comisai 1.0.28 → 1.0.30

package/node_modules/@comis/agent/dist/model/operation-model-defaults.js

@@ -1,38 +1,83 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Operation model defaults: static maps for provider-family model tiering.
+ * Operation model defaults: catalog-derived per-provider model tiering.
  *
- * These maps define the zero-config smart defaults for non-interactive
- * operations. When no explicit operationModels config is set, the resolver
- * uses these to select cost-appropriate models per provider family.
+ * Replaces the previous hardcoded `OPERATION_MODEL_DEFAULTS` table (which
+ * pinned `mid`/`fast` model IDs per provider family) with a pure function
+ * that reads the live pi-ai catalog at call time. Two design properties:
  *
- * Default model IDs are verified against pi-ai SDK registry v0.65.0.
- * Do NOT call normalizeModelId() on these -- they are already valid
- * registry IDs that bypass normalization.
+ * 1. Pi-ai SDK upgrades automatically light up new providers/models — no
+ *    per-release source edits to bump `OPERATION_MODEL_DEFAULTS` literals.
+ * 2. Closes the latent bug where switching primary to a non-Anthropic
+ *    provider left cron/heartbeat/compaction routed to Claude Sonnet
+ *    (because the old map was Anthropic/OpenAI/Google only).
+ *
+ * Tier picking: filter to text-capable models with non-zero cost, sort
+ * ascending by total cost (input + output), pick 10th-percentile = `fast`,
+ * 50th-percentile = `mid`. All-free-models providers (e.g. local Ollama,
+ * Z.AI most models) fall back to "first text-capable id" for both slots.
  *
  * @module
  */
+import { getModels, getProviders } from "@mariozechner/pi-ai";
+// ---------------------------------------------------------------------------
+// Tier resolution
+// ---------------------------------------------------------------------------
+/** Cached set of native pi-ai providers for O(1) membership check. */
+const _nativeProviderSet = new Set(getProviders());
+/** Sum of input + output cost (per-million-tokens). Treats undefined as 0. */
+function totalCost(m) {
+    return (m.cost?.input ?? 0) + (m.cost?.output ?? 0);
+}
 /**
- * Per-provider-family default models for mid-tier and fast-tier operations.
+ * Resolve cost-tier model defaults for a given native pi-ai provider.
+ *
+ * Returns `{ fast, mid }` model IDs (without provider prefix) selected from
+ * the catalog by ascending total cost. Both undefined fields when the
+ * provider is unknown to pi-ai (e.g. custom YAML providers like Ollama).
+ *
+ * Algorithm:
+ *   1. Fetch `getModels(provider)` -> all models for that provider.
+ *   2. Filter to models supporting text input (`m.input.includes("text")`).
+ *   3. Filter to non-zero cost (eliminates free/local-only models from
+ *      ranking — they won't be reachable in production).
+ *   4. Sort ascending by total cost.
+ *   5. `fast` = 10th percentile, `mid` = 50th percentile.
+ *   6. If post-filter set is empty (all-free provider), use the first
+ *      text-capable model id for both slots.
  *
- * - anthropic: Sonnet 4.6 (mid) for tool-using ops, Haiku 4.5 (fast) for classification
- * - google: Gemini 3 Flash (mid) for tool-using ops, Gemini 2.5 Flash Lite (fast) for classification
- * - openai: GPT-5.4-mini (mid) for tool-using ops, GPT-5.4-nano (fast) for classification
+ * Pure function — no async, no side effects. Re-callable per request.
+ *
+ * @param provider - Provider name to resolve (e.g. "anthropic", "openrouter")
+ * @returns `{ fast?: string, mid?: string }` — empty object for unknown providers
  */
-export const OPERATION_MODEL_DEFAULTS = {
-    anthropic: {
-        mid: "claude-sonnet-4-6",
-        fast: "claude-haiku-4-5",
-    },
-    google: {
-        mid: "gemini-3-flash",
-        fast: "gemini-2.5-flash-lite",
-    },
-    openai: {
-        mid: "gpt-5.4-mini",
-        fast: "gpt-5.4-nano",
-    },
-};
+export function resolveOperationDefaults(provider) {
+    if (!_nativeProviderSet.has(provider))
+        return {};
+    const all = getModels(provider);
+    const textCapable = all.filter((m) => m.input?.includes("text"));
+    // Non-free models, sorted ascending by total cost.
+    const priced = textCapable
+        .filter((m) => totalCost(m) > 0)
+        .sort((a, b) => totalCost(a) - totalCost(b));
+    if (priced.length === 0) {
+        // All-free-models provider (e.g. Z.AI's predominantly-free catalog,
+        // Github Copilot, Kimi Coding). Use first text-capable id for both
+        // slots — no division by zero, graceful degradation.
+        const fallback = textCapable[0]?.id;
+        return { fast: fallback, mid: fallback };
+    }
+    // Math.min clamp guards single-element arrays (10% of 1 -> 0).
+    const fastIdx = Math.min(priced.length - 1, Math.floor(priced.length * 0.1));
+    const midIdx = Math.min(priced.length - 1, Math.floor(priced.length * 0.5));
+    return {
+        fast: priced[fastIdx].id,
+        mid: priced[midIdx].id,
+    };
+}
+// ---------------------------------------------------------------------------
+// Operation -> tier mapping (provider-agnostic semantics)
+// ---------------------------------------------------------------------------
 /**
  * Maps each operation type to its cost tier.
  *

package/node_modules/@comis/agent/dist/model/operation-model-resolver.d.ts

@@ -9,7 +9,7 @@
  *   Level 1: invocationOverride (e.g., CronPayload.model)
  *   Level 2: operationModels[operationType] from agent config
  *   Level 3: parentModel (sub-agent only)
- *   Level 4: OPERATION_MODEL_DEFAULTS[providerFamily] + OPERATION_TIER_MAP
+ *   Level 4: catalog-derived tier (resolveOperationDefaults + OPERATION_TIER_MAP)
  *   Level 5: Agent primary model (ultimate fallback)
  *
  * @module
@@ -47,7 +47,7 @@ export declare function resolveProviderFamily(provider: string): string;
  *   1. invocationOverride -- per-call override (e.g., CronPayload.model)
  *   2. operationModels[op] -- explicit agent config
  *   3. parentModel -- inherited from parent agent (subagent only)
- *   4. OPERATION_MODEL_DEFAULTS -- provider-family smart defaults
+ *   4. resolveOperationDefaults -- pi-ai catalog-derived per-provider tier
  *   5. agent primary -- ultimate fallback
  *
  * @param params - Resolution context (all inputs needed for the decision)

package/node_modules/@comis/agent/dist/model/operation-model-resolver.js

@@ -10,13 +10,13 @@
  *   Level 1: invocationOverride (e.g., CronPayload.model)
  *   Level 2: operationModels[operationType] from agent config
  *   Level 3: parentModel (sub-agent only)
- *   Level 4: OPERATION_MODEL_DEFAULTS[providerFamily] + OPERATION_TIER_MAP
+ *   Level 4: catalog-derived tier (resolveOperationDefaults + OPERATION_TIER_MAP)
  *   Level 5: Agent primary model (ultimate fallback)
  *
  * @module
  */
 import { normalizeModelId } from "../provider/model-id-normalize.js";
-import { OPERATION_MODEL_DEFAULTS, OPERATION_TIER_MAP, OPERATION_TIMEOUT_DEFAULTS, OPERATION_CACHE_DEFAULTS, } from "./operation-model-defaults.js";
+import { resolveOperationDefaults, OPERATION_TIER_MAP, OPERATION_TIMEOUT_DEFAULTS, OPERATION_CACHE_DEFAULTS, } from "./operation-model-defaults.js";
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -80,7 +80,7 @@ export function resolveProviderFamily(provider) {
  *   1. invocationOverride -- per-call override (e.g., CronPayload.model)
  *   2. operationModels[op] -- explicit agent config
  *   3. parentModel -- inherited from parent agent (subagent only)
- *   4. OPERATION_MODEL_DEFAULTS -- provider-family smart defaults
+ *   4. resolveOperationDefaults -- pi-ai catalog-derived per-provider tier
  *   5. agent primary -- ultimate fallback
  *
  * @param params - Resolution context (all inputs needed for the decision)
@@ -120,13 +120,17 @@ export function resolveOperationModel(params) {
         const parsed = parseModelString(parentModel, agentProvider);
         return buildResult(parsed.provider, parsed.modelId, "parent_inherited", operationType, timeoutMs, cacheRetention);
     }
-    // -- Level 4: family default --
+    // -- Level 4: catalog-derived tier --
+    // Reads pi-ai catalog at call time (no hardcoded family map). Picks the
+    // 10th-percentile cost text-capable model for `fast`, 50th for `mid`.
+    // Returns {} for unknown providers (custom YAML providers like Ollama).
     const tier = OPERATION_TIER_MAP[operationType];
     if (tier !== "primary") {
-        const familyDefaults = OPERATION_MODEL_DEFAULTS[providerFamily];
-        if (familyDefaults) {
-            const modelId = familyDefaults[tier];
-            // Do NOT call normalizeModelId on defaults -- they are already registry-validated
+        const defaults = resolveOperationDefaults(providerFamily);
+        const modelId = defaults[tier];
+        if (modelId) {
+            // Do NOT call normalizeModelId on catalog ids — they are already
+            // canonical pi-ai registry entries.
             return buildResult(agentProvider, modelId, "family_default", operationType, timeoutMs, cacheRetention);
         }
     }

package/node_modules/@comis/agent/dist/provider/capabilities.d.ts

@@ -70,3 +70,24 @@ export declare function shouldDropThinkingBlocks(provider: string, modelId: stri
  * Otherwise returns "default".
  */
 export declare function resolveToolCallIdMode(provider: string, modelId: string): "default" | "strict9";
+/**
+ * Minimal Pino-compatible logger surface for `validateProviderOverrides`.
+ * Object-first warn signature matches the project convention (object + msg).
+ */
+export interface ProviderOverridesValidatorLogger {
+    warn(obj: object, msg: string): void;
+}
+/**
+ * Validate that every key in `PROVIDER_OVERRIDES` exists in the live pi-ai
+ * catalog. Orphaned keys (override entries for providers pi-ai no longer
+ * ships) are emitted as structured WARNs so operators notice on the next
+ * pi-ai bump. Does NOT throw -- the daemon continues to boot. Orphaned
+ * overrides are dead-code, not active failures.
+ *
+ * @param logger - Pino-compatible logger (object-first warn signature)
+ * @returns Inventory: orphan keys + total count of override keys checked
+ */
+export declare function validateProviderOverrides(logger: ProviderOverridesValidatorLogger): {
+    orphans: string[];
+    checked: number;
+};

package/node_modules/@comis/agent/dist/provider/capabilities.js

@@ -13,6 +13,7 @@
  *
  * @module
  */
+import { getProviders } from "@mariozechner/pi-ai";
 /**
  * Default provider capabilities. Matches ProviderCapabilitiesSchema defaults.
  * All fields present -- serves as the base layer in the 3-layer cascade.
@@ -161,3 +162,30 @@ export function resolveToolCallIdMode(provider, modelId) {
     }
     return caps.transcriptToolCallIdMode;
 }
+/**
+ * Validate that every key in `PROVIDER_OVERRIDES` exists in the live pi-ai
+ * catalog. Orphaned keys (override entries for providers pi-ai no longer
+ * ships) are emitted as structured WARNs so operators notice on the next
+ * pi-ai bump. Does NOT throw -- the daemon continues to boot. Orphaned
+ * overrides are dead-code, not active failures.
+ *
+ * @param logger - Pino-compatible logger (object-first warn signature)
+ * @returns Inventory: orphan keys + total count of override keys checked
+ */
+export function validateProviderOverrides(logger) {
+    const liveProviders = new Set(getProviders());
+    const overrideKeys = Object.keys(PROVIDER_OVERRIDES);
+    const orphans = [];
+    for (const key of overrideKeys) {
+        if (!liveProviders.has(key)) {
+            orphans.push(key);
+            logger.warn({
+                provider: key,
+                hint: "Provider override exists for unknown pi-ai provider; remove from PROVIDER_OVERRIDES on next bump",
+                errorKind: "config",
+                module: "agent.capabilities",
+            }, "Capability override has no matching pi-ai provider");
+        }
+    }
+    return { orphans, checked: overrideKeys.length };
+}

package/node_modules/@comis/agent/dist/session/orphaned-message-repair.js

@@ -74,11 +74,27 @@ export function repairOrphanedMessages(sessionManager) {
     }
     // Case 2: Tool-result tail -- session ends with tool/toolResult after
     // an assistant toolUse, but execution was interrupted by a restart.
+    // Content-aware (CONTEXT.md §Change 1A): the synthetic assistant text
+    // reflects the actual trailing toolResult body so the model is not given
+    // a prompt that contradicts the real successful result already on disk.
     /* eslint-disable @typescript-eslint/no-explicit-any -- role "tool"/"toolResult" not in SDK AgentMessage union */
     const isToolResult = lastMsg.role === "tool" || lastMsg.role === "toolResult";
     /* eslint-enable @typescript-eslint/no-explicit-any */
     if (isToolResult) {
-        appendSyntheticAssistant(sessionManager, "(previous tool execution was interrupted by a system restart)");
+        let text;
+        if (isErroredToolResult(lastMsg)) {
+            text = "(previous tool errored before I could react)";
+        }
+        else {
+            const body = parseToolResultBody(lastMsg);
+            if (body && body.restarting === true) {
+                text = "(daemon restarted to apply the change — continuing)";
+            }
+            else {
+                text = "(continuing after daemon restart)";
+            }
+        }
+        appendSyntheticAssistant(sessionManager, text);
         return {
             repaired: true,
             reason: "trailing tool result without assistant reply (interrupted by restart)",
@@ -153,6 +169,50 @@ function createSyntheticMessage(role, text) {
 function appendSyntheticAssistant(sessionManager, text) {
     sessionManager.appendMessage(createSyntheticMessage("assistant", text));
 }
+/**
+ * Best-effort parse of a trailing toolResult message into its tool-body
+ * shape. The SDK wire format stores the body as one or more text content
+ * blocks containing JSON. Returns null when the content isn't parseable
+ * JSON (e.g., raw string output from a non-structured tool). Per CONTEXT.md
+ * §Change 1A, parsing is best-effort, not a domain operation, so Result<T,E>
+ * is intentionally not used here.
+ */
+function parseToolResultBody(msg) {
+    const m = msg;
+    if (!m || !Array.isArray(m.content))
+        return null;
+    const first = m.content[0];
+    if (!first || first.type !== "text" || typeof first.text !== "string")
+        return null;
+    const trimmed = first.text.trim();
+    if (!trimmed.startsWith("{") && !trimmed.startsWith("["))
+        return null;
+    try {
+        const parsed = JSON.parse(trimmed);
+        return typeof parsed === "object" && parsed !== null ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Best-effort detection of an errored toolResult. The SDK and various tool
+ * adapters surface errors either via `isError: true` on the message envelope
+ * or on the first content block. Inspect both.
+ */
+function isErroredToolResult(msg) {
+    const m = msg;
+    if (!m)
+        return false;
+    if (m.isError === true)
+        return true;
+    if (Array.isArray(m.content) && m.content.length > 0) {
+        const first = m.content[0];
+        if (first && first.isError === true)
+            return true;
+    }
+    return false;
+}
 // ---------------------------------------------------------------------------
 // Case 4: Mid-session full-scan repair
 // ---------------------------------------------------------------------------

package/node_modules/@comis/agent/dist/workspace/templates.js

@@ -31,7 +31,7 @@ That's the default you start from. Kind without being soft. Witty without being
 
 ## About Comis
 
-Comis is an open-source, security-first AI agent platform. You're one of its agents. You live in your human's messaging apps -- Discord, Telegram, Slack, WhatsApp, Signal, iMessage, IRC, LINE -- and help them with real tools, persistent memory, and proactive scheduling. You're part of a fleet: multiple agents with different skills, models, and personalities, working together. MIT licensed. No cloud dependency. Self-hosted.
+Comis is an open-source, security-first AI agent platform. You're one of its agents. You live in your human's messaging apps -- Discord, Telegram, Slack, WhatsApp, Signal, iMessage, IRC, LINE -- and help them with real tools, persistent memory, and proactive scheduling. You're part of a fleet: multiple agents with different skills, models, and personalities, working together. Apache-2.0 licensed. No cloud dependency. Self-hosted.
 
 Friendly by nature. Powerful by design.
 

package/node_modules/@comis/agent/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/agent",
   "private": true,
-  "version": "1.0.28",
+  "version": "1.0.30",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "AI agent executor, budget control, and session management for Comis",

package/node_modules/@comis/channels/dist/shared/channel-manager.d.ts

@@ -130,7 +130,15 @@ export interface ChannelManagerDeps {
     handleConfigCommand?: (args: string[], channelType: string) => Promise<string | undefined>;
     /** Optional callback for task extraction after successful agent execution. */
     onTaskExtraction?: (conversationText: string, sessionKey: string, agentId: string) => Promise<void>;
-    /** Optional callback fired after each successful inbound message processing. Used by restart continuation tracker. */
+    /**
+     * Optional hook fired BEFORE the inbound message is dispatched to the executor.
+     * Use this for state that must be visible during processing (e.g. continuation
+     * tracker for SIGUSR2 capture). Fires for both real adapter inbounds and
+     * synthetic injected messages. Does NOT fire for early-return paths
+     * (no-adapter warning, graph-report intercept).
+     */
+    onMessageReceived?: (msg: NormalizedMessage, channelType: string) => void;
+    /** Optional callback fired AFTER each successful inbound message processing. Used by post-processing state (e.g. notification session activity recording). */
     onMessageProcessed?: (msg: NormalizedMessage, channelType: string) => void;
     /** When true, lifecycle reactor handles queued/thinking reactions -- skip ack reaction in inbound pipeline. */
     lifecycleReactionsEnabled?: boolean;
@@ -149,6 +157,16 @@ export interface ChannelManagerDeps {
     handleSlashCommand?: InboundPipelineDeps["handleSlashCommand"];
     /** Per-agent enforceFinalTag config lookup. */
     getEnforceFinalTag?: InboundPipelineDeps["getEnforceFinalTag"];
+    /**
+     * Optional in-flight outbound sendMessage promise tracker. PRODUCTION
+     * callers (daemon) MUST NOT pass this -- the factory creates its own
+     * per-instance Set. Exposed via deps strictly to allow unit tests to
+     * inject a controllable Set for drain-ordering and deadline assertions.
+     * Drained in stopAll() with a 5s deadline so SIGUSR2 cannot tear down
+     * adapters mid-send (which would orphan the SQLite delivery-queue ack
+     * and trigger a duplicate retry on the next instance).
+     */
+    inFlightSends?: Set<Promise<unknown>>;
     /** Optional allowFrom sender filter lookup. Returns allowed sender IDs for a channel type. Empty array = allow all. */
     getAllowFrom?: (channelType: string) => string[];
 }

package/node_modules/@comis/channels/dist/shared/channel-manager.js

@@ -33,6 +33,27 @@ export function createChannelManager(deps) {
     const sendOverrides = createSendOverrideStore();
     /** Adapter lookup map: channelType -> ChannelPort. Populated in startAll(). */
     const adaptersByType = new Map();
+    /**
+     * Per-instance in-flight outbound sendMessage promises. Used by
+     * deliver-to-channel.ts to register active sends; drained in stopAll() with
+     * a 5s deadline so SIGUSR2 cannot tear down adapters mid-send (which would
+     * orphan the SQLite delivery-queue ack and trigger a duplicate retry on the
+     * next instance).
+     *
+     * Tests may inject a Set via deps.inFlightSends to seed controllable
+     * promises for drain-ordering and deadline assertions; production callers
+     * (daemon) must NOT pass this -- the factory creates its own.
+     */
+    const inFlightSends = deps.inFlightSends ?? new Set();
+    /**
+     * Pipeline deps with inFlightSends threaded in. Spread once so the Set is
+     * visible to processInboundMessage at all three call sites (debounce flush
+     * handler, normal onMessage handler, injectMessage). The original deps
+     * object is left untouched -- callbacks like onMessageProcessed and
+     * onGraphReportRequest live on the same reference (spread copies the
+     * function references, not the underlying behavior).
+     */
+    const pipelineDeps = { ...deps, inFlightSends };
     // Clean up stale overrides, debounce entries, and group history when sessions expire
     deps.eventBus.on("session:expired", (ev) => {
         sendOverrides.delete(formatSessionKey(ev.sessionKey));
@@ -65,7 +86,7 @@ export function createChannelManager(deps) {
                     };
                     // Fire-and-forget: processInboundMessage is async but the flush callback is sync.
                     // Errors are caught by the onMessage error handler.
-                    void processInboundMessage(deps, adapter, syntheticMsg, activePacers, sendOverrides).catch((error) => {
+                    void processInboundMessage(pipelineDeps, adapter, syntheticMsg, activePacers, sendOverrides).catch((error) => {
                         deps.logger.error({
                             err: error instanceof Error ? error : new Error(String(error)),
                             channelType,
@@ -90,7 +111,12 @@ export function createChannelManager(deps) {
                                 return; // Handled -- do not forward to agent
                             }
                         }
-                        await processInboundMessage(deps, adapter, msg, activePacers, sendOverrides);
+                        // Fire onMessageReceived BEFORE await processInboundMessage so any
+                        // mid-processing SIGUSR2 still sees the session in continuation
+                        // tracker state. The graph-report intercept above must remain BEFORE
+                        // this call so control-plane callbacks bypass both hooks.
+                        deps.onMessageReceived?.(msg, adapter.channelType);
+                        await processInboundMessage(pipelineDeps, adapter, msg, activePacers, sendOverrides);
                         deps.onMessageProcessed?.(msg, adapter.channelType);
                     }
                     catch (error) {
@@ -130,6 +156,25 @@ export function createChannelManager(deps) {
             for (const pacer of activePacers) {
                 pacer.cancel();
             }
+            // Await in-flight outbound sends with a 5s deadline so SIGUSR2 cannot
+            // tear down adapters mid-HTTP-response (which would orphan the SQLite
+            // delivery-queue ack and trigger a duplicate retry on the next instance).
+            // Empty-Set fast path takes no log line, no setTimeout, no Promise.race --
+            // existing shutdown latency is preserved when nothing is in flight.
+            if (inFlightSends.size > 0) {
+                const drainStart = Date.now();
+                const inFlightCount = inFlightSends.size;
+                await Promise.race([
+                    Promise.allSettled([...inFlightSends]),
+                    new Promise((resolve) => setTimeout(resolve, 5000)),
+                ]);
+                deps.logger.info({
+                    inFlightCount,
+                    drainMs: Date.now() - drainStart,
+                    remaining: inFlightSends.size,
+                    hint: "Outbound sends drained before adapter teardown to avoid duplicate-message risk on SIGUSR2 hot-reload",
+                }, "Channel manager: in-flight outbound sends drained");
+            }
             // Build combined adapter list: direct adapters + plugin-registered adapters
             const registryAdapters = deps.channelRegistry
                 ? deps.channelRegistry.getChannelPlugins().map((p) => p.adapter)
@@ -168,7 +213,18 @@ export function createChannelManager(deps) {
                     return;
                 }
             }
-            await processInboundMessage(deps, adapter, msg, activePacers, sendOverrides);
+            // Two-callback contract (symmetric with the normal inbound path):
+            //   onMessageReceived fires BEFORE processInboundMessage so any
+            //     mid-execution SIGUSR2 sees the session in continuation tracker
+            //     state. Daemon wires this to continuationTracker.track(...).
+            //   onMessageProcessed fires AFTER processing for post-processing state
+            //     that depends on deferred refs (e.g. sessionTrackerRef.recordActivity).
+            // Both early-return branches above (no-adapter warn, graph-report intercept)
+            // intentionally bypass both callbacks because they represent control-plane
+            // events, not real session activity.
+            deps.onMessageReceived?.(msg, channelType);
+            await processInboundMessage(pipelineDeps, adapter, msg, activePacers, sendOverrides);
+            deps.onMessageProcessed?.(msg, channelType);
         },
     };
 }

package/node_modules/@comis/channels/dist/shared/deliver-to-channel.d.ts

@@ -118,6 +118,16 @@ export interface DeliverToChannelDeps {
      * Aborted deliveries emit delivery:aborted (not delivery:complete).
      */
     abortSignal?: AbortSignal;
+    /**
+     * Per-instance set of in-flight outbound sendMessage promises. When provided,
+     * each chunk send is added to the set BEFORE the await (so a throwing send
+     * is still tracked) and removed via .finally() on settle. Drained in
+     * channel-manager.stopAll() with a 5s deadline so SIGUSR2 cannot tear down
+     * adapters mid-send (which would orphan the SQLite delivery-queue ack and
+     * trigger a duplicate retry on the next instance). Created by the
+     * channel-manager factory; do not pass externally.
+     */
+    inFlightSends?: Set<Promise<unknown>>;
 }
 /**
  * Resolve the effective chunk limit for a delivery.

package/node_modules/@comis/channels/dist/shared/deliver-to-channel.js

@@ -334,18 +334,33 @@ export async function deliverToChannel(adapter, channelId, text, options, deps)
                 // If enqueue fails, log and continue -- queue failure should not block delivery
             }
             // Send with or without retry
-            let result;
-            let retried = false;
+            const retried = Boolean(deps?.retryEngine);
             const chunkSendStart = Date.now();
-            if (deps?.retryEngine) {
-                // RetryEngine expects a ChannelPort-like adapter -- our DeliveryAdapter
-                // has the same sendMessage signature, so cast through unknown
-                result = await deps.retryEngine.sendWithRetry(adapter, channelId, chunk, sendOpts);
-                retried = true;
-            }
-            else {
-                result = await adapter.sendMessage(channelId, chunk, sendOpts);
+            // Build the send promise WITHOUT awaiting yet, so we can register it
+            // in deps.inFlightSends synchronously before the underlying HTTPS POST
+            // is observable as in-flight. This guarantees that a SIGUSR2 hitting
+            // mid-send will see the promise in the Set and drain it before tearing
+            // down adapters (avoids orphaned SQLite delivery-queue acks and the
+            // resulting duplicate-message retry on the next instance).
+            const sendPromise = deps?.retryEngine
+                ? deps.retryEngine.sendWithRetry(
+                // RetryEngine expects a ChannelPort-like adapter -- our
+                // DeliveryAdapter has the same sendMessage signature, so cast
+                // through unknown
+                adapter, channelId, chunk, sendOpts)
+                : adapter.sendMessage(channelId, chunk, sendOpts);
+            if (deps?.inFlightSends) {
+                const tracked = sendPromise;
+                deps.inFlightSends.add(tracked);
+                // .finally fires on both fulfillment and rejection -- guarantees
+                // Set cleanup even if sendPromise rejects. We intentionally do
+                // not await this side-effect; the void keeps no-floating-promise
+                // lint quiet without altering the awaited value below.
+                void sendPromise.finally(() => {
+                    deps.inFlightSends?.delete(tracked);
+                });
             }
+            const result = await sendPromise;
             const chunkResult = {
                 ok: result.ok,
                 charCount: chunk.length,

package/node_modules/@comis/channels/dist/shared/execution-deliver.d.ts

@@ -11,7 +11,7 @@ import type { ExecutionPipelineDeps } from "./execution-pipeline.js";
 import type { BlockPacer } from "./block-pacer.js";
 import type { TypingLifecycleController } from "./typing-lifecycle-controller.js";
 /** Minimal deps needed for the delivery phase. */
-export type DeliverDeps = Pick<ExecutionPipelineDeps, "eventBus" | "logger" | "streamingConfig" | "channelRegistry" | "retryEngine" | "deliveryQueue">;
+export type DeliverDeps = Pick<ExecutionPipelineDeps, "eventBus" | "logger" | "streamingConfig" | "channelRegistry" | "retryEngine" | "deliveryQueue" | "inFlightSends">;
 /**
  * Chunk, coalesce, pace, and deliver the response text to the channel.
  *

package/node_modules/@comis/channels/dist/shared/execution-deliver.js

@@ -101,7 +101,7 @@ export async function deliverExecutionResponse(deps, adapter, effectiveMsg, fina
                 skipChunking: true,
                 origin: "agent",
             }, deps.deliveryQueue
-                ? { retryEngine: deps.retryEngine, eventBus: deps.eventBus, deliveryQueue: deps.deliveryQueue, replyMode: resolvedReplyMode, abortSignal: deliverySignal }
+                ? { retryEngine: deps.retryEngine, eventBus: deps.eventBus, deliveryQueue: deps.deliveryQueue, replyMode: resolvedReplyMode, abortSignal: deliverySignal, inFlightSends: deps.inFlightSends }
                 : undefined);
             if (!deliveryResult.ok || !deliveryResult.value.ok) {
                 failedChunks++;

package/node_modules/@comis/channels/dist/shared/execution-pipeline.d.ts

@@ -78,6 +78,14 @@ export interface ExecutionPipelineDeps {
     executionTimeoutMs?: number;
     /** Delivery queue for crash-safe persistence. */
     deliveryQueue?: DeliveryQueuePort;
+    /**
+     * Per-instance set of in-flight outbound sendMessage promises. Threaded
+     * through DeliverToChannelDeps so deliver-to-channel can register active
+     * sends. Drained in stopAll() with a 5s deadline so SIGUSR2 cannot tear
+     * down adapters mid-send. Created by the channel-manager factory; do not
+     * pass externally.
+     */
+    inFlightSends?: Set<Promise<unknown>>;
     /** When true, only content inside <final> blocks reaches users. */
     enforceFinalTag?: boolean;
 }

package/node_modules/@comis/channels/dist/shared/inbound-pipeline.d.ts

@@ -89,6 +89,14 @@ export interface InboundPipelineDeps {
     retryEngine?: RetryEngine;
     /** Delivery queue for crash-safe message persistence. When present, agent responses are enqueued before send. */
     deliveryQueue?: DeliveryQueuePort;
+    /**
+     * Per-instance set of in-flight outbound sendMessage promises. Threaded
+     * through ExecutionPipelineDeps -> DeliverToChannelDeps so deliver-to-channel
+     * can register active sends. Drained in stopAll() with a 5s deadline so
+     * SIGUSR2 cannot tear down adapters mid-send. Created by the channel-manager
+     * factory; do not pass externally.
+     */
+    inFlightSends?: Set<Promise<unknown>>;
     /** Optional active run registry for SDK-native steer+followup. */
     activeRunRegistry?: ActiveRunRegistry;
     /** Handle /config command. Returns response text or undefined if not a config command. */

package/node_modules/@comis/channels/dist/shared/inbound-route.d.ts

@@ -15,7 +15,7 @@ import type { BlockPacer } from "./block-pacer.js";
 import type { TypingLifecycleController } from "./typing-lifecycle-controller.js";
 import type { SendOverrideStore } from "./send-policy.js";
 /** Minimal deps needed for the routing phase. */
-export type RouteDeps = Pick<InboundPipelineDeps, "logger" | "eventBus" | "debounceBuffer" | "groupHistoryBuffer" | "sessionLabelStore" | "commandQueue" | "priorityScheduler" | "queueConfig" | "activeRunRegistry" | "streamingConfig" | "sendPolicyConfig" | "getElevatedReplyConfig" | "channelRegistry" | "retryEngine" | "deliveryQueue" | "followupTrigger" | "followupConfig" | "assembleToolsForAgent" | "voiceResponsePipeline" | "parseOutboundMedia" | "outboundMediaFetch" | "onTaskExtraction" | "responsePrefixConfig" | "buildTemplateContext" | "getEnforceFinalTag">;
+export type RouteDeps = Pick<InboundPipelineDeps, "logger" | "eventBus" | "debounceBuffer" | "groupHistoryBuffer" | "sessionLabelStore" | "commandQueue" | "priorityScheduler" | "queueConfig" | "activeRunRegistry" | "streamingConfig" | "sendPolicyConfig" | "getElevatedReplyConfig" | "channelRegistry" | "retryEngine" | "deliveryQueue" | "inFlightSends" | "followupTrigger" | "followupConfig" | "assembleToolsForAgent" | "voiceResponsePipeline" | "parseOutboundMedia" | "outboundMediaFetch" | "onTaskExtraction" | "responsePrefixConfig" | "buildTemplateContext" | "getEnforceFinalTag">;
 /**
  * Route an inbound message through debounce, group history, steer+followup,
  * or command queue. Falls back to direct execution when no queue is present.

package/node_modules/@comis/channels/dist/shared/inbound-route.js

@@ -104,6 +104,7 @@ export async function routeInboundMessage(deps, adapter, processedMsg, originalM
         channelRegistry: deps.channelRegistry,
         retryEngine: deps.retryEngine,
         deliveryQueue: deps.deliveryQueue,
+        inFlightSends: deps.inFlightSends,
         followupTrigger: deps.followupTrigger,
         followupConfig: deps.followupConfig,
         commandQueue: deps.commandQueue,

package/node_modules/@comis/channels/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/channels",
   "private": true,
-  "version": "1.0.28",
+  "version": "1.0.30",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Chat platform adapters — Discord, Telegram, Slack, WhatsApp, Signal, iMessage, IRC, LINE",

package/node_modules/@comis/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/cli",
   "private": true,
-  "version": "1.0.28",
+  "version": "1.0.30",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Command-line interface for the Comis AI agent platform",