@wrenai/genbi 0.0.4 → 0.0.6

package/dist-server/harness/route/wren-host-proxy.js

@@ -0,0 +1,228 @@
+#!/usr/bin/env node
+/**
+ * The Wren MCP server of a subscription Ask turn (codex:local, and the Claude agent-sdk host MCP):
+ * a stdio proxy in front of `wren serve mcp`.
+ *
+ *   node wren-host-proxy.js --credential-file <abs path> -- <wren> serve mcp --project <p> --quiet
+ *
+ * Every JSON-RPC line passes through to the child `wren serve mcp` unchanged, so the model sees
+ * the same tool names and schemas, except a `tools/call` of `run_sql`: that goes to this turn's
+ * host query service (see `host-query.ts`), which executes it through governed access and
+ * records it as host evidence. The credential file (0600, owned by this user) names the turn's
+ * unix socket and token; without a valid one, `run_sql` is refused rather than run elsewhere.
+ *
+ * Node builtins only, and erasable TypeScript only, so it also runs from source.
+ */
+import { spawn } from "node:child_process";
+import { closeSync, constants as fsConstants, fstatSync, openSync, readFileSync, realpathSync } from "node:fs";
+import { connect } from "node:net";
+import path from "node:path";
+import { createInterface } from "node:readline";
+import { fileURLToPath } from "node:url";
+const RUN_SQL = "run_sql";
+const MAX_SQL_BYTES = 65_536;
+/** The sentence the model sees per host error class; nothing from the host's wire is forwarded. */
+const ERROR_TEXT = {
+    invalid_request: "The request did not match the governed run_sql contract: pass a non-empty sql string and an optional positive integer limit.",
+    model_not_found: "The query references a table that is not a model in the bound semantic context; query only the models it defines.",
+    policy_rejected: "The read-only analytical policy rejected the query: use one SELECT that reads at least one bound model.",
+    invalid_sql: "The SQL could not be parsed or planned against the semantic context.",
+    execution_failed: "The data source rejected the query at execution time, for example an unknown column or a type mismatch.",
+    timeout: "The query exceeded the statement time limit.",
+    datasource_unavailable: "The bound data source could not be reached.",
+    result_too_large: "The result exceeded the governed byte limit; narrow the query.",
+    budget_exhausted: "This turn's query budget is exhausted; answer from the results you already have.",
+    unauthorized: "run_sql is unavailable: the host query service rejected this session.",
+    internal: "The governed query failed for an unclassified reason.",
+    transport: "The host query service is unavailable.",
+};
+const NO_CREDENTIAL = "run_sql is unavailable: no valid host query credential was provided for this turn.";
+/**
+ * Accepts only an absolute, regular, user-owned file no one else can read or write. The file is
+ * opened without following a symlink and checked and read through that one descriptor, so what
+ * is checked is what is read.
+ */
+export function readCredential(file) {
+    if (!file || !path.isAbsolute(file))
+        return undefined;
+    let fd;
+    try {
+        fd = openSync(file, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || (stat.mode & 0o077) !== 0)
+            return undefined;
+        if (typeof process.getuid === "function" && stat.uid !== process.getuid())
+            return undefined;
+        const value = JSON.parse(readFileSync(fd, "utf8"));
+        if (typeof value.socket !== "string" || !path.isAbsolute(value.socket))
+            return undefined;
+        if (typeof value.token !== "string" || value.token.length < 32)
+            return undefined;
+        return { socket: value.socket, token: value.token };
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+/**
+ * One connection at a time to the turn's host query service, reconnecting after a drop. Only
+ * the current socket's failure fails the pending requests (all of which were sent on it): a
+ * stale socket closing late never fails a request pending on its replacement. Each socket has
+ * its own read buffer.
+ */
+export class HostConnection {
+    credential;
+    open;
+    pending = new Map();
+    socket;
+    nextId = 1;
+    constructor(credential, open = connect) {
+        this.credential = credential;
+        this.open = open;
+    }
+    request(sql, limit) {
+        return new Promise((resolve) => {
+            const id = this.nextId++;
+            try {
+                const socket = this.current();
+                this.pending.set(id, resolve);
+                socket.write(`${JSON.stringify({ token: this.credential.token, id, sql, ...(limit !== undefined ? { limit } : {}) })}\n`);
+            }
+            catch {
+                this.pending.delete(id);
+                resolve({ error: "transport" });
+            }
+        });
+    }
+    close() {
+        this.socket?.end();
+    }
+    current() {
+        if (this.socket && !this.socket.destroyed)
+            return this.socket;
+        const socket = this.open(this.credential.socket);
+        let buffer = "";
+        const fail = () => {
+            if (this.socket !== socket)
+                return;
+            this.socket = undefined;
+            for (const waiter of this.pending.values())
+                waiter({ error: "transport" });
+            this.pending.clear();
+        };
+        socket.setEncoding("utf8");
+        socket.on("data", (chunk) => {
+            buffer += chunk;
+            let newline = buffer.indexOf("\n");
+            while (newline >= 0) {
+                const line = buffer.slice(0, newline);
+                buffer = buffer.slice(newline + 1);
+                newline = buffer.indexOf("\n");
+                try {
+                    const frame = JSON.parse(line);
+                    const waiter = typeof frame.id === "number" ? this.pending.get(frame.id) : undefined;
+                    if (!waiter || typeof frame.id !== "number")
+                        continue;
+                    this.pending.delete(frame.id);
+                    if (frame.error !== undefined)
+                        waiter({ error: typeof frame.error?.class === "string" ? frame.error.class : "internal" });
+                    else
+                        waiter({ result: frame.result });
+                }
+                catch {
+                    socket.destroy();
+                }
+            }
+        });
+        socket.on("error", fail);
+        socket.on("close", fail);
+        this.socket = socket;
+        return socket;
+    }
+}
+function parseArgs(argv) {
+    const separator = argv.indexOf("--");
+    if (separator < 0 || separator === argv.length - 1) {
+        process.stderr.write("wren host proxy: usage: --credential-file <path> -- <command> [args...]\n");
+        process.exit(2);
+    }
+    const own = argv.slice(0, separator);
+    const index = own.indexOf("--credential-file");
+    const credentialFile = index >= 0 ? own[index + 1] : undefined;
+    return { ...(credentialFile !== undefined ? { credentialFile } : {}), command: argv[separator + 1], args: argv.slice(separator + 2) };
+}
+function main() {
+    const options = parseArgs(process.argv.slice(2));
+    const credential = readCredential(options.credentialFile);
+    const host = credential ? new HostConnection(credential) : undefined;
+    const child = spawn(options.command, options.args, { stdio: ["pipe", "pipe", "inherit"] });
+    child.on("error", (error) => {
+        process.stderr.write(`wren host proxy: could not start the Wren MCP server: ${error.message}\n`);
+        process.exit(1);
+    });
+    child.on("exit", (code, signal) => process.exit(code ?? (signal ? 1 : 0)));
+    const send = (line) => { process.stdout.write(`${line}\n`); };
+    createInterface({ input: child.stdout, crlfDelay: Infinity }).on("line", send);
+    const toolResult = (id, text, isError, structured) => {
+        send(JSON.stringify({ jsonrpc: "2.0", id, result: {
+                content: [{ type: "text", text }],
+                ...(structured !== undefined ? { structuredContent: structured } : {}),
+                isError,
+            } }));
+    };
+    const runSql = async (id, input) => {
+        if (!host) {
+            toolResult(id, NO_CREDENTIAL, true);
+            return;
+        }
+        const args = typeof input === "object" && input !== null && !Array.isArray(input) ? input : {};
+        const { sql, limit } = args;
+        if (typeof sql !== "string" || !sql.trim() || Buffer.byteLength(sql) > MAX_SQL_BYTES
+            || (limit !== undefined && limit !== null && (typeof limit !== "number" || !Number.isInteger(limit) || limit < 1))) {
+            toolResult(id, ERROR_TEXT.invalid_request, true);
+            return;
+        }
+        const outcome = await host.request(sql, typeof limit === "number" ? limit : undefined);
+        if (outcome.error !== undefined) {
+            const known = outcome.error in ERROR_TEXT ? outcome.error : "internal";
+            toolResult(id, `Governed Wren query failed [${known}]: ${ERROR_TEXT[known]}`, true);
+            return;
+        }
+        toolResult(id, JSON.stringify(outcome.result), false, outcome.result);
+    };
+    createInterface({ input: process.stdin, crlfDelay: Infinity })
+        .on("line", (line) => {
+        let message;
+        try {
+            message = JSON.parse(line);
+        }
+        catch {
+            message = undefined;
+        }
+        if (message && message.method === "tools/call" && message.id !== undefined && message.params?.name === RUN_SQL) {
+            void runSql(message.id, message.params.arguments);
+            return;
+        }
+        child.stdin.write(`${line}\n`);
+    })
+        .on("close", () => {
+        child.stdin.end();
+        host?.close();
+    });
+}
+function invokedDirectly() {
+    if (process.argv[1] === undefined)
+        return false;
+    try {
+        return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
+    }
+    catch {
+        return false;
+    }
+}
+if (invokedDirectly())
+    main();

package/dist-server/harness/session/run.js

@@ -4,6 +4,7 @@ import { createLocalExecutionEnv } from "../exec/index.js";
 import { deriveEnforcement } from "../guardrails/index.js";
 import { executeAgent, summarizeToolOutput } from "../loop/index.js";
 import { getAllowedBlockTypes, renderEnvelope } from "../render/index.js";
+import { selectAnsweringCandidate } from "../render/answering-query.js";
 import { BUILD_DASHBOARD_TOOL_NAME, WREN_QUERY_TOOL_NAME, withResolvedTools } from "../tools/index.js";
 import { UnknownAgentError } from "./errors.js";
 import { findLockedGatedCheck } from "./gate.js";
@@ -23,11 +24,16 @@ import { findLockedGatedCheck } from "./gate.js";
  * becomes a `RefusalResult`.
  */
 export async function runAgent(bundle, agentId, userInput, ctx) {
+    if (bundle.vercel_bundle_version === "0.2")
+        throw new Error("Composed plans require the component host runner");
     assertCapabilities(bundle, ctx.capabilityRegistry);
     const agent = bundle.agents.find((candidate) => candidate.id === agentId);
     if (!agent) {
         throw new UnknownAgentError(agentId);
     }
+    if (agent.entrypoint === false || (agent.dependencies?.length ?? 0) > 0 || bundle.manifest_version === "0.3") {
+        throw new Error("This manifest requires its owning component runtime");
+    }
     const emitter = createAgentEventEmitter(ctx.onEvent);
     emitter.emit({ kind: "run.start", mode: "A", agentId });
     try {
@@ -50,15 +56,16 @@ export async function runAgent(bundle, agentId, userInput, ctx) {
             // forced to a refusal by this check.
             let sawSuccessfulDataAccessCall = false;
             const requiresDataAccess = agent.capabilities.some((entry) => entry.capability.startsWith("sql_execution:"));
-            // Deterministic table capture: the most recent *successful* `query`
-            // tool result, kept as a flat table payload (columns + positional
-            // rows + the SQL that produced it). This is the agent's real data —
-            // `renderEnvelope` builds the table/definition blocks straight from
-            // it instead of asking the render model to re-emit structure it tends
-            // to summarize away (leaving a bare `{type:"table"}`). The last
-            // success wins because, in the answer_query flow, it is the query
-            // whose rows are the answer.
-            let toolTable;
+            // Deterministic table capture: every *successful* `query` tool result,
+            // kept as a flat table payload (columns + positional rows + the SQL that
+            // produced it). This is the agent's real data — `renderEnvelope` builds
+            // the table/definition blocks straight from it instead of asking the
+            // render model to re-emit structure it tends to summarize away (leaving
+            // a bare `{type:"table"}`). Which capture is the answer is decided after
+            // the loop (see `selectAnsweringCandidate`): the one whose SQL the
+            // terminal artifact names, because a model that runs a stray check after
+            // the right query must not turn that check into a verified answer.
+            const toolTables = [];
             // Deterministic dashboard-envelope capture: the most recent
             // *successful* `build_dashboard` tool result, kept as-is (it's
             // already a complete, ordered `{blocks}` envelope — see
@@ -110,7 +117,7 @@ export async function runAgent(bundle, agentId, userInput, ctx) {
                         sawSuccessfulDataAccessCall = true;
                         const seed = toToolTableSeed(outcome.output, outcome.input);
                         if (seed !== undefined)
-                            toolTable = seed;
+                            toolTables.push(seed);
                     }
                     if (outcome.tool === BUILD_DASHBOARD_TOOL_NAME && outcome.outcome === "success") {
                         const seed = toDashboardSeed(outcome.output);
@@ -124,6 +131,7 @@ export async function runAgent(bundle, agentId, userInput, ctx) {
                 },
                 onEvent: emitter.emit,
             });
+            const toolTable = selectAnsweringCandidate(toolTables, terminalArtifactValue(artifacts));
             const envelope = await renderEnvelope(agent, artifacts, {
                 binding: ctx.binding,
                 registry: ctx.registry,
@@ -278,6 +286,18 @@ export async function runAgent(bundle, agentId, userInput, ctx) {
         throw error;
     }
 }
+/** The last dataflow artifact as a value: JSON text is parsed so a named `definition.sql` is visible. */
+function terminalArtifactValue(artifacts) {
+    const last = [...artifacts.values()].at(-1);
+    if (typeof last !== "string")
+        return last;
+    try {
+        return JSON.parse(last);
+    }
+    catch {
+        return last;
+    }
+}
 function describeRunError(error) {
     if (error instanceof Error)
         return error.message;

package/dist-server/harness/setup/runner.d.ts

@@ -18,6 +18,8 @@ export declare const BUILD_CONTEXT_AGENT_ID = "build_context";
  */
 export declare const DEFAULT_SETUP_MAX_TURNS = 120;
 export interface SetupStepRunOptions {
+    /** Owned turn cancellation, forwarded to the selected runtime. */
+    readonly signal?: AbortSignal;
     /** The composed single-line prompt (see `composeSetupPrompt`). */
     readonly prompt: string;
     /** The workspace root the initial connect turn scaffolds `<name>/` into. */
@@ -421,6 +423,15 @@ export interface HostContractDiagnostic {
     /** The concrete artifact/workflow conditions that must be true before another claimed success. */
     readonly expectedArtifactContract: readonly string[];
 }
+/**
+ * Where the bound project lives, so a recorded command's optional
+ * `cd <dir> &&` prefix can be resolved against it. Absent binding means the
+ * prefix cannot be verified and is not accepted.
+ */
+export interface ProjectBinding {
+    readonly root: string;
+    readonly projectDir: string;
+}
 export type RecordedSchemaDiscovery = {
     readonly kind: "successful";
     readonly command: string;
@@ -439,7 +450,7 @@ export type RecordedSchemaDiscovery = {
  * this for both terminal acceptance and the no-introspection diagnostic,
  * rather than reimplementing the allowlist elsewhere.
  */
-export declare function classifyRecordedSchemaDiscovery(worklog: readonly SetupWorklogEntry[]): RecordedSchemaDiscovery;
+export declare function classifyRecordedSchemaDiscovery(worklog: readonly SetupWorklogEntry[], binding?: ProjectBinding): RecordedSchemaDiscovery;
 /** Ordered, host-recorded progress; each value includes all preceding work. */
 export type ContextLifecyclePrefix = "none" | "discovery" | "validate" | "build";
 export type RecordedContextLifecycle = {
@@ -449,12 +460,15 @@ export type RecordedContextLifecycle = {
 } | {
     readonly kind: "validate_missing";
     readonly observed: string;
+    readonly unrecognised?: string;
 } | {
     readonly kind: "build_missing";
     readonly observed: string;
+    readonly unrecognised?: string;
 } | {
     readonly kind: "out_of_order";
     readonly observed: string;
+    readonly unrecognised?: string;
 };
 /**
  * Returns the greatest ordered prefix proved by the supplied successful tool
@@ -462,8 +476,8 @@ export type RecordedContextLifecycle = {
  * call in the same attempt is out of order, so a corrective attempt can ask
  * only for the unproven suffix.
  */
-export declare function recordedContextLifecyclePrefix(worklog: readonly SetupWorklogEntry[], prior?: ContextLifecyclePrefix): ContextLifecyclePrefix;
-export declare function classifyRecordedContextLifecycle(worklog: readonly SetupWorklogEntry[], prior?: ContextLifecyclePrefix): RecordedContextLifecycle;
+export declare function recordedContextLifecyclePrefix(worklog: readonly SetupWorklogEntry[], prior?: ContextLifecyclePrefix, binding?: ProjectBinding): ContextLifecyclePrefix;
+export declare function classifyRecordedContextLifecycle(worklog: readonly SetupWorklogEntry[], prior?: ContextLifecyclePrefix, binding?: ProjectBinding): RecordedContextLifecycle;
 /**
  * Parses the LAST `SETUP_STATUS: ok|needs_input|error` line out of a setup
  * turn's finalText (the terminal contract lives in the composed