@wrenai/genbi 0.0.5 → 0.0.6

package/dist-server/harness/route/{codex-host-query.js → host-query.js}

@@ -1,17 +1,20 @@
 import { randomBytes, timingSafeEqual } from "node:crypto";
+import { accessSync, existsSync, constants as fsConstants } from "node:fs";
 import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { createServer } from "node:net";
 import os from "node:os";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 import { COMPONENT_LIMITS } from "../components/runner.js";
 import { GovernedWrenError } from "../components/wren-access.js";
 /**
- * Per-turn bounds. Count, request and per-result bytes reuse the component runner's limits;
- * the total caps what the host keeps in memory for one turn until its answer is grounded.
- * Rows default to 1000 like `run_sql`. Like `run_sql`, the host probes one row past the limit to
- * report truncation; the cap is 9999 so the probe stays within governed-stdio's 10000-row bound.
+ * Per-scope bounds (one Ask turn, or one native session). Count, request and per-result bytes
+ * reuse the component runner's limits; the total caps what the host keeps in memory for one scope
+ * until its answer is grounded. Rows default to 1000 like `run_sql`. Like `run_sql`, the host
+ * probes one row past the limit to report truncation; the cap is 9999 so the probe stays within
+ * governed-stdio's 10000-row bound.
  */
-export const CODEX_HOST_QUERY_LIMITS = Object.freeze({
+export const HOST_QUERY_LIMITS = Object.freeze({
     queries: COMPONENT_LIMITS.calls,
     requestBytes: COMPONENT_LIMITS.requestBytes,
     resultBytes: COMPONENT_LIMITS.resultBytes,
@@ -20,58 +23,35 @@ export const CODEX_HOST_QUERY_LIMITS = Object.freeze({
     maxRows: 9_999,
     timeoutMs: COMPONENT_LIMITS.timeoutMs,
 });
-function requestFrame(value) {
-    if (typeof value !== "object" || value === null || Array.isArray(value))
-        return undefined;
-    const record = value;
-    if (typeof record.id !== "number" || !Number.isSafeInteger(record.id))
-        return undefined;
-    return { token: record.token, id: record.id, sql: record.sql, limit: record.limit };
-}
 /**
- * The host side of codex:local's `run_sql`: a per-turn unix socket in a fresh 0700 directory
- * that answers only requests carrying this turn's random token. Every query runs through
- * governed access (`wren governed-stdio`), gets a turn-unique host `query_id`, and is recorded
- * as an observation of this turn only.
+ * Every query runs through governed access (`wren governed-stdio`), gets a scope-unique host
+ * `query_id` (`q<N>-<tag>`), and is recorded as an observation of this scope only.
  */
-export async function openCodexHostQueryService(options) {
-    if (process.platform === "win32")
-        throw new Error("codex:local host query service requires unix sockets");
-    const directory = await mkdtemp(path.join(os.tmpdir(), "genbi-hq-"));
-    const token = Buffer.from(randomBytes(32).toString("base64url"), "utf8");
-    const turnTag = randomBytes(4).toString("hex");
-    const socketPath = path.join(directory, "s");
-    const credentialFile = path.join(directory, "credential.json");
+export function createHostQueryRecorder(options) {
+    const tag = randomBytes(4).toString("hex");
     const controller = new AbortController();
     const signal = options.signal ? AbortSignal.any([options.signal, controller.signal]) : controller.signal;
     const recorded = [];
-    const sockets = new Set();
     let attempts = 0;
     let recordedBytes = 0;
     let closed = false;
     let access;
-    const authorized = (candidate) => {
-        if (typeof candidate !== "string")
-            return false;
-        const presented = Buffer.from(candidate, "utf8");
-        return presented.length === token.length && timingSafeEqual(presented, token);
-    };
     const execute = async (sql, limit) => {
         if (closed || signal.aborted)
             return { error: "transport" };
-        if (typeof sql !== "string" || !sql.trim() || Buffer.byteLength(sql) > CODEX_HOST_QUERY_LIMITS.requestBytes)
+        if (typeof sql !== "string" || !sql.trim() || Buffer.byteLength(sql) > HOST_QUERY_LIMITS.requestBytes)
             return { error: "invalid_request" };
         if (limit !== undefined && limit !== null && (typeof limit !== "number" || !Number.isInteger(limit) || limit < 1))
             return { error: "invalid_request" };
-        if (attempts >= CODEX_HOST_QUERY_LIMITS.queries)
+        if (attempts >= HOST_QUERY_LIMITS.queries)
             return { error: "budget_exhausted" };
         attempts += 1;
-        const rows = Math.min(CODEX_HOST_QUERY_LIMITS.maxRows, typeof limit === "number" ? limit : CODEX_HOST_QUERY_LIMITS.defaultRows);
+        const rows = Math.min(HOST_QUERY_LIMITS.maxRows, typeof limit === "number" ? limit : HOST_QUERY_LIMITS.defaultRows);
         let result;
         try {
             access ??= options.openAccess(signal);
             const governed = await access;
-            result = await governed.query({ sql, limit: rows + 1 }, AbortSignal.any([signal, AbortSignal.timeout(CODEX_HOST_QUERY_LIMITS.timeoutMs)]));
+            result = await governed.query({ sql, limit: rows + 1 }, AbortSignal.any([signal, AbortSignal.timeout(HOST_QUERY_LIMITS.timeoutMs)]));
         }
         catch (error) {
             return { error: error instanceof GovernedWrenError ? error.errorClass : "transport" };
@@ -88,17 +68,65 @@ export async function openCodexHostQueryService(options) {
         const truncated = probed.length > rows;
         const shown = truncated ? probed.slice(0, rows) : probed;
         // The id is assigned here, once, so the observation and the model's copy carry the same id. The
-        // tag makes ids unique per turn: an id copied from an earlier turn never names this turn's query.
-        const output = { ...result, rows: shown, row_count: shown.length, truncated, query_id: `q${attempts}-${turnTag}` };
+        // tag makes ids unique per scope: an id copied from another turn or session never names this one's query.
+        const output = { ...result, rows: shown, row_count: shown.length, truncated, query_id: `q${attempts}-${tag}` };
         const bytes = Buffer.byteLength(JSON.stringify(output));
-        if (bytes > CODEX_HOST_QUERY_LIMITS.resultBytes)
+        if (bytes > HOST_QUERY_LIMITS.resultBytes)
             return { error: "result_too_large" };
-        if (recordedBytes + bytes > CODEX_HOST_QUERY_LIMITS.totalResultBytes)
+        if (recordedBytes + bytes > HOST_QUERY_LIMITS.totalResultBytes)
             return { error: "budget_exhausted" };
         recordedBytes += bytes;
         recorded.push(Object.freeze({ tool: "run_sql", input: Object.freeze({ sql, limit: rows }), output: structuredClone(output) }));
         return { result: output };
     };
+    let closing;
+    const close = () => {
+        closing ??= (async () => {
+            closed = true;
+            recorded.length = 0;
+            controller.abort();
+            try {
+                if (access)
+                    await (await access).close();
+            }
+            catch {
+                // Access that never opened, or already closed, has nothing left to release.
+            }
+        })();
+        return closing;
+    };
+    options.signal?.addEventListener("abort", () => { void close(); }, { once: true });
+    return { execute, observations: () => Object.freeze([...recorded]), close };
+}
+function requestFrame(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return undefined;
+    const record = value;
+    if (typeof record.id !== "number" || !Number.isSafeInteger(record.id))
+        return undefined;
+    return { token: record.token, id: record.id, sql: record.sql, limit: record.limit };
+}
+/**
+ * The host side of a subscription turn's `run_sql` (codex:local and the Claude agent-sdk Ask):
+ * a per-turn unix socket in a fresh 0700 directory that answers only requests carrying this
+ * turn's random token, in front of one {@link createHostQueryRecorder} for the turn.
+ */
+export async function openHostQueryService(options) {
+    if (process.platform === "win32")
+        throw new Error("the host query service requires unix sockets");
+    const directory = await mkdtemp(path.join(os.tmpdir(), "genbi-hq-"));
+    const token = Buffer.from(randomBytes(32).toString("base64url"), "utf8");
+    const socketPath = path.join(directory, "s");
+    const credentialFile = path.join(directory, "credential.json");
+    const recorder = createHostQueryRecorder(options);
+    const sockets = new Set();
+    let closed = false;
+    const authorized = (candidate) => {
+        if (typeof candidate !== "string")
+            return false;
+        const presented = Buffer.from(candidate, "utf8");
+        return presented.length === token.length && timingSafeEqual(presented, token);
+    };
     const serve = (socket) => {
         if (closed) {
             socket.destroy();
@@ -112,7 +140,7 @@ export async function openCodexHostQueryService(options) {
         socket.setEncoding("utf8");
         socket.on("data", (chunk) => {
             buffer += chunk;
-            if (buffer.length > 2 * CODEX_HOST_QUERY_LIMITS.requestBytes) {
+            if (buffer.length > 2 * HOST_QUERY_LIMITS.requestBytes) {
                 socket.destroy();
                 return;
             }
@@ -138,7 +166,7 @@ export async function openCodexHostQueryService(options) {
                     return;
                 }
                 tail = tail.then(async () => {
-                    const outcome = await execute(sql, limit);
+                    const outcome = await recorder.execute(sql, limit);
                     if (socket.destroyed)
                         return;
                     socket.write(`${JSON.stringify("result" in outcome ? { id, result: outcome.result } : { id, error: { class: outcome.error } })}\n`);
@@ -157,6 +185,7 @@ export async function openCodexHostQueryService(options) {
     }
     catch (error) {
         server.close();
+        await recorder.close();
         await rm(directory, { recursive: true, force: true });
         throw error;
     }
@@ -164,17 +193,11 @@ export async function openCodexHostQueryService(options) {
     const close = () => {
         closing ??= (async () => {
             closed = true;
-            recorded.length = 0;
-            controller.abort();
             for (const socket of sockets)
                 socket.destroy();
             await new Promise((resolve) => server.close(() => resolve()));
             try {
-                if (access)
-                    await (await access).close();
-            }
-            catch {
-                // Access that never opened, or already closed, has nothing left to release.
+                await recorder.close();
             }
             finally {
                 await rm(directory, { recursive: true, force: true });
@@ -183,9 +206,52 @@ export async function openCodexHostQueryService(options) {
         return closing;
     };
     options.signal?.addEventListener("abort", () => { void close(); }, { once: true });
-    return {
-        credentialFile,
-        observations: () => Object.freeze([...recorded]),
-        close,
-    };
+    return { directory, credentialFile, observations: recorder.observations, close };
+}
+/**
+ * The argv after the proxy command: the proxy script, this turn's credential file, then the
+ * `wren serve mcp` command it fronts. Shared by codex:local's `--server-arg`s and the agent-sdk
+ * host MCP config so the two cannot drift.
+ */
+export function wrenHostProxyArgs(options) {
+    return [
+        ...options.proxy.prefixArgs,
+        "--credential-file",
+        options.credentialFile,
+        "--",
+        options.mcpServer.command,
+        ...options.mcpServer.prefixArgs,
+        "serve",
+        "mcp",
+        "--project",
+        options.userProject,
+        "--quiet",
+    ];
+}
+/** The built proxy next to this module, else its source (Node strips its erasable types). */
+export function defaultWrenHostProxy() {
+    const built = fileURLToPath(new URL("./wren-host-proxy.js", import.meta.url));
+    const script = existsSync(built) ? built : fileURLToPath(new URL("./wren-host-proxy.ts", import.meta.url));
+    return { command: process.execPath, prefixArgs: [script] };
+}
+/** Governed access spawns one executable with fixed arguments; a prefixed command cannot be bound. */
+export function singleWrenExecutable(cli) {
+    if (cli.prefixArgs.length > 0)
+        throw new Error("host queries need a standalone wren executable");
+    return cli.command;
+}
+export function resolveExecutableOnPath(name) {
+    for (const directory of (process.env.PATH ?? "").split(path.delimiter)) {
+        if (!directory)
+            continue;
+        const candidate = path.join(directory, name);
+        try {
+            accessSync(candidate, fsConstants.X_OK);
+            return candidate;
+        }
+        catch {
+            // Keep searching.
+        }
+    }
+    throw new Error(`could not find the "${name}" executable on PATH`);
 }

package/dist-server/harness/route/route.js

@@ -86,6 +86,9 @@ export async function route(options) {
             ...(options.agentId !== undefined ? { agentId: options.agentId } : {}),
             ...(options.chatTimeoutMs !== undefined ? { chatTimeoutMs: options.chatTimeoutMs } : {}),
             ...(options.signal !== undefined ? { signal: options.signal } : {}),
+            // An Ask turn: its data queries can run through a per-turn host query service, so the
+            // answer can be grounded on host evidence (see `withHostVerification`).
+            hostQueries: {},
         });
         return { backend: "agent-sdk", warnings, ...result };
     }

package/dist-server/harness/route/types.d.ts

@@ -177,6 +177,18 @@ export interface DispatchedOptions {
      * flag) when unset, which is the pre-existing behavior.
      */
     readonly resumeSessionId?: string;
+    /**
+     * Ask turns only (`route()` sets it; the setup and enrichment runners do not): open a per-turn
+     * host query service and hand the dispatcher a host MCP server (`--host-mcp-config`) whose
+     * `run_sql` executes through it, so the answer can be grounded on what the host ran. `wren` is
+     * the standalone Wren executable for both governed access and `wren serve mcp`; when unset it
+     * is resolved on PATH, and when none is found the turn runs without host queries (and its
+     * answer stays unverified). Ignored under `modelsConfig`: warble refuses a host MCP for a
+     * hybrid-staged plan, which a models config can produce.
+     */
+    readonly hostQueries?: {
+        readonly wren?: string;
+    };
     /** Cancels the owned dispatcher process without falling back to another vendor. */
     readonly signal?: AbortSignal;
 }
@@ -191,6 +203,11 @@ export interface DispatchedResult {
      * the SDK itself never produced a session id to report.
      */
     readonly sessionId?: string | null;
+    /**
+     * Ask turns with host queries only: the queries this turn's host query service executed for
+     * the model's host `run_sql`, the only evidence its answer may be grounded on. Never persisted.
+     */
+    readonly hostObservations?: readonly import("./host-query.js").HostQueryObservation[];
 }
 export type DispatchedExecutor = (options: DispatchedOptions) => Promise<DispatchedResult>;
 /** Codex subscription Ask runs through warble-codex-local, never the Claude dispatched dispatcher. */
@@ -227,7 +244,7 @@ export interface CodexAskResult {
      * codex:local only: the queries this turn's host query service executed for the model's
      * `run_sql`, the only evidence its answer may be grounded on. Never persisted.
      */
-    readonly hostObservations?: readonly import("./codex-host-query.js").HostQueryObservation[];
+    readonly hostObservations?: readonly import("./host-query.js").HostQueryObservation[];
 }
 export type CodexAskExecutor = (options: CodexAskOptions) => Promise<CodexAskResult>;
 /**

package/dist-server/harness/route/{codex-wren-proxy.js → wren-host-proxy.js}

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 /**
- * codex:local's Wren MCP server: a stdio proxy in front of `wren serve mcp`.
+ * The Wren MCP server of a subscription Ask turn (codex:local, and the Claude agent-sdk host MCP):
+ * a stdio proxy in front of `wren serve mcp`.
  *
- *   node codex-wren-proxy.js --credential-file <abs path> -- <wren> serve mcp --project <p> --quiet
+ *   node wren-host-proxy.js --credential-file <abs path> -- <wren> serve mcp --project <p> --quiet
  *
  * Every JSON-RPC line passes through to the child `wren serve mcp` unchanged, so the model sees
  * the same tool names and schemas, except a `tools/call` of `run_sql`: that goes to this turn's
- * host query service (see `codex-host-query.ts`), which executes it through governed access and
+ * host query service (see `host-query.ts`), which executes it through governed access and
  * records it as host evidence. The credential file (0600, owned by this user) names the turn's
  * unix socket and token; without a valid one, `run_sql` is refused rather than run elsewhere.
  *
@@ -146,7 +147,7 @@ export class HostConnection {
 function parseArgs(argv) {
     const separator = argv.indexOf("--");
     if (separator < 0 || separator === argv.length - 1) {
-        process.stderr.write("codex wren proxy: usage: --credential-file <path> -- <command> [args...]\n");
+        process.stderr.write("wren host proxy: usage: --credential-file <path> -- <command> [args...]\n");
         process.exit(2);
     }
     const own = argv.slice(0, separator);
@@ -160,7 +161,7 @@ function main() {
     const host = credential ? new HostConnection(credential) : undefined;
     const child = spawn(options.command, options.args, { stdio: ["pipe", "pipe", "inherit"] });
     child.on("error", (error) => {
-        process.stderr.write(`codex wren proxy: could not start the Wren MCP server: ${error.message}\n`);
+        process.stderr.write(`wren host proxy: could not start the Wren MCP server: ${error.message}\n`);
         process.exit(1);
     });
     child.on("exit", (code, signal) => process.exit(code ?? (signal ? 1 : 0)));

package/dist-server/harness/setup/runner.d.ts

@@ -423,6 +423,15 @@ export interface HostContractDiagnostic {
     /** The concrete artifact/workflow conditions that must be true before another claimed success. */
     readonly expectedArtifactContract: readonly string[];
 }
+/**
+ * Where the bound project lives, so a recorded command's optional
+ * `cd <dir> &&` prefix can be resolved against it. Absent binding means the
+ * prefix cannot be verified and is not accepted.
+ */
+export interface ProjectBinding {
+    readonly root: string;
+    readonly projectDir: string;
+}
 export type RecordedSchemaDiscovery = {
     readonly kind: "successful";
     readonly command: string;
@@ -441,7 +450,7 @@ export type RecordedSchemaDiscovery = {
  * this for both terminal acceptance and the no-introspection diagnostic,
  * rather than reimplementing the allowlist elsewhere.
  */
-export declare function classifyRecordedSchemaDiscovery(worklog: readonly SetupWorklogEntry[]): RecordedSchemaDiscovery;
+export declare function classifyRecordedSchemaDiscovery(worklog: readonly SetupWorklogEntry[], binding?: ProjectBinding): RecordedSchemaDiscovery;
 /** Ordered, host-recorded progress; each value includes all preceding work. */
 export type ContextLifecyclePrefix = "none" | "discovery" | "validate" | "build";
 export type RecordedContextLifecycle = {
@@ -451,12 +460,15 @@ export type RecordedContextLifecycle = {
 } | {
     readonly kind: "validate_missing";
     readonly observed: string;
+    readonly unrecognised?: string;
 } | {
     readonly kind: "build_missing";
     readonly observed: string;
+    readonly unrecognised?: string;
 } | {
     readonly kind: "out_of_order";
     readonly observed: string;
+    readonly unrecognised?: string;
 };
 /**
  * Returns the greatest ordered prefix proved by the supplied successful tool
@@ -464,8 +476,8 @@ export type RecordedContextLifecycle = {
  * call in the same attempt is out of order, so a corrective attempt can ask
  * only for the unproven suffix.
  */
-export declare function recordedContextLifecyclePrefix(worklog: readonly SetupWorklogEntry[], prior?: ContextLifecyclePrefix): ContextLifecyclePrefix;
-export declare function classifyRecordedContextLifecycle(worklog: readonly SetupWorklogEntry[], prior?: ContextLifecyclePrefix): RecordedContextLifecycle;
+export declare function recordedContextLifecyclePrefix(worklog: readonly SetupWorklogEntry[], prior?: ContextLifecyclePrefix, binding?: ProjectBinding): ContextLifecyclePrefix;
+export declare function classifyRecordedContextLifecycle(worklog: readonly SetupWorklogEntry[], prior?: ContextLifecyclePrefix, binding?: ProjectBinding): RecordedContextLifecycle;
 /**
  * Parses the LAST `SETUP_STATUS: ok|needs_input|error` line out of a setup
  * turn's finalText (the terminal contract lives in the composed