from "node:os";
+import path from "node:path";
+import { COMPONENT_LIMITS } from "../components/runner.js";
+import { GovernedWrenError } from "../components/wren-access.js";
+/**
+ * Per-turn bounds. Count, request and per-result bytes reuse the component runner's limits;
+ * the total caps what the host keeps in memory for one turn until its answer is grounded.
+ * Rows default to 1000 like `run_sql`. Like `run_sql`, the host probes one row past the limit to
+ * report truncation; the cap is 9999 so the probe stays within governed-stdio's 10000-row bound.
+ */
+export const CODEX_HOST_QUERY_LIMITS = Object.freeze({
+    queries: COMPONENT_LIMITS.calls,
+    requestBytes: COMPONENT_LIMITS.requestBytes,
+    resultBytes: COMPONENT_LIMITS.resultBytes,
+    totalResultBytes: 8 * COMPONENT_LIMITS.resultBytes,
+    defaultRows: 1000,
+    maxRows: 9_999,
+    timeoutMs: COMPONENT_LIMITS.timeoutMs,
+});
+function requestFrame(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return undefined;
+    const record = value;
+    if (typeof record.id !== "number" || !Number.isSafeInteger(record.id))
+        return undefined;
+    return { token: record.token, id: record.id, sql: record.sql, limit: record.limit };
+}
+/**
+ * The host side of codex:local's `run_sql`: a per-turn unix socket in a fresh 0700 directory
+ * that answers only requests carrying this turn's random token. Every query runs through
+ * governed access (`wren governed-stdio`), gets a turn-unique host `query_id`, and is recorded
+ * as an observation of this turn only.
+ */
+export async function openCodexHostQueryService(options) {
+    if (process.platform === "win32")
+        throw new Error("codex:local host query service requires unix sockets");
+    const directory = await mkdtemp(path.join(os.tmpdir(), "genbi-hq-"));
+    const token = Buffer.from(randomBytes(32).toString("base64url"), "utf8");
+    const turnTag = randomBytes(4).toString("hex");
+    const socketPath = path.join(directory, "s");
+    const credentialFile = path.join(directory, "credential.json");
+    const controller = new AbortController();
+    const signal = options.signal ? AbortSignal.any([options.signal, controller.signal]) : controller.signal;
+    const recorded = [];
+    const sockets = new Set();
+    let attempts = 0;
+    let recordedBytes = 0;
+    let closed = false;
+    let access;
+    const authorized = (candidate) => {
+        if (typeof candidate !== "string")
+            return false;
+        const presented = Buffer.from(candidate, "utf8");
+        return presented.length === token.length && timingSafeEqual(presented, token);
+    };
+    const execute = async (sql, limit) => {
+        if (closed || signal.aborted)
+            return { error: "transport" };
+        if (typeof sql !== "string" || !sql.trim() || Buffer.byteLength(sql) > CODEX_HOST_QUERY_LIMITS.requestBytes)
+            return { error: "invalid_request" };
+        if (limit !== undefined && limit !== null && (typeof limit !== "number" || !Number.isInteger(limit) || limit < 1))
+            return { error: "invalid_request" };
+        if (attempts >= CODEX_HOST_QUERY_LIMITS.queries)
+            return { error: "budget_exhausted" };
+        attempts += 1;
+        const rows = Math.min(CODEX_HOST_QUERY_LIMITS.maxRows, typeof limit === "number" ? limit : CODEX_HOST_QUERY_LIMITS.defaultRows);
+        let result;
+        try {
+            access ??= options.openAccess(signal);
+            const governed = await access;
+            result = await governed.query({ sql, limit: rows + 1 }, AbortSignal.any([signal, AbortSignal.timeout(CODEX_HOST_QUERY_LIMITS.timeoutMs)]));
+        }
+        catch (error) {
+            return { error: error instanceof GovernedWrenError ? error.errorClass : "transport" };
+        }
+        if (closed)
+            return { error: "transport" };
+        if (typeof result !== "object" || result === null || Array.isArray(result))
+            return { error: "internal" };
+        const probed = result.rows;
+        if (!Array.isArray(probed))
+            return { error: "internal" };
+        // The N+1 probe, as plain `run_sql` reports it: more rows than asked means the shown rows
+        // are not the whole result. Only `rows` rows are returned and recorded.
+        const truncated = probed.length > rows;
+        const shown = truncated ? probed.slice(0, rows) : probed;
+        // The id is assigned here, once, so the observation and the model's copy carry the same id. The
+        // tag makes ids unique per turn: an id copied from an earlier turn never names this turn's query.
+        const output = { ...result, rows: shown, row_count: shown.length, truncated, query_id: `q${attempts}-${turnTag}` };
+        const bytes = Buffer.byteLength(JSON.stringify(output));
+        if (bytes > CODEX_HOST_QUERY_LIMITS.resultBytes)
+            return { error: "result_too_large" };
+        if (recordedBytes + bytes > CODEX_HOST_QUERY_LIMITS.totalResultBytes)
+            return { error: "budget_exhausted" };
+        recordedBytes += bytes;
+        recorded.push(Object.freeze({ tool: "run_sql", input: Object.freeze({ sql, limit: rows }), output: structuredClone(output) }));
+        return { result: output };
+    };
+    const serve = (socket) => {
+        if (closed) {
+            socket.destroy();
+            return;
+        }
+        sockets.add(socket);
+        socket.on("close", () => sockets.delete(socket));
+        socket.on("error", () => socket.destroy());
+        let buffer = "";
+        let tail = Promise.resolve();
+        socket.setEncoding("utf8");
+        socket.on("data", (chunk) => {
+            buffer += chunk;
+            if (buffer.length > 2 * CODEX_HOST_QUERY_LIMITS.requestBytes) {
+                socket.destroy();
+                return;
+            }
+            let newline = buffer.indexOf("\n");
+            while (newline >= 0) {
+                const line = buffer.slice(0, newline);
+                buffer = buffer.slice(newline + 1);
+                newline = buffer.indexOf("\n");
+                let frame;
+                try {
+                    frame = requestFrame(JSON.parse(line));
+                }
+                catch {
+                    frame = undefined;
+                }
+                if (!frame) {
+                    socket.destroy();
+                    return;
+                }
+                const { id, sql, limit } = frame;
+                if (!authorized(frame.token)) {
+                    socket.end(`${JSON.stringify({ id, error: { class: "unauthorized" } })}\n`);
+                    return;
+                }
+                tail = tail.then(async () => {
+                    const outcome = await execute(sql, limit);
+                    if (socket.destroyed)
+                        return;
+                    socket.write(`${JSON.stringify("result" in outcome ? { id, result: outcome.result } : { id, error: { class: outcome.error } })}\n`);
+                }).catch(() => { socket.destroy(); });
+            }
+        });
+    };
+    const server = createServer(serve);
+    try {
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(socketPath, () => { server.off("error", reject); resolve(); });
+        });
+        await chmod(socketPath, 0o600);
+        await writeFile(credentialFile, JSON.stringify({ socket: socketPath, token: token.toString("utf8") }), { encoding: "utf8", mode: 0o600, flag: "wx" });
+    }
+    catch (error) {
+        server.close();
+        await rm(directory, { recursive: true, force: true });
+        throw error;
+    }
+    let closing;
+    const close = () => {
+        closing ??= (async () => {
+            closed = true;
+            recorded.length = 0;
+            controller.abort();
+            for (const socket of sockets)
+                socket.destroy();
+            await new Promise((resolve) => server.close(() => resolve()));
+            try {
+                if (access)
+                    await (await access).close();
+            }
+            catch {
+                // Access that never opened, or already closed, has nothing left to release.
+            }
+            finally {
+                await rm(directory, { recursive: true, force: true });
+            }
+        })();
+        return closing;
+    };
+    options.signal?.addEventListener("abort", () => { void close(); }, { once: true });
+    return {
+        credentialFile,
+        observations: () => Object.freeze([...recorded]),
+        close,
+    };
+}

package/dist-server/harness/route/codex-local-manifest.d.ts

@@ -9,10 +9,18 @@ export declare const CODEX_ASK_COMPONENTS: readonly ["answer_query", "generate_d
 export type CodexAskComponent = (typeof CODEX_ASK_COMPONENTS)[number];
 export declare const CODEX_ENRICH_COMPONENTS: readonly ["inspect_context", "draft_enrichment"];
 export type CodexManifestPurpose = "analysis" | "setup" | "context_enrichment";
+export declare function codexAnalysisToolArgs(component: CodexAskComponent): string[];
 export declare function buildCodexAskManifestArgs(cli: ResolvedCli, irPath: string, models: CodexManifestModels, component?: CodexAskComponent): readonly string[];
 export declare function buildCodexBootstrapManifestArgs(cli: ResolvedCli, irPath: string): readonly string[];
 export declare function buildCodexEnrichmentManifestArgs(cli: ResolvedCli, irPath: string, models: CodexManifestModels, component: (typeof CODEX_ENRICH_COMPONENTS)[number]): readonly string[];
-export declare function describeCodexAskManifest(cli: ResolvedCli, irPath: string, models: CodexManifestModels): Promise<Bundle>;
+export declare function describeCodexAskManifest(cli: ResolvedCli, irPath: string, models: CodexManifestModels, context?: CodexManifestContext): Promise<Bundle>;
+export interface CodexManifestContext {
+    readonly warbleBin: string;
+    readonly contexts: Readonly<Record<string, {
+        readonly binding: unknown;
+        readonly snapshot: unknown;
+    }>>;
+}
 /**
  * Setup is a raw/bootstrap profile, not an Ask profile. Its dispatcher has a
  * dedicated whole-profile `manifest` command that neither needs nor accepts a

package/dist-server/harness/route/codex-local-manifest.js

@@ -1,8 +1,21 @@
 import { execFile } from "node:child_process";
-import { readFile } from "node:fs/promises";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { planDigest } from "../components/plan.js";
 import { loadBundle } from "../bundle/loader.js";
 export const CODEX_ASK_COMPONENTS = ["answer_query", "generate_dashboard"];
 export const CODEX_ENRICH_COMPONENTS = ["inspect_context", "draft_enrichment"];
+export function codexAnalysisToolArgs(component) {
+    const bindings = component === "answer_query"
+        ? ["generate_sql=run_sql", "repair_sql=run_sql"]
+        : ["plan_dashboard=get_context", "compose_layout=run_sql"];
+    const required = component === "answer_query"
+        ? ["generate_sql", "repair_sql"]
+        : ["plan_dashboard", "compose_layout"];
+    return ["--transport", "orchestrate", ...bindings.flatMap((binding) => ["--step-tool", binding]),
+        ...required.flatMap((step) => ["--require-tool", step])];
+}
 export function buildCodexAskManifestArgs(cli, irPath, models, component = "answer_query") {
     return [
         ...cli.prefixArgs,
@@ -20,10 +33,7 @@ export function buildCodexAskManifestArgs(cli, irPath, models, component = "answ
         // spawn it; the runtime binds the real Wren MCP command separately.
         "--server-command",
         process.execPath,
-        "--inspect-tool",
-        "get_context",
-        "--query-tool",
-        "run_sql",
+        ...codexAnalysisToolArgs(component),
     ];
 }
 export function buildCodexBootstrapManifestArgs(cli, irPath) {
@@ -33,10 +43,11 @@ export function buildCodexBootstrapManifestArgs(cli, irPath) {
         irPath,
         "--server-command",
         process.execPath,
-        "--source-tool",
-        "setup_execution",
-        "--context-tool",
-        "setup_execution",
+        "--transport", "exec",
+        "--step-tool", "connect=setup_execution",
+        "--step-tool", "build=setup_execution",
+        "--require-tool", "connect",
+        "--require-tool", "build",
     ];
 }
 export function buildCodexEnrichmentManifestArgs(cli, irPath, models, component) {
@@ -50,10 +61,9 @@ export function buildCodexEnrichmentManifestArgs(cli, irPath, models, component)
         component === "inspect_context" ? models.cheap : models.strong,
         "--server-command",
         process.execPath,
-        "--semantic-tool",
-        "get_context",
-        "--raw-material-tool",
-        "get_context",
+        "--transport", "turn",
+        "--step-tool", `${component === "inspect_context" ? "inspect" : "draft"}=get_context`,
+        "--require-tool", component === "inspect_context" ? "inspect" : "draft",
     ];
 }
 async function describeCodexComponentManifests(cli, irPath, components, argsFor) {
@@ -73,9 +83,80 @@ async function describeCodexComponentManifests(cli, irPath, components, argsFor)
     }
     return loadBundle({ ...primary, agents: bundles.flatMap((bundle) => bundle.agents) });
 }
-export async function describeCodexAskManifest(cli, irPath, models) {
+export async function describeCodexAskManifest(cli, irPath, models, context) {
+    const ir = JSON.parse(await readFile(irPath, "utf8"));
+    if (records(ir.components).some((node) => records(node.llm_calls).some((step) => records(step.component_calls).length))) {
+        if (!context)
+            throw new Error("Codex composed manifest requires component-owned prepared context");
+        return describeComposedCodexManifest(cli, irPath, ir, models, context);
+    }
     return describeCodexComponentManifests(cli, irPath, CODEX_ASK_COMPONENTS, (component) => buildCodexAskManifestArgs(cli, irPath, models, component));
 }
+async function describeComposedCodexManifest(cli, irPath, ir, models, context) {
+    const dir = await mkdtemp(path.join(os.tmpdir(), "genbi-codex-manifest-"));
+    try {
+        const bindings = Object.fromEntries(CODEX_ASK_COMPONENTS.map((id) => {
+            const node = records(ir.components).find((component) => component.id === id);
+            const prepared = context.contexts[id];
+            if (!node || !prepared || planDigest(prepared.binding) !== planDigest(node.context_binding)) {
+                throw new Error(`Codex manifest context binding mismatch for ${id}`);
+            }
+            // Display preparation never launches this MCP command. Tools remain owned
+            // by the answer component; the dashboard only receives its call alias.
+            return [id, { transport: "orchestrate", models, context: JSON.stringify(prepared.snapshot), mcp: {
+                        name: "wren", command: process.execPath,
+                        toolsByStep: id === "answer_query" ? { resolve_intent: [], generate_sql: ["run_sql"], repair_sql: ["run_sql"] }
+                            : { plan_dashboard: [], compose_layout: [] },
+                        requireTool: id === "answer_query" ? ["generate_sql", "repair_sql"] : [],
+                    } }];
+        }));
+        const file = path.join(dir, "bindings.json");
+        await writeFile(file, JSON.stringify({ components: bindings }), { mode: 0o600 });
+        const bundles = [];
+        for (const id of CODEX_ASK_COMPONENTS) {
+            const manifest = JSON.parse(await execCodexManifest(cli.command, [...cli.prefixArgs, "manifest", irPath,
+                "--component", id, "--transport", "orchestrate", "--component-bindings", file, "--warble-bin", context.warbleBin]));
+            if (manifest.version !== "0.3" || manifest.target !== "codex:local" || manifest.profile !== ir.profile || manifest.entry !== id || manifest.transport !== "orchestrate") {
+                throw new Error("Unexpected composed Codex manifest identity");
+            }
+            const nodes = records(manifest.components);
+            const expectedIds = id === "answer_query" ? [id] : [...CODEX_ASK_COMPONENTS];
+            if (nodes.length !== expectedIds.length || new Set(nodes.map((node) => node.id)).size !== nodes.length || nodes.some((node) => !expectedIds.includes(String(node.id)))) {
+                throw new Error("Unexpected composed Codex manifest closure");
+            }
+            for (const node of nodes) {
+                const source = records(ir.components).find((candidate) => candidate.id === node.id);
+                const emitted = records(node.steps);
+                const declared = records(source.llm_calls);
+                if (emitted.length !== declared.length)
+                    throw new Error("Unexpected composed Codex manifest steps");
+                for (let index = 0; index < declared.length; index++) {
+                    const step = declared[index];
+                    const actual = emitted[index];
+                    const aliases = Object.fromEntries(records(step.component_calls).map((edge) => [String(edge.alias), edge.component]));
+                    const tools = bindings[String(node.id)].mcp.toolsByStep[String(step.name)] ?? [];
+                    if (actual.name !== step.name || planDigest(actual.componentCalls) !== planDigest(aliases) || planDigest(actual.enabledTools) !== planDigest(tools)) {
+                        throw new Error("Unexpected composed Codex manifest tool authority");
+                    }
+                }
+            }
+            const entries = records(manifest.components).filter((node) => node.role === "entry");
+            if (entries.length !== 1 || entries[0].id !== id)
+                throw new Error("Unexpected composed Codex manifest entry");
+            const entry = entries[0];
+            const steps = records(entry.steps);
+            bundles.push(normalizeCodexManifest({ manifest_version: "0.1", target: manifest.target, profile: manifest.profile,
+                compat: { min_ir_version: ir.warble_ir_version, max_ir_version: ir.warble_ir_version },
+                agents: [{ ...entry, steps: steps.map((step) => ({ name: step.name })),
+                        tools: [...new Set(steps.flatMap((step) => Array.isArray(step.enabledTools) ? step.enabledTools.map(String) : []))].map((name) => ({ name, source: "mcp:wren" })) }],
+            }, ir));
+        }
+        return loadBundle({ ...bundles[0], agents: bundles.flatMap((bundle) => bundle.agents) });
+    }
+    finally {
+        await rm(dir, { recursive: true, force: true });
+    }
+}
 /**
  * Setup is a raw/bootstrap profile, not an Ask profile. Its dispatcher has a
  * dedicated whole-profile `manifest` command that neither needs nor accepts a
@@ -130,7 +211,7 @@ function normalizeCodexManifest(manifest, ir) {
                 return {
                     name,
                     tier: String(step["tier"] ?? source["tier"] ?? "strong"),
-                    consumes: Array.isArray(step["consumes"]) ? step["consumes"].map(String) : [],
+                    consumes: Array.isArray(step["consumes"]) ? step["consumes"].map(String) : Array.isArray(source["consumes"]) ? source["consumes"].map(String) : [],
                     produces: String(step["produces"] ?? source["produces"] ?? "result"),
                     prompt: String(source["prompt"] ?? ""),
                     realization: when

package/dist-server/harness/route/codex-wren-proxy.d.ts

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+import { type Socket } from "node:net";
+export interface Credential {
+    readonly socket: string;
+    readonly token: string;
+}
+export interface HostOutcome {
+    readonly result?: unknown;
+    readonly error?: string;
+}
+/**
+ * Accepts only an absolute, regular, user-owned file no one else can read or write. The file is
+ * opened without following a symlink and checked and read through that one descriptor, so what
+ * is checked is what is read.
+ */
+export declare function readCredential(file: string | undefined): Credential | undefined;
+/**
+ * One connection at a time to the turn's host query service, reconnecting after a drop. Only
+ * the current socket's failure fails the pending requests (all of which were sent on it): a
+ * stale socket closing late never fails a request pending on its replacement. Each socket has
+ * its own read buffer.
+ */
+export declare class HostConnection {
+    private readonly credential;
+    private readonly open;
+    private readonly pending;
+    private socket;
+    private nextId;
+    constructor(credential: Credential, open?: (socketPath: string) => Socket);
+    request(sql: string, limit: number | undefined): Promise<HostOutcome>;
+    close(): void;
+    private current;
+}