comisai 1.0.37 → 1.0.40

package/node_modules/@comis/daemon/dist/wiring/setup-gateway/setup-gateway-rpc.js

@@ -0,0 +1,415 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Gateway RPC bridge + adapter wiring.
+ * Hosts setupRpcBridge (deferred dispatch), buildRpcAdapterDeps (the 7-method
+ * adapter struct consumed by createDynamicMethodRouter), extractAttachmentMarkers
+ * (gateway JSONL → conversation history bridging), and buildDynamicRouterAndRegister.
+ * @module
+ */
+import { formatSessionKey, runWithContext, safePath, createDeliveryOrigin, systemNowMs, } from "@comis/core";
+import { existsSync, readFileSync } from "node:fs";
+import { parseSlashCommand } from "@comis/orchestrator";
+import { createDynamicMethodRouter, createRpcAdapters, } from "@comis/gateway";
+import { randomUUID } from "node:crypto";
+import { createRpcDispatch, classifyRpcError } from "../../api/rpc-dispatch.js";
+import { registerRpcMethods } from "../setup-gateway-api.js";
+import { buildExecutionRequestedLogFields, buildSlashCommandDeps, createCommandHandler, deriveTrustLevel, handleConfigChatCommand, } from "./setup-gateway-admin.js";
+/**
+ * Create the rpcCall wrapper and deferred dispatch mechanism. The returned
+ * rpcCall is usable immediately; call wireDispatch() after setupMonitoring
+ * resolves the heartbeatRunner TDZ to wire the real dispatch.
+ */
+export function setupRpcBridge(deps) {
+    const { gatewayLogger } = deps;
+    // Deferred inner dispatch -- assigned by wireDispatch() after all deps are ready
+    let rpcCallInner;
+    const rpcCall = async (method, params) => {
+        const rpcStartMs = systemNowMs();
+        try {
+            return await rpcCallInner(method, params);
+        }
+        catch (err) {
+            const errMsg = err instanceof Error ? err.message : String(err);
+            const classified = classifyRpcError(errMsg);
+            gatewayLogger.debug({
+                method,
+                err: errMsg,
+                durationMs: systemNowMs() - rpcStartMs,
+                hint: classified.hint,
+                errorKind: classified.errorKind,
+            }, "[rpcCall] failed");
+            throw err;
+        }
+    };
+    const wireDispatch = (dispatchDeps) => {
+        rpcCallInner = createRpcDispatch(dispatchDeps);
+    };
+    return { rpcCall, wireDispatch };
+}
+/**
+ * Read the pi-agent JSONL session file and extract gateway attachment markers.
+ * Returns `<!-- attachment:... -->` content strings for each successful
+ * `message.attach` tool call targeting the gateway channel type.
+ */
+export function extractAttachmentMarkers(workspaceDir, agentId, channelId, logger) {
+    if (!workspaceDir)
+        return [];
+    const jsonlPath = safePath(workspaceDir, "sessions", agentId, channelId, "default.jsonl");
+    if (!existsSync(jsonlPath))
+        return [];
+    try {
+        const raw = readFileSync(jsonlPath, "utf-8");
+        const lines = raw.split("\n").filter(Boolean);
+        const parsed = lines.map((l) => { try {
+            return JSON.parse(l);
+        }
+        catch {
+            return null;
+        } }).filter(Boolean);
+        // Collect attachment tool calls (toolCall blocks with name "message", action "attach")
+        const attachCalls = new Map();
+        const attachResults = new Map(); // toolCallId → mediaId
+        for (const obj of parsed) {
+            if (obj.type !== "message")
+                continue;
+            const msg = obj.message;
+            if (!msg)
+                continue;
+            if (msg.role === "assistant" && Array.isArray(msg.content)) {
+                for (const block of msg.content) {
+                    if ((block.type === "toolCall" || block.type === "tool_use") && block.name === "message") {
+                        const args = block.arguments ?? block.input;
+                        if (args?.action === "attach" && args?.channel_type === "gateway") {
+                            attachCalls.set(block.id, {
+                                type: args.attachment_type ?? "file",
+                                mimeType: args.mime_type ?? "application/octet-stream",
+                                fileName: args.file_name ?? "attachment",
+                                caption: args.caption ?? "",
+                            });
+                        }
+                    }
+                }
+            }
+            if (msg.role === "toolResult" || msg.role === "tool") {
+                const toolId = msg.toolCallId ?? msg.tool_use_id;
+                if (toolId && attachCalls.has(toolId)) {
+                    let resultText = "";
+                    if (typeof msg.content === "string")
+                        resultText = msg.content;
+                    else if (Array.isArray(msg.content)) {
+                        for (const part of msg.content) {
+                            if (part.type === "text" && typeof part.text === "string")
+                                resultText += part.text;
+                        }
+                    }
+                    // Result format: "Attachment delivered (mediaId: <uuid>)" or similar.
+                    // Extract mediaId from the text. Match either "mediaId: xxx" or a bare UUID
+                    // followed by ")" — covers both legacy and current formats.
+                    const mediaIdMatch = resultText.match(/mediaId[:\s]+([a-f0-9-]+)/i) ??
+                        resultText.match(/\b([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})\b/i);
+                    if (mediaIdMatch)
+                        attachResults.set(toolId, mediaIdMatch[1]);
+                }
+            }
+        }
+        // Build markers: for each successful attach, emit a `<!-- attachment:url -->` line
+        const markers = [];
+        for (const [toolId, info] of attachCalls) {
+            const mediaId = attachResults.get(toolId);
+            if (!mediaId)
+                continue;
+            const url = `/media/${mediaId}`;
+            const fileNameAttr = info.fileName ? ` fileName="${info.fileName.replace(/"/g, "\\\"")}"` : "";
+            const captionAttr = info.caption ? ` caption="${info.caption.replace(/"/g, "\\\"")}"` : "";
+            markers.push({
+                content: `<!-- attachment:type="${info.type}" mimeType="${info.mimeType}" url="${url}"${fileNameAttr}${captionAttr} -->`,
+                timestamp: systemNowMs(),
+            });
+        }
+        logger.debug({ agentId, channelId, markerCount: markers.length }, "Extracted attachment markers from JSONL");
+        return markers;
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Build the `RpcAdapterDeps` struct consumed by `createRpcAdapters`. The
+ * returned object captures all closure-bound deps for the 7 RPC adapter
+ * methods (executeAgent / searchMemory / inspectMemory / getConfig /
+ * getSessionHistory / setConfig / handleSlashCommand).
+ */
+export function buildRpcAdapterDeps(deps) {
+    const { container, gwConfig, agents, defaultAgentId, gatewayLogger, memoryApi, sessionStore, getExecutor, assembleToolsForAgent, preprocessMessageText, rpcCall, costTrackers, workspaceDirs, piSessionAdapters, greetingGenerator, activeExecutions, } = deps;
+    return {
+        isValidAgentId: (agentId) => !!agents[agentId],
+        executeAgent: async (params) => {
+            // Resolve agent ID from params, falling back to default when unknown.
+            const requestedAgentId = params.agentId ?? defaultAgentId;
+            const execAgentId = agents[requestedAgentId] ? requestedAgentId : defaultAgentId;
+            const connectionId = params.connectionId;
+            // Trust level from token scopes: admin/wildcard → admin, else user (fail-closed).
+            const trustLevel = deriveTrustLevel(params.scopes);
+            gatewayLogger.debug({ scopes: params.scopes, trustLevel, agentId: execAgentId }, "Trust level derived from token scopes");
+            gatewayLogger.info(buildExecutionRequestedLogFields({
+                agentId: execAgentId,
+                message: params.message,
+                connectionId,
+            }), "Agent execution requested");
+            // Link understanding preprocessing: enrich message text with fetched URL content
+            const enrichedText = await preprocessMessageText(params.message);
+            const msg = {
+                id: randomUUID(),
+                channelId: params.sessionKey?.channelId ?? "gateway",
+                channelType: "gateway",
+                senderId: params.sessionKey?.peerId ?? "rpc-client",
+                text: enrichedText,
+                timestamp: systemNowMs(),
+                attachments: [],
+                metadata: {},
+            };
+            const sk = {
+                tenantId: container.config.tenantId,
+                userId: params.sessionKey?.userId ?? "rpc-client",
+                channelId: params.sessionKey?.channelId ?? "gateway",
+            };
+            // Wrap in runWithContext so traceId propagates to all downstream logs
+            return runWithContext({
+                traceId: randomUUID(),
+                tenantId: sk.tenantId,
+                userId: sk.userId,
+                sessionKey: formatSessionKey(sk),
+                startedAt: systemNowMs(),
+                trustLevel,
+                deliveryOrigin: createDeliveryOrigin({
+                    channelType: "gateway",
+                    channelId: sk.channelId,
+                    userId: sk.userId,
+                    tenantId: sk.tenantId,
+                }),
+            }, async () => {
+                // Assemble per-agent tools via three-tier pipeline (builtin + platform + skills)
+                const tools = await assembleToolsForAgent(execAgentId);
+                gatewayLogger.debug({ agentId: execAgentId, toolCount: tools.length, ...(connectionId && { connectionId }) }, "Tools assembled for agent");
+                const execStartMs = systemNowMs();
+                const execKey = msg.id;
+                activeExecutions.set(execKey, { agentId: execAgentId, startedAt: execStartMs });
+                let result;
+                try {
+                    result = await getExecutor(execAgentId).execute(msg, sk, tools, params.onDelta, execAgentId, params.directives);
+                }
+                finally {
+                    activeExecutions.delete(execKey);
+                }
+                gatewayLogger.debug({
+                    agentId: execAgentId,
+                    durationMs: systemNowMs() - execStartMs,
+                    tokensIn: result.tokensUsed.input,
+                    tokensOut: result.tokensUsed.output,
+                    tokensTotal: result.tokensUsed.total,
+                    finishReason: result.finishReason,
+                    responseLen: result.response?.length ?? 0,
+                    toolCalls: result.stepsExecuted,
+                    llmCalls: result.llmCalls,
+                    sessionKey: formatSessionKey(sk),
+                    estimatedCostUsd: result.cost.total,
+                    ...(connectionId && { connectionId }),
+                }, "Agent execution complete");
+                // Bridge session history to SQLite (session.history RPC + /chat/history REST)
+                // and extract gateway attachment tool calls from the JSONL session so
+                // images/files persist across page navigations. Non-fatal on failure.
+                try {
+                    const existingSession = sessionStore.load(sk);
+                    const messages = existingSession?.messages ?? [];
+                    messages.push({ role: "user", content: msg.text, timestamp: msg.timestamp });
+                    const attachmentMarkers = extractAttachmentMarkers(workspaceDirs.get(execAgentId), execAgentId, sk.channelId, gatewayLogger);
+                    // Deduplicate against existing /media/ URLs in session history
+                    const existingText = messages.map((m) => m.content ?? "").join("\n");
+                    for (const marker of attachmentMarkers) {
+                        const urlMatch = marker.content.match(/\/media\/[^"]+/);
+                        if (urlMatch && existingText.includes(urlMatch[0]))
+                            continue;
+                        messages.push({ role: "assistant", content: marker.content, timestamp: marker.timestamp });
+                    }
+                    if (result.response) {
+                        messages.push({ role: "assistant", content: result.response, timestamp: systemNowMs() });
+                    }
+                    sessionStore.save(sk, messages);
+                    gatewayLogger.debug({ agentId: execAgentId, sessionKey: formatSessionKey(sk), messageCount: messages.length, attachments: attachmentMarkers.length }, "Session history bridged to SQLite store");
+                }
+                catch {
+                    // Session history bridging is non-fatal
+                }
+                // Token usage captured via PiEventBridge observability:token_usage → tokenTracker bus.
+                // Conversation memory persistence handled by PiExecutor.
+                // Emit message events for activity tracking (REST/WebSocket parity with channels).
+                container.eventBus.emit("message:received", { message: msg, sessionKey: sk });
+                if (result.response) {
+                    container.eventBus.emit("message:sent", {
+                        channelId: sk.channelId,
+                        messageId: randomUUID(),
+                        content: result.response,
+                    });
+                }
+                return {
+                    response: result.response,
+                    tokensUsed: result.tokensUsed,
+                    finishReason: result.finishReason,
+                    sessionKey: params.sessionKey?.channelId ?? "gateway",
+                };
+            });
+        },
+        searchMemory: async (params) => {
+            const results = await memoryApi.search(params.query, {
+                limit: params.limit,
+                tenantId: params.tenantId ?? container.config.tenantId,
+            });
+            return {
+                results: results.map((r) => ({
+                    id: r.entry.id,
+                    content: r.entry.content,
+                    memoryType: r.entry.memoryType ?? "semantic",
+                    trustLevel: r.entry.trustLevel,
+                    score: r.score ?? 0,
+                    createdAt: r.entry.createdAt,
+                })),
+            };
+        },
+        inspectMemory: async (params) => {
+            if (params.id) {
+                const entries = memoryApi.inspect({ limit: 1 });
+                const entry = entries.find((e) => e.id === params.id);
+                return {
+                    entry: entry
+                        ? {
+                            id: entry.id,
+                            content: entry.content,
+                            trustLevel: entry.trustLevel,
+                            createdAt: entry.createdAt,
+                        }
+                        : undefined,
+                };
+            }
+            const stats = memoryApi.stats(params.tenantId ?? container.config.tenantId);
+            return { stats: stats };
+        },
+        getConfig: async (params) => {
+            // Return sanitized config (no secrets)
+            const section = params?.section;
+            if (section && section in container.config) {
+                return { [section]: container.config[section] };
+            }
+            return {
+                tenantId: container.config.tenantId,
+                logLevel: container.config.logLevel,
+                gateway: { enabled: gwConfig.enabled, host: gwConfig.host, port: gwConfig.port },
+            };
+        },
+        getSessionHistory: async (params) => {
+            const sk = {
+                tenantId: container.config.tenantId,
+                userId: "rpc-client",
+                channelId: params.channelId ?? "gateway",
+            };
+            const data = sessionStore.load(sk);
+            if (!data) {
+                return { messages: [] };
+            }
+            // Extract user/assistant messages from pi-agent-core format
+            const messages = [];
+            for (const msg of data.messages) {
+                const m = msg;
+                const role = m.role;
+                if (role !== "user" && role !== "assistant")
+                    continue;
+                // Extract text content from content array or string
+                let text = "";
+                if (typeof m.content === "string") {
+                    text = m.content;
+                }
+                else if (Array.isArray(m.content)) {
+                    for (const part of m.content) {
+                        if (part.type === "text" && typeof part.text === "string") {
+                            text += part.text;
+                        }
+                    }
+                }
+                if (text) {
+                    messages.push({
+                        role,
+                        content: text,
+                        timestamp: m.timestamp ?? data.updatedAt,
+                    });
+                }
+            }
+            return { messages };
+        },
+        setConfig: async (params) => {
+            // Forward to config.patch RPC handler (handles validation, rate limiting, persistence)
+            const result = await rpcCall("config.patch", {
+                section: params.section,
+                key: params.key,
+                value: params.value,
+                _trustLevel: "admin",
+            });
+            return { ok: result.ok !== false, previous: result.previous };
+        },
+        handleSlashCommand: async (params) => {
+            const execAgentId = params.agentId ?? defaultAgentId;
+            const execAgentConfig = agents[execAgentId] ?? agents[defaultAgentId];
+            const sk = {
+                tenantId: container.config.tenantId,
+                userId: params.sessionKey?.userId ?? "rpc-client",
+                channelId: params.sessionKey?.channelId ?? "gateway",
+            };
+            const parsed = parseSlashCommand(params.message);
+            if (!parsed.found)
+                return { handled: false };
+            // Handle /config command
+            if (parsed.command === "config") {
+                return handleConfigChatCommand(parsed.args, rpcCall, params.scopes);
+            }
+            // getAvailableThinkingLevels intentionally omitted (no AgentSession at RPC time).
+            const cmdDeps = buildSlashCommandDeps({
+                execAgentId,
+                defaultAgentId,
+                execAgentConfig,
+                container,
+                costTrackers,
+                workspaceDirs,
+                piSessionAdapters,
+            });
+            const handler = createCommandHandler(cmdDeps);
+            const result = handler.handle(parsed, sk);
+            // If session reset command succeeded, try LLM greeting
+            if (result.handled && (parsed.command === "new" || parsed.command === "reset") && greetingGenerator) {
+                const greetingAgentConfig = agents[params.agentId ?? defaultAgentId] ?? agents[defaultAgentId];
+                const greetingResult = await greetingGenerator.generate(greetingAgentConfig?.name ?? "Comis");
+                if (greetingResult.ok) {
+                    return { handled: true, response: greetingResult.value };
+                }
+                // Fallback to static string on LLM failure
+            }
+            return { handled: result.handled, response: result.response, directives: result.directives };
+        },
+        logger: gatewayLogger,
+    };
+}
+// Dynamic router construction + RPC method registration -------------------
+/**
+ * Build the dynamic-method router and register all RPC methods. Returns the
+ * router handle for the gateway server.
+ */
+export function buildDynamicRouterAndRegister(deps) {
+    const { rpcAdapterDeps, container, configPaths, rpcCall, gatewayLogger } = deps;
+    const dynamicRouter = createDynamicMethodRouter(createRpcAdapters(rpcAdapterDeps), gatewayLogger);
+    // Register all RPC methods as gateway-to-rpcCall passthroughs.
+    // All business logic is in domain handler modules (api/*.ts) via rpc-dispatch.
+    registerRpcMethods({
+        dynamicRouter,
+        container,
+        configPaths,
+        rpcCall,
+    });
+    return dynamicRouter;
+}

package/node_modules/@comis/daemon/dist/wiring/setup-gateway-api.d.ts

@@ -0,0 +1,60 @@
+/**
+ * RPC method registration for the gateway dynamic router.
+ *
+ * Every method is registered through a single registry loop over
+ * `API_CONTRACTS_ORDERED` from `@comis/core`. Adding a new RPC method
+ * requires only adding a contract entry to the registry — no edit to
+ * this file is needed.
+ *
+ * Nested-loop pattern: the outer loop iterates contracts; the inner loop
+ * iterates each contract's `scopes`. Today every contract has
+ * `scopes.length === 1` (verified by `sessions.test.ts`). The nested loop
+ * nonetheless supports future multi-scope contracts (e.g., a method
+ * exposed at both rpc AND admin scopes simultaneously) without requiring
+ * this dispatcher to change.
+ *
+ * The cron.add inline transformer that previously lived here has been
+ * folded into cron-handlers.ts. The handler body now normalizes the WEB
+ * on-wire shape (nested `schedule` + `message`) into the flat fields used
+ * by buildCronSchedule. No special-case registrations remain.
+ *
+ * Extracted from setup-gateway.ts.
+ * @module
+ */
+import { type AppContainer } from "@comis/core";
+import type { RpcCall } from "@comis/skills";
+import type { DynamicMethodRouter } from "@comis/gateway";
+/** Dependencies for RPC method registration. */
+export interface RpcMethodDeps {
+    /** Dynamic method router to register methods on. */
+    dynamicRouter: DynamicMethodRouter;
+    /** Bootstrap output (config, eventBus, secretManager, tenantId). */
+    container: AppContainer;
+    /** Active config file paths for gateway.status RPC. */
+    configPaths: string[];
+    /** RPC call dispatcher for session/cron bridge methods. */
+    rpcCall: RpcCall;
+}
+/**
+ * Register all RPC methods on the dynamic router.
+ *
+ * All handlers live in domain modules (`api/*.ts`) and are dispatched via
+ * `rpcCall`. This function only wires method names to trust scopes — driven
+ * entirely from the `API_CONTRACTS_ORDERED` registry in `@comis/core`.
+ *
+ * Adding a new RPC method requires only:
+ *   1. Adding the contract to `packages/core/src/api-contracts/<domain>.ts`
+ *      (and the domain aggregator array).
+ *   2. Adding the handler entry to the matching `packages/daemon/src/api/
+ *      <domain>-handlers.ts` factory.
+ *
+ * No edit to this file is needed for either step — the bidirectional 1:1
+ * architecture test (`test/architecture/api-contracts-bidirectional.test.ts`)
+ * catches misalignment between registry and handlers.
+ *
+ * Multi-scope handling: every contract today declares exactly one scope
+ * (verified by `sessions.test.ts`). The nested loop iterates `c.scopes` so
+ * that future contracts authored with multiple scopes (e.g., the same
+ * method available at both rpc + admin) work automatically.
+ */
+export declare function registerRpcMethods(deps: RpcMethodDeps): void;

package/node_modules/@comis/daemon/dist/wiring/setup-gateway-api.js

@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * RPC method registration for the gateway dynamic router.
+ *
+ * Every method is registered through a single registry loop over
+ * `API_CONTRACTS_ORDERED` from `@comis/core`. Adding a new RPC method
+ * requires only adding a contract entry to the registry — no edit to
+ * this file is needed.
+ *
+ * Nested-loop pattern: the outer loop iterates contracts; the inner loop
+ * iterates each contract's `scopes`. Today every contract has
+ * `scopes.length === 1` (verified by `sessions.test.ts`). The nested loop
+ * nonetheless supports future multi-scope contracts (e.g., a method
+ * exposed at both rpc AND admin scopes simultaneously) without requiring
+ * this dispatcher to change.
+ *
+ * The cron.add inline transformer that previously lived here has been
+ * folded into cron-handlers.ts. The handler body now normalizes the WEB
+ * on-wire shape (nested `schedule` + `message`) into the flat fields used
+ * by buildCronSchedule. No special-case registrations remain.
+ *
+ * Extracted from setup-gateway.ts.
+ * @module
+ */
+import { API_CONTRACTS_ORDERED } from "@comis/core";
+// ---------------------------------------------------------------------------
+// Registration function
+// ---------------------------------------------------------------------------
+/**
+ * Register all RPC methods on the dynamic router.
+ *
+ * All handlers live in domain modules (`api/*.ts`) and are dispatched via
+ * `rpcCall`. This function only wires method names to trust scopes — driven
+ * entirely from the `API_CONTRACTS_ORDERED` registry in `@comis/core`.
+ *
+ * Adding a new RPC method requires only:
+ *   1. Adding the contract to `packages/core/src/api-contracts/<domain>.ts`
+ *      (and the domain aggregator array).
+ *   2. Adding the handler entry to the matching `packages/daemon/src/api/
+ *      <domain>-handlers.ts` factory.
+ *
+ * No edit to this file is needed for either step — the bidirectional 1:1
+ * architecture test (`test/architecture/api-contracts-bidirectional.test.ts`)
+ * catches misalignment between registry and handlers.
+ *
+ * Multi-scope handling: every contract today declares exactly one scope
+ * (verified by `sessions.test.ts`). The nested loop iterates `c.scopes` so
+ * that future contracts authored with multiple scopes (e.g., the same
+ * method available at both rpc + admin) work automatically.
+ */
+export function registerRpcMethods(deps) {
+    const { dynamicRouter, rpcCall } = deps;
+    // Outer loop iterates contracts; inner loop iterates each contract's
+    // scopes. For single-scope contracts (the common case) the inner loop
+    // runs once and registers the method under that scope. For multi-scope
+    // contracts (none today; future-proof) the method registers separately
+    // under each scope.
+    for (const c of API_CONTRACTS_ORDERED) {
+        for (const scope of c.scopes) {
+            if (scope === "admin") {
+                dynamicRouter.registerMethod(c.method, "admin", async (params) => rpcCall(c.method, { ...(params ?? {}), _trustLevel: "admin" }));
+            }
+            else {
+                dynamicRouter.registerMethod(c.method, "rpc", async (params) => rpcCall(c.method, params ?? {}));
+            }
+        }
+    }
+}

package/node_modules/@comis/daemon/dist/wiring/setup-gateway-routes.js

@@ -1,11 +1,12 @@
 // SPDX-License-Identifier: Apache-2.0
+// @allow-throw: gateway-route wiring re-raise; consumed at daemon.ts bootstrap catch boundary.
 /**
  * Gateway HTTP route mounting: webhooks, media serving, and OpenAI-compatible API.
  * Extracted from setup-gateway.ts to isolate route mounting (webhook sub-app,
  * media routes, OpenAI /v1/* endpoints with Bearer auth) into a single-concern module.
  * @module
  */
-import { safePath, generateStrongToken, } from "@comis/core";
+import { safePath, generateStrongToken, systemNowMs, } from "@comis/core";
 import { extractBearerToken, checkScope, createMappedWebhookEndpoint, getPresetMappings, createOpenaiCompletionsRoute, createOpenaiModelsRoute, createOpenaiEmbeddingsRoute, createResponsesRoute, createMediaRoutes, } from "@comis/gateway";
 import { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
@@ -44,7 +45,7 @@ export function mountGatewayRoutes(deps) {
                 secret: resolvedWebhookToken,
                 maxBodyBytes: webhooksConfig.maxBodyBytes,
                 onWake: async (_mapping) => {
-                    const startMs = Date.now();
+                    const startMs = systemNowMs();
                     let success = true;
                     let error;
                     try {
@@ -64,14 +65,14 @@ export function mountGatewayRoutes(deps) {
                             event: "wake",
                             statusCode: success ? 200 : 500,
                             success,
-                            durationMs: Date.now() - startMs,
+                            durationMs: systemNowMs() - startMs,
                             error,
-                            timestamp: Date.now(),
+                            timestamp: systemNowMs(),
                         });
                     }
                 },
                 onAgentAction: async (_mapping, renderedMessage, renderedSessionKey) => {
-                    const startMs = Date.now();
+                    const startMs = systemNowMs();
                     let success = true;
                     let error;
                     try {
@@ -82,7 +83,7 @@ export function mountGatewayRoutes(deps) {
                             channelType: "webhook",
                             senderId: "webhook",
                             text: renderedMessage,
-                            timestamp: Date.now(),
+                            timestamp: systemNowMs(),
                             attachments: [],
                             metadata: { webhookMappingId: _mapping.id },
                         };
@@ -106,9 +107,9 @@ export function mountGatewayRoutes(deps) {
                             event: "agent_action",
                             statusCode: success ? 200 : 500,
                             success,
-                            durationMs: Date.now() - startMs,
+                            durationMs: systemNowMs() - startMs,
                             error,
-                            timestamp: Date.now(),
+                            timestamp: systemNowMs(),
                         });
                     }
                 },
@@ -185,7 +186,7 @@ export function mountGatewayRoutes(deps) {
                 channelType: "openai",
                 senderId: sessionKey?.peerId ?? "openai-api",
                 text: enrichedText,
-                timestamp: Date.now(),
+                timestamp: systemNowMs(),
                 attachments: [],
                 metadata: {
                     ...(systemPrompt && { openaiSystemPrompt: systemPrompt }),
@@ -236,7 +237,7 @@ export function mountGatewayRoutes(deps) {
                 channelType: "responses",
                 senderId: sessionKey?.peerId ?? "responses-api",
                 text: enrichedText,
-                timestamp: Date.now(),
+                timestamp: systemNowMs(),
                 attachments: [],
                 metadata: {},
             };

package/node_modules/@comis/daemon/dist/wiring/setup-heartbeat.d.ts

@@ -1,9 +1,7 @@
 /**
  * Heartbeat wiring: creates PerAgentHeartbeatRunner with AgentHeartbeatSource
  * as its onTick callback for LLM-driven per-agent heartbeat turns.
- * Extracted from daemon.ts step 6.7.0.0 to isolate per-agent heartbeat
- * initialization from the main wiring sequence.
- * Agent Heartbeat Source
+ * Isolates per-agent heartbeat initialization from the main wiring sequence.
  * @module
  */
 import type { AppContainer, ChannelPort } from "@comis/core";

package/node_modules/@comis/daemon/dist/wiring/setup-heartbeat.js

@@ -1,14 +1,13 @@
 // SPDX-License-Identifier: Apache-2.0
+// @allow-throw: heartbeat-executor lookup guard; consumed at daemon.ts bootstrap catch boundary.
 /**
  * Heartbeat wiring: creates PerAgentHeartbeatRunner with AgentHeartbeatSource
  * as its onTick callback for LLM-driven per-agent heartbeat turns.
- * Extracted from daemon.ts step 6.7.0.0 to isolate per-agent heartbeat
- * initialization from the main wiring sequence.
- * Agent Heartbeat Source
+ * Isolates per-agent heartbeat initialization from the main wiring sequence.
  * @module
  */
 import { readFile } from "node:fs/promises";
-import { safePath } from "@comis/core";
+import { safePath, systemNowMs } from "@comis/core";
 import { isHeartbeatContentEffectivelyEmpty } from "@comis/agent";
 import { resolveEffectiveHeartbeatConfig, createAgentHeartbeatSource, createPerAgentHeartbeatRunner, createDuplicateDetector, } from "@comis/scheduler";
 import { applyToolPolicy } from "@comis/skills";
@@ -69,7 +68,7 @@ export function setupHeartbeat(deps) {
             const stats = memoryApi.stats(tenantId, agentId);
             if (stats.totalEntries === 0 || stats.oldestCreatedAt === null)
                 return undefined;
-            const ageDays = Math.floor((Date.now() - stats.oldestCreatedAt) / 86_400_000);
+            const ageDays = Math.floor((systemNowMs() - stats.oldestCreatedAt) / 86_400_000);
             return { totalEntries: stats.totalEntries, oldestEntryAgeDays: ageDays };
         }
         : undefined;

package/node_modules/@comis/daemon/dist/wiring/setup-mcp.js

@@ -52,7 +52,7 @@ function resolveDefaultMcpCwd(workspaceDir, serverName, logger) {
             dir,
             err: err instanceof Error ? err.message : String(err),
             hint: "Falling back to workspace root cwd for MCP server",
-            errorKind: "io",
+            errorKind: "internal",
         }, "Failed to create MCP server output dir");
         return workspaceDir;
     }