comisai 1.0.37 → 1.0.40

package/node_modules/@comis/daemon/dist/wiring/setup-tools.js

@@ -6,11 +6,26 @@
  * @module
  */
 import { isAbsolute, resolve } from "node:path";
-import { enterConfigMutationFence, leaveConfigMutationFence } from "../rpc/persist-to-config.js";
+import { enterConfigMutationFence, leaveConfigMutationFence } from "../api/shared/persist-to-config.js";
 import { SkillsConfigSchema, sanitizeLogString, tryGetContext, parseFormattedSessionKey, safePath, formatSessionKey, } from "@comis/core";
-import { sessionKeyToPath, WORKSPACE_FILE_NAMES, DEFAULT_TEMPLATES, registerWorkspaceFilesInTracker, } from "@comis/agent";
+import { sessionKeyToPath } from "@comis/agent";
+// Workspace helpers live in @comis/core.
+import { WORKSPACE_FILE_NAMES, DEFAULT_TEMPLATES, registerWorkspaceFilesInTracker, } from "@comis/core";
 import { stat as fsStat } from "node:fs/promises";
-import { assembleToolPipeline, createFileStateTracker, createCronTool, createUnifiedMemoryTool, createUnifiedSessionTool, createUnifiedContextTool, createMessageTool, createDiscordActionTool, createTelegramActionTool, createSlackActionTool, createWhatsAppActionTool, createSessionsSendTool, createSessionsSpawnTool, createSubagentsTool, createPipelineTool, createImageTool, createTTSTool, createTranscribeAudioTool, createDescribeVideoTool, createExtractDocumentTool, createGatewayTool, createBrowserTool, createAgentsManageTool, createObsQueryTool, createSessionsManageTool, createModelsManageTool, createTokensManageTool, createChannelsManageTool, createSkillsManageTool, createMcpManageTool, createHeartbeatManageTool, createProvidersManageTool, createNotifyTool, createImageGenerateTool, createBackgroundTasksTool, createExecTool, createProcessTool, createProcessRegistry, createApplyPatchTool, sanitizeImageForApi, createMediaPersistenceService, createCredentialInjector, mcpToolsToAgentTools, TOOL_PROFILES, TOOL_GROUPS, } from "@comis/skills";
+// Skills-concern symbols staying on the `.` subpath (policy, pipeline, MCP
+// bridge, credential injection, link understanding). These symbols live
+// in packages/skills/src/skills/index.ts.
+import { TOOL_PROFILES, TOOL_GROUPS, assembleToolPipeline, mcpToolsToAgentTools, createCredentialInjector, } from "@comis/skills";
+// Tool capability adapters + factories live on the `./tools` subpath.
+// Exec / process / apply-patch tool factories, file-state tracker,
+// media-persistence / image-sanitizer all live under
+// packages/skills/src/tools/. Daemon imports them from the dedicated
+// subpath to surface the architectural boundary in the type system.
+import { createExecTool, createProcessTool, createProcessRegistry, createApplyPatchTool, createFileStateTracker, sanitizeImageForApi, createMediaPersistenceService, } from "@comis/skills/tools";
+// Descriptor registry on the `./platform-tools` subpath. Replaces the
+// prior inline 38-call enumeration of `createXTool(agentRpc, ...)`
+// factories.
+import { createPlatformToolRegistry, } from "@comis/skills/platform-tools";
 // ---------------------------------------------------------------------------
 // Setup function
 // ---------------------------------------------------------------------------
@@ -32,6 +47,18 @@ export function setupTools(deps) {
      * repeats on every LLM call even though the underlying state is fixed at
      * daemon startup (detectSandboxProvider runs once). */
     const warnedNoSandboxAgents = new Set();
+    /**
+     * Platform-tool descriptor registry -- single source of truth for the 45
+     * platform-tools. Constructed once at `setupTools` invocation (the set is
+     * static at module-load time). Daemon's per-agent assembly filters the
+     * registry by `conditional` predicates and invokes each surviving
+     * descriptor's `build(ctx)` callback with a runtime context. This replaces
+     * the prior 175-line `agentPlatformTools` closure that hand-enumerated
+     * 38 `createXTool(agentRpc, ...)` factory calls. The exec / process /
+     * apply-patch tools stay enumerated inline below — they are `./tools`
+     * subpath (built-in non-platform).
+     */
+    const PLATFORM_TOOL_REGISTRY = createPlatformToolRegistry();
     function getOrCreateRegistry(agentId) {
         let registry = processRegistries.get(agentId);
         if (!registry) {
@@ -133,7 +160,7 @@ export function setupTools(deps) {
             }
             : [...(sharedPaths ?? [])]; // Non-admin: static empty array (no change)
         const agentConfig = agents[agentId] ?? agents[defaultAgentId];
-        // Use the agent's own skills config (SkillsConfigSchema defaults apply if not specified)
+        // Use the agent's own skills config (SkillsConfigSchema defaults apply if not specified).
         const skillsConfig = agentConfig?.skills ?? SkillsConfigSchema.parse({});
         // Resolve relative discoveryPaths against dataDir so ./skills -> ~/.comis/skills
         const agentWorkspaceSkillsDir = safePath(workspaceDirs.get(agentId) ?? defaultWorkspaceDir, "skills");
@@ -146,95 +173,74 @@ export function setupTools(deps) {
         if (!readOnlyPaths.includes(logsDir)) {
             readOnlyPaths.push(logsDir);
         }
-        // Create per-agent rpcCall that injects _agentId
+        // Create per-agent rpcCall that injects _agentId.
         const agentRpc = createAgentRpcCall(agentId);
+        // Per-agent build context for the descriptor registry. The platform-tool
+        // factory calls live in packages/skills/src/platform-tools/registry.ts.
+        // The 4 truly-conditional tools (background_tasks, image_generate,
+        // unified_context, browser) carry `conditional` predicates on the
+        // registry side; daemon filters via .filter(d => !d.conditional ||
+        // d.conditional(ctx)) BEFORE invoking d.build(ctx).
+        //
+        // The agents-manage callbacks (onMutationStart / onMutationEnd /
+        // onAgentCreated) are NOT a conditional -- they're complex args passed
+        // unconditionally via the build context.
+        //
+        // The exec/process/apply-patch tools remain enumerated inline below the
+        // registry call (their per-call config involves the sandbox provider,
+        // workspace dir, tool-results dir resolver, and capability port -- too
+        // complex to fit the descriptor `build(ctx)` shape; they're `./tools`
+        // subpath, not platform-tools, so they don't belong in the platform-tool
+        // registry).
         const agentPlatformTools = () => {
-            const tools = [
-                createCronTool(agentRpc),
-                createUnifiedMemoryTool(agentRpc, approvalGate),
-                createUnifiedSessionTool(agentRpc),
-                createMessageTool(agentRpc),
-                createDiscordActionTool(agentRpc, skillsLogger),
-                createTelegramActionTool(agentRpc),
-                createSlackActionTool(agentRpc),
-                createWhatsAppActionTool(agentRpc),
-                createSessionsSendTool(agentRpc),
-                createSessionsSpawnTool(agentRpc),
-                createSubagentsTool(agentRpc, skillsLogger),
-                createPipelineTool(agentRpc, skillsLogger, approvalGate),
-                createImageTool(agentRpc),
-                createTTSTool(agentRpc),
-                createTranscribeAudioTool(agentRpc),
-                createDescribeVideoTool(agentRpc),
-                createExtractDocumentTool(agentRpc),
-                createGatewayTool(agentRpc, skillsLogger),
-                createAgentsManageTool(agentRpc, skillsLogger, approvalGate, {
-                    onMutationStart: enterConfigMutationFence,
-                    onMutationEnd: leaveConfigMutationFence,
-                    // After agents.create seeds the new workspace's template files
-                    // (IDENTITY.md, ROLE.md, etc.) via ensureWorkspace, register those
-                    // seeded paths in THIS session's tracker so the caller LLM can
-                    // overwrite them via `write` without hitting the [not_read] gate.
-                    // Each file path is absolute; the seeded content is deterministic
-                    // (DEFAULT_TEMPLATES[name]), so we register the known mtime + content.
-                    onAgentCreated: async ({ workspaceDir }) => {
-                        if (!workspaceDir)
-                            return;
-                        for (const name of WORKSPACE_FILE_NAMES) {
-                            const filePath = safePath(workspaceDir, name);
-                            try {
-                                const st = await fsStat(filePath);
-                                // Idempotency: skip when tracker already records this path at
-                                // the same mtime -- avoids redundant recordRead work when the
-                                // same admin session creates the same agent twice (e.g. create,
-                                // delete, re-create within one turn).
-                                const existing = fileStateTracker.getReadState(filePath);
-                                if (existing && existing.mtime === st.mtimeMs)
-                                    continue;
-                                fileStateTracker.recordRead(filePath, st.mtimeMs, 0, undefined, Buffer.from(DEFAULT_TEMPLATES[name], "utf-8"));
-                            }
-                            catch {
-                                /* file absent or stat failed -- skip registration */
-                            }
+            const ctx = {
+                agentId,
+                rpcCall: agentRpc,
+                skillsLogger,
+                approvalGate,
+                eventBus,
+                imageGenProvider: deps.imageGenProvider,
+                backgroundTaskManager: deps.backgroundTaskManager,
+                toolCapabilityPort: deps.getCapabilityPortForAgent(agentId),
+                contextEngineVersion: agentConfig?.contextEngine?.version ?? "pipeline",
+                builtinToolsBrowserEnabled: skillsConfig.builtinTools.browser,
+                onConfigMutationStart: enterConfigMutationFence,
+                onConfigMutationEnd: leaveConfigMutationFence,
+                // After agents.create seeds the new workspace's template files
+                // (IDENTITY.md, ROLE.md, etc.) via ensureWorkspace, register those
+                // seeded paths in THIS session's tracker so the caller LLM can
+                // overwrite them via `write` without hitting the [not_read] gate.
+                // Each file path is absolute; the seeded content is deterministic
+                // (DEFAULT_TEMPLATES[name]), so we register the known mtime + content.
+                onAgentCreated: async ({ workspaceDir }) => {
+                    if (!workspaceDir)
+                        return;
+                    for (const name of WORKSPACE_FILE_NAMES) {
+                        const filePath = safePath(workspaceDir, name);
+                        try {
+                            const st = await fsStat(filePath);
+                            // Idempotency: skip when tracker already records this path at
+                            // the same mtime -- avoids redundant recordRead work when the
+                            // same admin session creates the same agent twice (e.g. create,
+                            // delete, re-create within one turn).
+                            const existing = fileStateTracker.getReadState(filePath);
+                            if (existing && existing.mtime === st.mtimeMs)
+                                continue;
+                            fileStateTracker.recordRead(filePath, st.mtimeMs, 0, undefined, Buffer.from(DEFAULT_TEMPLATES[name], "utf-8"));
                         }
-                    },
-                }),
-                createObsQueryTool(agentRpc),
-                createSessionsManageTool(agentRpc, approvalGate),
-                createModelsManageTool(agentRpc),
-                createProvidersManageTool(agentRpc, approvalGate, {
-                    onMutationStart: enterConfigMutationFence,
-                    onMutationEnd: leaveConfigMutationFence,
-                }),
-                createTokensManageTool(agentRpc, approvalGate),
-                createChannelsManageTool(agentRpc, approvalGate),
-                createSkillsManageTool(agentRpc, approvalGate),
-                createMcpManageTool(agentRpc, approvalGate),
-                createHeartbeatManageTool(agentRpc),
-                createNotifyTool(agentRpc),
-            ];
-            // Background tasks tool -- always registered (any user can check their tasks)
-            if (deps.backgroundTaskManager) {
-                tools.push(createBackgroundTasksTool({ manager: deps.backgroundTaskManager, agentId }));
-            }
-            // Image generation tool only when provider available (API key present)
-            if (deps.imageGenProvider) {
-                tools.push(createImageGenerateTool(agentRpc));
-            }
-            // Conditional: DAG context tools
-            const ceVersion = agentConfig?.contextEngine?.version ?? "pipeline";
-            if (ceVersion === "dag") {
-                tools.push(createUnifiedContextTool(agentRpc));
-            }
-            // Browser tool is conditional on builtinTools.browser config toggle
-            if (skillsConfig.builtinTools.browser) {
-                tools.push(createBrowserTool({
-                    rpcCall: agentRpc,
-                    sanitizeImage: sanitizeImageForApi,
-                    persistMedia: getOrCreateScreenshotPersistence(agentId),
-                    workspaceDir: workspaceDirs.get(agentId) ?? defaultWorkspaceDir,
-                }));
-            }
+                        catch {
+                            /* file absent or stat failed -- skip registration */
+                        }
+                    }
+                },
+                browserSanitizeImage: sanitizeImageForApi,
+                browserPersistMedia: getOrCreateScreenshotPersistence(agentId),
+                browserWorkspaceDir: workspaceDirs.get(agentId) ?? defaultWorkspaceDir,
+            };
+            const tools = PLATFORM_TOOL_REGISTRY
+                .filter((d) => !d.conditional || d.conditional(ctx))
+                .map((d) => d.build(ctx))
+                .filter((t) => t !== undefined);
             // Build per-agent sandbox config from daemon provider + agent config
             const sandboxCfg = skillsConfig.execSandbox.enabled === "always" && sandboxProvider
                 ? {
@@ -261,11 +267,13 @@ export function setupTools(deps) {
                 const agentWorkspaceDir = workspaceDirs.get(agentId) ?? defaultWorkspaceDir;
                 // Getter for session tool-results dir, resolved at call time via ALS context.
                 // Matches session path pattern from comis-session-manager + microcompaction-guard.
+                // Renamed local from `ctx` to `alsCtx` to avoid shadowing the outer
+                // `PlatformToolBuildContext` variable created for the registry call.
                 const getToolResultsDir = () => {
-                    const ctx = tryGetContext();
-                    if (!ctx?.sessionKey)
+                    const alsCtx = tryGetContext();
+                    if (!alsCtx?.sessionKey)
                         return undefined;
-                    const parsed = parseFormattedSessionKey(ctx.sessionKey);
+                    const parsed = parseFormattedSessionKey(alsCtx.sessionKey);
                     if (!parsed)
                         return undefined;
                     const sessionBaseDir = safePath(agentWorkspaceDir, "sessions");

package/node_modules/@comis/daemon/dist/wiring/tool-capability-adapter.js

@@ -59,7 +59,7 @@ const EMPTY_ALIAS_MAP = new Map();
 function normalizeAliasKey(pkg) {
     if (pkg.startsWith("@"))
         return pkg.toLowerCase();
-    return pkg.toLowerCase().replace(/[_.\-]+/g, "-");
+    return pkg.toLowerCase().replace(/[_.-]+/g, "-");
 }
 /**
  * Build the live ToolCapabilityPort adapter.

package/node_modules/@comis/daemon/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/daemon",
   "private": true,
-  "version": "1.0.37",
+  "version": "1.0.40",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Background daemon and orchestrator for the Comis platform",

package/node_modules/@comis/gateway/dist/acp/acp-server.js

@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: Apache-2.0
+// @allow-throw: ACP HTTP server route handler; throws caught by Hono framework error-handler boundary.
 /**
  * ACP Agent Server — Agent Communication Protocol implementation for IDE integration.
  *

package/node_modules/@comis/gateway/dist/auth/mtls-verifier.js

@@ -1,6 +1,7 @@
 import { ok, err } from "@comis/shared";
 import { X509Certificate } from "node:crypto";
 import { readFileSync } from "node:fs";
+import { systemNowMs, systemDateFrom } from "@comis/core";
 /**
  * Validate that certificate files exist, are readable PEM, and are not expired.
  *
@@ -35,8 +36,8 @@ export function validateCertificates(paths) {
         try {
             const pem = readFileSync(file.path, "utf-8");
             const cert = new X509Certificate(pem);
-            const notAfter = new Date(cert.validTo);
-            if (notAfter.getTime() < Date.now()) {
+            const notAfter = systemDateFrom(cert.validTo);
+            if (notAfter.getTime() < systemNowMs()) {
                 return err(new Error(`${file.label} at ${file.path} expired on ${cert.validTo}`));
             }
         }

package/node_modules/@comis/gateway/dist/oauth/oauth-callback-route.d.ts

@@ -18,7 +18,7 @@
  */
 import { Hono } from "hono";
 import type { OAuthCredentialStorePort, TypedEventBus } from "@comis/core";
-import type { GatewayLogger } from "../server/hono-server.js";
+import type { GatewayLogger } from "../server/gateway-logger.js";
 /** 5-minute pending-flow expiry. Exported for test parity. */
 export declare const PENDING_FLOW_TIMEOUT_MS: number;
 /**
@@ -31,10 +31,10 @@ export interface PendingFlow {
     verifier: string;
     /** "openai-codex" — used for path-vs-flow provider validation. */
     provider: string;
-    /** Date.now() at insertion time. */
+    /** systemNowMs() at insertion time. */
     createdAt: number;
     /**
-     * Cleanup timer reference. The handler clearTimeout(timer) on consume;
+     * Cleanup timer reference. The handler systemClearTimeout(timer) on consume;
      * the auto-expiry path (PENDING_FLOW_TIMEOUT_MS) deletes the entry.
      */
     timer: ReturnType<typeof setTimeout>;

package/node_modules/@comis/gateway/dist/oauth/oauth-callback-route.js

@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: Apache-2.0
+// @allow-throw: OAuth HTTP callback route; throws caught by Hono error-handler boundary per AGENTS.md §2.1 web-user-facing flows exception.
 /**
  * OAuth callback route for the Comis gateway.
  *
@@ -18,7 +19,7 @@
  * @module
  */
 import { Hono } from "hono";
-import { resolveCodexAuthIdentity, rewriteOAuthError, redactEmailForLog, } from "@comis/agent";
+import { resolveCodexAuthIdentity, rewriteOAuthError, redactEmailForLog, systemNowMs, systemSetTimeout, systemClearTimeout } from "@comis/core";
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -99,7 +100,7 @@ async function exchangeAuthorizationCode(params) {
     return {
         access: json.access_token,
         refresh: json.refresh_token,
-        expires: Date.now() + json.expires_in * 1000,
+        expires: systemNowMs() + json.expires_in * 1000,
     };
 }
 // ---------------------------------------------------------------------------
@@ -113,7 +114,7 @@ async function exchangeAuthorizationCode(params) {
  * — never hand-roll a PRNG.
  */
 export function insertPendingFlow(map, state, flow, logger) {
-    const timer = setTimeout(() => {
+    const timer = systemSetTimeout(() => {
         map.delete(state);
         logger.debug({ provider: flow.provider, submodule: "oauth-callback" }, "Pending OAuth flow expired");
     }, PENDING_FLOW_TIMEOUT_MS);
@@ -149,7 +150,7 @@ export function createOAuthCallbackRoute(deps) {
         }
         // One-time-use: cancel the timer + remove the entry BEFORE the
         // exchange so even a failed exchange does not leave a reusable state.
-        clearTimeout(flow.timer);
+        systemClearTimeout(flow.timer);
         deps.pendingFlows.delete(state);
         try {
             const tokens = await exchangeAuthorizationCode({
@@ -187,7 +188,7 @@ export function createOAuthCallbackRoute(deps) {
                 provider,
                 profileId,
                 identity: identityForEvent,
-                timestamp: Date.now(),
+                timestamp: systemNowMs(),
             });
             deps.logger.info({
                 provider,
@@ -201,7 +202,7 @@ export function createOAuthCallbackRoute(deps) {
             const rewritten = rewriteOAuthError(caught);
             deps.logger.warn({
                 provider,
-                errorKind: rewritten.errorKind,
+                errorKind: "auth",
                 hint: rewritten.hint,
                 submodule: "oauth-callback",
             }, "OAuth callback exchange failed");

package/node_modules/@comis/gateway/dist/openai/openai-completions.js

@@ -11,6 +11,7 @@
 import { Hono } from "hono";
 import { streamSSE } from "hono/streaming";
 import { suppressError } from "@comis/shared";
+import { systemNowMs } from "@comis/core";
 import { ChatCompletionRequestSchema, createOpenAIError, mapFinishReason, } from "./openai-types.js";
 // ---------------------------------------------------------------------------
 // Streaming helper
@@ -171,7 +172,7 @@ export function createOpenaiCompletionsRoute(deps) {
             }
             // Generate completion identifiers
             const completionId = `chatcmpl-${crypto.randomUUID()}`;
-            const created = Math.floor(Date.now() / 1000);
+            const created = Math.floor(systemNowMs() / 1000);
             // Build session key for OpenAI compat requests
             const sessionKey = {
                 userId: "openai-api",

package/node_modules/@comis/gateway/dist/rpc/ws-handler.js

@@ -1,3 +1,4 @@
+import { systemNowMs, systemSetTimeout, systemSetInterval, systemClearInterval } from "@comis/core";
 /**
  * Manages active WebSocket connections with heartbeat and lifecycle tracking.
  */
@@ -18,7 +19,7 @@ export class WsConnectionManager {
         this.connections.set(connectionId, {
             clientId,
             ws,
-            connectedAt: Date.now(),
+            connectedAt: systemNowMs(),
         });
     }
     /**
@@ -27,7 +28,7 @@ export class WsConnectionManager {
     remove(connectionId) {
         const conn = this.connections.get(connectionId);
         if (conn?.heartbeatTimer) {
-            clearInterval(conn.heartbeatTimer);
+            systemClearInterval(conn.heartbeatTimer);
         }
         this.connections.delete(connectionId);
     }
@@ -110,7 +111,7 @@ export class WsConnectionManager {
         const closePromises = [];
         for (const [id, conn] of this.connections) {
             if (conn.heartbeatTimer) {
-                clearInterval(conn.heartbeatTimer);
+                systemClearInterval(conn.heartbeatTimer);
             }
             // Listen for close completion on the raw ws before initiating close
             const raw = conn.ws.raw;
@@ -130,7 +131,7 @@ export class WsConnectionManager {
         if (closePromises.length > 0) {
             await Promise.race([
                 Promise.all(closePromises),
-                new Promise((resolve) => setTimeout(resolve, timeoutMs)),
+                new Promise((resolve) => systemSetTimeout(resolve, timeoutMs)),
             ]);
         }
     }
@@ -171,7 +172,7 @@ let connectionCounter = 0;
  */
 export function createWsHandler(deps, rpcContext) {
     const { rpcServer, connections, logger, maxBatchSize, heartbeatMs, maxMessageBytes, messageRateLimit } = deps;
-    const connectionId = `ws-${++connectionCounter}-${Date.now()}`;
+    const connectionId = `ws-${++connectionCounter}-${systemNowMs()}`;
     // Per-connection sliding window rate limiter
     const messageTimestamps = [];
     // Enrich RPC context with connectionId so RPC call logs can reference it
@@ -182,10 +183,10 @@ export function createWsHandler(deps, rpcContext) {
             logger.debug({ connectionId, clientId: rpcContext.clientId, activeConnections: connections.size }, `WebSocket connected: ${rpcContext.clientId}`);
             // Set up heartbeat ping if enabled
             if (heartbeatMs > 0) {
-                const timer = setInterval(() => {
+                const timer = systemSetInterval(() => {
                     try {
                         // Send a JSON-RPC notification as heartbeat ping
-                        ws.send(JSON.stringify({ jsonrpc: "2.0", method: "heartbeat", params: { ts: Date.now() } }));
+                        ws.send(JSON.stringify({ jsonrpc: "2.0", method: "heartbeat", params: { ts: systemNowMs() } }));
                     }
                     catch {
                         // Connection may be closed; cleanup will happen in onClose
@@ -213,7 +214,7 @@ export function createWsHandler(deps, rpcContext) {
                 return;
             }
             // Per-connection message rate limiting (sliding window)
-            const now = Date.now();
+            const now = systemNowMs();
             const { maxMessages, windowMs } = messageRateLimit;
             // Remove timestamps outside the window
             while (messageTimestamps.length > 0 && messageTimestamps[0] <= now - windowMs) {
@@ -286,7 +287,7 @@ export function createWsHandler(deps, rpcContext) {
         },
         onClose(evt, _ws) {
             const conn = connections.get(connectionId);
-            const connectionDurationMs = conn ? Date.now() - conn.connectedAt : undefined;
+            const connectionDurationMs = conn ? systemNowMs() - conn.connectedAt : undefined;
             connections.remove(connectionId);
             const isAbnormal = evt.code !== 1000 && evt.code !== 1001 && evt.code !== 1005;
             const logFn = isAbnormal ? logger.info.bind(logger) : logger.debug.bind(logger);

package/node_modules/@comis/gateway/dist/server/gateway-logger.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Minimal pino-compatible logger interface for the gateway.
+ *
+ * Lives in its own module so both the hono server and oauth-callback route
+ * can import it without forming a cycle (the server imports the route's
+ * factory; the route needs the logger type for its deps).
+ */
+export interface GatewayLogger {
+    debug(msg: string): void;
+    debug(obj: Record<string, unknown>, msg: string): void;
+    info(msg: string): void;
+    info(obj: Record<string, unknown>, msg: string): void;
+    warn(msg: string): void;
+    warn(obj: Record<string, unknown>, msg: string): void;
+    error(msg: string): void;
+    error(obj: Record<string, unknown>, msg: string): void;
+}

package/node_modules/@comis/gateway/dist/server/gateway-logger.js

@@ -0,0 +1 @@
+export {};

package/node_modules/@comis/gateway/dist/server/hono-server.d.ts

@@ -9,19 +9,8 @@ import { WsConnectionManager } from "../rpc/ws-handler.js";
 import { type WebhookHandler } from "../webhook/webhook-endpoint.js";
 import { type PendingFlow } from "../oauth/oauth-callback-route.js";
 import type { OAuthCredentialStorePort } from "@comis/core";
-/**
- * Logger interface for gateway server (minimal pino-compatible).
- */
-export interface GatewayLogger {
-    debug(msg: string): void;
-    debug(obj: Record<string, unknown>, msg: string): void;
-    info(msg: string): void;
-    info(obj: Record<string, unknown>, msg: string): void;
-    warn(msg: string): void;
-    warn(obj: Record<string, unknown>, msg: string): void;
-    error(msg: string): void;
-    error(obj: Record<string, unknown>, msg: string): void;
-}
+import type { GatewayLogger } from "./gateway-logger.js";
+export type { GatewayLogger };
 /**
  * Dependencies for creating a gateway server.
  */

package/node_modules/@comis/gateway/dist/server/hono-server.js

@@ -1,4 +1,4 @@
-import { tryGetContext } from "@comis/core";
+import { tryGetContext, systemNowDate } from "@comis/core";
 import { serve } from "@hono/node-server";
 import { createNodeWebSocket } from "@hono/node-ws";
 import { Hono } from "hono";
@@ -74,7 +74,7 @@ export function createGatewayServer(deps) {
     app.get("/health", (c) => {
         return c.json({
             status: "ok",
-            timestamp: new Date().toISOString(),
+            timestamp: systemNowDate().toISOString(),
             ...(deps.fingerprint && {
                 instanceId: deps.fingerprint.instanceId,
                 startedAt: deps.fingerprint.startedAt,

package/node_modules/@comis/gateway/dist/web/media-routes.js

@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: Apache-2.0
+// @allow-throw: @allow-throw boundary: gateway HTTP media-routes; throws caught by Hono framework error-handler boundary per AGENTS.md §2.1 web exception.
 /**
  * Media file serving routes -- Hono sub-app for serving stored media files.
  *
@@ -14,7 +15,7 @@
 import * as fs from "node:fs/promises";
 import { Hono } from "hono";
 import { z } from "zod";
-import { safePath, PathTraversalError } from "@comis/core";
+import { safePath, PathTraversalError, systemNowMs } from "@comis/core";
 import { extractBearerToken } from "../auth/token-auth.js";
 /** Media ID validation pattern: letters, digits, dots, hyphens, underscores. */
 const MEDIA_ID_PATTERN = /^[\p{L}\p{N}._-]+$/u;
@@ -101,7 +102,7 @@ export function createMediaRoutes(deps) {
         }
         // Check TTL expiration
         if (ttlMs !== undefined) {
-            const age = Math.max(0, Date.now() - stat.mtimeMs);
+            const age = Math.max(0, systemNowMs() - stat.mtimeMs);
             if (age >= ttlMs) {
                 return c.json({ error: "Media expired" }, 410);
             }

package/node_modules/@comis/gateway/dist/web/rest-api.js

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: Apache-2.0
-import { parseFormattedSessionKey } from "@comis/core";
+import { parseFormattedSessionKey, systemNowMs, systemNowDate } from "@comis/core";
 import { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { cors } from "hono/cors";
@@ -20,7 +20,7 @@ export class ActivityRingBuffer {
             id: this.nextId++,
             event,
             payload,
-            timestamp: Date.now(),
+            timestamp: systemNowMs(),
         });
         if (this.entries.length > this.maxSize) {
             this.entries.shift();
@@ -117,7 +117,7 @@ export function createRestApi(deps) {
     api.get("/health", (c) => {
         return c.json({
             status: "ok",
-            timestamp: new Date().toISOString(),
+            timestamp: systemNowDate().toISOString(),
             ...(deps.fingerprint && {
                 instanceId: deps.fingerprint.instanceId,
                 startedAt: deps.fingerprint.startedAt,

package/node_modules/@comis/gateway/dist/webhook/hmac-verifier.js

@@ -1,4 +1,5 @@
 import { createHmac, timingSafeEqual } from "node:crypto";
+import { systemNowMs } from "@comis/core";
 /**
  * Verify an HMAC signature against a body using constant-time comparison.
  *
@@ -41,7 +42,7 @@ export function createHmacMiddleware(config) {
         const tsHeader = c.req.header(timestampHeaderName);
         if (tsHeader) {
             const ts = parseInt(tsHeader, 10);
-            const nowSec = Math.floor(Date.now() / 1000);
+            const nowSec = Math.floor(systemNowMs() / 1000);
             if (Number.isNaN(ts) || Math.abs(nowSec - ts) > maxAgeSec) {
                 return c.json({ error: "Webhook timestamp expired or invalid" }, 401);
             }

package/node_modules/@comis/gateway/dist/webhook/webhook-endpoint.js

@@ -3,6 +3,7 @@ import { bodyLimit } from "hono/body-limit";
 import { z } from "zod";
 import { createHmacMiddleware } from "./hmac-verifier.js";
 import { resolveWebhookMapping, renderTemplate } from "./webhook-mapping.js";
+import { systemNowDate } from "@comis/core";
 /** Default maximum webhook body size: 1MB */
 const DEFAULT_MAX_BODY_BYTES = 1024 * 1024;
 /**
@@ -161,7 +162,7 @@ export function createMappedWebhookEndpoint(deps) {
             headers,
             query: queryObj,
             path: reqPath,
-            now: new Date().toISOString(),
+            now: systemNowDate().toISOString(),
         };
         try {
             if (mapping.action === "wake") {

package/node_modules/@comis/gateway/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/gateway",
   "private": true,
-  "version": "1.0.37",
+  "version": "1.0.40",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "HTTP, JSON-RPC, and WebSocket gateway for Comis",

package/node_modules/@comis/infra/dist/index.d.ts

@@ -1,5 +1,8 @@
 export { createLogger } from "./logging/index.js";
 export type { LoggerOptions, ComisLogger } from "./logging/index.js";
-export type { LogFields, ErrorKind } from "./logging/index.js";
-export { isValidLogLevel, VALID_LOG_LEVELS } from "./logging/index.js";
+export type { LogFields, ErrorKind } from "@comis/core";
+export { isValidLogLevel, VALID_LOG_LEVELS } from "@comis/core";
 export { isDocker } from "./runtime/is-docker.js";
+export { createSystemClock } from "./runtime/clock.js";
+export { createSystemEnv } from "./runtime/env.js";
+export { createSystemTimers } from "./runtime/timers.js";