comisai 1.0.33 → 1.0.36

package/node_modules/@comis/agent/dist/executor/pi-executor.js

@@ -27,6 +27,7 @@ tryGetContext, ContextEngineConfigSchema, } from "@comis/core";
 import { suppressError } from "@comis/shared";
 import { createToolRetryBreaker } from "../safety/tool-retry-breaker.js";
 import { createMessageSendLimiter } from "../safety/message-send-limiter.js";
+import { resolveProviderApiKey } from "../model/resolve-provider-api-key.js";
 import { repairOrphanedMessages, scrubPoisonedThinkingBlocks } from "../session/orphaned-message-repair.js";
 import { scrubRedactedToolCalls } from "../session/scrub-redacted-tool-calls.js";
 import { createPiEventBridge } from "../bridge/pi-event-bridge.js";
@@ -51,7 +52,7 @@ import { validateInput } from "./executor-input-guard.js";
 import { scanWithOutputGuard } from "./executor-response-filter.js";
 import { normalizeModelCompat } from "../provider/model-compat.js";
 import { normalizeModelId } from "../provider/model-id-normalize.js";
-import { isAnthropicFamily, isGoogleFamily } from "../provider/capabilities.js";
+import { isAnthropicFamily, isGoogleFamily, resolveProviderCapabilities } from "../provider/capabilities.js";
 import { detectOnboardingState } from "../workspace/onboarding-detector.js";
 import { PromptTimeoutError } from "./prompt-timeout.js";
 import { classifyError, classifyPromptTimeout } from "./error-classifier.js";
@@ -197,6 +198,27 @@ export function createPiExecutor(config, deps) {
         async execute(msg, sessionKey, tools, onDelta, agentId, _directives, _prevTimestamp, overrides) {
             // a. Record execution start time
             const executionStartMs = Date.now();
+            // a-bis. Pre-resolve OAuth token before any pi-coding-agent
+            // dispatch. The setRuntimeApiKey side-effect inside resolveProviderApiKey
+            // carries the token into pi-coding-agent's outbound LLM request via the
+            // runtime-override priority path. For OAuth-eligible
+            // providers (openai-codex, anthropic, github-copilot via pi-ai's
+            // built-in registry) the resolver chain (agent-config -> lastGood ->
+            // first available) runs and refreshes the token if expired. For
+            // non-OAuth providers the helper falls through to authStorage.getApiKey.
+            //
+            // Throw-propagation: on OAuthError the helper throws
+            // an Error containing the OAuthError.message. Outer async callers
+            // (gateway routes via Hono, channel handlers via try/catch) lift the
+            // throw into a user-facing error response. OAuthError
+            // is fatal — no env-var fallback, no retry, no silent rotation.
+            // CLAUDE.md "no empty catch" honored because we don't add a catch
+            // here at all; the resolver itself logs via the oauth-resolver module.
+            await resolveProviderApiKey(config.provider, {
+                authStorage: deps.authStorage,
+                oauthManager: deps.oauthManager,
+                agentConfig: config,
+            });
             // b. Initialize result
             const result = {
                 response: "",
@@ -775,7 +797,7 @@ export function createPiExecutor(config, deps) {
                         session.abortCompaction();
                         suppressError(session.abort(), "session abort on compaction cancel");
                     },
-                    // 260501-dkl: cancel the SDK's internal auto-retry loop when the
+                    // Cancel the SDK's internal auto-retry loop when the
                     // bridge classifies the auto_retry_start error as `rate_limited`.
                     // Rate-limit windows (per-minute) outlast the SDK's retry budget
                     // (~30s), so retrying within the window cannot succeed.
@@ -820,7 +842,7 @@ export function createPiExecutor(config, deps) {
                     sepConfig: sepEnabled ? { maxSteps: config.sep?.maxSteps ?? 15, minSteps: config.sep?.minSteps ?? 3 } : undefined,
                     sepMessageText: sepEnabled ? (msg.text ?? "") : undefined,
                     sepExecutionStartMs: sepEnabled ? executionStartMs : undefined,
-                    // Cache break detection Phase 2 callback.
+                    // Cache break detection post-call callback.
                     // Enrich with elapsed time for tiered server-side attribution.
                     checkCacheBreak: (input) => cacheBreakDetector.checkResponseForCacheBreak({
                         ...input,
@@ -841,7 +863,7 @@ export function createPiExecutor(config, deps) {
                             timestamp: Date.now(),
                         };
                     },
-                    // 260428-hoy: pre-LLM-call hook -- runs once per `turn_start`,
+                    // Pre-LLM-call hook -- runs once per `turn_start`,
                     // BEFORE pi-ai serializes the next request. Asserts the
                     // cross-turn hash invariant (logs ERROR per mutated block, with
                     // module:"agent.bridge.hash-invariant"), then heals any mutated
@@ -893,7 +915,7 @@ export function createPiExecutor(config, deps) {
                         }
                         return live;
                     },
-                    // 260428-iag wire-edge diagnostic: resolves the per-session JSONL
+                    // Wire-edge diagnostic: resolves the per-session JSONL
                     // path on demand. The bridge invokes this only after detecting the
                     // signed-replay rejection signature on a 400 — never on the happy
                     // path. Path comes from the same sessionAdapter that already
@@ -996,12 +1018,46 @@ export function createPiExecutor(config, deps) {
                 // Applied AFTER sideEffects so the background placeholder is returned instead of
                 // waiting for sideEffects processing. When the tool completes in background,
                 // the sideEffects are still processed by the original wrapped execute.
+                // Capture origin at wrap-time via explicit threading.
+                // The closure reads runPrompt-scope variables synchronously each invocation
+                // so the captured origin reflects the originating session, not the
+                // background-continuation context (which lacks these locals).
                 if (deps.backgroundTaskManager && config.backgroundTasks?.enabled !== false) {
                     const bgConfig = BackgroundTasksConfigSchema.parse(config.backgroundTasks ?? {});
+                    const resolvedAgentId = agentId ?? "default";
+                    const originResolver = () => {
+                        // Defensive: if any required field is unexpectedly missing, fall through
+                        // to foreground execution (no background promotion). Promotion requires
+                        // a complete origin.
+                        if (!formattedKey || formattedKey.length === 0)
+                            return undefined;
+                        if (!msg.channelType || msg.channelType.length === 0)
+                            return undefined;
+                        if (!msg.channelId || msg.channelId.length === 0)
+                            return undefined;
+                        // Read incoming hop count off msg.metadata so the runner can enforce
+                        // the recursion bound. Top-level user messages have no
+                        // metadata.backgroundHopCount -> default to 0.
+                        // Cast metadata defensively because NormalizedMessageSchema.metadata
+                        // is z.record(z.string(), z.unknown()).
+                        const meta = msg.metadata;
+                        const rawHopCount = meta?.backgroundHopCount;
+                        const incomingHopCount = typeof rawHopCount === "number" && Number.isFinite(rawHopCount) && rawHopCount >= 0
+                            ? Math.floor(rawHopCount)
+                            : 0;
+                        return {
+                            agentId: resolvedAgentId,
+                            sessionKey: formattedKey,
+                            channelType: msg.channelType,
+                            channelId: msg.channelId,
+                            traceId: executionId ?? null,
+                            backgroundHopCount: incomingHopCount,
+                        };
+                    };
                     for (const tool of mergedCustomTools) {
                         const wrapped = wrapToolForAutoBackground(
                         // eslint-disable-next-line @typescript-eslint/no-explicit-any -- SDK interop boundary
-                        tool, deps.backgroundTaskManager, bgConfig, deps.backgroundNotifyFn ?? (async () => { }), agentId ?? "default");
+                        tool, deps.backgroundTaskManager, bgConfig, deps.backgroundNotifyFn ?? (async () => { }), originResolver);
                         tool.execute = wrapped.execute;
                     }
                 }
@@ -1095,6 +1151,15 @@ export function createPiExecutor(config, deps) {
                         getTruncationSummary, getTurnBudgetSummary,
                         executionPlanRef, sepEnabled, isOnboarding,
                         geminiCacheHit, geminiCachedTokens, modelTier,
+                        // Provider attribution tag for the bookend log.
+                        // resolvedModel?.provider is the post-resolution / post-override
+                        // provider; falling back to config.provider records operator
+                        // INTENT on the silent-fallback misconfig path (resolvedModel
+                        // undefined). resolveProviderCapabilities is computed once here
+                        // to keep executor-post-execution.ts free of capability-cascade
+                        // imports.
+                        provider: resolvedModel?.provider ?? config.provider,
+                        providerFamily: resolveProviderCapabilities(resolvedModel?.provider ?? config.provider).providerFamily,
                         deferralResult, mergedCustomTools, deliveredGuides,
                         deps: {
                             eventBus: deps.eventBus,

package/node_modules/@comis/agent/dist/executor/post-batch-continuation.js

@@ -15,7 +15,7 @@ import { fromPromise, ok, err } from "@comis/shared";
 // ---------------------------------------------------------------------------
 // Implementation
 // ---------------------------------------------------------------------------
-const MODULE = "agent.executor.post-batch-continuation";
+const SUBMODULE = "executor.post-batch-continuation";
 /* eslint-disable @typescript-eslint/no-explicit-any */
 function isToolCallBlock(block) {
     return block?.type === "toolCall" || block?.type === "tool_use";
@@ -84,7 +84,7 @@ export async function runPostBatchContinuation(deps) {
     const { session, messages, config, logger, agentId, getVisibleAssistantText } = deps;
     // Step 1: disable check.
     if (!config.enabled || config.maxRetries === 0) {
-        logger.info({ module: MODULE, agentId, decision: "skip", reason: "disabled" }, "Post-batch continuation skipped");
+        logger.info({ submodule: SUBMODULE, agentId, decision: "skip", reason: "disabled" }, "Post-batch continuation skipped");
         return ok({
             recovered: false,
             attempts: 0,
@@ -97,7 +97,7 @@ export async function runPostBatchContinuation(deps) {
     /* eslint-disable @typescript-eslint/no-explicit-any */
     const msgs = messages;
     if (!Array.isArray(msgs) || msgs.length === 0) {
-        logger.info({ module: MODULE, agentId, decision: "skip", reason: "non_empty_final" }, "Post-batch continuation skipped");
+        logger.info({ submodule: SUBMODULE, agentId, decision: "skip", reason: "non_empty_final" }, "Post-batch continuation skipped");
         return ok({
             recovered: false,
             attempts: 0,
@@ -113,7 +113,7 @@ export async function runPostBatchContinuation(deps) {
         !hasThinkingBlock(last.content) &&
         !hasToolCallBlock(last.content);
     if (!lastIsEmpty) {
-        logger.info({ module: MODULE, agentId, decision: "skip", reason: "non_empty_final" }, "Post-batch continuation skipped");
+        logger.info({ submodule: SUBMODULE, agentId, decision: "skip", reason: "non_empty_final" }, "Post-batch continuation skipped");
         return ok({
             recovered: false,
             attempts: 0,
@@ -141,7 +141,7 @@ export async function runPostBatchContinuation(deps) {
     /* eslint-enable @typescript-eslint/no-explicit-any */
     const priorToolNames = [...priorToolNamesSet];
     if (priorToolCallCount === 0) {
-        logger.info({ module: MODULE, agentId, decision: "skip", reason: "no_tool_calls" }, "Post-batch continuation skipped");
+        logger.info({ submodule: SUBMODULE, agentId, decision: "skip", reason: "no_tool_calls" }, "Post-batch continuation skipped");
         return ok({
             recovered: false,
             attempts: 0,
@@ -152,7 +152,7 @@ export async function runPostBatchContinuation(deps) {
     }
     // Step 4: decision-log fire.
     logger.info({
-        module: MODULE,
+        submodule: SUBMODULE,
         agentId,
         decision: "fire",
         reason: "empty_after_tool_batch",
@@ -170,7 +170,7 @@ export async function runPostBatchContinuation(deps) {
         const text = getVisibleAssistantText(session);
         const outcomeForLog = text && text.length > 0 ? "recovered" : "still_empty";
         logger.info({
-            module: MODULE,
+            submodule: SUBMODULE,
             agentId,
             attempt,
             maxAttempts: config.maxRetries,

package/node_modules/@comis/agent/dist/executor/stream-wrappers/request-body-injector.d.ts

@@ -40,7 +40,7 @@ export interface RequestBodyInjectorConfig {
      *  but system prompt + tools are still worth caching. */
     getMinTokensOverride?: () => number | undefined;
     /** Callback invoked with the API-ready payload after cache breakpoint
-     *  placement. Used by cache break detector Phase 1 to extract prompt state for
+     *  placement. Used by the cache break detector to extract prompt state for
      *  change detection. Receives the mutated params, the model, and (for Anthropic) the HTTP headers. */
     onPayloadForCacheDetection?: (params: Record<string, unknown>, model: {
         id: string;

package/node_modules/@comis/agent/dist/executor/stream-wrappers/request-body-injector.js

@@ -1484,7 +1484,7 @@ export function createRequestBodyInjector(config, logger) {
                             mergedHeaders["anthropic-beta"] = allBetas.join(", ");
                         }
                     }
-                    // Feed payload to cache break detector Phase 1 (after breakpoint placement)
+                    // Feed payload to cache break detector (after breakpoint placement)
                     if (config.onPayloadForCacheDetection) {
                         config.onPayloadForCacheDetection(result, model, mergedHeaders);
                     }

package/node_modules/@comis/agent/dist/executor/tool-deferral.d.ts

@@ -107,7 +107,7 @@ export declare function resolveToolCallingTemperature(modelTier: ModelTier): num
  * When this returns true, request-body-injector strips client-side
  * `discover_tools` from the API payload and appends `tool_search_tool_regex`
  * instead -- so any model-facing teaching string about `discover_tools`
- * contradicts the actual tool list and must be suppressed (260428-oyc).
+ * contradicts the actual tool list and must be suppressed.
  *
  * Lowercase-normalize so provider-prefixed model ids
  * (`anthropic/claude-sonnet-4`, `bedrock/anthropic.claude-opus-4`) resolve
@@ -149,7 +149,7 @@ export declare function resolveToolDescription(tool: ToolDefinition): string;
  *   teaching string therefore points at direct invocation + tool-search by
  *   regex, never at `discover_tools`. Without this conditional, the model
  *   reads its own preamble ("call discover_tools") against a tool list that
- *   doesn't contain that tool and gives up (260428-oyc production repro).
+ *   doesn't contain that tool and gives up (production repro).
  *
  * @param entries - Deferred tool entries (remaining after discovery re-inclusion)
  * @param options - Optional flags. `useToolSearch=true` switches the third

package/node_modules/@comis/agent/dist/executor/tool-deferral.js

@@ -102,7 +102,7 @@ export function resolveToolCallingTemperature(modelTier) {
  * When this returns true, request-body-injector strips client-side
  * `discover_tools` from the API payload and appends `tool_search_tool_regex`
  * instead -- so any model-facing teaching string about `discover_tools`
- * contradicts the actual tool list and must be suppressed (260428-oyc).
+ * contradicts the actual tool list and must be suppressed.
  *
  * Lowercase-normalize so provider-prefixed model ids
  * (`anthropic/claude-sonnet-4`, `bedrock/anthropic.claude-opus-4`) resolve
@@ -183,7 +183,7 @@ export function resolveToolDescription(tool) {
  *   teaching string therefore points at direct invocation + tool-search by
  *   regex, never at `discover_tools`. Without this conditional, the model
  *   reads its own preamble ("call discover_tools") against a tool list that
- *   doesn't contain that tool and gives up (260428-oyc production repro).
+ *   doesn't contain that tool and gives up (production repro).
  *
  * @param entries - Deferred tool entries (remaining after discovery re-inclusion)
  * @param options - Optional flags. `useToolSearch=true` switches the third
@@ -257,7 +257,7 @@ export function applyToolDeferral(tools, _contextWindow, deferralContext, logger
     for (const t of tools) {
         originalToolMap.set(t.name, t);
     }
-    // Phase 1: Rule-based deferral
+    // Rule-based deferral
     for (const rule of DEFERRAL_RULES) {
         if (!rule.activeWhen(deferralContext)) {
             for (const toolName of rule.tools) {
@@ -267,7 +267,7 @@ export function applyToolDeferral(tools, _contextWindow, deferralContext, logger
             }
         }
     }
-    // Phase 2: MCP tools deferred by default (only for providers with mid-turn injection)
+    // MCP tools deferred by default (only for providers with mid-turn injection)
     // Providers without mid-turn injection (OpenAI, xAI, etc.) get MCP tools from the start,
     // because sub-agents only call execute() once and there is no "next execution" for
     // discovered tools to appear in.
@@ -282,7 +282,7 @@ export function applyToolDeferral(tools, _contextWindow, deferralContext, logger
             }
         }
     }
-    // Phase 3: Small model aggressive deferral
+    // Small model aggressive deferral
     if (deferralContext.modelTier === "small") {
         for (const t of tools) {
             if (!deferredSet.has(t.name) && !CORE_TOOLS.has(t.name) && !deferralContext.recentlyUsedToolNames.has(t.name)) {
@@ -290,7 +290,7 @@ export function applyToolDeferral(tools, _contextWindow, deferralContext, logger
             }
         }
     }
-    // Phase 4: Merge lifecycle-demoted tools into deferral set for unified discover_tools
+    // Merge lifecycle-demoted tools into deferral set for unified discover_tools
     // Clear discovery state for lifecycle-demoted tools (prevents appearing
     // in both discoveredTools and deferredEntries simultaneously)
     if (deferralContext.lifecycleDemotedNames) {
@@ -301,7 +301,7 @@ export function applyToolDeferral(tools, _contextWindow, deferralContext, logger
             }
         }
     }
-    // Phase 5: Operator overrides (neverDefer / alwaysDefer from DeferredToolsConfigSchema)
+    // Operator overrides (neverDefer / alwaysDefer from DeferredToolsConfigSchema)
     if (deferralContext.neverDefer) {
         for (const name of deferralContext.neverDefer) {
             deferredSet.delete(name);

package/node_modules/@comis/agent/dist/index.d.ts

@@ -50,6 +50,23 @@ export { createModelScanner } from "./model/model-scanner.js";
 export type { ScanResult, ModelScanner, ModelScannerDeps } from "./model/model-scanner.js";
 export { createOAuthTokenManager } from "./model/oauth-token-manager.js";
 export type { OAuthTokenManager, OAuthTokenManagerDeps, OAuthError } from "./model/oauth-token-manager.js";
+export { resolveProviderApiKey } from "./model/resolve-provider-api-key.js";
+export type { ResolveProviderApiKeyDeps } from "./model/resolve-provider-api-key.js";
+export { decodeCodexJwtPayload, resolveCodexAuthIdentity, resolveCodexStableSubject, resolveCodexAccessTokenExpiry, redactEmailForLog } from "./model/oauth-identity.js";
+export { createOAuthCredentialStoreFile } from "./model/oauth-credential-store-file.js";
+export type { OAuthCredentialStoreFileConfig } from "./model/oauth-credential-store-file.js";
+export { selectOAuthCredentialStore } from "./model/oauth-credential-store-selector.js";
+export type { SelectOAuthCredentialStoreInput, OAuthStorageMode, } from "./model/oauth-credential-store-selector.js";
+export { isRemoteEnvironment } from "./model/oauth-env.js";
+export type { IsRemoteEnvironmentInput } from "./model/oauth-env.js";
+export { loginOpenAICodexOAuth } from "./model/oauth-login-runner.js";
+export type { LoginError, LoginRunnerSuccess, LoginRunnerParams, RunnerPrompter, } from "./model/oauth-login-runner.js";
+export { loginOpenAICodexDeviceCode } from "./model/oauth-device-code.js";
+export type { DeviceCodeVerificationPrompt, LoginOpenAICodexDeviceCodeOptions, } from "./model/oauth-device-code.js";
+export { runOAuthTlsPreflight } from "./model/oauth-tls-preflight.js";
+export type { TlsPreflightResult, TlsPreflightFailureKind, RunOAuthTlsPreflightOptions, } from "./model/oauth-tls-preflight.js";
+export { rewriteOAuthError } from "./model/oauth-errors.js";
+export type { OAuthErrorCode, RewrittenOAuthError, } from "./model/oauth-errors.js";
 export { createAuthUsageTracker } from "./model/auth-usage-tracker.js";
 export type { AuthUsageTracker, ProfileStats, ProfileUsageInput } from "./model/auth-usage-tracker.js";
 export { createLastKnownModelTracker } from "./model/last-known-model.js";

package/node_modules/@comis/agent/dist/index.js

@@ -26,7 +26,7 @@ export { createAuthProvider } from "./model/auth-provider.js";
 export { createAuthProfileManager } from "./model/auth-profile.js";
 // Auth rotation adapter (key rotation with cooldown)
 export { createAuthRotationAdapter } from "./model/auth-rotation-adapter.js";
-// Image-aware model routing (existing + image fallback chain from 62-05)
+// Image-aware model routing (existing + image fallback chain)
 export { resolveModelForMessage, isVisionCapable, createImageFallbackChain } from "./model/image-router.js";
 // Model allowlist
 export { createModelAllowlist } from "./model/model-allowlist.js";
@@ -40,9 +40,30 @@ export { createModelCatalog, resolveModelPricing, ZERO_COST } from "./model/mode
 export { getCacheProviderInfo } from "./executor/cache-usage-helpers.js";
 // Model scanner
 export { createModelScanner } from "./model/model-scanner.js";
-// OAuth token manager (from 62-03)
+// OAuth token manager
 export { createOAuthTokenManager } from "./model/oauth-token-manager.js";
-// Auth usage tracker (from 62-05)
+// Per-LLM-call OAuth dispatch helper — shared helper used by PiExecutor.execute()
+// pre-hook and the two compaction getApiKey callbacks. Re-exported so the
+// integration test can drive the same resolver hook the executor uses.
+export { resolveProviderApiKey } from "./model/resolve-provider-api-key.js";
+// OAuth identity — pure-function JWT decoder + identity resolver + redaction helper
+export { decodeCodexJwtPayload, resolveCodexAuthIdentity, resolveCodexStableSubject, resolveCodexAccessTokenExpiry, redactEmailForLog } from "./model/oauth-identity.js";
+// OAuth credential store — file adapter (plaintext file-backed adapter with atomic write + per-profile lock + schema versioning)
+export { createOAuthCredentialStoreFile } from "./model/oauth-credential-store-file.js";
+// OAuth credential store selector — lives here so the CLI process can
+// instantiate the same adapter the daemon uses
+export { selectOAuthCredentialStore } from "./model/oauth-credential-store-selector.js";
+// OAuth env detection — pure function for VPS/headless heuristic
+export { isRemoteEnvironment } from "./model/oauth-env.js";
+// OAuth login runner — interactive login orchestrator
+export { loginOpenAICodexOAuth } from "./model/oauth-login-runner.js";
+// Device-code OAuth flow
+export { loginOpenAICodexDeviceCode } from "./model/oauth-device-code.js";
+// OAuth TLS preflight
+export { runOAuthTlsPreflight } from "./model/oauth-tls-preflight.js";
+// OAuth error catalogue
+export { rewriteOAuthError } from "./model/oauth-errors.js";
+// Auth usage tracker
 export { createAuthUsageTracker } from "./model/auth-usage-tracker.js";
 // Last-known-working model tracker (auth-failure fallback)
 export { createLastKnownModelTracker } from "./model/last-known-model.js";
@@ -107,15 +128,15 @@ export { withPromptTimeout, withResettablePromptTimeout, PromptTimeoutError } fr
 // Error classification (user-safe error messages)
 export { classifyError, classifyPromptTimeout } from "./executor/error-classifier.js";
 export { composeStreamWrappers, createConfigResolver, createRequestBodyInjector, createCacheTraceWriter, createApiPayloadTraceWriter, createToolResultSizeBouncer, clearSessionRenderedToolCache } from "./executor/stream-wrappers/index.js";
-// Active run registry (-- tracks running sessions for mid-stream steering)
+// Active run registry (tracks running sessions for mid-stream steering)
 export { createActiveRunRegistry } from "./executor/active-run-registry.js";
 // Cache break detection
 export { clearCacheBreakDetectorSession, extractGeminiPromptState } from "./executor/cache-break-detection.js";
-// Cache break diff writer ()
+// Cache break diff writer
 export { createCacheBreakDiffWriter } from "./executor/cache-break-diff-writer.js";
 // Gemini cache injector
 export { createGeminiCacheInjector } from "./executor/gemini-cache-injector.js";
-// Gemini cache manager ()
+// Gemini cache manager
 export { createGeminiCacheManager, computeCacheContentHash } from "./executor/gemini-cache-manager.js";
 // Gemini cache lifecycle
 export { wireGeminiCacheCleanup } from "./executor/gemini-cache-lifecycle.js";
@@ -166,24 +187,24 @@ export { createResultCondenser } from "./spawn/index.js";
 export { createNarrativeCaster } from "./spawn/index.js";
 export { createLifecycleHooks, deriveSubagentContextEngineConfig } from "./spawn/index.js";
 export { createEphemeralComisSessionManager } from "./spawn/index.js";
-// Context engine (, )
+// Context engine
 export { createContextEngine } from "./context-engine/index.js";
 export { createThinkingBlockCleaner } from "./context-engine/index.js";
 export { computeTokenBudget } from "./context-engine/index.js";
-// DAG reconciliation, compaction, integrity, and assembler (Phases 411-414)
+// DAG reconciliation, compaction, integrity, and assembler
 export { reconcileJsonlToDag, installDagIngestionHook, createDagContextEngine, runLeafPass, runCondensedPass, resolveFreshTailBoundary, shouldCompact, markAncestorsDirty, recomputeDescendantCounts, runDagCompaction, checkIntegrity, CHARS_PER_TOKEN_RATIO, } from "./context-engine/index.js";
 // Provider capabilities
 export { DEFAULTS as PROVIDER_CAPABILITY_DEFAULTS, resolveProviderCapabilities, normalizeProviderId, isAnthropicFamily, isOpenAiFamily, shouldDropThinkingBlocks, resolveToolCallIdMode, validateProviderOverrides, } from "./provider/capabilities.js";
 // Model compatibility auto-detection (xAI compat flags)
 export { normalizeModelCompat } from "./provider/model-compat.js";
-// Model ID normalization ()
+// Model ID normalization
 export { normalizeModelId } from "./provider/model-id-normalize.js";
 // Response sanitization pipeline
 export { sanitizeAssistantResponse, setSanitizeLogger, extractFinalTagContent } from "./provider/response/sanitize-pipeline.js";
-// Response filter utilities ( -- used by ThinkingTagFilter)
+// Response filter utilities (used by ThinkingTagFilter)
 export { stripReasoningTagsFromText } from "./response-filter/reasoning-tags.js";
 export { findCodeRegions, isInsideCode } from "./response-filter/code-regions.js";
-// Thinking tag filter ( -- moved from @comis/channels)
+// Thinking tag filter (moved from @comis/channels)
 export { createThinkingTagFilter } from "./response-filter/thinking-tag-filter.js";
 // Operation model resolver
 export { resolveOperationModel, resolveProviderFamily } from "./model/operation-model-resolver.js";

package/node_modules/@comis/agent/dist/model/auth-provider.d.ts

@@ -12,7 +12,8 @@
  */
 import type { AuthStorage } from "@mariozechner/pi-coding-agent";
 import type { SecretManager } from "@comis/core";
-import type { TypedEventBus } from "@comis/core";
+import type { TypedEventBus, OAuthCredentialStorePort } from "@comis/core";
+import type { ComisLogger } from "@comis/infra";
 import { type AuthProfileManager, type AuthProfile, type OrderingStrategy } from "./auth-profile.js";
 import { type AuthRotationAdapter } from "./auth-rotation-adapter.js";
 import { type AuthUsageTracker } from "./auth-usage-tracker.js";
@@ -35,10 +36,32 @@ export interface AuthProviderConfig {
     cooldownCapMs?: number;
     /** OAuth configuration. When provided, creates an OAuthTokenManager. */
     oauth?: {
-        /** EventBus for emitting auth:token_rotated events. */
+        /** EventBus for emitting auth events (token_rotated, profile_bootstrapped, refresh_failed). */
         eventBus: TypedEventBus;
+        /** Credential store for persistent refresh — REQUIRED. */
+        credentialStore: OAuthCredentialStorePort;
+        /** Logger for OAuth log events — REQUIRED. */
+        logger: ComisLogger;
+        /** Data directory for lock-file path resolution — REQUIRED. */
+        dataDir: string;
         /** Prefix for SecretManager key names (default: "OAUTH_"). */
         keyPrefix?: string;
+        /**
+         * Absolute path to auth-profiles.json for the chokidar watcher. When set,
+         * OAuthTokenManager registers a file watcher that invalidates its in-memory
+         * cache on external rewrites (CLI auth login). Pass `undefined` for
+         * encrypted-store mode (documented limitation).
+         */
+        watchPath?: string;
+        /**
+         * Getter for the agent's oauthProfiles map. Called fresh on every
+         * OAuthTokenManager.getApiKey() invocation. Optional — falls back to a
+         * no-agent-level-preference contract when absent. The closure implementation
+         * should dereference the daemon's stable
+         * `container.config.agents[agentId]?.oauthProfiles` so the value is observed
+         * across `agents.update` reference-replacements without a daemon restart.
+         */
+        getAgentOauthProfiles?: () => Record<string, string> | undefined;
     };
 }
 /** Unified auth provider exposing all composed auth modules. */

package/node_modules/@comis/agent/dist/model/auth-provider.js

@@ -69,7 +69,13 @@ export function createAuthProvider(config) {
         const oauthDeps = {
             secretManager,
             eventBus: oauth.eventBus,
+            credentialStore: oauth.credentialStore,
+            logger: oauth.logger,
+            dataDir: oauth.dataDir,
             keyPrefix: oauth.keyPrefix,
+            watchPath: oauth.watchPath,
+            // Thread the agent oauthProfiles getter through.
+            getAgentOauthProfiles: oauth.getAgentOauthProfiles,
         };
         oauthManager = createOAuthTokenManager(oauthDeps);
     }

package/node_modules/@comis/agent/dist/model/compaction-model-resolver.d.ts

@@ -10,9 +10,9 @@
  *   still routed to Claude Haiku, defeating the cost-tiering intent and
  *   causing cross-provider auth confusion (no Anthropic API key configured).
  *
- *   Phase 2C-2 changes the schema default to "" and resolves at runtime:
- *   pick the fast-tier model from `resolveOperationDefaults(primaryProvider)`,
- *   with `getModels(primaryProvider)[0]` as the catalog-fallback.
+ *   The schema default is "" and the value is resolved at runtime: pick the
+ *   fast-tier model from `resolveOperationDefaults(primaryProvider)`, with
+ *   `getModels(primaryProvider)[0]` as the catalog-fallback.
  *
  *   Note: explicit `compactionModel` values from existing YAML configs win
  *   unchanged (length > 0 short-circuits the resolver). No backward-compat

package/node_modules/@comis/agent/dist/model/compaction-model-resolver.js

@@ -11,9 +11,9 @@
  *   still routed to Claude Haiku, defeating the cost-tiering intent and
  *   causing cross-provider auth confusion (no Anthropic API key configured).
  *
- *   Phase 2C-2 changes the schema default to "" and resolves at runtime:
- *   pick the fast-tier model from `resolveOperationDefaults(primaryProvider)`,
- *   with `getModels(primaryProvider)[0]` as the catalog-fallback.
+ *   The schema default is "" and the value is resolved at runtime: pick the
+ *   fast-tier model from `resolveOperationDefaults(primaryProvider)`, with
+ *   `getModels(primaryProvider)[0]` as the catalog-fallback.
  *
  *   Note: explicit `compactionModel` values from existing YAML configs win
  *   unchanged (length > 0 short-circuits the resolver). No backward-compat

package/node_modules/@comis/agent/dist/model/oauth-credential-store-file.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Plaintext file-backed OAuthCredentialStorePort adapter.
+ *
+ * Default storage backend for OAuth credentials (derives from existing
+ * dataDir, no separate config key). Stores all profiles in a single JSON
+ * file at ${dataDir}/auth-profiles.json with mode 0o600.
+ *
+ * Atomic write sequence (full POSIX crash safety on ext4):
+ *   write tmp 0o600 → fsync(tmpFd) → close(tmpFd) → rename(tmp, canonical)
+ *   → fsync(parentDirFd) → close(parentDirFd)
+ *
+ * cron-store.ts does NOT fsync the parent directory; this adapter MUST
+ * because OAuth credentials are security-critical (a lost rename due to
+ * power-loss-after-data-write would silently log the user out).
+ *
+ * Per-profile-ID locking via withExecutionLock: different providers and
+ * different identities for the same provider can refresh in parallel.
+ *
+ * Schema versioning: single integer version at top level. Hard-fail on
+ * mismatch — pre-1.0 software, no migration plumbing.
+ *
+ * @module
+ */
+import { type OAuthCredentialStorePort } from "@comis/core";
+export interface OAuthCredentialStoreFileConfig {
+    /** Comis data directory (e.g. ~/.comis). The adapter writes to ${dataDir}/auth-profiles.json. */
+    dataDir: string;
+}
+/**
+ * Create a plaintext file-backed OAuthCredentialStorePort adapter.
+ *
+ * Atomic, lock-protected, version-validated. Lifecycle:
+ * - On factory call: ensures dataDir exists (mkdir 0o700 recursive); cleans up stale .tmp files.
+ * - On every set/delete: per-profile-ID file lock → load → mutate → atomic-write.
+ * - On every get/has/list: load (no lock — readers see snapshot per POSIX rename atomicity).
+ */
+export declare function createOAuthCredentialStoreFile(config: OAuthCredentialStoreFileConfig): OAuthCredentialStorePort;