@wrenai/genbi 0.0.4 → 0.0.6

package/dist-server/harness/route/codex-local-manifest.js

@@ -1,8 +1,21 @@
 import { execFile } from "node:child_process";
-import { readFile } from "node:fs/promises";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { planDigest } from "../components/plan.js";
 import { loadBundle } from "../bundle/loader.js";
 export const CODEX_ASK_COMPONENTS = ["answer_query", "generate_dashboard"];
 export const CODEX_ENRICH_COMPONENTS = ["inspect_context", "draft_enrichment"];
+export function codexAnalysisToolArgs(component) {
+    const bindings = component === "answer_query"
+        ? ["generate_sql=run_sql", "repair_sql=run_sql"]
+        : ["plan_dashboard=get_context", "compose_layout=run_sql"];
+    const required = component === "answer_query"
+        ? ["generate_sql", "repair_sql"]
+        : ["plan_dashboard", "compose_layout"];
+    return ["--transport", "orchestrate", ...bindings.flatMap((binding) => ["--step-tool", binding]),
+        ...required.flatMap((step) => ["--require-tool", step])];
+}
 export function buildCodexAskManifestArgs(cli, irPath, models, component = "answer_query") {
     return [
         ...cli.prefixArgs,
@@ -20,10 +33,7 @@ export function buildCodexAskManifestArgs(cli, irPath, models, component = "answ
         // spawn it; the runtime binds the real Wren MCP command separately.
         "--server-command",
         process.execPath,
-        "--inspect-tool",
-        "get_context",
-        "--query-tool",
-        "run_sql",
+        ...codexAnalysisToolArgs(component),
     ];
 }
 export function buildCodexBootstrapManifestArgs(cli, irPath) {
@@ -33,10 +43,11 @@ export function buildCodexBootstrapManifestArgs(cli, irPath) {
         irPath,
         "--server-command",
         process.execPath,
-        "--source-tool",
-        "setup_execution",
-        "--context-tool",
-        "setup_execution",
+        "--transport", "exec",
+        "--step-tool", "connect=setup_execution",
+        "--step-tool", "build=setup_execution",
+        "--require-tool", "connect",
+        "--require-tool", "build",
     ];
 }
 export function buildCodexEnrichmentManifestArgs(cli, irPath, models, component) {
@@ -50,10 +61,9 @@ export function buildCodexEnrichmentManifestArgs(cli, irPath, models, component)
         component === "inspect_context" ? models.cheap : models.strong,
         "--server-command",
         process.execPath,
-        "--semantic-tool",
-        "get_context",
-        "--raw-material-tool",
-        "get_context",
+        "--transport", "turn",
+        "--step-tool", `${component === "inspect_context" ? "inspect" : "draft"}=get_context`,
+        "--require-tool", component === "inspect_context" ? "inspect" : "draft",
     ];
 }
 async function describeCodexComponentManifests(cli, irPath, components, argsFor) {
@@ -73,9 +83,80 @@ async function describeCodexComponentManifests(cli, irPath, components, argsFor)
     }
     return loadBundle({ ...primary, agents: bundles.flatMap((bundle) => bundle.agents) });
 }
-export async function describeCodexAskManifest(cli, irPath, models) {
+export async function describeCodexAskManifest(cli, irPath, models, context) {
+    const ir = JSON.parse(await readFile(irPath, "utf8"));
+    if (records(ir.components).some((node) => records(node.llm_calls).some((step) => records(step.component_calls).length))) {
+        if (!context)
+            throw new Error("Codex composed manifest requires component-owned prepared context");
+        return describeComposedCodexManifest(cli, irPath, ir, models, context);
+    }
     return describeCodexComponentManifests(cli, irPath, CODEX_ASK_COMPONENTS, (component) => buildCodexAskManifestArgs(cli, irPath, models, component));
 }
+async function describeComposedCodexManifest(cli, irPath, ir, models, context) {
+    const dir = await mkdtemp(path.join(os.tmpdir(), "genbi-codex-manifest-"));
+    try {
+        const bindings = Object.fromEntries(CODEX_ASK_COMPONENTS.map((id) => {
+            const node = records(ir.components).find((component) => component.id === id);
+            const prepared = context.contexts[id];
+            if (!node || !prepared || planDigest(prepared.binding) !== planDigest(node.context_binding)) {
+                throw new Error(`Codex manifest context binding mismatch for ${id}`);
+            }
+            // Display preparation never launches this MCP command. Tools remain owned
+            // by the answer component; the dashboard only receives its call alias.
+            return [id, { transport: "orchestrate", models, context: JSON.stringify(prepared.snapshot), mcp: {
+                        name: "wren", command: process.execPath,
+                        toolsByStep: id === "answer_query" ? { resolve_intent: [], generate_sql: ["run_sql"], repair_sql: ["run_sql"] }
+                            : { plan_dashboard: [], compose_layout: [] },
+                        requireTool: id === "answer_query" ? ["generate_sql", "repair_sql"] : [],
+                    } }];
+        }));
+        const file = path.join(dir, "bindings.json");
+        await writeFile(file, JSON.stringify({ components: bindings }), { mode: 0o600 });
+        const bundles = [];
+        for (const id of CODEX_ASK_COMPONENTS) {
+            const manifest = JSON.parse(await execCodexManifest(cli.command, [...cli.prefixArgs, "manifest", irPath,
+                "--component", id, "--transport", "orchestrate", "--component-bindings", file, "--warble-bin", context.warbleBin]));
+            if (manifest.version !== "0.3" || manifest.target !== "codex:local" || manifest.profile !== ir.profile || manifest.entry !== id || manifest.transport !== "orchestrate") {
+                throw new Error("Unexpected composed Codex manifest identity");
+            }
+            const nodes = records(manifest.components);
+            const expectedIds = id === "answer_query" ? [id] : [...CODEX_ASK_COMPONENTS];
+            if (nodes.length !== expectedIds.length || new Set(nodes.map((node) => node.id)).size !== nodes.length || nodes.some((node) => !expectedIds.includes(String(node.id)))) {
+                throw new Error("Unexpected composed Codex manifest closure");
+            }
+            for (const node of nodes) {
+                const source = records(ir.components).find((candidate) => candidate.id === node.id);
+                const emitted = records(node.steps);
+                const declared = records(source.llm_calls);
+                if (emitted.length !== declared.length)
+                    throw new Error("Unexpected composed Codex manifest steps");
+                for (let index = 0; index < declared.length; index++) {
+                    const step = declared[index];
+                    const actual = emitted[index];
+                    const aliases = Object.fromEntries(records(step.component_calls).map((edge) => [String(edge.alias), edge.component]));
+                    const tools = bindings[String(node.id)].mcp.toolsByStep[String(step.name)] ?? [];
+                    if (actual.name !== step.name || planDigest(actual.componentCalls) !== planDigest(aliases) || planDigest(actual.enabledTools) !== planDigest(tools)) {
+                        throw new Error("Unexpected composed Codex manifest tool authority");
+                    }
+                }
+            }
+            const entries = records(manifest.components).filter((node) => node.role === "entry");
+            if (entries.length !== 1 || entries[0].id !== id)
+                throw new Error("Unexpected composed Codex manifest entry");
+            const entry = entries[0];
+            const steps = records(entry.steps);
+            bundles.push(normalizeCodexManifest({ manifest_version: "0.1", target: manifest.target, profile: manifest.profile,
+                compat: { min_ir_version: ir.warble_ir_version, max_ir_version: ir.warble_ir_version },
+                agents: [{ ...entry, steps: steps.map((step) => ({ name: step.name })),
+                        tools: [...new Set(steps.flatMap((step) => Array.isArray(step.enabledTools) ? step.enabledTools.map(String) : []))].map((name) => ({ name, source: "mcp:wren" })) }],
+            }, ir));
+        }
+        return loadBundle({ ...bundles[0], agents: bundles.flatMap((bundle) => bundle.agents) });
+    }
+    finally {
+        await rm(dir, { recursive: true, force: true });
+    }
+}
 /**
  * Setup is a raw/bootstrap profile, not an Ask profile. Its dispatcher has a
  * dedicated whole-profile `manifest` command that neither needs nor accepts a
@@ -130,7 +211,7 @@ function normalizeCodexManifest(manifest, ir) {
                 return {
                     name,
                     tier: String(step["tier"] ?? source["tier"] ?? "strong"),
-                    consumes: Array.isArray(step["consumes"]) ? step["consumes"].map(String) : [],
+                    consumes: Array.isArray(step["consumes"]) ? step["consumes"].map(String) : Array.isArray(source["consumes"]) ? source["consumes"].map(String) : [],
                     produces: String(step["produces"] ?? source["produces"] ?? "result"),
                     prompt: String(source["prompt"] ?? ""),
                     realization: when

package/dist-server/harness/route/describe.js

@@ -1,6 +1,12 @@
-import { readFile } from "node:fs/promises";
+import { mkdtemp, readFile, realpath, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { generatePreparedContext, resolveContextLoaderBinary } from "../compile/context-loader.js";
+import { resolveWarbleBinary } from "../compile/resolve-binary.js";
 import { loadBundleWithProvenance } from "../bundle/loader.js";
 import { compileProfile, compileRawProfile } from "../compile/pipeline.js";
+import { planDigest, readExecutionPlan } from "../components/plan.js";
+import { describeComponentPlan } from "../components/display.js";
 import { buildAgentSdkManifestArgs, runAgentSdkManifest } from "./agent-sdk-manifest.js";
 import { resolveAgentSdkCli } from "./agent-sdk-cli.js";
 import { resolveCodexLocalCli } from "./codex-local-cli.js";
@@ -45,14 +51,44 @@ async function describeCodexManifest(options) {
         throw new Error("Codex manifest requires orchestrator, cheap, and strong model bindings");
     }
     const cli = await resolveCodexLocalCli(options.codexLocalBin);
-    return purpose === "context_enrichment"
-        ? describeCodexEnrichmentManifest(cli, compiled.irPath, models)
-        : describeCodexAskManifest(cli, compiled.irPath, models);
+    if (purpose === "context_enrichment")
+        return describeCodexEnrichmentManifest(cli, compiled.irPath, models);
+    const ir = JSON.parse(await readFile(compiled.irPath, "utf8"));
+    if (!ir.components.some((node) => node.llm_calls.some((step) => step.component_calls?.length))) {
+        return describeCodexAskManifest(cli, compiled.irPath, models);
+    }
+    const dir = await mkdtemp(path.join(os.tmpdir(), "genbi-manifest-context-"));
+    try {
+        if (options.context === "bootstrap")
+            throw new Error("Composed analysis requires a bound project");
+        const project = await realpath(options.userProject);
+        for (const id of ["answer_query", "generate_dashboard"]) {
+            const binding = ir.components.find((node) => node.id === id)?.context_binding;
+            if (!binding || typeof binding.project !== "string" || !path.isAbsolute(binding.project) || await realpath(binding.project) !== project) {
+                throw new Error(`Codex manifest cannot capture context for ${id} from a different project`);
+            }
+        }
+        const file = path.join(dir, "context.json");
+        await generatePreparedContext(resolveContextLoaderBinary(), project, file);
+        const snapshot = JSON.parse(await readFile(file, "utf8"));
+        return await describeCodexAskManifest(cli, compiled.irPath, models, {
+            warbleBin: await resolveWarbleBinary(options.warbleBin),
+            contexts: Object.fromEntries(ir.components.map((node) => [node.id, { binding: node.context_binding, snapshot }])),
+        });
+    }
+    finally {
+        await rm(dir, { recursive: true, force: true });
+    }
 }
 async function describeVercelBundle(options) {
     const compiled = await compileForDescription(options, "agnostic");
     // `mode: "agnostic"` always produces a bundle — see `compileProfile`'s doc comment.
     const bundleJson = JSON.parse(await readFile(compiled.bundlePath, "utf-8"));
+    if (bundleJson.vercel_bundle_version === "0.2") {
+        const ir = JSON.parse(await readFile(compiled.irPath, "utf8"));
+        const plan = readExecutionPlan(JSON.stringify(bundleJson), { digest: bundleJson.bundle_sha256, inputIrDigest: planDigest(ir), declarations: Object.fromEntries(ir.components.map((node) => [node.id, node])), contextBinding: ir.context_binding });
+        return describeComponentPlan(plan, bundleJson.profile);
+    }
     return loadBundleWithProvenance(bundleJson, {
         ...(compiled.warbleBin !== undefined ? { warbleBin: compiled.warbleBin } : {}),
         profileSource: options.profileSource,
@@ -66,10 +102,13 @@ async function describeAgentSdkManifest(options) {
         ...(options.context !== "bootstrap" ? { userProject: options.userProject } : {}),
     });
     const stdout = await runAgentSdkManifest(command, args);
-    return loadBundleWithProvenance(JSON.parse(stdout), {
+    const manifest = JSON.parse(stdout);
+    if (manifest.target !== "claude-agent-sdk:local")
+        throw new Error("Unexpected SDK manifest target");
+    return loadBundleWithProvenance(manifest, {
         ...(compiled.warbleBin !== undefined ? { warbleBin: compiled.warbleBin } : {}),
         profileSource: options.profileSource,
-    });
+    }, { irVersion: "0.9", bundleVersions: ["0.1", "0.3"] });
 }
 function compileForDescription(options, mode) {
     const shared = {

package/dist-server/harness/route/dispatched.d.ts

@@ -1,5 +1,11 @@
 import type { ResolvedCli } from "./agent-sdk-cli.js";
+import { type HostQueryService } from "./host-query.js";
 import type { DispatchedOptions, DispatchedResult } from "./types.js";
+/** The host MCP server's name; warble allows exactly `mcp__wren_host__run_sql` from it. */
+export declare const HOST_MCP_SERVER_NAME = "wren_host";
+export declare const HOST_MCP_TOOLS: readonly ["run_sql"];
+/** Appended once to the dispatched system prompt by warble (single line, at most 300 characters). */
+export declare const HOST_MCP_INSTRUCTION: string;
 export interface AgentSdkChatCommand {
     readonly command: string;
     readonly args: readonly string[];
@@ -40,6 +46,8 @@ export interface BuildAgentSdkChatArgsOptions {
      * `DispatchedOptions.resumeSessionId`.
      */
     readonly resume?: string;
+    /** This turn's host MCP config file (see `writeHostMcpConfig`), forwarded as `--host-mcp-config <path>`. */
+    readonly hostMcpConfig?: string;
 }
 /**
  * Builds the argv (and stdin input) for a `warble-agent-sdk chat` invocation
@@ -113,6 +121,18 @@ export declare function buildAgentSdkChatArgs(cli: ResolvedCli, options: BuildAg
  * conversation, not a disk-state prompt rebuild.
  */
 export declare function runDispatchedDefault(options: DispatchedOptions): Promise<DispatchedResult>;
+/**
+ * Writes the turn's `--host-mcp-config` file into the host query service's private 0700
+ * directory, as warble 0.16 reads it: a 0600 file owned by this user holding exactly
+ * `{name, command, args, tools, instruction}`, `command` absolute. The server is the Wren host
+ * proxy in front of `wren serve mcp`; the file names the credential file by path only, never its
+ * token. It is removed with the directory when the service closes.
+ */
+export declare function writeHostMcpConfig(service: Pick<HostQueryService, "directory" | "credentialFile">, options: {
+    readonly proxy: ResolvedCli;
+    readonly mcpServer: ResolvedCli;
+    readonly userProject: string;
+}): Promise<string>;
 /**
  * A `spawnChat` turn that failed (non-zero exit, timeout, or spawn error) but still surfaced a
  * resumable SDK session id along the way (the dispatcher's `{t:"session",id}` NDJSON line — see

package/dist-server/harness/route/dispatched.js

@@ -1,14 +1,24 @@
 import { spawn } from "node:child_process";
-import { mkdtemp } from "node:fs/promises";
+import { mkdtemp, readFile, writeFile } from "node:fs/promises";
 import { createInterface } from "node:readline";
 import os from "node:os";
 import path from "node:path";
+import { ModelConfig } from "@warble/claude-agent-sdk";
 import { enforceCompliance } from "../compliance/index.js";
+import { hashDirectory } from "../compile/fingerprint.js";
 import { compileProfile } from "../compile/pipeline.js";
+import { openWrenComponentAccess } from "../components/wren-access.js";
 import { resolveWarbleBinary } from "../compile/resolve-binary.js";
 import { createAgentEventEmitter } from "../events/index.js";
 import { createChatEventMapperState, mapChatEventToAgentEvent, parseWarbleChatEventLine, } from "./chat-event-mapper.js";
 import { resolveAgentSdkCli } from "./agent-sdk-cli.js";
+import { defaultWrenHostProxy, openHostQueryService, resolveExecutableOnPath, wrenHostProxyArgs, } from "./host-query.js";
+/** The host MCP server's name; warble allows exactly `mcp__wren_host__run_sql` from it. */
+export const HOST_MCP_SERVER_NAME = "wren_host";
+export const HOST_MCP_TOOLS = Object.freeze(["run_sql"]);
+/** Appended once to the dispatched system prompt by warble (single line, at most 300 characters). */
+export const HOST_MCP_INSTRUCTION = "Run data queries with mcp__wren_host__run_sql (sql, optional limit): it returns the rows plus a query_id; " +
+    "cite that query_id in your answer's definition.";
 const MODE_B_AGENT_ID = "answer_query";
 /**
  * Builds the argv (and stdin input) for a `warble-agent-sdk chat` invocation
@@ -56,6 +66,7 @@ export function buildAgentSdkChatArgs(cli, options) {
             ...(options.modelsConfig !== undefined ? ["--models-config", options.modelsConfig] : []),
             ...(options.maxTurns !== undefined ? ["--max-turns", String(options.maxTurns)] : []),
             ...(options.resume !== undefined ? ["--resume", options.resume] : []),
+            ...(options.hostMcpConfig !== undefined ? ["--host-mcp-config", options.hostMcpConfig] : []),
             "--stream-json",
         ],
         input: `${encodeQuestionForStdin(options.question)}\n`,
@@ -169,30 +180,45 @@ export async function runDispatchedDefault(options) {
         const outDir = options.outDir ?? (await mkdtemp(path.join(os.tmpdir(), "wren-harness-agent-sdk-")));
         if (options.signal?.aborted)
             throw new Error("warble-agent-sdk chat was cancelled during preparation");
-        const command = buildAgentSdkChatArgs(cli, {
-            irPath,
-            userProject: options.userProject,
-            question: options.question,
-            outDir,
-            warbleBin,
-            agentId,
-            ...(options.modelsConfig !== undefined ? { modelsConfig: options.modelsConfig } : {}),
-            ...(options.maxTurns !== undefined ? { maxTurns: options.maxTurns } : {}),
-            ...(options.resumeSessionId !== undefined ? { resume: options.resumeSessionId } : {}),
-        });
-        const { finalText, sessionId } = await spawnChat(command, (event) => emitter.emit(event), options.chatTimeoutMs ?? CHAT_TIMEOUT_MS, options.signal);
-        // `spawnChat` resolves with whatever trimmed final-answer text
-        // the process produced, even if that's empty — e.g. the CLI exits 0 but
-        // never printed a terminal answer line (a dispatcher bug, an unexpected
-        // output-format change, or a turn that produced no text). Treat that as
-        // a failure rather than a silent empty "answer".
-        if (finalText.length === 0) {
-            throw new Error("warble-agent-sdk chat exited successfully but produced no stdout — expected the turn's " +
-                "final answer text; got empty output");
+        // This turn's host query service, when the caller asked for one: the only place the host MCP's
+        // run_sql executes and the only evidence the answer can be grounded on. Closed (and its
+        // observations discarded) when the turn ends, whatever the outcome.
+        const host = await openAskHostQueries(options, irPath);
+        try {
+            const command = buildAgentSdkChatArgs(cli, {
+                irPath,
+                userProject: options.userProject,
+                question: options.question,
+                outDir,
+                warbleBin,
+                agentId,
+                ...(options.modelsConfig !== undefined ? { modelsConfig: options.modelsConfig } : {}),
+                ...(options.maxTurns !== undefined ? { maxTurns: options.maxTurns } : {}),
+                ...(options.resumeSessionId !== undefined ? { resume: options.resumeSessionId } : {}),
+                ...(host !== undefined ? { hostMcpConfig: host.configFile } : {}),
+            });
+            const { finalText, sessionId } = await spawnChat(command, (event) => emitter.emit(event), options.chatTimeoutMs ?? CHAT_TIMEOUT_MS, options.signal);
+            // `spawnChat` resolves with whatever trimmed final-answer text
+            // the process produced, even if that's empty — e.g. the CLI exits 0 but
+            // never printed a terminal answer line (a dispatcher bug, an unexpected
+            // output-format change, or a turn that produced no text). Treat that as
+            // a failure rather than a silent empty "answer".
+            if (finalText.length === 0) {
+                throw new Error("warble-agent-sdk chat exited successfully but produced no stdout — expected the turn's " +
+                    "final answer text; got empty output");
+            }
+            const hostObservations = host?.service.observations();
+            emitter.emit({ kind: "answer", text: finalText });
+            emitter.emit({ kind: "run.finish", status: "answer" });
+            return {
+                finalText,
+                ...(sessionId !== undefined ? { sessionId } : {}),
+                ...(hostObservations !== undefined ? { hostObservations } : {}),
+            };
+        }
+        finally {
+            await host?.service.close();
         }
-        emitter.emit({ kind: "answer", text: finalText });
-        emitter.emit({ kind: "run.finish", status: "answer" });
-        return { finalText, ...(sessionId !== undefined ? { sessionId } : {}) };
     }
     catch (error) {
         emitter.emit({ kind: "error", message: describeDispatchedError(error) });
@@ -200,6 +226,78 @@ export async function runDispatchedDefault(options) {
         throw error;
     }
 }
+/**
+ * Opens an Ask turn's host query service and writes its host MCP config, or returns `undefined`
+ * when the turn runs without one (not requested, a hybrid models config, or no `wren` on PATH).
+ */
+async function openAskHostQueries(options, irPath) {
+    if (options.hostQueries === undefined)
+        return undefined;
+    if (options.modelsConfig !== undefined && await bindsNonAnthropicTier(irPath, options.modelsConfig))
+        return undefined;
+    let wren;
+    try {
+        wren = options.hostQueries.wren ?? resolveExecutableOnPath("wren");
+    }
+    catch {
+        return undefined;
+    }
+    const userProject = options.userProject;
+    const service = await openHostQueryService({
+        openAccess: async (signal) => openWrenComponentAccess({
+            executable: wren,
+            project: userProject,
+            fingerprint: await hashDirectory(userProject),
+            signal,
+        }),
+        ...(options.signal !== undefined ? { signal: options.signal } : {}),
+    });
+    try {
+        const configFile = await writeHostMcpConfig(service, {
+            proxy: defaultWrenHostProxy(),
+            mcpServer: { command: wren, prefixArgs: [] },
+            userProject,
+        });
+        return { service, configFile };
+    }
+    catch (error) {
+        await service.close();
+        throw error;
+    }
+}
+/**
+ * True when the models config binds a tier this IR's steps use to a non-Anthropic provider. Warble
+ * runs such a plan hybrid-staged and refuses `--host-mcp-config` for it; an all-Anthropic config (the
+ * only kind Setup writes for Claude subscription) keeps the host MCP. Every IR tier is checked, not
+ * just the dispatched component's, so a hybrid tier anywhere in the profile also skips it.
+ */
+async function bindsNonAnthropicTier(irPath, modelsConfig) {
+    const ir = JSON.parse(await readFile(irPath, "utf8"));
+    const models = ModelConfig.fromYaml(await readFile(modelsConfig, "utf8"));
+    const tiers = new Set(ir.components.flatMap((component) => component.llm_calls.map((step) => step.tier)));
+    return [...tiers].some((tier) => models.binding(tier).provider !== "anthropic");
+}
+/**
+ * Writes the turn's `--host-mcp-config` file into the host query service's private 0700
+ * directory, as warble 0.16 reads it: a 0600 file owned by this user holding exactly
+ * `{name, command, args, tools, instruction}`, `command` absolute. The server is the Wren host
+ * proxy in front of `wren serve mcp`; the file names the credential file by path only, never its
+ * token. It is removed with the directory when the service closes.
+ */
+export async function writeHostMcpConfig(service, options) {
+    if (!path.isAbsolute(options.proxy.command))
+        throw new Error("the host MCP command must be an absolute path");
+    const file = path.join(service.directory, "host-mcp.json");
+    const config = {
+        name: HOST_MCP_SERVER_NAME,
+        command: options.proxy.command,
+        args: wrenHostProxyArgs({ ...options, credentialFile: service.credentialFile }),
+        tools: [...HOST_MCP_TOOLS],
+        instruction: HOST_MCP_INSTRUCTION,
+    };
+    await writeFile(file, JSON.stringify(config), { encoding: "utf8", mode: 0o600, flag: "wx" });
+    return file;
+}
 function describeDispatchedError(error) {
     if (error instanceof Error)
         return error.message;

package/dist-server/harness/route/host-query.d.ts

@@ -0,0 +1,93 @@
+import type { ComponentAccess } from "../components/broker.js";
+import { type GovernedErrorClass } from "../components/wren-access.js";
+import type { ResolvedCli } from "./agent-sdk-cli.js";
+/**
+ * One query the host executed for a subscription turn or a native session, in the component
+ * runner's observation shape (`input.sql`, `output` carrying a host `query_id`), so the shared
+ * grounding predicate reads it unchanged.
+ */
+export interface HostQueryObservation {
+    readonly tool: "run_sql";
+    readonly input: {
+        readonly sql: string;
+        readonly limit: number;
+    };
+    readonly output: unknown;
+}
+/**
+ * Per-scope bounds (one Ask turn, or one native session). Count, request and per-result bytes
+ * reuse the component runner's limits; the total caps what the host keeps in memory for one scope
+ * until its answer is grounded. Rows default to 1000 like `run_sql`. Like `run_sql`, the host
+ * probes one row past the limit to report truncation; the cap is 9999 so the probe stays within
+ * governed-stdio's 10000-row bound.
+ */
+export declare const HOST_QUERY_LIMITS: Readonly<{
+    queries: 32;
+    requestBytes: 65536;
+    resultBytes: 1048576;
+    totalResultBytes: number;
+    defaultRows: 1000;
+    maxRows: 9999;
+    timeoutMs: 120000;
+}>;
+/** Error classes a host query may return; each transport owns the sentence the model sees. */
+export type HostQueryErrorClass = GovernedErrorClass | "unauthorized" | "budget_exhausted";
+export type HostQueryOutcome = {
+    readonly result: unknown;
+} | {
+    readonly error: HostQueryErrorClass;
+};
+export interface HostQueryRecorderOptions {
+    /** Opens governed access for this scope; called at most once, on the first query. */
+    readonly openAccess: (signal: AbortSignal) => Promise<ComponentAccess>;
+    readonly signal?: AbortSignal;
+}
+/**
+ * Executes and records one scope's queries in process. The scope is the recorder: its
+ * observations are never shared, and its `query_id`s carry a tag no other recorder has.
+ */
+export interface HostQueryRecorder {
+    execute(sql: unknown, limit: unknown): Promise<HostQueryOutcome>;
+    /** This scope's recorded observations, in execution order. Empty after `close()`. */
+    observations(): readonly HostQueryObservation[];
+    /** Stops accepting queries, discards observations, closes governed access. Idempotent. */
+    close(): Promise<void>;
+}
+/**
+ * Every query runs through governed access (`wren governed-stdio`), gets a scope-unique host
+ * `query_id` (`q<N>-<tag>`), and is recorded as an observation of this scope only.
+ */
+export declare function createHostQueryRecorder(options: HostQueryRecorderOptions): HostQueryRecorder;
+export interface HostQueryService {
+    /** This service's private 0700 directory; it is removed on `close()`. */
+    readonly directory: string;
+    /** A 0600 file holding this turn's socket path and token. Its own path carries no secret. */
+    readonly credentialFile: string;
+    /** This turn's recorded observations, in execution order. Empty after `close()`. */
+    observations(): readonly HostQueryObservation[];
+    /** Stops accepting queries, discards observations, closes governed access, removes the directory. */
+    close(): Promise<void>;
+}
+export type HostQueryServiceOptions = HostQueryRecorderOptions;
+/**
+ * The host side of a subscription turn's `run_sql` (codex:local and the Claude agent-sdk Ask):
+ * a per-turn unix socket in a fresh 0700 directory that answers only requests carrying this
+ * turn's random token, in front of one {@link createHostQueryRecorder} for the turn.
+ */
+export declare function openHostQueryService(options: HostQueryServiceOptions): Promise<HostQueryService>;
+/**
+ * The argv after the proxy command: the proxy script, this turn's credential file, then the
+ * `wren serve mcp` command it fronts. Shared by codex:local's `--server-arg`s and the agent-sdk
+ * host MCP config so the two cannot drift.
+ */
+export declare function wrenHostProxyArgs(options: {
+    readonly proxy: ResolvedCli;
+    readonly credentialFile: string;
+    readonly mcpServer: ResolvedCli;
+    readonly userProject: string;
+}): string[];
+/** The built proxy next to this module, else its source (Node strips its erasable types). */
+export declare function defaultWrenHostProxy(): ResolvedCli;
+/** Governed access spawns one executable with fixed arguments; a prefixed command cannot be bound. */
+export declare function singleWrenExecutable(cli: ResolvedCli): string;
+export declare function resolveExecutableOnPath(name: string): string;