comisai 1.0.34 → 1.0.36

package/node_modules/@comis/gateway/dist/server/hono-server.js

@@ -14,6 +14,7 @@ import { createRestApi, ActivityRingBuffer, subscribeActivityBuffer } from "../w
 import { createSseEndpoint } from "../web/sse-endpoint.js";
 import { createStaticMiddleware } from "../web/static-middleware.js";
 import { createWebhookEndpoint } from "../webhook/webhook-endpoint.js";
+import { createOAuthCallbackRoute, } from "../oauth/oauth-callback-route.js";
 /**
  * Create a gateway server with Hono.
  *
@@ -123,6 +124,15 @@ export function createGatewayServer(deps) {
         const webhookApp = createWebhookEndpoint(deps.webhookDeps);
         app.route("/hooks", webhookApp);
     }
+    // Mount OAuth callback at GET /oauth/callback/:provider
+    if (deps.oauthCallbackDeps) {
+        const oauthApp = createOAuthCallbackRoute({
+            ...deps.oauthCallbackDeps,
+            logger,
+        });
+        app.route("/oauth", oauthApp);
+        logger.debug({ submodule: "oauth-callback" }, "OAuth callback route mounted at /oauth/callback/:provider");
+    }
     // Mount web dashboard routes (if configured)
     let unsubscribeActivity;
     if (deps.webDeps) {

package/node_modules/@comis/gateway/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/gateway",
   "private": true,
-  "version": "1.0.34",
+  "version": "1.0.36",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "HTTP, JSON-RPC, and WebSocket gateway for Comis",

package/node_modules/@comis/infra/dist/logging/log-fields.d.ts

@@ -73,6 +73,29 @@ export interface LogFields {
      * that produced it.
      */
     module: string;
+    /**
+     * Finer-grained scope inside an existing `module` binding.
+     *
+     * Use at call sites instead of overriding `module:` in the payload.
+     * Pino concatenates parent-bound fields (pre-serialized JSON fragment)
+     * with the call-site object without deduplication, so passing
+     * `{ module: "agent.bridge.X" }` against a parent already bound with
+     * `module: "agent"` emits BOTH keys on the same line. JSON parsers
+     * keep the last, but the polluted output wastes bytes and confuses
+     * log consumers.
+     *
+     * `submodule` sidesteps the duplicate-key emission entirely:
+     * @example
+     *   logger.info(
+     *     { submodule: "bridge.hash-invariant", agentId, durationMs },
+     *     "Hash invariant assertion ran",
+     *   );
+     *
+     * Convention: omit any redundant parent-prefix from the value
+     * (e.g., under `module: "agent"`, prefer `submodule: "bridge.X"`
+     * over `submodule: "agent.bridge.X"`).
+     */
+    submodule: string;
     /**
      * Pipeline step name.
      * @example "response-filter" | "chunking" | "markdown-ir" | "media-compress"

package/node_modules/@comis/infra/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/infra",
   "private": true,
-  "version": "1.0.34",
+  "version": "1.0.36",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Structured logging infrastructure for Comis",

package/node_modules/@comis/memory/dist/compaction.d.ts

@@ -5,9 +5,8 @@
  * into semantic memories, keeping working memory bounded while preserving
  * important information.
  *
- * The summarizer is pluggable -- the actual LLM call will be wired in
- * Phase 3 (Agent). This module defines the interface and orchestrates
- * the compaction workflow.
+ * The summarizer is pluggable -- this module defines the interface and
+ * orchestrates the compaction workflow.
  *
  * Workflow:
  * 1. Find sessions idle for longer than minIdleMs
@@ -25,8 +24,7 @@ import type { SessionStore } from "./session-store.js";
 import type { SqliteMemoryAdapter } from "./sqlite-memory-adapter.js";
 /**
  * Pluggable summarizer function. Takes conversation messages and returns
- * a summary string plus extracted facts. The actual LLM call is wired
- * in Phase 3 (Agent).
+ * a summary string plus extracted facts.
  */
 export type Summarizer = (messages: unknown[]) => Promise<{
     summary: string;

package/node_modules/@comis/memory/dist/compaction.js

@@ -6,9 +6,8 @@
  * into semantic memories, keeping working memory bounded while preserving
  * important information.
  *
- * The summarizer is pluggable -- the actual LLM call will be wired in
- * Phase 3 (Agent). This module defines the interface and orchestrates
- * the compaction workflow.
+ * The summarizer is pluggable -- this module defines the interface and
+ * orchestrates the compaction workflow.
  *
  * Workflow:
  * 1. Find sessions idle for longer than minIdleMs

package/node_modules/@comis/memory/dist/delivery-queue-adapter.d.ts

@@ -8,7 +8,7 @@
  * @module
  */
 import type Database from "better-sqlite3";
-import type { DeliveryQueuePort } from "@comis/core";
+import type { DeliveryQueuePort, TypedEventBus } from "@comis/core";
 /**
  * Create a SQLite-backed DeliveryQueuePort.
  *
@@ -18,4 +18,4 @@ import type { DeliveryQueuePort } from "@comis/core";
  * @param db - An open better-sqlite3 Database instance
  * @returns DeliveryQueuePort implementation (frozen)
  */
-export declare function createSqliteDeliveryQueue(db: Database.Database): DeliveryQueuePort;
+export declare function createSqliteDeliveryQueue(db: Database.Database, eventBus: Pick<TypedEventBus, "emit">): DeliveryQueuePort;

package/node_modules/@comis/memory/dist/delivery-queue-adapter.js

@@ -50,7 +50,7 @@ function rowToEntry(row) {
  * @param db - An open better-sqlite3 Database instance
  * @returns DeliveryQueuePort implementation (frozen)
  */
-export function createSqliteDeliveryQueue(db) {
+export function createSqliteDeliveryQueue(db, eventBus) {
     // --- Prepared statements ---
     const insertStmt = db.prepare(`
     INSERT INTO delivery_queue (
@@ -87,6 +87,19 @@ export function createSqliteDeliveryQueue(db) {
     const pruneStmt = db.prepare(`
     DELETE FROM delivery_queue
     WHERE expire_at < ? AND status NOT IN ('delivered')
+  `);
+    const insertInFlightStmt = db.prepare(`
+    INSERT INTO delivery_queue (
+      id, text, channel_type, channel_id, tenant_id, options_json, origin,
+      format_applied, chunking_applied, status, attempt_count, max_attempts,
+      created_at, scheduled_at, expire_at, last_attempt_at, next_retry_at,
+      last_error, markdown_fallback_applied, delivered_message_id, trace_id
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'in_flight', 0, ?, ?, ?, ?, NULL, NULL, NULL, 0, NULL, ?)
+  `);
+    const recoverInFlightStmt = db.prepare(`
+    UPDATE delivery_queue
+    SET status = 'pending', last_error = NULL
+    WHERE status = 'in_flight'
   `);
     const depthStmt = db.prepare(`
     SELECT COUNT(*) as count FROM delivery_queue
@@ -103,6 +116,32 @@ export function createSqliteDeliveryQueue(db) {
             try {
                 const id = randomUUID();
                 insertStmt.run(id, entry.text, entry.channelType, entry.channelId, entry.tenantId, entry.optionsJson, entry.origin, entry.formatApplied ? 1 : 0, entry.chunkingApplied ? 1 : 0, entry.maxAttempts, entry.createdAt, entry.scheduledAt, entry.expireAt, entry.traceId ?? null);
+                // Emit AFTER SQL success -- preserves invariant: one delivery:enqueued <=> one persisted row.
+                eventBus.emit("delivery:enqueued", {
+                    entryId: id,
+                    channelId: entry.channelId,
+                    channelType: entry.channelType,
+                    origin: entry.origin,
+                    timestamp: Date.now(),
+                });
+                return Promise.resolve(ok(id));
+            }
+            catch (e) {
+                return Promise.resolve(err(e instanceof Error ? e : new Error(String(e))));
+            }
+        },
+        enqueueInFlight(entry) {
+            try {
+                const id = randomUUID();
+                insertInFlightStmt.run(id, entry.text, entry.channelType, entry.channelId, entry.tenantId, entry.optionsJson, entry.origin, entry.formatApplied ? 1 : 0, entry.chunkingApplied ? 1 : 0, entry.maxAttempts, entry.createdAt, entry.scheduledAt, entry.expireAt, entry.traceId ?? null);
+                // Same delivery:enqueued event as enqueue() -- universal observability (SPEC-R5).
+                eventBus.emit("delivery:enqueued", {
+                    entryId: id,
+                    channelId: entry.channelId,
+                    channelType: entry.channelType,
+                    origin: entry.origin,
+                    timestamp: Date.now(),
+                });
                 return Promise.resolve(ok(id));
             }
             catch (e) {
@@ -192,6 +231,15 @@ export function createSqliteDeliveryQueue(db) {
                 return Promise.resolve(err(e instanceof Error ? e : new Error(String(e))));
             }
         },
+        recoverInFlight() {
+            try {
+                const result = recoverInFlightStmt.run();
+                return Promise.resolve(ok(result.changes));
+            }
+            catch (e) {
+                return Promise.resolve(err(e instanceof Error ? e : new Error(String(e))));
+            }
+        },
     };
     return Object.freeze(queue);
 }

package/node_modules/@comis/memory/dist/index.d.ts

@@ -22,6 +22,8 @@ export type { BatchIndexer, BatchIndexerOptions, BatchIndexerResult } from "./em
 export { openSqliteDatabase, chmodDbFiles } from "./sqlite-adapter-base.js";
 export type { SqliteAdapterOptions } from "./sqlite-adapter-base.js";
 export { createSqliteSecretStore } from "./sqlite-secret-store.js";
+export { initOAuthProfileSchema } from "./oauth-profile-schema.js";
+export { createOAuthProfileStoreEncrypted } from "./oauth-profile-store-encrypted.js";
 export { setupSecrets } from "./setup-secrets.js";
 export type { SecretsBootResult } from "./setup-secrets.js";
 export { createNamedGraphStore } from "./named-graph-store.js";

package/node_modules/@comis/memory/dist/index.js

@@ -28,6 +28,9 @@ export { createBatchIndexer } from "./embedding-batch-indexer.js";
 export { openSqliteDatabase, chmodDbFiles } from "./sqlite-adapter-base.js";
 // SQLite secret store (SecretStorePort implementation)
 export { createSqliteSecretStore } from "./sqlite-secret-store.js";
+// OAuth profile schema + encrypted SQLite OAuthCredentialStorePort adapter
+export { initOAuthProfileSchema } from "./oauth-profile-schema.js";
+export { createOAuthProfileStoreEncrypted } from "./oauth-profile-store-encrypted.js";
 // Secret store bootstrap (master key resolution)
 export { setupSecrets } from "./setup-secrets.js";
 // Named graph store (server-side pipeline persistence)

package/node_modules/@comis/memory/dist/memory-api.d.ts

@@ -80,6 +80,6 @@ export interface MemoryApi {
  * and memory config.
  *
  * The factory function pattern is consistent with createSessionStore and
- * createSecretManager from Phase 1.
+ * createSecretManager.
  */
 export declare function createMemoryApi(db: Database.Database, adapter: SqliteMemoryAdapter, sessionStore: SessionStore, config: MemoryConfig): MemoryApi;

package/node_modules/@comis/memory/dist/memory-api.js

@@ -16,7 +16,7 @@ import { rowToEntry, buildFilterClause, countRows, groupCountRows } from "./row-
  * and memory config.
  *
  * The factory function pattern is consistent with createSessionStore and
- * createSecretManager from Phase 1.
+ * createSecretManager.
  */
 export function createMemoryApi(db, adapter, sessionStore, config) {
     return {

package/node_modules/@comis/memory/dist/oauth-profile-schema.d.ts

@@ -0,0 +1,17 @@
+import type Database from "better-sqlite3";
+/**
+ * Create the oauth_profiles table and supporting index.
+ *
+ * Single ciphertext+iv+auth_tag+salt per row — entire OAuthProfile JSON
+ * encrypted as one blob, no half-rotated state.
+ *
+ * Denormalized expires_at column lets the doctor query expiring profiles
+ * via SELECT profile_id FROM oauth_profiles WHERE provider = ?
+ * AND expires_at < ? without decrypting any blob.
+ *
+ * No FK to secrets table — OAuth profiles are independent from named
+ * secrets. Index on provider supports list({ provider }) filtering.
+ *
+ * Idempotent via IF NOT EXISTS — safe to call multiple times.
+ */
+export declare function initOAuthProfileSchema(db: Database.Database): void;

package/node_modules/@comis/memory/dist/oauth-profile-schema.js

@@ -0,0 +1,33 @@
+/**
+ * Create the oauth_profiles table and supporting index.
+ *
+ * Single ciphertext+iv+auth_tag+salt per row — entire OAuthProfile JSON
+ * encrypted as one blob, no half-rotated state.
+ *
+ * Denormalized expires_at column lets the doctor query expiring profiles
+ * via SELECT profile_id FROM oauth_profiles WHERE provider = ?
+ * AND expires_at < ? without decrypting any blob.
+ *
+ * No FK to secrets table — OAuth profiles are independent from named
+ * secrets. Index on provider supports list({ provider }) filtering.
+ *
+ * Idempotent via IF NOT EXISTS — safe to call multiple times.
+ */
+export function initOAuthProfileSchema(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS oauth_profiles (
+      profile_id              TEXT PRIMARY KEY,
+      provider                TEXT NOT NULL,
+      identity                TEXT NOT NULL,
+      credentials_ciphertext  BLOB NOT NULL,
+      credentials_iv          BLOB NOT NULL,
+      credentials_auth_tag    BLOB NOT NULL,
+      credentials_salt        BLOB NOT NULL,
+      expires_at              INTEGER NOT NULL,
+      version                 INTEGER NOT NULL DEFAULT 1,
+      created_at              INTEGER NOT NULL,
+      updated_at              INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_oauth_profiles_provider ON oauth_profiles(provider);
+  `);
+}

package/node_modules/@comis/memory/dist/oauth-profile-store-encrypted.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Encrypted SQLite-backed OAuthCredentialStorePort adapter.
+ *
+ * Mirrors credential-mapping-store's factory pattern (takes a pre-opened
+ * Database instance, does NOT open its own). The lifecycle is owned by
+ * the caller — we share the existing secrets.db connection to keep all
+ * encrypted-at-rest data in one DB file.
+ *
+ * The entire OAuthProfile JSON payload is encrypted as one AES-256-GCM
+ * blob per row. One ciphertext+iv+authTag+salt set per profile. Atomic
+ * update — no half-rotated state where access changes but refresh doesn't.
+ *
+ * Denormalized expires_at column stays in sync on every write so the
+ * doctor can query expiring profiles without decrypting any blob.
+ *
+ * @module
+ */
+import type Database from "better-sqlite3";
+import type { OAuthCredentialStorePort, SecretsCrypto } from "@comis/core";
+/**
+ * Create an encrypted OAuthCredentialStorePort backed by a shared SQLite DB.
+ *
+ * The adapter does NOT own the db lifecycle — the caller supplies an
+ * already-open Database (typically the secrets.db chain). Initializes its
+ * own oauth_profiles table via initOAuthProfileSchema (idempotent).
+ */
+export declare function createOAuthProfileStoreEncrypted(db: Database.Database, crypto: SecretsCrypto): OAuthCredentialStorePort;

package/node_modules/@comis/memory/dist/oauth-profile-store-encrypted.js

@@ -0,0 +1,144 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Encrypted SQLite-backed OAuthCredentialStorePort adapter.
+ *
+ * Mirrors credential-mapping-store's factory pattern (takes a pre-opened
+ * Database instance, does NOT open its own). The lifecycle is owned by
+ * the caller — we share the existing secrets.db connection to keep all
+ * encrypted-at-rest data in one DB file.
+ *
+ * The entire OAuthProfile JSON payload is encrypted as one AES-256-GCM
+ * blob per row. One ciphertext+iv+authTag+salt set per profile. Atomic
+ * update — no half-rotated state where access changes but refresh doesn't.
+ *
+ * Denormalized expires_at column stays in sync on every write so the
+ * doctor can query expiring profiles without decrypting any blob.
+ *
+ * @module
+ */
+import { ok, err, fromPromise } from "@comis/shared";
+import { validateProfileId } from "@comis/core";
+import { initOAuthProfileSchema } from "./oauth-profile-schema.js";
+const SCHEMA_VERSION = 1;
+/**
+ * Create an encrypted OAuthCredentialStorePort backed by a shared SQLite DB.
+ *
+ * The adapter does NOT own the db lifecycle — the caller supplies an
+ * already-open Database (typically the secrets.db chain). Initializes its
+ * own oauth_profiles table via initOAuthProfileSchema (idempotent).
+ */
+export function createOAuthProfileStoreEncrypted(db, crypto) {
+    initOAuthProfileSchema(db);
+    const upsertStmt = db.prepare(`
+    INSERT INTO oauth_profiles (
+      profile_id, provider, identity,
+      credentials_ciphertext, credentials_iv, credentials_auth_tag, credentials_salt,
+      expires_at, version, created_at, updated_at
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(profile_id) DO UPDATE SET
+      provider = excluded.provider,
+      identity = excluded.identity,
+      credentials_ciphertext = excluded.credentials_ciphertext,
+      credentials_iv = excluded.credentials_iv,
+      credentials_auth_tag = excluded.credentials_auth_tag,
+      credentials_salt = excluded.credentials_salt,
+      expires_at = excluded.expires_at,
+      version = excluded.version,
+      updated_at = excluded.updated_at
+  `);
+    const getStmt = db.prepare("SELECT * FROM oauth_profiles WHERE profile_id = ?");
+    const deleteStmt = db.prepare("DELETE FROM oauth_profiles WHERE profile_id = ?");
+    const listAllStmt = db.prepare("SELECT * FROM oauth_profiles");
+    const listByProviderStmt = db.prepare("SELECT * FROM oauth_profiles WHERE provider = ?");
+    const existsStmt = db.prepare("SELECT 1 FROM oauth_profiles WHERE profile_id = ?");
+    function rowToProfile(row) {
+        if (row.version !== SCHEMA_VERSION) {
+            return err(new Error("OAuth profile store version mismatch: expected " +
+                SCHEMA_VERSION +
+                ", got " +
+                String(row.version) +
+                ". Hint: drop the oauth_profiles table and re-run `comis auth login` to recreate. Stored profiles for unknown schema versions cannot be migrated."));
+        }
+        const decryptResult = crypto.decrypt({
+            ciphertext: row.credentials_ciphertext,
+            iv: row.credentials_iv,
+            authTag: row.credentials_auth_tag,
+            salt: row.credentials_salt,
+        });
+        if (!decryptResult.ok)
+            return err(decryptResult.error);
+        let parsed;
+        try {
+            parsed = JSON.parse(decryptResult.value);
+        }
+        catch (e) {
+            return err(new Error("OAuth profile decryption produced invalid JSON: " + String(e)));
+        }
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+            return err(new Error("OAuth profile decryption produced non-object payload"));
+        }
+        return ok(parsed);
+    }
+    const port = {
+        async get(profileId) {
+            const validation = validateProfileId(profileId);
+            if (!validation.ok)
+                return err(validation.error);
+            return fromPromise((async () => {
+                const row = getStmt.get(profileId);
+                if (!row)
+                    return undefined;
+                const r = rowToProfile(row);
+                if (!r.ok)
+                    throw r.error;
+                return r.value;
+            })());
+        },
+        async set(profileId, profile) {
+            const validation = validateProfileId(profileId);
+            if (!validation.ok)
+                return err(validation.error);
+            const fullProfile = { ...profile, profileId, version: SCHEMA_VERSION };
+            const payload = JSON.stringify(fullProfile);
+            const encryptResult = crypto.encrypt(payload);
+            if (!encryptResult.ok)
+                return err(encryptResult.error);
+            const enc = encryptResult.value;
+            const now = Date.now();
+            return fromPromise((async () => {
+                upsertStmt.run(profileId, validation.value.provider, validation.value.identity, enc.ciphertext, enc.iv, enc.authTag, enc.salt, fullProfile.expires, SCHEMA_VERSION, now, now);
+            })());
+        },
+        async delete(profileId) {
+            const validation = validateProfileId(profileId);
+            if (!validation.ok)
+                return err(validation.error);
+            return fromPromise((async () => {
+                const result = deleteStmt.run(profileId);
+                return result.changes > 0;
+            })());
+        },
+        async list(filter) {
+            return fromPromise((async () => {
+                const rows = filter?.provider
+                    ? listByProviderStmt.all(filter.provider)
+                    : listAllStmt.all();
+                const profiles = [];
+                for (const row of rows) {
+                    const r = rowToProfile(row);
+                    if (!r.ok)
+                        throw r.error;
+                    profiles.push(r.value);
+                }
+                return profiles;
+            })());
+        },
+        async has(profileId) {
+            const validation = validateProfileId(profileId);
+            if (!validation.ok)
+                return err(validation.error);
+            return fromPromise((async () => existsStmt.get(profileId) !== undefined)());
+        },
+    };
+    return Object.freeze(port);
+}

package/node_modules/@comis/memory/dist/session-store.d.ts

@@ -5,7 +5,7 @@
  * prepared statements. Sessions survive process restarts since they are
  * stored in SQLite.
  *
- * Factory function pattern (createSessionStore) consistent with Phase 1
+ * Factory function pattern (createSessionStore) consistent with
  * createSecretManager for minimal public surface area.
  */
 import type Database from "better-sqlite3";

package/node_modules/@comis/memory/dist/session-store.js

@@ -6,7 +6,7 @@
  * prepared statements. Sessions survive process restarts since they are
  * stored in SQLite.
  *
- * Factory function pattern (createSessionStore) consistent with Phase 1
+ * Factory function pattern (createSessionStore) consistent with
  * createSecretManager for minimal public surface area.
  */
 import { formatSessionKey } from "@comis/core";

package/node_modules/@comis/memory/dist/sqlite-secret-store.d.ts

@@ -10,7 +10,32 @@
  *
  * Persists encrypted secrets across daemon restarts.
  */
+import type Database from "better-sqlite3";
 import type { SecretStorePort, SecretsCrypto } from "@comis/core";
+/**
+ * Concrete return type of createSqliteSecretStore.
+ *
+ * Implements SecretStorePort and additionally exposes the underlying
+ * better-sqlite3 handle for adapters that need to share the same
+ * connection (e.g., the encrypted OAuth profile store).
+ *
+ * The `db` field is intentionally additive — `SecretStorePort` itself is
+ * unchanged and remains the canonical port boundary. Consumers that only
+ * need port-level operations should accept `SecretStorePort`, not
+ * `SqliteSecretStoreHandle`.
+ */
+export interface SqliteSecretStoreHandle extends SecretStorePort {
+    /**
+     * Underlying better-sqlite3 handle.
+     *
+     * Use for sharing the connection with sibling tables in the same DB
+     * file (e.g., `oauth_profiles` alongside `secrets`). Eliminates the
+     * dual-handle hazard (close-order, schema-init double-execution,
+     * prepared-statement cache fragmentation) that two separate handles
+     * to the same WAL-mode SQLite file would introduce.
+     */
+    readonly db: Database.Database;
+}
 /**
  * Create a SqliteSecretStore bound to the given database path.
  *
@@ -22,11 +47,12 @@ import type { SecretStorePort, SecretsCrypto } from "@comis/core";
  * 5. Validate canary (master key mismatch detection)
  * 6. Second chmod pass (SQLite may create WAL/SHM during canary)
  * 7. Prepare all SQL statements once
- * 8. Return frozen SecretStorePort object
+ * 8. Return frozen SqliteSecretStoreHandle (SecretStorePort + db field)
  *
  * @param dbPath - Absolute path to the secrets.db file
  * @param crypto - SecretsCrypto engine bound to the current master key
- * @returns SecretStorePort implementation
+ * @returns SqliteSecretStoreHandle — a SecretStorePort that also exposes
+ *          the underlying better-sqlite3 handle on `.db`
  * @throws Error if schema init, canary validation, or DB open fails
  */
-export declare function createSqliteSecretStore(dbPath: string, crypto: SecretsCrypto): SecretStorePort;
+export declare function createSqliteSecretStore(dbPath: string, crypto: SecretsCrypto): SqliteSecretStoreHandle;

package/node_modules/@comis/memory/dist/sqlite-secret-store.js

@@ -25,11 +25,12 @@ import { openSqliteDatabase, chmodDbFiles } from "./sqlite-adapter-base.js";
  * 5. Validate canary (master key mismatch detection)
  * 6. Second chmod pass (SQLite may create WAL/SHM during canary)
  * 7. Prepare all SQL statements once
- * 8. Return frozen SecretStorePort object
+ * 8. Return frozen SqliteSecretStoreHandle (SecretStorePort + db field)
  *
  * @param dbPath - Absolute path to the secrets.db file
  * @param crypto - SecretsCrypto engine bound to the current master key
- * @returns SecretStorePort implementation
+ * @returns SqliteSecretStoreHandle — a SecretStorePort that also exposes
+ *          the underlying better-sqlite3 handle on `.db`
  * @throws Error if schema init, canary validation, or DB open fails
  */
 export function createSqliteSecretStore(dbPath, crypto) {
@@ -149,5 +150,12 @@ export function createSqliteSecretStore(dbPath, crypto) {
             db.close();
         },
     };
-    return Object.freeze(store);
+    // Expose the underlying db handle on the factory return so the encrypted
+    // OAuth profile adapter (oauth-profile-store-encrypted) can share this same
+    // connection rather than opening a second handle to the same secrets.db
+    // file. The SecretStorePort surface itself is unchanged — consumers that
+    // only need port-level operations should accept SecretStorePort, not
+    // SqliteSecretStoreHandle.
+    const handle = { ...store, db };
+    return Object.freeze(handle);
 }

package/node_modules/@comis/memory/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/memory",
   "private": true,
-  "version": "1.0.34",
+  "version": "1.0.36",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "SQLite memory, embeddings, and RAG storage for Comis agents",

package/node_modules/@comis/scheduler/dist/execution/execution-lock.d.ts

@@ -14,6 +14,19 @@ export interface ExecutionLockOptions {
     updateMs: number;
     /** Callback when lock is compromised (e.g., external release). */
     onCompromised?: (err: Error) => void;
+    /**
+     * Optional lock-acquisition retry budget. Forwarded to proper-lockfile's
+     * own retry option (uses a built-in incremental backoff). When undefined
+     * (default), retries: 0 — fail fast on contention. Lets the OAuth manager
+     * wait for a sibling refresh to complete (concurrent-refresh acceptance)
+     * without callers having to roll their own retry loop.
+     */
+    retries?: number | {
+        retries: number;
+        minTimeout?: number;
+        maxTimeout?: number;
+        factor?: number;
+    };
 }
 /**
  * Acquire a file lock, execute the function, and release the lock.

package/node_modules/@comis/scheduler/dist/execution/execution-lock.js

@@ -41,7 +41,7 @@ export async function withExecutionLock(lockPath, fn, options) {
         release = await lockfile.lock(lockPath, {
             stale: opts.staleMs,
             update: opts.updateMs,
-            retries: 0,
+            retries: opts.retries ?? 0,
             onCompromised: opts.onCompromised ?? (() => { }),
         });
     }

package/node_modules/@comis/scheduler/dist/execution/index.d.ts

@@ -1,2 +1,4 @@
 export { createExecutionTracker } from "./execution-tracker.js";
 export type { ExecutionTracker, ExecutionLogEntry } from "./execution-tracker.js";
+export { withExecutionLock, isLocked } from "./execution-lock.js";
+export type { ExecutionLockOptions } from "./execution-lock.js";

package/node_modules/@comis/scheduler/dist/execution/index.js

@@ -2,3 +2,5 @@
 // @comis/scheduler/execution — execution safety primitives
 // Execution tracking
 export { createExecutionTracker } from "./execution-tracker.js";
+// File-based execution lock
+export { withExecutionLock, isLocked } from "./execution-lock.js";

package/node_modules/@comis/scheduler/dist/heartbeat/agent-heartbeat-source.js

@@ -158,7 +158,7 @@ export function createAgentHeartbeatSource(deps) {
                 },
             };
             // 9. Resolve model (for logging)
-            const model = resolveHeartbeatModel(undefined, // per-agent heartbeat model removed in Phase 2
+            const model = resolveHeartbeatModel(undefined, // per-agent heartbeat model not in schema
             undefined, // global heartbeat model not yet in schema
             agentConfig.model);
             logger.info({ agentId, trigger, model, channelType: msg.channelType }, "Heartbeat run starting");

package/node_modules/@comis/scheduler/dist/index.d.ts

@@ -7,6 +7,8 @@ export { createCronScheduler } from "./cron/index.js";
 export type { CronScheduler } from "./cron/index.js";
 export { createExecutionTracker } from "./execution/index.js";
 export type { ExecutionTracker, ExecutionLogEntry } from "./execution/index.js";
+export { withExecutionLock, isLocked } from "./execution/execution-lock.js";
+export type { ExecutionLockOptions } from "./execution/execution-lock.js";
 export { HEARTBEAT_OK_TOKEN, createHeartbeatRunner } from "./heartbeat/index.js";
 export type { HeartbeatCheckResult, HeartbeatSourcePort, HeartbeatRunner } from "./heartbeat/index.js";
 export { resolveEffectiveHeartbeatConfig } from "./heartbeat/index.js";