comisai 1.0.33 → 1.0.36

package/node_modules/@comis/daemon/dist/wiring/setup-agents.js

@@ -13,8 +13,15 @@ import { homedir } from "node:os";
 import { existsSync, mkdirSync } from "node:fs";
 import { isAbsolute, resolve } from "node:path";
 import { getModels, getProviders } from "@mariozechner/pi-ai";
-import { createCircuitBreaker, createBudgetGuard, createCostTracker, createStepCounter, createSessionLifecycle, ensureWorkspace, resolveWorkspaceDir, createPiExecutor, createComisSessionManager, cleanupStaleLocks, createAuthStorageAdapter, createModelRegistryAdapter, registerCustomProviders, createProviderHealthMonitor, createLastKnownModelTracker, createAuthProfileManager, createAuthRotationAdapter, setSanitizeLogger, setToolNormalizationLogger, resolveOperationDefaults, resolveCompactionModel, LEAN_TOOL_DESCRIPTIONS, resolveDescription, } from "@comis/agent";
+import { createCircuitBreaker, createBudgetGuard, createCostTracker, createStepCounter, createSessionLifecycle, ensureWorkspace, resolveWorkspaceDir, createPiExecutor, createComisSessionManager, cleanupStaleLocks, createAuthStorageAdapter, createAuthProvider, selectOAuthCredentialStore, createModelRegistryAdapter, registerCustomProviders, createProviderHealthMonitor, createLastKnownModelTracker, createAuthProfileManager, createAuthRotationAdapter, setSanitizeLogger, setToolNormalizationLogger, resolveOperationDefaults, resolveCompactionModel, LEAN_TOOL_DESCRIPTIONS, resolveDescription, } from "@comis/agent";
 import { agentToolsToToolDefinitions, createSkillRegistry, createRuntimeEligibilityContext, TOOL_PROFILES, } from "@comis/skills";
+// Once-per-daemon-process WARN flag for the encrypted-store hot-reload
+// limitation. Lifted to module scope so the flag survives across per-agent
+// setupSingleAgent calls AND any future re-invocations of setupAgents within
+// the same process. Operator-friendly notice — fires exactly once per daemon
+// process so the operator sees it in startup logs without N-times-per-agent
+// noise.
+let encryptedModeWarnFired = false;
 // ---------------------------------------------------------------------------
 // Single-agent setup (extracted for hot-add reuse)
 // ---------------------------------------------------------------------------
@@ -104,6 +111,75 @@ export async function setupSingleAgent(agentId, rawAgentConfig, deps) {
         secretManager: scopedManager,
         customProviderEntries,
     });
+    // -------------------------------------------------------------------------
+    // FIRST daemon-side OAuth wiring.
+    //
+    // Closes the unwired-OAuth gap — the createAuthProvider symbol was exported
+    // by @comis/agent but never called by the daemon, so refreshed OAuth tokens
+    // lived only in the in-memory cache and silently disappeared on restart.
+    // AuthProviderConfig.oauth credentialStore + logger + dataDir are REQUIRED
+    // so this wiring is type-checked at compile time — future regressions
+    // surface as TS errors, not silent runtime failures.
+    //
+    // All path constructions in this block use safePath from @comis/core (NOT
+    // path.join — AGENTS.md §2.2 ESLint security rule).
+    // When storage === "encrypted", the OAuth profile adapter SHARES the
+    // existing secretsDb handle from createSqliteSecretStore (no dual-handle).
+    // -------------------------------------------------------------------------
+    const oauthStorageMode = container.config.oauth.storage;
+    const dataDirAbs = container.config.dataDir && container.config.dataDir.length > 0
+        ? container.config.dataDir
+        : safePath(homedir(), ".comis");
+    // Use the daemon-level OAuthCredentialStore handle that setupAgents()
+    // constructed once and threaded through SingleAgentDeps. Same store
+    // reference is also exposed on AgentsResult so daemon.ts can plumb it into
+    // RpcDispatchDeps for the agents.update oauthProfiles existence check.
+    const oauthCredentialStore = deps.oauthCredentialStore;
+    const authProvider = createAuthProvider({
+        secretManager: scopedManager,
+        additionalProviderKeys: undefined,
+        oauth: {
+            eventBus: container.eventBus,
+            credentialStore: oauthCredentialStore,
+            logger: agentLogger.child({ submodule: "oauth-token-manager" }),
+            dataDir: dataDirAbs,
+            keyPrefix: "OAUTH_",
+            // Pass auth-profiles.json path when file adapter active so
+            // OAuthTokenManager can register the chokidar watcher and pick up
+            // CLI-written profiles within ~250ms without a daemon restart.
+            // Encrypted-mode: undefined -> no watcher; documented limitation.
+            watchPath: oauthStorageMode === "file"
+                ? safePath(dataDirAbs, "auth-profiles.json")
+                : undefined,
+            // Closure-stability: the closure dereferences
+            // container.config.agents[agentId]?.oauthProfiles on every call.
+            // This is the only correct shape because:
+            //   1. Line ~222 above writes effectiveConfig (a NEW object built
+            //      from { ...agentConfig, model, provider }) into
+            //      container.config.agents[agentId]. The local `agentConfig`
+            //      parameter diverges from the daemon's map immediately at
+            //      startup — capturing it would observe the wrong value.
+            //   2. agents.update at agent-handlers.ts:341 executes
+            //      `deps.agents[agentId] = parsedConfig`, REPLACING the
+            //      reference at that key with a new validated object. Capturing
+            //      the local agentConfig parameter would miss this hot-update.
+            //   3. daemon.ts:594, 634 confirm `deps.agents` and
+            //      `container.config.agents` are THE SAME map object — the
+            //      daemon's single per-process Container.config instance.
+            // The map identity is stable; only the value at the agent key
+            // changes. The closure-evaluated dereference observes (1) at
+            // startup AND (2) on every agents.update without an event-bus
+            // invalidation or daemon restart, allowing the agents_manage tool to
+            // update without a daemon restart.
+            getAgentOauthProfiles: () => container.config.agents?.[agentId]?.oauthProfiles,
+        },
+    });
+    agentLogger.debug({
+        agentId,
+        oauthStorage: oauthStorageMode,
+        dataDir: dataDirAbs,
+        submodule: "setup-agents",
+    }, "OAuth credential store + auth provider + per-LLM-call dispatch wired");
     const piModelRegistry = createModelRegistryAdapter(piAuthStorage);
     const { registered: customProviderCount, providerAliases } = registerCustomProviders(piModelRegistry, customProviderEntries, scopedManager, agentLogger);
     if (customProviderCount > 0) {
@@ -235,6 +311,11 @@ export async function setupSingleAgent(agentId, rawAgentConfig, deps) {
         eventBus: container.eventBus,
         logger: perAgentLogger,
         authStorage: piAuthStorage,
+        // Thread OAuthTokenManager into the executor so the per-LLM-call
+        // dispatch hook (PiExecutor.execute pre-hook + the two compaction
+        // getApiKey callbacks in executor-context-engine-setup.ts) can resolve
+        // OAuth tokens via resolveProviderApiKey.
+        oauthManager: authProvider.oauth,
         modelRegistry: piModelRegistry,
         providerAliases,
         fallbackModels: fallbackModelStrings.length > 0 ? fallbackModelStrings : undefined,
@@ -312,9 +393,23 @@ export async function setupSingleAgent(agentId, rawAgentConfig, deps) {
 export async function setupAgents(deps) {
     const { container, memoryAdapter, sessionStore, agentLogger } = deps;
     // Inject module-level logger for response sanitization pipeline
-    setSanitizeLogger(agentLogger.child({ module: "response-sanitize" }));
+    setSanitizeLogger(agentLogger.child({ submodule: "response-sanitize" }));
     // Inject module-level logger for tool schema normalization pipeline
-    setToolNormalizationLogger(agentLogger.child({ module: "tool-normalize" }));
+    setToolNormalizationLogger(agentLogger.child({ submodule: "tool-normalize" }));
+    // Once-per-daemon WARN for the encrypted-store hot-reload limitation.
+    // Placed in setupAgents() body (NOT setupSingleAgent) so the notice fires
+    // exactly once per daemon process — not N times for N agents. Operator
+    // sees this in startup logs without surprise; daemon restart is required
+    // to pick up CLI-written OAuth profiles in encrypted-store mode.
+    const overallStorageMode = container.config.oauth.storage;
+    if (overallStorageMode === "encrypted" && !encryptedModeWarnFired) {
+        encryptedModeWarnFired = true;
+        agentLogger.warn({
+            hint: "CLI auth login changes require daemon restart in encrypted mode (file-watch unsupported on encrypted SQLite WAL)",
+            errorKind: "limitation_known",
+            submodule: "setup-agents",
+        }, "OAuth hot-reload disabled in encrypted-store mode");
+    }
     const agents = container.config.agents; // Always populated after schema transform
     const routingConfig = container.config.routing;
     // Daemon-level tracing defaults
@@ -368,6 +463,19 @@ export async function setupAgents(deps) {
     });
     // Global last-known-working model tracker (shared across all agents)
     const lastKnownModel = createLastKnownModelTracker();
+    // Construct the daemon-level OAuthCredentialStore handle ONCE (instead of
+    // per-agent inside setupSingleAgent). Same handle is reused across every
+    // agent setup AND surfaced on AgentsResult so daemon.ts can plumb it into
+    // RpcDispatchDeps for the agents.update oauthProfiles existence check.
+    const dataDirAbsForOauth = container.config.dataDir && container.config.dataDir.length > 0
+        ? container.config.dataDir
+        : safePath(homedir(), ".comis");
+    const oauthCredentialStore = selectOAuthCredentialStore({
+        storage: container.config.oauth.storage,
+        dataDir: dataDirAbsForOauth,
+        secretsCrypto: deps.secretsCrypto,
+        secretsDb: deps.secretsDb,
+    });
     // Construct shared deps struct once before the loop (for hot-add reuse)
     const singleAgentDeps = {
         container,
@@ -395,6 +503,12 @@ export async function setupAgents(deps) {
         getChannelMaxChars: deps.getChannelMaxChars,
         backgroundTaskManager: deps.backgroundTaskManager,
         backgroundNotifyFn: deps.backgroundNotifyFn,
+        // Secrets bootstrap output for OAuth wiring.
+        secretsCrypto: deps.secretsCrypto,
+        secretsDb: deps.secretsDb,
+        // Daemon-level OAuth credential store handle (constructed once above,
+        // reused per-agent + threaded into RPC deps).
+        oauthCredentialStore,
     };
     for (const [agentId, agentConfig] of Object.entries(agents)) {
         const result = await setupSingleAgent(agentId, agentConfig, singleAgentDeps);
@@ -451,6 +565,10 @@ export async function setupAgents(deps) {
         lockCleanupTimer,
         singleAgentDeps,
         providerHealth,
+        // Daemon-level OAuth credential store, plumbed by daemon.ts into
+        // RpcDispatchDeps.oauthCredentialStore so agents.update can validate
+        // oauthProfiles patches via has().
+        oauthCredentialStore,
     };
 }
 // ---------------------------------------------------------------------------
@@ -543,3 +661,9 @@ function deriveCanaryFallback(baseSecret, agentId) {
         .update(`canary-fallback:${agentId}`)
         .digest("hex");
 }
+// ---------------------------------------------------------------------------
+// OAuth credential store selection lives in @comis/agent (CLI cannot import
+// from @comis/daemon, so the helper must live where both daemon and CLI
+// consume it).
+// See: packages/agent/src/model/oauth-credential-store-selector.ts
+// ---------------------------------------------------------------------------

package/node_modules/@comis/daemon/dist/wiring/setup-background-completion-runner.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Background completion runner wiring for daemon startup.
+ *
+ * Subscribes the runner to background_task:{completed,failed} events after
+ * the notification service has been wired (so fallbackNotifyFn is live),
+ * and returns a shutdown handle for the daemon's system:shutdown sequence
+ * to await before tearing down the executor.
+ *
+ * Per AGENTS §2.4: composition root + factories. This wiring lives in
+ * @comis/daemon (composition root); the actual factory body is in
+ * @comis/agent.
+ *
+ * @module
+ */
+import { type BackgroundCompletionRunner, type BackgroundTaskManager, type NotifyFn } from "@comis/agent";
+import type { TypedEventBus } from "@comis/core";
+import type { ComisLogger } from "@comis/infra";
+import type { AgentExecutor } from "@comis/agent";
+import type { RunnerSessionStore } from "@comis/agent";
+/** Result of setupBackgroundCompletionRunner -- exposed to the daemon for shutdown. */
+export interface BackgroundCompletionRunnerContext {
+    runner: BackgroundCompletionRunner;
+}
+export interface SetupBackgroundCompletionRunnerDeps {
+    eventBus: TypedEventBus;
+    getExecutor: (agentId: string) => AgentExecutor;
+    sessionStore: RunnerSessionStore;
+    taskManager: Pick<BackgroundTaskManager, "getTask">;
+    /** bgNotifyFn closure used when the originating session is gone. */
+    fallbackNotifyFn: NotifyFn;
+    /** From config.backgroundTasks.maxBackgroundHops (default 3). NOT config.workflow.*. */
+    maxBackgroundHops: number;
+    logger: ComisLogger;
+}
+/**
+ * Wire the background completion runner from daemon-level dependencies.
+ * Call this AFTER setupNotifications so fallbackNotifyFn is wired.
+ */
+export declare function setupBackgroundCompletionRunner(deps: SetupBackgroundCompletionRunnerDeps): BackgroundCompletionRunnerContext;

package/node_modules/@comis/daemon/dist/wiring/setup-background-completion-runner.js

@@ -0,0 +1,32 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Background completion runner wiring for daemon startup.
+ *
+ * Subscribes the runner to background_task:{completed,failed} events after
+ * the notification service has been wired (so fallbackNotifyFn is live),
+ * and returns a shutdown handle for the daemon's system:shutdown sequence
+ * to await before tearing down the executor.
+ *
+ * Per AGENTS §2.4: composition root + factories. This wiring lives in
+ * @comis/daemon (composition root); the actual factory body is in
+ * @comis/agent.
+ *
+ * @module
+ */
+import { createBackgroundCompletionRunner, } from "@comis/agent";
+/**
+ * Wire the background completion runner from daemon-level dependencies.
+ * Call this AFTER setupNotifications so fallbackNotifyFn is wired.
+ */
+export function setupBackgroundCompletionRunner(deps) {
+    const runner = createBackgroundCompletionRunner({
+        eventBus: deps.eventBus,
+        getExecutor: deps.getExecutor,
+        sessionStore: deps.sessionStore,
+        taskManager: deps.taskManager,
+        fallbackNotifyFn: deps.fallbackNotifyFn,
+        maxBackgroundHops: deps.maxBackgroundHops,
+        logger: deps.logger,
+    });
+    return { runner };
+}

package/node_modules/@comis/daemon/dist/wiring/setup-background-tasks.d.ts

@@ -19,9 +19,16 @@ export interface SetupBackgroundTasksDeps {
 }
 /**
  * Wire the background task subsystem from daemon-level dependencies.
- * Creates BackgroundTaskManager with file-based persistence, recovers
- * incomplete tasks from the previous daemon run (marking them failed),
- * and starts an hourly cleanup timer for stale completed/failed tasks.
+ * Creates BackgroundTaskManager with file-based persistence and starts
+ * an hourly cleanup timer for stale completed/failed tasks.
+ *
+ * Note: startup recovery (marking interrupted tasks as failed) is
+ * INTENTIONALLY deferred to daemon.ts. The daemon calls it AFTER
+ * `setupBackgroundCompletionRunner` has subscribed to
+ * background_task:{completed,failed}. If recovery fires before the runner
+ * subscribes, the synthesized failure events for restart-interrupted tasks
+ * land in an empty handler set and the user never sees the recovery
+ * announcement.
  * @param deps - Daemon-level dependencies
  * @returns BackgroundTasksContext with manager instance
  */

package/node_modules/@comis/daemon/dist/wiring/setup-background-tasks.js

@@ -9,9 +9,16 @@ import { createBackgroundTaskManager } from "@comis/agent";
 import { safePath } from "@comis/core";
 /**
  * Wire the background task subsystem from daemon-level dependencies.
- * Creates BackgroundTaskManager with file-based persistence, recovers
- * incomplete tasks from the previous daemon run (marking them failed),
- * and starts an hourly cleanup timer for stale completed/failed tasks.
+ * Creates BackgroundTaskManager with file-based persistence and starts
+ * an hourly cleanup timer for stale completed/failed tasks.
+ *
+ * Note: startup recovery (marking interrupted tasks as failed) is
+ * INTENTIONALLY deferred to daemon.ts. The daemon calls it AFTER
+ * `setupBackgroundCompletionRunner` has subscribed to
+ * background_task:{completed,failed}. If recovery fires before the runner
+ * subscribes, the synthesized failure events for restart-interrupted tasks
+ * land in an empty handler set and the user never sees the recovery
+ * announcement.
  * @param deps - Daemon-level dependencies
  * @returns BackgroundTasksContext with manager instance
  */
@@ -21,8 +28,7 @@ export function setupBackgroundTasks(deps) {
         eventBus: deps.eventBus,
         logger: deps.logger,
     });
-    // Mark incomplete tasks from previous daemon run as failed
-    manager.recoverOnStartup();
+    // Startup recovery is deferred to daemon.ts (after the completion runner subscribes).
     // Periodic cleanup of stale completed/failed tasks (24h TTL)
     const cleanupInterval = setInterval(() => manager.cleanup(), 3_600_000); // every hour
     cleanupInterval.unref(); // don't keep daemon alive for cleanup

package/node_modules/@comis/daemon/dist/wiring/setup-channels.js

@@ -96,7 +96,7 @@ export async function setupChannels(deps) {
                 return;
             }
             const workspacePath = deps.workspaceDirs?.get(agentId) ?? "";
-            const reviewLogger = logger.child({ agentId, module: "memory-review" });
+            const reviewLogger = logger.child({ agentId, submodule: "memory-review" });
             const reviewResult = await runMemoryReview({
                 agentId,
                 tenantId: deps.tenantId ?? container.config.tenantId ?? "default",
@@ -142,6 +142,25 @@ export async function setupChannels(deps) {
             // Extract session strategy from event payload (defaults: fresh, 3 turns)
             const sessionStrategy = payload.sessionStrategy ?? "fresh";
             const maxHistoryTurns = payload.maxHistoryTurns ?? 3;
+            // Cadence-aware cache-waste guard: rolling/accumulate strategies on long cadences
+            // guarantee cache-write waste because the prompt cache TTL is short (5 min for "cron"
+            // operations — see OPERATION_CACHE_DEFAULTS.cron in @comis/agent). Threshold = 2x TTL
+            // so we don't warn on borderline-useful 6-9 min cadences. Operator intent is preserved
+            // (no auto-downgrade) — this is informational only. Scoped to schedule.kind === "every"
+            // because cron-expression cadence is not threaded through the event payload.
+            const CRON_CACHE_TTL_2X_MS = 600_000;
+            if (sessionStrategy !== "fresh" &&
+                payload.cadenceMs !== undefined &&
+                payload.cadenceMs > CRON_CACHE_TTL_2X_MS) {
+                logger.warn({
+                    jobName,
+                    agentId: payload.agentId,
+                    sessionStrategy,
+                    cadenceMs: payload.cadenceMs,
+                    hint: "Cadence exceeds cache TTL by 2x; rolling/accumulate guarantees per-tick cache-write waste. Set sessionStrategy:'fresh' unless cross-tick session memory is essential.",
+                    errorKind: "config",
+                }, "Cron sessionStrategy may waste cache writes at this cadence");
+            }
             // Resolve cron operation model via 5-level priority chain
             const agentConfig = agents[payload.agentId];
             let cronOverrides;

package/node_modules/@comis/daemon/dist/wiring/setup-cross-session.js

@@ -581,7 +581,7 @@ export function setupCrossSession(deps) {
         maxAgeMs: 3_600_000,
         maxEntries: 100,
         eventBus: container.eventBus,
-        logger: deps.logger?.child({ module: "dead-letter-queue" }),
+        logger: deps.logger?.child({ submodule: "dead-letter-queue" }),
     });
     // Create announcement batcher for coalescing near-simultaneous sub-agent completions
     const announcementBatcher = createAnnouncementBatcher({

package/node_modules/@comis/daemon/dist/wiring/setup-delivery.d.ts

@@ -5,8 +5,9 @@
  * Queue two-phase lifecycle resolves the circular dependency between the
  * queue and channel adapters:
  *   1. setupDeliveryQueue() creates the adapter immediately (before setupChannels).
- *   2. drainAndStartPrune() runs drain + starts prune timer AFTER setupChannels
- *      populates channelAdapters.
+ *   2. drainAndStart() recovers in_flight rows, runs startup drain, then starts
+ *      both the recurring drain timer and the prune timer AFTER
+ *      setupChannels populates channelAdapters.
  * Crash-Safe Delivery Queue.
  * Session Mirroring.
  * @module setup-delivery — Delivery subsystem wiring (queue + mirror)
@@ -18,9 +19,9 @@ import type { PluginRegistry } from "@comis/core";
 export interface DeliveryQueueResult {
     /** The delivery queue adapter (real or no-op), available immediately. */
     deliveryQueue: DeliveryQueuePort;
-    /** Runs startup drain then starts periodic prune timer. Call AFTER setupChannels. */
-    drainAndStartPrune: () => Promise<void>;
-    /** Clears the prune interval timer (call on shutdown). */
+    /** Recovers in_flight rows, runs startup drain, then starts the recurring drain + prune timers. Call AFTER setupChannels. */
+    drainAndStart: () => Promise<void>;
+    /** Clears the recurring drain interval AND the prune interval (call on shutdown). */
     shutdown: () => void;
 }
 export declare function setupDeliveryQueue(deps: {
@@ -31,6 +32,14 @@ export declare function setupDeliveryQueue(deps: {
     logger: ComisLogger;
     channelAdapters: Map<string, DeliveryAdapter>;
 }): Promise<DeliveryQueueResult>;
+export declare function drainDeliveryQueue(deps: {
+    deliveryQueue: DeliveryQueuePort;
+    channelAdapters: Map<string, DeliveryAdapter>;
+    eventBus: TypedEventBus;
+    logger: ComisLogger;
+    drainBudgetMs: number;
+    defaultMaxAttempts: number;
+}): Promise<void>;
 export interface DeliveryMirrorResult {
     /** The delivery mirror adapter (real or no-op), available immediately. */
     deliveryMirror: DeliveryMirrorPort;

package/node_modules/@comis/daemon/dist/wiring/setup-delivery.js

@@ -6,8 +6,9 @@
  * Queue two-phase lifecycle resolves the circular dependency between the
  * queue and channel adapters:
  *   1. setupDeliveryQueue() creates the adapter immediately (before setupChannels).
- *   2. drainAndStartPrune() runs drain + starts prune timer AFTER setupChannels
- *      populates channelAdapters.
+ *   2. drainAndStart() recovers in_flight rows, runs startup drain, then starts
+ *      both the recurring drain timer and the prune timer AFTER
+ *      setupChannels populates channelAdapters.
  * Crash-Safe Delivery Queue.
  * Session Mirroring.
  * @module setup-delivery — Delivery subsystem wiring (queue + mirror)
@@ -15,7 +16,7 @@
 import { createNoOpDeliveryQueue, createNoOpDeliveryMirror } from "@comis/core";
 import { createSqliteDeliveryQueue, createSqliteDeliveryMirror } from "@comis/memory";
 import { isPermanentError, computeQueueBackoff } from "@comis/channels";
-import { ok } from "@comis/shared";
+import { ok, suppressError } from "@comis/shared";
 import { createHash } from "node:crypto";
 // ---------------------------------------------------------------------------
 // Setup function
@@ -28,28 +29,56 @@ export async function setupDeliveryQueue(deps) {
         logger.debug("Delivery queue disabled by config");
         return {
             deliveryQueue: createNoOpDeliveryQueue(),
-            drainAndStartPrune: async () => { },
+            drainAndStart: async () => { },
             shutdown: () => { },
         };
     }
     // eslint-disable-next-line @typescript-eslint/no-explicit-any -- db is better-sqlite3 Database; typed as unknown to avoid cross-package type dependency
-    const deliveryQueue = createSqliteDeliveryQueue(db);
+    const deliveryQueue = createSqliteDeliveryQueue(db, eventBus);
     logger.info({ maxQueueDepth: queueConfig.maxQueueDepth, defaultMaxAttempts: queueConfig.defaultMaxAttempts }, "Delivery queue enabled");
     let pruneInterval;
-    // 2. Startup drain + 3. Periodic prune (deferred until channelAdapters populated)
-    const drainAndStartPrune = async () => {
-        // --- Drain ---
+    let drainInterval;
+    // Single-tick gate: in-flight Promise prevents overlapping ticks.
+    let draining = null;
+    // Inner helper: one drain pass. Reused by startup drain AND each recurring tick.
+    const runOneDrainPass = async () => {
+        await drainDeliveryQueue({
+            deliveryQueue,
+            channelAdapters,
+            eventBus,
+            logger,
+            drainBudgetMs: queueConfig.drainBudgetMs,
+            defaultMaxAttempts: queueConfig.defaultMaxAttempts,
+        });
+    };
+    // 2. Startup drain + recurring drain timer + prune timer (deferred until channelAdapters populated)
+    const drainAndStart = async () => {
+        // --- Step 1: Recover in_flight rows. ---
+        // Runs UNCONDITIONALLY -- independent of drainOnStartup policy. An 'in_flight'
+        // row from a prior crash is a correctness bug regardless of the drain policy.
+        const recoverResult = await deliveryQueue.recoverInFlight();
+        if (!recoverResult.ok) {
+            logger.warn({ err: recoverResult.error, hint: "Could not recover in_flight rows on startup; messages may stall until next restart", errorKind: "internal" }, "Delivery queue: recoverInFlight failed");
+        }
+        else if (recoverResult.value > 0) {
+            logger.info({ recovered: recoverResult.value }, "Delivery queue: recovered in_flight rows to pending");
+        }
+        // --- Step 2: Startup drain (existing behavior, unchanged). ---
         if (queueConfig.drainOnStartup) {
-            await drainDeliveryQueue({
-                deliveryQueue,
-                channelAdapters,
-                eventBus,
-                logger,
-                drainBudgetMs: queueConfig.drainBudgetMs,
-                defaultMaxAttempts: queueConfig.defaultMaxAttempts,
-            });
+            await runOneDrainPass();
         }
-        // --- Prune timer ---
+        // --- Step 3: Recurring drain timer. ---
+        drainInterval = setInterval(() => {
+            if (draining)
+                return; // single-tick gate
+            draining = runOneDrainPass().finally(() => { draining = null; });
+            // Fire-and-forget: failures inside drainDeliveryQueue are already logged
+            // and do not propagate (it never throws). suppressError satisfies the
+            // no-floating-promise lint without altering semantics.
+            suppressError(draining, "delivery queue recurring drain tick");
+        }, queueConfig.drainIntervalMs);
+        drainInterval.unref();
+        // --- Step 4: Prune timer (existing behavior, unchanged). ---
         pruneInterval = setInterval(async () => {
             const result = await deliveryQueue.pruneExpired();
             if (result.ok && result.value > 0) {
@@ -59,17 +88,21 @@ export async function setupDeliveryQueue(deps) {
         pruneInterval.unref();
     };
     const shutdown = () => {
+        if (drainInterval) {
+            clearInterval(drainInterval);
+            drainInterval = undefined;
+        }
         if (pruneInterval) {
             clearInterval(pruneInterval);
             pruneInterval = undefined;
         }
     };
-    return { deliveryQueue, drainAndStartPrune, shutdown };
+    return { deliveryQueue, drainAndStart, shutdown };
 }
 // ---------------------------------------------------------------------------
 // Drain implementation
 // ---------------------------------------------------------------------------
-async function drainDeliveryQueue(deps) {
+export async function drainDeliveryQueue(deps) {
     const { deliveryQueue, channelAdapters, eventBus, logger, drainBudgetMs, defaultMaxAttempts } = deps;
     const drainStart = Date.now();
     const deadline = drainStart + drainBudgetMs;

package/node_modules/@comis/daemon/dist/wiring/setup-schedulers.js

@@ -108,6 +108,10 @@ export async function setupSchedulers(deps) {
                         payloadKind: job.payload.kind,
                         sessionStrategy: job.sessionStrategy,
                         maxHistoryTurns: job.maxHistoryTurns,
+                        // Cadence is a literal number only for kind === "every"; cron-expression
+                        // schedules would require parsing the expression to estimate a cadence,
+                        // which is out of scope. Consumers must treat undefined as "unknown".
+                        cadenceMs: job.schedule.kind === "every" ? job.schedule.everyMs : undefined,
                         cronJobModel: job.payload.kind === "agent_turn" ? job.payload.model : undefined,
                         cacheRetention: job.cacheRetention,
                         toolPolicy: job.toolPolicy,

package/node_modules/@comis/daemon/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/daemon",
   "private": true,
-  "version": "1.0.33",
+  "version": "1.0.36",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Background daemon and orchestrator for the Comis platform",

package/node_modules/@comis/gateway/dist/index.d.ts

@@ -9,6 +9,8 @@ export type { RpcAdapterDeps } from "./rpc/rpc-adapters.js";
 export { WsConnectionManager } from "./rpc/ws-handler.js";
 export { createMappedWebhookEndpoint } from "./webhook/webhook-endpoint.js";
 export { getPresetMappings } from "./webhook/webhook-presets.js";
+export { createOAuthCallbackRoute, insertPendingFlow, PENDING_FLOW_TIMEOUT_MS, } from "./oauth/oauth-callback-route.js";
+export type { OAuthCallbackDeps, PendingFlow, } from "./oauth/oauth-callback-route.js";
 export { createMediaRoutes } from "./web/index.js";
 export { createOpenaiCompletionsRoute } from "./openai/index.js";
 export { createOpenaiModelsRoute } from "./openai/index.js";

package/node_modules/@comis/gateway/dist/index.js

@@ -16,6 +16,8 @@ export { WsConnectionManager } from "./rpc/ws-handler.js";
 // Webhook
 export { createMappedWebhookEndpoint } from "./webhook/webhook-endpoint.js";
 export { getPresetMappings } from "./webhook/webhook-presets.js";
+// OAuth callback route exports
+export { createOAuthCallbackRoute, insertPendingFlow, PENDING_FLOW_TIMEOUT_MS, } from "./oauth/oauth-callback-route.js";
 // Web -- media routes
 export { createMediaRoutes } from "./web/index.js";
 // OpenAI compatibility endpoints

package/node_modules/@comis/gateway/dist/oauth/oauth-callback-route.d.ts

@@ -0,0 +1,66 @@
+/**
+ * OAuth callback route for the Comis gateway.
+ *
+ * Mounted at `GET /callback/:provider` via `app.route("/oauth", subApp)`. The
+ * handler validates code+state, looks up the state in the in-memory pending-
+ * flow map, verifies path-vs-flow provider match, deletes the entry BEFORE
+ * the token exchange (one-time-use invariant), exchanges the code at
+ * auth.openai.com/oauth/token, resolves identity via
+ * resolveCodexAuthIdentity, persists via OAuthCredentialStorePort.set, emits
+ * auth:profile_bootstrapped, and returns a static "Login Successful" HTML
+ * page (200) on success or a "Login Failed" HTML page (400/500) on failure.
+ *
+ * HTTP method is GET, NOT POST (OAuth servers always redirect with GET).
+ * Logging discipline (CLAUDE.md): submodule: "oauth-callback"
+ * on every line; NEVER log code/state/verifier/access/refresh values.
+ *
+ * @module
+ */
+import { Hono } from "hono";
+import type { OAuthCredentialStorePort, TypedEventBus } from "@comis/core";
+import type { GatewayLogger } from "../server/hono-server.js";
+/** 5-minute pending-flow expiry. Exported for test parity. */
+export declare const PENDING_FLOW_TIMEOUT_MS: number;
+/**
+ * Pending-flow entry stored in the in-memory map keyed by `state`.
+ * Created by insertPendingFlow at flow-initiation time; consumed by the
+ * /callback/:provider handler on a successful state-match.
+ */
+export interface PendingFlow {
+    /** PKCE code_verifier generated at flow initiation. */
+    verifier: string;
+    /** "openai-codex" — used for path-vs-flow provider validation. */
+    provider: string;
+    /** Date.now() at insertion time. */
+    createdAt: number;
+    /**
+     * Cleanup timer reference. The handler clearTimeout(timer) on consume;
+     * the auto-expiry path (PENDING_FLOW_TIMEOUT_MS) deletes the entry.
+     */
+    timer: ReturnType<typeof setTimeout>;
+}
+/** Dependencies for createOAuthCallbackRoute. */
+export interface OAuthCallbackDeps {
+    readonly credentialStore: OAuthCredentialStorePort;
+    readonly eventBus: TypedEventBus;
+    readonly logger: GatewayLogger;
+    /** State -> PendingFlow map; mutated by handler + insertPendingFlow. */
+    readonly pendingFlows: Map<string, PendingFlow>;
+}
+/**
+ * Seed the pending-flow map with a new state -> PendingFlow entry, scheduling
+ * a 5-minute auto-delete cleanup timer.
+ *
+ * The caller is responsible for generating `state` via crypto.randomBytes(16)
+ * — never hand-roll a PRNG.
+ */
+export declare function insertPendingFlow(map: Map<string, PendingFlow>, state: string, flow: Omit<PendingFlow, "timer">, logger: GatewayLogger): void;
+/**
+ * Create the OAuth callback Hono sub-app.
+ *
+ * Mount via:
+ *   const app = new Hono();
+ *   app.route("/oauth", createOAuthCallbackRoute(deps));
+ * Resulting URL: GET /oauth/callback/:provider
+ */
+export declare function createOAuthCallbackRoute(deps: OAuthCallbackDeps): Hono;