comisai 1.0.42 → 1.0.44

package/node_modules/@comis/core/dist/security/log-sanitizer.js

@@ -9,7 +9,7 @@
  * This is a SECOND line of defense. Pino's fast-redact handles structured
  * fields; this handles unstructured string content.
  */
-import { SK_API_KEY, BEARER_TOKEN_LOG, TELEGRAM_BOT_TOKEN, AWS_KEY_ID_BOUNDED, AWS_SECRET_KEY, STRIPE_KEY, GOOGLE_API_KEY, SLACK_APP_TOKEN, SENDGRID_KEY, JWT_PATTERN, URL_PASSWORD, HEX_SECRET_LONG, GITHUB_TOKEN_FULL, ANTHROPIC_API_KEY, OPENAI_PROJECT_KEY, DISCORD_BOT_TOKEN, DB_CONNECTION_STRING, } from "./injection-patterns.js";
+import { SK_API_KEY, BEARER_TOKEN_LOG, TELEGRAM_BOT_TOKEN, AWS_KEY_ID_BOUNDED, AWS_SECRET_KEY, STRIPE_KEY, GOOGLE_API_KEY, SLACK_APP_TOKEN, SENDGRID_KEY, JWT_PATTERN, URL_PASSWORD, HEX_SECRET_LONG, FAL_KEY, GITHUB_TOKEN_FULL, ANTHROPIC_API_KEY, OPENAI_PROJECT_KEY, DISCORD_BOT_TOKEN, DB_CONNECTION_STRING, } from "./injection-patterns.js";
 /**
  * Credential patterns to detect and redact in log strings.
  *
@@ -47,6 +47,10 @@ const CREDENTIAL_PATTERNS = [
     { pattern: URL_PASSWORD, replacement: "://$1:[REDACTED]@" },
     // Discord bot tokens: M/N prefix, three dot-separated segments
     { pattern: DISCORD_BOT_TOKEN, replacement: "[REDACTED_DISCORD_TOKEN]" },
+    // FAL API keys: <uuid-or-token>:<24+ hex> (CR-01, Phase 192). Before the generic
+    // hex pass so the colon-joined key is replaced as one unit; the 24-hex-tail floor
+    // keeps ordinary host:port / key:value prose out.
+    { pattern: FAL_KEY, replacement: "[REDACTED_FAL]" },
     // Generic hex secrets (40+ chars of hex, commonly git tokens, etc.)
     { pattern: HEX_SECRET_LONG, replacement: "[REDACTED_HEX]" },
     // GitHub tokens: ghp_, gho_, ghu_, ghs_, ghr_ followed by 36+ chars
@@ -81,3 +85,48 @@ export function sanitizeLogString(input) {
     }
     return result;
 }
+/**
+ * Redact a free-text error/diagnostic string: strip URLs (`[URL]`), the bare
+ * `Authorization:`/`Bearer` credential-scheme markers, and any long token
+ * (`[REDACTED]`). The single source of truth for the SEC-01 redaction regex —
+ * reused by `sanitizeApiError` (adapter API-error bodies in `@comis/skills`),
+ * the inbound voice handler's structured-log lines, AND the voice-OUT pipeline's
+ * WARN branches in `@comis/channels`.
+ *
+ * Relocated here from `@comis/skills` (media-adapter-shared.ts) in Phase 197 so
+ * BOTH `@comis/skills` and `@comis/channels` resolve ONE definition: channels
+ * deliberately does NOT import skills (structural-typing boundary), so the pure
+ * primitive lives DOWN in core where both packages already depend. The redaction
+ * SEMANTICS are unchanged from the original — only the location moved.
+ *
+ * This is intentionally narrower than {@link sanitizeLogString} (which matches a
+ * catalog of known credential FORMATS): `redactErrorMessage` is the coarser
+ * URL/scheme/long-token scrubber for opaque adapter error bodies where the exact
+ * credential shape is unknown.
+ *
+ * @param body - The free-text error/diagnostic string to redact
+ * @returns The redacted string (URLs, credential schemes, and long tokens scrubbed)
+ */
+export function redactErrorMessage(body) {
+    return (body
+        .replace(/https?:\/\/[^\s"')]+/g, "[URL]")
+        // WR-03: redact a credential-scheme marker TOGETHER with the long token it
+        // carries, as ONE `[REDACTED]` — and ONLY when a >=20-char credential token
+        // actually follows. The optional `Authorization:` / `Bearer ` prefix is
+        // part of the match but the `{20,}` token is REQUIRED, so the prefix is
+        // consumed only alongside a real credential (no orphaned scheme word, no
+        // double-space), while a bare "bearer"/"authorization" used as PROSE — or a
+        // scheme followed by a sub-20-char value — is left verbatim (the prior
+        // non-anchored deletion mangled such prose). Single character class with a
+        // single `+`/`{20,}` quantifier — linear, no catastrophic backtracking.
+        // eslint-disable-next-line no-restricted-syntax, security/detect-unsafe-regex -- media adapter API-error sanitization (not the Pino censor literal); the optional prefixes precede a single character class with one bounded quantifier — no nested/overlapping quantifier, so it is linear-time (safe-regex false positive)
+        .replace(/\b(?:Authorization:\s*)?(?:Bearer\s+)?[A-Za-z0-9_-]{20,}/gi, "[REDACTED]")
+        // Defense-in-depth: any standalone long token NOT preceded by a scheme
+        // marker (so untouched above) is still redacted — preserves the prior
+        // long-token floor and the no-opaque-leak guarantee.
+        // eslint-disable-next-line no-restricted-syntax -- media adapter API-error sanitization (not the Pino censor literal)
+        .replace(/[A-Za-z0-9_-]{20,}/g, "[REDACTED]")
+        // Collapse any residual run of internal whitespace a redaction may have
+        // produced (single-space only — never alters non-redacted prose spacing).
+        .replace(/ {2,}/g, " "));
+}

package/node_modules/@comis/core/dist/security/master-key.d.ts

@@ -11,6 +11,13 @@
 export interface MasterKeyWriteResult {
     readonly written: boolean;
     readonly path: string;
+    /**
+     * The freshly-generated master key in 64-char hex encoding.
+     * Defined iff `written === true` (first-time write only).
+     * Absent (undefined) when `written === false` (key already present).
+     * NEVER log this value.
+     */
+    readonly keyHex?: string;
 }
 /**
  * Generate a 32-byte hex master key.

package/node_modules/@comis/core/dist/security/master-key.js

@@ -10,7 +10,7 @@
  * @module
  */
 import { randomBytes } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, appendFileSync, chmodSync, } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, appendFileSync, chmodSync, openSync, writeSync, closeSync, } from "node:fs";
 import { safePath } from "./safe-path.js";
 /**
  * Generate a 32-byte hex master key.
@@ -42,7 +42,24 @@ export function writeMasterKeyIfAbsent(dataDir) {
     }
     mkdirSync(dataDir, { recursive: true, mode: 0o700 });
     const keyHex = generateMasterKey();
-    appendFileSync(envPath, `\nSECRETS_MASTER_KEY=${keyHex}\n`);
+    // W5: create the file with mode 0o600 atomically. openSync with flag "a"
+    // only applies the mode on file CREATION (O_CREAT path) — if the file already
+    // exists (append mode), the mode argument is ignored and the existing
+    // permissions are preserved. This eliminates the brief window where a newly
+    // created file is visible at umask-default permissions before chmodSync narrows it.
+    if (!existsSync(envPath)) {
+        const fd = openSync(envPath, "a", 0o600);
+        try {
+            writeSync(fd, `\nSECRETS_MASTER_KEY=${keyHex}\n`);
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    else {
+        appendFileSync(envPath, `\nSECRETS_MASTER_KEY=${keyHex}\n`);
+    }
+    // Defensive chmod: narrows any pre-existing file that was created at broader mode.
     chmodSync(envPath, 0o600);
-    return { written: true, path: envPath };
+    return { written: true, path: envPath, keyHex };
 }

package/node_modules/@comis/core/dist/security/memory-write-validator.js

@@ -16,6 +16,7 @@
  */
 import { detectSuspiciousPatterns } from "./external-content.js";
 import { DANGEROUS_COMMAND_PATTERNS } from "./injection-patterns.js";
+import { scrubSecretsFromText } from "./secret-egress-guard.js";
 /**
  * Module-level constant: Set of regex source strings for CRITICAL classification.
  * These are execution-oriented patterns dangerous when stored in memory for later
@@ -30,6 +31,12 @@ const CRITICAL_PATTERN_SOURCES = new Set(DANGEROUS_COMMAND_PATTERNS.map((p) => p
  * @returns Validation result with severity classification and matched patterns
  */
 export function validateMemoryWrite(content) {
+    // secret scan FIRST — pre-persist block using the shared keystone guard.
+    // scrubSecretsFromText uses the fast pre-filter; most content pays O(prefixes) only.
+    const scrub = scrubSecretsFromText(content);
+    if (scrub.redactions > 0) {
+        return { severity: "critical", patterns: ["secret-egress-guard"], criticalPatterns: ["secret-egress-guard"] };
+    }
     const patterns = detectSuspiciousPatterns(content);
     if (patterns.length === 0) {
         return { severity: "clean", patterns: [], criticalPatterns: [] };

package/node_modules/@comis/core/dist/security/oauth-helpers.d.ts

@@ -72,8 +72,7 @@ export type OAuthErrorCode = "unsupported_region" | "callback_validation_failed"
  * Output record carrying both UX-facing text and Pino-log-field values.
  *
  * Domain consumers switch on `code` (the OAuth discriminator); logger
- * payloads use `logErrorKind` (the closed-union mirror that satisfies the
- * AGENTS.md §2.7 logging contract).
+ * payloads use `logErrorKind` (the closed-union mirror for Pino log fields).
  *
  * `rewritten.code` carries the OAuth-domain discriminator value (one of
  * "refresh_token_reused" | "invalid_grant" | …) into the OAuthError + event

package/node_modules/@comis/core/dist/security/output-guard.d.ts

@@ -4,14 +4,23 @@ import type { OutputGuardPort } from "../ports/output-guard.js";
  *
  * Checks for:
  * 1. Secret patterns (API keys, tokens, private keys)
- * 2. Canary token leakage (if canaryToken provided in context)
- * 3. System prompt extraction attempts
+ * 2. Bound known-secret values (exact-match — the daemon's own credentials)
+ * 3. Canary token leakage (if canaryToken provided in context)
+ * 4. System prompt extraction attempts
  *
  * Critical findings (severity: "critical") are blocked and redacted in the
- * `sanitized` field using `[REDACTED:{pattern_name}]` format. Warning-level
- * findings (bearer_token, prompt_extraction) remain detect-only -- they are
- * reported in `findings` but the `sanitized` text is left unchanged.
+ * `sanitized` field using `[REDACTED:{pattern_name}]` format.
+ *
+ * @param opts.knownSecrets - Exact secret VALUES the daemon knows must never
+ *   appear in output (e.g. resolved gateway tokens, the master key). Redacted by
+ *   EXACT MATCH regardless of surrounding context — this closes the bare-secret
+ *   gap (a high-entropy token with no `key=`/`token:` prefix that the regex
+ *   patterns miss) with ZERO false-positive risk (no entropy heuristic that would
+ *   over-redact git SHAs / hashes). Empty or sub-`KNOWN_SECRET_MIN_LENGTH` values
+ *   are ignored so a misconfigured short value can never redact ordinary text.
  *
  * Uses Result<T,E> pattern.
  */
-export declare function createOutputGuard(): OutputGuardPort;
+export declare function createOutputGuard(opts?: {
+    knownSecrets?: readonly string[];
+}): OutputGuardPort;

package/node_modules/@comis/core/dist/security/output-guard.js

@@ -4,7 +4,8 @@ import { AWS_KEY_ID, BEARER_TOKEN, HEX_SECRET_32, BASE64_SECRET, PRIVATE_KEY_HEA
 /** Common secret patterns to detect in LLM output. */
 const SECRET_PATTERNS = [
     { name: "aws_key", regex: AWS_KEY_ID, severity: "critical" },
-    { name: "bearer_token", regex: BEARER_TOKEN, severity: "warning" },
+    { name: "bearer_token", regex: BEARER_TOKEN, severity: "critical" }, // REDACTS
+    { name: "hf_token", regex: /\bhf_[A-Za-z0-9_]{18,}\b/g, severity: "critical" }, // bare hf_ (keystone PREFIX_MIN_BODY_LENGTHS["hf_"] = 18)
     { name: "hex_secret_32", regex: HEX_SECRET_32, severity: "critical" },
     { name: "base64_secret", regex: BASE64_SECRET, severity: "critical" },
     { name: "private_key_header", regex: PRIVATE_KEY_HEADER, severity: "critical" },
@@ -24,22 +25,35 @@ const PROMPT_EXTRACTION_PATTERNS_LOCAL = [
     { name: "system_prompt_label", regex: SYSTEM_PROMPT_LABEL },
     { name: "instructions_label", regex: INSTRUCTIONS_LABEL },
 ];
+/** Minimum length for a bound known-secret to be eligible for exact-match
+ *  redaction — guards against a short/empty value redacting ordinary text. */
+const KNOWN_SECRET_MIN_LENGTH = 8;
 /**
  * Create an OutputGuard adapter that scans LLM responses.
  *
  * Checks for:
  * 1. Secret patterns (API keys, tokens, private keys)
- * 2. Canary token leakage (if canaryToken provided in context)
- * 3. System prompt extraction attempts
+ * 2. Bound known-secret values (exact-match — the daemon's own credentials)
+ * 3. Canary token leakage (if canaryToken provided in context)
+ * 4. System prompt extraction attempts
  *
  * Critical findings (severity: "critical") are blocked and redacted in the
- * `sanitized` field using `[REDACTED:{pattern_name}]` format. Warning-level
- * findings (bearer_token, prompt_extraction) remain detect-only -- they are
- * reported in `findings` but the `sanitized` text is left unchanged.
+ * `sanitized` field using `[REDACTED:{pattern_name}]` format.
+ *
+ * @param opts.knownSecrets - Exact secret VALUES the daemon knows must never
+ *   appear in output (e.g. resolved gateway tokens, the master key). Redacted by
+ *   EXACT MATCH regardless of surrounding context — this closes the bare-secret
+ *   gap (a high-entropy token with no `key=`/`token:` prefix that the regex
+ *   patterns miss) with ZERO false-positive risk (no entropy heuristic that would
+ *   over-redact git SHAs / hashes). Empty or sub-`KNOWN_SECRET_MIN_LENGTH` values
+ *   are ignored so a misconfigured short value can never redact ordinary text.
  *
  * Uses Result<T,E> pattern.
  */
-export function createOutputGuard() {
+export function createOutputGuard(opts) {
+    // Bind + dedupe the eligible known secrets ONCE at creation (longest-first so a
+    // secret that is a substring of another is handled deterministically).
+    const boundKnownSecrets = Array.from(new Set((opts?.knownSecrets ?? []).filter((s) => typeof s === "string" && s.trim().length >= KNOWN_SECRET_MIN_LENGTH))).sort((a, b) => b.length - a.length);
     return {
         scan(response, context) {
             const findings = [];
@@ -63,7 +77,22 @@ export function createOutputGuard() {
                     });
                 }
             }
-            // 2. Check canary token leakage -- always critical, redact in sanitized
+            // 2. Bound known-secret values -- exact-match redaction (the daemon's own
+            // credentials). Catches BARE high-entropy secrets the prefix-gated regex
+            // patterns miss, with zero false-positive risk. Position references the
+            // ORIGINAL response.
+            for (const secret of boundKnownSecrets) {
+                if (response.includes(secret)) {
+                    sanitized = sanitized.replaceAll(secret, "[REDACTED:known_secret]");
+                    findings.push({
+                        type: "secret_leak",
+                        pattern: "known_secret",
+                        position: response.indexOf(secret),
+                        severity: "critical",
+                    });
+                }
+            }
+            // 3. Check canary token leakage -- always critical, redact in sanitized
             if (context?.canaryToken && response.includes(context.canaryToken)) {
                 sanitized = sanitized.replaceAll(context.canaryToken, "[REDACTED:canary]");
                 findings.push({
@@ -73,7 +102,7 @@ export function createOutputGuard() {
                     severity: "critical",
                 });
             }
-            // 3. Check prompt extraction patterns -- warning severity, detect-only
+            // 4. Check prompt extraction patterns -- warning severity, detect-only
             for (const pattern of PROMPT_EXTRACTION_PATTERNS_LOCAL) {
                 pattern.regex.lastIndex = 0;
                 let match;
@@ -90,5 +119,21 @@ export function createOutputGuard() {
             const blocked = findings.some(f => f.severity === "critical");
             return ok({ safe, blocked, findings, sanitized });
         },
+        // ENDPOINT-03 (Phase 211): register a runtime secret (the minted lease
+        // bearer) so the NEXT scan redacts it. scan() reads `boundKnownSecrets`
+        // live each call, so pushing here is read immediately. The same
+        // KNOWN_SECRET_MIN_LENGTH floor + longest-first ordering the constructor
+        // applies are re-applied so a short/empty value can never redact ordinary
+        // text and a substring secret is handled deterministically.
+        registerSecret(value) {
+            if (typeof value !== "string" || value.trim().length < KNOWN_SECRET_MIN_LENGTH) {
+                return; // floor: short/empty/whitespace never registered
+            }
+            if (boundKnownSecrets.includes(value)) {
+                return; // dedup: already registered
+            }
+            boundKnownSecrets.push(value);
+            boundKnownSecrets.sort((a, b) => b.length - a.length); // longest-first
+        },
     };
 }

package/node_modules/@comis/core/dist/security/patterns/credential-log.d.ts

@@ -31,6 +31,15 @@ export declare const JWT_PATTERN: RegExp;
 export declare const URL_PASSWORD: RegExp;
 /** Generic hex secret (40+ chars) */
 export declare const HEX_SECRET_LONG: RegExp;
+/**
+ * FAL API key: `<uuid-or-token>:<24+ hex>` (CR-01, Phase 192). A FAL `FAL_KEY`
+ * is a uuid-shaped id joined by `:` to a long hex secret half — caught by NEITHER
+ * `HEX_SECRET_LONG` (the uuid half has hyphens; the hex half is ~32 < 40 chars)
+ * NOR the digit-prefixed `TELEGRAM_BOT_TOKEN`. The 24-char-hex floor on the tail
+ * is what keeps ordinary `host:8080` / `key:value` prose from matching (a colon
+ * alone is not enough — the high-entropy hex tail is the discriminator). The head
+ * is hex + hyphens (a uuid) so a plain word before the colon does not match. */
+export declare const FAL_KEY: RegExp;
 /** GitHub token (all prefixes: ghp, gho, ghu, ghs, ghr) */
 export declare const GITHUB_TOKEN_FULL: RegExp;
 /** All credential log patterns. */

package/node_modules/@comis/core/dist/security/patterns/credential-log.js

@@ -32,6 +32,15 @@ export const JWT_PATTERN = /\beyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-
 export const URL_PASSWORD = /:\/\/([^:]+):([^@]{3,})@/g;
 /** Generic hex secret (40+ chars) */
 export const HEX_SECRET_LONG = /\b[0-9a-f]{40,}\b/gi;
+/**
+ * FAL API key: `<uuid-or-token>:<24+ hex>` (CR-01, Phase 192). A FAL `FAL_KEY`
+ * is a uuid-shaped id joined by `:` to a long hex secret half — caught by NEITHER
+ * `HEX_SECRET_LONG` (the uuid half has hyphens; the hex half is ~32 < 40 chars)
+ * NOR the digit-prefixed `TELEGRAM_BOT_TOKEN`. The 24-char-hex floor on the tail
+ * is what keeps ordinary `host:8080` / `key:value` prose from matching (a colon
+ * alone is not enough — the high-entropy hex tail is the discriminator). The head
+ * is hex + hyphens (a uuid) so a plain word before the colon does not match. */
+export const FAL_KEY = /\b[0-9a-fA-F][0-9a-fA-F-]{7,}:[0-9a-fA-F]{24,}\b/g;
 /** GitHub token (all prefixes: ghp, gho, ghu, ghs, ghr) */
 export const GITHUB_TOKEN_FULL = /\bgh[pousr]_[A-Za-z0-9_]{36,}\b/g;
 /** All credential log patterns. */
@@ -48,5 +57,6 @@ export const CREDENTIAL_LOG_PATTERNS = [
     JWT_PATTERN,
     URL_PASSWORD,
     HEX_SECRET_LONG,
+    FAL_KEY,
     GITHUB_TOKEN_FULL,
 ];

package/node_modules/@comis/core/dist/security/provider-catalog/index.d.ts

@@ -0,0 +1,5 @@
+export type { HostPattern, InjectionRule, RequestFinalizer, StaticHeader, HostRule, BrokerBinding, ProviderPreset, PresetLibrary } from "./types.js";
+export type { InjectionInput } from "./injection-engine.js";
+export { normalizeHost, hostRuleMatches, pathAllowed, resolveBinding } from "./matcher.js";
+export { applyInjections } from "./injection-engine.js";
+export { expandPreset, PRESETS } from "./presets.js";

package/node_modules/@comis/core/dist/security/provider-catalog/index.js

@@ -0,0 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// provider-catalog public surface
+export { normalizeHost, hostRuleMatches, pathAllowed, resolveBinding } from "./matcher.js";
+export { applyInjections } from "./injection-engine.js";
+export { expandPreset, PRESETS } from "./presets.js";

package/node_modules/@comis/core/dist/security/provider-catalog/injection-engine.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Injection engine — applies credential injection rules to a mutable request.
+ *
+ * Port of OneCLI `inject.rs` `apply_injections` and `apply_set_param` (Apache-2.0).
+ *
+ * Pure module — no logger, no I/O, no side-effects beyond mutating the caller-
+ * supplied Headers and URL objects.  The `secret` field of `InjectionInput` MUST
+ * NOT appear in any log call — there are zero loggers in this module.
+ *
+ * Security invariants:
+ *   - `replaceHeader` is a strict no-op when the target header is absent.
+ *     It MUST NOT introduce credentials into requests that did not already
+ *     carry the header.
+ *   - `applySetParam` uses raw string append to preserve the existing query
+ *     bytes verbatim.  `url.searchParams.set(...)` is FORBIDDEN here because
+ *     it re-encodes the entire query string, corrupting HMAC-signed requests.
+ *   - CRLF rejection in header names is delegated to the WHATWG `Headers`
+ *     implementation (Node 22 built-in).
+ *
+ * @module
+ */
+import type { InjectionRule } from "./types.js";
+/** Mutable request surfaces that `applyInjections` writes credentials into. */
+export interface InjectionInput {
+    /** Mutable WHATWG Headers from the intercepted request. */
+    readonly headers: Headers;
+    /** Mutable WHATWG URL from the intercepted request. */
+    readonly url: URL;
+    /** The already-resolved API key / credential.  MUST NOT be logged. */
+    readonly secret: string;
+}
+/**
+ * Applies the injection rule array to the mutable `input`, writing credentials
+ * into the request headers and/or URL query string.
+ *
+ * Default-Bearer: when `rules` is empty, falls back to injecting
+ * `Authorization: Bearer <secret>` — the generic REST-API credential pattern.
+ *
+ * Rules are applied in declaration order; later rules overwrite earlier ones on
+ * the same header name (last-wins).
+ */
+export declare function applyInjections(rules: readonly InjectionRule[], input: InjectionInput): void;

package/node_modules/@comis/core/dist/security/provider-catalog/injection-engine.js

@@ -0,0 +1,101 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Injection engine — applies credential injection rules to a mutable request.
+ *
+ * Port of OneCLI `inject.rs` `apply_injections` and `apply_set_param` (Apache-2.0).
+ *
+ * Pure module — no logger, no I/O, no side-effects beyond mutating the caller-
+ * supplied Headers and URL objects.  The `secret` field of `InjectionInput` MUST
+ * NOT appear in any log call — there are zero loggers in this module.
+ *
+ * Security invariants:
+ *   - `replaceHeader` is a strict no-op when the target header is absent.
+ *     It MUST NOT introduce credentials into requests that did not already
+ *     carry the header.
+ *   - `applySetParam` uses raw string append to preserve the existing query
+ *     bytes verbatim.  `url.searchParams.set(...)` is FORBIDDEN here because
+ *     it re-encodes the entire query string, corrupting HMAC-signed requests.
+ *   - CRLF rejection in header names is delegated to the WHATWG `Headers`
+ *     implementation (Node 22 built-in).
+ *
+ * @module
+ */
+// ── applySetParam (private) ───────────────────────────────────────────────────
+/**
+ * Appends `name=value` to `url.search` using raw string concatenation so that
+ * pre-existing query bytes are preserved verbatim.
+ *
+ * DO NOT replace this with `url.searchParams.set(name, value)` — that API
+ * re-encodes the entire existing query string, corrupting percent-encoded
+ * sequences such as HMAC signatures (`%2F` → `%252F`).
+ */
+function applySetParam(url, name, value) {
+    const hash = url.hash; // e.g. "#section"
+    url.hash = "";
+    const encodedPair = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
+    url.search = url.search === "" ? `?${encodedPair}` : `${url.search}&${encodedPair}`;
+    url.hash = hash;
+}
+// ── applyInjections ───────────────────────────────────────────────────────────
+/**
+ * Applies the injection rule array to the mutable `input`, writing credentials
+ * into the request headers and/or URL query string.
+ *
+ * Default-Bearer: when `rules` is empty, falls back to injecting
+ * `Authorization: Bearer <secret>` — the generic REST-API credential pattern.
+ *
+ * Rules are applied in declaration order; later rules overwrite earlier ones on
+ * the same header name (last-wins).
+ */
+export function applyInjections(rules, input) {
+    // Default: empty rules → Authorization: Bearer <secret>
+    if (rules.length === 0) {
+        input.headers.set("authorization", `Bearer ${input.secret}`);
+        return;
+    }
+    for (const rule of rules) {
+        switch (rule.kind) {
+            case "setHeader": {
+                const value = rule.format === "bearer"
+                    ? `Bearer ${input.secret}`
+                    : input.secret;
+                input.headers.set(rule.name, value);
+                if (rule.removeAuthorization === true) {
+                    input.headers.delete("authorization");
+                }
+                break;
+            }
+            case "replaceHeader": {
+                // Strict no-op when the header is absent.
+                // Never introduce credentials into requests that did not already
+                // carry the target header.
+                if (input.headers.has(rule.name)) {
+                    const value = rule.format === "bearer"
+                        ? `Bearer ${input.secret}`
+                        : input.secret;
+                    input.headers.set(rule.name, value);
+                }
+                break;
+            }
+            case "removeHeader": {
+                // WHATWG Headers.delete() is case-insensitive.
+                input.headers.delete(rule.name);
+                break;
+            }
+            case "setParam": {
+                applySetParam(input.url, rule.name, input.secret);
+                break;
+            }
+            default: {
+                // Exhaustiveness guard — catches new InjectionRule kinds at compile time.
+                // At runtime the unreachable branch throws to prevent silent credential omission.
+                // (File is in packages/core/src/security/ — exception zone; throw is allowed.)
+                const _exhaustive = rule;
+                // Only serialize the `kind` discriminant — never JSON.stringify the
+                // full rule object, which may contain a `value` field in a future rule kind
+                // that holds a credential. Restricting to `kind` prevents credential-in-log.
+                throw new Error(`Unknown injection rule kind: ${String(_exhaustive.kind)}`);
+            }
+        }
+    }
+}

package/node_modules/@comis/core/dist/security/provider-catalog/matcher.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Host/path matcher for the credential-injection broker.
+ *
+ * Port of OneCLI `apps.rs` host_rule_matches + provider_for_host_and_path
+ * (Apache-2.0, https://github.com/anthropics/onecli/blob/main/src/gateway/apps.rs :71-909).
+ *
+ * Faithful-but-honest deltas from the original:
+ *   - `normalizeHost` fixes the OneCLI `strip_port` IPv6 bug (`gateway.rs:866`) by detecting
+ *     a leading `[` bracket and extracting the IPv6 literal before any colon scan.
+ *   - `resolveBinding` implements two-pass priority (path-scoped rules beat host-only) as a
+ *     provider-agnostic primitive; the curated `apps.rs` preset catalog is optional sugar only
+ *     (see `presets.ts`).
+ *   - Fail-closed defaults throughout: unknown host → undefined; empty `pathPolicy` → deny all.
+ *
+ * Consumed by the CredentialBroker on every CONNECT request. No I/O, no logger,
+ * no timestamps — fully deterministic pure functions.
+ *
+ * @module
+ */
+import type { BrokerBinding, HostRule } from "./types.js";
+/**
+ * Normalise a CONNECT authority string to a bare lowercase hostname.
+ *
+ * Handles:
+ *   - Port stripping (`api.example.com:443` → `api.example.com`)
+ *   - Lowercasing (`API.Example.COM` → `api.example.com`)
+ *   - FQDN trailing dot (`api.example.com.` → `api.example.com`)
+ *   - Bracketed IPv6 with port (`[2606:4700::1]:443` → `2606:4700::1`)
+ *   - Bare bracketed IPv6 (`[::1]` → `::1`)
+ *
+ * Fixes the OneCLI `gateway.rs:866` IPv6 bug where naive last-colon stripping would
+ * corrupt `[2606:4700::1]:443` to `[2606`.
+ */
+export declare function normalizeHost(authority: string): string;
+/**
+ * Test whether a host rule's pattern matches the (already-normalised) hostname.
+ *
+ * Exact: strict equality.
+ * Suffix: `hostname.endsWith(suffix) && hostname.length > suffix.length` — the length guard
+ *   is mandatory: the bare suffix string itself must never match its own rule.
+ */
+export declare function hostRuleMatches(rule: HostRule, hostname: string): boolean;
+/**
+ * Evaluate the rule's `pathPolicy` glob allow-list against the request path.
+ *
+ * Port of path_matches (apps.rs :213-280). Four glob forms:
+ *   - bare wildcard (*) matches all paths
+ *   - boundary glob (/v1/*): path must start with /v1/ AND have at least one more segment
+ *   - prefix glob (/v1/messages*): path must start with the literal prefix /v1/messages
+ *   - segment wildcard (/repos/STAR/issues): exactly one path segment in the wildcard slot
+ *
+ * Query string is stripped before comparison.
+ * Fail-closed: `pathPolicy: []` rejects all paths.
+ *
+ * Path normalization: `/../` and `/./` segments are resolved before comparison
+ * via `new URL(path, "https://x").pathname`. Malformed paths that cannot be
+ * parsed return false (deny). This is defense-in-depth — the CredentialBroker
+ * MUST also normalize the raw path before calling this function.
+ */
+export declare function pathAllowed(rule: HostRule, path: string): boolean;
+/**
+ * Resolve the best `{ binding, rule }` pair for a (hostname, path) request.
+ *
+ * Two-pass priority (port of `provider_for_host_and_path`, apps.rs):
+ *   1. Path-scoped rules (those with `rule.pathPrefix` defined) are evaluated first.
+ *   2. Host-only rules (no `pathPrefix`) are evaluated in config order as fallback.
+ *
+ * Returns `undefined` when no binding matches — fail-closed.
+ * `hostname` is assumed already normalised by the caller.
+ */
+export declare function resolveBinding(bindings: readonly BrokerBinding[], hostname: string, path: string): {
+    binding: BrokerBinding;
+    rule: HostRule;
+} | undefined;