comisai 1.0.25 → 1.0.27

package/node_modules/@comis/daemon/dist/rpc/provider-handlers.js

@@ -0,0 +1,330 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Provider management RPC handler module.
+ * Provides 7 handlers for runtime LLM provider management:
+ *   providers.list    - List all providers with summary and apiKeyConfigured state
+ *   providers.get     - Retrieve full provider config plus agentsUsing list
+ *   providers.create  - Register a new provider entry with validation
+ *   providers.update  - Patch an existing provider config with merge semantics
+ *   providers.delete  - Remove a provider (blocked if agents reference it)
+ *   providers.enable  - Set enabled:true on a disabled provider
+ *   providers.disable - Set enabled:false (warns but does not block on references)
+ *
+ * Follows the same factory pattern as agent-handlers.ts. Each handler validates
+ * input, operates on the runtime providerEntries map, and returns structured results.
+ * API key values are NEVER exposed -- only apiKeyName references and apiKeyConfigured state.
+ * @module
+ */
+import { ProviderEntrySchema } from "@comis/core";
+import { persistToConfig } from "./persist-to-config.js";
+import { probeProviderAuth } from "./probe-provider-auth.js";
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Sweep all agents for references to a given provider across three slots:
+ * 1. Primary provider (agent.provider === providerId)
+ * 2. Fallback models (agent.modelFailover.fallbackModels[].provider)
+ * 3. Auth profiles (agent.modelFailover.authProfiles[].provider)
+ *
+ * Returns a structured breakdown of referencing agents by slot.
+ */
+function findAgentReferences(agents, providerId) {
+    const primary = [];
+    const fallback = [];
+    const authProfile = [];
+    for (const [agentId, agent] of Object.entries(agents)) {
+        if (agent.provider === providerId) {
+            primary.push(agentId);
+        }
+        if (agent.modelFailover?.fallbackModels?.some((f) => f.provider === providerId)) {
+            fallback.push(agentId);
+        }
+        if (agent.modelFailover?.authProfiles?.some((a) => a.provider === providerId)) {
+            authProfile.push(agentId);
+        }
+    }
+    return { primary, fallback, authProfile };
+}
+/**
+ * Check whether any agent references exist across the three slots.
+ */
+function hasAnyReferences(refs) {
+    return refs.primary.length > 0 || refs.fallback.length > 0 || refs.authProfile.length > 0;
+}
+/**
+ * Format agent references into a human-readable message.
+ */
+function formatReferenceMessage(refs) {
+    const parts = [];
+    if (refs.primary.length > 0) {
+        parts.push(`primary provider: ${refs.primary.join(", ")}`);
+    }
+    if (refs.fallback.length > 0) {
+        parts.push(`fallbackModels: ${refs.fallback.join(", ")}`);
+    }
+    if (refs.authProfile.length > 0) {
+        parts.push(`authProfiles: ${refs.authProfile.join(", ")}`);
+    }
+    return parts.join("; ");
+}
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+/**
+ * Create a record of provider management RPC handlers bound to the given deps.
+ */
+export function createProviderHandlers(deps) {
+    return {
+        "providers.list": async (params) => {
+            const trustLevel = params._trustLevel;
+            if (trustLevel !== "admin") {
+                throw new Error("Admin access required for provider listing");
+            }
+            const summaries = Object.entries(deps.providerEntries).map(([id, entry]) => ({
+                id,
+                type: entry.type,
+                name: entry.name,
+                enabled: entry.enabled,
+                baseUrl: entry.baseUrl,
+                apiKeyName: entry.apiKeyName,
+                modelCount: entry.models.length,
+                apiKeyConfigured: entry.apiKeyName
+                    ? (deps.secretManager?.has(entry.apiKeyName) ?? false)
+                    : null,
+            }));
+            return { providers: summaries };
+        },
+        "providers.get": async (params) => {
+            const trustLevel = params._trustLevel;
+            if (trustLevel !== "admin") {
+                throw new Error("Admin access required for provider retrieval");
+            }
+            const providerId = params.providerId;
+            if (!providerId) {
+                throw new Error("Missing required parameter: providerId");
+            }
+            const entry = deps.providerEntries[providerId];
+            if (entry === undefined) {
+                throw new Error(`Provider not found: ${providerId}`);
+            }
+            // Build agentsUsing list by scanning all three reference slots
+            const refs = findAgentReferences(deps.agents, providerId);
+            const agentsUsing = [
+                ...new Set([...refs.primary, ...refs.fallback, ...refs.authProfile]),
+            ];
+            return {
+                providerId,
+                config: {
+                    type: entry.type,
+                    name: entry.name,
+                    baseUrl: entry.baseUrl,
+                    apiKeyName: entry.apiKeyName,
+                    enabled: entry.enabled,
+                    timeoutMs: entry.timeoutMs,
+                    maxRetries: entry.maxRetries,
+                    headers: entry.headers,
+                    capabilities: entry.capabilities,
+                    models: entry.models,
+                },
+                apiKeyConfigured: entry.apiKeyName
+                    ? (deps.secretManager?.has(entry.apiKeyName) ?? false)
+                    : null,
+                agentsUsing,
+            };
+        },
+        "providers.create": async (params) => {
+            const trustLevel = params._trustLevel;
+            if (trustLevel !== "admin") {
+                throw new Error("Admin access required for provider creation");
+            }
+            const providerId = params.providerId;
+            if (!providerId) {
+                throw new Error("Missing required parameter: providerId");
+            }
+            // Reserved name check -- "default" collides with PerAgentConfig.provider schema default
+            if (providerId === "default") {
+                throw new Error('Provider ID "default" is reserved. The name "default" collides with the agent schema default -- ' +
+                    "every agent that never set its provider explicitly would match this entry. " +
+                    "Choose a descriptive name instead (e.g., 'my-ollama', 'nvidia-nim', 'groq-cloud').");
+            }
+            if (deps.providerEntries[providerId] !== undefined) {
+                throw new Error(`Provider already exists: ${providerId}`);
+            }
+            const config = params.config ?? {};
+            const parsedConfig = ProviderEntrySchema.parse(config);
+            // Probe provider API key before committing config
+            if (parsedConfig.apiKeyName && deps.secretManager) {
+                const apiKey = deps.secretManager.get(parsedConfig.apiKeyName);
+                if (apiKey) {
+                    const probeResult = await probeProviderAuth(parsedConfig.baseUrl, apiKey, parsedConfig.models[0]?.id);
+                    if (!probeResult.ok) {
+                        throw new Error(`Provider "${providerId}" API key validation failed: ${probeResult.error}`);
+                    }
+                }
+            }
+            deps.providerEntries[providerId] = parsedConfig;
+            // Best-effort persistence to config.yaml
+            if (deps.persistDeps) {
+                const ctx = params._context;
+                const persistResult = await persistToConfig(deps.persistDeps, {
+                    patch: { providers: { entries: { [providerId]: config } } },
+                    actionType: "providers.create",
+                    entityId: providerId,
+                    actingUser: ctx?.userId ?? params._agentId,
+                    traceId: ctx?.traceId ?? params._traceId,
+                });
+                if (!persistResult.ok) {
+                    deps.persistDeps.logger.warn({ method: "providers.create", providerId, err: persistResult.error, hint: "Provider created in memory but config persistence failed", errorKind: "config" }, "Provider config persistence failed");
+                }
+            }
+            return { providerId, config: parsedConfig, created: true };
+        },
+        "providers.update": async (params) => {
+            const trustLevel = params._trustLevel;
+            if (trustLevel !== "admin") {
+                throw new Error("Admin access required for provider modification");
+            }
+            const providerId = params.providerId;
+            if (!providerId) {
+                throw new Error("Missing required parameter: providerId");
+            }
+            const existing = deps.providerEntries[providerId];
+            if (existing === undefined) {
+                throw new Error(`Provider not found: ${providerId}`);
+            }
+            const config = params.config ?? {};
+            // Capture user-provided fields BEFORE merge -- persistToConfig does deepMerge internally,
+            // so we only persist the user's partial patch (not the fully merged config).
+            const userPatch = params.config ? structuredClone(params.config) : {};
+            // Headers: shallow merge per-key (preserve existing keys, overlay new ones)
+            if (config.headers && existing.headers) {
+                config.headers = { ...existing.headers, ...config.headers };
+            }
+            // models[] and capabilities: replaced wholesale via spread (no merge needed)
+            const merged = { ...existing, ...config };
+            const parsedConfig = ProviderEntrySchema.parse(merged);
+            deps.providerEntries[providerId] = parsedConfig;
+            // Best-effort persistence to config.yaml -- persist userPatch NOT merged config
+            if (deps.persistDeps) {
+                const ctx = params._context;
+                const persistResult = await persistToConfig(deps.persistDeps, {
+                    patch: { providers: { entries: { [providerId]: userPatch } } },
+                    actionType: "providers.update",
+                    entityId: providerId,
+                    actingUser: ctx?.userId ?? params._agentId,
+                    traceId: ctx?.traceId ?? params._traceId,
+                });
+                if (!persistResult.ok) {
+                    deps.persistDeps.logger.warn({ method: "providers.update", providerId, err: persistResult.error, hint: "Provider updated in memory but config persistence failed", errorKind: "config" }, "Provider config persistence failed");
+                }
+            }
+            return { providerId, config: parsedConfig, updated: true };
+        },
+        "providers.delete": async (params) => {
+            const trustLevel = params._trustLevel;
+            if (trustLevel !== "admin") {
+                throw new Error("Admin access required for provider deletion");
+            }
+            const providerId = params.providerId;
+            if (!providerId) {
+                throw new Error("Missing required parameter: providerId");
+            }
+            const existing = deps.providerEntries[providerId];
+            if (existing === undefined) {
+                throw new Error(`Provider not found: ${providerId}`);
+            }
+            // Three-slot reference check: block deletion if any agent references this provider
+            const refs = findAgentReferences(deps.agents, providerId);
+            if (hasAnyReferences(refs)) {
+                throw new Error(`Cannot delete provider "${providerId}": referenced by agents -- ${formatReferenceMessage(refs)}. ` +
+                    "Remove agent references first, then retry deletion.");
+            }
+            delete deps.providerEntries[providerId];
+            // Best-effort persistence with removePaths
+            if (deps.persistDeps) {
+                const ctx = params._context;
+                const persistResult = await persistToConfig(deps.persistDeps, {
+                    patch: {},
+                    removePaths: [["providers", "entries", providerId]],
+                    actionType: "providers.delete",
+                    entityId: providerId,
+                    actingUser: ctx?.userId ?? params._agentId,
+                    traceId: ctx?.traceId ?? params._traceId,
+                });
+                if (!persistResult.ok) {
+                    deps.persistDeps.logger.warn({ method: "providers.delete", providerId, err: persistResult.error, hint: "Provider deleted in memory but config persistence failed", errorKind: "config" }, "Provider config persistence failed");
+                }
+            }
+            return { providerId, deleted: true };
+        },
+        "providers.enable": async (params) => {
+            const trustLevel = params._trustLevel;
+            if (trustLevel !== "admin") {
+                throw new Error("Admin access required for provider enable");
+            }
+            const providerId = params.providerId;
+            if (!providerId) {
+                throw new Error("Missing required parameter: providerId");
+            }
+            const existing = deps.providerEntries[providerId];
+            if (existing === undefined) {
+                throw new Error(`Provider not found: ${providerId}`);
+            }
+            deps.providerEntries[providerId].enabled = true;
+            // Best-effort persistence
+            if (deps.persistDeps) {
+                const ctx = params._context;
+                const persistResult = await persistToConfig(deps.persistDeps, {
+                    patch: { providers: { entries: { [providerId]: { enabled: true } } } },
+                    actionType: "providers.enable",
+                    entityId: providerId,
+                    actingUser: ctx?.userId ?? params._agentId,
+                    traceId: ctx?.traceId ?? params._traceId,
+                });
+                if (!persistResult.ok) {
+                    deps.persistDeps.logger.warn({ method: "providers.enable", providerId, err: persistResult.error, hint: "Provider enabled in memory but config persistence failed", errorKind: "config" }, "Provider config persistence failed");
+                }
+            }
+            return { providerId, enabled: true };
+        },
+        "providers.disable": async (params) => {
+            const trustLevel = params._trustLevel;
+            if (trustLevel !== "admin") {
+                throw new Error("Admin access required for provider disable");
+            }
+            const providerId = params.providerId;
+            if (!providerId) {
+                throw new Error("Missing required parameter: providerId");
+            }
+            const existing = deps.providerEntries[providerId];
+            if (existing === undefined) {
+                throw new Error(`Provider not found: ${providerId}`);
+            }
+            // Three-slot reference sweep: warn but do NOT reject
+            const refs = findAgentReferences(deps.agents, providerId);
+            let warning;
+            if (hasAnyReferences(refs)) {
+                warning =
+                    `Provider "${providerId}" is referenced by agents (${formatReferenceMessage(refs)}). ` +
+                        "Disabling will prevent these agents from using this provider until re-enabled.";
+            }
+            deps.providerEntries[providerId].enabled = false;
+            // Best-effort persistence
+            if (deps.persistDeps) {
+                const ctx = params._context;
+                const persistResult = await persistToConfig(deps.persistDeps, {
+                    patch: { providers: { entries: { [providerId]: { enabled: false } } } },
+                    actionType: "providers.disable",
+                    entityId: providerId,
+                    actingUser: ctx?.userId ?? params._agentId,
+                    traceId: ctx?.traceId ?? params._traceId,
+                });
+                if (!persistResult.ok) {
+                    deps.persistDeps.logger.warn({ method: "providers.disable", providerId, err: persistResult.error, hint: "Provider disabled in memory but config persistence failed", errorKind: "config" }, "Provider config persistence failed");
+                }
+            }
+            return { providerId, enabled: false, ...(warning ? { warning } : {}) };
+        },
+    };
+}

package/node_modules/@comis/daemon/dist/rpc/rpc-dispatch.js

@@ -30,6 +30,7 @@ import { createHeartbeatHandlers } from "./heartbeat-handlers.js";
 import { createSkillHandlers } from "./skill-handlers.js";
 import { createNotificationHandlers } from "./notification-handlers.js";
 import { createImageHandlers } from "./image-handlers.js";
+import { createProviderHandlers } from "./provider-handlers.js";
 // ---------------------------------------------------------------------------
 // Error classification
 // ---------------------------------------------------------------------------
@@ -88,6 +89,19 @@ export function createRpcDispatch(deps) {
         ...createAgentHandlers({
             ...deps,
             secretManager: deps.container?.secretManager,
+            providerEntries: deps.container.config.providers.entries,
+            persistDeps: {
+                container: deps.container,
+                configPaths: deps.configPaths,
+                defaultConfigPaths: deps.defaultConfigPaths,
+                configGitManager: deps.configGitManager,
+                logger: deps.logger,
+            },
+        }),
+        ...createProviderHandlers({
+            agents: deps.agents,
+            providerEntries: deps.container.config.providers.entries,
+            secretManager: deps.container?.secretManager,
             persistDeps: {
                 container: deps.container,
                 configPaths: deps.configPaths,
@@ -97,7 +111,10 @@ export function createRpcDispatch(deps) {
             },
         }),
         ...createObsHandlers(deps),
-        ...createModelHandlers(deps),
+        ...createModelHandlers({
+            ...deps,
+            providerEntries: deps.container.config.providers.entries,
+        }),
         ...createChannelHandlers({
             ...deps,
             persistDeps: {

package/node_modules/@comis/daemon/dist/setup-docker-restart-warn.d.ts

@@ -0,0 +1,4 @@
+import type { ComisLogger } from "@comis/infra";
+export declare function emitDockerRestartPolicyWarn(logger: ComisLogger, opts?: {
+    isDocker?: () => boolean;
+}): void;

package/node_modules/@comis/daemon/dist/setup-docker-restart-warn.js

@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Boot-time WARN that fires inside Docker containers, telling the operator
+ * that wizard "Restart" actions and any `gateway.*` config-reload action
+ * (`gateway.restart`, `gateway.env_set`, `gateway.patch` on restart-triggering
+ * paths) all rely on the container's restart policy to bring the daemon back.
+ *
+ * Without `--restart unless-stopped` (or compose `restart: unless-stopped`)
+ * the container exits and stays exited the first time the user clicks
+ * "Restart" in the wizard, producing a silent "comis status: offline" with
+ * no breadcrumb in `docker logs` pointing at the missing flag. This WARN
+ * is that breadcrumb.
+ *
+ * Pure function over an injected logger and an optional `isDocker` probe
+ * (defaulting to the real one from `@comis/infra`) so it is unit-testable
+ * without spinning up the daemon harness.
+ *
+ * @module
+ */
+import { isDocker as defaultIsDocker } from "@comis/infra";
+export function emitDockerRestartPolicyWarn(logger, opts = {}) {
+    const probe = opts.isDocker ?? defaultIsDocker;
+    if (!probe())
+        return;
+    logger.warn({
+        hint: "Wizard 'Restart' actions, gateway.restart, gateway.env_set, and gateway.patch on restart-triggering paths all require the container to have --restart unless-stopped (or compose restart: unless-stopped). Verify from your host with: docker inspect <name> --format '{{.HostConfig.RestartPolicy.Name}}'",
+        errorKind: "config",
+        module: "daemon",
+    }, "Running in Docker — restart policy required for config-reload operations");
+}

package/node_modules/@comis/daemon/dist/wiring/setup-agents.d.ts

@@ -8,7 +8,7 @@
 import { type AppContainer, type InjectionRateLimiter, type PerAgentConfig } from "@comis/core";
 import type { ComisLogger } from "@comis/infra";
 import type { SqliteMemoryAdapter, createSessionStore } from "@comis/memory";
-import { createBudgetGuard, createCostTracker, createStepCounter, createSessionLifecycle, createComisSessionManager, type AgentExecutor, type ActiveRunRegistry, type ProviderHealthMonitor } from "@comis/agent";
+import { createBudgetGuard, createCostTracker, createStepCounter, createSessionLifecycle, createComisSessionManager, type AgentExecutor, type ActiveRunRegistry, type ProviderHealthMonitor, type LastKnownModelTracker } from "@comis/agent";
 import { type SkillRegistry, type SkillWatcherHandle } from "@comis/skills";
 type PiSessionAdapter = ReturnType<typeof createComisSessionManager>;
 /** Shared dependencies computed once before the agent loop and passed to each
@@ -39,6 +39,8 @@ export interface SingleAgentDeps {
     db?: unknown;
     /** Global provider health monitor shared across all agents */
     providerHealth?: ProviderHealthMonitor;
+    /** Global last-known-working model tracker shared across all agents */
+    lastKnownModel?: LastKnownModelTracker;
     /** Optional embedding port for discover_tools semantic search. */
     embeddingPort?: import("@comis/core").EmbeddingPort;
     /** Delivery mirror port for session mirroring injection */

package/node_modules/@comis/daemon/dist/wiring/setup-agents.js

@@ -12,7 +12,7 @@ import { createHmac } from "node:crypto";
 import { homedir } from "node:os";
 import { existsSync, mkdirSync } from "node:fs";
 import { isAbsolute, resolve } from "node:path";
-import { createCircuitBreaker, createBudgetGuard, createCostTracker, createStepCounter, createSessionLifecycle, ensureWorkspace, resolveWorkspaceDir, createPiExecutor, createComisSessionManager, cleanupStaleLocks, createAuthStorageAdapter, createModelRegistryAdapter, registerCustomProviders, createProviderHealthMonitor, setSanitizeLogger, setToolNormalizationLogger, LEAN_TOOL_DESCRIPTIONS, resolveDescription, } from "@comis/agent";
+import { createCircuitBreaker, createBudgetGuard, createCostTracker, createStepCounter, createSessionLifecycle, ensureWorkspace, resolveWorkspaceDir, createPiExecutor, createComisSessionManager, cleanupStaleLocks, createAuthStorageAdapter, createModelRegistryAdapter, registerCustomProviders, createProviderHealthMonitor, createLastKnownModelTracker, createAuthProfileManager, createAuthRotationAdapter, setSanitizeLogger, setToolNormalizationLogger, LEAN_TOOL_DESCRIPTIONS, resolveDescription, } from "@comis/agent";
 import { agentToolsToToolDefinitions, createSkillRegistry, createRuntimeEligibilityContext, TOOL_PROFILES, } from "@comis/skills";
 // ---------------------------------------------------------------------------
 // Single-agent setup (extracted for hot-add reuse)
@@ -71,10 +71,13 @@ export async function setupSingleAgent(agentId, rawAgentConfig, deps) {
         customProviderEntries,
     });
     const piModelRegistry = createModelRegistryAdapter(piAuthStorage);
-    const customProviderCount = registerCustomProviders(piModelRegistry, customProviderEntries, scopedManager, agentLogger);
+    const { registered: customProviderCount, providerAliases } = registerCustomProviders(piModelRegistry, customProviderEntries, scopedManager, agentLogger);
     if (customProviderCount > 0) {
         agentLogger.debug({ agentId, customProviderCount }, "Custom YAML providers registered with pi ModelRegistry");
     }
+    if (providerAliases.size > 0) {
+        agentLogger.debug({ agentId, aliases: Object.fromEntries(providerAliases) }, "Provider name aliases for built-in resolution");
+    }
     // Create JSONL session adapter for this agent
     const lockDir = safePath(dir, ".locks");
     const sessionAdapter = createComisSessionManager({
@@ -172,9 +175,26 @@ export async function setupSingleAgent(agentId, rawAgentConfig, deps) {
     // No wrapWithAudit: PiEventBridge already emits tool:executed for ALL tools.
     // tools: [] -- all tools come exclusively through customTools where the full
     // Comis security pipeline (safePath + tool policy + audit) is enforced.
+    // Model failover: convert config FallbackModel[] to "provider:modelId" strings
+    // and create auth rotation adapter for multi-key providers.
+    const failoverConfig = effectiveConfig.modelFailover;
+    const fallbackModelStrings = failoverConfig.fallbackModels.map((m) => `${m.provider}:${m.modelId}`);
+    const authProfileManager = failoverConfig.authProfiles.length > 0
+        ? createAuthProfileManager({
+            profiles: failoverConfig.authProfiles,
+            secretManager: scopedManager,
+            initialMs: failoverConfig.cooldownInitialMs,
+            multiplier: failoverConfig.cooldownMultiplier,
+            capMs: failoverConfig.cooldownCapMs,
+        })
+        : undefined;
+    const authRotation = authProfileManager
+        ? createAuthRotationAdapter({ authStorage: piAuthStorage, profileManager: authProfileManager })
+        : undefined;
     const executor = createPiExecutor(effectiveConfig, {
         circuitBreaker,
         providerHealth: deps.providerHealth,
+        lastKnownModel: deps.lastKnownModel,
         budgetGuard,
         costTracker,
         stepCounter,
@@ -182,6 +202,9 @@ export async function setupSingleAgent(agentId, rawAgentConfig, deps) {
         logger: perAgentLogger,
         authStorage: piAuthStorage,
         modelRegistry: piModelRegistry,
+        providerAliases,
+        fallbackModels: fallbackModelStrings.length > 0 ? fallbackModelStrings : undefined,
+        authRotation,
         sessionAdapter,
         workspaceDir: dir,
         agentDir: resolvedAgentDir,
@@ -309,6 +332,8 @@ export async function setupAgents(deps) {
         recoveryThreshold: 1,
         eventBus: container.eventBus,
     });
+    // Global last-known-working model tracker (shared across all agents)
+    const lastKnownModel = createLastKnownModelTracker();
     // Construct shared deps struct once before the loop (for hot-add reuse)
     const singleAgentDeps = {
         container,
@@ -328,6 +353,7 @@ export async function setupAgents(deps) {
         contextStore: deps.contextStore,
         db: deps.db,
         providerHealth,
+        lastKnownModel,
         embeddingPort: deps.embeddingPort,
         deliveryMirror: deps.deliveryMirror,
         deliveryMirrorConfig: deps.deliveryMirrorConfig,

package/node_modules/@comis/daemon/dist/wiring/setup-cross-session.js

@@ -53,6 +53,7 @@ export const SUB_AGENT_TOOL_DENYLIST = new Set([
     "channels_manage", // channels.restart, config.patch -> SIGUSR2
     "agents_manage", // agent create/delete -> config persistence -> SIGUSR2
     "models_manage", // model config changes -> config persistence -> SIGUSR2
+    "providers_manage", // provider CRUD -> config persistence -> SIGUSR2
     "tokens_manage", // token CRUD -> config persistence -> SIGUSR2
     "skills_manage", // skill config changes -> config persistence -> potential SIGUSR2
     "sessions_manage", // session purge is destructive

package/node_modules/@comis/daemon/dist/wiring/setup-tools.js

@@ -11,7 +11,7 @@ import { enterConfigMutationFence, leaveConfigMutationFence } from "../rpc/persi
 import { SkillsConfigSchema, sanitizeLogString, tryGetContext, parseFormattedSessionKey, safePath, formatSessionKey } from "@comis/core";
 import { sessionKeyToPath, WORKSPACE_FILE_NAMES, DEFAULT_TEMPLATES, registerWorkspaceFilesInTracker, } from "@comis/agent";
 import { stat as fsStat } from "node:fs/promises";
-import { assembleToolPipeline, createFileStateTracker, createCronTool, createUnifiedMemoryTool, createUnifiedSessionTool, createUnifiedContextTool, createAgentsListTool, createMessageTool, createDiscordActionTool, createTelegramActionTool, createSlackActionTool, createWhatsAppActionTool, createSessionsSendTool, createSessionsSpawnTool, createSubagentsTool, createPipelineTool, createImageTool, createTTSTool, createTranscribeAudioTool, createDescribeVideoTool, createExtractDocumentTool, createGatewayTool, createBrowserTool, createAgentsManageTool, createObsQueryTool, createSessionsManageTool, createModelsManageTool, createTokensManageTool, createChannelsManageTool, createSkillsManageTool, createMcpManageTool, createHeartbeatManageTool, createNotifyTool, createImageGenerateTool, createBackgroundTasksTool, createExecTool, createProcessTool, createProcessRegistry, createApplyPatchTool, sanitizeImageForApi, createMediaPersistenceService, createCredentialInjector, mcpToolsToAgentTools, TOOL_PROFILES, TOOL_GROUPS, } from "@comis/skills";
+import { assembleToolPipeline, createFileStateTracker, createCronTool, createUnifiedMemoryTool, createUnifiedSessionTool, createUnifiedContextTool, createMessageTool, createDiscordActionTool, createTelegramActionTool, createSlackActionTool, createWhatsAppActionTool, createSessionsSendTool, createSessionsSpawnTool, createSubagentsTool, createPipelineTool, createImageTool, createTTSTool, createTranscribeAudioTool, createDescribeVideoTool, createExtractDocumentTool, createGatewayTool, createBrowserTool, createAgentsManageTool, createObsQueryTool, createSessionsManageTool, createModelsManageTool, createTokensManageTool, createChannelsManageTool, createSkillsManageTool, createMcpManageTool, createHeartbeatManageTool, createProvidersManageTool, createNotifyTool, createImageGenerateTool, createBackgroundTasksTool, createExecTool, createProcessTool, createProcessRegistry, createApplyPatchTool, sanitizeImageForApi, createMediaPersistenceService, createCredentialInjector, mcpToolsToAgentTools, TOOL_PROFILES, TOOL_GROUPS, } from "@comis/skills";
 // ---------------------------------------------------------------------------
 // Setup function
 // ---------------------------------------------------------------------------
@@ -154,7 +154,6 @@ export function setupTools(deps) {
                 createCronTool(agentRpc),
                 createUnifiedMemoryTool(agentRpc, approvalGate),
                 createUnifiedSessionTool(agentRpc),
-                createAgentsListTool(agentRpc),
                 createMessageTool(agentRpc),
                 createDiscordActionTool(agentRpc, skillsLogger),
                 createTelegramActionTool(agentRpc),
@@ -169,8 +168,8 @@ export function setupTools(deps) {
                 createTranscribeAudioTool(agentRpc),
                 createDescribeVideoTool(agentRpc),
                 createExtractDocumentTool(agentRpc),
-                createGatewayTool(agentRpc),
-                createAgentsManageTool(agentRpc, approvalGate, {
+                createGatewayTool(agentRpc, skillsLogger),
+                createAgentsManageTool(agentRpc, skillsLogger, approvalGate, {
                     onMutationStart: enterConfigMutationFence,
                     onMutationEnd: leaveConfigMutationFence,
                     // After agents.create seeds the new workspace's template files
@@ -204,6 +203,10 @@ export function setupTools(deps) {
                 createObsQueryTool(agentRpc),
                 createSessionsManageTool(agentRpc, approvalGate),
                 createModelsManageTool(agentRpc),
+                createProvidersManageTool(agentRpc, approvalGate, {
+                    onMutationStart: enterConfigMutationFence,
+                    onMutationEnd: leaveConfigMutationFence,
+                }),
                 createTokensManageTool(agentRpc, approvalGate),
                 createChannelsManageTool(agentRpc, approvalGate),
                 createSkillsManageTool(agentRpc, approvalGate),

package/node_modules/@comis/daemon/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/daemon",
   "private": true,
-  "version": "1.0.25",
+  "version": "1.0.27",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Background daemon and orchestrator for the Comis platform",

package/node_modules/@comis/gateway/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/gateway",
   "private": true,
-  "version": "1.0.25",
+  "version": "1.0.27",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "HTTP, JSON-RPC, and WebSocket gateway for Comis",

package/node_modules/@comis/infra/dist/index.d.ts

@@ -2,3 +2,4 @@ export { createLogger } from "./logging/index.js";
 export type { LoggerOptions, ComisLogger } from "./logging/index.js";
 export type { LogFields, ErrorKind } from "./logging/index.js";
 export { isValidLogLevel, VALID_LOG_LEVELS } from "./logging/index.js";
+export { isDocker } from "./runtime/is-docker.js";

package/node_modules/@comis/infra/dist/index.js

@@ -3,3 +3,5 @@
 // Logging (Pino logger factory with credential redaction, audit level)
 export { createLogger } from "./logging/index.js";
 export { isValidLogLevel, VALID_LOG_LEVELS } from "./logging/index.js";
+// Runtime detection helpers (single source of truth for Docker/PID-1 probes)
+export { isDocker } from "./runtime/is-docker.js";

package/node_modules/@comis/infra/dist/runtime/is-docker.d.ts

@@ -0,0 +1 @@
+export declare function isDocker(): boolean;

package/node_modules/@comis/infra/dist/runtime/is-docker.js

@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Detect whether we are running inside a Docker container.
+ *
+ * Probes `/.dockerenv`, the standard marker file Docker creates at PID 1's
+ * filesystem root. Used by callers that need to surface restart-policy
+ * guidance: inside a container the daemon is owned by PID 1 (dumb-init in
+ * the official image), so signalling it exits the container — Docker's
+ * restart policy is what brings it back. Without `--restart unless-stopped`
+ * (or compose `restart: unless-stopped`) the container stays exited.
+ *
+ * Defensive: any probe error returns false. We never throw out of a runtime
+ * detection helper.
+ *
+ * @module
+ */
+import { existsSync } from "node:fs";
+export function isDocker() {
+    try {
+        return existsSync("/.dockerenv");
+    }
+    catch {
+        return false;
+    }
+}

package/node_modules/@comis/infra/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/infra",
   "private": true,
-  "version": "1.0.25",
+  "version": "1.0.27",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Structured logging infrastructure for Comis",

package/node_modules/@comis/memory/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/memory",
   "private": true,
-  "version": "1.0.25",
+  "version": "1.0.27",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "SQLite memory, embeddings, and RAG storage for Comis agents",

package/node_modules/@comis/scheduler/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/scheduler",
   "private": true,
-  "version": "1.0.25",
+  "version": "1.0.27",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Task scheduling and cron management for Comis",