Repository navigation
Tags
Tags
fix(genbi): redact env values in setup gate messages and bind explici… …t cwd to the project Gate messages quote the agent's command back to it and into the correction prompt, so a leading or chained NAME=value assignment could echo a credential. Every quoted command now has assignment values masked and is length-capped, including the pre-existing failed-discovery and failed-exec messages. A recorded explicit cwd also left a hole: a bare lifecycle or discovery command run from another directory still counted. When an entry records a cwd, the effective directory must now resolve to the bound project or the entry is unrecognised (and quoted in the failure). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
chore(wren): carry genbi's core/wren changes onto 0.15.0 Rebases the core/wren delta of the genbi branch (merge-base 243eec8) onto origin/main's core/wren 0.15.0, keeping main's version and dependency floors (wren-core-py>=0.8.0, uv.lock unchanged). Source commits: 06ec3b5 a4a3cd7 3f86673 d4885d3 ba337c9 1b4b919 Non-trivial resolutions: - engine.py: keep main's validate_planned_sql/DatabaseTimeoutError imports and add genbi's validate_read_only_query for `query --read-only`. - context_cli.py: keep main's `errors=` keyword on _print_warnings (error counts in the validate summary) plus genbi's "0 warning(s), N error(s)" line and connection check. - tests: keep both sides' new tests in test_context.py and test_context_cli.py; main's non-UTF-8 default-encoding init/build test now passes `--data-source postgres`, because the genbi scaffold leaves data_source blank until a profile is bound and build refuses a blank data_source. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix(context-loader): keep install state readable for other users A root `npm install -g` followed by use from a different service user failed verification: install-state.json was written 0600, so the non-root reader could not parse it and the loader was reported as not installed. The file holds only digests and the binary path, so read access does not weaken integrity. Set state 0644, binary 0755 and bin dir 0755 explicitly (a restrictive umask cannot strip them), and repair them on the reuse path. Nothing becomes group- or world-writable; the owned-file and path-escape checks are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
feat(context-loader): build and certify linux-x64 and linux-arm64 art… …ifacts The published package carried only a darwin-arm64 artifact row, so its postinstall failed on Linux and any package depending on it could not be installed there. The release workflow now builds all three targets in a matrix (Linux legs inside an old-glibc image, with a glibc floor check and a binary smoke run), then a single publish job collects the archives, generates one manifest with a row per target, verifies every row through the real installer download path, and publishes the release and npm package once. generate-release-manifest.mjs accepts repeated <target> <archive> <url> triples; the single-archive darwin-arm64 form still works. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix(genbi): isolate slot failures, surface governed error classes, gr… …ound the answering query (#9) A chatty model against the composed answer_query runtime lost 32-39% of runs to callee_failed with zero wrong answers: every loss was a first-shot SQL error the model would have corrected on its next query. Four defects sat behind that, and a batch-shaped callee would lose a whole report to one bad slot. - runner: a rejected tool call failed the whole invocation before the on_failure repair branch could run, so repair_sql was unreachable on tool errors. A failed tool call now fails the step; the declared repair runs and an unrepaired failure is still callee_failed. Requests that declare slots treat a tool error as one slot's outcome instead, so the other slots are answered; a malformed declaration buys nothing. - normalize: per-slot arrays are normalized entry by entry from the executed queries they name; a single answer is the observed table the terminal value names, never simply the last table (a stray check after the right query produced a verified-but-wrong count). The legacy loop's tool-table seed follows the same rule. - governed transport: failures carry a closed error class classified from error codes and phases only; the harness owns the sentence the model sees and never forwards the wire message. Protocol is wren-governed/2; /1 still works and its string errors read as internal. - read-only policy: sqlglot models AND/OR/XOR and EXISTS as Func nodes, so the allow-list rejected every query with two WHERE conditions. They and a few read-only aggregates are admitted; the rejection phase is SQL_POLICY_CHECK so the transport classifies it as policy_rejected. Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
fix(genbi): retain reviewed dependency license provenance
fix: provision secure managed Python runtimes in GenBI (#3) * fix: attest and relocate managed Wren console entrypoints * chore: align managed runtime validation with personal fork * fix: normalize fresh CPython modes before managed provisioning * test: expect personal fork managed runtime mirror