comisai 1.0.27 → 1.0.30

package/node_modules/@comis/channels/dist/shared/inbound-route.d.ts

@@ -15,7 +15,7 @@ import type { BlockPacer } from "./block-pacer.js";
 import type { TypingLifecycleController } from "./typing-lifecycle-controller.js";
 import type { SendOverrideStore } from "./send-policy.js";
 /** Minimal deps needed for the routing phase. */
-export type RouteDeps = Pick<InboundPipelineDeps, "logger" | "eventBus" | "debounceBuffer" | "groupHistoryBuffer" | "sessionLabelStore" | "commandQueue" | "priorityScheduler" | "queueConfig" | "activeRunRegistry" | "streamingConfig" | "sendPolicyConfig" | "getElevatedReplyConfig" | "channelRegistry" | "retryEngine" | "deliveryQueue" | "followupTrigger" | "followupConfig" | "assembleToolsForAgent" | "voiceResponsePipeline" | "parseOutboundMedia" | "outboundMediaFetch" | "onTaskExtraction" | "responsePrefixConfig" | "buildTemplateContext" | "getEnforceFinalTag">;
+export type RouteDeps = Pick<InboundPipelineDeps, "logger" | "eventBus" | "debounceBuffer" | "groupHistoryBuffer" | "sessionLabelStore" | "commandQueue" | "priorityScheduler" | "queueConfig" | "activeRunRegistry" | "streamingConfig" | "sendPolicyConfig" | "getElevatedReplyConfig" | "channelRegistry" | "retryEngine" | "deliveryQueue" | "inFlightSends" | "followupTrigger" | "followupConfig" | "assembleToolsForAgent" | "voiceResponsePipeline" | "parseOutboundMedia" | "outboundMediaFetch" | "onTaskExtraction" | "responsePrefixConfig" | "buildTemplateContext" | "getEnforceFinalTag">;
 /**
  * Route an inbound message through debounce, group history, steer+followup,
  * or command queue. Falls back to direct execution when no queue is present.

package/node_modules/@comis/channels/dist/shared/inbound-route.js

@@ -104,6 +104,7 @@ export async function routeInboundMessage(deps, adapter, processedMsg, originalM
         channelRegistry: deps.channelRegistry,
         retryEngine: deps.retryEngine,
         deliveryQueue: deps.deliveryQueue,
+        inFlightSends: deps.inFlightSends,
         followupTrigger: deps.followupTrigger,
         followupConfig: deps.followupConfig,
         commandQueue: deps.commandQueue,

package/node_modules/@comis/channels/dist/telegram/message-mapper.d.ts

@@ -1,5 +1,15 @@
 import type { NormalizedMessage } from "@comis/core";
 import type { Message } from "grammy/types";
+/**
+ * Identifying details of the bot account, used to detect addressing in
+ * inbound Telegram messages (mentions, replies, bot_command targets).
+ *
+ * Sourced from `bot.api.getMe()` after token validation in the adapter.
+ */
+export interface TelegramBotIdentity {
+    id: number;
+    username: string;
+}
 /**
  * Map a Grammy Message object to a NormalizedMessage.
  *
@@ -14,8 +24,15 @@ import type { Message } from "grammy/types";
  * - Media -> attachments via `buildAttachments()`
  * - Platform metadata preserved in `metadata` field
  *
+ * When `bot` is provided, message entities and `reply_to_message` are
+ * inspected to populate `metadata.isBotMentioned`, `metadata.replyToBot`,
+ * and `metadata.isBotCommand` so that the inbound gate's mention-gated
+ * activation policy can correctly route addressed group messages to the
+ * agent. Omitting `bot` preserves prior behavior (no addressing flags).
+ *
  * @param msg - A plain Telegram Message object
  * @param chatId - The chat ID (used as channelId)
+ * @param bot - Optional bot identity for addressing detection
  * @returns A fully populated NormalizedMessage
  */
-export declare function mapGrammyToNormalized(msg: Message, chatId: number): NormalizedMessage;
+export declare function mapGrammyToNormalized(msg: Message, chatId: number, bot?: TelegramBotIdentity): NormalizedMessage;

package/node_modules/@comis/channels/dist/telegram/message-mapper.js

@@ -2,6 +2,81 @@ import { randomUUID } from "node:crypto";
 import { buildAttachments } from "./media-handler.js";
 import { normalizeLocation } from "../shared/location-normalizer.js";
 import { resolveTelegramThreadContext } from "./thread-context.js";
+/**
+ * Inspect a Telegram message for any signal that the bot is being addressed:
+ *
+ * - `mention` entity (`@username`) matching the bot's username
+ * - `text_mention` entity referencing the bot's user id (no public username
+ *   required; this is what private bots receive)
+ * - `bot_command` entity — bare `/cmd` (privacy-off DM) or `/cmd@<botUsername>`
+ *   (group with privacy-on)
+ * - `reply_to_message` whose author is the bot itself
+ *
+ * Mentions of *other* users / `text_mention` of *other* users / commands
+ * targeted at *other* bots do not flip any flag.
+ */
+function detectBotAddressing(msg, bot) {
+    const result = {
+        isBotMentioned: false,
+        replyToBot: false,
+        isBotCommand: false,
+    };
+    // Reply-to detection: a reply to a message authored by the bot is treated
+    // as addressing, mirroring the convention used by other channels.
+    if (msg.reply_to_message?.from?.id === bot.id) {
+        result.replyToBot = true;
+    }
+    // Entities live on text or caption depending on whether the message is
+    // a plain message or a media-with-caption.
+    const entities = msg.entities ?? msg.caption_entities ?? [];
+    if (entities.length === 0) {
+        return result;
+    }
+    const source = msg.text ?? msg.caption ?? "";
+    const expectedMention = `@${bot.username.toLowerCase()}`;
+    for (const ent of entities) {
+        if (ent.type === "mention") {
+            // `mention` entity covers `@username` text — slice and case-insensitive compare.
+            const slice = source.slice(ent.offset, ent.offset + ent.length).toLowerCase();
+            if (slice === expectedMention) {
+                result.isBotMentioned = true;
+            }
+        }
+        else if (ent.type === "text_mention") {
+            // `text_mention` entity carries a `user` payload — used for bots without
+            // a public username, or when Telegram resolves the mention server-side.
+            const tm = ent;
+            if (tm.user?.id === bot.id) {
+                result.isBotMentioned = true;
+            }
+        }
+        else if (ent.type === "bot_command") {
+            // Slash command targeting: `/cmd` (no target — DM/privacy-off) or
+            // `/cmd@<botUsername>` (group with privacy-on). Either form addressed
+            // to this bot activates it; commands targeted at *other* bots do not.
+            const slice = source.slice(ent.offset, ent.offset + ent.length);
+            const atIdx = slice.indexOf("@");
+            if (atIdx === -1) {
+                // Bare /cmd — only meaningful in DMs or privacy-off groups, where
+                // Telegram delivers it to us in the first place.
+                result.isBotCommand = true;
+            }
+            else {
+                const target = slice.slice(atIdx + 1).toLowerCase();
+                if (target === bot.username.toLowerCase()) {
+                    result.isBotCommand = true;
+                }
+            }
+        }
+    }
+    // A bot_command entity for this bot implies activation — surface it as a
+    // mention so downstream gates (which key off `isBotMentioned`) treat it
+    // identically to an explicit @mention.
+    if (result.isBotCommand) {
+        result.isBotMentioned = true;
+    }
+    return result;
+}
 /**
  * Map a Grammy Message object to a NormalizedMessage.
  *
@@ -16,11 +91,18 @@ import { resolveTelegramThreadContext } from "./thread-context.js";
  * - Media -> attachments via `buildAttachments()`
  * - Platform metadata preserved in `metadata` field
  *
+ * When `bot` is provided, message entities and `reply_to_message` are
+ * inspected to populate `metadata.isBotMentioned`, `metadata.replyToBot`,
+ * and `metadata.isBotCommand` so that the inbound gate's mention-gated
+ * activation policy can correctly route addressed group messages to the
+ * agent. Omitting `bot` preserves prior behavior (no addressing flags).
+ *
  * @param msg - A plain Telegram Message object
  * @param chatId - The chat ID (used as channelId)
+ * @param bot - Optional bot identity for addressing detection
  * @returns A fully populated NormalizedMessage
  */
-export function mapGrammyToNormalized(msg, chatId) {
+export function mapGrammyToNormalized(msg, chatId, bot) {
     const metadata = {
         telegramMessageId: msg.message_id,
         telegramChatType: msg.chat.type,
@@ -42,6 +124,18 @@ export function mapGrammyToNormalized(msg, chatId) {
         metadata.telegramIsForum = isForum;
         metadata.telegramThreadScope = threadCtx.scope;
     }
+    // Bot addressing detection — only when bot identity is supplied. The
+    // adapter populates `bot` after token validation; tests that exercise
+    // the pure mapper without a bot identity continue to omit these flags.
+    if (bot) {
+        const addressing = detectBotAddressing(msg, bot);
+        if (addressing.isBotMentioned)
+            metadata.isBotMentioned = true;
+        if (addressing.replyToBot)
+            metadata.replyToBot = true;
+        if (addressing.isBotCommand)
+            metadata.isBotCommand = true;
+    }
     // Extract text from message body or caption
     let text = msg.text ?? msg.caption ?? "";
     // GPS location extraction from venue and location messages

package/node_modules/@comis/channels/dist/telegram/telegram-adapter.js

@@ -125,6 +125,9 @@ export function createTelegramAdapter(deps) {
     const handlers = [];
     let _channelId = "telegram-pending";
     let runnerHandle = null;
+    // Bot identity is populated after token validation in start(). Used by the
+    // message mapper to detect mentions/replies/bot_commands aimed at this bot.
+    let botIdentity;
     // Health tracking
     let _connected = false;
     let _startedAt;
@@ -140,7 +143,7 @@ export function createTelegramAdapter(deps) {
             return;
         }
         _lastMessageAt = Date.now();
-        const normalized = mapGrammyToNormalized(msg, chatId);
+        const normalized = mapGrammyToNormalized(msg, chatId, botIdentity);
         deps.logger.info({ channelType: "telegram", messageId: normalized.id, chatId: String(chatId), previewLen: (normalized.text ?? "").length }, "Inbound message");
         for (const handler of handlers) {
             // Fire-and-forget: don't block Grammy middleware
@@ -175,6 +178,9 @@ export function createTelegramAdapter(deps) {
             }
             const botInfo = tokenResult.value;
             _channelId = `telegram-${botInfo.id}`;
+            // Populate identity now that getMe() has succeeded — message mapper
+            // uses this to detect mentions/replies/bot_commands aimed at us.
+            botIdentity = { id: botInfo.id, username: botInfo.username };
             // Validate webhook secret if provided
             if (deps.webhookSecret) {
                 const secretResult = validateWebhookSecret(deps.webhookSecret);

package/node_modules/@comis/channels/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/channels",
   "private": true,
-  "version": "1.0.27",
+  "version": "1.0.30",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Chat platform adapters — Discord, Telegram, Slack, WhatsApp, Signal, iMessage, IRC, LINE",

package/node_modules/@comis/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/cli",
   "private": true,
-  "version": "1.0.27",
+  "version": "1.0.30",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Command-line interface for the Comis AI agent platform",

package/node_modules/@comis/core/dist/config/schema-agent.d.ts

@@ -397,7 +397,11 @@ export declare const ContextEngineConfigSchema: z.ZodObject<{
      *  triggers on model id / provider / api change (those checks are
      *  unconditional regardless of this idle threshold). Range: 1 min .. 24 h. */
     replayDriftIdleMs: z.ZodDefault<z.ZodNumber>;
-    /** Model for LLM compaction in "provider:modelId" format. Defaults to Haiku for cost efficiency. Empty string falls through to session model. */
+    /** Model for LLM compaction in "provider:modelId" format. Empty string
+     *  (the default) triggers runtime resolution against the agent's primary
+     *  provider via pi-ai catalog (fast-tier cost model). Avoids pinning a
+     *  hardcoded Anthropic literal that goes stale on pi-ai upgrades and
+     *  cross-routes background ops to Claude when primary is OpenRouter/Google/etc. */
     compactionModel: z.ZodDefault<z.ZodString>;
     /** Minimum age (in tool result positions) before content is eligible for dead content eviction. */
     evictionMinAge: z.ZodDefault<z.ZodNumber>;
@@ -1616,7 +1620,11 @@ export declare const PerAgentConfigSchema: z.ZodObject<{
          *  triggers on model id / provider / api change (those checks are
          *  unconditional regardless of this idle threshold). Range: 1 min .. 24 h. */
         replayDriftIdleMs: z.ZodDefault<z.ZodNumber>;
-        /** Model for LLM compaction in "provider:modelId" format. Defaults to Haiku for cost efficiency. Empty string falls through to session model. */
+        /** Model for LLM compaction in "provider:modelId" format. Empty string
+         *  (the default) triggers runtime resolution against the agent's primary
+         *  provider via pi-ai catalog (fast-tier cost model). Avoids pinning a
+         *  hardcoded Anthropic literal that goes stale on pi-ai upgrades and
+         *  cross-routes background ops to Claude when primary is OpenRouter/Google/etc. */
         compactionModel: z.ZodDefault<z.ZodString>;
         /** Minimum age (in tool result positions) before content is eligible for dead content eviction. */
         evictionMinAge: z.ZodDefault<z.ZodNumber>;
@@ -2309,7 +2317,11 @@ export declare const AgentsMapSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
          *  triggers on model id / provider / api change (those checks are
          *  unconditional regardless of this idle threshold). Range: 1 min .. 24 h. */
         replayDriftIdleMs: z.ZodDefault<z.ZodNumber>;
-        /** Model for LLM compaction in "provider:modelId" format. Defaults to Haiku for cost efficiency. Empty string falls through to session model. */
+        /** Model for LLM compaction in "provider:modelId" format. Empty string
+         *  (the default) triggers runtime resolution against the agent's primary
+         *  provider via pi-ai catalog (fast-tier cost model). Avoids pinning a
+         *  hardcoded Anthropic literal that goes stale on pi-ai upgrades and
+         *  cross-routes background ops to Claude when primary is OpenRouter/Google/etc. */
         compactionModel: z.ZodDefault<z.ZodString>;
         /** Minimum age (in tool result positions) before content is eligible for dead content eviction. */
         evictionMinAge: z.ZodDefault<z.ZodNumber>;

package/node_modules/@comis/core/dist/config/schema-agent.js

@@ -294,8 +294,12 @@ export const ContextEngineConfigSchema = z.strictObject({
      *  triggers on model id / provider / api change (those checks are
      *  unconditional regardless of this idle threshold). Range: 1 min .. 24 h. */
     replayDriftIdleMs: z.number().int().min(60_000).max(24 * 60 * 60_000).default(30 * 60_000),
-    /** Model for LLM compaction in "provider:modelId" format. Defaults to Haiku for cost efficiency. Empty string falls through to session model. */
-    compactionModel: z.string().default("anthropic:claude-haiku-4-5-20250929"),
+    /** Model for LLM compaction in "provider:modelId" format. Empty string
+     *  (the default) triggers runtime resolution against the agent's primary
+     *  provider via pi-ai catalog (fast-tier cost model). Avoids pinning a
+     *  hardcoded Anthropic literal that goes stale on pi-ai upgrades and
+     *  cross-routes background ops to Claude when primary is OpenRouter/Google/etc. */
+    compactionModel: z.string().default(""),
     /** Minimum age (in tool result positions) before content is eligible for dead content eviction. */
     evictionMinAge: z.number().int().min(3).max(50).default(15),
     // --- Pipeline mode ---

package/node_modules/@comis/core/dist/config/schema-integrations.d.ts

@@ -306,10 +306,10 @@ export declare const VisionConfigSchema: z.ZodObject<{
  * Link understanding configuration.
  *
  * Controls automatic URL detection, fetching, and content extraction
- * from inbound messages. Disabled by default for backward compatibility.
+ * from inbound messages.
  */
 export declare const LinkUnderstandingConfigSchema: z.ZodObject<{
-    /** Enable automatic link understanding (default: false) */
+    /** Enable automatic link understanding (default: true) */
     enabled: z.ZodDefault<z.ZodBoolean>;
     /** Maximum number of links to process per message (default: 3) */
     maxLinks: z.ZodDefault<z.ZodNumber>;
@@ -541,7 +541,7 @@ export declare const MediaConfigSchema: z.ZodObject<{
     }, z.core.$strict>>;
     /** Link understanding settings */
     linkUnderstanding: z.ZodDefault<z.ZodObject<{
-        /** Enable automatic link understanding (default: false) */
+        /** Enable automatic link understanding (default: true) */
         enabled: z.ZodDefault<z.ZodBoolean>;
         /** Maximum number of links to process per message (default: 3) */
         maxLinks: z.ZodDefault<z.ZodNumber>;
@@ -848,7 +848,7 @@ export declare const IntegrationsConfigSchema: z.ZodObject<{
         }, z.core.$strict>>;
         /** Link understanding settings */
         linkUnderstanding: z.ZodDefault<z.ZodObject<{
-            /** Enable automatic link understanding (default: false) */
+            /** Enable automatic link understanding (default: true) */
             enabled: z.ZodDefault<z.ZodBoolean>;
             /** Maximum number of links to process per message (default: 3) */
             maxLinks: z.ZodDefault<z.ZodNumber>;

package/node_modules/@comis/core/dist/config/schema-integrations.js

@@ -197,11 +197,11 @@ export const VisionConfigSchema = z.strictObject({
  * Link understanding configuration.
  *
  * Controls automatic URL detection, fetching, and content extraction
- * from inbound messages. Disabled by default for backward compatibility.
+ * from inbound messages.
  */
 export const LinkUnderstandingConfigSchema = z.strictObject({
-    /** Enable automatic link understanding (default: false) */
-    enabled: z.boolean().default(false),
+    /** Enable automatic link understanding (default: true) */
+    enabled: z.boolean().default(true),
     /** Maximum number of links to process per message (default: 3) */
     maxLinks: z.number().int().positive().default(3),
     /** Timeout for fetching each URL in milliseconds (default: 10000) */

package/node_modules/@comis/core/dist/config/schema-models.d.ts

@@ -34,10 +34,12 @@ export declare const ModelsConfigSchema: z.ZodObject<{
         modelId: z.ZodString;
     }, z.core.$strict>>>;
     /** Default model identifier. When a per-agent config sets model: "default", this value is used.
-     *  Falls back to "claude-sonnet-4-5-20250929" if empty. */
+     *  When empty (the default), runtime resolution picks the mid-tier cost
+     *  model from the resolved provider's pi-ai catalog (resolveOperationDefaults). */
     defaultModel: z.ZodDefault<z.ZodString>;
     /** Default provider. When a per-agent config sets provider: "default", this value is used.
-     *  Falls back to "anthropic" if empty. */
+     *  When empty (the default), runtime resolution picks the most-populated
+     *  native provider from the pi-ai catalog (heuristic). */
     defaultProvider: z.ZodDefault<z.ZodString>;
 }, z.core.$strict>;
 /** Inferred models configuration type. */

package/node_modules/@comis/core/dist/config/schema-models.js

@@ -28,9 +28,11 @@ export const ModelsConfigSchema = z.strictObject({
     /** Friendly model aliases (e.g., "claude" -> anthropic/claude-sonnet-4) */
     aliases: z.array(ModelAliasSchema).default([]),
     /** Default model identifier. When a per-agent config sets model: "default", this value is used.
-     *  Falls back to "claude-sonnet-4-5-20250929" if empty. */
+     *  When empty (the default), runtime resolution picks the mid-tier cost
+     *  model from the resolved provider's pi-ai catalog (resolveOperationDefaults). */
     defaultModel: z.string().default(""),
     /** Default provider. When a per-agent config sets provider: "default", this value is used.
-     *  Falls back to "anthropic" if empty. */
+     *  When empty (the default), runtime resolution picks the most-populated
+     *  native provider from the pi-ai catalog (heuristic). */
     defaultProvider: z.string().default(""),
 });

package/node_modules/@comis/core/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/core",
   "private": true,
-  "version": "1.0.27",
+  "version": "1.0.30",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Core domain types, ports, event bus, security, and config for Comis",

package/node_modules/@comis/daemon/dist/daemon.js

@@ -9,7 +9,7 @@ import { ok, err, suppressError } from "@comis/shared";
 import { createGatewayServer } from "@comis/gateway";
 import { setupLogging, setupObservability, setupHealth, setupMemory, setupAgents, setupSchedulers, setupChannels, setupMedia, setupCrossSession, setupMcp, setupTools, setupMonitoring, setupHeartbeat, setupTaskExtraction, setupShutdown, setupGateway, setupRpcBridge, setupDeliveryQueue, setupDeliveryMirror, setupNotifications, setupBackgroundTasks, } from "./wiring/index.js";
 import { setupSingleAgent } from "./wiring/setup-agents.js";
-import { createActiveRunRegistry, createModelCatalog, wireSessionStateCleanup, wireMcpDisconnectCleanup, createGeminiCacheManager, wireGeminiCacheCleanup, createSessionTrackerRegistry } from "@comis/agent";
+import { createActiveRunRegistry, createModelCatalog, wireSessionStateCleanup, wireMcpDisconnectCleanup, createGeminiCacheManager, wireGeminiCacheCleanup, createSessionTrackerRegistry, validateProviderOverrides } from "@comis/agent";
 import { detectSandboxProvider, createImageGenProvider, createImageGenRateLimiter, createFileStateTracker } from "@comis/skills";
 import { createGraphCoordinator, createNodeTypeRegistry } from "./graph/index.js";
 import { createChannelHealthMonitor } from "@comis/channels";
@@ -33,6 +33,7 @@ import { writeFile as fsWriteFile, rm } from "node:fs/promises";
 import { createExecGit } from "./config/exec-git.js";
 import { saveLastKnownGood, buildRollbackSuggestion, handleRestoreFlag } from "./config/last-known-good.js";
 import { createRestartContinuationTracker, loadContinuations, buildMcpStatusLine } from "./wiring/restart-continuation.js";
+import { createInboundMessageIdResolver } from "./wiring/inbound-message-id-resolver.js";
 import { logOperationModelDryRun } from "./wiring/startup-dry-run.js";
 import os from "node:os";
 import { join as pathJoin, dirname as pathDirname, resolve as pathResolve } from "node:path";
@@ -327,6 +328,11 @@ export async function main(overrides = {}) {
     if (approvalsWarning) {
         daemonLogger.warn({ hint: "Set approvals.enabled: true or remove unused rules", errorKind: "config" }, approvalsWarning);
     }
+    // 3.6. Validate PROVIDER_OVERRIDES vs live pi-ai catalog (Layer 3C -- 260501-07g).
+    // Emits one structured WARN per orphaned override key (provider listed in
+    // PROVIDER_OVERRIDES that pi-ai no longer ships). Fire-and-forget: never
+    // throws, daemon continues to boot with dead override entries.
+    validateProviderOverrides(agentLogger);
     // 4. Observability
     const { tokenTracker, latencyRecorder, sharedCostTracker, // needed for obs.reset billing clear
     diagnosticCollector, billingEstimator, channelActivityTracker, deliveryTracer, } = setupObservability({ eventBus: container.eventBus, _createTokenTracker, _createLatencyRecorder, logger: logLevelManager.getLogger("observability"), dataDir });
@@ -620,11 +626,20 @@ export async function main(overrides = {}) {
     // before setupTools completes).
     // Deferred notification session tracker ref: wired after setupNotifications returns.
     // The onMessageProcessed callback reads this at call time (not definition time),
-    // so it is always set before any message arrives.
+    // so it is always set before any message arrives. recordActivity MUST stay in
+    // the post-processing callback because the ref is wired AFTER setupChannels
+    // returns; tracker.track moved to onMessageReceived which has no such dep.
     const sessionTrackerRef = {};
     // eslint-disable-next-line @typescript-eslint/no-explicit-any -- matches assembleToolsForAgent signature from setup-tools.ts
     const toolAssemblerRef = {};
-    const { adaptersByType, channelManager, resolveAttachment, lifecycleReactors, channelPlugins, commandQueue } = await setupChannels({
+    // Resolver translating daemon UUIDs (NormalizedMessage.id) back to platform-
+    // native message ids (e.g. Telegram integer message_id) for the
+    // message.delete/edit/react RPC handlers. Built post-setupChannels (needs
+    // channelCapabilities from the return), captured by reference inside the
+    // onMessageReceived lambda below — safe because no inbound message can fire
+    // before channelManager.start() runs later.
+    let inboundMessageIdResolver;
+    const { adaptersByType, channelManager, resolveAttachment, lifecycleReactors, channelPlugins, channelCapabilities, commandQueue } = await setupChannels({
         container, executors, defaultAgentId, sessionManager, sessionStore,
         logger, channelsLogger,
         linkRunner,
@@ -654,18 +669,41 @@ export async function main(overrides = {}) {
         rpcCall,
         // Task extraction callback (gated by config.scheduler.tasks.enabled)
         onTaskExtraction: extractFromConversation,
-        // Restart continuation: track recently-active sessions for SIGUSR2 replay
-        onMessageProcessed: (msg, channelType) => {
+        // Restart continuation: track recently-active sessions for SIGUSR2 replay.
+        // Two-callback timing split (260430-s4m corrects the r4i-A flaw):
+        //   onMessageReceived fires BEFORE processInboundMessage so the tracker
+        //     Map is populated before any tool call could trigger SIGUSR2 mid-
+        //     execution. Without this, multi-restart chains saw 0 captured records
+        //     and the next instance had nothing to replay -> silent bot.
+        //   onMessageProcessed fires AFTER processing for sessionTrackerRef
+        //     because the ref is wired post-setupNotifications (deferred-ref
+        //     pattern); calling it pre-processing would fire on an undefined ref.
+        onMessageReceived: (msg, channelType) => {
+            // Preserve channel-native chat type so post-restart synthetic messages
+            // can frame group sessions correctly. Without this, group inbounds are
+            // mis-framed as DMs on first turn after restart.
+            const chatType = typeof msg.metadata?.telegramChatType === "string"
+                ? msg.metadata.telegramChatType
+                : undefined;
             continuationTracker.track({
                 agentId: defaultAgentId,
                 channelType,
                 channelId: msg.channelId,
                 userId: msg.senderId,
+                chatType,
                 tenantId: container.config.tenantId,
                 timestamp: Date.now(),
             });
+            // Translate daemon UUID -> platform-native message id so message.delete/
+            // edit/react can call channel adapters with what they actually expect.
+            // Resolver is assigned just after setupChannels returns (below).
+            inboundMessageIdResolver?.record(msg, channelType);
+        },
+        onMessageProcessed: (msg, channelType) => {
             // Record session activity for notification channel resolution fallback.
-            // sessionTrackerRef is populated after setupNotifications() returns (below).
+            // sessionTrackerRef.ref is populated post-construction by
+            // setupNotifications (line 879 below), so this MUST stay in the
+            // after-processing callback -- moving it earlier would fire on undefined.
             sessionTrackerRef.ref?.recordActivity(defaultAgentId, channelType, msg.channelId);
         },
         // /approve and /deny chat command interception
@@ -680,6 +718,18 @@ export async function main(overrides = {}) {
     });
     // Populate channel plugins ref for per-message char limit resolution.
     channelPluginsRef.ref = channelPlugins;
+    // Build the inbound message id resolver now that we have channelCapabilities.
+    // Each enabled channel contributes its `replyToMetaKey` (e.g. "telegramMessageId")
+    // so the resolver knows which metadata field to read on inbound to capture
+    // the platform-native id. Safe to assign now: setupChannels has not started
+    // adapters yet, so no inbound message has fired the onMessageReceived lambda.
+    {
+        const metaKeyByChannel = new Map();
+        for (const [type, cap] of channelCapabilities) {
+            metaKeyByChannel.set(type, cap.replyToMetaKey);
+        }
+        inboundMessageIdResolver = createInboundMessageIdResolver({ metaKeyByChannel });
+    }
     // Populate channelAdapters ref now that setupChannels has returned.
     // The drain cycle needs adapters to re-deliver pending messages.
     for (const [type, adapter] of adaptersByType) {
@@ -1022,7 +1072,7 @@ export async function main(overrides = {}) {
         agentDataDir: pathJoin(container.config.dataDir ?? pathJoin(os.homedir(), ".comis"), "agents"),
         sessionStore: sessionStoreBridge,
         crossSessionSender, subAgentRunner, graphCoordinator, namedGraphStore, nodeTypeRegistry,
-        securityConfig: container.config.security, adaptersByType, visionRegistry,
+        securityConfig: container.config.security, adaptersByType, inboundMessageIdResolver, visionRegistry,
         mediaConfig: container.config.integrations.media, ttsAdapter, linkRunner,
         logger, container, configPaths, defaultConfigPaths: DEFAULT_CONFIG_PATHS,
         configGitManager,
@@ -1160,7 +1210,7 @@ export async function main(overrides = {}) {
                 errorKind: "dependency",
             }, "MCP connection failures detected during restart continuation replay");
         }
-        const baseText = "[system: daemon restarted after config change — session restored. Do NOT repeat, re-send, or re-execute anything from the previous conversation. Simply greet the user or wait for their next message.]";
+        const baseText = "[system: daemon restarted to apply a config change. The result of your previous tool call is in the conversation above — react to it naturally, confirm or surface any issue, then yield to the user.]";
         for (const record of continuations) {
             // Skip sessions that already received a message during this startup cycle
             // (e.g., Telegram webhook delivered before continuation replay ran).
@@ -1168,6 +1218,21 @@ export async function main(overrides = {}) {
                 daemonLogger.debug({ channelType: record.channelType, channelId: record.channelId }, "Skipping continuation replay: session already active this cycle");
                 continue;
             }
+            // Rehydrate chat-type metadata so downstream resolveChatType /
+            // isGroupMessage classify the resumed session correctly. Without this,
+            // a synthetic restart message for a group is mis-framed as a DM on the
+            // first post-restart turn.
+            const syntheticMetadata = {
+                isRestartContinuation: true,
+                mcpStatusLine: mcpStatusLine ?? null,
+            };
+            if (record.channelType === "telegram" && record.chatType) {
+                syntheticMetadata.telegramChatType = record.chatType;
+            }
+            if (record.chatType === "group" || record.chatType === "supergroup") {
+                // Channel-agnostic flag mirrored by other adapters (e.g. WhatsApp).
+                syntheticMetadata.isGroup = true;
+            }
             const syntheticMsg = {
                 id: randomUUID(),
                 channelId: record.channelId,
@@ -1176,7 +1241,7 @@ export async function main(overrides = {}) {
                 text: mcpStatusLine ? `${baseText}\n${mcpStatusLine}` : baseText,
                 timestamp: Date.now(),
                 attachments: [],
-                metadata: { isRestartContinuation: true, mcpStatusLine: mcpStatusLine ?? null },
+                metadata: syntheticMetadata,
             };
             channelManager.injectMessage(record.channelType, syntheticMsg).catch((injectErr) => {
                 daemonLogger.warn({ err: injectErr, channelType: record.channelType, channelId: record.channelId, hint: "Continuation replay failed; user can re-send to resume", errorKind: "internal" }, "Failed to replay continuation");

package/node_modules/@comis/daemon/dist/rpc/agent-handlers.js

@@ -18,6 +18,7 @@ import { resolveWorkspaceDir, resolveOperationModel, resolveProviderFamily, OPER
 import { persistToConfig } from "./persist-to-config.js";
 import { writeInlineWorkspaceFiles, } from "./agent-inline-workspace.js";
 import { probeProviderAuth } from "./probe-provider-auth.js";
+import { resolveProviderCredential } from "./credential-resolver.js";
 // ---------------------------------------------------------------------------
 // Factory
 // ---------------------------------------------------------------------------
@@ -68,6 +69,18 @@ export function createAgentHandlers(deps) {
             existingSkills.builtinTools = { ...DEFAULT_BUILTIN_TOOLS, ...existingBt };
             raw.skills = existingSkills;
             const parsedConfig = PerAgentConfigSchema.parse(config);
+            // Credential guard (260501-2pz): fail-loud if the new agent's
+            // provider has no resolvable API key. Mirrors agents.update guard
+            // ordering — runs BEFORE the in-memory commit so rejection prevents
+            // assignment, file persist, and hot-add. Same helper as the patch /
+            // update call sites for cross-handler consistency.
+            const credCheck = resolveProviderCredential(parsedConfig.provider, {
+                providerEntries: deps.providerEntries ?? {},
+                secretManager: deps.secretManager,
+            });
+            if (!credCheck.ok) {
+                throw new Error(credCheck.reason);
+            }
             deps.agents[agentId] = parsedConfig;
             // Best-effort persistence to config.yaml
             if (deps.persistDeps) {
@@ -207,18 +220,36 @@ export function createAgentHandlers(deps) {
             }
             const merged = { ...existing, ...config };
             const parsedConfig = PerAgentConfigSchema.parse(merged);
-            // Probe provider API key when provider or model changes
+            // Credential guard + probe (260501-2pz): when provider OR model
+            // changes, (a) GUARD — fail-loud if the resulting provider's API key
+            // is not resolvable from any source (no silent skip), then (b) PROBE
+            // — preexisting wire validation when an explicit providers.entries
+            // record with apiKeyName exists. Order matters: guard runs first
+            // (cheap, all paths), probe runs second (only when applicable).
             const providerChanging = config.provider !== undefined && config.provider !== existing.provider;
             const modelChanging = config.model !== undefined && config.model !== existing.model;
-            if ((providerChanging || modelChanging) && deps.providerEntries) {
+            if (providerChanging || modelChanging) {
                 const targetProvider = parsedConfig.provider;
-                const providerEntry = deps.providerEntries[targetProvider];
-                if (providerEntry?.apiKeyName && deps.secretManager) {
-                    const apiKey = deps.secretManager.get(providerEntry.apiKeyName);
-                    if (apiKey) {
-                        const probeResult = await probeProviderAuth(providerEntry.baseUrl, apiKey, parsedConfig.model);
-                        if (!probeResult.ok) {
-                            throw new Error(`Cannot switch agent "${agentId}" to provider "${targetProvider}": ${probeResult.error}`);
+                // (a) GUARD — fail-loud if no credential source resolves
+                const resolution = resolveProviderCredential(targetProvider, {
+                    providerEntries: deps.providerEntries ?? {},
+                    secretManager: deps.secretManager,
+                });
+                if (!resolution.ok) {
+                    throw new Error(resolution.reason);
+                }
+                // (b) PROBE — preexisting behavior, fires only when an explicit
+                // providers.entries record with apiKeyName exists and the secret
+                // is retrievable. Validates the key works against the wire.
+                if (deps.providerEntries) {
+                    const providerEntry = deps.providerEntries[targetProvider];
+                    if (providerEntry?.apiKeyName && deps.secretManager) {
+                        const apiKey = deps.secretManager.get(providerEntry.apiKeyName);
+                        if (apiKey) {
+                            const probeResult = await probeProviderAuth(providerEntry.baseUrl, apiKey, parsedConfig.model);
+                            if (!probeResult.ok) {
+                                throw new Error(`Cannot switch agent "${agentId}" to provider "${targetProvider}": ${probeResult.error}`);
+                            }
                         }
                     }
                 }

package/node_modules/@comis/daemon/dist/rpc/builtin-provider-guard.d.ts

@@ -0,0 +1,16 @@
+export type BuiltInProviderGuardResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Check whether a providers.create call would land a redundant custom
+ * entry that shadows pi-ai's dynamic catalog. Returns ok=true when the
+ * call is legitimate (genuine custom provider OR proxy with distinct
+ * baseUrl), ok=false with an actionable reason otherwise.
+ */
+export declare function checkBuiltInProviderRedundancy(providerId: string, config: {
+    baseUrl?: string;
+    apiKeyName?: string;
+}): BuiltInProviderGuardResult;