comisai 1.0.42 → 1.0.44

package/node_modules/@comis/core/dist/security/credential-classify.js

@@ -0,0 +1,47 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Header-credential classifier — the keystone's typed view of a single
+ * `(headerName, value)` credential. Consumed by the credential-extraction
+ * lifecycle.
+ *
+ *   - "ref"           — a store-backed reference: an `${VAR}`/`$VAR`/`$${VAR}`
+ *                       string (optionally scheme/quote-wrapped) OR a SecretRef
+ *                       object. Already externalized — nothing to extract.
+ *   - "oauth-bearer"  — a `Bearer `-scheme value wrapping a secret-looking
+ *                       remainder (an OAuth/PAT bearer token pasted inline).
+ *   - "static-secret" — a raw secret value with no auth scheme.
+ *
+ * Reuses the canonical env-substitution patterns (no re-authored ref regexes)
+ * and the keystone `looksLikeSecretValue` heuristic.
+ *
+ * @module
+ */
+import { isSecretRef } from "../domain/secret-ref.js";
+import { looksLikeSecretValue, isEnvRefString } from "./secret-detection.js";
+const BEARER_SCHEME_RE = /^Bearer\s+/i;
+/**
+ * Classify a header credential by `(name, value)`.
+ *
+ * Precedence: SecretRef object → ref; env-ref string → ref; Bearer-scheme
+ * value → oauth-bearer; otherwise → static-secret.
+ */
+export function classifyHeaderCredential(_name, value) {
+    if (isSecretRef(value)) {
+        return { kind: "ref" };
+    }
+    if (typeof value === "string") {
+        if (isEnvRefString(value)) {
+            return { kind: "ref" };
+        }
+        const trimmed = value.trim();
+        // A Bearer-scheme value wrapping a secret-looking remainder is an inline
+        // OAuth/PAT bearer token. looksLikeSecretValue strips the scheme internally,
+        // so it sees the remainder.
+        if (BEARER_SCHEME_RE.test(trimmed) && looksLikeSecretValue(trimmed)) {
+            return { kind: "oauth-bearer" };
+        }
+        return { kind: "static-secret" };
+    }
+    // A present, non-ref, non-string credential value — treat as a static secret.
+    return { kind: "static-secret" };
+}

package/node_modules/@comis/core/dist/security/external-content.d.ts

@@ -15,7 +15,7 @@ export declare function detectSuspiciousPatterns(content: string): string[];
  * Security warning prepended to external content.
  */
 export declare const EXTERNAL_CONTENT_WARNING: string;
-export type ExternalContentSource = "email" | "webhook" | "api" | "channel_metadata" | "web_search" | "web_fetch" | "document" | "unknown";
+export type ExternalContentSource = "email" | "webhook" | "api" | "channel_metadata" | "web_search" | "web_fetch" | "document" | "voice_transcription" | "vision" | "video_description" | "mcp_tool" | "mcp_resource" | "outcome_judge" | "learned_skill_synthesis" | "learned_skill_reflection" | "learned_profile_reflection" | "learned_topic_reflection" | "memory_generalization" | "unknown";
 export type WrapExternalContentOptions = {
     /** Source of the external content */
     source: ExternalContentSource;

package/node_modules/@comis/core/dist/security/external-content.js

@@ -8,7 +8,7 @@
  * SECURITY: External content should NEVER be directly interpolated into
  * system prompts or treated as trusted instructions.
  */
-import { randomBytes } from "node:crypto";
+import { randomBytes, createHmac } from "node:crypto";
 import { tryGetContext } from "../context/context.js";
 import { IGNORE_INSTRUCTIONS_BROAD, DISREGARD_PREVIOUS, FORGET_INSTRUCTIONS_BROAD, YOU_ARE_NOW_ARTICLE, NEW_INSTRUCTIONS_COLON, SYSTEM_COMMAND, EXEC_COMMAND, ELEVATED_TRUE, RM_RF, DELETE_ALL, SYSTEM_TAG, ROLE_BOUNDARY, ACT_AS_ROLE, SPECIAL_TOKEN_DELIMITERS, CONTEXT_RESET, RULE_REPLACEMENT, OVERRIDE_SAFETY, } from "./injection-patterns.js";
 /**
@@ -55,6 +55,44 @@ export function detectSuspiciousPatterns(content) {
 function generateRandomDelimiter() {
     return randomBytes(12).toString("hex");
 }
+/**
+ * Process-stable, unpredictable salt for deriving per-session content delimiters.
+ * Generated ONCE per process and NEVER exposed (not logged, not returned, not in
+ * any prompt). A fresh salt on daemon restart simply rebuilds the provider's
+ * prompt-cache prefix once — acceptable, and the delimiter stays unforgeable to an
+ * attacker who never sees the salt.
+ *
+ * LAZILY generated (NOT at module load): unrelated modules partially-mock
+ * `node:crypto` in their tests, and an eager top-level `randomBytes` call would
+ * crash their import. Memoized on first use so it stays process-stable thereafter.
+ */
+let processDelimiterSalt;
+function getProcessDelimiterSalt() {
+    processDelimiterSalt ??= randomBytes(32);
+    return processDelimiterSalt;
+}
+/**
+ * Derive a delimiter that is STABLE across the turns of one session — so the
+ * taint-wrapped content keeps a byte-identical prefix turn-to-turn and the
+ * provider's automatic prompt cache holds (the dag engine wraps every history
+ * summary; a per-CALL random delimiter churned the whole summaries block every
+ * turn, breaking the cache right after the system prompt and forcing the large
+ * suffix to re-process fresh — measured ~60% steady-state cache-hit).
+ *
+ * SECURITY: the value is an HMAC under a process-secret salt the attacker never
+ * sees, so it is no more predictable than the previous random delimiter; and
+ * `replaceMarkers` remains the PRIMARY forge defense (it strips ANY
+ * `<<<UNTRUSTED_hex>>>` from the body regardless of the active delimiter), so a
+ * per-session value does not weaken the boundary. Returns undefined when there is
+ * no session identity to key on (channel ingress, pre-resolution) — the caller
+ * then uses a fresh random delimiter (the prior behavior for that case).
+ */
+function sessionStableDelimiter(ctx) {
+    if (!ctx?.sessionKey)
+        return undefined;
+    const scopeKey = `${ctx.tenantId ?? "default"}:${ctx.sessionKey}:${ctx.agentId ?? ""}`;
+    return createHmac("sha256", getProcessDelimiterSalt()).update(scopeKey).digest("hex").slice(0, 24);
+}
 /**
  * Security warning prepended to external content.
  */
@@ -78,6 +116,17 @@ const EXTERNAL_SOURCE_LABELS = {
     web_search: "Web Search",
     web_fetch: "Web Fetch",
     document: "Document",
+    voice_transcription: "Voice transcription",
+    vision: "Vision analysis",
+    video_description: "Video description",
+    mcp_tool: "MCP tool result",
+    mcp_resource: "MCP resource content",
+    outcome_judge: "Outcome judge input",
+    learned_skill_synthesis: "Learned-skill synthesis input",
+    learned_skill_reflection: "Learned-skill reflection input",
+    learned_profile_reflection: "Learned-profile reflection input",
+    learned_topic_reflection: "Learned-topic reflection input",
+    memory_generalization: "Memory generalization cluster input",
     unknown: "External",
 };
 const FULLWIDTH_ASCII_OFFSET = 0xfee0;
@@ -186,9 +235,11 @@ export function wrapExternalContent(content, options) {
     }
     const metadata = metadataLines.join("\n");
     const warningBlock = includeWarning ? `${EXTERNAL_CONTENT_WARNING}\n\n` : "";
-    // Use per-session random delimiter from context, or generate fresh one
+    // Delimiter precedence: an explicit per-session contentDelimiter (if wiring set
+    // one) → a session-stable derived delimiter (cache-friendly; byte-identical
+    // across the session's turns) → a fresh random delimiter (no session identity).
     const ctx = tryGetContext();
-    const delimiter = ctx?.contentDelimiter ?? generateRandomDelimiter();
+    const delimiter = ctx?.contentDelimiter ?? sessionStableDelimiter(ctx) ?? generateRandomDelimiter();
     const startMarker = `<<<UNTRUSTED_${delimiter}>>>`;
     const endMarker = `<<<END_UNTRUSTED_${delimiter}>>>`;
     return [

package/node_modules/@comis/core/dist/security/handler-capability-map.d.ts

@@ -0,0 +1,134 @@
+/**
+ * `HANDLER_CAPABILITY_MAP` — the single auditable source-of-truth that
+ * classifies every orchestration-core RPC method to its required
+ * {@link AgentCapability} (CAP-04, v8 §3.7).
+ *
+ * Why a registry (not a fuzzy "every handler" scan): "gated" must be a
+ * machine-checkable table, not a notion. Each orchestration method is one of
+ * three classifications:
+ *   - an `AgentCapability` ("orch:*") — the handler MUST call
+ *     `requireCapability(rawParams._capabilities, <cap>)` near its top (the
+ *     in-process gate, because the agent loop skips `checkScope`).
+ *   - `"deny-by-origin"` — an admin/control-plane method un-grantable to an
+ *     agent origin (the `rpc-dispatch.ts` chokepoint rejects an `_agentId`-bearing
+ *     call for every scopes:["admin"] method). 210-GAP populates this class with
+ *     the message subset §3.5 keeps admin-only (edit/delete/fetch/attach) + the
+ *     arbitrary-session lifecycle ops carrying an in-handler `_trustLevel`-admin
+ *     check (session.delete/export/reset_conversation).
+ *   - `"ungated"` — a read-only / lifecycle method governed by neither a cap
+ *     nor deny-by-origin (agent-reachable, rpc-scoped contract).
+ *
+ * This is consumed by two tests that keep the gate and the table from drifting:
+ *   1. `test/architecture/gated-handlers-require-capability.test.ts` AST-asserts
+ *      every `AgentCapability`-valued method's handler body calls
+ *      `requireCapability` with that exact cap (mapped-but-ungated fails the
+ *      build), AND derives the orchestration-mutating method set from
+ *      `API_CONTRACTS_ORDERED` and asserts each is a KEY here (a new mutating
+ *      method in an existing gated namespace forces an entry → forces a gate).
+ *   2. `packages/core/src/security/handler-capability-map.test.ts` pins the
+ *      anchor classifications + the no-typo'd-cap invariant.
+ *
+ * Phase 212's `tool.invoke` cap-map will REUSE this table (the gate and the
+ * SDK draw from one source), so it lives in `security/` (importable by both
+ * `@comis/daemon` handlers and `@comis/agent` tool-assembly with no package
+ * cycle) and OUT of `api-contracts/` (the web-codegen surface).
+ *
+ * SCOPE (v8 / RESEARCH Open Q3): 210 classifies the orchestration-CORE methods
+ * only — session.spawn plus the graph, cron, message and skills families. The
+ * FULL §3.6 read/web/analyze/write/browse tool-surface map is Phase 212. Do NOT
+ * enumerate the full tool surface here.
+ *
+ * @module
+ */
+import type { AgentCapability } from "./capability.js";
+/** Three-way classification of an orchestration RPC method (see module doc). */
+export type HandlerCapabilityClassification = AgentCapability | "deny-by-origin" | "ungated";
+/**
+ * Method → classification for the orchestration-core surface (the five gated
+ * families + their read-only/lifecycle siblings). Every method in the
+ * {session, graph, cron, message, skills} namespaces is classified so the
+ * `API_CONTRACTS_ORDERED`-derived completeness assertion always finds a key —
+ * an UNCLASSIFIED new method in a gated namespace fails that arch-test, forcing
+ * a human to decide gated-vs-ungated.
+ *
+ * `as const satisfies` keeps the literal cap strings exact (so the no-typo'd-cap
+ * invariant holds at the type level too) while typing the whole table as a
+ * `Record<string, HandlerCapabilityClassification>`.
+ */
+export declare const HANDLER_CAPABILITY_MAP: {
+    readonly "session.spawn": "orch:spawn";
+    readonly "session.send": "ungated";
+    readonly "session.compact": "ungated";
+    readonly "session.delete": "deny-by-origin";
+    readonly "session.export": "deny-by-origin";
+    readonly "session.history": "ungated";
+    readonly "session.list": "ungated";
+    readonly "session.reset": "ungated";
+    readonly "session.reset_conversation": "deny-by-origin";
+    readonly "session.run_status": "ungated";
+    readonly "session.search": "ungated";
+    readonly "session.status": "ungated";
+    readonly "graph.define": "orch:graph";
+    readonly "graph.execute": "orch:graph";
+    readonly "graph.save": "orch:graph";
+    readonly "graph.load": "orch:graph";
+    readonly "graph.delete": "orch:graph";
+    readonly "graph.deleteRun": "orch:graph";
+    readonly "graph.cancel": "orch:graph";
+    readonly "graph.list": "ungated";
+    readonly "graph.status": "ungated";
+    readonly "graph.runs": "ungated";
+    readonly "graph.outputs": "ungated";
+    readonly "cron.add": "orch:cron";
+    readonly "cron.update": "orch:cron";
+    readonly "cron.remove": "orch:cron";
+    readonly "cron.run": "orch:cron";
+    readonly "cron.list": "ungated";
+    readonly "cron.status": "ungated";
+    readonly "cron.runs": "ungated";
+    readonly "message.send": "orch:message";
+    readonly "message.reply": "orch:message";
+    readonly "message.react": "orch:message";
+    readonly "message.edit": "deny-by-origin";
+    readonly "message.delete": "deny-by-origin";
+    readonly "message.attach": "deny-by-origin";
+    readonly "message.fetch": "deny-by-origin";
+    readonly "skills.create": "orch:skill";
+    readonly "skills.update": "orch:skill";
+    readonly "skills.delete": "orch:skill";
+    readonly "skills.import": "orch:skill";
+    readonly "skills.upload": "orch:skill";
+    readonly "skills.list": "ungated";
+    readonly "capabilities.introspect": "ungated";
+};
+/** The method-name keys of {@link HANDLER_CAPABILITY_MAP}. */
+export type GatedMethodName = keyof typeof HANDLER_CAPABILITY_MAP;
+/**
+ * SELF_SCOPED_AGENT_READS — the tight, named cap-socket audience exception
+ * (CLI-01 / CLI-02; v8 §15 "whoami — read, no cap").
+ *
+ * These three methods are `"ungated"` in {@link HANDLER_CAPABILITY_MAP} (no
+ * `orch:*` cap, not deny-by-origin), `scopes:["rpc"]` (not admin), and each
+ * self-scopes to the dispatcher-injected `_agentId` at its handler
+ * (`capabilities-handlers.ts` reads `_agentId` before strip; `session-read.ts`
+ * filters to the caller's own sessions) — so a valid lease reaching one reports
+ * ONLY the caller's own caps/status, never another agent's.
+ *
+ * The lease audience (`@comis/infra` `lease-manager.ts` `validate`) imports THIS
+ * set so the exception lives in ONE auditable place beside the classification
+ * table (no drift). `validate` short-circuits the `orch:*` audience deny ONLY
+ * for these names, and ONLY after the bearer/expiry/revoke authenticity checks —
+ * it grants a valid lease reach to nothing else; the gated/deny-by-origin path
+ * is byte-identical to before.
+ *
+ * TIGHTNESS is the whole point: the set is exactly these three. Do NOT add
+ * `session.search`/`session.history`/`graph.list`/`cron.list`/`skills.list` —
+ * those self-scoped reads are reachable via the `tool.invoke` cap-mapped path or
+ * are out of scope for `whoami`/`status`; widening here is unreviewed audience
+ * surface. The drift test in `handler-capability-map.test.ts` pins each member
+ * to `ungated` + `scopes:["rpc"]` + non-denylisted, so a typo adding a fourth
+ * (or an admin/gated) method fails the build.
+ */
+export declare const SELF_SCOPED_AGENT_READS: readonly ["capabilities.introspect", "session.status", "session.list"];
+/** A member of {@link SELF_SCOPED_AGENT_READS}. */
+export type SelfScopedAgentRead = (typeof SELF_SCOPED_AGENT_READS)[number];

package/node_modules/@comis/core/dist/security/handler-capability-map.js

@@ -0,0 +1,112 @@
+/**
+ * Method → classification for the orchestration-core surface (the five gated
+ * families + their read-only/lifecycle siblings). Every method in the
+ * {session, graph, cron, message, skills} namespaces is classified so the
+ * `API_CONTRACTS_ORDERED`-derived completeness assertion always finds a key —
+ * an UNCLASSIFIED new method in a gated namespace fails that arch-test, forcing
+ * a human to decide gated-vs-ungated.
+ *
+ * `as const satisfies` keeps the literal cap strings exact (so the no-typo'd-cap
+ * invariant holds at the type level too) while typing the whole table as a
+ * `Record<string, HandlerCapabilityClassification>`.
+ */
+export const HANDLER_CAPABILITY_MAP = {
+    // ── session ── only session.spawn is an orch cap; session.send is governed by
+    // the agentToAgent policy gate. The read/lifecycle ops split two ways
+    // (210-GAP MD-01): list/compact/reset/history/run_status/search/status are
+    // "ungated" (agent-reachable self-scoped reads, rpc-scoped contracts), while
+    // delete/export/reset_conversation are "deny-by-origin" — they carry an
+    // in-handler `_trustLevel === "admin"` check AND target an ARBITRARY session
+    // by key (not the caller's own), so they are genuine control plane and stay
+    // scopes:["admin"]; an agent origin is denied at the chokepoint.
+    "session.spawn": "orch:spawn",
+    "session.send": "ungated",
+    "session.compact": "ungated",
+    "session.delete": "deny-by-origin",
+    "session.export": "deny-by-origin",
+    "session.history": "ungated",
+    "session.list": "ungated",
+    "session.reset": "ungated",
+    "session.reset_conversation": "deny-by-origin",
+    "session.run_status": "ungated",
+    "session.search": "ungated",
+    "session.status": "ungated",
+    // ── graph ── mutating set → orch:graph; read-only views → ungated.
+    "graph.define": "orch:graph",
+    "graph.execute": "orch:graph",
+    "graph.save": "orch:graph",
+    "graph.load": "orch:graph",
+    "graph.delete": "orch:graph",
+    "graph.deleteRun": "orch:graph",
+    "graph.cancel": "orch:graph",
+    "graph.list": "ungated",
+    "graph.status": "ungated",
+    "graph.runs": "ungated",
+    "graph.outputs": "ungated",
+    // ── cron ── mutating/exec set → orch:cron; read-only views → ungated.
+    "cron.add": "orch:cron",
+    "cron.update": "orch:cron",
+    "cron.remove": "orch:cron",
+    "cron.run": "orch:cron",
+    "cron.list": "ungated",
+    "cron.status": "ungated",
+    "cron.runs": "ungated",
+    // ── message ── 210-GAP / §3.5: `orch:message` exposes ONLY the
+    // genuinely-outward send subset (send/reply/react). edit/delete/fetch/attach
+    // are admin-only and NOT part of the cap → "deny-by-origin" (they stay
+    // scopes:["admin"]; an agent origin is denied at the chokepoint, NOT
+    // cap-gated). This corrects the prior over-broad gating that (a) put
+    // edit/delete/attach behind a cap no profile grants and (b) made a
+    // _capabilities-stripped admin gateway caller throw on the (undefined) cap.
+    "message.send": "orch:message",
+    "message.reply": "orch:message",
+    "message.react": "orch:message",
+    "message.edit": "deny-by-origin",
+    "message.delete": "deny-by-origin",
+    "message.attach": "deny-by-origin",
+    "message.fetch": "deny-by-origin",
+    // ── skills ── mutating set → orch:skill; skills.list is read-only.
+    "skills.create": "orch:skill",
+    "skills.update": "orch:skill",
+    "skills.delete": "orch:skill",
+    "skills.import": "orch:skill",
+    "skills.upload": "orch:skill",
+    "skills.list": "ungated",
+    // ── capabilities ── INTRO-02 (Phase 215): capabilities.introspect (the
+    // `whoami` read) is read-only + agent-reachable with NO cap — an agent queries
+    // its OWN resolved caps + remaining budget/quota. It joins the read-only
+    // "ungated" class (beside session.status); the handler enforces _agentId
+    // self-scope, NOT a requireCapability gate. scopes:["rpc"], not admin.
+    "capabilities.introspect": "ungated",
+};
+/**
+ * SELF_SCOPED_AGENT_READS — the tight, named cap-socket audience exception
+ * (CLI-01 / CLI-02; v8 §15 "whoami — read, no cap").
+ *
+ * These three methods are `"ungated"` in {@link HANDLER_CAPABILITY_MAP} (no
+ * `orch:*` cap, not deny-by-origin), `scopes:["rpc"]` (not admin), and each
+ * self-scopes to the dispatcher-injected `_agentId` at its handler
+ * (`capabilities-handlers.ts` reads `_agentId` before strip; `session-read.ts`
+ * filters to the caller's own sessions) — so a valid lease reaching one reports
+ * ONLY the caller's own caps/status, never another agent's.
+ *
+ * The lease audience (`@comis/infra` `lease-manager.ts` `validate`) imports THIS
+ * set so the exception lives in ONE auditable place beside the classification
+ * table (no drift). `validate` short-circuits the `orch:*` audience deny ONLY
+ * for these names, and ONLY after the bearer/expiry/revoke authenticity checks —
+ * it grants a valid lease reach to nothing else; the gated/deny-by-origin path
+ * is byte-identical to before.
+ *
+ * TIGHTNESS is the whole point: the set is exactly these three. Do NOT add
+ * `session.search`/`session.history`/`graph.list`/`cron.list`/`skills.list` —
+ * those self-scoped reads are reachable via the `tool.invoke` cap-mapped path or
+ * are out of scope for `whoami`/`status`; widening here is unreviewed audience
+ * surface. The drift test in `handler-capability-map.test.ts` pins each member
+ * to `ungated` + `scopes:["rpc"]` + non-denylisted, so a typo adding a fourth
+ * (or an admin/gated) method fails the build.
+ */
+export const SELF_SCOPED_AGENT_READS = [
+    "capabilities.introspect",
+    "session.status",
+    "session.list",
+];

package/node_modules/@comis/core/dist/security/index.d.ts

@@ -1,18 +1,33 @@
 export { safePath, PathTraversalError } from "./safe-path.js";
+export { validateBindMount } from "./bind-mount-validator.js";
 export { writeMasterKeyIfAbsent, generateMasterKey } from "./master-key.js";
 export type { MasterKeyWriteResult } from "./master-key.js";
 export { validateProfileId, PROFILE_ID_RE } from "./profile-id.js";
 export { decodeCodexJwtPayload, resolveCodexAuthIdentity, resolveCodexStableSubject, resolveCodexAccessTokenExpiry, redactEmailForLog, rewriteOAuthError, } from "./oauth-helpers.js";
 export type { OAuthErrorCode, RewrittenOAuthError } from "./oauth-helpers.js";
-export { validateUrl, BLOCKED_RANGES, CLOUD_METADATA_IPS } from "./ssrf-guard.js";
-export type { ValidatedUrl } from "./ssrf-guard.js";
-export { createSecretManager, envSubset } from "./secret-manager.js";
-export type { SecretManager } from "./secret-manager.js";
+export { validateUrl, validateLocalServerUrl, BLOCKED_RANGES, CLOUD_METADATA_IPS, setSsrfBlockHook } from "./ssrf-guard.js";
+export type { ValidatedUrl, SsrfBlockReason } from "./ssrf-guard.js";
+export { createSecretManager, createSecretManagerWithMutableHandle, envSubset } from "./secret-manager.js";
+export type { SecretManager, MutableSecretManager } from "./secret-manager.js";
 export { classifyAction, requiresConfirmation, registerAction, lockRegistry, isRegistryLocked } from "./action-classifier.js";
 export type { ActionClassification } from "./action-classifier.js";
-export { AuditEventSchema, createAuditEvent } from "./audit.js";
-export type { AuditEvent, CreateAuditEventParams } from "./audit.js";
-export { sanitizeLogString } from "./log-sanitizer.js";
+export { AuditEventSchema, createAuditEvent, AUDIT_KINDS, kindIsSecuritySignal } from "./audit.js";
+export type { AuditEvent, AuditKind, CreateAuditEventParams } from "./audit.js";
+export { AGENT_CAPABILITIES, checkCapability, requireCapability, CapabilityDeniedError, attenuateCaps } from "./capability.js";
+export type { AgentCapability } from "./capability.js";
+export { HANDLER_CAPABILITY_MAP } from "./handler-capability-map.js";
+export type { HandlerCapabilityClassification, GatedMethodName } from "./handler-capability-map.js";
+export { SELF_SCOPED_AGENT_READS } from "./handler-capability-map.js";
+export type { SelfScopedAgentRead } from "./handler-capability-map.js";
+export { CLI_SUBCOMMAND_MAP } from "./cli-subcommand-map.js";
+export type { CliCallTarget, CliSubcommand } from "./cli-subcommand-map.js";
+export { TOOL_CAPABILITY_MAP, TOOL_ROUTE_MAP } from "./tool-capability-map.js";
+export type { ToolName, ToolRoute } from "./tool-capability-map.js";
+export { RESULT_REF_THRESHOLDS, DEFAULT_INLINE_THRESHOLD_BYTES, PER_FILE_CAP_BYTES, PER_RUN_AGGREGATE_CAP_BYTES, getResultRefThreshold, shouldMaterialize, isExpired, selectEvictions, checkPerFileCap, computeExpiresAt, } from "./result-ref.js";
+export type { ResultRef } from "./result-ref.js";
+export { sanitizeLogString, redactErrorMessage } from "./log-sanitizer.js";
+export { redactValue, REDACT_LIMITS } from "./redact-value.js";
+export type { RedactedValue, RedactionReason, RedactionRecord, RedactOptions, RedactLimits, } from "./redact-value.js";
 export { wrapExternalContent, wrapWebContent, detectSuspiciousPatterns, EXTERNAL_CONTENT_WARNING } from "./external-content.js";
 export type { ExternalContentSource, WrapExternalContentOptions } from "./external-content.js";
 export { createOutputGuard } from "./output-guard.js";
@@ -24,20 +39,31 @@ export { createInputSecurityGuard } from "./input-security-guard.js";
 export type { InputSecurityGuard, InputSecurityGuardResult, InputSecurityGuardConfig } from "./input-security-guard.js";
 export { validateMemoryWrite } from "./memory-write-validator.js";
 export type { MemoryWriteValidationResult } from "./memory-write-validator.js";
+export { validateLearnedDocBody, MAX_DOC_NAME_LENGTH } from "./validate-learned-doc-body.js";
+export type { LearnedDocValidation, LearnedDocFinding } from "./validate-learned-doc-body.js";
 export { generateCanaryToken, detectCanaryLeakage } from "./canary-token.js";
+export { signCallbackData, verifyCallbackData, renderCallbackData, parseCallbackData, } from "./callback-signing.js";
+export type { CallbackChoice, CallbackRenderError, ParsedCallback } from "./callback-signing.js";
 export { createSecretsCrypto, parseMasterKey } from "./secret-crypto.js";
 export type { SecretsCrypto, EncryptedSecret } from "./secret-crypto.js";
 export { matchesSecretPattern, isSecretAccessible } from "./secret-access.js";
 export { createScopedSecretManager } from "./secret-manager.js";
 export type { ScopedSecretManagerOptions } from "./secret-manager.js";
 export { generateStrongToken, generateRotationId } from "./token-generator.js";
-export { redactConfigSecrets } from "./config-redaction.js";
+export { looksLikeSecretValue, isSecretFieldName, isEnvRefString, scanForSecrets, redactForDisplay, PLAINTEXT_SECRET_PREFIXES, PREFIX_MIN_BODY_LENGTHS } from "./secret-detection.js";
+export type { SecretFinding } from "./secret-detection.js";
+export { classifyHeaderCredential } from "./credential-classify.js";
+export type { CredentialKind, HeaderCredentialClassification } from "./credential-classify.js";
 export { ZERO_WIDTH_REGEX, TAG_BLOCK_REGEX, stripInvisible, containsTagBlockChars, IGNORE_PREV_INSTRUCTIONS, YOU_ARE_NOW, FORGET_EVERYTHING, NEW_INSTRUCTIONS, IMPORTANT_OVERRIDE, IGNORE_INSTRUCTIONS_BROAD, DISREGARD_PREVIOUS, FORGET_INSTRUCTIONS_BROAD, YOU_ARE_NOW_ARTICLE, NEW_INSTRUCTIONS_COLON, DISREGARD_INSTRUCTIONS, ACT_AS_ROLE, ASSISTANT_ROLE_MARKER, SPECIAL_TOKEN_DELIMITERS, CONTEXT_RESET, RULE_REPLACEMENT, OVERRIDE_SAFETY, SYSTEM_COLON, SYSTEM_BRACKET, INST_BRACKET, SYSTEM_TAG, SYSTEM_COMMAND, ROLE_BOUNDARY, EXEC_COMMAND, ELEVATED_TRUE, RM_RF, DELETE_ALL, DANGEROUS_COMMAND_PATTERNS, HEX_SECRET_32, BASE64_SECRET, PRIVATE_KEY_HEADER, GITHUB_TOKEN, SLACK_TOKEN, SYSTEM_PROMPT_LABEL, INSTRUCTIONS_LABEL, PROMPT_EXTRACTION_PATTERNS, SK_API_KEY, BEARER_TOKEN_LOG, TELEGRAM_BOT_TOKEN, GOOGLE_API_KEY, JWT_PATTERN, URL_PASSWORD, EXEC_SUBSHELL_PATTERN, EXEC_BACKTICK_PATTERN, EXEC_EVAL_PATTERN, EXEC_PIPE_BASH_PATTERN, ENV_PRINTENV_PATTERN, ENV_PROC_ENVIRON_PATTERN, ENV_MASS_DUMP_PATTERN, CRYPTO_STRATUM_PATTERN, CRYPTO_MINER_BINARY_PATTERN, CRYPTO_POOL_DOMAIN_PATTERN, NET_CURL_PIPE_PATTERN, NET_WGET_EXEC_PATTERN, NET_REVERSE_SHELL_PATTERN, OBF_BASE64_LONG_PATTERN, OBF_HEX_LONG_PATTERN, OBF_BASE64_DECODE_PIPE_PATTERN, XML_SKILL_CLOSE_TAG, XML_SYSTEM_TAG, HTML_COMMENT_INJECTION, HIDDEN_DIV_PATTERN, TRANSLATE_EXECUTE_PATTERN, EXFIL_CURL_PATTERN, READ_SECRETS_PATTERN, WORKSPACE_SCANNER_PATTERNS, } from "./injection-patterns.js";
 export type { StripResult } from "./injection-patterns.js";
 export { createInjectionRateLimiter } from "./injection-rate-limiter.js";
 export type { InjectionRateLimiter, InjectionRateLimiterConfig, RateLimitResult } from "./injection-rate-limiter.js";
 export { resolveSecretRef, resolveConfigSecretRefs } from "./secret-ref-resolver.js";
 export type { ResolveSecretRefDeps, ResolveSecretRefOptions } from "./secret-ref-resolver.js";
-export { SECRET_FIELD_PATTERN } from "./config-redaction.js";
 export { scanConfigForSecrets, scanEnvForSecrets, auditSecrets } from "./secrets-audit.js";
 export type { AuditFinding, AuditSeverity, AuditOptions } from "./secrets-audit.js";
+export type { ScrubResult } from "./secret-egress-guard.js";
+export { mightContainSecret, scrubSecretsFromText } from "./secret-egress-guard.js";
+export type { HostPattern, InjectionRule, RequestFinalizer, StaticHeader, HostRule, BrokerBinding, ProviderPreset, PresetLibrary } from "./provider-catalog/index.js";
+export { normalizeHost, hostRuleMatches, pathAllowed, resolveBinding, applyInjections, expandPreset, PRESETS } from "./provider-catalog/index.js";
+export type { InjectionInput } from "./provider-catalog/index.js";

package/node_modules/@comis/core/dist/security/index.js

@@ -1,6 +1,9 @@
 // SPDX-License-Identifier: Apache-2.0
 // @comis/core/security — Security utilities
 export { safePath, PathTraversalError } from "./safe-path.js";
+// JAIL-03 bind-mount validator (Phase 211) — pure denylist backstop reusing the
+// safe-path symlink-resolve-through-ancestors primitive.
+export { validateBindMount } from "./bind-mount-validator.js";
 // Master-key file helpers (daemon-free `secrets init` body)
 export { writeMasterKeyIfAbsent, generateMasterKey } from "./master-key.js";
 // OAuth profile-ID validation
@@ -8,14 +11,34 @@ export { validateProfileId, PROFILE_ID_RE } from "./profile-id.js";
 // OAuth helpers
 export { decodeCodexJwtPayload, resolveCodexAuthIdentity, resolveCodexStableSubject, resolveCodexAccessTokenExpiry, redactEmailForLog, rewriteOAuthError, } from "./oauth-helpers.js";
 // SSRF guard
-export { validateUrl, BLOCKED_RANGES, CLOUD_METADATA_IPS } from "./ssrf-guard.js";
-export { createSecretManager, envSubset } from "./secret-manager.js";
+export { validateUrl, validateLocalServerUrl, BLOCKED_RANGES, CLOUD_METADATA_IPS, setSsrfBlockHook } from "./ssrf-guard.js";
+export { createSecretManager, createSecretManagerWithMutableHandle, envSubset } from "./secret-manager.js";
 // Action classifier
 export { classifyAction, requiresConfirmation, registerAction, lockRegistry, isRegistryLocked } from "./action-classifier.js";
 // Audit events
-export { AuditEventSchema, createAuditEvent } from "./audit.js";
+export { AuditEventSchema, createAuditEvent, AUDIT_KINDS, kindIsSecuritySignal } from "./audit.js";
+// Agent orchestration capabilities (Phase 210)
+export { AGENT_CAPABILITIES, checkCapability, requireCapability, CapabilityDeniedError, attenuateCaps } from "./capability.js";
+// HANDLER_CAPABILITY_MAP — the single auditable method→capability source-of-truth (CAP-04)
+export { HANDLER_CAPABILITY_MAP } from "./handler-capability-map.js";
+// SELF_SCOPED_AGENT_READS — the tight cap-socket audience exception (CLI-01/02);
+// the @comis/infra lease audience imports it so whoami/status reach the agent's
+// own self-scoped reads with any valid lease.
+export { SELF_SCOPED_AGENT_READS } from "./handler-capability-map.js";
+// CLI_SUBCOMMAND_MAP — the `comis-agent` subcommand→{tool|method} 1:1 table
+// (CLI-01, v8 §7). The @comis/skills comis-agent-cli dispatches over it; the
+// cap is DERIVED from the cap-maps (never restated). `skill` + admin verbs are
+// excluded by design (denylisted orch:skill / CLI-03).
+export { CLI_SUBCOMMAND_MAP } from "./cli-subcommand-map.js";
+// TOOL_CAPABILITY_MAP / TOOL_ROUTE_MAP — the single source for the tool.invoke
+// surface (gate + lease audience + SDK codegen) (Phase 212, DISPATCH/READ)
+export { TOOL_CAPABILITY_MAP, TOOL_ROUTE_MAP } from "./tool-capability-map.js";
+// ResultRef — minimal structured result-handle + its pure threshold/GC math (Phase 212, REF)
+export { RESULT_REF_THRESHOLDS, DEFAULT_INLINE_THRESHOLD_BYTES, PER_FILE_CAP_BYTES, PER_RUN_AGGREGATE_CAP_BYTES, getResultRefThreshold, shouldMaterialize, isExpired, selectEvictions, checkPerFileCap, computeExpiresAt, } from "./result-ref.js";
 // Log sanitizer
-export { sanitizeLogString } from "./log-sanitizer.js";
+export { sanitizeLogString, redactErrorMessage } from "./log-sanitizer.js";
+// Bounded redaction primitive (activity transparency)
+export { redactValue, REDACT_LIMITS } from "./redact-value.js";
 // External content security wrapping
 export { wrapExternalContent, wrapWebContent, detectSuspiciousPatterns, EXTERNAL_CONTENT_WARNING } from "./external-content.js";
 // Output guard adapter
@@ -28,8 +51,15 @@ export { validateInput } from "./input-validator.js";
 export { createInputSecurityGuard } from "./input-security-guard.js";
 // Memory write validator
 export { validateMemoryWrite } from "./memory-write-validator.js";
+// Learned-doc static scan (v2.31 Reflection) — the STATIC poison/secret scan an
+// advisory Mental Model doc receives (SKILL-02 / INV-3). Wraps validateMemoryWrite
+// per-field; no scripts/tool-policy/dynamic surface. Consumed by the agent reflection
+// job (223-04) + the daemon reflect path (223-05).
+export { validateLearnedDocBody, MAX_DOC_NAME_LENGTH } from "./validate-learned-doc-body.js";
 // Canary tokens
 export { generateCanaryToken, detectCanaryLeakage } from "./canary-token.js";
+// Signed interactive-approval callbacks
+export { signCallbackData, verifyCallbackData, renderCallbackData, parseCallbackData, } from "./callback-signing.js";
 // Secret encryption engine
 export { createSecretsCrypto, parseMasterKey } from "./secret-crypto.js";
 // Secret access pattern matching
@@ -38,8 +68,9 @@ export { matchesSecretPattern, isSecretAccessible } from "./secret-access.js";
 export { createScopedSecretManager } from "./secret-manager.js";
 // Strong token generation
 export { generateStrongToken, generateRotationId } from "./token-generator.js";
-// Config secret redaction
-export { redactConfigSecrets } from "./config-redaction.js";
+// Secret detection keystone
+export { looksLikeSecretValue, isSecretFieldName, isEnvRefString, scanForSecrets, redactForDisplay, PLAINTEXT_SECRET_PREFIXES, PREFIX_MIN_BODY_LENGTHS } from "./secret-detection.js";
+export { classifyHeaderCredential } from "./credential-classify.js";
 // Injection pattern constants
 export { ZERO_WIDTH_REGEX, TAG_BLOCK_REGEX, stripInvisible, containsTagBlockChars, 
 // Jailbreak patterns
@@ -66,7 +97,7 @@ HTML_COMMENT_INJECTION, HIDDEN_DIV_PATTERN, TRANSLATE_EXECUTE_PATTERN, EXFIL_CUR
 export { createInjectionRateLimiter } from "./injection-rate-limiter.js";
 // SecretRef resolver
 export { resolveSecretRef, resolveConfigSecretRefs } from "./secret-ref-resolver.js";
-// Config secret redaction pattern (reused by audit scanner)
-export { SECRET_FIELD_PATTERN } from "./config-redaction.js";
 // Secrets audit scanner
 export { scanConfigForSecrets, scanEnvForSecrets, auditSecrets } from "./secrets-audit.js";
+export { mightContainSecret, scrubSecretsFromText } from "./secret-egress-guard.js";
+export { normalizeHost, hostRuleMatches, pathAllowed, resolveBinding, applyInjections, expandPreset, PRESETS } from "./provider-catalog/index.js";

package/node_modules/@comis/core/dist/security/input-security-guard.js

@@ -15,6 +15,16 @@
  * @module input-security-guard
  */
 import { IGNORE_PREV_INSTRUCTIONS, IGNORE_INSTRUCTIONS_BROAD, DISREGARD_PREVIOUS, DISREGARD_INSTRUCTIONS, FORGET_EVERYTHING, FORGET_INSTRUCTIONS_BROAD, YOU_ARE_NOW, YOU_ARE_NOW_ARTICLE, NEW_INSTRUCTIONS, NEW_INSTRUCTIONS_COLON, IMPORTANT_OVERRIDE, OVERRIDE_SAFETY, ACT_AS_ROLE, CONTEXT_RESET, RULE_REPLACEMENT, SYSTEM_TAG, SYSTEM_BRACKET, SYSTEM_COMMAND, SPECIAL_TOKEN_DELIMITERS, ROLE_BOUNDARY, ASSISTANT_ROLE_MARKER, } from "./injection-patterns.js";
+/**
+ * Defense-in-depth bound on the scan input (GIANT-INPUT-WEDGE, 30uc-20260624). The scan is a
+ * heuristic over `text` — `stripCodeBlocks` (regex over the whole string) + per-pattern regex
+ * tests + a `split(/\s+/)` typoglycemia loop (O(words)). On a multi-MB message that is millions
+ * of synchronous string ops that block the Node event loop. A jailbreak directive is realistically
+ * at the START of a message; scanning only the first 64 KB catches real injections while keeping
+ * the scan O(1) in input size. (The inbound message-size cap in executor-input-guard rejects the
+ * multi-MB message entirely before this runs; this bound keeps `scan()` itself safe for any caller.)
+ */
+const MAX_SCAN_CHARS = 65_536;
 // ---------------------------------------------------------------------------
 // Weighted pattern categories
 // ---------------------------------------------------------------------------
@@ -111,7 +121,10 @@ export function createInputSecurityGuard(config) {
     const action = config?.action ?? "warn";
     return {
         scan(text) {
-            const stripped = stripCodeBlocks(text);
+            // GIANT-INPUT-WEDGE: bound the scanned text so the O(words) typoglycemia loop + the regex
+            // passes can never block the event loop on a multi-MB input (a jailbreak is at the start).
+            const bounded = text.length > MAX_SCAN_CHARS ? text.slice(0, MAX_SCAN_CHARS) : text;
+            const stripped = stripCodeBlocks(bounded);
             const matched = [];
             let score = 0;
             // 1. Weighted pattern category matching

package/node_modules/@comis/core/dist/security/log-sanitizer.d.ts

@@ -19,3 +19,26 @@
  * @returns The sanitized string with credentials replaced
  */
 export declare function sanitizeLogString(input: string): string;
+/**
+ * Redact a free-text error/diagnostic string: strip URLs (`[URL]`), the bare
+ * `Authorization:`/`Bearer` credential-scheme markers, and any long token
+ * (`[REDACTED]`). The single source of truth for the SEC-01 redaction regex —
+ * reused by `sanitizeApiError` (adapter API-error bodies in `@comis/skills`),
+ * the inbound voice handler's structured-log lines, AND the voice-OUT pipeline's
+ * WARN branches in `@comis/channels`.
+ *
+ * Relocated here from `@comis/skills` (media-adapter-shared.ts) in Phase 197 so
+ * BOTH `@comis/skills` and `@comis/channels` resolve ONE definition: channels
+ * deliberately does NOT import skills (structural-typing boundary), so the pure
+ * primitive lives DOWN in core where both packages already depend. The redaction
+ * SEMANTICS are unchanged from the original — only the location moved.
+ *
+ * This is intentionally narrower than {@link sanitizeLogString} (which matches a
+ * catalog of known credential FORMATS): `redactErrorMessage` is the coarser
+ * URL/scheme/long-token scrubber for opaque adapter error bodies where the exact
+ * credential shape is unknown.
+ *
+ * @param body - The free-text error/diagnostic string to redact
+ * @returns The redacted string (URLs, credential schemes, and long tokens scrubbed)
+ */
+export declare function redactErrorMessage(body: string): string;