comisai 1.0.34 → 1.0.37

package/node_modules/@comis/core/dist/config/index.d.ts

@@ -1,5 +1,7 @@
 export { AppConfigSchema } from "./schema.js";
 export { ApprovalsConfigSchema, ApprovalRuleSchema, checkApprovalsConfig } from "./schema-approvals.js";
+export { ToolingConfigSchema, DEFAULT_CLUSTER_CONFIG, DEFAULT_BUILTIN_ASSIGNMENTS, } from "./schema-tooling.js";
+export type { ToolingConfig } from "./schema-tooling.js";
 export { AutoReplyEngineConfigSchema, GroupActivationModeSchema, } from "./schema-auto-reply-engine.js";
 export { BrowserConfigSchema } from "./schema-browser.js";
 export { MessagesConfigSchema } from "./schema-messages.js";
@@ -22,6 +24,8 @@ export type { SubagentContextConfig } from "../domain/subagent-context-config.js
 export { AgentSecretsConfigSchema, SecretsConfigSchema, } from "./schema-secrets.js";
 export { BackgroundTasksConfigSchema } from "./schema-background-tasks.js";
 export type { BackgroundTasksConfig } from "./schema-background-tasks.js";
+export { OutputRetentionConfigSchema } from "./schema-output-retention.js";
+export type { OutputRetentionConfig, RetentionClass } from "./schema-output-retention.js";
 export { SkillsConfigSchema, PromptSkillsConfigSchema } from "./schema-skills.js";
 export { DaemonConfigSchema, LoggingConfigSchema, TracingDefaultsSchema, ConfigWebhookSchema } from "./schema-daemon.js";
 export { HeartbeatConfigSchema, SchedulerConfigSchema } from "./schema-scheduler.js";
@@ -30,6 +34,8 @@ export { IntegrationsConfigSchema, BraveSearchConfigSchema, McpServerEntrySchema
 export { MonitoringConfigSchema } from "./schema-observability.js";
 export { ObservabilityConfigSchema } from "./schema-observability.js";
 export type { ObservabilityConfig, ObservabilityPersistenceConfig } from "./schema-observability.js";
+export { OAuthConfigSchema } from "./schema-oauth.js";
+export type { OAuthConfig } from "./schema-oauth.js";
 export { PluginsConfigSchema, PluginEntrySchema } from "./schema-plugins.js";
 export { QueueConfigSchema, QueueModeSchema, OverflowPolicySchema, PerChannelQueueConfigSchema, OverflowConfigSchema, DebounceBufferConfigSchema, FollowupConfigSchema, PriorityLaneConfigSchema, LaneAssignmentConfigSchema, } from "./schema-queue.js";
 export { StreamingConfigSchema, PerChannelStreamingConfigSchema, TypingModeSchema, ChunkModeSchema, TableModeSchema, } from "./schema-streaming.js";
@@ -61,7 +67,7 @@ export { loadConfigFile, validateConfig } from "./loader.js";
 export type { ConfigLoadOptions } from "./loader.js";
 export { resolveIncludes, MAX_INCLUDE_DEPTH } from "./include-resolver.js";
 export type { IncludeResolverDeps } from "./include-resolver.js";
-export { substituteEnvVars, warnSuspiciousEnvValues, extractReferencedSecretNames, type EnvValueWarning } from "./env-substitution.js";
+export { substituteEnvVars, warnSuspiciousEnvValues, extractReferencedSecretNames, findUnresolvedEnvRefs, formatMissingEnvRefError, type EnvValueWarning, type UnresolvedEnvRef, } from "./env-substitution.js";
 export { migrateConfig } from "./migrate.js";
 export { deepMerge, mergeLayered, loadLayered } from "./layered.js";
 export { IMMUTABLE_CONFIG_PREFIXES, MUTABLE_CONFIG_OVERRIDES, isImmutableConfigPath, matchesOverridePattern, getMutableOverridesForSection } from "./immutable-keys.js";

package/node_modules/@comis/core/dist/config/index.js

@@ -3,6 +3,7 @@
 // Schemas (for direct validation or extension)
 export { AppConfigSchema } from "./schema.js";
 export { ApprovalsConfigSchema, ApprovalRuleSchema, checkApprovalsConfig } from "./schema-approvals.js";
+export { ToolingConfigSchema, DEFAULT_CLUSTER_CONFIG, DEFAULT_BUILTIN_ASSIGNMENTS, } from "./schema-tooling.js";
 export { AutoReplyEngineConfigSchema, GroupActivationModeSchema, } from "./schema-auto-reply-engine.js";
 export { BrowserConfigSchema } from "./schema-browser.js";
 export { MessagesConfigSchema } from "./schema-messages.js";
@@ -25,6 +26,7 @@ export { SecurityConfigSchema, PermissionConfigSchema, ActionConfirmationConfigS
 export { SubagentContextConfigSchema } from "../domain/subagent-context-config.js";
 export { AgentSecretsConfigSchema, SecretsConfigSchema, } from "./schema-secrets.js";
 export { BackgroundTasksConfigSchema } from "./schema-background-tasks.js";
+export { OutputRetentionConfigSchema } from "./schema-output-retention.js";
 export { SkillsConfigSchema, PromptSkillsConfigSchema } from "./schema-skills.js";
 export { DaemonConfigSchema, LoggingConfigSchema, TracingDefaultsSchema, ConfigWebhookSchema } from "./schema-daemon.js";
 export { HeartbeatConfigSchema, SchedulerConfigSchema } from "./schema-scheduler.js";
@@ -32,6 +34,7 @@ export { GatewayConfigSchema, GatewayTlsConfigSchema, GatewayTokenSchema, Gatewa
 export { IntegrationsConfigSchema, BraveSearchConfigSchema, McpServerEntrySchema, McpConfigSchema, TranscriptionConfigSchema, TtsConfigSchema, TtsAutoModeSchema, ElevenLabsVoiceSettingsSchema, TtsOutputFormatSchema, ImageAnalysisConfigSchema, VisionScopeRuleSchema, VisionConfigSchema, LinkUnderstandingConfigSchema, MediaInfraConfigSchema, MediaConfigSchema, AutoReplyRuleSchema, AutoReplyConfigSchema, DOCUMENT_MIME_WHITELIST, FileExtractionConfigSchema, MediaPersistenceConfigSchema, ImageGenerationConfigSchema, } from "./schema-integrations.js";
 export { MonitoringConfigSchema } from "./schema-observability.js";
 export { ObservabilityConfigSchema } from "./schema-observability.js";
+export { OAuthConfigSchema } from "./schema-oauth.js";
 export { PluginsConfigSchema, PluginEntrySchema } from "./schema-plugins.js";
 export { QueueConfigSchema, QueueModeSchema, OverflowPolicySchema, PerChannelQueueConfigSchema, OverflowConfigSchema, DebounceBufferConfigSchema, FollowupConfigSchema, PriorityLaneConfigSchema, LaneAssignmentConfigSchema, } from "./schema-queue.js";
 export { StreamingConfigSchema, PerChannelStreamingConfigSchema, TypingModeSchema, ChunkModeSchema, TableModeSchema, } from "./schema-streaming.js";
@@ -51,7 +54,7 @@ export { loadConfigFile, validateConfig } from "./loader.js";
 // Include resolver ($include directive processing)
 export { resolveIncludes, MAX_INCLUDE_DEPTH } from "./include-resolver.js";
 // Environment variable substitution (${VAR} processing)
-export { substituteEnvVars, warnSuspiciousEnvValues, extractReferencedSecretNames } from "./env-substitution.js";
+export { substituteEnvVars, warnSuspiciousEnvValues, extractReferencedSecretNames, findUnresolvedEnvRefs, formatMissingEnvRefError, } from "./env-substitution.js";
 // Config migration (legacy key transformation)
 export { migrateConfig } from "./migrate.js";
 // Layered merge

package/node_modules/@comis/core/dist/config/loader.js

@@ -74,11 +74,18 @@ export function loadConfigFile(filePath, options) {
         }
         // Step 3: Substitute ${VAR} references (if getSecret provided)
         if (options?.getSecret) {
+            // Stash disabled MCP server entries before substitution. A disabled
+            // server may legitimately reference env vars the user has not set yet
+            // (e.g., a placeholder finnhub entry awaiting an API key). Substitution
+            // must not fail bootstrap on those — they are filtered out at
+            // connect-time in setup-mcp.ts. Originals are restored verbatim after.
+            const stash = stashDisabledMcpServers(processed);
             const subResult = substituteEnvVars(processed, options.getSecret, resolved);
             if (!subResult.ok) {
                 return subResult;
             }
             processed = subResult.value;
+            restoreDisabledMcpServers(processed, stash);
         }
         return ok(processed);
     }
@@ -108,3 +115,57 @@ export function validateConfig(raw) {
         details: result.error.issues,
     });
 }
+/**
+ * Replace `enabled: false` MCP server entries in
+ * `integrations.mcp.servers[]` with neutral stubs and return the originals
+ * so `restoreDisabledMcpServers` can put them back after env substitution.
+ *
+ * Mutates `processed` in place. The stub keeps no env-substitutable fields,
+ * so substitution sees no `${VAR}` refs from disabled servers.
+ */
+function stashDisabledMcpServers(processed) {
+    const integrations = processed.integrations;
+    if (integrations === null || typeof integrations !== "object" || Array.isArray(integrations)) {
+        return [];
+    }
+    const mcp = integrations.mcp;
+    if (mcp === null || typeof mcp !== "object" || Array.isArray(mcp))
+        return [];
+    const servers = mcp.servers;
+    if (!Array.isArray(servers))
+        return [];
+    const stash = [];
+    for (let idx = 0; idx < servers.length; idx++) {
+        const srv = servers[idx];
+        if (srv === null || typeof srv !== "object" || Array.isArray(srv))
+            continue;
+        if (srv.enabled !== false)
+            continue;
+        stash.push({ idx, original: srv });
+        servers[idx] = { enabled: false };
+    }
+    return stash;
+}
+/**
+ * Restore originals previously saved by `stashDisabledMcpServers`. Operates
+ * on the substituted tree (a fresh object returned by `substituteEnvVars`),
+ * walking back to the same array index. No-op when stash is empty.
+ */
+function restoreDisabledMcpServers(processed, stash) {
+    if (stash.length === 0)
+        return;
+    const integrations = processed.integrations;
+    if (integrations === null || typeof integrations !== "object" || Array.isArray(integrations)) {
+        return;
+    }
+    const mcp = integrations.mcp;
+    if (mcp === null || typeof mcp !== "object" || Array.isArray(mcp))
+        return;
+    const servers = mcp.servers;
+    if (!Array.isArray(servers))
+        return;
+    for (const { idx, original } of stash) {
+        if (idx < servers.length)
+            servers[idx] = original;
+    }
+}

package/node_modules/@comis/core/dist/config/managed-sections.d.ts

@@ -41,7 +41,7 @@ export interface ManagedSectionRedirect {
      * fields fit in < 20 lines of hint text. Verified against the tool's
      * TypeBox parameter schema as of this commit.
      *
-     * Bug B (260428-gj6): production trace c7b91328 showed the agent burning
+     * Bug B: production trace c7b91328 showed the agent burning
      * ~30s × 4 LLM calls re-loading the agents_manage schema after an
      * immutable-path rejection. Surfacing the fragment inline closes that
      * round-trip tax.
@@ -91,8 +91,8 @@ export declare function getManagedSectionRedirect(section: string | undefined, k
  *   stub forwards to the real tool and registers it as discovered).
  *
  * Naming `discover_tools` in the hint actively misleads Anthropic
- * Sonnet/Opus 4.x because that tool is not in their payload (260428-oyc
- * production repro: agent saw "Recovery: (1) call discover_tools(...)" and
+ * Sonnet/Opus 4.x because that tool is not in their payload (production
+ * repro: agent saw "Recovery: (1) call discover_tools(...)" and
  * gave up, reporting "I don't have a discover_tools function"). The
  * single-step framing works on every provider.
  *

package/node_modules/@comis/core/dist/config/managed-sections.js

@@ -30,7 +30,7 @@ export const MANAGED_SECTIONS = [
         // Flat parameter shape -- verified against mcp-manage-tool.ts McpManageToolParams.
         exampleArgs: {
             action: "connect",
-            name: "<server-name>",
+            server_name: "<server-name>",
             transport: "stdio",
             command: "<command>",
             args: [],
@@ -44,7 +44,7 @@ export const MANAGED_SECTIONS = [
         schemaFragment: {
             actions: ["list", "status", "connect", "disconnect", "reconnect"],
             requiredByAction: {
-                connect: ["name", "transport", "command"],
+                connect: ["server_name", "transport", "command"],
             },
         },
     },
@@ -120,6 +120,11 @@ export const MANAGED_SECTIONS = [
                 model: "<model-id>",
                 provider: "<provider>",
                 maxSteps: 100,
+                // Advertise the per-agent OAuth profile preference to the LLM.
+                // Maps provider → "<provider>:<identity>" stored profile ID.
+                // Validated end-to-end by the Zod refine and daemon-side has()
+                // existence check.
+                oauthProfiles: { "openai-codex": "openai-codex:user@example.com" },
             },
         },
         fullyManaged: true,
@@ -173,8 +178,8 @@ export function getManagedSectionRedirect(section, key) {
  *   stub forwards to the real tool and registers it as discovered).
  *
  * Naming `discover_tools` in the hint actively misleads Anthropic
- * Sonnet/Opus 4.x because that tool is not in their payload (260428-oyc
- * production repro: agent saw "Recovery: (1) call discover_tools(...)" and
+ * Sonnet/Opus 4.x because that tool is not in their payload (production
+ * repro: agent saw "Recovery: (1) call discover_tools(...)" and
  * gave up, reporting "I don't have a discover_tools function"). The
  * single-step framing works on every provider.
  *
@@ -195,7 +200,7 @@ export function formatRedirectHint(redirect, mutablePaths) {
     else {
         parts.push(`Call ${redirect.tool} directly; it will auto-load on first invocation.`);
     }
-    // Bug B (260428-gj6): inline the dedicated tool's action enum + required
+    // Bug B: inline the dedicated tool's action enum + required
     // fields so the LLM can call it without a separate discover_tools round-
     // trip. Positioned AFTER the Recovery example (so the example is the first
     // thing the model sees) and BEFORE the mutablePaths block (which is the