comisai 1.0.34 → 1.0.37

package/node_modules/@comis/daemon/dist/daemon-types.d.ts

@@ -5,11 +5,11 @@
  * @module
  */
 import type { DeviceIdentity } from "@comis/core";
-import type { AppContainer, ChannelPort } from "@comis/core";
+import type { AppContainer, ChannelPort, DeliveryQueuePort } from "@comis/core";
 import type { ApprovalGate } from "@comis/core";
-import type { ChannelHealthMonitor } from "@comis/channels";
+import type { ChannelHealthMonitor, DeliveryAdapter } from "@comis/channels";
 import type { ComisLogger } from "@comis/infra";
-import type { SessionResetScheduler } from "@comis/agent";
+import type { SessionResetScheduler, BackgroundTaskManager } from "@comis/agent";
 import type { GatewayServerHandle } from "@comis/gateway";
 import type { HeartbeatRunner, CronScheduler } from "@comis/scheduler";
 import type { BrowserService, RpcCall } from "@comis/skills";
@@ -52,6 +52,26 @@ export interface DaemonInstance {
     readonly heartbeatRunner?: HeartbeatRunner;
     readonly gatewayHandle?: GatewayServerHandle;
     readonly adapterRegistry: Map<string, ChannelPort>;
+    /**
+     * Delivery-queue-side adapter map. Adapters registered here are
+     * used by the recurring delivery-queue drainer for crash-safe outbound
+     * delivery. Distinct from `adapterRegistry` (which serves direct dispatch
+     * via the RPC message.* path) -- daemon.ts populates this map AFTER
+     * setupChannels returns. Tests that exercise the recurring drainer must
+     * register adapters in this map so the drainer can find them.
+     */
+    readonly deliveryAdapters: Map<string, DeliveryAdapter>;
+    /**
+     * Crash-safe delivery queue port. Exposed for tests that need
+     * to assert on queue depth (depth returns to 0 after drain).
+     */
+    readonly deliveryQueue: DeliveryQueuePort;
+    /**
+     * Background task manager. Exposed for integration tests that
+     * need to promote synthetic tasks and call complete()/fail() to drive the
+     * completion runner pipeline without a live LLM.
+     */
+    readonly backgroundTaskManager: BackgroundTaskManager;
     readonly rpcCall: RpcCall;
     readonly deviceIdentity?: DeviceIdentity;
     readonly diagnosticCollector: DiagnosticCollector;

package/node_modules/@comis/daemon/dist/daemon.js

@@ -3,13 +3,13 @@
  * Daemon Entry Point: thin orchestrator calling setupXxx() factories in sequence.
  * @module
  */
-import { bootstrap, loadEnvFile, createApprovalGate, parseFormattedSessionKey, createConfigGitManager, envSubset, generateStrongToken, createAuditAggregator, createInjectionRateLimiter, validateMemoryWrite, checkApprovalsConfig, safePath, resolveConfigSecretRefs, formatSessionKey } from "@comis/core";
+import { bootstrap, loadEnvFile, createApprovalGate, parseFormattedSessionKey, createConfigGitManager, envSubset, generateStrongToken, createAuditAggregator, createInjectionRateLimiter, validateMemoryWrite, checkApprovalsConfig, safePath, resolveConfigSecretRefs, formatSessionKey, BackgroundTasksConfigSchema } from "@comis/core";
 import { setupSecrets as _setupSecretsImpl, createSqliteSecretStore, createNamedGraphStore, createContextStore, createObservabilityStore } from "@comis/memory";
 import { ok, err, suppressError } from "@comis/shared";
 import { createGatewayServer } from "@comis/gateway";
-import { setupLogging, setupObservability, setupHealth, setupMemory, setupAgents, setupSchedulers, setupChannels, setupMedia, setupCrossSession, setupMcp, setupTools, setupMonitoring, setupHeartbeat, setupTaskExtraction, setupShutdown, setupGateway, setupRpcBridge, setupDeliveryQueue, setupDeliveryMirror, setupNotifications, setupBackgroundTasks, } from "./wiring/index.js";
+import { setupLogging, setupObservability, setupHealth, setupMemory, setupAgents, setupSchedulers, setupChannels, setupMedia, setupCrossSession, setupMcp, setupTools, setupMonitoring, setupHeartbeat, setupTaskExtraction, setupShutdown, setupGateway, setupRpcBridge, setupDeliveryQueue, setupDeliveryMirror, setupNotifications, setupBackgroundTasks, setupBackgroundCompletionRunner, setupOutputRetention, } from "./wiring/index.js";
 import { setupSingleAgent } from "./wiring/setup-agents.js";
-import { createActiveRunRegistry, createModelCatalog, wireSessionStateCleanup, wireMcpDisconnectCleanup, createGeminiCacheManager, wireGeminiCacheCleanup, createSessionTrackerRegistry, validateProviderOverrides } from "@comis/agent";
+import { createActiveRunRegistry, createBackgroundSessionResolver, createModelCatalog, wireSessionStateCleanup, wireMcpDisconnectCleanup, createGeminiCacheManager, wireGeminiCacheCleanup, createSessionTrackerRegistry, validateProviderOverrides, resolveWorkspaceDir } from "@comis/agent";
 import { detectSandboxProvider, createImageGenProvider, createImageGenRateLimiter, createFileStateTracker } from "@comis/skills";
 import { createGraphCoordinator, createNodeTypeRegistry } from "./graph/index.js";
 import { createChannelHealthMonitor } from "@comis/channels";
@@ -27,6 +27,7 @@ import { registerGracefulShutdown } from "./process/graceful-shutdown.js";
 import { createProcessMonitor } from "./process/process-monitor.js";
 import { startWatchdog } from "./health/watchdog.js";
 import { emitDockerRestartPolicyWarn } from "./setup-docker-restart-warn.js";
+import { hasAnyOAuthAgent, emitOAuthTlsPreflightWarn } from "./wiring/oauth-preflight.js";
 import { randomUUID, createHmac } from "node:crypto";
 import { existsSync, chmodSync, statSync, mkdirSync, readFileSync, unlinkSync, cpSync } from "node:fs";
 import { writeFile as fsWriteFile, rm } from "node:fs/promises";
@@ -184,7 +185,7 @@ export async function runPreflightDoctor(exitFn, opts = {}) {
             level: 60,
             time: new Date().toISOString(),
             name: "comis-daemon",
-            module: "preflight",
+            submodule: "preflight",
             errorKind: "dependency",
             err: message,
             hint: "Native module 'better-sqlite3' failed to load. Try: npm rebuild better-sqlite3 (or re-run install.sh). If this persists, reinstall comisai from a fresh tarball.",
@@ -243,6 +244,11 @@ export async function main(overrides = {}) {
     });
     let mergedEnv = process.env;
     let secretStore;
+    // Captured here so setupAgents can wire the encrypted-mode OAuth profile
+    // adapter against the SAME db handle (no dual-handle to the same secrets.db
+    // file).
+    let secretsCrypto;
+    let secretsDb;
     if (!secretsBootResult.ok) {
         // Invalid master key -- fatal error
         throw new Error(`Secrets bootstrap failed: ${secretsBootResult.error.message}`);
@@ -252,6 +258,9 @@ export async function main(overrides = {}) {
         const { crypto, dbPath } = secretsBootResult.value;
         const store = createSqliteSecretStore(dbPath, crypto);
         secretStore = store;
+        // Capture for downstream OAuth wiring in setupAgents.
+        secretsCrypto = crypto;
+        secretsDb = store.db;
         const decryptResult = store.decryptAll();
         if (!decryptResult.ok) {
             throw new Error(`Secret decryption failed: ${decryptResult.error.message}`);
@@ -328,7 +337,7 @@ export async function main(overrides = {}) {
     if (approvalsWarning) {
         daemonLogger.warn({ hint: "Set approvals.enabled: true or remove unused rules", errorKind: "config" }, approvalsWarning);
     }
-    // 3.6. Validate PROVIDER_OVERRIDES vs live pi-ai catalog (Layer 3C -- 260501-07g).
+    // 3.6. Validate PROVIDER_OVERRIDES vs live pi-ai catalog.
     // Emits one structured WARN per orphaned override key (provider listed in
     // PROVIDER_OVERRIDES that pi-ai no longer ships). Fire-and-forget: never
     // throws, daemon continues to boot with dead override entries.
@@ -378,6 +387,11 @@ export async function main(overrides = {}) {
     // Created once and injected into both setupAgents (PiExecutor registration)
     // and setupChannels (inbound pipeline routing).
     const activeRunRegistry = createActiveRunRegistry();
+    // Composite-key resolver wraps the registry for production lookups.
+    // The raw registry is still threaded for register/deregister calls in
+    // pi-executor and executor-post-execution; the resolver supersedes
+    // single-arg `.has()`/`.get()` everywhere.
+    const sessionResolver = createBackgroundSessionResolver({ activeRunRegistry });
     // Derive canary fallback secret from tenantId.
     // Used when CANARY_SECRET env var is not configured. The per-agent derivation
     // in setup-agents.ts uses this as a base combined with agentId for uniqueness.
@@ -405,7 +419,7 @@ export async function main(overrides = {}) {
     // Deferred channel plugins ref for resolving platform character limits.
     // Populated after setupChannels; the callback is invoked at message time (always set by then).
     const channelPluginsRef = {};
-    // 6.5.1. Background task system (Proactive v1 -- BGND)
+    // 6.5.1. Background task system
     // Created before setupAgents so BackgroundTaskManager is available for executor deps.
     const { backgroundTaskManager } = setupBackgroundTasks({
         dataDir,
@@ -462,7 +476,39 @@ export async function main(overrides = {}) {
     }
     // 6.6. Agents
     const agents = container.config.agents;
-    const { sessionManager, executors, workspaceDirs, costTrackers, budgetGuards, stepCounters, defaultAgentId, defaultWorkspaceDir, getExecutor, piSessionAdapters, skillWatcherHandles, skillRegistries, lockCleanupTimer, singleAgentDeps, providerHealth, } = await setupAgents({
+    // defaultWorkspaceDir hoisted upfront so setupMcp can run BEFORE
+    // setupAgents (it consumes defaultWorkspaceDir as defaultCwd; per-agent
+    // ToolCapabilityPort adapters constructed inside setupSingleAgent close
+    // over the daemon-global mcpClientManager). Mirrors the per-agent
+    // computation in setup-agents.ts (`resolveWorkspaceDir(effectiveConfig,
+    // agentId)` for the agent's own workspace).
+    const defaultAgentId = container.config.routing.defaultAgentId;
+    const defaultAgentConfig = agents[defaultAgentId] ??
+        agents.default ??
+        {};
+    const defaultWorkspaceDir = resolveWorkspaceDir(defaultAgentConfig, defaultAgentId);
+    // setupMcp runs before setupAgents so per-agent ToolCapabilityPort
+    // adapter construction inside setupSingleAgent can close over
+    // mcpClientManager. createMcpClientManager is a pure in-memory state
+    // holder (no I/O) -- the manager is constructed before any server-connect
+    // attempts, so the ordering is safe.
+    const { mcpClientManager } = await setupMcp({
+        servers: container.config.integrations.mcp.servers,
+        logger: skillsLogger,
+        callToolTimeoutMs: container.config.integrations.mcp.callToolTimeoutMs,
+        defaultCwd: defaultWorkspaceDir,
+        eventBus: container.eventBus,
+        stdioDefaultConcurrency: container.config.integrations.mcp.stdioDefaultConcurrency,
+        httpDefaultConcurrency: container.config.integrations.mcp.httpDefaultConcurrency,
+    });
+    const { sessionManager, executors, workspaceDirs, costTrackers, budgetGuards, stepCounters, getExecutor, piSessionAdapters, skillWatcherHandles, skillRegistries, lockCleanupTimer, singleAgentDeps, providerHealth, 
+    // Daemon-level OAuth credential store, threaded into RpcDispatchDeps
+    // below so agents.update can validate oauthProfiles patches via has().
+    oauthCredentialStore, 
+    // Per-agent live ToolCapabilityPort adapters; daemon.ts threads
+    // getCapabilityPortForAgent into setupTools and mutates this map on
+    // hot-add / hot-remove.
+    toolCapabilityPorts, } = await setupAgents({
         container, memoryAdapter, sessionStore, agentLogger, outboundMediaEnabled: true,
         autonomousMediaEnabled: !container.config.integrations.media.transcription.autoTranscribe
             || !container.config.integrations.media.vision.enabled
@@ -488,6 +534,14 @@ export async function main(overrides = {}) {
         },
         backgroundTaskManager, // Auto-background middleware in executor pipeline
         backgroundNotifyFn: bgNotifyFn, // Completion notification via deferred notificationService ref
+        // Plumb the secrets bootstrap result through so setup-agents can wire the
+        // OAuth credential store. encrypted-mode shares the existing
+        // better-sqlite3 connection (no dual-handle).
+        secretsCrypto,
+        secretsDb,
+        // Daemon-global MCP manager threaded into setupSingleAgent for
+        // per-agent ToolCapabilityPort adapter construction.
+        mcpClientManager,
     });
     // Log operation model resolutions at startup (dry-run validation)
     logOperationModelDryRun({
@@ -565,7 +619,7 @@ export async function main(overrides = {}) {
     // can be threaded into channel config command handling. The deferred dispatch pattern
     // ensures rpcCall is safe to pass now; actual dispatch wires later via wireDispatch().
     const { rpcCall, wireDispatch } = setupRpcBridge({ gatewayLogger });
-    // 6.6.8.6. Approval gate (moved before channels for APPR-CHAT command interception)
+    // 6.6.8.6. Approval gate (moved before channels for chat command interception)
     const approvalGate = createApprovalGate({
         eventBus: container.eventBus,
         getTimeoutMs: () => container.config.approvals?.defaultTimeoutMs ?? 30_000,
@@ -573,7 +627,7 @@ export async function main(overrides = {}) {
         getBatchApprovalTtlMs: () => container.config.approvals?.batchApprovalTtlMs ?? 30_000,
         logger: daemonLogger, // Approval cache hit/miss debug logging
     });
-    // 6.6.8.6.1. Restore pending approvals from previous restart (quick-174)
+    // 6.6.8.6.1. Restore pending approvals from previous restart
     const approvalRestorePath = pathJoin(container.config.dataDir || dataDir, "restart-approvals.json");
     if (existsSync(approvalRestorePath)) {
         try {
@@ -615,9 +669,9 @@ export async function main(overrides = {}) {
     }
     // 6.6.7.8. Delivery queue: create adapter BEFORE setupChannels.
     // channelAdapters map is passed by reference -- populated after setupChannels.
-    // drainAndStartPrune() is called AFTER setupChannels (two-phase lifecycle).
+    // drainAndStart() is called AFTER setupChannels (two-phase lifecycle).
     const channelAdaptersRef = new Map();
-    const { deliveryQueue, drainAndStartPrune: drainAndStartDeliveryPrune, shutdown: shutdownDeliveryQueue } = await setupDeliveryQueue({
+    const { deliveryQueue, drainAndStart: drainAndStartDeliveryPrune, shutdown: shutdownDeliveryQueue } = await setupDeliveryQueue({
         db, config: container.config, eventBus: container.eventBus, logger: daemonLogger, channelAdapters: channelAdaptersRef,
     });
     // 6.6.8. Channels (moved down from 6.6.6 -- needs ssrfFetcher and transcriber from setupMedia)
@@ -665,12 +719,14 @@ export async function main(overrides = {}) {
         queueConfig: container.config.queue,
         // steer+followup inbound routing
         activeRunRegistry,
+        // Composite-key resolver for active-session lookup
+        sessionResolver,
         // /config chat command handling via deferred RPC dispatch
         rpcCall,
         // Task extraction callback (gated by config.scheduler.tasks.enabled)
         onTaskExtraction: extractFromConversation,
         // Restart continuation: track recently-active sessions for SIGUSR2 replay.
-        // Two-callback timing split (260430-s4m corrects the r4i-A flaw):
+        // Two-callback timing split:
         //   onMessageReceived fires BEFORE processInboundMessage so the tracker
         //     Map is populated before any tool call could trigger SIGUSR2 mid-
         //     execution. Without this, multi-restart chains saw 0 captured records
@@ -708,7 +764,7 @@ export async function main(overrides = {}) {
         },
         // /approve and /deny chat command interception
         approvalGate: container.config.approvals?.enabled ? approvalGate : undefined,
-        // CMD-WIRE: Per-agent session adapters and cost trackers for slash commands
+        // Per-agent session adapters and cost trackers for slash commands
         piSessionAdapters,
         costTrackers,
         // Delivery queue for crash-safe persistence
@@ -744,7 +800,25 @@ export async function main(overrides = {}) {
     container.eventBus.on("system:shutdown", () => { shutdownMirror(); });
     // Structured logging for delivery queue lifecycle events
     setupDeliveryQueueLogging({ eventBus: container.eventBus, logger: daemonLogger });
-    // 6.6.8.0.1. Notification system (Proactive v1)
+    // Output retention housekeeper.
+    // Mirrors the delivery-queue/mirror prune pattern — single-tick gate +
+    // .unref() interval. Scans <defaultWorkspaceDir>/output/<className>/,
+    // deletes leaf files older than the class's retentionMs. Operators can
+    // disable via outputRetention.enabled: false. Per AGENTS §6.6
+    // (security/daemon): file deletion is destructive; the destructive
+    // path is gated on enabled + per-class retentionMs.
+    if (defaultWorkspaceDir) {
+        const outputRetentionHandle = setupOutputRetention({
+            config: container.config.outputRetention,
+            workspaceDir: defaultWorkspaceDir,
+            logger: daemonLogger,
+        });
+        container.eventBus.on("system:shutdown", () => { outputRetentionHandle.shutdown(); });
+    }
+    else {
+        daemonLogger.debug({ hint: "No defaultWorkspaceDir; output retention housekeeper skipped" }, "Output retention: skipped (no default workspace)");
+    }
+    // 6.6.8.0.1. Notification system
     // setupNotifications creates the NotificationService and SessionTracker.
     // The factory is already complete -- this call wires it into the daemon.
     const notificationContext = setupNotifications({
@@ -761,6 +835,34 @@ export async function main(overrides = {}) {
     sessionTrackerRef.ref = notificationContext.sessionTracker;
     // Wire deferred notification ref for background task completion callbacks
     bgNotifyRef.ref = notificationContext.notificationService;
+    // 6.6.8.0.2. Background-task completion runner -- re-enters the originating
+    // agent session when a backgrounded tool finishes.
+    // Runs AFTER setupNotifications so bgNotifyFn is live as fallbackNotifyFn.
+    //
+    // maxBackgroundHops is read from config.backgroundTasks.maxBackgroundHops
+    // (NOT config.workflow.*).
+    // backgroundTasks is a per-agent field; parse via BackgroundTasksConfigSchema to
+    // get the correct default (3) when not explicitly configured.
+    const bgConfigForRunner = BackgroundTasksConfigSchema.parse(agents[defaultAgentId]?.backgroundTasks ?? {});
+    const bgCompletionRunnerContext = setupBackgroundCompletionRunner({
+        eventBus: container.eventBus,
+        // setup-agents.ts:178 declares getExecutor as synchronous
+        // ((agentId: string) => AgentExecutor) -- resolved lazily per event.
+        getExecutor,
+        sessionStore,
+        taskManager: backgroundTaskManager,
+        fallbackNotifyFn: bgNotifyFn,
+        maxBackgroundHops: bgConfigForRunner.maxBackgroundHops,
+        logger: daemonLogger,
+    });
+    container.eventBus.on("system:shutdown", () => {
+        void bgCompletionRunnerContext.runner.shutdown();
+    });
+    // 6.6.8.0.3. Recover background tasks NOW (after the runner is subscribed).
+    // setup-background-tasks.ts INTENTIONALLY does not call this -- if it did,
+    // recovered failed events would fire before the runner subscribes and the
+    // user would never see the recovery announcement.
+    backgroundTaskManager.recoverOnStartup();
     // Channel health monitor -- polls adapter getStatus() at configurable interval.
     // Created after adapters are initialized, started immediately with the adapter map.
     let channelHealthMonitor;
@@ -794,21 +896,17 @@ export async function main(overrides = {}) {
     // Structured logging for channel health state transitions
     setupChannelHealthLogging({ eventBus: container.eventBus, logger: daemonLogger });
     // 6.6.8.7. MCP server connections (external tool servers)
-    const { mcpClientManager } = await setupMcp({
-        servers: container.config.integrations.mcp.servers,
-        logger: skillsLogger,
-        callToolTimeoutMs: container.config.integrations.mcp.callToolTimeoutMs,
-        defaultCwd: defaultWorkspaceDir,
-        eventBus: container.eventBus,
-        stdioDefaultConcurrency: container.config.integrations.mcp.stdioDefaultConcurrency,
-        httpDefaultConcurrency: container.config.integrations.mcp.httpDefaultConcurrency,
-    });
+    // setupMcp is called earlier (before setupAgents @ line ~600) so per-agent
+    // ToolCapabilityPort adapter construction inside setupSingleAgent can
+    // close over mcpClientManager. The mcpClientManager const declared at the
+    // earlier site is in lexical scope here; no additional wiring needed at
+    // this section anchor.
     // Detect sandbox provider once at startup
     const sandboxProvider = detectSandboxProvider(skillsLogger);
     if (sandboxProvider) {
         skillsLogger.info({ provider: sandboxProvider.name }, "Exec sandbox provider detected");
     }
-    // 6.6.8.4.1. Image generation provider (Proactive v1 -- IMGN)
+    // 6.6.8.4.1. Image generation provider
     const imageGenConfig = container.config.integrations.media.imageGeneration;
     const imageGenResult = createImageGenProvider(imageGenConfig, container.secretManager);
     const imageGenProvider = imageGenResult.ok ? imageGenResult.value : undefined;
@@ -824,6 +922,21 @@ export async function main(overrides = {}) {
     else {
         skillsLogger.warn({ err: imageGenResult.error, hint: "Check image generation config provider value", errorKind: "config" }, "Image generation provider creation failed");
     }
+    // Per-agent ToolCapabilityPort resolver. Falls back to the default
+    // agent's port for unknown agentIds (mirrors the setup-tools.ts:327
+    // `agents[agentId] ?? agents[defaultAgentId]` convention). Throws if
+    // neither exists -- this fires both for an initialization-order bug AND
+    // for runtime hot-remove paths (agent + default both removed; stale
+    // cron/graph/heartbeat caller carrying a since-removed agentId). The
+    // message stays scenario-agnostic so the operator can diagnose either
+    // cause.
+    const getCapabilityPortForAgent = (agentId) => {
+        const port = toolCapabilityPorts.get(agentId) ?? toolCapabilityPorts.get(defaultAgentId);
+        if (!port) {
+            throw new Error(`No ToolCapabilityPort registered for agent '${agentId}' and no default agent ('${defaultAgentId}') fallback available -- the agent may have been removed or the daemon failed to initialize.`);
+        }
+        return port;
+    };
     // 6.6.8.5. Tools + message preprocessing
     const { assembleToolsForAgent, preprocessMessageText } = setupTools({
         rpcCall, agents, defaultAgentId, workspaceDirs, defaultWorkspaceDir,
@@ -839,6 +952,7 @@ export async function main(overrides = {}) {
         imageGenProvider, // Conditional: only registered when API key is present
         backgroundTaskManager, // Background_tasks tool registration
         sessionTrackerRegistry,
+        getCapabilityPortForAgent,
     });
     // Wire deferred tool assembler ref now that setupTools has returned
     toolAssemblerRef.ref = assembleToolsForAgent;
@@ -851,6 +965,9 @@ export async function main(overrides = {}) {
         memoryAdapter,
         gatewaySend: gatewaySendRef,
         activeRunRegistry,
+        // Composite-key resolver supersedes activeRunRegistry.get(sessionKey)
+        // for sub-agent-runner abort paths.
+        sessionResolver,
         deliveryQueue,
     });
     // Rolling prompt timeout counter (sliding 5-minute window).
@@ -935,7 +1052,8 @@ export async function main(overrides = {}) {
         executors,
         assembleToolsForAgent,
         workspaceDirs,
-        activeRunRegistry,
+        // Composite-key resolver replaces single-arg .has()
+        sessionResolver,
         duplicateDetector,
         adaptersByType,
         systemEventQueue,
@@ -1032,6 +1150,7 @@ export async function main(overrides = {}) {
             skillWatcherHandles.set(agentId, result.skillWatcherHandle);
         }
         skillRegistries.set(agentId, result.skillRegistry);
+        toolCapabilityPorts.set(agentId, result.toolCapabilityPort);
         container.eventBus.emit("agent:hot_added", { agentId, timestamp: Date.now() });
         daemonLogger.info({ agentId, durationMs: Date.now() - startMs }, "Agent hot-added to running daemon");
     };
@@ -1059,11 +1178,12 @@ export async function main(overrides = {}) {
         stepCounters.delete(agentId);
         piSessionAdapters.delete(agentId);
         skillRegistries.delete(agentId);
+        toolCapabilityPorts.delete(agentId);
         container.eventBus.emit("agent:hot_removed", { agentId, timestamp: Date.now() });
         daemonLogger.info({ agentId, durationMs: Date.now() - startMs }, "Agent hot-removed from running daemon");
     };
     // 6.7.1. Wire RPC dispatch now that heartbeatRunner is available
-    // Keep a reference so we can add wsConnections/mediaDir after gateway setup (quick-91).
+    // Keep a reference so we can add wsConnections/mediaDir after gateway setup.
     const rpcDispatchDeps = {
         defaultAgentId, getAgentCronScheduler, cronSchedulers, executionTrackers,
         wakeCoalescer, defaultWorkspaceDir, workspaceDirs, memoryApi, memoryAdapter,
@@ -1102,7 +1222,7 @@ export async function main(overrides = {}) {
         },
         memoryWriteValidator: validateMemoryWrite, // memory content validation
         eventBus: container.eventBus, // security event emission for memory writes
-        mcpClientManager, // Phase quick-81: MCP server management
+        mcpClientManager, // MCP server management
         contextStore, // DAG recall RPC handlers
         contextEngineConfig: {
             maxRecallsPerDay: agents[defaultAgentId]?.contextEngine?.maxRecallsPerDay ?? 10,
@@ -1120,7 +1240,7 @@ export async function main(overrides = {}) {
         embeddingCacheStats, // embedding cache stats for memory.embeddingCache RPC
         embeddingCircuitBreakerState, // Embedding circuit breaker state for memory operations
         skillRegistries, // skill management handlers in rpc-dispatch
-        notificationService: notificationContext.notificationService, // Proactive v1: notification.send RPC handler
+        notificationService: notificationContext.notificationService, // notification.send RPC handler
         // Image generation RPC handler deps
         imageHandlerDeps: imageGenProvider && imageGenRateLimiter ? {
             provider: imageGenProvider,
@@ -1129,6 +1249,9 @@ export async function main(overrides = {}) {
             logger: skillsLogger,
             getChannelAdapter: (channelType) => adaptersByType.get(channelType),
         } : undefined,
+        // Daemon-level OAuth credential store handle for the agents.update
+        // oauthProfiles existence check.
+        oauthCredentialStore,
     };
     wireDispatch(rpcDispatchDeps);
     // 7. Gateway
@@ -1147,7 +1270,7 @@ export async function main(overrides = {}) {
         suspendedAgents,
         instanceId, startupStartMs,
     });
-    // 7.0.1. Wire deferred gateway attachment deps (quick-91)
+    // 7.0.1. Wire deferred gateway attachment deps
     // wsConnections and mediaDir are now available after gateway setup; message.attach
     // handler closures read from the mutable rpcDispatchDeps reference at call time.
     rpcDispatchDeps.wsConnections = wsConnections;
@@ -1262,7 +1385,7 @@ export async function main(overrides = {}) {
         secretStore, // close secrets.db on shutdown
         auditAggregator, // clear pending dedup timers
         injectionRateLimiter, // clear rate limiter timers on shutdown
-        lockCleanupTimer, // quick-112: clear periodic lock cleanup timer
+        lockCleanupTimer, // clear periodic lock cleanup timer
         dataDir: container.config.dataDir || dataDir,
         continuationTracker,
         lifecycleReactors, // destroy lifecycle reactors on shutdown
@@ -1388,6 +1511,12 @@ export async function main(overrides = {}) {
     // startup banner. No-op outside containers. Wired here so the WARN lands
     // in `docker logs` next to the banner, where operators look first.
     emitDockerRestartPolicyWarn(daemonLogger);
+    // Boot-time TLS preflight against auth.openai.com.
+    // Fire-and-forget — daemon is already serving by this point; the WARN
+    // is purely advisory. Skipped when no OAuth-using agent is configured.
+    if (hasAnyOAuthAgent(container.config.agents)) {
+        void emitOAuthTlsPreflightWarn(daemonLogger);
+    }
     // Snapshot current config as last-known-good after successful startup
     if (configPaths.length > 0) {
         const activeConfigPath = configPaths[configPaths.length - 1];
@@ -1400,6 +1529,15 @@ export async function main(overrides = {}) {
         container, logger, logLevelManager, tokenTracker, latencyRecorder,
         processMonitor, shutdownHandle, watchdogHandle, cronSchedulers, resetSchedulers,
         browserServices, heartbeatRunner, gatewayHandle, adapterRegistry: adaptersByType,
+        // Expose the delivery-queue-side adapter map and the queue port
+        // itself so integration tests can register adapters that the recurring
+        // drainer sees and assert on queue depth.
+        deliveryAdapters: channelAdaptersRef,
+        deliveryQueue,
+        // Expose the background task manager so integration tests can
+        // promote synthetic tasks and call complete()/fail() to drive the
+        // completion runner pipeline without requiring a live LLM call.
+        backgroundTaskManager,
         rpcCall, deviceIdentity, diagnosticCollector, billingEstimator,
         channelActivityTracker, deliveryTracer, approvalGate, channelHealthMonitor, sessionStoreBridge,
     };

package/node_modules/@comis/daemon/dist/index.d.ts

@@ -7,3 +7,5 @@ export { createAnnouncementDeadLetterQueue } from "./announcement-dead-letter.js
 export type { AnnouncementDeadLetterQueue, DeadLetterEntry } from "./announcement-dead-letter.js";
 export { createContextHandlers } from "./rpc/context-handlers.js";
 export type { ContextHandlerDeps } from "./rpc/context-handlers.js";
+export { createAgentHandlers } from "./rpc/agent-handlers.js";
+export type { AgentHandlerDeps } from "./rpc/agent-handlers.js";

package/node_modules/@comis/daemon/dist/index.js

@@ -10,3 +10,8 @@ export { sweepResultFiles, buildAnnouncementMessage, deliverFailureNotification
 export { createAnnouncementDeadLetterQueue } from "./announcement-dead-letter.js";
 // Context handlers: DAG context engine RPC handlers
 export { createContextHandlers } from "./rpc/context-handlers.js";
+// Agent management RPC handlers — re-exported so the multi-account
+// integration test can drive the actual `agents.update` RPC handler against a
+// shared `agents` map, mirroring the daemon-runtime container.config.agents
+// pattern at daemon.ts:594/634.
+export { createAgentHandlers } from "./rpc/agent-handlers.js";

package/node_modules/@comis/daemon/dist/observability/channel-health-logger.js

@@ -56,7 +56,7 @@ export function setupChannelHealthLogging(deps) {
                 lastMessageAt,
                 hint,
                 errorKind: ERROR_KIND_MAP[currentState] ?? "internal",
-                module: MODULE,
+                submodule: MODULE,
             }, "Channel health degraded: %s -> %s", previousState, currentState);
         }
         else {
@@ -66,7 +66,7 @@ export function setupChannelHealthLogging(deps) {
                 previousState,
                 currentState,
                 connectionMode,
-                module: MODULE,
+                submodule: MODULE,
             }, "Channel health changed: %s -> %s", previousState, currentState);
         }
     });
@@ -76,7 +76,7 @@ export function setupChannelHealthLogging(deps) {
             channelType: event.channelType,
             state: event.state,
             responseTimeMs: event.responseTimeMs,
-            module: MODULE,
+            submodule: MODULE,
         }, "Health check: %s = %s", event.channelType, event.state);
     });
 }

package/node_modules/@comis/daemon/dist/observability/delivery-queue-logger.js

@@ -21,7 +21,7 @@
 export function setupDeliveryQueueLogging(deps) {
     const { eventBus, logger } = deps;
     const MODULE = "delivery-queue";
-    const log = logger.child({ module: MODULE });
+    const log = logger.child({ submodule: MODULE });
     // 1. Enqueue: message enters queue (boundary event -> INFO)
     eventBus.on("delivery:enqueued", (data) => {
         log.info({

package/node_modules/@comis/daemon/dist/rpc/agent-handlers.d.ts

@@ -12,7 +12,7 @@
  * the runtime agents map, and returns structured results.
  * @module
  */
-import type { PerAgentConfig, ProviderEntry } from "@comis/core";
+import type { PerAgentConfig, ProviderEntry, OAuthCredentialStorePort } from "@comis/core";
 import { type PersistToConfigDeps } from "./persist-to-config.js";
 import type { RpcHandler } from "./types.js";
 /** Dependencies required by agent management RPC handlers. */
@@ -36,6 +36,27 @@ export interface AgentHandlerDeps {
     };
     /** Provider entries map for probe lookups when agents switch providers. */
     providerEntries?: Record<string, ProviderEntry>;
+    /**
+     * Optional OAuth credential store for validating that `oauthProfiles`
+     * patches reference existing stored profile IDs. The
+     * agents.update handler iterates over each (provider, profileId) entry
+     * in the patched config and calls `has(profileId)`; on miss it throws
+     * with the documented "not found in store" wording BEFORE the
+     * `deps.agents[agentId] = parsedConfig` reference-replacement at the
+     * end of the handler — failure leaves the daemon's in-memory map AND
+     * the YAML both unchanged. When this field is absent (e.g. test
+     * contexts without OAuth wiring) the validation block is a no-op so
+     * existing behavior is preserved.
+     */
+    oauthCredentialStore?: OAuthCredentialStorePort;
+    /**
+     * Models config — passed to the credential resolver so that
+     * `provider: "default"` is resolved to `models.defaultProvider` for the
+     * key check, mirroring runtime resolution in `resolveAgentModel`.
+     */
+    modelsConfig?: {
+        defaultProvider?: string;
+    };
 }
 /**
  * Create a record of agent management RPC handlers bound to the given deps.