comisai 1.0.36 → 1.0.37

package/node_modules/@comis/core/dist/ports/tool-capability.d.ts

@@ -0,0 +1,165 @@
+/**
+ * ToolCapabilityPort -- hexagonal architecture boundary for the v1.1 capability layer.
+ *
+ * Provides both a static config-derived view (clusters, hints, aliases) AND a
+ * live runtime view (connected MCP servers, visible prompt skills). One port,
+ * two views -- exec runs per-tool-call (not per-turn) and needs a live getter.
+ *
+ * Adapters: live daemon-side adapter, createNoOpCapabilityPort (production
+ * no-op, this package), test-only stub factory (lives in `__test-helpers/` --
+ * production source MUST NOT import).
+ *
+ * @module
+ */
+/**
+ * Capability source reference -- discriminated union pointing at either a
+ * connected MCP server or a visible prompt skill. Used in the package-alias
+ * map to resolve "import yfinance" or "pip install pandas" back to a connected
+ * tool/skill that should be preferred over the install.
+ */
+export type CapabilitySourceRef = {
+    readonly type: "mcp";
+    readonly name: string;
+} | {
+    readonly type: "skill";
+    readonly name: string;
+};
+/**
+ * Merged capability view of a single visible prompt skill.
+ *
+ * All operator overrides, manifest `comis.capability` values, and skill-key
+ * fallbacks are pre-merged in the adapter (precedence:
+ * operator(skillKey) > operator(skillName) > comis.capability > fallback).
+ * Consumers see the final merged shape.
+ */
+export interface PromptSkillCapability {
+    /** Stable skill identifier used by the agent runtime. */
+    readonly name: string;
+    /** Optional canonical key (`<author>::<slug>`) for cross-host portability. */
+    readonly skillKey?: string;
+    /** Human-readable description (falls back to manifest description if no override). */
+    readonly description: string;
+    /** Cluster ID for capability-index grouping (e.g. "data-fetching-financial"). */
+    readonly cluster?: string;
+    /** Operator-tunable display summary; falls back to description when absent. */
+    readonly summary?: string;
+    /** Package names this skill replaces (for install-detour overlap detection). */
+    readonly replacesPackages: readonly string[];
+    /** Where the skill was discovered from. */
+    readonly source?: "bundled" | "workspace" | "local";
+}
+/**
+ * Cluster metadata used by the capability-index renderer.
+ */
+export interface ClusterConfig {
+    readonly label: string;
+    readonly priority: number;
+    readonly preferOverInstalls: boolean;
+}
+/**
+ * Hint metadata for a connected MCP server.
+ */
+export interface McpServerHint {
+    readonly cluster: string;
+    readonly description: string;
+    readonly replacesPackages: readonly string[];
+}
+/**
+ * Hint metadata for a visible prompt skill (operator-supplied overrides).
+ */
+export interface SkillHint {
+    readonly cluster: string;
+    readonly description?: string;
+    readonly replacesPackages: readonly string[];
+}
+/**
+ * The capability port. Covers both the static config-derived view and a live
+ * runtime view. Adapter implementation lives in @comis/daemon; the in-package
+ * createNoOpCapabilityPort serves as the production no-op.
+ *
+ * Adapters: createNoOpCapabilityPort (production no-op, this package),
+ * test-only stub factory in `__test-helpers/`, live daemon-side adapter.
+ */
+export interface ToolCapabilityPort {
+    /**
+     * Whether the per-turn capability index renderer should fire at all. When
+     * false, the renderer returns empty text and the executor-prompt-runner
+     * filters it out.
+     *
+     * @returns `true` if the operator has enabled the capability index.
+     */
+    isCapabilityIndexEnabled(): boolean;
+    /**
+     * Install-detour mode for pip/npm/pnpm/yarn detection.
+     * - `observe`: log only, no agent-visible response.
+     * - `advise`: emit a non-blocking advisory next turn.
+     * - `soft-stop`: refuse the exec call with an operator-overridable message.
+     *
+     * @returns The currently-configured mode.
+     */
+    getInstallDetourMode(): "observe" | "advise" | "soft-stop";
+    /**
+     * Cluster ID for a builtin tool (exec, read, write, ...).
+     *
+     * @param toolName - The builtin tool's registered name.
+     * @returns The cluster ID, or undefined if the tool is uncategorized.
+     */
+    getBuiltinCluster(toolName: string): string | undefined;
+    /**
+     * Cluster metadata (label, priority, preferOverInstalls flag).
+     *
+     * @param clusterId - The cluster identifier.
+     * @returns The cluster config, or undefined if the cluster is unknown.
+     */
+    getClusterConfig(clusterId: string): ClusterConfig | undefined;
+    /**
+     * Hint metadata for a connected MCP server (operator-supplied overrides).
+     *
+     * @param serverName - The MCP server name (sanitized form).
+     * @returns The hint, or undefined if no operator override exists.
+     */
+    getMcpServerHint(serverName: string): McpServerHint | undefined;
+    /**
+     * Hint metadata for a visible prompt skill (operator-supplied overrides).
+     *
+     * @param skillName - The skill's runtime name.
+     * @param skillKey - Optional canonical key (`<author>::<slug>`).
+     * @returns The hint, or undefined if no operator override exists.
+     */
+    getSkillHint(skillName: string, skillKey?: string): SkillHint | undefined;
+    /**
+     * Pre-normalized package alias map (PEP-503-like keys for Python:
+     * lowercase, `_` and `.` collapsed to `-`).
+     *
+     * Build fresh on each call (no memoization in v1.1) -- visible skills can
+     * change mid-session (skill discovery, allow/deny edits), connected MCP
+     * servers can connect/disconnect, capturing at construction would freeze
+     * stale state.
+     *
+     * @returns A read-only map keyed by normalized package name pointing at
+     *   the matching MCP server or prompt skill.
+     */
+    getPackageAliasMap(): ReadonlyMap<string, CapabilitySourceRef>;
+    /**
+     * Currently-connected MCP server names (sanitized form).
+     *
+     * @returns A read-only array of server names. Order is undefined.
+     */
+    getConnectedMcpServers(): readonly string[];
+    /**
+     * Visible eligible prompt skills with merged capability metadata.
+     * Filters: allowedSkills/deniedSkills, runtime eligibility (os/bins/env),
+     * AND `disableModelInvocation !== true`.
+     * Merging: operator(skillKey) > operator(skillName) > comis.capability > fallback.
+     *
+     * IMPORTANT -- cache fence:
+     * This method MUST NOT be consumed by `assembleRichSystemPrompt`'s
+     * `assemblerParams` in `packages/agent/src/executor/prompt-assembly.ts`.
+     * If a skill discovery sweep runs between turns, the cached system-prompt
+     * prefix MUST stay byte-identical. Consumers: per-turn capability index
+     * renderer + install-detour parser ONLY.
+     *
+     * @returns A read-only array of merged capability views.
+     */
+    getPromptSkillCapabilities(): readonly PromptSkillCapability[];
+}

package/node_modules/@comis/core/dist/ports/tool-capability.js

@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * ToolCapabilityPort -- hexagonal architecture boundary for the v1.1 capability layer.
+ *
+ * Provides both a static config-derived view (clusters, hints, aliases) AND a
+ * live runtime view (connected MCP servers, visible prompt skills). One port,
+ * two views -- exec runs per-tool-call (not per-turn) and needs a live getter.
+ *
+ * Adapters: live daemon-side adapter, createNoOpCapabilityPort (production
+ * no-op, this package), test-only stub factory (lives in `__test-helpers/` --
+ * production source MUST NOT import).
+ *
+ * @module
+ */
+export {};

package/node_modules/@comis/core/dist/security/audit.d.ts

@@ -7,35 +7,24 @@ import type { ActionClassification } from "./action-classifier.js";
  * classification, outcome, tracing, and timing information.
  */
 export declare const AuditEventSchema: z.ZodObject<{
-    /** Unique event identifier (UUIDv4). */
     id: z.ZodGUID;
-    /** ISO 8601 timestamp of when the event occurred. */
     timestamp: z.ZodISODateTime;
-    /** Tenant identifier for multi-tenant isolation. */
     tenantId: z.ZodString;
-    /** Agent that performed the action (may be system). */
     agentId: z.ZodString;
-    /** User who triggered or owns the action (may be "system"). */
     userId: z.ZodString;
-    /** The action that was performed (e.g., "file.delete"). */
     actionType: z.ZodString;
-    /** Risk classification of the action. */
     classification: z.ZodEnum<{
         read: "read";
         mutate: "mutate";
         destructive: "destructive";
     }>;
-    /** Whether the action succeeded or failed. */
     outcome: z.ZodEnum<{
         success: "success";
         failure: "failure";
         denied: "denied";
     }>;
-    /** Arbitrary metadata about the event. */
     metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    /** Distributed tracing identifier for correlating events. */
     traceId: z.ZodOptional<z.ZodString>;
-    /** Duration of the action in milliseconds. */
     duration: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>;
 /** TypeScript type inferred from the AuditEvent Zod schema. */

package/node_modules/@comis/core/dist/tool-metadata.d.ts

@@ -8,6 +8,24 @@
  * Registry supports incremental registration via spread-merge semantics:
  * different sources can register different fields for the same tool.
  */
+/**
+ * Capability metadata for a builtin/platform tool -- used by the v1.1 capability
+ * layer to route tools into clusters and detect install-detour overlap.
+ *
+ * All fields optional. Operators may override `cluster` per-tool via
+ * `tooling.capabilityClusters.builtinAssignments[toolName]`. The metadata
+ * default applies when no operator override is present.
+ *
+ * `getBuiltinCluster` precedence: operator override > metadata default > undefined.
+ */
+export interface ToolCapabilityMetadata {
+    /** Cluster ID this tool belongs to (e.g., "data-fetching-financial"). */
+    readonly cluster?: string;
+    /** Operator-tunable display summary; falls back to tool description if absent. */
+    readonly summary?: string;
+    /** Package names this tool replaces (for install-detour overlap detection). */
+    readonly replacesPackages?: readonly string[];
+}
 /** Per-tool metadata stored in the side-channel registry. All fields optional. */
 export interface ComisToolMetadata {
     /** Per-tool result size cap in characters. */
@@ -44,10 +62,12 @@ export interface ComisToolMetadata {
     requiredByAction?: Readonly<Record<string, readonly string[]>>;
     /** Pre-flight input validator. Returns error string on failure, undefined on success. */
     validateInput?: (params: Record<string, unknown>) => string | undefined | Promise<string | undefined>;
+    /** Capability metadata for tool-first routing (v1.1). */
+    capability?: ToolCapabilityMetadata;
 }
 /**
  * Register metadata for a tool. Merges with any existing metadata via spread,
- * allowing incremental registration from different phases.
+ * allowing incremental registration from different sources.
  */
 export declare function registerToolMetadata(name: string, meta: ComisToolMetadata): void;
 /**

package/node_modules/@comis/core/dist/tool-metadata.js

@@ -15,7 +15,7 @@
 const registry = new Map();
 /**
  * Register metadata for a tool. Merges with any existing metadata via spread,
- * allowing incremental registration from different phases.
+ * allowing incremental registration from different sources.
  */
 export function registerToolMetadata(name, meta) {
     registry.set(name, { ...registry.get(name), ...meta });

package/node_modules/@comis/core/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/core",
   "private": true,
-  "version": "1.0.36",
+  "version": "1.0.37",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Core domain types, ports, event bus, security, and config for Comis",

package/node_modules/@comis/daemon/bundled-skills/skill-creator/scripts/validate-skill.py

@@ -31,7 +31,7 @@ VALID_TOP_FIELDS = {
 }
 
 VALID_COMIS_FIELDS = {
-    "os", "requires", "skill-key", "primary-env", "command-dispatch",
+    "os", "requires", "skill-key", "primary-env", "command-dispatch", "capability",
 }
 
 VALID_PERMISSIONS_FIELDS = {"fsRead", "fsWrite", "net", "env"}

package/node_modules/@comis/daemon/dist/daemon.js

@@ -7,9 +7,9 @@ import { bootstrap, loadEnvFile, createApprovalGate, parseFormattedSessionKey, c
 import { setupSecrets as _setupSecretsImpl, createSqliteSecretStore, createNamedGraphStore, createContextStore, createObservabilityStore } from "@comis/memory";
 import { ok, err, suppressError } from "@comis/shared";
 import { createGatewayServer } from "@comis/gateway";
-import { setupLogging, setupObservability, setupHealth, setupMemory, setupAgents, setupSchedulers, setupChannels, setupMedia, setupCrossSession, setupMcp, setupTools, setupMonitoring, setupHeartbeat, setupTaskExtraction, setupShutdown, setupGateway, setupRpcBridge, setupDeliveryQueue, setupDeliveryMirror, setupNotifications, setupBackgroundTasks, setupBackgroundCompletionRunner, } from "./wiring/index.js";
+import { setupLogging, setupObservability, setupHealth, setupMemory, setupAgents, setupSchedulers, setupChannels, setupMedia, setupCrossSession, setupMcp, setupTools, setupMonitoring, setupHeartbeat, setupTaskExtraction, setupShutdown, setupGateway, setupRpcBridge, setupDeliveryQueue, setupDeliveryMirror, setupNotifications, setupBackgroundTasks, setupBackgroundCompletionRunner, setupOutputRetention, } from "./wiring/index.js";
 import { setupSingleAgent } from "./wiring/setup-agents.js";
-import { createActiveRunRegistry, createModelCatalog, wireSessionStateCleanup, wireMcpDisconnectCleanup, createGeminiCacheManager, wireGeminiCacheCleanup, createSessionTrackerRegistry, validateProviderOverrides } from "@comis/agent";
+import { createActiveRunRegistry, createBackgroundSessionResolver, createModelCatalog, wireSessionStateCleanup, wireMcpDisconnectCleanup, createGeminiCacheManager, wireGeminiCacheCleanup, createSessionTrackerRegistry, validateProviderOverrides, resolveWorkspaceDir } from "@comis/agent";
 import { detectSandboxProvider, createImageGenProvider, createImageGenRateLimiter, createFileStateTracker } from "@comis/skills";
 import { createGraphCoordinator, createNodeTypeRegistry } from "./graph/index.js";
 import { createChannelHealthMonitor } from "@comis/channels";
@@ -387,6 +387,11 @@ export async function main(overrides = {}) {
     // Created once and injected into both setupAgents (PiExecutor registration)
     // and setupChannels (inbound pipeline routing).
     const activeRunRegistry = createActiveRunRegistry();
+    // Composite-key resolver wraps the registry for production lookups.
+    // The raw registry is still threaded for register/deregister calls in
+    // pi-executor and executor-post-execution; the resolver supersedes
+    // single-arg `.has()`/`.get()` everywhere.
+    const sessionResolver = createBackgroundSessionResolver({ activeRunRegistry });
     // Derive canary fallback secret from tenantId.
     // Used when CANARY_SECRET env var is not configured. The per-agent derivation
     // in setup-agents.ts uses this as a base combined with agentId for uniqueness.
@@ -471,10 +476,39 @@ export async function main(overrides = {}) {
     }
     // 6.6. Agents
     const agents = container.config.agents;
-    const { sessionManager, executors, workspaceDirs, costTrackers, budgetGuards, stepCounters, defaultAgentId, defaultWorkspaceDir, getExecutor, piSessionAdapters, skillWatcherHandles, skillRegistries, lockCleanupTimer, singleAgentDeps, providerHealth, 
+    // defaultWorkspaceDir hoisted upfront so setupMcp can run BEFORE
+    // setupAgents (it consumes defaultWorkspaceDir as defaultCwd; per-agent
+    // ToolCapabilityPort adapters constructed inside setupSingleAgent close
+    // over the daemon-global mcpClientManager). Mirrors the per-agent
+    // computation in setup-agents.ts (`resolveWorkspaceDir(effectiveConfig,
+    // agentId)` for the agent's own workspace).
+    const defaultAgentId = container.config.routing.defaultAgentId;
+    const defaultAgentConfig = agents[defaultAgentId] ??
+        agents.default ??
+        {};
+    const defaultWorkspaceDir = resolveWorkspaceDir(defaultAgentConfig, defaultAgentId);
+    // setupMcp runs before setupAgents so per-agent ToolCapabilityPort
+    // adapter construction inside setupSingleAgent can close over
+    // mcpClientManager. createMcpClientManager is a pure in-memory state
+    // holder (no I/O) -- the manager is constructed before any server-connect
+    // attempts, so the ordering is safe.
+    const { mcpClientManager } = await setupMcp({
+        servers: container.config.integrations.mcp.servers,
+        logger: skillsLogger,
+        callToolTimeoutMs: container.config.integrations.mcp.callToolTimeoutMs,
+        defaultCwd: defaultWorkspaceDir,
+        eventBus: container.eventBus,
+        stdioDefaultConcurrency: container.config.integrations.mcp.stdioDefaultConcurrency,
+        httpDefaultConcurrency: container.config.integrations.mcp.httpDefaultConcurrency,
+    });
+    const { sessionManager, executors, workspaceDirs, costTrackers, budgetGuards, stepCounters, getExecutor, piSessionAdapters, skillWatcherHandles, skillRegistries, lockCleanupTimer, singleAgentDeps, providerHealth, 
     // Daemon-level OAuth credential store, threaded into RpcDispatchDeps
     // below so agents.update can validate oauthProfiles patches via has().
-    oauthCredentialStore, } = await setupAgents({
+    oauthCredentialStore, 
+    // Per-agent live ToolCapabilityPort adapters; daemon.ts threads
+    // getCapabilityPortForAgent into setupTools and mutates this map on
+    // hot-add / hot-remove.
+    toolCapabilityPorts, } = await setupAgents({
         container, memoryAdapter, sessionStore, agentLogger, outboundMediaEnabled: true,
         autonomousMediaEnabled: !container.config.integrations.media.transcription.autoTranscribe
             || !container.config.integrations.media.vision.enabled
@@ -505,6 +539,9 @@ export async function main(overrides = {}) {
         // better-sqlite3 connection (no dual-handle).
         secretsCrypto,
         secretsDb,
+        // Daemon-global MCP manager threaded into setupSingleAgent for
+        // per-agent ToolCapabilityPort adapter construction.
+        mcpClientManager,
     });
     // Log operation model resolutions at startup (dry-run validation)
     logOperationModelDryRun({
@@ -682,6 +719,8 @@ export async function main(overrides = {}) {
         queueConfig: container.config.queue,
         // steer+followup inbound routing
         activeRunRegistry,
+        // Composite-key resolver for active-session lookup
+        sessionResolver,
         // /config chat command handling via deferred RPC dispatch
         rpcCall,
         // Task extraction callback (gated by config.scheduler.tasks.enabled)
@@ -761,6 +800,24 @@ export async function main(overrides = {}) {
     container.eventBus.on("system:shutdown", () => { shutdownMirror(); });
     // Structured logging for delivery queue lifecycle events
     setupDeliveryQueueLogging({ eventBus: container.eventBus, logger: daemonLogger });
+    // Output retention housekeeper.
+    // Mirrors the delivery-queue/mirror prune pattern — single-tick gate +
+    // .unref() interval. Scans <defaultWorkspaceDir>/output/<className>/,
+    // deletes leaf files older than the class's retentionMs. Operators can
+    // disable via outputRetention.enabled: false. Per AGENTS §6.6
+    // (security/daemon): file deletion is destructive; the destructive
+    // path is gated on enabled + per-class retentionMs.
+    if (defaultWorkspaceDir) {
+        const outputRetentionHandle = setupOutputRetention({
+            config: container.config.outputRetention,
+            workspaceDir: defaultWorkspaceDir,
+            logger: daemonLogger,
+        });
+        container.eventBus.on("system:shutdown", () => { outputRetentionHandle.shutdown(); });
+    }
+    else {
+        daemonLogger.debug({ hint: "No defaultWorkspaceDir; output retention housekeeper skipped" }, "Output retention: skipped (no default workspace)");
+    }
     // 6.6.8.0.1. Notification system
     // setupNotifications creates the NotificationService and SessionTracker.
     // The factory is already complete -- this call wires it into the daemon.
@@ -839,15 +896,11 @@ export async function main(overrides = {}) {
     // Structured logging for channel health state transitions
     setupChannelHealthLogging({ eventBus: container.eventBus, logger: daemonLogger });
     // 6.6.8.7. MCP server connections (external tool servers)
-    const { mcpClientManager } = await setupMcp({
-        servers: container.config.integrations.mcp.servers,
-        logger: skillsLogger,
-        callToolTimeoutMs: container.config.integrations.mcp.callToolTimeoutMs,
-        defaultCwd: defaultWorkspaceDir,
-        eventBus: container.eventBus,
-        stdioDefaultConcurrency: container.config.integrations.mcp.stdioDefaultConcurrency,
-        httpDefaultConcurrency: container.config.integrations.mcp.httpDefaultConcurrency,
-    });
+    // setupMcp is called earlier (before setupAgents @ line ~600) so per-agent
+    // ToolCapabilityPort adapter construction inside setupSingleAgent can
+    // close over mcpClientManager. The mcpClientManager const declared at the
+    // earlier site is in lexical scope here; no additional wiring needed at
+    // this section anchor.
     // Detect sandbox provider once at startup
     const sandboxProvider = detectSandboxProvider(skillsLogger);
     if (sandboxProvider) {
@@ -869,6 +922,21 @@ export async function main(overrides = {}) {
     else {
         skillsLogger.warn({ err: imageGenResult.error, hint: "Check image generation config provider value", errorKind: "config" }, "Image generation provider creation failed");
     }
+    // Per-agent ToolCapabilityPort resolver. Falls back to the default
+    // agent's port for unknown agentIds (mirrors the setup-tools.ts:327
+    // `agents[agentId] ?? agents[defaultAgentId]` convention). Throws if
+    // neither exists -- this fires both for an initialization-order bug AND
+    // for runtime hot-remove paths (agent + default both removed; stale
+    // cron/graph/heartbeat caller carrying a since-removed agentId). The
+    // message stays scenario-agnostic so the operator can diagnose either
+    // cause.
+    const getCapabilityPortForAgent = (agentId) => {
+        const port = toolCapabilityPorts.get(agentId) ?? toolCapabilityPorts.get(defaultAgentId);
+        if (!port) {
+            throw new Error(`No ToolCapabilityPort registered for agent '${agentId}' and no default agent ('${defaultAgentId}') fallback available -- the agent may have been removed or the daemon failed to initialize.`);
+        }
+        return port;
+    };
     // 6.6.8.5. Tools + message preprocessing
     const { assembleToolsForAgent, preprocessMessageText } = setupTools({
         rpcCall, agents, defaultAgentId, workspaceDirs, defaultWorkspaceDir,
@@ -884,6 +952,7 @@ export async function main(overrides = {}) {
         imageGenProvider, // Conditional: only registered when API key is present
         backgroundTaskManager, // Background_tasks tool registration
         sessionTrackerRegistry,
+        getCapabilityPortForAgent,
     });
     // Wire deferred tool assembler ref now that setupTools has returned
     toolAssemblerRef.ref = assembleToolsForAgent;
@@ -896,6 +965,9 @@ export async function main(overrides = {}) {
         memoryAdapter,
         gatewaySend: gatewaySendRef,
         activeRunRegistry,
+        // Composite-key resolver supersedes activeRunRegistry.get(sessionKey)
+        // for sub-agent-runner abort paths.
+        sessionResolver,
         deliveryQueue,
     });
     // Rolling prompt timeout counter (sliding 5-minute window).
@@ -980,7 +1052,8 @@ export async function main(overrides = {}) {
         executors,
         assembleToolsForAgent,
         workspaceDirs,
-        activeRunRegistry,
+        // Composite-key resolver replaces single-arg .has()
+        sessionResolver,
         duplicateDetector,
         adaptersByType,
         systemEventQueue,
@@ -1077,6 +1150,7 @@ export async function main(overrides = {}) {
             skillWatcherHandles.set(agentId, result.skillWatcherHandle);
         }
         skillRegistries.set(agentId, result.skillRegistry);
+        toolCapabilityPorts.set(agentId, result.toolCapabilityPort);
         container.eventBus.emit("agent:hot_added", { agentId, timestamp: Date.now() });
         daemonLogger.info({ agentId, durationMs: Date.now() - startMs }, "Agent hot-added to running daemon");
     };
@@ -1104,6 +1178,7 @@ export async function main(overrides = {}) {
         stepCounters.delete(agentId);
         piSessionAdapters.delete(agentId);
         skillRegistries.delete(agentId);
+        toolCapabilityPorts.delete(agentId);
         container.eventBus.emit("agent:hot_removed", { agentId, timestamp: Date.now() });
         daemonLogger.info({ agentId, durationMs: Date.now() - startMs }, "Agent hot-removed from running daemon");
     };

package/node_modules/@comis/daemon/dist/rpc/agent-inline-workspace.d.ts

@@ -1,6 +1,6 @@
 /**
  * Best-effort writer for inline ROLE.md / IDENTITY.md content supplied via
- * the L2 single-call agents.create path (260428-vyf).
+ * the L2 single-call agents.create path.
  *
  * Collapses the previous 3-call agent-creation workflow
  * (`agents_manage.create` -> `write(ROLE.md)` -> `write(IDENTITY.md)`)

package/node_modules/@comis/daemon/dist/rpc/agent-inline-workspace.js

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
  * Best-effort writer for inline ROLE.md / IDENTITY.md content supplied via
- * the L2 single-call agents.create path (260428-vyf).
+ * the L2 single-call agents.create path.
  *
  * Collapses the previous 3-call agent-creation workflow
  * (`agents_manage.create` -> `write(ROLE.md)` -> `write(IDENTITY.md)`)

package/node_modules/@comis/daemon/dist/rpc/builtin-provider-guard.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Built-in provider redundancy guard for providers.create (260501-gyy FIX 2).
+ * Built-in provider redundancy guard for providers.create.
  *
  * Rejects providers_manage create attempts that would shadow pi-ai's
  * dynamic catalog with a redundant custom entry. A built-in provider
@@ -16,7 +16,7 @@
  * in the source template (catalog-agnostic). Pinned by source-grep
  * regression test in builtin-provider-guard.test.ts.
  *
- * Mirrors credential-resolver.ts shape (260501-2pz precedent).
+ * Mirrors credential-resolver.ts shape.
  *
  * @module
  */

package/node_modules/@comis/daemon/dist/rpc/credential-resolver.js

@@ -16,7 +16,7 @@
  *      injected oauthProfileLoader (the OAuthCredentialStorePort handle held by
  *      the daemon, adapted to a synchronous has-check at the call site).
  *
- * Note on synchronous loader facade (quick-260504-irq): `OAuthCredentialStorePort.has`
+ * Note on synchronous loader facade: `OAuthCredentialStorePort.has`
  * is async (returns Promise<Result<boolean, Error>>). To avoid an async cascade
  * through every call site, this resolver remains SYNCHRONOUS and accepts a
  * sync facade (`oauthProfileLoader: { has(profileId: string): boolean }`).

package/node_modules/@comis/daemon/dist/rpc/model-handlers.d.ts

@@ -3,7 +3,7 @@
  * Handles model catalog query methods:
  *   models.list           -- List available models (optionally filtered by provider)
  *   models.test           -- Check provider configuration and catalog status
- *   models.list_providers -- Live native pi-ai catalog provider list (Layer 1F)
+ *   models.list_providers -- Live native pi-ai catalog provider list
  * All handlers are read-only -- no approval gate required.
  * @module
  */

package/node_modules/@comis/daemon/dist/rpc/model-handlers.js

@@ -4,7 +4,7 @@
  * Handles model catalog query methods:
  *   models.list           -- List available models (optionally filtered by provider)
  *   models.test           -- Check provider configuration and catalog status
- *   models.list_providers -- Live native pi-ai catalog provider list (Layer 1F)
+ *   models.list_providers -- Live native pi-ai catalog provider list
  * All handlers are read-only -- no approval gate required.
  * @module
  */
@@ -64,7 +64,7 @@ export function createModelHandlers(deps) {
             };
         },
         // -----------------------------------------------------------------------
-        // List native pi-ai catalog providers (Layer 1F -- 260430-vwt)
+        // List native pi-ai catalog providers
         //
         // Live self-discovery for the agent: returns the de-duplicated, sorted
         // list of provider names from the pi-ai native catalog. Pairs with the

package/node_modules/@comis/daemon/dist/sub-agent-runner.d.ts

@@ -139,6 +139,24 @@ export interface SubAgentRunnerDeps {
             abort(): Promise<void>;
         } | undefined;
     };
+    /**
+     * Optional composite-key resolver (R3, B37). When provided, supersedes
+     * `activeRunRegistry.get(sessionKey)` for production aborts: the resolver
+     * accepts `{ agentId, channelType, channelId }` so multi-agent /
+     * multi-channel sessions are distinguishable. Locally re-declared to a
+     * structural minimum (avoids a daemon -> agent type-only import cycle in
+     * this leaf module). The daemon wires it via
+     * `createBackgroundSessionResolver({activeRunRegistry})`.
+     */
+    sessionResolver?: {
+        resolveActiveSession(key: {
+            agentId: string;
+            channelType: string;
+            channelId: string;
+        }): {
+            abort(): Promise<void>;
+        } | undefined;
+    };
     /** Optional result condenser for compressing subagent output */
     resultCondenser?: {
         condense(params: {