comisai 1.0.41 → 1.0.44

package/node_modules/@comis/agent/dist/spawn/index.d.ts

@@ -17,4 +17,8 @@ export type { LifecycleHooksDeps } from "./lifecycle-hooks.js";
 export { createEphemeralComisSessionManager } from "./pi-mono-adapters.js";
 export { createSubAgentRunner, ANNOUNCE_PARENT_TIMEOUT_MS } from "./sub-agent-runner.js";
 export type { SubAgentRunnerDeps, SubAgentRun, SpawnParams, SubAgentRunnerLogger } from "./sub-agent-runner.js";
-export { sweepResultFiles, buildAnnouncementMessage, deliverFailureNotification } from "./sub-agent-result-processor.js";
+export { sweepResultFiles, buildAnnouncementMessage, deliverFailureNotification, classifyErrorContext } from "./sub-agent-result-processor.js";
+export { createDeliveryDedup } from "./announce-key.js";
+export type { DeliveryDedup } from "./announce-key.js";
+export { comparePosture, resolvePostureFromSkills } from "./sandbox-posture.js";
+export type { SandboxPosture, PostureDimension, PostureComparison, SkillsPostureSlice, } from "./sandbox-posture.js";

package/node_modules/@comis/agent/dist/spawn/index.js

@@ -12,4 +12,14 @@ export { createNarrativeCaster } from "./narrative-caster.js";
 export { createLifecycleHooks, deriveSubagentContextEngineConfig } from "./lifecycle-hooks.js";
 export { createEphemeralComisSessionManager } from "./pi-mono-adapters.js";
 export { createSubAgentRunner, ANNOUNCE_PARENT_TIMEOUT_MS } from "./sub-agent-runner.js";
-export { sweepResultFiles, buildAnnouncementMessage, deliverFailureNotification } from "./sub-agent-result-processor.js";
+export { sweepResultFiles, buildAnnouncementMessage, deliverFailureNotification, classifyErrorContext } from "./sub-agent-result-processor.js";
+// createDeliveryDedup + DeliveryDedup cross the package boundary (the orchestrator
+// batcher + daemon wiring share one bounded delivered-key store). buildAnnounceKey
+// and MAX_DELIVERED_KEYS stay agent-internal (used only within spawn/ + the agent's
+// own tests via relative import) — not re-exported, to avoid a dead public export.
+export { createDeliveryDedup } from "./announce-key.js";
+// Pure sandbox-posture primitive (SANDBOX-01). The comparator + resolver are a
+// @comis/agent leaf; the daemon wiring (Plan 02) injects a resolver closure over
+// container.config.agents into the sub-agent runner, so the TYPE + comparator must
+// cross the package boundary here.
+export { comparePosture, resolvePostureFromSkills } from "./sandbox-posture.js";

package/node_modules/@comis/agent/dist/spawn/narrative-caster.d.ts

@@ -10,7 +10,7 @@
  *
  * @module
  */
-import type { CondensedResult } from "@comis/core";
+import type { CondensedResult, ResultRef } from "@comis/core";
 /** Configuration for the NarrativeCaster factory. */
 export interface NarrativeCasterConfig {
     /** Whether narrative casting is enabled (config.narrativeCasting). */
@@ -33,6 +33,15 @@ export interface CastParams {
     cost: number;
     /** Sub-agent session key for reference. */
     sessionKey: string;
+    /**
+     * Phase 218 (SUMREF-02): the child's full output materialized to its jailed
+     * workspace as a structured handle. When present, the "Full result" line
+     * becomes the drill-in handle (ref + bytes + kind) the lead queries on demand
+     * (read/grep/jq), instead of the bare condenser diskPath — so the lead's
+     * window grows by a summary + a handle, never the megabyte body. Absent ⇒ the
+     * line falls back to `condensedResult.diskPath` (today's behavior).
+     */
+    resultRef?: ResultRef;
 }
 /**
  * Trailing instruction appended to every announcement.

package/node_modules/@comis/agent/dist/spawn/narrative-caster.js

@@ -69,10 +69,27 @@ function truncateLabel(text) {
     return clean.slice(0, MAX_LABEL_LENGTH - 3) + "...";
 }
 // ---------------------------------------------------------------------------
+// Full-result drill-in line (SUMREF-02)
+// ---------------------------------------------------------------------------
+/**
+ * The "Full result" announcement line. When a materialized {@link ResultRef}
+ * handle is present, the lead drills into it on demand (read/grep/jq) so only a
+ * summary + a handle enter its window (the longevity invariant); otherwise the
+ * bare condenser `diskPath` is used (today's behavior — no store/handle, so the
+ * on-disk condensed result IS the pointer). Kept byte-aligned with the runner's
+ * buildAnnouncementMessage body so both announcement paths agree.
+ */
+function formatFullResultLine(diskPath, resultRef) {
+    if (resultRef) {
+        return `Full result (drill in with read/grep/jq): ${resultRef.ref} (${resultRef.bytes}B, ${resultRef.kind})`;
+    }
+    return `Full result: ${diskPath}`;
+}
+// ---------------------------------------------------------------------------
 // Tagged result format (enabled mode)
 // ---------------------------------------------------------------------------
 function formatTaggedResult(params, tagPrefix) {
-    const { condensedResult, task, runtimeMs, stepsExecuted, tokensUsed, cost, sessionKey } = params;
+    const { condensedResult, task, runtimeMs, stepsExecuted, tokensUsed, cost, sessionKey, resultRef } = params;
     const label = truncateLabel(params.label ?? task);
     const result = condensedResult.result;
     const sections = [];
@@ -131,8 +148,9 @@ function formatTaggedResult(params, tagPrefix) {
     sections.push(`Condensation: Level ${condensedResult.level} | ` +
         `Original: ${condensedResult.originalTokens} tokens | ` +
         `Ratio: ${condensedResult.compressionRatio.toFixed(2)}`);
-    // 12. Full result disk path
-    sections.push(`Full result: ${condensedResult.diskPath}`);
+    // 12. Full result drill-in (the structured ResultRef handle when present —
+    // SUMREF-02 — else the condenser diskPath).
+    sections.push(formatFullResultLine(condensedResult.diskPath, resultRef));
     // 13. Session line
     sections.push(`Session: ${sessionKey}`);
     // 14. Trailing instruction
@@ -144,7 +162,7 @@ function formatTaggedResult(params, tagPrefix) {
 // Untagged result format (disabled mode fallback)
 // ---------------------------------------------------------------------------
 function formatUntaggedResult(params) {
-    const { condensedResult, task, runtimeMs, stepsExecuted, tokensUsed, cost, sessionKey } = params;
+    const { condensedResult, task, runtimeMs, stepsExecuted, tokensUsed, cost, sessionKey, resultRef } = params;
     const result = condensedResult.result;
     return [
         `[System Message]`,
@@ -156,7 +174,7 @@ function formatUntaggedResult(params) {
         ``,
         `---`,
         `Runtime: ${(runtimeMs / 1000).toFixed(1)}s | Steps: ${stepsExecuted} | Tokens: ${tokensUsed} | Cost: $${cost.toFixed(4)} | Session: ${sessionKey}`,
-        `Full result: ${condensedResult.diskPath}`,
+        formatFullResultLine(condensedResult.diskPath, resultRef),
         ``,
         TRAILING_INSTRUCTION,
     ].join("\n");

package/node_modules/@comis/agent/dist/spawn/result-condenser.js

@@ -23,7 +23,7 @@
 /* eslint-disable @typescript-eslint/no-explicit-any */
 import { generateSummary, truncateHead, truncateTail } from "@earendil-works/pi-coding-agent";
 import { SubagentResultSchema } from "@comis/core";
-import { safePath, systemNowMs, systemNowDate } from "@comis/core";
+import { safePath, scriptTokenFactor, systemNowMs, systemNowDate, scrubSecretsFromText } from "@comis/core";
 import { mkdir, writeFile } from "node:fs/promises";
 import { dirname } from "node:path";
 import { CHARS_PER_TOKEN } from "../safety/token-estimator.js";
@@ -79,7 +79,30 @@ export function createResultCondenser(deps) {
 // Internal pipeline
 // ---------------------------------------------------------------------------
 async function condenseInternal(params, deps) {
-    const { fullResult, task, runId, sessionKey, agentId } = params;
+    const { task, runId, sessionKey, agentId } = params;
+    // Scrub before condense, relay, and persist — one pass, pre-filter inside.
+    // This single reassignment ensures wrapAsSubagentResult, persistFullResult,
+    // and all downstream uses receive scrubbed text.
+    const relayScrub = scrubSecretsFromText(params.fullResult);
+    let fullResult = params.fullResult;
+    if (relayScrub.redactions > 0) {
+        deps.logger.warn({ runId, agentId, redactions: relayScrub.redactions,
+            hint: "Secret found in sub-agent full result — redacted before relay and persist",
+            errorKind: "internal" }, "egress guard: sub-agent result scrubbed");
+        fullResult = relayScrub.text;
+        // Secure handoff: signal to the parent agent that a credential was
+        // redacted and is now in the secure credential store — instruct it NOT to
+        // re-use the raw token from this result.
+        //
+        // NOTE: The MCP server name is NOT available at condenseInternal (CondenseParams
+        // has no serverName field). An actionable `mcp-oauth:<serverName>` ${ref} is
+        // therefore deferred — threading serverName here requires invasive cross-package
+        // CondenseParams API changes. Generic advisory only.
+        fullResult +=
+            "\n\n[Credential redacted and stored in the secure credential store. " +
+                "Retrieve via the OAuth store profileId or use `comis auth profile get` — " +
+                "do NOT attempt to re-use the raw token from this result.]";
+    }
     const originalTokens = estimateTokens(fullResult);
     // Compute disk path eagerly.
     // Simplified directory naming for new runs: {tenantId}/{runId}.json
@@ -137,7 +160,7 @@ async function condenseInternal(params, deps) {
         deps.logger.debug({ runId, agentId, originalTokens, condensedTokens, level }, "Result condenser: Level 3 truncation (no model)");
     }
     // Persist full result to disk -- always, regardless of level.
-    // Thread metadata for offline analysis (Findings 17, 20).
+    // Thread metadata for offline analysis.
     const persistMetadata = {
         parentTraceId: params.parentTraceId,
         graphId: params.graphId,
@@ -162,7 +185,10 @@ async function condenseInternal(params, deps) {
 // Token estimation
 // ---------------------------------------------------------------------------
 function estimateTokens(text) {
-    return Math.ceil(text.length / CHARS_PER_TOKEN);
+    // Script-factored (TOK-01): sub-agent results can be non-Latin (GEN-03 /
+    // Phase 181 increases this) — honest condensation thresholds are the
+    // conservative direction.
+    return Math.ceil(text.length / (CHARS_PER_TOKEN * scriptTokenFactor(text)));
 }
 // ---------------------------------------------------------------------------
 // Level 1 / Level 3 helper: wrap raw text as SubagentResult
@@ -284,7 +310,15 @@ Output ONLY the JSON object, no markdown fencing, no explanation.`;
 // Level 3: Head+tail truncation
 // ---------------------------------------------------------------------------
 function headTailTruncate(fullResult, maxTokens, task) {
-    const budget = maxTokens * CHARS_PER_TOKEN;
+    // Review WR-02: factor the char budget by the same script factor this
+    // module's estimateTokens divides by. tokens->chars is the OUTPUT direction
+    // here — a flat maxTokens*4 budget over-emits dense scripts ~2x past
+    // maxResultTokens under the module's own (factored) measure, the inverse
+    // of the conservative tokens->chars reservation sites. The full result's
+    // factor approximates the head+tail slices' factor (strictly conservative
+    // for the budget direction); ASCII factor 1.0 keeps the budget
+    // byte-identical (I1).
+    const budget = Math.floor(maxTokens * CHARS_PER_TOKEN * scriptTokenFactor(fullResult));
     const headBudget = Math.floor(budget * HEAD_RATIO);
     const tailBudget = Math.floor(budget * TAIL_RATIO);
     const head = truncateHead(fullResult, { maxBytes: headBudget });
@@ -319,7 +353,9 @@ async function persistFullResult(diskPath, runId, sessionKey, task, fullResult,
     const cappedResult = fullResult.length > DISK_WRITE_HARD_CAP_CHARS
         ? fullResult.slice(0, DISK_WRITE_HARD_CAP_CHARS)
         : fullResult;
+    // fs-safe-allowed: diskPath is per-spawn full-result drop dir, caller-supplied (sub-agent disk overflow); not under ~/.comis/ directly
     await mkdir(dirname(diskPath), { recursive: true });
+    // fs-safe-allowed: caller-supplied diskPath (spawn-result disk-spill); not under ~/.comis/ directly
     await writeFile(diskPath, JSON.stringify({
         runId,
         sessionKey,
@@ -327,13 +363,13 @@ async function persistFullResult(diskPath, runId, sessionKey, task, fullResult,
         fullResult: cappedResult,
         condensationLevel: level,
         persistedAt: systemNowDate().toISOString(),
-        // Finding 20: Parent trace correlation
+        // Parent trace correlation
         ...(metadata?.parentTraceId ? { parentTraceId: metadata.parentTraceId } : {}),
         ...(metadata?.graphId ? { graphId: metadata.graphId } : {}),
         ...(metadata?.nodeId ? { nodeId: metadata.nodeId } : {}),
-        // Finding 17: Tool metadata for offline analysis
+        // Tool metadata for offline analysis
         ...(metadata?.toolMetadata ? { toolMetadata: metadata.toolMetadata } : {}),
-        // Finding 20: Token/cost usage breakdown
+        // Token/cost usage breakdown
         ...(metadata?.usage ? { usage: metadata.usage } : {}),
         // Error context for non-successful executions
         ...(metadata?.errorContext ? { errorContext: metadata.errorContext } : {}),

package/node_modules/@comis/agent/dist/spawn/sandbox-posture.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Pure sandbox-posture primitive (SANDBOX-01).
+ *
+ * One tested source of truth for the partial-order confinement semantics used
+ * by the sub-agent spawn no-downgrade invariant (P0-C): a spawned child must
+ * never be *less* confined than its spawner. This module is the dependency-free
+ * foundation — no I/O, no event bus, no full daemon-config import. It is a
+ * `@comis/agent` leaf so the daemon wiring can later INJECT a resolver into the
+ * sub-agent runner (Plan 02) without inverting the dependency direction.
+ *
+ * ## The 4 config-derived dimensions (strict → loose)
+ * Each dimension's enum labels are the EXACT operator-config strings from
+ * `@comis/core` `schema-skills.ts` — never invented here:
+ * - **exec** (`ExecSandboxSchema.enabled`, schema-skills.ts:90): `always` (sandbox
+ *   wraps the command — MORE confined) > `never` (unsandboxed — LESS confined).
+ * - **filesystem** (`TerminalAllowEntrySchema.scope.filesystem`, schema-skills.ts:145):
+ *   `workspace` > `listed-paths` > `home` > `full`.
+ * - **network** (`...scope.network`, schema-skills.ts:147): `none` > `listed-hosts` > `full`.
+ * - **uid** (`...scope.uid`, schema-skills.ts:150): `dedicated` > `daemon`.
+ *
+ * Higher rank = more confined. A child is a DOWNGRADE (refuse) iff it is strictly
+ * LESS confined than the parent on ANY single dimension (a partial order, not a
+ * total one): the child can tighten one dimension and loosen another and still be
+ * a downgrade.
+ *
+ * ## Design-vs-config reconciliation (ROADMAP success-criterion 1)
+ * The design doc (§5 P0-C) and ROADMAP criterion-1 describe a `broker-only > open`
+ * exec-network dimension and a "sandboxed (broker-only) parent → open child"
+ * example. **That dimension does NOT exist as operator config.**
+ * `broker-only`/`open`/`none` are RUNTIME sandbox network *modes* derived at spawn
+ * time (`packages/skills/src/tools/builtin/sandbox/types.ts:36`), not a Zod config
+ * field; the config-level exec sandbox is ONLY `enabled: always|never`. The
+ * criterion-1 "broker-only parent → open child refused" therefore maps to the real
+ * config model as: **a more-confined parent (e.g. exec `always`) spawning a
+ * less-confined child (exec `never`) is refused.** We deliberately do NOT model the
+ * bogus `broker-only > open` config dimension — it would be unverifiable. If a
+ * future "exec network mode" config field is added, the comparator extends
+ * additively via a new rank map.
+ *
+ * ## Missing-field-safe-default (threat T-172-01)
+ * A missing/absent field on ANY dimension resolves to the MOST-confined enum
+ * (highest rank) BEFORE comparison — a posture is NEVER inferred more permissive
+ * than reality, so a config gap cannot silently open a downgrade.
+ *
+ * @module
+ */
+/**
+ * A resolved sandbox posture across the 4 config-derived confinement dimensions.
+ *
+ * For the sub-agent spawn path, **exec is the active dimension** today;
+ * `filesystem`/`network`/`uid` are present in the type so the comparator composes
+ * when the deferred terminal-posture path lands (A1), but they resolve to their
+ * most-confined default when absent (see {@link comparePosture}). The sub-agent
+ * resolver ({@link resolvePostureFromSkills}) leaves them unset in P0-C scope.
+ */
+export interface SandboxPosture {
+    /** Exec sandbox enablement. `always` = sandbox wraps the command (more confined). */
+    exec: "always" | "never";
+    /** Filesystem reach. Absent ⇒ `workspace` (strictest). */
+    filesystem?: "workspace" | "listed-paths" | "home" | "full";
+    /** Network reach. Absent ⇒ `none` (strictest). */
+    network?: "none" | "listed-hosts" | "full";
+    /** Process uid. Absent ⇒ `dedicated` (strictest). */
+    uid?: "dedicated" | "daemon";
+}
+/** The four confinement dimensions the comparator ranks. */
+export type PostureDimension = "exec" | "filesystem" | "network" | "uid";
+/** Result of comparing a parent posture against a prospective child posture. */
+export interface PostureComparison {
+    /** `true` ⇒ the child is LESS confined on ≥1 dimension ⇒ refuse the spawn. */
+    isDowngrade: boolean;
+    /** The dimension(s) on which the child was strictly less confined (enum labels). */
+    violatedDimensions: PostureDimension[];
+}
+/**
+ * Compare a parent posture against a prospective child posture.
+ *
+ * Returns {@link PostureComparison.isDowngrade} = `true` (and the violating
+ * dimension names) iff the child is strictly LESS confined than the parent on
+ * ANY single dimension. Equal posture and a more-confined (upgrade) child both
+ * compare as allowed. Absent fields on either side fold to the most-confined
+ * value before comparison (T-172-01).
+ *
+ * Pure: no I/O, no config import, deterministic for a given input pair.
+ */
+export declare function comparePosture(parent: SandboxPosture, child: SandboxPosture): PostureComparison;
+/**
+ * The minimal structural slice of an agent's skills config this resolver reads.
+ *
+ * Declared inline (NOT imported from the full daemon config) so this module
+ * stays a `@comis/agent` leaf: Plan 02's daemon wiring injects a resolver closure
+ * built over the per-agent skills config it holds, which structurally satisfies
+ * this shape. Only `execSandbox.enabled` is consumed in P0-C scope.
+ */
+export interface SkillsPostureSlice {
+    execSandbox?: {
+        enabled?: "always" | "never";
+    };
+}
+/**
+ * Fold an agent's skills config slice into a {@link SandboxPosture}.
+ *
+ * P0-C scope (A1): only the **exec** dimension is populated, from
+ * `skills.execSandbox.enabled`. An absent slice or absent `enabled` resolves to
+ * `"always"` — the most-confined default, matching the schema default
+ * (`ExecSandboxSchema.enabled.default("always")`). The `filesystem`/`network`/`uid`
+ * dimensions are deliberately left UNSET: they are reserved for the future
+ * terminal-posture wiring (the deferred terminal-driver path) and fold to their
+ * most-confined value in {@link comparePosture}, so the comparator treats this
+ * resolver's output as fully confined on the inert dimensions.
+ *
+ * Pure: no I/O, no config import beyond the structural {@link SkillsPostureSlice}.
+ */
+export declare function resolvePostureFromSkills(skills: SkillsPostureSlice | undefined): SandboxPosture;

package/node_modules/@comis/agent/dist/spawn/sandbox-posture.js

@@ -0,0 +1,167 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Pure sandbox-posture primitive (SANDBOX-01).
+ *
+ * One tested source of truth for the partial-order confinement semantics used
+ * by the sub-agent spawn no-downgrade invariant (P0-C): a spawned child must
+ * never be *less* confined than its spawner. This module is the dependency-free
+ * foundation — no I/O, no event bus, no full daemon-config import. It is a
+ * `@comis/agent` leaf so the daemon wiring can later INJECT a resolver into the
+ * sub-agent runner (Plan 02) without inverting the dependency direction.
+ *
+ * ## The 4 config-derived dimensions (strict → loose)
+ * Each dimension's enum labels are the EXACT operator-config strings from
+ * `@comis/core` `schema-skills.ts` — never invented here:
+ * - **exec** (`ExecSandboxSchema.enabled`, schema-skills.ts:90): `always` (sandbox
+ *   wraps the command — MORE confined) > `never` (unsandboxed — LESS confined).
+ * - **filesystem** (`TerminalAllowEntrySchema.scope.filesystem`, schema-skills.ts:145):
+ *   `workspace` > `listed-paths` > `home` > `full`.
+ * - **network** (`...scope.network`, schema-skills.ts:147): `none` > `listed-hosts` > `full`.
+ * - **uid** (`...scope.uid`, schema-skills.ts:150): `dedicated` > `daemon`.
+ *
+ * Higher rank = more confined. A child is a DOWNGRADE (refuse) iff it is strictly
+ * LESS confined than the parent on ANY single dimension (a partial order, not a
+ * total one): the child can tighten one dimension and loosen another and still be
+ * a downgrade.
+ *
+ * ## Design-vs-config reconciliation (ROADMAP success-criterion 1)
+ * The design doc (§5 P0-C) and ROADMAP criterion-1 describe a `broker-only > open`
+ * exec-network dimension and a "sandboxed (broker-only) parent → open child"
+ * example. **That dimension does NOT exist as operator config.**
+ * `broker-only`/`open`/`none` are RUNTIME sandbox network *modes* derived at spawn
+ * time (`packages/skills/src/tools/builtin/sandbox/types.ts:36`), not a Zod config
+ * field; the config-level exec sandbox is ONLY `enabled: always|never`. The
+ * criterion-1 "broker-only parent → open child refused" therefore maps to the real
+ * config model as: **a more-confined parent (e.g. exec `always`) spawning a
+ * less-confined child (exec `never`) is refused.** We deliberately do NOT model the
+ * bogus `broker-only > open` config dimension — it would be unverifiable. If a
+ * future "exec network mode" config field is added, the comparator extends
+ * additively via a new rank map.
+ *
+ * ## Missing-field-safe-default (threat T-172-01)
+ * A missing/absent field on ANY dimension resolves to the MOST-confined enum
+ * (highest rank) BEFORE comparison — a posture is NEVER inferred more permissive
+ * than reality, so a config gap cannot silently open a downgrade.
+ *
+ * @module
+ */
+// ---------------------------------------------------------------------------
+// Rank maps (strict → loose). Higher rank = MORE confined.
+//
+// The FIRST key in each map is the most-confined enum, which is also the
+// safe default used when a dimension is absent (missing-field-safe-default).
+// ---------------------------------------------------------------------------
+// `Map` lookups (not object indexing) avoid the `detect-object-injection` sink
+// while keeping the key set closed to each dimension's enum literals. The first
+// entry in each map is the most-confined enum — also the safe default an absent
+// field folds to in rankOf().
+const EXEC_RANK = new Map([
+    ["always", 1],
+    ["never", 0],
+]);
+const FILESYSTEM_RANK = new Map([
+    ["workspace", 3],
+    ["listed-paths", 2],
+    ["home", 1],
+    ["full", 0],
+]);
+const NETWORK_RANK = new Map([
+    ["none", 2],
+    ["listed-hosts", 1],
+    ["full", 0],
+]);
+const UID_RANK = new Map([
+    ["dedicated", 1],
+    ["daemon", 0],
+]);
+const DIMENSIONS = [
+    "exec",
+    "filesystem",
+    "network",
+    "uid",
+];
+// Most-confined rank per dimension — the value an absent field folds to BEFORE
+// ranking AND the fail-closed fallback for a present-but-unknown enum value. The
+// pre-map `?? <most-confined>` already guarantees a valid key for the only field
+// the validated config path can leave undefined, so the trailing `?? MOST_CONFINED`
+// is defensive: it only fires if a caller hand-builds a SandboxPosture with an
+// out-of-union value, bypassing Zod (schema-skills.ts enums). When it does fire it
+// must rank MOST-confined (not 0 = least), so an unexpected value fails CLOSED — a
+// child carrying it looks confined/safe; a parent carrying it makes a looser child
+// a downgrade — never the reverse.
+const EXEC_MOST_CONFINED = 1; // "always"
+const FILESYSTEM_MOST_CONFINED = 3; // "workspace"
+const NETWORK_MOST_CONFINED = 2; // "none"
+const UID_MOST_CONFINED = 1; // "dedicated"
+/**
+ * Rank a single dimension of a posture, folding an absent field to the
+ * most-confined value (highest rank) BEFORE ranking. This is the load-bearing
+ * safe default (T-172-01): a missing field is never read as more permissive than
+ * reality. The pre-map `?? <most-confined>` IS the safe default for an absent
+ * field; the trailing `?? <most-confined>` is the fail-closed fallback for a
+ * present-but-unknown enum value (unreachable via the Zod-validated config path,
+ * but if a caller hand-builds a posture it must still fail CLOSED — IN-01).
+ */
+function rankOf(posture, dimension) {
+    switch (dimension) {
+        case "exec":
+            return EXEC_RANK.get(posture.exec) ?? EXEC_MOST_CONFINED;
+        case "filesystem":
+            return (FILESYSTEM_RANK.get(posture.filesystem ?? "workspace") ??
+                FILESYSTEM_MOST_CONFINED);
+        case "network":
+            return (NETWORK_RANK.get(posture.network ?? "none") ?? NETWORK_MOST_CONFINED);
+        case "uid":
+            return UID_RANK.get(posture.uid ?? "dedicated") ?? UID_MOST_CONFINED;
+        default: {
+            const _exhaustive = dimension;
+            return _exhaustive;
+        }
+    }
+}
+/**
+ * Compare a parent posture against a prospective child posture.
+ *
+ * Returns {@link PostureComparison.isDowngrade} = `true` (and the violating
+ * dimension names) iff the child is strictly LESS confined than the parent on
+ * ANY single dimension. Equal posture and a more-confined (upgrade) child both
+ * compare as allowed. Absent fields on either side fold to the most-confined
+ * value before comparison (T-172-01).
+ *
+ * Pure: no I/O, no config import, deterministic for a given input pair.
+ */
+export function comparePosture(parent, child) {
+    const violatedDimensions = [];
+    for (const dimension of DIMENSIONS) {
+        const parentRank = rankOf(parent, dimension);
+        const childRank = rankOf(child, dimension);
+        // Lower child rank = less confined than the parent on this dimension = downgrade.
+        if (childRank < parentRank) {
+            violatedDimensions.push(dimension);
+        }
+    }
+    return {
+        isDowngrade: violatedDimensions.length > 0,
+        violatedDimensions,
+    };
+}
+/**
+ * Fold an agent's skills config slice into a {@link SandboxPosture}.
+ *
+ * P0-C scope (A1): only the **exec** dimension is populated, from
+ * `skills.execSandbox.enabled`. An absent slice or absent `enabled` resolves to
+ * `"always"` — the most-confined default, matching the schema default
+ * (`ExecSandboxSchema.enabled.default("always")`). The `filesystem`/`network`/`uid`
+ * dimensions are deliberately left UNSET: they are reserved for the future
+ * terminal-posture wiring (the deferred terminal-driver path) and fold to their
+ * most-confined value in {@link comparePosture}, so the comparator treats this
+ * resolver's output as fully confined on the inert dimensions.
+ *
+ * Pure: no I/O, no config import beyond the structural {@link SkillsPostureSlice}.
+ */
+export function resolvePostureFromSkills(skills) {
+    return {
+        exec: skills?.execSandbox?.enabled ?? "always",
+        // filesystem / network / uid intentionally unset (present-but-inert, A1).
+    };
+}

package/node_modules/@comis/agent/dist/spawn/spawn-packet-builder.d.ts

@@ -27,6 +27,8 @@ export interface SpawnPacketBuildParams {
     toolGroups?: string[];
     includeParentHistory?: "none" | "summary";
     domainKnowledge?: string[];
+    /** Inherited conversation language (DET-02 tag); omitted from the packet when undefined. */
+    language?: string;
 }
 /**
  * Create a SpawnPacketBuilder bound to parent context deps.

package/node_modules/@comis/agent/dist/spawn/spawn-packet-builder.js

@@ -32,6 +32,7 @@ export function createSpawnPacketBuilder(deps) {
                 depth: deps.currentDepth,
                 maxDepth: deps.maxSpawnDepth,
                 agentWorkspaces: deps.agentWorkspaces,
+                ...(params.language !== undefined ? { language: params.language } : {}),
                 // parentSummary intentionally left undefined; populated by executeSubAgent
             };
         },

package/node_modules/@comis/agent/dist/spawn/steer-run.d.ts

@@ -0,0 +1,105 @@
+import type { RunHandle } from "../executor/active-run-registry.js";
+/** Minimal pino-compatible logger (mirrors SubAgentRunnerLogger). */
+interface SteerRunLogger {
+    info(obj: Record<string, unknown>, msg: string): void;
+    warn(obj: Record<string, unknown>, msg: string): void;
+    error(obj: Record<string, unknown>, msg: string): void;
+    debug(obj: Record<string, unknown>, msg: string): void;
+}
+/**
+ * The minimal slice of a SubAgentRun this helper reads. Declared locally (NOT
+ * imported from sub-agent-runner.ts) so the dependency stays one-directional
+ * (runner → helper); importing the runner's `SubAgentRun` type here would form
+ * a sub-agent-runner ↔ steer-run source-level cycle (no-cycles.test.ts counts
+ * type-only imports). The runner's full SubAgentRun is structurally assignable
+ * to this shape, so `runs: Map<string, SubAgentRun>` flows in unchanged.
+ */
+export interface SteerableRun {
+    runId: string;
+    agentId: string;
+    sessionKey: string;
+    announceChannelType?: string;
+    announceChannelId?: string;
+}
+/**
+ * Composite key for the resolver lookup. MUST compose, via
+ * `BackgroundSessionResolver.formatComposite`, to the EXACT key the executor
+ * registers the live handle under (pi-executor.ts:1152-1156):
+ *
+ *   formatSessionKey({ tenantId: agentId ?? "default",
+ *                      channelId: `${originChannelType}:${msg.channelId}`,
+ *                      userId: msg.channelId })
+ *
+ * where for a sub-agent run `originChannelType = deliveryOrigin?.channelType ??
+ * channelType ?? "gateway"` and `msg.channelId = subSessionKey.channelId` (the
+ * executor ALWAYS receives subSessionKey — sub-agent-runner.ts:1289). So:
+ *   - channelType → run.announceChannelType ?? "gateway"  (the executor's
+ *     originChannelType: announce runs propagate announceChannelType into ALS as
+ *     deliveryOrigin; no-announce runs fall back to "gateway")
+ *   - channelId   → the PARSED sub-session channelId (NOT run.announceChannelId
+ *     — the executor never keys on the announce channelId; it keys on
+ *     subSessionKey.channelId)
+ *
+ * WR-01 (175-REVIEW.md): the prior formula used `"sub-agent"` for channelType
+ * and `run.announceChannelId ?? parsed?.channelId` for channelId, which DIVERGED
+ * from the registration key and made `steerRun` return `{steered:false}` for a
+ * genuinely-running sub-agent (and made the kill/ghost/watchdog abort lookups
+ * silently miss — best-effort there, so latent, but fatal for steer). Mirror the
+ * IDENTICAL formula in sub-agent-runner.ts:`deriveCompositeForRun`; the 175-00
+ * spike (sub-agent-runner.steer-resolve.spike.test.ts) fails loudly on drift.
+ */
+declare function deriveCompositeForRun(run: SteerableRun): {
+    agentId: string;
+    channelType: string;
+    channelId: string;
+};
+/**
+ * Test-only alias for the module-private {@link deriveCompositeForRun}. The
+ * 175-00 A1 spike (sub-agent-runner.steer-resolve.spike.test.ts) imports the
+ * REAL formula so a drift between it and the executor registration key
+ * (pi-executor.ts:1152-1156) fails loudly — NOT a reconstructed replica
+ * (WR-01 correction: the old inline replica made the drift guard a tautology).
+ * @internal
+ */
+export declare const deriveCompositeForRunForTest: typeof deriveCompositeForRun;
+/**
+ * Dependencies for {@link steerRun}. The resolver/registry are typed to the
+ * FULL RunHandle (unlike the runner's narrowed `{abort()}` deps — see the L2
+ * note in the module header).
+ */
+export interface SteerRunDeps {
+    /** READ only — never mutated (no status change, no spawn). */
+    runs: Map<string, SteerableRun>;
+    /** Composite-key resolver (the A1-chosen lookup, mirrors killRun). */
+    sessionResolver?: {
+        resolveActiveSession(key: {
+            agentId: string;
+            channelType: string;
+            channelId: string;
+        }): RunHandle | undefined;
+    };
+    /** By-sessionKey fallback (175-00 documented; composite resolves today). */
+    activeRunRegistry?: {
+        get(sessionKey: string): RunHandle | undefined;
+    };
+    logger?: SteerRunLogger;
+}
+/** Result of an inject attempt (Result-shaped, mirrors killRun). */
+export interface SteerRunResult {
+    steered: boolean;
+    /** Which SDK primitive landed the inject (for the subagent:steered event). */
+    mode?: "steer" | "followup";
+    /** Set when no live handle / not running — the WARN-able failure branch. */
+    error?: string;
+}
+/**
+ * Inject a steer message into the running child's live SDK session.
+ *
+ * @param deps - run map + resolver/registry lookups + logger
+ * @param runId - the target run id
+ * @param message - the steer message text (agent-supplied; NEVER logged here)
+ * @returns `{steered:true, mode}` on success; `{steered:false, error}` when the
+ *   run is unknown or has no live session (the caller throws on `!steered`).
+ */
+export declare function steerRun(deps: SteerRunDeps, runId: string, message: string): Promise<SteerRunResult>;
+export {};