@wrenai/genbi 0.0.4 → 0.0.5

package/dist-server/harness/route/codex-wren-proxy.js

@@ -0,0 +1,227 @@
+#!/usr/bin/env node
+/**
+ * codex:local's Wren MCP server: a stdio proxy in front of `wren serve mcp`.
+ *
+ *   node codex-wren-proxy.js --credential-file <abs path> -- <wren> serve mcp --project <p> --quiet
+ *
+ * Every JSON-RPC line passes through to the child `wren serve mcp` unchanged, so the model sees
+ * the same tool names and schemas, except a `tools/call` of `run_sql`: that goes to this turn's
+ * host query service (see `codex-host-query.ts`), which executes it through governed access and
+ * records it as host evidence. The credential file (0600, owned by this user) names the turn's
+ * unix socket and token; without a valid one, `run_sql` is refused rather than run elsewhere.
+ *
+ * Node builtins only, and erasable TypeScript only, so it also runs from source.
+ */
+import { spawn } from "node:child_process";
+import { closeSync, constants as fsConstants, fstatSync, openSync, readFileSync, realpathSync } from "node:fs";
+import { connect } from "node:net";
+import path from "node:path";
+import { createInterface } from "node:readline";
+import { fileURLToPath } from "node:url";
+const RUN_SQL = "run_sql";
+const MAX_SQL_BYTES = 65_536;
+/** The sentence the model sees per host error class; nothing from the host's wire is forwarded. */
+const ERROR_TEXT = {
+    invalid_request: "The request did not match the governed run_sql contract: pass a non-empty sql string and an optional positive integer limit.",
+    model_not_found: "The query references a table that is not a model in the bound semantic context; query only the models it defines.",
+    policy_rejected: "The read-only analytical policy rejected the query: use one SELECT that reads at least one bound model.",
+    invalid_sql: "The SQL could not be parsed or planned against the semantic context.",
+    execution_failed: "The data source rejected the query at execution time, for example an unknown column or a type mismatch.",
+    timeout: "The query exceeded the statement time limit.",
+    datasource_unavailable: "The bound data source could not be reached.",
+    result_too_large: "The result exceeded the governed byte limit; narrow the query.",
+    budget_exhausted: "This turn's query budget is exhausted; answer from the results you already have.",
+    unauthorized: "run_sql is unavailable: the host query service rejected this session.",
+    internal: "The governed query failed for an unclassified reason.",
+    transport: "The host query service is unavailable.",
+};
+const NO_CREDENTIAL = "run_sql is unavailable: no valid host query credential was provided for this turn.";
+/**
+ * Accepts only an absolute, regular, user-owned file no one else can read or write. The file is
+ * opened without following a symlink and checked and read through that one descriptor, so what
+ * is checked is what is read.
+ */
+export function readCredential(file) {
+    if (!file || !path.isAbsolute(file))
+        return undefined;
+    let fd;
+    try {
+        fd = openSync(file, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || (stat.mode & 0o077) !== 0)
+            return undefined;
+        if (typeof process.getuid === "function" && stat.uid !== process.getuid())
+            return undefined;
+        const value = JSON.parse(readFileSync(fd, "utf8"));
+        if (typeof value.socket !== "string" || !path.isAbsolute(value.socket))
+            return undefined;
+        if (typeof value.token !== "string" || value.token.length < 32)
+            return undefined;
+        return { socket: value.socket, token: value.token };
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+/**
+ * One connection at a time to the turn's host query service, reconnecting after a drop. Only
+ * the current socket's failure fails the pending requests (all of which were sent on it): a
+ * stale socket closing late never fails a request pending on its replacement. Each socket has
+ * its own read buffer.
+ */
+export class HostConnection {
+    credential;
+    open;
+    pending = new Map();
+    socket;
+    nextId = 1;
+    constructor(credential, open = connect) {
+        this.credential = credential;
+        this.open = open;
+    }
+    request(sql, limit) {
+        return new Promise((resolve) => {
+            const id = this.nextId++;
+            try {
+                const socket = this.current();
+                this.pending.set(id, resolve);
+                socket.write(`${JSON.stringify({ token: this.credential.token, id, sql, ...(limit !== undefined ? { limit } : {}) })}\n`);
+            }
+            catch {
+                this.pending.delete(id);
+                resolve({ error: "transport" });
+            }
+        });
+    }
+    close() {
+        this.socket?.end();
+    }
+    current() {
+        if (this.socket && !this.socket.destroyed)
+            return this.socket;
+        const socket = this.open(this.credential.socket);
+        let buffer = "";
+        const fail = () => {
+            if (this.socket !== socket)
+                return;
+            this.socket = undefined;
+            for (const waiter of this.pending.values())
+                waiter({ error: "transport" });
+            this.pending.clear();
+        };
+        socket.setEncoding("utf8");
+        socket.on("data", (chunk) => {
+            buffer += chunk;
+            let newline = buffer.indexOf("\n");
+            while (newline >= 0) {
+                const line = buffer.slice(0, newline);
+                buffer = buffer.slice(newline + 1);
+                newline = buffer.indexOf("\n");
+                try {
+                    const frame = JSON.parse(line);
+                    const waiter = typeof frame.id === "number" ? this.pending.get(frame.id) : undefined;
+                    if (!waiter || typeof frame.id !== "number")
+                        continue;
+                    this.pending.delete(frame.id);
+                    if (frame.error !== undefined)
+                        waiter({ error: typeof frame.error?.class === "string" ? frame.error.class : "internal" });
+                    else
+                        waiter({ result: frame.result });
+                }
+                catch {
+                    socket.destroy();
+                }
+            }
+        });
+        socket.on("error", fail);
+        socket.on("close", fail);
+        this.socket = socket;
+        return socket;
+    }
+}
+function parseArgs(argv) {
+    const separator = argv.indexOf("--");
+    if (separator < 0 || separator === argv.length - 1) {
+        process.stderr.write("codex wren proxy: usage: --credential-file <path> -- <command> [args...]\n");
+        process.exit(2);
+    }
+    const own = argv.slice(0, separator);
+    const index = own.indexOf("--credential-file");
+    const credentialFile = index >= 0 ? own[index + 1] : undefined;
+    return { ...(credentialFile !== undefined ? { credentialFile } : {}), command: argv[separator + 1], args: argv.slice(separator + 2) };
+}
+function main() {
+    const options = parseArgs(process.argv.slice(2));
+    const credential = readCredential(options.credentialFile);
+    const host = credential ? new HostConnection(credential) : undefined;
+    const child = spawn(options.command, options.args, { stdio: ["pipe", "pipe", "inherit"] });
+    child.on("error", (error) => {
+        process.stderr.write(`codex wren proxy: could not start the Wren MCP server: ${error.message}\n`);
+        process.exit(1);
+    });
+    child.on("exit", (code, signal) => process.exit(code ?? (signal ? 1 : 0)));
+    const send = (line) => { process.stdout.write(`${line}\n`); };
+    createInterface({ input: child.stdout, crlfDelay: Infinity }).on("line", send);
+    const toolResult = (id, text, isError, structured) => {
+        send(JSON.stringify({ jsonrpc: "2.0", id, result: {
+                content: [{ type: "text", text }],
+                ...(structured !== undefined ? { structuredContent: structured } : {}),
+                isError,
+            } }));
+    };
+    const runSql = async (id, input) => {
+        if (!host) {
+            toolResult(id, NO_CREDENTIAL, true);
+            return;
+        }
+        const args = typeof input === "object" && input !== null && !Array.isArray(input) ? input : {};
+        const { sql, limit } = args;
+        if (typeof sql !== "string" || !sql.trim() || Buffer.byteLength(sql) > MAX_SQL_BYTES
+            || (limit !== undefined && limit !== null && (typeof limit !== "number" || !Number.isInteger(limit) || limit < 1))) {
+            toolResult(id, ERROR_TEXT.invalid_request, true);
+            return;
+        }
+        const outcome = await host.request(sql, typeof limit === "number" ? limit : undefined);
+        if (outcome.error !== undefined) {
+            const known = outcome.error in ERROR_TEXT ? outcome.error : "internal";
+            toolResult(id, `Governed Wren query failed [${known}]: ${ERROR_TEXT[known]}`, true);
+            return;
+        }
+        toolResult(id, JSON.stringify(outcome.result), false, outcome.result);
+    };
+    createInterface({ input: process.stdin, crlfDelay: Infinity })
+        .on("line", (line) => {
+        let message;
+        try {
+            message = JSON.parse(line);
+        }
+        catch {
+            message = undefined;
+        }
+        if (message && message.method === "tools/call" && message.id !== undefined && message.params?.name === RUN_SQL) {
+            void runSql(message.id, message.params.arguments);
+            return;
+        }
+        child.stdin.write(`${line}\n`);
+    })
+        .on("close", () => {
+        child.stdin.end();
+        host?.close();
+    });
+}
+function invokedDirectly() {
+    if (process.argv[1] === undefined)
+        return false;
+    try {
+        return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
+    }
+    catch {
+        return false;
+    }
+}
+if (invokedDirectly())
+    main();

package/dist-server/harness/route/describe.js

@@ -1,6 +1,12 @@
-import { readFile } from "node:fs/promises";
+import { mkdtemp, readFile, realpath, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { generatePreparedContext, resolveContextLoaderBinary } from "../compile/context-loader.js";
+import { resolveWarbleBinary } from "../compile/resolve-binary.js";
 import { loadBundleWithProvenance } from "../bundle/loader.js";
 import { compileProfile, compileRawProfile } from "../compile/pipeline.js";
+import { planDigest, readExecutionPlan } from "../components/plan.js";
+import { describeComponentPlan } from "../components/display.js";
 import { buildAgentSdkManifestArgs, runAgentSdkManifest } from "./agent-sdk-manifest.js";
 import { resolveAgentSdkCli } from "./agent-sdk-cli.js";
 import { resolveCodexLocalCli } from "./codex-local-cli.js";
@@ -45,14 +51,44 @@ async function describeCodexManifest(options) {
         throw new Error("Codex manifest requires orchestrator, cheap, and strong model bindings");
     }
     const cli = await resolveCodexLocalCli(options.codexLocalBin);
-    return purpose === "context_enrichment"
-        ? describeCodexEnrichmentManifest(cli, compiled.irPath, models)
-        : describeCodexAskManifest(cli, compiled.irPath, models);
+    if (purpose === "context_enrichment")
+        return describeCodexEnrichmentManifest(cli, compiled.irPath, models);
+    const ir = JSON.parse(await readFile(compiled.irPath, "utf8"));
+    if (!ir.components.some((node) => node.llm_calls.some((step) => step.component_calls?.length))) {
+        return describeCodexAskManifest(cli, compiled.irPath, models);
+    }
+    const dir = await mkdtemp(path.join(os.tmpdir(), "genbi-manifest-context-"));
+    try {
+        if (options.context === "bootstrap")
+            throw new Error("Composed analysis requires a bound project");
+        const project = await realpath(options.userProject);
+        for (const id of ["answer_query", "generate_dashboard"]) {
+            const binding = ir.components.find((node) => node.id === id)?.context_binding;
+            if (!binding || typeof binding.project !== "string" || !path.isAbsolute(binding.project) || await realpath(binding.project) !== project) {
+                throw new Error(`Codex manifest cannot capture context for ${id} from a different project`);
+            }
+        }
+        const file = path.join(dir, "context.json");
+        await generatePreparedContext(resolveContextLoaderBinary(), project, file);
+        const snapshot = JSON.parse(await readFile(file, "utf8"));
+        return await describeCodexAskManifest(cli, compiled.irPath, models, {
+            warbleBin: await resolveWarbleBinary(options.warbleBin),
+            contexts: Object.fromEntries(ir.components.map((node) => [node.id, { binding: node.context_binding, snapshot }])),
+        });
+    }
+    finally {
+        await rm(dir, { recursive: true, force: true });
+    }
 }
 async function describeVercelBundle(options) {
     const compiled = await compileForDescription(options, "agnostic");
     // `mode: "agnostic"` always produces a bundle — see `compileProfile`'s doc comment.
     const bundleJson = JSON.parse(await readFile(compiled.bundlePath, "utf-8"));
+    if (bundleJson.vercel_bundle_version === "0.2") {
+        const ir = JSON.parse(await readFile(compiled.irPath, "utf8"));
+        const plan = readExecutionPlan(JSON.stringify(bundleJson), { digest: bundleJson.bundle_sha256, inputIrDigest: planDigest(ir), declarations: Object.fromEntries(ir.components.map((node) => [node.id, node])), contextBinding: ir.context_binding });
+        return describeComponentPlan(plan, bundleJson.profile);
+    }
     return loadBundleWithProvenance(bundleJson, {
         ...(compiled.warbleBin !== undefined ? { warbleBin: compiled.warbleBin } : {}),
         profileSource: options.profileSource,
@@ -66,10 +102,13 @@ async function describeAgentSdkManifest(options) {
         ...(options.context !== "bootstrap" ? { userProject: options.userProject } : {}),
     });
     const stdout = await runAgentSdkManifest(command, args);
-    return loadBundleWithProvenance(JSON.parse(stdout), {
+    const manifest = JSON.parse(stdout);
+    if (manifest.target !== "claude-agent-sdk:local")
+        throw new Error("Unexpected SDK manifest target");
+    return loadBundleWithProvenance(manifest, {
         ...(compiled.warbleBin !== undefined ? { warbleBin: compiled.warbleBin } : {}),
         profileSource: options.profileSource,
-    });
+    }, { irVersion: "0.9", bundleVersions: ["0.1", "0.3"] });
 }
 function compileForDescription(options, mode) {
     const shared = {

package/dist-server/harness/route/in-process.d.ts

@@ -1,11 +1,32 @@
+import { type TierBinding } from "../providers/index.js";
 import type { RunAgentResult } from "../session/index.js";
 import type { InProcessOptions } from "./types.js";
-/** Projects a bundle-wide validated map onto the component selected for one turn. */
+/**
+ * Projects a bundle-wide validated map onto the component selected for one
+ * turn, keyed on (mount, tier): an `<agent.id>/<tier>` entry wins over the
+ * bare tier entry, so the same tier name can bind a different model per mount.
+ */
 export declare function filterTierBindingForAgent(agent: {
+    readonly id?: string;
     readonly steps: readonly {
         readonly tier: string;
     }[];
 }, tierBinding: Readonly<Record<string, import("../providers/index.js").AdapterSpec>>): Readonly<Record<string, import("../providers/index.js").AdapterSpec>>;
+/**
+ * The legacy (single-agent, IR 0.6) path has no caller/callee split: every
+ * step, and the render stage, sees rows. So a zone-aware binding on this path
+ * must be all-private; a `public` or unset zone on any tier the agent (or its
+ * render stage) uses is a loud failure, the same posture as the composed gate.
+ */
+export declare function assertLegacyZoneBinding(agent: {
+    readonly id: string;
+    readonly steps: readonly {
+        readonly tier: string;
+        readonly realization: {
+            readonly kind: string;
+        };
+    }[];
+}, binding: TierBinding, renderTier: string | undefined): void;
 /**
  * Resolves the `rootDir` the native `write_artifact` tool's
  * `createLocalExecutionEnv` scope is rooted at. Precedence: an explicit

package/dist-server/harness/route/in-process.js

@@ -3,20 +3,57 @@ import path from "node:path";
 import { createDefaultCapabilityRegistry } from "../capability/registry.js";
 import { createLocalExecutionEnv } from "../exec/index.js";
 import { deriveEnforcement } from "../guardrails/index.js";
-import { createDefaultProviderRegistry } from "../providers/index.js";
+import { createDefaultProviderRegistry, isZoneAwareBinding, resolveTierSpec } from "../providers/index.js";
+import { ZoneGateError } from "../components/zone-gate.js";
 import { runAgent } from "../session/index.js";
 import { createWrenNativeToolRegistry, resolveWrenBinary } from "../tools/index.js";
 import { deriveAdapterSpec } from "./adapter-spec.js";
 import { describeBundle } from "./describe.js";
 import { buildHybridTierBinding, buildUniformTierBinding } from "./tier-binding.js";
+import { executionPlanFor } from "../components/display.js";
+import { runInProcessComponents } from "../components/in-process.js";
 const ANSWER_QUERY_AGENT_ID = "answer_query";
 /** Operator-wide override for `resolveArtifactsDir`'s default, e.g. for a long-running BFF process. */
 const ARTIFACTS_DIR_ENV_VAR = "WREN_HARNESS_ARTIFACTS_DIR";
-/** Projects a bundle-wide validated map onto the component selected for one turn. */
+/**
+ * Projects a bundle-wide validated map onto the component selected for one
+ * turn, keyed on (mount, tier): an `<agent.id>/<tier>` entry wins over the
+ * bare tier entry, so the same tier name can bind a different model per mount.
+ */
 export function filterTierBindingForAgent(agent, tierBinding) {
+    const binding = { tiers: tierBinding };
     return Object.fromEntries([...new Set(agent.steps.map((step) => step.tier))]
-        .filter((tier) => tierBinding[tier] !== undefined)
-        .map((tier) => [tier, tierBinding[tier]]));
+        .map((tier) => [tier, resolveTierSpec(binding, tier, agent.id)?.spec])
+        .filter((entry) => entry[1] !== undefined));
+}
+/**
+ * The legacy (single-agent, IR 0.6) path has no caller/callee split: every
+ * step, and the render stage, sees rows. So a zone-aware binding on this path
+ * must be all-private; a `public` or unset zone on any tier the agent (or its
+ * render stage) uses is a loud failure, the same posture as the composed gate.
+ */
+export function assertLegacyZoneBinding(agent, binding, renderTier) {
+    if (!isZoneAwareBinding(binding))
+        return;
+    const violations = [];
+    const check = (tier, what) => {
+        const resolved = resolveTierSpec(binding, tier, agent.id);
+        const zone = resolved?.spec.zone ?? "unbound";
+        if (!resolved)
+            violations.push({ code: "unbound_tier", component: agent.id, tier, zone, message: `${what} (tier ${tier}) has no binding entry` });
+        else if (zone === "unbound")
+            violations.push({ code: "missing_zone", component: agent.id, tier, zone, message: `${what} (tier ${tier}) sees project data but binding entry "${resolved.key}" declares no zone` });
+        else if (zone !== "private")
+            violations.push({ code: "data_step_public", component: agent.id, tier, zone, message: `${what} (tier ${tier}) sees project data but binding entry "${resolved.key}" is zone: ${zone}; it must be private` });
+    };
+    for (const step of agent.steps)
+        check(step.tier, `step ${agent.id}.${step.tier}`);
+    const independent = agent.steps.filter((step) => step.realization.kind === "independent");
+    const render = renderTier ?? independent[independent.length - 1]?.tier;
+    if (render !== undefined)
+        check(render, `render stage of ${agent.id}`);
+    if (violations.length > 0)
+        throw new ZoneGateError(violations);
 }
 /**
  * Resolves the `rootDir` the native `write_artifact` tool's
@@ -56,6 +93,12 @@ export function resolveArtifactsDir(outDir) {
  */
 export async function runInProcessDefault(options) {
     const bundle = options.bundle ?? (await describeBundle(options));
+    if (bundle.vercel_bundle_version === "0.2") {
+        const plan = executionPlanFor(bundle);
+        if (!plan)
+            throw new Error("Composed display has no trusted execution plan");
+        return runInProcessComponents(plan, options);
+    }
     // Intent routing (server/turn.ts) picks the agent id when present; falls back to answer_query,
     // the original default from before intent routing existed.
     const agentId = options.agentId ?? ANSWER_QUERY_AGENT_ID;
@@ -69,6 +112,13 @@ export async function runInProcessDefault(options) {
     // here; `buildHybridTierBinding` intentionally rejects tiers used solely by
     // another component.
     const agentTierBinding = options.tierBinding === undefined ? undefined : filterTierBindingForAgent(agent, options.tierBinding);
+    if (options.tierBinding !== undefined || options.disclosurePolicy !== undefined || options.zoneRoles !== undefined) {
+        assertLegacyZoneBinding(agent, {
+            tiers: options.tierBinding ?? {},
+            ...(options.disclosurePolicy !== undefined ? { disclosurePolicy: options.disclosurePolicy } : {}),
+            ...(options.zoneRoles !== undefined ? { roles: options.zoneRoles } : {}),
+        }, undefined);
+    }
     const binding = options.tierBinding !== undefined
         ? buildHybridTierBinding(agent, agentTierBinding)
         : buildUniformTierBinding(agent, deriveAdapterSpec(options.authChoice, options.model !== undefined ? { model: options.model } : {}));

package/dist-server/harness/route/route.js

@@ -41,8 +41,8 @@ export async function route(options) {
     const deployment = options.deployment ?? "personal";
     const { warnings } = enforceCompliance(authChoice, { deployment });
     if (authChoice.mode === "subscription") {
-        if (options.tierBinding !== undefined) {
-            throw new Error("tierBinding (hybrid in-process per-tier routing) has no effect under a subscription " +
+        if (options.tierBinding !== undefined || options.disclosurePolicy !== undefined || options.zoneRoles !== undefined) {
+            throw new Error("tierBinding (with disclosurePolicy/zoneRoles: hybrid in-process per-tier routing) has no effect under a subscription " +
                 "authChoice — dispatched has no adapter/tier binding of its own; use modelsConfig instead " +
                 "(warble-agent-sdk's own --models-config per-step routing)");
         }
@@ -96,6 +96,7 @@ export async function route(options) {
             "per-tier adapter map)");
     }
     const result = await runInProcess({
+        ...(options.signal !== undefined ? { signal: options.signal } : {}),
         authChoice,
         profileSource: options.profileSource,
         userProject: options.userProject,
@@ -107,6 +108,8 @@ export async function route(options) {
         ...(options.bundle !== undefined ? { bundle: options.bundle } : {}),
         ...(options.mcpServers !== undefined ? { mcpServers: options.mcpServers } : {}),
         ...(options.tierBinding !== undefined ? { tierBinding: options.tierBinding } : {}),
+        ...(options.disclosurePolicy !== undefined ? { disclosurePolicy: options.disclosurePolicy } : {}),
+        ...(options.zoneRoles !== undefined ? { zoneRoles: options.zoneRoles } : {}),
         ...(options.onEvent !== undefined ? { onEvent: options.onEvent } : {}),
         ...(options.agentId !== undefined ? { agentId: options.agentId } : {}),
     });

package/dist-server/harness/route/types.d.ts

@@ -2,7 +2,7 @@ import type { AuthChoice } from "../auth/index.js";
 import type { Bundle } from "../bundle/schema.js";
 import type { Deployment } from "../compliance/index.js";
 import type { AgentEvent } from "../events/index.js";
-import type { AdapterSpec } from "../providers/index.js";
+import type { AdapterSpec, DisclosurePolicy, ZoneRoles } from "../providers/index.js";
 import type { RunAgentResult } from "../session/index.js";
 import type { McpServerConfigMap } from "../tools/index.js";
 import type { ResolvedCli } from "./agent-sdk-cli.js";
@@ -15,6 +15,7 @@ import type { CodexManifestModels } from "./codex-local-manifest.js";
  * tool through the real `wren` CLI (native tools) against `userProject`.
  */
 export interface InProcessOptions {
+    readonly signal?: AbortSignal;
     readonly authChoice: Extract<AuthChoice, {
         mode: "api-key" | "local" | "gateway";
     }>;
@@ -55,6 +56,19 @@ export interface InProcessOptions {
      * coverage is total-or-loud-fail.
      */
     readonly tierBinding?: Readonly<Record<string, AdapterSpec>>;
+    /**
+     * Hybrid privacy split: the egress disclosure policy the verification step
+     * enforces on every callee result before a caller sees it. Its presence
+     * arms the zone gate (see `components/zone-gate.ts`) and requires
+     * `zoneRoles.judge`.
+     */
+    readonly disclosurePolicy?: DisclosurePolicy;
+    /** Hybrid privacy split: binding keys of the judge / render tiers the zone gate checks by role. */
+    readonly zoneRoles?: ZoneRoles;
+    /** Hybrid privacy split: size bound for the capability card handed to public-zone steps (default 32 KiB). */
+    readonly capabilityCard?: {
+        readonly maxBytes?: number;
+    };
     /** Live-event layer: forwarded to `RunAgentContext.onEvent`. See that field's doc comment. */
     readonly onEvent?: (event: AgentEvent) => void;
     /**
@@ -209,6 +223,11 @@ export interface CodexAskOptions {
 }
 export interface CodexAskResult {
     readonly finalText: string;
+    /**
+     * codex:local only: the queries this turn's host query service executed for the model's
+     * `run_sql`, the only evidence its answer may be grounded on. Never persisted.
+     */
+    readonly hostObservations?: readonly import("./codex-host-query.js").HostQueryObservation[];
 }
 export type CodexAskExecutor = (options: CodexAskOptions) => Promise<CodexAskResult>;
 /**
@@ -243,6 +262,10 @@ export interface RouteOptions {
     readonly mcpServers?: McpServerConfigMap;
     /** In-process only (hybrid mode); see `InProcessOptions.tierBinding`. `route()` rejects this alongside a `subscription` authChoice. */
     readonly tierBinding?: Readonly<Record<string, AdapterSpec>>;
+    /** In-process only; see `InProcessOptions.disclosurePolicy`. */
+    readonly disclosurePolicy?: DisclosurePolicy;
+    /** In-process only; see `InProcessOptions.zoneRoles`. */
+    readonly zoneRoles?: ZoneRoles;
     /** Dispatched only (hybrid mode); see `DispatchedOptions.modelsConfig`. `route()` rejects this alongside a non-`subscription` authChoice. */
     readonly modelsConfig?: string;
     /** Live-event layer: forwarded to whichever mode executor runs. See `InProcessOptions.onEvent`/`DispatchedOptions.onEvent`. */
@@ -283,4 +306,10 @@ export type RouteResult = ({
 } & DispatchedResult) | ({
     readonly backend: "codex-local";
     readonly warnings: readonly string[];
+} & CodexAskResult) | ({
+    readonly backend: "codex-app-server";
+    readonly warnings: readonly string[];
+    /** Host-captured normalized component evidence; never recovered from model prose. */
+    readonly envelope?: import("../render/envelope.js").RenderEnvelope;
+    readonly dataAttempted?: boolean;
 } & CodexAskResult);

package/dist-server/harness/session/run.js

@@ -4,6 +4,7 @@ import { createLocalExecutionEnv } from "../exec/index.js";
 import { deriveEnforcement } from "../guardrails/index.js";
 import { executeAgent, summarizeToolOutput } from "../loop/index.js";
 import { getAllowedBlockTypes, renderEnvelope } from "../render/index.js";
+import { selectAnsweringCandidate } from "../render/answering-query.js";
 import { BUILD_DASHBOARD_TOOL_NAME, WREN_QUERY_TOOL_NAME, withResolvedTools } from "../tools/index.js";
 import { UnknownAgentError } from "./errors.js";
 import { findLockedGatedCheck } from "./gate.js";
@@ -23,11 +24,16 @@ import { findLockedGatedCheck } from "./gate.js";
  * becomes a `RefusalResult`.
  */
 export async function runAgent(bundle, agentId, userInput, ctx) {
+    if (bundle.vercel_bundle_version === "0.2")
+        throw new Error("Composed plans require the component host runner");
     assertCapabilities(bundle, ctx.capabilityRegistry);
     const agent = bundle.agents.find((candidate) => candidate.id === agentId);
     if (!agent) {
         throw new UnknownAgentError(agentId);
     }
+    if (agent.entrypoint === false || (agent.dependencies?.length ?? 0) > 0 || bundle.manifest_version === "0.3") {
+        throw new Error("This manifest requires its owning component runtime");
+    }
     const emitter = createAgentEventEmitter(ctx.onEvent);
     emitter.emit({ kind: "run.start", mode: "A", agentId });
     try {
@@ -50,15 +56,16 @@ export async function runAgent(bundle, agentId, userInput, ctx) {
             // forced to a refusal by this check.
             let sawSuccessfulDataAccessCall = false;
             const requiresDataAccess = agent.capabilities.some((entry) => entry.capability.startsWith("sql_execution:"));
-            // Deterministic table capture: the most recent *successful* `query`
-            // tool result, kept as a flat table payload (columns + positional
-            // rows + the SQL that produced it). This is the agent's real data —
-            // `renderEnvelope` builds the table/definition blocks straight from
-            // it instead of asking the render model to re-emit structure it tends
-            // to summarize away (leaving a bare `{type:"table"}`). The last
-            // success wins because, in the answer_query flow, it is the query
-            // whose rows are the answer.
-            let toolTable;
+            // Deterministic table capture: every *successful* `query` tool result,
+            // kept as a flat table payload (columns + positional rows + the SQL that
+            // produced it). This is the agent's real data — `renderEnvelope` builds
+            // the table/definition blocks straight from it instead of asking the
+            // render model to re-emit structure it tends to summarize away (leaving
+            // a bare `{type:"table"}`). Which capture is the answer is decided after
+            // the loop (see `selectAnsweringCandidate`): the one whose SQL the
+            // terminal artifact names, because a model that runs a stray check after
+            // the right query must not turn that check into a verified answer.
+            const toolTables = [];
             // Deterministic dashboard-envelope capture: the most recent
             // *successful* `build_dashboard` tool result, kept as-is (it's
             // already a complete, ordered `{blocks}` envelope — see
@@ -110,7 +117,7 @@ export async function runAgent(bundle, agentId, userInput, ctx) {
                         sawSuccessfulDataAccessCall = true;
                         const seed = toToolTableSeed(outcome.output, outcome.input);
                         if (seed !== undefined)
-                            toolTable = seed;
+                            toolTables.push(seed);
                     }
                     if (outcome.tool === BUILD_DASHBOARD_TOOL_NAME && outcome.outcome === "success") {
                         const seed = toDashboardSeed(outcome.output);
@@ -124,6 +131,7 @@ export async function runAgent(bundle, agentId, userInput, ctx) {
                 },
                 onEvent: emitter.emit,
             });
+            const toolTable = selectAnsweringCandidate(toolTables, terminalArtifactValue(artifacts));
             const envelope = await renderEnvelope(agent, artifacts, {
                 binding: ctx.binding,
                 registry: ctx.registry,
@@ -278,6 +286,18 @@ export async function runAgent(bundle, agentId, userInput, ctx) {
         throw error;
     }
 }
+/** The last dataflow artifact as a value: JSON text is parsed so a named `definition.sql` is visible. */
+function terminalArtifactValue(artifacts) {
+    const last = [...artifacts.values()].at(-1);
+    if (typeof last !== "string")
+        return last;
+    try {
+        return JSON.parse(last);
+    }
+    catch {
+        return last;
+    }
+}
 function describeRunError(error) {
     if (error instanceof Error)
         return error.message;

package/dist-server/harness/setup/runner.d.ts

@@ -18,6 +18,8 @@ export declare const BUILD_CONTEXT_AGENT_ID = "build_context";
  */
 export declare const DEFAULT_SETUP_MAX_TURNS = 120;
 export interface SetupStepRunOptions {
+    /** Owned turn cancellation, forwarded to the selected runtime. */
+    readonly signal?: AbortSignal;
     /** The composed single-line prompt (see `composeSetupPrompt`). */
     readonly prompt: string;
     /** The workspace root the initial connect turn scaffolds `<name>/` into. */