comisai 1.0.41 → 1.0.44

package/node_modules/@comis/daemon/dist/wiring/setup-agents/setup-agents-boot-window.js

@@ -0,0 +1,58 @@
+import { compareServedWindowForProvider, collectAgentBootWindowInfo, } from "@comis/agent";
+/**
+ * KNOB-01 + FLOOR-01 (v2.21): served-window comparison + boot-window-info
+ * collection beside the per-agent registry — the ONLY seam with the
+ * registry-enriched "configured" the executor itself resolves (pi-executor
+ * find + `?? 8_192`). Fail-open wholesale (FLOOR-01-16 / T-176-15): any error
+ * is WARN-logged and boot continues; turn-time guards still apply (dag:
+ * CWF-02 preflight; pipeline: 85% compaction trigger + reactive
+ * classification).
+ *
+ * `convertTools` MUST be the same closure later bound into
+ * `PiExecutorDeps.convertTools` — reference identity is the WR-03 corpus pin
+ * (the boot floor measures the exact description set the turn ships).
+ *
+ * Extracted from setup-agents-runtime.ts (600-line subdirectory cap split).
+ */
+export function runBootWindowHonestyChecks(params) {
+    const { agentId, providerId, modelId, container, deps, piModelRegistry, providerAliases, agentLogger, effectiveConfig, convertTools, } = params;
+    try {
+        const findModel = (p, m) => {
+            let r = piModelRegistry.find(p, m);
+            if (!r) {
+                const builtIn = providerAliases.get(p);
+                if (builtIn)
+                    r = piModelRegistry.find(builtIn, m);
+            }
+            return r ?? undefined;
+        };
+        const providerEntry = container.config.providers?.entries?.[providerId];
+        const comparison = compareServedWindowForProvider({
+            providerId,
+            served: deps.servedWindowByProvider?.get(providerId),
+            providerEntry,
+            findModel,
+            logger: agentLogger,
+        });
+        if (comparison)
+            deps.servedWindowComparisons?.set(comparison.providerId, comparison);
+        deps.agentBootWindowInfo?.set(agentId, collectAgentBootWindowInfo({
+            agentId,
+            providerId,
+            modelId,
+            findModel,
+            served: deps.servedWindowByProvider?.get(providerId),
+            explicitCapabilityClass: providerEntry?.capabilities?.capabilityClass,
+            agentConfig: effectiveConfig,
+            convertTools,
+        }));
+    }
+    catch (err) {
+        agentLogger.warn({
+            err,
+            agentId,
+            errorKind: "internal",
+            hint: "served-window comparison / boot-window collection failed — boot continues (fail-open); turn-time guards still apply (dag: CWF-02 preflight; pipeline: 85% compaction trigger + reactive classification)",
+        }, "Boot window honesty checks skipped for agent");
+    }
+}

package/node_modules/@comis/daemon/dist/wiring/setup-agents/setup-agents-descriptions.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Pre-resolved lean tool descriptions for a single agent runtime.
+ *
+ * Extracted from {@link setupSingleAgent} (setup-agents-runtime.ts) to keep
+ * that file under the per-subdirectory size cap. Pure mechanical move — the
+ * behavior (description resolution + the "Tool descriptions resolved" INFO)
+ * is unchanged.
+ *
+ * @module
+ */
+import { type AgentBootWindowInfo } from "@comis/agent";
+import type { PerAgentConfig } from "@comis/core";
+import type { ComisLogger } from "@comis/infra";
+/**
+ * Resolve every lean tool description once at agent setup time.
+ *
+ * channelType is unavailable at agent setup time; the message tool resolves to
+ * the "chat" fallback. Per-channel resolution is deferred to runtime. The
+ * setup-time modelTier only affects lean description text (e.g. the admin
+ * suffix) — capability class is resolved per-execution in pi-executor via
+ * resolveModelProfile().
+ *
+ * Emits one INFO ("Tool descriptions resolved") with count/token/over-limit
+ * telemetry. `logger` is the per-agent child logger (agentId already bound —
+ * not duplicated here).
+ */
+export declare function resolveLeanDescriptionsForAgent(agentConfig: PerAgentConfig, logger: ComisLogger): Record<string, string>;
+/** AgentBootWindowInfo's convertTools slot — the shared closure's signature. */
+type FloorConvertTools = NonNullable<AgentBootWindowInfo["convertTools"]>;
+/**
+ * WR-03 (176 review): build the ONE tool-conversion closure shared by BOTH
+ * consumers — PiExecutorDeps.convertTools (turn-time S corpus) AND
+ * AgentBootWindowInfo.convertTools (FLOOR-01 boot corpus). setupSingleAgent
+ * calls this once per agent and binds the single returned reference into both:
+ * that reference identity is the corpus-identity pin (I8 extended from formula
+ * to input). Cast safe: the adapter reads only schema fields at conversion
+ * time; execute is lazy.
+ */
+export declare function buildSharedConvertTools(resolvedDescriptions: Record<string, string>): (tools: Parameters<FloorConvertTools>[0]) => import("@earendil-works/pi-coding-agent").ToolDefinition<import("typebox").TSchema, unknown, any>[];
+export {};

package/node_modules/@comis/daemon/dist/wiring/setup-agents/setup-agents-descriptions.js

@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Pre-resolved lean tool descriptions for a single agent runtime.
+ *
+ * Extracted from {@link setupSingleAgent} (setup-agents-runtime.ts) to keep
+ * that file under the per-subdirectory size cap. Pure mechanical move — the
+ * behavior (description resolution + the "Tool descriptions resolved" INFO)
+ * is unchanged.
+ *
+ * @module
+ */
+import { LEAN_TOOL_DESCRIPTIONS, resolveDescription, } from "@comis/agent";
+import { agentToolsToToolDefinitions } from "@comis/skills";
+/**
+ * Resolve every lean tool description once at agent setup time.
+ *
+ * channelType is unavailable at agent setup time; the message tool resolves to
+ * the "chat" fallback. Per-channel resolution is deferred to runtime. The
+ * setup-time modelTier only affects lean description text (e.g. the admin
+ * suffix) — capability class is resolved per-execution in pi-executor via
+ * resolveModelProfile().
+ *
+ * Emits one INFO ("Tool descriptions resolved") with count/token/over-limit
+ * telemetry. `logger` is the per-agent child logger (agentId already bound —
+ * not duplicated here).
+ */
+export function resolveLeanDescriptionsForAgent(agentConfig, logger) {
+    const descriptionContext = {
+        channelType: undefined,
+        trustLevel: "default", // Trust comes from token/context at message time, not config
+        modelTier: agentConfig.bootstrap?.promptMode === "minimal" ? "small" : "large",
+    };
+    const resolvedDescriptions = {};
+    let dynamicCount = 0;
+    for (const name of Object.keys(LEAN_TOOL_DESCRIPTIONS)) {
+        const raw = LEAN_TOOL_DESCRIPTIONS[name];
+        if (typeof raw === "function")
+            dynamicCount++;
+        resolvedDescriptions[name] = resolveDescription({ name }, LEAN_TOOL_DESCRIPTIONS, descriptionContext);
+    }
+    const totalDescriptionTokens = Object.values(resolvedDescriptions)
+        .reduce((sum, d) => sum + Math.ceil(d.length / 4), 0);
+    const overLimitCount = Object.values(resolvedDescriptions)
+        .filter((d) => d.length > 300).length;
+    logger.info({
+        descriptionCount: Object.keys(resolvedDescriptions).length,
+        tokenCount: totalDescriptionTokens,
+        dynamicCount,
+        overLimitCount,
+        // Setup-time modelTier for lean description selection (per-execution tier may differ)
+        modelTier: descriptionContext.modelTier,
+    }, "Tool descriptions resolved");
+    return resolvedDescriptions;
+}
+/**
+ * WR-03 (176 review): build the ONE tool-conversion closure shared by BOTH
+ * consumers — PiExecutorDeps.convertTools (turn-time S corpus) AND
+ * AgentBootWindowInfo.convertTools (FLOOR-01 boot corpus). setupSingleAgent
+ * calls this once per agent and binds the single returned reference into both:
+ * that reference identity is the corpus-identity pin (I8 extended from formula
+ * to input). Cast safe: the adapter reads only schema fields at conversion
+ * time; execute is lazy.
+ */
+export function buildSharedConvertTools(resolvedDescriptions) {
+    return (tools) => agentToolsToToolDefinitions(tools, resolvedDescriptions);
+}

package/node_modules/@comis/daemon/dist/wiring/setup-agents/setup-agents-oauth.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Daemon-side OAuth auth-provider wiring for a single agent runtime.
+ *
+ * Extracted from {@link setupSingleAgent} (setup-agents-runtime.ts) to keep
+ * that file under the per-subdirectory size cap. Pure mechanical move — the
+ * behavior (and its load-bearing closure-stability comment) is unchanged.
+ *
+ * Closes the unwired-OAuth gap — the `createAuthProvider` symbol was exported
+ * by `@comis/agent` but never called by the daemon, so refreshed OAuth tokens
+ * lived only in the in-memory cache and silently disappeared on restart.
+ * `AuthProviderConfig.oauth` credentialStore + logger + dataDir are REQUIRED so
+ * this wiring is type-checked at compile time — future regressions surface as
+ * TS errors, not silent runtime failures.
+ *
+ * @module
+ */
+import { type AuthProvider, type AuthProviderConfig } from "@comis/agent";
+import { type AppContainer, type CredentialStorageMode, type FileLockPort, type OAuthCredentialStorePort } from "@comis/core";
+import type { ComisLogger } from "@comis/infra";
+/**
+ * Once-per-daemon WARN for the encrypted-store hot-reload limitation.
+ *
+ * Called from setupAgents() (NOT setupSingleAgent) so the notice fires exactly
+ * once per daemon process — not N times for N agents. Operator sees this in
+ * startup logs without surprise; daemon restart is required to pick up
+ * CLI-written OAuth profiles in encrypted-store mode (file-watch is
+ * unsupported on encrypted SQLite WAL — see `watchPath` below). Lives in this
+ * OAuth leaf (the limitation it describes) since the registry leaf sits at its
+ * per-subdirectory size cap.
+ */
+export declare function warnEncryptedModeOnce(storageMode: CredentialStorageMode, agentLogger: ComisLogger): void;
+/** Inputs for {@link wireAuthProvider} — exactly the locals the OAuth block needs. */
+export interface WireAuthProviderArgs {
+    /** Agent being (re)built; keys the live oauthProfiles dereference. */
+    agentId: string;
+    /** Per-process daemon container (holds config.agents map + eventBus). */
+    container: AppContainer;
+    /** Agent-scoped secret manager for resolving API key values. */
+    scopedManager: AuthProviderConfig["secretManager"];
+    /** Daemon-level OAuth credential store handle (constructed once, threaded in). */
+    oauthCredentialStore: OAuthCredentialStorePort;
+    /** Canonical proper-lockfile FileLockPort instance (shared with the session adapter). */
+    fileLock: FileLockPort;
+    /** Resolved absolute data dir (defaults to ~/.comis upstream). */
+    dataDirAbs: string;
+    /** OAuth storage mode ("file" enables the auth-profiles.json watcher; "env"/"encrypted" → no watcher). */
+    oauthStorageMode: CredentialStorageMode;
+    /** Agent-scoped logger. */
+    agentLogger: ComisLogger;
+}
+/**
+ * Construct the per-agent OAuth-aware {@link AuthProvider}.
+ *
+ * All path constructions use `safePath` from `@comis/core` (NOT `path.join` —
+ * required by the ESLint security rule). When storage === "encrypted", the
+ * OAuth profile adapter SHARES the existing secretsDb handle (no dual-handle).
+ */
+export declare function wireAuthProvider(args: WireAuthProviderArgs): AuthProvider;

package/node_modules/@comis/daemon/dist/wiring/setup-agents/setup-agents-oauth.js

@@ -0,0 +1,128 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Daemon-side OAuth auth-provider wiring for a single agent runtime.
+ *
+ * Extracted from {@link setupSingleAgent} (setup-agents-runtime.ts) to keep
+ * that file under the per-subdirectory size cap. Pure mechanical move — the
+ * behavior (and its load-bearing closure-stability comment) is unchanged.
+ *
+ * Closes the unwired-OAuth gap — the `createAuthProvider` symbol was exported
+ * by `@comis/agent` but never called by the daemon, so refreshed OAuth tokens
+ * lived only in the in-memory cache and silently disappeared on restart.
+ * `AuthProviderConfig.oauth` credentialStore + logger + dataDir are REQUIRED so
+ * this wiring is type-checked at compile time — future regressions surface as
+ * TS errors, not silent runtime failures.
+ *
+ * @module
+ */
+import { createAuthProvider } from "@comis/agent";
+import { safePath } from "@comis/core";
+// Once-per-daemon-process WARN flag for the encrypted-store hot-reload
+// limitation. Module scope so the flag survives across per-agent
+// setupSingleAgent calls AND any future re-invocations of setupAgents within
+// the same process.
+let encryptedModeWarnFired = false;
+/**
+ * Once-per-daemon WARN for the encrypted-store hot-reload limitation.
+ *
+ * Called from setupAgents() (NOT setupSingleAgent) so the notice fires exactly
+ * once per daemon process — not N times for N agents. Operator sees this in
+ * startup logs without surprise; daemon restart is required to pick up
+ * CLI-written OAuth profiles in encrypted-store mode (file-watch is
+ * unsupported on encrypted SQLite WAL — see `watchPath` below). Lives in this
+ * OAuth leaf (the limitation it describes) since the registry leaf sits at its
+ * per-subdirectory size cap.
+ */
+export function warnEncryptedModeOnce(storageMode, agentLogger) {
+    if (storageMode !== "encrypted" || encryptedModeWarnFired)
+        return;
+    encryptedModeWarnFired = true;
+    agentLogger.warn({
+        hint: "CLI auth login changes require daemon restart in encrypted mode (file-watch unsupported on encrypted SQLite WAL)",
+        errorKind: "config",
+        submodule: "setup-agents",
+    }, "OAuth hot-reload disabled in encrypted-store mode");
+}
+/**
+ * Construct the per-agent OAuth-aware {@link AuthProvider}.
+ *
+ * All path constructions use `safePath` from `@comis/core` (NOT `path.join` —
+ * required by the ESLint security rule). When storage === "encrypted", the
+ * OAuth profile adapter SHARES the existing secretsDb handle (no dual-handle).
+ */
+export function wireAuthProvider(args) {
+    const { agentId, container, scopedManager, oauthCredentialStore, fileLock, dataDirAbs, oauthStorageMode, agentLogger, } = args;
+    const authProvider = createAuthProvider({
+        secretManager: scopedManager,
+        additionalProviderKeys: undefined,
+        oauth: {
+            eventBus: container.eventBus,
+            credentialStore: oauthCredentialStore,
+            logger: agentLogger.child({ submodule: "oauth-token-manager" }),
+            dataDir: dataDirAbs,
+            // Same canonical FileLockPort instance the OAuth credential store
+            // was constructed with — both the file adapter and the token manager
+            // need cross-process serialization on the same .locks/ directory.
+            fileLock,
+            keyPrefix: "OAUTH_",
+            // Pass auth-profiles.json path when file adapter active so
+            // OAuthTokenManager can register the chokidar watcher and pick up
+            // CLI-written profiles within ~250ms without a daemon restart.
+            // Encrypted-mode: undefined -> no watcher; documented limitation.
+            watchPath: oauthStorageMode === "file"
+                ? safePath(dataDirAbs, "auth-profiles.json")
+                : undefined,
+            // Closure-stability: the closure dereferences
+            // container.config.agents[agentId]?.oauthProfiles on every call.
+            // This is the only correct shape because:
+            //   1. The `container.config.agents[agentId] = effectiveConfig`
+            //      writeback in setupSingleAgent stores a NEW object built from
+            //      { ...agentConfig, model, provider } into the daemon's map.
+            //      The local `agentConfig` parameter diverges from the map
+            //      immediately at startup — capturing it would observe the
+            //      wrong value.
+            //   2. agents.update at agent-handlers.ts:341 executes
+            //      `deps.agents[agentId] = parsedConfig`, REPLACING the
+            //      reference at that key with a new validated object. Capturing
+            //      the local agentConfig parameter would miss this hot-update.
+            //   3. daemon.ts confirms `deps.agents` and `container.config.agents`
+            //      are THE SAME map object — search for
+            //      `agents: container.config.agents` in the RpcDispatchDeps
+            //      construction. The daemon holds a single per-process
+            //      Container.config instance.
+            // The map identity is stable; only the value at the agent key
+            // changes. The closure-evaluated dereference observes (1) at
+            // startup AND (2) on every agents.update without an event-bus
+            // invalidation or daemon restart, allowing the agents_manage tool to
+            // update without a daemon restart.
+            getAgentOauthProfiles: () => container.config.agents?.[agentId]?.oauthProfiles,
+        },
+    });
+    // Encrypted-mode cache-invalidation subscription: auth:profile_added fires
+    // from auth-handlers.ts auth.set after a CLI `comis auth login` writes a
+    // new OAuth profile via daemon RPC. The file-mode chokidar watcher already
+    // handles this for file mode (no change to that path). Encrypted mode has
+    // no watcher (watchPath: undefined above), so we subscribe here instead.
+    //
+    // INVARIANT: This subscription is installed exactly ONCE per agentId.
+    // setup-agents-registry calls setupSingleAgent once per agentId at boot;
+    // createHotAdd (daemon.ts) only calls it for NEW agentIds that are not yet
+    // registered. If a future hot-reload path needs to re-invoke setupSingleAgent
+    // for an EXISTING agentId (e.g. a live config update), the old listener MUST
+    // be removed before installing the new one — failure to do so multiplies
+    // listeners on the shared container.eventBus for that authProvider, leaking
+    // references to the discarded instance. The caller must capture the unsubscribe
+    // handle returned by the on() call and call .off() on re-invocation.
+    if (oauthStorageMode === "encrypted") {
+        container.eventBus.on("auth:profile_added", () => {
+            authProvider.oauth?.invalidate();
+        });
+    }
+    agentLogger.debug({
+        agentId,
+        oauthStorage: oauthStorageMode,
+        dataDir: dataDirAbs,
+        submodule: "setup-agents",
+    }, "OAuth credential store + auth provider + per-LLM-call dispatch wired");
+    return authProvider;
+}

package/node_modules/@comis/daemon/dist/wiring/setup-agents/setup-agents-registry.d.ts

@@ -10,11 +10,11 @@
  *
  * @module
  */
-import { type AppContainer, type InjectionRateLimiter, type OAuthCredentialStorePort, type SecretsCrypto, type ToolCapabilityPort } from "@comis/core";
+import { type AppContainer, type InjectionRateLimiter, type OAuthCredentialStorePort, type OAuthTokenManager, type SecretsCrypto, type ToolCapabilityPort } from "@comis/core";
 import type { ComisLogger } from "@comis/infra";
 import type Database from "better-sqlite3";
 import type { SqliteMemoryAdapter, createSessionStore } from "@comis/memory";
-import { createBudgetGuard, createCostTracker, createStepCounter, createSessionLifecycle, type AgentExecutor, type ActiveRunRegistry, type ProviderHealthMonitor } from "@comis/agent";
+import { createBudgetGuard, createCostTracker, createStepCounter, createSessionLifecycle, type AgentExecutor, type ActiveRunRegistry, type AuthStorage, type ProviderHealthMonitor } from "@comis/agent";
 import { type SkillRegistry, type SkillWatcherHandle, type McpClientManager } from "@comis/skills";
 import type { SingleAgentDeps } from "./setup-agents-types.js";
 import type { createComisSessionManager } from "@comis/agent";
@@ -45,12 +45,8 @@ export interface AgentsResult {
     skillWatcherHandles: Map<string, SkillWatcherHandle>;
     /** Per-agent skill registries for skills.list RPC method. */
     skillRegistries: Map<string, SkillRegistry>;
-    /**
-     * Per-agent ToolCapabilityPort instances. Consumed by setupTools via the
-     * getCapabilityPortForAgent closure on ToolsDeps; mutated by hot-add /
-     * hot-remove in daemon.ts to keep the parallel map consistent with
-     * skillRegistries.
-     */
+    /** Per-agent ToolCapabilityPort instances. Consumed by setupTools via the
+     * getCapabilityPortForAgent closure on ToolsDeps; mutated by hot-add / hot-remove in daemon.ts. */
     toolCapabilityPorts: Map<string, ToolCapabilityPort>;
     /** Periodic lock cleanup timer (cleared on shutdown). */
     lockCleanupTimer: import("@comis/core").TimerHandle;
@@ -58,12 +54,23 @@ export interface AgentsResult {
     singleAgentDeps: SingleAgentDeps;
     /** Global provider health monitor for daemon-level health metrics */
     providerHealth: ProviderHealthMonitor;
-    /**
-     * Daemon-level OAuthCredentialStore handle. Threaded into
-     * RpcDispatchDeps so agents.update can validate oauthProfiles patches
-     * via has().
-     */
+    /** Daemon-level OAuthCredentialStore handle. Threaded into RpcDispatchDeps so agents.update
+     * can validate oauthProfiles patches via has(). */
     oauthCredentialStore: OAuthCredentialStorePort;
+    /** Per-agent OAuthTokenManager instances (184) — the SAME managers the executors use (no 2nd
+     * instance). daemon.ts threads the DEFAULT agent's into buildImageGenBundle → the Codex image
+     * adapter (CDX-01). Only OAuth-configured agents appear (setupSingleAgent's `oauth` is undefined). */
+    oauthManagers: Map<string, OAuthTokenManager>;
+    /** FLAG-3: per-agent pi AuthStorage (piAuthStorage) → the memory.ask dialectic OAuth resolver's
+     *  runtime-override target. Mirrors oauthManagers (every agent has one). */
+    authStorages: Map<string, AuthStorage>;
+    /** Session-scoped trajectory recorder registry. Daemon shutdown MUST call `closeAll()` to
+     * flush every open per-session recorder. */
+    trajectoryRegistry: import("@comis/observability").SessionTrajectoryHandleRegistry;
+    /** Per-agent ExecutionPlanHolder reference (read-only port). Surfaced so daemon.ts threads the
+     * DEFAULT agent's holder into ChannelsDeps.executionPlanPort; the same ref flows into
+     * PiExecutorDeps.executionPlanHolder + AcpServerDeps.executionPlanPort (Pitfall 1). */
+    executionPlanPorts: Map<string, import("@comis/core").ExecutionPlanPort>;
 }
 /**
  * Create the full per-agent executor subsystem: session manager, per-agent
@@ -94,12 +101,56 @@ export declare function setupAgents(deps: {
     embeddingQueue?: {
         enqueue(entryId: string, content: string): void;
     };
-    /** Context store for DAG mode context engine */
-    contextStore?: import("@comis/core").ContextStorePort;
-    /** Raw better-sqlite3 database handle for DAG transactions */
-    db?: unknown;
     /** Optional embedding port for discover_tools semantic search. */
     embeddingPort?: import("@comis/core").EmbeddingPort;
+    /** Optional cross-encoder reranker (built in setup-memory only when an agent enables
+     *  rerank). Threaded into each per-agent createPiExecutor like memoryPort. */
+    rerankerPort?: import("@comis/core").RerankerPort;
+    /** Model-present probe result from setup-memory; forwarded into each
+     *  SingleAgentDeps so the per-agent effective rerank precedence consults the SAME
+     *  value as the build gate (Pitfall 4 — one source). */
+    rerankerModelPresent?: boolean;
+    /** Entity-associative store. Threaded into each per-agent createPiExecutor
+     *  like memoryPort (the recall read path). Built in setup-memory on the shared db. */
+    entityStore?: import("@comis/core").MemoryEntityStore;
+    /** LCD lossless context store (Phase 128). Threaded into each per-agent
+     *  createPiExecutor like entityStore — as `contextStore` (the dag-mode assembly
+     *  read path -> context-engine.ts `dag` branch). Built in setup-memory on the
+     *  shared db (`createLcdStore(db)`); injected as the core `ContextStorePort` TYPE
+     *  (agent↛memory cut). Opt-in (`contextEngine.version: "dag"`); default pipeline. */
+    lcdStore?: import("@comis/core").ContextStorePort;
+    /** R1 (132-05): the daemon-owned per-tenant summarizer spend+breaker; threaded
+     *  into each per-agent createPiExecutor -> setupContextEngine (the getSummarizerDeps
+     *  leaf-seam gate). ONE daemon instance, partitions by tenantId. */
+    summarizerSpendBreaker?: import("@comis/agent").SummarizerSpendBreaker;
+    spendAccumulator?: import("@comis/agent").SpendAccumulator;
+    /** Phase 213-08 (BUDGET-01/02): the late-bound per-root budget holder + rootRunId
+     *  resolver, forwarded into each SingleAgentDeps (every bridge holds the SAME
+     *  holder, populated by the cap layer); absent ⇒ the per-root reserve is a no-op. */
+    boundedAutonomyBudget?: import("@comis/agent").BoundedAutonomyBudgetHolder;
+    resolveRootRunId?: (sessionKey: import("@comis/core").SessionKey) => string;
+    /** Temporal-spread store. Threaded into each per-agent createPiExecutor like entityStore (the recall temporal-spread read path). Built in setup-memory on the shared db. */
+    temporalStore?: import("@comis/core").MemoryTemporalStore;
+    /** Causal store. Threaded into each per-agent createPiExecutor like entityStore (the recall 5th causal lane read path). Built in setup-memory on the shared db. */
+    causalStore?: import("@comis/core").MemoryCausalStore;
+    /** Triple store. Threaded into each per-agent createPiExecutor like
+     *  entityStore (the recall 6th graph-spread lane read path). Built in setup-memory on the shared db. */
+    tripleStore?: import("@comis/core").TripleStorePort;
+    /** Embedding read store. Threaded into each per-agent createPiExecutor like
+     *  entityStore (the recall MMR diversity re-rank's scoped embedding read). Built in setup-memory on the shared db. */
+    embeddingStore?: import("@comis/core").MemoryEmbeddingStore;
+    /** Usefulness store. Threaded into each per-agent createPiExecutor like entityStore (the recall usefulness read path). Built in setup-memory on the shared db. */
+    usefulnessStore?: import("@comis/core").MemoryUsefulnessStore;
+    /** Pinned-memory store (the `MemoryPinnedStore` face of `memoryAdapter`). Threaded into
+     *  each per-agent createPiExecutor so the recall pipeline's Step-0 pinned-first lane can fire.
+     *  Without this the lane gate is always false and pinned memories are silently absent from every
+     *  agent response (R6 blocker). The same `SqliteMemoryAdapter` already passed as `memoryPort`
+     *  implements `MemoryPinnedStore`; the daemon supplies it here as the segregated port TYPE.
+     *  Built in setup-memory on the shared db. */
+    pinnedStore?: import("@comis/core").MemoryPinnedStore;
+    provenanceStore?: import("@comis/core").LcdProvenanceReadStore;
+    learnedSkillStore?: import("@comis/core").MentalModelStorePort;
+    learnedSkillSurfaceRegistry?: import("./learned-skill-surface-registry.js").LearnedSkillSurfaceRegistry;
     /** Delivery mirror port for session mirroring injection */
     deliveryMirror?: import("@comis/core").DeliveryMirrorPort;
     /** Delivery mirror config for injection budget */
@@ -116,13 +167,13 @@ export declare function setupAgents(deps: {
     /**
      * SecretsCrypto engine bound to SECRETS_MASTER_KEY. Defined when daemon
      * was started with a valid master key. Required for
-     * `appConfig.oauth.storage === "encrypted"` mode.
+     * `appConfig.security.storage === "encrypted"` mode.
      */
     secretsCrypto?: SecretsCrypto;
     /**
      * Shared better-sqlite3 handle to secrets.db. Plumbed from daemon.ts where
      * createSqliteSecretStore now exposes its db field. Required for
-     * `appConfig.oauth.storage === "encrypted"` mode.
+     * `appConfig.security.storage === "encrypted"` mode.
      */
     secretsDb?: Database.Database;
     /**
@@ -137,5 +188,25 @@ export declare function setupAgents(deps: {
     env: import("@comis/core").EnvPort;
     /** Timer scheduling. */
     timers: import("@comis/core").TimerPort;
+    /**
+     * ObservabilityStore for SystemPromptReport persistence. Forwarded
+     * into SingleAgentDeps and then into createPiExecutor's
+     * `observabilityStore` slot — drives the build+persist block in
+     * prompt-assembly.ts. When undefined (persistence disabled), the
+     * block is a no-op.
+     */
+    obsStore?: import("@comis/memory").ObservabilityStore;
+    /** Ollama served context-window probe result from bootAgents (CWF-03).
+     *  Map from provider config key (e.g. "qwen36-local") to discovered num_ctx.
+     *  Absent → probe not run or all failed; executors fall back to configured window. */
+    servedWindowByProvider?: Map<string, number>;
+    /** KNOB-01/03: daemon-owned collector — one served-vs-configured comparison per
+     *  provider; daemon.ts derives servedBelowConfiguredCount from it at the posture
+     *  write (one comparison, two surfaces — no drift). */
+    servedWindowComparisons?: Map<string, import("@comis/agent").ServedWindowComparison>;
+    /** FLOOR-01: daemon-owned collector of per-agent boot window info (registry-mirrored
+     *  configured window + reconciled effective window + profile) — consumed by the
+     *  daemon's viable-floor loop after setupTools. */
+    agentBootWindowInfo?: Map<string, import("@comis/agent").AgentBootWindowInfo>;
 }): Promise<AgentsResult>;
 export {};