comisai 1.0.36 → 1.0.37

package/node_modules/@comis/agent/dist/bootstrap/sections/tooling-sections.d.ts

@@ -4,8 +4,36 @@
  */
 /** Model size tier — determines prompt verbosity for tool descriptions. */
 export type ModelTier = "small" | "medium" | "large";
-export declare function buildToolingSection(toolNames: string[], _modelTier: ModelTier, toolSummaries?: Record<string, string>): string[];
-export declare function buildToolCallStyleSection(isMinimal: boolean, toolNames?: string[]): string[];
+/**
+ * Build the static `## Available Tools` block (legacy path, gate-off) OR a
+ * single residual one-liner pointing the model at the per-turn `## Capabilities`
+ * block (gate-on path).
+ *
+ * @param capabilityIndexEnabled - When `true`, emits ONLY the residual
+ *   one-liner. When `false` or undefined, emits the legacy flat block
+ *   BYTE-IDENTICALLY to the pre-feature baseline. The two paths are MUTUALLY
+ *   EXCLUSIVE.
+ *
+ *   Restart-required: this gate selects between two cached system-prompt
+ *   shapes; toggling at runtime is forbidden. Operator-facing constraint is
+ *   documented in config docs.
+ */
+export declare function buildToolingSection(toolNames: string[], _modelTier: ModelTier, toolSummaries?: Record<string, string>, capabilityIndexEnabled?: boolean): string[];
+/**
+ * Build the static "## Tool Call Style" section with conditional coding guidelines.
+ *
+ * @param capabilityIndexEnabled - When `true`, AND when `exec` is in
+ *   `toolNames`, the rendered output includes the dual-gated "Tool-first
+ *   principle" bullet immediately before the existing Python-virtualenv rule.
+ *   When `false` or `undefined`, the bullet is omitted; the existing venv
+ *   rule emits unchanged when `exec` is present.
+ *
+ *   Restart-required: the gate value flows from `tooling.capabilityIndex.enabled`
+ *   via `AssemblerParams.capabilityIndexEnabled`, populated at the prompt
+ *   assembly site from `port.isCapabilityIndexEnabled()`. The value is
+ *   config-derived and stable per session — SAFE inside the cache fence.
+ */
+export declare function buildToolCallStyleSection(isMinimal: boolean, toolNames?: string[], capabilityIndexEnabled?: boolean): string[];
 /** Tool names that trigger the confirmation flow / self-update gating section. */
 export declare const CONFIRMATION_TOOL_NAMES: string[];
 /**

package/node_modules/@comis/agent/dist/bootstrap/sections/tooling-sections.js

@@ -5,9 +5,36 @@
  */
 import { TOOL_SUMMARIES, TOOL_ORDER } from "./tool-descriptions.js";
 import { getProviders } from "@mariozechner/pi-ai";
-export function buildToolingSection(toolNames, _modelTier, toolSummaries) {
+/**
+ * Build the static `## Available Tools` block (legacy path, gate-off) OR a
+ * single residual one-liner pointing the model at the per-turn `## Capabilities`
+ * block (gate-on path).
+ *
+ * @param capabilityIndexEnabled - When `true`, emits ONLY the residual
+ *   one-liner. When `false` or undefined, emits the legacy flat block
+ *   BYTE-IDENTICALLY to the pre-feature baseline. The two paths are MUTUALLY
+ *   EXCLUSIVE.
+ *
+ *   Restart-required: this gate selects between two cached system-prompt
+ *   shapes; toggling at runtime is forbidden. Operator-facing constraint is
+ *   documented in config docs.
+ */
+export function buildToolingSection(toolNames, _modelTier, toolSummaries, capabilityIndexEnabled) {
     if (toolNames.length === 0)
         return [];
+    // Gate-on path: residual one-liner only. The per-turn `## Capabilities`
+    // block is rendered into the dynamic preamble by `executor-prompt-runner.ts`.
+    // The wording below is normative.
+    if (capabilityIndexEnabled === true) {
+        return [
+            "When this turn includes a `Capabilities` context, refer to it for grouped tool guidance " +
+                "before invoking tools or running installs. Tool schemas in your active toolspace are " +
+                "authoritative for parameter shapes.",
+        ];
+    }
+    // Gate-off path: legacy flat block BYTE-IDENTICAL to pre-feature baseline.
+    // DO NOT modify the body below — the byte-identity assertion in
+    // tooling-sections.test.ts depends on this shape staying exact.
     const summaries = { ...TOOL_SUMMARIES, ...toolSummaries };
     const ordered = TOOL_ORDER.filter((t) => toolNames.includes(t));
     const extras = toolNames.filter((t) => !TOOL_ORDER.includes(t)).sort();
@@ -23,7 +50,21 @@ export function buildToolingSection(toolNames, _modelTier, toolSummaries) {
 // ---------------------------------------------------------------------------
 // 4. Tool Call Style (skip if minimal)
 // ---------------------------------------------------------------------------
-export function buildToolCallStyleSection(isMinimal, toolNames = []) {
+/**
+ * Build the static "## Tool Call Style" section with conditional coding guidelines.
+ *
+ * @param capabilityIndexEnabled - When `true`, AND when `exec` is in
+ *   `toolNames`, the rendered output includes the dual-gated "Tool-first
+ *   principle" bullet immediately before the existing Python-virtualenv rule.
+ *   When `false` or `undefined`, the bullet is omitted; the existing venv
+ *   rule emits unchanged when `exec` is present.
+ *
+ *   Restart-required: the gate value flows from `tooling.capabilityIndex.enabled`
+ *   via `AssemblerParams.capabilityIndexEnabled`, populated at the prompt
+ *   assembly site from `port.isCapabilityIndexEnabled()`. The value is
+ *   config-derived and stable per session — SAFE inside the cache fence.
+ */
+export function buildToolCallStyleSection(isMinimal, toolNames = [], capabilityIndexEnabled) {
     if (isMinimal)
         return [];
     const lines = [
@@ -64,6 +105,14 @@ export function buildToolCallStyleSection(isMinimal, toolNames = []) {
         guidelines.push("- Show file paths clearly when working with files.");
     }
     if (has("exec")) {
+        // Dual-gated counterweight to the venv rule below. The bullet precedes
+        // the venv rule because the first read sets the default; the second is
+        // the install fallback. Restart-required: capabilityIndexEnabled flows
+        // from `tooling.capabilityIndex.enabled` via AssemblerParams →
+        // SECTIONS["tool-call-style"].
+        if (capabilityIndexEnabled === true) {
+            guidelines.push("- **Tool-first principle.** When this turn includes a `Capabilities` context and the task can be satisfied by a connected tool or available skill, prefer that capability over installing a Python or Node package. Use installs only for capabilities not covered by active tools, deferred tools, or visible prompt skills.");
+        }
         guidelines.push("- **Python projects:** Always create a virtualenv per project (`python3 -m venv .venv`). "
             + "Install packages into the project venv (`source .venv/bin/activate && pip install ...`). "
             + "Never use `--break-system-packages` — it pollutes the system Python. "

package/node_modules/@comis/agent/dist/bootstrap/system-prompt-assembler.d.ts

@@ -79,6 +79,28 @@ export interface AssemblerParams {
     excludeBootstrapFromContext?: boolean;
     /** Workspace profile controlling platform instruction verbosity ('full' or 'specialist'). */
     workspaceProfile?: "full" | "specialist";
+    /**
+     * Capability index gate.
+     *
+     * When `true`, `buildToolingSection` emits the residual one-liner instead
+     * of the legacy `## Available Tools` flat block; the per-turn
+     * `## Capabilities` block is rendered into the dynamic preamble in
+     * `executor-prompt-runner.ts`.
+     * When `false` or `undefined`, the static prompt is byte-identical to
+     * the pre-feature baseline.
+     *
+     * RESTART-REQUIRED: this flag selects between two cached system-prompt
+     * shapes. Daemon wiring documents the operator-facing constraint.
+     *
+     * SAFE INSIDE THE CACHE FENCE: this value is config-derived
+     * (operator-only, restart-required) and stable across all turns of a
+     * session. Plumbing it through `assemblerParams` does NOT create a
+     * cache-thrash regression. Live-runtime accessors
+     * (getPromptSkillCapabilities, getConnectedMcpServers) are forbidden
+     * inside this interface and enforced by an architecture-grep test.
+     * Adding a config-derived flag to the cache fence is safe.
+     */
+    capabilityIndexEnabled?: boolean;
     /** Whether Silent Execution Planner (SEP) is enabled for this agent. */
     sepEnabled?: boolean;
 }

package/node_modules/@comis/agent/dist/bootstrap/system-prompt-assembler.js

@@ -82,8 +82,8 @@ export const SECTIONS = [
     { id: "safety", includeIn: MODES_ALL, build: (p, m) => buildSafetySection(m === "minimal") },
     { id: "language", includeIn: MODES_ALL, build: (p) => buildLanguageSection(p.userLanguage) },
     // --- Semi-stable body: operational-kept sections (MODES_ALL -- builders self-filter for minimal) ---
-    { id: "tooling", includeIn: MODES_ALL, build: (p, m) => buildToolingSection(p.toolNames ?? [], m === "minimal" ? "small" : "large", p.toolSummaries) },
-    { id: "tool-call-style", includeIn: MODES_ALL, build: (p, m) => buildToolCallStyleSection(m === "minimal", p.toolNames ?? []) },
+    { id: "tooling", includeIn: MODES_ALL, build: (p, m) => buildToolingSection(p.toolNames ?? [], m === "minimal" ? "small" : "large", p.toolSummaries, p.capabilityIndexEnabled) },
+    { id: "tool-call-style", includeIn: MODES_ALL, build: (p, m) => buildToolCallStyleSection(m === "minimal", p.toolNames ?? [], p.capabilityIndexEnabled) },
     // --- Operational-stripped sections (MODES_FULL_MIN -- dropped in "operational") ---
     { id: "self-update", includeIn: MODES_FULL_MIN, build: (p, m) => buildSelfUpdateGatingSection(p.toolNames ?? [], m === "minimal", true) },
     { id: "config-secret", includeIn: MODES_FULL_MIN, build: (p, m) => buildConfigSecretIntegritySection(p.toolNames ?? [], m === "minimal") },

package/node_modules/@comis/agent/dist/bridge/bridge-event-handlers.d.ts

@@ -10,11 +10,7 @@
  *
  * @module
  */
-/**
- * Extract the MCP server name from a sanitized tool name.
- * Format: `mcp__serverName--toolName`. Returns undefined for non-MCP tools.
- */
-export declare function extractMcpServerName(toolName: string): string | undefined;
+export { extractMcpServerName } from "@comis/shared";
 /**
  * Classify an MCP error message into a category for observability.
  */

package/node_modules/@comis/agent/dist/bridge/bridge-event-handlers.js

@@ -13,21 +13,9 @@
  */
 // ---------------------------------------------------------------------------
 // MCP attribution helpers
-// Defined inline to avoid cross-package import from @comis/skills.
+// Re-exported from @comis/shared (canonical home).
 // ---------------------------------------------------------------------------
-/**
- * Extract the MCP server name from a sanitized tool name.
- * Format: `mcp__serverName--toolName`. Returns undefined for non-MCP tools.
- */
-export function extractMcpServerName(toolName) {
-    if (!toolName.startsWith("mcp__"))
-        return undefined;
-    const rest = toolName.slice(5);
-    const sepIdx = rest.indexOf("--");
-    if (sepIdx <= 0)
-        return undefined;
-    return rest.slice(0, sepIdx);
-}
+export { extractMcpServerName } from "@comis/shared";
 /**
  * Classify an MCP error message into a category for observability.
  */

package/node_modules/@comis/agent/dist/bridge/bridge-metrics.d.ts

@@ -26,6 +26,16 @@ export interface BridgeMetricsState {
     lastContextUsage: ContextUsageData | undefined;
     textEmitted: boolean;
     lastLlmErrorMessage: string | undefined;
+    /** Per-turn capture of outbound delivery events. Populated by pi-event-bridge
+     *  on tool_execution_end for `message(action='send'|'reply'|'attach')`.
+     *  Read by executor-post-execution.ts to make sentinel-aware decisions.
+     *  Reset at turn start. */
+    outboundLog: Array<{
+        action: string;
+        channelType: string;
+        channelId: string;
+        timestamp: number;
+    }>;
     toolStartTimes: Map<string, number>;
     toolCallHistory: string[];
     lastActiveToolName: string | undefined;
@@ -75,6 +85,22 @@ export interface BridgeMetricsState {
     /** Total tool calls across all signature-replay scrubs whose thoughtSignature
      *  was stripped (post-incident-visibility metric). */
     signatureScrubsToolCallsAffected: number;
+    /**
+     * Per-composite-key drain inflight gate. Owned by the bridge; passed into
+     * `drainAt(...)` at the `tool_execution_end` call site (inline-consumption +
+     * composite drain).
+     *
+     * Map keyed by `${agentId}:${channelType}:${channelId}` (composite key).
+     * Concurrent calls for the SAME composite key return immediately
+     * (single-tick gate). Concurrent calls for DIFFERENT composite keys drain
+     * independently (multi-agent isolation).
+     *
+     * Entry cleanup: `.delete(formatted)` runs in `.finally(...)` of the
+     * drain promise so the Map size remains bounded across long-running
+     * sessions (entry removed within one event-loop tick of drain
+     * resolution).
+     */
+    drainInflightByKey: Map<string, Promise<void>>;
 }
 /**
  * Create a fresh metrics state with all counters zeroed.

package/node_modules/@comis/agent/dist/bridge/bridge-metrics.js

@@ -29,6 +29,7 @@ export function createBridgeMetrics() {
         lastContextUsage: undefined,
         textEmitted: false,
         lastLlmErrorMessage: undefined,
+        outboundLog: [],
         toolStartTimes: new Map(),
         toolCallHistory: [],
         lastActiveToolName: undefined,
@@ -58,6 +59,8 @@ export function createBridgeMetrics() {
         hashAssertionMismatches: 0,
         signatureScrubs: 0,
         signatureScrubsToolCallsAffected: 0,
+        // per-composite-key drain inflight gate.
+        drainInflightByKey: new Map(),
     };
 }
 /**

package/node_modules/@comis/agent/dist/bridge/pi-event-bridge.d.ts

@@ -20,6 +20,7 @@ import type { ProviderHealthMonitor } from "../safety/provider-health-monitor.js
 import type { ContextWindowGuard, ContextUsageData } from "../safety/context-window-guard.js";
 import type { ExecutionResult } from "../executor/types.js";
 import type { ExecutionPlan } from "../planner/types.js";
+import { type DrainInflightState } from "../executor/drain-helper.js";
 import { type ThinkingBlockHash } from "./thinking-block-hash-invariant.js";
 /** Per-call TTL split estimate, populated by requestBodyInjector's onPayload.
  *  Shared mutable object — written by the stream wrapper, read by the bridge. */
@@ -203,6 +204,14 @@ export interface PiEventBridgeResult {
         hashes: ReadonlyMap<string, ReadonlyArray<ThinkingBlockHash>>;
         canonical: ReadonlyMap<string, ReadonlyArray<unknown>>;
     };
+    /**
+     * Expose the bridge-owned drain inflight gate so executor-post-execution
+     * can fire an end-of-turn backstop drainAt sharing the same composite-key
+     * gate map. Returns the live `BridgeMetricsState` slice -- callers MUST
+     * treat this as read-mostly (the only mutation contract is `drainAt`
+     * adding/removing entries).
+     */
+    getDrainState: () => DrainInflightState;
 }
 export { sanitizeToolArgs, extractErrorText } from "./bridge-event-handlers.js";
 /**

package/node_modules/@comis/agent/dist/bridge/pi-event-bridge.js

@@ -18,8 +18,10 @@ import { getCacheProviderInfo } from "../executor/cache-usage-helpers.js";
 import { sanitizeMcpToolNameForAnalytics } from "../executor/cache-break-detection.js";
 import { classifyError } from "../executor/error-classifier.js";
 import { extractPlanFromResponse } from "../planner/plan-extractor.js";
-import { extractMcpServerName, classifyMcpErrorType, sanitizeToolArgs, extractErrorText } from "./bridge-event-handlers.js";
+import { extractMcpServerName } from "@comis/shared";
+import { classifyMcpErrorType, sanitizeToolArgs, extractErrorText } from "./bridge-event-handlers.js";
 import { createBridgeMetrics, buildBridgeResult } from "./bridge-metrics.js";
+import { drainAt } from "../executor/drain-helper.js";
 import { checkStepLimit, emitStepLimitAbort, checkBudgetLimit, emitBudgetAbort, checkBudgetTrajectory, checkContextWindow, emitContextAbort, checkCircuitBreaker, emitCircuitBreakerAbort } from "./bridge-safety-controls.js";
 import { computeThinkingBlockHashes, diffThinkingBlocksAgainstPersisted, WIRE_DIFF_HINT_FILE_MISSING, WIRE_DIFF_HINT_NOT_FOUND, } from "./thinking-block-hash-invariant.js";
 // Re-export helper functions for backward compatibility with existing imports
@@ -171,6 +173,62 @@ export function createPiEventBridge(deps) {
                         durationMs,
                         ...(errorText && { errorText }),
                     });
+                    // Capture outbound deliveries. The post-execution silent-sentinel
+                    // gate reads this per-turn log to make sentinel-aware decisions
+                    // about paired memory persistence. Reset at turn_start; bounded by
+                    // per-turn outbound message count.
+                    //
+                    // On the SAME tool_execution_end event, fire
+                    // `drainAt({agentId, channelType, channelId})` (the composite-keyed
+                    // inline-consumption drain). The gate state lives in bridge-metrics
+                    // (`m.drainInflightByKey`) so concurrent drains for the same
+                    // composite key collapse to a single in-flight Promise; concurrent
+                    // drains for different composite keys (multi-agent) run
+                    // independently. Failures inside drainAt are suppressed with WARN
+                    // logging -- the bridge's tool_execution_end propagation is NEVER
+                    // aborted by drain misbehavior.
+                    if (endEvent.toolName === "message" && toolSuccess && sanitizedArgs) {
+                        const action = typeof sanitizedArgs.action === "string" ? sanitizedArgs.action : "";
+                        if (action === "send" || action === "reply" || action === "attach") {
+                            const channelType = typeof sanitizedArgs.channel_type === "string" ? sanitizedArgs.channel_type : "";
+                            const channelId = typeof sanitizedArgs.channel_id === "string" ? sanitizedArgs.channel_id : "";
+                            m.outboundLog.push({
+                                action,
+                                channelType,
+                                channelId,
+                                timestamp: Date.now(),
+                            });
+                            // Composite-key drain at the bridge call site. The composite
+                            // (agentId, channelType, channelId) prevents cross-agent
+                            // contamination of the inline-consumption queue. Use the
+                            // message tool's own channel_type / channel_id when present
+                            // (the tool resolved them); fall back to the bridge's bound
+                            // deps.channelId when the tool args were sanitized away
+                            // (defensive). A drain trigger with empty channelType OR empty
+                            // channelId is skipped -- formatDrainKey would otherwise
+                            // produce ambiguous keys.
+                            //
+                            // drainAt is fire-and-forget: it spawns the drain Promise and
+                            // wraps it in suppressError internally. The kickoffDrain
+                            // wrapper below double-wraps the synchronous invocation in
+                            // suppressError (Promise.resolve adapter) so a (impossible)
+                            // synchronous throw inside drainAt cannot abort the bridge's
+                            // tool_execution_end propagation -- fire-and-forget contract /
+                            // non-fatal drain failure.
+                            const drainChannelType = channelType.length > 0 ? channelType : "";
+                            const drainChannelId = channelId.length > 0 ? channelId : deps.channelId;
+                            if (drainChannelType.length > 0 && drainChannelId.length > 0) {
+                                const kickoffDrain = Promise.resolve().then(() => {
+                                    drainAt({
+                                        agentId: deps.agentId,
+                                        channelType: drainChannelType,
+                                        channelId: drainChannelId,
+                                    }, { drainInflightByKey: m.drainInflightByKey }, deps.logger);
+                                });
+                                suppressError(kickoffDrain, "bridge tool_use_complete drainAt kickoff");
+                            }
+                        }
+                    }
                     // Look up truncation metadata from stream wrapper registry
                     const truncMeta = deps.getTruncationMeta?.(endEvent.toolCallId);
                     deps.eventBus.emit("tool:executed", {
@@ -222,6 +280,10 @@ export function createPiEventBridge(deps) {
                 // LLM turn about to start (pre-serialize hook for assert+restore)
                 // -----------------------------------------------------------------
                 case "turn_start": {
+                    // Reset per-turn outbound capture. The log accumulates
+                    // message(send/reply/attach) calls across the turn so the
+                    // post-execution gate can make sentinel-aware decisions.
+                    m.outboundLog.length = 0;
                     // Run the executor-supplied pre-call closure once per turn, before
                     // pi-ai reads `session.agent.state.messages` to serialize the next
                     // API request. The closure performs the assert-then-restore pass
@@ -1050,5 +1112,14 @@ export function createPiEventBridge(deps) {
         hashes: m.thinkingBlockHashes,
         canonical: m.thinkingBlockCanonical,
     });
-    return { listener, getResult, addGhostCost, getThinkingBlockStores };
+    // Expose the per-composite-key drain inflight gate so executor-post-
+    // execution can fire an end-of-turn backstop drainAt that shares the SAME
+    // gate map as the bridge's tool_execution_end call site. The returned
+    // object has a live reference to the underlying Map -- mutations from the
+    // bridge AND the executor post-execution path land in the same state
+    // container, satisfying the single-tick gate contract.
+    const getDrainState = () => ({
+        drainInflightByKey: m.drainInflightByKey,
+    });
+    return { listener, getResult, addGhostCost, getThinkingBlockStores, getDrainState };
 }

package/node_modules/@comis/agent/dist/context-engine/signature-surrogate-guard.d.ts

@@ -21,16 +21,16 @@
  * plain text rather than sending sanitized-text + original-signature
  * mismatch. Skips `redacted: true` blocks (no readable text to taint).
  *
- * 260430-anthropic-400-thinking-block: cacheFenceIndex is intentionally
- * NOT consulted to gate guarding. The guard is pure/deterministic — input
- * messages → same guarded output every time — so iter 1 strips,
- * Anthropic caches the guarded prefix, iter 2 strips identically, and the
- * cache hits. The prior fence-skip caused per-execution divergence
- * symmetric to the bug found in `signature-replay-scrubber.ts` and
- * `thinking-block-cleaner.ts`: iter 1 stripped (fence=-1) and built a
- * surrogate-safe cached prefix, iter 2 preserved fence-protected messages
- * (fence>0) and re-introduced surrogate-tainted-with-original-signature
- * blocks at positions Anthropic had cached without them.
+ * cacheFenceIndex is intentionally NOT consulted to gate guarding. The
+ * guard is pure/deterministic — input messages → same guarded output every
+ * time — so iter 1 strips, Anthropic caches the guarded prefix, iter 2
+ * strips identically, and the cache hits. The prior fence-skip caused
+ * per-execution divergence symmetric to the bug found in
+ * `signature-replay-scrubber.ts` and `thinking-block-cleaner.ts`: iter 1
+ * stripped (fence=-1) and built a surrogate-safe cached prefix, iter 2
+ * preserved fence-protected messages (fence>0) and re-introduced
+ * surrogate-tainted-with-original-signature blocks at positions Anthropic
+ * had cached without them.
  *
  * Immutability: never mutates input; shallow-copies the block and the
  * containing message only when scrubbing is needed. When no scrub fires,

package/node_modules/@comis/agent/dist/context-engine/signature-surrogate-guard.js

@@ -22,16 +22,16 @@
  * plain text rather than sending sanitized-text + original-signature
  * mismatch. Skips `redacted: true` blocks (no readable text to taint).
  *
- * 260430-anthropic-400-thinking-block: cacheFenceIndex is intentionally
- * NOT consulted to gate guarding. The guard is pure/deterministic — input
- * messages → same guarded output every time — so iter 1 strips,
- * Anthropic caches the guarded prefix, iter 2 strips identically, and the
- * cache hits. The prior fence-skip caused per-execution divergence
- * symmetric to the bug found in `signature-replay-scrubber.ts` and
- * `thinking-block-cleaner.ts`: iter 1 stripped (fence=-1) and built a
- * surrogate-safe cached prefix, iter 2 preserved fence-protected messages
- * (fence>0) and re-introduced surrogate-tainted-with-original-signature
- * blocks at positions Anthropic had cached without them.
+ * cacheFenceIndex is intentionally NOT consulted to gate guarding. The
+ * guard is pure/deterministic — input messages → same guarded output every
+ * time — so iter 1 strips, Anthropic caches the guarded prefix, iter 2
+ * strips identically, and the cache hits. The prior fence-skip caused
+ * per-execution divergence symmetric to the bug found in
+ * `signature-replay-scrubber.ts` and `thinking-block-cleaner.ts`: iter 1
+ * stripped (fence=-1) and built a surrogate-safe cached prefix, iter 2
+ * preserved fence-protected messages (fence>0) and re-introduced
+ * surrogate-tainted-with-original-signature blocks at positions Anthropic
+ * had cached without them.
  *
  * Immutability: never mutates input; shallow-copies the block and the
  * containing message only when scrubbing is needed. When no scrub fires,
@@ -69,10 +69,10 @@ export function createSignatureSurrogateGuard(deps) {
             for (let i = 0; i < messages.length; i++) {
                 // eslint-disable-next-line security/detect-object-injection -- numeric index
                 const original = messages[i];
-                // 260430-anthropic-400-thinking-block: cacheFenceIndex is intentionally
-                // NOT consulted here. Stripping uniformly across the array keeps the
-                // guarded prefix identical across iterations of the same execution,
-                // which is what Anthropic's prompt-cache validator requires.
+                // cacheFenceIndex is intentionally NOT consulted here. Stripping
+                // uniformly across the array keeps the guarded prefix identical
+                // across iterations of the same execution, which is what
+                // Anthropic's prompt-cache validator requires.
                 const msg = original;
                 if (msg.role !== "assistant" || !Array.isArray(msg.content)) {
                     // eslint-disable-next-line security/detect-object-injection -- numeric index

package/node_modules/@comis/agent/dist/context-engine/thinking-block-cleaner.d.ts

@@ -5,17 +5,16 @@
  * keep-window, measured in assistant turns (not turn pairs). Redacted thinking
  * blocks (containing encrypted signatures for API continuity) are always preserved.
  *
- * 260430-anthropic-400-thinking-block: cacheFenceIndex is intentionally NOT
- * consulted to gate stripping. The cleaner is pure/deterministic — input
- * messages → same cleaned output every time — so iteration 1 strips,
- * Anthropic caches the cleaned prefix, iteration 2 strips identically, and
- * the cache hits. The prior fence-skip caused per-execution divergence:
- * iter 1 stripped (fence=-1) and built a thinking-free cached prefix,
- * iter 2 preserved fence-protected messages (fence>0) and re-introduced
- * thinking blocks at positions Anthropic had cached without them, which
- * the prompt-cache validator rejected with `400 ... blocks cannot be
- * modified`. The cacheFenceIndex on the budget is read for diagnostic
- * stats only and never gates the strip decision.
+ * cacheFenceIndex is intentionally NOT consulted to gate stripping. The
+ * cleaner is pure/deterministic — input messages → same cleaned output
+ * every time — so iteration 1 strips, Anthropic caches the cleaned prefix,
+ * iteration 2 strips identically, and the cache hits. The prior fence-skip
+ * caused per-execution divergence: iter 1 stripped (fence=-1) and built a
+ * thinking-free cached prefix, iter 2 preserved fence-protected messages
+ * (fence>0) and re-introduced thinking blocks at positions Anthropic had
+ * cached without them, which the prompt-cache validator rejected with
+ * `400 ... blocks cannot be modified`. The cacheFenceIndex on the budget
+ * is read for diagnostic stats only and never gates the strip decision.
  *
  * Immutability: never mutates input messages or arrays. Returns new arrays and
  * shallow-copied messages only when changes are needed. When no changes are
@@ -39,8 +38,7 @@ import type { ContextLayer } from "./types.js";
 export declare function createThinkingBlockCleaner(keepTurns: number, onCleaned?: (stats: {
     blocksRemoved: number;
     /** Cache fence index when present on the budget; reported for diagnostics
-     *  only. Stripping is no longer gated on the fence (260430-anthropic-400-
-     *  thinking-block). */
+     *  only. Stripping is no longer gated on the fence. */
     cacheFenceIndex?: number;
     /** Number of messages protected by the cache fence. Always undefined now
      *  because the fence does not protect any messages from stripping. */

package/node_modules/@comis/agent/dist/context-engine/thinking-block-cleaner.js

@@ -6,17 +6,16 @@
  * keep-window, measured in assistant turns (not turn pairs). Redacted thinking
  * blocks (containing encrypted signatures for API continuity) are always preserved.
  *
- * 260430-anthropic-400-thinking-block: cacheFenceIndex is intentionally NOT
- * consulted to gate stripping. The cleaner is pure/deterministic — input
- * messages → same cleaned output every time — so iteration 1 strips,
- * Anthropic caches the cleaned prefix, iteration 2 strips identically, and
- * the cache hits. The prior fence-skip caused per-execution divergence:
- * iter 1 stripped (fence=-1) and built a thinking-free cached prefix,
- * iter 2 preserved fence-protected messages (fence>0) and re-introduced
- * thinking blocks at positions Anthropic had cached without them, which
- * the prompt-cache validator rejected with `400 ... blocks cannot be
- * modified`. The cacheFenceIndex on the budget is read for diagnostic
- * stats only and never gates the strip decision.
+ * cacheFenceIndex is intentionally NOT consulted to gate stripping. The
+ * cleaner is pure/deterministic — input messages → same cleaned output
+ * every time — so iteration 1 strips, Anthropic caches the cleaned prefix,
+ * iteration 2 strips identically, and the cache hits. The prior fence-skip
+ * caused per-execution divergence: iter 1 stripped (fence=-1) and built a
+ * thinking-free cached prefix, iter 2 preserved fence-protected messages
+ * (fence>0) and re-introduced thinking blocks at positions Anthropic had
+ * cached without them, which the prompt-cache validator rejected with
+ * `400 ... blocks cannot be modified`. The cacheFenceIndex on the budget
+ * is read for diagnostic stats only and never gates the strip decision.
  *
  * Immutability: never mutates input messages or arrays. Returns new arrays and
  * shallow-copied messages only when changes are needed. When no changes are
@@ -77,10 +76,10 @@ export function createThinkingBlockCleaner(keepTurns, onCleaned, getKeepTurnsOve
             let blocksRemoved = 0;
             const result = new Array(messages.length);
             for (let i = 0; i < messages.length; i++) {
-                // 260430-anthropic-400-thinking-block: cacheFenceIndex is intentionally
-                // NOT consulted here. Stripping uniformly across the array keeps the
-                // cleaned prefix identical across iterations of the same execution,
-                // which is what Anthropic's prompt-cache validator requires.
+                // cacheFenceIndex is intentionally NOT consulted here. Stripping
+                // uniformly across the array keeps the cleaned prefix identical
+                // across iterations of the same execution, which is what
+                // Anthropic's prompt-cache validator requires.
                 const msg = messages[i];
                 if (!oldAssistantIndices.has(i)) {
                     // Within keep-window or not an assistant message -- pass through unchanged

package/node_modules/@comis/agent/dist/executor/capability-index-context.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Per-turn capability-index renderer.
+ *
+ * Renders the `## Capabilities` block for the dynamic preamble. Lives
+ * post-deferral in the executor lifecycle; consumes a `ToolCapabilityPort`
+ * for cluster/skill resolution and an `ExcludeDeferralResult` for active
+ * vs deferred tool partitioning.
+ *
+ * Pure-function builder: no logger, no IO, no `Result` envelope, no mutable
+ * module state beyond frozen module-level constants. Mirrors the shape of
+ * `buildDeferredToolsContext` in `tool-deferral.ts`.
+ *
+ * IMPORTANT -- cache fence:
+ * This module is consumed ONLY by `executor-tool-assembly.ts`. It MUST NOT
+ * be imported by `prompt-assembly.ts` -- the static prompt cache prefix MUST
+ * stay byte-identical when the skill registry reloads between turns.
+ * An architecture-grep enforces this invariant.
+ *
+ * @module
+ */
+import type { ToolCapabilityPort } from "@comis/core";
+import type { ExcludeDeferralResult } from "./tool-deferral.js";
+/**
+ * Output struct from {@link buildCapabilityIndexContext}. All counts are
+ * post-elision -- they reflect what the renderer surfaces, not the upstream
+ * input cardinality.
+ */
+export interface CapabilityIndexRenderResult {
+    /** Rendered text block. Empty string when the index is gated off or all-zero counts. */
+    readonly text: string;
+    /** Estimated tokens for the rendered text (`Math.ceil(text.length / CHARS_PER_TOKEN_RATIO)`). */
+    readonly capabilityIndexTokens: number;
+    /** Number of distinct clusters surfaced. */
+    readonly clusterCount: number;
+    /** Number of active tools (builtins + active MCP tools). */
+    readonly activeToolCount: number;
+    /** Number of deferred MCP tools after the orphan-drop (server connected). */
+    readonly deferredToolCount: number;
+    /** Number of visible eligible prompt skills (port-reported, not rendered count). */
+    readonly promptSkillCount: number;
+}
+/**
+ * Build the per-turn capability-index render result.
+ *
+ * Behavior:
+ *  - Gate respect: returns {@link EMPTY} when `port.isCapabilityIndexEnabled()` is false.
+ *  - Empty-input fast path: returns {@link EMPTY} when all three surface counts are zero.
+ *  - Cluster bucketing: builtins -> `getBuiltinCluster()` (or `"other-tools"`),
+ *    MCP -> `getMcpServerHint().cluster` (or `"external-integrations"`),
+ *    skills -> `skill.cluster` (or `"prompt-skills"`).
+ *  - Orphan-drop: deferred MCP tools whose server is not in the live
+ *    `getConnectedMcpServers()` snapshot are dropped silently.
+ *  - Sort: `(priority asc, clusterId asc)` for clusters; `TOOL_ORDER` for
+ *    builtins (alphabetical fallback for unknowns); alphabetical for MCP
+ *    servers and skills.
+ *  - Per-group cap: 8 names + `+N more`.
+ *  - >32 elision: drop ALL per-cluster name lists; keep headers + counts only.
+ *  - Forbidden-literal discipline: the rendered text names neither the
+ *    client-side discovery tool nor the server-side tool search regex tool.
+ *    The deferred-tools preamble bullet uses the mechanism-neutral
+ *    `"discovery mechanism available in your active toolspace"` wording.
+ *    An architecture-grep enforces the file-level invariant.
+ *
+ * Restart-required note: `tooling.capabilityIndex.enabled` requires a daemon
+ * restart to take effect. The renderer respects the port's reported value at
+ * render time but does not enforce the restart constraint.
+ *
+ * @param deferralResult - Output of `applyToolDeferral` (active + deferred tool partition).
+ * @param port - The capability port (gate flag, cluster/skill resolution, live runtime view).
+ * @returns Frozen {@link CapabilityIndexRenderResult}; identity-stable {@link EMPTY} for the no-op path.
+ */
+export declare function buildCapabilityIndexContext(deferralResult: ExcludeDeferralResult, port: ToolCapabilityPort): CapabilityIndexRenderResult;