comisai 1.0.22 → 1.0.23

package/node_modules/@comis/agent/dist/executor/pi-executor.js

@@ -449,6 +449,24 @@ export function createPiExecutor(config, deps) {
                 }
                 const resourceLoader = new DefaultResourceLoader(resourceLoaderOptions);
                 await resourceLoader.reload();
+                // The SDK's `tools` is an allowlist of tool *names* (not definitions).
+                // An empty array is treated as a non-empty allowlist that allows zero
+                // tools, including all customTools — which is why the agent ran
+                // tool-less from every entry point (chat API, SSE, Telegram, etc.):
+                // every Comis tool was filtered out of the SDK's tool registry, the
+                // Anthropic API request went out with `tools: []`, and the model
+                // emitted `<tool_call>...</tool_call>` markup as plaintext that
+                // Comis's loop never parsed back.
+                //
+                // Pass our customTool names as the explicit allowlist so:
+                //   1. All customTools land in the SDK's tool registry (their names
+                //      pass `isAllowedTool`).
+                //   2. SDK built-ins like `bash` that conflict with Comis's policy
+                //      controls are filtered out (Comis uses `exec` instead, with
+                //      its own sandbox/audit hooks).
+                //   3. Where names overlap (read/edit/write), Comis's customTools
+                //      override the SDK built-ins via Map.set() in the registry
+                //      build (`agent-session.js:1810-1813` in pi-coding-agent@0.68.0).
                 const sessionOptions = {
                     cwd: deps.workspaceDir,
                     authStorage: deps.authStorage,
@@ -457,7 +475,7 @@ export function createPiExecutor(config, deps) {
                     sessionManager: sm,
                     settingsManager,
                     resourceLoader,
-                    tools: [],
+                    tools: mergedCustomTools.map((t) => t.name),
                     customTools: mergedCustomTools,
                 };
                 const { session, modelFallbackMessage } = await createAgentSession(sessionOptions);
@@ -654,11 +672,20 @@ export function createPiExecutor(config, deps) {
                     const postActiveNames = session.getActiveToolNames?.() ?? [];
                     if (postActiveNames.length < mergedToolNames.length) {
                         const rejected = mergedToolNames.filter(n => !postActiveNames.includes(n));
+                        const allRejected = postActiveNames.length === 0 && rejected.length === mergedToolNames.length;
                         deps.logger.warn({
                             rejected,
-                            hint: "SDK filtered some tools that Comis registered; check tool name collisions with SDK built-ins",
+                            rejectedCount: rejected.length,
+                            registeredCount: mergedToolNames.length,
+                            postActiveCount: postActiveNames.length,
+                            allRejected,
+                            hint: allRejected
+                                ? "SDK has 0 active tools after setActiveToolsByName -- not a name collision (empty active list, every Comis tool dropped). Indicates the SDK ResourceLoader / agent.tools handoff is broken; the LLM will receive no structured tool definitions and may emit `<tool_call>` markup as plaintext instead of using tool_use content blocks."
+                                : "SDK filtered some Comis tools; likely name collisions with SDK built-ins (e.g. SDK reserves `bash`, `read_file`, etc.). Rename or omit the listed tools to avoid the conflict.",
                             errorKind: "validation",
-                        }, "SDK rejected some tool registrations");
+                        }, allRejected
+                            ? "SDK rejected ALL tool registrations -- agent will run with no tools"
+                            : "SDK rejected some tool registrations");
                     }
                 }
                 catch (toolMgmtError) {

package/node_modules/@comis/agent/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/agent",
   "private": true,
-  "version": "1.0.22",
+  "version": "1.0.23",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "AI agent executor, budget control, and session management for Comis",

package/node_modules/@comis/channels/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/channels",
   "private": true,
-  "version": "1.0.22",
+  "version": "1.0.23",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Chat platform adapters — Discord, Telegram, Slack, WhatsApp, Signal, iMessage, IRC, LINE",

package/node_modules/@comis/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/cli",
   "private": true,
-  "version": "1.0.22",
+  "version": "1.0.23",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Command-line interface for the Comis AI agent platform",

package/node_modules/@comis/core/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/core",
   "private": true,
-  "version": "1.0.22",
+  "version": "1.0.23",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Core domain types, ports, event bus, security, and config for Comis",

package/node_modules/@comis/daemon/dist/daemon.js

@@ -182,13 +182,20 @@ export async function main(overrides = {}) {
     // better-sqlite3 'bindings' module fails fast with a clear repair hint
     // instead of cascading into a systemd restart loop.
     await _preflightDoctor(exitFn);
-    // 0. Load secrets from .env
-    const envPath = safePath(safePath(os.homedir(), ".comis"), ".env");
-    loadEnvFile(envPath);
-    // 0.5. Decrypt secrets, merge with env, scrub process.env
+    // 0. Resolve data directory, then load secrets from <dataDir>/.env.
+    // The env file always lives alongside the data dir, so it follows
+    // COMIS_DATA_DIR — set to /data inside the Docker container (matches
+    // the compose mount of ${COMIS_ENV_FILE:-~/.comis/.env}:/data/.env:ro),
+    // unset on bare-metal so it falls back to ~/.comis/.env. This is what
+    // makes the legacy "credentials in a flat .env file" workflow the
+    // default for both deployment modes; secrets.db is opt-in via
+    // SECRETS_MASTER_KEY.
     // eslint-disable-next-line no-restricted-syntax -- process.env access needed before SecretManager is initialized
     const dataDir = process.env["COMIS_DATA_DIR"]
         ?? safePath(os.homedir(), ".comis");
+    const envPath = safePath(dataDir, ".env");
+    loadEnvFile(envPath);
+    // 0.5. Decrypt secrets, merge with env, scrub process.env
     // Scan and correct permissions on known sensitive files
     const permissionCorrections = hardenDataDirPermissions(dataDir);
     const secretsBootResult = _setupSecrets({

package/node_modules/@comis/daemon/dist/wiring/setup-gateway.d.ts

@@ -14,6 +14,28 @@ import type { MemoryApi, SqliteMemoryAdapter, createEmbeddingQueue, createSessio
 import type { RpcCall } from "@comis/skills";
 import { createGatewayServer, WsConnectionManager, type GatewayServerHandle } from "@comis/gateway";
 import type { RpcDispatchDeps } from "../rpc/rpc-dispatch.js";
+/**
+ * Build the structured log fields for the gateway "Agent execution requested"
+ * INFO line. Replaces the previous behavior of logging the first 200 chars
+ * of the raw user message, which violated AGENTS.md §2.2 (no message bodies
+ * in logs at any level). Emits message length plus a short SHA-256 prefix
+ * for correlation, never the body itself.
+ *
+ * @param input.agentId       Resolved agent ID (already trust-derived).
+ * @param input.message       Raw user message (may be empty / undefined).
+ * @param input.connectionId  Optional WebSocket connection ID.
+ * @returns Object suitable for `logger.info(obj, "Agent execution requested")`.
+ */
+export declare function buildExecutionRequestedLogFields(input: {
+    agentId: string;
+    message: string | undefined;
+    connectionId: string | undefined;
+}): {
+    agentId: string;
+    messageLen: number;
+    messageHash?: string;
+    connectionId?: string;
+};
 /** All services produced by the RPC bridge setup phase. */
 export interface RpcBridgeResult {
     /** The rpcCall function usable immediately (delegates to inner dispatch once wired). */

package/node_modules/@comis/daemon/dist/wiring/setup-gateway.js

@@ -15,10 +15,39 @@ import { suppressError } from "@comis/shared";
 import { readFileSync, existsSync } from "node:fs";
 import { parseSlashCommand, createCommandHandler, createGreetingGenerator, } from "@comis/agent";
 import { createDynamicMethodRouter, createRpcAdapters, createTokenStore, WsConnectionManager, } from "@comis/gateway";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createRpcDispatch, classifyRpcError } from "../rpc/rpc-dispatch.js";
+// ===========================================================================
+// Execution-request log redaction helper
+// ===========================================================================
+/**
+ * Build the structured log fields for the gateway "Agent execution requested"
+ * INFO line. Replaces the previous behavior of logging the first 200 chars
+ * of the raw user message, which violated AGENTS.md §2.2 (no message bodies
+ * in logs at any level). Emits message length plus a short SHA-256 prefix
+ * for correlation, never the body itself.
+ *
+ * @param input.agentId       Resolved agent ID (already trust-derived).
+ * @param input.message       Raw user message (may be empty / undefined).
+ * @param input.connectionId  Optional WebSocket connection ID.
+ * @returns Object suitable for `logger.info(obj, "Agent execution requested")`.
+ */
+export function buildExecutionRequestedLogFields(input) {
+    const raw = input.message ?? "";
+    const fields = {
+        agentId: input.agentId,
+        messageLen: raw.length,
+    };
+    if (raw.length > 0) {
+        fields.messageHash = createHash("sha256").update(raw).digest("hex").slice(0, 12);
+    }
+    if (input.connectionId !== undefined) {
+        fields.connectionId = input.connectionId;
+    }
+    return fields;
+}
 /**
  * Create the rpcCall wrapper and deferred dispatch mechanism.
  * The returned rpcCall can be passed to setupTools immediately. After
@@ -296,14 +325,11 @@ export async function setupGateway(deps) {
             // Admin scope or wildcard -> admin trust; otherwise -> user trust (fail-closed).
             const trustLevel = deriveTrustLevel(params.scopes);
             gatewayLogger.debug({ scopes: params.scopes, trustLevel, agentId: execAgentId }, "Trust level derived from token scopes");
-            const rawMsg = params.message ?? "";
-            const truncated = rawMsg.length > 200;
-            gatewayLogger.info({
+            gatewayLogger.info(buildExecutionRequestedLogFields({
                 agentId: execAgentId,
-                message: rawMsg.slice(0, 200),
-                ...(truncated && { messageTruncated: true }),
-                ...(connectionId && { connectionId }),
-            }, "Agent execution requested");
+                message: params.message,
+                connectionId,
+            }), "Agent execution requested");
             // Link understanding preprocessing: enrich message text with fetched URL content
             const enrichedText = await preprocessMessageText(params.message);
             const msg = {

package/node_modules/@comis/daemon/dist/wiring/setup-tools.js

@@ -28,6 +28,11 @@ export function setupTools(deps) {
     const { rpcCall, agents, defaultAgentId, workspaceDirs, defaultWorkspaceDir, dataDir, secretManager, platformSecretNames, eventBus, skillsLogger, linkRunner, approvalGate, subprocessEnv, credentialMappingStore, onSuspiciousContent, mcpClientManager, sandboxProvider, sessionTrackerRegistry, } = deps;
     /** Per-agent ProcessRegistry instances for background process lifecycle management. */
     const processRegistries = new Map();
+    /** Agents we've already logged the no-sandbox WARN for. Per-agent assembly
+     * runs on every session/heartbeat/cron tick; without this guard the WARN
+     * repeats on every LLM call even though the underlying state is fixed at
+     * daemon startup (detectSandboxProvider runs once). */
+    const warnedNoSandboxAgents = new Set();
     function getOrCreateRegistry(agentId) {
         let registry = processRegistries.get(agentId);
         if (!registry) {
@@ -238,7 +243,15 @@ export function setupTools(deps) {
                 }
                 : undefined;
             if (!sandboxCfg && skillsConfig.execSandbox.enabled === "always") {
-                skillsLogger.warn({ agentId, hint: "Sandbox enabled in config but no provider available -- exec tool will run without OS sandbox", errorKind: "config" }, "Exec tool running without OS sandbox");
+                if (warnedNoSandboxAgents.has(agentId)) {
+                    // Already warned for this agent at WARN level — drop to DEBUG so
+                    // every per-call assembly doesn't re-log the same fact.
+                    skillsLogger.debug({ agentId }, "Exec tool running without OS sandbox (already warned at startup; per-call DEBUG)");
+                }
+                else {
+                    skillsLogger.warn({ agentId, hint: "Sandbox enabled in config but no provider available -- exec tool will run without OS sandbox", errorKind: "config" }, "Exec tool running without OS sandbox");
+                    warnedNoSandboxAgents.add(agentId);
+                }
             }
             // Exec tool -- always instantiated; builtinTools ceiling applied after profile filtering
             {

package/node_modules/@comis/daemon/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/daemon",
   "private": true,
-  "version": "1.0.22",
+  "version": "1.0.23",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Background daemon and orchestrator for the Comis platform",

package/node_modules/@comis/gateway/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/gateway",
   "private": true,
-  "version": "1.0.22",
+  "version": "1.0.23",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "HTTP, JSON-RPC, and WebSocket gateway for Comis",

package/node_modules/@comis/infra/dist/logging/log-fields.d.ts

@@ -119,10 +119,10 @@ export interface LogFields {
     closeReason: string;
     /** Semantic categorization of the WebSocket close code (e.g., "normal", "abnormal", "no-status"). */
     closeType: string;
-    /** Whether the logged message text was truncated from the original. */
-    messageTruncated: boolean;
     /** Input message character length. */
     messageLen: number;
+    /** First 12 hex chars of SHA-256 of input message; omitted when empty. Stable per content. */
+    messageHash: string;
     /** Output response character length. */
     responseLen: number;
     /** Flat input token count for easy aggregation. */

package/node_modules/@comis/infra/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/infra",
   "private": true,
-  "version": "1.0.22",
+  "version": "1.0.23",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Structured logging infrastructure for Comis",

package/node_modules/@comis/memory/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/memory",
   "private": true,
-  "version": "1.0.22",
+  "version": "1.0.23",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "SQLite memory, embeddings, and RAG storage for Comis agents",

package/node_modules/@comis/scheduler/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/scheduler",
   "private": true,
-  "version": "1.0.22",
+  "version": "1.0.23",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Task scheduling and cron management for Comis",

package/node_modules/@comis/shared/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/shared",
   "private": true,
-  "version": "1.0.22",
+  "version": "1.0.23",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Shared types and utilities for the Comis platform",

package/node_modules/@comis/skills/dist/builtin/sandbox/detect-provider.d.ts

@@ -10,6 +10,7 @@
 import type { SandboxProvider } from "./types.js";
 /** Minimal logger interface for sandbox detection. */
 export interface DetectLogger {
+    info(obj: Record<string, unknown>, msg: string): void;
     warn(obj: Record<string, unknown>, msg: string): void;
 }
 /**

package/node_modules/@comis/skills/dist/builtin/sandbox/detect-provider.js

@@ -8,8 +8,40 @@
  *
  * @module
  */
+import { existsSync } from "node:fs";
+import { spawnSync } from "node:child_process";
 import { BwrapProvider } from "./bwrap-provider.js";
 import { SandboxExecProvider } from "./sandbox-exec-provider.js";
+/**
+ * True when the daemon is running inside a Linux container. Docker writes
+ * `/.dockerenv` on container creation; Podman writes `/run/.containerenv`.
+ * One sync stat per daemon boot — runs once at sandbox detection.
+ */
+function isContainer() {
+    return existsSync("/.dockerenv") || existsSync("/run/.containerenv");
+}
+/**
+ * Smoke-test the bwrap binary against the isolation flags BwrapProvider
+ * actually uses (--unshare-pid + --proc /proc). On Docker Desktop's linuxkit
+ * kernel and similar restricted environments this combo EPERMs at the
+ * procfs mount step, even with apparmor/seccomp unconfined — every later
+ * exec call would silently fail. `available()` only checks if `bwrap` is on
+ * PATH, so without this probe the daemon would log "provider: bwrap" even
+ * when bwrap is non-functional. ~50ms one-shot at startup.
+ */
+function bwrapSmokeTest() {
+    const r = spawnSync("bwrap", [
+        "--unshare-user",
+        "--unshare-pid",
+        "--proc", "/proc",
+        "--ro-bind", "/usr", "/usr",
+        "--ro-bind", "/bin", "/bin",
+        "--ro-bind", "/lib", "/lib",
+        "--tmpfs", "/tmp",
+        "/bin/true",
+    ], { encoding: "utf8", timeout: 5000 });
+    return r.status === 0;
+}
 /**
  * Detect and return the best available sandbox provider for this platform.
  * Returns undefined if no sandbox runtime is available -- caller decides
@@ -18,12 +50,53 @@ import { SandboxExecProvider } from "./sandbox-exec-provider.js";
 export function detectSandboxProvider(logger) {
     if (process.platform === "linux") {
         const bwrap = new BwrapProvider();
-        if (bwrap.available())
+        if (bwrap.available()) {
+            if (!bwrapSmokeTest()) {
+                // bwrap is on PATH but the kernel rejects the isolation flags
+                // (typically Docker Desktop's linuxkit on macOS/Windows). Behaviour
+                // diverges by environment:
+                //
+                //  - Inside a container: the project already declares macOS/Windows
+                //    Docker Desktop as dev/testing only (CLAUDE.md, README, docs).
+                //    Returning bwrap would just make every exec call fail and
+                //    leave the agent useless for local testing. We disable the
+                //    sandbox so exec runs unsandboxed inside the container,
+                //    accepting the documented trust-boundary trade-off, and warn
+                //    loudly. /data and /etc/comis are reachable from agent exec
+                //    in this mode — never use it in production.
+                //
+                //  - Bare metal: a non-functional bwrap is a real misconfiguration
+                //    (rare on stock Linux). Surface it loudly and return the
+                //    provider so exec fails via bwrap's stderr until the operator
+                //    fixes the kernel/userns config — never silently degrade
+                //    sandboxing on a bare-metal host.
+                if (isContainer()) {
+                    logger?.warn({
+                        hint: "Kernel rejected --unshare-pid + --proc /proc (typically Docker Desktop linuxkit on macOS/Windows). Sandbox auto-disabled so agent exec is functional for development. PRODUCTION DEPLOYMENTS MUST USE A REAL LINUX HOST — see docs/operations/docker.mdx → Platform Support.",
+                        errorKind: "config",
+                    }, "Exec sandbox DISABLED (kernel limitation; container host) -- shell commands will run UNSANDBOXED. Dev/testing only.");
+                    return undefined;
+                }
+                logger?.warn({
+                    hint: "Kernel rejected --unshare-pid + --proc /proc on a bare-metal host. Check `kernel.unprivileged_userns_clone` and AppArmor's `apparmor_restrict_unprivileged_userns`. Exec calls will fail until bwrap can run.",
+                    errorKind: "config",
+                }, "bwrap installed but smoke test failed -- exec sandbox is non-functional on this kernel");
+            }
             return bwrap;
-        logger?.warn({
-            hint: "Install bubblewrap for OS-level exec sandboxing: apt install bubblewrap",
-            errorKind: "config",
-        }, "bwrap not found -- exec tool will run without OS sandbox");
+        }
+        if (isContainer()) {
+            // Container deployments treat the container itself as the trust boundary;
+            // bwrap is intentionally absent. See docs/operations/docker.mdx → Trust boundary.
+            logger?.info({
+                hint: "Container runtime detected; intra-container exec sandboxing is opt-in. To enable, install bubblewrap and run with security_opt: apparmor=unconfined / seccomp=unconfined.",
+            }, "Exec OS sandbox not present (container runtime) -- relying on container isolation");
+        }
+        else {
+            logger?.warn({
+                hint: "Install bubblewrap for OS-level exec sandboxing: apt install bubblewrap",
+                errorKind: "config",
+            }, "bwrap not found -- exec tool will run without OS sandbox");
+        }
         return undefined;
     }
     if (process.platform === "darwin") {

package/node_modules/@comis/skills/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/skills",
   "private": true,
-  "version": "1.0.22",
+  "version": "1.0.23",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Skill system, MCP integration, and tool sandbox for Comis agents",

package/node_modules/@comis/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@comis/web",
-  "version": "1.0.22",
+  "version": "1.0.23",
   "description": "Web dashboard SPA for Comis agent management",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "comisai",
-  "version": "1.0.22",
+  "version": "1.0.23",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Security-first AI agent platform — connects AI agents to Discord, Telegram, Slack, WhatsApp, and more",
@@ -111,18 +111,18 @@
     "@comis/web"
   ],
   "dependencies": {
-    "@comis/shared": "1.0.22",
-    "@comis/core": "1.0.22",
-    "@comis/infra": "1.0.22",
-    "@comis/memory": "1.0.22",
-    "@comis/gateway": "1.0.22",
-    "@comis/skills": "1.0.22",
-    "@comis/scheduler": "1.0.22",
-    "@comis/agent": "1.0.22",
-    "@comis/channels": "1.0.22",
-    "@comis/cli": "1.0.22",
-    "@comis/daemon": "1.0.22",
-    "@comis/web": "1.0.22",
+    "@comis/shared": "1.0.23",
+    "@comis/core": "1.0.23",
+    "@comis/infra": "1.0.23",
+    "@comis/memory": "1.0.23",
+    "@comis/gateway": "1.0.23",
+    "@comis/skills": "1.0.23",
+    "@comis/scheduler": "1.0.23",
+    "@comis/agent": "1.0.23",
+    "@comis/channels": "1.0.23",
+    "@comis/cli": "1.0.23",
+    "@comis/daemon": "1.0.23",
+    "@comis/web": "1.0.23",
     "@agentclientprotocol/sdk": "^0.19.0",
     "@clack/core": "^1.1.0",
     "@clack/prompts": "^1.1.0",