@wrenai/genbi 0.0.5 → 0.0.6

package/README.md

@@ -25,7 +25,7 @@ the rest:
 
 ## Developer preview
 
-`@wrenai/genbi` is published at `0.0.4`. Nothing here is under a compatibility
+`@wrenai/genbi` is published at `0.0.5`. Nothing here is under a compatibility
 commitment yet — commands, environment variables and interfaces move without
 notice. Runtime support is limited to the exact versions and execution scopes in the
 packaged certification records; a supported protocol alone does not enable a runtime. See

package/dist-server/harness/route/codex-ask.d.ts

@@ -8,7 +8,7 @@ export declare function buildCodexAskArgs(cli: ResolvedCli, options: {
     readonly codexHome: string;
     readonly models: CodexManifestModels;
     readonly mcpServer: ResolvedCli;
-    /** The genbi stdio proxy Codex starts as its `wren` MCP server (see `codex-wren-proxy.ts`). */
+    /** The genbi stdio proxy Codex starts as its `wren` MCP server (see `wren-host-proxy.ts`). */
     readonly proxy: ResolvedCli;
     /** This turn's host query credential file; the proxy reads it, its path carries no secret. */
     readonly credentialFile: string;

package/dist-server/harness/route/codex-ask.js

@@ -1,15 +1,13 @@
 import { spawn } from "node:child_process";
-import { accessSync, existsSync, constants as fsConstants } from "node:fs";
 import { createInterface } from "node:readline";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
 import { hashDirectory } from "../compile/fingerprint.js";
 import { openWrenComponentAccess } from "../components/wren-access.js";
 import { enforceCompliance } from "../compliance/index.js";
 import { compileProfile } from "../compile/pipeline.js";
 import { createAgentEventEmitter } from "../events/index.js";
 import { CodexAskEventMapper } from "./codex-ask-events.js";
-import { openCodexHostQueryService } from "./codex-host-query.js";
+import { defaultWrenHostProxy, openHostQueryService, resolveExecutableOnPath, singleWrenExecutable, wrenHostProxyArgs, } from "./host-query.js";
 import { resolveCodexLocalCli } from "./codex-local-cli.js";
 import { CODEX_ASK_COMPONENTS, codexAnalysisToolArgs, } from "./codex-local-manifest.js";
 const CODEX_BILLING_ENV_KEYS = new Set([
@@ -25,19 +23,7 @@ const DEFAULT_CODEX_ASK_TIMEOUT_MS = 10 * 60 * 1000;
 export function buildCodexAskArgs(cli, options) {
     if (!options.question.trim())
         throw new Error("Codex Ask question must not be empty");
-    const serverArgs = [
-        ...options.proxy.prefixArgs,
-        "--credential-file",
-        options.credentialFile,
-        "--",
-        options.mcpServer.command,
-        ...options.mcpServer.prefixArgs,
-        "serve",
-        "mcp",
-        "--project",
-        options.userProject,
-        "--quiet",
-    ];
+    const serverArgs = wrenHostProxyArgs(options);
     return [
         ...cli.prefixArgs,
         "dispatch",
@@ -107,9 +93,9 @@ export async function runCodexAskDefault(options) {
         // This turn's host query service: the only place codex:local's run_sql executes and the
         // only evidence its answer can be grounded on. Closed (and its observations discarded)
         // when the turn ends, whatever the outcome.
-        const hostQueries = await openCodexHostQueryService({
+        const hostQueries = await openHostQueryService({
             openAccess: async (signal) => openWrenComponentAccess({
-                executable: singleExecutable(mcpServer),
+                executable: singleWrenExecutable(mcpServer),
                 project: userProject,
                 fingerprint: await hashDirectory(userProject),
                 signal,
@@ -124,7 +110,7 @@ export async function runCodexAskDefault(options) {
                 codexHome,
                 models,
                 mcpServer,
-                proxy: defaultWrenProxy(),
+                proxy: defaultWrenHostProxy(),
                 credentialFile: hostQueries.credentialFile,
                 timeoutMs,
                 component,
@@ -154,33 +140,6 @@ function resolveModels(value) {
     }
     return models;
 }
-/** Governed access spawns one executable with fixed arguments; a prefixed command cannot be bound. */
-function singleExecutable(cli) {
-    if (cli.prefixArgs.length > 0)
-        throw new Error("codex:local host queries need a standalone wren executable");
-    return cli.command;
-}
-/** The built proxy next to this module, else its source (Node strips its erasable types). */
-function defaultWrenProxy() {
-    const built = fileURLToPath(new URL("./codex-wren-proxy.js", import.meta.url));
-    const script = existsSync(built) ? built : fileURLToPath(new URL("./codex-wren-proxy.ts", import.meta.url));
-    return { command: process.execPath, prefixArgs: [script] };
-}
-function resolveExecutableOnPath(name) {
-    for (const directory of (process.env.PATH ?? "").split(path.delimiter)) {
-        if (!directory)
-            continue;
-        const candidate = path.join(directory, name);
-        try {
-            accessSync(candidate, fsConstants.X_OK);
-            return candidate;
-        }
-        catch {
-            // Keep searching.
-        }
-    }
-    throw new Error(`could not find the "${name}" executable on PATH`);
-}
 function sanitizedCodexEnvironment() {
     return Object.fromEntries(Object.entries(process.env).filter(([key, value]) => value !== undefined && !CODEX_BILLING_ENV_KEYS.has(key.toUpperCase())));
 }

package/dist-server/harness/route/dispatched.d.ts

@@ -1,5 +1,11 @@
 import type { ResolvedCli } from "./agent-sdk-cli.js";
+import { type HostQueryService } from "./host-query.js";
 import type { DispatchedOptions, DispatchedResult } from "./types.js";
+/** The host MCP server's name; warble allows exactly `mcp__wren_host__run_sql` from it. */
+export declare const HOST_MCP_SERVER_NAME = "wren_host";
+export declare const HOST_MCP_TOOLS: readonly ["run_sql"];
+/** Appended once to the dispatched system prompt by warble (single line, at most 300 characters). */
+export declare const HOST_MCP_INSTRUCTION: string;
 export interface AgentSdkChatCommand {
     readonly command: string;
     readonly args: readonly string[];
@@ -40,6 +46,8 @@ export interface BuildAgentSdkChatArgsOptions {
      * `DispatchedOptions.resumeSessionId`.
      */
     readonly resume?: string;
+    /** This turn's host MCP config file (see `writeHostMcpConfig`), forwarded as `--host-mcp-config <path>`. */
+    readonly hostMcpConfig?: string;
 }
 /**
  * Builds the argv (and stdin input) for a `warble-agent-sdk chat` invocation
@@ -113,6 +121,18 @@ export declare function buildAgentSdkChatArgs(cli: ResolvedCli, options: BuildAg
  * conversation, not a disk-state prompt rebuild.
  */
 export declare function runDispatchedDefault(options: DispatchedOptions): Promise<DispatchedResult>;
+/**
+ * Writes the turn's `--host-mcp-config` file into the host query service's private 0700
+ * directory, as warble 0.16 reads it: a 0600 file owned by this user holding exactly
+ * `{name, command, args, tools, instruction}`, `command` absolute. The server is the Wren host
+ * proxy in front of `wren serve mcp`; the file names the credential file by path only, never its
+ * token. It is removed with the directory when the service closes.
+ */
+export declare function writeHostMcpConfig(service: Pick<HostQueryService, "directory" | "credentialFile">, options: {
+    readonly proxy: ResolvedCli;
+    readonly mcpServer: ResolvedCli;
+    readonly userProject: string;
+}): Promise<string>;
 /**
  * A `spawnChat` turn that failed (non-zero exit, timeout, or spawn error) but still surfaced a
  * resumable SDK session id along the way (the dispatcher's `{t:"session",id}` NDJSON line — see

package/dist-server/harness/route/dispatched.js

@@ -1,14 +1,24 @@
 import { spawn } from "node:child_process";
-import { mkdtemp } from "node:fs/promises";
+import { mkdtemp, readFile, writeFile } from "node:fs/promises";
 import { createInterface } from "node:readline";
 import os from "node:os";
 import path from "node:path";
+import { ModelConfig } from "@warble/claude-agent-sdk";
 import { enforceCompliance } from "../compliance/index.js";
+import { hashDirectory } from "../compile/fingerprint.js";
 import { compileProfile } from "../compile/pipeline.js";
+import { openWrenComponentAccess } from "../components/wren-access.js";
 import { resolveWarbleBinary } from "../compile/resolve-binary.js";
 import { createAgentEventEmitter } from "../events/index.js";
 import { createChatEventMapperState, mapChatEventToAgentEvent, parseWarbleChatEventLine, } from "./chat-event-mapper.js";
 import { resolveAgentSdkCli } from "./agent-sdk-cli.js";
+import { defaultWrenHostProxy, openHostQueryService, resolveExecutableOnPath, wrenHostProxyArgs, } from "./host-query.js";
+/** The host MCP server's name; warble allows exactly `mcp__wren_host__run_sql` from it. */
+export const HOST_MCP_SERVER_NAME = "wren_host";
+export const HOST_MCP_TOOLS = Object.freeze(["run_sql"]);
+/** Appended once to the dispatched system prompt by warble (single line, at most 300 characters). */
+export const HOST_MCP_INSTRUCTION = "Run data queries with mcp__wren_host__run_sql (sql, optional limit): it returns the rows plus a query_id; " +
+    "cite that query_id in your answer's definition.";
 const MODE_B_AGENT_ID = "answer_query";
 /**
  * Builds the argv (and stdin input) for a `warble-agent-sdk chat` invocation
@@ -56,6 +66,7 @@ export function buildAgentSdkChatArgs(cli, options) {
             ...(options.modelsConfig !== undefined ? ["--models-config", options.modelsConfig] : []),
             ...(options.maxTurns !== undefined ? ["--max-turns", String(options.maxTurns)] : []),
             ...(options.resume !== undefined ? ["--resume", options.resume] : []),
+            ...(options.hostMcpConfig !== undefined ? ["--host-mcp-config", options.hostMcpConfig] : []),
             "--stream-json",
         ],
         input: `${encodeQuestionForStdin(options.question)}\n`,
@@ -169,30 +180,45 @@ export async function runDispatchedDefault(options) {
         const outDir = options.outDir ?? (await mkdtemp(path.join(os.tmpdir(), "wren-harness-agent-sdk-")));
         if (options.signal?.aborted)
             throw new Error("warble-agent-sdk chat was cancelled during preparation");
-        const command = buildAgentSdkChatArgs(cli, {
-            irPath,
-            userProject: options.userProject,
-            question: options.question,
-            outDir,
-            warbleBin,
-            agentId,
-            ...(options.modelsConfig !== undefined ? { modelsConfig: options.modelsConfig } : {}),
-            ...(options.maxTurns !== undefined ? { maxTurns: options.maxTurns } : {}),
-            ...(options.resumeSessionId !== undefined ? { resume: options.resumeSessionId } : {}),
-        });
-        const { finalText, sessionId } = await spawnChat(command, (event) => emitter.emit(event), options.chatTimeoutMs ?? CHAT_TIMEOUT_MS, options.signal);
-        // `spawnChat` resolves with whatever trimmed final-answer text
-        // the process produced, even if that's empty — e.g. the CLI exits 0 but
-        // never printed a terminal answer line (a dispatcher bug, an unexpected
-        // output-format change, or a turn that produced no text). Treat that as
-        // a failure rather than a silent empty "answer".
-        if (finalText.length === 0) {
-            throw new Error("warble-agent-sdk chat exited successfully but produced no stdout — expected the turn's " +
-                "final answer text; got empty output");
+        // This turn's host query service, when the caller asked for one: the only place the host MCP's
+        // run_sql executes and the only evidence the answer can be grounded on. Closed (and its
+        // observations discarded) when the turn ends, whatever the outcome.
+        const host = await openAskHostQueries(options, irPath);
+        try {
+            const command = buildAgentSdkChatArgs(cli, {
+                irPath,
+                userProject: options.userProject,
+                question: options.question,
+                outDir,
+                warbleBin,
+                agentId,
+                ...(options.modelsConfig !== undefined ? { modelsConfig: options.modelsConfig } : {}),
+                ...(options.maxTurns !== undefined ? { maxTurns: options.maxTurns } : {}),
+                ...(options.resumeSessionId !== undefined ? { resume: options.resumeSessionId } : {}),
+                ...(host !== undefined ? { hostMcpConfig: host.configFile } : {}),
+            });
+            const { finalText, sessionId } = await spawnChat(command, (event) => emitter.emit(event), options.chatTimeoutMs ?? CHAT_TIMEOUT_MS, options.signal);
+            // `spawnChat` resolves with whatever trimmed final-answer text
+            // the process produced, even if that's empty — e.g. the CLI exits 0 but
+            // never printed a terminal answer line (a dispatcher bug, an unexpected
+            // output-format change, or a turn that produced no text). Treat that as
+            // a failure rather than a silent empty "answer".
+            if (finalText.length === 0) {
+                throw new Error("warble-agent-sdk chat exited successfully but produced no stdout — expected the turn's " +
+                    "final answer text; got empty output");
+            }
+            const hostObservations = host?.service.observations();
+            emitter.emit({ kind: "answer", text: finalText });
+            emitter.emit({ kind: "run.finish", status: "answer" });
+            return {
+                finalText,
+                ...(sessionId !== undefined ? { sessionId } : {}),
+                ...(hostObservations !== undefined ? { hostObservations } : {}),
+            };
+        }
+        finally {
+            await host?.service.close();
         }
-        emitter.emit({ kind: "answer", text: finalText });
-        emitter.emit({ kind: "run.finish", status: "answer" });
-        return { finalText, ...(sessionId !== undefined ? { sessionId } : {}) };
     }
     catch (error) {
         emitter.emit({ kind: "error", message: describeDispatchedError(error) });
@@ -200,6 +226,78 @@ export async function runDispatchedDefault(options) {
         throw error;
     }
 }
+/**
+ * Opens an Ask turn's host query service and writes its host MCP config, or returns `undefined`
+ * when the turn runs without one (not requested, a hybrid models config, or no `wren` on PATH).
+ */
+async function openAskHostQueries(options, irPath) {
+    if (options.hostQueries === undefined)
+        return undefined;
+    if (options.modelsConfig !== undefined && await bindsNonAnthropicTier(irPath, options.modelsConfig))
+        return undefined;
+    let wren;
+    try {
+        wren = options.hostQueries.wren ?? resolveExecutableOnPath("wren");
+    }
+    catch {
+        return undefined;
+    }
+    const userProject = options.userProject;
+    const service = await openHostQueryService({
+        openAccess: async (signal) => openWrenComponentAccess({
+            executable: wren,
+            project: userProject,
+            fingerprint: await hashDirectory(userProject),
+            signal,
+        }),
+        ...(options.signal !== undefined ? { signal: options.signal } : {}),
+    });
+    try {
+        const configFile = await writeHostMcpConfig(service, {
+            proxy: defaultWrenHostProxy(),
+            mcpServer: { command: wren, prefixArgs: [] },
+            userProject,
+        });
+        return { service, configFile };
+    }
+    catch (error) {
+        await service.close();
+        throw error;
+    }
+}
+/**
+ * True when the models config binds a tier this IR's steps use to a non-Anthropic provider. Warble
+ * runs such a plan hybrid-staged and refuses `--host-mcp-config` for it; an all-Anthropic config (the
+ * only kind Setup writes for Claude subscription) keeps the host MCP. Every IR tier is checked, not
+ * just the dispatched component's, so a hybrid tier anywhere in the profile also skips it.
+ */
+async function bindsNonAnthropicTier(irPath, modelsConfig) {
+    const ir = JSON.parse(await readFile(irPath, "utf8"));
+    const models = ModelConfig.fromYaml(await readFile(modelsConfig, "utf8"));
+    const tiers = new Set(ir.components.flatMap((component) => component.llm_calls.map((step) => step.tier)));
+    return [...tiers].some((tier) => models.binding(tier).provider !== "anthropic");
+}
+/**
+ * Writes the turn's `--host-mcp-config` file into the host query service's private 0700
+ * directory, as warble 0.16 reads it: a 0600 file owned by this user holding exactly
+ * `{name, command, args, tools, instruction}`, `command` absolute. The server is the Wren host
+ * proxy in front of `wren serve mcp`; the file names the credential file by path only, never its
+ * token. It is removed with the directory when the service closes.
+ */
+export async function writeHostMcpConfig(service, options) {
+    if (!path.isAbsolute(options.proxy.command))
+        throw new Error("the host MCP command must be an absolute path");
+    const file = path.join(service.directory, "host-mcp.json");
+    const config = {
+        name: HOST_MCP_SERVER_NAME,
+        command: options.proxy.command,
+        args: wrenHostProxyArgs({ ...options, credentialFile: service.credentialFile }),
+        tools: [...HOST_MCP_TOOLS],
+        instruction: HOST_MCP_INSTRUCTION,
+    };
+    await writeFile(file, JSON.stringify(config), { encoding: "utf8", mode: 0o600, flag: "wx" });
+    return file;
+}
 function describeDispatchedError(error) {
     if (error instanceof Error)
         return error.message;

package/dist-server/harness/route/host-query.d.ts

@@ -0,0 +1,93 @@
+import type { ComponentAccess } from "../components/broker.js";
+import { type GovernedErrorClass } from "../components/wren-access.js";
+import type { ResolvedCli } from "./agent-sdk-cli.js";
+/**
+ * One query the host executed for a subscription turn or a native session, in the component
+ * runner's observation shape (`input.sql`, `output` carrying a host `query_id`), so the shared
+ * grounding predicate reads it unchanged.
+ */
+export interface HostQueryObservation {
+    readonly tool: "run_sql";
+    readonly input: {
+        readonly sql: string;
+        readonly limit: number;
+    };
+    readonly output: unknown;
+}
+/**
+ * Per-scope bounds (one Ask turn, or one native session). Count, request and per-result bytes
+ * reuse the component runner's limits; the total caps what the host keeps in memory for one scope
+ * until its answer is grounded. Rows default to 1000 like `run_sql`. Like `run_sql`, the host
+ * probes one row past the limit to report truncation; the cap is 9999 so the probe stays within
+ * governed-stdio's 10000-row bound.
+ */
+export declare const HOST_QUERY_LIMITS: Readonly<{
+    queries: 32;
+    requestBytes: 65536;
+    resultBytes: 1048576;
+    totalResultBytes: number;
+    defaultRows: 1000;
+    maxRows: 9999;
+    timeoutMs: 120000;
+}>;
+/** Error classes a host query may return; each transport owns the sentence the model sees. */
+export type HostQueryErrorClass = GovernedErrorClass | "unauthorized" | "budget_exhausted";
+export type HostQueryOutcome = {
+    readonly result: unknown;
+} | {
+    readonly error: HostQueryErrorClass;
+};
+export interface HostQueryRecorderOptions {
+    /** Opens governed access for this scope; called at most once, on the first query. */
+    readonly openAccess: (signal: AbortSignal) => Promise<ComponentAccess>;
+    readonly signal?: AbortSignal;
+}
+/**
+ * Executes and records one scope's queries in process. The scope is the recorder: its
+ * observations are never shared, and its `query_id`s carry a tag no other recorder has.
+ */
+export interface HostQueryRecorder {
+    execute(sql: unknown, limit: unknown): Promise<HostQueryOutcome>;
+    /** This scope's recorded observations, in execution order. Empty after `close()`. */
+    observations(): readonly HostQueryObservation[];
+    /** Stops accepting queries, discards observations, closes governed access. Idempotent. */
+    close(): Promise<void>;
+}
+/**
+ * Every query runs through governed access (`wren governed-stdio`), gets a scope-unique host
+ * `query_id` (`q<N>-<tag>`), and is recorded as an observation of this scope only.
+ */
+export declare function createHostQueryRecorder(options: HostQueryRecorderOptions): HostQueryRecorder;
+export interface HostQueryService {
+    /** This service's private 0700 directory; it is removed on `close()`. */
+    readonly directory: string;
+    /** A 0600 file holding this turn's socket path and token. Its own path carries no secret. */
+    readonly credentialFile: string;
+    /** This turn's recorded observations, in execution order. Empty after `close()`. */
+    observations(): readonly HostQueryObservation[];
+    /** Stops accepting queries, discards observations, closes governed access, removes the directory. */
+    close(): Promise<void>;
+}
+export type HostQueryServiceOptions = HostQueryRecorderOptions;
+/**
+ * The host side of a subscription turn's `run_sql` (codex:local and the Claude agent-sdk Ask):
+ * a per-turn unix socket in a fresh 0700 directory that answers only requests carrying this
+ * turn's random token, in front of one {@link createHostQueryRecorder} for the turn.
+ */
+export declare function openHostQueryService(options: HostQueryServiceOptions): Promise<HostQueryService>;
+/**
+ * The argv after the proxy command: the proxy script, this turn's credential file, then the
+ * `wren serve mcp` command it fronts. Shared by codex:local's `--server-arg`s and the agent-sdk
+ * host MCP config so the two cannot drift.
+ */
+export declare function wrenHostProxyArgs(options: {
+    readonly proxy: ResolvedCli;
+    readonly credentialFile: string;
+    readonly mcpServer: ResolvedCli;
+    readonly userProject: string;
+}): string[];
+/** The built proxy next to this module, else its source (Node strips its erasable types). */
+export declare function defaultWrenHostProxy(): ResolvedCli;
+/** Governed access spawns one executable with fixed arguments; a prefixed command cannot be bound. */
+export declare function singleWrenExecutable(cli: ResolvedCli): string;
+export declare function resolveExecutableOnPath(name: string): string;