comisai 1.0.36 → 1.0.40

package/node_modules/@comis/agent/dist/workspace/data-env.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Workspace-internal data env resolver.
+ *
+ * Returns environment variables for python/matplotlib subprocesses that
+ * derive ALL paths from `workspaceDir`. Avoids slow pip installs in the
+ * chart hot path and matplotlib Fontconfig errors from a non-writable
+ * default cache dir.
+ *
+ * This file contains no host-env reads. Subprocesses inheriting the
+ * daemon's full environment can pick up host paths (e.g.
+ * `/root/.cache/matplotlib`) that fail under read-only systemd hardening
+ * (`ProtectSystem=strict`) and leak host PATH into the agent's tool
+ * execution.
+ *
+ * matplotlib + python deps install into the agent workspace's `venv/`.
+ * The Dockerfile pre-warms the default workspace's venv at image build
+ * time so first-chart latency drops; subsequent chart calls reuse the
+ * venv. Full Docker image size goes up (acceptable trade-off).
+ *
+ * Mirrors workspace-resolver.ts's safePath + workspaceDir precedent
+ * (no path.join, no host-env reads).
+ *
+ * @module
+ */
+/**
+ * Resolve workspace-internal env vars for python/matplotlib subprocesses.
+ *
+ * The returned record is intended to be MERGED over an existing subprocess
+ * env at the call site (e.g. exec-tool's `{ ...baseEnv, ...resolveDataEnv(...) }`),
+ * so the workspace-internal values win on collision and the host PATH /
+ * cache dirs are not surfaced inside the subprocess.
+ *
+ * @param opts.workspaceDir - Absolute path to the agent workspace.
+ * @returns env-var record suitable for `child_process.spawn(..., { env })`.
+ */
+export declare function resolveDataEnv(opts: {
+    workspaceDir: string;
+}): Record<string, string>;

package/node_modules/@comis/agent/dist/workspace/data-env.js

@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Workspace-internal data env resolver.
+ *
+ * Returns environment variables for python/matplotlib subprocesses that
+ * derive ALL paths from `workspaceDir`. Avoids slow pip installs in the
+ * chart hot path and matplotlib Fontconfig errors from a non-writable
+ * default cache dir.
+ *
+ * This file contains no host-env reads. Subprocesses inheriting the
+ * daemon's full environment can pick up host paths (e.g.
+ * `/root/.cache/matplotlib`) that fail under read-only systemd hardening
+ * (`ProtectSystem=strict`) and leak host PATH into the agent's tool
+ * execution.
+ *
+ * matplotlib + python deps install into the agent workspace's `venv/`.
+ * The Dockerfile pre-warms the default workspace's venv at image build
+ * time so first-chart latency drops; subsequent chart calls reuse the
+ * venv. Full Docker image size goes up (acceptable trade-off).
+ *
+ * Mirrors workspace-resolver.ts's safePath + workspaceDir precedent
+ * (no path.join, no host-env reads).
+ *
+ * @module
+ */
+import { safePath } from "@comis/core";
+/**
+ * Resolve workspace-internal env vars for python/matplotlib subprocesses.
+ *
+ * The returned record is intended to be MERGED over an existing subprocess
+ * env at the call site (e.g. exec-tool's `{ ...baseEnv, ...resolveDataEnv(...) }`),
+ * so the workspace-internal values win on collision and the host PATH /
+ * cache dirs are not surfaced inside the subprocess.
+ *
+ * @param opts.workspaceDir - Absolute path to the agent workspace.
+ * @returns env-var record suitable for `child_process.spawn(..., { env })`.
+ */
+export function resolveDataEnv(opts) {
+    const venvBin = safePath(opts.workspaceDir, "venv", "bin");
+    const cacheDir = safePath(opts.workspaceDir, ".cache");
+    const mplDir = safePath(cacheDir, "matplotlib");
+    return {
+        // Python venv binaries on PATH (no host-PATH pollution).
+        PATH: venvBin,
+        // matplotlib config + cache dir (writable, workspace-internal).
+        MPLCONFIGDIR: mplDir,
+        // XDG cache spec -- fontconfig + other libs honor this.
+        XDG_CACHE_HOME: cacheDir,
+        // Force matplotlib to use a non-interactive backend (avoids
+        // Tkinter / X11 dependencies that would bloat the container image
+        // and otherwise crash on headless containers).
+        MPLBACKEND: "Agg",
+        // Disable pip's distrust of the (workspace-internal) venv path.
+        PIP_DISABLE_PIP_VERSION_CHECK: "1",
+    };
+}

package/node_modules/@comis/agent/dist/workspace/index.d.ts

@@ -1,6 +1,7 @@
 export { ensureWorkspace, getWorkspaceStatus, registerWorkspaceFilesInTracker, WORKSPACE_SUBDIRS, } from "./workspace-manager.js";
 export type { WorkspaceFiles, EnsureWorkspaceOptions, WorkspaceStatus, WorkspaceSeedTracker, RegisterWorkspaceResult, } from "./workspace-manager.js";
 export { resolveWorkspaceDir } from "./workspace-resolver.js";
+export { resolveDataEnv } from "./data-env.js";
 export { WORKSPACE_FILE_NAMES, DEFAULT_TEMPLATES } from "./templates.js";
 export type { WorkspaceFileName } from "./templates.js";
 export { isHeartbeatContentEffectivelyEmpty } from "./heartbeat-file.js";

package/node_modules/@comis/agent/dist/workspace/index.js

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 export { ensureWorkspace, getWorkspaceStatus, registerWorkspaceFilesInTracker, WORKSPACE_SUBDIRS, } from "./workspace-manager.js";
 export { resolveWorkspaceDir } from "./workspace-resolver.js";
+export { resolveDataEnv } from "./data-env.js";
 export { WORKSPACE_FILE_NAMES, DEFAULT_TEMPLATES } from "./templates.js";
 export { isHeartbeatContentEffectivelyEmpty } from "./heartbeat-file.js";
 export { isBootContentEffectivelyEmpty, BOOT_FILE_NAME } from "./boot-file.js";

package/node_modules/@comis/agent/dist/workspace/onboarding-detector.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 import * as fs from "node:fs/promises";
-import { safePath } from "@comis/core";
+import { safePath, systemNowMs } from "@comis/core";
 import { incrementOnboardingCount, isIdentityFilled, readWorkspaceState, writeWorkspaceState } from "./workspace-state.js";
 /** Auto-complete onboarding after this many messages if identity is still unfilled. */
 const MAX_ONBOARDING_MESSAGES = 3;
@@ -35,7 +35,7 @@ export async function detectOnboardingState(workspaceDir) {
     // Cap: auto-complete onboarding after MAX_ONBOARDING_MESSAGES attempts
     const count = await incrementOnboardingCount(workspaceDir);
     if (count > MAX_ONBOARDING_MESSAGES) {
-        await writeWorkspaceState(workspaceDir, { onboardingCompletedAt: Date.now() });
+        await writeWorkspaceState(workspaceDir, { onboardingCompletedAt: systemNowMs() });
         return false;
     }
     return true;

package/node_modules/@comis/agent/dist/workspace/templates.js

@@ -203,7 +203,11 @@ Capture what matters. The system persists it automatically.
 ## Workspace Organization
 
 \`\`\`
-projects/    -- Code repos (each in its own subfolder, venvs inside as .venv)
+projects/    -- Code repos (each in its own subfolder, .venv per repo)
+venv/        -- Pre-warmed Python env (matplotlib, numpy, pandas on PATH).
+                Use venv/bin/python for chart/data work; venv/bin/pip
+                install <pkg> for extras. Per-project venvs go inside
+                projects/<name>/.venv (separate lifecycle).
 scripts/     -- Standalone reusable scripts
 documents/   -- Text docs, PDFs, spreadsheets, markdown
 media/       -- User-provided images, audio, video

package/node_modules/@comis/agent/dist/workspace/workspace-manager.d.ts

@@ -76,7 +76,7 @@ export interface RegisterWorkspaceResult {
     registered: number;
     /** Files whose tracker entry already matched disk mtime -- no re-read performed. */
     skipped: number;
-    /** Total wall-clock duration in ms (Date.now() deltas). */
+    /** Total wall-clock duration in ms (systemNowMs() deltas). */
     durationMs: number;
 }
 /**

package/node_modules/@comis/agent/dist/workspace/workspace-manager.js

@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
-import { safePath } from "@comis/core";
+// @allow-throw: workspace-manager re-raise of non-EEXIST fs errors (line 101); consumed by daemon bootstrap (daemon.ts catch boundary).
+import { safePath, systemNowMs } from "@comis/core";
 import { execFile as execFileCb } from "node:child_process";
 import * as fs from "node:fs/promises";
 import { promisify } from "node:util";
@@ -100,7 +101,7 @@ export async function ensureWorkspace(options) {
             }
         }
         if (bootstrapNewlyWritten) {
-            await writeWorkspaceState(dir, { bootstrapSeededAt: Date.now() });
+            await writeWorkspaceState(dir, { bootstrapSeededAt: systemNowMs() });
         }
     }
     if (initGit) {
@@ -146,7 +147,7 @@ export async function ensureWorkspace(options) {
  * @returns Aggregate counts `{ registered, skipped, durationMs }`.
  */
 export async function registerWorkspaceFilesInTracker(dir, tracker, logger) {
-    const startMs = Date.now();
+    const startMs = systemNowMs();
     let registered = 0;
     let skipped = 0;
     for (const name of WORKSPACE_FILE_NAMES) {
@@ -170,7 +171,7 @@ export async function registerWorkspaceFilesInTracker(dir, tracker, logger) {
             // still reflects how many files were present (registered + skipped).
         }
     }
-    const durationMs = Date.now() - startMs;
+    const durationMs = systemNowMs() - startMs;
     logger?.debug?.({ dir, registered, skipped, durationMs, fileCount: WORKSPACE_FILE_NAMES.length }, "Workspace template files registered in tracker");
     return { registered, skipped, durationMs };
 }
@@ -227,7 +228,7 @@ export async function getWorkspaceStatus(dir) {
     // Detect and record onboarding completion (fires once)
     const isComplete = !bootstrapPresent || identityFilled;
     if (isComplete && state.bootstrapSeededAt && !state.onboardingCompletedAt) {
-        const now = Date.now();
+        const now = systemNowMs();
         await writeWorkspaceState(dir, { onboardingCompletedAt: now });
         state.onboardingCompletedAt = now;
     }

package/node_modules/@comis/agent/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/agent",
   "private": true,
-  "version": "1.0.36",
+  "version": "1.0.40",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "AI agent executor, budget control, and session management for Comis",

package/node_modules/@comis/channels/dist/discord/credential-validator.d.ts

@@ -18,6 +18,9 @@ export interface DiscordBotInfo {
  * of Telegram's getMe() call.
  *
  * @param token - The Discord bot token
+ * @param apiRoot - Optional REST API root URL override (production: undefined;
+ *   E2E tests: `http://127.0.0.1:<mock-port>`). When set, the REST client
+ *   talks to this URL instead of `https://discord.com/api`.
  * @returns DiscordBotInfo on success, Error on failure
  */
-export declare const validateDiscordToken: (token: string) => Promise<Result<DiscordBotInfo, Error>>;
+export declare function validateDiscordToken(token: string, apiRoot?: string): Promise<Result<DiscordBotInfo, Error>>;

package/node_modules/@comis/channels/dist/discord/credential-validator.js

@@ -1,6 +1,5 @@
 // SPDX-License-Identifier: Apache-2.0
 import { ok, err } from "@comis/shared";
-import { createCredentialValidator } from "../shared/credential-validator-factory.js";
 /**
  * Validate a Discord bot token by calling the /users/@me REST endpoint.
  *
@@ -9,25 +8,32 @@ import { createCredentialValidator } from "../shared/credential-validator-factor
  * of Telegram's getMe() call.
  *
  * @param token - The Discord bot token
+ * @param apiRoot - Optional REST API root URL override (production: undefined;
+ *   E2E tests: `http://127.0.0.1:<mock-port>`). When set, the REST client
+ *   talks to this URL instead of `https://discord.com/api`.
  * @returns DiscordBotInfo on success, Error on failure
  */
-export const validateDiscordToken = createCredentialValidator({
-    platform: "Discord",
-    validateInputs: (token) => (token.trim() === "" ? "token must not be empty" : undefined),
-    callApi: async (token) => {
-        try {
-            const { REST, Routes } = await import("discord.js");
-            const rest = new REST({ version: "10" }).setToken(token);
-            const me = (await rest.get(Routes.user("@me")));
-            return ok({
-                id: me.id,
-                username: me.username,
-                discriminator: me.discriminator,
-            });
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            return err(new Error(`Invalid Discord bot token: ${message}`));
-        }
-    },
-});
+export async function validateDiscordToken(token, apiRoot) {
+    if (token.trim() === "") {
+        return err(new Error("Invalid Discord credentials: token must not be empty"));
+    }
+    try {
+        const { REST, Routes } = await import("discord.js");
+        // E2E seam: when caller passes `apiRoot`, point @discordjs/rest at the
+        // override URL. Production path leaves the option object untouched so
+        // discord.js uses its built-in default.
+        const rest = apiRoot
+            ? new REST({ version: "10", api: apiRoot }).setToken(token)
+            : new REST({ version: "10" }).setToken(token);
+        const me = (await rest.get(Routes.user("@me")));
+        return ok({
+            id: me.id,
+            username: me.username,
+            discriminator: me.discriminator,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return err(new Error(`Invalid Discord bot token: ${message}`));
+    }
+}

package/node_modules/@comis/channels/dist/discord/discord-actions.d.ts

@@ -7,7 +7,7 @@
  *
  * @module
  */
-import type { ComisLogger } from "@comis/infra";
+import type { ComisLogger } from "@comis/core";
 import type { Result } from "@comis/shared";
 import { type Client } from "discord.js";
 /**

package/node_modules/@comis/channels/dist/discord/discord-actions.js

@@ -11,6 +11,14 @@
 import { ok, err } from "@comis/shared";
 import { normalizePollDurationHours } from "@comis/core";
 import { ActivityType, ChannelType, } from "discord.js";
+// Discord channel narrowing helpers replace untyped-cast call sites.
+// asTextLike returns a structural-subset DiscordTextLikeChannel for
+// text-like channels (messages/send/edit/delete/setTopic/setRateLimitPerUser/
+// sendTyping/threads.*); asThreadInfo returns DiscordThreadInfo for the
+// threadList iteration sites. The DiscordTextLikeChannel type is imported
+// for one site (channel_info) that extends it with optional read-only
+// metadata fields (name/topic) at a single local-projection cast site.
+import { asTextLike, asThreadInfo } from "./discord-adapter-types.js";
 /**
  * Execute a Discord platform action by delegating to the appropriate
  * case in the action switch.
@@ -22,8 +30,10 @@ export async function executeDiscordAction(client, action, params, logger) {
                 const channelId = String(params.channel_id);
                 const messageId = String(params.message_id);
                 const channel = await client.channels.fetch(channelId);
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                const msg = await channel.messages.fetch(messageId);
+                const tc = asTextLike(channel);
+                if (!tc)
+                    return err(new Error(`Channel ${channelId} is not a text-based channel`));
+                const msg = await tc.messages.fetch(messageId);
                 await msg.pin();
                 return ok({ pinned: true, channelId, messageId });
             }
@@ -31,8 +41,10 @@ export async function executeDiscordAction(client, action, params, logger) {
                 const channelId = String(params.channel_id);
                 const messageId = String(params.message_id);
                 const channel = await client.channels.fetch(channelId);
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                const msg = await channel.messages.fetch(messageId);
+                const tc = asTextLike(channel);
+                if (!tc)
+                    return err(new Error(`Channel ${channelId} is not a text-based channel`));
+                const msg = await tc.messages.fetch(messageId);
                 await msg.unpin();
                 return ok({ unpinned: true, channelId, messageId });
             }
@@ -84,16 +96,20 @@ export async function executeDiscordAction(client, action, params, logger) {
                 const channelId = String(params.channel_id);
                 const topic = String(params.topic);
                 const channel = await client.channels.fetch(channelId);
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                await channel.setTopic(topic);
+                const tc = asTextLike(channel);
+                if (!tc)
+                    return err(new Error(`Channel ${channelId} is not a text-based channel`));
+                await tc.setTopic(topic);
                 return ok({ topicSet: true, channelId, topic });
             }
             case "set_slowmode": {
                 const channelId = String(params.channel_id);
                 const seconds = Number(params.seconds);
                 const channel = await client.channels.fetch(channelId);
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                await channel.setRateLimitPerUser(seconds);
+                const tc = asTextLike(channel);
+                if (!tc)
+                    return err(new Error(`Channel ${channelId} is not a text-based channel`));
+                await tc.setRateLimitPerUser(seconds);
                 return ok({ slowmodeSet: true, channelId, seconds });
             }
             case "guild_info": {
@@ -104,15 +120,24 @@ export async function executeDiscordAction(client, action, params, logger) {
                     name: guild.name,
                     memberCount: guild.memberCount,
                     ownerId: guild.ownerId,
-                    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                    iconURL: guild.iconURL?.() ?? null,
+                    // discord.js@14.x types Guild.iconURL() correctly — no cast needed.
+                    iconURL: guild.iconURL() ?? null,
                 });
             }
             case "channel_info": {
                 const channelId = String(params.channel_id);
                 const channel = await client.channels.fetch(channelId);
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                const ch = channel;
+                const tc = asTextLike(channel);
+                if (!tc)
+                    return err(new Error(`Channel ${channelId} is not a text-based channel`));
+                // Read-only metadata projection — discord.js@14.x text-like channels
+                // (TextChannel, NewsChannel, ThreadChannel, DMChannel) all have `name`
+                // on GuildChannel / DMChannel and `topic: string | null` on
+                // BaseGuildTextChannel (DMs / forum threads omit topic — handled via
+                // the `undefined` check below). The structural projection is local to
+                // this site; the canonical DiscordTextLikeChannel contract intentionally
+                // omits these read-only metadata fields.
+                const ch = tc;
                 const info = {
                     id: ch.id,
                     name: ch.name,
@@ -155,15 +180,14 @@ export async function executeDiscordAction(client, action, params, logger) {
                     ? params.auto_archive_duration
                     : 1440;
                 const channel = await client.channels.fetch(channelId);
-                if (!channel || !channel.isTextBased()) {
+                const tc = asTextLike(channel);
+                if (!tc) {
                     return err(new Error(`Channel ${channelId} is not a text-based channel`));
                 }
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                const textCh = channel;
-                if (!textCh.threads?.create) {
+                if (!tc.threads?.create) {
                     return err(new Error(`Channel ${channelId} does not support threads`));
                 }
-                const thread = await textCh.threads.create({
+                const thread = await tc.threads.create({
                     name,
                     autoArchiveDuration,
                     ...(messageId ? { startMessage: messageId } : {}),
@@ -174,29 +198,24 @@ export async function executeDiscordAction(client, action, params, logger) {
             case "threadList": {
                 const channelId = String(params.channel_id);
                 const channel = await client.channels.fetch(channelId);
-                if (!channel || !channel.isTextBased()) {
+                const tc = asTextLike(channel);
+                if (!tc) {
                     return err(new Error(`Channel ${channelId} is not a text-based channel`));
                 }
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                const textCh = channel;
-                if (!textCh.threads?.fetchActive) {
+                if (!tc.threads?.fetchActive) {
                     return err(new Error(`Channel ${channelId} does not support threads`));
                 }
-                const fetched = await textCh.threads.fetchActive();
+                const fetched = await tc.threads.fetchActive();
                 const threads = [];
                 for (const [, t] of fetched.threads) {
-                    threads.push({
-                        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                        id: t.id,
-                        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                        name: t.name,
-                        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                        archived: t.archived ?? false,
-                        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                        memberCount: t.memberCount ?? 0,
-                        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                        messageCount: t.messageCount ?? 0,
-                    });
+                    // asThreadInfo() returns null for thread objects with unexpected
+                    // shape (missing/wrong-typed id/name/archived/memberCount/messageCount).
+                    // Skip those rather than emitting partial / `?? 0` placeholders —
+                    // the helper enforces a strict per-field type guard.
+                    const info = asThreadInfo(t);
+                    if (!info)
+                        continue;
+                    threads.push(info);
                 }
                 logger.debug({ channelType: "discord", toolName: "discord_action", action: "threadList" }, "Threads listed");
                 return ok({ threads });
@@ -208,8 +227,14 @@ export async function executeDiscordAction(client, action, params, logger) {
                 if (!channel || !channel.isThread()) {
                     return err(new Error(`Channel ${threadId} is not a thread`));
                 }
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                const sent = await channel.send({ content: text });
+                // A thread channel is also a text-like channel — asTextLike's runtime
+                // isTextBased() check covers thread channels too (discord.js@14.x
+                // AnyThreadChannel implements TextBasedChannel).
+                const tc = asTextLike(channel);
+                if (!tc) {
+                    return err(new Error(`Channel ${threadId} is not a text-based thread channel`));
+                }
+                const sent = await tc.send({ content: text });
                 logger.debug({ channelType: "discord", toolName: "discord_action", action: "threadReply" }, "Thread reply sent");
                 return ok({ messageId: sent.id, threadId });
             }
@@ -222,15 +247,23 @@ export async function executeDiscordAction(client, action, params, logger) {
                 const typeStr = params.type ? String(params.type) : "text";
                 const parentId = params.parent_id ? String(params.parent_id) : undefined;
                 const topic = params.topic ? String(params.topic) : undefined;
+                // Narrow channel-type keys to discord.js's `GuildChannelTypes` so the
+                // `GuildChannelManager.create<Type>` overload resolves to its specific
+                // `MappedGuildChannelTypes[Type]` return (rather than the loose
+                // non-generic overload that returns `unknown` for arbitrary numeric `type`).
                 const channelTypeMap = {
                     text: ChannelType.GuildText,
                     voice: ChannelType.GuildVoice,
                     category: ChannelType.GuildCategory,
                     announcement: ChannelType.GuildAnnouncement,
                 };
-                const mappedType = channelTypeMap[typeStr] ?? ChannelType.GuildText;
+                const mappedType = typeStr in channelTypeMap
+                    ? channelTypeMap[typeStr]
+                    : ChannelType.GuildText;
                 const guild = await client.guilds.fetch(guildId);
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                // discord.js@14.x types guild.channels.create() via GuildChannelManager.
+                // The cast narrows the polymorphic union (which can be a partial fetch
+                // collection in some code paths) to the manager's create-supporting shape.
                 const newChannel = await guild.channels.create({
                     name,
                     type: mappedType,
@@ -246,6 +279,10 @@ export async function executeDiscordAction(client, action, params, logger) {
                 if (!channel) {
                     return err(new Error(`Channel ${channelId} not found`));
                 }
+                const tc = asTextLike(channel);
+                if (!tc) {
+                    return err(new Error(`Channel ${channelId} is not a text-based channel`));
+                }
                 const editOptions = {};
                 if (params.name !== undefined)
                     editOptions.name = String(params.name);
@@ -253,8 +290,7 @@ export async function executeDiscordAction(client, action, params, logger) {
                     editOptions.topic = String(params.topic);
                 if (params.position !== undefined)
                     editOptions.position = Number(params.position);
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                await channel.edit(editOptions);
+                await tc.edit(editOptions);
                 logger.debug({ channelType: "discord", toolName: "discord_action", action: "channelEdit" }, "Channel edited");
                 return ok({ channelId, edited: true });
             }
@@ -264,8 +300,11 @@ export async function executeDiscordAction(client, action, params, logger) {
                 if (!channel) {
                     return err(new Error(`Channel ${channelId} not found`));
                 }
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                await channel.delete("Agent-requested channel deletion");
+                const tc = asTextLike(channel);
+                if (!tc) {
+                    return err(new Error(`Channel ${channelId} is not a text-based channel`));
+                }
+                await tc.delete("Agent-requested channel deletion");
                 logger.info({ channelType: "discord", action: "channelDelete", chatId: channelId }, "Channel deleted");
                 return ok({ channelId, deleted: true });
             }
@@ -315,9 +354,9 @@ export async function executeDiscordAction(client, action, params, logger) {
             case "sendTyping": {
                 const chatId = String(params.chatId);
                 const channel = await client.channels.fetch(chatId);
-                if (channel?.isTextBased()) {
-                    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                    await channel.sendTyping();
+                const tc = asTextLike(channel);
+                if (tc) {
+                    await tc.sendTyping();
                 }
                 return ok({ typing: true });
             }

package/node_modules/@comis/channels/dist/discord/discord-adapter-types.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Discord channel narrowing — runtime methods we use that discord.js types
+ * either omit or under-narrow for the polymorphic `Channel | null` return of
+ * `client.channels.fetch()`.
+ *
+ * The interface is a STRUCTURAL subset of discord.js's actual runtime shape;
+ * it does NOT add fields. All methods listed here exist on TextChannel,
+ * NewsChannel, ThreadChannel, DMChannel, and forum threads in discord.js 14.x.
+ *
+ * NOTE: discord.js is exact-pinned at 14.26.4 (CLAUDE.md "Supply-chain
+ * invariants"). A future minor/major bump must verify the listed runtime
+ * methods still exist on the polymorphic Channel union.
+ *
+ * This file deliberately does NOT import @comis/shared's `Result`.
+ * `asTextLike` is a typed-cast utility, not a fallible computation; `null`
+ * is the right "not text-like" signal that callers handle.
+ *
+ * @module
+ */
+import type { AnyThreadChannel, GuildBasedChannel, TextBasedChannel, MessageManager, ThreadManager, Message } from "discord.js";
+/**
+ * Structural subset of a Discord text-like channel covering the runtime
+ * methods used by `discord-actions.ts` (pin/unpin/send/edit/delete/setTopic/
+ * setRateLimitPerUser/sendTyping/threads.*).
+ *
+ * This interface eliminates `as any` casts in `discord-actions.ts` by
+ * providing typed structural shapes for the polymorphic channel union.
+ *
+ * The `threads?` field combines the base `ThreadManager` (for `fetchActive()`)
+ * with the create overload from `GuildTextThreadManager` (which extends
+ * `ThreadManager<false>` and adds `create()`). The `threadCreate` action
+ * call site needs both methods on the same narrowed reference, and the
+ * underlying discord.js types model them via the GuildTextThreadManager
+ * subclass rather than the ThreadManager base — the structural intersection
+ * captures both shapes in a single field type. The `create()` parameter
+ * type is intentionally permissive (`Record<string, unknown>`) because the
+ * action layer builds the payload defensively from RPC arguments.
+ */
+export interface DiscordTextLikeChannel {
+    readonly id: string;
+    readonly type: number;
+    readonly messages: MessageManager;
+    setTopic(topic: string, reason?: string): Promise<unknown>;
+    setRateLimitPerUser(rateLimitPerUser: number, reason?: string): Promise<unknown>;
+    send(payload: Record<string, unknown> | string): Promise<Message>;
+    edit(options: Record<string, unknown>): Promise<unknown>;
+    delete(reason?: string): Promise<unknown>;
+    sendTyping(): Promise<void>;
+    /**
+     * Present only on text channels that support threads; undefined elsewhere.
+     * `fetchActive()` lives on `ThreadManager` (base); `create()` lives on
+     * `GuildTextThreadManager` (subclass) — see interface JSDoc for the
+     * structural intersection rationale.
+     */
+    readonly threads?: ThreadManager & {
+        create?(options: Record<string, unknown>): Promise<{
+            id: string;
+            name: string;
+        }>;
+    };
+}
+/**
+ * Narrow a discord.js channel to `DiscordTextLikeChannel`. Returns `null`
+ * if the channel is `null`, lacks an `isTextBased()` method, or
+ * `isTextBased()` returns falsy.
+ *
+ * The cast `channel as unknown as DiscordTextLikeChannel` is gated by the
+ * runtime guards above — a forged object would have to satisfy both the
+ * function-presence and `isTextBased() === true` checks to slip through,
+ * and underlying discord.js API calls would still fail at the SDK boundary.
+ */
+export declare function asTextLike(channel: AnyThreadChannel | GuildBasedChannel | TextBasedChannel | null): DiscordTextLikeChannel | null;
+/**
+ * Secondary shape for per-thread iteration sites in `discord-actions.ts`
+ * `threadList` action. The polymorphic iteration item from
+ * `ThreadManager.fetchActive()` is typed loosely; this is a stricter
+ * structural shape suitable for the read-only fields the action emits.
+ */
+export interface DiscordThreadInfo {
+    readonly id: string;
+    readonly name: string;
+    readonly archived: boolean;
+    readonly memberCount: number;
+    readonly messageCount: number;
+}
+/**
+ * Narrow a per-thread iteration object to `DiscordThreadInfo`. Returns
+ * `null` if any required field is missing or wrong-typed.
+ *
+ * The function is intentionally defensive — `fetchActive()` returns
+ * differently-shaped objects across discord.js minor versions, and the
+ * iteration site logs `archived ?? false` / `memberCount ?? 0` /
+ * `messageCount ?? 0` defaults. Callers that want the lenient behavior
+ * should fall back to `0` / `false` on `null` return per their own policy.
+ */
+export declare function asThreadInfo(thread: unknown): DiscordThreadInfo | null;