comisai 1.0.37 → 1.0.41

package/node_modules/@comis/orchestrator/dist/queue/priority-scheduler.js

@@ -0,0 +1,200 @@
+// SPDX-License-Identifier: Apache-2.0
+// @allow-throw: priority-scheduler shutdown guard; consumed by inbound-pipeline boundary catch.
+/**
+ * Priority Scheduler: Multi-lane queue scheduling with per-lane concurrency.
+ *
+ * Replaces the single global PQueue gate with named priority lanes, each
+ * backed by its own PQueue with independent concurrency limits. This allows
+ * DMs, group mentions, and background tasks to have different scheduling
+ * priorities without starving any lane.
+ *
+ * Since each lane has its own PQueue running independently, starvation is
+ * prevented by design -- as long as each lane has concurrency > 0, its tasks
+ * will execute. The aging promotion mechanism is observability-only: it emits
+ * events when tasks wait longer than the configured threshold, but does not
+ * actually move tasks between lanes (PQueue does not support mid-flight
+ * task migration).
+ *
+ * @module
+ */
+import PQueue from "p-queue";
+import { systemNowMs, systemSetInterval, systemClearInterval } from "@comis/core";
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+/**
+ * Create a multi-lane priority scheduler.
+ *
+ * Each configured lane gets its own PQueue with independent concurrency.
+ * Tasks are routed to lanes by name; unknown lane names fall back to the
+ * lowest-priority lane.
+ *
+ * An aging sweep timer runs periodically and emits `priority:aged_promotion`
+ * events for monitoring when tasks have waited longer than the configured
+ * agingPromotionMs threshold.
+ *
+ * @param deps - Lane configuration and event bus
+ * @returns PriorityScheduler instance
+ */
+export function createPriorityScheduler(deps) {
+    const { eventBus } = deps;
+    // Sort lanes by priority descending (highest first)
+    const sortedConfigs = [...deps.lanes].sort((a, b) => b.priority - a.priority);
+    // Build lane map
+    const laneMap = new Map();
+    let lowestLane;
+    for (const config of sortedConfigs) {
+        const entry = {
+            queue: new PQueue({ concurrency: config.concurrency }),
+            config,
+            enqueueTimes: [],
+        };
+        laneMap.set(config.name, entry);
+        // Track lowest-priority lane (last in sorted order)
+        lowestLane = entry;
+    }
+    // If no lanes configured, create a default "normal" lane
+    if (laneMap.size === 0) {
+        const defaultConfig = {
+            name: "normal",
+            concurrency: 5,
+            priority: 0,
+            agingPromotionMs: 0,
+        };
+        const entry = {
+            queue: new PQueue({ concurrency: 5 }),
+            config: defaultConfig,
+            enqueueTimes: [],
+        };
+        laneMap.set("normal", entry);
+        lowestLane = entry;
+    }
+    let isShutdown = false;
+    // -------------------------------------------------------------------------
+    // Aging sweep timer (observability only)
+    // -------------------------------------------------------------------------
+    /**
+     * Determine the lane name one priority level above a given lane.
+     * Returns the lane name with the next higher priority, or the same
+     * lane name if already highest.
+     */
+    function getHigherLaneName(currentLaneName) {
+        const currentIdx = sortedConfigs.findIndex((c) => c.name === currentLaneName);
+        if (currentIdx <= 0)
+            return sortedConfigs[0]?.name ?? currentLaneName;
+        return sortedConfigs[currentIdx - 1].name;
+    }
+    const AGING_SWEEP_INTERVAL_MS = 5_000;
+    let agingSweepTimer;
+    function startAgingSweep() {
+        agingSweepTimer = systemSetInterval(() => {
+            const now = systemNowMs();
+            for (const [laneName, entry] of laneMap) {
+                if (entry.config.agingPromotionMs <= 0)
+                    continue;
+                // Check oldest enqueue times
+                for (const enqueueTime of entry.enqueueTimes) {
+                    const waitTimeMs = now - enqueueTime;
+                    if (waitTimeMs >= entry.config.agingPromotionMs) {
+                        eventBus.emit("priority:aged_promotion", {
+                            sessionKey: laneName,
+                            fromLane: laneName,
+                            toLane: getHigherLaneName(laneName),
+                            waitTimeMs,
+                            timestamp: now,
+                        });
+                    }
+                }
+            }
+        }, AGING_SWEEP_INTERVAL_MS);
+        // Don't keep the process alive just for aging sweep
+        agingSweepTimer.unref();
+    }
+    startAgingSweep();
+    // -------------------------------------------------------------------------
+    // PriorityScheduler implementation
+    // -------------------------------------------------------------------------
+    return {
+        async enqueue(laneName, task) {
+            if (isShutdown) {
+                throw new Error("Priority scheduler is shut down");
+            }
+            // Resolve lane (fall back to lowest-priority lane)
+            let lane = laneMap.get(laneName);
+            if (!lane) {
+                lane = lowestLane;
+            }
+            const enqueuedAt = systemNowMs();
+            lane.enqueueTimes.push(enqueuedAt);
+            await lane.queue.add(async () => {
+                // Remove enqueue timestamp (task is now executing)
+                const idx = lane.enqueueTimes.indexOf(enqueuedAt);
+                if (idx !== -1) {
+                    lane.enqueueTimes.splice(idx, 1);
+                }
+                await task();
+            });
+        },
+        getStats() {
+            const stats = {};
+            for (const [name, entry] of laneMap) {
+                stats[name] = {
+                    pending: entry.queue.size,
+                    executing: entry.queue.pending,
+                    concurrency: entry.config.concurrency,
+                    priority: entry.config.priority,
+                };
+            }
+            return stats;
+        },
+        getTotalConcurrency() {
+            let total = 0;
+            for (const entry of laneMap.values()) {
+                total += entry.config.concurrency;
+            }
+            return total;
+        },
+        pause() {
+            for (const entry of laneMap.values()) {
+                entry.queue.pause();
+            }
+        },
+        resume() {
+            for (const entry of laneMap.values()) {
+                entry.queue.start();
+            }
+        },
+        async drainAll() {
+            const promises = [];
+            for (const entry of laneMap.values()) {
+                promises.push(entry.queue.onIdle());
+            }
+            await Promise.all(promises);
+        },
+        async shutdown() {
+            isShutdown = true;
+            // Stop aging sweep
+            if (agingSweepTimer !== undefined) {
+                systemClearInterval(agingSweepTimer);
+                agingSweepTimer = undefined;
+            }
+            // Pause all lanes
+            for (const entry of laneMap.values()) {
+                entry.queue.pause();
+            }
+            // Wait for active tasks to finish
+            const activePromises = [];
+            for (const entry of laneMap.values()) {
+                if (entry.queue.pending > 0) {
+                    activePromises.push(entry.queue.onIdle());
+                }
+            }
+            await Promise.all(activePromises);
+            // Clear all lanes
+            for (const entry of laneMap.values()) {
+                entry.queue.clear();
+                entry.enqueueTimes.length = 0;
+            }
+        },
+    };
+}

package/node_modules/@comis/orchestrator/dist/session-key/session-key-builder.d.ts

@@ -0,0 +1,49 @@
+import type { NormalizedMessage, SessionKey } from "@comis/core";
+/**
+ * DM scope modes controlling session isolation granularity for direct messages.
+ */
+export type DmScopeMode = "main" | "per-peer" | "per-channel-peer" | "per-account-channel-peer";
+/**
+ * Parameters for building a scoped session key.
+ */
+export interface ScopedSessionKeyParams {
+    /** The incoming normalized message */
+    msg: NormalizedMessage;
+    /** Agent identifier for multi-agent setups (retained for caller ergonomics
+     *  and future telemetry; NOT serialized into the session key — see
+     *  `@comis/core/domain/session-key.ts`). */
+    agentId: string;
+    /** ChannelPort.channelId — bot account identifier */
+    adapterChannelId: string;
+    /** Tenant identifier (defaults to "default") */
+    tenantId?: string;
+    /** DM scope mode (defaults to "per-channel-peer") */
+    dmScopeMode?: DmScopeMode;
+    /** Thread ID for forum/thread isolation */
+    threadId?: string;
+}
+/**
+ * Build a scoped session key based on DM scope mode and thread isolation.
+ *
+ * Group messages always use per-channel-peer behavior regardless of dmScopeMode.
+ * DM messages apply the configured scope mode:
+ * - "main": single shared session (userId="main", channelId="dm")
+ * - "per-peer": per-peer sessions across all channels
+ * - "per-channel-peer": per-channel per-peer sessions (default)
+ * - "per-account-channel-peer": includes adapter channel ID for multi-bot isolation
+ *
+ * The `agentId` param is retained for caller ergonomics / future telemetry
+ * but is NOT serialized into the session key.
+ */
+export declare function buildScopedSessionKey(params: ScopedSessionKeyParams): SessionKey;
+/**
+ * Extract a thread ID from platform-specific message metadata.
+ *
+ * Supports:
+ * - Discord: parentChannelId present -> return msg.channelId (thread channel)
+ * - Slack: slackThreadTs present -> return its string value
+ * - Telegram: telegramThreadId present -> return its string value
+ *
+ * @returns Thread ID string or undefined if not in a thread context
+ */
+export declare function extractThreadId(msg: NormalizedMessage): string | undefined;

package/node_modules/@comis/orchestrator/dist/session-key/session-key-builder.js

@@ -0,0 +1,100 @@
+/**
+ * Detect whether a message originates from a group context.
+ *
+ * A message is a group message if any of:
+ * - msg.metadata.guildId is defined (Discord server)
+ * - msg.metadata.isGroup is true (generic group flag)
+ * - msg.metadata.telegramChatType is "group" or "supergroup"
+ */
+function isGroupMessage(msg) {
+    const meta = msg.metadata;
+    if (meta.guildId !== undefined)
+        return true;
+    if (meta.isGroup === true)
+        return true;
+    const chatType = meta.telegramChatType;
+    if (chatType === "group" || chatType === "supergroup")
+        return true;
+    return false;
+}
+/**
+ * Build a scoped session key based on DM scope mode and thread isolation.
+ *
+ * Group messages always use per-channel-peer behavior regardless of dmScopeMode.
+ * DM messages apply the configured scope mode:
+ * - "main": single shared session (userId="main", channelId="dm")
+ * - "per-peer": per-peer sessions across all channels
+ * - "per-channel-peer": per-channel per-peer sessions (default)
+ * - "per-account-channel-peer": includes adapter channel ID for multi-bot isolation
+ *
+ * The `agentId` param is retained for caller ergonomics / future telemetry
+ * but is NOT serialized into the session key.
+ */
+export function buildScopedSessionKey(params) {
+    const { msg, adapterChannelId, tenantId = "default", dmScopeMode = "per-channel-peer", threadId, } = params;
+    const key = {
+        tenantId,
+        userId: msg.senderId,
+        channelId: msg.channelId,
+    };
+    if (isGroupMessage(msg)) {
+        // Group messages: always per-channel-peer behavior
+        key.userId = msg.senderId;
+        key.channelId = msg.channelId;
+        key.peerId = msg.senderId;
+        if (msg.metadata.guildId !== undefined) {
+            key.guildId = String(msg.metadata.guildId);
+        }
+    }
+    else {
+        // DM messages: apply scope mode
+        switch (dmScopeMode) {
+            case "main":
+                key.userId = "main";
+                key.channelId = "dm";
+                // No peerId for main scope
+                break;
+            case "per-peer":
+                key.userId = msg.senderId;
+                key.channelId = "dm";
+                key.peerId = msg.senderId;
+                break;
+            case "per-channel-peer":
+                key.userId = msg.senderId;
+                key.channelId = msg.channelId;
+                key.peerId = msg.senderId;
+                break;
+            case "per-account-channel-peer":
+                key.userId = msg.senderId;
+                key.channelId = `${adapterChannelId}:${msg.channelId}`;
+                key.peerId = msg.senderId;
+                break;
+        }
+    }
+    if (threadId !== undefined) {
+        key.threadId = threadId;
+    }
+    return key;
+}
+/**
+ * Extract a thread ID from platform-specific message metadata.
+ *
+ * Supports:
+ * - Discord: parentChannelId present -> return msg.channelId (thread channel)
+ * - Slack: slackThreadTs present -> return its string value
+ * - Telegram: telegramThreadId present -> return its string value
+ *
+ * @returns Thread ID string or undefined if not in a thread context
+ */
+export function extractThreadId(msg) {
+    if (msg.metadata.parentChannelId !== undefined) {
+        return msg.channelId;
+    }
+    if (msg.metadata.slackThreadTs !== undefined) {
+        return String(msg.metadata.slackThreadTs);
+    }
+    if (msg.metadata.telegramThreadId !== undefined) {
+        return String(msg.metadata.telegramThreadId);
+    }
+    return undefined;
+}

package/node_modules/@comis/orchestrator/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@comis/orchestrator",
+  "private": true,
+  "version": "1.0.41",
+  "author": "Moshe Anconina",
+  "license": "Apache-2.0",
+  "description": "Inbound orchestration: channel-manager lifecycle, inbound pipeline, execute-and-deliver coordination, command queue, message routing",
+  "keywords": [
+    "comis",
+    "ai",
+    "agent",
+    "orchestrator",
+    "inbound",
+    "channel-manager"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/comisai/comis.git",
+    "directory": "packages/orchestrator"
+  },
+  "homepage": "https://github.com/comisai/comis#readme",
+  "bugs": {
+    "url": "https://github.com/comisai/comis/issues"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run"
+  }
+}

package/node_modules/@comis/scheduler/dist/cron/cron-expression.js

@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 import { Cron } from "croner";
+import { systemDateFrom } from "@comis/core";
 /**
  * Compute the next run time in milliseconds for a given schedule.
  *
@@ -25,7 +26,7 @@ function computeCron(expr, tz, nowMs) {
         const timezone = tz ?? Intl.DateTimeFormat().resolvedOptions().timeZone;
         const cron = new Cron(expr, { timezone, catch: false });
         // 1ms lookback prevents skipping current-second boundary
-        const nextDate = cron.nextRun(new Date(nowMs - 1));
+        const nextDate = cron.nextRun(systemDateFrom(nowMs - 1));
         if (!nextDate)
             return undefined;
         const nextMs = nextDate.getTime();
@@ -50,7 +51,7 @@ function computeEvery(everyMs, anchorMs, nowMs) {
     return next;
 }
 function computeAt(at, nowMs) {
-    const dateMs = new Date(at).getTime();
+    const dateMs = systemDateFrom(at).getTime();
     if (!Number.isFinite(dateMs))
         return undefined;
     return dateMs > nowMs ? dateMs : undefined;

package/node_modules/@comis/scheduler/dist/cron/cron-scheduler.d.ts

@@ -39,7 +39,7 @@ export interface CronScheduler {
  * Create a CronScheduler with timer loop, job lifecycle, and error backoff.
  *
  * - Single timer via armTimer(): earliest nextRunAtMs, clamped to MAX_TIMER_DELAY_MS
- * - Timer uses .unref() to avoid keeping the process alive (decision [06-03])
+ * - Timer uses .unref() to avoid keeping the process alive
  * - Due jobs: emit scheduler:job_started, call executeJob, emit scheduler:job_completed
  * - Success: reset consecutiveErrors, compute nextRunAtMs
  * - Error: increment consecutiveErrors, apply backoff from ERROR_BACKOFF_SCHEDULE_MS

package/node_modules/@comis/scheduler/dist/cron/cron-scheduler.js

@@ -1,4 +1,5 @@
 import { computeNextRunAtMs } from "./cron-expression.js";
+import { systemSetTimeout, systemClearTimeout } from "@comis/core";
 /** Maximum timer delay -- clamp to prevent long waits and recover from clock drift. */
 const MAX_TIMER_DELAY_MS = 60_000;
 /** Backoff schedule for consecutive errors: 30s, 1m, 5m, 15m, 60m (cap). */
@@ -7,7 +8,7 @@ const ERROR_BACKOFF_SCHEDULE_MS = [30_000, 60_000, 300_000, 900_000, 3_600_000];
  * Create a CronScheduler with timer loop, job lifecycle, and error backoff.
  *
  * - Single timer via armTimer(): earliest nextRunAtMs, clamped to MAX_TIMER_DELAY_MS
- * - Timer uses .unref() to avoid keeping the process alive (decision [06-03])
+ * - Timer uses .unref() to avoid keeping the process alive
  * - Due jobs: emit scheduler:job_started, call executeJob, emit scheduler:job_completed
  * - Success: reset consecutiveErrors, compute nextRunAtMs
  * - Error: increment consecutiveErrors, apply backoff from ERROR_BACKOFF_SCHEDULE_MS
@@ -20,7 +21,7 @@ export function createCronScheduler(deps) {
     let runningCount = 0;
     function armTimer() {
         if (timer !== null) {
-            clearTimeout(timer);
+            systemClearTimeout(timer);
             timer = null;
         }
         if (jobs.length === 0)
@@ -35,7 +36,7 @@ export function createCronScheduler(deps) {
         // Compute delay, clamped to MAX_TIMER_DELAY_MS
         const rawDelay = earliestMs === Infinity ? MAX_TIMER_DELAY_MS : Math.max(0, earliestMs - now);
         const delay = Math.min(rawDelay, MAX_TIMER_DELAY_MS);
-        timer = setTimeout(() => {
+        timer = systemSetTimeout(() => {
             void tick();
         }, delay);
         timer.unref();
@@ -143,7 +144,7 @@ export function createCronScheduler(deps) {
         },
         stop() {
             if (timer !== null) {
-                clearTimeout(timer);
+                systemClearTimeout(timer);
                 timer = null;
             }
             logger.info("CronScheduler stopped");
@@ -184,7 +185,7 @@ function errorBackoffMs(consecutiveErrors) {
  * Check if job should be auto-suspended and apply if so.
  * Returns true if the job was suspended.
  *
- * CRON-CIRCUIT: Circuit breaker for cron jobs -- prevents permanently failing
+ * Circuit breaker for cron jobs -- prevents permanently failing
  * jobs from retrying forever, wasting API costs and compute.
  */
 function checkAutoSuspend(job, globalMax, lastError, endTime, logger, eventBus) {

package/node_modules/@comis/scheduler/dist/cron/cron-store.js

@@ -1,9 +1,13 @@
 // SPDX-License-Identifier: Apache-2.0
+// @allow-throw: boundary for file-IO + lock-acquisition errors in CronStore; consumed via daemon cron-handlers + setup-schedulers.
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { z } from "zod";
 import { CronJobSchema } from "./cron-types.js";
-import { withExecutionLock } from "../execution/execution-lock.js";
+// Scheduler internals consume the canonical FileLockPort.withLock() API
+// from @comis/core. The FileLockPort returns Result<T, LockError> where
+// LockError = { kind: "locked" | "error", message: string }.
+import { createFileLock } from "@comis/core";
 const CronJobArraySchema = z.array(CronJobSchema);
 /** Lock options for CronStore mutations: short stale/update since operations are fast. */
 const LOCK_OPTIONS = { staleMs: 30_000, updateMs: 5_000 };
@@ -16,6 +20,8 @@ const LOCK_OPTIONS = { staleMs: 30_000, updateMs: 5_000 };
 export function createCronStore(filePath, logger) {
     const lockPath = `${filePath}.lock`;
     const mutex = createMutex();
+    // Stateless factory — one instance per CronStore.
+    const fileLock = createFileLock();
     /** Internal load: reads and parses the store file. */
     async function loadFromFile() {
         try {
@@ -84,19 +90,19 @@ export function createCronStore(filePath, logger) {
         },
         async addJob(job) {
             await mutex.serialize(async () => {
-                const result = await withExecutionLock(lockPath, async () => {
+                const result = await fileLock.withLock(lockPath, async () => {
                     const jobs = await loadFromFile();
                     jobs.push(job);
                     await saveToFile(jobs);
                 }, LOCK_OPTIONS);
                 if (!result.ok) {
-                    throw new Error(`CronStore addJob failed: lock ${result.error}`);
+                    throw new Error(`CronStore addJob failed: lock ${result.error.kind}`);
                 }
             });
         },
         async removeJob(jobId) {
             return mutex.serialize(async () => {
-                const result = await withExecutionLock(lockPath, async () => {
+                const result = await fileLock.withLock(lockPath, async () => {
                     const jobs = await loadFromFile();
                     const idx = jobs.findIndex((j) => j.id === jobId);
                     if (idx === -1)
@@ -106,14 +112,14 @@ export function createCronStore(filePath, logger) {
                     return true;
                 }, LOCK_OPTIONS);
                 if (!result.ok) {
-                    throw new Error(`CronStore removeJob failed: lock ${result.error}`);
+                    throw new Error(`CronStore removeJob failed: lock ${result.error.kind}`);
                 }
                 return result.value;
             });
         },
         async updateJob(jobId, update) {
             return mutex.serialize(async () => {
-                const result = await withExecutionLock(lockPath, async () => {
+                const result = await fileLock.withLock(lockPath, async () => {
                     const jobs = await loadFromFile();
                     const idx = jobs.findIndex((j) => j.id === jobId);
                     if (idx === -1)
@@ -126,7 +132,7 @@ export function createCronStore(filePath, logger) {
                     return true;
                 }, LOCK_OPTIONS);
                 if (!result.ok) {
-                    throw new Error(`CronStore updateJob failed: lock ${result.error}`);
+                    throw new Error(`CronStore updateJob failed: lock ${result.error.kind}`);
                 }
                 return result.value;
             });

package/node_modules/@comis/scheduler/dist/cron/index.d.ts

@@ -1,4 +1,4 @@
-export type { CronJob } from "./cron-types.js";
+export type { CronJob, CronSchedule } from "./cron-types.js";
 export { computeNextRunAtMs } from "./cron-expression.js";
 export { createCronStore } from "./cron-store.js";
 export type { CronStore } from "./cron-store.js";

package/node_modules/@comis/scheduler/dist/execution/execution-tracker.js

@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: Apache-2.0
+// @allow-throw: scheduler-execution state-tracking guard; consumed via daemon scheduler wiring catch (daemon.ts bootstrap boundary).
 /**
  * JSONL-based execution tracking with auto-prune and anomaly detection.
  *

package/node_modules/@comis/scheduler/dist/execution/index.d.ts

@@ -1,4 +1,2 @@
 export { createExecutionTracker } from "./execution-tracker.js";
 export type { ExecutionTracker, ExecutionLogEntry } from "./execution-tracker.js";
-export { withExecutionLock, isLocked } from "./execution-lock.js";
-export type { ExecutionLockOptions } from "./execution-lock.js";

package/node_modules/@comis/scheduler/dist/execution/index.js

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
-// @comis/scheduler/execution — execution safety primitives
+// @comis/scheduler/execution — execution safety primitives.
+//
+// The file-based execution lock lives at @comis/core/runtime/file-lock.ts;
+// cron internals consume `createFileLock` from @comis/core directly.
 // Execution tracking
 export { createExecutionTracker } from "./execution-tracker.js";
-// File-based execution lock
-export { withExecutionLock, isLocked } from "./execution-lock.js";

package/node_modules/@comis/scheduler/dist/heartbeat/agent-heartbeat-source.d.ts

@@ -52,7 +52,12 @@ interface HeartbeatSessionResolver {
     }): boolean;
 }
 /** Tool policy filter function signature -- matches applyToolPolicy from @comis/skills.
- *  Injected as a dep so scheduler doesn't take a hard dependency on skills. */
+ *  Injected as a dep so scheduler doesn't take a hard dependency on skills.
+ *
+ *  `reason.kind` is the closed-union mirror of `ToolFilterReason` from
+ *  @comis/skills/policy/tool-policy.ts (two variants: "not_in_profile" +
+ *  "explicit_deny"). Plain TS union, not Zod — internal scheduler-skills
+ *  boundary, not a parsed-payload contract. */
 export interface HeartbeatToolPolicyFilter {
     (tools: unknown[], policy: {
         profile: string;
@@ -63,7 +68,7 @@ export interface HeartbeatToolPolicyFilter {
         filtered: Array<{
             toolName: string;
             reason: {
-                kind: string;
+                kind: "not_in_profile" | "explicit_deny";
             };
         }>;
     };

package/node_modules/@comis/scheduler/dist/heartbeat/agent-heartbeat-source.js

@@ -19,7 +19,7 @@
  * @module
  */
 import { randomUUID } from "node:crypto";
-import { formatSessionKey, runWithContext } from "@comis/core";
+import { formatSessionKey, runWithContext, systemNowMs } from "@comis/core";
 import { deliverHeartbeatNotification } from "./delivery-bridge.js";
 import { shouldBypassFileGates } from "./file-gate.js";
 import { resolveHeartbeatTriggerKind, buildHeartbeatPrompt } from "./prompt-builder.js";
@@ -159,7 +159,7 @@ export function createAgentHeartbeatSource(deps) {
                 channelType: config.target?.channelType ?? "heartbeat",
                 senderId: "system",
                 text: promptText,
-                timestamp: Date.now(),
+                timestamp: systemNowMs(),
                 attachments: [],
                 metadata: {
                     trigger: "heartbeat",
@@ -181,14 +181,14 @@ export function createAgentHeartbeatSource(deps) {
                 tenantId: sessionKey.tenantId,
                 userId: sessionKey.userId,
                 sessionKey: formattedKey,
-                startedAt: Date.now(),
+                startedAt: systemNowMs(),
                 trustLevel: "user",
                 channelType: msg.channelType,
             }, () => executor.execute(msg, sessionKey, tools, agentId, {
                 model,
                 operationType: "heartbeat",
             }));
-            logger.info({ agentId, trigger, durationMs: Date.now() - msg.timestamp }, "Heartbeat run complete");
+            logger.info({ agentId, trigger, durationMs: systemNowMs() - msg.timestamp }, "Heartbeat run complete");
             // 10.5 Response processing: classify and decide delivery vs suppression
             const hasMedia = /^MEDIA:/m.test(result.response ?? "");
             const outcome = processHeartbeatResponse({
@@ -205,7 +205,7 @@ export function createAgentHeartbeatSource(deps) {
                 }
                 // Store last heartbeat for dedup
                 if (deps.sessionOps) {
-                    deps.sessionOps.storeLastHeartbeat(formattedKey, outcome.cleanedText, Date.now());
+                    deps.sessionOps.storeLastHeartbeat(formattedKey, outcome.cleanedText, systemNowMs());
                 }
                 return;
             }
@@ -213,7 +213,7 @@ export function createAgentHeartbeatSource(deps) {
             logger.debug({ agentId, textLength: outcome.text.length }, "Heartbeat response classified for delivery");
             // Store last heartbeat for dedup
             if (deps.sessionOps) {
-                deps.sessionOps.storeLastHeartbeat(formattedKey, outcome.text, Date.now());
+                deps.sessionOps.storeLastHeartbeat(formattedKey, outcome.text, systemNowMs());
             }
             // 11. Deliver response via delivery bridge (fire-and-forget)
             if (config.target && outcome.text) {
@@ -228,7 +228,7 @@ export function createAgentHeartbeatSource(deps) {
                     sourceName: "heartbeat",
                     text: outcome.text,
                     level,
-                    timestamp: Date.now(),
+                    timestamp: systemNowMs(),
                 };
                 const deliveryOpts = {
                     agentId,