comisai 1.0.22 → 1.0.24

package/node_modules/@comis/agent/dist/executor/pi-executor.js

@@ -324,6 +324,23 @@ export function createPiExecutor(config, deps) {
             if (normalizedPrimary.normalized) {
                 deps.logger.debug({ original: config.model, resolved: normalizedPrimary.modelId }, "Model ID normalized via shortcut");
             }
+            // Surface the silent-fallback case where pi-coding-agent picks a different
+            // provider than the user configured. When find() returns undefined for an
+            // explicit (non-default) provider/model, pi will silently shop `findInitialModel`
+            // and pick whatever built-in has env-var auth -- e.g., GEMINI_API_KEY → google.
+            // The wiring fix in setup-agents.ts should cover the YAML-provider case; this
+            // log catches stragglers (typos, disabled providers, missing API keys).
+            if (!resolvedModel
+                && config.provider.toLowerCase() !== "default"
+                && config.model.toLowerCase() !== "default") {
+                deps.logger.warn({
+                    agentId,
+                    configuredProvider: config.provider,
+                    configuredModel: normalizedPrimary.modelId,
+                    hint: "Provider not registered in pi ModelRegistry. Check providers.entries.<name> in config.yaml has type/baseUrl/apiKeyName set, the API key resolves via SecretManager, and the provider is enabled. Without a match, pi-coding-agent silently falls back to whatever built-in provider has env-var credentials.",
+                    errorKind: "config",
+                }, "Configured provider/model not found in registry; pi-coding-agent will fall back");
+            }
             if (executionOverrides?.model) {
                 // Model override format: "provider:modelId" (same as compactionModel pattern)
                 const parts = executionOverrides.model.split(":");
@@ -449,6 +466,24 @@ export function createPiExecutor(config, deps) {
                 }
                 const resourceLoader = new DefaultResourceLoader(resourceLoaderOptions);
                 await resourceLoader.reload();
+                // The SDK's `tools` is an allowlist of tool *names* (not definitions).
+                // An empty array is treated as a non-empty allowlist that allows zero
+                // tools, including all customTools — which is why the agent ran
+                // tool-less from every entry point (chat API, SSE, Telegram, etc.):
+                // every Comis tool was filtered out of the SDK's tool registry, the
+                // Anthropic API request went out with `tools: []`, and the model
+                // emitted `<tool_call>...</tool_call>` markup as plaintext that
+                // Comis's loop never parsed back.
+                //
+                // Pass our customTool names as the explicit allowlist so:
+                //   1. All customTools land in the SDK's tool registry (their names
+                //      pass `isAllowedTool`).
+                //   2. SDK built-ins like `bash` that conflict with Comis's policy
+                //      controls are filtered out (Comis uses `exec` instead, with
+                //      its own sandbox/audit hooks).
+                //   3. Where names overlap (read/edit/write), Comis's customTools
+                //      override the SDK built-ins via Map.set() in the registry
+                //      build (`agent-session.js:1810-1813` in pi-coding-agent@0.68.0).
                 const sessionOptions = {
                     cwd: deps.workspaceDir,
                     authStorage: deps.authStorage,
@@ -457,7 +492,7 @@ export function createPiExecutor(config, deps) {
                     sessionManager: sm,
                     settingsManager,
                     resourceLoader,
-                    tools: [],
+                    tools: mergedCustomTools.map((t) => t.name),
                     customTools: mergedCustomTools,
                 };
                 const { session, modelFallbackMessage } = await createAgentSession(sessionOptions);
@@ -654,11 +689,20 @@ export function createPiExecutor(config, deps) {
                     const postActiveNames = session.getActiveToolNames?.() ?? [];
                     if (postActiveNames.length < mergedToolNames.length) {
                         const rejected = mergedToolNames.filter(n => !postActiveNames.includes(n));
+                        const allRejected = postActiveNames.length === 0 && rejected.length === mergedToolNames.length;
                         deps.logger.warn({
                             rejected,
-                            hint: "SDK filtered some tools that Comis registered; check tool name collisions with SDK built-ins",
+                            rejectedCount: rejected.length,
+                            registeredCount: mergedToolNames.length,
+                            postActiveCount: postActiveNames.length,
+                            allRejected,
+                            hint: allRejected
+                                ? "SDK has 0 active tools after setActiveToolsByName -- not a name collision (empty active list, every Comis tool dropped). Indicates the SDK ResourceLoader / agent.tools handoff is broken; the LLM will receive no structured tool definitions and may emit `<tool_call>` markup as plaintext instead of using tool_use content blocks."
+                                : "SDK filtered some Comis tools; likely name collisions with SDK built-ins (e.g. SDK reserves `bash`, `read_file`, etc.). Rename or omit the listed tools to avoid the conflict.",
                             errorKind: "validation",
-                        }, "SDK rejected some tool registrations");
+                        }, allRejected
+                            ? "SDK rejected ALL tool registrations -- agent will run with no tools"
+                            : "SDK rejected some tool registrations");
                     }
                 }
                 catch (toolMgmtError) {

package/node_modules/@comis/agent/dist/index.d.ts

@@ -135,7 +135,8 @@ export { createPiEventBridge } from "./bridge/pi-event-bridge.js";
 export type { PiEventBridgeDeps, PiEventBridgeResult } from "./bridge/pi-event-bridge.js";
 export { createAuthStorageAdapter, DEFAULT_PROVIDER_KEYS } from "./model/auth-storage-adapter.js";
 export type { AuthStorageAdapterOptions } from "./model/auth-storage-adapter.js";
-export { createModelRegistryAdapter, resolveInitialModel } from "./model/model-registry-adapter.js";
+export { createModelRegistryAdapter, registerCustomProviders, resolveInitialModel } from "./model/model-registry-adapter.js";
+export type { CustomProviderRegistration, CustomProviderLogger } from "./model/model-registry-adapter.js";
 export { sessionKeyToPath, pathToSessionKey } from "./session/session-key-mapper.js";
 export { detectBrokenFollowThrough, FOLLOW_THROUGH_PATTERNS } from "./safety/response-safety-checks.js";
 export type { FollowThroughResult } from "./safety/response-safety-checks.js";

package/node_modules/@comis/agent/dist/index.js

@@ -135,7 +135,7 @@ export { createPiEventBridge } from "./bridge/pi-event-bridge.js";
 // Auth storage adapter (SecretManager to pi-coding-agent AuthStorage)
 export { createAuthStorageAdapter, DEFAULT_PROVIDER_KEYS } from "./model/auth-storage-adapter.js";
 // Model registry adapter (ModelRegistry creation + initial model resolution)
-export { createModelRegistryAdapter, resolveInitialModel } from "./model/model-registry-adapter.js";
+export { createModelRegistryAdapter, registerCustomProviders, resolveInitialModel } from "./model/model-registry-adapter.js";
 // Session key mapper (SessionKey to/from filesystem path)
 export { sessionKeyToPath, pathToSessionKey } from "./session/session-key-mapper.js";
 // ---------------------------------------------------------------------------

package/node_modules/@comis/agent/dist/model/auth-storage-adapter.d.ts

@@ -10,12 +10,33 @@ import { AuthStorage } from "@mariozechner/pi-coding-agent";
 import type { SecretManager } from "@comis/core";
 /** Default provider-to-env-var mapping for known LLM providers. */
 export declare const DEFAULT_PROVIDER_KEYS: Record<string, string>;
+/**
+ * Custom YAML provider entry projection used to populate AuthStorage with
+ * runtime API keys for providers declared under `providers.entries.*`.
+ *
+ * Only the fields needed for credential wiring are included -- the full
+ * ProviderEntry lives in @comis/core but importing it here would pull
+ * the entire config domain into the agent package.
+ */
+export interface CustomProviderAuth {
+    /** SecretManager key name for the API key (e.g., "NVIDIA_API_KEY"). */
+    apiKeyName: string;
+    /** Whether the provider is enabled. Disabled entries are skipped. */
+    enabled: boolean;
+}
 /** Options for creating an AuthStorage adapter. */
 export interface AuthStorageAdapterOptions {
     /** SecretManager to read API keys from. */
     secretManager: SecretManager;
     /** Additional provider-to-env-var mappings beyond the defaults. */
     additionalProviderKeys?: Record<string, string>;
+    /**
+     * Custom YAML provider entries (`providers.entries.*`). Each entry's
+     * `apiKeyName` is resolved through `secretManager` and registered as a
+     * runtime override on the returned AuthStorage. Disabled entries and
+     * entries with empty `apiKeyName` are skipped silently.
+     */
+    customProviderEntries?: Record<string, CustomProviderAuth>;
 }
 /**
  * Create an AuthStorage populated with API keys from SecretManager.

package/node_modules/@comis/agent/dist/model/auth-storage-adapter.js

@@ -24,7 +24,7 @@ export const DEFAULT_PROVIDER_KEYS = {
  * setRuntimeApiKey() for found keys. Missing keys are silently skipped.
  */
 export function createAuthStorageAdapter(options) {
-    const { secretManager, additionalProviderKeys } = options;
+    const { secretManager, additionalProviderKeys, customProviderEntries } = options;
     const storage = AuthStorage.fromStorage(new InMemoryAuthStorageBackend());
     const allProviderKeys = { ...DEFAULT_PROVIDER_KEYS, ...additionalProviderKeys };
     for (const [provider, envKey] of Object.entries(allProviderKeys)) {
@@ -33,5 +33,19 @@ export function createAuthStorageAdapter(options) {
             storage.setRuntimeApiKey(provider, apiKey);
         }
     }
+    // Custom YAML providers (providers.entries.*). Runtime overrides take
+    // priority over auth.json and env-var fallback in pi-coding-agent, so
+    // YAML config wins over any stray env keys (e.g., GEMINI_API_KEY) that
+    // might otherwise satisfy hasAuth() for an unrelated built-in provider.
+    if (customProviderEntries) {
+        for (const [providerName, entry] of Object.entries(customProviderEntries)) {
+            if (!entry.enabled || !entry.apiKeyName)
+                continue;
+            const apiKey = secretManager.get(entry.apiKeyName);
+            if (apiKey) {
+                storage.setRuntimeApiKey(providerName, apiKey);
+            }
+        }
+    }
     return storage;
 }

package/node_modules/@comis/agent/dist/model/model-registry-adapter.d.ts

@@ -12,6 +12,7 @@ import { ModelRegistry } from "@mariozechner/pi-coding-agent";
 import type { AuthStorage } from "@mariozechner/pi-coding-agent";
 import type { Api, Model } from "@mariozechner/pi-ai";
 import type { ThinkingLevel } from "@mariozechner/pi-agent-core";
+import type { SecretManager } from "@comis/core";
 import type { ModelAllowlist } from "./model-allowlist.js";
 /** Result of initial model resolution. */
 export interface InitialModelResult {
@@ -30,6 +31,51 @@ export interface InitialModelResult {
  * have API keys configured in AuthStorage.
  */
 export declare function createModelRegistryAdapter(authStorage: AuthStorage): ModelRegistry;
+/** Subset of `ProviderEntry` (from `@comis/core`) we read for pi registration. */
+export interface CustomProviderRegistration {
+    type: string;
+    baseUrl: string;
+    apiKeyName: string;
+    enabled: boolean;
+    headers: Record<string, string>;
+    models: ReadonlyArray<{
+        id: string;
+        name?: string;
+        contextWindow?: number;
+        maxTokens?: number;
+        reasoning?: boolean;
+        input?: ReadonlyArray<"text" | "image">;
+        cost?: {
+            input?: number;
+            output?: number;
+            cacheRead?: number;
+            cacheWrite?: number;
+        };
+    }>;
+}
+/** Logger surface accepted by `registerCustomProviders`. Subset of Pino. */
+export interface CustomProviderLogger {
+    warn(obj: Record<string, unknown>, msg: string): void;
+    debug(obj: Record<string, unknown>, msg: string): void;
+}
+/**
+ * Register YAML `providers.entries.*` with pi-coding-agent's ModelRegistry.
+ *
+ * Without this, custom OpenAI-compatible providers (NVIDIA NIM, Together,
+ * ollama, etc.) are not findable via `registry.find(provider, modelId)`,
+ * which causes pi's `findInitialModel` to silently fall back to whatever
+ * built-in provider has env-var auth (e.g., GEMINI_API_KEY → google).
+ *
+ * Per-entry behavior:
+ *   - Skipped if `enabled === false`.
+ *   - Skipped if no models declared and no `baseUrl` override.
+ *   - On `registerProvider` error (missing baseUrl, missing apiKey, etc.),
+ *     a WARN is logged and the loop continues -- one bad entry must not
+ *     prevent the daemon from starting.
+ *
+ * @returns Number of entries successfully registered.
+ */
+export declare function registerCustomProviders(registry: ModelRegistry, entries: Record<string, CustomProviderRegistration>, secretManager: SecretManager, logger: CustomProviderLogger): number;
 /**
  * Resolve the initial model for an agent session.
  *

package/node_modules/@comis/agent/dist/model/model-registry-adapter.js

@@ -20,6 +20,114 @@ import { ModelRegistry } from "@mariozechner/pi-coding-agent";
 export function createModelRegistryAdapter(authStorage) {
     return ModelRegistry.inMemory(authStorage);
 }
+/**
+ * YAML provider type → pi-ai API identifier. Mirrors the
+ * `OPENAI_COMPATIBLE_TYPES` set in `model-scanner.ts`. Unknown types
+ * default to `openai-completions` so arbitrary OpenAI-compatible
+ * proxies (NVIDIA NIM, Together, ollama, lm-studio, etc.) work without
+ * code changes.
+ */
+const PROVIDER_TYPE_TO_API = {
+    openai: "openai-completions",
+    groq: "openai-completions",
+    mistral: "openai-completions",
+    together: "openai-completions",
+    deepseek: "openai-completions",
+    cerebras: "openai-completions",
+    xai: "openai-completions",
+    openrouter: "openai-completions",
+    anthropic: "anthropic-messages",
+    google: "google-generative-ai",
+};
+/**
+ * Register YAML `providers.entries.*` with pi-coding-agent's ModelRegistry.
+ *
+ * Without this, custom OpenAI-compatible providers (NVIDIA NIM, Together,
+ * ollama, etc.) are not findable via `registry.find(provider, modelId)`,
+ * which causes pi's `findInitialModel` to silently fall back to whatever
+ * built-in provider has env-var auth (e.g., GEMINI_API_KEY → google).
+ *
+ * Per-entry behavior:
+ *   - Skipped if `enabled === false`.
+ *   - Skipped if no models declared and no `baseUrl` override.
+ *   - On `registerProvider` error (missing baseUrl, missing apiKey, etc.),
+ *     a WARN is logged and the loop continues -- one bad entry must not
+ *     prevent the daemon from starting.
+ *
+ * @returns Number of entries successfully registered.
+ */
+export function registerCustomProviders(registry, entries, secretManager, logger) {
+    let registered = 0;
+    for (const [providerName, entry] of Object.entries(entries)) {
+        if (!entry.enabled) {
+            logger.debug({ providerName }, "Custom provider skipped (disabled)");
+            continue;
+        }
+        const hasModels = entry.models.length > 0;
+        const hasBaseUrlOverride = !!entry.baseUrl;
+        if (!hasModels && !hasBaseUrlOverride) {
+            logger.debug({ providerName }, "Custom provider skipped (no models and no baseUrl override)");
+            continue;
+        }
+        const apiKey = entry.apiKeyName ? secretManager.get(entry.apiKeyName) : undefined;
+        if (hasModels && !apiKey) {
+            logger.warn({
+                providerName,
+                apiKeyName: entry.apiKeyName,
+                hint: "Set the named secret in ~/.comis/.env or remove the provider entry from config.yaml",
+                errorKind: "config",
+            }, "Custom provider has models but no API key -- skipping registration");
+            continue;
+        }
+        const api = PROVIDER_TYPE_TO_API[entry.type] ?? "openai-completions";
+        const headersResolved = Object.keys(entry.headers).length > 0 ? entry.headers : undefined;
+        try {
+            registry.registerProvider(providerName, {
+                api,
+                baseUrl: entry.baseUrl || undefined,
+                apiKey,
+                headers: headersResolved,
+                // pi's ProviderModelConfig requires concrete values for name/cost/
+                // contextWindow/maxTokens. Comis's UserModelSchema lets users omit
+                // these (defaults to optional/undefined), so we fill in zeros and
+                // a generous default context window. Cost is informational only
+                // and our CostTracker uses pi-ai's own catalog where it can.
+                models: hasModels
+                    ? entry.models.map((m) => ({
+                        id: m.id,
+                        name: m.name ?? m.id,
+                        contextWindow: m.contextWindow ?? 128_000,
+                        maxTokens: m.maxTokens ?? 4_096,
+                        reasoning: m.reasoning ?? false,
+                        input: m.input ? [...m.input] : ["text"],
+                        cost: {
+                            input: m.cost?.input ?? 0,
+                            output: m.cost?.output ?? 0,
+                            cacheRead: m.cost?.cacheRead ?? 0,
+                            cacheWrite: m.cost?.cacheWrite ?? 0,
+                        },
+                    }))
+                    : undefined,
+            });
+            registered += 1;
+            logger.debug({
+                providerName,
+                api,
+                baseUrl: entry.baseUrl,
+                modelCount: entry.models.length,
+            }, "Custom provider registered with pi ModelRegistry");
+        }
+        catch (error) {
+            logger.warn({
+                providerName,
+                err: error instanceof Error ? error.message : String(error),
+                hint: "Check providers.entries config: baseUrl required when defining models; apiKey required unless oauth configured",
+                errorKind: "config",
+            }, "Custom provider registration failed");
+        }
+    }
+    return registered;
+}
 /**
  * Resolve the initial model for an agent session.
  *

package/node_modules/@comis/agent/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/agent",
   "private": true,
-  "version": "1.0.22",
+  "version": "1.0.24",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "AI agent executor, budget control, and session management for Comis",

package/node_modules/@comis/channels/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/channels",
   "private": true,
-  "version": "1.0.22",
+  "version": "1.0.24",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Chat platform adapters — Discord, Telegram, Slack, WhatsApp, Signal, iMessage, IRC, LINE",

package/node_modules/@comis/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/cli",
   "private": true,
-  "version": "1.0.22",
+  "version": "1.0.24",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Command-line interface for the Comis AI agent platform",

package/node_modules/@comis/core/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/core",
   "private": true,
-  "version": "1.0.22",
+  "version": "1.0.24",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Core domain types, ports, event bus, security, and config for Comis",

package/node_modules/@comis/daemon/dist/daemon.js

@@ -182,13 +182,20 @@ export async function main(overrides = {}) {
     // better-sqlite3 'bindings' module fails fast with a clear repair hint
     // instead of cascading into a systemd restart loop.
     await _preflightDoctor(exitFn);
-    // 0. Load secrets from .env
-    const envPath = safePath(safePath(os.homedir(), ".comis"), ".env");
-    loadEnvFile(envPath);
-    // 0.5. Decrypt secrets, merge with env, scrub process.env
+    // 0. Resolve data directory, then load secrets from <dataDir>/.env.
+    // The env file always lives alongside the data dir, so it follows
+    // COMIS_DATA_DIR — set to /data inside the Docker container (matches
+    // the compose mount of ${COMIS_ENV_FILE:-~/.comis/.env}:/data/.env:ro),
+    // unset on bare-metal so it falls back to ~/.comis/.env. This is what
+    // makes the legacy "credentials in a flat .env file" workflow the
+    // default for both deployment modes; secrets.db is opt-in via
+    // SECRETS_MASTER_KEY.
     // eslint-disable-next-line no-restricted-syntax -- process.env access needed before SecretManager is initialized
     const dataDir = process.env["COMIS_DATA_DIR"]
         ?? safePath(os.homedir(), ".comis");
+    const envPath = safePath(dataDir, ".env");
+    loadEnvFile(envPath);
+    // 0.5. Decrypt secrets, merge with env, scrub process.env
     // Scan and correct permissions on known sensitive files
     const permissionCorrections = hardenDataDirPermissions(dataDir);
     const secretsBootResult = _setupSecrets({

package/node_modules/@comis/daemon/dist/wiring/setup-agents.js

@@ -12,7 +12,7 @@ import { createHmac } from "node:crypto";
 import { homedir } from "node:os";
 import { existsSync, mkdirSync } from "node:fs";
 import { isAbsolute, resolve } from "node:path";
-import { createCircuitBreaker, createBudgetGuard, createCostTracker, createStepCounter, createSessionLifecycle, ensureWorkspace, resolveWorkspaceDir, createPiExecutor, createComisSessionManager, cleanupStaleLocks, createAuthStorageAdapter, createModelRegistryAdapter, createProviderHealthMonitor, setSanitizeLogger, setToolNormalizationLogger, LEAN_TOOL_DESCRIPTIONS, resolveDescription, } from "@comis/agent";
+import { createCircuitBreaker, createBudgetGuard, createCostTracker, createStepCounter, createSessionLifecycle, ensureWorkspace, resolveWorkspaceDir, createPiExecutor, createComisSessionManager, cleanupStaleLocks, createAuthStorageAdapter, createModelRegistryAdapter, registerCustomProviders, createProviderHealthMonitor, setSanitizeLogger, setToolNormalizationLogger, LEAN_TOOL_DESCRIPTIONS, resolveDescription, } from "@comis/agent";
 import { agentToolsToToolDefinitions, createSkillRegistry, createRuntimeEligibilityContext, TOOL_PROFILES, } from "@comis/skills";
 // ---------------------------------------------------------------------------
 // Single-agent setup (extracted for hot-add reuse)
@@ -60,9 +60,21 @@ export async function setupSingleAgent(agentId, rawAgentConfig, deps) {
         eventBus: container.eventBus,
     });
     agentLogger.debug({ agentId, allowPatterns: agentSecrets.allow }, "Per-agent ScopedSecretManager created");
-    // Per-agent auth + model registry (moved from shared to per-agent for credential isolation)
-    const piAuthStorage = createAuthStorageAdapter({ secretManager: scopedManager });
+    // Per-agent auth + model registry (moved from shared to per-agent for credential isolation).
+    // Custom YAML providers under `providers.entries.*` are wired into both auth (runtime API
+    // key overrides) and the registry (so `find(provider, modelId)` succeeds) -- without this,
+    // pi-coding-agent silently falls back to whatever built-in provider has env-var auth (e.g.,
+    // GEMINI_API_KEY → google), bypassing the configured provider entirely.
+    const customProviderEntries = container.config.providers?.entries ?? {};
+    const piAuthStorage = createAuthStorageAdapter({
+        secretManager: scopedManager,
+        customProviderEntries,
+    });
     const piModelRegistry = createModelRegistryAdapter(piAuthStorage);
+    const customProviderCount = registerCustomProviders(piModelRegistry, customProviderEntries, scopedManager, agentLogger);
+    if (customProviderCount > 0) {
+        agentLogger.debug({ agentId, customProviderCount }, "Custom YAML providers registered with pi ModelRegistry");
+    }
     // Create JSONL session adapter for this agent
     const lockDir = safePath(dir, ".locks");
     const sessionAdapter = createComisSessionManager({

package/node_modules/@comis/daemon/dist/wiring/setup-gateway.d.ts

@@ -14,6 +14,28 @@ import type { MemoryApi, SqliteMemoryAdapter, createEmbeddingQueue, createSessio
 import type { RpcCall } from "@comis/skills";
 import { createGatewayServer, WsConnectionManager, type GatewayServerHandle } from "@comis/gateway";
 import type { RpcDispatchDeps } from "../rpc/rpc-dispatch.js";
+/**
+ * Build the structured log fields for the gateway "Agent execution requested"
+ * INFO line. Replaces the previous behavior of logging the first 200 chars
+ * of the raw user message, which violated AGENTS.md §2.2 (no message bodies
+ * in logs at any level). Emits message length plus a short SHA-256 prefix
+ * for correlation, never the body itself.
+ *
+ * @param input.agentId       Resolved agent ID (already trust-derived).
+ * @param input.message       Raw user message (may be empty / undefined).
+ * @param input.connectionId  Optional WebSocket connection ID.
+ * @returns Object suitable for `logger.info(obj, "Agent execution requested")`.
+ */
+export declare function buildExecutionRequestedLogFields(input: {
+    agentId: string;
+    message: string | undefined;
+    connectionId: string | undefined;
+}): {
+    agentId: string;
+    messageLen: number;
+    messageHash?: string;
+    connectionId?: string;
+};
 /** All services produced by the RPC bridge setup phase. */
 export interface RpcBridgeResult {
     /** The rpcCall function usable immediately (delegates to inner dispatch once wired). */

package/node_modules/@comis/daemon/dist/wiring/setup-gateway.js

@@ -15,10 +15,39 @@ import { suppressError } from "@comis/shared";
 import { readFileSync, existsSync } from "node:fs";
 import { parseSlashCommand, createCommandHandler, createGreetingGenerator, } from "@comis/agent";
 import { createDynamicMethodRouter, createRpcAdapters, createTokenStore, WsConnectionManager, } from "@comis/gateway";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createRpcDispatch, classifyRpcError } from "../rpc/rpc-dispatch.js";
+// ===========================================================================
+// Execution-request log redaction helper
+// ===========================================================================
+/**
+ * Build the structured log fields for the gateway "Agent execution requested"
+ * INFO line. Replaces the previous behavior of logging the first 200 chars
+ * of the raw user message, which violated AGENTS.md §2.2 (no message bodies
+ * in logs at any level). Emits message length plus a short SHA-256 prefix
+ * for correlation, never the body itself.
+ *
+ * @param input.agentId       Resolved agent ID (already trust-derived).
+ * @param input.message       Raw user message (may be empty / undefined).
+ * @param input.connectionId  Optional WebSocket connection ID.
+ * @returns Object suitable for `logger.info(obj, "Agent execution requested")`.
+ */
+export function buildExecutionRequestedLogFields(input) {
+    const raw = input.message ?? "";
+    const fields = {
+        agentId: input.agentId,
+        messageLen: raw.length,
+    };
+    if (raw.length > 0) {
+        fields.messageHash = createHash("sha256").update(raw).digest("hex").slice(0, 12);
+    }
+    if (input.connectionId !== undefined) {
+        fields.connectionId = input.connectionId;
+    }
+    return fields;
+}
 /**
  * Create the rpcCall wrapper and deferred dispatch mechanism.
  * The returned rpcCall can be passed to setupTools immediately. After
@@ -296,14 +325,11 @@ export async function setupGateway(deps) {
             // Admin scope or wildcard -> admin trust; otherwise -> user trust (fail-closed).
             const trustLevel = deriveTrustLevel(params.scopes);
             gatewayLogger.debug({ scopes: params.scopes, trustLevel, agentId: execAgentId }, "Trust level derived from token scopes");
-            const rawMsg = params.message ?? "";
-            const truncated = rawMsg.length > 200;
-            gatewayLogger.info({
+            gatewayLogger.info(buildExecutionRequestedLogFields({
                 agentId: execAgentId,
-                message: rawMsg.slice(0, 200),
-                ...(truncated && { messageTruncated: true }),
-                ...(connectionId && { connectionId }),
-            }, "Agent execution requested");
+                message: params.message,
+                connectionId,
+            }), "Agent execution requested");
             // Link understanding preprocessing: enrich message text with fetched URL content
             const enrichedText = await preprocessMessageText(params.message);
             const msg = {

package/node_modules/@comis/daemon/dist/wiring/setup-tools.js

@@ -28,6 +28,11 @@ export function setupTools(deps) {
     const { rpcCall, agents, defaultAgentId, workspaceDirs, defaultWorkspaceDir, dataDir, secretManager, platformSecretNames, eventBus, skillsLogger, linkRunner, approvalGate, subprocessEnv, credentialMappingStore, onSuspiciousContent, mcpClientManager, sandboxProvider, sessionTrackerRegistry, } = deps;
     /** Per-agent ProcessRegistry instances for background process lifecycle management. */
     const processRegistries = new Map();
+    /** Agents we've already logged the no-sandbox WARN for. Per-agent assembly
+     * runs on every session/heartbeat/cron tick; without this guard the WARN
+     * repeats on every LLM call even though the underlying state is fixed at
+     * daemon startup (detectSandboxProvider runs once). */
+    const warnedNoSandboxAgents = new Set();
     function getOrCreateRegistry(agentId) {
         let registry = processRegistries.get(agentId);
         if (!registry) {
@@ -238,7 +243,15 @@ export function setupTools(deps) {
                 }
                 : undefined;
             if (!sandboxCfg && skillsConfig.execSandbox.enabled === "always") {
-                skillsLogger.warn({ agentId, hint: "Sandbox enabled in config but no provider available -- exec tool will run without OS sandbox", errorKind: "config" }, "Exec tool running without OS sandbox");
+                if (warnedNoSandboxAgents.has(agentId)) {
+                    // Already warned for this agent at WARN level — drop to DEBUG so
+                    // every per-call assembly doesn't re-log the same fact.
+                    skillsLogger.debug({ agentId }, "Exec tool running without OS sandbox (already warned at startup; per-call DEBUG)");
+                }
+                else {
+                    skillsLogger.warn({ agentId, hint: "Sandbox enabled in config but no provider available -- exec tool will run without OS sandbox", errorKind: "config" }, "Exec tool running without OS sandbox");
+                    warnedNoSandboxAgents.add(agentId);
+                }
             }
             // Exec tool -- always instantiated; builtinTools ceiling applied after profile filtering
             {

package/node_modules/@comis/daemon/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/daemon",
   "private": true,
-  "version": "1.0.22",
+  "version": "1.0.24",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Background daemon and orchestrator for the Comis platform",

package/node_modules/@comis/gateway/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/gateway",
   "private": true,
-  "version": "1.0.22",
+  "version": "1.0.24",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "HTTP, JSON-RPC, and WebSocket gateway for Comis",

package/node_modules/@comis/infra/dist/logging/log-fields.d.ts

@@ -119,10 +119,10 @@ export interface LogFields {
     closeReason: string;
     /** Semantic categorization of the WebSocket close code (e.g., "normal", "abnormal", "no-status"). */
     closeType: string;
-    /** Whether the logged message text was truncated from the original. */
-    messageTruncated: boolean;
     /** Input message character length. */
     messageLen: number;
+    /** First 12 hex chars of SHA-256 of input message; omitted when empty. Stable per content. */
+    messageHash: string;
     /** Output response character length. */
     responseLen: number;
     /** Flat input token count for easy aggregation. */

package/node_modules/@comis/infra/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/infra",
   "private": true,
-  "version": "1.0.22",
+  "version": "1.0.24",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Structured logging infrastructure for Comis",

package/node_modules/@comis/memory/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/memory",
   "private": true,
-  "version": "1.0.22",
+  "version": "1.0.24",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "SQLite memory, embeddings, and RAG storage for Comis agents",

package/node_modules/@comis/scheduler/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/scheduler",
   "private": true,
-  "version": "1.0.22",
+  "version": "1.0.24",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Task scheduling and cron management for Comis",

package/node_modules/@comis/shared/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/shared",
   "private": true,
-  "version": "1.0.22",
+  "version": "1.0.24",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Shared types and utilities for the Comis platform",

package/node_modules/@comis/skills/dist/builtin/sandbox/detect-provider.d.ts

@@ -10,6 +10,7 @@
 import type { SandboxProvider } from "./types.js";
 /** Minimal logger interface for sandbox detection. */
 export interface DetectLogger {
+    info(obj: Record<string, unknown>, msg: string): void;
     warn(obj: Record<string, unknown>, msg: string): void;
 }
 /**

package/node_modules/@comis/skills/dist/builtin/sandbox/detect-provider.js

@@ -8,8 +8,40 @@
  *
  * @module
  */
+import { existsSync } from "node:fs";
+import { spawnSync } from "node:child_process";
 import { BwrapProvider } from "./bwrap-provider.js";
 import { SandboxExecProvider } from "./sandbox-exec-provider.js";
+/**
+ * True when the daemon is running inside a Linux container. Docker writes
+ * `/.dockerenv` on container creation; Podman writes `/run/.containerenv`.
+ * One sync stat per daemon boot — runs once at sandbox detection.
+ */
+function isContainer() {
+    return existsSync("/.dockerenv") || existsSync("/run/.containerenv");
+}
+/**
+ * Smoke-test the bwrap binary against the isolation flags BwrapProvider
+ * actually uses (--unshare-pid + --proc /proc). On Docker Desktop's linuxkit
+ * kernel and similar restricted environments this combo EPERMs at the
+ * procfs mount step, even with apparmor/seccomp unconfined — every later
+ * exec call would silently fail. `available()` only checks if `bwrap` is on
+ * PATH, so without this probe the daemon would log "provider: bwrap" even
+ * when bwrap is non-functional. ~50ms one-shot at startup.
+ */
+function bwrapSmokeTest() {
+    const r = spawnSync("bwrap", [
+        "--unshare-user",
+        "--unshare-pid",
+        "--proc", "/proc",
+        "--ro-bind", "/usr", "/usr",
+        "--ro-bind", "/bin", "/bin",
+        "--ro-bind", "/lib", "/lib",
+        "--tmpfs", "/tmp",
+        "/bin/true",
+    ], { encoding: "utf8", timeout: 5000 });
+    return r.status === 0;
+}
 /**
  * Detect and return the best available sandbox provider for this platform.
  * Returns undefined if no sandbox runtime is available -- caller decides
@@ -18,12 +50,53 @@ import { SandboxExecProvider } from "./sandbox-exec-provider.js";
 export function detectSandboxProvider(logger) {
     if (process.platform === "linux") {
         const bwrap = new BwrapProvider();
-        if (bwrap.available())
+        if (bwrap.available()) {
+            if (!bwrapSmokeTest()) {
+                // bwrap is on PATH but the kernel rejects the isolation flags
+                // (typically Docker Desktop's linuxkit on macOS/Windows). Behaviour
+                // diverges by environment:
+                //
+                //  - Inside a container: the project already declares macOS/Windows
+                //    Docker Desktop as dev/testing only (CLAUDE.md, README, docs).
+                //    Returning bwrap would just make every exec call fail and
+                //    leave the agent useless for local testing. We disable the
+                //    sandbox so exec runs unsandboxed inside the container,
+                //    accepting the documented trust-boundary trade-off, and warn
+                //    loudly. /data and /etc/comis are reachable from agent exec
+                //    in this mode — never use it in production.
+                //
+                //  - Bare metal: a non-functional bwrap is a real misconfiguration
+                //    (rare on stock Linux). Surface it loudly and return the
+                //    provider so exec fails via bwrap's stderr until the operator
+                //    fixes the kernel/userns config — never silently degrade
+                //    sandboxing on a bare-metal host.
+                if (isContainer()) {
+                    logger?.warn({
+                        hint: "Kernel rejected --unshare-pid + --proc /proc (typically Docker Desktop linuxkit on macOS/Windows). Sandbox auto-disabled so agent exec is functional for development. PRODUCTION DEPLOYMENTS MUST USE A REAL LINUX HOST — see docs/operations/docker.mdx → Platform Support.",
+                        errorKind: "config",
+                    }, "Exec sandbox DISABLED (kernel limitation; container host) -- shell commands will run UNSANDBOXED. Dev/testing only.");
+                    return undefined;
+                }
+                logger?.warn({
+                    hint: "Kernel rejected --unshare-pid + --proc /proc on a bare-metal host. Check `kernel.unprivileged_userns_clone` and AppArmor's `apparmor_restrict_unprivileged_userns`. Exec calls will fail until bwrap can run.",
+                    errorKind: "config",
+                }, "bwrap installed but smoke test failed -- exec sandbox is non-functional on this kernel");
+            }
             return bwrap;
-        logger?.warn({
-            hint: "Install bubblewrap for OS-level exec sandboxing: apt install bubblewrap",
-            errorKind: "config",
-        }, "bwrap not found -- exec tool will run without OS sandbox");
+        }
+        if (isContainer()) {
+            // Container deployments treat the container itself as the trust boundary;
+            // bwrap is intentionally absent. See docs/operations/docker.mdx → Trust boundary.
+            logger?.info({
+                hint: "Container runtime detected; intra-container exec sandboxing is opt-in. To enable, install bubblewrap and run with security_opt: apparmor=unconfined / seccomp=unconfined.",
+            }, "Exec OS sandbox not present (container runtime) -- relying on container isolation");
+        }
+        else {
+            logger?.warn({
+                hint: "Install bubblewrap for OS-level exec sandboxing: apt install bubblewrap",
+                errorKind: "config",
+            }, "bwrap not found -- exec tool will run without OS sandbox");
+        }
         return undefined;
     }
     if (process.platform === "darwin") {

package/node_modules/@comis/skills/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/skills",
   "private": true,
-  "version": "1.0.22",
+  "version": "1.0.24",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Skill system, MCP integration, and tool sandbox for Comis agents",

package/node_modules/@comis/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@comis/web",
-  "version": "1.0.22",
+  "version": "1.0.24",
   "description": "Web dashboard SPA for Comis agent management",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "comisai",
-  "version": "1.0.22",
+  "version": "1.0.24",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Security-first AI agent platform — connects AI agents to Discord, Telegram, Slack, WhatsApp, and more",
@@ -111,18 +111,18 @@
     "@comis/web"
   ],
   "dependencies": {
-    "@comis/shared": "1.0.22",
-    "@comis/core": "1.0.22",
-    "@comis/infra": "1.0.22",
-    "@comis/memory": "1.0.22",
-    "@comis/gateway": "1.0.22",
-    "@comis/skills": "1.0.22",
-    "@comis/scheduler": "1.0.22",
-    "@comis/agent": "1.0.22",
-    "@comis/channels": "1.0.22",
-    "@comis/cli": "1.0.22",
-    "@comis/daemon": "1.0.22",
-    "@comis/web": "1.0.22",
+    "@comis/shared": "1.0.24",
+    "@comis/core": "1.0.24",
+    "@comis/infra": "1.0.24",
+    "@comis/memory": "1.0.24",
+    "@comis/gateway": "1.0.24",
+    "@comis/skills": "1.0.24",
+    "@comis/scheduler": "1.0.24",
+    "@comis/agent": "1.0.24",
+    "@comis/channels": "1.0.24",
+    "@comis/cli": "1.0.24",
+    "@comis/daemon": "1.0.24",
+    "@comis/web": "1.0.24",
     "@agentclientprotocol/sdk": "^0.19.0",
     "@clack/core": "^1.1.0",
     "@clack/prompts": "^1.1.0",