comisai 1.0.33 → 1.0.36

package/node_modules/@comis/skills/dist/builtin/platform/cron-tool.js

@@ -39,7 +39,7 @@ const CronToolParams = Type.Object({
     payload_text: Type.Optional(Type.String({ description: "Payload text or message content" })),
     // session strategy params
     session_strategy: Type.Optional(Type.Union([Type.Literal("fresh"), Type.Literal("rolling"), Type.Literal("accumulate")], {
-        description: "Session history strategy for recurring jobs. Valid values: fresh (new session each run), rolling (keep last N turns), accumulate (keep all history). Default: fresh",
+        description: "Session history strategy for recurring jobs. Valid values: fresh (new session each run; default and STRONGLY PREFERRED for cadences ≥ 10 minutes), rolling (keep last N turns; ONLY use when cadence < 5 minutes), accumulate (keep all history; rarely correct, leaks across runs). Rationale: cron uses a 5-minute prompt cache TTL, so any cadence longer than that wastes cache-write spend on rolling/accumulate — the cache is always cold by the next tick. Pick fresh unless cross-tick session memory is essential and cadence is < 5 minutes. Default: fresh",
     })),
     max_history_turns: Type.Optional(Type.Integer({ description: "Number of recent turns to keep for rolling strategy (default 3)" })),
     model: Type.Optional(Type.String({

package/node_modules/@comis/skills/dist/builtin/platform/gateway-tool.js

@@ -165,16 +165,16 @@ export function createGatewayTool(rpcCall, logger) {
                             hint: "Ask the user to confirm this restart, then call again with _confirmed: true.",
                         };
                     }
-                    // 260428-qrn: Inside Docker the restart relies entirely on the
-                    // container's restart policy to bring the daemon back. Surface
-                    // a structured WARN so the operator gets a breadcrumb in
-                    // `docker logs` pointing at `--restart unless-stopped`. Tool
-                    // result schema unchanged (Pino-only -- no extra content blocks).
+                    // Inside Docker the restart relies entirely on the container's
+                    // restart policy to bring the daemon back. Surface a structured
+                    // WARN so the operator gets a breadcrumb in `docker logs`
+                    // pointing at `--restart unless-stopped`. Tool result schema
+                    // unchanged (Pino-only -- no extra content blocks).
                     if (isDocker()) {
                         logger.warn({
                             hint: "Container must have --restart unless-stopped (or compose restart: unless-stopped) for the restart to bring it back. Otherwise run 'docker restart <name>' from your host after the daemon exits.",
                             errorKind: "config",
-                            module: "skill.gateway",
+                            submodule: "skill.gateway",
                         }, "Daemon restart requested inside Docker container — relies on container restart policy");
                     }
                     return rpcCall("gateway.restart", { _trustLevel });

package/node_modules/@comis/skills/dist/builtin/platform/mcp-manage-tool.d.ts

@@ -13,7 +13,7 @@ import type { ApprovalGate } from "@comis/core";
 import type { RpcCall } from "./cron-tool.js";
 declare const McpManageToolParams: Type.TObject<{
     action: Type.TUnion<[Type.TLiteral<"list">, Type.TLiteral<"status">, Type.TLiteral<"connect">, Type.TLiteral<"disconnect">, Type.TLiteral<"reconnect">]>;
-    name: Type.TOptional<Type.TString>;
+    server_name: Type.TOptional<Type.TString>;
     transport: Type.TOptional<Type.TString>;
     command: Type.TOptional<Type.TString>;
     args: Type.TOptional<Type.TArray<Type.TString>>;

package/node_modules/@comis/skills/dist/builtin/platform/mcp-manage-tool.js

@@ -22,7 +22,7 @@ const McpManageToolParams = Type.Object({
         Type.Literal("disconnect"),
         Type.Literal("reconnect"),
     ], { description: "MCP server management action. Valid values: list (all servers with status), status (detailed single server info), connect (add new server), disconnect (remove server), reconnect (restart server connection)" }),
-    name: Type.Optional(Type.String({
+    server_name: Type.Optional(Type.String({
         description: "MCP server name. Required for status/connect/disconnect/reconnect.",
     })),
     transport: Type.Optional(Type.String({
@@ -72,14 +72,14 @@ export function createMcpManageTool(rpcCall, approvalGate) {
                 return rpcCall("mcp.list", { _trustLevel: ctx.trustLevel });
             },
             async status(p, rpcCall, ctx) {
-                const name = readStringParam(p, "name");
-                return rpcCall("mcp.status", { name, _trustLevel: ctx.trustLevel });
+                const name = readStringParam(p, "server_name");
+                return rpcCall("mcp.status", { server_name: name, _trustLevel: ctx.trustLevel });
             },
             async connect(p, rpcCall, ctx) {
-                const name = readStringParam(p, "name");
+                const name = readStringParam(p, "server_name");
                 const transport = readStringParam(p, "transport");
                 return rpcCall("mcp.connect", {
-                    name,
+                    server_name: name,
                     transport,
                     command: p.command,
                     args: p.args,
@@ -89,13 +89,13 @@ export function createMcpManageTool(rpcCall, approvalGate) {
                 });
             },
             async disconnect(p, rpcCall, ctx) {
-                const name = readStringParam(p, "name");
-                return rpcCall("mcp.disconnect", { name, _trustLevel: ctx.trustLevel });
+                const name = readStringParam(p, "server_name");
+                return rpcCall("mcp.disconnect", { server_name: name, _trustLevel: ctx.trustLevel });
             },
             async reconnect(p, rpcCall, ctx) {
-                const name = readStringParam(p, "name");
+                const name = readStringParam(p, "server_name");
                 return rpcCall("mcp.reconnect", {
-                    name,
+                    server_name: name,
                     transport: p.transport,
                     command: p.command,
                     args: p.args,

package/node_modules/@comis/skills/dist/builtin/sandbox/bwrap-provider.d.ts

@@ -7,6 +7,17 @@
  * @module
  */
 import type { SandboxOptions, SandboxProvider } from "./types.js";
+/**
+ * System paths to bind read-only. Filtered by existsSync once at
+ * first buildArgs() call and cached for the provider's lifetime.
+ *
+ * Exported so the bwrap smoke test in detect-provider.ts consumes the
+ * same list — drift between smoke and production binds caused a real
+ * false-negative on usrmerge x86-64 hosts (smoke test missed /lib64
+ * → /bin/true's dynamic linker unreachable → smoke EPERMs while the
+ * production sandbox actually works fine).
+ */
+export declare const SYSTEM_RO_PATHS: readonly ["/usr", "/bin", "/sbin", "/lib", "/lib64", "/lib32", "/etc/resolv.conf", "/etc/hosts", "/etc/hostname", "/etc/ssl", "/etc/ca-certificates", "/etc/pki", "/etc/ld.so.cache", "/etc/ld.so.conf", "/etc/ld.so.conf.d", "/etc/alternatives", "/etc/localtime", "/etc/passwd", "/etc/group", "/etc/nsswitch.conf"];
 export declare class BwrapProvider implements SandboxProvider {
     readonly name = "bwrap";
     private bwrapPath;

package/node_modules/@comis/skills/dist/builtin/sandbox/bwrap-provider.js

@@ -14,8 +14,14 @@ import path from "node:path";
 /**
  * System paths to bind read-only. Filtered by existsSync once at
  * first buildArgs() call and cached for the provider's lifetime.
+ *
+ * Exported so the bwrap smoke test in detect-provider.ts consumes the
+ * same list — drift between smoke and production binds caused a real
+ * false-negative on usrmerge x86-64 hosts (smoke test missed /lib64
+ * → /bin/true's dynamic linker unreachable → smoke EPERMs while the
+ * production sandbox actually works fine).
  */
-const SYSTEM_RO_PATHS = [
+export const SYSTEM_RO_PATHS = [
     "/usr",
     "/bin",
     "/sbin",
@@ -73,6 +79,40 @@ function getClaudeCodeRwPaths(home) {
         /* eslint-enable no-restricted-syntax */
     ].filter((p) => existsSync(p));
 }
+/**
+ * Per-user XDG paths that need read-write access for language package managers.
+ *
+ * These paths MUST match the systemd ReadWritePaths in
+ * packages/daemon/systemd/comis.service.template. Without RW access here,
+ * package managers writing to standard XDG paths (npm, uv, pipx, cargo, go,
+ * deno, bun) fail with EROFS at the bwrap mount layer even when the outer
+ * systemd sandbox permits the write.
+ *
+ * Why these specific paths:
+ * - ~/.npm     -- npm/npx default cache + global modules root.
+ * - ~/.cache   -- XDG_CACHE_HOME default; uv archives, deno cache, bun cache,
+ *                pip wheel cache, cargo registry cache, go module cache.
+ *                wrapEnv() also redirects most caches into the workspace, but
+ *                some tools (e.g. uv's archive cache) still touch ~/.cache
+ *                during early bootstrap before env vars take effect.
+ * - ~/.local/share -- XDG_DATA_HOME default; uvx tool installs, pipx venvs,
+ *                    rustup toolchains, generic XDG_DATA consumers.
+ *
+ * Note: this returns a subset of paths bound RO by getUserRoPaths
+ * (specifically ~/.local). The RW bind is emitted AFTER the RO bind in
+ * buildArgs, which causes bwrap to apply the more-permissive RW mount on
+ * top of the RO mount for the ~/.local/share subpath. ~/.local itself
+ * remains RO; only ~/.local/share becomes RW.
+ */
+function getDevToolRwPaths(home) {
+    /* eslint-disable no-restricted-syntax -- Trusted: constant subpaths of homedir, no user input */
+    return [
+        path.join(home, ".npm"),
+        path.join(home, ".cache"),
+        path.join(home, ".local", "share"),
+        /* eslint-enable no-restricted-syntax */
+    ].filter((p) => existsSync(p));
+}
 export class BwrapProvider {
     name = "bwrap";
     bwrapPath = null;
@@ -124,6 +164,14 @@ export class BwrapProvider {
         for (const cp of getClaudeCodeRwPaths(os.homedir())) {
             args.push("--bind", cp, cp);
         }
+        // -- Dev tool RW paths (read-write) --
+        // MUST come after getUserRoPaths above so the RW bind for ~/.local/share
+        // overrides the RO bind for ~/.local. MUST come before the discovery
+        // readOnlyPaths loop below so caller-supplied RO can't shadow these.
+        // Mirror of systemd ReadWritePaths in comis.service.template.
+        for (const dp of getDevToolRwPaths(os.homedir())) {
+            args.push("--bind", dp, dp);
+        }
         // -- Read-only paths (discovery paths, custom) --
         for (const ro of opts.readOnlyPaths) {
             if (existsSync(ro)) {
@@ -139,6 +187,24 @@ export class BwrapProvider {
     wrapEnv(env, workspacePath) {
         // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
         const cacheDir = path.join(workspacePath, ".cache");
+        // Workspace-rooted bin dirs that hold CLIs installed by sandboxed package
+        // managers. Prepended to PATH so a binary installed by `cargo install <crate>`
+        // (or pipx, go install, bun add -g, deno install, pnpm add -g) on one exec
+        // call is invocable on the NEXT exec call. Ordering: highest-frequency first.
+        const toolBinPaths = [
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            path.join(workspacePath, ".local", "bin"), // PYTHONUSERBASE/bin + PIPX_BIN_DIR
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            path.join(cacheDir, "cargo", "bin"), // cargo install
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            path.join(cacheDir, "go", "bin"), // go install
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            path.join(cacheDir, "bun", "bin"), // bun add -g
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            path.join(cacheDir, "pnpm"), // pnpm global (PNPM_HOME itself is the bin dir)
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            path.join(cacheDir, "deno", "bin"), // deno install
+        ];
         return {
             ...env,
             // Temp files: heredocs, wheel builds, etc.
@@ -150,6 +216,15 @@ export class BwrapProvider {
             // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
             PIP_CACHE_DIR: path.join(cacheDir, "pip"),
             XDG_CACHE_HOME: cacheDir,
+            // XDG_STATE_HOME (~/.local/state by default): pipx logs, some Python
+            // tools, runtime state. The ~/.local parent bind is RO (getUserRoPaths)
+            // and getDevToolRwPaths only carves out ~/.local/share, so anything
+            // defaulting to ~/.local/state would EROFS without this redirect.
+            // pipx happens to survive (PIPX_HOME captures all pipx state) but other
+            // XDG-state-using tools would not. Defensive belt-and-suspenders matching
+            // the existing XDG_CACHE_HOME pattern.
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            XDG_STATE_HOME: path.join(workspacePath, ".local", "state"),
             // Python: redirect user packages into workspace.
             // PYTHONNOUSERSITE is NOT set — sandbox read paths cover dirs that
             // pip needs to scan. Removing it lets Python find packages installed
@@ -176,6 +251,44 @@ export class BwrapProvider {
             GEM_HOME: path.join(cacheDir, "gems"),
             // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
             BUNDLE_PATH: path.join(cacheDir, "bundle"),
+            // Rust: rustup multiplexer needs RUSTUP_HOME to locate the toolchain.
+            // Pointed at the system rustup install (written by install.sh's
+            // install_rust at /usr/local/rustup). A workspace-rooted RUSTUP_HOME
+            // would be empty on first call, breaking `cargo install <crate>` with
+            // "rustup could not choose a version of cargo to run, because no default
+            // is configured" — confirmed on a real VPS during the dev-sandbox matrix
+            // test. CARGO_HOME stays workspace-rooted (above) so `cargo install`
+            // outputs land in <workspace>/.cache/cargo/bin and survive.
+            // Tradeoff: agent loses the ability to `rustup install <toolchain>` from
+            // inside exec (would need RW to /usr/local/rustup). Acceptable — the
+            // canonical use case is `cargo install <crate>`, which works.
+            RUSTUP_HOME: "/usr/local/rustup",
+            // uv: tool install dir for `uvx` / `uv tool install` (paired with UV_PYTHON_INSTALL_DIR above).
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            UV_TOOL_DIR: path.join(cacheDir, "uv", "tools"),
+            // pipx: venvs root + bin dir. PIPX_BIN_DIR aligns with PYTHONUSERBASE/bin
+            // (PYTHONUSERBASE = workspace/.local) so user-installed and pipx-installed
+            // CLIs share a single PATH entry: workspace/.local/bin.
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            PIPX_HOME: path.join(cacheDir, "pipx"),
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            PIPX_BIN_DIR: path.join(workspacePath, ".local", "bin"),
+            // pnpm global store + bin dir (PNPM_HOME is on PATH below).
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            PNPM_HOME: path.join(cacheDir, "pnpm"),
+            // bun: install root; binaries land in $BUN_INSTALL/bin.
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            BUN_INSTALL: path.join(cacheDir, "bun"),
+            // deno: cache + installed CLI dir ($DENO_DIR/bin via `deno install`).
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            DENO_DIR: path.join(cacheDir, "deno"),
+            // yarn cache; mirrors the others for completeness even though yarn is rare in agent flows.
+            // eslint-disable-next-line no-restricted-syntax -- Trusted: workspace path is daemon-controlled, constant subpaths
+            YARN_CACHE_FOLDER: path.join(cacheDir, "yarn"),
+            // PATH augmentation MUST come after the spread above so it overrides
+            // any PATH carried in `env`. Empty entries are filtered to avoid
+            // trailing/duplicate colons when env.PATH is undefined.
+            PATH: [...toolBinPaths, env.PATH ?? ""].filter(Boolean).join(":"),
         };
     }
 }

package/node_modules/@comis/skills/dist/builtin/sandbox/detect-provider.js

@@ -10,7 +10,7 @@
  */
 import { existsSync } from "node:fs";
 import { spawnSync } from "node:child_process";
-import { BwrapProvider } from "./bwrap-provider.js";
+import { BwrapProvider, SYSTEM_RO_PATHS } from "./bwrap-provider.js";
 import { SandboxExecProvider } from "./sandbox-exec-provider.js";
 /**
  * True when the daemon is running inside a Linux container. Docker writes
@@ -21,26 +21,42 @@ function isContainer() {
     return existsSync("/.dockerenv") || existsSync("/run/.containerenv");
 }
 /**
- * Smoke-test the bwrap binary against the isolation flags BwrapProvider
- * actually uses (--unshare-pid + --proc /proc). On Docker Desktop's linuxkit
- * kernel and similar restricted environments this combo EPERMs at the
- * procfs mount step, even with apparmor/seccomp unconfined — every later
- * exec call would silently fail. `available()` only checks if `bwrap` is on
- * PATH, so without this probe the daemon would log "provider: bwrap" even
- * when bwrap is non-functional. ~50ms one-shot at startup.
+ * Smoke-test bwrap against the same SYSTEM_RO_PATHS BwrapProvider.buildArgs()
+ * uses, plus --unshare-pid + --proc /proc — the kernel-feature combo we
+ * actually need to detect. Reusing the production bind list prevents drift
+ * (e.g. /lib64 must be present on usrmerge x86-64 hosts where /bin/true's
+ * dynamic linker lives there; without it the smoke spawn EPERMs at execvp
+ * even though the production sandbox itself runs fine).
+ *
+ * On Docker Desktop's linuxkit kernel and similar restricted environments
+ * --unshare-pid + --proc /proc EPERMs at the procfs mount step, even with
+ * apparmor/seccomp unconfined — every later exec call would silently fail.
+ * `available()` only checks if `bwrap` is on PATH, so without this probe the
+ * daemon would log "provider: bwrap" even when bwrap is non-functional.
+ * ~50ms one-shot at startup.
+ *
+ * Returns the raw `stderr` and `signal` from bwrap so the caller can include
+ * them in the warn payload — operators reading the log see the actual bwrap
+ * error message (e.g. "Creating new namespace failed: Operation not
+ * permitted") without having to enable DEBUG logging.
  */
 function bwrapSmokeTest() {
+    const sysBinds = SYSTEM_RO_PATHS
+        .filter((p) => existsSync(p))
+        .flatMap((p) => ["--ro-bind", p, p]);
     const r = spawnSync("bwrap", [
         "--unshare-user",
         "--unshare-pid",
         "--proc", "/proc",
-        "--ro-bind", "/usr", "/usr",
-        "--ro-bind", "/bin", "/bin",
-        "--ro-bind", "/lib", "/lib",
+        ...sysBinds,
         "--tmpfs", "/tmp",
         "/bin/true",
     ], { encoding: "utf8", timeout: 5000 });
-    return r.status === 0;
+    return {
+        ok: r.status === 0,
+        stderr: (r.stderr ?? "").trim(),
+        signal: r.signal ?? null,
+    };
 }
 /**
  * Detect and return the best available sandbox provider for this platform.
@@ -51,7 +67,8 @@ export function detectSandboxProvider(logger) {
     if (process.platform === "linux") {
         const bwrap = new BwrapProvider();
         if (bwrap.available()) {
-            if (!bwrapSmokeTest()) {
+            const smoke = bwrapSmokeTest();
+            if (!smoke.ok) {
                 // bwrap is on PATH but the kernel rejects the isolation flags
                 // (typically Docker Desktop's linuxkit on macOS/Windows). Behaviour
                 // diverges by environment:
@@ -69,17 +86,25 @@ export function detectSandboxProvider(logger) {
                 //    (rare on stock Linux). Surface it loudly and return the
                 //    provider so exec fails via bwrap's stderr until the operator
                 //    fixes the kernel/userns config — never silently degrade
-                //    sandboxing on a bare-metal host.
+                //    sandboxing on a bare-metal host. The warn payload now includes
+                //    `stderr` (the actual bwrap error) and `signal` so operators
+                //    don't have to enable DEBUG logging to diagnose; the hint
+                //    points at stderr first and demotes kernel sysctls to a
+                //    secondary fallback.
                 if (isContainer()) {
                     logger?.warn({
                         hint: "Kernel rejected --unshare-pid + --proc /proc (typically Docker Desktop linuxkit on macOS/Windows). Sandbox auto-disabled so agent exec is functional for development. PRODUCTION DEPLOYMENTS MUST USE A REAL LINUX HOST — see docs/operations/docker.mdx → Platform Support.",
                         errorKind: "config",
+                        stderr: smoke.stderr,
+                        signal: smoke.signal,
                     }, "Exec sandbox DISABLED (kernel limitation; container host) -- shell commands will run UNSANDBOXED. Dev/testing only.");
                     return undefined;
                 }
                 logger?.warn({
-                    hint: "Kernel rejected --unshare-pid + --proc /proc on a bare-metal host. Check `kernel.unprivileged_userns_clone` and AppArmor's `apparmor_restrict_unprivileged_userns`. Exec calls will fail until bwrap can run.",
+                    hint: "Check the `stderr` field above for the actual bwrap error — that's the primary signal. If stderr mentions namespaces or 'Operation not permitted' on a bare-metal host, then as a secondary diagnostic verify `sysctl kernel.unprivileged_userns_clone=1` and AppArmor's `apparmor_restrict_unprivileged_userns=0` (Ubuntu 23.10+). Exec calls will fail until bwrap can run.",
                     errorKind: "config",
+                    stderr: smoke.stderr,
+                    signal: smoke.signal,
                 }, "bwrap installed but smoke test failed -- exec sandbox is non-functional on this kernel");
             }
             return bwrap;

package/node_modules/@comis/skills/dist/media/ssrf-fetcher.d.ts

@@ -9,6 +9,13 @@
  * URL** (preserving TLS SNI). This maintains SSRF protection while keeping
  * TLS certificate validation working correctly.
  *
+ * Both `fetch` and `Agent` are imported from undici directly (NOT
+ * `globalThis.fetch`): Node's bundled fetch ships an older undici whose
+ * request-handler lifecycle is incompatible with the v8 `Agent` we use for
+ * DNS pinning. Mixing the two throws `InvalidArgumentError: invalid
+ * onRequestStart method` and breaks every channel's inbound media path. Do
+ * not swap this back to `globalThis.fetch`.
+ *
  * Every outbound media fetch MUST go through this utility.
  *
  * @module

package/node_modules/@comis/skills/dist/media/ssrf-fetcher.js

@@ -10,13 +10,20 @@
  * URL** (preserving TLS SNI). This maintains SSRF protection while keeping
  * TLS certificate validation working correctly.
  *
+ * Both `fetch` and `Agent` are imported from undici directly (NOT
+ * `globalThis.fetch`): Node's bundled fetch ships an older undici whose
+ * request-handler lifecycle is incompatible with the v8 `Agent` we use for
+ * DNS pinning. Mixing the two throws `InvalidArgumentError: invalid
+ * onRequestStart method` and breaks every channel's inbound media path. Do
+ * not swap this back to `globalThis.fetch`.
+ *
  * Every outbound media fetch MUST go through this utility.
  *
  * @module
  */
 import { validateUrl } from "@comis/core";
 import { fromPromise, suppressError } from "@comis/shared";
-import { Agent } from "undici";
+import { Agent, fetch } from "undici";
 /**
  * Classify a fetch error into an actionable errorKind + hint for structured logging.
  */
@@ -121,7 +128,7 @@ export function createSsrfGuardedFetcher(config, logger) {
                 //    because the original hostname stays in the URL.
                 const agent = createPinnedAgent(ip);
                 try {
-                    const response = await globalThis.fetch(url, {
+                    const response = await fetch(url, {
                         signal: AbortSignal.timeout(30_000),
                         redirect: "error", // Do not follow redirects — they could point to internal IPs
                         dispatcher: agent,

package/node_modules/@comis/skills/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/skills",
   "private": true,
-  "version": "1.0.33",
+  "version": "1.0.36",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Skill system, MCP integration, and tool sandbox for Comis agents",

package/node_modules/@comis/web/dist/assets/{agent-detail-71BSbSfD.js → agent-detail-q8t1NB7w.js}

@@ -1,4 +1,4 @@
-import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import{a as u,i as d}from"./index-CBr0Tm9_.js";import"./ic-breadcrumb-DqN6G3gc.js";import"./ic-tag-CvMVQFRR.js";import"./ic-confirm-dialog-DGlPbV1T.js";import"./ic-relative-time-B3UAnTqg.js";function f(e){return e.toLocaleString(`en-US`)}var p=class extends r{constructor(...e){super(...e),this.label=``,this.used=0,this.total=0,this.warnThreshold=70,this.dangerThreshold=90}static{this.styles=[o,n`
+import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import{a as u,i as d}from"./index-8Tg9oc-C.js";import"./ic-breadcrumb-DqN6G3gc.js";import"./ic-tag-CvMVQFRR.js";import"./ic-confirm-dialog-DGlPbV1T.js";import"./ic-relative-time-B3UAnTqg.js";function f(e){return e.toLocaleString(`en-US`)}var p=class extends r{constructor(...e){super(...e),this.label=``,this.used=0,this.total=0,this.warnThreshold=70,this.dangerThreshold=90}static{this.styles=[o,n`
       :host {
         display: block;
       }

package/node_modules/@comis/web/dist/assets/{agent-editor-CTSDZhwT.js → agent-editor-B46io5gv.js}

@@ -1,4 +1,4 @@
-import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import{a as u}from"./index-CBr0Tm9_.js";import"./ic-breadcrumb-DqN6G3gc.js";import"./ic-tag-CvMVQFRR.js";import"./ic-array-editor-BLoEyeLS.js";function d(e,t=0){let n=[],r=`  `.repeat(t);for(let[i,a]of Object.entries(e))if(!(a==null||a===``))if(Array.isArray(a)){if(a.length===0)continue;n.push(`${r}${i}:`);for(let e of a)if(typeof e==`object`&&e&&!Array.isArray(e)){let i=d(e,t+2).split(`
+import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import{a as u}from"./index-8Tg9oc-C.js";import"./ic-breadcrumb-DqN6G3gc.js";import"./ic-tag-CvMVQFRR.js";import"./ic-array-editor-BLoEyeLS.js";function d(e,t=0){let n=[],r=`  `.repeat(t);for(let[i,a]of Object.entries(e))if(!(a==null||a===``))if(Array.isArray(a)){if(a.length===0)continue;n.push(`${r}${i}:`);for(let e of a)if(typeof e==`object`&&e&&!Array.isArray(e)){let i=d(e,t+2).split(`
 `).filter(Boolean);if(i.length>0){n.push(`${r}  - ${i[0].trimStart()}`);for(let e=1;e<i.length;e++)n.push(`${r}    ${i[e].trimStart()}`)}}else n.push(`${r}  - ${f(e)}`)}else if(typeof a==`object`){let e=d(a,t+1);e.trim()&&(n.push(`${r}${i}:`),n.push(e))}else n.push(`${r}${i}: ${f(a)}`);return n.join(`
 `)}function f(e){return typeof e==`string`?/[:#{}[\],&*?|>!%@`'"]/.test(e)||e.includes(`
 `)?`"${e.replace(/\\/g,`\\\\`).replace(/"/g,`\\"`)}"`:e:typeof e==`boolean`?e?`true`:`false`:String(e)}function p(){let e=new Set,t=t=>{e.size>0&&t.preventDefault()};return{get isDirty(){return e.size>0},markDirty(t=`_default`){e.add(t)},markClean(){e.clear()},confirmNavigation(){return e.size===0?!0:window.confirm(`You have unsaved changes. Discard and leave?`)},attach(){window.addEventListener(`beforeunload`,t)},detach(){window.removeEventListener(`beforeunload`,t)},dirtyFields(){return[...e]}}}function m(e,t,n){return e[t]??n}function h(e,n,r,i,a){let o=m(e,n,void 0),s=a?.step??`1`,c=s.includes(`.`)?s.split(`.`)[1].length:0,l=o===void 0?``:(c>0?Number(Number(o).toFixed(c)):o).toString(),u=a?.id??`field-${n.replace(/\./g,`-`)}`;return t`

package/node_modules/@comis/web/dist/assets/{agent-list-BEhni2ea.js → agent-list-DQ6g2Rcx.js}

@@ -1,4 +1,4 @@
-import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import{a as u,i as d}from"./index-CBr0Tm9_.js";import"./ic-tag-CvMVQFRR.js";import"./ic-confirm-dialog-DGlPbV1T.js";import"./ic-data-table-CKIvr-ag.js";import"./ic-search-input-B02AGw1i.js";import"./ic-icon-BGNCCPpZ.js";import"./ic-empty-state-CM3Wbj2f.js";var f={active:`success`,idle:`info`,suspended:`warning`,error:`error`},p={active:`Active`,idle:`Idle`,suspended:`Suspended`,error:`Error`},m=[{value:`active`,label:`Active`,color:`var(--ic-success)`},{value:`idle`,label:`Idle`,color:`var(--ic-info)`},{value:`suspended`,label:`Suspended`,color:`var(--ic-warning)`},{value:`error`,label:`Error`,color:`var(--ic-error)`}],h=new Intl.NumberFormat(`en-US`,{style:`currency`,currency:`USD`}),g={minimal:`Read and write only. Safest option for restricted environments.`,coding:`Common tools including web, memory, and file operations.`,messaging:`Optimized for chat and messaging workflows.`,supervisor:`Extended tools for agent orchestration and oversight.`,full:`All available tools. Best for autonomous agents with broad capabilities.`},_=class extends r{constructor(...e){super(...e),this.apiClient=null,this.rpcClient=null,this.eventDispatcher=null,this._sse=null,this._reloadDebounce=null,this._agents=[],this._loadState=`loading`,this._error=``,this._deleteTarget=null,this._actionPending=``,this._searchQuery=``,this._statusFilters=new Set,this._wizardOpen=!1,this._wizardStep=1,this._wizardError=``,this._wizardCreating=!1,this._wizardAgentId=``,this._wizardAgentName=``,this._wizardProvider=`anthropic`,this._wizardModel=``,this._wizardToolProfile=`full`,this._catalogProviders=[]}static{this.styles=[o,i,n`
+import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import{a as u,i as d}from"./index-8Tg9oc-C.js";import"./ic-tag-CvMVQFRR.js";import"./ic-confirm-dialog-DGlPbV1T.js";import"./ic-data-table-CKIvr-ag.js";import"./ic-search-input-B02AGw1i.js";import"./ic-icon-BGNCCPpZ.js";import"./ic-empty-state-CM3Wbj2f.js";var f={active:`success`,idle:`info`,suspended:`warning`,error:`error`},p={active:`Active`,idle:`Idle`,suspended:`Suspended`,error:`Error`},m=[{value:`active`,label:`Active`,color:`var(--ic-success)`},{value:`idle`,label:`Idle`,color:`var(--ic-info)`},{value:`suspended`,label:`Suspended`,color:`var(--ic-warning)`},{value:`error`,label:`Error`,color:`var(--ic-error)`}],h=new Intl.NumberFormat(`en-US`,{style:`currency`,currency:`USD`}),g={minimal:`Read and write only. Safest option for restricted environments.`,coding:`Common tools including web, memory, and file operations.`,messaging:`Optimized for chat and messaging workflows.`,supervisor:`Extended tools for agent orchestration and oversight.`,full:`All available tools. Best for autonomous agents with broad capabilities.`},_=class extends r{constructor(...e){super(...e),this.apiClient=null,this.rpcClient=null,this.eventDispatcher=null,this._sse=null,this._reloadDebounce=null,this._agents=[],this._loadState=`loading`,this._error=``,this._deleteTarget=null,this._actionPending=``,this._searchQuery=``,this._statusFilters=new Set,this._wizardOpen=!1,this._wizardStep=1,this._wizardError=``,this._wizardCreating=!1,this._wizardAgentId=``,this._wizardAgentName=``,this._wizardProvider=`anthropic`,this._wizardModel=``,this._wizardToolProfile=`full`,this._catalogProviders=[]}static{this.styles=[o,i,n`
       :host {
         display: block;
       }

package/node_modules/@comis/web/dist/assets/{billing-view-DVP1IvVs.js → billing-view-IWPR8LgF.js}

@@ -1,4 +1,4 @@
-import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import{i as u}from"./index-CBr0Tm9_.js";import"./ic-empty-state-CM3Wbj2f.js";import"./ic-time-range-picker-DXbYeBmY.js";var d=class extends r{constructor(...e){super(...e),this.segments=[],this.total=0,this.currency=`$`}static{this.styles=[o,n`
+import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import{i as u}from"./index-8Tg9oc-C.js";import"./ic-empty-state-CM3Wbj2f.js";import"./ic-time-range-picker-DXbYeBmY.js";var d=class extends r{constructor(...e){super(...e),this.segments=[],this.total=0,this.currency=`$`}static{this.styles=[o,n`
       :host {
         display: block;
       }

package/node_modules/@comis/web/dist/assets/{channel-detail-N_YK74xC.js → channel-detail-DlNNZuuC.js}

@@ -1,4 +1,4 @@
-import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import{a as u,i as d}from"./index-CBr0Tm9_.js";import"./ic-breadcrumb-DqN6G3gc.js";import"./ic-tag-CvMVQFRR.js";import"./ic-relative-time-B3UAnTqg.js";import"./ic-icon-BGNCCPpZ.js";import"./ic-empty-state-CM3Wbj2f.js";import"./ic-tabs-yBjkWKJH.js";import"./ic-connection-dot-CXyhlJup.js";var f=[{key:`transcribeAudio`,label:`Voice Transcription`,description:`Transcribe inbound audio/voice attachments to text (STT)`},{key:`analyzeImages`,label:`Image Analysis`,description:`Analyze inbound images using vision AI`},{key:`describeVideos`,label:`Video Description`,description:`Generate text descriptions of inbound video attachments`},{key:`extractDocuments`,label:`Document Extraction`,description:`Extract text from PDF, CSV, and other document attachments`},{key:`understandLinks`,label:`Link Understanding`,description:`Fetch and inject content from URLs in message text`}],p={telegram:[{key:`botToken`,label:`Bot Token`,type:`secret`},{key:`webhookUrl`,label:`Webhook URL`,type:`text`,placeholder:`https://...`},{key:`ackReaction.enabled`,label:`Ack Reaction`,type:`toggle`},{key:`ackReaction.emoji`,label:`Ack Emoji`,type:`text`,placeholder:`👀`}],discord:[{key:`botToken`,label:`Bot Token`,type:`secret`},{key:`guildId`,label:`Guild ID`,type:`text`}],slack:[{key:`botToken`,label:`Bot Token`,type:`secret`},{key:`appToken`,label:`App Token`,type:`secret`},{key:`signingSecret`,label:`Signing Secret`,type:`secret`},{key:`mode`,label:`Mode`,type:`select`,options:[`socket`,`http`]}],whatsapp:[{key:`authDir`,label:`Auth Directory`,type:`text`},{key:`printQR`,label:`Print QR Code`,type:`toggle`}],line:[{key:`channelSecret`,label:`Channel Secret`,type:`secret`},{key:`webhookPath`,label:`Webhook Path`,type:`text`,placeholder:`/webhooks/line`}],signal:[{key:`baseUrl`,label:`Base URL`,type:`text`,placeholder:`http://127.0.0.1:8080`},{key:`account`,label:`Account`,type:`text`},{key:`cliPath`,label:`CLI Path`,type:`text`}],irc:[{key:`host`,label:`Host`,type:`text`},{key:`port`,label:`Port`,type:`text`},{key:`nick`,label:`Nick`,type:`text`},{key:`tls`,label:`TLS`,type:`toggle`},{key:`nickservPassword`,label:`NickServ Password`,type:`secret`},{key:`channels`,label:`Channels`,type:`list`}],imessage:[{key:`binaryPath`,label:`Binary Path`,type:`text`},{key:`account`,label:`Account`,type:`text`}]};function m(e){return e?e.charAt(0).toUpperCase()+e.slice(1):``}function h(e,t){return t.split(`.`).reduce((e,t)=>typeof e==`object`&&e?e[t]:void 0,e)}var g=class extends r{constructor(...e){super(...e),this.apiClient=null,this.rpcClient=null,this.eventDispatcher=null,this.channelType=``,this._loadState=`loading`,this._error=``,this._config={},this._enabled=!1,this._status=`disconnected`,this._deliveryTrace=[],this._activityData=[],this._channelLastActiveAt=0,this._channelMessagesSent=0,this._channelMessagesReceived=0,this._connectionMode=``,this._lastError=``,this._actionPending=!1,this._queueStatus=null,this._capabilities=null,this._mediaProcessing={transcribeAudio:!0,analyzeImages:!0,describeVideos:!0,extractDocuments:!0,understandLinks:!0},this._sse=null,this._reloadDebounce=null,this._hasLoaded=!1,this._previousChannelType=``}static{this.styles=[o,i,n`
+import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import{a as u,i as d}from"./index-8Tg9oc-C.js";import"./ic-breadcrumb-DqN6G3gc.js";import"./ic-tag-CvMVQFRR.js";import"./ic-relative-time-B3UAnTqg.js";import"./ic-icon-BGNCCPpZ.js";import"./ic-empty-state-CM3Wbj2f.js";import"./ic-tabs-yBjkWKJH.js";import"./ic-connection-dot-y77LZ3Gu.js";var f=[{key:`transcribeAudio`,label:`Voice Transcription`,description:`Transcribe inbound audio/voice attachments to text (STT)`},{key:`analyzeImages`,label:`Image Analysis`,description:`Analyze inbound images using vision AI`},{key:`describeVideos`,label:`Video Description`,description:`Generate text descriptions of inbound video attachments`},{key:`extractDocuments`,label:`Document Extraction`,description:`Extract text from PDF, CSV, and other document attachments`},{key:`understandLinks`,label:`Link Understanding`,description:`Fetch and inject content from URLs in message text`}],p={telegram:[{key:`botToken`,label:`Bot Token`,type:`secret`},{key:`webhookUrl`,label:`Webhook URL`,type:`text`,placeholder:`https://...`},{key:`ackReaction.enabled`,label:`Ack Reaction`,type:`toggle`},{key:`ackReaction.emoji`,label:`Ack Emoji`,type:`text`,placeholder:`👀`}],discord:[{key:`botToken`,label:`Bot Token`,type:`secret`},{key:`guildId`,label:`Guild ID`,type:`text`}],slack:[{key:`botToken`,label:`Bot Token`,type:`secret`},{key:`appToken`,label:`App Token`,type:`secret`},{key:`signingSecret`,label:`Signing Secret`,type:`secret`},{key:`mode`,label:`Mode`,type:`select`,options:[`socket`,`http`]}],whatsapp:[{key:`authDir`,label:`Auth Directory`,type:`text`},{key:`printQR`,label:`Print QR Code`,type:`toggle`}],line:[{key:`channelSecret`,label:`Channel Secret`,type:`secret`},{key:`webhookPath`,label:`Webhook Path`,type:`text`,placeholder:`/webhooks/line`}],signal:[{key:`baseUrl`,label:`Base URL`,type:`text`,placeholder:`http://127.0.0.1:8080`},{key:`account`,label:`Account`,type:`text`},{key:`cliPath`,label:`CLI Path`,type:`text`}],irc:[{key:`host`,label:`Host`,type:`text`},{key:`port`,label:`Port`,type:`text`},{key:`nick`,label:`Nick`,type:`text`},{key:`tls`,label:`TLS`,type:`toggle`},{key:`nickservPassword`,label:`NickServ Password`,type:`secret`},{key:`channels`,label:`Channels`,type:`list`}],imessage:[{key:`binaryPath`,label:`Binary Path`,type:`text`},{key:`account`,label:`Account`,type:`text`}]};function m(e){return e?e.charAt(0).toUpperCase()+e.slice(1):``}function h(e,t){return t.split(`.`).reduce((e,t)=>typeof e==`object`&&e?e[t]:void 0,e)}var g=class extends r{constructor(...e){super(...e),this.apiClient=null,this.rpcClient=null,this.eventDispatcher=null,this.channelType=``,this._loadState=`loading`,this._error=``,this._config={},this._enabled=!1,this._status=`disconnected`,this._deliveryTrace=[],this._activityData=[],this._channelLastActiveAt=0,this._channelMessagesSent=0,this._channelMessagesReceived=0,this._connectionMode=``,this._lastError=``,this._actionPending=!1,this._queueStatus=null,this._capabilities=null,this._mediaProcessing={transcribeAudio:!0,analyzeImages:!0,describeVideos:!0,extractDocuments:!0,understandLinks:!0},this._sse=null,this._reloadDebounce=null,this._hasLoaded=!1,this._previousChannelType=``}static{this.styles=[o,i,n`
       :host {
         display: block;
       }

package/node_modules/@comis/web/dist/assets/{channel-list-DRk6ZJaF.js → channel-list-DhGwxiMc.js}

@@ -1,4 +1,4 @@
-import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import{a as u,i as d,n as f,r as p,t as m}from"./index-CBr0Tm9_.js";import"./ic-confirm-dialog-DGlPbV1T.js";import"./ic-empty-state-CM3Wbj2f.js";var h=class extends r{constructor(...e){super(...e),this.channelType=``,this.name=``,this.status=`disconnected`,this.enabled=!1,this.isStale=!1,this.messageCount=0,this.uptime=0,this.lastActivity=0}static{this.styles=[o,i,n`
+import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import{a as u,i as d,n as f,r as p,t as m}from"./index-8Tg9oc-C.js";import"./ic-confirm-dialog-DGlPbV1T.js";import"./ic-empty-state-CM3Wbj2f.js";var h=class extends r{constructor(...e){super(...e),this.channelType=``,this.name=``,this.status=`disconnected`,this.enabled=!1,this.isStale=!1,this.messageCount=0,this.uptime=0,this.lastActivity=0}static{this.styles=[o,i,n`
       :host {
         display: block;
         min-width: 280px;

package/node_modules/@comis/web/dist/assets/{chat-console-Dm-GtSf9.js → chat-console-Nv6fM3Rc.js}

@@ -1,4 +1,4 @@
-import{a as e,c as t,f as n,h as r,l as i,n as a,o,r as s,s as c,t as l,u}from"./decorate-BvWYovGE.js";import{a as d}from"./index-CBr0Tm9_.js";import"./ic-tag-CvMVQFRR.js";import"./ic-relative-time-B3UAnTqg.js";import"./ic-search-input-B02AGw1i.js";import"./ic-icon-BGNCCPpZ.js";import"./ic-empty-state-CM3Wbj2f.js";import{n as f,r as p}from"./session-key-parser-Dkqcj2Ss.js";import{n as m,r as h}from"./ic-tool-call-DNmwTjek.js";import"./ic-chat-message-DfSERzzg.js";import"./ic-budget-segment-bar-zLsMzjDO.js";var g=class extends i{constructor(...e){super(...e),this.sessions=[],this.selectedKey=``,this.filter=``,this.open=!1}static{this.styles=[s,a,r`
+import{a as e,c as t,f as n,h as r,l as i,n as a,o,r as s,s as c,t as l,u}from"./decorate-BvWYovGE.js";import{a as d}from"./index-8Tg9oc-C.js";import"./ic-tag-CvMVQFRR.js";import"./ic-relative-time-B3UAnTqg.js";import"./ic-search-input-B02AGw1i.js";import"./ic-icon-BGNCCPpZ.js";import"./ic-empty-state-CM3Wbj2f.js";import{n as f,r as p}from"./session-key-parser-Dkqcj2Ss.js";import{n as m,r as h}from"./ic-tool-call-qt6w1NQl.js";import"./ic-chat-message-BFt3cVpx.js";import"./ic-budget-segment-bar-zLsMzjDO.js";var g=class extends i{constructor(...e){super(...e),this.sessions=[],this.selectedKey=``,this.filter=``,this.open=!1}static{this.styles=[s,a,r`
       :host {
         display: block;
       }

package/node_modules/@comis/web/dist/assets/{config-editor-CIferYX6.js → config-editor-BYKuJF76.js}

@@ -1,4 +1,4 @@
-import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import{a as u}from"./index-CBr0Tm9_.js";import"./ic-tag-CvMVQFRR.js";import"./ic-confirm-dialog-DGlPbV1T.js";import"./ic-relative-time-B3UAnTqg.js";import"./ic-array-editor-BLoEyeLS.js";import"./ic-empty-state-CM3Wbj2f.js";import"./ic-tabs-yBjkWKJH.js";import"./ic-select-BqfZISjw.js";function d(e,t){let n=e.split(`
+import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import{a as u}from"./index-8Tg9oc-C.js";import"./ic-tag-CvMVQFRR.js";import"./ic-confirm-dialog-DGlPbV1T.js";import"./ic-relative-time-B3UAnTqg.js";import"./ic-array-editor-BLoEyeLS.js";import"./ic-empty-state-CM3Wbj2f.js";import"./ic-tabs-yBjkWKJH.js";import"./ic-select-BqfZISjw.js";function d(e,t){let n=e.split(`
 `),r=t.split(`
 `),i=n.length,a=r.length,o=Array.from({length:i+1},()=>Array(a+1).fill(0));for(let e=1;e<=i;e++)for(let t=1;t<=a;t++)n[e-1]===r[t-1]?o[e][t]=o[e-1][t-1]+1:o[e][t]=Math.max(o[e-1][t],o[e][t-1]);let s=i,c=a,l=[],u=[];for(;s>0||c>0;)s>0&&c>0&&n[s-1]===r[c-1]?(l.push({text:n[s-1],status:`unchanged`}),u.push({text:r[c-1],status:`unchanged`}),s--,c--):c>0&&(s===0||o[s][c-1]>=o[s-1][c])?(u.push({text:r[c-1],status:`added`}),l.push({text:``,status:`unchanged`}),c--):(l.push({text:n[s-1],status:`removed`}),u.push({text:``,status:`unchanged`}),s--);return l.reverse(),u.reverse(),{oldLines:l,newLines:u}}var f=class extends r{constructor(...e){super(...e),this.oldText=``,this.newText=``,this.oldLabel=`Current`,this.newLabel=`Pending`,this._syncing=!1}static{this.styles=[o,i,n`
       :host {

package/node_modules/@comis/web/dist/assets/{context-dag-browser-CL84rXXM.js → context-dag-browser-ClNEtzYE.js}

@@ -1,4 +1,4 @@
-import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import"./index-CBr0Tm9_.js";import"./ic-tag-CvMVQFRR.js";import"./ic-relative-time-B3UAnTqg.js";import"./ic-search-input-B02AGw1i.js";import"./ic-empty-state-CM3Wbj2f.js";import"./ic-detail-panel-DiCe4hLr.js";var u=class extends r{constructor(...e){super(...e),this.rpcClient=null,this._loadState=`loading`,this._conversations=[],this._selectedConvId=null,this._treeNodes=[],this._treeMessageCount=0,this._expanded=new Set,this._searchQuery=``,this._searchResults=[],this._inspectedNode=null,this._detailOpen=!1,this._treeLoading=!1,this._searchLoading=!1,this._errorMsg=``,this._searchTimeout=null,this._rpcClientInitialized=!1}static{this.styles=[o,i,n`
+import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import"./index-8Tg9oc-C.js";import"./ic-tag-CvMVQFRR.js";import"./ic-relative-time-B3UAnTqg.js";import"./ic-search-input-B02AGw1i.js";import"./ic-empty-state-CM3Wbj2f.js";import"./ic-detail-panel-DiCe4hLr.js";var u=class extends r{constructor(...e){super(...e),this.rpcClient=null,this._loadState=`loading`,this._conversations=[],this._selectedConvId=null,this._treeNodes=[],this._treeMessageCount=0,this._expanded=new Set,this._searchQuery=``,this._searchResults=[],this._inspectedNode=null,this._detailOpen=!1,this._treeLoading=!1,this._searchLoading=!1,this._errorMsg=``,this._searchTimeout=null,this._rpcClientInitialized=!1}static{this.styles=[o,i,n`
       :host {
         display: block;
       }

package/node_modules/@comis/web/dist/assets/{context-engine-B1HOTEZv.js → context-engine-BZJ6HChd.js}

@@ -1,4 +1,4 @@
-import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import{i as u}from"./index-CBr0Tm9_.js";import"./ic-relative-time-B3UAnTqg.js";import"./ic-empty-state-CM3Wbj2f.js";import"./ic-budget-segment-bar-zLsMzjDO.js";import"./ic-layer-waterfall-WkaFyu-l.js";var d={file_read:`var(--ic-accent)`,exec:`var(--ic-success)`,web:`var(--ic-info, #3b82f6)`,image:`var(--ic-warning)`,error:`var(--ic-error)`},f=`var(--ic-text-dim)`,p=class extends r{constructor(...e){super(...e),this.categories={},this.showLegend=!0}static{this.styles=[o,n`
+import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import{i as u}from"./index-8Tg9oc-C.js";import"./ic-relative-time-B3UAnTqg.js";import"./ic-empty-state-CM3Wbj2f.js";import"./ic-budget-segment-bar-zLsMzjDO.js";import"./ic-layer-waterfall-WkaFyu-l.js";var d={file_read:`var(--ic-accent)`,exec:`var(--ic-success)`,web:`var(--ic-info, #3b82f6)`,image:`var(--ic-warning)`,error:`var(--ic-error)`},f=`var(--ic-text-dim)`,p=class extends r{constructor(...e){super(...e),this.categories={},this.showLegend=!0}static{this.styles=[o,n`
       :host {
         display: block;
       }

package/node_modules/@comis/web/dist/assets/{delivery-view-Y6JKYVFw.js → delivery-view-Cb7I3vGu.js}

@@ -1,4 +1,4 @@
-import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import"./index-CBr0Tm9_.js";import"./ic-relative-time-B3UAnTqg.js";import"./ic-empty-state-CM3Wbj2f.js";import"./ic-time-range-picker-DXbYeBmY.js";import"./ic-detail-panel-DiCe4hLr.js";import"./ic-delivery-row-B3YwjjuM.js";function u(e){return e>=1e3?`${(e/1e3).toFixed(1)}s`:`${e}ms`}var d=class extends r{constructor(...e){super(...e),this.steps=[],this.totalDurationMs=0}static{this.styles=[o,n`
+import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import"./index-8Tg9oc-C.js";import"./ic-relative-time-B3UAnTqg.js";import"./ic-empty-state-CM3Wbj2f.js";import"./ic-time-range-picker-DXbYeBmY.js";import"./ic-detail-panel-DiCe4hLr.js";import"./ic-delivery-row-B3YwjjuM.js";function u(e){return e>=1e3?`${(e/1e3).toFixed(1)}s`:`${e}ms`}var d=class extends r{constructor(...e){super(...e),this.steps=[],this.totalDurationMs=0}static{this.styles=[o,n`
       :host {
         display: block;
       }

package/node_modules/@comis/web/dist/assets/{diagnostics-view-DWV1UQjz.js → diagnostics-view-9u9Lyu5a.js}

@@ -1,4 +1,4 @@
-import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import{n as u,t as d}from"./observability-types-D0tkwElU.js";import{i as f}from"./index-CBr0Tm9_.js";import"./ic-tag-CvMVQFRR.js";import"./ic-relative-time-B3UAnTqg.js";import"./ic-empty-state-CM3Wbj2f.js";import"./ic-time-range-picker-DXbYeBmY.js";var p=3e4,m=6048e5,h={info:`var(--ic-text-dim)`,warn:`var(--ic-warning)`,error:`var(--ic-error)`},g=class extends r{constructor(...e){super(...e),this.rpcClient=null,this.eventDispatcher=null,this._sse=null,this._reloadDebounce=null,this._loadState=`loading`,this._sinceMs=m,this._selectedRange=`7d`,this._events=[],this._selectedCategories=new Set,this._selectedSeverities=new Set,this._eventCounts={},this._refreshInterval=null,this._rpcStatusUnsub=null}static{this.styles=[o,i,n`
+import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import{n as u,t as d}from"./observability-types-D0tkwElU.js";import{i as f}from"./index-8Tg9oc-C.js";import"./ic-tag-CvMVQFRR.js";import"./ic-relative-time-B3UAnTqg.js";import"./ic-empty-state-CM3Wbj2f.js";import"./ic-time-range-picker-DXbYeBmY.js";var p=3e4,m=6048e5,h={info:`var(--ic-text-dim)`,warn:`var(--ic-warning)`,error:`var(--ic-error)`},g=class extends r{constructor(...e){super(...e),this.rpcClient=null,this.eventDispatcher=null,this._sse=null,this._reloadDebounce=null,this._loadState=`loading`,this._sinceMs=m,this._selectedRange=`7d`,this._events=[],this._selectedCategories=new Set,this._selectedSeverities=new Set,this._eventCounts={},this._refreshInterval=null,this._rpcStatusUnsub=null}static{this.styles=[o,i,n`
       :host { display: block; }
 
       .diagnostics-view { padding: 0; }

package/node_modules/@comis/web/dist/assets/{ic-chat-message-DfSERzzg.js → ic-chat-message-BFt3cVpx.js}

@@ -1,4 +1,4 @@
-import{c as e,d as t,f as n,h as r,l as i,n as a,o,r as s,s as c,t as l,u}from"./decorate-BvWYovGE.js";import{a as d}from"./index-CBr0Tm9_.js";import"./ic-icon-BGNCCPpZ.js";import{n as f,r as p,t as m}from"./directive-BOYXJ-K-.js";var h=class extends f{constructor(e){if(super(e),this.it=u,e.type!==p.CHILD)throw Error(this.constructor.directiveName+`() can only be used in child bindings`)}render(e){if(e===u||e==null)return this._t=void 0,this.it=e;if(e===t)return e;if(typeof e!=`string`)throw Error(this.constructor.directiveName+`() called with a non-string value`);if(e===this.it)return this._t;this.it=e;let n=[e];return n.raw=n,this._t={_$litType$:this.constructor.resultType,strings:n,values:[]}}};h.directiveName=`unsafeHTML`,h.resultType=1;var g=m(h),_=new Set(`const.let.var.function.return.if.else.for.while.import.export.from.true.false.null.undefined.class.new.this.async.await.throw.try.catch.switch.case.break.continue.default.typeof.instanceof.void.delete.in.of.yield.static.extends.implements.interface.type.enum.abstract.readonly`.split(`.`));function v(e){return e.replace(/&/g,`&amp;`).replace(/</g,`&lt;`).replace(/>/g,`&gt;`).replace(/"/g,`&quot;`)}function y(e,t){if(!t)return v(e);let n=t.toLowerCase(),r=v(e);return r=r.replace(/\/\*[\s\S]*?\*\//g,e=>`<span class="hl-comment">${e}</span>`),r=r.replace(/\/\/[^\n]*/g,e=>e.includes(`hl-comment`)?e:`<span class="hl-comment">${e}</span>`),(n===`yaml`||n===`yml`||n===`bash`||n===`sh`||n===`python`||n===`py`)&&(r=r.replace(/(?:^|(?<=\n))(\s*#[^\n]*)/g,e=>`<span class="hl-comment">${e}</span>`)),r=r.replace(/(?<!<span class=")(&quot;(?:[^&]|&(?!quot;))*?&quot;)/g,e=>e.includes(`hl-`)?e:`<span class="hl-string">${e}</span>`),r=r.replace(/(?<![=\w])('[^'\\]*(?:\\.[^'\\]*)*')/g,e=>e.includes(`hl-`)?e:`<span class="hl-string">${e}</span>`),r=r.replace(/\b(\d+(?:\.\d+)?)\b/g,e=>e.includes(`hl-`)?e:`<span class="hl-number">${e}</span>`),(n===`json`||n===`yaml`||n===`yml`)&&(r=r.replace(/(?:^|(?<=\n))(\s*)(&quot;[\w.-]+&quot;)(\s*:)/gm,(e,t,n,r)=>`${t}<span class="hl-property">${n}</span>${r}`),(n===`yaml`||n===`yml`)&&(r=r.replace(/(?:^|(?<=\n))(\s*)([\w.-]+)(\s*:)/gm,(e,t,n,r)=>n.includes(`hl-`)?e:`${t}<span class="hl-property">${n}</span>${r}`))),(n===`javascript`||n===`js`||n===`typescript`||n===`ts`||n===`jsx`||n===`tsx`)&&(r=r.replace(/\b([a-z]+)\b/g,e=>_.has(e)?`<span class="hl-keyword">${e}</span>`:e)),r}var b=class extends i{constructor(...e){super(...e),this.code=``,this.language=``,this.copyable=!0,this._copied=!1,this._copyTimer=null}static{this.styles=[s,a,r`
+import{c as e,d as t,f as n,h as r,l as i,n as a,o,r as s,s as c,t as l,u}from"./decorate-BvWYovGE.js";import{a as d}from"./index-8Tg9oc-C.js";import"./ic-icon-BGNCCPpZ.js";import{n as f,r as p,t as m}from"./directive-BOYXJ-K-.js";var h=class extends f{constructor(e){if(super(e),this.it=u,e.type!==p.CHILD)throw Error(this.constructor.directiveName+`() can only be used in child bindings`)}render(e){if(e===u||e==null)return this._t=void 0,this.it=e;if(e===t)return e;if(typeof e!=`string`)throw Error(this.constructor.directiveName+`() called with a non-string value`);if(e===this.it)return this._t;this.it=e;let n=[e];return n.raw=n,this._t={_$litType$:this.constructor.resultType,strings:n,values:[]}}};h.directiveName=`unsafeHTML`,h.resultType=1;var g=m(h),_=new Set(`const.let.var.function.return.if.else.for.while.import.export.from.true.false.null.undefined.class.new.this.async.await.throw.try.catch.switch.case.break.continue.default.typeof.instanceof.void.delete.in.of.yield.static.extends.implements.interface.type.enum.abstract.readonly`.split(`.`));function v(e){return e.replace(/&/g,`&amp;`).replace(/</g,`&lt;`).replace(/>/g,`&gt;`).replace(/"/g,`&quot;`)}function y(e,t){if(!t)return v(e);let n=t.toLowerCase(),r=v(e);return r=r.replace(/\/\*[\s\S]*?\*\//g,e=>`<span class="hl-comment">${e}</span>`),r=r.replace(/\/\/[^\n]*/g,e=>e.includes(`hl-comment`)?e:`<span class="hl-comment">${e}</span>`),(n===`yaml`||n===`yml`||n===`bash`||n===`sh`||n===`python`||n===`py`)&&(r=r.replace(/(?:^|(?<=\n))(\s*#[^\n]*)/g,e=>`<span class="hl-comment">${e}</span>`)),r=r.replace(/(?<!<span class=")(&quot;(?:[^&]|&(?!quot;))*?&quot;)/g,e=>e.includes(`hl-`)?e:`<span class="hl-string">${e}</span>`),r=r.replace(/(?<![=\w])('[^'\\]*(?:\\.[^'\\]*)*')/g,e=>e.includes(`hl-`)?e:`<span class="hl-string">${e}</span>`),r=r.replace(/\b(\d+(?:\.\d+)?)\b/g,e=>e.includes(`hl-`)?e:`<span class="hl-number">${e}</span>`),(n===`json`||n===`yaml`||n===`yml`)&&(r=r.replace(/(?:^|(?<=\n))(\s*)(&quot;[\w.-]+&quot;)(\s*:)/gm,(e,t,n,r)=>`${t}<span class="hl-property">${n}</span>${r}`),(n===`yaml`||n===`yml`)&&(r=r.replace(/(?:^|(?<=\n))(\s*)([\w.-]+)(\s*:)/gm,(e,t,n,r)=>n.includes(`hl-`)?e:`${t}<span class="hl-property">${n}</span>${r}`))),(n===`javascript`||n===`js`||n===`typescript`||n===`ts`||n===`jsx`||n===`tsx`)&&(r=r.replace(/\b([a-z]+)\b/g,e=>_.has(e)?`<span class="hl-keyword">${e}</span>`:e)),r}var b=class extends i{constructor(...e){super(...e),this.code=``,this.language=``,this.copyable=!0,this._copied=!1,this._copyTimer=null}static{this.styles=[s,a,r`
       :host {
         display: block;
       }

package/node_modules/@comis/web/dist/assets/{ic-connection-dot-CXyhlJup.js → ic-connection-dot-y77LZ3Gu.js}

@@ -1,4 +1,4 @@
-import{c as e,f as t,h as n,l as r,r as i,s as a,t as o}from"./decorate-BvWYovGE.js";import{t as s}from"./index-CBr0Tm9_.js";import"./ic-icon-BGNCCPpZ.js";var c=class extends r{constructor(...e){super(...e),this.status=`disconnected`,this.size=`8px`,this.showLabel=!0}static{this.styles=[i,n`
+import{c as e,f as t,h as n,l as r,r as i,s as a,t as o}from"./decorate-BvWYovGE.js";import{t as s}from"./index-8Tg9oc-C.js";import"./ic-icon-BGNCCPpZ.js";var c=class extends r{constructor(...e){super(...e),this.status=`disconnected`,this.size=`8px`,this.showLabel=!0}static{this.styles=[i,n`
       :host {
         display: inline-flex;
         align-items: center;

package/node_modules/@comis/web/dist/assets/{ic-tool-call-DNmwTjek.js → ic-tool-call-qt6w1NQl.js}

@@ -1,4 +1,4 @@
-import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import"./index-CBr0Tm9_.js";import"./ic-icon-BGNCCPpZ.js";import"./ic-chat-message-DfSERzzg.js";function u(e){return e.replace(/\b(?:NO_REPLY|HEARTBEAT_OK)\b/g,``).trim()}function d(e){if(!e.includes(`[System context]`)&&!e.includes(`[End system context]`))return e;let t=e.lastIndexOf(`[End system context]`);if(t===-1)return e;let n=e.slice(t+20),r=n.match(/\s*\[[\w-]+\]\s+\S+\s+\([^)]*\):\s*/);if(r){let e=n.indexOf(r[0])+r[0].length;return n.slice(e).trim()}return n.trim()}function f(e,t){return t===`assistant`?u(e):t===`user`?d(e):e}function p(e){if(e==null)return``;if(typeof e==`string`)return e;try{return JSON.stringify(e,null,2)}catch{return String(e)}}var m=class extends r{constructor(...e){super(...e),this.toolName=``,this.input=null,this.output=null,this.expanded=!1,this.status=`success`,this._showFullOutput=!1}static{this.styles=[o,i,n`
+import{c as e,f as t,h as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./decorate-BvWYovGE.js";import"./index-8Tg9oc-C.js";import"./ic-icon-BGNCCPpZ.js";import"./ic-chat-message-BFt3cVpx.js";function u(e){return e.replace(/\b(?:NO_REPLY|HEARTBEAT_OK)\b/g,``).trim()}function d(e){if(!e.includes(`[System context]`)&&!e.includes(`[End system context]`))return e;let t=e.lastIndexOf(`[End system context]`);if(t===-1)return e;let n=e.slice(t+20),r=n.match(/\s*\[[\w-]+\]\s+\S+\s+\([^)]*\):\s*/);if(r){let e=n.indexOf(r[0])+r[0].length;return n.slice(e).trim()}return n.trim()}function f(e,t){return t===`assistant`?u(e):t===`user`?d(e):e}function p(e){if(e==null)return``;if(typeof e==`string`)return e;try{return JSON.stringify(e,null,2)}catch{return String(e)}}var m=class extends r{constructor(...e){super(...e),this.toolName=``,this.input=null,this.output=null,this.expanded=!1,this.status=`success`,this._showFullOutput=!1}static{this.styles=[o,i,n`
       :host {
         display: block;
       }