comisai 1.0.33 → 1.0.36

package/node_modules/@comis/core/dist/exports/config.d.ts

@@ -1,2 +1,2 @@
-export { AppConfigSchema, AgentConfigSchema, AgentsMapSchema, BudgetConfigSchema, CircuitBreakerConfigSchema, DmScopeConfigSchema, ElevatedReplyConfigSchema, ModelRoutesSchema, HeartbeatConfigSchema, HeartbeatTargetSchema, PerAgentConfigSchema, PerAgentCronConfigSchema, PerAgentHeartbeatConfigSchema, PerAgentSchedulerConfigSchema, PruningConfigSchema, RagConfigSchema, ResetPolicyOverrideSchema, RoutingBindingSchema, RoutingConfigSchema, SessionResetPolicySchema, TracingConfigSchema, ChannelConfigSchema, ChannelEntrySchema, ChannelHealthCheckSchema, MemoryConfigSchema, CompactionConfigSchema, RetentionConfigSchema, SecurityConfigSchema, PermissionConfigSchema, ActionConfirmationConfigSchema, AgentToAgentConfigSchema, SkillsConfigSchema, DaemonConfigSchema, LoggingConfigSchema, TracingDefaultsSchema, ConfigWebhookSchema, SchedulerConfigSchema, GatewayConfigSchema, GatewayTlsConfigSchema, GatewayTokenSchema, GatewayRateLimitSchema, IntegrationsConfigSchema, BraveSearchConfigSchema, McpServerEntrySchema, McpConfigSchema, TranscriptionConfigSchema, TtsConfigSchema, TtsAutoModeSchema, ElevenLabsVoiceSettingsSchema, TtsOutputFormatSchema, ImageAnalysisConfigSchema, VisionScopeRuleSchema, VisionConfigSchema, LinkUnderstandingConfigSchema, MediaConfigSchema, DOCUMENT_MIME_WHITELIST, FileExtractionConfigSchema, AutoReplyRuleSchema, AutoReplyConfigSchema, MonitoringConfigSchema, PluginsConfigSchema, PluginEntrySchema, QueueConfigSchema, QueueModeSchema, OverflowPolicySchema, PerChannelQueueConfigSchema, OverflowConfigSchema, DebounceBufferConfigSchema, FollowupConfigSchema, PriorityLaneConfigSchema, LaneAssignmentConfigSchema, StreamingConfigSchema, PerChannelStreamingConfigSchema, TypingModeSchema, ChunkModeSchema, DeliveryMirrorConfigSchema, DeliveryQueueConfigSchema, DeliveryTimingConfigSchema, DeliveryTimingModeSchema, CoalescerConfigSchema, AutoReplyEngineConfigSchema, GroupActivationModeSchema, SendPolicyConfigSchema, SendPolicyRuleSchema, SendActionSchema, EnvelopeConfigSchema, RetryConfigSchema, WebhooksConfigSchema, WebhookMappingConfigSchema, WebhookMappingMatchSchema, AgentSecretsConfigSchema, SecretsConfigSchema, DocumentationConfigSchema, DocumentationLinkSchema, ImageGenerationConfigSchema, NotificationConfigSchema, VerbosityConfigSchema, VerbosityLevelSchema, VerbosityOverrideSchema, ContextEngineConfigSchema, BackgroundTasksConfigSchema, MemoryReviewConfigSchema, ProviderEntrySchema, ProvidersConfigSchema, UserModelSchema, ModelCostSchema, OperationModelEntrySchema, OperationModelsSchema, substituteEnvVars, warnSuspiciousEnvValues, loadConfigFile, validateConfig, deepMerge, mergeLayered, loadLayered, IMMUTABLE_CONFIG_PREFIXES, MUTABLE_CONFIG_OVERRIDES, isImmutableConfigPath, matchesOverridePattern, getMutableOverridesForSection, MANAGED_SECTIONS, getManagedSectionRedirect, formatRedirectHint, getConfigSchema, getConfigSections, getFieldMetadata, validatePartial, createConfigGitManager, checkApprovalsConfig, } from "../config/index.js";
-export type { AppConfig, AgentConfig, BudgetConfig, CircuitBreakerConfig, DmScopeConfig, ElevatedReplyConfig, ModelRoutes, PruningConfig, HeartbeatConfig, HeartbeatTarget, PerAgentConfig, PerAgentCronConfig, PerAgentHeartbeatConfig, PerAgentSchedulerConfig, RagConfig, ResetPolicyOverride, RoutingBinding, RoutingConfig, SessionResetPolicyConfig, TracingConfig, ChannelConfig, ChannelEntry, ChannelHealthCheckConfig, AckReactionConfig, MemoryConfig, CompactionConfig, RetentionConfig, SecurityConfig, PermissionConfig, ActionConfirmationConfig, AgentToAgentConfig, SkillsConfig, DaemonConfig, LoggingConfig, TracingDefaults, ConfigWebhook, SchedulerConfig, GatewayConfig, GatewayTlsConfig, GatewayToken, GatewayRateLimit, IntegrationsConfig, BraveSearchConfig, McpServerEntry, McpConfig, TranscriptionConfig, TtsConfig, TtsAutoMode, ElevenLabsVoiceSettings, TtsOutputFormat, ImageAnalysisConfig, VisionScopeRule, VisionConfig, LinkUnderstandingConfig, MediaConfig, FileExtractionConfig, AutoReplyRule, AutoReplyConfig, MonitoringConfig, DiskMonitorConfig, ResourceMonitorConfig, SystemdMonitorConfig, SecurityUpdateMonitorConfig, GitMonitorConfig, PluginsConfig, PluginEntry, QueueConfig, PerChannelQueueConfig, QueueMode, OverflowPolicy, OverflowConfig, DebounceBufferConfig, FollowupConfig, PriorityLaneConfig, LaneAssignmentConfig, StreamingConfig, PerChannelStreamingConfig, TypingMode, ChunkMode, DeliveryMirrorConfig, DeliveryQueueConfig, DeliveryTimingConfig, DeliveryTimingMode, CoalescerConfig, AutoReplyEngineConfig, GroupActivationMode, SendPolicyConfig, SendPolicyRule, SendAction, EnvelopeConfig, RetryConfig, WebhooksConfig, WebhookMappingConfig, AgentSecretsConfig, SecretsConfig, ConfigError, ConfigErrorCode, FieldMetadata, PartialValidationResult, ConfigGitManager, GitCommitMetadata, HistoryEntry, GitManagerDeps, ExecGitFn, EnvValueWarning, LifecycleReactionsConfig, LifecycleReactionsTimingConfig, SenderTrustDisplayConfig, DocumentationConfig, DocumentationLink, ImageGenerationConfig, NotificationConfig, VerbosityConfig, VerbosityLevel, VerbosityOverride, ContextEngineConfig, BackgroundTasksConfig, MemoryReviewConfig, ProviderEntry, ProvidersConfig, UserModel, ModelCost, OperationModelEntry, OperationModels, ModelOperationType, } from "../config/index.js";
+export { AppConfigSchema, AgentConfigSchema, AgentsMapSchema, BudgetConfigSchema, CircuitBreakerConfigSchema, DmScopeConfigSchema, ElevatedReplyConfigSchema, ModelRoutesSchema, HeartbeatConfigSchema, HeartbeatTargetSchema, PerAgentConfigSchema, PerAgentCronConfigSchema, PerAgentHeartbeatConfigSchema, PerAgentSchedulerConfigSchema, PruningConfigSchema, RagConfigSchema, ResetPolicyOverrideSchema, RoutingBindingSchema, RoutingConfigSchema, SessionResetPolicySchema, TracingConfigSchema, ChannelConfigSchema, ChannelEntrySchema, ChannelHealthCheckSchema, MemoryConfigSchema, CompactionConfigSchema, RetentionConfigSchema, SecurityConfigSchema, PermissionConfigSchema, ActionConfirmationConfigSchema, AgentToAgentConfigSchema, SkillsConfigSchema, DaemonConfigSchema, LoggingConfigSchema, TracingDefaultsSchema, ConfigWebhookSchema, SchedulerConfigSchema, GatewayConfigSchema, GatewayTlsConfigSchema, GatewayTokenSchema, GatewayRateLimitSchema, IntegrationsConfigSchema, BraveSearchConfigSchema, McpServerEntrySchema, McpConfigSchema, TranscriptionConfigSchema, TtsConfigSchema, TtsAutoModeSchema, ElevenLabsVoiceSettingsSchema, TtsOutputFormatSchema, ImageAnalysisConfigSchema, VisionScopeRuleSchema, VisionConfigSchema, LinkUnderstandingConfigSchema, MediaConfigSchema, DOCUMENT_MIME_WHITELIST, FileExtractionConfigSchema, AutoReplyRuleSchema, AutoReplyConfigSchema, MonitoringConfigSchema, PluginsConfigSchema, PluginEntrySchema, QueueConfigSchema, QueueModeSchema, OverflowPolicySchema, PerChannelQueueConfigSchema, OverflowConfigSchema, DebounceBufferConfigSchema, FollowupConfigSchema, PriorityLaneConfigSchema, LaneAssignmentConfigSchema, StreamingConfigSchema, PerChannelStreamingConfigSchema, TypingModeSchema, ChunkModeSchema, DeliveryMirrorConfigSchema, DeliveryQueueConfigSchema, DeliveryTimingConfigSchema, DeliveryTimingModeSchema, CoalescerConfigSchema, AutoReplyEngineConfigSchema, GroupActivationModeSchema, SendPolicyConfigSchema, SendPolicyRuleSchema, SendActionSchema, EnvelopeConfigSchema, RetryConfigSchema, WebhooksConfigSchema, WebhookMappingConfigSchema, WebhookMappingMatchSchema, AgentSecretsConfigSchema, SecretsConfigSchema, DocumentationConfigSchema, DocumentationLinkSchema, ImageGenerationConfigSchema, NotificationConfigSchema, VerbosityConfigSchema, VerbosityLevelSchema, VerbosityOverrideSchema, ContextEngineConfigSchema, BackgroundTasksConfigSchema, MemoryReviewConfigSchema, ProviderEntrySchema, ProvidersConfigSchema, UserModelSchema, ModelCostSchema, OperationModelEntrySchema, OperationModelsSchema, OAuthConfigSchema, substituteEnvVars, warnSuspiciousEnvValues, findUnresolvedEnvRefs, formatMissingEnvRefError, loadConfigFile, validateConfig, deepMerge, mergeLayered, loadLayered, IMMUTABLE_CONFIG_PREFIXES, MUTABLE_CONFIG_OVERRIDES, isImmutableConfigPath, matchesOverridePattern, getMutableOverridesForSection, MANAGED_SECTIONS, getManagedSectionRedirect, formatRedirectHint, getConfigSchema, getConfigSections, getFieldMetadata, validatePartial, createConfigGitManager, checkApprovalsConfig, } from "../config/index.js";
+export type { AppConfig, AgentConfig, BudgetConfig, CircuitBreakerConfig, DmScopeConfig, ElevatedReplyConfig, ModelRoutes, PruningConfig, HeartbeatConfig, HeartbeatTarget, PerAgentConfig, PerAgentCronConfig, PerAgentHeartbeatConfig, PerAgentSchedulerConfig, RagConfig, ResetPolicyOverride, RoutingBinding, RoutingConfig, SessionResetPolicyConfig, TracingConfig, ChannelConfig, ChannelEntry, ChannelHealthCheckConfig, AckReactionConfig, MemoryConfig, CompactionConfig, RetentionConfig, SecurityConfig, PermissionConfig, ActionConfirmationConfig, AgentToAgentConfig, SkillsConfig, DaemonConfig, LoggingConfig, TracingDefaults, ConfigWebhook, SchedulerConfig, GatewayConfig, GatewayTlsConfig, GatewayToken, GatewayRateLimit, IntegrationsConfig, BraveSearchConfig, McpServerEntry, McpConfig, TranscriptionConfig, TtsConfig, TtsAutoMode, ElevenLabsVoiceSettings, TtsOutputFormat, ImageAnalysisConfig, VisionScopeRule, VisionConfig, LinkUnderstandingConfig, MediaConfig, FileExtractionConfig, AutoReplyRule, AutoReplyConfig, MonitoringConfig, DiskMonitorConfig, ResourceMonitorConfig, SystemdMonitorConfig, SecurityUpdateMonitorConfig, GitMonitorConfig, PluginsConfig, PluginEntry, QueueConfig, PerChannelQueueConfig, QueueMode, OverflowPolicy, OverflowConfig, DebounceBufferConfig, FollowupConfig, PriorityLaneConfig, LaneAssignmentConfig, StreamingConfig, PerChannelStreamingConfig, TypingMode, ChunkMode, DeliveryMirrorConfig, DeliveryQueueConfig, DeliveryTimingConfig, DeliveryTimingMode, CoalescerConfig, AutoReplyEngineConfig, GroupActivationMode, SendPolicyConfig, SendPolicyRule, SendAction, EnvelopeConfig, RetryConfig, WebhooksConfig, WebhookMappingConfig, AgentSecretsConfig, SecretsConfig, ConfigError, ConfigErrorCode, FieldMetadata, PartialValidationResult, ConfigGitManager, GitCommitMetadata, HistoryEntry, GitManagerDeps, ExecGitFn, EnvValueWarning, UnresolvedEnvRef, LifecycleReactionsConfig, LifecycleReactionsTimingConfig, SenderTrustDisplayConfig, DocumentationConfig, DocumentationLink, ImageGenerationConfig, NotificationConfig, VerbosityConfig, VerbosityLevel, VerbosityOverride, ContextEngineConfig, BackgroundTasksConfig, MemoryReviewConfig, ProviderEntry, ProvidersConfig, UserModel, ModelCost, OperationModelEntry, OperationModels, ModelOperationType, OAuthConfig, } from "../config/index.js";

package/node_modules/@comis/core/dist/exports/config.js

@@ -1,3 +1,3 @@
 // SPDX-License-Identifier: Apache-2.0
 // @comis/core exports — Config (layered configuration with Zod validation)
-export { AppConfigSchema, AgentConfigSchema, AgentsMapSchema, BudgetConfigSchema, CircuitBreakerConfigSchema, DmScopeConfigSchema, ElevatedReplyConfigSchema, ModelRoutesSchema, HeartbeatConfigSchema, HeartbeatTargetSchema, PerAgentConfigSchema, PerAgentCronConfigSchema, PerAgentHeartbeatConfigSchema, PerAgentSchedulerConfigSchema, PruningConfigSchema, RagConfigSchema, ResetPolicyOverrideSchema, RoutingBindingSchema, RoutingConfigSchema, SessionResetPolicySchema, TracingConfigSchema, ChannelConfigSchema, ChannelEntrySchema, ChannelHealthCheckSchema, MemoryConfigSchema, CompactionConfigSchema, RetentionConfigSchema, SecurityConfigSchema, PermissionConfigSchema, ActionConfirmationConfigSchema, AgentToAgentConfigSchema, SkillsConfigSchema, DaemonConfigSchema, LoggingConfigSchema, TracingDefaultsSchema, ConfigWebhookSchema, SchedulerConfigSchema, GatewayConfigSchema, GatewayTlsConfigSchema, GatewayTokenSchema, GatewayRateLimitSchema, IntegrationsConfigSchema, BraveSearchConfigSchema, McpServerEntrySchema, McpConfigSchema, TranscriptionConfigSchema, TtsConfigSchema, TtsAutoModeSchema, ElevenLabsVoiceSettingsSchema, TtsOutputFormatSchema, ImageAnalysisConfigSchema, VisionScopeRuleSchema, VisionConfigSchema, LinkUnderstandingConfigSchema, MediaConfigSchema, DOCUMENT_MIME_WHITELIST, FileExtractionConfigSchema, AutoReplyRuleSchema, AutoReplyConfigSchema, MonitoringConfigSchema, PluginsConfigSchema, PluginEntrySchema, QueueConfigSchema, QueueModeSchema, OverflowPolicySchema, PerChannelQueueConfigSchema, OverflowConfigSchema, DebounceBufferConfigSchema, FollowupConfigSchema, PriorityLaneConfigSchema, LaneAssignmentConfigSchema, StreamingConfigSchema, PerChannelStreamingConfigSchema, TypingModeSchema, ChunkModeSchema, DeliveryMirrorConfigSchema, DeliveryQueueConfigSchema, DeliveryTimingConfigSchema, DeliveryTimingModeSchema, CoalescerConfigSchema, AutoReplyEngineConfigSchema, GroupActivationModeSchema, SendPolicyConfigSchema, SendPolicyRuleSchema, SendActionSchema, EnvelopeConfigSchema, RetryConfigSchema, WebhooksConfigSchema, WebhookMappingConfigSchema, WebhookMappingMatchSchema, AgentSecretsConfigSchema, SecretsConfigSchema, DocumentationConfigSchema, DocumentationLinkSchema, ImageGenerationConfigSchema, NotificationConfigSchema, VerbosityConfigSchema, VerbosityLevelSchema, VerbosityOverrideSchema, ContextEngineConfigSchema, BackgroundTasksConfigSchema, MemoryReviewConfigSchema, ProviderEntrySchema, ProvidersConfigSchema, UserModelSchema, ModelCostSchema, OperationModelEntrySchema, OperationModelsSchema, substituteEnvVars, warnSuspiciousEnvValues, loadConfigFile, validateConfig, deepMerge, mergeLayered, loadLayered, IMMUTABLE_CONFIG_PREFIXES, MUTABLE_CONFIG_OVERRIDES, isImmutableConfigPath, matchesOverridePattern, getMutableOverridesForSection, MANAGED_SECTIONS, getManagedSectionRedirect, formatRedirectHint, getConfigSchema, getConfigSections, getFieldMetadata, validatePartial, createConfigGitManager, checkApprovalsConfig, } from "../config/index.js";
+export { AppConfigSchema, AgentConfigSchema, AgentsMapSchema, BudgetConfigSchema, CircuitBreakerConfigSchema, DmScopeConfigSchema, ElevatedReplyConfigSchema, ModelRoutesSchema, HeartbeatConfigSchema, HeartbeatTargetSchema, PerAgentConfigSchema, PerAgentCronConfigSchema, PerAgentHeartbeatConfigSchema, PerAgentSchedulerConfigSchema, PruningConfigSchema, RagConfigSchema, ResetPolicyOverrideSchema, RoutingBindingSchema, RoutingConfigSchema, SessionResetPolicySchema, TracingConfigSchema, ChannelConfigSchema, ChannelEntrySchema, ChannelHealthCheckSchema, MemoryConfigSchema, CompactionConfigSchema, RetentionConfigSchema, SecurityConfigSchema, PermissionConfigSchema, ActionConfirmationConfigSchema, AgentToAgentConfigSchema, SkillsConfigSchema, DaemonConfigSchema, LoggingConfigSchema, TracingDefaultsSchema, ConfigWebhookSchema, SchedulerConfigSchema, GatewayConfigSchema, GatewayTlsConfigSchema, GatewayTokenSchema, GatewayRateLimitSchema, IntegrationsConfigSchema, BraveSearchConfigSchema, McpServerEntrySchema, McpConfigSchema, TranscriptionConfigSchema, TtsConfigSchema, TtsAutoModeSchema, ElevenLabsVoiceSettingsSchema, TtsOutputFormatSchema, ImageAnalysisConfigSchema, VisionScopeRuleSchema, VisionConfigSchema, LinkUnderstandingConfigSchema, MediaConfigSchema, DOCUMENT_MIME_WHITELIST, FileExtractionConfigSchema, AutoReplyRuleSchema, AutoReplyConfigSchema, MonitoringConfigSchema, PluginsConfigSchema, PluginEntrySchema, QueueConfigSchema, QueueModeSchema, OverflowPolicySchema, PerChannelQueueConfigSchema, OverflowConfigSchema, DebounceBufferConfigSchema, FollowupConfigSchema, PriorityLaneConfigSchema, LaneAssignmentConfigSchema, StreamingConfigSchema, PerChannelStreamingConfigSchema, TypingModeSchema, ChunkModeSchema, DeliveryMirrorConfigSchema, DeliveryQueueConfigSchema, DeliveryTimingConfigSchema, DeliveryTimingModeSchema, CoalescerConfigSchema, AutoReplyEngineConfigSchema, GroupActivationModeSchema, SendPolicyConfigSchema, SendPolicyRuleSchema, SendActionSchema, EnvelopeConfigSchema, RetryConfigSchema, WebhooksConfigSchema, WebhookMappingConfigSchema, WebhookMappingMatchSchema, AgentSecretsConfigSchema, SecretsConfigSchema, DocumentationConfigSchema, DocumentationLinkSchema, ImageGenerationConfigSchema, NotificationConfigSchema, VerbosityConfigSchema, VerbosityLevelSchema, VerbosityOverrideSchema, ContextEngineConfigSchema, BackgroundTasksConfigSchema, MemoryReviewConfigSchema, ProviderEntrySchema, ProvidersConfigSchema, UserModelSchema, ModelCostSchema, OperationModelEntrySchema, OperationModelsSchema, OAuthConfigSchema, substituteEnvVars, warnSuspiciousEnvValues, findUnresolvedEnvRefs, formatMissingEnvRefError, loadConfigFile, validateConfig, deepMerge, mergeLayered, loadLayered, IMMUTABLE_CONFIG_PREFIXES, MUTABLE_CONFIG_OVERRIDES, isImmutableConfigPath, matchesOverridePattern, getMutableOverridesForSection, MANAGED_SECTIONS, getManagedSectionRedirect, formatRedirectHint, getConfigSchema, getConfigSections, getFieldMetadata, validatePartial, createConfigGitManager, checkApprovalsConfig, } from "../config/index.js";

package/node_modules/@comis/core/dist/exports/domain.d.ts

@@ -1,2 +1,4 @@
 export { AttachmentSchema, NormalizedMessageSchema, parseMessage, TrustLevelSchema, MemorySourceSchema, MemoryEntrySchema, ToolCallSchema, TokenUsageSchema, AgentResponseSchema, SessionKeySchema, parseSessionKey, formatSessionKey, parseFormattedSessionKey, PollInputSchema, PollOptionResultSchema, NormalizedPollResultSchema, normalizePollDurationHours, RichButtonSchema, RichCardFieldSchema, RichCardSchema, RichEffectSchema, ApprovalRequestSchema, ApprovalResolutionSchema, SerializedApprovalRequestSchema, SerializedApprovalCacheEntrySchema, InjectionTypeSchema, CredentialMappingSchema, SecretRefSchema, isSecretRef, SecretRefOrStringSchema, DeliveryOriginSchema, createDeliveryOrigin, NodeStatusSchema, GraphStatusSchema, GraphNodeSchema, NodeExecutionStateSchema, ExecutionGraphSchema, GraphValidationError, parseExecutionGraph, topologicalSort, validateAndSortGraph, SubagentResultSchema, SubagentEndReasonSchema, parseSubagentResult, SubagentContextConfigSchema, NodeTypeIdSchema, ToolSchemaProfileSchema, ToolCallArgumentsEncodingSchema, ModelCompatConfigSchema, ProviderFamilySchema, TranscriptToolCallIdModeSchema, ProviderCapabilitiesSchema, } from "../domain/index.js";
+export { BackgroundTaskOriginSchema } from "../domain/background-task-origin.js";
+export type { BackgroundTaskOrigin } from "../domain/background-task-origin.js";
 export type { Attachment, NormalizedMessage, TrustLevel, MemoryEntry, ToolCall, TokenUsage, AgentResponse, SessionKey, PollInput, NormalizedPollResult, PollOptionResult, RichButton, RichCard, RichEffect, ApprovalRequest, ApprovalResolution, SerializedApprovalRequest, SerializedApprovalCacheEntry, InjectionType, CredentialMapping, SecretRef, DeliveryOrigin, NodeStatus, GraphStatus, GraphNode, NodeExecutionState, ExecutionGraph, ValidatedGraph, SubagentResult, SubagentEndReason, SpawnPacket, CondensedResult, SubAgentSpawnPreparedEvent, SubAgentSpawnRejectedEvent, SubAgentSpawnStartedEvent, SubAgentResultCondensedEvent, SubAgentLifecycleEndedEvent, SubAgentContextCompactedEvent, SubagentContextConfig, NodeTypeId, NodeTypeDriver, NodeDriverAction, NodeDriverContext, ToolSchemaProfile, ToolCallArgumentsEncoding, ModelCompatConfig, ProviderFamily, TranscriptToolCallIdMode, ProviderCapabilities, } from "../domain/index.js";

package/node_modules/@comis/core/dist/exports/domain.js

@@ -31,3 +31,4 @@ NodeTypeIdSchema,
 ToolSchemaProfileSchema, ToolCallArgumentsEncodingSchema, ModelCompatConfigSchema, 
 // Provider capabilities
 ProviderFamilySchema, TranscriptToolCallIdModeSchema, ProviderCapabilitiesSchema, } from "../domain/index.js";
+export { BackgroundTaskOriginSchema } from "../domain/background-task-origin.js";

package/node_modules/@comis/core/dist/exports/ports.d.ts

@@ -1,2 +1,2 @@
-export { ChannelCapabilitySchema, createNoOpDeliveryQueue, createNoOpDeliveryMirror } from "../ports/index.js";
-export type { ChannelPort, MessageHandler, SendMessageOptions, FetchMessagesOptions, FetchedMessage, AttachmentPayload, ChannelPluginPort, ChannelCapability, ChannelStatus, MemoryPort, MemorySearchOptions, MemorySearchResult, MemoryUpdateFields, SkillPort, SkillPermissions, SkillInput, SkillOutput, SkillManifest, EmbeddingPort, TranscriptionPort, TranscriptionOptions, TranscriptionResult, TTSPort, TTSOptions, TTSResult, ImageAnalysisPort, ImageAnalysisOptions, VisionRequest, VideoRequest, VisionResult, VisionProvider, ResolvedMedia, MediaResolverPort, FileClassification, FileExtractionErrorKind, FileExtractionError, FileExtractionInput, FileExtractionResult, FileExtractionPort, HookName, ModifyingHookName, VoidHookName, HookHandlerMap, HookBeforeAgentStartEvent, HookBeforeAgentStartContext, HookBeforeAgentStartResult, HookAgentEndEvent, HookAgentEndContext, HookBeforeToolCallEvent, HookBeforeToolCallContext, HookBeforeToolCallResult, HookAfterToolCallEvent, HookAfterToolCallContext, HookToolResultPersistEvent, HookToolResultPersistContext, HookToolResultPersistResult, HookBeforeCompactionEvent, HookBeforeCompactionContext, HookBeforeCompactionResult, HookAfterCompactionEvent, HookAfterCompactionContext, HookSessionStartEvent, HookSessionStartContext, HookSessionEndEvent, HookSessionEndContext, HookGatewayStartEvent, HookGatewayStartContext, HookGatewayStopEvent, HookGatewayStopContext, PluginPort, PluginRegistryApi, RegisteredHook, PluginToolDefinition, PluginHttpRoute, DeviceIdentity, DeviceIdentityPort, PairingRequest, PairedDevice, OutputGuardPort, OutputGuardFinding, OutputGuardResult, SecretStorePort, SecretMetadata, CredentialMappingPort, DeliveryQueuePort, DeliveryQueueEntry, DeliveryQueueEnqueueInput, DeliveryQueueStatusCounts, DeliveryMirrorPort, DeliveryMirrorEntry, DeliveryMirrorRecordInput, Provider, ImageGenInput, ImageGenOutput, ImageGenerationPort, } from "../ports/index.js";
+export { ChannelCapabilitySchema, createNoOpDeliveryQueue, createNoOpDeliveryMirror, validateProfileId, PROFILE_ID_RE, } from "../ports/index.js";
+export type { ChannelPort, MessageHandler, SendMessageOptions, FetchMessagesOptions, FetchedMessage, AttachmentPayload, ChannelPluginPort, ChannelCapability, ChannelStatus, MemoryPort, MemorySearchOptions, MemorySearchResult, MemoryUpdateFields, SkillPort, SkillPermissions, SkillInput, SkillOutput, SkillManifest, EmbeddingPort, TranscriptionPort, TranscriptionOptions, TranscriptionResult, TTSPort, TTSOptions, TTSResult, ImageAnalysisPort, ImageAnalysisOptions, VisionRequest, VideoRequest, VisionResult, VisionProvider, ResolvedMedia, MediaResolverPort, FileClassification, FileExtractionErrorKind, FileExtractionError, FileExtractionInput, FileExtractionResult, FileExtractionPort, HookName, ModifyingHookName, VoidHookName, HookHandlerMap, HookBeforeAgentStartEvent, HookBeforeAgentStartContext, HookBeforeAgentStartResult, HookAgentEndEvent, HookAgentEndContext, HookBeforeToolCallEvent, HookBeforeToolCallContext, HookBeforeToolCallResult, HookAfterToolCallEvent, HookAfterToolCallContext, HookToolResultPersistEvent, HookToolResultPersistContext, HookToolResultPersistResult, HookBeforeCompactionEvent, HookBeforeCompactionContext, HookBeforeCompactionResult, HookAfterCompactionEvent, HookAfterCompactionContext, HookSessionStartEvent, HookSessionStartContext, HookSessionEndEvent, HookSessionEndContext, HookGatewayStartEvent, HookGatewayStartContext, HookGatewayStopEvent, HookGatewayStopContext, PluginPort, PluginRegistryApi, RegisteredHook, PluginToolDefinition, PluginHttpRoute, DeviceIdentity, DeviceIdentityPort, PairingRequest, PairedDevice, OutputGuardPort, OutputGuardFinding, OutputGuardResult, SecretStorePort, SecretMetadata, CredentialMappingPort, OAuthCredentialStorePort, OAuthProfile, DeliveryQueuePort, DeliveryQueueEntry, DeliveryQueueEnqueueInput, DeliveryQueueStatusCounts, DeliveryMirrorPort, DeliveryMirrorEntry, DeliveryMirrorRecordInput, Provider, ImageGenInput, ImageGenOutput, ImageGenerationPort, } from "../ports/index.js";

package/node_modules/@comis/core/dist/exports/ports.js

@@ -1,3 +1,3 @@
 // SPDX-License-Identifier: Apache-2.0
 // @comis/core exports — Port interfaces (hexagonal architecture boundaries)
-export { ChannelCapabilitySchema, createNoOpDeliveryQueue, createNoOpDeliveryMirror } from "../ports/index.js";
+export { ChannelCapabilitySchema, createNoOpDeliveryQueue, createNoOpDeliveryMirror, validateProfileId, PROFILE_ID_RE, } from "../ports/index.js";

package/node_modules/@comis/core/dist/ports/delivery-queue.d.ts

@@ -65,6 +65,19 @@ export interface DeliveryQueuePort {
      * @returns The assigned entry ID on success.
      */
     enqueue(entry: DeliveryQueueEnqueueInput): Promise<Result<string, Error>>;
+    /**
+     * Enqueue a new outbound message with status='in_flight' (process-local lease).
+     *
+     * Used by the channel-side synchronous-send path: insert as 'in_flight' so the
+     * recurring drainer's `WHERE status='pending'` filter does not race-pick the row
+     * mid-send. Same semantics as enqueue() except for the initial status.
+     * On crash, the startup sweep (recoverInFlight) resets these rows back to 'pending'.
+     *
+     * Emits delivery:enqueued (same event as enqueue()) -- universal observability.
+     *
+     * @returns The assigned entry ID on success.
+     */
+    enqueueInFlight(entry: DeliveryQueueEnqueueInput): Promise<Result<string, Error>>;
     /**
      * Mark an entry as successfully delivered.
      * @param id - The queue entry ID
@@ -103,6 +116,16 @@ export interface DeliveryQueuePort {
      * @param channelType - Optional filter to restrict counts to a specific channel.
      */
     statusCounts(channelType?: string): Promise<Result<DeliveryQueueStatusCounts, Error>>;
+    /**
+     * Reset all rows with status='in_flight' to status='pending', clearing last_error.
+     *
+     * Called once at daemon startup before the existing startup drain. Treats
+     * 'in_flight' as a process-local lease -- any in_flight row left over from a
+     * prior daemon process is by definition stale and must be re-attempted.
+     *
+     * @returns The number of rows recovered (transitioned in_flight -> pending).
+     */
+    recoverInFlight(): Promise<Result<number, Error>>;
 }
 /**
  * No-op delivery queue for when the queue feature is disabled.

package/node_modules/@comis/core/dist/ports/delivery-queue.js

@@ -22,6 +22,7 @@ import { ok } from "@comis/shared";
 export function createNoOpDeliveryQueue() {
     return Object.freeze({
         enqueue: () => Promise.resolve(ok(randomUUID())),
+        enqueueInFlight: () => Promise.resolve(ok(randomUUID())),
         ack: () => Promise.resolve(ok(undefined)),
         nack: () => Promise.resolve(ok(undefined)),
         fail: () => Promise.resolve(ok(undefined)),
@@ -29,5 +30,6 @@ export function createNoOpDeliveryQueue() {
         pruneExpired: () => Promise.resolve(ok(0)),
         depth: () => Promise.resolve(ok(0)),
         statusCounts: () => Promise.resolve(ok({ pending: 0, inFlight: 0, failed: 0, delivered: 0, expired: 0 })),
+        recoverInFlight: () => Promise.resolve(ok(0)),
     });
 }

package/node_modules/@comis/core/dist/ports/index.d.ts

@@ -16,6 +16,8 @@ export type { DeviceIdentity, DeviceIdentityPort, PairingRequest, PairedDevice,
 export type { OutputGuardPort, OutputGuardFinding, OutputGuardResult, } from "./output-guard.js";
 export type { SecretStorePort, SecretMetadata, } from "./secret-store.js";
 export type { CredentialMappingPort } from "./credential-mapping.js";
+export type { OAuthCredentialStorePort, OAuthProfile } from "./oauth-credential-store.js";
+export { validateProfileId, PROFILE_ID_RE } from "./oauth-credential-store.js";
 export type { Provider, ImageGenInput, ImageGenOutput, ImageGenerationPort } from "./provider.js";
 export type { DeliveryQueuePort, DeliveryQueueEntry, DeliveryQueueEnqueueInput, DeliveryQueueStatusCounts, } from "./delivery-queue.js";
 export { createNoOpDeliveryQueue } from "./delivery-queue.js";

package/node_modules/@comis/core/dist/ports/index.js

@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 // Port interfaces - Hexagonal architecture boundaries
 export { ChannelCapabilitySchema } from "./channel-plugin.js";
+export { validateProfileId, PROFILE_ID_RE } from "./oauth-credential-store.js";
 export { createNoOpDeliveryQueue } from "./delivery-queue.js";
 export { createNoOpDeliveryMirror } from "./delivery-mirror.js";

package/node_modules/@comis/core/dist/ports/oauth-credential-store.d.ts

@@ -0,0 +1,64 @@
+import type { Result } from "@comis/shared";
+/**
+ * Persisted OAuth profile shape.
+ *
+ * Maps to pi-ai's OAuthCredentials plus comis-managed metadata
+ * (provider, profileId, identity claims). The expires field is
+ * milliseconds since epoch (matches pi-ai — the JWT exp claim is
+ * seconds, but pi-ai stores ms).
+ */
+export interface OAuthProfile {
+    /** OAuth provider id (e.g. "openai-codex", "anthropic"). */
+    provider: string;
+    /** Canonical profile identifier in the form "<provider>:<identity>". */
+    profileId: string;
+    /** OAuth access token (JWT for OpenAI Codex). NEVER log this value. */
+    access: string;
+    /** OAuth refresh token. NEVER log this value. */
+    refresh: string;
+    /** Access-token expiry in ms since epoch. */
+    expires: number;
+    /** Provider-specific account identifier (e.g. Codex chatgpt_account_id). */
+    accountId?: string;
+    /** Identity email (when JWT decode produced one). */
+    email?: string;
+    /** Human-friendly display name (when available). */
+    displayName?: string;
+    /** Schema version. Currently always 1. Hard-fail on mismatch. */
+    version: 1;
+}
+/**
+ * OAuthCredentialStorePort: Hexagonal architecture boundary for mutable
+ * OAuth credential persistence.
+ *
+ * Distinct from SecretStorePort (which is read-only). Every storage
+ * backend (file-based, encrypted SQLite) implements this interface.
+ *
+ * All operations are asynchronous and return Result<T, Error> for
+ * explicit error handling — never throw at the public boundary.
+ */
+export interface OAuthCredentialStorePort {
+    get(profileId: string): Promise<Result<OAuthProfile | undefined, Error>>;
+    set(profileId: string, profile: OAuthProfile): Promise<Result<void, Error>>;
+    delete(profileId: string): Promise<Result<boolean, Error>>;
+    list(filter?: {
+        provider?: string;
+    }): Promise<Result<OAuthProfile[], Error>>;
+    has(profileId: string): Promise<Result<boolean, Error>>;
+}
+/**
+ * Profile-ID format regex: <provider>:<identity>.
+ * Provider must start with letter; alphanumeric + hyphen only.
+ * Identity is non-empty and may contain @, ., etc.
+ */
+export declare const PROFILE_ID_RE: RegExp;
+/**
+ * Validate a profile-ID string against the <provider>:<identity> shape.
+ * Returns parsed parts on success; an Error describing the violation otherwise.
+ * Defense-in-depth: also rejects identities containing path-traversal or
+ * control characters (newline, null, slash, backslash, ..).
+ */
+export declare function validateProfileId(id: string): Result<{
+    provider: string;
+    identity: string;
+}, Error>;

package/node_modules/@comis/core/dist/ports/oauth-credential-store.js

@@ -0,0 +1,37 @@
+import { ok, err } from "@comis/shared";
+/**
+ * Profile-ID format regex: <provider>:<identity>.
+ * Provider must start with letter; alphanumeric + hyphen only.
+ * Identity is non-empty and may contain @, ., etc.
+ */
+export const PROFILE_ID_RE = /^[a-z][a-z0-9-]*:.+$/i;
+/**
+ * Validate a profile-ID string against the <provider>:<identity> shape.
+ * Returns parsed parts on success; an Error describing the violation otherwise.
+ * Defense-in-depth: also rejects identities containing path-traversal or
+ * control characters (newline, null, slash, backslash, ..).
+ */
+export function validateProfileId(id) {
+    if (typeof id !== "string" || id.length === 0) {
+        return err(new Error("Invalid profile ID: empty or non-string"));
+    }
+    if (!PROFILE_ID_RE.test(id)) {
+        return err(new Error('Invalid profile ID "' + id + '": expected "<provider>:<identity>"'));
+    }
+    const colonIdx = id.indexOf(":");
+    const provider = id.slice(0, colonIdx);
+    const identity = id.slice(colonIdx + 1);
+    if (!provider)
+        return err(new Error('Invalid profile ID "' + id + '": empty provider'));
+    if (!identity)
+        return err(new Error('Invalid profile ID "' + id + '": empty identity'));
+    if (identity.includes("\0") ||
+        identity.includes("\n") ||
+        identity.includes("\r") ||
+        identity.includes("..") ||
+        identity.includes("/") ||
+        identity.includes("\\")) {
+        return err(new Error('Invalid profile ID "' + id + '": identity contains forbidden characters'));
+    }
+    return ok({ provider, identity });
+}

package/node_modules/@comis/core/dist/tool-metadata.d.ts

@@ -22,6 +22,26 @@ export interface ComisToolMetadata {
     outputSchema?: Record<string, unknown>;
     /** Tool names that should be co-discovered whenever this tool is discovered (bidirectional). */
     coDiscoverWith?: string[];
+    /** Valid `action` enum values for action-discriminated tools. Used by the
+     *  generic schema-validator in @comis/skills/bridge to gate unknown actions
+     *  before the per-tool validateInput runs. Field shape mirrors
+     *  `ManagedSectionRedirect.schemaFragment.actions` in
+     *  @comis/core/src/config/managed-sections.ts so cross-consistency tests
+     *  can compare them. */
+    validActions?: readonly string[];
+    /** Full set of accepted top-level parameter keys. Unknown keys trigger a
+     *  Levenshtein "did you mean" hint via the schema-validator. Action-
+     *  discriminated tools list the union across all actions; non-discriminated
+     *  tools list every accepted key. Omit when the tool's params are open-
+     *  ended (e.g. exec). */
+    validKeys?: readonly string[];
+    /** Required keys per action value (action-discriminated tools only). Maps
+     *  each `action` literal to the list of params that MUST be present beyond
+     *  `action` itself. Field name + shape mirror
+     *  `ManagedSectionRedirect.schemaFragment.requiredByAction` in
+     *  @comis/core/src/config/managed-sections.ts. Omit actions with no
+     *  required fields beyond `action`. */
+    requiredByAction?: Readonly<Record<string, readonly string[]>>;
     /** Pre-flight input validator. Returns error string on failure, undefined on success. */
     validateInput?: (params: Record<string, unknown>) => string | undefined | Promise<string | undefined>;
 }

package/node_modules/@comis/core/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/core",
   "private": true,
-  "version": "1.0.33",
+  "version": "1.0.36",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Core domain types, ports, event bus, security, and config for Comis",

package/node_modules/@comis/daemon/dist/daemon-types.d.ts

@@ -5,11 +5,11 @@
  * @module
  */
 import type { DeviceIdentity } from "@comis/core";
-import type { AppContainer, ChannelPort } from "@comis/core";
+import type { AppContainer, ChannelPort, DeliveryQueuePort } from "@comis/core";
 import type { ApprovalGate } from "@comis/core";
-import type { ChannelHealthMonitor } from "@comis/channels";
+import type { ChannelHealthMonitor, DeliveryAdapter } from "@comis/channels";
 import type { ComisLogger } from "@comis/infra";
-import type { SessionResetScheduler } from "@comis/agent";
+import type { SessionResetScheduler, BackgroundTaskManager } from "@comis/agent";
 import type { GatewayServerHandle } from "@comis/gateway";
 import type { HeartbeatRunner, CronScheduler } from "@comis/scheduler";
 import type { BrowserService, RpcCall } from "@comis/skills";
@@ -52,6 +52,26 @@ export interface DaemonInstance {
     readonly heartbeatRunner?: HeartbeatRunner;
     readonly gatewayHandle?: GatewayServerHandle;
     readonly adapterRegistry: Map<string, ChannelPort>;
+    /**
+     * Delivery-queue-side adapter map. Adapters registered here are
+     * used by the recurring delivery-queue drainer for crash-safe outbound
+     * delivery. Distinct from `adapterRegistry` (which serves direct dispatch
+     * via the RPC message.* path) -- daemon.ts populates this map AFTER
+     * setupChannels returns. Tests that exercise the recurring drainer must
+     * register adapters in this map so the drainer can find them.
+     */
+    readonly deliveryAdapters: Map<string, DeliveryAdapter>;
+    /**
+     * Crash-safe delivery queue port. Exposed for tests that need
+     * to assert on queue depth (depth returns to 0 after drain).
+     */
+    readonly deliveryQueue: DeliveryQueuePort;
+    /**
+     * Background task manager. Exposed for integration tests that
+     * need to promote synthetic tasks and call complete()/fail() to drive the
+     * completion runner pipeline without a live LLM.
+     */
+    readonly backgroundTaskManager: BackgroundTaskManager;
     readonly rpcCall: RpcCall;
     readonly deviceIdentity?: DeviceIdentity;
     readonly diagnosticCollector: DiagnosticCollector;

package/node_modules/@comis/daemon/dist/daemon.js

@@ -3,11 +3,11 @@
  * Daemon Entry Point: thin orchestrator calling setupXxx() factories in sequence.
  * @module
  */
-import { bootstrap, loadEnvFile, createApprovalGate, parseFormattedSessionKey, createConfigGitManager, envSubset, generateStrongToken, createAuditAggregator, createInjectionRateLimiter, validateMemoryWrite, checkApprovalsConfig, safePath, resolveConfigSecretRefs, formatSessionKey } from "@comis/core";
+import { bootstrap, loadEnvFile, createApprovalGate, parseFormattedSessionKey, createConfigGitManager, envSubset, generateStrongToken, createAuditAggregator, createInjectionRateLimiter, validateMemoryWrite, checkApprovalsConfig, safePath, resolveConfigSecretRefs, formatSessionKey, BackgroundTasksConfigSchema } from "@comis/core";
 import { setupSecrets as _setupSecretsImpl, createSqliteSecretStore, createNamedGraphStore, createContextStore, createObservabilityStore } from "@comis/memory";
 import { ok, err, suppressError } from "@comis/shared";
 import { createGatewayServer } from "@comis/gateway";
-import { setupLogging, setupObservability, setupHealth, setupMemory, setupAgents, setupSchedulers, setupChannels, setupMedia, setupCrossSession, setupMcp, setupTools, setupMonitoring, setupHeartbeat, setupTaskExtraction, setupShutdown, setupGateway, setupRpcBridge, setupDeliveryQueue, setupDeliveryMirror, setupNotifications, setupBackgroundTasks, } from "./wiring/index.js";
+import { setupLogging, setupObservability, setupHealth, setupMemory, setupAgents, setupSchedulers, setupChannels, setupMedia, setupCrossSession, setupMcp, setupTools, setupMonitoring, setupHeartbeat, setupTaskExtraction, setupShutdown, setupGateway, setupRpcBridge, setupDeliveryQueue, setupDeliveryMirror, setupNotifications, setupBackgroundTasks, setupBackgroundCompletionRunner, } from "./wiring/index.js";
 import { setupSingleAgent } from "./wiring/setup-agents.js";
 import { createActiveRunRegistry, createModelCatalog, wireSessionStateCleanup, wireMcpDisconnectCleanup, createGeminiCacheManager, wireGeminiCacheCleanup, createSessionTrackerRegistry, validateProviderOverrides } from "@comis/agent";
 import { detectSandboxProvider, createImageGenProvider, createImageGenRateLimiter, createFileStateTracker } from "@comis/skills";
@@ -27,6 +27,7 @@ import { registerGracefulShutdown } from "./process/graceful-shutdown.js";
 import { createProcessMonitor } from "./process/process-monitor.js";
 import { startWatchdog } from "./health/watchdog.js";
 import { emitDockerRestartPolicyWarn } from "./setup-docker-restart-warn.js";
+import { hasAnyOAuthAgent, emitOAuthTlsPreflightWarn } from "./wiring/oauth-preflight.js";
 import { randomUUID, createHmac } from "node:crypto";
 import { existsSync, chmodSync, statSync, mkdirSync, readFileSync, unlinkSync, cpSync } from "node:fs";
 import { writeFile as fsWriteFile, rm } from "node:fs/promises";
@@ -184,7 +185,7 @@ export async function runPreflightDoctor(exitFn, opts = {}) {
             level: 60,
             time: new Date().toISOString(),
             name: "comis-daemon",
-            module: "preflight",
+            submodule: "preflight",
             errorKind: "dependency",
             err: message,
             hint: "Native module 'better-sqlite3' failed to load. Try: npm rebuild better-sqlite3 (or re-run install.sh). If this persists, reinstall comisai from a fresh tarball.",
@@ -243,6 +244,11 @@ export async function main(overrides = {}) {
     });
     let mergedEnv = process.env;
     let secretStore;
+    // Captured here so setupAgents can wire the encrypted-mode OAuth profile
+    // adapter against the SAME db handle (no dual-handle to the same secrets.db
+    // file).
+    let secretsCrypto;
+    let secretsDb;
     if (!secretsBootResult.ok) {
         // Invalid master key -- fatal error
         throw new Error(`Secrets bootstrap failed: ${secretsBootResult.error.message}`);
@@ -252,6 +258,9 @@ export async function main(overrides = {}) {
         const { crypto, dbPath } = secretsBootResult.value;
         const store = createSqliteSecretStore(dbPath, crypto);
         secretStore = store;
+        // Capture for downstream OAuth wiring in setupAgents.
+        secretsCrypto = crypto;
+        secretsDb = store.db;
         const decryptResult = store.decryptAll();
         if (!decryptResult.ok) {
             throw new Error(`Secret decryption failed: ${decryptResult.error.message}`);
@@ -328,7 +337,7 @@ export async function main(overrides = {}) {
     if (approvalsWarning) {
         daemonLogger.warn({ hint: "Set approvals.enabled: true or remove unused rules", errorKind: "config" }, approvalsWarning);
     }
-    // 3.6. Validate PROVIDER_OVERRIDES vs live pi-ai catalog (Layer 3C -- 260501-07g).
+    // 3.6. Validate PROVIDER_OVERRIDES vs live pi-ai catalog.
     // Emits one structured WARN per orphaned override key (provider listed in
     // PROVIDER_OVERRIDES that pi-ai no longer ships). Fire-and-forget: never
     // throws, daemon continues to boot with dead override entries.
@@ -405,7 +414,7 @@ export async function main(overrides = {}) {
     // Deferred channel plugins ref for resolving platform character limits.
     // Populated after setupChannels; the callback is invoked at message time (always set by then).
     const channelPluginsRef = {};
-    // 6.5.1. Background task system (Proactive v1 -- BGND)
+    // 6.5.1. Background task system
     // Created before setupAgents so BackgroundTaskManager is available for executor deps.
     const { backgroundTaskManager } = setupBackgroundTasks({
         dataDir,
@@ -462,7 +471,10 @@ export async function main(overrides = {}) {
     }
     // 6.6. Agents
     const agents = container.config.agents;
-    const { sessionManager, executors, workspaceDirs, costTrackers, budgetGuards, stepCounters, defaultAgentId, defaultWorkspaceDir, getExecutor, piSessionAdapters, skillWatcherHandles, skillRegistries, lockCleanupTimer, singleAgentDeps, providerHealth, } = await setupAgents({
+    const { sessionManager, executors, workspaceDirs, costTrackers, budgetGuards, stepCounters, defaultAgentId, defaultWorkspaceDir, getExecutor, piSessionAdapters, skillWatcherHandles, skillRegistries, lockCleanupTimer, singleAgentDeps, providerHealth, 
+    // Daemon-level OAuth credential store, threaded into RpcDispatchDeps
+    // below so agents.update can validate oauthProfiles patches via has().
+    oauthCredentialStore, } = await setupAgents({
         container, memoryAdapter, sessionStore, agentLogger, outboundMediaEnabled: true,
         autonomousMediaEnabled: !container.config.integrations.media.transcription.autoTranscribe
             || !container.config.integrations.media.vision.enabled
@@ -488,6 +500,11 @@ export async function main(overrides = {}) {
         },
         backgroundTaskManager, // Auto-background middleware in executor pipeline
         backgroundNotifyFn: bgNotifyFn, // Completion notification via deferred notificationService ref
+        // Plumb the secrets bootstrap result through so setup-agents can wire the
+        // OAuth credential store. encrypted-mode shares the existing
+        // better-sqlite3 connection (no dual-handle).
+        secretsCrypto,
+        secretsDb,
     });
     // Log operation model resolutions at startup (dry-run validation)
     logOperationModelDryRun({
@@ -565,7 +582,7 @@ export async function main(overrides = {}) {
     // can be threaded into channel config command handling. The deferred dispatch pattern
     // ensures rpcCall is safe to pass now; actual dispatch wires later via wireDispatch().
     const { rpcCall, wireDispatch } = setupRpcBridge({ gatewayLogger });
-    // 6.6.8.6. Approval gate (moved before channels for APPR-CHAT command interception)
+    // 6.6.8.6. Approval gate (moved before channels for chat command interception)
     const approvalGate = createApprovalGate({
         eventBus: container.eventBus,
         getTimeoutMs: () => container.config.approvals?.defaultTimeoutMs ?? 30_000,
@@ -573,7 +590,7 @@ export async function main(overrides = {}) {
         getBatchApprovalTtlMs: () => container.config.approvals?.batchApprovalTtlMs ?? 30_000,
         logger: daemonLogger, // Approval cache hit/miss debug logging
     });
-    // 6.6.8.6.1. Restore pending approvals from previous restart (quick-174)
+    // 6.6.8.6.1. Restore pending approvals from previous restart
     const approvalRestorePath = pathJoin(container.config.dataDir || dataDir, "restart-approvals.json");
     if (existsSync(approvalRestorePath)) {
         try {
@@ -615,9 +632,9 @@ export async function main(overrides = {}) {
     }
     // 6.6.7.8. Delivery queue: create adapter BEFORE setupChannels.
     // channelAdapters map is passed by reference -- populated after setupChannels.
-    // drainAndStartPrune() is called AFTER setupChannels (two-phase lifecycle).
+    // drainAndStart() is called AFTER setupChannels (two-phase lifecycle).
     const channelAdaptersRef = new Map();
-    const { deliveryQueue, drainAndStartPrune: drainAndStartDeliveryPrune, shutdown: shutdownDeliveryQueue } = await setupDeliveryQueue({
+    const { deliveryQueue, drainAndStart: drainAndStartDeliveryPrune, shutdown: shutdownDeliveryQueue } = await setupDeliveryQueue({
         db, config: container.config, eventBus: container.eventBus, logger: daemonLogger, channelAdapters: channelAdaptersRef,
     });
     // 6.6.8. Channels (moved down from 6.6.6 -- needs ssrfFetcher and transcriber from setupMedia)
@@ -670,7 +687,7 @@ export async function main(overrides = {}) {
         // Task extraction callback (gated by config.scheduler.tasks.enabled)
         onTaskExtraction: extractFromConversation,
         // Restart continuation: track recently-active sessions for SIGUSR2 replay.
-        // Two-callback timing split (260430-s4m corrects the r4i-A flaw):
+        // Two-callback timing split:
         //   onMessageReceived fires BEFORE processInboundMessage so the tracker
         //     Map is populated before any tool call could trigger SIGUSR2 mid-
         //     execution. Without this, multi-restart chains saw 0 captured records
@@ -708,7 +725,7 @@ export async function main(overrides = {}) {
         },
         // /approve and /deny chat command interception
         approvalGate: container.config.approvals?.enabled ? approvalGate : undefined,
-        // CMD-WIRE: Per-agent session adapters and cost trackers for slash commands
+        // Per-agent session adapters and cost trackers for slash commands
         piSessionAdapters,
         costTrackers,
         // Delivery queue for crash-safe persistence
@@ -744,7 +761,7 @@ export async function main(overrides = {}) {
     container.eventBus.on("system:shutdown", () => { shutdownMirror(); });
     // Structured logging for delivery queue lifecycle events
     setupDeliveryQueueLogging({ eventBus: container.eventBus, logger: daemonLogger });
-    // 6.6.8.0.1. Notification system (Proactive v1)
+    // 6.6.8.0.1. Notification system
     // setupNotifications creates the NotificationService and SessionTracker.
     // The factory is already complete -- this call wires it into the daemon.
     const notificationContext = setupNotifications({
@@ -761,6 +778,34 @@ export async function main(overrides = {}) {
     sessionTrackerRef.ref = notificationContext.sessionTracker;
     // Wire deferred notification ref for background task completion callbacks
     bgNotifyRef.ref = notificationContext.notificationService;
+    // 6.6.8.0.2. Background-task completion runner -- re-enters the originating
+    // agent session when a backgrounded tool finishes.
+    // Runs AFTER setupNotifications so bgNotifyFn is live as fallbackNotifyFn.
+    //
+    // maxBackgroundHops is read from config.backgroundTasks.maxBackgroundHops
+    // (NOT config.workflow.*).
+    // backgroundTasks is a per-agent field; parse via BackgroundTasksConfigSchema to
+    // get the correct default (3) when not explicitly configured.
+    const bgConfigForRunner = BackgroundTasksConfigSchema.parse(agents[defaultAgentId]?.backgroundTasks ?? {});
+    const bgCompletionRunnerContext = setupBackgroundCompletionRunner({
+        eventBus: container.eventBus,
+        // setup-agents.ts:178 declares getExecutor as synchronous
+        // ((agentId: string) => AgentExecutor) -- resolved lazily per event.
+        getExecutor,
+        sessionStore,
+        taskManager: backgroundTaskManager,
+        fallbackNotifyFn: bgNotifyFn,
+        maxBackgroundHops: bgConfigForRunner.maxBackgroundHops,
+        logger: daemonLogger,
+    });
+    container.eventBus.on("system:shutdown", () => {
+        void bgCompletionRunnerContext.runner.shutdown();
+    });
+    // 6.6.8.0.3. Recover background tasks NOW (after the runner is subscribed).
+    // setup-background-tasks.ts INTENTIONALLY does not call this -- if it did,
+    // recovered failed events would fire before the runner subscribes and the
+    // user would never see the recovery announcement.
+    backgroundTaskManager.recoverOnStartup();
     // Channel health monitor -- polls adapter getStatus() at configurable interval.
     // Created after adapters are initialized, started immediately with the adapter map.
     let channelHealthMonitor;
@@ -808,7 +853,7 @@ export async function main(overrides = {}) {
     if (sandboxProvider) {
         skillsLogger.info({ provider: sandboxProvider.name }, "Exec sandbox provider detected");
     }
-    // 6.6.8.4.1. Image generation provider (Proactive v1 -- IMGN)
+    // 6.6.8.4.1. Image generation provider
     const imageGenConfig = container.config.integrations.media.imageGeneration;
     const imageGenResult = createImageGenProvider(imageGenConfig, container.secretManager);
     const imageGenProvider = imageGenResult.ok ? imageGenResult.value : undefined;
@@ -1063,7 +1108,7 @@ export async function main(overrides = {}) {
         daemonLogger.info({ agentId, durationMs: Date.now() - startMs }, "Agent hot-removed from running daemon");
     };
     // 6.7.1. Wire RPC dispatch now that heartbeatRunner is available
-    // Keep a reference so we can add wsConnections/mediaDir after gateway setup (quick-91).
+    // Keep a reference so we can add wsConnections/mediaDir after gateway setup.
     const rpcDispatchDeps = {
         defaultAgentId, getAgentCronScheduler, cronSchedulers, executionTrackers,
         wakeCoalescer, defaultWorkspaceDir, workspaceDirs, memoryApi, memoryAdapter,
@@ -1102,7 +1147,7 @@ export async function main(overrides = {}) {
         },
         memoryWriteValidator: validateMemoryWrite, // memory content validation
         eventBus: container.eventBus, // security event emission for memory writes
-        mcpClientManager, // Phase quick-81: MCP server management
+        mcpClientManager, // MCP server management
         contextStore, // DAG recall RPC handlers
         contextEngineConfig: {
             maxRecallsPerDay: agents[defaultAgentId]?.contextEngine?.maxRecallsPerDay ?? 10,
@@ -1120,7 +1165,7 @@ export async function main(overrides = {}) {
         embeddingCacheStats, // embedding cache stats for memory.embeddingCache RPC
         embeddingCircuitBreakerState, // Embedding circuit breaker state for memory operations
         skillRegistries, // skill management handlers in rpc-dispatch
-        notificationService: notificationContext.notificationService, // Proactive v1: notification.send RPC handler
+        notificationService: notificationContext.notificationService, // notification.send RPC handler
         // Image generation RPC handler deps
         imageHandlerDeps: imageGenProvider && imageGenRateLimiter ? {
             provider: imageGenProvider,
@@ -1129,6 +1174,9 @@ export async function main(overrides = {}) {
             logger: skillsLogger,
             getChannelAdapter: (channelType) => adaptersByType.get(channelType),
         } : undefined,
+        // Daemon-level OAuth credential store handle for the agents.update
+        // oauthProfiles existence check.
+        oauthCredentialStore,
     };
     wireDispatch(rpcDispatchDeps);
     // 7. Gateway
@@ -1147,7 +1195,7 @@ export async function main(overrides = {}) {
         suspendedAgents,
         instanceId, startupStartMs,
     });
-    // 7.0.1. Wire deferred gateway attachment deps (quick-91)
+    // 7.0.1. Wire deferred gateway attachment deps
     // wsConnections and mediaDir are now available after gateway setup; message.attach
     // handler closures read from the mutable rpcDispatchDeps reference at call time.
     rpcDispatchDeps.wsConnections = wsConnections;
@@ -1262,7 +1310,7 @@ export async function main(overrides = {}) {
         secretStore, // close secrets.db on shutdown
         auditAggregator, // clear pending dedup timers
         injectionRateLimiter, // clear rate limiter timers on shutdown
-        lockCleanupTimer, // quick-112: clear periodic lock cleanup timer
+        lockCleanupTimer, // clear periodic lock cleanup timer
         dataDir: container.config.dataDir || dataDir,
         continuationTracker,
         lifecycleReactors, // destroy lifecycle reactors on shutdown
@@ -1388,6 +1436,12 @@ export async function main(overrides = {}) {
     // startup banner. No-op outside containers. Wired here so the WARN lands
     // in `docker logs` next to the banner, where operators look first.
     emitDockerRestartPolicyWarn(daemonLogger);
+    // Boot-time TLS preflight against auth.openai.com.
+    // Fire-and-forget — daemon is already serving by this point; the WARN
+    // is purely advisory. Skipped when no OAuth-using agent is configured.
+    if (hasAnyOAuthAgent(container.config.agents)) {
+        void emitOAuthTlsPreflightWarn(daemonLogger);
+    }
     // Snapshot current config as last-known-good after successful startup
     if (configPaths.length > 0) {
         const activeConfigPath = configPaths[configPaths.length - 1];
@@ -1400,6 +1454,15 @@ export async function main(overrides = {}) {
         container, logger, logLevelManager, tokenTracker, latencyRecorder,
         processMonitor, shutdownHandle, watchdogHandle, cronSchedulers, resetSchedulers,
         browserServices, heartbeatRunner, gatewayHandle, adapterRegistry: adaptersByType,
+        // Expose the delivery-queue-side adapter map and the queue port
+        // itself so integration tests can register adapters that the recurring
+        // drainer sees and assert on queue depth.
+        deliveryAdapters: channelAdaptersRef,
+        deliveryQueue,
+        // Expose the background task manager so integration tests can
+        // promote synthetic tasks and call complete()/fail() to drive the
+        // completion runner pipeline without requiring a live LLM call.
+        backgroundTaskManager,
         rpcCall, deviceIdentity, diagnosticCollector, billingEstimator,
         channelActivityTracker, deliveryTracer, approvalGate, channelHealthMonitor, sessionStoreBridge,
     };