@xfey/tutti 0.1.108 → 0.1.109

package/README.md

@@ -4,6 +4,8 @@
 
 `apps/server` 是 Tutti 的项目 host service，也是机器级 Local Console 的进程入口。
 
+`0.1.109` 的 Codex skill 接入统一验证 `skills/extraRoots/set` / `skills/list` 与实际 `SKILL.md` 文件身份；Chat 的安全阶段日志可通过 invocation ref 关联外部 Reference 读取。版本发布、测试 Host 切换和飞书真人门禁分别记录于[按需资料计划](../../docs/roadmap/feishu-on-demand-reference-plan.md)，不以安装版本代替实际读取证据。
+
 它负责：
 
 - `tutti launch` 后的项目绑定、恢复和接管入口

package/dist/chat-assistant/diagnostics.d.ts

@@ -0,0 +1,17 @@
+import type { ProviderInvocationProgress } from "../providers/invocation-progress.js";
+export type ChatAssistantLogger = {
+    info: (fields: Record<string, unknown>, message: string) => void;
+    warn: (fields: Record<string, unknown>, message: string) => void;
+};
+type ChatAssistantProgress = ProviderInvocationProgress | {
+    stage: "queued" | "inspection_wait" | "model_requested" | "reply_persisted" | "failed" | "skipped";
+    reason_code?: "queue_full" | "stopping" | "context_unavailable" | "answer_failed" | "reply_failed";
+};
+export declare function createChatAssistantDiagnostics(options: {
+    logger?: ChatAssistantLogger;
+    projectId: string;
+    triggerMessageId: string;
+    scope: string;
+}): (event: ChatAssistantProgress) => void;
+export {};
+//# sourceMappingURL=diagnostics.d.ts.map

package/dist/chat-assistant/diagnostics.js

@@ -0,0 +1,27 @@
+import { createEventRef } from "@tutti/shared/ids";
+export function createChatAssistantDiagnostics(options) {
+    const requestRef = createEventRef();
+    const started = performance.now();
+    return (event) => {
+        try {
+            const fields = {
+                project_id: options.projectId,
+                chat_request_ref: requestRef,
+                trigger_message_ref: options.triggerMessageId,
+                scope: options.scope,
+                elapsed_ms: Math.round(performance.now() - started),
+                ...event,
+            };
+            if (event.stage === "failed" || event.stage === "provider_failed") {
+                options.logger?.warn(fields, "Chat assistant progress");
+            }
+            else {
+                options.logger?.info(fields, "Chat assistant progress");
+            }
+        }
+        catch {
+            /* Logging must not replace the answer or interrupt queue draining. */
+        }
+    };
+}
+//# sourceMappingURL=diagnostics.js.map

package/dist/chat-assistant/index.d.ts

@@ -1,5 +1,7 @@
 import type { ProjectId } from "@tutti/shared/ids";
 import type { MessageProjection } from "@tutti/shared/schemas/api";
+import { type ChatAssistantLogger } from "./diagnostics.js";
+import type { ProviderInvocationProgressObserver } from "../providers/invocation-progress.js";
 import { type HostProjectStore, type SqliteDatabase } from "../store/index.js";
 import type { WorkspaceEventBus } from "../server-shell/http/workspace-events.js";
 export declare const CHAT_ASSISTANT_OUTPUT_SCHEMA: {
@@ -19,6 +21,7 @@ export type ChatAssistantOutput = {
 };
 export type ChatAssistantPromptInput = {
     prompt: string;
+    onProgress?: ProviderInvocationProgressObserver;
 };
 export type ReadOnlyChatAssistantModel = {
     answer: (input: ChatAssistantPromptInput) => Promise<ChatAssistantOutput>;
@@ -35,6 +38,7 @@ export type ReadOnlyChatAssistantHandle = {
     stopAccepting: () => void;
 };
 export type ReadOnlyChatAssistantOptions = {
+    logger?: ChatAssistantLogger;
     project: {
         project_id: ProjectId;
         display_name: string;

package/dist/chat-assistant/index.js

@@ -1,3 +1,4 @@
+import { createChatAssistantDiagnostics } from "./diagnostics.js";
 import { createClarificationRoundAgentMessage, createMainChatAgentMessage, readClarificationRoundMessagesWindow, readClarificationRoundProjection, readMainChatMessageWindow, readMainChatMessagesBeforeCursor, readMessageProjectionById, } from "../collaboration-state/index.js";
 import { renderPromptTemplate } from "../prompt-templates/index.js";
 import { withHostStoreTransaction, } from "../store/index.js";
@@ -111,13 +112,21 @@ export class ReadOnlyChatAssistant {
         if (!this.accepting) {
             return { triggered: false };
         }
+        const report = createChatAssistantDiagnostics({
+            ...(this.options.logger === undefined ? {} : { logger: this.options.logger }),
+            projectId: this.options.project.project_id,
+            triggerMessageId: input.message.id,
+            scope: input.message.scope.kind,
+        });
         if (this.pending.length >= this.maxQueuedMentions) {
+            report({ stage: "failed", reason_code: "queue_full" });
             this.appendAssistantMessageForTrigger(input.message, assistantFailureMessage(), {
                 scratchpad_source: "exclude",
             });
             return { triggered: true };
         }
-        this.pending.push(input.message);
+        report({ stage: "queued" });
+        this.pending.push({ message: input.message, report });
         this.pump();
         return { triggered: true };
     }
@@ -132,7 +141,8 @@ export class ReadOnlyChatAssistant {
             return;
         }
         this.accepting = false;
-        for (const message of this.pending.splice(0)) {
+        for (const { message, report } of this.pending.splice(0)) {
+            report({ stage: "skipped", reason_code: "stopping" });
             this.appendAssistantMessageForTrigger(message, assistantFailureMessage(), {
                 scratchpad_source: "exclude",
             });
@@ -143,12 +153,14 @@ export class ReadOnlyChatAssistant {
         if (this.active !== null) {
             return;
         }
-        const message = this.pending.shift();
-        if (message === undefined) {
+        const pending = this.pending.shift();
+        if (pending === undefined) {
             this.resolveIdleIfNeeded();
             return;
         }
-        const task = this.respond(message).catch(() => undefined);
+        const task = this.respond(pending.message, pending.report).catch(() => {
+            pending.report({ stage: "failed", reason_code: "reply_failed" });
+        });
         this.active = task;
         void task.finally(() => {
             if (this.active === task) {
@@ -311,23 +323,34 @@ export class ReadOnlyChatAssistant {
         }
         this.appendMainChatAssistantMessage(triggerMessage, body, refs);
     }
-    async respond(triggerMessage) {
+    async respond(triggerMessage, report) {
+        let answer;
         try {
+            report({ stage: "inspection_wait" });
             await this.options.waitForInspectionAvailability?.();
             const prompt = this.renderPrompt(triggerMessage);
             if (prompt === null) {
+                report({ stage: "skipped", reason_code: "context_unavailable" });
                 return;
             }
+            report({ stage: "model_requested" });
             const output = await this.options.model.answer({
                 prompt,
+                onProgress: report,
             });
-            this.appendAssistantMessageForTrigger(triggerMessage, normalizeAnswer(output.answer));
+            answer = normalizeAnswer(output.answer);
         }
         catch {
+            report({ stage: "failed", reason_code: "answer_failed" });
             this.appendAssistantMessageForTrigger(triggerMessage, assistantFailureMessage(), {
                 scratchpad_source: "exclude",
             });
+            report({ stage: "reply_persisted" });
+            return;
         }
+        // Persistence/outbound-hook failure must not retry by creating a second reply.
+        this.appendAssistantMessageForTrigger(triggerMessage, answer);
+        report({ stage: "reply_persisted" });
     }
 }
 //# sourceMappingURL=index.js.map

package/dist/providers/invocation-progress.d.ts

@@ -0,0 +1,10 @@
+export type ProviderInvocationProgress = {
+    stage: "provider_queued" | "provider_started" | "context_ready" | "skills_ready" | "turn_started" | "turn_completed" | "provider_failed";
+    invocation_ref?: string;
+    skill_count?: number;
+    completed_tool_count?: number;
+    reason_code?: "provider_unavailable" | "app_server_protocol_error" | "auth_failed" | "thread_start_failed" | "turn_failed" | "turn_timeout" | "unexpected_server_request" | "skill_selection_failed" | "output_parse_failed" | "output_validation_failed" | "file_read_not_observed" | "write_detected" | "secret_leak_detected" | "process_lifecycle_failed" | "admission_unavailable";
+};
+export type ProviderInvocationProgressObserver = (event: ProviderInvocationProgress) => void;
+export declare function reportProviderInvocationProgress(observer: ProviderInvocationProgressObserver | undefined, event: ProviderInvocationProgress): void;
+//# sourceMappingURL=invocation-progress.d.ts.map

package/dist/providers/invocation-progress.js

@@ -0,0 +1,9 @@
+export function reportProviderInvocationProgress(observer, event) {
+    try {
+        observer?.(event);
+    }
+    catch {
+        /* Diagnostics cannot change the provider outcome. */
+    }
+}
+//# sourceMappingURL=invocation-progress.js.map

package/dist/providers/openai/app-server/read-only-procedure.d.ts

@@ -1,3 +1,4 @@
+import { type ProviderInvocationProgressObserver } from "../../invocation-progress.js";
 import { type CodexAppServerLifecycleIncident } from "./invocation-lifecycle.js";
 import { type CodexAppServerInvocationCoordinator, type CodexAppServerInvocationLease } from "./invocation-coordinator.js";
 import { type CodexAppServerRuntimeTelemetryOptions } from "./runtime-telemetry.js";
@@ -5,6 +6,7 @@ import { type CodexAppServerAgentContextRuntime, type CodexAppServerSkillSelecti
 import { type OpenAiTokenUsage } from "../token-usage.js";
 export type CodexAppServerWebSearchMode = "disabled" | "cached" | "live";
 export type CodexAppServerReadOnlyProcedureInput<TOutput> = {
+    onProgress?: ProviderInvocationProgressObserver;
     apiKey: string;
     apiBaseUrl?: string;
     defaultModel?: string;

package/dist/providers/openai/app-server/read-only-procedure.js

@@ -1,7 +1,9 @@
 import { execFileSync, spawn } from "node:child_process";
 import { mkdirSync, mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
+import { discoverCodexAppServerSkills } from "./skill-discovery.js";
+import { reportProviderInvocationProgress, } from "../../invocation-progress.js";
 import { buildCodexAppServerProcessPlan } from "../codex-app-server.js";
 import { DEFAULT_OPENAI_MODEL } from "../model-config.js";
 import { CodexAppServerJsonRpcClient, CodexAppServerProtocolError } from "./json-rpc.js";
@@ -113,6 +115,7 @@ function structuredOutputDetails(client, text) {
 }
 export async function runCodexAppServerReadOnlyProcedure(options) {
     if (options.invocationCoordinator !== undefined && options.invocationLease === undefined) {
+        reportProviderInvocationProgress(options.onProgress, { stage: "provider_queued" });
         let lease;
         try {
             lease = await options.invocationCoordinator.acquire();
@@ -132,6 +135,7 @@ export async function runCodexAppServerReadOnlyProcedure(options) {
             lease.release();
         }
     }
+    reportProviderInvocationProgress(options.onProgress, { stage: "provider_started" });
     let skillInputs;
     let contextRuntimeHint;
     try {
@@ -167,6 +171,13 @@ export async function runCodexAppServerReadOnlyProcedure(options) {
             options.builtInSkillsRoot ?? "",
         ]));
     }
+    if (contextRuntimeHint !== undefined)
+        reportProviderInvocationProgress(options.onProgress, {
+            stage: "context_ready",
+            ...(contextRuntimeHint.invocation_ref === undefined
+                ? {}
+                : { invocation_ref: contextRuntimeHint.invocation_ref }),
+        });
     const model = options.defaultModel ?? DEFAULT_OPENAI_MODEL;
     const tempRoot = mkdtempSync(join(tmpdir(), "tutti-codex-readonly-procedure-"));
     const codexHome = options.session?.codexHome ?? join(tempRoot, "codex-home");
@@ -223,7 +234,7 @@ export async function runCodexAppServerReadOnlyProcedure(options) {
         options.userSkillsRoot ?? "",
         options.builtInSkillsRoot ?? "",
         ...(contextRuntimeHint?.sensitiveValues ?? []),
-        ...skillInputs.map((skill) => skill.path),
+        ...skillInputs.flatMap((skill) => [skill.path, dirname(skill.path)]),
     ];
     const strictLeakCheckValues = [options.apiKey, ...(contextRuntimeHint?.sensitiveValues ?? [])];
     let primaryError;
@@ -248,6 +259,16 @@ export async function runCodexAppServerReadOnlyProcedure(options) {
         if (!isApiKeyAccount(loginResponse)) {
             throw new CodexAppServerReadOnlyProcedureError("auth_failed", "Codex app-server did not accept API key auth.");
         }
+        await discoverCodexAppServerSkills({
+            client,
+            cwd: appServerCwd,
+            skills: skillInputs,
+            requestTimeoutMs,
+        });
+        reportProviderInvocationProgress(options.onProgress, {
+            stage: "skills_ready",
+            skill_count: skillInputs.length,
+        });
         let threadId;
         if (options.session?.threadId === undefined) {
             const threadStartResponse = await client.request("thread/start", {
@@ -298,6 +319,7 @@ export async function runCodexAppServerReadOnlyProcedure(options) {
             modelProvider,
             outputSchema: options.outputSchema,
         }, requestTimeoutMs);
+        reportProviderInvocationProgress(options.onProgress, { stage: "turn_started" });
         const turnCompletedPromise = client.waitForNotification((notification) => notification.method === "turn/completed", turnTimeoutMs);
         const serverRequestPromise = client.waitForServerRequest(turnTimeoutMs);
         let completedOrRequest;
@@ -350,6 +372,10 @@ export async function runCodexAppServerReadOnlyProcedure(options) {
         const agentText = client.notifications
             .map((notification) => extractAgentText(notification))
             .join("");
+        reportProviderInvocationProgress(options.onProgress, {
+            stage: "turn_completed",
+            completed_tool_count: structuredOutputDetails(client, agentText).completed_tool_count ?? 0,
+        });
         let parsed;
         try {
             parsed = parseCodexAppServerStructuredJson(agentText);
@@ -408,6 +434,9 @@ export async function runCodexAppServerReadOnlyProcedure(options) {
         if (error instanceof CodexAppServerReadOnlyProcedureError) {
             primaryError = error;
         }
+        else if (error instanceof CodexAppServerSkillSelectionError) {
+            primaryError = new CodexAppServerReadOnlyProcedureError("skill_selection_failed", error.message);
+        }
         else if (error instanceof CodexAppServerProtocolError) {
             primaryError = new CodexAppServerReadOnlyProcedureError("app_server_protocol_error", redactWithKnownValues(error.message, sensitiveValues));
         }

package/dist/providers/openai/app-server/skill-discovery.d.ts

@@ -0,0 +1,10 @@
+import { type CodexAppServerSkillInput } from "./skills.js";
+export declare function discoverCodexAppServerSkills(options: {
+    client: {
+        request: (method: string, params: unknown, timeoutMs: number) => Promise<unknown>;
+    };
+    cwd: string;
+    skills: CodexAppServerSkillInput[];
+    requestTimeoutMs: number;
+}): Promise<void>;
+//# sourceMappingURL=skill-discovery.d.ts.map

package/dist/providers/openai/app-server/skill-discovery.js

@@ -0,0 +1,29 @@
+import { realpathSync } from "node:fs";
+import { dirname } from "node:path";
+import { isRecord } from "./runtime-helpers.js";
+import { CodexAppServerSkillSelectionError } from "./skills.js";
+// Use the pinned binary's protocol, not fields accepted only by a newer client.
+// Extra roots are process-local; each invocation owns its app-server process.
+export async function discoverCodexAppServerSkills(options) {
+    if (options.skills.length === 0)
+        return;
+    try {
+        const cwd = realpathSync(options.cwd);
+        await options.client.request("skills/extraRoots/set", { extraRoots: [...new Set(options.skills.map((skill) => dirname(skill.path)))] }, options.requestTimeoutMs);
+        const response = await options.client.request("skills/list", { cwds: [cwd], forceReload: true }, options.requestTimeoutMs);
+        const entry = isRecord(response) && Array.isArray(response.data)
+            ? response.data.find((entry) => isRecord(entry) && entry.cwd === cwd)
+            : undefined;
+        const discovered = isRecord(entry) && Array.isArray(entry.skills) ? entry.skills : [];
+        if (!options.skills.every((skill) => discovered.some((candidate) => isRecord(candidate) &&
+            candidate.name === skill.name &&
+            candidate.path === skill.path &&
+            candidate.enabled === true)))
+            throw new Error("Selected skill was not discovered");
+    }
+    catch {
+        // No discovered paths, parser errors or arbitrary RPC error bodies in diagnostics.
+        throw new CodexAppServerSkillSelectionError("skill_discovery_failed", "Codex app-server could not discover the selected skills.");
+    }
+}
+//# sourceMappingURL=skill-discovery.js.map

package/dist/providers/openai/app-server/skills.d.ts

@@ -30,27 +30,21 @@ export type CodexAppServerAgentContextTokenRequest = {
 export type CodexAppServerAgentContextToken = {
     token: string;
     expires_at?: string;
+    invocation_ref?: string;
 };
 export type CodexAppServerAgentContextRuntime = {
     baseUrl: string;
     issueToken: (input: CodexAppServerAgentContextTokenRequest) => CodexAppServerAgentContextToken;
 };
-export type CodexAppServerSkillsListWarmup = {
-    cwds: string[];
-    forceReload: true;
-    perCwdExtraUserRoots: Array<{
-        cwd: string;
-        extraUserRoots: string[];
-    }>;
-};
 export type CodexAppServerContextRuntimeHint = {
     text: string;
     sensitiveValues: string[];
     scopes: CodexAppServerContextApiScope[];
+    invocation_ref?: string;
 };
 export declare class CodexAppServerSkillSelectionError extends Error {
-    readonly code: "built_in_skill_not_found" | "built_in_skill_invalid";
-    constructor(code: "built_in_skill_not_found" | "built_in_skill_invalid", message: string);
+    readonly code: "built_in_skill_not_found" | "built_in_skill_invalid" | "skill_discovery_failed";
+    constructor(code: "built_in_skill_not_found" | "built_in_skill_invalid" | "skill_discovery_failed", message: string);
 }
 export declare const CODEX_APP_SERVER_SKILL_SELECTIONS: Record<CodexAppServerSkillSelectionName, CodexAppServerSkillSelection>;
 export declare function resolveCodexAppServerSkillSelection(selectionName: CodexAppServerSkillSelectionName): CodexAppServerSkillSelection;
@@ -60,12 +54,6 @@ export declare function resolveCodexAppServerSkillInputs(options: {
     builtInSkillsRoot?: string;
     userSkillsRoot?: string;
 }): CodexAppServerSkillInput[];
-export declare function resolveCodexAppServerSkillsListWarmup(options: {
-    cwd: string;
-    selectionName?: CodexAppServerSkillSelectionName;
-    selection?: CodexAppServerSkillSelection;
-    userSkillsRoot?: string;
-}): CodexAppServerSkillsListWarmup | undefined;
 export declare function buildCodexAppServerTurnInput(options: {
     prompt: string;
     skills?: CodexAppServerSkillInput[];

package/dist/providers/openai/app-server/skills.js

@@ -1,4 +1,4 @@
-import { existsSync, statSync } from "node:fs";
+import { existsSync, realpathSync, statSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { listUserSkills } from "../../../skills/index.js";
@@ -121,12 +121,12 @@ function resolveBuiltInSkill(options) {
     if (!statSync(skillMdPath).isFile()) {
         throw new CodexAppServerSkillSelectionError("built_in_skill_invalid", `Built-in skill is invalid: ${options.name}`);
     }
-    return { name: options.name, path };
+    return { name: options.name, path: realpathSync(skillMdPath) };
 }
 function resolveUserSkill(options) {
     return {
         name: options.name,
-        path: join(options.userSkillsRoot, options.name),
+        path: realpathSync(join(options.userSkillsRoot, options.name, "SKILL.md")),
     };
 }
 export function resolveCodexAppServerSkillSelection(selectionName) {
@@ -149,32 +149,6 @@ export function resolveCodexAppServerSkillInputs(options) {
         : [];
     return [...builtInSkills, ...userSkills];
 }
-export function resolveCodexAppServerSkillsListWarmup(options) {
-    const selection = options.selection ??
-        (options.selectionName === undefined
-            ? {
-                builtInSkillNames: [],
-                userSkillMode: "disabled",
-                contextApiScopes: [],
-            }
-            : resolveCodexAppServerSkillSelection(options.selectionName));
-    if (selection.userSkillMode !== "all_enabled" || options.userSkillsRoot === undefined) {
-        return undefined;
-    }
-    if (listUserSkills(options.userSkillsRoot).length === 0) {
-        return undefined;
-    }
-    return {
-        cwds: [options.cwd],
-        forceReload: true,
-        perCwdExtraUserRoots: [
-            {
-                cwd: options.cwd,
-                extraUserRoots: [options.userSkillsRoot],
-            },
-        ],
-    };
-}
 function createTextInputItem(text) {
     return {
         type: "text",
@@ -228,6 +202,7 @@ export function resolveCodexAppServerContextRuntimeHint(options) {
         }),
         sensitiveValues: [issued.token, options.agentContext.baseUrl],
         scopes: selection.contextApiScopes,
+        ...(issued.invocation_ref === undefined ? {} : { invocation_ref: issued.invocation_ref }),
     };
 }
 //# sourceMappingURL=skills.js.map

package/dist/providers/openai/app-server/workspace-write-run.js

@@ -1,7 +1,8 @@
 import { spawn } from "node:child_process";
 import { mkdirSync, mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
+import { discoverCodexAppServerSkills } from "./skill-discovery.js";
 import { buildCodexAppServerProcessPlan } from "../codex-app-server.js";
 import { DEFAULT_OPENAI_MODEL } from "../model-config.js";
 import { CodexAppServerJsonRpcClient, CodexAppServerProtocolError, } from "./json-rpc.js";
@@ -10,7 +11,7 @@ import { CodexAppServerAdmissionError, } from "./invocation-coordinator.js";
 import { createCodexAppServerRuntimeObserver, } from "./runtime-telemetry.js";
 import { createReadOnlySandboxPolicy, createWorkspaceWriteSandboxPolicy, } from "./sandbox-policy.js";
 import { buildCodexAppServerProviderConfigOverrides, resolveCodexAppServerModelProvider, } from "./provider-config.js";
-import { buildCodexAppServerTurnInput, resolveCodexAppServerContextRuntimeHint, resolveCodexAppServerSkillsListWarmup, resolveCodexAppServerSkillInputs, CodexAppServerSkillSelectionError, } from "./skills.js";
+import { buildCodexAppServerTurnInput, resolveCodexAppServerContextRuntimeHint, resolveCodexAppServerSkillInputs, CodexAppServerSkillSelectionError, } from "./skills.js";
 import { compactText, containsKnownSecret, createCodexSpawnEnv, extractAgentText, extractServerRequestMethod, findJsonObjectCandidates, isApiKeyAccount, readThreadId, readTurnError, readTurnStatus, redactWithKnownValues, } from "./runtime-helpers.js";
 import { extractCodexAppServerTokenUsage } from "../token-usage.js";
 const DEFAULT_REQUEST_TIMEOUT_MS = 60_000;
@@ -170,7 +171,6 @@ export async function runCodexAppServerWorkspaceWriteRun(options) {
         }
     }
     let skillInputs;
-    let skillsListWarmup;
     let contextRuntimeHint;
     try {
         skillInputs = resolveCodexAppServerSkillInputs({
@@ -182,13 +182,6 @@ export async function runCodexAppServerWorkspaceWriteRun(options) {
                 ? {}
                 : { builtInSkillsRoot: options.builtInSkillsRoot }),
         });
-        skillsListWarmup = resolveCodexAppServerSkillsListWarmup({
-            cwd: options.workspaceRoot,
-            ...(options.skillSelectionName === undefined
-                ? {}
-                : { selectionName: options.skillSelectionName }),
-            ...(options.userSkillsRoot === undefined ? {} : { userSkillsRoot: options.userSkillsRoot }),
-        });
         contextRuntimeHint = resolveCodexAppServerContextRuntimeHint({
             ...(options.approvalContext?.activityRef === undefined
                 ? {}
@@ -267,11 +260,7 @@ export async function runCodexAppServerWorkspaceWriteRun(options) {
         options.userSkillsRoot ?? "",
         options.builtInSkillsRoot ?? "",
         ...(contextRuntimeHint?.sensitiveValues ?? []),
-        ...skillInputs.map((skill) => skill.path),
-        ...(skillsListWarmup?.perCwdExtraUserRoots.flatMap((entry) => [
-            entry.cwd,
-            ...entry.extraUserRoots,
-        ]) ?? []),
+        ...skillInputs.flatMap((skill) => [skill.path, dirname(skill.path)]),
     ];
     const strictLeakCheckValues = [options.apiKey, ...(contextRuntimeHint?.sensitiveValues ?? [])];
     let primaryError;
@@ -297,9 +286,12 @@ export async function runCodexAppServerWorkspaceWriteRun(options) {
         if (!isApiKeyAccount(loginResponse)) {
             throw new CodexAppServerWorkspaceWriteRunError("auth_failed", "Codex app-server did not accept API key auth.");
         }
-        if (skillsListWarmup !== undefined) {
-            await client.request("skills/list", skillsListWarmup, requestTimeoutMs);
-        }
+        await discoverCodexAppServerSkills({
+            client,
+            cwd: options.workspaceRoot,
+            skills: skillInputs,
+            requestTimeoutMs,
+        });
         let threadId;
         if (options.session?.threadId === undefined) {
             const threadStartResponse = await client.request("thread/start", {
@@ -484,7 +476,9 @@ export async function runCodexAppServerWorkspaceWriteRun(options) {
         }
         else {
             const message = error instanceof Error ? error.message : String(error);
-            primaryError = new CodexAppServerWorkspaceWriteRunError("app_server_protocol_error", redactWithKnownValues(message, sensitiveValues), { turn_start_state: turnStartState });
+            primaryError = new CodexAppServerWorkspaceWriteRunError(error instanceof CodexAppServerSkillSelectionError
+                ? "skill_selection_failed"
+                : "app_server_protocol_error", redactWithKnownValues(message, sensitiveValues), { turn_start_state: turnStartState });
         }
     }
     finally {

package/dist/providers/openai/chat-assistant.js

@@ -1,12 +1,14 @@
 import { CHAT_ASSISTANT_OUTPUT_SCHEMA, isChatAssistantOutput, } from "../../chat-assistant/index.js";
 import { readOpenAiApiKeyCredential } from "./credential-store.js";
-import { resolveOpenAiProviderConfig, } from "./provider-config.js";
-import { runCodexAppServerReadOnlyProcedure } from "./app-server/read-only-procedure.js";
+import { resolveOpenAiProviderConfig } from "./provider-config.js";
+import { CodexAppServerReadOnlyProcedureError, runCodexAppServerReadOnlyProcedure, } from "./app-server/read-only-procedure.js";
+import { reportProviderInvocationProgress } from "../invocation-progress.js";
 import { getProjectUserSkillsRoot } from "../../skills/index.js";
 export function createOpenAiReadOnlyChatAssistantModel(options) {
     return {
         async answer(input) {
             const result = await runCodexAppServerReadOnlyProcedure({
+                ...(input.onProgress === undefined ? {} : { onProgress: input.onProgress }),
                 apiKey: options.apiKey,
                 workspaceRoot: options.workspaceRoot,
                 prompt: input.prompt,
@@ -37,6 +39,14 @@ export function createOpenAiReadOnlyChatAssistantModel(options) {
                 ...(options.onLifecycleIncident === undefined
                     ? {}
                     : { onLifecycleIncident: options.onLifecycleIncident }),
+            }).catch((error) => {
+                reportProviderInvocationProgress(input.onProgress, {
+                    stage: "provider_failed",
+                    reason_code: error instanceof CodexAppServerReadOnlyProcedureError
+                        ? error.code
+                        : "provider_unavailable",
+                });
+                throw error;
             });
             if (options.recordUsage !== undefined && result.usage !== undefined) {
                 options.recordUsage({

package/dist/server-shell/cli/host-server-runtime.js

@@ -137,6 +137,7 @@ function createAgentContextRuntime(options) {
             return {
                 token: token.token,
                 expires_at: token.expires_at,
+                invocation_ref: token.reference_invocation_ref,
             };
         },
     };
@@ -419,6 +420,7 @@ export async function startForegroundHostServer(options) {
         }),
     });
     const chatAssistant = new ReadOnlyChatAssistant({
+        logger: createHostRuntimeLogger({ component: "chat-assistant", logFilePath, now }),
         project: chatAssistantProject,
         store,
         events: workspaceEvents,

package/dist/server-shell/http/routes/agent-context-external-reference-routes.js

@@ -16,20 +16,43 @@ export function registerAgentContextExternalReferenceRoutes(app, options) {
         }, async (request, reply) => {
             reply.header("cache-control", "no-store");
             const invocation = authorizeAgentContextRequest(request, options, "references:external");
+            const started = performance.now();
+            const diagnosticFields = {
+                action,
+                invocation_ref: invocation.reference_invocation_ref,
+                activity_ref: invocation.activity_ref,
+            };
+            request.log.info({ ...diagnosticFields, stage: "external_reference_request" }, "External Reference request started");
             const service = options.externalReferences;
-            if (!service)
+            if (!service) {
+                request.log.info({
+                    ...diagnosticFields,
+                    stage: "external_reference_unavailable",
+                    reason_code: "external_references_not_enabled",
+                }, "External Reference service unavailable");
                 return { kind: "unavailable", reason: "external_references_not_enabled" };
+            }
             const sourceRef = request.query.source_ref;
             if (action === "read" &&
                 (sourceRef === undefined || !/^external_ref_[a-f0-9]{32}$/u.test(sourceRef)))
                 return { kind: "unavailable", reason: "reference_source_invalid" };
             try {
-                if (action === "list")
-                    return { items: await service.list(invocation) };
+                if (action === "list") {
+                    const items = await service.list(invocation);
+                    request.log.info({
+                        ...diagnosticFields,
+                        stage: "external_reference_list",
+                        source_count: items.length,
+                        elapsed_ms: Math.round(performance.now() - started),
+                    }, "External Reference sources listed");
+                    return { items };
+                }
                 const result = await service.read(invocation, sourceRef);
                 const { copy } = result;
                 request.log.info({
                     stage: "external_reference_read",
+                    action,
+                    elapsed_ms: Math.round(performance.now() - started),
                     invocation_ref: invocation.reference_invocation_ref,
                     activity_ref: invocation.activity_ref,
                     source_ref: copy.source_ref,
@@ -70,7 +93,9 @@ export function registerAgentContextExternalReferenceRoutes(app, options) {
                             ? "reference_cache_unsafe"
                             : "reference_read_unavailable";
                 request.log.warn({
-                    stage: "external_reference_read",
+                    stage: "external_reference_unavailable",
+                    action,
+                    elapsed_ms: Math.round(performance.now() - started),
                     invocation_ref: invocation.reference_invocation_ref,
                     activity_ref: invocation.activity_ref,
                     ...(sourceRef === undefined ? {} : { source_ref: sourceRef }),

package/dist/server-shell/http/static-web.js

@@ -3,18 +3,19 @@ import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import fastifyStatic from "@fastify/static";
 const BLOCKED_SPA_FALLBACK_PREFIXES = [
-    "/api/",
+    "/api",
     "/health",
-    "/host-local/",
-    "/local-console/",
-    "/assets/",
+    "/host-local",
+    "/local-console",
+    "/assets",
+    "/internal",
 ];
 function requestPath(request) {
     const queryIndex = request.url.indexOf("?");
     return queryIndex === -1 ? request.url : request.url.slice(0, queryIndex);
 }
 function shouldServeSpaFallback(path) {
-    return !BLOCKED_SPA_FALLBACK_PREFIXES.some((prefix) => path === prefix || path.startsWith(prefix));
+    return !BLOCKED_SPA_FALLBACK_PREFIXES.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
 }
 function sendIndex(reply, indexHtml) {
     void reply
@@ -39,7 +40,10 @@ export function registerHostWebStaticRoutes(app, options) {
     });
     app.get("/*", (request, reply) => {
         if (!shouldServeSpaFallback(requestPath(request))) {
-            void reply.status(404).send({
+            void reply
+                .header("cache-control", "no-store")
+                .status(404)
+                .send({
                 error: {
                     code: "not_found",
                     message: "Route was not found",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xfey/tutti",
-  "version": "0.1.108",
+  "version": "0.1.109",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",