comisai 1.0.19 → 1.0.23

package/node_modules/@comis/agent/dist/context-engine/context-engine.js

@@ -18,6 +18,8 @@
 import { LAYER_CIRCUIT_BREAKER_THRESHOLD, CHARS_PER_TOKEN_RATIO, DEFAULT_COMPACTION_PREFIX_ANCHOR_TURNS } from "./constants.js";
 import { computeTokenBudget } from "./token-budget.js";
 import { createThinkingBlockCleaner } from "./thinking-block-cleaner.js";
+import { createSignatureReplayScrubber } from "./signature-replay-scrubber.js";
+import { createSignatureSurrogateGuard } from "./signature-surrogate-guard.js";
 import { createReasoningTagStripper } from "./reasoning-tag-stripper.js";
 import { createHistoryWindowLayer } from "./history-window.js";
 import { createObservationMaskerLayer } from "./observation-masker.js";
@@ -93,8 +95,8 @@ async function runLayer(layer, messages, budget, breaker, logger) {
         const result = await layer.apply(messages, budget);
         breaker.recordSuccess(layer.name);
         const durationMs = Date.now() - start;
-        // Only log layers that actually modify messages or take measurable time
-        if (messagesIn !== result.length || durationMs > 0) {
+        // Only log layers that actually modify messages
+        if (messagesIn !== result.length) {
             logger.debug({ layerName: layer.name, messagesIn, messagesOut: result.length, durationMs }, "Context engine layer applied");
         }
         return {
@@ -132,6 +134,8 @@ function getCallbackSnapshot(state) {
     return {
         masker: state.masker,
         thinking: state.thinking,
+        signatureReplayScrubber: state.signatureReplayScrubber,
+        signatureSurrogateGuard: state.signatureSurrogateGuard,
         reasoningTags: state.reasoningTags,
         compaction: state.compaction,
         rehydration: state.rehydration,
@@ -175,6 +179,8 @@ export function createContextEngine(config, deps) {
     const callbackState = {
         masker: null,
         thinking: null,
+        signatureReplayScrubber: null,
+        signatureSurrogateGuard: null,
         reasoningTags: null,
         compaction: null,
         rehydration: null,
@@ -190,6 +196,27 @@ export function createContextEngine(config, deps) {
         thinkingCleaner = createThinkingBlockCleaner(config.thinkingKeepTurns, (stats) => { callbackState.thinking = stats; }, deps.getThinkingKeepTurnsOverride);
         layers.push(thinkingCleaner);
     }
+    // Signature replay scrubber (Fix #2): activates only when the executor
+    // memoized a `{ drop: true }` drift decision for this execute() call.
+    // NOT gated on `model.reasoning` because Gemini's `thoughtSignature` lives
+    // on toolCall blocks even when the model itself isn't flagged as reasoning.
+    // The layer no-ops when the gate is closed, so unconditional addition is
+    // cheap; opt-in is via the executor providing `getReplayDriftMode`.
+    if (deps.getReplayDriftMode) {
+        const getReplayDriftMode = deps.getReplayDriftMode;
+        layers.push(createSignatureReplayScrubber({
+            getReplayDriftMode,
+            onScrubbed: (stats) => { callbackState.signatureReplayScrubber = stats; },
+        }));
+    }
+    // Signature surrogate guard (Fix #3): scrub thinkingSignature from blocks
+    // whose text contains unpaired UTF-16 surrogates so pi-ai's
+    // sanitizeSurrogates() does not produce a sanitized-text-with-original-
+    // signature mismatch on replay. Always active — cost is one walk over
+    // thinking blocks with two regex tests per block, no I/O.
+    layers.push(createSignatureSurrogateGuard({
+        onGuarded: (stats) => { callbackState.signatureSurrogateGuard = stats; },
+    }));
     // Reasoning tag stripper: always active (not gated by model.reasoning) because
     // inline tags come from OTHER providers' responses persisted in session history --
     // the current model's capabilities are irrelevant.
@@ -285,6 +312,8 @@ export function createContextEngine(config, deps) {
             // Reset callback state for this invocation
             callbackState.masker = null;
             callbackState.thinking = null;
+            callbackState.signatureReplayScrubber = null;
+            callbackState.signatureSurrogateGuard = null;
             callbackState.reasoningTags = null;
             callbackState.compaction = null;
             callbackState.rehydration = null;
@@ -537,6 +566,18 @@ export function createContextEngine(config, deps) {
                     thinkingFenceIndex: snap.thinking.cacheFenceIndex,
                 }),
                 ...(snap.reasoningTags && snap.reasoningTags.tagsStripped > 0 ? { reasoningTagsStripped: snap.reasoningTags.tagsStripped } : {}),
+                ...(snap.signatureReplayScrubber && snap.signatureReplayScrubber.dropped > 0
+                    ? { signatureReplayScrubberDropped: snap.signatureReplayScrubber.dropped }
+                    : {}),
+                ...(snap.signatureReplayScrubber && snap.signatureReplayScrubber.signaturesStripped > 0
+                    ? { signatureReplayScrubberSignaturesStripped: snap.signatureReplayScrubber.signaturesStripped }
+                    : {}),
+                ...(snap.signatureReplayScrubber?.reason !== undefined
+                    ? { signatureReplayScrubberReason: snap.signatureReplayScrubber.reason }
+                    : {}),
+                ...(snap.signatureSurrogateGuard && snap.signatureSurrogateGuard.signaturesStripped > 0
+                    ? { signatureSurrogateGuardSignaturesStripped: snap.signatureSurrogateGuard.signaturesStripped }
+                    : {}),
                 budgetUtilization: Math.round(metrics.budgetUtilization * 100) / 100,
                 evictionCategories: metrics.evictionCategories,
                 rereadCount: metrics.rereadCount,

package/node_modules/@comis/agent/dist/context-engine/signature-replay-scrubber.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Signature replay scrubber context engine layer.
+ *
+ * Activates only when `getReplayDriftMode()` returns `{ drop: true }`. When
+ * active, drops every `type:"thinking"` block (signed and redacted alike)
+ * and strips `thoughtSignature` from every `type:"toolCall"` /
+ * `type:"tool_call"` block across the whole history. Respects
+ * `budget.cacheFenceIndex` exactly like `thinking-block-cleaner`: messages
+ * at or below the fence are passed through unchanged.
+ *
+ * Provider coverage rationale: the scrubber is NOT gated on `model.reasoning`
+ * because Gemini's `thoughtSignature` lives on toolCall blocks even when the
+ * model itself is not flagged as reasoning. Cost of running a no-op loop is
+ * negligible vs the savings of preventing a 400-rejection round trip.
+ *
+ * Immutability: never mutates input messages or arrays. Returns new arrays
+ * and shallow-copied messages only when changes are needed. When drift is
+ * detected but the history happens to contain no thinking blocks or signed
+ * toolCalls (e.g. fresh session), returns the original `messages` reference
+ * (zero allocation).
+ *
+ * @module
+ */
+import type { ContextLayer } from "./types.js";
+import type { DriftCheck } from "../executor/replay-drift-detector.js";
+/** Stats reported via the `onScrubbed` callback. */
+interface ScrubbedStats {
+    /** Number of thinking blocks dropped across the whole history. */
+    dropped: number;
+    /** Number of thoughtSignatures stripped from toolCall blocks. */
+    signaturesStripped: number;
+    /** Drift reason that triggered the scrub (forwarded for observability). */
+    reason?: string;
+}
+/** Dependencies for `createSignatureReplayScrubber`. */
+export interface SignatureReplayScrubberDeps {
+    /** Getter for the per-execute() memoized replay drift decision. The
+     *  layer no-ops when this returns undefined or `{ drop: false }`. */
+    getReplayDriftMode: () => DriftCheck | undefined;
+    /** Optional callback invoked exactly once at the end of `apply()` with
+     *  the scrub counts and drift reason. */
+    onScrubbed?: (stats: ScrubbedStats) => void;
+}
+/**
+ * Create the signature-replay-scrubber pipeline layer.
+ *
+ * Layer ordering: runs AFTER `thinking-block-cleaner` and BEFORE
+ * `signature-surrogate-guard` (and well before `reasoning-tag-stripper`).
+ */
+export declare function createSignatureReplayScrubber(deps: SignatureReplayScrubberDeps): ContextLayer;
+export {};

package/node_modules/@comis/agent/dist/context-engine/signature-replay-scrubber.js

@@ -0,0 +1,110 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Signature replay scrubber context engine layer.
+ *
+ * Activates only when `getReplayDriftMode()` returns `{ drop: true }`. When
+ * active, drops every `type:"thinking"` block (signed and redacted alike)
+ * and strips `thoughtSignature` from every `type:"toolCall"` /
+ * `type:"tool_call"` block across the whole history. Respects
+ * `budget.cacheFenceIndex` exactly like `thinking-block-cleaner`: messages
+ * at or below the fence are passed through unchanged.
+ *
+ * Provider coverage rationale: the scrubber is NOT gated on `model.reasoning`
+ * because Gemini's `thoughtSignature` lives on toolCall blocks even when the
+ * model itself is not flagged as reasoning. Cost of running a no-op loop is
+ * negligible vs the savings of preventing a 400-rejection round trip.
+ *
+ * Immutability: never mutates input messages or arrays. Returns new arrays
+ * and shallow-copied messages only when changes are needed. When drift is
+ * detected but the history happens to contain no thinking blocks or signed
+ * toolCalls (e.g. fresh session), returns the original `messages` reference
+ * (zero allocation).
+ *
+ * @module
+ */
+/**
+ * Create the signature-replay-scrubber pipeline layer.
+ *
+ * Layer ordering: runs AFTER `thinking-block-cleaner` and BEFORE
+ * `signature-surrogate-guard` (and well before `reasoning-tag-stripper`).
+ */
+export function createSignatureReplayScrubber(deps) {
+    return {
+        name: "signature-replay-scrubber",
+        async apply(messages, budget) {
+            const drift = deps.getReplayDriftMode();
+            if (!drift || !drift.drop) {
+                // Gate closed → no-op, return same reference (zero allocation).
+                return messages;
+            }
+            if (messages.length === 0)
+                return messages;
+            let anyChanged = false;
+            let dropped = 0;
+            let signaturesStripped = 0;
+            const result = new Array(messages.length);
+            for (let i = 0; i < messages.length; i++) {
+                // eslint-disable-next-line security/detect-object-injection -- numeric index
+                const original = messages[i];
+                // Cache fence: messages at or below the fence must not be modified.
+                if (i <= budget.cacheFenceIndex) {
+                    // eslint-disable-next-line security/detect-object-injection -- numeric index
+                    result[i] = original;
+                    continue;
+                }
+                const msg = original;
+                if (msg.role !== "assistant" || !Array.isArray(msg.content)) {
+                    // eslint-disable-next-line security/detect-object-injection -- numeric index
+                    result[i] = original;
+                    continue;
+                }
+                const content = msg.content;
+                let messageChanged = false;
+                const newContent = [];
+                for (let j = 0; j < content.length; j++) {
+                    // eslint-disable-next-line security/detect-object-injection -- numeric index
+                    const block = content[j];
+                    if (!block || typeof block !== "object") {
+                        newContent.push(block);
+                        continue;
+                    }
+                    const b = block;
+                    if (b.type === "thinking") {
+                        // Drop signed AND redacted alike — drift mode invalidates the
+                        // entire prefix, so retaining redacted thinking just keeps a
+                        // surface that the next replay can still reject.
+                        dropped++;
+                        messageChanged = true;
+                        continue;
+                    }
+                    if ((b.type === "toolCall" || b.type === "tool_call") && b.thoughtSignature !== undefined) {
+                        // Shallow-copy and drop only the thoughtSignature property.
+                        const copy = { ...b };
+                        delete copy.thoughtSignature;
+                        newContent.push(copy);
+                        signaturesStripped++;
+                        messageChanged = true;
+                        continue;
+                    }
+                    newContent.push(block);
+                }
+                if (messageChanged) {
+                    // eslint-disable-next-line security/detect-object-injection -- numeric index
+                    result[i] = { ...msg, content: newContent };
+                    anyChanged = true;
+                }
+                else {
+                    // eslint-disable-next-line security/detect-object-injection -- numeric index
+                    result[i] = original;
+                }
+            }
+            // Always notify so observers see the drift reason even on zero-touch
+            // histories (drift fired but no signed state in the conversation yet).
+            deps.onScrubbed?.({ dropped, signaturesStripped, reason: drift.reason });
+            // Zero-allocation early return when nothing was actually changed.
+            if (!anyChanged)
+                return messages;
+            return result;
+        },
+    };
+}

package/node_modules/@comis/agent/dist/context-engine/signature-surrogate-guard.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Signature surrogate guard context engine layer.
+ *
+ * Defends against pi-ai's `sanitizeSurrogates(block.thinking)` mutating the
+ * thinking text while preserving the original signature. When that happens,
+ * Anthropic's signature validator rejects the assistant turn on replay with
+ * `400 invalid_request_error: ... cannot be modified` because the bytes the
+ * signature was computed over no longer match the bytes being sent.
+ *
+ * Reference: pi-ai upstream behavior in
+ * `node_modules/.pnpm/@mariozechner+pi-ai@0.67.68_HASH/node_modules/@mariozechner/pi-ai/dist/providers/anthropic.js`
+ * around line 661 calls `sanitizeSurrogates(block.thinking)` while preserving
+ * the original `signature`. A separate upstream PR is recommended (out of
+ * scope for this commit); Comis is protected by this guard regardless of
+ * upstream.
+ *
+ * Strategy: scan every type:"thinking" block on every assistant message
+ * for unpaired UTF-16 surrogates in `block.thinking`. When found AND the
+ * block carries a non-empty `thinkingSignature`, strip the signature so
+ * pi-ai's downstream serialization falls back to converting the block to
+ * plain text rather than sending sanitized-text + original-signature
+ * mismatch. Skips `redacted: true` blocks (no readable text to taint).
+ *
+ * Cache fence respected exactly like `thinking-block-cleaner` and
+ * `signature-replay-scrubber`.
+ *
+ * Immutability: never mutates input; shallow-copies the block and the
+ * containing message only when scrubbing is needed. When no scrub fires,
+ * returns the input array reference unchanged (zero allocation).
+ *
+ * @module
+ */
+import type { ContextLayer } from "./types.js";
+/** Stats reported via the `onGuarded` callback. */
+interface GuardedStats {
+    /** Number of thinkingSignatures stripped due to unpaired surrogates. */
+    signaturesStripped: number;
+}
+/** Optional dependencies for `createSignatureSurrogateGuard`. */
+export interface SignatureSurrogateGuardDeps {
+    /** Optional callback invoked exactly once at the end of `apply()` with
+     *  the count of signatures stripped. */
+    onGuarded?: (stats: GuardedStats) => void;
+}
+/**
+ * Create the signature-surrogate-guard pipeline layer.
+ *
+ * Layer ordering: runs AFTER `signature-replay-scrubber` (Fix #2) and
+ * BEFORE `reasoning-tag-stripper`. Always added unconditionally — the cost
+ * is one walk over thinking blocks with two regex tests per block, which
+ * is negligible compared to a single 400-rejection round trip.
+ */
+export declare function createSignatureSurrogateGuard(deps?: SignatureSurrogateGuardDeps): ContextLayer;
+export {};

package/node_modules/@comis/agent/dist/context-engine/signature-surrogate-guard.js

@@ -0,0 +1,145 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Signature surrogate guard context engine layer.
+ *
+ * Defends against pi-ai's `sanitizeSurrogates(block.thinking)` mutating the
+ * thinking text while preserving the original signature. When that happens,
+ * Anthropic's signature validator rejects the assistant turn on replay with
+ * `400 invalid_request_error: ... cannot be modified` because the bytes the
+ * signature was computed over no longer match the bytes being sent.
+ *
+ * Reference: pi-ai upstream behavior in
+ * `node_modules/.pnpm/@mariozechner+pi-ai@0.67.68_HASH/node_modules/@mariozechner/pi-ai/dist/providers/anthropic.js`
+ * around line 661 calls `sanitizeSurrogates(block.thinking)` while preserving
+ * the original `signature`. A separate upstream PR is recommended (out of
+ * scope for this commit); Comis is protected by this guard regardless of
+ * upstream.
+ *
+ * Strategy: scan every type:"thinking" block on every assistant message
+ * for unpaired UTF-16 surrogates in `block.thinking`. When found AND the
+ * block carries a non-empty `thinkingSignature`, strip the signature so
+ * pi-ai's downstream serialization falls back to converting the block to
+ * plain text rather than sending sanitized-text + original-signature
+ * mismatch. Skips `redacted: true` blocks (no readable text to taint).
+ *
+ * Cache fence respected exactly like `thinking-block-cleaner` and
+ * `signature-replay-scrubber`.
+ *
+ * Immutability: never mutates input; shallow-copies the block and the
+ * containing message only when scrubbing is needed. When no scrub fires,
+ * returns the input array reference unchanged (zero allocation).
+ *
+ * @module
+ */
+// ---------------------------------------------------------------------------
+// Surrogate detection regexes (mirror pi-ai sanitizeSurrogates internals)
+// ---------------------------------------------------------------------------
+// Reference: pi-ai sanitizeSurrogates internals, anthropic.js:661 area.
+// High surrogate not followed by low surrogate.
+const UNPAIRED_HIGH_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])/;
+// Low surrogate not preceded by high surrogate.
+const UNPAIRED_LOW_SURROGATE = /(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+/**
+ * Create the signature-surrogate-guard pipeline layer.
+ *
+ * Layer ordering: runs AFTER `signature-replay-scrubber` (Fix #2) and
+ * BEFORE `reasoning-tag-stripper`. Always added unconditionally — the cost
+ * is one walk over thinking blocks with two regex tests per block, which
+ * is negligible compared to a single 400-rejection round trip.
+ */
+export function createSignatureSurrogateGuard(deps) {
+    return {
+        name: "signature-surrogate-guard",
+        async apply(messages, budget) {
+            if (messages.length === 0) {
+                deps?.onGuarded?.({ signaturesStripped: 0 });
+                return messages;
+            }
+            let anyChanged = false;
+            let signaturesStripped = 0;
+            const result = new Array(messages.length);
+            for (let i = 0; i < messages.length; i++) {
+                // eslint-disable-next-line security/detect-object-injection -- numeric index
+                const original = messages[i];
+                // Cache fence: messages at or below the fence must not be modified.
+                if (i <= budget.cacheFenceIndex) {
+                    // eslint-disable-next-line security/detect-object-injection -- numeric index
+                    result[i] = original;
+                    continue;
+                }
+                const msg = original;
+                if (msg.role !== "assistant" || !Array.isArray(msg.content)) {
+                    // eslint-disable-next-line security/detect-object-injection -- numeric index
+                    result[i] = original;
+                    continue;
+                }
+                const content = msg.content;
+                let messageChanged = false;
+                const newContent = new Array(content.length);
+                for (let j = 0; j < content.length; j++) {
+                    // eslint-disable-next-line security/detect-object-injection -- numeric index
+                    const block = content[j];
+                    if (!block || typeof block !== "object") {
+                        // eslint-disable-next-line security/detect-object-injection -- numeric index
+                        newContent[j] = block;
+                        continue;
+                    }
+                    const b = block;
+                    // Only inspect type:"thinking" blocks.
+                    if (b.type !== "thinking") {
+                        // eslint-disable-next-line security/detect-object-injection -- numeric index
+                        newContent[j] = block;
+                        continue;
+                    }
+                    // Skip redacted blocks: they have no readable text to taint.
+                    if (b.redacted === true) {
+                        // eslint-disable-next-line security/detect-object-injection -- numeric index
+                        newContent[j] = block;
+                        continue;
+                    }
+                    // Skip when there's no signature to strip in the first place.
+                    if (!b.thinkingSignature) {
+                        // eslint-disable-next-line security/detect-object-injection -- numeric index
+                        newContent[j] = block;
+                        continue;
+                    }
+                    const text = b.thinking;
+                    if (typeof text !== "string") {
+                        // eslint-disable-next-line security/detect-object-injection -- numeric index
+                        newContent[j] = block;
+                        continue;
+                    }
+                    if (UNPAIRED_HIGH_SURROGATE.test(text) || UNPAIRED_LOW_SURROGATE.test(text)) {
+                        // Strip the signature: shallow-copy the block and set
+                        // thinkingSignature to "" so pi-ai's downstream serialization
+                        // falls back to converting the block to plain text rather than
+                        // sending sanitized-text + original-signature mismatch.
+                        const copy = { ...b, thinkingSignature: "" };
+                        // eslint-disable-next-line security/detect-object-injection -- numeric index
+                        newContent[j] = copy;
+                        signaturesStripped++;
+                        messageChanged = true;
+                    }
+                    else {
+                        // eslint-disable-next-line security/detect-object-injection -- numeric index
+                        newContent[j] = block;
+                    }
+                }
+                if (messageChanged) {
+                    // eslint-disable-next-line security/detect-object-injection -- numeric index
+                    result[i] = { ...msg, content: newContent };
+                    anyChanged = true;
+                }
+                else {
+                    // eslint-disable-next-line security/detect-object-injection -- numeric index
+                    result[i] = original;
+                }
+            }
+            deps?.onGuarded?.({ signaturesStripped });
+            // Zero-allocation early return when nothing was scrubbed.
+            if (!anyChanged)
+                return messages;
+            return result;
+        },
+    };
+}

package/node_modules/@comis/agent/dist/context-engine/types-core.d.ts

@@ -92,6 +92,16 @@ export interface ContextEngineDeps {
         contextWindow: number;
         /** Maximum output tokens for the model. */
         maxTokens: number;
+        /** Optional model identifier (e.g. "claude-opus-4-7"). Used by replay
+         *  drift detection downstream of this getter. */
+        id?: string;
+        /** Optional provider name (e.g. "anthropic"). Used by replay drift
+         *  detection downstream of this getter. */
+        provider?: string;
+        /** Optional API family tag (e.g. "anthropic.messages",
+         *  "google.generative_ai.responses"). Used by replay drift detection
+         *  downstream of this getter. */
+        api?: string;
     };
     /** Channel type for history window per-channel overrides (e.g., "dm", "group"). */
     channelType?: string;
@@ -134,6 +144,13 @@ export interface ContextEngineDeps {
      *  static value is used. Used by idle thinking clear to strip all thinking
      *  blocks when the cache is cold (>1h idle). */
     getThinkingKeepTurnsOverride?: () => number | undefined;
+    /** Optional getter for the per-execute() memoized replay drift decision.
+     *  When the getter returns a DriftCheck with `drop: true`, the
+     *  signature-replay-scrubber layer activates for this pipeline run. When
+     *  undefined or `drop: false`, the layer no-ops. The drift result is
+     *  memoized at the executor layer so all pipeline runs within a single
+     *  execute() see a consistent decision. */
+    getReplayDriftMode?: () => import("../executor/replay-drift-detector.js").DriftCheck | undefined;
 }
 /**
  * API-grounded token count anchor from the last LLM response.

package/node_modules/@comis/agent/dist/executor/error-classifier.d.ts

@@ -8,7 +8,17 @@
  *
  * @module
  */
-export type ErrorCategory = "credit_exhausted" | "rate_limited" | "auth_invalid" | "overloaded" | "context_too_long" | "content_filtered" | "client_request" | "prompt_timeout"
+export type ErrorCategory = "credit_exhausted" | "rate_limited" | "auth_invalid" | "overloaded" | "context_too_long" | "content_filtered"
+/**
+ * Provider-agnostic signed-replay rejection: the model rejected stored
+ * signed thinking / reasoning state on the latest assistant turn during
+ * replay (Anthropic `cannot be modified`, Gemini `thought_signature
+ * mismatch`, OpenAI Responses `reasoning_item not found`, OpenAI
+ * Completions `reasoning_id expired`, Mistral `encrypted_content
+ * verification failed`, etc.). Self-healable: the runner scrubs the
+ * stored signed state in place and re-enters the model retry chain.
+ */
+ | "client_request_signed_replay" | "client_request" | "prompt_timeout"
 /**
  * Model produced an empty response (no text, no tool call). Almost always
  * caused by a malformed toolResult poisoning the next turn. Retryable once

package/node_modules/@comis/agent/dist/executor/error-classifier.js

@@ -9,6 +9,7 @@
  *
  * @module
  */
+import { isSignedReplayError } from "./signed-replay-detector.js";
 const ERROR_PATTERNS = [
     // Billing / credits
     {
@@ -45,6 +46,18 @@ const ERROR_PATTERNS = [
         userMessage: "The conversation has grown too long. Please start a new conversation.",
         retryable: false,
     },
+    // Provider-agnostic signed-replay rejection: must be tested BEFORE the
+    // plain client_request pattern because every signed-replay error string
+    // also matches `invalid_request_error` / `cannot be modified`. First match
+    // wins, so this more-specific subcategory has to be checked first.
+    // Retryable=true because the runner scrubs signed thinking state in place
+    // and re-enters the model retry chain (see executor-prompt-runner.ts).
+    {
+        test: { test: (s) => isSignedReplayError(s) },
+        category: "client_request_signed_replay",
+        userMessage: "Your request couldn't be processed due to a formatting issue. The AI agent will try again automatically.",
+        retryable: true,
+    },
     // Client-side validation (Anthropic 400 invalid_request_error, 422, malformed)
     // Placed BEFORE content_filtered so /refus|blocked/ in that rule cannot steal
     // matches. Placed AFTER billing/auth/rate/overloaded/context so those specific

package/node_modules/@comis/agent/dist/executor/executor-context-engine-setup.d.ts

@@ -49,6 +49,7 @@ export interface ContextEngineSetupParams {
                     maxTokens?: number;
                     id?: string;
                     provider?: string;
+                    api?: string;
                 } | undefined;
             };
         };

package/node_modules/@comis/agent/dist/executor/executor-context-engine-setup.js

@@ -17,6 +17,7 @@ import { createContextEngine } from "../context-engine/index.js";
 import { CHARS_PER_TOKEN_RATIO } from "../context-engine/constants.js";
 import { resolveOperationModel, resolveProviderFamily } from "../model/operation-model-resolver.js";
 import { getBreakpointIndex, getBreakpointIndexMapSize, getSessionLatches, } from "./executor-session-state.js";
+import { shouldDropSignedFields } from "./replay-drift-detector.js";
 import { readFileSync } from "node:fs";
 // ---------------------------------------------------------------------------
 // Main function
@@ -41,6 +42,45 @@ export function setupContextEngine(params) {
     const agentId = deps.agentId;
     // contextEngineOverrides removed from ExecutionOverrides -- compaction model resolved via operationModels chain
     const contextEngineConfig = config.contextEngine ?? ContextEngineConfigSchema.parse({});
+    // --- Replay drift memo (Fix #2) -----------------------------------------
+    // Memoized per-execute() so all pipeline runs in a single execute() see a
+    // consistent decision (cleaner + scrubber must agree). The closure reads
+    // the latest model identity each time (handles cycleModel mid-execute).
+    let memoizedDrift;
+    const computeDriftIfNeeded = () => {
+        if (memoizedDrift !== undefined)
+            return memoizedDrift;
+        try {
+            const model = session.agent.state.model;
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- SessionManager interop
+            const fileEntries = (sm?.fileEntries ?? []);
+            const idleMs = contextEngineConfig.replayDriftIdleMs ?? 30 * 60_000;
+            // Derive currentApi from model.api when present; otherwise fall back to
+            // the provider family (resolveProviderFamily strips -bedrock / -vertex).
+            const currentApi = model?.api ?? resolveProviderFamily(config.provider);
+            memoizedDrift = shouldDropSignedFields({
+                // Cast: shouldDropSignedFields tolerates malformed entries internally.
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                fileEntries: fileEntries,
+                currentModel: {
+                    id: model?.id,
+                    provider: model?.provider ?? config.provider,
+                    api: currentApi,
+                },
+                idleMs,
+            });
+            return memoizedDrift;
+        }
+        catch (err) {
+            deps.logger.warn({
+                err,
+                hint: "Replay drift detection failed; defaulting to no scrub",
+                errorKind: "internal",
+            }, "Replay drift detection failed");
+            memoizedDrift = { drop: false };
+            return memoizedDrift;
+        }
+    };
     const contextEngine = createContextEngine(contextEngineConfig, {
         logger: deps.logger,
         eventBus: deps.eventBus,
@@ -53,6 +93,11 @@ export function setupContextEngine(params) {
                 reasoning: model?.reasoning ?? false,
                 contextWindow: model?.contextWindow ?? 128_000,
                 maxTokens: model?.maxTokens ?? 8192,
+                id: model?.id,
+                provider: model?.provider,
+                // model.api is optional pi-ai metadata. Cast for the optional access
+                // since the structural type does not require it.
+                api: model?.api,
             };
         },
         channelType: msg.channelType,
@@ -70,8 +115,18 @@ export function setupContextEngine(params) {
             const latches = getSessionLatches(formattedKey);
             if (latches?.idleThinkingClear.get())
                 return 0; // Strip all thinking when idle
+            // When replay drift fires, also clamp keepTurns=0 so the cleaner agrees
+            // with the new signature-replay-scrubber. Defense in depth: the scrubber
+            // drops everything beyond the cache fence, but a future refactor that
+            // narrows the scrubber's scope must not leave the cleaner inconsistent.
+            const drift = computeDriftIfNeeded();
+            if (drift?.drop)
+                return 0;
             return undefined; // Use default keepTurns
         },
+        // Replay drift mode getter (Fix #2): activates the
+        // signature-replay-scrubber pipeline layer when drift is detected.
+        getReplayDriftMode: () => computeDriftIfNeeded(),
         // LLM compaction deps
         getCompactionDeps: () => ({
             logger: deps.logger,