comisai 1.0.19 → 1.0.23

package/node_modules/@comis/agent/dist/executor/executor-prompt-runner.js

@@ -22,6 +22,7 @@ import { wrapInEnvelope } from "../envelope/message-envelope.js";
 import { runWithModelRetry } from "./model-retry.js";
 import { withPromptTimeout, PromptTimeoutError } from "./prompt-timeout.js";
 import { classifyError, classifyPromptTimeout } from "./error-classifier.js";
+import { scrubSignedReplayStateInPlace } from "./signature-block-scrubber.js";
 import { createOverflowRecoveryWrapper } from "./overflow-recovery.js";
 import { isContextOverflowError } from "../safety/context-truncation-recovery.js";
 import { scanWithOutputGuard, recoverEmptyFinalResponse, extractExecutionPlan, generateCompletenessNudge, } from "./executor-response-filter.js";
@@ -252,13 +253,113 @@ export async function runPrompt(params) {
                     }
                 }
                 if (!silent02Recovered && !silentRetryAttempted) {
-                    // Client-side validation errors (e.g. Anthropic 400 invalid_request_error
-                    // on thinking-block immutability) are deterministic — retrying with the
-                    // same message body will reproduce the same failure. Short-circuit before
-                    // the strip+retry block to avoid wasting tokens on a repeat request.
+                    // Classify the bridge's recorded LLM error to pick the correct path:
+                    //   - "client_request_signed_replay": scrub signed thinking state and
+                    //     re-enter runWithModelRetry once (provider-agnostic self-heal,
+                    //     covers Anthropic, Bedrock-Claude, Gemini, OpenAI Responses,
+                    //     OpenAI Completions reasoning, Mistral).
+                    //   - "client_request": deterministic; declare terminal failure
+                    //     verbatim with the original error wording.
+                    //   - default: fall through to the existing strip-empty-turn +
+                    //     re-enter retry path below.
                     const llmErrSource = earlyBridgeResult.lastLlmErrorMessage ?? "";
                     const earlyClassification = classifyError(new Error(llmErrSource));
-                    if (earlyClassification.category === "client_request") {
+                    if (earlyClassification.category === "client_request_signed_replay") {
+                        // Provider-agnostic signed-replay self-heal. Scrub stored signed
+                        // thinking / reasoning state in place, then re-enter the full
+                        // model retry pipeline once. Mirrors the silent-retry shape but
+                        // with a 1s settle (vs 3s for transient overload) since the
+                        // failure cause is deterministic state on disk, not a transient
+                        // provider condition.
+                        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                        const msgs = session.messages ?? [];
+                        const { blocksRemoved, thoughtSignaturesStripped } = scrubSignedReplayStateInPlace(msgs);
+                        deps.logger.info({
+                            blocksRemoved,
+                            thoughtSignaturesStripped,
+                            providerError: llmErrSource,
+                            hint: "Signed-replay rejection detected; scrubbing thinking state and retrying once",
+                            errorKind: "transient",
+                        }, "Signed-replay self-heal: scrubbing and retrying");
+                        // Brief settle before retry. Distinct from the 3s silent-retry
+                        // delay because signed-replay is a deterministic state error,
+                        // not a transient provider condition.
+                        await new Promise(r => setTimeout(r, 1_000));
+                        const retryResult = await runWithModelRetry({
+                            session,
+                            messageText,
+                            promptImages,
+                            config: { provider: config.provider, model: config.model },
+                            resolvedModel: resolvedModel ? `${resolvedModel.provider}:${resolvedModel.id}` : undefined,
+                            timeoutConfig: {
+                                promptTimeoutMs: effectiveTimeout.promptTimeoutMs,
+                                retryPromptTimeoutMs: effectiveTimeout.retryPromptTimeoutMs,
+                            },
+                            deps: {
+                                eventBus: deps.eventBus,
+                                logger: deps.logger,
+                                authRotation: deps.authRotation,
+                                fallbackModels: deps.fallbackModels,
+                                modelRegistry: deps.modelRegistry,
+                                agentId,
+                                sessionKey: formatSessionKey(sessionKey),
+                                providerHealth: deps.providerHealth,
+                                onResetTimer: (fn) => { onResetTimer(fn); },
+                            },
+                        });
+                        promptSucceeded = retryResult.succeeded;
+                        promptError = retryResult.error;
+                        // Re-check for empty response after retry; mirror the
+                        // silent-retry post-check semantics so the recovery event
+                        // reports a faithful succeeded flag.
+                        let recovered = promptSucceeded;
+                        if (promptSucceeded) {
+                            const retryText = session.getLastAssistantText?.() ?? "";
+                            if (retryText === "") {
+                                const retryBridgeResult = bridge.getResult();
+                                if ((retryBridgeResult.llmCalls ?? 0) > 0 && !retryBridgeResult.textEmitted) {
+                                    recovered = false;
+                                    promptSucceeded = false;
+                                    const llmDetail = retryBridgeResult.lastLlmErrorMessage
+                                        ? ` — ${retryBridgeResult.lastLlmErrorMessage}`
+                                        : "";
+                                    promptError = new Error(`Signed-replay self-heal failed: ${retryBridgeResult.llmCalls} LLM call(s) produced empty response after retry (finishReason: ${retryBridgeResult.finishReason ?? "unknown"})${llmDetail}`);
+                                }
+                            }
+                        }
+                        deps.eventBus.emit("execution:signed_replay_recovered", {
+                            agentId: agentId ?? "default",
+                            sessionKey: formatSessionKey(sessionKey),
+                            blocksRemoved,
+                            thoughtSignaturesStripped,
+                            succeeded: recovered,
+                            timestamp: Date.now(),
+                        });
+                        if (recovered) {
+                            deps.logger.info({
+                                blocksRemoved,
+                                thoughtSignaturesStripped,
+                                recovered: true,
+                            }, "Signed-replay self-heal succeeded");
+                        }
+                        else {
+                            deps.logger.warn({
+                                blocksRemoved,
+                                thoughtSignaturesStripped,
+                                hint: "Signed-replay self-heal retry also failed; declaring terminal failure",
+                                errorKind: "dependency",
+                            }, "Signed-replay self-heal retry failed");
+                        }
+                        // Close the gate so this branch cannot be re-entered within the
+                        // same runPrompt invocation.
+                        // eslint-disable-next-line no-useless-assignment
+                        silentRetryAttempted = true;
+                    }
+                    else if (earlyClassification.category === "client_request") {
+                        // Plain client_request: deterministic failure (e.g. unprocessable_entity,
+                        // bare "cannot be modified" without signature noun). Retrying would
+                        // reproduce the same failure. Short-circuit before the strip+retry
+                        // block to avoid wasting tokens.
                         deps.logger.warn({
                             llmCalls: earlyBridgeResult.llmCalls,
                             finishReason: earlyBridgeResult.finishReason,

package/node_modules/@comis/agent/dist/executor/executor-tool-assembly.js

@@ -186,6 +186,7 @@ export async function assembleTools(params) {
     // -------------------------------------------------------------------
     const resourceLoaderOptions = {
         cwd: deps.workspaceDir,
+        agentDir: deps.agentDir,
         settingsManager,
         noExtensions: true,
         additionalSkillPaths: config.skills?.discoveryPaths ?? [],

package/node_modules/@comis/agent/dist/executor/pi-executor.d.ts

@@ -50,10 +50,7 @@ import type { AgentExecutor } from "./types.js";
  *
  * Extracted as a named function for independent unit testing.
  */
-export declare function createBeforeToolCallGuard(stepCounter: StepCounter, budgetGuard: BudgetGuard, circuitBreaker: CircuitBreaker, toolRetryBreaker?: ToolRetryBreaker, messageSendLimiter?: MessageSendLimiter): (context: unknown, _signal?: AbortSignal) => Promise<{
-    block: boolean;
-    reason: string;
-} | undefined>;
+export declare function createBeforeToolCallGuard(stepCounter: StepCounter, budgetGuard: BudgetGuard, circuitBreaker: CircuitBreaker, toolRetryBreaker?: ToolRetryBreaker, messageSendLimiter?: MessageSendLimiter): (context: unknown, _signal?: AbortSignal) => Promise<import("../safety/message-send-limiter.js").MessageSendVerdict | undefined>;
 /**
  * Merge SDK session stats into execution result for token totals (R-13).
  *

package/node_modules/@comis/agent/dist/executor/pi-executor.js

@@ -449,6 +449,24 @@ export function createPiExecutor(config, deps) {
                 }
                 const resourceLoader = new DefaultResourceLoader(resourceLoaderOptions);
                 await resourceLoader.reload();
+                // The SDK's `tools` is an allowlist of tool *names* (not definitions).
+                // An empty array is treated as a non-empty allowlist that allows zero
+                // tools, including all customTools — which is why the agent ran
+                // tool-less from every entry point (chat API, SSE, Telegram, etc.):
+                // every Comis tool was filtered out of the SDK's tool registry, the
+                // Anthropic API request went out with `tools: []`, and the model
+                // emitted `<tool_call>...</tool_call>` markup as plaintext that
+                // Comis's loop never parsed back.
+                //
+                // Pass our customTool names as the explicit allowlist so:
+                //   1. All customTools land in the SDK's tool registry (their names
+                //      pass `isAllowedTool`).
+                //   2. SDK built-ins like `bash` that conflict with Comis's policy
+                //      controls are filtered out (Comis uses `exec` instead, with
+                //      its own sandbox/audit hooks).
+                //   3. Where names overlap (read/edit/write), Comis's customTools
+                //      override the SDK built-ins via Map.set() in the registry
+                //      build (`agent-session.js:1810-1813` in pi-coding-agent@0.68.0).
                 const sessionOptions = {
                     cwd: deps.workspaceDir,
                     authStorage: deps.authStorage,
@@ -457,7 +475,7 @@ export function createPiExecutor(config, deps) {
                     sessionManager: sm,
                     settingsManager,
                     resourceLoader,
-                    tools: [],
+                    tools: mergedCustomTools.map((t) => t.name),
                     customTools: mergedCustomTools,
                 };
                 const { session, modelFallbackMessage } = await createAgentSession(sessionOptions);
@@ -654,11 +672,20 @@ export function createPiExecutor(config, deps) {
                     const postActiveNames = session.getActiveToolNames?.() ?? [];
                     if (postActiveNames.length < mergedToolNames.length) {
                         const rejected = mergedToolNames.filter(n => !postActiveNames.includes(n));
+                        const allRejected = postActiveNames.length === 0 && rejected.length === mergedToolNames.length;
                         deps.logger.warn({
                             rejected,
-                            hint: "SDK filtered some tools that Comis registered; check tool name collisions with SDK built-ins",
+                            rejectedCount: rejected.length,
+                            registeredCount: mergedToolNames.length,
+                            postActiveCount: postActiveNames.length,
+                            allRejected,
+                            hint: allRejected
+                                ? "SDK has 0 active tools after setActiveToolsByName -- not a name collision (empty active list, every Comis tool dropped). Indicates the SDK ResourceLoader / agent.tools handoff is broken; the LLM will receive no structured tool definitions and may emit `<tool_call>` markup as plaintext instead of using tool_use content blocks."
+                                : "SDK filtered some Comis tools; likely name collisions with SDK built-ins (e.g. SDK reserves `bash`, `read_file`, etc.). Rename or omit the listed tools to avoid the conflict.",
                             errorKind: "validation",
-                        }, "SDK rejected some tool registrations");
+                        }, allRejected
+                            ? "SDK rejected ALL tool registrations -- agent will run with no tools"
+                            : "SDK rejected some tool registrations");
                     }
                 }
                 catch (toolMgmtError) {

package/node_modules/@comis/agent/dist/executor/replay-drift-detector.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Provider-agnostic replay-drift detector.
+ *
+ * Reads session file entries (jsonl-backed; survives daemon restarts) and
+ * decides whether the current pipeline run should scrub stored signed
+ * thinking / reasoning state pre-send to avoid provider replay-rejection.
+ *
+ * Drift conditions (first-match-wins ordering):
+ *   1. idle gap > threshold
+ *   2. model id change vs the last assistant turn
+ *   3. provider change
+ *   4. api change (e.g. anthropic.messages -> google.generative_ai.responses)
+ *
+ * Pure function — no async, no I/O. Defensive: tolerates malformed entries,
+ * missing timestamps, and the empty-history case.
+ *
+ * @module
+ */
+/** Subset of a session file entry the detector reads. */
+interface DriftFileEntry {
+    /** Unix-ms timestamp of the entry. */
+    timestamp?: number;
+    /** Entry kind; only `"message"` carries a role/content we care about. */
+    type?: string;
+    /** Message body for message-type entries. */
+    message?: {
+        role?: string;
+        /** Optional metadata persisted on assistant turns; pi-ai records the
+         *  stream metadata here including model identity. */
+        metadata?: {
+            model?: {
+                id?: string;
+                provider?: string;
+                api?: string;
+            };
+            provider?: string;
+            api?: string;
+        };
+        content?: unknown;
+    };
+}
+/** Input to `shouldDropSignedFields`. */
+export interface DriftCheckInput {
+    /** Session manager file entries, jsonl-backed. */
+    fileEntries: ReadonlyArray<DriftFileEntry>;
+    /** Current model identity from `session.agent.state.model` plus
+     *  `config.provider`. All fields optional; missing fields disable the
+     *  corresponding drift check rather than tripping it. */
+    currentModel: {
+        id?: string;
+        provider?: string;
+        api?: string;
+    };
+    /** Idle threshold from config (already resolved with default applied). */
+    idleMs: number;
+    /** Now() injection for testability. Default: `Date.now()`. */
+    now?: number;
+}
+/** Result of `shouldDropSignedFields`. */
+export interface DriftCheck {
+    /** True when the caller should scrub signed thinking state pre-send. */
+    drop: boolean;
+    /** Human-readable reason; populated only when drop===true. */
+    reason?: "idle" | "model_change" | "provider_change" | "api_change";
+    /** Diagnostic detail for logger / event payload. */
+    detail?: {
+        idleGapMs?: number;
+        previousModel?: string;
+        previousProvider?: string;
+        previousApi?: string;
+    };
+}
+/**
+ * Decide whether signed thinking state should be scrubbed pre-send.
+ *
+ * Walks `fileEntries` from the END to find the most recent assistant message
+ * with content. Compares its timestamp + recorded model identity against the
+ * current model identity and the configured idle threshold.
+ *
+ * Ordering: idle takes precedence over model_change, which takes precedence
+ * over provider_change, which takes precedence over api_change. The order is
+ * tested explicitly so future refactors cannot silently change it.
+ */
+export declare function shouldDropSignedFields(input: DriftCheckInput): DriftCheck;
+export {};

package/node_modules/@comis/agent/dist/executor/replay-drift-detector.js

@@ -0,0 +1,92 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Provider-agnostic replay-drift detector.
+ *
+ * Reads session file entries (jsonl-backed; survives daemon restarts) and
+ * decides whether the current pipeline run should scrub stored signed
+ * thinking / reasoning state pre-send to avoid provider replay-rejection.
+ *
+ * Drift conditions (first-match-wins ordering):
+ *   1. idle gap > threshold
+ *   2. model id change vs the last assistant turn
+ *   3. provider change
+ *   4. api change (e.g. anthropic.messages -> google.generative_ai.responses)
+ *
+ * Pure function — no async, no I/O. Defensive: tolerates malformed entries,
+ * missing timestamps, and the empty-history case.
+ *
+ * @module
+ */
+// ---------------------------------------------------------------------------
+// Implementation
+// ---------------------------------------------------------------------------
+/**
+ * Decide whether signed thinking state should be scrubbed pre-send.
+ *
+ * Walks `fileEntries` from the END to find the most recent assistant message
+ * with content. Compares its timestamp + recorded model identity against the
+ * current model identity and the configured idle threshold.
+ *
+ * Ordering: idle takes precedence over model_change, which takes precedence
+ * over provider_change, which takes precedence over api_change. The order is
+ * tested explicitly so future refactors cannot silently change it.
+ */
+export function shouldDropSignedFields(input) {
+    const { fileEntries, currentModel, idleMs } = input;
+    const now = input.now ?? Date.now();
+    if (!Array.isArray(fileEntries) || fileEntries.length === 0) {
+        return { drop: false };
+    }
+    // Walk from the end to find the most recent assistant message.
+    let lastAssistant = null;
+    for (let i = fileEntries.length - 1; i >= 0; i--) {
+        // eslint-disable-next-line security/detect-object-injection -- numeric index, caller-supplied array
+        const entry = fileEntries[i];
+        if (!entry || typeof entry !== "object")
+            continue;
+        if (entry.type !== "message")
+            continue;
+        if (entry.message?.role !== "assistant")
+            continue;
+        lastAssistant = entry;
+        break;
+    }
+    if (lastAssistant === null) {
+        // No prior assistant entry → nothing to drift from.
+        return { drop: false };
+    }
+    // Idle check: highest precedence.
+    const lastTs = typeof lastAssistant.timestamp === "number" ? lastAssistant.timestamp : undefined;
+    if (lastTs !== undefined) {
+        const idleGapMs = now - lastTs;
+        if (idleGapMs > idleMs) {
+            return { drop: true, reason: "idle", detail: { idleGapMs } };
+        }
+    }
+    // Identity comparisons. pi-ai persists stream metadata on assistant turns
+    // under message.metadata.model; some legacy paths put it directly on
+    // message.metadata.{provider,api}. Probe both shapes.
+    const meta = lastAssistant.message?.metadata;
+    const previousModel = meta?.model?.id;
+    const previousProvider = meta?.model?.provider ?? meta?.provider;
+    const previousApi = meta?.model?.api ?? meta?.api;
+    // Model id change.
+    if (previousModel !== undefined &&
+        currentModel.id !== undefined &&
+        previousModel !== currentModel.id) {
+        return { drop: true, reason: "model_change", detail: { previousModel } };
+    }
+    // Provider change.
+    if (previousProvider !== undefined &&
+        currentModel.provider !== undefined &&
+        previousProvider !== currentModel.provider) {
+        return { drop: true, reason: "provider_change", detail: { previousProvider } };
+    }
+    // API change.
+    if (previousApi !== undefined &&
+        currentModel.api !== undefined &&
+        previousApi !== currentModel.api) {
+        return { drop: true, reason: "api_change", detail: { previousApi } };
+    }
+    return { drop: false };
+}

package/node_modules/@comis/agent/dist/executor/signature-block-scrubber.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Signed-replay state scrubber for the reject-and-retry self-heal path.
+ *
+ * Mutates the in-memory session message array in place so the next API call
+ * does not replay the rejected signed thinking / reasoning state. Distinct
+ * from the steady-state thinking-block-cleaner pipeline layer:
+ * - This scrubber is more aggressive: drops every `type:"thinking"` block
+ *   regardless of `redacted` flag, and strips `thoughtSignature` from every
+ *   `type:"toolCall"` block.
+ * - It runs only on the rejection path in `executor-prompt-runner.ts`, after
+ *   `isSignedReplayError` has classified the error.
+ *
+ * Defensive: tolerates undefined / non-array `messages`, individual messages
+ * lacking `content`, non-array content, blocks lacking `type`. Returns the
+ * counts so the caller can emit the recovery event with accurate numbers.
+ *
+ * @module
+ */
+/**
+ * Walk every assistant message in `messages` and:
+ * - Filter out every block where `block.type === "thinking"` (signed and
+ *   redacted alike).
+ * - For every remaining block where `block.type === "toolCall"` or
+ *   `block.type === "tool_call"` (pi-ai normalizes inconsistently across
+ *   providers), delete `thoughtSignature` if present.
+ *
+ * Mutates the input array in place. Returns the number of blocks removed and
+ * the number of thoughtSignatures stripped so the caller can include them
+ * in the recovery event payload.
+ */
+export declare function scrubSignedReplayStateInPlace(messages: unknown[]): {
+    blocksRemoved: number;
+    thoughtSignaturesStripped: number;
+};

package/node_modules/@comis/agent/dist/executor/signature-block-scrubber.js

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Signed-replay state scrubber for the reject-and-retry self-heal path.
+ *
+ * Mutates the in-memory session message array in place so the next API call
+ * does not replay the rejected signed thinking / reasoning state. Distinct
+ * from the steady-state thinking-block-cleaner pipeline layer:
+ * - This scrubber is more aggressive: drops every `type:"thinking"` block
+ *   regardless of `redacted` flag, and strips `thoughtSignature` from every
+ *   `type:"toolCall"` block.
+ * - It runs only on the rejection path in `executor-prompt-runner.ts`, after
+ *   `isSignedReplayError` has classified the error.
+ *
+ * Defensive: tolerates undefined / non-array `messages`, individual messages
+ * lacking `content`, non-array content, blocks lacking `type`. Returns the
+ * counts so the caller can emit the recovery event with accurate numbers.
+ *
+ * @module
+ */
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Walk every assistant message in `messages` and:
+ * - Filter out every block where `block.type === "thinking"` (signed and
+ *   redacted alike).
+ * - For every remaining block where `block.type === "toolCall"` or
+ *   `block.type === "tool_call"` (pi-ai normalizes inconsistently across
+ *   providers), delete `thoughtSignature` if present.
+ *
+ * Mutates the input array in place. Returns the number of blocks removed and
+ * the number of thoughtSignatures stripped so the caller can include them
+ * in the recovery event payload.
+ */
+export function scrubSignedReplayStateInPlace(messages) {
+    let blocksRemoved = 0;
+    let thoughtSignaturesStripped = 0;
+    if (!Array.isArray(messages)) {
+        return { blocksRemoved, thoughtSignaturesStripped };
+    }
+    for (const msg of messages) {
+        if (!msg || typeof msg !== "object")
+            continue;
+        const m = msg;
+        if (m.role !== "assistant")
+            continue;
+        if (!Array.isArray(m.content))
+            continue;
+        const content = m.content;
+        // Walk in reverse so splicing does not shift indices we still need to visit.
+        for (let i = content.length - 1; i >= 0; i--) {
+            // eslint-disable-next-line security/detect-object-injection -- numeric index over caller's array
+            const block = content[i];
+            if (!block || typeof block !== "object")
+                continue;
+            const b = block;
+            if (b.type === "thinking") {
+                content.splice(i, 1);
+                blocksRemoved++;
+                continue;
+            }
+            if ((b.type === "toolCall" || b.type === "tool_call") && b.thoughtSignature !== undefined) {
+                delete b.thoughtSignature;
+                thoughtSignaturesStripped++;
+            }
+        }
+    }
+    return { blocksRemoved, thoughtSignaturesStripped };
+}

package/node_modules/@comis/agent/dist/executor/signed-replay-detector.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Provider-agnostic signed-replay error detector.
+ *
+ * Detects provider rejections of stored signed thinking / reasoning state on
+ * the latest assistant message during replay. Triggered by a real production
+ * incident on `srv1593437` 2026-04-24T20:07:34Z (trace
+ * `93ba66cf-4283-4ed4-92bd-73d00b4eeb76`, request_id
+ * `req_011CaPCYYKfJRpuG3w2y5s52`) where Anthropic returned
+ * `400 invalid_request_error: messages.5.content.17: 'thinking' or
+ * 'redacted_thinking' blocks in the latest assistant message cannot be
+ * modified` after a 74-min idle gap with multiple daemon restarts.
+ *
+ * Provider coverage:
+ * - Anthropic: `messages.N.content.M ... thinking|redacted_thinking ... cannot be modified`
+ *   (also via the JSON-path fast-path).
+ * - Bedrock-Claude: same wire shape as Anthropic over Bedrock.
+ * - Google Gemini / Vertex / Gemini-CLI: `thought_signature` mismatch /
+ *   verification failed / not found.
+ * - OpenAI Responses (o-series): `reasoning_item` not found / invalid /
+ *   expired / mismatch.
+ * - OpenAI Completions reasoning: `reasoning_id` not found / expired.
+ * - Mistral: `encrypted_content` mismatch / verification failed / tampered.
+ *
+ * Pure function — no I/O, no logger. The classifier in `error-classifier.ts`
+ * uses this as a `RegExp | { test(s: string): boolean }`-shaped pattern. The
+ * runner in `executor-prompt-runner.ts` uses the resulting category to drive
+ * the scrub-and-retry self-heal path.
+ *
+ * @module
+ */
+/**
+ * Returns `true` when the given error message indicates a provider has
+ * rejected stored signed thinking / reasoning state on the latest assistant
+ * turn during replay, across the seven targeted providers.
+ *
+ * Match logic: either (signature noun + rejection verb both fire) OR the
+ * Anthropic JSON-path fast-path fires.
+ */
+export declare function isSignedReplayError(message: string): boolean;

package/node_modules/@comis/agent/dist/executor/signed-replay-detector.js

@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Provider-agnostic signed-replay error detector.
+ *
+ * Detects provider rejections of stored signed thinking / reasoning state on
+ * the latest assistant message during replay. Triggered by a real production
+ * incident on `srv1593437` 2026-04-24T20:07:34Z (trace
+ * `93ba66cf-4283-4ed4-92bd-73d00b4eeb76`, request_id
+ * `req_011CaPCYYKfJRpuG3w2y5s52`) where Anthropic returned
+ * `400 invalid_request_error: messages.5.content.17: 'thinking' or
+ * 'redacted_thinking' blocks in the latest assistant message cannot be
+ * modified` after a 74-min idle gap with multiple daemon restarts.
+ *
+ * Provider coverage:
+ * - Anthropic: `messages.N.content.M ... thinking|redacted_thinking ... cannot be modified`
+ *   (also via the JSON-path fast-path).
+ * - Bedrock-Claude: same wire shape as Anthropic over Bedrock.
+ * - Google Gemini / Vertex / Gemini-CLI: `thought_signature` mismatch /
+ *   verification failed / not found.
+ * - OpenAI Responses (o-series): `reasoning_item` not found / invalid /
+ *   expired / mismatch.
+ * - OpenAI Completions reasoning: `reasoning_id` not found / expired.
+ * - Mistral: `encrypted_content` mismatch / verification failed / tampered.
+ *
+ * Pure function — no I/O, no logger. The classifier in `error-classifier.ts`
+ * uses this as a `RegExp | { test(s: string): boolean }`-shaped pattern. The
+ * runner in `executor-prompt-runner.ts` uses the resulting category to drive
+ * the scrub-and-retry self-heal path.
+ *
+ * @module
+ */
+// ---------------------------------------------------------------------------
+// Patterns (case-insensitive)
+// ---------------------------------------------------------------------------
+/**
+ * Signature-noun regex: matches the provider-specific name for "the signed
+ * piece of state attached to the assistant turn". Covers all seven targeted
+ * providers without leaking unrelated false positives.
+ */
+const SIGNATURE_NOUN = /thinking|redacted_thinking|reasoning_item|encrypted_content|thought_signature|reasoning_id/i;
+/**
+ * Rejection-verb regex: matches any of the verbs providers use to reject
+ * tampered / stale / mismatched signed state. Pairing this with a signature
+ * noun avoids matching unrelated `invalid` / `not found` errors (e.g. model
+ * not found).
+ */
+const REJECTION_VERB = /cannot be modified|not found|invalid|mismatch|verification failed|expired|tampered|stale/i;
+/**
+ * Anthropic JSON-path fast-path: matches the canonical Anthropic 400 error
+ * shape `messages.N.content.M: ...thinking|redacted_thinking...`. This shape
+ * always indicates signed-replay rejection regardless of which verb appears
+ * in the surrounding text.
+ */
+const ANTHROPIC_JSON_PATH = /messages\.\d+\.content\.\d+:.*(?:thinking|redacted_thinking)/i;
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Returns `true` when the given error message indicates a provider has
+ * rejected stored signed thinking / reasoning state on the latest assistant
+ * turn during replay, across the seven targeted providers.
+ *
+ * Match logic: either (signature noun + rejection verb both fire) OR the
+ * Anthropic JSON-path fast-path fires.
+ */
+export function isSignedReplayError(message) {
+    if (!message)
+        return false;
+    if (ANTHROPIC_JSON_PATH.test(message))
+        return true;
+    return SIGNATURE_NOUN.test(message) && REJECTION_VERB.test(message);
+}

package/node_modules/@comis/agent/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/agent",
   "private": true,
-  "version": "1.0.19",
+  "version": "1.0.23",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "AI agent executor, budget control, and session management for Comis",

package/node_modules/@comis/channels/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/channels",
   "private": true,
-  "version": "1.0.19",
+  "version": "1.0.23",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Chat platform adapters — Discord, Telegram, Slack, WhatsApp, Signal, iMessage, IRC, LINE",

package/node_modules/@comis/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/cli",
   "private": true,
-  "version": "1.0.19",
+  "version": "1.0.23",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Command-line interface for the Comis AI agent platform",