@wrenai/genbi 0.0.4 → 0.0.5

package/dist-server/server/native-shutdown.d.ts

@@ -0,0 +1,6 @@
+/** Drain every owned resource and report cleanup failures without process details. */
+export declare function shutdownNativeResources(options: {
+    shutdownSessions(): Promise<void>;
+    closeTerminals(): void;
+    closeServer(): void;
+}): Promise<0 | 1>;

package/dist-server/server/native-shutdown.js

@@ -0,0 +1,28 @@
+/** Drain every owned resource and report cleanup failures without process details. */
+export async function shutdownNativeResources(options) {
+    let failed = false;
+    // Calling the session fence before other cleanup closes new admission immediately.
+    let cleanup = Promise.resolve();
+    try {
+        cleanup = options.shutdownSessions();
+    }
+    catch {
+        failed = true;
+    }
+    // Attach the rejection observer before synchronous cleanup can throw.
+    const settled = cleanup.catch(() => { failed = true; });
+    try {
+        options.closeTerminals();
+    }
+    catch {
+        failed = true;
+    }
+    try {
+        options.closeServer();
+    }
+    catch {
+        failed = true;
+    }
+    await settled;
+    return failed ? 1 : 0;
+}

package/dist-server/server/native-wren-home.d.ts

@@ -0,0 +1,18 @@
+import type { NativeWrenRuntime } from "./native-wren-runtime.js";
+export interface CodexWrenHome {
+    readonly home: string;
+    readonly dataRoots: readonly string[];
+    readonly active?: () => boolean;
+    readonly assertActive?: () => void;
+    readonly cleanup?: () => void;
+}
+/** Setup has no bound profile yet, but still receives a fresh private WREN_HOME. */
+export declare function createEmptyCodexWrenHome(cwd: string): CodexWrenHome;
+export declare function materializeCodexWrenHome(input: {
+    readonly runtime: NativeWrenRuntime;
+    readonly projectPath: string;
+    readonly cwd: string;
+    readonly sourceWrenHome: string;
+    readonly home: string;
+    readonly toolDirectories: readonly string[];
+}): CodexWrenHome;

package/dist-server/server/native-wren-home.js

@@ -0,0 +1,262 @@
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { buildNativeChildEnvironment, nativeProcessEnvironment } from "./native-runtime-spec.js";
+import { InteractiveLaunchError } from "./native-session-workspace.js";
+const MATERIALIZE_WREN_HOME_SCRIPT = String.raw `
+import json
+import os
+import pathlib
+import re
+import sys
+import yaml
+from dotenv import dotenv_values
+from wren.profile import resolve_profile_for_project
+
+project = pathlib.Path(sys.argv[1]).resolve(strict=True)
+destination = pathlib.Path(sys.argv[2])
+source_home = pathlib.Path(sys.argv[3]).resolve(strict=True)
+
+def regular(path, required=True):
+    if not path.exists():
+        if required:
+            raise SystemExit(2)
+        return None
+    if path.is_symlink() or not path.is_file() or path.resolve(strict=True) != path:
+        raise SystemExit(3)
+    return path
+
+regular(project / "wren_project.yml")
+regular(source_home / "profiles.yml")
+name, profile = resolve_profile_for_project(project, strict=True)
+if not name or not isinstance(profile, dict):
+    raise SystemExit(4)
+
+pattern = re.compile(r"\$\{([_A-Z][_A-Z0-9]*)\}")
+keys = set()
+def collect(value):
+    if isinstance(value, str):
+        keys.update(pattern.findall(value))
+    elif isinstance(value, dict):
+        for item in value.values(): collect(item)
+    elif isinstance(value, list):
+        for item in value: collect(item)
+collect(profile)
+
+project_env_path = regular(project / ".env", required=False)
+home_env_path = regular(source_home / ".env", required=False)
+project_values = dotenv_values(project_env_path) if project_env_path else {}
+home_values = dotenv_values(home_env_path) if home_env_path else {}
+selected = {}
+for key in sorted(keys):
+    value = project_values.get(key)
+    if value is None:
+        value = home_values.get(key)
+    if value is None:
+        raise SystemExit(5)
+    selected[key] = str(value)
+
+def expand(value):
+    if isinstance(value, str):
+        return pattern.sub(lambda match: selected[match.group(1)], value)
+    if isinstance(value, dict):
+        return {key: expand(item) for key, item in value.items()}
+    if isinstance(value, list):
+        return [expand(item) for item in value]
+    return value
+
+destination.mkdir(mode=0o700, parents=False, exist_ok=False)
+os.chmod(destination, 0o700)
+def private_write(path, content):
+    descriptor = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    with os.fdopen(descriptor, "w", encoding="utf-8") as output:
+        output.write(content)
+    os.chmod(path, 0o600)
+
+profile_path = destination / "profiles.yml"
+private_write(profile_path, yaml.safe_dump({"active": name, "profiles": {name: profile}}, sort_keys=False))
+if selected:
+    session_env = destination / ".env"
+    private_write(session_env, "".join(f"{key}={json.dumps(value)}\n" for key, value in selected.items()))
+
+expanded = expand(profile)
+data_source = expanded.get("datasource")
+data_root = None
+if data_source in ("duckdb", "local_file"):
+    data_root = expanded.get("url")
+elif data_source == "datafusion":
+    data_root = expanded.get("source")
+if data_root:
+    root = pathlib.Path(data_root).expanduser()
+    if not root.is_absolute():
+        root = project / root
+    print(root.resolve(strict=True))
+`;
+function unavailable() {
+    throw new InteractiveLaunchError("native Wren session home is unavailable");
+}
+function privateDirectoryIdentity(directory) {
+    try {
+        const metadata = lstatSync(directory);
+        const canonical = realpathSync(directory);
+        if (!metadata.isDirectory() || metadata.isSymbolicLink() || canonical !== directory || (metadata.mode & 0o777) !== 0o700)
+            return unavailable();
+        return { canonical, dev: metadata.dev, ino: metadata.ino, mode: metadata.mode & 0o777 };
+    }
+    catch (error) {
+        if (error instanceof InteractiveLaunchError)
+            throw error;
+        return unavailable();
+    }
+}
+function privateFileIdentity(file) {
+    try {
+        const metadata = lstatSync(file);
+        const canonical = realpathSync(file);
+        if (!metadata.isFile() || metadata.isSymbolicLink() || canonical !== file || (metadata.mode & 0o777) !== 0o600)
+            return unavailable();
+        return {
+            canonical,
+            dev: metadata.dev,
+            ino: metadata.ino,
+            mode: metadata.mode & 0o777,
+            size: metadata.size,
+            mtimeMs: metadata.mtimeMs,
+            ctimeMs: metadata.ctimeMs,
+            digest: createHash("sha256").update(readFileSync(file)).digest("hex"),
+        };
+    }
+    catch (error) {
+        if (error instanceof InteractiveLaunchError)
+            throw error;
+        return unavailable();
+    }
+}
+function samePathIdentity(left, right) {
+    return left.canonical === right.canonical && left.dev === right.dev && left.ino === right.ino && left.mode === right.mode;
+}
+function sameFileIdentity(left, right) {
+    return samePathIdentity(left, right)
+        && left.size === right.size
+        && left.mtimeMs === right.mtimeMs
+        && left.ctimeMs === right.ctimeMs
+        && left.digest === right.digest;
+}
+function captureWrenHome(destination, fileNames) {
+    try {
+        const actualNames = readdirSync(destination).sort();
+        const expectedNames = [...fileNames].sort();
+        if (JSON.stringify(actualNames) !== JSON.stringify(expectedNames))
+            return unavailable();
+        return {
+            directory: privateDirectoryIdentity(destination),
+            files: Object.freeze(Object.fromEntries(expectedNames.map((name) => [name, privateFileIdentity(path.join(destination, name))]))),
+        };
+    }
+    catch (error) {
+        if (error instanceof InteractiveLaunchError)
+            throw error;
+        return unavailable();
+    }
+}
+function assertWrenHome(destination, expected) {
+    const current = captureWrenHome(destination, Object.keys(expected.files));
+    if (!samePathIdentity(current.directory, expected.directory))
+        return unavailable();
+    for (const [name, identity] of Object.entries(expected.files)) {
+        const observed = current.files[name];
+        if (!observed || !sameFileIdentity(observed, identity))
+            return unavailable();
+    }
+}
+function retirementMarker(cwd) {
+    return path.join(cwd, ".wren-retired");
+}
+function retire(destination, marker) {
+    rmSync(destination, { recursive: true, force: true });
+    writeFileSync(marker, "retired\n", { encoding: "utf8", mode: 0o600, flag: "wx" });
+    privateFileIdentity(marker);
+}
+/** Setup has no bound profile yet, but still receives a fresh private WREN_HOME. */
+export function createEmptyCodexWrenHome(cwd) {
+    const destination = path.join(cwd, ".wren");
+    const marker = retirementMarker(cwd);
+    let active = false;
+    try {
+        if (existsSync(marker))
+            throw new Error("retired");
+        mkdirSync(destination, { mode: 0o700 });
+        chmodSync(destination, 0o700);
+        const identity = captureWrenHome(destination, []);
+        active = true;
+        return Object.freeze({
+            home: destination,
+            dataRoots: Object.freeze([]),
+            active: () => active,
+            assertActive: () => {
+                if (!active)
+                    return unavailable();
+                assertWrenHome(destination, identity);
+            },
+            cleanup: () => {
+                if (!active)
+                    return;
+                active = false;
+                retire(destination, marker);
+            },
+        });
+    }
+    catch {
+        rmSync(destination, { recursive: true, force: true });
+        throw new InteractiveLaunchError("native Wren session home is unavailable");
+    }
+}
+export function materializeCodexWrenHome(input) {
+    const destination = path.join(input.cwd, ".wren");
+    const marker = retirementMarker(input.cwd);
+    let active = false;
+    try {
+        if (existsSync(marker))
+            throw new Error("retired");
+        const environment = buildNativeChildEnvironment({
+            toolDirectories: input.toolDirectories,
+            home: input.home,
+            projectPath: input.projectPath,
+            wrenHome: input.sourceWrenHome,
+            python: true,
+        });
+        const output = execFileSync(input.runtime.venv_python, ["-c", MATERIALIZE_WREN_HOME_SCRIPT, input.projectPath, destination, input.sourceWrenHome], {
+            cwd: input.projectPath,
+            env: nativeProcessEnvironment(environment),
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+            timeout: 10_000,
+        });
+        const envFile = path.join(destination, ".env");
+        const identity = captureWrenHome(destination, ["profiles.yml", ...(existsSync(envFile) ? [".env"] : [])]);
+        active = true;
+        const assertActive = () => {
+            if (!active)
+                return unavailable();
+            assertWrenHome(destination, identity);
+        };
+        return Object.freeze({
+            home: destination,
+            dataRoots: Object.freeze(output.trim() ? [output.trim()] : []),
+            active: () => active,
+            assertActive,
+            cleanup: () => {
+                if (!active)
+                    return;
+                active = false;
+                retire(destination, marker);
+            },
+        });
+    }
+    catch {
+        active = false;
+        rmSync(destination, { recursive: true, force: true });
+        throw new InteractiveLaunchError("native Wren project profile is unavailable");
+    }
+}

package/dist-server/server/node-pty-host.d.ts

@@ -1,4 +1,5 @@
 import { type PtyFactory, type PtyProcess } from "./interactive-terminal.js";
+import { type NativeChildEnvironment } from "./native-runtime-spec.js";
 interface NodePtyModule {
     spawn(file: string, args: string[], options: {
         cwd: string;
@@ -10,7 +11,7 @@ interface NodePtyModule {
 }
 export interface PtyHostOptions {
     readonly cwd?: string;
-    readonly env?: NodeJS.ProcessEnv;
+    readonly env?: NodeJS.ProcessEnv | NativeChildEnvironment;
     readonly probeExecutable?: string;
     readonly probeTimeoutMs?: number;
 }

package/dist-server/server/node-pty-host.js

@@ -1,6 +1,7 @@
 import { closeSync, constants, fchmodSync, fstatSync, lstatSync, openSync } from "node:fs";
 import path from "node:path";
 import { nativeTerminalEnvironment } from "./interactive-terminal.js";
+import { nativeProcessEnvironment } from "./native-runtime-spec.js";
 /**
  * node-pty 1.1 ships a small spawn-helper for prebuilt macOS binaries. Some
  * package managers restore that regular file without its executable mode,
@@ -62,7 +63,7 @@ export async function createProbedPtyFactory(nodePty, options = {}) {
             cols: 80,
             rows: 24,
             name: "xterm-256color",
-            env,
+            env: nativeProcessEnvironment(env),
         });
     }
     catch {
@@ -94,7 +95,7 @@ export async function createProbedPtyFactory(nodePty, options = {}) {
             name: "xterm-256color",
             // Defend this lower adapter too: future PTY callers cannot bypass the
             // server-owned native-terminal color contract by supplying an env.
-            env: nativeTerminalEnvironment(spawnOptions.env ?? env),
+            env: nativeProcessEnvironment(nativeTerminalEnvironment(spawnOptions.env ?? env)),
         }),
     };
 }

package/dist-server/server/profile-registry.d.ts

@@ -0,0 +1,139 @@
+import type { Store, WarbleProfileAdmissionStatus, WarbleProfileEntryKind, WarbleProfileKind, WarbleProfileRole, WarbleProfileRow } from "./db.js";
+import type { WarbleProfileDto } from "./wire-types.js";
+export type { WarbleProfileAdmissionStatus, WarbleProfileEntryKind, WarbleProfileKind, WarbleProfileRole, WarbleProfileRow };
+/** The shipped profiles and the role each plays. Anything else under `profiles/` is ignored. */
+export declare const BUILTIN_PROFILE_ROLES: Readonly<Record<string, WarbleProfileRole>>;
+/** The profile whose compiled IR defines the host ceiling. */
+export declare const CEILING_PROFILE_ID = "genbi-default";
+/** The persisted runtime tier rows come from the analysis profile and name exactly these two tiers. */
+export declare const HOST_TIERS: ReadonlySet<string>;
+/**
+ * Bump when an admission rule is added, tightened or withdrawn. A stored verdict computed under an
+ * older rule set is stale even when the profile bytes and the warble binary are unchanged — the
+ * rules are the third input to the verdict. 1: rules 1–6. 2: a pinned entry must not compose.
+ * 3: that rule withdrawn (the dispatcher refuses every composing profile without a host, so it
+ * never separated anything); composition is recorded on the component summary instead.
+ */
+export declare const ADMISSION_RULES_VERSION = 3;
+export declare class ProfileRegistryError extends Error {
+    readonly status: 400 | 404 | 409 | 503;
+    constructor(status: 400 | 404 | 409 | 503, message: string);
+}
+export interface HostCeiling {
+    readonly capabilities: ReadonlySet<string>;
+    readonly tiers: ReadonlySet<string>;
+}
+export interface AdmissionComponentSummary {
+    readonly id: string;
+    readonly type: string;
+    readonly trigger: string;
+    readonly outcome: string;
+    readonly realizationKind: string;
+    readonly entrypoint: boolean;
+    readonly tiers: readonly string[];
+    readonly capabilities: readonly string[];
+    readonly hasDescription: boolean;
+    readonly nativeEligible: boolean;
+    /** `alias → component` edges this component's steps authorize; non-empty means it composes. */
+    readonly composes: readonly string[];
+}
+export interface AdmissionVerdict {
+    readonly status: WarbleProfileAdmissionStatus;
+    /** Every failed rule, in rule order; empty when admitted. */
+    readonly reasons: readonly string[];
+    readonly entry?: {
+        readonly kind: WarbleProfileEntryKind;
+        readonly verb?: string;
+    };
+    readonly irVersion?: string;
+    readonly components: readonly AdmissionComponentSummary[];
+}
+/**
+ * The capability ceiling is whatever the shipped analysis profile already requires, read from its
+ * compiled IR. Listing the names by hand would let the ceiling drift from the profile it describes.
+ */
+export declare function deriveHostCeiling(ceilingIr: unknown): HostCeiling;
+/** Rules 2–5 over a compiled IR. Pure: rule 1 (compiling) and rule 6 (staleness) live in the registry. */
+export declare function admitCompiledProfile(ir: unknown, options: {
+    readonly expectedId: string;
+    readonly ceiling: HostCeiling;
+}): AdmissionVerdict;
+/** The `profile:` scalar of a profile.yml. Flat YAML, read the same way `composeUserProfile` does. */
+export declare function readProfileId(profileYamlText: string): string | undefined;
+export type SourcePathCheck = {
+    readonly ok: true;
+    readonly resolved: string;
+    readonly real: string;
+} | {
+    readonly ok: false;
+    readonly message: string;
+};
+/**
+ * A user profile is handed to the server as a directory path on this machine, the same way the
+ * adopt flow receives a project path. The path is checked, not trusted: it must be absolute, be a
+ * real directory rather than a link, hold a `profile.yml`, and sit outside the roots the registry
+ * itself owns, so a request can never register the package tree or the user-data tree as "new".
+ */
+export declare function validateUserProfileSourcePath(sourcePath: unknown, options: {
+    readonly forbiddenRoots: readonly string[];
+}): SourcePathCheck;
+export declare function toWarbleProfileDto(row: WarbleProfileRow): WarbleProfileDto;
+export interface ProfileRegistryOptions {
+    readonly store: Store;
+    /** The package's own `profiles/` tree (the directory the analysis profile source lives in). */
+    readonly builtinProfilesDir: string;
+    /** Where user-added profiles are copied: `<workspaceRoot>/profiles`. Created on first add. */
+    readonly userProfilesDir: string;
+    /** Rule 1: compile a raw profile directory with the pinned warble. Throws on failure. */
+    readonly compileRaw: (profileSource: string) => Promise<{
+        readonly irPath: string;
+    }>;
+    /** Identity of the warble binary admission ran against; part of the staleness key (rule 6). */
+    readonly warbleIdentity: () => Promise<string>;
+    readonly now?: () => Date;
+}
+export declare class ProfileRegistry {
+    private readonly options;
+    private ready;
+    private ceiling;
+    private ceilingFailure;
+    private readonly now;
+    constructor(options: ProfileRegistryOptions);
+    /** Registers the shipped profiles once and re-checks stored rows whose inputs changed. Idempotent. */
+    ensureReady(): Promise<void>;
+    private initialize;
+    private registerBuiltins;
+    private registerBuiltin;
+    private readmitIfStale;
+    /**
+     * Runs rules 1–5 for one directory and persists the verdict. The ceiling profile's own verdict
+     * also fixes the ceiling; while it fails to compile no conversation profile can be admitted,
+     * and each row says so rather than silently inheriting an empty ceiling.
+     */
+    private admitAndStore;
+    /**
+     * `warble compile` re-derives its fetched Hub cache on every run and documents that two
+     * concurrent runs can collide on the rename, failing one of them loudly and transiently. A BFF
+     * compiles for readiness and sessions while this registry is admitting, so one bounded retry
+     * keeps a shipped profile from being recorded as unavailable over that collision. A profile that
+     * fails twice is recorded with the second failure.
+     */
+    private compileOnceWithRetry;
+    list(): Promise<readonly WarbleProfileRow[]>;
+    get(id: string): Promise<WarbleProfileRow | undefined>;
+    /**
+     * Copies a profile directory from `sourcePath` into the user-data tree and admits it. The copy is
+     * what the registry owns from then on; the original is never read again.
+     */
+    add(sourcePath: unknown): Promise<WarbleProfileRow>;
+    /** Removes a user profile and its copy. A profile any native session has run inside stays. */
+    remove(id: string): Promise<void>;
+    /**
+     * The directory a conversation session compiles from, for an id the browser selected. Refuses
+     * anything that is not an admitted conversation profile, with the stored reason.
+     */
+    resolveConversationProfileSource(id: string): Promise<{
+        readonly sourceDir: string;
+        readonly row: WarbleProfileRow;
+    }>;
+}