@xfey/tutti 0.1.68 → 0.1.70

package/dist/chat-assistant/index.d.ts

@@ -43,7 +43,7 @@ export type ReadOnlyChatAssistantOptions = {
     workspaceRoot: string;
     model: ReadOnlyChatAssistantModel;
     promptsRoot?: string;
-    onScratchpadSourceChanged?: () => void;
+    onScratchpadSourceChanged?: (message: MessageProjection) => void;
     now?: () => Date;
 };
 export declare function isChatAssistantOutput(value: unknown): value is ChatAssistantOutput;

package/dist/chat-assistant/index.js

@@ -206,7 +206,7 @@ export class ReadOnlyChatAssistant {
             invalidates: mainChatMessageInvalidates(),
         });
         if (refs?.scratchpad_source !== "exclude") {
-            this.options.onScratchpadSourceChanged?.();
+            this.options.onScratchpadSourceChanged?.(message);
         }
     }
     appendClarificationRoundAssistantMessage(input) {

package/dist/collaboration-state/task-compile-context.js

@@ -2,6 +2,16 @@ import { withHostStoreTransaction } from "../store/index.js";
 import { readScratchpadProjection } from "./scratchpad.js";
 import { readScratchpadSourceState } from "./scratchpad-source-state.js";
 import { nowIso, stringifyJson } from "./serialization.js";
+function cursorIsAfter(left, right) {
+    if (left === undefined) {
+        return false;
+    }
+    if (right === undefined) {
+        return true;
+    }
+    const timeOrder = left.created_at.localeCompare(right.created_at);
+    return timeOrder > 0 || (timeOrder === 0 && left.message_id > right.message_id);
+}
 function parseStringArray(value, field) {
     let parsed;
     try {
@@ -238,11 +248,18 @@ export function rollbackTaskCompileContext(db, input) {
         }
         const rolledBackAt = nowIso(input.now);
         const sourceState = readScratchpadSourceState(tx);
-        const dirtySince = sourceState.in_flight !== undefined &&
-            new Date(rolledBackAt).getTime() <= new Date(sourceState.in_flight.started_at).getTime()
-            ? new Date(new Date(sourceState.in_flight.started_at).getTime() + 1).toISOString()
-            : rolledBackAt;
         const after = context.source_window.after;
+        const through = context.source_window.through;
+        const hasBoundaryAfterSourceChanges = sourceState.dirty_since !== undefined ||
+            sourceState.in_flight !== undefined ||
+            cursorIsAfter(sourceState.refreshed_through_cursor, through);
+        const dirtySince = hasBoundaryAfterSourceChanges
+            ? sourceState.in_flight !== undefined &&
+                new Date(rolledBackAt).getTime() <= new Date(sourceState.in_flight.started_at).getTime()
+                ? new Date(new Date(sourceState.in_flight.started_at).getTime() + 1).toISOString()
+                : rolledBackAt
+            : null;
+        const restoredThrough = hasBoundaryAfterSourceChanges ? after : through;
         tx.prepare(`
         INSERT INTO scratchpad_source_state (
           id,
@@ -261,7 +278,7 @@ export function rollbackTaskCompileContext(db, input) {
           refreshed_through_cursor_message_id = excluded.refreshed_through_cursor_message_id,
           dirty_since = excluded.dirty_since,
           updated_at = excluded.updated_at
-      `).run(after?.created_at ?? null, after?.message_id ?? null, after?.created_at ?? null, after?.message_id ?? null, dirtySince, rolledBackAt);
+      `).run(after?.created_at ?? null, after?.message_id ?? null, restoredThrough?.created_at ?? null, restoredThrough?.message_id ?? null, dirtySince, rolledBackAt);
         tx.prepare("DELETE FROM active_task_compile_context WHERE workflow_ref = ?").run(input.workflow_ref);
         return true;
     });

package/dist/control-plane/index.d.ts

@@ -1,5 +1,5 @@
 import { type ActivityRef, type ClarificationRoundRef, type IdempotencyKey, type WorkflowInvocationRef } from "@tutti/shared/ids";
-import type { ExecutionStatusProjection, ContextSyncDisposition, ContextSyncResult, RefreshScratchpadDisposition, RefreshScratchpadResult, RunSchedulerNowDisposition, RunSchedulerNowPayload, RefreshReferenceSummariesDisposition, RefreshReferenceSummariesPayload, RefreshReferenceSummariesResult, SendClarificationRoundMessageDisposition, SendClarificationRoundMessagePayload, SendClarificationRoundMessageResult, SubmitClarificationRoundDisposition, SubmitClarificationRoundPayload, SubmitClarificationRoundResult, SubmitWorklistDisposition, SubmitWorklistPayload, SubmitWorklistResult, ProcedureLane } from "@tutti/shared/schemas/api";
+import type { ExecutionStatusProjection, MessageProjection, ContextSyncDisposition, ContextSyncResult, RefreshScratchpadDisposition, RefreshScratchpadResult, RunSchedulerNowDisposition, RunSchedulerNowPayload, RefreshReferenceSummariesDisposition, RefreshReferenceSummariesPayload, RefreshReferenceSummariesResult, SendClarificationRoundMessageDisposition, SendClarificationRoundMessagePayload, SendClarificationRoundMessageResult, SubmitClarificationRoundDisposition, SubmitClarificationRoundPayload, SubmitClarificationRoundResult, SubmitWorklistDisposition, SubmitWorklistPayload, SubmitWorklistResult, ProcedureLane } from "@tutti/shared/schemas/api";
 import type { ContextSyncWorkflowTrigger } from "./workflows/index.js";
 import type { ControlPlaneCommandResult, Phase5ControlPlaneOptions, StartupRecoveryOptions, StartupRecoveryResult, TrustedHumanAuthor } from "./types.js";
 import { type ProjectBriefRefreshReason, type RefreshProjectBriefProjectionResult } from "./project-brief-refresh.js";
@@ -30,7 +30,7 @@ export declare class Phase5ControlPlane {
     startScratchpadRefresh(options?: {
         lane?: ProcedureLane;
     }): ControlPlaneCommandResult<RefreshScratchpadDisposition, RefreshScratchpadResult>;
-    notifyScratchpadSourceChanged(): void;
+    notifyScratchpadSourceChanged(message: MessageProjection): void;
     refreshProjectBrief(options: {
         reason: ProjectBriefRefreshReason;
         workflowRef?: WorkflowInvocationRef;

package/dist/control-plane/index.js

@@ -1,6 +1,7 @@
 import { readActiveTaskCompileContext, readWorklistProjection, } from "../collaboration-state/index.js";
 import { ProcedureEngine } from "../procedure-engine/index.js";
 import { RunEngine } from "../run-engine/index.js";
+import { WorkspaceOpsError, readReferenceSummaryTargets, } from "../workspace-ops/index.js";
 import { publishProcedureTransition as publishProcedureTransitionEvent, publishRunResultRecorded as publishRunResultRecordedEvent, publishRunTransition as publishRunTransitionEvent, publishTaskRunStarted as publishTaskRunStartedEvent, } from "./event-publishers.js";
 import { startContextSyncAnalysisProcedure } from "./context-sync.js";
 import { refreshProjectBriefProjection, } from "./project-brief-refresh.js";
@@ -9,6 +10,7 @@ import { runControlPlaneStartupRecovery } from "./startup-recovery.js";
 import { readControlPlaneExecutionStatus } from "./execution-status.js";
 import { ScratchpadAutoRefreshScheduler } from "./scratchpad-auto-refresh.js";
 import { startControlPlaneScratchpadRefresh } from "./scratchpad-refresh-start.js";
+import { shouldUseMessageAsScratchpadSource } from "./scratchpad-source-messages.js";
 import { startControlPlaneTaskCompile } from "./task-compile-start.js";
 import { startControlPlaneTaskCompileContinuation } from "./task-compile-continuation.js";
 import { startControlPlaneTaskBoundFollowUpCheck } from "./follow-up-start.js";
@@ -106,7 +108,10 @@ export class Phase5ControlPlane {
             publishProcedureTransition: (state) => this.publishProcedureTransition(state),
         });
     }
-    notifyScratchpadSourceChanged() {
+    notifyScratchpadSourceChanged(message) {
+        if (!shouldUseMessageAsScratchpadSource(message)) {
+            return;
+        }
         this.scratchpadAutoRefreshScheduler.notifySourceChanged();
     }
     refreshProjectBrief(options) {
@@ -169,8 +174,26 @@ export class Phase5ControlPlane {
     }
     startReferenceSummaryRefresh(payload = {}) {
         if (payload.paths === undefined) {
-            this.pendingAllReferenceSummaries = true;
+            this.pendingAllReferenceSummaries = false;
             this.pendingReferenceSummaryPaths.clear();
+            if (this.projectContext === undefined) {
+                this.pendingAllReferenceSummaries = true;
+            }
+            else {
+                try {
+                    for (const target of readReferenceSummaryTargets({
+                        workspaceRoot: this.projectContext.workspaceRoot,
+                        now: this.now,
+                    })) {
+                        this.pendingReferenceSummaryPaths.add(target.path);
+                    }
+                }
+                catch (error) {
+                    if (!(error instanceof WorkspaceOpsError && error.code === "not_found")) {
+                        throw error;
+                    }
+                }
+            }
         }
         else {
             for (const path of payload.paths) {
@@ -192,6 +215,11 @@ export class Phase5ControlPlane {
             projectContext: this.projectContext,
             logger: this.logger,
             now: this.now,
+            onTargetsPersisted: (targets) => {
+                for (const target of targets) {
+                    this.pendingReferenceSummaryPaths.delete(target.path);
+                }
+            },
             publishProcedureTransition: (state) => this.publishProcedureTransition(state),
         });
         if (result.disposition.kind !== "already_running") {

package/dist/control-plane/reference-summary-refresh.d.ts

@@ -3,6 +3,7 @@ import type { RefreshReferenceSummariesDisposition, RefreshReferenceSummariesRes
 import type { ProcedureEngine, ProcedureEngineState } from "../procedure-engine/index.js";
 import type { WorkspaceEventBus } from "../server-shell/http/workspace-events.js";
 import type { HostProjectStore } from "../store/index.js";
+import { type ReferenceSummaryTarget } from "../workspace-ops/index.js";
 import type { ControlPlaneCommandResult, ControlPlaneLogger, Phase5ControlPlaneOptions } from "./types.js";
 import type { ProcedureWorkflowRunnerResolver } from "./workflows/index.js";
 export declare function startReferenceSummaryRefreshProcedure(input: {
@@ -21,6 +22,7 @@ export declare function startReferenceSummaryRefreshProcedure(input: {
         activityRef: ActivityRef;
         workflowRef: WorkflowInvocationRef;
     }) => void;
+    onTargetsPersisted?: (targets: ReferenceSummaryTarget[]) => void;
     publishProcedureTransition: (state: ProcedureEngineState) => void;
 }): ControlPlaneCommandResult<RefreshReferenceSummariesDisposition, RefreshReferenceSummariesResult>;
 //# sourceMappingURL=reference-summary-refresh.d.ts.map

package/dist/control-plane/reference-summary-refresh.js

@@ -135,6 +135,7 @@ async function runReferenceSummaryRefresh(options) {
         if (result.commit_oid !== undefined) {
             lastCommitOid = result.commit_oid;
         }
+        options.onTargetsPersisted?.(batch);
         targets = readTargets({
             projectContext: options.projectContext,
             now: options.now,
@@ -379,6 +380,9 @@ export function startReferenceSummaryRefreshProcedure(input) {
                 events: input.events,
                 logger: input.logger,
                 reportProgress: context.reportProgress,
+                ...(input.onTargetsPersisted === undefined
+                    ? {}
+                    : { onTargetsPersisted: input.onTargetsPersisted }),
                 now: input.now,
             });
         },

package/dist/providers/openai/app-server/json-rpc.js

@@ -1,5 +1,6 @@
 import { StringDecoder } from "node:string_decoder";
 import { redactText } from "@tutti/shared/utils";
+const PROCESS_EXIT_STDERR_EXCERPT_MAX_LENGTH = 500;
 export class CodexAppServerProtocolError extends Error {
     code;
     constructor(message, code) {
@@ -21,6 +22,16 @@ function normalizeProtocolError(method, error) {
     const message = typeof rawMessage === "string" ? redactText(rawMessage) : "protocol_error";
     return new CodexAppServerProtocolError(`Codex app-server request failed: ${method}: ${code}: ${message}`, "request_failed");
 }
+function processExitStderrExcerpt(value) {
+    const normalized = redactText(value).replace(/\s+/gu, " ").trim();
+    if (normalized.length === 0) {
+        return "";
+    }
+    if (normalized.length <= PROCESS_EXIT_STDERR_EXCERPT_MAX_LENGTH) {
+        return normalized;
+    }
+    return `${normalized.slice(0, PROCESS_EXIT_STDERR_EXCERPT_MAX_LENGTH)}...`;
+}
 export class CodexAppServerJsonRpcClient {
     child;
     options;
@@ -47,7 +58,8 @@ export class CodexAppServerJsonRpcClient {
         });
         child.on("exit", (code, signal) => {
             this.closed = true;
-            this.rejectAll(new CodexAppServerProtocolError(`Codex app-server exited before request completed: code=${code ?? "null"} signal=${signal ?? "null"}`, "process_exited"));
+            const stderrExcerpt = processExitStderrExcerpt(this.stderrText);
+            this.rejectAll(new CodexAppServerProtocolError(`Codex app-server exited before request completed: code=${code ?? "null"} signal=${signal ?? "null"}${stderrExcerpt === "" ? "" : ` stderr=${stderrExcerpt}`}`, "process_exited"));
         });
         child.on("error", (error) => {
             this.closed = true;

package/dist/providers/openai/app-server/linux-sandbox-readiness.js

@@ -2,7 +2,7 @@ import { spawnSync } from "node:child_process";
 import { mkdirSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { CODEX_APP_SERVER_COMMAND } from "../codex-app-server.js";
+import { buildCodexCliProcessPlan } from "../codex-app-server.js";
 import { createCodexSpawnEnv } from "./runtime-helpers.js";
 const DEFAULT_PROBE_TIMEOUT_MS = 10_000;
 export const CODEX_LINUX_SANDBOX_GUIDANCE = "Install bubblewrap. On Ubuntu 24.04, also install apparmor-profiles and apparmor-utils and load the distribution bwrap-userns-restrict profile. Then run `tutti doctor` again.";
@@ -74,9 +74,12 @@ export function inspectCodexLinuxSandboxReadiness(options = {}) {
         const codexHome = join(tempRoot, "codex-home");
         mkdirSync(codexHome, { recursive: true, mode: 0o700 });
         const runProbe = options.runProbe ?? defaultProbeRunner;
-        return classifyProbeResult(runProbe({
-            command: options.codexCommand ?? CODEX_APP_SERVER_COMMAND,
+        const processPlan = buildCodexCliProcessPlan({
             args: ["sandbox", "--", "/bin/true"],
+            ...(options.codexCommand === undefined ? {} : { codexCommand: options.codexCommand }),
+        });
+        return classifyProbeResult(runProbe({
+            ...processPlan,
             cwd: tempRoot,
             env: createCodexSpawnEnv(codexHome, options.baseEnv ?? process.env),
             timeoutMs: options.timeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS,

package/dist/providers/openai/app-server/read-only-procedure.js

@@ -120,9 +120,9 @@ export async function runCodexAppServerReadOnlyProcedure(options) {
     const processPlan = buildCodexAppServerProcessPlan({
         codexHome,
         configOverrides: buildCodexAppServerProviderConfigOverrides(options),
+        ...(options.codexCommand === undefined ? {} : { codexCommand: options.codexCommand }),
     });
-    const command = options.codexCommand ?? processPlan.command;
-    const child = spawn(command, processPlan.args, {
+    const child = spawn(processPlan.command, processPlan.args, {
         cwd: process.cwd(),
         env: createCodexSpawnEnv(codexHome, options.baseEnv ?? process.env),
         stdio: "pipe",

package/dist/providers/openai/app-server/smoke.js

@@ -25,9 +25,9 @@ export async function runCodexAppServerNoWriteSmoke(options) {
     const processPlan = buildCodexAppServerProcessPlan({
         codexHome,
         configOverrides: buildCodexAppServerProviderConfigOverrides(options),
+        ...(options.codexCommand === undefined ? {} : { codexCommand: options.codexCommand }),
     });
-    const command = options.codexCommand ?? processPlan.command;
-    const child = spawn(command, processPlan.args, {
+    const child = spawn(processPlan.command, processPlan.args, {
         cwd: process.cwd(),
         env: createCodexSpawnEnv(codexHome, options.baseEnv ?? process.env),
         stdio: "pipe",

package/dist/providers/openai/app-server/workspace-write-run.js

@@ -196,9 +196,9 @@ export async function runCodexAppServerWorkspaceWriteRun(options) {
     const processPlan = buildCodexAppServerProcessPlan({
         codexHome,
         configOverrides: buildCodexAppServerProviderConfigOverrides(options),
+        ...(options.codexCommand === undefined ? {} : { codexCommand: options.codexCommand }),
     });
-    const command = options.codexCommand ?? processPlan.command;
-    const child = spawn(command, processPlan.args, {
+    const child = spawn(processPlan.command, processPlan.args, {
         cwd: process.cwd(),
         env: createCodexSpawnEnv(codexHome, options.baseEnv ?? process.env),
         stdio: "pipe",

package/dist/providers/openai/codex-app-server.d.ts

@@ -1,3 +1,4 @@
+export declare const CODEX_APP_SERVER_ENTRYPOINT: string;
 export declare const CODEX_APP_SERVER_COMMAND: string;
 export declare const CODEX_APP_SERVER_LISTEN_URL: "stdio://";
 export declare const CODEX_APP_SERVER_CLIENT_NAME: "tutti_host";
@@ -73,8 +74,13 @@ export type CodexAppServerTurnStartTemplatePlan = {
 };
 export type BuildCodexAppServerProcessPlanOptions = {
     codexHome: string;
+    codexCommand?: string;
     configOverrides?: readonly CodexAppServerConfigOverride[];
 };
+export type CodexCliProcessPlan = {
+    command: string;
+    args: string[];
+};
 export type CodexAppServerNoWriteSmokePlan = {
     process: CodexAppServerProcessPlan;
     initialize: CodexAppServerRequestPlan<"initialize", CodexAppServerInitializeRequestParams>;
@@ -107,6 +113,10 @@ export declare const CODEX_NO_WRITE_SMOKE_OUTPUT_SCHEMA: {
 export declare function createCodexAppServerProcessEnv(options: {
     codexHome: string;
 }): Record<string, string>;
+export declare function buildCodexCliProcessPlan(options: {
+    args: readonly string[];
+    codexCommand?: string;
+}): CodexCliProcessPlan;
 export declare function buildCodexAppServerProcessPlan(options: BuildCodexAppServerProcessPlanOptions): CodexAppServerProcessPlan;
 export declare function createCodexAppServerNoWriteSmokePlan(options: CodexNoWriteSmokePlanOptions): CodexAppServerNoWriteSmokePlan;
 export declare class CodexAppServerJsonlParseError extends Error {

package/dist/providers/openai/codex-app-server.js

@@ -2,7 +2,8 @@ import { createRequire } from "node:module";
 import { dirname, isAbsolute, join } from "node:path";
 import { DEFAULT_OPENAI_MODEL } from "./model-config.js";
 const require = createRequire(import.meta.url);
-export const CODEX_APP_SERVER_COMMAND = join(dirname(require.resolve("@openai/codex/package.json")), "bin", "codex.js");
+export const CODEX_APP_SERVER_ENTRYPOINT = join(dirname(require.resolve("@openai/codex/package.json")), "bin", "codex.js");
+export const CODEX_APP_SERVER_COMMAND = process.execPath;
 export const CODEX_APP_SERVER_LISTEN_URL = "stdio://";
 export const CODEX_APP_SERVER_CLIENT_NAME = "tutti_host";
 export const CODEX_APP_SERVER_CLIENT_TITLE = "Tutti Host";
@@ -37,12 +38,28 @@ export function createCodexAppServerProcessEnv(options) {
         CODEX_HOME: options.codexHome,
     };
 }
-export function buildCodexAppServerProcessPlan(options) {
-    const args = ["app-server", "--listen", CODEX_APP_SERVER_LISTEN_URL];
-    pushConfigOverrides(args, options.configOverrides ?? []);
+export function buildCodexCliProcessPlan(options) {
+    if (options.codexCommand !== undefined) {
+        assertNonEmpty(options.codexCommand, "codexCommand");
+        return {
+            command: options.codexCommand,
+            args: [...options.args],
+        };
+    }
     return {
         command: CODEX_APP_SERVER_COMMAND,
-        args,
+        args: [CODEX_APP_SERVER_ENTRYPOINT, ...options.args],
+    };
+}
+export function buildCodexAppServerProcessPlan(options) {
+    const codexArgs = ["app-server", "--listen", CODEX_APP_SERVER_LISTEN_URL];
+    pushConfigOverrides(codexArgs, options.configOverrides ?? []);
+    const processPlan = buildCodexCliProcessPlan({
+        args: codexArgs,
+        ...(options.codexCommand === undefined ? {} : { codexCommand: options.codexCommand }),
+    });
+    return {
+        ...processPlan,
         env: createCodexAppServerProcessEnv({ codexHome: options.codexHome }),
         transport: {
             kind: "stdio",

package/dist/server-shell/cli/host-server-runtime.js

@@ -283,7 +283,7 @@ export async function startForegroundHostServer(options) {
                 return await resolution.model.answer(input);
             },
         },
-        onScratchpadSourceChanged: () => controlPlane.notifyScratchpadSourceChanged(),
+        onScratchpadSourceChanged: (message) => controlPlane.notifyScratchpadSourceChanged(message),
         now,
     });
     let close = async () => { };

package/dist/server-shell/http/routes/project-api/messages-routes.js

@@ -71,7 +71,7 @@ export function registerMessagesRoutes(app, { options, workspaceEvents, }) {
                 },
                 invalidates: mainChatMessageInvalidates(),
             });
-            options.controlPlane?.notifyScratchpadSourceChanged();
+            options.controlPlane?.notifyScratchpadSourceChanged(execution.result.message);
             options.chatAssistant?.enqueue({ message: execution.result.message });
         }
         return response;

package/dist/server-shell/http/routes/project-api/reference-files-routes.js

@@ -137,7 +137,7 @@ export function registerReferenceFilesRoutes(app, { options, workspaceEvents, })
                     },
                     invalidates,
                 });
-                options.controlPlane?.notifyScratchpadSourceChanged();
+                options.controlPlane?.notifyScratchpadSourceChanged(execution.result.message);
                 options.controlPlane?.startReferenceSummaryRefresh({
                     paths: [execution.result.file.path],
                 });

package/dist/server-shell/local-console/invocation-context.d.ts

@@ -19,10 +19,12 @@ export declare function createDesktopLocalConsoleInvocationContext(options: {
 export declare function createLocalConsoleServiceEnvironment(options: {
     env: NodeJS.ProcessEnv;
     tuttiHome: string;
+    runtimeExecutablePath?: string;
 }): NodeJS.ProcessEnv;
 export declare function createLocalConsoleOperationEnvironment(options: {
     serviceEnvironment: NodeJS.ProcessEnv;
     invocationEnvironment: LocalConsoleInvocationEnvironment;
     tuttiHome: string;
+    runtimeExecutablePath?: string;
 }): NodeJS.ProcessEnv;
 //# sourceMappingURL=invocation-context.d.ts.map

package/dist/server-shell/local-console/invocation-context.js

@@ -1,4 +1,4 @@
-import { resolve } from "node:path";
+import { delimiter, dirname, resolve } from "node:path";
 export const LOCAL_CONSOLE_INVOCATION_ENV_KEYS = [
     "DBUS_SESSION_BUS_ADDRESS",
     "DISPLAY",
@@ -12,6 +12,12 @@ export const LOCAL_CONSOLE_INVOCATION_ENV_KEYS = [
     "WAYLAND_DISPLAY",
     "XDG_CURRENT_DESKTOP",
 ];
+function mergeExecutablePaths(values, runtimeExecutablePath) {
+    const entries = [dirname(runtimeExecutablePath), ...values.flatMap((value) => value?.split(delimiter) ?? [])]
+        .map((entry) => entry.trim())
+        .filter((entry) => entry !== "");
+    return [...new Set(entries)].join(delimiter);
+}
 export function collectLocalConsoleInvocationEnvironment(env) {
     const environment = {};
     for (const key of LOCAL_CONSOLE_INVOCATION_ENV_KEYS) {
@@ -52,12 +58,15 @@ export function createLocalConsoleServiceEnvironment(options) {
             environment[key] = value;
         }
     }
+    environment.PATH = mergeExecutablePaths([environment.PATH], options.runtimeExecutablePath ?? process.execPath);
     return environment;
 }
 export function createLocalConsoleOperationEnvironment(options) {
+    const executablePath = mergeExecutablePaths([options.invocationEnvironment.PATH, options.serviceEnvironment.PATH], options.runtimeExecutablePath ?? process.execPath);
     return {
         ...options.serviceEnvironment,
         ...options.invocationEnvironment,
+        PATH: executablePath,
         TUTTI_HOME: options.tuttiHome,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xfey/tutti",
-  "version": "0.1.68",
+  "version": "0.1.70",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/prompts/procedures/README.md

@@ -9,19 +9,19 @@
 - `task-compile.md`：使用 Codex app-server read-only adapter，根据直接输入的 Scratchpad / Worklist 与按需读取的项目上下文文件生成追加式 task compile proposal，或请求 workflow-bound clarification；执行面仅为 app-server read-only。
 - `project-context-bootstrap.md`：使用 Codex app-server read-only adapter 为缺失 baseline context files 生成完整文件内容计划；实际写入和 commit 由 `workspace-ops` 受控完成。
 - `context-sync.md`：使用 Codex app-server read-only adapter 生成文档同步更新计划；实际文件写入和 commit 由 `workspace-ops` 受控完成。
-- `reference-file-summary.md`：使用 Codex app-server read-only adapter 读取单个 reference 文件并生成简短 summary 或 unavailable reason；实际 README summary 索引写入和 commit 由 `workspace-ops` 受控完成。
+- `reference-file-summary.md`：使用 Codex app-server read-only adapter 读取单个 reference 文件并生成“包含什么”的抽象 summary；不复现原句、表格行、个人信息、标识符或 secret-like value，正文敏感本身不构成 unavailable，只有无法访问、解码或理解才返回该分支。实际 README summary 索引写入和 commit 由 `workspace-ops` 受控完成。
 - `follow-up-check.md`：在 task-bound clarification submit 后判断同一 task 契约能否继续，返回 `resume` / `needs_more_input` / `requires_retasking`。
 
 `project_context_bootstrap` 的 provider path 只让 Codex app-server read-only adapter 生成缺失文档内容；如果该计划不可用，Control Plane 会回退到本地保守模板。
 `project_context_bootstrap` 的 read-only 输入只包含项目名、非空时的 `missing_docs` 与刷新后的 Scratchpad；prompt 会要求 app-server 只读探索仓库，并可通过 `read-project-docs` / `read-references` skill 按需读取现有文档和参考文件。输出只包含 `documents[].doc_key/content`，固定 path 由 Control Plane 后处理生成。
-`task_compile` 的 read-only 输入只包含 durable context 固定的五字段 Scratchpad、当前 Worklist、可选 compact `recent_references` 和可选完整有序 `clarification_rounds`；reference 项只含 path、最终 name 与 available/unavailable summary，不含 blob/message/workflow audit fields。每次 continuation 仍读取同一 pinned Scratchpad 与 source set，不读取并行变化的 Current Scratchpad或 boundary 后的新上传；later round 可以纠正 earlier round，明确撤回时允许空 proposal 正常结束。prompt 暴露 `read-project-docs` / `read-worklist` / `read-references` skills 供 app-server 必要时读取项目上下文文件、既有任务 contract / latest result 或相关 reference 正文；Scratchpad 和 Worklist 紧凑视图仍以直接输入为准，不通过 skill 重读 Scratchpad。provider raw output 使用 `{ result: ... }` 互斥分支；proposal 分支用 `module_ref` 指向新模块或既有模块，task 只输出 `title / goal / scope`，runner adapter 再映射为 Control Plane 内部 proposal：`goal` 同时作为内部 task summary 和 contract goal，`scope` 作为内部 contract scope。
+`task_compile` 的 read-only 输入只包含 durable context 固定的五字段 Scratchpad、当前 Worklist、可选 compact `recent_references` 和可选完整有序 `clarification_rounds`；reference 项只含 path、最终 name 与 available/unavailable summary，不含 blob/message/workflow audit fields。每次 continuation 仍读取同一 pinned Scratchpad 与 source set，不读取并行变化的 Current Scratchpad或 boundary 后的新上传；later round 可以纠正 earlier round，明确撤回时允许空 proposal 正常结束。prompt 暴露 `read-project-docs` / `read-worklist` / `read-references` skills 供 app-server 必要时读取项目上下文文件、既有任务 contract / latest result 或相关 reference 正文；拟议工作实质依赖 reference 时必须在冻结 contract 前读取 source，不以 summary 替代原文。只有现有上下文支持一个 coherent formal contract 时才 proposal；重大歧义或冲突若必须替用户选择意图，则请求最少 clarification，低影响、可逆或已有 convention 覆盖的细节继续写成有界假设。Scratchpad 和 Worklist 紧凑视图仍以直接输入为准，不通过 skill 重读 Scratchpad。provider raw output 使用 `{ result: ... }` 互斥分支；proposal 分支用 `module_ref` 指向新模块或既有模块，task 只输出 `title / goal / scope`，runner adapter 再映射为 Control Plane 内部 proposal：`goal` 同时作为内部 task summary 和 contract goal，`scope` 作为内部 contract scope。
 `context_sync` 没有 provider-facing direct input；workflow ref、activity ref、触发原因、安全元数据、checked paths、skipped paths 和 open questions 都不进入 prompt，只用于运行时追踪、调度或审计。prompt 说明通用文档同步目标、目标项目文档落点和 canonical docs 职责，由 app-server 主动探索 repo，并通过 `read-project-docs` / `read-worklist` / `read-references` skill 按需读取现有文档、正式任务上下文和参考文件。Worklist / task result 只作为阶段性完成背景和稳定结果线索，不写成长文档里的逐任务流水。
 `context_sync` prompt 只返回 `summary` 与 `updates[].path/content`；空 `updates` 表示无需同步，非空 `updates` 由 Control Plane 调用 `workspace-ops` 做 path policy、mainline clean 检查、文件写入和 Git commit。
 `project_brief_refresh` 只走 OpenAI SDK structured output，不使用 Codex app-server，不读取 repo 或 skills。它接收四个 baseline Project Docs 的 bounded source 内容与状态，输出 `product_summary / tech_summary / structure_summary / principles_summary`，由 Control Plane 写入 host-local `project_brief` projection；Project Docs 创建、同步、被成功 Run promotion 修改，或 provider setup 后需要 backfill 时可以触发。provider 不可用、source 不可用、brief 已经 fresh 或刷新失败都不影响 Project Docs 写入结果。
 `reference_summary_refresh` 不接收 provider-facing workflow input。Control Plane 内部保留 workflow / activity trace anchors 与单个 reference file metadata 用于定位、审计和写回；runner 会把目标文件复制到一个临时目录，并以该目录作为 app-server `cwd`，prompt 只说明读取当前目录中的唯一目标文件、禁用写入和网络，并返回 bounded structured summary 输出。
 Phase 6.5 的 reference upload message 可以作为普通聊天事实进入 `scratchpad_refresh`，但 prompt 明确禁止模型在未读取文件的情况下推断文件正文。
 `scratchpad_refresh` 与 `task_compile` 在压缩上下文时应保留任务执行和验收必需的用户提供细节。`scratchpad_refresh` 读取当前周期完整、有序的主群聊 `messages`，并按 `messages > active_task_compile > worklist > project_brief` 理解上下文；只有 `messages` 可以产生新的 `task_changes`。每条超长消息先做保留头尾的中间截断，再合并连续作者；不得静默删除较早消息。需要排除的是 secret、provider 细节、raw log 和 Tutti runtime / internal path。
-`follow_up_check` 的 provider-facing 输入只包含展平后的 `title / goal / scope`、上一 `Run.needs_human` 的 `summary`、原 `clarification_request_payload` 和压缩后的 `answers[]`；workflow ref、task id/status、activity ref、result kind、Run lineage、message id、作者 identity 和时间戳不进入 prompt。provider raw output 使用 `{ result: ... }` 互斥分支，只输出 `resume.summary`、`needs_more_input.{title,summary,request}` 或 `requires_retasking.summary`；runner adapter 再映射为 Control Plane 内部 outcome。控制面负责把 `resume`、`needs_more_input`、`requires_retasking` 分别物化为 continuation、下一轮 round 或 retasking-required closure。`Run.failed` / `Task.failed` 当前不再通过 follow-up retry 复活。
+`follow_up_check` 的 provider-facing 输入只包含展平后的 `title / goal / scope`、上一 `Run.needs_human` 的 `summary`、原 `clarification_request_payload` 和压缩后的 `answers[]`；workflow ref、task id/status、activity ref、result kind、Run lineage、message id、作者 identity 和时间戳不进入 prompt。它只判断原 human decision 是否在同一 frozen contract 内解决：已解决为 `resume`，同一决策仍可在 contract 内补充为 `needs_more_input`，采纳回答会改变 goal / scope 为 `requires_retasking`；不得请求 Run 自己负责的实现选择。provider raw output 使用 `{ result: ... }` 互斥分支，runner adapter 再映射为 Control Plane 内部 outcome。控制面负责把三个结果分别物化为 continuation、下一轮 round 或 retasking-required closure。`Run.failed` / `Task.failed` 当前不再通过 follow-up retry 复活。
 
 ## 输入变量
 

package/prompts/procedures/follow-up-check.md

@@ -33,11 +33,13 @@ Fields:
 # Decision Rules
 
 - Use only `workflow_input_json`; do not inspect files, repository state, Worklist, Scratchpad, references, Project Docs, or external context.
-- Treat `goal` and `scope` as the frozen task contract, `previous_run.summary` and `previous_run.clarification_request_payload` as the blocker, and `answers` as the submitted human reply.
-- Return `resume` when the answers provide enough non-secret context or confirmation to continue the same task.
-- Return `needs_more_input` when the task contract is still valid but the answers do not resolve the blocker.
-- Return `requires_retasking` when the answers change the goal or scope enough that the current task should not continue.
+- Treat `goal` and `scope` as the frozen task contract, `previous_run.summary` and `previous_run.clarification_request_payload` as the identified human decision, and `answers` as the submitted human reply.
+- Evaluate only whether the answers resolve that decision within the same frozen task contract.
+- Return `resume` when the blocker is resolved without changing the contract.
+- Return `needs_more_input` when the same human decision remains unresolved but can still be answered within the contract.
+- Return `requires_retasking` when honoring the answers would change the task's goal or scope.
 - Treat user-provided non-secret details in answers as valid continuation context when they resolve the blocker.
+- Do not request decisions about implementation choices that remain the Run's responsibility.
 - Do not patch the task contract, create tasks, suggest Worklist edits, or ask for credentials, secrets, deployment tokens, cookies, or Tutti runtime/internal paths.
 
 # Output

package/prompts/procedures/reference-file-summary.md

@@ -18,10 +18,10 @@ You summarize one human-uploaded Tutti reference file.
 # Task
 
 - Read only the single target file in the current directory, and do not inspect parent directories or unrelated files.
-- Summarize the stable user-provided content in one concise sentence under 400 characters, based on content you can access and understand rather than guessed metadata.
-- For structured or tabular content, summarize the subject and notable structure at a high level; do not dump rows or large excerpts.
-- Return `unavailable` with a brief natural-language reason if the file cannot be accessed, decoded, understood, or safely summarized.
-- If the file appears to contain credentials, private keys, tokens, `.env`-style secrets, or other sensitive material, return `unavailable` without quoting the content.
+- Describe what the file contains in one concise sentence under 400 characters, based on content you can access and understand rather than guessed metadata.
+- Keep the description abstract: identify the subject, information types, notable structure, and apparent purpose without reproducing source sentences, rows, personal details, identifiers, or secret-like values.
+- If the file contains sensitive material, describe only its general category and purpose without exposing values or quoting the content. Content sensitivity alone does not make a summary unavailable.
+- Return `unavailable` with a brief natural-language reason only if the file cannot be accessed, decoded, or understood well enough to describe what it contains.
 - Do not edit files, stage files, commit, install dependencies, run builds, run tests, start dev servers, deploy, perform network lookups, or include local absolute paths, provider details, host paths, cookies, or tokens.
 
 # Output

package/prompts/procedures/task-compile.md

@@ -27,7 +27,7 @@ You compile Tutti's Scratchpad into an append-only Worklist proposal for post-ba
 - Treat the provided Scratchpad and Worklist as authoritative. Do not use skills to reread them.
 - Use `read-worklist` only when an existing task's contract or latest result would clarify the current task's subject, boundary, or delivery relationship. Do not duplicate tasks already covered by the Worklist.
 - Use `read-project-docs` or `read-references` only when task scope, acceptance, product intent, technical stack, repo structure, agent working rules, or reference contents matter and are not clear from direct input.
-- Use recent references when they materially inform the proposed work, and read the source when its summary is insufficient to freeze the task contract.
+- When proposed work materially depends on a recent reference, read the relevant source before freezing the task contract; do not rely on its summary alone.
 - Preserve user-provided non-secret details when they are needed to execute or accept the task. Do not generalize them into vague labels.
 - Do not use web search, credentials, provider internals, raw logs, or Tutti runtime/internal paths.
 
@@ -44,11 +44,11 @@ When the Scratchpad clearly asks for one of these direct deliverables, include a
 
 # Readiness
 
-Return a `proposal` when you can freeze formal tasks without making a high-impact hidden assumption for the users. Missing low-impact details, reversible choices, and established project conventions should usually become bounded assumptions or notes inside task `scope`, not clarification.
+Return a `proposal` only when the available context supports one coherent formal task contract without making a high-impact choice for the users. Treat an unresolved material ambiguity or conflict as a missing decision when resolving it would require choosing the users' intent; ask the minimum clarification needed instead of turning that choice into an assumption. Missing low-impact details, reversible choices, and established project conventions should usually become bounded assumptions or notes inside task `scope`, not clarification.
 
 Return `clarification_request_payload` only when all are true:
 
-- The missing decision would materially change goal, scope, user-visible behavior, visual or interaction direction, technical shape, data or asset source, acceptance criteria, safety boundary, or external side effect.
+- Resolving the issue would materially change goal, scope, user-visible behavior, visual or interaction direction, technical shape, data or asset source, acceptance criteria, safety boundary, or external side effect.
 - Scratchpad, Worklist, Project Docs, repo facts, and relevant references do not answer it.
 - Guessing would likely cause rework, risk, or user surprise.
 - A concise human answer can unblock task creation.

package/prompts/runs/README.md

@@ -7,12 +7,12 @@ These templates are used by task `Run` execution.
 - `task-retry.md` is rendered for bounded Run pipeline self-correction retries after feedback such as no candidate diff before or after checks, Artifact validation failure, failed checks, or accepted-checkpoint failure. It is not a failed-task follow-up path and does not resurrect `Task.failed`.
   Templates in this directory may describe task contracts, repo evidence, check expectations, artifact declaration rules, and documentation update responsibilities. They must never include provider credentials or host-local secret material.
 
-`task-run.md` allows `needs_human` only for human requirement decisions, non-secret context, or risk confirmation. Unusable candidates, ordinary missing diffs, or repo/tooling errors that prevent implementation should be returned as `failed` so the Run does not open task-bound clarification incorrectly. If the task contract does not require repository file changes, the output can use `completed_no_repo_changes`; otherwise a completed implementation is expected to produce a candidate diff. If the candidate is complete but Codex self-validation commands are unavailable or blocked, the task-run output should still be `completed`; Tutti checks are the authoritative validation gate.
+`task-run.md` keeps implementation judgment inside the frozen contract with Codex. Human clarification is reserved for interpreting contract intent, choosing among incompatible requirements or source facts, supplying required non-secret context, relaxing an explicit constraint, or accepting a material risk or external effect. Technical difficulty, tooling failure, and validation failure stay with the Run when they can be handled; otherwise the result is `failed`, not a question for the user. If the task contract does not require repository file changes, the output can use `completed_no_repo_changes`; otherwise a completed implementation is expected to produce a candidate diff. If the candidate is complete but Codex self-validation commands are unavailable or blocked, the task-run output should still be `completed`; Tutti checks are the authoritative validation gate.
 Initial `task-run.md`, active `task-continuation.md`, and active pipeline `task-retry.md` receive the compact task contract fields `title / goal / scope` plus optional receipt-derived `recent_references`; each reference includes only path, final name and available/unavailable summary. Continuation adds the required `continuation` block, and pipeline self-correction retry adds the required `correction` block with the previous failure summary, machine-generated reason code, correction guidance, a required redacted / bounded diagnostic, and `promotion_failure` as either a complete object or explicit `null`. Provider transient retry and self-correction both preserve the same reference context. Provider-facing prompts do not receive task ids, task summaries, Run lineage, workflow anchors, blob ids, message ids, changed paths, docs status, checks status, or the safety audit context entry.
 All three Run templates use a slim mutually exclusive structured output schema under `result`: exactly one of `completed.{summary,user_note_candidate}`, `completed_no_repo_changes.{summary,user_note_candidate}`, `needs_human.{title,summary,request}`, or `failed.summary`. The `summary` is a concise, human-readable result note for project members who may not inspect the code. Completed branches also require `user_note_candidate`, which is either a short user-facing final-card sentence or `null`; it must not repeat `summary` or include file paths. Checks, docs, promotion, changed paths, and other Tutti status stay in structured fields derived by the Run pipeline. They do not ask Codex to self-report docs status or changed paths; both come from Run pipeline Git diff and derived projection.
 Run templates describe `docs/reference/` as a user-visible file exchange area. Human uploads remain under `docs/reference/files/` and `docs/reference/images/`; `docs/reference/tutti/**` is for Tutti-generated files intended for direct member review in References, not temporary output, internal notes, logs, or canonical project documentation. Generated user-visible files must be written under `docs/reference/tutti/`, with `docs/reference/tutti/<meaningful-folder>/...` used when the folder name should be shown as a References UI group. Generated files under `docs/reference/tutti/` are discovered from promoted changed paths, rendered by References automatically, and may be listed in completed task result cards.
 Initial `task-run.md`, active `task-continuation.md`, and active pipeline `task-retry.md` also instruct Codex to write or update the single active `tutti.artifact.json` manifest only when the task creates or updates a member-viewable visual artifact. Each template includes the complete strict static and server JSON shapes: every behavior field is required, `network` is always an explicit boolean, and server `script / ready_path / port` fields are forbidden. A server package instead declares the fixed `artifact:preview` npm script in its own `package.json` and listens on the injected `HOST / PORT`. The manifest remains repo truth and is not reported through the structured output schema.
-Active task-bound follow-up still only starts continuation Runs from `Run.needs_human`. Pipeline self-correction retry happens before a terminal Run result is recorded and does not open clarification.
+Active task-bound follow-up still only starts continuation Runs from `Run.needs_human`. `follow_up_check` resumes when the identified human decision is resolved in the same contract, asks for more input only while that same decision remains unresolved, and requires retasking when honoring the answer would change goal or scope; it does not delegate Run-owned implementation choices. Continuation applies the same Run boundary after considering the answers and never repeats a resolved question. Pipeline self-correction retry happens before a terminal Run result is recorded; it treats correction as machine feedback, repairs it inside the frozen contract by default, and only returns `needs_human` when the feedback exposes a genuinely unresolved human decision under the normal Run boundary.
 All three templates state that cwd is the persistent project workspace, may contain unaccepted source and project-local runtime/dependency state from earlier failed attempts, and must not be reset, checked out, stashed, cleaned, or otherwise discarded. Continuation, provider transient retry, and self-correction reuse that same directory and accumulated state.
 All three templates require a final Git status inspection and make the Agent responsible for maintaining the repository's own `.gitignore` according to project conventions. They do not prescribe runtime path names or force intentional generated source out of Git.
 

package/prompts/runs/task-continuation.md

@@ -35,7 +35,7 @@ Use `continuation` to understand:
 - what humans answered;
 - why `follow_up_check` allowed this task to resume.
 
-Human clarification answers may clarify or confirm work inside the frozen task contract. They must not expand `goal` or `scope` into a new task. If `continuation` is missing or does not contain the needed human answer, return `failed` rather than inventing context.
+Human clarification answers may clarify or confirm work inside the frozen task contract. They must not expand `goal` or `scope` into a new task. If `continuation` is missing or structurally incomplete, return `failed` rather than inventing context.
 
 # Execution Boundary
 
@@ -49,7 +49,7 @@ Human clarification answers may clarify or confirm work inside the frozen task c
 - Before returning, inspect the final Git status. Maintain the repository's own `.gitignore` for project-local state that should not be versioned, following existing project conventions; keep files Git-visible when they are intentional versioned source. Do not assume fixed runtime path names.
 - Prefer small, reviewable changes that preserve existing style and tests.
 
-If the formal task contract plus submitted clarification is still insufficient, return `needs_human` only for a human requirement decision, non-secret context, or risk confirmation. Return `failed` when no usable candidate can be produced.
+Apply the same human-decision boundary after considering the submitted clarification. Do not repeat a resolved question. Return `needs_human` only when the answer remains materially insufficient for the same frozen contract or execution reveals a distinct unresolved human decision. Use implementation judgment for choices that remain inside the contract; return `failed` when no usable candidate can be produced.
 
 # Context Access
 

package/prompts/runs/task-retry.md

@@ -57,7 +57,7 @@ Correct the existing candidate in place, using `correction.summary`, `correction
 - Before returning, inspect the final Git status. Maintain the repository's own `.gitignore` for project-local state that should not be versioned, following existing project conventions; keep files Git-visible when they are intentional versioned source. Do not assume fixed runtime path names.
 - Prefer small, reviewable changes that preserve existing style and tests.
 
-Human clarification is not available as an interactive step inside this retry. If the formal task contract itself is insufficient, return `needs_human` with one concrete, non-secret question. Return `failed` when no usable candidate can be produced.
+Treat correction feedback as a machine-reported implementation problem, not as new task context. Correct it without human input when possible within the frozen contract. If it exposes an unresolved human decision under the normal Run boundary, return `needs_human` with the minimum concrete, non-secret question; do not treat correction feedback as permission to change the task's intent or constraints. Return `failed` when no usable candidate can be produced and no human decision can unblock it.
 
 # Context Access