@xfey/tutti 0.1.119 → 0.1.121

package/dist/server-shell/cli/host-server-runtime.js

@@ -14,9 +14,11 @@ import { cleanupStaleCodexAppServerTempRoots } from "../../providers/openai/app-
 import { CodexAppServerInvocationCoordinator } from "../../providers/openai/app-server/invocation-coordinator.js";
 import { resolveProjectOpenAiReadOnlyChatAssistantModel } from "../../providers/openai/chat-assistant.js";
 import { HostPlatformOutboundCoordinator, HostPlatformOutboundWorker, } from "../../platform-outbound/index.js";
-import { configureProjectOpenAiProvider, discoverProjectOpenAiModels, readOpenAiProviderConfigProjection, updateProjectOpenAiDefaultModel, } from "../../providers/openai/index.js";
+import { configureProjectOpenAiProvider, discoverProjectOpenAiModels, updateProjectOpenAiDefaultModel, } from "../../providers/openai/index.js";
 import { readProviderUsageProjection, recordProviderUsageEvent, } from "../../provider-usage/index.js";
 import { resolveProjectOpenAiRunPipelineRunner } from "../../run-pipeline/openai.js";
+import { createManagedChatModel, createManagedRunPipeline, createManagedWorkflowRunner, } from "../managed-access/runners.js";
+import { createNativeManagedHostRuntime, readProjectModelAccess, } from "../managed-access/project-provider.js";
 import { openHostProjectStore } from "../../store/index.js";
 import { resolvePackagedWebStaticRoot } from "../http/static-web.js";
 import { AGENT_CONTEXT_BASE_PATH, AgentContextTokenRegistry, } from "../http/routes/agent-context.js";
@@ -224,9 +226,10 @@ export async function startForegroundHostServer(options) {
         now,
     });
     const workspaceEvents = new WorkspaceEventBus({ now });
-    const getProviderConfig = () => readOpenAiProviderConfigProjection({
+    const getProviderConfig = () => readProjectModelAccess({
         tuttiHome: options.preparation.tutti_home,
         projectId: options.preparation.project_id,
+        relayUrl: options.preparation.relay_url,
     });
     const recordUsage = (usage) => {
         recordProviderUsageEvent(store.db, {
@@ -293,6 +296,14 @@ export async function startForegroundHostServer(options) {
         logFilePath,
         now,
     });
+    const managedRuntime = createNativeManagedHostRuntime({
+        tuttiHome: options.preparation.tutti_home,
+        projectId: options.preparation.project_id,
+        relayUrl: options.preparation.relay_url,
+        workspaceRoot: options.preparation.workspace_root,
+        surface: options.preparation.machine_local.binding.surface_profile.kind,
+        observe: (event) => controlPlaneLogger.info({ ...event, component: "managed-model-access" }, "Managed model access"),
+    });
     const platformOutboundLogger = createHostRuntimeLogger({
         component: "platform-outbound",
         logFilePath,
@@ -397,27 +408,37 @@ export async function startForegroundHostServer(options) {
         readMainlineStatus: () => ({
             mainline_clean: readHostRepoProjection(options.preparation.workspace_root).mainline_clean,
         }),
-        resolveRunPipeline: () => resolveProjectOpenAiRunPipelineRunner({
-            tuttiHome: options.preparation.tutti_home,
-            projectId: options.preparation.project_id,
-            workspaceRoot: options.preparation.workspace_root,
-            agentContext: agentContextRuntime,
-            approvalManager,
-            logger: runPipelineLogger,
-            recordUsage,
-            invocationCoordinator: codexInvocationCoordinator,
-            checkProcessCoordinator,
-            onLifecycleIncident: runLifecycleIncident,
-        }),
-        resolveWorkflowRunner: () => resolveProjectOpenAiProcedureWorkflowRunner({
-            tuttiHome: options.preparation.tutti_home,
-            projectId: options.preparation.project_id,
-            workspaceRoot: options.preparation.workspace_root,
-            agentContext: agentContextRuntime,
-            recordUsage,
-            invocationCoordinator: codexInvocationCoordinator,
-            onLifecycleIncident: procedureLifecycleIncident,
-        }),
+        resolveRunPipeline: () => {
+            const runtimeOptions = {
+                tuttiHome: options.preparation.tutti_home,
+                projectId: options.preparation.project_id,
+                workspaceRoot: options.preparation.workspace_root,
+                agentContext: agentContextRuntime,
+                approvalManager,
+                logger: runPipelineLogger,
+                recordUsage,
+                invocationCoordinator: codexInvocationCoordinator,
+                checkProcessCoordinator,
+                onLifecycleIncident: runLifecycleIncident,
+            };
+            return managedRuntime === null
+                ? resolveProjectOpenAiRunPipelineRunner(runtimeOptions)
+                : { kind: "ready", runner: createManagedRunPipeline(managedRuntime, runtimeOptions) };
+        },
+        resolveWorkflowRunner: () => {
+            const runtimeOptions = {
+                tuttiHome: options.preparation.tutti_home,
+                projectId: options.preparation.project_id,
+                workspaceRoot: options.preparation.workspace_root,
+                agentContext: agentContextRuntime,
+                recordUsage,
+                invocationCoordinator: codexInvocationCoordinator,
+                onLifecycleIncident: procedureLifecycleIncident,
+            };
+            return managedRuntime === null
+                ? resolveProjectOpenAiProcedureWorkflowRunner(runtimeOptions)
+                : { kind: "ready", runner: createManagedWorkflowRunner(managedRuntime, runtimeOptions) };
+        },
     });
     const chatAssistant = new ReadOnlyChatAssistant({
         logger: createHostRuntimeLogger({ component: "chat-assistant", logFilePath, now }),
@@ -427,7 +448,7 @@ export async function startForegroundHostServer(options) {
         workspaceRoot: options.preparation.workspace_root,
         model: {
             answer: async (input) => {
-                const resolution = resolveProjectOpenAiReadOnlyChatAssistantModel({
+                const runtimeOptions = {
                     tuttiHome: options.preparation.tutti_home,
                     projectId: options.preparation.project_id,
                     workspaceRoot: options.preparation.workspace_root,
@@ -435,7 +456,13 @@ export async function startForegroundHostServer(options) {
                     recordUsage,
                     invocationCoordinator: codexInvocationCoordinator,
                     onLifecycleIncident: chatLifecycleIncident,
-                });
+                };
+                const resolution = managedRuntime === null
+                    ? resolveProjectOpenAiReadOnlyChatAssistantModel(runtimeOptions)
+                    : {
+                        kind: "ready",
+                        model: createManagedChatModel(managedRuntime, runtimeOptions),
+                    };
                 if (resolution.kind !== "ready") {
                     throw new Error("Provider is not configured.");
                 }
@@ -488,6 +515,9 @@ export async function startForegroundHostServer(options) {
         providerConfig: {
             get: getProviderConfig,
             configure: async (input) => {
+                if (managedRuntime !== null) {
+                    throw new HostLocalProviderConfigureError("managed_model_fixed", "Managed project access cannot be replaced through BYOK setup.");
+                }
                 const result = await configureProjectOpenAiProvider({
                     tuttiHome: options.preparation.tutti_home,
                     projectId: options.preparation.project_id,
@@ -597,11 +627,18 @@ export async function startForegroundHostServer(options) {
                 chatAssistant,
                 tuttiHome: options.preparation.tutti_home,
                 getProviderConfig,
-                providerModel: createHostProviderModelService({
-                    tuttiHome: options.preparation.tutti_home,
-                    projectId: options.preparation.project_id,
-                    now,
-                }),
+                providerModel: managedRuntime === null
+                    ? createHostProviderModelService({
+                        tuttiHome: options.preparation.tutti_home,
+                        projectId: options.preparation.project_id,
+                        now,
+                    })
+                    : {
+                        discover: () => Promise.resolve({ status: "unavailable", reason: "managed_model_fixed" }),
+                        update: () => Promise.resolve({
+                            disposition: { kind: "provider_unavailable", reason: "managed_model_fixed" },
+                        }),
+                    },
                 getProviderUsage: () => readProviderUsageProjection(store.db),
                 updateProjectDisplayName: (displayName) => {
                     updateRuntimeProjectDisplayName(displayName);
@@ -613,6 +650,7 @@ export async function startForegroundHostServer(options) {
                 capabilities: {
                     clarification: true,
                     repo_viewer: true,
+                    provider_model_update: managedRuntime === null,
                 },
                 getRepo: () => readHostRepoProjection(options.preparation.workspace_root),
                 workspaceOps: {
@@ -657,10 +695,20 @@ export async function startForegroundHostServer(options) {
         store.close();
         throw error;
     }
-    controlPlane.runStartupRecovery({
-        workspaceRoot: options.preparation.workspace_root,
-        recoverInProgressCommands: true,
-    });
+    let recoveryStarted = false;
+    const startRecovery = () => {
+        if (recoveryStarted)
+            return;
+        recoveryStarted = true;
+        controlPlane.runStartupRecovery({
+            workspaceRoot: options.preparation.workspace_root,
+            recoverInProgressCommands: true,
+        });
+    };
+    // Managed creation / reauthorization activates during Relay registration. Do
+    // not recover a stored task against a not-yet-activated native delegation.
+    if (managedRuntime === null)
+        startRecovery();
     let resolveClosed;
     let rejectClosed;
     const closed = new Promise((resolve, reject) => {
@@ -708,6 +756,7 @@ export async function startForegroundHostServer(options) {
     };
     return {
         app,
+        startRecovery,
         store,
         log_file_path: logFilePath,
         runtime_endpoint: runtimeEndpoint,

package/dist/server-shell/cli/launch-command.js

@@ -115,7 +115,7 @@ export function renderFeishuCompletionPage(options) {
     ].join("\n");
 }
 async function ensureProviderConfigured(preparation) {
-    if (preparation.provider_status === "configured") {
+    if (preparation.provider_status === "configured" || preparation.provider_status === "managed") {
         return;
     }
     if (!process.stdin.isTTY || !process.stdout.isTTY) {

package/dist/server-shell/cli/launch.d.ts

@@ -1,6 +1,6 @@
 import type { ProjectSurface } from "@tutti/shared/domain";
 import { type ProjectId } from "@tutti/shared/ids";
-import { type OpenAiProviderConfigProjection } from "../../providers/openai/index.js";
+import type { ProviderConfigProjection } from "@tutti/shared/schemas/api";
 import { type GitBootstrapResult, type LaunchConfirmationHandler } from "./git-bootstrap.js";
 import { type MachineProjectBindingResult } from "./machine-local.js";
 import { type ProjectIdentityReadResult } from "./project-identity.js";
@@ -15,8 +15,12 @@ export type LaunchPreparationOptions = {
     projectDisplayName?: string;
     projectDescription?: string;
     projectSurface?: ProjectSurface;
+    reservedIdentity?: {
+        projectId: ProjectId;
+        hostRegistrationSecret: string;
+    };
 };
-export type LaunchProviderStatus = OpenAiProviderConfigProjection["status"];
+export type LaunchProviderStatus = ProviderConfigProjection["status"];
 export type LaunchPreparationResult = {
     status: "prepared";
     workspace_root: string;
@@ -26,7 +30,7 @@ export type LaunchPreparationResult = {
     relay_url: string;
     local_diagnostic_endpoint: string;
     provider_status: LaunchProviderStatus;
-    provider_config: OpenAiProviderConfigProjection;
+    provider_config: ProviderConfigProjection;
     project_identity_created: boolean;
     git: GitBootstrapResult;
     machine_local: MachineProjectBindingResult;

package/dist/server-shell/cli/launch.js

@@ -1,9 +1,10 @@
 import { basename, resolve } from "node:path";
 import { createProjectId } from "@tutti/shared/ids";
-import { readOpenAiProviderConfigProjection, resolveTuttiHome, } from "../../providers/openai/index.js";
+import { resolveTuttiHome } from "../../providers/openai/index.js";
+import { readProjectModelAccess } from "../managed-access/project-provider.js";
 import { LaunchError } from "./errors.js";
 import { assertSafeProjectRoot, ensureGitBootstrap, } from "./git-bootstrap.js";
-import { ensureMachineProjectBinding } from "./machine-local.js";
+import { assertReservedMachineProjectIdentity, ensureMachineProjectBinding, } from "./machine-local.js";
 import { readProjectIdentity, readProjectDisplayName, writeProjectDescription, writeProjectDisplayName, writeProjectIdentity, } from "./project-identity.js";
 const DEFAULT_RELAY_URL = "https://tutti.now";
 const DEFAULT_HOST_ENDPOINT_HOST = "127.0.0.1";
@@ -50,7 +51,21 @@ export async function prepareLaunchProject(options) {
     const relayUrl = context.relay_url;
     const localDiagnosticEndpoint = context.local_diagnostic_endpoint.base_url;
     const existingIdentity = context.existing_identity;
-    const projectId = existingIdentity.kind === "present" ? existingIdentity.project_id : createProjectId();
+    const projectId = existingIdentity.kind === "present"
+        ? existingIdentity.project_id
+        : (options.reservedIdentity?.projectId ?? createProjectId());
+    if (options.reservedIdentity !== undefined) {
+        if (projectId !== options.reservedIdentity.projectId)
+            throw new LaunchError("project_identity_conflict", "This directory belongs to a different project", "Use the directory approved in the native creation request.");
+        assertReservedMachineProjectIdentity({
+            tuttiHome,
+            projectId,
+            workspaceRoot,
+            relayUrl,
+            surface: options.projectSurface ?? "standalone",
+            hostSecret: options.reservedIdentity.hostRegistrationSecret,
+        });
+    }
     const projectIdentityCreated = existingIdentity.kind === "missing";
     const gitOptions = {
         workspaceRoot,
@@ -89,10 +104,14 @@ export async function prepareLaunchProject(options) {
     if (options.projectSurface !== undefined) {
         bindingOptions.surface = options.projectSurface;
     }
+    if (options.reservedIdentity !== undefined) {
+        bindingOptions.reservedHostSecret = options.reservedIdentity.hostRegistrationSecret;
+    }
     const machineLocal = ensureMachineProjectBinding(bindingOptions);
-    const providerConfig = readOpenAiProviderConfigProjection({
+    const providerConfig = readProjectModelAccess({
         tuttiHome,
         projectId,
+        relayUrl,
     });
     return {
         status: "prepared",

package/dist/server-shell/cli/machine-local.d.ts

@@ -41,6 +41,7 @@ export type EnsureMachineProjectBindingOptions = {
     displayNameSnapshot?: string;
     relayUrl?: string;
     surface?: ProjectSurface;
+    reservedHostSecret?: string;
     allowWorkspaceRootTakeover?: boolean;
     now?: () => Date;
 };
@@ -103,5 +104,13 @@ export declare function updateMachineProjectDisplayNameSnapshot(options: {
     displayName: string;
     now?: () => Date;
 }): MachineProjectBindingRecord;
+export declare function assertReservedMachineProjectIdentity(options: {
+    tuttiHome: string;
+    projectId: ProjectId;
+    workspaceRoot: string;
+    relayUrl: string;
+    surface: ProjectSurface;
+    hostSecret: string;
+}): void;
 export declare function ensureMachineProjectBinding(options: EnsureMachineProjectBindingOptions): MachineProjectBindingResult;
 //# sourceMappingURL=machine-local.d.ts.map

package/dist/server-shell/cli/machine-local.js

@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-import { appendFileSync, chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync, } from "node:fs";
+import { appendFileSync, chmodSync, closeSync, existsSync, fsyncSync, linkSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync, } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { createProjectSurfaceProfile, isProjectSurfaceProfile, } from "@tutti/shared/domain";
 import { ID_PREFIXES, isPrefixedId } from "@tutti/shared/ids";
@@ -286,33 +286,76 @@ export function updateMachineProjectDisplayNameSnapshot(options) {
     writePrivateJsonFile(getMachineProjectBindingPath(options.tuttiHome, options.projectId), binding);
     return binding;
 }
-function ensureHostRegistrationSecret(tuttiHome, projectId, now) {
+function ensureHostRegistrationSecret(tuttiHome, projectId, now, reservedSecret) {
     const secretPath = getHostRegistrationSecretPath(tuttiHome, projectId);
     const ref = createHostRegistrationSecretRef(projectId);
     if (existsSync(secretPath)) {
+        const existing = readHostRegistrationSecret(tuttiHome, projectId);
+        if (reservedSecret !== undefined && existing.secret !== reservedSecret)
+            throw reservedIdentityConflict();
         return {
             ref,
             created: false,
-            createdAt: readHostRegistrationSecret(tuttiHome, projectId).created_at,
+            createdAt: existing.created_at,
         };
     }
     const timestamp = now().toISOString();
     const secretFile = {
         kind: "host_registration_secret_v1",
         project_id: projectId,
-        secret: createHostRegistrationSecret(),
+        secret: reservedSecret ?? createHostRegistrationSecret(),
         created_at: timestamp,
         updated_at: timestamp,
     };
-    writePrivateJsonFile(secretPath, secretFile);
+    // Publish a complete file exclusively; racing creation must never replace a proof
+    // already reserved or registered by another process.
+    ensurePrivateDirectory(dirname(secretPath));
+    const temporary = `${secretPath}.${randomBytes(12).toString("hex")}.tmp`;
+    const fd = openSync(temporary, "wx", 0o600);
+    try {
+        writeFileSync(fd, `${JSON.stringify(secretFile)}\n`, "utf8");
+        fsyncSync(fd);
+        try {
+            linkSync(temporary, secretPath);
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            const existing = readHostRegistrationSecret(tuttiHome, projectId);
+            if (reservedSecret !== undefined && existing.secret !== reservedSecret)
+                throw reservedIdentityConflict();
+            return { ref, created: false, createdAt: existing.created_at };
+        }
+    }
+    finally {
+        closeSync(fd);
+        unlinkSync(temporary);
+    }
     return { ref, created: true, createdAt: timestamp };
 }
+function reservedIdentityConflict() {
+    return new LaunchError("project_identity_conflict", "The native creation reservation conflicts with this project's local identity", "Keep the existing project unchanged and reconcile its native creation record.");
+}
+// Read-only preflight, before any Git bootstrap, adoption or credential write.
+export function assertReservedMachineProjectIdentity(options) {
+    if (!isPrefixedId(options.projectId, ID_PREFIXES.project) ||
+        !/^[A-Za-z0-9_-]{43}$/u.test(options.hostSecret))
+        throw reservedIdentityConflict();
+    const binding = readMachineProjectBinding(options.tuttiHome, options.projectId);
+    if (binding !== null &&
+        (binding.workspace_root !== resolve(options.workspaceRoot) ||
+            binding.surface_profile.kind !== options.surface ||
+            binding.relay_url !== options.relayUrl))
+        throw reservedIdentityConflict();
+    if (existsSync(getHostRegistrationSecretPath(options.tuttiHome, options.projectId)) &&
+        readHostRegistrationSecret(options.tuttiHome, options.projectId).secret !== options.hostSecret)
+        throw reservedIdentityConflict();
+}
 export function ensureMachineProjectBinding(options) {
     const now = options.now ?? (() => new Date());
     const workspaceRoot = resolve(options.workspaceRoot);
     const localStoreRoot = getProjectLocalStoreRoot(options.tuttiHome, options.projectId);
     const bindingPath = getMachineProjectBindingPath(options.tuttiHome, options.projectId);
-    const secret = ensureHostRegistrationSecret(options.tuttiHome, options.projectId, now);
     const existing = readMachineProjectBinding(options.tuttiHome, options.projectId);
     const requestedSurface = options.surface ?? existing?.surface_profile.kind ?? "standalone";
     if (existing !== null && existing.surface_profile.kind !== requestedSurface) {
@@ -323,6 +366,17 @@ export function ensureMachineProjectBinding(options) {
         options.allowWorkspaceRootTakeover !== true) {
         throw new LaunchError("project_identity_conflict", "This project is already bound to a different workspace root on this machine", "Use the future takeover flow, or remove the stale binding only after verifying no host server is running.");
     }
+    if (options.reservedHostSecret !== undefined) {
+        assertReservedMachineProjectIdentity({
+            tuttiHome: options.tuttiHome,
+            projectId: options.projectId,
+            workspaceRoot,
+            relayUrl: options.relayUrl ?? "",
+            surface: requestedSurface,
+            hostSecret: options.reservedHostSecret,
+        });
+    }
+    const secret = ensureHostRegistrationSecret(options.tuttiHome, options.projectId, now, options.reservedHostSecret);
     const binding = {
         project_id: options.projectId,
         surface_profile: createProjectSurfaceProfile(requestedSurface),

package/dist/server-shell/cli/project-resolver.d.ts

@@ -1,5 +1,5 @@
 import { type ProjectId } from "@tutti/shared/ids";
-import { type OpenAiProviderConfigProjection } from "../../providers/openai/index.js";
+import type { ProviderConfigProjection } from "@tutti/shared/schemas/api";
 import { type MachineProjectBindingRecord, type MachineRuntimeEndpointRecord } from "./machine-local.js";
 export type ExistingProjectContext = {
     workspace_root: string;
@@ -8,7 +8,7 @@ export type ExistingProjectContext = {
     display_name: string;
     binding: MachineProjectBindingRecord | null;
     runtime_endpoint: MachineRuntimeEndpointRecord | null;
-    provider_config: OpenAiProviderConfigProjection;
+    provider_config: ProviderConfigProjection;
     provider_base_url?: string;
 };
 export type ManagedProjectContext = ExistingProjectContext & {

package/dist/server-shell/cli/project-resolver.js

@@ -1,7 +1,8 @@
 import { existsSync } from "node:fs";
 import { basename, resolve } from "node:path";
 import { ID_PREFIXES, isPrefixedId } from "@tutti/shared/ids";
-import { readOpenAiProviderConfigProjection, readProjectOpenAiProviderConfig, resolveTuttiHome, } from "../../providers/openai/index.js";
+import { readProjectOpenAiProviderConfig, resolveTuttiHome } from "../../providers/openai/index.js";
+import { readProjectModelAccess } from "../managed-access/project-provider.js";
 import { LaunchError } from "./errors.js";
 import { assertSafeProjectRoot } from "./git-bootstrap.js";
 import { inspectMachineProjectInventory, inspectMachineProjectInventories, } from "./machine-project-inspector.js";
@@ -157,9 +158,10 @@ export function resolveExistingProjectContext(options) {
         display_name: readProjectDisplayName(workspaceRoot) ?? identity.project_id,
         binding,
         runtime_endpoint: readMachineRuntimeEndpoint(tuttiHome, identity.project_id),
-        provider_config: readOpenAiProviderConfigProjection({
+        provider_config: readProjectModelAccess({
             tuttiHome,
             projectId: identity.project_id,
+            relayUrl: binding?.relay_url ?? env.TUTTI_RELAY_URL ?? "https://tutti.now",
         }),
         ...(projectConfig.kind === "ok" && projectConfig.config.api_base_url !== undefined
             ? { provider_base_url: projectConfig.config.api_base_url }
@@ -197,9 +199,10 @@ export function resolveManagedProjectContext(options) {
         display_name: entry.display_name,
         binding,
         runtime_endpoint: runtimeEndpoint,
-        provider_config: readOpenAiProviderConfigProjection({
+        provider_config: readProjectModelAccess({
             tuttiHome,
             projectId: entry.project_id,
+            relayUrl: binding?.relay_url ?? env.TUTTI_RELAY_URL ?? "https://tutti.now",
         }),
         ...(projectConfig.kind === "ok" && projectConfig.config.api_base_url !== undefined
             ? { provider_base_url: projectConfig.config.api_base_url }

package/dist/server-shell/cli/relay-registration.js

@@ -4,6 +4,10 @@ import { createIdempotencyKey, } from "@tutti/shared/ids";
 import { deleteFeishuOwnerAccountHandoff, readFeishuOwnerAccountHandoff, readHostRegistrationSecret, updateMachineProjectRelayBinding, } from "./machine-local.js";
 import { LaunchError } from "./errors.js";
 import { readProjectDisplayName } from "./project-identity.js";
+import { findNativeManagedProject } from "../managed-access/state.js";
+import { realpathSync } from "node:fs";
+import { ManagedLocalStateError } from "../managed-access/private-store.js";
+import { reconcileNativePreparation } from "../managed-access/transport.js";
 export function relayErrorToLaunchError(error, relayUrl) {
     if (error instanceof LaunchError) {
         return error;
@@ -25,6 +29,28 @@ export async function registerHostWithRelay(options) {
     const hostSecret = readHostRegistrationSecret(options.preparation.tutti_home, options.preparation.project_id);
     const surfaceProfile = options.preparation.machine_local?.binding.surface_profile ??
         { kind: "standalone", version: 1 };
+    const managed = findNativeManagedProject({
+        tuttiHome: options.preparation.tutti_home,
+        relayUrl: options.preparation.relay_url,
+        projectId: options.preparation.project_id,
+    });
+    if (managed !== null &&
+        (managed.journal.workspace_root !== realpathSync(options.preparation.workspace_root) ||
+            managed.journal.surface !== surfaceProfile.kind ||
+            managed.journal.host_registration_secret !== hostSecret.secret))
+        throw new ManagedLocalStateError("managed_registration_mismatch");
+    // A lost registration response is reconciled independently before retry. Once
+    // activated, ordinary collaboration reconnect does not require browser consent.
+    if (managed !== null && managed.journal.state !== "registered") {
+        await reconcileNativePreparation({
+            state: managed.state,
+            requestRef: managed.journal.request_ref,
+            fetchImpl: (input, init) => options.fetchImpl(input instanceof Request ? input.url : input, init),
+            now: options.now?.() ?? new Date(),
+            ...(options.signal === undefined ? {} : { signal: options.signal }),
+        });
+    }
+    const pendingManaged = managed !== null && managed.state.read(managed.journal.request_ref).state !== "registered";
     const registrationOptions = {
         relayUrl: options.preparation.relay_url,
         projectId: options.preparation.project_id,
@@ -50,17 +76,25 @@ export async function registerHostWithRelay(options) {
         ...(options.signal === undefined ? {} : { signal: options.signal }),
         ...(options.now === undefined ? {} : { issuedAt: options.now() }),
     };
-    const accountHandoff = surfaceProfile.kind === "feishu"
+    const accountHandoff = surfaceProfile.kind === "feishu" && managed === null
         ? readFeishuOwnerAccountHandoff(options.preparation.tutti_home, options.preparation.project_id, options.now?.() ?? new Date())
         : null;
     if (accountHandoff !== null) {
         registrationOptions.accountHandoffToken = accountHandoff.token;
     }
+    if (pendingManaged && managed !== null) {
+        registrationOptions.managedBootstrap = managed.state.bootstrap(managed.journal.request_ref, options.now?.() ?? new Date());
+    }
     const response = await options.registerRelayHostConnection(registrationOptions);
     if (response.disposition.kind !== "registered" || response.result === undefined) {
         throw new LaunchError("relay_registration_failed", "Relay host registration did not complete", "Retry `tutti launch` with a new registration command.");
     }
     const result = response.result;
+    if (pendingManaged && managed !== null) {
+        if (result.managed_authority === undefined ||
+            result.managed_authority.relay_project_ref !== result.relay_project.relay_project_ref)
+            throw new ManagedLocalStateError("managed_registration_mismatch");
+    }
     if ((result.relay_project.surface_profile?.kind ?? "standalone") !== surfaceProfile.kind) {
         throw new LaunchError("project_surface_conflict", "Relay returned a different project collaboration surface", "Keep the Host stopped and inspect the machine project binding and Relay project metadata.");
     }
@@ -69,6 +103,9 @@ export async function registerHostWithRelay(options) {
         (result.join_token?.visibility !== "visible_once" || result.join_token.join_url === undefined)) {
         throw new LaunchError("relay_registration_failed", "Relay did not return a visible join URL for this launch", "Retry `tutti launch` so the host can rotate a fresh visible-once join URL.");
     }
+    if (pendingManaged && managed !== null && result.managed_authority !== undefined) {
+        managed.state.registered(managed.journal.request_ref, result.managed_authority);
+    }
     updateMachineProjectRelayBinding({
         tuttiHome: options.preparation.tutti_home,
         projectId: options.preparation.project_id,

package/dist/server-shell/http/routes/local-control.d.ts

@@ -1,5 +1,5 @@
 import type { FastifyInstance } from "fastify";
-import type { ProviderConfigProjection } from "@tutti/shared/schemas/api";
+import { type ProviderConfigProjection } from "@tutti/shared/schemas/api";
 import type { ProjectId } from "@tutti/shared/ids";
 import { type FeishuSetupProjection } from "@tutti/shared/schemas/internal";
 export type HostLocalControlOptions = {

package/dist/server-shell/http/routes/local-control.js

@@ -1,4 +1,5 @@
 import { timingSafeEqual } from "node:crypto";
+import { ProviderConfigProjectionSchema, } from "@tutti/shared/schemas/api";
 import { FeishuSetupProjectionSchema, } from "@tutti/shared/schemas/internal";
 class HostLocalControlUnauthorizedError extends Error {
     statusCode = 401;
@@ -90,52 +91,7 @@ const HostLocalProjectResponseSchema = {
         display_name: { type: "string", minLength: 1, maxLength: 80 },
     },
 };
-const HostLocalProviderConfigResponseSchema = {
-    oneOf: [
-        {
-            type: "object",
-            required: ["status"],
-            additionalProperties: false,
-            properties: {
-                status: { type: "string", enum: ["not_configured"] },
-            },
-        },
-        {
-            type: "object",
-            required: [
-                "status",
-                "provider",
-                "auth_kind",
-                "redacted_key",
-                "default_model",
-                "validated_at",
-            ],
-            additionalProperties: false,
-            properties: {
-                status: { type: "string", enum: ["configured"] },
-                provider: { type: "string", enum: ["openai"] },
-                auth_kind: { type: "string", enum: ["api_key"] },
-                redacted_key: { type: "string" },
-                default_model: { type: "string" },
-                validated_at: { type: "string" },
-            },
-        },
-        {
-            type: "object",
-            required: ["status"],
-            additionalProperties: false,
-            properties: {
-                status: { type: "string", enum: ["invalid"] },
-                provider: { type: "string", enum: ["openai"] },
-                auth_kind: { type: "string", enum: ["api_key"] },
-                redacted_key: { type: "string" },
-                default_model: { type: "string" },
-                validated_at: { type: "string" },
-                invalid_reason_code: { type: "string" },
-            },
-        },
-    ],
-};
+const HostLocalProviderConfigResponseSchema = ProviderConfigProjectionSchema;
 const HostLocalLaunchStatusResponseSchema = {
     type: "object",
     additionalProperties: false,