comisai 1.0.24 → 1.0.25

package/node_modules/@comis/agent/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/agent",
   "private": true,
-  "version": "1.0.24",
+  "version": "1.0.25",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "AI agent executor, budget control, and session management for Comis",

package/node_modules/@comis/channels/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/channels",
   "private": true,
-  "version": "1.0.24",
+  "version": "1.0.25",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Chat platform adapters — Discord, Telegram, Slack, WhatsApp, Signal, iMessage, IRC, LINE",

package/node_modules/@comis/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/cli",
   "private": true,
-  "version": "1.0.24",
+  "version": "1.0.25",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Command-line interface for the Comis AI agent platform",

package/node_modules/@comis/core/dist/bootstrap.js

@@ -2,6 +2,7 @@ import { ok, err } from "@comis/shared";
 import os from "node:os";
 import path from "node:path";
 import { loadLayered } from "./config/layered.js";
+import { buildGatewayEnvLayer } from "./config/env-layer.js";
 import { TypedEventBus } from "./event-bus/index.js";
 import { createSecretManager, safePath } from "./security/index.js";
 import { createPluginRegistry } from "./hooks/plugin-registry.js";
@@ -44,12 +45,16 @@ export function bootstrap(options) {
     // Wrap getSecret to record every name referenced by the config — the set
     // becomes container.platformSecretNames and is used by the exec tool to
     // refuse secretRefs access to platform-managed credentials.
+    // envLayer projects operational env vars (COMIS_GATEWAY_HOST/PORT) into
+    // the config layer stack at lower priority than YAML files, so explicit
+    // user config wins over env — see config/env-layer.ts.
     const referencedNames = new Set();
     const configResult = loadLayered(options.configPaths, {
         getSecret: (key) => {
             referencedNames.add(key);
             return secretManager.get(key);
         },
+        envLayer: buildGatewayEnvLayer(env),
     });
     if (!configResult.ok) {
         return err(configResult.error);

package/node_modules/@comis/core/dist/config/env-layer.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Operational env-var → config-layer projection.
+ *
+ * Bridges container/systemd/pm2 deployments to layered config without a
+ * config.yaml. Currently supported:
+ *
+ *   COMIS_GATEWAY_HOST → gateway.host (e.g. "0.0.0.0" inside the Docker image)
+ *   COMIS_GATEWAY_PORT → gateway.port
+ *
+ * The returned object is a partial config layer fed to mergeLayered() at
+ * lower priority than YAML files: schema defaults < env layer < config.yaml.
+ * This keeps explicit user config authoritative — a `gateway.host: 127.0.0.1`
+ * in config.yaml is never silently broadened to 0.0.0.0 by an inherited env
+ * var, preserving the secure-by-default contract on `gateway.host`.
+ *
+ * Empty-string host and non-numeric / out-of-range ports are dropped so a
+ * typo never silently relocates the daemon.
+ *
+ * @module
+ */
+/** Subset of env vars consumed by this projection. */
+export interface GatewayEnvSource {
+    COMIS_GATEWAY_HOST?: string | undefined;
+    COMIS_GATEWAY_PORT?: string | undefined;
+}
+/**
+ * Build a partial config layer from env vars. Returns an empty object when
+ * no relevant env vars are set (callers can pass through to mergeLayered
+ * unconditionally without affecting precedence).
+ */
+export declare function buildGatewayEnvLayer(env: GatewayEnvSource): Record<string, unknown>;

package/node_modules/@comis/core/dist/config/env-layer.js

@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Operational env-var → config-layer projection.
+ *
+ * Bridges container/systemd/pm2 deployments to layered config without a
+ * config.yaml. Currently supported:
+ *
+ *   COMIS_GATEWAY_HOST → gateway.host (e.g. "0.0.0.0" inside the Docker image)
+ *   COMIS_GATEWAY_PORT → gateway.port
+ *
+ * The returned object is a partial config layer fed to mergeLayered() at
+ * lower priority than YAML files: schema defaults < env layer < config.yaml.
+ * This keeps explicit user config authoritative — a `gateway.host: 127.0.0.1`
+ * in config.yaml is never silently broadened to 0.0.0.0 by an inherited env
+ * var, preserving the secure-by-default contract on `gateway.host`.
+ *
+ * Empty-string host and non-numeric / out-of-range ports are dropped so a
+ * typo never silently relocates the daemon.
+ *
+ * @module
+ */
+/**
+ * Build a partial config layer from env vars. Returns an empty object when
+ * no relevant env vars are set (callers can pass through to mergeLayered
+ * unconditionally without affecting precedence).
+ */
+export function buildGatewayEnvLayer(env) {
+    const gateway = {};
+    const rawHost = env.COMIS_GATEWAY_HOST;
+    if (typeof rawHost === "string" && rawHost.length > 0) {
+        gateway["host"] = rawHost;
+    }
+    const rawPort = env.COMIS_GATEWAY_PORT;
+    if (typeof rawPort === "string" && rawPort.length > 0) {
+        const parsed = Number.parseInt(rawPort, 10);
+        if (Number.isFinite(parsed) && parsed >= 1 && parsed <= 65_535) {
+            gateway["port"] = parsed;
+        }
+    }
+    return Object.keys(gateway).length > 0 ? { gateway } : {};
+}

package/node_modules/@comis/core/dist/config/layered.d.ts

@@ -24,7 +24,16 @@ export declare function mergeLayered(layers: Record<string, unknown>[]): Result<
  * This supports the common pattern: defaults.yaml < config.yaml < config.local.yaml
  *
  * If any file fails to load, returns the error immediately.
+ *
+ * `envLayer` (when provided) is prepended to the layer sequence so it sits
+ * between Zod schema defaults and YAML files in precedence order:
+ *   defaults < envLayer < config files
+ * Explicit user config in YAML always wins over env-derived values, which
+ * preserves secure-by-default semantics for security-sensitive fields like
+ * `gateway.host` — an inherited env var can never silently broaden a bind
+ * the operator pinned in config.yaml.
  */
 export declare function loadLayered(configPaths: string[], options?: {
     getSecret?: (key: string) => string | undefined;
+    envLayer?: Record<string, unknown>;
 }): Result<AppConfig, ConfigError>;

package/node_modules/@comis/core/dist/config/layered.js

@@ -73,9 +73,20 @@ export function mergeLayered(layers) {
  * This supports the common pattern: defaults.yaml < config.yaml < config.local.yaml
  *
  * If any file fails to load, returns the error immediately.
+ *
+ * `envLayer` (when provided) is prepended to the layer sequence so it sits
+ * between Zod schema defaults and YAML files in precedence order:
+ *   defaults < envLayer < config files
+ * Explicit user config in YAML always wins over env-derived values, which
+ * preserves secure-by-default semantics for security-sensitive fields like
+ * `gateway.host` — an inherited env var can never silently broaden a bind
+ * the operator pinned in config.yaml.
  */
 export function loadLayered(configPaths, options) {
     const layers = [];
+    if (options?.envLayer && Object.keys(options.envLayer).length > 0) {
+        layers.push(options.envLayer);
+    }
     for (const configPath of configPaths) {
         const result = loadConfigFile(configPath, options?.getSecret ? { getSecret: options.getSecret } : undefined);
         if (!result.ok) {

package/node_modules/@comis/core/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/core",
   "private": true,
-  "version": "1.0.24",
+  "version": "1.0.25",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Core domain types, ports, event bus, security, and config for Comis",

package/node_modules/@comis/daemon/dist/daemon.js

@@ -1044,6 +1044,9 @@ export async function main(overrides = {}) {
     };
     wireDispatch(rpcDispatchDeps);
     // 7. Gateway
+    // gateway.host / .port are resolved through the layered config in bootstrap:
+    // schema defaults < env layer (COMIS_GATEWAY_HOST/PORT) < config.yaml.
+    // See packages/core/src/config/env-layer.ts.
     const gwConfig = container.config.gateway;
     const { gatewayHandle, activeExecutions, getActiveConnectionCount, wsConnections } = await setupGateway({
         container, gwConfig, webhooksConfig: container.config.webhooks, agents, defaultAgentId,

package/node_modules/@comis/daemon/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/daemon",
   "private": true,
-  "version": "1.0.24",
+  "version": "1.0.25",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Background daemon and orchestrator for the Comis platform",

package/node_modules/@comis/gateway/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/gateway",
   "private": true,
-  "version": "1.0.24",
+  "version": "1.0.25",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "HTTP, JSON-RPC, and WebSocket gateway for Comis",

package/node_modules/@comis/infra/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/infra",
   "private": true,
-  "version": "1.0.24",
+  "version": "1.0.25",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Structured logging infrastructure for Comis",

package/node_modules/@comis/memory/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/memory",
   "private": true,
-  "version": "1.0.24",
+  "version": "1.0.25",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "SQLite memory, embeddings, and RAG storage for Comis agents",

package/node_modules/@comis/scheduler/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/scheduler",
   "private": true,
-  "version": "1.0.24",
+  "version": "1.0.25",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Task scheduling and cron management for Comis",

package/node_modules/@comis/shared/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/shared",
   "private": true,
-  "version": "1.0.24",
+  "version": "1.0.25",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Shared types and utilities for the Comis platform",

package/node_modules/@comis/skills/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/skills",
   "private": true,
-  "version": "1.0.24",
+  "version": "1.0.25",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Skill system, MCP integration, and tool sandbox for Comis agents",