@wrenai/genbi 0.0.4 → 0.0.6

package/dist-server/harness/route/host-query.js

@@ -0,0 +1,257 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { accessSync, existsSync, constants as fsConstants } from "node:fs";
+import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { createServer } from "node:net";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { COMPONENT_LIMITS } from "../components/runner.js";
+import { GovernedWrenError } from "../components/wren-access.js";
+/**
+ * Per-scope bounds (one Ask turn, or one native session). Count, request and per-result bytes
+ * reuse the component runner's limits; the total caps what the host keeps in memory for one scope
+ * until its answer is grounded. Rows default to 1000 like `run_sql`. Like `run_sql`, the host
+ * probes one row past the limit to report truncation; the cap is 9999 so the probe stays within
+ * governed-stdio's 10000-row bound.
+ */
+export const HOST_QUERY_LIMITS = Object.freeze({
+    queries: COMPONENT_LIMITS.calls,
+    requestBytes: COMPONENT_LIMITS.requestBytes,
+    resultBytes: COMPONENT_LIMITS.resultBytes,
+    totalResultBytes: 8 * COMPONENT_LIMITS.resultBytes,
+    defaultRows: 1000,
+    maxRows: 9_999,
+    timeoutMs: COMPONENT_LIMITS.timeoutMs,
+});
+/**
+ * Every query runs through governed access (`wren governed-stdio`), gets a scope-unique host
+ * `query_id` (`q<N>-<tag>`), and is recorded as an observation of this scope only.
+ */
+export function createHostQueryRecorder(options) {
+    const tag = randomBytes(4).toString("hex");
+    const controller = new AbortController();
+    const signal = options.signal ? AbortSignal.any([options.signal, controller.signal]) : controller.signal;
+    const recorded = [];
+    let attempts = 0;
+    let recordedBytes = 0;
+    let closed = false;
+    let access;
+    const execute = async (sql, limit) => {
+        if (closed || signal.aborted)
+            return { error: "transport" };
+        if (typeof sql !== "string" || !sql.trim() || Buffer.byteLength(sql) > HOST_QUERY_LIMITS.requestBytes)
+            return { error: "invalid_request" };
+        if (limit !== undefined && limit !== null && (typeof limit !== "number" || !Number.isInteger(limit) || limit < 1))
+            return { error: "invalid_request" };
+        if (attempts >= HOST_QUERY_LIMITS.queries)
+            return { error: "budget_exhausted" };
+        attempts += 1;
+        const rows = Math.min(HOST_QUERY_LIMITS.maxRows, typeof limit === "number" ? limit : HOST_QUERY_LIMITS.defaultRows);
+        let result;
+        try {
+            access ??= options.openAccess(signal);
+            const governed = await access;
+            result = await governed.query({ sql, limit: rows + 1 }, AbortSignal.any([signal, AbortSignal.timeout(HOST_QUERY_LIMITS.timeoutMs)]));
+        }
+        catch (error) {
+            return { error: error instanceof GovernedWrenError ? error.errorClass : "transport" };
+        }
+        if (closed)
+            return { error: "transport" };
+        if (typeof result !== "object" || result === null || Array.isArray(result))
+            return { error: "internal" };
+        const probed = result.rows;
+        if (!Array.isArray(probed))
+            return { error: "internal" };
+        // The N+1 probe, as plain `run_sql` reports it: more rows than asked means the shown rows
+        // are not the whole result. Only `rows` rows are returned and recorded.
+        const truncated = probed.length > rows;
+        const shown = truncated ? probed.slice(0, rows) : probed;
+        // The id is assigned here, once, so the observation and the model's copy carry the same id. The
+        // tag makes ids unique per scope: an id copied from another turn or session never names this one's query.
+        const output = { ...result, rows: shown, row_count: shown.length, truncated, query_id: `q${attempts}-${tag}` };
+        const bytes = Buffer.byteLength(JSON.stringify(output));
+        if (bytes > HOST_QUERY_LIMITS.resultBytes)
+            return { error: "result_too_large" };
+        if (recordedBytes + bytes > HOST_QUERY_LIMITS.totalResultBytes)
+            return { error: "budget_exhausted" };
+        recordedBytes += bytes;
+        recorded.push(Object.freeze({ tool: "run_sql", input: Object.freeze({ sql, limit: rows }), output: structuredClone(output) }));
+        return { result: output };
+    };
+    let closing;
+    const close = () => {
+        closing ??= (async () => {
+            closed = true;
+            recorded.length = 0;
+            controller.abort();
+            try {
+                if (access)
+                    await (await access).close();
+            }
+            catch {
+                // Access that never opened, or already closed, has nothing left to release.
+            }
+        })();
+        return closing;
+    };
+    options.signal?.addEventListener("abort", () => { void close(); }, { once: true });
+    return { execute, observations: () => Object.freeze([...recorded]), close };
+}
+function requestFrame(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return undefined;
+    const record = value;
+    if (typeof record.id !== "number" || !Number.isSafeInteger(record.id))
+        return undefined;
+    return { token: record.token, id: record.id, sql: record.sql, limit: record.limit };
+}
+/**
+ * The host side of a subscription turn's `run_sql` (codex:local and the Claude agent-sdk Ask):
+ * a per-turn unix socket in a fresh 0700 directory that answers only requests carrying this
+ * turn's random token, in front of one {@link createHostQueryRecorder} for the turn.
+ */
+export async function openHostQueryService(options) {
+    if (process.platform === "win32")
+        throw new Error("the host query service requires unix sockets");
+    const directory = await mkdtemp(path.join(os.tmpdir(), "genbi-hq-"));
+    const token = Buffer.from(randomBytes(32).toString("base64url"), "utf8");
+    const socketPath = path.join(directory, "s");
+    const credentialFile = path.join(directory, "credential.json");
+    const recorder = createHostQueryRecorder(options);
+    const sockets = new Set();
+    let closed = false;
+    const authorized = (candidate) => {
+        if (typeof candidate !== "string")
+            return false;
+        const presented = Buffer.from(candidate, "utf8");
+        return presented.length === token.length && timingSafeEqual(presented, token);
+    };
+    const serve = (socket) => {
+        if (closed) {
+            socket.destroy();
+            return;
+        }
+        sockets.add(socket);
+        socket.on("close", () => sockets.delete(socket));
+        socket.on("error", () => socket.destroy());
+        let buffer = "";
+        let tail = Promise.resolve();
+        socket.setEncoding("utf8");
+        socket.on("data", (chunk) => {
+            buffer += chunk;
+            if (buffer.length > 2 * HOST_QUERY_LIMITS.requestBytes) {
+                socket.destroy();
+                return;
+            }
+            let newline = buffer.indexOf("\n");
+            while (newline >= 0) {
+                const line = buffer.slice(0, newline);
+                buffer = buffer.slice(newline + 1);
+                newline = buffer.indexOf("\n");
+                let frame;
+                try {
+                    frame = requestFrame(JSON.parse(line));
+                }
+                catch {
+                    frame = undefined;
+                }
+                if (!frame) {
+                    socket.destroy();
+                    return;
+                }
+                const { id, sql, limit } = frame;
+                if (!authorized(frame.token)) {
+                    socket.end(`${JSON.stringify({ id, error: { class: "unauthorized" } })}\n`);
+                    return;
+                }
+                tail = tail.then(async () => {
+                    const outcome = await recorder.execute(sql, limit);
+                    if (socket.destroyed)
+                        return;
+                    socket.write(`${JSON.stringify("result" in outcome ? { id, result: outcome.result } : { id, error: { class: outcome.error } })}\n`);
+                }).catch(() => { socket.destroy(); });
+            }
+        });
+    };
+    const server = createServer(serve);
+    try {
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(socketPath, () => { server.off("error", reject); resolve(); });
+        });
+        await chmod(socketPath, 0o600);
+        await writeFile(credentialFile, JSON.stringify({ socket: socketPath, token: token.toString("utf8") }), { encoding: "utf8", mode: 0o600, flag: "wx" });
+    }
+    catch (error) {
+        server.close();
+        await recorder.close();
+        await rm(directory, { recursive: true, force: true });
+        throw error;
+    }
+    let closing;
+    const close = () => {
+        closing ??= (async () => {
+            closed = true;
+            for (const socket of sockets)
+                socket.destroy();
+            await new Promise((resolve) => server.close(() => resolve()));
+            try {
+                await recorder.close();
+            }
+            finally {
+                await rm(directory, { recursive: true, force: true });
+            }
+        })();
+        return closing;
+    };
+    options.signal?.addEventListener("abort", () => { void close(); }, { once: true });
+    return { directory, credentialFile, observations: recorder.observations, close };
+}
+/**
+ * The argv after the proxy command: the proxy script, this turn's credential file, then the
+ * `wren serve mcp` command it fronts. Shared by codex:local's `--server-arg`s and the agent-sdk
+ * host MCP config so the two cannot drift.
+ */
+export function wrenHostProxyArgs(options) {
+    return [
+        ...options.proxy.prefixArgs,
+        "--credential-file",
+        options.credentialFile,
+        "--",
+        options.mcpServer.command,
+        ...options.mcpServer.prefixArgs,
+        "serve",
+        "mcp",
+        "--project",
+        options.userProject,
+        "--quiet",
+    ];
+}
+/** The built proxy next to this module, else its source (Node strips its erasable types). */
+export function defaultWrenHostProxy() {
+    const built = fileURLToPath(new URL("./wren-host-proxy.js", import.meta.url));
+    const script = existsSync(built) ? built : fileURLToPath(new URL("./wren-host-proxy.ts", import.meta.url));
+    return { command: process.execPath, prefixArgs: [script] };
+}
+/** Governed access spawns one executable with fixed arguments; a prefixed command cannot be bound. */
+export function singleWrenExecutable(cli) {
+    if (cli.prefixArgs.length > 0)
+        throw new Error("host queries need a standalone wren executable");
+    return cli.command;
+}
+export function resolveExecutableOnPath(name) {
+    for (const directory of (process.env.PATH ?? "").split(path.delimiter)) {
+        if (!directory)
+            continue;
+        const candidate = path.join(directory, name);
+        try {
+            accessSync(candidate, fsConstants.X_OK);
+            return candidate;
+        }
+        catch {
+            // Keep searching.
+        }
+    }
+    throw new Error(`could not find the "${name}" executable on PATH`);
+}

package/dist-server/harness/route/in-process.d.ts

@@ -1,11 +1,32 @@
+import { type TierBinding } from "../providers/index.js";
 import type { RunAgentResult } from "../session/index.js";
 import type { InProcessOptions } from "./types.js";
-/** Projects a bundle-wide validated map onto the component selected for one turn. */
+/**
+ * Projects a bundle-wide validated map onto the component selected for one
+ * turn, keyed on (mount, tier): an `<agent.id>/<tier>` entry wins over the
+ * bare tier entry, so the same tier name can bind a different model per mount.
+ */
 export declare function filterTierBindingForAgent(agent: {
+    readonly id?: string;
     readonly steps: readonly {
         readonly tier: string;
     }[];
 }, tierBinding: Readonly<Record<string, import("../providers/index.js").AdapterSpec>>): Readonly<Record<string, import("../providers/index.js").AdapterSpec>>;
+/**
+ * The legacy (single-agent, IR 0.6) path has no caller/callee split: every
+ * step, and the render stage, sees rows. So a zone-aware binding on this path
+ * must be all-private; a `public` or unset zone on any tier the agent (or its
+ * render stage) uses is a loud failure, the same posture as the composed gate.
+ */
+export declare function assertLegacyZoneBinding(agent: {
+    readonly id: string;
+    readonly steps: readonly {
+        readonly tier: string;
+        readonly realization: {
+            readonly kind: string;
+        };
+    }[];
+}, binding: TierBinding, renderTier: string | undefined): void;
 /**
  * Resolves the `rootDir` the native `write_artifact` tool's
  * `createLocalExecutionEnv` scope is rooted at. Precedence: an explicit

package/dist-server/harness/route/in-process.js

@@ -3,20 +3,57 @@ import path from "node:path";
 import { createDefaultCapabilityRegistry } from "../capability/registry.js";
 import { createLocalExecutionEnv } from "../exec/index.js";
 import { deriveEnforcement } from "../guardrails/index.js";
-import { createDefaultProviderRegistry } from "../providers/index.js";
+import { createDefaultProviderRegistry, isZoneAwareBinding, resolveTierSpec } from "../providers/index.js";
+import { ZoneGateError } from "../components/zone-gate.js";
 import { runAgent } from "../session/index.js";
 import { createWrenNativeToolRegistry, resolveWrenBinary } from "../tools/index.js";
 import { deriveAdapterSpec } from "./adapter-spec.js";
 import { describeBundle } from "./describe.js";
 import { buildHybridTierBinding, buildUniformTierBinding } from "./tier-binding.js";
+import { executionPlanFor } from "../components/display.js";
+import { runInProcessComponents } from "../components/in-process.js";
 const ANSWER_QUERY_AGENT_ID = "answer_query";
 /** Operator-wide override for `resolveArtifactsDir`'s default, e.g. for a long-running BFF process. */
 const ARTIFACTS_DIR_ENV_VAR = "WREN_HARNESS_ARTIFACTS_DIR";
-/** Projects a bundle-wide validated map onto the component selected for one turn. */
+/**
+ * Projects a bundle-wide validated map onto the component selected for one
+ * turn, keyed on (mount, tier): an `<agent.id>/<tier>` entry wins over the
+ * bare tier entry, so the same tier name can bind a different model per mount.
+ */
 export function filterTierBindingForAgent(agent, tierBinding) {
+    const binding = { tiers: tierBinding };
     return Object.fromEntries([...new Set(agent.steps.map((step) => step.tier))]
-        .filter((tier) => tierBinding[tier] !== undefined)
-        .map((tier) => [tier, tierBinding[tier]]));
+        .map((tier) => [tier, resolveTierSpec(binding, tier, agent.id)?.spec])
+        .filter((entry) => entry[1] !== undefined));
+}
+/**
+ * The legacy (single-agent, IR 0.6) path has no caller/callee split: every
+ * step, and the render stage, sees rows. So a zone-aware binding on this path
+ * must be all-private; a `public` or unset zone on any tier the agent (or its
+ * render stage) uses is a loud failure, the same posture as the composed gate.
+ */
+export function assertLegacyZoneBinding(agent, binding, renderTier) {
+    if (!isZoneAwareBinding(binding))
+        return;
+    const violations = [];
+    const check = (tier, what) => {
+        const resolved = resolveTierSpec(binding, tier, agent.id);
+        const zone = resolved?.spec.zone ?? "unbound";
+        if (!resolved)
+            violations.push({ code: "unbound_tier", component: agent.id, tier, zone, message: `${what} (tier ${tier}) has no binding entry` });
+        else if (zone === "unbound")
+            violations.push({ code: "missing_zone", component: agent.id, tier, zone, message: `${what} (tier ${tier}) sees project data but binding entry "${resolved.key}" declares no zone` });
+        else if (zone !== "private")
+            violations.push({ code: "data_step_public", component: agent.id, tier, zone, message: `${what} (tier ${tier}) sees project data but binding entry "${resolved.key}" is zone: ${zone}; it must be private` });
+    };
+    for (const step of agent.steps)
+        check(step.tier, `step ${agent.id}.${step.tier}`);
+    const independent = agent.steps.filter((step) => step.realization.kind === "independent");
+    const render = renderTier ?? independent[independent.length - 1]?.tier;
+    if (render !== undefined)
+        check(render, `render stage of ${agent.id}`);
+    if (violations.length > 0)
+        throw new ZoneGateError(violations);
 }
 /**
  * Resolves the `rootDir` the native `write_artifact` tool's
@@ -56,6 +93,12 @@ export function resolveArtifactsDir(outDir) {
  */
 export async function runInProcessDefault(options) {
     const bundle = options.bundle ?? (await describeBundle(options));
+    if (bundle.vercel_bundle_version === "0.2") {
+        const plan = executionPlanFor(bundle);
+        if (!plan)
+            throw new Error("Composed display has no trusted execution plan");
+        return runInProcessComponents(plan, options);
+    }
     // Intent routing (server/turn.ts) picks the agent id when present; falls back to answer_query,
     // the original default from before intent routing existed.
     const agentId = options.agentId ?? ANSWER_QUERY_AGENT_ID;
@@ -69,6 +112,13 @@ export async function runInProcessDefault(options) {
     // here; `buildHybridTierBinding` intentionally rejects tiers used solely by
     // another component.
     const agentTierBinding = options.tierBinding === undefined ? undefined : filterTierBindingForAgent(agent, options.tierBinding);
+    if (options.tierBinding !== undefined || options.disclosurePolicy !== undefined || options.zoneRoles !== undefined) {
+        assertLegacyZoneBinding(agent, {
+            tiers: options.tierBinding ?? {},
+            ...(options.disclosurePolicy !== undefined ? { disclosurePolicy: options.disclosurePolicy } : {}),
+            ...(options.zoneRoles !== undefined ? { roles: options.zoneRoles } : {}),
+        }, undefined);
+    }
     const binding = options.tierBinding !== undefined
         ? buildHybridTierBinding(agent, agentTierBinding)
         : buildUniformTierBinding(agent, deriveAdapterSpec(options.authChoice, options.model !== undefined ? { model: options.model } : {}));

package/dist-server/harness/route/route.js

@@ -41,8 +41,8 @@ export async function route(options) {
     const deployment = options.deployment ?? "personal";
     const { warnings } = enforceCompliance(authChoice, { deployment });
     if (authChoice.mode === "subscription") {
-        if (options.tierBinding !== undefined) {
-            throw new Error("tierBinding (hybrid in-process per-tier routing) has no effect under a subscription " +
+        if (options.tierBinding !== undefined || options.disclosurePolicy !== undefined || options.zoneRoles !== undefined) {
+            throw new Error("tierBinding (with disclosurePolicy/zoneRoles: hybrid in-process per-tier routing) has no effect under a subscription " +
                 "authChoice — dispatched has no adapter/tier binding of its own; use modelsConfig instead " +
                 "(warble-agent-sdk's own --models-config per-step routing)");
         }
@@ -86,6 +86,9 @@ export async function route(options) {
             ...(options.agentId !== undefined ? { agentId: options.agentId } : {}),
             ...(options.chatTimeoutMs !== undefined ? { chatTimeoutMs: options.chatTimeoutMs } : {}),
             ...(options.signal !== undefined ? { signal: options.signal } : {}),
+            // An Ask turn: its data queries can run through a per-turn host query service, so the
+            // answer can be grounded on host evidence (see `withHostVerification`).
+            hostQueries: {},
         });
         return { backend: "agent-sdk", warnings, ...result };
     }
@@ -96,6 +99,7 @@ export async function route(options) {
             "per-tier adapter map)");
     }
     const result = await runInProcess({
+        ...(options.signal !== undefined ? { signal: options.signal } : {}),
         authChoice,
         profileSource: options.profileSource,
         userProject: options.userProject,
@@ -107,6 +111,8 @@ export async function route(options) {
         ...(options.bundle !== undefined ? { bundle: options.bundle } : {}),
         ...(options.mcpServers !== undefined ? { mcpServers: options.mcpServers } : {}),
         ...(options.tierBinding !== undefined ? { tierBinding: options.tierBinding } : {}),
+        ...(options.disclosurePolicy !== undefined ? { disclosurePolicy: options.disclosurePolicy } : {}),
+        ...(options.zoneRoles !== undefined ? { zoneRoles: options.zoneRoles } : {}),
         ...(options.onEvent !== undefined ? { onEvent: options.onEvent } : {}),
         ...(options.agentId !== undefined ? { agentId: options.agentId } : {}),
     });

package/dist-server/harness/route/types.d.ts

@@ -2,7 +2,7 @@ import type { AuthChoice } from "../auth/index.js";
 import type { Bundle } from "../bundle/schema.js";
 import type { Deployment } from "../compliance/index.js";
 import type { AgentEvent } from "../events/index.js";
-import type { AdapterSpec } from "../providers/index.js";
+import type { AdapterSpec, DisclosurePolicy, ZoneRoles } from "../providers/index.js";
 import type { RunAgentResult } from "../session/index.js";
 import type { McpServerConfigMap } from "../tools/index.js";
 import type { ResolvedCli } from "./agent-sdk-cli.js";
@@ -15,6 +15,7 @@ import type { CodexManifestModels } from "./codex-local-manifest.js";
  * tool through the real `wren` CLI (native tools) against `userProject`.
  */
 export interface InProcessOptions {
+    readonly signal?: AbortSignal;
     readonly authChoice: Extract<AuthChoice, {
         mode: "api-key" | "local" | "gateway";
     }>;
@@ -55,6 +56,19 @@ export interface InProcessOptions {
      * coverage is total-or-loud-fail.
      */
     readonly tierBinding?: Readonly<Record<string, AdapterSpec>>;
+    /**
+     * Hybrid privacy split: the egress disclosure policy the verification step
+     * enforces on every callee result before a caller sees it. Its presence
+     * arms the zone gate (see `components/zone-gate.ts`) and requires
+     * `zoneRoles.judge`.
+     */
+    readonly disclosurePolicy?: DisclosurePolicy;
+    /** Hybrid privacy split: binding keys of the judge / render tiers the zone gate checks by role. */
+    readonly zoneRoles?: ZoneRoles;
+    /** Hybrid privacy split: size bound for the capability card handed to public-zone steps (default 32 KiB). */
+    readonly capabilityCard?: {
+        readonly maxBytes?: number;
+    };
     /** Live-event layer: forwarded to `RunAgentContext.onEvent`. See that field's doc comment. */
     readonly onEvent?: (event: AgentEvent) => void;
     /**
@@ -163,6 +177,18 @@ export interface DispatchedOptions {
      * flag) when unset, which is the pre-existing behavior.
      */
     readonly resumeSessionId?: string;
+    /**
+     * Ask turns only (`route()` sets it; the setup and enrichment runners do not): open a per-turn
+     * host query service and hand the dispatcher a host MCP server (`--host-mcp-config`) whose
+     * `run_sql` executes through it, so the answer can be grounded on what the host ran. `wren` is
+     * the standalone Wren executable for both governed access and `wren serve mcp`; when unset it
+     * is resolved on PATH, and when none is found the turn runs without host queries (and its
+     * answer stays unverified). Ignored under `modelsConfig`: warble refuses a host MCP for a
+     * hybrid-staged plan, which a models config can produce.
+     */
+    readonly hostQueries?: {
+        readonly wren?: string;
+    };
     /** Cancels the owned dispatcher process without falling back to another vendor. */
     readonly signal?: AbortSignal;
 }
@@ -177,6 +203,11 @@ export interface DispatchedResult {
      * the SDK itself never produced a session id to report.
      */
     readonly sessionId?: string | null;
+    /**
+     * Ask turns with host queries only: the queries this turn's host query service executed for
+     * the model's host `run_sql`, the only evidence its answer may be grounded on. Never persisted.
+     */
+    readonly hostObservations?: readonly import("./host-query.js").HostQueryObservation[];
 }
 export type DispatchedExecutor = (options: DispatchedOptions) => Promise<DispatchedResult>;
 /** Codex subscription Ask runs through warble-codex-local, never the Claude dispatched dispatcher. */
@@ -209,6 +240,11 @@ export interface CodexAskOptions {
 }
 export interface CodexAskResult {
     readonly finalText: string;
+    /**
+     * codex:local only: the queries this turn's host query service executed for the model's
+     * `run_sql`, the only evidence its answer may be grounded on. Never persisted.
+     */
+    readonly hostObservations?: readonly import("./host-query.js").HostQueryObservation[];
 }
 export type CodexAskExecutor = (options: CodexAskOptions) => Promise<CodexAskResult>;
 /**
@@ -243,6 +279,10 @@ export interface RouteOptions {
     readonly mcpServers?: McpServerConfigMap;
     /** In-process only (hybrid mode); see `InProcessOptions.tierBinding`. `route()` rejects this alongside a `subscription` authChoice. */
     readonly tierBinding?: Readonly<Record<string, AdapterSpec>>;
+    /** In-process only; see `InProcessOptions.disclosurePolicy`. */
+    readonly disclosurePolicy?: DisclosurePolicy;
+    /** In-process only; see `InProcessOptions.zoneRoles`. */
+    readonly zoneRoles?: ZoneRoles;
     /** Dispatched only (hybrid mode); see `DispatchedOptions.modelsConfig`. `route()` rejects this alongside a non-`subscription` authChoice. */
     readonly modelsConfig?: string;
     /** Live-event layer: forwarded to whichever mode executor runs. See `InProcessOptions.onEvent`/`DispatchedOptions.onEvent`. */
@@ -283,4 +323,10 @@ export type RouteResult = ({
 } & DispatchedResult) | ({
     readonly backend: "codex-local";
     readonly warnings: readonly string[];
+} & CodexAskResult) | ({
+    readonly backend: "codex-app-server";
+    readonly warnings: readonly string[];
+    /** Host-captured normalized component evidence; never recovered from model prose. */
+    readonly envelope?: import("../render/envelope.js").RenderEnvelope;
+    readonly dataAttempted?: boolean;
 } & CodexAskResult);

package/dist-server/harness/route/wren-host-proxy.d.ts

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+import { type Socket } from "node:net";
+export interface Credential {
+    readonly socket: string;
+    readonly token: string;
+}
+export interface HostOutcome {
+    readonly result?: unknown;
+    readonly error?: string;
+}
+/**
+ * Accepts only an absolute, regular, user-owned file no one else can read or write. The file is
+ * opened without following a symlink and checked and read through that one descriptor, so what
+ * is checked is what is read.
+ */
+export declare function readCredential(file: string | undefined): Credential | undefined;
+/**
+ * One connection at a time to the turn's host query service, reconnecting after a drop. Only
+ * the current socket's failure fails the pending requests (all of which were sent on it): a
+ * stale socket closing late never fails a request pending on its replacement. Each socket has
+ * its own read buffer.
+ */
+export declare class HostConnection {
+    private readonly credential;
+    private readonly open;
+    private readonly pending;
+    private socket;
+    private nextId;
+    constructor(credential: Credential, open?: (socketPath: string) => Socket);
+    request(sql: string, limit: number | undefined): Promise<HostOutcome>;
+    close(): void;
+    private current;
+}