comisai 1.0.33 → 1.0.36

package/node_modules/@comis/agent/dist/executor/cache-break-detection.js

@@ -2,10 +2,10 @@
 /**
  * Cache break detection module: two-phase detection with Anthropic adapter.
  *
- * Phase 1 (pre-call): Records prompt state via provider-specific adapter
+ * Pre-call: Records prompt state via provider-specific adapter
  * (system hash, per-tool schema hashes, cache_control metadata hash).
  *
- * Phase 2 (post-call): Compares cacheRead tokens against baseline using
+ * Post-call: Compares cacheRead tokens against baseline using
  * AND-based dual threshold (both >5% relative AND >2000 absolute must exceed).
  * Provider-agnostic.
  *
@@ -467,18 +467,18 @@ const STANDARD_ANTHROPIC_FIELDS = new Set([
     "betas",
 ]);
 /**
- * Extract prompt state from Anthropic API payload for Phase 1 recording.
+ * Extract prompt state from Anthropic API payload for pre-call recording.
  *
  * CRITICAL: Does NOT mutate the original params object. Creates shallow copies
- * for hashing with cache_control stripped (D-08). Per-tool hashing uses
- * input_schema (D-09).
+ * for hashing with cache_control stripped. Per-tool hashing uses
+ * input_schema.
  */
 export function extractAnthropicPromptState(params, modelId, retention, sessionKey, agentId, headers) {
     // Extract tools (do NOT mutate params)
     const tools = Array.isArray(params.tools)
         ? params.tools
         : [];
-    // Per-tool hashing using input_schema (D-09)
+    // Per-tool hashing using input_schema.
     // Skip server-side tools (tool_search_tool_regex etc.) which lack input_schema.
     const perToolHashes = {};
     const toolNames = [];
@@ -510,7 +510,7 @@ export function extractAnthropicPromptState(params, modelId, retention, sessionK
         return rest;
     });
     const systemHash = computeHash(systemForHash);
-    // Hash cache_control metadata separately (D-08)
+    // Hash cache_control metadata separately
     const cacheMetadata = [
         ...tools.map((t) => t.cache_control).filter(Boolean),
         ...system.map((b) => b.cache_control).filter(Boolean),
@@ -600,7 +600,7 @@ export function extractAnthropicPromptState(params, modelId, retention, sessionK
 // Gemini adapter
 // ---------------------------------------------------------------------------
 /**
- * Extract Gemini-native prompt state for Phase 1 cache break detection.
+ * Extract Gemini-native prompt state for pre-call cache break detection.
  *
  * Gemini payload structure differs from Anthropic:
  * - System prompt: config.systemInstruction (string, not array of blocks)

package/node_modules/@comis/agent/dist/executor/executor-context-engine-setup.d.ts

@@ -17,6 +17,7 @@ import { type ContextEngine } from "../context-engine/index.js";
 import type { TokenAnchor } from "../context-engine/types.js";
 import type { DiscoveryTracker } from "./discovery-tracker.js";
 import type { ExecutionOverrides } from "./types.js";
+import type { OAuthTokenManager } from "../model/oauth-token-manager.js";
 /** Subset of PiExecutorDeps used by context engine setup. */
 export interface ContextEngineSetupDeps {
     logger: ComisLogger;
@@ -28,6 +29,12 @@ export interface ContextEngineSetupDeps {
     getPromptSkillsXml?: () => string;
     contextStore?: import("@comis/memory").ContextStore;
     db?: unknown;
+    /**
+     * Optional OAuth token manager. When provided, compaction LLM
+     * calls route through resolveProviderApiKey for OAuth-eligible providers,
+     * with fallthrough to authStorage for non-OAuth providers.
+     */
+    oauthManager?: OAuthTokenManager;
 }
 /** Parameters for context engine creation. */
 export interface ContextEngineSetupParams {
@@ -80,6 +87,15 @@ export interface ContextEngineSetupResult {
     contextEngine: ContextEngine;
     /** Getter for accumulated transformContext duration in ms */
     getContextEngineDurationMs: () => number;
+    /** Per-execute signature-replay scrub counters. `signatureScrubs`
+     *  bumps once per non-empty scrubber emission; `signatureScrubsToolCallsAffected`
+     *  accumulates the toolCallsAffected field across emissions. Surfaced to
+     *  executor-post-execution.ts so the bookend "Execution complete" INFO log
+     *  carries the per-execute total instead of the per-event INFO emissions. */
+    getSignatureScrubCounters: () => {
+        signatureScrubs: number;
+        signatureScrubsToolCallsAffected: number;
+    };
 }
 /**
  * Create and wire the context engine for a single execution.

package/node_modules/@comis/agent/dist/executor/executor-context-engine-setup.js

@@ -16,6 +16,7 @@ import { ContextEngineConfigSchema, safePath, } from "@comis/core";
 import { createContextEngine } from "../context-engine/index.js";
 import { CHARS_PER_TOKEN_RATIO } from "../context-engine/constants.js";
 import { resolveOperationModel, resolveProviderFamily } from "../model/operation-model-resolver.js";
+import { resolveProviderApiKey } from "../model/resolve-provider-api-key.js";
 import { getBreakpointIndex, getBreakpointIndexMapSize, getSessionLatches, } from "./executor-session-state.js";
 import { shouldDropSignedFields } from "./replay-drift-detector.js";
 import { readFileSync } from "node:fs";
@@ -47,7 +48,7 @@ export function setupContextEngine(params) {
     // consistent decision (cleaner + scrubber must agree). The closure reads
     // the latest model identity each time (handles cycleModel mid-execute).
     // Returns the identity/idle drift only — the kvl tool-defs dimension was
-    // removed in 260428-lm6 in favor of the unconditional latest-message
+    // removed in favor of the unconditional latest-message
     // preserving scrub in signature-replay-scrubber.
     let memoizedDrift;
     const computeDriftIfNeeded = () => {
@@ -85,6 +86,12 @@ export function setupContextEngine(params) {
             return memoizedDrift;
         }
     };
+    // Per-execute counters for the signature-replay scrubber. Live
+    // for the lifetime of this setupContextEngine() call (one per execute()),
+    // so no reset is needed — the closure goes out of scope at execute end and
+    // a fresh setup creates fresh zeroed counters for the next execute.
+    let signatureScrubs = 0;
+    let signatureScrubsToolCallsAffected = 0;
     const contextEngine = createContextEngine(contextEngineConfig, {
         logger: deps.logger,
         eventBus: deps.eventBus,
@@ -110,6 +117,17 @@ export function setupContextEngine(params) {
         getSystemTokensEstimate: getCachedSystemTokensEstimate,
         // G-09: Notify cache break detector when observation masking modifies content
         onContentModified: () => cacheBreakDetector.notifyContentModification(formattedKey),
+        // Accumulate signature-replay scrub counts per-execute. Only
+        // counts emissions that actually scrubbed something (zero-touch turns
+        // are filtered out — they're not a "scrub" in the post-incident-visibility
+        // sense). Sums toolCallsAffected so the bookend "Execution complete" log
+        // carries the post-incident-visibility metric.
+        onSignatureReplayScrubbed: (stats) => {
+            if (stats.scrubbedAssistantMessages > 0) {
+                signatureScrubs++;
+                signatureScrubsToolCallsAffected += stats.toolCallsAffected;
+            }
+        },
         // Provide API-grounded token anchor to context engine pipeline
         getTokenAnchor,
         // Reset anchor when compaction replaces the message array
@@ -146,9 +164,16 @@ export function setupContextEngine(params) {
                     reasoning: model?.reasoning ?? false,
                 };
             },
-            getApiKey: async () => {
-                return (await deps.authStorage.getApiKey(config.provider)) ?? "";
-            },
+            // Route compaction's primary getApiKey through the shared
+            // dispatch helper so OAuth-eligible providers refresh through
+            // OAuthTokenManager + setRuntimeApiKey on every call. Non-OAuth
+            // providers (anthropic, openai, etc.) still fall through to
+            // authStorage.getApiKey unchanged.
+            getApiKey: async () => resolveProviderApiKey(config.provider, {
+                authStorage: deps.authStorage,
+                oauthManager: deps.oauthManager,
+                agentConfig: config,
+            }),
             // Resolve compaction model via 5-level priority chain
             // contextEngineOverrides removed -- invocationOverride path eliminated
             //   Path 1: operationModels.compaction (operator config) -> explicit_config (Level 2)
@@ -171,7 +196,17 @@ export function setupContextEngine(params) {
                             return {
                                 overrideModel: {
                                     model: compactionModel,
-                                    getApiKey: async () => (await deps.authStorage.getApiKey(compactionResolution.provider)) ?? "",
+                                    // Route the override-model getApiKey through
+                                    // the shared dispatch helper. Each callsite passes
+                                    // its OWN providerId — config.provider above for the
+                                    // primary, compactionResolution.provider here for the
+                                    // override — both correctly resolve the right OAuth
+                                    // profile via agentConfig.oauthProfiles[providerId].
+                                    getApiKey: async () => resolveProviderApiKey(compactionResolution.provider, {
+                                        authStorage: deps.authStorage,
+                                        oauthManager: deps.oauthManager,
+                                        agentConfig: config,
+                                    }),
                                 },
                             };
                         }
@@ -314,5 +349,11 @@ export function setupContextEngine(params) {
     return {
         contextEngine,
         getContextEngineDurationMs: () => contextEngineDurationMs,
+        // Expose per-execute signature-replay scrub counters so the
+        // bookend "Execution complete" INFO log can roll them up.
+        getSignatureScrubCounters: () => ({
+            signatureScrubs,
+            signatureScrubsToolCallsAffected,
+        }),
     };
 }

package/node_modules/@comis/agent/dist/executor/executor-post-execution.d.ts

@@ -59,6 +59,17 @@ export interface PostExecutionBridgeResult {
     sessionCacheSavedUsd?: number;
     /** 1.5: Thinking tokens from SDK reasoningTokens field. */
     thinkingTokens?: number;
+    /** Number of pre-LLM-call hash-assertion walks performed (one per turn_start). */
+    hashAssertionsRan?: number;
+    /** Total cross-turn thinking-block hash mismatches surfaced across all walks. */
+    hashAssertionMismatches?: number;
+    /** Bridge-side mirror of the scrub counter (carried through buildBridgeResult
+     *  for symmetry — the canonical per-execute total comes from
+     *  ceSetup.getSignatureScrubCounters() since the scrubber doesn't write to
+     *  bridge metrics; included on this interface so consumers reading the
+     *  bridge-result shape get a coherent type). */
+    signatureScrubs?: number;
+    signatureScrubsToolCallsAffected?: number;
 }
 /** Bridge interface used by post-execution. */
 export interface PostExecutionBridge {
@@ -86,6 +97,10 @@ export interface PostExecutionParams {
     };
     ceSetup: {
         getContextEngineDurationMs(): number;
+        getSignatureScrubCounters(): {
+            signatureScrubs: number;
+            signatureScrubsToolCallsAffected: number;
+        };
     };
     streamSetup: {
         capturedRetention?: {
@@ -108,6 +123,21 @@ export interface PostExecutionParams {
     geminiCacheHit: boolean;
     geminiCachedTokens: number;
     modelTier: string | undefined;
+    /**
+     * Provider used for this execution. Sourced from `resolvedModel.provider` in
+     * pi-executor when available; falls back to `config.provider` when the
+     * misconfig silent-fallback path triggers (resolvedModel undefined). The
+     * fallback value records operator INTENT — the actual provider chosen by
+     * pi-coding-agent's silent-fallback logic is opaque at this layer, and intent
+     * is the more useful signal for operator-side cache-hit-rate segmentation.
+     */
+    provider: string;
+    /**
+     * Provider family derived from `resolveProviderCapabilities(provider).providerFamily`.
+     * One of "anthropic" | "openai" | "google" | "default". Pre-computed at the
+     * call site (pi-executor) so this module stays free of capability-cascade dependencies.
+     */
+    providerFamily: string;
     deferralResult: {
         deferredCount: number;
     };

package/node_modules/@comis/agent/dist/executor/executor-post-execution.js

@@ -139,7 +139,7 @@ export function resetPairedMemoryDedupForTests() {
  * @param params - All inputs needed for post-execution cleanup
  */
 export async function postExecution(params) {
-    const { result, session, sm, config, msg, sessionKey, formattedKey, agentId, executionStartMs, executionId, bridge, unsubscribe, contextEngineRef, ceSetup, streamSetup, getTruncationSummary, getTurnBudgetSummary, executionPlanRef, isOnboarding, geminiCacheHit, geminiCachedTokens, modelTier, deferralResult, mergedCustomTools, deliveredGuides, deps, sessionAdapter, executionCacheRetentionClear, adaptiveRetentionClear, } = params;
+    const { result, session, sm, config, msg, sessionKey, formattedKey, agentId, executionStartMs, executionId, bridge, unsubscribe, contextEngineRef, ceSetup, streamSetup, getTruncationSummary, getTurnBudgetSummary, executionPlanRef, isOnboarding, geminiCacheHit, geminiCachedTokens, modelTier, provider, providerFamily, deferralResult, mergedCustomTools, deliveredGuides, deps, sessionAdapter, executionCacheRetentionClear, adaptiveRetentionClear, } = params;
     unsubscribe();
     // Clear per-execution cache retention to prevent state leakage
     executionCacheRetentionClear();
@@ -235,6 +235,10 @@ export async function postExecution(params) {
     // Truncation summary from bouncer + turn budget summary
     const truncSummary = getTruncationSummary();
     const turnBudgetSummary = getTurnBudgetSummary();
+    // Snapshot the scrub counters once before composing the bookend log so both
+    // fields read from the same observation (the getter is cheap but the
+    // read-twice pattern would still be a micro-divergence risk).
+    const scrubCounters = ceSetup.getSignatureScrubCounters();
     deps.logger.info({
         sessionKey: formattedKey,
         durationMs,
@@ -274,6 +278,8 @@ export async function postExecution(params) {
         geminiCacheHit,
         geminiCachedTokens,
         modelTier,
+        provider,
+        providerFamily,
         deferredCount: deferralResult.deferredCount,
         activeToolCount: mergedCustomTools.length,
         guidesDelivered: deliveredGuides.size,
@@ -282,6 +288,16 @@ export async function postExecution(params) {
         toolFailureRate: (result.stepsExecuted ?? 0) > 0
             ? Math.round(((bridgeResult.failedToolCalls ?? 0) / (result.stepsExecuted ?? 0)) * 100)
             : 0,
+        // Per-execute diagnostic counters rolled up from the two demoted log
+        // sites. Always populated (no `> 0` gate) — `0` is itself meaningful
+        // ("no scrubs/assertions this execute") and gating would lose that
+        // signal. hashAssertions* come from the bridge metrics path;
+        // signatureScrubs* come from ceSetup since the scrubber doesn't write
+        // to bridge state.
+        hashAssertionsRan: bridgeResult.hashAssertionsRan ?? 0,
+        hashAssertionMismatches: bridgeResult.hashAssertionMismatches ?? 0,
+        signatureScrubs: scrubCounters.signatureScrubs,
+        signatureScrubsToolCallsAffected: scrubCounters.signatureScrubsToolCallsAffected,
         ...(bridgeResult.failedTools && bridgeResult.failedTools.length > 0 && { failedTools: bridgeResult.failedTools }),
         truncatedTools: truncSummary.truncatedTools,
         totalTruncatedChars: truncSummary.totalTruncatedChars,

package/node_modules/@comis/agent/dist/executor/executor-prompt-runner.js

@@ -644,7 +644,7 @@ export async function runPrompt(params) {
         // NOTE: Only evaluate bridge.getResult().textEmitted when needed to avoid
         // incrementing mock call counters (budget tests use callCount on getResult).
         const rawResponse = getVisibleAssistantText(session);
-        const needsRecovery = rawResponse === "" || ["NO_REPLY", "HEARTBEAT_OK"].includes(rawResponse.trim());
+        const needsRecovery = rawResponse === "";
         // Find the last user message index to bound empty-response recovery
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         const sessionMessages = session.messages ?? [];

package/node_modules/@comis/agent/dist/executor/executor-response-filter.d.ts

@@ -42,10 +42,15 @@ export declare function scanWithOutputGuard(params: {
     logger: ComisLogger;
 }): OutputGuardScanResult;
 /**
- * When the final assistant message is thinking-only or a
- * silent token (NO_REPLY, HEARTBEAT_OK) but text was emitted in earlier
+ * When the final assistant message is empty but text was emitted in earlier
  * turns, recover a meaningful user-visible response.
  *
+ * Recovery fires only when `extractedResponse === ""`. Silent tokens
+ * (`NO_REPLY`, `HEARTBEAT_OK`) are explicit suppression signals and pass
+ * through unchanged — the channel-layer filter
+ * (`packages/channels/src/shared/response-filter.ts`) detects and suppresses
+ * them downstream.
+ *
  * Two-pass strategy (gated):
  * 1. **Tool-call synthesis** (primary) — if ≥1 prior assistant turn within the
  *    current execution window contains tool-call blocks, synthesize a
@@ -62,10 +67,6 @@ export declare function scanWithOutputGuard(params: {
  * comment below) ensures the standalone walk only fires when no tool calls
  * were observed; this keeps the pass selection mutually exclusive.
  *
- * Suppressed when a delivery tool (`message`, `notify`) was used — the agent
- * already delivered content via side-channel and the silent final token is
- * intentional.
- *
  * Returns the recovered text, or the original response if no recovery needed.
  */
 export declare function recoverEmptyFinalResponse(params: {

package/node_modules/@comis/agent/dist/executor/executor-response-filter.js

@@ -84,16 +84,16 @@ export function scanWithOutputGuard(params) {
 // ---------------------------------------------------------------------------
 /** Silent tokens that indicate the final message has no visible content. */
 const SILENT_FINAL_TOKENS = ["NO_REPLY", "HEARTBEAT_OK"];
-/** Tool names whose successful invocation means the agent already delivered
- *  content to the user through a side-channel. When one of these tools was
- *  called during the execution, a silent final token (NO_REPLY) is intentional
- *  and recovery must be suppressed to avoid leaking internal narration. */
-const DELIVERY_TOOL_NAMES = ["message", "notify"];
 /**
- * When the final assistant message is thinking-only or a
- * silent token (NO_REPLY, HEARTBEAT_OK) but text was emitted in earlier
+ * When the final assistant message is empty but text was emitted in earlier
  * turns, recover a meaningful user-visible response.
  *
+ * Recovery fires only when `extractedResponse === ""`. Silent tokens
+ * (`NO_REPLY`, `HEARTBEAT_OK`) are explicit suppression signals and pass
+ * through unchanged — the channel-layer filter
+ * (`packages/channels/src/shared/response-filter.ts`) detects and suppresses
+ * them downstream.
+ *
  * Two-pass strategy (gated):
  * 1. **Tool-call synthesis** (primary) — if ≥1 prior assistant turn within the
  *    current execution window contains tool-call blocks, synthesize a
@@ -110,29 +110,13 @@ const DELIVERY_TOOL_NAMES = ["message", "notify"];
  * comment below) ensures the standalone walk only fires when no tool calls
  * were observed; this keeps the pass selection mutually exclusive.
  *
- * Suppressed when a delivery tool (`message`, `notify`) was used — the agent
- * already delivered content via side-channel and the silent final token is
- * intentional.
- *
  * Returns the recovered text, or the original response if no recovery needed.
  */
 export function recoverEmptyFinalResponse(params) {
     const { extractedResponse, textEmitted, messages, logger, userMessageIndex } = params;
     const lowerBound = userMessageIndex ?? 0;
-    const isSilentFinalToken = SILENT_FINAL_TOKENS.includes(extractedResponse.trim());
-    if ((extractedResponse === "" || isSilentFinalToken) && textEmitted) {
+    if (extractedResponse === "" && textEmitted) {
         if (Array.isArray(messages)) {
-            // Guard: if the agent already delivered content via a delivery tool
-            // (message, notify), the silent final token is intentional — skip
-            // recovery to avoid leaking internal narration (e.g. "Now let me
-            // generate the chart:" surfaced as a user-visible message).
-            if (isSilentFinalToken && hasDeliveryToolCall(messages, lowerBound)) {
-                logger.debug({
-                    hint: "Silent final token after delivery tool call — recovery suppressed",
-                    extractedResponse,
-                }, "Skipping empty-response recovery (delivery tool used)");
-                return extractedResponse;
-            }
             /* eslint-disable @typescript-eslint/no-explicit-any */
             // Collect tool-call summaries from prior assistant turns within the
             // current execution window (lowerBound .. messages.length).
@@ -170,7 +154,7 @@ export function recoverEmptyFinalResponse(params) {
                     `${bullets}\n` +
                     `The work was done; the assistant did not summarize. Please ask "what did you do?" if details are needed.`;
                 logger.info({
-                    module: "agent.executor.empty-turn-recovery",
+                    submodule: "executor.empty-turn-recovery",
                     recoveryPass: "tool-call-synthesis",
                     toolCallCount: toolCallSummaries.length,
                     toolNames: [...toolNamesSet],
@@ -226,23 +210,6 @@ function extractVisibleText(content) {
     return undefined;
 }
 /* eslint-enable @typescript-eslint/no-explicit-any */
-/** Check whether any assistant turn (from lowerBound onward) contains a tool
- *  call to a delivery tool (message, notify). These tools send content to the
- *  user through a side-channel, so a subsequent NO_REPLY is intentional. */
-/* eslint-disable @typescript-eslint/no-explicit-any */
-function hasDeliveryToolCall(messages, lowerBound) {
-    for (let i = lowerBound; i < messages.length; i++) {
-        const msg = messages[i]; // eslint-disable-line security/detect-object-injection
-        if (msg?.role === "assistant" && Array.isArray(msg.content)) {
-            const hasDelivery = msg.content.some((b) => (b?.type === "toolCall" || b?.type === "tool_use") &&
-                DELIVERY_TOOL_NAMES.includes(b?.name));
-            if (hasDelivery)
-                return true;
-        }
-    }
-    return false;
-}
-/* eslint-enable @typescript-eslint/no-explicit-any */
 /** Summarize a single tool-call content block as `toolName({primary_arg: "value"})`.
  *  Reads `name` from the block, and `input` (Anthropic native) or `arguments`
  *  (internal mapped convention) for args. Returns bare tool name on malformed

package/node_modules/@comis/agent/dist/executor/executor-tool-assembly.js

@@ -297,8 +297,7 @@ export async function assembleTools(params) {
     // discovered) is the only factually-accurate set -- using mergedCustomTools
     // (pre-deferral) would false-positive on currently-deferred tools and tell
     // the agent "call directly, no discovery needed" for tools that aren't
-    // actually loaded. See design §4.2, §5.5, decision log row 4:
-    // .planning/design/discover-tools-bm25-fallback-fix.md
+    // actually loaded.
     if (deferralResult.discoverTool) {
         const activeAfterDeferral = new Set([
             ...deferralResult.activeTools.map(t => t.name),
@@ -324,7 +323,7 @@ export async function assembleTools(params) {
     }
     // Build deferred context for dynamic preamble injection.
     //
-    // 260428-oyc: under Anthropic Sonnet/Opus 4.x, request-body-injector.ts
+    // Under Anthropic Sonnet/Opus 4.x, request-body-injector.ts
     // strips client-side `discover_tools` from the API payload and replaces it
     // with the server-side `tool_search_tool_regex` + per-tool `defer_loading`
     // flag. Pass `useToolSearch=true` so the preamble teaches the model that

package/node_modules/@comis/agent/dist/executor/gemini-cache-injector.d.ts

@@ -3,7 +3,7 @@
  *
  * Injects CachedContent name into Gemini API payloads and atomically strips
  * the three inherited fields (systemInstruction, tools, toolConfig) to avoid
- * double-billing. Operates inside the onPayload hook (post-buildParams) per D-04.
+ * double-billing. Operates inside the onPayload hook (post-buildParams).
  *
  * Handles cache injection, inherited field stripping, and staleness recovery.
  *
@@ -24,7 +24,7 @@ export interface GeminiCacheInjectorConfig {
     /** Callback when a Gemini CachedContent entry is successfully injected.
      *  Called with the CacheEntry so the caller can capture cache hit stats for logging. */
     onCacheHit?: (entry: CacheEntry) => void;
-    /** Callback for cache break detection Phase 1.
+    /** Callback for cache break detection.
      *  Called with the API-ready payload AFTER any cache injection. */
     onPayloadForCacheDetection?: (params: Record<string, unknown>, model: {
         id: string;

package/node_modules/@comis/agent/dist/executor/gemini-cache-injector.js

@@ -4,7 +4,7 @@
  *
  * Injects CachedContent name into Gemini API payloads and atomically strips
  * the three inherited fields (systemInstruction, tools, toolConfig) to avoid
- * double-billing. Operates inside the onPayload hook (post-buildParams) per D-04.
+ * double-billing. Operates inside the onPayload hook (post-buildParams).
  *
  * Handles cache injection, inherited field stripping, and staleness recovery.
  *
@@ -103,7 +103,7 @@ export function createGeminiCacheInjector(config, logger) {
                         config.onPayloadForCacheDetection?.(resolvedParams, modelInfo);
                         return resolvedParams;
                     }
-                    // D-03: Assertion -- all three fields must be present for stripping
+                    // Assertion -- all three fields must be present for stripping
                     if (configObj.systemInstruction === undefined ||
                         configObj.tools === undefined ||
                         configObj.toolConfig === undefined) {
@@ -112,7 +112,7 @@ export function createGeminiCacheInjector(config, logger) {
                             cacheName: entry.name,
                             hint: "Expected fields missing from config -- cache entry stale, evicting",
                             errorKind: "validation",
-                        }, "Gemini cache injector: stale cache detected (D-03)");
+                        }, "Gemini cache injector: stale cache detected");
                         suppressError(config.cacheManager.dispose(config.sessionKey), "stale-cache-eviction-d03");
                         config.onPayloadForCacheDetection?.(resolvedParams, modelInfo);
                         return resolvedParams;
@@ -129,7 +129,7 @@ export function createGeminiCacheInjector(config, logger) {
                     }, "Gemini cache injector: injected cached content");
                     // Notify caller of successful cache injection for observability
                     config.onCacheHit?.(entry);
-                    // D-07: Phase 1 cache break detection callback
+                    // Cache break detection callback
                     config.onPayloadForCacheDetection?.(resolvedParams, modelInfo);
                     return resolvedParams;
                 },

package/node_modules/@comis/agent/dist/executor/phase-filter.d.ts

@@ -25,13 +25,13 @@ export declare function isVisibleTextBlock(block: any): boolean;
  *   - cross-turn boundary (role === "user" encountered before a
  *     qualifying assistant) — return "" because the user message marks
  *     the start of the current execution window; assistants before it
- *     belong to prior turns (260501-gyy).
+ *     belong to prior turns.
  *
  * When the resulting last assistant contains commentary-phase text
  * blocks, drops them and returns only visible text. Otherwise returns
  * the visible (non-commentary) text blocks of the last assistant
  * directly — does NOT delegate to session.getLastAssistantText(),
  * which walks past empty messages and would re-introduce the
- * synthetic-leak (260501-egj).
+ * synthetic-leak.
  */
 export declare function getVisibleAssistantText(session: any): string;

package/node_modules/@comis/agent/dist/executor/phase-filter.js

@@ -41,21 +41,20 @@ export function isVisibleTextBlock(block) {
  *   - cross-turn boundary (role === "user" encountered before a
  *     qualifying assistant) — return "" because the user message marks
  *     the start of the current execution window; assistants before it
- *     belong to prior turns (260501-gyy).
+ *     belong to prior turns.
  *
  * When the resulting last assistant contains commentary-phase text
  * blocks, drops them and returns only visible text. Otherwise returns
  * the visible (non-commentary) text blocks of the last assistant
  * directly — does NOT delegate to session.getLastAssistantText(),
  * which walks past empty messages and would re-introduce the
- * synthetic-leak (260501-egj).
+ * synthetic-leak.
  */
 export function getVisibleAssistantText(session) {
     const messages = session?.messages;
     // Find last "real" assistant message in the CURRENT execution window —
     // skip aborted-empty, error-empty, and synthetic-injected; stop at the
-    // first user message (turn boundary) to avoid leaking prior-turn text
-    // (260501-gyy).
+    // first user message (turn boundary) to avoid leaking prior-turn text.
     const lastAssistant = (() => {
         if (!Array.isArray(messages))
             return undefined;
@@ -93,9 +92,8 @@ export function getVisibleAssistantText(session) {
     // No commentary — return lastAssistant's visible text directly.
     // Do NOT delegate to session.getLastAssistantText() because it walks
     // past empty messages (aborted/error/etc.) and re-introduces the
-    // synthetic-leak (production bug 260501-egj: post-restart-resumption
-    // rate-limit returned synthetic placeholder instead of the
-    // 260501-cur "Rate limit exceeded" terminal error).
+    // synthetic-leak (post-restart-resumption rate-limit returned synthetic
+    // placeholder instead of the "Rate limit exceeded" terminal error).
     if (!lastAssistant?.content || !Array.isArray(lastAssistant.content))
         return "";
     return lastAssistant.content

package/node_modules/@comis/agent/dist/executor/pi-executor.d.ts

@@ -33,6 +33,7 @@ import type { MessageSendLimiter } from "../safety/message-send-limiter.js";
 import type { ProviderHealthMonitor } from "../safety/provider-health-monitor.js";
 import type { ComisSessionManager } from "../session/comis-session-manager.js";
 import type { AuthRotationAdapter } from "../model/auth-rotation-adapter.js";
+import type { OAuthTokenManager } from "../model/oauth-token-manager.js";
 import type { ActiveRunRegistry } from "./active-run-registry.js";
 import type { GeminiCacheManager } from "./gemini-cache-manager.js";
 import type { BackgroundTaskManager, NotifyFn } from "../background/index.js";
@@ -120,6 +121,18 @@ export interface PiExecutorDeps {
     fallbackModels?: string[];
     /** Optional auth rotation adapter for multi-key providers. */
     authRotation?: AuthRotationAdapter;
+    /**
+     * Optional OAuth token manager. When provided, the per-LLM-call
+     * dispatch hook in execute() resolves the OAuth token via the resolver
+     * chain (agent-config -> lastGood -> first available) and sets it into
+     * authStorage's runtime override Map for pi-coding-agent's outbound LLM
+     * call.
+     *
+     * Single hook per execute() — long-running execute()s
+     * (>= 1 hour) may see token expire mid-loop; revisit if observed
+     * in production.
+     */
+    oauthManager?: OAuthTokenManager;
     /** Active run registry for mid-execution steering. */
     activeRunRegistry?: ActiveRunRegistry;
     /** Daemon-level tracing defaults for rotation. */