comisai 1.0.33 → 1.0.36

package/node_modules/@comis/daemon/dist/health/watchdog.js

@@ -11,15 +11,20 @@
  * @module
  */
 let sdNotify = null;
+let sdNotifyLoadError = null;
 try {
     // Dynamic import of sd-notify. This will fail on macOS since it's a
     // Linux-native C addon. When unavailable, all operations become no-ops.
     const mod = await import("sd-notify");
     sdNotify = (mod.default ?? mod);
 }
-catch {
+catch (err) {
     // sd-notify not available (macOS, missing native build, etc.)
-    // All watchdog operations will be no-ops.
+    // All watchdog operations will be no-ops. Capture the failure reason so
+    // startWatchdog() can surface it loudly when running under systemd
+    // (NOTIFY_SOCKET set) — silent fallback there leaves Type=notify units
+    // hung in 'activating (start)' until TimeoutStartSec fires.
+    sdNotifyLoadError = err instanceof Error ? err.message : String(err);
 }
 // ---------------------------------------------------------------------------
 // Factory
@@ -37,7 +42,17 @@ export function startWatchdog(deps) {
     const threshold = deps.eventLoopDelayThresholdMs ?? 500;
     let timer;
     if (!notify) {
-        deps.logger.debug("sd-notify not available, watchdog disabled (expected on macOS)");
+        // eslint-disable-next-line no-restricted-syntax -- process.env access needed for systemd detection; NOTIFY_SOCKET is set by systemd, not a secret
+        if (process.env["NOTIFY_SOCKET"]) {
+            deps.logger.warn({
+                errorKind: "config",
+                hint: "Reinstall comisai with libsystemd-dev + pkg-config available so the sd-notify native addon builds. Without it, systemd receives no READY/WATCHDOG signals and the unit will hang in 'activating' until TimeoutStartSec, then enter a respawn loop.",
+                loadError: sdNotifyLoadError ?? "unknown",
+            }, "sd-notify not loaded but NOTIFY_SOCKET is set; systemd integration disabled");
+        }
+        else {
+            deps.logger.debug("sd-notify not available, watchdog disabled (expected on macOS)");
+        }
         return { stop: () => { } };
     }
     // Signal ready to systemd

package/node_modules/@comis/daemon/dist/index.d.ts

@@ -7,3 +7,5 @@ export { createAnnouncementDeadLetterQueue } from "./announcement-dead-letter.js
 export type { AnnouncementDeadLetterQueue, DeadLetterEntry } from "./announcement-dead-letter.js";
 export { createContextHandlers } from "./rpc/context-handlers.js";
 export type { ContextHandlerDeps } from "./rpc/context-handlers.js";
+export { createAgentHandlers } from "./rpc/agent-handlers.js";
+export type { AgentHandlerDeps } from "./rpc/agent-handlers.js";

package/node_modules/@comis/daemon/dist/index.js

@@ -10,3 +10,8 @@ export { sweepResultFiles, buildAnnouncementMessage, deliverFailureNotification
 export { createAnnouncementDeadLetterQueue } from "./announcement-dead-letter.js";
 // Context handlers: DAG context engine RPC handlers
 export { createContextHandlers } from "./rpc/context-handlers.js";
+// Agent management RPC handlers — re-exported so the multi-account
+// integration test can drive the actual `agents.update` RPC handler against a
+// shared `agents` map, mirroring the daemon-runtime container.config.agents
+// pattern at daemon.ts:594/634.
+export { createAgentHandlers } from "./rpc/agent-handlers.js";

package/node_modules/@comis/daemon/dist/observability/channel-health-logger.js

@@ -56,7 +56,7 @@ export function setupChannelHealthLogging(deps) {
                 lastMessageAt,
                 hint,
                 errorKind: ERROR_KIND_MAP[currentState] ?? "internal",
-                module: MODULE,
+                submodule: MODULE,
             }, "Channel health degraded: %s -> %s", previousState, currentState);
         }
         else {
@@ -66,7 +66,7 @@ export function setupChannelHealthLogging(deps) {
                 previousState,
                 currentState,
                 connectionMode,
-                module: MODULE,
+                submodule: MODULE,
             }, "Channel health changed: %s -> %s", previousState, currentState);
         }
     });
@@ -76,7 +76,7 @@ export function setupChannelHealthLogging(deps) {
             channelType: event.channelType,
             state: event.state,
             responseTimeMs: event.responseTimeMs,
-            module: MODULE,
+            submodule: MODULE,
         }, "Health check: %s = %s", event.channelType, event.state);
     });
 }

package/node_modules/@comis/daemon/dist/observability/delivery-queue-logger.js

@@ -21,7 +21,7 @@
 export function setupDeliveryQueueLogging(deps) {
     const { eventBus, logger } = deps;
     const MODULE = "delivery-queue";
-    const log = logger.child({ module: MODULE });
+    const log = logger.child({ submodule: MODULE });
     // 1. Enqueue: message enters queue (boundary event -> INFO)
     eventBus.on("delivery:enqueued", (data) => {
         log.info({

package/node_modules/@comis/daemon/dist/rpc/agent-handlers.d.ts

@@ -12,7 +12,7 @@
  * the runtime agents map, and returns structured results.
  * @module
  */
-import type { PerAgentConfig, ProviderEntry } from "@comis/core";
+import type { PerAgentConfig, ProviderEntry, OAuthCredentialStorePort } from "@comis/core";
 import { type PersistToConfigDeps } from "./persist-to-config.js";
 import type { RpcHandler } from "./types.js";
 /** Dependencies required by agent management RPC handlers. */
@@ -36,6 +36,27 @@ export interface AgentHandlerDeps {
     };
     /** Provider entries map for probe lookups when agents switch providers. */
     providerEntries?: Record<string, ProviderEntry>;
+    /**
+     * Optional OAuth credential store for validating that `oauthProfiles`
+     * patches reference existing stored profile IDs. The
+     * agents.update handler iterates over each (provider, profileId) entry
+     * in the patched config and calls `has(profileId)`; on miss it throws
+     * with the documented "not found in store" wording BEFORE the
+     * `deps.agents[agentId] = parsedConfig` reference-replacement at the
+     * end of the handler — failure leaves the daemon's in-memory map AND
+     * the YAML both unchanged. When this field is absent (e.g. test
+     * contexts without OAuth wiring) the validation block is a no-op so
+     * existing behavior is preserved.
+     */
+    oauthCredentialStore?: OAuthCredentialStorePort;
+    /**
+     * Models config — passed to the credential resolver so that
+     * `provider: "default"` is resolved to `models.defaultProvider` for the
+     * key check, mirroring runtime resolution in `resolveAgentModel`.
+     */
+    modelsConfig?: {
+        defaultProvider?: string;
+    };
 }
 /**
  * Create a record of agent management RPC handlers bound to the given deps.

package/node_modules/@comis/daemon/dist/rpc/agent-handlers.js

@@ -39,12 +39,12 @@ export function createAgentHandlers(deps) {
             if (deps.agents[agentId] !== undefined) {
                 throw new Error(`Agent already exists: ${agentId}`);
             }
-            // 260428-vyf L2: extract inlineContent BEFORE config processing.
-            // role/identity are write-once side-effects (ROLE.md / IDENTITY.md
-            // file writes), NOT durable state — they NEVER enter the persisted
-            // config patch. The L1 tool boundary is responsible for stripping
-            // them from `config.workspace` before this RPC is called; this
-            // handler only consumes the dedicated top-level `inlineContent`
+            // Extract inlineContent BEFORE config processing. role/identity
+            // are write-once side-effects (ROLE.md / IDENTITY.md file writes),
+            // NOT durable state — they NEVER enter the persisted config patch.
+            // The tool boundary is responsible for stripping them from
+            // `config.workspace` before this RPC is called; this handler only
+            // consumes the dedicated top-level `inlineContent`
             // field. If a (mis)caller leaves them inside config.workspace, the
             // downstream Zod strict-object will reject them — that's an
             // explicit failure mode, not a silent drop.
@@ -69,17 +69,37 @@ export function createAgentHandlers(deps) {
             existingSkills.builtinTools = { ...DEFAULT_BUILTIN_TOOLS, ...existingBt };
             raw.skills = existingSkills;
             const parsedConfig = PerAgentConfigSchema.parse(config);
-            // Credential guard (260501-2pz): fail-loud if the new agent's
-            // provider has no resolvable API key. Mirrors agents.update guard
+            // Credential guard: fail-loud if the new agent's provider has no
+            // resolvable API key. Mirrors agents.update guard
             // ordering — runs BEFORE the in-memory commit so rejection prevents
             // assignment, file persist, and hot-add. Same helper as the patch /
             // update call sites for cross-handler consistency.
-            const credCheck = resolveProviderCredential(parsedConfig.provider, {
-                providerEntries: deps.providerEntries ?? {},
-                secretManager: deps.secretManager,
-            });
-            if (!credCheck.ok) {
-                throw new Error(credCheck.reason);
+            //
+            // Also plumb agents.<id>.oauthProfiles + the daemon-level OAuth
+            // credential store so OAuth-only providers (e.g. openai-codex) can
+            // resolve via Source C. Pre-resolve has() so the resolver itself stays
+            // synchronous (port-side validator does no I/O).
+            {
+                const targetProvider = parsedConfig.provider;
+                // eslint-disable-next-line security/detect-object-injection -- typed Record<string, string> read; targetProvider validated by schema parse
+                const configuredProfileId = parsedConfig.oauthProfiles?.[targetProvider];
+                let loaderHasProfile = false;
+                if (configuredProfileId && deps.oauthCredentialStore) {
+                    const hasResult = await deps.oauthCredentialStore.has(configuredProfileId);
+                    loaderHasProfile = hasResult.ok && hasResult.value === true;
+                }
+                const credCheck = resolveProviderCredential(targetProvider, {
+                    providerEntries: deps.providerEntries ?? {},
+                    secretManager: deps.secretManager,
+                    modelsConfig: deps.modelsConfig,
+                    oauthProfiles: parsedConfig.oauthProfiles,
+                    oauthProfileLoader: configuredProfileId
+                        ? { has: (id) => id === configuredProfileId && loaderHasProfile }
+                        : undefined,
+                });
+                if (!credCheck.ok) {
+                    throw new Error(credCheck.reason);
+                }
             }
             deps.agents[agentId] = parsedConfig;
             // Best-effort persistence to config.yaml
@@ -109,7 +129,7 @@ export function createAgentHandlers(deps) {
                 }
             }
             const workspaceDir = resolveWorkspaceDir(parsedConfig, agentId);
-            // 260428-vyf L2: best-effort inline ROLE.md / IDENTITY.md write.
+            // Best-effort inline ROLE.md / IDENTITY.md write.
             // Only invoke when inlineContent has at least one populated field
             // AND the persistDeps logger is available (the helper requires a
             // structured logger; the in-memory-only test path skips it).
@@ -220,20 +240,63 @@ export function createAgentHandlers(deps) {
             }
             const merged = { ...existing, ...config };
             const parsedConfig = PerAgentConfigSchema.parse(merged);
-            // Credential guard + probe (260501-2pz): when provider OR model
-            // changes, (a) GUARD — fail-loud if the resulting provider's API key
-            // is not resolvable from any source (no silent skip), then (b) PROBE
-            // — preexisting wire validation when an explicit providers.entries
+            // Validate oauthProfiles patch — each profileId must exist in the
+            // OAuth credential store. Skipped when no oauthCredentialStore is
+            // wired (test contexts; non-OAuth-aware setups). Critical: this
+            // throws BEFORE the `deps.agents[agentId] = parsedConfig`
+            // reference-replacement at the end of the handler, so on failure the
+            // daemon's in-memory map AND the YAML are both unchanged. The
+            // Zod-layer format check has already run during
+            // PerAgentConfigSchema.parse(merged) above — this block ONLY checks
+            // existence in the store.
+            if (parsedConfig.oauthProfiles !== undefined && deps.oauthCredentialStore) {
+                for (const [provider, profileId] of Object.entries(parsedConfig.oauthProfiles)) {
+                    const has = await deps.oauthCredentialStore.has(profileId);
+                    if (!has.ok || !has.value) {
+                        throw new Error(`profile ${profileId} not found in store. Run "comis auth list" to see available profiles.`);
+                    }
+                    // The provider variable is iterated for completeness; the
+                    // existence check is keyed on profileId alone (validateProfileId
+                    // — invoked by the Zod refine — already enforced that the
+                    // profile-id's provider portion equals the map key).
+                    void provider;
+                }
+            }
+            // Credential guard + probe: when provider changes,
+            // (a) GUARD — fail-loud if the resulting provider's API key is not
+            // resolvable from any source (no silent skip), then (b) PROBE —
+            // preexisting wire validation when an explicit providers.entries
             // record with apiKeyName exists. Order matters: guard runs first
             // (cheap, all paths), probe runs second (only when applicable).
+            //
+            // Model-only changes with unchanged provider DO NOT fire the guard
+            // or probe — they introduce no new credential surface.
+            // Stale-broken-config detection moves to the next chat turn
+            // (fail-loud at the request boundary), where the message is
+            // correctly shaped for the actual failure mode (not a pre-emptive
+            // API-key prompt that is wrong for OAuth providers like
+            // openai-codex). Also plumbs agents.<id>.oauthProfiles + the
+            // daemon-level OAuth credential store so Source C can fire.
             const providerChanging = config.provider !== undefined && config.provider !== existing.provider;
-            const modelChanging = config.model !== undefined && config.model !== existing.model;
-            if (providerChanging || modelChanging) {
+            if (providerChanging) {
                 const targetProvider = parsedConfig.provider;
+                // Pre-resolve has() at the daemon edge so the resolver stays sync.
+                // eslint-disable-next-line security/detect-object-injection -- typed Record<string, string> read; targetProvider validated by schema parse
+                const configuredProfileId = parsedConfig.oauthProfiles?.[targetProvider];
+                let loaderHasProfile = false;
+                if (configuredProfileId && deps.oauthCredentialStore) {
+                    const hasResult = await deps.oauthCredentialStore.has(configuredProfileId);
+                    loaderHasProfile = hasResult.ok && hasResult.value === true;
+                }
                 // (a) GUARD — fail-loud if no credential source resolves
                 const resolution = resolveProviderCredential(targetProvider, {
                     providerEntries: deps.providerEntries ?? {},
                     secretManager: deps.secretManager,
+                    modelsConfig: deps.modelsConfig,
+                    oauthProfiles: parsedConfig.oauthProfiles,
+                    oauthProfileLoader: configuredProfileId
+                        ? { has: (id) => id === configuredProfileId && loaderHasProfile }
+                        : undefined,
                 });
                 if (!resolution.ok) {
                     throw new Error(resolution.reason);

package/node_modules/@comis/daemon/dist/rpc/agent-inline-workspace.js

@@ -63,7 +63,7 @@ async function attemptWrite(deps, agentId, filename, targetPath, content) {
     catch (e) {
         const message = e instanceof Error ? e.message : String(e);
         deps.logger.warn({
-            module: "daemon.rpc.agent-handlers",
+            submodule: "rpc.agent-handlers",
             agentId,
             file: filename,
             err: e,
@@ -128,7 +128,7 @@ export async function writeInlineWorkspaceFiles(deps, params) {
     // Pure no-op invocations (both fields absent) stay silent.
     if (roleWritten || identityWritten) {
         deps.logger.info({
-            module: "daemon.rpc.agent-handlers",
+            submodule: "rpc.agent-handlers",
             agentId: params.agentId,
             roleBytes: roleWritten ? params.role.length : 0,
             identityBytes: identityWritten ? params.identity.length : 0,

package/node_modules/@comis/daemon/dist/rpc/config-handlers.d.ts

@@ -7,7 +7,7 @@
  * Extracted from daemon.ts rpcCallInner switch block
  * @module
  */
-import { type AppContainer, type ConfigGitManager } from "@comis/core";
+import { type AppContainer, type ConfigGitManager, type OAuthCredentialStorePort } from "@comis/core";
 import type { ComisLogger } from "@comis/infra";
 import { z } from "zod";
 import type { RpcHandler } from "./types.js";
@@ -26,6 +26,14 @@ export interface ConfigHandlerDeps {
         timeoutMs?: number;
         secret?: string;
     };
+    /**
+     * Optional OAuth credential store, used by the credential guard to
+     * confirm that an agent's `oauthProfiles[provider]` entry refers to a
+     * profile that actually exists in ~/.comis/auth-profiles.json (or the
+     * encrypted-SQLite equivalent). When absent, the OAuth branch of the
+     * resolver is a no-op — existing API-key behavior is preserved.
+     */
+    oauthCredentialStore?: OAuthCredentialStorePort;
 }
 /**
  * Unwrap Zod schema wrappers (Optional / Nullable / Default / Pipe) to get

package/node_modules/@comis/daemon/dist/rpc/config-handlers.js

@@ -8,7 +8,7 @@
  * Extracted from daemon.ts rpcCallInner switch block
  * @module
  */
-import { isImmutableConfigPath, getConfigSchema, getConfigSections, deepMerge, AppConfigSchema, redactConfigSecrets, warnSuspiciousEnvValues, getManagedSectionRedirect, formatRedirectHint, } from "@comis/core";
+import { isImmutableConfigPath, getConfigSchema, getConfigSections, deepMerge, AppConfigSchema, redactConfigSecrets, warnSuspiciousEnvValues, findUnresolvedEnvRefs, formatMissingEnvRefError, getManagedSectionRedirect, formatRedirectHint, } from "@comis/core";
 import { suppressError } from "@comis/shared";
 import { stringify as yamlStringify } from "yaml";
 import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync } from "node:fs";
@@ -444,7 +444,7 @@ export function createConfigHandlers(deps) {
                 // pre-flight and bridge metadata validator catch this earlier for
                 // LLM tool calls -- this path is reached when those layers are
                 // bypassed. Emit the same redirect hint so all clients see
-                // identical, model-agnostic recovery instructions (quick-260425-t40).
+                // identical, model-agnostic recovery instructions.
                 if (isImmutableConfigPath(section, key)) {
                     const redirect = getManagedSectionRedirect(section, key);
                     const suffix = redirect
@@ -452,29 +452,74 @@ export function createConfigHandlers(deps) {
                         : " This setting requires manual operator intervention via config files.";
                     throw new Error(`Config path "${key ? `${section}.${key}` : section}" is immutable and cannot be modified at runtime.${suffix}`);
                 }
-                // Credential guard (260501-2pz): when a patch targets an agent's
-                // provider/model field, verify the resulting provider's API key is
-                // resolvable from at least one source pi-coding-agent will consult
-                // at runtime. Fail-loud here rather than letting an unauthorized
-                // provider config persist and explode at the next chat turn.
-                // See `.planning/design/daemon-credential-guard/PLAN.md`.
+                // Credential guard: when a patch targets an agent's provider/model
+                // field, verify the resulting provider's API key is resolvable from
+                // at least one source pi-coding-agent will consult at runtime.
+                // Fail-loud here rather than letting an unauthorized provider
+                // config persist and explode at the next chat turn.
+                //
+                // Model-only patches with unchanged provider introduce no new
+                // credential surface — short-circuit the guard entirely. The
+                // runtime auth chain that just authenticated the LLM call making
+                // this patch will keep working. Stale-broken-config detection
+                // moves back to the next chat turn (fail-loud at the request
+                // boundary), where the message is correctly shaped for the actual
+                // failure mode (not a pre-emptive API-key prompt that is wrong for
+                // OAuth providers like openai-codex).
                 if (section === "agents" && isAgentProviderOrModelKey(key)) {
                     const targetProvider = extractTargetProvider(key, coercedValue, deps.container.config);
                     if (targetProvider !== undefined) {
-                        const resolution = resolveProviderCredential(targetProvider, {
-                            providerEntries: deps.container.config.providers?.entries ?? {},
-                            secretManager: deps.container.secretManager,
-                        });
-                        if (!resolution.ok) {
-                            deps.logger.warn({
-                                method: "config.patch",
-                                section,
-                                key,
-                                targetProvider,
-                                hint: "Provider credential not resolvable",
-                                errorKind: "validation",
-                            }, "Config patch rejected: missing provider credential");
-                            throw new Error(resolution.reason);
+                        // For `.model` keys, extractTargetProvider returns the agent's
+                        // CURRENT provider (config-handlers.ts:65-69) — so the resolved
+                        // targetProvider always equals the current provider. The
+                        // model-only short-circuit therefore always fires for `.model`
+                        // keys; we still compute the equality explicitly so the
+                        // intent is readable and the check survives any future change
+                        // to extractTargetProvider's contract.
+                        const isModelOnlyPatch = key.endsWith(".model");
+                        const agentId = key.split(".")[0];
+                        // eslint-disable-next-line security/detect-object-injection -- agentId from validated key; agents map is typed Record
+                        const currentProvider = agentId
+                            ? deps.container.config.agents?.[agentId]?.provider
+                            : undefined;
+                        const providerUnchanged = currentProvider === targetProvider;
+                        if (!(isModelOnlyPatch && providerUnchanged)) {
+                            // Provider is changing (or this is a `.provider` patch where
+                            // targetProvider is the new value) — run the credential guard.
+                            // eslint-disable-next-line security/detect-object-injection -- agentId from validated key; agents map is typed Record
+                            const agentOauthProfiles = (agentId
+                                ? deps.container.config.agents?.[agentId]?.oauthProfiles
+                                : undefined);
+                            // Pre-resolve the loader has() for the configured profile so the
+                            // resolver can stay synchronous. This keeps Hexagonal port-side
+                            // validators I/O-free.
+                            // eslint-disable-next-line security/detect-object-injection -- typed Record<string, string> read; targetProvider validated above
+                            const configuredProfileId = agentOauthProfiles?.[targetProvider];
+                            let loaderHasProfile = false;
+                            if (configuredProfileId && deps.oauthCredentialStore) {
+                                const hasResult = await deps.oauthCredentialStore.has(configuredProfileId);
+                                loaderHasProfile = hasResult.ok && hasResult.value === true;
+                            }
+                            const resolution = resolveProviderCredential(targetProvider, {
+                                providerEntries: deps.container.config.providers?.entries ?? {},
+                                secretManager: deps.container.secretManager,
+                                modelsConfig: deps.container.config.models,
+                                oauthProfiles: agentOauthProfiles,
+                                oauthProfileLoader: configuredProfileId
+                                    ? { has: (id) => id === configuredProfileId && loaderHasProfile }
+                                    : undefined,
+                            });
+                            if (!resolution.ok) {
+                                deps.logger.warn({
+                                    method: "config.patch",
+                                    section,
+                                    key,
+                                    targetProvider,
+                                    hint: "Provider credential not resolvable",
+                                    errorKind: "validation",
+                                }, "Config patch rejected: missing provider credential");
+                                throw new Error(resolution.reason);
+                            }
                         }
                     }
                 }
@@ -537,6 +582,42 @@ export function createConfigHandlers(deps) {
                     throw new Error(`Suspicious env value(s) in config patch: ${hints}. ` +
                         `Use \${VAR_NAME} syntax to reference secrets stored via env_set.`);
                 }
+                // Reject patches that reference env vars not in the secrets store, on
+                // enabled MCP servers only. The env-substitution skip on disabled
+                // servers makes `enabled:false + ${VAR}` harmless at bootstrap; this
+                // gate forbids the partially-valid `enabled:true + missing ${VAR}`
+                // shape.
+                //
+                // We walk `patch` (not the deep-merged config) because we only
+                // validate what's being WRITTEN this RPC. `restoreMcpServerEnv` above
+                // already restored env from existing YAML for partial-update-without-
+                // env patches, so `patch.integrations.mcp.servers[].env` is the
+                // post-restore truth. Full-config validation would re-flag pre-
+                // existing valid-at-write-time refs whose secrets were later removed
+                // (out of scope, separate problem).
+                const patchInteg = patch.integrations;
+                const patchMcp = patchInteg?.mcp;
+                const patchServers = patchMcp?.servers;
+                if (Array.isArray(patchServers)) {
+                    for (const s of patchServers) {
+                        if (!s || typeof s !== "object")
+                            continue;
+                        const server = s;
+                        // McpServerEntrySchema.enabled defaults to true → absent = enabled.
+                        // Only explicit `enabled: false` skips the check (preserves the
+                        // placeholder-for-later pattern).
+                        if (server.enabled === false)
+                            continue;
+                        if (!server.env)
+                            continue;
+                        const serverName = typeof server.name === "string" ? server.name : "<unnamed>";
+                        const unresolved = findUnresolvedEnvRefs(server.env, (key) => deps.container.secretManager.get(key));
+                        if (unresolved.length > 0) {
+                            const missingNames = unresolved.map((u) => u.varName);
+                            throw new Error(formatMissingEnvRefError(serverName, missingNames));
+                        }
+                    }
+                }
                 const updatedLocal = deepMerge(existingLocal, patch);
                 // ${VAR} env var references in string values are preserved
                 // through YAML round-trip. yamlStringify writes them literally, parseYaml
@@ -651,7 +732,7 @@ export function createConfigHandlers(deps) {
                 }
                 // Check immutable paths -- entire section is being replaced.
                 // Backstop for direct-RPC clients; LLM tool calls hit the same redirect
-                // earlier via gateway-tool / bridge validator (quick-260425-t40).
+                // earlier via gateway-tool / bridge validator.
                 if (isImmutableConfigPath(section)) {
                     const redirect = getManagedSectionRedirect(section);
                     const suffix = redirect

package/node_modules/@comis/daemon/dist/rpc/credential-resolver.d.ts

@@ -6,12 +6,41 @@ export interface CredentialResolverDeps {
     secretManager?: {
         has(key: string): boolean;
     };
+    /**
+     * Models config — used to resolve `provider: "default"` to the operator's
+     * configured `models.defaultProvider`, mirroring runtime resolution in
+     * `resolveAgentModel`. When omitted or `defaultProvider` is empty, a
+     * literal `"default"` input passes through and produces a clear rejection
+     * pointing the operator at `models.defaultProvider`.
+     */
+    modelsConfig?: {
+        defaultProvider?: string;
+    };
+    /**
+     * Per-agent OAuth profile map (Record<provider, profileId>) sourced from
+     * `agents.<id>.oauthProfiles` on the daemon's container.config. When an
+     * entry exists for the resolved provider AND `oauthProfileLoader.has`
+     * returns true, the resolver returns ok with source: "oauth_profile".
+     */
+    oauthProfiles?: Record<string, string>;
+    /**
+     * Synchronous facade over OAuthCredentialStorePort.has. The async port
+     * call MUST be performed at the daemon edge (config-handlers /
+     * agent-handlers) and adapted to this sync shape — the resolver itself
+     * does no I/O (hexagonal: port-side validator). Pass a closure such as
+     * `{ has: () => storeHasResult.ok && storeHasResult.value }`.
+     */
+    oauthProfileLoader?: {
+        has(profileId: string): boolean;
+    };
 }
 export interface CredentialResolution {
     ok: boolean;
     /** When ok=false: actionable error message ready to throw. */
     reason?: string;
     /** When ok=true: which source resolved. Useful for debug logs. */
-    source?: "keyless" | "providers_entry" | "env_canonical";
+    source?: "keyless" | "providers_entry" | "env_canonical" | "oauth_profile";
+    /** When ok=true: the provider name actually checked (after "default" resolution). */
+    resolvedProvider?: string;
 }
 export declare function resolveProviderCredential(targetProvider: string, deps: CredentialResolverDeps): CredentialResolution;