@xfey/tutti 0.1.118 → 0.1.120

package/dist/approvals/decision-command.d.ts

@@ -24,9 +24,9 @@ export declare function executeApprovalDecisionCommand(input: {
     } | {
         state: "pending";
         request: {
+            expires_at?: string;
             task_id?: string;
             activity_ref?: string;
-            expires_at?: string;
             reason?: string;
             file_change?: {
                 paths?: string[];
@@ -68,9 +68,9 @@ export declare function executeApprovalDecisionCommand(input: {
     } | {
         state: "resolved";
         request: {
+            expires_at?: string;
             task_id?: string;
             activity_ref?: string;
-            expires_at?: string;
             reason?: string;
             file_change?: {
                 paths?: string[];

package/dist/collaboration-state/clarification-snapshot.d.ts

@@ -26,9 +26,6 @@ export declare function readSubmittedClarificationMessages(db: SqliteDatabase, r
                 target: {
                     fallback_context?: {
                         snapshot: {
-                            role?: string;
-                            accessible_name?: string;
-                            text_excerpt?: string;
                             state?: {
                                 expanded?: boolean;
                                 selected?: boolean;
@@ -36,6 +33,9 @@ export declare function readSubmittedClarificationMessages(db: SqliteDatabase, r
                                 pressed?: boolean;
                                 disabled?: boolean;
                             };
+                            role?: string;
+                            accessible_name?: string;
+                            text_excerpt?: string;
                             tag_name: string;
                             element_kind: "content" | "control" | "container";
                             context: {
@@ -62,9 +62,6 @@ export declare function readSubmittedClarificationMessages(db: SqliteDatabase, r
                         };
                     };
                     snapshot: {
-                        role?: string;
-                        accessible_name?: string;
-                        text_excerpt?: string;
                         state?: {
                             expanded?: boolean;
                             selected?: boolean;
@@ -72,6 +69,9 @@ export declare function readSubmittedClarificationMessages(db: SqliteDatabase, r
                             pressed?: boolean;
                             disabled?: boolean;
                         };
+                        role?: string;
+                        accessible_name?: string;
+                        text_excerpt?: string;
                         tag_name: string;
                         element_kind: "content" | "control" | "container";
                         context: {
@@ -144,7 +144,7 @@ export declare function readSubmittedClarificationMessages(db: SqliteDatabase, r
             title: string;
             workflow_ref: string;
             tasks: {
-                status: "failed" | "done" | "pending" | "todo" | "running";
+                status: "failed" | "pending" | "done" | "todo" | "running";
                 task_id: string;
                 title: string;
                 summary: string;
@@ -162,9 +162,9 @@ export declare function readSubmittedClarificationMessages(db: SqliteDatabase, r
         };
         reply_context?: {
             status: "resolved";
+            truncated: boolean;
             role: "human" | "system" | "tutti" | "operator";
             message_id: string;
-            truncated: boolean;
             text: string;
             external_reference_sources: string[];
         } | {
@@ -210,6 +210,7 @@ export declare function readSubmittedClarificationMessages(db: SqliteDatabase, r
             feedback_key: string;
         };
     };
+    created_at: string;
     scope: {
         kind: "main_chat";
     } | {
@@ -233,7 +234,6 @@ export declare function readSubmittedClarificationMessages(db: SqliteDatabase, r
         kind: "human" | "system" | "agent";
     };
     body: string;
-    created_at: string;
     message_kind: "user_text" | "agent_text" | "system_notice" | "clarification_request" | "clarification_card";
 }[];
 //# sourceMappingURL=clarification-snapshot.d.ts.map

package/dist/collaboration-state/task-compile-context.d.ts

@@ -24,7 +24,7 @@ export declare function completeTaskCompileContext(db: SqliteDatabase, input: Co
     task_changes: string[];
     receipts: {
         compiled_tasks?: {
-            status: "failed" | "done" | "pending" | "todo" | "running";
+            status: "failed" | "pending" | "done" | "todo" | "running";
             task_id: string;
             title: string;
             summary: string;

package/dist/control-plane/workflows/openai.d.ts

@@ -1,18 +1,17 @@
 import type { ProjectId } from "@tutti/shared/ids";
 import type { ProviderUsageRecorder } from "../../provider-usage/index.js";
 import { type OpenAiStructuredOutputClient } from "../../providers/openai/sdk-procedure-runner.js";
-import { type OpenAiProviderConfig } from "../../providers/openai/provider-config.js";
+import { type OpenAiCredentialAccess, type OpenAiExecutionConfig } from "../../providers/openai/execution-access.js";
 import type { ProcedureWorkflowRunner, ProcedureWorkflowRunnerResolution, TaskCompilePromptInput, TaskCompileWorkflowInput } from "./types.js";
 import type { CodexAppServerAgentContextRuntime } from "../../providers/openai/app-server/skills.js";
 import type { CodexAppServerInvocationCoordinator } from "../../providers/openai/app-server/invocation-coordinator.js";
 import type { CodexAppServerLifecycleIncident } from "../../providers/openai/app-server/invocation-lifecycle.js";
 export type OpenAiProcedureWorkflowRunnerOptions = {
-    config: OpenAiProviderConfig;
+    config: OpenAiExecutionConfig;
     client: OpenAiStructuredOutputClient;
     recordUsage?: ProviderUsageRecorder;
     promptsRoot?: string;
-    readOnlyAppServer?: {
-        apiKey: string;
+    readOnlyAppServer?: OpenAiCredentialAccess & {
         workspaceRoot: string;
         codexCommand?: string;
         requestTimeoutMs?: number;

package/dist/control-plane/workflows/openai.js

@@ -6,7 +6,8 @@ import { clarificationAnswerRole } from "@tutti/shared/utils";
 import { renderPromptTemplate } from "../../prompt-templates/index.js";
 import { createOpenAiStructuredOutputClient, runOpenAiStructuredOutput, } from "../../providers/openai/sdk-procedure-runner.js";
 import { readOpenAiApiKeyCredential } from "../../providers/openai/credential-store.js";
-import { resolveOpenAiProviderConfig, } from "../../providers/openai/provider-config.js";
+import { resolveOpenAiProviderConfig } from "../../providers/openai/provider-config.js";
+import { openAiCredentialAccess, } from "../../providers/openai/execution-access.js";
 import { SCRATCHPAD_REFRESH_OUTPUT_SCHEMA, TASK_COMPILE_OUTPUT_SCHEMA, PROJECT_CONTEXT_BOOTSTRAP_OUTPUT_SCHEMA, CONTEXT_SYNC_OUTPUT_SCHEMA, PROJECT_BRIEF_REFRESH_OUTPUT_SCHEMA, FOLLOW_UP_CHECK_OUTPUT_SCHEMA, REFERENCE_FILE_SUMMARY_OUTPUT_SCHEMA, isContextSyncWorkflowOutput, isFollowUpCheckStructuredOutput, isProjectBriefRefreshWorkflowOutput, isProjectContextBootstrapWorkflowOutput, isReferenceFileSummaryStructuredOutput, isScratchpadRefreshStructuredOutput, isTaskCompileStructuredOutput, } from "./structured-output.js";
 import { runCodexAppServerReadOnlyProcedure, } from "../../providers/openai/app-server/read-only-procedure.js";
 import { CODEX_APP_SERVER_VERSION } from "../../providers/openai/codex-app-server.js";
@@ -17,7 +18,7 @@ function readOnlyAppServerOptions(options, prompt, outputSchema, skillSelectionN
         throw new Error("Codex app-server read-only Procedure adapter is not configured");
     }
     return {
-        apiKey: options.readOnlyAppServer.apiKey,
+        ...openAiCredentialAccess(options.readOnlyAppServer),
         workspaceRoot: options.readOnlyAppServer.workspaceRoot,
         prompt,
         outputSchema,

package/dist/providers/openai/app-server/invocation-coordinator.d.ts

@@ -1,4 +1,5 @@
 export type CodexAppServerInvocationLease = {
+    isClosing?: () => boolean;
     setCloser: (closer: () => Promise<unknown>) => void;
     release: () => void;
 };

package/dist/providers/openai/app-server/invocation-coordinator.js

@@ -48,6 +48,8 @@ export class CodexAppServerInvocationCoordinator {
     }
     async closeActive() {
         const active = this.active;
+        if (active !== null)
+            active.closing = true;
         if (active?.closer !== undefined) {
             await active.closer();
         }
@@ -59,9 +61,10 @@ export class CodexAppServerInvocationCoordinator {
         return new Promise((resolve) => this.idleWaiters.add(resolve));
     }
     activate() {
-        const admission = { released: false };
+        const admission = { released: false, closing: false };
         this.active = admission;
         return {
+            isClosing: () => admission.closing || admission.released,
             setCloser: (closer) => {
                 if (!admission.released) {
                     admission.closer = closer;

package/dist/providers/openai/app-server/invocation-deadline.d.ts

@@ -0,0 +1,3 @@
+import type { CodexAppServerInvocation } from "./invocation-lifecycle.js";
+export declare function armInvocationDeadline(invocation: CodexAppServerInvocation, deadline: number | undefined): () => void;
+//# sourceMappingURL=invocation-deadline.d.ts.map

package/dist/providers/openai/app-server/invocation-deadline.js

@@ -0,0 +1,15 @@
+// Managed access has an overall deadline in addition to per-RPC and per-turn
+// timeouts. Close the actual process tree; do not abandon a Promise that can keep
+// writing after its model credential lease has been returned.
+export function armInvocationDeadline(invocation, deadline) {
+    if (deadline === undefined)
+        return () => { };
+    const timer = setTimeout(() => {
+        void invocation.close().catch(() => {
+            // The adapter's finally awaits the same close and records lifecycle failure.
+        });
+    }, Math.max(1, deadline - Date.now()));
+    timer.unref();
+    return () => clearTimeout(timer);
+}
+//# sourceMappingURL=invocation-deadline.js.map

package/dist/providers/openai/app-server/read-only-procedure.d.ts

@@ -1,3 +1,4 @@
+import { type OpenAiCredentialAccess } from "../execution-access.js";
 import { type ProviderInvocationProgressObserver } from "../../invocation-progress.js";
 import { type CodexAppServerLifecycleIncident } from "./invocation-lifecycle.js";
 import { type CodexAppServerInvocationCoordinator, type CodexAppServerInvocationLease } from "./invocation-coordinator.js";
@@ -5,9 +6,8 @@ import { type CodexAppServerRuntimeTelemetryOptions } from "./runtime-telemetry.
 import { type CodexAppServerAgentContextRuntime, type CodexAppServerSkillSelectionName } from "./skills.js";
 import { type OpenAiTokenUsage } from "../token-usage.js";
 export type CodexAppServerWebSearchMode = "disabled" | "cached" | "live";
-export type CodexAppServerReadOnlyProcedureInput<TOutput> = {
+export type CodexAppServerReadOnlyProcedureInput<TOutput> = OpenAiCredentialAccess & {
     onProgress?: ProviderInvocationProgressObserver;
-    apiKey: string;
     apiBaseUrl?: string;
     defaultModel?: string;
     workspaceRoot: string;
@@ -44,6 +44,8 @@ export type CodexAppServerReadOnlyProcedureInput<TOutput> = {
     invocationCoordinator?: CodexAppServerInvocationCoordinator;
     /** @internal Set only by the coordinator wrapper. */
     invocationLease?: CodexAppServerInvocationLease;
+    /** @internal Overall deadline supplied by the managed credential wrapper. */
+    invocationDeadline?: number;
 };
 export type CodexAppServerReadOnlyProcedureResult<TOutput> = {
     output: TOutput;

package/dist/providers/openai/app-server/read-only-procedure.js

@@ -3,6 +3,8 @@ import { mkdirSync, mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { discoverCodexAppServerSkills } from "./skill-discovery.js";
+import { managedInvocationBudget } from "../execution-access.js";
+import { armInvocationDeadline } from "./invocation-deadline.js";
 import { reportProviderInvocationProgress, } from "../../invocation-progress.js";
 import { buildCodexAppServerProcessPlan } from "../codex-app-server.js";
 import { DEFAULT_OPENAI_MODEL } from "../model-config.js";
@@ -135,6 +137,18 @@ export async function runCodexAppServerReadOnlyProcedure(options) {
             lease.release();
         }
     }
+    if (options.invocationLease?.isClosing?.()) {
+        throw new CodexAppServerReadOnlyProcedureError("admission_unavailable", "Codex app-server admission is closed.");
+    }
+    if (options.credentialLease !== undefined) {
+        const { credentialLease, ...invocation } = options;
+        const budget = managedInvocationBudget(options.turnTimeoutMs ?? DEFAULT_TURN_TIMEOUT_MS);
+        return credentialLease(budget, (apiKey) => runCodexAppServerReadOnlyProcedure({
+            ...invocation,
+            apiKey,
+            invocationDeadline: Date.now() + budget,
+        }));
+    }
     reportProviderInvocationProgress(options.onProgress, { stage: "provider_started" });
     let skillInputs;
     let contextRuntimeHint;
@@ -223,6 +237,7 @@ export async function runCodexAppServerReadOnlyProcedure(options) {
             : { onIncident: options.onLifecycleIncident }),
     });
     options.invocationLease?.setCloser(() => invocation.close());
+    const disarmDeadline = armInvocationDeadline(invocation, options.invocationDeadline);
     const sensitiveValues = [
         options.apiKey,
         tempRoot,
@@ -446,6 +461,7 @@ export async function runCodexAppServerReadOnlyProcedure(options) {
         }
     }
     finally {
+        disarmDeadline();
         runtimeObserver?.flush();
         try {
             await invocation.close();

package/dist/providers/openai/app-server/workspace-write-run.d.ts

@@ -1,4 +1,5 @@
 import type { ActivityRef, TaskId } from "@tutti/shared/ids";
+import { type OpenAiCredentialAccess } from "../execution-access.js";
 import type { CodexAppServerApprovalPolicy } from "../codex-app-server.js";
 import { type CodexAppServerJsonRpcError, type CodexAppServerJsonRpcServerRequest } from "./json-rpc.js";
 import { type CodexAppServerLifecycleIncident } from "./invocation-lifecycle.js";
@@ -27,8 +28,7 @@ export type CodexAppServerApprovalHandler = (input: {
         sensitiveValues: readonly string[];
     };
 }) => Promise<CodexAppServerApprovalResponse>;
-export type CodexAppServerWorkspaceWriteRunInput<TOutput> = {
-    apiKey: string;
+export type CodexAppServerWorkspaceWriteRunInput<TOutput> = OpenAiCredentialAccess & {
     apiBaseUrl?: string;
     defaultModel?: string;
     workspaceRoot: string;
@@ -70,6 +70,8 @@ export type CodexAppServerWorkspaceWriteRunInput<TOutput> = {
     invocationCoordinator?: CodexAppServerInvocationCoordinator;
     /** @internal Set only by the coordinator wrapper. */
     invocationLease?: CodexAppServerInvocationLease;
+    /** @internal Overall deadline supplied by the managed credential wrapper. */
+    invocationDeadline?: number;
 };
 export type CodexAppServerWorkspaceWriteRunResult<TOutput> = {
     output: TOutput;

package/dist/providers/openai/app-server/workspace-write-run.js

@@ -3,6 +3,8 @@ import { mkdirSync, mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { discoverCodexAppServerSkills } from "./skill-discovery.js";
+import { managedInvocationBudget } from "../execution-access.js";
+import { armInvocationDeadline } from "./invocation-deadline.js";
 import { buildCodexAppServerProcessPlan } from "../codex-app-server.js";
 import { DEFAULT_OPENAI_MODEL } from "../model-config.js";
 import { CodexAppServerJsonRpcClient, CodexAppServerProtocolError, } from "./json-rpc.js";
@@ -170,6 +172,18 @@ export async function runCodexAppServerWorkspaceWriteRun(options) {
             lease.release();
         }
     }
+    if (options.invocationLease?.isClosing?.()) {
+        throw new CodexAppServerWorkspaceWriteRunError("admission_unavailable", "Codex app-server admission is closed.");
+    }
+    if (options.credentialLease !== undefined) {
+        const { credentialLease, ...invocation } = options;
+        const budget = managedInvocationBudget(options.turnTimeoutMs ?? DEFAULT_TURN_TIMEOUT_MS);
+        return credentialLease(budget, (apiKey) => runCodexAppServerWorkspaceWriteRun({
+            ...invocation,
+            apiKey,
+            invocationDeadline: Date.now() + budget,
+        }));
+    }
     let skillInputs;
     let contextRuntimeHint;
     try {
@@ -251,6 +265,7 @@ export async function runCodexAppServerWorkspaceWriteRun(options) {
             : { onIncident: options.onLifecycleIncident }),
     });
     options.invocationLease?.setCloser(() => invocation.close());
+    const disarmDeadline = armInvocationDeadline(invocation, options.invocationDeadline);
     const sensitiveValues = [
         options.apiKey,
         tempRoot,
@@ -482,6 +497,7 @@ export async function runCodexAppServerWorkspaceWriteRun(options) {
         }
     }
     finally {
+        disarmDeadline();
         runtimeObserver?.flush();
         try {
             await invocation.close();

package/dist/providers/openai/chat-assistant.d.ts

@@ -1,13 +1,12 @@
 import type { ProjectId } from "@tutti/shared/ids";
 import { type ReadOnlyChatAssistantModel } from "../../chat-assistant/index.js";
-import { type OpenAiProviderConfig } from "./provider-config.js";
+import { type OpenAiCredentialAccess, type OpenAiExecutionConfig } from "./execution-access.js";
 import type { CodexAppServerAgentContextRuntime } from "./app-server/skills.js";
 import type { CodexAppServerInvocationCoordinator } from "./app-server/invocation-coordinator.js";
 import type { CodexAppServerLifecycleIncident } from "./app-server/invocation-lifecycle.js";
 import type { ProviderUsageRecorder } from "../../provider-usage/index.js";
-export type OpenAiReadOnlyChatAssistantModelOptions = {
-    config: OpenAiProviderConfig;
-    apiKey: string;
+export type OpenAiReadOnlyChatAssistantModelOptions = OpenAiCredentialAccess & {
+    config: OpenAiExecutionConfig;
     workspaceRoot: string;
     tuttiHome?: string;
     userSkillsRoot?: string;

package/dist/providers/openai/chat-assistant.js

@@ -1,6 +1,7 @@
 import { CHAT_ASSISTANT_OUTPUT_SCHEMA, isChatAssistantOutput, } from "../../chat-assistant/index.js";
 import { readOpenAiApiKeyCredential } from "./credential-store.js";
 import { resolveOpenAiProviderConfig } from "./provider-config.js";
+import { openAiCredentialAccess, } from "./execution-access.js";
 import { CodexAppServerReadOnlyProcedureError, runCodexAppServerReadOnlyProcedure, } from "./app-server/read-only-procedure.js";
 import { reportProviderInvocationProgress } from "../invocation-progress.js";
 import { getProjectUserSkillsRoot } from "../../skills/index.js";
@@ -9,7 +10,7 @@ export function createOpenAiReadOnlyChatAssistantModel(options) {
         async answer(input) {
             const result = await runCodexAppServerReadOnlyProcedure({
                 ...(input.onProgress === undefined ? {} : { onProgress: input.onProgress }),
-                apiKey: options.apiKey,
+                ...openAiCredentialAccess(options),
                 workspaceRoot: options.workspaceRoot,
                 prompt: input.prompt,
                 outputSchema: CHAT_ASSISTANT_OUTPUT_SCHEMA,

package/dist/providers/openai/execution-access.d.ts

@@ -0,0 +1,17 @@
+export type OpenAiExecutionConfig = {
+    default_model: string;
+    api_base_url?: string;
+    organization_id?: string;
+    openai_project_id?: string;
+};
+export type OpenAiCredentialLease = <T>(maximumDurationMs: number, invoke: (apiKey: string) => Promise<T>) => Promise<T>;
+export type OpenAiCredentialAccess = {
+    apiKey: string;
+    credentialLease?: never;
+} | {
+    apiKey?: never;
+    credentialLease: OpenAiCredentialLease;
+};
+export declare function openAiCredentialAccess(access: OpenAiCredentialAccess): OpenAiCredentialAccess;
+export declare function managedInvocationBudget(turnTimeoutMs: number): number;
+//# sourceMappingURL=execution-access.d.ts.map

package/dist/providers/openai/execution-access.js

@@ -0,0 +1,13 @@
+export function openAiCredentialAccess(access) {
+    return access.credentialLease === undefined
+        ? { apiKey: access.apiKey }
+        : { credentialLease: access.credentialLease };
+}
+// A bounded allowance for login/discovery/archive in addition to the business turn.
+// The adapter also installs a wall-clock deadline that closes the process tree.
+export function managedInvocationBudget(turnTimeoutMs) {
+    if (!Number.isSafeInteger(turnTimeoutMs) || turnTimeoutMs < 1 || turnTimeoutMs > 1_200_000)
+        throw new Error("managed_invocation_timeout_invalid");
+    return turnTimeoutMs + 120_000;
+}
+//# sourceMappingURL=execution-access.js.map

package/dist/providers/openai/sdk-procedure-runner.d.ts

@@ -1,3 +1,4 @@
+import type { OpenAiCredentialAccess } from "./execution-access.js";
 import { type OpenAiCredentialValidationDiagnostic, type OpenAiCredentialValidationFailureReason } from "./credential-validation.js";
 import { type OpenAiTokenUsage } from "./token-usage.js";
 export type OpenAiJsonSchema = {
@@ -26,8 +27,7 @@ export type OpenAiStructuredOutputClient = {
         }) => Promise<unknown>;
     };
 };
-export type OpenAiStructuredOutputClientInput = {
-    apiKey: string;
+export type OpenAiStructuredOutputClientInput = OpenAiCredentialAccess & {
     apiBaseUrl?: string;
     organizationId?: string;
     openAiProjectId?: string;

package/dist/providers/openai/sdk-procedure-runner.js

@@ -26,6 +26,23 @@ function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 export function createOpenAiStructuredOutputClient(input) {
+    if (input.credentialLease !== undefined) {
+        const { credentialLease, ...connection } = input;
+        return {
+            responses: {
+                create: (body, options) => {
+                    const timeout = options?.timeout ?? DEFAULT_TIMEOUT_MS;
+                    if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 1_200_000)
+                        return Promise.reject(new Error("managed_invocation_timeout_invalid"));
+                    return credentialLease(timeout, (apiKey) => createOpenAiStructuredOutputClient({ ...connection, apiKey }).responses.create(body, {
+                        ...options,
+                        timeout,
+                        maxRetries: 0,
+                    }));
+                },
+            },
+        };
+    }
     const clientOptions = {
         apiKey: input.apiKey,
         maxRetries: 0,

package/dist/run-pipeline/artifact-applicability.d.ts

@@ -2,7 +2,7 @@ import type { ActivityRef, TaskId } from "@tutti/shared/ids";
 import { type CandidateArtifactValidationFailure, type CandidateArtifactValidationResult, type ValidateCandidateArtifactOptions } from "../artifacts/index.js";
 import type { ProviderUsageRecorder } from "../provider-usage/index.js";
 import { type OpenAiStructuredOutputClient } from "../providers/openai/sdk-procedure-runner.js";
-import type { OpenAiProviderConfig } from "../providers/openai/provider-config.js";
+import { type OpenAiCredentialAccess, type OpenAiExecutionConfig } from "../providers/openai/execution-access.js";
 import type { RunDiffSummary } from "../workspace-ops/index.js";
 export type ArtifactApplicabilityDecision = {
     decision: "artifact_required" | "not_applicable";
@@ -30,12 +30,11 @@ export type ArtifactCandidateGateResult = {
     correctable: boolean;
     failure: CandidateArtifactValidationFailure;
 };
-export type RunArtifactCandidateGateOptions = {
+export type RunArtifactCandidateGateOptions = OpenAiCredentialAccess & {
     repoRoot: string;
     task: ArtifactApplicabilityJudgeInput["task"];
     diff: RunDiffSummary;
-    config: OpenAiProviderConfig;
-    apiKey: string;
+    config: OpenAiExecutionConfig;
     promptsRoot?: string;
     baseEnv?: NodeJS.ProcessEnv;
     client?: OpenAiStructuredOutputClient;

package/dist/run-pipeline/artifact-applicability.js

@@ -4,6 +4,7 @@ import { redactAndTruncateText } from "@tutti/shared/utils";
 import { ARTIFACT_MANIFEST_PATH, validateCandidateArtifact, } from "../artifacts/index.js";
 import { renderPromptTemplate } from "../prompt-templates/index.js";
 import { createOpenAiStructuredOutputClient, OpenAiStructuredOutputError, runOpenAiStructuredOutput, } from "../providers/openai/sdk-procedure-runner.js";
+import { openAiCredentialAccess, } from "../providers/openai/execution-access.js";
 const ARTIFACT_APPLICABILITY_OUTPUT_SCHEMA = {
     type: "object",
     required: ["decision", "reason"],
@@ -135,7 +136,7 @@ function deterministicApplicability(options) {
 function createDefaultJudge(options) {
     const client = options.client ??
         createOpenAiStructuredOutputClient({
-            apiKey: options.apiKey,
+            ...openAiCredentialAccess(options),
             ...(options.config.api_base_url === undefined
                 ? {}
                 : { apiBaseUrl: options.config.api_base_url }),

package/dist/run-pipeline/openai.d.ts

@@ -6,15 +6,14 @@ import type { ProviderUsageRecorder } from "../provider-usage/index.js";
 import type { OpenAiStructuredOutputClient } from "../providers/openai/sdk-procedure-runner.js";
 import type { CandidateArtifactValidationResult, ValidateCandidateArtifactOptions } from "../artifacts/index.js";
 import { type ArtifactApplicabilityJudge } from "./artifact-applicability.js";
-import { type OpenAiProviderConfig } from "../providers/openai/provider-config.js";
+import { type OpenAiCredentialAccess, type OpenAiExecutionConfig } from "../providers/openai/execution-access.js";
 import { type CodexLinuxSandboxReadiness } from "../providers/openai/app-server/linux-sandbox-readiness.js";
 import type { CodexAppServerAgentContextRuntime } from "../providers/openai/app-server/skills.js";
 import type { CodexAppServerInvocationCoordinator } from "../providers/openai/app-server/invocation-coordinator.js";
 import type { CodexAppServerLifecycleIncident } from "../providers/openai/app-server/invocation-lifecycle.js";
 export { TASK_RUN_OUTPUT_SCHEMA } from "./task-run-output.js";
-export type OpenAiRunPipelineRunnerOptions = {
-    config: OpenAiProviderConfig;
-    apiKey: string;
+export type OpenAiRunPipelineRunnerOptions = OpenAiCredentialAccess & {
+    config: OpenAiExecutionConfig;
     workspaceRoot: string;
     promptsRoot?: string;
     tuttiHome?: string;

package/dist/run-pipeline/openai.js

@@ -3,7 +3,8 @@ import { runArtifactCandidateGate, } from "./artifact-applicability.js";
 import { checkSkipFields, checkStatus, checksSummary, completedWithoutRepoChanges, docsStatusForChangedPaths, failedBeforeChecks, failedFinishedResult, promotionNotAttempted, promotionNotPromoted, successfulRunSummary, } from "./result-projections.js";
 import { runWorkspaceWriteTask } from "./task-run-invocation.js";
 import { readOpenAiApiKeyCredential } from "../providers/openai/credential-store.js";
-import { resolveOpenAiProviderConfig, } from "../providers/openai/provider-config.js";
+import { resolveOpenAiProviderConfig } from "../providers/openai/provider-config.js";
+import { openAiCredentialAccess, } from "../providers/openai/execution-access.js";
 import { CodexAppServerWorkspaceWriteRunError } from "../providers/openai/app-server/workspace-write-run.js";
 import { inspectCodexLinuxSandboxReadiness, } from "../providers/openai/app-server/linux-sandbox-readiness.js";
 import { getProjectUserSkillsRoot } from "../skills/index.js";
@@ -287,7 +288,7 @@ async function runTaskAttempt(options, input) {
             },
             diff,
             config: options.config,
-            apiKey: options.apiKey,
+            ...openAiCredentialAccess(options),
             ...(options.promptsRoot === undefined ? {} : { promptsRoot: options.promptsRoot }),
             ...(options.baseEnv === undefined ? {} : { baseEnv: options.baseEnv }),
             ...(options.artifactApplicabilityClient === undefined

package/dist/run-pipeline/task-run-invocation.js

@@ -1,3 +1,4 @@
+import { openAiCredentialAccess } from "../providers/openai/execution-access.js";
 import { renderPromptTemplate } from "../prompt-templates/index.js";
 import { CODEX_APP_SERVER_VERSION } from "../providers/openai/codex-app-server.js";
 import { CodexAppServerWorkspaceWriteRunError, runCodexAppServerWorkspaceWriteRun, } from "../providers/openai/app-server/workspace-write-run.js";
@@ -71,9 +72,7 @@ function createRecoveryPrompt(input) {
     const needsCanonicalContext = input.session === undefined || input.session.metadata.thread_id === undefined;
     return renderPromptTemplate({
         templateKey: "runs.task_recovery",
-        ...(input.options.promptsRoot === undefined
-            ? {}
-            : { promptsRoot: input.options.promptsRoot }),
+        ...(input.options.promptsRoot === undefined ? {} : { promptsRoot: input.options.promptsRoot }),
         variables: {
             recovery_input_json: {
                 ...(needsCanonicalContext
@@ -148,7 +147,7 @@ function openTaskSession(options, input) {
 async function runTaskTurn(input) {
     let activeSession = input.session;
     const invoke = () => runCodexAppServerWorkspaceWriteRun({
-        apiKey: input.options.apiKey,
+        ...openAiCredentialAccess(input.options),
         workspaceRoot: input.options.workspaceRoot,
         prompt: input.prompt,
         sandboxMode: input.sandboxMode,
@@ -164,9 +163,7 @@ async function runTaskTurn(input) {
         ...(input.skillSelectionName === undefined
             ? {}
             : { skillSelectionName: input.skillSelectionName }),
-        ...(input.approvalHandler === undefined
-            ? {}
-            : { approvalHandler: input.approvalHandler }),
+        ...(input.approvalHandler === undefined ? {} : { approvalHandler: input.approvalHandler }),
         ...(input.options.config.api_base_url === undefined
             ? {}
             : { apiBaseUrl: input.options.config.api_base_url }),
@@ -274,9 +271,7 @@ function outputRecoveryEvidence(error) {
     return {
         previous_agent_output: error.details.agent_output ?? "",
         provider_output_failure: {
-            kind: error.code === "output_parse_failed"
-                ? "malformed_or_missing_json"
-                : "schema_mismatch",
+            kind: error.code === "output_parse_failed" ? "malformed_or_missing_json" : "schema_mismatch",
             diagnostic: error.message,
         },
     };
@@ -298,8 +293,7 @@ function gateRecoveryEvidence(input) {
     };
 }
 function recoveryEvidenceForRun(input) {
-    if (input.pipelineInput.run_lineage.kind !== "retry" ||
-        input.session === undefined) {
+    if (input.pipelineInput.run_lineage.kind !== "retry" || input.session === undefined) {
         return input.current;
     }
     const persisted = readCodexSessionRecoveryEvidence(input.session);

package/dist/server-shell/cli/cli.js

@@ -192,6 +192,9 @@ async function runProviderSetupCommand(target) {
     const project = resolveExistingProjectContext({
         ...(target === undefined ? {} : { target }),
     });
+    if (project.provider_config.status === "managed") {
+        throw new LaunchError("provider_configuration_required", "This project uses Tutti managed access.", "Manage its trial authorization in your Tutti account; BYOK setup cannot replace it.");
+    }
     const result = await runProviderSetupTui({
         tuttiHome: project.tutti_home,
         projectId: project.project_id,

package/dist/server-shell/cli/host-lifecycle.js

@@ -352,6 +352,7 @@ export async function startLaunchProject(options) {
     let relay;
     try {
         relay = await connectionManager.start();
+        host.startRecovery();
     }
     catch (error) {
         const launchError = error instanceof LaunchError || error instanceof RelayHostControlClientError

package/dist/server-shell/cli/host-server-runtime.d.ts

@@ -24,6 +24,7 @@ export type HostServerHandle = {
     integration_reference_attachment: (command: TrustedReferenceAttachmentIngestionCommand) => Promise<IntegrationDeliveryDisposition>;
     integration_managed_reference: (command: TrustedManagedReferenceIngestionCommand) => Promise<IntegrationManagedReferenceDisposition>;
     attachRelayConnectionManager: (manager: HostRelayConnectionManager) => void;
+    startRecovery: () => void;
     closed: Promise<void>;
     close: () => Promise<void>;
 };