feat(wren): GenBI app build & deploy — semantic layer → shareable web app

[PaulChen79]

What

Adds a GenBI app build & deploy pipeline to the wren CLI: turn a Wren project's semantic layer into a shareable, browser-side GenBI web app and deploy it to the user's Vercel or Cloudflare account — from a natural-language request to a public URL in one conversation.

Design: CLI ↔ agent split

• The CLI owns all deterministic state — the authoritative build instruction, the app index, verify, and deploy.
• The agent authors the app code, following the CLI's build instruction. .wren/apps.yml is only ever written by the CLI, never hand-edited.

New CLI surface (wren genbi)

Command	Purpose
wren genbi build <name> --prompt "…" [--data-mode snapshot|live]	Print a project-hydrated build instruction (wasm wiring with pinned wren-core-wasm version, the project's model/column inventory, data-mode guidance, acceptance criteria, target folder). Writes nothing to disk.
wren genbi register / list / remove	Machine-written app index.
wren genbi verify <name>	Deterministic deploy preflight.
wren genbi open <name>	Local preview.
wren genbi deploy <name> --provider vercel|cloudflare [--prod]	Deploy and return a shareable URL.

Data modes

• snapshot (default) — data is bundled with the app as parquet/duckdb and queried client-side. Fully serverless.
• live — the app calls back to the user's warehouse/API at view time. Requires a CORS-enabled endpoint.

Security

• Secret-leak gate — verify fails the app if credentials are inlined into app files, and deploy refuses to ship it (the deploy target is a public static host).
• No tokens on the command line — VERCEL_TOKEN / CLOUDFLARE_API_TOKEN (and CLOUDFLARE_ACCOUNT_ID) are discovered from the environment or .env, never passed as flags.
• Production deploys are preview-by-default; --prod is explicit.

Skill

Ships a genbi-app agent workflow guide. Per main's new model (skills served from the CLI, with skills/wren/ as the only external discovery stub), the guide lives at core/wren/src/wren/skills_content/genbi-app/SKILL.md and is served via wren skills get genbi-app — no separate skills/ directory, no version drift.

Tests

• Unit tests for build, deploy, index, and verify (core/wren/tests/unit/test_genbi_*.py).
• End-to-end walkthrough script core/wren/scripts/genbi-e2e.sh.
• The existing served-content guard and skill-stub guards pass with genbi-app added to the bundled set.

Notes

This branch also merges main (0.9.0) and aligns the GenBI skill with main's "skills served from the CLI" architecture (#2329).

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added a full wren genbi command suite: build (composes agent instructions), register/list/remove, verify, open (local HTTP preview), and deploy to Vercel or Cloudflare. Token lookup supports env/project .env fallbacks.

• Bug Fixes / Safety

  • Strict app-name validation and structural/security preflight checks to prevent path traversal and inline-secret leakage.

• Documentation

  • New GenBI workflow guide and updated skill/manifest entries.

• Tests

  • Extensive unit tests covering build, index, verify, deploy, and provider flows.

Screen.Recording.2026-06-10.at.9.05.10.AM.mov

Screen.Recording.2026-06-10.at.9.06.39.AM.mov

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

This PR introduces the complete GenBI feature for building and deploying LLM-generated web applications from Wren semantic layers. It adds a wren genbi CLI subcommand group with build, register, list, remove, verify, open, and deploy commands; implements Vercel and Cloudflare deployment adapters; manages app state in .wren/apps.yml; composes build instructions for LLM agents; validates apps with security gates; and includes comprehensive unit tests and skill documentation.

Changes

GenBI Build & Deployment Feature

Layer / File(s)	Summary
Deployment provider interface and implementations core/wren/src/wren/genbi/providers/base.py, core/wren/src/wren/genbi/providers/vercel.py, core/wren/src/wren/genbi/providers/cloudflare.py, core/wren/src/wren/genbi/providers/__init__.py	Defines the DeployProvider protocol, Deployment and DeployError types; implements Vercel adapter (v13 Deployments API with file collection and bearer auth) and Cloudflare adapter (Pages via wrangler CLI with account scoping); provides a factory to instantiate providers by name.
App index and state management core/wren/src/wren/genbi/index.py	Implements YAML-based app registry at .wren/apps.yml with CRUD operations: register_app, get_app, update_app, remove_app; handles schema versioning, status transitions (scaffolded/built/deployed), and error handling for malformed YAML.
Build instruction composition core/wren/src/wren/genbi/composer.py	Generates markdown build instructions for LLM agents, embedding MDL/target paths, wren-core-wasm pinned version, data-mode-specific guidance (snapshot vs. live), model inventory from project metadata, acceptance criteria and next CLI steps.
App verification and security gates core/wren/src/wren/genbi/verify.py	Implements structural validation: checks app directory, index.html, and mdl.json existence/validity; enforces snapshot-mode data asset requirements; scans files for inlined credentials/secrets using regex patterns; returns VerifyResult with pass/fail and failure details.
Token discovery and resolution core/wren/src/wren/genbi/tokens.py	Implements 3-tier token lookup: process environment → standard .env sources via profile module → explicit project .env file; returns None when absent and gracefully handles missing python-dotenv.
GenBI command suite core/wren/src/wren/genbi/cli.py	Defines genbi_app Typer sub-application with commands: build, register, list, remove, verify, open, and deploy; includes helpers for project discovery, prompt resolution, app name validation (slug regex), and registered app lookup.
CLI main entry point integration core/wren/src/wren/cli.py	Registers genbi_app into the main Wren CLI via app.add_typer(genbi_app), making wren genbi subcommand group available.
Build command unit tests core/wren/tests/unit/test_genbi_build.py	Tests wren genbi build: instruction composition without side effects, model inventory inclusion, WASM/CDN guidance, data-mode output (snapshot vs. live), prompt handling (file/stdin), implicit MDL compilation, unknown data-mode rejection, and path-traversal name validation.
Index management unit tests core/wren/tests/unit/test_genbi_index.py	Tests wren genbi register, list, remove: .wren/apps.yml persistence, listing with metadata, missing index handling, entry deletion, YAML validation errors, and path-traversal security.
Verification and local preview unit tests core/wren/tests/unit/test_genbi_verify.py	Tests wren genbi verify and open: successful verification with status flipping (scaffolded→built), preflight failures (missing/invalid artifacts, missing data assets), security rejection of inlined secrets (config.js, settings.json, index.html), live-mode exemptions, and unregistered app errors.
Deployment provider unit tests core/wren/tests/unit/test_genbi_deploy.py	Tests wren genbi deploy: token resolution tiering (env → project .env), Vercel/Cloudflare request construction and state persistence, missing token errors with guidance, verification abort on broken artifacts, missing URL validation, and unknown provider errors.
GenBI skill guide and bundled content core/wren/src/wren/skills_content/genbi/SKILL.md, skills/index.json, skills/wren/SKILL.md, core/wren/tests/unit/test_skills_cli.py, core/wren/src/wren/skills_content/dlt-connector/SKILL.md	Adds end-to-end GenBI workflow guide covering CLI-driven process, data modes, app conventions, deployment prerequisites, Vercel/Cloudflare token handling, safety boundaries; updates skill discovery metadata and integrates GenBI as follow-up from dlt-connector; updates bundled skills test to include genbi.

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant GenbiCLI
  participant Verifier
  participant Provider
  participant AppIndex
  User->>GenbiCLI: wren genbi deploy <name> --provider <p> --prod?
  GenbiCLI->>Verifier: verify_app(app_dir, data_mode)
  Verifier-->>GenbiCLI: VerifyResult (passed/fail)
  GenbiCLI->>Provider: deploy(build_dir, app_name, token, prod, link)
  Provider-->>GenbiCLI: Deployment(url, environment, ids)
  GenbiCLI->>AppIndex: update_app(name, deployment metadata)
  GenbiCLI-->>User: prints deployed URL or error

Loading

🎯 4 (Complex) | ⏱️ ~60 minutes

Suggested reviewers

• goldmedal

"🐰 I stitched the build and deploy trail,
With Vercel stamps and Wrangler's sail,
I scanned for secrets, kept tokens out of sight,
Verified the app before it took flight,
Hop, deploy — the dashboard shines tonight!"

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 26.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title directly and specifically describes the main feature being added: the GenBI app build and deploy pipeline that transforms a Wren semantic layer into a shareable web app.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch worktree-deploy-app

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 10

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@core/wren/scripts/genbi-e2e.sh`:
- Around line 161-169: The test currently background-launches the server via the
genbi "open" command and then blindly sleeps 2s (see the genbi open ... &
snippet and OPEN_PID, WORK/open.out, URL variables); replace that sleep with a
bounded readiness loop that repeatedly extracts the URL from WORK/open.out (same
grep used to set URL) and attempts a lightweight HTTP probe (curl -sf) until
success or a configurable timeout (e.g., 30s) with a short sleep interval (e.g.,
0.5–1s) between attempts; on timeout, kill OPEN_PID and fail the test, and on
success continue as before. Ensure you update references to URL after each grep
attempt inside the loop so the probe uses the freshly discovered port.

In `@core/wren/src/wren/genbi/cli.py`:
- Around line 42-63: User-supplied app names can contain path traversal (e.g.,
"../") and are being path-joined directly in
build/register/verify/open_app/deploy, allowing escapes from the project's apps
directory; replace those joins by calling a central resolver (e.g.,
_resolve_app_dir(project_path, name)) that constructs project_apps =
project_path / "apps", resolves the resulting path, verifies it is a child of
project_apps (path.resolve().startswith(project_apps.resolve())), and raises a
typer.BadParameter (or ValueError caught and re-raised as typer.BadParameter)
for invalid or empty names; update build, register, verify, open_app, and deploy
to use _resolve_app_dir(project_path, name) instead of direct joins and ensure
all callers handle the raised error appropriately.

In `@core/wren/src/wren/genbi/index.py`:
- Around line 28-36: load_index currently assumes the YAML file is a mapping and
will crash on malformed `.wren/apps.yml`; wrap the yaml.safe_load call in a
try/except that catches yaml.YAMLError (and other parsing exceptions) and
validate that the returned data is a dict before calling setdefault; if parsing
fails or data is not a mapping, raise a clear, user-actionable ValueError (or a
custom error) that mentions the offending path (use index_path(project_path))
and advises the file is malformed, otherwise proceed to set default
"schema_version" and "apps" and return the dict; keep references to load_index,
index_path, and INDEX_SCHEMA_VERSION when implementing this.

In `@core/wren/src/wren/genbi/providers/cloudflare.py`:
- Around line 92-97: The code currently fabricates a deployment URL with
f"https://{app_name}.pages.dev" when result["url"] is missing; stop this by
removing the fallback and propagate the missing URL instead (e.g., set url =
result.get("url") or None) so upstream can detect/fail on missing data; update
the Deployment construction in the same block (the usage of url, environment,
account_id) and ensure any callers of Deployment (or code that expects a
non-empty url) handle a None/empty url rather than relying on a fabricated
pages.dev address.
- Around line 34-38: The dict comprehension that reads file bytes from build_dir
must skip symlinks and ensure resolved paths stay inside build_dir to prevent
exfiltration; update the comprehension/filter around rglob("*") to only include
entries where p.is_file() and not p.is_symlink() and where p.resolve() is under
build_dir (e.g., use p.resolve().is_relative_to(build_dir) or fall back to a
safe prefix compare of str(p.resolve()) against str(build_dir.resolve()) +
os.sep), then call p.read_bytes() only for those validated paths so
base64.b64encode(...) never reads files outside build_dir.

In `@core/wren/src/wren/genbi/providers/vercel.py`:
- Around line 70-73: The code currently defaults raw_url = data.get("url", "")
which leads to producing "https://" when the URL is missing; update the provider
code that constructs raw_url (the variable raw_url in vercel.py) to validate
presence and format of data["url"] before returning the Deployment: if
data.get("url") is missing or empty, raise an explicit error (e.g.,
ValueError/RuntimeError) or return a clear failure instead of defaulting to "",
and only build the Deployment(url=...) with the https:// prefix when raw_url is
non-empty and does not already start with "http"; ensure this check happens
right before the Deployment(...) call so the code never persists or returns
"https://".
- Around line 30-37: The file-collection loop in vercel.py allows symlink
traversal because path.is_file() and path.read_bytes() follow symlinks; prevent
exfiltration by skipping symlinks or verifying resolved targets are inside the
build_dir. In the for path in sorted(build_dir.rglob("*")) loop (the block that
appends to files), add a check to skip path if path.is_symlink() (or resolve the
path and ensure path.resolve().relative_to(build_dir.resolve()) succeeds inside
a try/except) before calling read_bytes(), so only regular files under build_dir
are read and encoded.

In `@core/wren/src/wren/genbi/verify.py`:
- Around line 68-100: verify_app currently ignores unknown data_mode values; add
an explicit validation of the data_mode parameter (in the verify_app function)
against the supported set (at minimum the existing "snapshot" mode) and treat
any other value as a verification failure: append a clear failure like
"unsupported data_mode: {data_mode}" to failures and return VerifyResult(False,
failures) early. Ensure you reference the same VerifyResult return type and
place the check after the app_dir existence checks (before the existing if
data_mode == "snapshot": block) so unsupported modes are rejected
deterministically.

In `@core/wren/src/wren/skills_content/genbi-app/SKILL.md`:
- Around line 51-55: The sentence in SKILL.md that currently says the build
"writes nothing to disk" conflicts with earlier text that the tool may
implicitly compile target/mdl.json; update the wording to scope the side-effect
(e.g., state that the command performs no writes to the app/index or app bundle
but may implicitly generate/compile target/mdl.json when missing). Edit the
paragraph around the long-prompt instructions to explicitly mention the implicit
target/mdl.json compilation behavior and clarify that only that metadata file
may be created, while no application bundle/app index files are written.

In `@core/wren/tests/unit/test_genbi_deploy.py`:
- Around line 54-57: The test assumes no external dotenv/profile fallbacks but
only deletes the VERCEL_TOKEN env var; make it hermetic by also isolating
filesystem and disabling dotenv/profile loaders: in
test_token_absent_returns_none (and the other affected tests) unset VERCEL_TOKEN
via monkeypatch.delenv, then set HOME and XDG_CONFIG_HOME to tmp_path with
monkeypatch.setenv(str(tmp_path)), and monkeypatch any dotenv/profile loader to
a no-op (e.g., monkeypatch.setattr("dotenv.load_dotenv", lambda *a, **k: False,
raising=False)) so resolve_token is forced to consult only the controlled
environment; apply the same pattern around resolve_token calls in the other test
blocks.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 1643c895-5504-4554-bdeb-7f3a91c5e17c

📥 Commits

Reviewing files that changed from the base of the PR and between 5fd8870 and 9bd7196.

⛔ Files ignored due to path filters (1)

• core/wren/uv.lock is excluded by !**/*.lock

📒 Files selected for processing (19)

• core/wren/scripts/genbi-e2e.sh
• core/wren/src/wren/cli.py
• core/wren/src/wren/genbi/__init__.py
• core/wren/src/wren/genbi/cli.py
• core/wren/src/wren/genbi/composer.py
• core/wren/src/wren/genbi/index.py
• core/wren/src/wren/genbi/providers/__init__.py
• core/wren/src/wren/genbi/providers/base.py
• core/wren/src/wren/genbi/providers/cloudflare.py
• core/wren/src/wren/genbi/providers/vercel.py
• core/wren/src/wren/genbi/tokens.py
• core/wren/src/wren/genbi/verify.py
• core/wren/src/wren/skills_content/genbi-app/SKILL.md
• core/wren/tests/unit/test_genbi_build.py
• core/wren/tests/unit/test_genbi_deploy.py
• core/wren/tests/unit/test_genbi_index.py
• core/wren/tests/unit/test_genbi_verify.py
• core/wren/tests/unit/test_skills_cli.py
• skills/wren/SKILL.md

[coderabbitai]

♻️ Duplicate comments (1)

core/wren/src/wren/skills_content/genbi/SKILL.md (1)

51-55: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

The disk-write statement still contradicts earlier text.

Lines 26-27 state that wren genbi build "compiles it implicitly" when target/mdl.json is missing, but lines 54-55 claim it "writes nothing to disk." This past review concern remains unaddressed.

📝 Suggested clarification

-For long or multi-line prompts use `--prompt-file <file>` or pipe to
-`--prompt -`. The command prints the authoritative build instruction —
-wasm wiring (pinned version, CDN load), the project's model/column inventory,
-data-mode guidance, acceptance criteria, and the target folder. It writes
-nothing to disk.
+For long or multi-line prompts use `--prompt-file <file>` or pipe to
+`--prompt -`. The command prints the authoritative build instruction —
+wasm wiring (pinned version, CDN load), the project's model/column inventory,
+data-mode guidance, acceptance criteria, and the target folder. It does not
+write app files or `.wren/apps.yml` (it may compile `target/mdl.json` if missing).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@core/wren/src/wren/skills_content/genbi/SKILL.md` around lines 51 - 55, The
documentation contradicts itself: the section describing "wren genbi build" must
be clarified so it consistently states whether the command writes files when it
"compiles it implicitly" due to a missing target/mdl.json; update SKILL.md to
either (A) state that "wren genbi build" will perform an implicit compile and
write the compiled artifacts (e.g., target/mdl.json and wasm wiring) to disk, or
(B) state that it only compiles in-memory and prints the authoritative build
instruction to stdout without writing any files; ensure the phrasing around
"wren genbi build", "target/mdl.json", and the sentence "It writes nothing to
disk." is made consistent and unambiguous.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Duplicate comments:
In `@core/wren/src/wren/skills_content/genbi/SKILL.md`:
- Around line 51-55: The documentation contradicts itself: the section
describing "wren genbi build" must be clarified so it consistently states
whether the command writes files when it "compiles it implicitly" due to a
missing target/mdl.json; update SKILL.md to either (A) state that "wren genbi
build" will perform an implicit compile and write the compiled artifacts (e.g.,
target/mdl.json and wasm wiring) to disk, or (B) state that it only compiles
in-memory and prints the authoritative build instruction to stdout without
writing any files; ensure the phrasing around "wren genbi build",
"target/mdl.json", and the sentence "It writes nothing to disk." is made
consistent and unambiguous.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: f98e824d-9653-4d2c-a321-16bd7ec114ca

📥 Commits

Reviewing files that changed from the base of the PR and between 9bd7196 and 5b8a766.

📒 Files selected for processing (6)

• core/wren/scripts/genbi-e2e.sh
• core/wren/src/wren/skills_content/dlt-connector/SKILL.md
• core/wren/src/wren/skills_content/genbi/SKILL.md
• core/wren/tests/unit/test_skills_cli.py
• skills/index.json
• skills/wren/SKILL.md

✅ Files skipped from review due to trivial changes (1)

• skills/index.json

🚧 Files skipped from review as they are similar to previous changes (2)

• core/wren/tests/unit/test_skills_cli.py
• core/wren/scripts/genbi-e2e.sh

[goldmedal]

Review — GenBI app build & deploy

Verdict: Approve with one security follow-up. Clean CLI↔agent split, deterministic state owned by the CLI, and strong behavior-test coverage across build/index/verify/deploy. The prior review round already hardened path traversal, symlink exfiltration, URL fabrication, malformed-index handling, and fail-closed verify — each with a regression test. One gap below is worth fixing before verify is leaned on as a real safety boundary.

Scope & CI

• Entirely core/wren/** + skills/ — no Rust/PyO3/connector/MDL surfaces, so no connector-regression or schema risk.
• wren-ci.yml covers core/wren/** and runs pytest tests/unit/ -v -m unit; all new tests carry pytestmark = pytest.mark.unit, so they run.
• Verified @wrenai/wren-core-wasm@0.4.1 matches core/wren-core-wasm/package.json exactly (name + version) — no CDN drift.

🟠 Medium — secret-leak gate has a suffix blind spot (reproduced)

verify._scan_for_secrets scans an allowlist of suffixes only: .css .htm .html .js .json .md .mjs .txt. Everything else is skipped — including the two most likely secret carriers an LLM will create:

• .env — the canonical secret file; agents write these reflexively.
• .ts / .tsx / .jsx / .vue — very plausible for a "web app"; none are scanned.

Meanwhile vercel._collect_files uploads every regular file under the app dir (only symlinks / outside-root skipped), and wrangler pages deploy . ships the whole folder. I reproduced this: a live app carrying a .env (postgres connection string) and a config.ts with the same secret passes verify cleanly and would be uploaded to the public host — defeating the gate's stated purpose ("a credential-leaking app can never reach a public URL").

Recommendation: invert to default-deny — scan every file except a small set of known-binary/data suffixes (.parquet, .duckdb, images, fonts, .wasm) — rather than allowlisting text types. As belt-and-suspenders, also refuse to upload dotfiles like .env* in _collect_files. At minimum add .env*, .ts, .tsx, .jsx, .vue, .yaml, .yml, .toml — but the allowlist will keep losing this race against whatever extension the agent picks next; default-deny is the durable fix.

🟡 Low — don't oversell the gate

The patterns are deliberately narrow (good for false positives) but miss GCP service-account JSON (private_key), bare bearer tokens, and generic high-entropy keys. The composer/SKILL text presents verify as the thing that catches inlined credentials, which invites over-trust. Worth one sentence noting it's best-effort defense-in-depth, not a guarantee — the real rule (already stated) is "never inline secrets."

Nits

• CI lint runs ruff … src/ only, so the new test files aren't lint-gated (pre-existing behavior).
• open/remove take name without routing through _resolve_app_dir, but they only touch index dict keys / serve an already-validated dir, and register (the only index writer) validates the slug — no traversal risk. Fine as-is.

Done well

• Token discipline is textbook: env → .env tiers, never argv, never persisted — asserted on both providers and on apps.yml.
• The autouse _isolate_env_loading fixture is the right call — without it the missing-token tests could pass spuriously or fire a real API call on a dev machine with a live VERCEL_TOKEN.
• "Never fabricate a URL" + fail-closed-on-unknown-mode + MalformedIndexError are each small, exactly-right robustness choices with tests.

The Medium finding is the only thing I'd want addressed before merge, given security is the headline feature.

[goldmedal]

We should also write the doc for the genBi command.

[goldmedal]

Follow-up note: update the project-structure doc

The default-deny secret-scan fix looks good (verified: the .env + config.ts case that previously slipped now fails verify, with regression tests). One minor doc-completeness gap worth folding into this PR's docs commit:

GenBI introduces two new project-local artifacts — <project>/apps/<name>/ (the generated app) and <project>/.wren/apps.yml (the app index) — but the canonical "what lives in the project vs. globally in ~/.wren/" reference, docs/core/guides/manage_project.md, isn't updated and lists neither. It already documents target/mdl.json and .wren/memory/, so adding apps/ and placing .wren/apps.yml next to .wren/memory/ keeps the overview complete. The genbi guide/cli reference mention apps/<name>/ inline, but the structure overview doesn't.

Not a blocker — genbi.md covers the layout for genbi users; this is just to keep the central structure doc in sync with the directories this PR adds.

(Unrelated, pre-existing: docs/core/README.md links to guides/modeling/wren_project.md, which doesn't exist yet — leave for a separate PR.)