@treeseed/sdk 0.4.13 → 0.5.0

package/dist/treeseed/template-catalog/templates/starter-basic/template/src/config.yaml

@@ -9,6 +9,10 @@ site:
       items:
         - label: Handbook
           href: /knowledge/handbook/
+        - label: Proposals
+          href: /proposals/
+        - label: Decisions
+          href: /decisions/
     - label: Build
       items:
         - label: Welcome
@@ -38,3 +42,24 @@ models:
   docs:
     defaults:
       tags: []
+  notes:
+    defaults:
+      author: __SITE_NAME__
+      draft: false
+      tags: []
+  questions:
+    defaults:
+      draft: false
+      tags: []
+  objectives:
+    defaults:
+      draft: false
+      tags: []
+  proposals:
+    defaults:
+      draft: false
+      tags: []
+  decisions:
+    defaults:
+      draft: false
+      tags: []

package/dist/treeseed/template-catalog/templates/starter-basic/template/src/content/decisions/adopt-initial-proposal-loop.mdx

@@ -0,0 +1,22 @@
+---
+id: decision:adopt-initial-proposal-loop
+title: Adopt The Initial Proposal Loop
+description: Seed the starter with a decision record alongside the initial proposal.
+date: 2026-04-17
+summary: The starter demonstrates that decisions are first-class records, not hidden implementation residue.
+status: live
+decisionType: approved
+rationale: Teams benefit from a visible pattern for recording what was chosen and why.
+authority: Starter template
+primaryContributor: starter-steward
+relatedObjectives: []
+relatedQuestions: []
+relatedNotes: []
+relatedProposals:
+  - establish-initial-proposal-loop
+relatedBooks: []
+implements:
+  - starter
+---
+
+This starter decision exists to make the proposal-to-decision loop visible in a freshly generated TreeSeed site.

package/dist/treeseed/template-catalog/templates/starter-basic/template/src/content/people/starter-steward.mdx

@@ -0,0 +1,11 @@
+---
+name: Starter Steward
+role: Maintainer
+affiliation: Starter template
+status: live
+tags:
+  - stewardship
+  - starter
+---
+
+This placeholder profile exists so the starter can model contributor-linked content from the first commit.

package/dist/treeseed/template-catalog/templates/starter-basic/template/src/content/proposals/establish-initial-proposal-loop.mdx

@@ -0,0 +1,17 @@
+---
+id: proposal:establish-initial-proposal-loop
+title: Establish The Initial Proposal Loop
+description: Seed the starter with a proposal so suggested changes are explicit from day one.
+date: 2026-04-17
+summary: The starter should show how a team can move from questions and objectives into a concrete proposal.
+status: live
+proposalType: strategy
+motivation: New sites should inherit a visible proposal-to-decision pattern instead of recreating it ad hoc.
+primaryContributor: starter-steward
+relatedObjectives: []
+relatedQuestions: []
+relatedNotes: []
+relatedBooks: []
+---
+
+Use this starter proposal as a placeholder for the first concrete change a team wants to make in its site or operating model.

package/dist/treeseed/template-catalog/templates/starter-basic/template/src/manifest.yaml

@@ -3,17 +3,24 @@ siteConfigPath: ./src/config.yaml
 content:
   docs: ./src/content/knowledge
   pages: ./src/content/pages
-  notes: ./src/content/empty
-  questions: ./src/content/empty
-  objectives: ./src/content/empty
-  people: ./src/content/empty
-  agents: ./src/content/empty
-  books: ./src/content/empty
+  notes: ./src/content/notes
+  questions: ./src/content/questions
+  objectives: ./src/content/objectives
+  proposals: ./src/content/proposals
+  decisions: ./src/content/decisions
+  people: ./src/content/people
+  agents: ./src/content/agents
+  books: ./src/content/books
+  templates: ./src/content/templates
+  knowledge_packs: ./src/content/knowledge-packs
+  workdays: ./src/content/workdays
 features:
   docs: true
   books: false
-  notes: false
-  questions: false
-  objectives: false
-  agents: false
+  notes: true
+  questions: true
+  objectives: true
+  proposals: true
+  decisions: true
+  agents: true
   forms: false

package/dist/treeseed/template-catalog/templates/starter-basic/template/treeseed.site.yaml

@@ -5,12 +5,14 @@ contactEmail: __CONTACT_EMAIL__
 hosting:
   kind: hosted_project
   registration: optional
-  marketBaseUrl: https://api.treeseed.ai
+  marketBaseUrl: https://knowledge.coop
   teamId: __SITE_SLUG__
   projectId: __SITE_SLUG__
 cloudflare:
   accountId: replace-with-cloudflare-account-id
   workerName: __SITE_SLUG__
+  queueName: __SITE_SLUG__-agent-work
+  dlqName: __SITE_SLUG__-agent-work-dlq
   pages:
     projectName: __SITE_SLUG__
     previewProjectName: __SITE_SLUG__-staging
@@ -23,17 +25,77 @@ cloudflare:
     manifestKeyTemplate: teams/{teamId}/published/common.json
     previewRootTemplate: teams/{teamId}/previews
     previewTtlHours: 168
+surfaces:
+  web:
+    enabled: true
+    provider: cloudflare
+    rootDir: .
+    publicBaseUrl: https://__SITE_SLUG__.pages.dev
+    localBaseUrl: http://127.0.0.1:4321
+  api:
+    enabled: true
+    provider: railway
+    rootDir: .
+    localBaseUrl: http://127.0.0.1:3000
+services:
+  api:
+    enabled: true
+    provider: railway
+    rootDir: .
+    publicBaseUrl: https://__SITE_SLUG__-api.up.railway.app
+    railway:
+      serviceName: __SITE_SLUG__-api
+      buildCommand: npm run build
+      startCommand: node ./src/api/server.js
+    environments:
+      local:
+        baseUrl: http://127.0.0.1:3000
+  manager:
+    enabled: true
+    provider: railway
+    railway:
+      serviceName: __SITE_SLUG__-manager
+      rootDir: .
+      buildCommand: npm run build
+      startCommand: node ./node_modules/@treeseed/core/dist/services/manager.js
+      schedule: '*/5 * * * *'
+  worker:
+    enabled: true
+    provider: railway
+    railway:
+      serviceName: __SITE_SLUG__-worker
+      rootDir: .
+      buildCommand: npm run build
+      startCommand: node ./node_modules/@treeseed/core/dist/services/worker.js
+  workdayStart:
+    enabled: true
+    provider: railway
+    railway:
+      serviceName: __SITE_SLUG__-workday-start
+      rootDir: .
+      buildCommand: npm run build
+      startCommand: node ./node_modules/@treeseed/core/dist/services/workday-start.js
+      schedule: '0 9 * * 1-5'
+  workdayReport:
+    enabled: true
+    provider: railway
+    railway:
+      serviceName: __SITE_SLUG__-workday-report
+      rootDir: .
+      buildCommand: npm run build
+      startCommand: node ./node_modules/@treeseed/core/dist/services/workday-report.js
+      schedule: '5 17 * * 1-5'
 plugins:
-  - package: '@treeseed/sdk/plugin-default'
+  - package: '@treeseed/core/plugin-default'
 providers:
   forms: store_only
   agents:
-    execution: stub
+    execution: copilot
     mutation: local_branch
-    repository: stub
-    verification: stub
-    notification: stub
-    research: stub
+    repository: git
+    verification: local
+    notification: sdk_message
+    research: project_graph
   deploy: cloudflare
   content:
     runtime: team_scoped_r2_overlay

package/dist/treeseed/template-catalog/templates/starter-basic/template.config.json

@@ -78,6 +78,7 @@
       "astro.config.ts",
       "tsconfig.json",
       "treeseed.site.yaml",
+      "src/api/server.js",
       "src/content.config.ts",
       "src/config.yaml",
       "src/manifest.yaml",

package/dist/workflow/operations.d.ts

@@ -45,8 +45,81 @@ type WorkflowRepoReport = {
 export declare function workflowStatus(helpers: WorkflowOperationHelpers): Promise<TreeseedWorkflowResult<import("../workflow-state.ts").TreeseedWorkflowState>>;
 export declare function workflowTasks(helpers: WorkflowOperationHelpers): Promise<TreeseedWorkflowResult<{
     tasks: TreeseedTaskBranchMetadata[];
+    workstreams: Array<{
+        id: string;
+        title: string;
+        linkedDirectRefs: Array<{
+            model: "objective" | "question" | "note";
+            id: string;
+        }>;
+        branch: string;
+        local: boolean;
+        remote: boolean;
+        current: boolean;
+        previewUrl: string | null;
+        lastSaveAt: string | null;
+        verificationResult: "ready" | "needs_attention" | "unknown";
+        stagingCandidate: boolean;
+        archived: boolean;
+    }>;
 }>>;
 export declare function workflowConfig(helpers: WorkflowOperationHelpers, input?: TreeseedConfigInput): Promise<TreeseedWorkflowResult<{
+    mode: string;
+    scopes: ("local" | "staging" | "prod")[];
+    sync: "none" | "cloudflare" | "railway" | "github" | "all" | undefined;
+    configPath: string;
+    keyPath: string;
+    repairs: unknown[];
+    preflight: {
+        ok: boolean;
+        requireAuth: boolean;
+        missingCommands: string[];
+        failingAuth: string[];
+        checks: {
+            commands: {
+                [k: string]: {
+                    installed: boolean;
+                    path: string | null;
+                };
+            };
+            auth: {};
+        };
+    };
+    toolHealth: {
+        githubCli: {
+            name: any;
+            available: any;
+            detail: any;
+        };
+        ghActExtension: {
+            name: any;
+            available: any;
+            detail: any;
+        };
+        dockerDaemon: {
+            name: any;
+            available: any;
+            detail: any;
+        };
+        wranglerCli: {
+            name: any;
+            available: any;
+            detail: any;
+        };
+        railwayCli: {
+            name: any;
+            available: any;
+            detail: any;
+        };
+        actVerificationReady: any;
+        remediation: string[];
+    };
+    market: any;
+    connection: import("../sdk-types.ts").ProjectConnection | null;
+    runnerTokenIssued: boolean;
+} & {
+    finalState?: WorkflowStatePayload;
+}> | TreeseedWorkflowResult<{
     mode: string;
     scopes: ("local" | "staging" | "prod")[];
     sync: "none" | "cloudflare" | "railway" | "github" | "all";
@@ -66,6 +139,7 @@ export declare function workflowConfig(helpers: WorkflowOperationHelpers, input?
                 ready: any;
                 detail: any;
             }[];
+            issues: any[];
         };
     }[];
     repairs: import("../operations/services/config-runtime.ts").TreeseedRepairAction[];
@@ -100,9 +174,21 @@ export declare function workflowConfig(helpers: WorkflowOperationHelpers, input?
             available: any;
             detail: any;
         };
+        wranglerCli: {
+            name: any;
+            available: any;
+            detail: any;
+        };
+        railwayCli: {
+            name: any;
+            available: any;
+            detail: any;
+        };
         actVerificationReady: any;
         remediation: string[];
     };
+    context: import("../operations/services/config-runtime.ts").TreeseedCollectedConfigContext;
+    secretSession: import("../operations/services/config-runtime.ts").TreeseedConfigSecretSessionBootstrap;
 } & {
     finalState?: WorkflowStatePayload;
 }> | TreeseedWorkflowResult<{
@@ -142,9 +228,21 @@ export declare function workflowConfig(helpers: WorkflowOperationHelpers, input?
             available: any;
             detail: any;
         };
+        wranglerCli: {
+            name: any;
+            available: any;
+            detail: any;
+        };
+        railwayCli: {
+            name: any;
+            available: any;
+            detail: any;
+        };
         actVerificationReady: any;
         remediation: string[];
     };
+    context: import("../operations/services/config-runtime.ts").TreeseedCollectedConfigContext;
+    secretSession: import("../operations/services/config-runtime.ts").TreeseedConfigSecretSessionBootstrap;
 } & {
     finalState?: WorkflowStatePayload;
 }>>;

package/dist/workflow/operations.js

@@ -9,12 +9,20 @@ import {
   checkTreeseedProviderConnections,
   collectTreeseedConfigContext,
   collectTreeseedPrintEnvReport,
+  ensureTreeseedSecretSessionForConfig,
   ensureTreeseedActVerificationTooling,
   ensureTreeseedGitignoreEntries,
   finalizeTreeseedConfig,
   getTreeseedMachineConfigPaths,
-  rotateTreeseedMachineKey
+  inspectTreeseedKeyAgentStatus,
+  loadTreeseedMachineConfig,
+  resolveTreeseedLaunchEnvironment,
+  resolveTreeseedRemoteSession,
+  rotateTreeseedMachineKey,
+  setTreeseedRemoteSession,
+  writeTreeseedMachineConfig
 } from "../operations/services/config-runtime.js";
+import { ControlPlaneClient } from "../control-plane-client.js";
 import { exportTreeseedCodebase } from "../operations/services/export-runtime.js";
 import {
   assertDeploymentInitialized,
@@ -338,7 +346,175 @@ function createTasksResult(cwd) {
       packages
     };
   });
-  return buildWorkflowResult("tasks", cwd, { tasks }, { includeFinalState: false });
+  const workstreams = tasks.map((task) => ({
+    id: task.name,
+    title: task.name.replace(/^task\//u, "").replace(/[-_]+/gu, " "),
+    linkedDirectRefs: [],
+    branch: task.name,
+    local: task.local,
+    remote: task.remote,
+    current: task.current,
+    previewUrl: task.preview.url,
+    lastSaveAt: task.lastCommitDate ?? null,
+    verificationResult: task.dirtyCurrent ? "needs_attention" : task.head ? "ready" : "unknown",
+    stagingCandidate: task.name === STAGING_BRANCH,
+    archived: false
+  }));
+  return buildWorkflowResult("tasks", cwd, { tasks, workstreams }, { includeFinalState: false });
+}
+function normalizeOptionalString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+async function connectTreeseedMarketProject(helpers, tenantRoot, input, context) {
+  const machineConfig = loadTreeseedMachineConfig(tenantRoot);
+  const marketSettings = machineConfig.settings?.market && typeof machineConfig.settings.market === "object" ? machineConfig.settings.market : {};
+  const remoteSettings = machineConfig.settings?.remote && typeof machineConfig.settings.remote === "object" ? machineConfig.settings.remote : { activeHostId: "official", executionMode: "prefer-local", hosts: [] };
+  const baseUrl = normalizeOptionalString(input.marketBaseUrl) ?? normalizeOptionalString(marketSettings.baseUrl) ?? normalizeOptionalString(remoteSettings.hosts?.find?.((entry) => entry?.official === true)?.baseUrl) ?? normalizeOptionalString(remoteSettings.hosts?.find?.((entry) => entry?.id === remoteSettings.activeHostId)?.baseUrl);
+  if (!baseUrl) {
+    workflowError(
+      "config",
+      "validation_failed",
+      "Treeseed config --connect-market requires a market base URL. Pass --market-base-url or configure an authenticated remote host first."
+    );
+  }
+  const hostId = normalizeOptionalString(marketSettings.hostId) ?? "knowledge-coop";
+  const activeRemoteSession = resolveTreeseedRemoteSession(tenantRoot, hostId) ?? resolveTreeseedRemoteSession(tenantRoot, remoteSettings.activeHostId) ?? resolveTreeseedRemoteSession(tenantRoot, "official");
+  const accessToken = normalizeOptionalString(input.marketAccessToken) ?? normalizeOptionalString(activeRemoteSession?.accessToken);
+  if (!accessToken) {
+    workflowError(
+      "config",
+      "validation_failed",
+      "Treeseed config --connect-market requires a market access token. Authenticate to the Knowledge Coop control-plane first or pass --market-access-token."
+    );
+  }
+  const projectId = normalizeOptionalString(input.marketProjectId) ?? normalizeOptionalString(marketSettings.projectId);
+  if (!projectId) {
+    workflowError(
+      "config",
+      "validation_failed",
+      "Treeseed config --connect-market requires --market-project-id or an existing settings.market.projectId value."
+    );
+  }
+  const teamId = normalizeOptionalString(input.marketTeamId) ?? normalizeOptionalString(marketSettings.teamId);
+  const projectSlug = normalizeOptionalString(input.marketProjectSlug) ?? normalizeOptionalString(marketSettings.projectSlug) ?? normalizeOptionalString(machineConfig.project?.slug) ?? projectId;
+  const teamSlug = normalizeOptionalString(input.marketTeamSlug) ?? normalizeOptionalString(marketSettings.teamSlug);
+  const projectApiBaseUrl = normalizeOptionalString(input.marketProjectApiBaseUrl) ?? normalizeOptionalString(marketSettings.projectApiBaseUrl);
+  const client = new ControlPlaneClient({
+    baseUrl,
+    accessToken
+  });
+  const connectionResult = await client.upsertProjectConnection(projectId, {
+    mode: "hybrid",
+    projectApiBaseUrl,
+    executionOwner: "project_runner",
+    metadata: {
+      pairingSource: "treeseed_config_connect_market",
+      tenantRoot,
+      tenantSlug: normalizeOptionalString(machineConfig.project?.slug),
+      repoSlug: normalizeOptionalString(machineConfig.project?.slug),
+      teamId,
+      teamSlug,
+      projectSlug,
+      connectedAt: (/* @__PURE__ */ new Date()).toISOString()
+    },
+    rotateRunnerToken: input.rotateRunnerToken === true
+  });
+  const hosts = Array.isArray(remoteSettings.hosts) ? [...remoteSettings.hosts] : [];
+  const updatedHost = {
+    id: hostId,
+    label: "Knowledge Coop",
+    baseUrl,
+    official: false
+  };
+  const existingHostIndex = hosts.findIndex(
+    (entry) => String(entry?.id ?? "") === hostId || String(entry?.baseUrl ?? "").replace(/\/+$/u, "") === baseUrl.replace(/\/+$/u, "")
+  );
+  if (existingHostIndex >= 0) {
+    hosts.splice(existingHostIndex, 1, {
+      ...hosts[existingHostIndex],
+      ...updatedHost
+    });
+  } else {
+    hosts.unshift(updatedHost);
+  }
+  if (normalizeOptionalString(input.marketAccessToken)) {
+    setTreeseedRemoteSession(tenantRoot, {
+      hostId,
+      accessToken,
+      refreshToken: activeRemoteSession?.refreshToken ?? "",
+      expiresAt: activeRemoteSession?.expiresAt ?? "",
+      principal: activeRemoteSession?.principal ?? null
+    });
+  }
+  const runnerHostId = `market-runner:${projectId}`;
+  if (connectionResult.runnerToken) {
+    setTreeseedRemoteSession(tenantRoot, {
+      hostId: runnerHostId,
+      accessToken: connectionResult.runnerToken,
+      refreshToken: "",
+      expiresAt: "",
+      principal: {
+        id: `runner:${projectId}`,
+        displayName: "Knowledge Coop Project Runner",
+        scopes: [],
+        roles: ["project_runner"],
+        permissions: [],
+        metadata: { projectId }
+      }
+    });
+  }
+  machineConfig.settings.remote = {
+    ...remoteSettings,
+    activeHostId: hostId,
+    hosts
+  };
+  machineConfig.settings.market = {
+    baseUrl,
+    hostId,
+    teamId,
+    teamSlug,
+    projectId,
+    projectSlug,
+    projectApiBaseUrl: connectionResult.connection?.projectApiBaseUrl ?? projectApiBaseUrl ?? null,
+    connectionMode: connectionResult.connection?.mode ?? "hybrid",
+    executionOwner: connectionResult.connection?.executionOwner ?? "project_runner",
+    runnerHostId,
+    runnerReady: Boolean(connectionResult.runnerToken || resolveTreeseedRemoteSession(tenantRoot, runnerHostId)?.accessToken),
+    runnerRegisteredAt: connectionResult.connection?.runnerRegisteredAt ?? null,
+    runnerLastSeenAt: connectionResult.connection?.runnerLastSeenAt ?? null,
+    launchPhase: null,
+    lastSuccessfulPhase: null,
+    githubRepository: null,
+    workflowBootstrapReady: false,
+    approvalBlockers: [],
+    connectedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  writeTreeseedMachineConfig(tenantRoot, machineConfig);
+  const { configPath, keyPath } = getTreeseedMachineConfigPaths(tenantRoot);
+  return buildWorkflowResult(
+    "config",
+    tenantRoot,
+    {
+      mode: "connect-market",
+      scopes: context.scopes,
+      sync: context.sync,
+      configPath,
+      keyPath,
+      repairs: context.repairs,
+      preflight: context.preflight,
+      toolHealth: context.toolHealth,
+      market: machineConfig.settings.market,
+      connection: connectionResult.connection,
+      runnerTokenIssued: Boolean(connectionResult.runnerToken)
+    },
+    {
+      summary: "Knowledge Coop project pairing completed.",
+      nextSteps: createNextSteps([
+        { operation: "status", reason: "Confirm the new market connection, runner health, and current workstream posture." },
+        { operation: "tasks", reason: "Inspect the branch-backed workstreams that will now sync into the Knowledge Coop UI." }
+      ])
+    }
+  );
 }
 function maybePrint(write, line, stream = "stdout") {
   if (!line) return;
@@ -846,13 +1022,27 @@ async function workflowConfig(helpers, input = {}) {
       const revealSecrets = input.showSecrets === true;
       const printEnvOnly = input.printEnvOnly === true;
       const rotateMachineKeyFlag = input.rotateMachineKey === true;
+      const connectMarketFlag = input.connectMarket === true;
+      const nonInteractive = input.nonInteractive === true;
       const repairs = input.repair === false ? [] : resolveTreeseedWorkflowState(tenantRoot).deployConfigPresent ? applyTreeseedSafeRepairs(tenantRoot) : [];
       const toolHealth = ensureTreeseedActVerificationTooling({
         tenantRoot,
-        installIfMissing: true,
+        installIfMissing: input.installMissingTooling === true,
         env: helpers.context.env,
         write: (line) => maybePrint(helpers.write, line)
       });
+      const secretSession = printEnvOnly && !revealSecrets ? {
+        status: inspectTreeseedKeyAgentStatus(tenantRoot),
+        createdWrappedKey: false,
+        migratedWrappedKey: false,
+        unlockSource: "existing-session"
+      } : await ensureTreeseedSecretSessionForConfig({
+        tenantRoot,
+        interactive: false,
+        env: helpers.context.env,
+        createIfMissing: true,
+        allowMigration: true
+      });
       ensureTreeseedGitignoreEntries(tenantRoot);
       const preflight = collectCliPreflight({ cwd: tenantRoot, requireAuth: false });
       const contextSnapshot = collectTreeseedConfigContext({
@@ -882,7 +1072,9 @@ async function workflowConfig(helpers, input = {}) {
             reports: reports2,
             repairs,
             preflight,
-            toolHealth
+            toolHealth,
+            context: contextSnapshot,
+            secretSession
           },
           {
             nextSteps: createNextSteps([
@@ -903,7 +1095,9 @@ async function workflowConfig(helpers, input = {}) {
             keyPath: result.keyPath,
             repairs,
             preflight,
-            toolHealth
+            toolHealth,
+            context: contextSnapshot,
+            secretSession
           },
           {
             nextSteps: createNextSteps([
@@ -912,12 +1106,28 @@ async function workflowConfig(helpers, input = {}) {
           }
         );
       }
+      if (connectMarketFlag) {
+        return connectTreeseedMarketProject(helpers, tenantRoot, input, {
+          scopes,
+          sync,
+          repairs,
+          preflight,
+          toolHealth
+        });
+      }
       const explicitUpdates = Array.isArray(input.updates) ? input.updates.map((update) => ({
         scope: update.scope,
         entryId: String(update.entryId ?? ""),
         value: typeof update.value === "string" ? update.value : "",
         reused: update.reused === true
       })) : null;
+      if (!explicitUpdates && !nonInteractive) {
+        workflowError(
+          "config",
+          "validation_failed",
+          "Treeseed config requires interactive input or explicit updates. Re-run in a TTY, or use --non-interactive/--json from the CLI when you want resolved values applied automatically."
+        );
+      }
       const autoUpdates = scopes.flatMap(
         (scope) => contextSnapshot.entriesByScope[scope].map((entry) => ({
           scope,
@@ -926,6 +1136,7 @@ async function workflowConfig(helpers, input = {}) {
           reused: entry.currentValue.length > 0 || entry.suggestedValue.length > 0
         }))
       );
+      maybePrint(helpers.write, "Saving resolved configuration values to machine config...");
       const applyResult = applyTreeseedConfigValues({
         tenantRoot,
         updates: explicitUpdates ?? autoUpdates
@@ -934,6 +1145,12 @@ async function workflowConfig(helpers, input = {}) {
         tenantRoot,
         scopes,
         sync,
+        env: helpers.context.env,
+        onProgress: (line) => maybePrint(helpers.write, line)
+      });
+      const refreshedContext = collectTreeseedConfigContext({
+        tenantRoot,
+        scopes,
         env: helpers.context.env
       });
       const reports = printEnv ? scopes.map((scope) => ({
@@ -960,7 +1177,8 @@ async function workflowConfig(helpers, input = {}) {
           repairs,
           preflight,
           toolHealth,
-          context: contextSnapshot,
+          secretSession,
+          context: refreshedContext,
           result: {
             ...applyResult,
             ...finalizeResult
@@ -1170,7 +1388,11 @@ async function workflowDev(helpers, input = {}) {
       if (input.port !== void 0) {
         args.push("--port", String(input.port));
       }
-      const env = { ...process.env, ...helpers.context.env ?? {} };
+      const env = resolveTreeseedLaunchEnvironment({
+        tenantRoot,
+        scope: "local",
+        baseEnv: { ...process.env, ...helpers.context.env ?? {} }
+      });
       if (input.background) {
         const child = spawn(process.execPath, args, {
           cwd: tenantRoot,