@wrenai/genbi 0.0.5 → 0.0.6

package/dist-server/harness/setup/runner.js

@@ -124,6 +124,22 @@ function resolveDispatchedUserProject(runOptions, agentId) {
     }
     return canonicalProject;
 }
+/**
+ * The project directory a project-bound step (`connect_resume`/`context`) runs
+ * against, as the default exec cwd of the in-process `setup_execution` tool.
+ * `undefined` for the initial `connect` step, which scaffolds the project from
+ * the workspace root, and for a missing/unsafe project name. The tool applies
+ * it only while the directory actually exists.
+ */
+function boundSetupProjectDir(runOptions, agentId) {
+    const stepKey = runOptions.stepKey ?? (agentId === BUILD_CONTEXT_AGENT_ID ? "context" : "connect");
+    if (stepKey === "connect")
+        return undefined;
+    const projectName = runOptions.projectName;
+    if (projectName === undefined || !SAFE_PROJECT_NAME.test(projectName))
+        return undefined;
+    return path.resolve(runOptions.workspaceRoot, projectName);
+}
 /**
  * Dispatches a setup-wizard turn over dispatched, bypassing `route()` entirely
  * (unlike the Ask turn path) so it can perform its own, setup-specific
@@ -562,8 +578,14 @@ export class InProcessSetupRunner {
             // project-root write scope on the dispatched side.
             const policy = { readOnly: false, artifactWriteScope: "." };
             const env = createLocalExecutionEnv({ rootDir: runOptions.workspaceRoot });
+            const boundProjectDir = boundSetupProjectDir(runOptions, agentId);
             const nativeTools = createNativeToolRegistry();
-            nativeTools.register(SETUP_EXECUTION_TOOL_NAME, () => createSetupExecutionTool({ env, policy, workspaceRoot: runOptions.workspaceRoot }));
+            nativeTools.register(SETUP_EXECUTION_TOOL_NAME, () => createSetupExecutionTool({
+                env,
+                policy,
+                workspaceRoot: runOptions.workspaceRoot,
+                ...(boundProjectDir !== undefined ? { defaultExecCwd: boundProjectDir } : {}),
+            }));
             // Kept in lockstep with `effectiveMaxTurns()` above via the shared
             // `resolveEffectiveMaxTurns` helper, exactly like `DispatchedSetupRunner.run()`
             // does for its own `--max-turns` flag.
@@ -1052,6 +1074,64 @@ const SCHEMA_INTROSPECTION_COMMANDS = [
     /\b(?:psql|mysql|sqlite3|duckdb|snowsql|clickhouse-client|trino(?:-cli)?)\b[\s\S]*(?:\s(?:-c|--command|--execute|--query)\s|\b(?:information_schema|show\s+(?:tables|columns)|describe\s+(?:table|schema)|\.tables)\b)/i,
     /\bbq\s+query\b/i,
 ];
+const CD_PREFIX = /^\s*cd\s+("[^"$`\\]*"|'[^']*'|[^\s;&|<>()$`\\'"~]+)\s*&&\s*([\s\S]*)$/;
+const STARTS_WITH_CD = /^\s*cd(?:\s|$)/;
+/**
+ * A recorded relative `cwd` resolves against the tool's own root: the workspace
+ * for the in-process tool, the project for Codex local (whose tool root is the
+ * project directory for project steps).
+ */
+function recordedCwdBase(entry, cwd, binding) {
+    return path.resolve(entry.label === CODEX_SETUP_EXECUTION_TOOL_NAME ? binding.projectDir : binding.root, cwd);
+}
+function samePath(a, b) {
+    const resolvedA = path.resolve(a);
+    const resolvedB = path.resolve(b);
+    if (resolvedA === resolvedB)
+        return true;
+    try {
+        return realpathSync(resolvedA) === realpathSync(resolvedB);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The ONE recogniser rule shared by schema discovery and the context
+ * lifecycle: a recorded command counts only as the bare command or as exactly
+ * one `cd <dir> && <cmd>` whose `<dir>` is the bound project. Returns the
+ * command to match against the per-stage patterns (the `cd` prefix stripped),
+ * or `undefined` when the shape is not recognised (another directory, a second
+ * `cd`, a dynamic or `~` directory, or no binding to verify against).
+ *
+ * `<dir>` resolves against the exec's explicit `cwd` when the entry recorded
+ * one. Otherwise the effective cwd was not recorded, so the target is accepted
+ * if it names the project from either candidate default (workspace root, the
+ * pre-binding default; or the project itself, the post-binding default). The
+ * entry already exited 0, so the `cd` really resolved to that directory.
+ */
+function projectLocalCommand(entry, command, binding) {
+    const explicitCwd = entry.input?.cwd;
+    const recordedCwd = typeof explicitCwd === "string" && explicitCwd.length > 0 ? explicitCwd : undefined;
+    if (!STARTS_WITH_CD.test(command)) {
+        if (binding === undefined || recordedCwd === undefined)
+            return command;
+        // A recorded cwd must itself be the project for a bare command to count.
+        return samePath(recordedCwdBase(entry, recordedCwd, binding), binding.projectDir) ? command : undefined;
+    }
+    if (binding === undefined)
+        return undefined;
+    const match = CD_PREFIX.exec(command);
+    if (!match)
+        return undefined;
+    const raw = match[1];
+    const dir = raw.startsWith('"') || raw.startsWith("'") ? raw.slice(1, -1) : raw;
+    const inner = match[2];
+    if (dir.length === 0 || STARTS_WITH_CD.test(inner))
+        return undefined;
+    const bases = recordedCwd !== undefined ? [recordedCwdBase(entry, recordedCwd, binding)] : [binding.root, binding.projectDir];
+    return bases.some((base) => samePath(path.resolve(base, dir), binding.projectDir)) ? inner : undefined;
+}
 /**
  * The single setup-workflow contract for recognisable schema discovery. A
  * matching command is evidence only after it completed successfully (see
@@ -1060,13 +1140,18 @@ const SCHEMA_INTROSPECTION_COMMANDS = [
  * this for both terminal acceptance and the no-introspection diagnostic,
  * rather than reimplementing the allowlist elsewhere.
  */
-export function classifyRecordedSchemaDiscovery(worklog) {
+export function classifyRecordedSchemaDiscovery(worklog, binding) {
     let failed;
     for (const entry of worklog) {
         const command = isSetupExecutionEntry(entry) ? execCommandOf(entry) : undefined;
-        if (command === undefined ||
-            !SCHEMA_DISCOVERY_EVIDENCE.test(command) ||
-            !SCHEMA_INTROSPECTION_COMMANDS.some((pattern) => pattern.test(command))) {
+        if (command === undefined)
+            continue;
+        // Without a binding (legacy callers) the matching below is unchanged; with
+        // one, a leading `cd` must satisfy the shared project-local rule.
+        const recognised = binding === undefined ? command : projectLocalCommand(entry, command, binding);
+        if (recognised === undefined ||
+            !SCHEMA_DISCOVERY_EVIDENCE.test(recognised) ||
+            !SCHEMA_INTROSPECTION_COMMANDS.some((pattern) => pattern.test(recognised))) {
             continue;
         }
         const succeeded = execSucceeded(entry);
@@ -1087,7 +1172,7 @@ const DIRECT_CONTEXT_LIFECYCLE_COMMAND = new RegExp(String.raw `^\s*(?:(?:${SHEL
  * context build`, each recorded as a successful setup execution. An artifact
  * alone or merely naming a command in the final message is not evidence.
  */
-function contextLifecycleStage(command) {
+function contextLifecycleStage(entry, command, binding) {
     // This evidence must describe the actual lifecycle invocation, rather than
     // merely mention it. `setup_execution` already supplies the project cwd as
     // a separate structured field; the only shell prefixes we accept here are
@@ -1096,7 +1181,12 @@ function contextLifecycleStage(command) {
     // command cwd to the canonical project, so this is the same project-local
     // lifecycle operation emitted by some Wren guidance. Arbitrary paths, other
     // flags, shell sequencing, quoted text, and wrappers remain unrecognized.
-    const match = DIRECT_CONTEXT_LIFECYCLE_COMMAND.exec(command);
+    // The one additional shape is a single `cd <project> &&` prefix, decided by
+    // the shared `projectLocalCommand` rule (also used for schema discovery).
+    const inner = projectLocalCommand(entry, command, binding);
+    if (inner === undefined)
+        return undefined;
+    const match = DIRECT_CONTEXT_LIFECYCLE_COMMAND.exec(inner);
     return match?.[1]?.toLowerCase();
 }
 function stageAfter(prefix) {
@@ -1111,40 +1201,55 @@ function prefixFor(stage) {
         return "discovery";
     return stage === "build" ? "validate" : "none";
 }
-function scanRecordedContextLifecycle(worklog, prior) {
+const CONTEXT_LIFECYCLE_MENTION = /\bwren\s+context\s+(validate|build)\b/i;
+function scanRecordedContextLifecycle(worklog, prior, binding) {
     let stage = stageAfter(prior);
     let completed = prior === "build";
     let outOfOrderObserved;
+    // Successful commands that mention a lifecycle command but were not
+    // recognised as one, so a failure can quote them instead of claiming the
+    // command never ran.
+    const unrecognisedMentions = [];
     for (const entry of worklog) {
         if (!isSetupExecutionEntry(entry) || execSucceeded(entry) !== true)
             continue;
         const command = execCommandOf(entry);
         if (command === undefined)
             continue;
+        const noteUnrecognised = (candidate, text) => {
+            if (contextLifecycleStage(candidate, text, binding) !== undefined)
+                return;
+            const mention = CONTEXT_LIFECYCLE_MENTION.exec(text);
+            if (mention)
+                unrecognisedMentions.push({ command: text, stage: mention[1].toLowerCase() });
+        };
         if (stage === "discovery") {
-            if (classifyRecordedSchemaDiscovery([entry]).kind === "successful") {
+            if (classifyRecordedSchemaDiscovery([entry], binding).kind === "successful") {
                 stage = "validate";
                 continue;
             }
-            if (contextLifecycleStage(command) !== undefined) {
-                outOfOrderObserved ??= `successful \`${command}\` ran before successful schema discovery`;
+            if (contextLifecycleStage(entry, command, binding) !== undefined) {
+                outOfOrderObserved ??= `successful ${quoteCommand(command)} ran before successful schema discovery`;
             }
+            noteUnrecognised(entry, command);
             continue;
         }
-        const nativeStage = contextLifecycleStage(command);
+        const nativeStage = contextLifecycleStage(entry, command, binding);
+        if (nativeStage === undefined)
+            noteUnrecognised(entry, command);
         if (stage === "validate") {
             if (nativeStage === "validate") {
                 stage = "build";
             }
             else if (nativeStage === "build") {
-                outOfOrderObserved ??= `successful \`${command}\` ran before successful \`wren context validate\``;
+                outOfOrderObserved ??= `successful ${quoteCommand(command)} ran before successful \`wren context validate\``;
             }
             continue;
         }
         if (nativeStage === "build")
             completed = true;
     }
-    return { stage, completed, outOfOrderObserved };
+    return { stage, completed, outOfOrderObserved, unrecognisedMentions };
 }
 /**
  * Returns the greatest ordered prefix proved by the supplied successful tool
@@ -1152,26 +1257,122 @@ function scanRecordedContextLifecycle(worklog, prior) {
  * call in the same attempt is out of order, so a corrective attempt can ask
  * only for the unproven suffix.
  */
-export function recordedContextLifecyclePrefix(worklog, prior = "none") {
-    const scan = scanRecordedContextLifecycle(worklog, prior);
+export function recordedContextLifecyclePrefix(worklog, prior = "none", binding) {
+    const scan = scanRecordedContextLifecycle(worklog, prior, binding);
     return scan.completed ? "build" : prefixFor(scan.stage);
 }
-export function classifyRecordedContextLifecycle(worklog, prior = "none") {
-    const { stage, completed, outOfOrderObserved } = scanRecordedContextLifecycle(worklog, prior);
+export function classifyRecordedContextLifecycle(worklog, prior = "none", binding) {
+    const { stage, completed, outOfOrderObserved, unrecognisedMentions } = scanRecordedContextLifecycle(worklog, prior, binding);
+    const wanted = stage === "validate" ? "validate" : "build";
+    const unrecognised = (unrecognisedMentions.find((mention) => mention.stage === wanted) ?? unrecognisedMentions[0])?.command;
     if (completed)
         return { kind: "successful" };
+    const withUnrecognised = unrecognised !== undefined ? { unrecognised } : {};
     if (outOfOrderObserved !== undefined)
-        return { kind: "out_of_order", observed: outOfOrderObserved };
+        return { kind: "out_of_order", observed: outOfOrderObserved, ...withUnrecognised };
     if (stage === "discovery")
         return { kind: "missing_discovery" };
-    if (stage === "validate")
-        return { kind: "validate_missing", observed: "no successful `wren context validate` followed successful schema discovery" };
-    return { kind: "build_missing", observed: "no successful `wren context build` followed successful `wren context validate`" };
+    if (stage === "validate") {
+        return { kind: "validate_missing", observed: "no recognised successful `wren context validate` followed successful schema discovery", ...withUnrecognised };
+    }
+    return { kind: "build_missing", observed: "no recognised successful `wren context build` followed successful `wren context validate`", ...withUnrecognised };
 }
 /** A narrow terminal-message check: only override a context error that explicitly claims a zero-table/model outcome. */
 function claimsNoTablesOrModels(message) {
     return /\b(?:no|zero)\s+(?:tables?|models?)\b|\b0\s+(?:tables?|models?)\b/i.test(message);
 }
+const ENV_ASSIGNMENT_VALUE = /(^|[\s;&|(])([A-Za-z_][A-Za-z0-9_]*)=("[^"]*"|'[^']*'|[^\s;&|]*)/g;
+/** Masks the value of every `NAME=value` assignment (leading, after `env`, or after `&&`/`;`). */
+function redactEnvAssignments(command) {
+    return command.replace(ENV_ASSIGNMENT_VALUE, "$1$2=***");
+}
+/** Quotes a command for an error message: env values redacted first, then bounded so a long script cannot flood it. */
+function quoteCommand(command) {
+    const flat = redactEnvAssignments(command).replace(/\s+/g, " ").trim();
+    return `\`${flat.length > 300 ? `${flat.slice(0, 300)}...` : flat}\``;
+}
+const UNRECOGNISED_LIFECYCLE_HINT = "It exited successfully but is not a recognised lifecycle invocation: only the bare command (optionally with environment assignments or `--path .`) or a single `cd <project directory> &&` prefix naming this step's project directory is accepted. Run it again as the bare command and set the `setup_execution` `cwd` field to the project directory instead of shell chaining.";
+function projectBindingOf(context) {
+    return { root: context.root, projectDir: path.join(context.root, context.name) };
+}
+/**
+ * The host-held evidence gate for a successful `context` step: the recorded
+ * discovery -> validate -> build lifecycle, then the built `target/mdl.json`.
+ * Returns the failure, or `undefined` when the evidence supports success. It
+ * never looks at the agent's own status line.
+ */
+function verifyContextEvidence(context) {
+    if (context.worklog !== undefined) {
+        const lifecycle = classifyRecordedContextLifecycle(context.worklog, context.priorContextLifecycle, projectBindingOf(context));
+        if (lifecycle.kind === "missing_discovery") {
+            return hostContractFailure("context_schema_discovery_missing", "The agent never completed recognized schema discovery in its recorded worklog, so its model/build result cannot be accepted. This is an agent-workflow failure, not evidence that the connection or data source lacks tables.", "the recorded worklog has no successful recognized schema-discovery command", [
+                "run a recognized schema-discovery command against the connected source and make sure it exits successfully",
+                "build target/mdl.json only from that discovered schema, with at least one model",
+            ], "no_successful_schema_discovery");
+        }
+        const discovery = classifyRecordedSchemaDiscovery(context.worklog, projectBindingOf(context));
+        if (discovery.kind === "failed") {
+            const exitCodeSuffix = discovery.exitCode !== undefined ? ` with exit code ${discovery.exitCode}` : "";
+            return hostContractFailure("context_schema_discovery_failed", `${quoteCommand(discovery.command)} failed${exitCodeSuffix} during schema discovery — a model/build result cannot be accepted until that command/tool failure is resolved; this is not evidence that the connection or data source lacks tables.`, discovery.exitCode !== undefined
+                ? `the recorded schema-discovery command exited with code ${discovery.exitCode}`
+                : "the recorded schema-discovery command failed", [
+                "resolve the schema-discovery command failure and run a recognized discovery command successfully",
+                "build target/mdl.json only from that discovered schema, with at least one model",
+            ]);
+        }
+        if (lifecycle.kind === "validate_missing") {
+            return hostContractFailure("context_validate_missing", lifecycle.unrecognised !== undefined
+                ? `The agent ran ${quoteCommand(lifecycle.unrecognised)} successfully, but it was not recognised as \`wren context validate\` after schema discovery. ${UNRECOGNISED_LIFECYCLE_HINT}`
+                : "The agent did not successfully run `wren context validate` after recognized schema discovery, so its model/build result cannot be accepted.", lifecycle.unrecognised !== undefined
+                ? `${lifecycle.observed}; unrecognised successful command: ${quoteCommand(lifecycle.unrecognised)}`
+                : lifecycle.observed, [
+                "run a recognized schema-discovery command successfully",
+                "run `wren context validate` successfully before `wren context build`",
+                "build target/mdl.json only after validation, with at least one model",
+                ...(lifecycle.unrecognised !== undefined
+                    ? ["pass the project directory through the `setup_execution` `cwd` field rather than `cd`/shell chaining"]
+                    : []),
+            ]);
+        }
+        if (lifecycle.kind === "build_missing") {
+            return hostContractFailure("context_build_missing", lifecycle.unrecognised !== undefined
+                ? `The agent ran ${quoteCommand(lifecycle.unrecognised)} successfully, but it was not recognised as \`wren context build\` after \`wren context validate\`. ${UNRECOGNISED_LIFECYCLE_HINT}`
+                : "The agent did not successfully run `wren context build` after `wren context validate`, so its claimed context success cannot be accepted.", lifecycle.unrecognised !== undefined
+                ? `${lifecycle.observed}; unrecognised successful command: ${quoteCommand(lifecycle.unrecognised)}`
+                : lifecycle.observed, [
+                "run a recognized schema-discovery command successfully",
+                "run `wren context validate` successfully",
+                "run `wren context build` successfully after validation and produce target/mdl.json with at least one model",
+                ...(lifecycle.unrecognised !== undefined
+                    ? ["pass the project directory through the `setup_execution` `cwd` field rather than `cd`/shell chaining"]
+                    : []),
+            ]);
+        }
+        if (lifecycle.kind === "out_of_order") {
+            return hostContractFailure("context_lifecycle_out_of_order", lifecycle.unrecognised !== undefined
+                ? `The native context lifecycle ran out of order; Setup requires successful schema discovery followed by \`wren context validate\` and then \`wren context build\`. The agent also ran ${quoteCommand(lifecycle.unrecognised)} successfully, but it was not recognised. ${UNRECOGNISED_LIFECYCLE_HINT}`
+                : "The native context lifecycle ran out of order; Setup requires successful schema discovery followed by `wren context validate` and then `wren context build`.", lifecycle.unrecognised !== undefined
+                ? `${lifecycle.observed}; unrecognised successful command: ${quoteCommand(lifecycle.unrecognised)}`
+                : lifecycle.observed, [
+                "run a recognized schema-discovery command successfully",
+                "run `wren context validate` successfully before `wren context build`",
+                "produce target/mdl.json with at least one schema-derived model",
+                ...(lifecycle.unrecognised !== undefined
+                    ? ["pass the project directory through the `setup_execution` `cwd` field rather than `cd`/shell chaining"]
+                    : []),
+            ]);
+        }
+    }
+    const mdlPath = path.join(context.root, context.name, "target", "mdl.json");
+    if (!existsSync(mdlPath)) {
+        return hostContractFailure("context_mdl_missing", `the setup agent reported "ok" but ${mdlPath} does not exist — treating this as a failed context build`, "target/mdl.json is missing after the claimed context build", ["target/mdl.json must exist", "target/mdl.json must contain at least one model"]);
+    }
+    const modelCount = countMdlModels(mdlPath);
+    if (modelCount < 1) {
+        return hostContractFailure("context_mdl_empty", `the setup agent reported "ok" but ${mdlPath} has ${modelCount} models — treating this as a failed context build`, `target/mdl.json has ${modelCount} models after the claimed context build`, ["target/mdl.json must contain at least one model"]);
+    }
+    return undefined;
+}
 /**
  * Parses the LAST `SETUP_STATUS: ok|needs_input|error` line out of a setup
  * turn's finalText (the terminal contract lives in the composed
@@ -1214,6 +1415,12 @@ export function parseSetupTerminal(finalText, context) {
         }
     }
     if (!matched) {
+        // For the context step the status line is advisory: recorded execution
+        // evidence plus the built project decide success. Anything short of that
+        // keeps the missing-status failure (and its bounded correction turn).
+        if (context.stepKey === "context" && context.worklog !== undefined && verifyContextEvidence(context) === undefined) {
+            return { status: "ok", message: defaultMessageFor("ok") };
+        }
         return {
             status: "error",
             message: "the setup agent's final message did not contain a SETUP_STATUS line",
@@ -1222,54 +1429,9 @@ export function parseSetupTerminal(finalText, context) {
     }
     if (matched.status === "ok") {
         if (context.stepKey === "context") {
-            if (context.worklog !== undefined) {
-                const lifecycle = classifyRecordedContextLifecycle(context.worklog, context.priorContextLifecycle);
-                if (lifecycle.kind === "missing_discovery") {
-                    return hostContractFailure("context_schema_discovery_missing", "The agent never completed recognized schema discovery in its recorded worklog, so its model/build result cannot be accepted. This is an agent-workflow failure, not evidence that the connection or data source lacks tables.", "the recorded worklog has no successful recognized schema-discovery command", [
-                        "run a recognized schema-discovery command against the connected source and make sure it exits successfully",
-                        "build target/mdl.json only from that discovered schema, with at least one model",
-                    ], "no_successful_schema_discovery");
-                }
-                const discovery = classifyRecordedSchemaDiscovery(context.worklog);
-                if (discovery.kind === "failed") {
-                    const exitCodeSuffix = discovery.exitCode !== undefined ? ` with exit code ${discovery.exitCode}` : "";
-                    return hostContractFailure("context_schema_discovery_failed", `\`${discovery.command}\` failed${exitCodeSuffix} during schema discovery — a model/build result cannot be accepted until that command/tool failure is resolved; this is not evidence that the connection or data source lacks tables.`, discovery.exitCode !== undefined
-                        ? `the recorded schema-discovery command exited with code ${discovery.exitCode}`
-                        : "the recorded schema-discovery command failed", [
-                        "resolve the schema-discovery command failure and run a recognized discovery command successfully",
-                        "build target/mdl.json only from that discovered schema, with at least one model",
-                    ]);
-                }
-                if (lifecycle.kind === "validate_missing") {
-                    return hostContractFailure("context_validate_missing", "The agent did not successfully run `wren context validate` after recognized schema discovery, so its model/build result cannot be accepted.", lifecycle.observed, [
-                        "run a recognized schema-discovery command successfully",
-                        "run `wren context validate` successfully before `wren context build`",
-                        "build target/mdl.json only after validation, with at least one model",
-                    ]);
-                }
-                if (lifecycle.kind === "build_missing") {
-                    return hostContractFailure("context_build_missing", "The agent did not successfully run `wren context build` after `wren context validate`, so its claimed context success cannot be accepted.", lifecycle.observed, [
-                        "run a recognized schema-discovery command successfully",
-                        "run `wren context validate` successfully",
-                        "run `wren context build` successfully after validation and produce target/mdl.json with at least one model",
-                    ]);
-                }
-                if (lifecycle.kind === "out_of_order") {
-                    return hostContractFailure("context_lifecycle_out_of_order", "The native context lifecycle ran out of order; Setup requires successful schema discovery followed by `wren context validate` and then `wren context build`.", lifecycle.observed, [
-                        "run a recognized schema-discovery command successfully",
-                        "run `wren context validate` successfully before `wren context build`",
-                        "produce target/mdl.json with at least one schema-derived model",
-                    ]);
-                }
-            }
-            const mdlPath = path.join(context.root, context.name, "target", "mdl.json");
-            if (!existsSync(mdlPath)) {
-                return hostContractFailure("context_mdl_missing", `the setup agent reported "ok" but ${mdlPath} does not exist — treating this as a failed context build`, "target/mdl.json is missing after the claimed context build", ["target/mdl.json must exist", "target/mdl.json must contain at least one model"]);
-            }
-            const modelCount = countMdlModels(mdlPath);
-            if (modelCount < 1) {
-                return hostContractFailure("context_mdl_empty", `the setup agent reported "ok" but ${mdlPath} has ${modelCount} models — treating this as a failed context build`, `target/mdl.json has ${modelCount} models after the claimed context build`, ["target/mdl.json must contain at least one model"]);
-            }
+            const failure = verifyContextEvidence(context);
+            if (failure !== undefined)
+                return failure;
         }
         else {
             const markerName = context.stepKey === "connect_resume" ? ".wren-validated" : "wren_project.yml";
@@ -1316,14 +1478,14 @@ export function parseSetupTerminal(finalText, context) {
         // `setup_execution` call that exited non-zero, and reframe if one is found.
         const failedExec = firstFailedExec(context.worklog);
         if (failedExec !== undefined) {
-            const command = failedExec.command !== undefined ? `\`${failedExec.command}\`` : "a command";
+            const command = failedExec.command !== undefined ? quoteCommand(failedExec.command) : "a command";
             const exitCodeSuffix = failedExec.exitCode !== undefined ? ` with exit code ${failedExec.exitCode}` : "";
             return {
                 status: "error",
                 message: `${command} failed${exitCodeSuffix} during this step — a command in this step's own history failed, so this step's error framing can't be trusted until that's ruled out; this is a command/tool failure, not by itself evidence that the connection or data source lacks tables. The agent's own report was: "${matched.message}"`,
             };
         }
-        if (claimsNoTablesOrModels(matched.message) && classifyRecordedSchemaDiscovery(context.worklog).kind === "none") {
+        if (claimsNoTablesOrModels(matched.message) && classifyRecordedSchemaDiscovery(context.worklog, projectBindingOf(context)).kind === "none") {
             return {
                 status: "error",
                 failureKind: "no_successful_schema_discovery",

package/dist-server/harness/tools/setup-native.d.ts

@@ -17,6 +17,13 @@ export interface SetupExecutionToolOptions {
      * never broaden either its cwd or its write scope beyond it.
      */
     readonly workspaceRoot: string;
+    /**
+     * The bound project directory of a project-bound setup step. When set and the
+     * directory exists, an `exec` without an explicit `cwd` runs there instead of
+     * at `workspaceRoot`; an explicit `cwd` still wins. Must lie within
+     * `workspaceRoot` (same containment check as an explicit `cwd`).
+     */
+    readonly defaultExecCwd?: string;
 }
 /**
  * A single flat top-level object, NOT a `z.discriminatedUnion` — a

package/dist-server/harness/tools/setup-native.js

@@ -109,7 +109,7 @@ export const setupExecutionInputSchema = z.object({
     cwd: z
         .string()
         .optional()
-        .describe('Optional for both actions: use this directory instead of the workspace root as the command cwd or the base for a relative write path (e.g. the project directory). Absolute or relative to the workspace root, and must resolve within it. Defaults to the workspace root when omitted. For exec, use this instead of "cd <dir> && ..." chaining.'),
+        .describe('Optional for both actions: use this directory instead of the workspace root as the command cwd or the base for a relative write path (e.g. the project directory). Absolute or relative to the workspace root, and must resolve within it. Defaults to the workspace root when omitted (for exec, the bound project directory once the step has one). For exec, use this instead of "cd <dir> && ..." chaining.'),
     path: z
         .string()
         .optional()
@@ -291,8 +291,11 @@ function resolveWritePath(workspaceRoot, requestedPath, requestedCwd) {
  * exec cwd to any directory within `workspaceRoot` (e.g. the project
  * directory), but never broaden it beyond that root.
  */
-function resolveExecCwd(workspaceRoot, requestedCwd) {
+function resolveExecCwd(workspaceRoot, requestedCwd, defaultCwd) {
     if (requestedCwd === undefined) {
+        if (defaultCwd !== undefined && existsSync(defaultCwd)) {
+            return assertWithinScope(workspaceRoot, defaultCwd, (requested, scope) => new SetupExecCwdScopeError(requested, scope));
+        }
         return workspaceRoot;
     }
     return assertWithinScope(workspaceRoot, requestedCwd, (requestedCwd, scope) => new SetupExecCwdScopeError(requestedCwd, scope));
@@ -319,7 +322,7 @@ export async function executeSetupExecution(input, options) {
             throw new SetupExecutionInputError("exec", "command");
         }
         assertCommandAllowed(input.command);
-        const cwd = resolveExecCwd(workspaceRoot, input.cwd);
+        const cwd = resolveExecCwd(workspaceRoot, input.cwd, options.defaultExecCwd);
         const result = await env.exec({ mode: "write", command: "/bin/sh", args: ["-c", input.command], cwd, timeoutMs: SETUP_EXEC_TIMEOUT_MS }, policy);
         const { stdout, stderr } = redactSetupExecutionOutput(input.command, result);
         return {
@@ -343,7 +346,7 @@ export function createSetupExecutionTool(options) {
     return tool({
         description: "Run a shell command or write a file within the setup workspace, subject to a destructive/redirection " +
             'command denylist and a workspace-root scope. Two call shapes: {action: "exec", command, cwd?} runs a ' +
-            "shell command (command is required; cwd is optional, defaults to the workspace root, and must resolve " +
+            "shell command (command is required; cwd is optional, defaults to the bound project directory for a project step once it exists (otherwise the workspace root), and must resolve " +
             'within it — path/content are unused); {action: "write", path, content, cwd?} writes a file (path and content ' +
             "are both required; a relative path uses cwd when supplied, otherwise the workspace root; command is unused). A call missing the field(s) its action requires, or " +
             "supplying a cwd/path that escapes the workspace root, is rejected before anything runs or is written.",

package/dist-server/server/app.js

@@ -24,7 +24,7 @@ import { verifyProposal } from "./enrichment-verify.js";
 import { canonicalizeProposal, hashEnrichmentOperation, NATIVE_ENRICHMENT_SUBMIT_INPUT_SCHEMA, NATIVE_ENRICHMENT_SUBMIT_MCP_TOOL_NAME, requiresApproval, resolveEnrichmentBinding, sameEnrichmentBinding, EnrichmentContractError } from "./enrichment.js";
 import { INTERACTIVE_TARGETS, InteractiveLaunchError } from "./interactive-terminal.js";
 import { nativeSessionLaunchErrorCode, nativeSessionLaunchFailure, nativeSessionLifecycle, NATIVE_PURPOSES, NATIVE_SETUP_RECOVERY_MCP_TOOL_NAME, NativeSetupRecoveryError } from "./native-sessions.js";
-import { NATIVE_MCP_PERSIST_ANSWER_TOOL_NAME, NATIVE_MCP_TOOL_NAME, NATIVE_PERSIST_ANSWER_CONTRACT, NATIVE_SAVE_DASHBOARD_CONTRACT, NativeArtifactError } from "./native-artifacts.js";
+import { NATIVE_MCP_PERSIST_ANSWER_TOOL_NAME, NATIVE_MCP_QUERY_TOOL_NAME, NATIVE_MCP_TOOL_NAME, NATIVE_PERSIST_ANSWER_CONTRACT, NATIVE_QUERY_INPUT_SCHEMA, NATIVE_SAVE_DASHBOARD_CONTRACT, NativeArtifactError } from "./native-artifacts.js";
 import { sameNativeRuntimeBinding } from "./native-dispatch-registry.js";
 import { ProfileRegistryError, toWarbleProfileDto } from "./profile-registry.js";
 import { DEFAULT_CONVERSATION_PROFILE } from "./native-sessions.js";
@@ -1196,14 +1196,19 @@ export function createApp(deps) {
         };
         const artifactTool = {
             name: NATIVE_MCP_TOOL_NAME,
-            description: "Save a dashboard to Artifacts. Use a prior persist_answer reference, or select this session's latest retained answer when the opaque reference is no longer available, without recomputing. The host marks the artifact verified only when the referenced answer is one it grounded itself; a dashboard built from a payload you write is stored as unverified. The existing payload form remains available for compatibility.",
+            description: "Save a dashboard to Artifacts. Use a prior persist_answer reference, or select this session's latest retained answer when the opaque reference is no longer available, without recomputing. The host marks the artifact verified only when the referenced answer is one it grounded itself, or when a payload you write holds only table and definition blocks (plus an optional summary) and every definition cites a query this session ran through the query tool (by its query_id, else its SQL); its tables and definitions are then rebuilt from those query results and your summary is kept. A payload with any other block (narrative, chart, KPI) or an estimate flag is stored intact and unverified, as is any other payload. The existing payload form remains available for compatibility.",
             inputSchema: NATIVE_SAVE_DASHBOARD_CONTRACT.inputSchema,
         };
         const persistAnswerTool = {
             name: NATIVE_MCP_PERSIST_ANSWER_TOOL_NAME,
-            description: "Persist this answer's exact typed table and optional definition result before conversational presentation. idempotency_key is retry authority only; the host returns canonical provenance. On success, later save_dashboard calls should use its opaque answer_ref, with the session-scoped latest selector available if that ref leaves the conversation; on failure, present the answer but report that reference saving is unavailable.",
+            description: "Persist this answer's exact typed table and optional definition result before conversational presentation. idempotency_key is retry authority only; the host returns canonical provenance. On success, later save_dashboard calls should use its opaque answer_ref, with the session-scoped latest selector available if that ref leaves the conversation; on failure, present the answer but report that reference saving is unavailable. The host records the answer as verified only when its definition cites a query this session ran through the query tool (by its query_id, else its SQL); its table and definition are then rebuilt from that query's result. Any other answer is stored as written and unverified.",
             inputSchema: NATIVE_PERSIST_ANSWER_CONTRACT.inputSchema,
         };
+        const queryTool = {
+            name: NATIVE_MCP_QUERY_TOOL_NAME,
+            description: "Run one read-only SQL query through the host and return its rows plus a query_id. Cite that query_id in the definition block of the answer you persist or save; only answers whose every definition cites a query this session ran here can be recorded as verified.",
+            inputSchema: NATIVE_QUERY_INPUT_SCHEMA,
+        };
         const enrichmentSubmitTool = {
             name: NATIVE_ENRICHMENT_SUBMIT_MCP_TOOL_NAME,
             description: "Submit a drafted context enrichment proposal for host verification. The host re-checks the project binding, canonicalizes the proposal, and runs it through a shadow-copy verification ladder (grammar, sink, validate, build, dry-run) against a throwaway copy of the project -- the bound project itself is never written to. Only a verified proposal is recorded, into the same enrichment ledger a human reviews through accept/edit/skip. A refuted proposal is never recorded; the refuting step and reason are returned so the draft can be revised.",
@@ -1216,7 +1221,7 @@ export function createApp(deps) {
         const nativeToolsForPurpose = (purpose) => {
             switch (purpose) {
                 case "setup": return [setupTool];
-                case "analysis": return [persistAnswerTool, artifactTool];
+                case "analysis": return deps.nativeArtifacts?.queryAvailable() ? [queryTool, persistAnswerTool, artifactTool] : [persistAnswerTool, artifactTool];
                 case "context_enrichment": return [enrichmentSubmitTool];
                 default: {
                     const exhaustive = purpose;
@@ -1244,6 +1249,10 @@ export function createApp(deps) {
                 const saved = deps.nativeArtifacts.save(credential, request.params.arguments);
                 return c.json({ jsonrpc: "2.0", id, result: { content: [{ type: "text", text: JSON.stringify(saved) }], structuredContent: saved } });
             }
+            if (nativeSession.purpose === "analysis" && request.params.name === NATIVE_MCP_QUERY_TOOL_NAME && deps.nativeArtifacts.queryAvailable()) {
+                const queried = await deps.nativeArtifacts.query(credential, request.params.arguments);
+                return c.json({ jsonrpc: "2.0", id, result: { isError: queried.isError, content: [{ type: "text", text: queried.text }], ...(queried.result !== undefined ? { structuredContent: queried.result } : {}) } });
+            }
             if (nativeSession.purpose === "analysis" && request.params.name === NATIVE_MCP_PERSIST_ANSWER_TOOL_NAME) {
                 const persisted = deps.nativeArtifacts.persistAnswer(credential, request.params.arguments);
                 return c.json({ jsonrpc: "2.0", id, result: { content: [{ type: "text", text: JSON.stringify(persisted) }], structuredContent: persisted } });

package/dist-server/server/bin.js

@@ -122,6 +122,8 @@ import { resolveWarbleBinary } from "../harness/compile/resolve-binary.js";
 import { toAuthChoiceFromRuntimeSettings } from "./auth-choice.js";
 import { Store } from "./db.js";
 import { resolveEnrichmentBinding, resolveProjectIdentity } from "./enrichment.js";
+import { hashDirectory } from "../harness/compile/fingerprint.js";
+import { openWrenComponentAccess } from "../harness/components/wren-access.js";
 import { createDispatchedEnrichmentDraftRunner } from "./enrichment-runner.js";
 import { dispatchInteractiveArtifacts, getInteractiveTerminalReadiness, InteractiveLaunchError, InteractiveTerminalManager, prepareInteractiveHandoff, unavailableInteractiveReadiness } from "./interactive-terminal.js";
 import { createProbedPtyFactory, ensureDarwinNodePtySpawnHelper } from "./node-pty-host.js";
@@ -556,6 +558,12 @@ async function main() {
         expectedMcpUrl: nativeMcpUrl,
         mcpUrl: process.env["WREN_HARNESS_NATIVE_MCP_URL"] ?? nativeMcpUrl,
         getBinding: currentInteractiveBinding,
+        // The session `query` tool runs through the same `wren` native sessions are given.
+        ...(nativeWrenExecutable ? {
+            openQueryAccess: async (binding, signal) => openWrenComponentAccess({
+                executable: nativeWrenExecutable.executable, project: binding.path, fingerprint: await hashDirectory(binding.path), signal,
+            }),
+        } : {}),
     });
     const nativeTerminalHostAvailable = async () => {
         try {

package/dist-server/server/fold.d.ts

@@ -57,14 +57,15 @@ export declare function toAnswerOrRefusalEvent(id: string, result: RouteResult,
  * The one place a subscription answer's `verified` is decided; a `verified`
  * field in model-written text is never kept.
  *
- * - `codex-local`: the model's `run_sql` executes through this turn's host
- *   query service, so the answer is grounded against that turn's observations
- *   ({@link groundCodexLocalEnvelope}): verified only when every query it
- *   cites is one the host ran this turn and that read a table, and then its
- *   tables and definitions are the observed ones. Otherwise it stays as
- *   written, badged "Unverified".
- * - `agent-sdk`: the host runs none of its queries and holds no evidence, so
- *   it is always `false`, with the rest of the envelope kept as-is.
+ * - `codex-local` and `agent-sdk`: the model's host query tool (codex:local's
+ *   `run_sql`, the agent-sdk host MCP's `run_sql`) executes through this turn's
+ *   host query service, so the answer is grounded against that turn's
+ *   observations ({@link groundOnHostEvidence}): verified only when every
+ *   query it cites is one the host ran this turn and that read a table, and
+ *   then its tables and definitions are the observed ones. Otherwise it stays
+ *   as written, badged "Unverified" — including any answer whose data came
+ *   another way (agent-sdk's Bash `wren` stays available and yields no host
+ *   evidence).
  *
  * Other backends pass through.
  */