comisai 1.0.42 → 1.0.44

package/node_modules/@comis/daemon/dist/api/agent-handlers.js

@@ -14,6 +14,7 @@
  * the runtime agents map, and returns structured results.
  * @module
  */
+import { AuthorizationError } from "./errors.js";
 import { PerAgentConfigSchema, AgentsCreateContract, AgentsGetContract, AgentsUpdateContract, AgentsDeleteContract, AgentsSuspendContract, AgentsResumeContract, AgentGetOperationModelsContract, stripInternalFields, systemGetEnv, } from "@comis/core";
 import { resolveOperationModel, resolveProviderFamily, OPERATION_TIER_MAP, DEFAULT_PROVIDER_KEYS, } from "@comis/agent";
 import { resolveWorkspaceDir } from "@comis/core";
@@ -41,7 +42,7 @@ export function createAgentHandlers(deps) {
         [AgentsCreateContract.method]: async (rawParams) => {
             const trustLevel = rawParams._trustLevel;
             if (trustLevel !== "admin") {
-                throw new Error("Admin access required for agent creation");
+                throw new AuthorizationError("Admin access required for agent creation");
             }
             // Bespoke pre-Zod validation FIRST (preserves user-friendly error
             // messages matching existing handler-test assertions).
@@ -135,7 +136,17 @@ export function createAgentHandlers(deps) {
             // Hot-add agent to running daemon without restart
             if (deps.hotAdd) {
                 try {
-                    await deps.hotAdd(agentId, parsedConfig);
+                    // Derive the RAW (pre-Zod-default) rag.rerank.enabled from the
+                    // RPC `config` (NOT parsedConfig — the parse defaults unset to a concrete false and
+                    // erases the signal). Coerce only genuine booleans; anything else -> undefined (unset)
+                    // so the hot-added agent's effective-rerank precedence distinguishes unset from off.
+                    const rawRerank = (() => {
+                        const rag = config?.["rag"];
+                        const rerank = rag !== null && typeof rag === "object" ? rag["rerank"] : undefined;
+                        const enabled = rerank !== null && typeof rerank === "object" ? rerank["enabled"] : undefined;
+                        return typeof enabled === "boolean" ? enabled : undefined;
+                    })();
+                    await deps.hotAdd(agentId, parsedConfig, rawRerank);
                 }
                 catch (hotAddErr) {
                     deps.persistDeps?.logger.warn({ method: "agents.create", agentId, err: hotAddErr,
@@ -212,7 +223,7 @@ export function createAgentHandlers(deps) {
         [AgentsUpdateContract.method]: async (rawParams) => {
             const trustLevel = rawParams._trustLevel;
             if (trustLevel !== "admin") {
-                throw new Error("Admin access required for agent modification");
+                throw new AuthorizationError("Admin access required for agent modification");
             }
             const agentId = rawParams.agentId;
             if (!agentId) {
@@ -224,6 +235,12 @@ export function createAgentHandlers(deps) {
             }
             const userParams = stripInternalFields(rawParams);
             const params = AgentsUpdateContract.request.parse(userParams);
+            // dryRun: run the SAME validation below (deep-merge + Zod parse +
+            // oauthProfiles existence check + credential guard/probe) but skip BOTH
+            // the in-memory hot-apply and the config.yaml persist at the end. The
+            // web editor's "Validate" button sends this so validating prod config
+            // does not silently mutate config.yaml / config.last-good.yaml.
+            const dryRun = params.dryRun === true;
             const config = params.config ?? {};
             // Capture user-provided fields before deep-merge mutates config.
             // persistToConfig does deepMerge(existingYAML, patch) internally,
@@ -342,6 +359,17 @@ export function createAgentHandlers(deps) {
                     }
                 }
             }
+            // dryRun stops here: validation above has passed (it would have thrown
+            // otherwise), so report success WITHOUT hot-applying or persisting. The
+            // in-memory agent map is left as the pre-call reference and config.yaml
+            // is untouched.
+            if (dryRun) {
+                deps.persistDeps?.logger.debug({ method: "agents.update", agentId, step: "dry-run-validate" }, "agents.update dry-run validated config without persisting or hot-applying");
+                const result = { agentId, config: parsedConfig, updated: true };
+                if (IS_DEV)
+                    AgentsUpdateContract.response.parse(result);
+                return result;
+            }
             deps.agents[agentId] = parsedConfig;
             // Best-effort persistence to config.yaml
             if (deps.persistDeps) {
@@ -365,7 +393,7 @@ export function createAgentHandlers(deps) {
         [AgentsDeleteContract.method]: async (rawParams) => {
             const trustLevel = rawParams._trustLevel;
             if (trustLevel !== "admin") {
-                throw new Error("Admin access required for agent deletion");
+                throw new AuthorizationError("Admin access required for agent deletion");
             }
             const agentId = rawParams.agentId;
             if (!agentId) {
@@ -416,7 +444,7 @@ export function createAgentHandlers(deps) {
         [AgentsSuspendContract.method]: async (rawParams) => {
             const trustLevel = rawParams._trustLevel;
             if (trustLevel !== "admin") {
-                throw new Error("Admin access required for agent suspension");
+                throw new AuthorizationError("Admin access required for agent suspension");
             }
             const agentId = rawParams.agentId;
             if (!agentId) {
@@ -439,7 +467,7 @@ export function createAgentHandlers(deps) {
         [AgentsResumeContract.method]: async (rawParams) => {
             const trustLevel = rawParams._trustLevel;
             if (trustLevel !== "admin") {
-                throw new Error("Admin access required for agent resumption");
+                throw new AuthorizationError("Admin access required for agent resumption");
             }
             const agentId = rawParams.agentId;
             if (!agentId) {

package/node_modules/@comis/daemon/dist/api/agent-inline-workspace.js

@@ -57,6 +57,7 @@ function resolveTarget(workspaceDir, filename) {
  */
 async function attemptWrite(deps, agentId, filename, targetPath, content) {
     try {
+        // fs-safe-allowed: targetPath is per-agent workspace ROLE.md/IDENTITY.md, operator-configured; not ~/.comis/ directly
         await writeFile(targetPath, content, { encoding: "utf8" });
         return ok(undefined);
     }

package/node_modules/@comis/daemon/dist/api/auth-handlers.d.ts

@@ -14,9 +14,11 @@
  * "active profile" concept (see
  * packages/core/src/ports/oauth-credential-store.ts lines 46-52).
  *
- * NOTE: there is intentionally NO `auth.login` daemon RPC method either.
- * Daemon-assisted OAuth login is out of scope (would require its own
- * threat-model amendment).
+ * `auth.set` (AuthSetContract, scopes:["admin"]) is the daemon-assisted
+ * OAuth-login RPC, authorized by the §8.1 threat-model amendment in
+ * DESIGN-credential-storage-modes.md. The CLI runs the OAuth browser/device
+ * flow locally, then delegates persistence to this handler so the CLI never
+ * imports @comis/memory or opens secrets.db.
  *
  * Reviewers: this file returns OAuth-token-bearing data structurally (the
  * un-projected `OAuthProfile[]` lives in handler closure scope between the
@@ -63,12 +65,12 @@ import type { RpcHandler } from "./types.js";
 import type { AuthApiDeps as AuthHandlerDeps } from "./types.js";
 export type { AuthHandlerDeps };
 /**
- * Create the 2 admin-scoped encrypted-OAuth-profile RPC handlers.
+ * Create the 3 admin-scoped encrypted-OAuth-profile RPC handlers.
  *
  * @param deps Injected dependencies (OAuthCredentialStorePort, AppContainer,
  *   ComisLogger). When `oauthCredentialStore` is undefined the handlers
  *   degrade gracefully: `auth.list` returns an empty array; `auth.logout`
- *   rejects with a config-pointer error.
- * @returns Handler map: `auth.list`, `auth.logout`.
+ *   and `auth.set` reject with a config-pointer error.
+ * @returns Handler map: `auth.list`, `auth.logout`, `auth.set`.
  */
 export declare function createAuthHandlers(deps: AuthHandlerDeps): Record<string, RpcHandler>;

package/node_modules/@comis/daemon/dist/api/auth-handlers.js

@@ -16,9 +16,11 @@
  * "active profile" concept (see
  * packages/core/src/ports/oauth-credential-store.ts lines 46-52).
  *
- * NOTE: there is intentionally NO `auth.login` daemon RPC method either.
- * Daemon-assisted OAuth login is out of scope (would require its own
- * threat-model amendment).
+ * `auth.set` (AuthSetContract, scopes:["admin"]) is the daemon-assisted
+ * OAuth-login RPC, authorized by the §8.1 threat-model amendment in
+ * DESIGN-credential-storage-modes.md. The CLI runs the OAuth browser/device
+ * flow locally, then delegates persistence to this handler so the CLI never
+ * imports @comis/memory or opens secrets.db.
  *
  * Reviewers: this file returns OAuth-token-bearing data structurally (the
  * un-projected `OAuthProfile[]` lives in handler closure scope between the
@@ -54,7 +56,8 @@
  *
  * @module
  */
-import { AuthListContract, AuthLogoutContract, stripInternalFields, systemGetEnv, systemNowMs, } from "@comis/core";
+import { AuthorizationError } from "./errors.js";
+import { AuthListContract, AuthLogoutContract, AuthSetContract, redactEmailForLog, stripInternalFields, systemGetEnv, systemNowMs, } from "@comis/core";
 // ---------------------------------------------------------------------------
 // Token-stripping projection
 // ---------------------------------------------------------------------------
@@ -82,13 +85,13 @@ function redactProfileForRpc(p) {
 // Factory
 // ---------------------------------------------------------------------------
 /**
- * Create the 2 admin-scoped encrypted-OAuth-profile RPC handlers.
+ * Create the 3 admin-scoped encrypted-OAuth-profile RPC handlers.
  *
  * @param deps Injected dependencies (OAuthCredentialStorePort, AppContainer,
  *   ComisLogger). When `oauthCredentialStore` is undefined the handlers
  *   degrade gracefully: `auth.list` returns an empty array; `auth.logout`
- *   rejects with a config-pointer error.
- * @returns Handler map: `auth.list`, `auth.logout`.
+ *   and `auth.set` reject with a config-pointer error.
+ * @returns Handler map: `auth.list`, `auth.logout`, `auth.set`.
  */
 export function createAuthHandlers(deps) {
     return {
@@ -110,7 +113,7 @@ export function createAuthHandlers(deps) {
             // rawParams BEFORE the strip-and-parse step.
             const trustLevel = rawParams._trustLevel;
             if (trustLevel !== "admin") {
-                throw new Error("Admin access required for auth.list");
+                throw new AuthorizationError("Admin access required for auth.list");
             }
             if (!deps.oauthCredentialStore) {
                 // No encrypted store configured -- return empty list, not an error.
@@ -175,7 +178,7 @@ export function createAuthHandlers(deps) {
             // Admin gate FIRST (separate from the contract schema).
             const trustLevel = rawParams._trustLevel;
             if (trustLevel !== "admin") {
-                throw new Error("Admin access required for auth.logout");
+                throw new AuthorizationError("Admin access required for auth.logout");
             }
             // Bespoke profileId guard runs BEFORE the contract parse so the
             // user-facing error message stays
@@ -187,8 +190,8 @@ export function createAuthHandlers(deps) {
                 throw new Error("Missing required parameter: profileId");
             }
             if (!deps.oauthCredentialStore) {
-                throw new Error("Encrypted OAuth store not configured (SECRETS_MASTER_KEY missing or oauth.storage is 'file'). " +
-                    "Run `comis secrets init --write` then restart the daemon, or switch oauth.storage to 'file'.");
+                throw new Error("Encrypted OAuth store not configured (SECRETS_MASTER_KEY missing or security.storage is 'file' or 'env'). " +
+                    "Run `comis secrets init --write` then restart the daemon, or set security.storage: file in your config.yaml.");
             }
             // Strip dispatcher-injected _X internals + contract-parse for
             // type narrowing (defense-in-depth — the bespoke guard above
@@ -241,5 +244,113 @@ export function createAuthHandlers(deps) {
             }
             return result;
         },
+        /**
+         * auth.set -- persist a completed OAuthProfile received from the CLI after
+         * the OAuth browser/device flow. Admin only. The CLI never opens secrets.db
+         * or reads SECRETS_MASTER_KEY — it delegates the write to this handler.
+         *
+         * Response is token-free: `{ profileId, stored: true }`. Tokens live only
+         * inside the encrypted store from this point forward.
+         */
+        [AuthSetContract.method]: async (rawParams) => {
+            const startMs = systemNowMs();
+            // 1. Admin gate — read BEFORE stripInternalFields (dispatcher injects _trustLevel).
+            const trustLevel = rawParams._trustLevel;
+            if (trustLevel !== "admin") {
+                throw new AuthorizationError("Admin access required for auth.set");
+            }
+            // 2. Guard: store must exist (encrypted mode requires daemon-owned store;
+            //    env mode rejects login at CLI level before reaching here).
+            if (!deps.oauthCredentialStore) {
+                throw new Error("Encrypted OAuth store not configured. Daemon must be running with " +
+                    "security.storage: encrypted and SECRETS_MASTER_KEY set, " +
+                    "or set security.storage: file in config.yaml.");
+            }
+            // 3. Strip dispatcher internals, then contract-parse (type narrowing +
+            //    version:1 guard). The parse cannot fail by construction if the CLI
+            //    used callTyped(AuthSetContract, ...) correctly.
+            const userParams = stripInternalFields(rawParams);
+            const params = AuthSetContract.request.parse(userParams);
+            // 4. Build OAuthProfile (version pinned to 1 by contract literal guard).
+            const profile = {
+                provider: params.provider,
+                profileId: params.profileId,
+                access: params.access,
+                refresh: params.refresh,
+                expires: params.expires,
+                accountId: params.accountId,
+                email: params.email,
+                displayName: params.displayName,
+                version: 1,
+            };
+            // 5. Write through port.
+            const writeResult = await deps.oauthCredentialStore.set(params.profileId, profile);
+            if (!writeResult.ok) {
+                // Map SQLITE_BUSY to an actionable retryable error hint.
+                const isBusy = writeResult.error.message.includes("database is locked") ||
+                    writeResult.error.message.includes("SQLITE_BUSY");
+                const hint = isBusy
+                    ? "secrets.db is temporarily locked; wait a moment and retry the login command"
+                    : "Check secrets.db integrity and SECRETS_MASTER_KEY availability";
+                deps.logger.error({
+                    method: "auth.set",
+                    profileId: params.profileId,
+                    provider: params.provider,
+                    durationMs: systemNowMs() - startMs,
+                    outcome: "failure",
+                    err: writeResult.error,
+                    hint,
+                    errorKind: "config",
+                }, "OAuth profile write failed");
+                throw new Error(`Failed to persist OAuth profile: ${hint}`);
+            }
+            // 6. Audit + log — ONLY provider/profileId/redacted-email.
+            //    NEVER access, refresh, or accountId (residency requirement).
+            deps.container.eventBus.emit("audit:event", {
+                timestamp: systemNowMs(),
+                agentId: "system",
+                tenantId: deps.container.config.tenantId ?? "default",
+                actionType: "auth.set",
+                kind: "auth_mutation",
+                outcome: "success",
+                metadata: {
+                    provider: params.provider,
+                    profileId: params.profileId,
+                },
+            });
+            // The identity field must NOT embed accountId when email is absent.
+            // The residency rule (§6, auth-handlers.ts header) allows only
+            // provider/profileId/redacted-email in log output. Using a non-
+            // identifying sentinel keeps the log line informative without leaking
+            // an account identifier when the OAuth provider returns no email.
+            deps.logger.info({
+                method: "auth.set",
+                provider: params.provider,
+                profileId: params.profileId,
+                identity: redactEmailForLog(params.email) ?? "<email-unavailable>",
+                durationMs: systemNowMs() - startMs,
+                outcome: "success",
+            }, "OAuth profile stored via daemon RPC");
+            // 7. Emit auth:profile_added so in-process subscribers (e.g., the
+            //    encrypted-mode OAuthTokenManager cache invalidation wired in
+            //    setup-agents-oauth.ts) can react without a daemon restart.
+            //    The file-mode watcher emits this event via chokidar; encrypted
+            //    mode has no watcher — this RPC handler is the only writer, so
+            //    the emission lives here. Payload is metadata-only (no tokens).
+            deps.container.eventBus.emit("auth:profile_added", {
+                provider: params.provider,
+                profileId: params.profileId,
+                identity: redactEmailForLog(params.email) ?? "<email-unavailable>",
+                source: "external",
+                timestamp: systemNowMs(),
+            });
+            // 8. Token-free response; dev-mode residency canary strips any
+            //    accidental token additions (Zod closed schema is defense-in-depth).
+            const result = { profileId: params.profileId, stored: true };
+            if (systemGetEnv("NODE_ENV") !== "production") {
+                AuthSetContract.response.parse(result);
+            }
+            return result;
+        },
     };
 }

package/node_modules/@comis/daemon/dist/api/autonomy-handlers.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Autonomy RPC handler module (Phase 213-06, REVOKE-01/03) — the operator-facing
+ * live-control surface of the bounded-autonomy control plane:
+ *
+ *   - `lease.revoke {leaseId|rootRunId}` — COOPERATIVE stop. Revoke a single
+ *     capability lease by `leaseId`, OR every lease of a spawn tree by
+ *     `rootRunId` (cascading each to its descendants). The LeaseManager then
+ *     denies the next RPC the bearer makes (REVOKE-01 "external to + non-bypassable
+ *     by the agent"). Returns the content-free revoked COUNT.
+ *   - `run.kill {rootRunId}` — HARD stop. Kill every run of the spawn tree
+ *     (`subAgentRunner.killByRootRun` aborts each SDK session) AND revoke every
+ *     lease of the tree (`leaseManager.revokeByRootRun`) so a survivor child can
+ *     never keep operating (REVOKE-03). Returns the content-free killed COUNT.
+ *   - `autonomy.evict {rootRunId}` — DEMOTE (Phase 217-04, EVICT-01). Marks the
+ *     `rootRunId` in the daemon-wide evicted-set (`evictRegistry.mark`); the
+ *     bounded-autonomy chokepoint consults it at the NEXT gate decision (EVICT-03,
+ *     mid-run) to resolve the run's effective profile to `default`. UNLIKE
+ *     revoke/kill, evict does NOT abort — the run CONTINUES under `default` (which
+ *     still escalates outward, never auto-sends). Returns the content-free
+ *     `{ evicted }` boolean. Registered ONLY when the OPTIONAL `evictRegistry`
+ *     dep is wired (HIGH-1 — the Wave-2 composition root supplies it).
+ *
+ * DENY-BY-ORIGIN IS AUTOMATIC — there is NO manual agent-origin check here (it
+ * would drift, and the single-chokepoint arch gate forbids per-handler scatter).
+ * All three methods are `scopes:["admin"]` (Plan 03 / Plan 04) → they land in the
+ * DERIVED `ADMIN_METHODS` → the dispatch chokepoint's origin guard
+ * (rpc-dispatch.ts) denies any agent-origin call BEFORE the handler runs (an agent
+ * cannot self-un-evict — T-217-12). The autonomy-handlers test proves the deny on
+ * the dispatch path.
+ *
+ * Per-method pipeline mirrors `subagent-handlers.ts`: bespoke pre-Zod guard
+ * FIRST (rawParams reads → user-friendly error) → stripInternalFields →
+ * request.parse → business logic → dev-mode response.parse. Content-free §2.7
+ * logging (count + method only — NEVER the bearer or param bodies).
+ *
+ * @module
+ */
+import type { DurableRunPort, EventMap } from "@comis/core";
+import type { LeaseManager } from "@comis/infra";
+import type { ComisLogger } from "@comis/infra";
+import type { EvictRegistry } from "../autonomy/evict-registry.js";
+import type { RpcHandler } from "./types.js";
+/**
+ * The narrow deps the autonomy handlers read. `ApiDispatchDeps` (the dispatcher's
+ * superset) is assignable to this by structural subtyping — `leaseManager` is
+ * threaded onto `OrchestratorApiDeps`, `subAgentRunner` already lives there, and
+ * `logger` is required on every slice.
+ */
+export interface AutonomyHandlerDeps {
+    /** The credential-broker lease authority — the revoke fan-outs (Plan 02). */
+    leaseManager: LeaseManager;
+    /** The sub-agent runner — `killByRootRun` aborts a whole spawn tree (Plan 01). */
+    subAgentRunner: {
+        killByRootRun(rootRunId: string): {
+            killed: number;
+        };
+    };
+    /**
+     * Phase 216 (DUR-03): the durable-run store. OPTIONAL — when a `rootRunId` is
+     * revoked (lease.revoke by rootRunId, OR run.kill), the handler ALSO calls
+     * `invalidateForRevoke(rootRunId)` so the persisted checkpoint flips to status
+     * `revoked` and a subsequent boot can NEVER re-mint the pre-revoke caps (the
+     * resurrection-window close, invariant #6/#13). **Absent ⇒ inert** (the lease
+     * revoke alone still stops the live bearer; the persisted record is just not
+     * poisoned — only matters once durability is enabled, which is when the daemon
+     * wires this). Best-effort: an invalidate error is WARN-logged, never fails the
+     * revoke RPC (the lease is already revoked — the cooperative/hard stop holds).
+     */
+    durableRuns?: DurableRunPort;
+    /**
+     * Phase 217-04 (EVICT-01): the daemon-wide evicted-`rootRunId` set. OPTIONAL —
+     * the sole call site (rpc-dispatch.ts, `createAutonomyHandlers({ ...deps,
+     * leaseManager: deps.leaseManager })`) does NOT supply it until the Wave-2
+     * composition root (Plan 05) constructs `createEvictRegistry` and threads it
+     * onto `deps`. CRITICAL (HIGH-1): it MUST stay OPTIONAL so the Wave-1 `pnpm
+     * build` compiles with the unchanged call site; the `autonomy.evict` handler is
+     * registered ONLY when this is present (mirrors how `leaseManager`/
+     * `boundedAutonomy` gate whole handler families). **Absent ⇒ the autonomy.evict
+     * method is simply not registered** (a stray call hits the dispatcher's
+     * unknown-method path) — no build break, no half-wired handler.
+     */
+    evictRegistry?: EvictRegistry;
+    /**
+     * FLEET-03 (Phase 220-01): the typed event bus. OPTIONAL — when wired, the
+     * handlers emit a content-free `autonomy:revoked` (lease.revoke by rootRunId) /
+     * `autonomy:killed` (run.kill) BESIDE the existing INFO line so `comis fleet`
+     * surfaces the revoke/kill counts. **Absent ⇒ no emit, byte-identical pre-220
+     * boot** (mirrors the `durableRuns?`/`evictRegistry?` optional-dep convention).
+     * The PRODUCTION construction site (rpc-dispatch.ts createAutonomyHandlers)
+     * MUST supply `deps.container.eventBus` — otherwise the live daemon emits
+     * nothing and Plan 03's counts are silently zero.
+     */
+    eventBus?: {
+        emit<K extends keyof EventMap>(event: K, payload: EventMap[K]): void;
+    };
+    /**
+     * FLEET-03: the wiring-layer clock for the emitted-event timestamp. Supplied as
+     * `systemNowMs` by the construction site (the globals-gate-safe wiring clock the
+     * execution:aborted emit uses) — NEVER `Date.now()`/`new Date()` here. Only read
+     * when `eventBus` is present (the production site supplies both together).
+     */
+    now?: () => number;
+    /** Structured logger for the content-free §2.7 instrumentation. */
+    logger: ComisLogger;
+}
+/**
+ * Create the autonomy RPC handlers bound to the given deps. Spread into the
+ * dispatcher alongside `...createSubagentHandlers(deps)`.
+ */
+export declare function createAutonomyHandlers(deps: AutonomyHandlerDeps): Record<string, RpcHandler>;

package/node_modules/@comis/daemon/dist/api/autonomy-handlers.js

@@ -0,0 +1,186 @@
+// SPDX-License-Identifier: Apache-2.0
+// @allow-throw: RPC handler module — all throws are caught and converted to JSON-RPC error responses by rpc-dispatch.ts:306-321.
+/**
+ * Autonomy RPC handler module (Phase 213-06, REVOKE-01/03) — the operator-facing
+ * live-control surface of the bounded-autonomy control plane:
+ *
+ *   - `lease.revoke {leaseId|rootRunId}` — COOPERATIVE stop. Revoke a single
+ *     capability lease by `leaseId`, OR every lease of a spawn tree by
+ *     `rootRunId` (cascading each to its descendants). The LeaseManager then
+ *     denies the next RPC the bearer makes (REVOKE-01 "external to + non-bypassable
+ *     by the agent"). Returns the content-free revoked COUNT.
+ *   - `run.kill {rootRunId}` — HARD stop. Kill every run of the spawn tree
+ *     (`subAgentRunner.killByRootRun` aborts each SDK session) AND revoke every
+ *     lease of the tree (`leaseManager.revokeByRootRun`) so a survivor child can
+ *     never keep operating (REVOKE-03). Returns the content-free killed COUNT.
+ *   - `autonomy.evict {rootRunId}` — DEMOTE (Phase 217-04, EVICT-01). Marks the
+ *     `rootRunId` in the daemon-wide evicted-set (`evictRegistry.mark`); the
+ *     bounded-autonomy chokepoint consults it at the NEXT gate decision (EVICT-03,
+ *     mid-run) to resolve the run's effective profile to `default`. UNLIKE
+ *     revoke/kill, evict does NOT abort — the run CONTINUES under `default` (which
+ *     still escalates outward, never auto-sends). Returns the content-free
+ *     `{ evicted }` boolean. Registered ONLY when the OPTIONAL `evictRegistry`
+ *     dep is wired (HIGH-1 — the Wave-2 composition root supplies it).
+ *
+ * DENY-BY-ORIGIN IS AUTOMATIC — there is NO manual agent-origin check here (it
+ * would drift, and the single-chokepoint arch gate forbids per-handler scatter).
+ * All three methods are `scopes:["admin"]` (Plan 03 / Plan 04) → they land in the
+ * DERIVED `ADMIN_METHODS` → the dispatch chokepoint's origin guard
+ * (rpc-dispatch.ts) denies any agent-origin call BEFORE the handler runs (an agent
+ * cannot self-un-evict — T-217-12). The autonomy-handlers test proves the deny on
+ * the dispatch path.
+ *
+ * Per-method pipeline mirrors `subagent-handlers.ts`: bespoke pre-Zod guard
+ * FIRST (rawParams reads → user-friendly error) → stripInternalFields →
+ * request.parse → business logic → dev-mode response.parse. Content-free §2.7
+ * logging (count + method only — NEVER the bearer or param bodies).
+ *
+ * @module
+ */
+import { LeaseRevokeContract, RunKillContract, AutonomyEvictContract, stripInternalFields, systemGetEnv, } from "@comis/core";
+// ---------------------------------------------------------------------------
+// Dev-mode response parse helper (mirrors subagent-handlers.ts)
+// ---------------------------------------------------------------------------
+/**
+ * Run `contract.response.parse(result)` only when NODE_ENV !== "production".
+ * Daemon side is the trust boundary; in production the trust check is the
+ * in-handler logic, not the contract parse.
+ */
+const IS_DEV = systemGetEnv("NODE_ENV") !== "production";
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+/**
+ * Create the autonomy RPC handlers bound to the given deps. Spread into the
+ * dispatcher alongside `...createSubagentHandlers(deps)`.
+ */
+export function createAutonomyHandlers(deps) {
+    /**
+     * DUR-03: poison the persisted run record on revoke so a subsequent boot finds
+     * status='revoked' and ORPHANS the run rather than re-minting the pre-revoke
+     * caps. Best-effort — a write error is WARN-logged but never fails the revoke
+     * RPC (the in-memory lease is already revoked, so the live bearer is dead
+     * regardless; this only affects post-restart resumability). Inert when no
+     * durable store is wired (durability off).
+     */
+    async function invalidatePersistedRecord(rootRunId, method) {
+        if (!deps.durableRuns)
+            return;
+        const r = await deps.durableRuns.invalidateForRevoke(rootRunId);
+        if (!r.ok) {
+            deps.logger.warn({ method, err: r.error, hint: "could not flip the durable run record to 'revoked'; a restart could resume it — verify the run is dead", errorKind: "dependency" }, "Durable record invalidate-on-revoke failed (lease still revoked)");
+        }
+    }
+    // HIGH-1: capture the OPTIONAL evictRegistry once so the conditional spread
+    // narrows it to non-undefined inside the evict handler closure (no `!`
+    // non-null assertion needed). Absent ⇒ the autonomy.evict key is omitted from
+    // the returned record entirely (the Wave-1 partial-boot state).
+    const evictRegistry = deps.evictRegistry;
+    return {
+        [LeaseRevokeContract.method]: async (rawParams) => {
+            // Bespoke pre-Zod guard FIRST (one-of required; user-friendly message).
+            const leaseId = rawParams.leaseId;
+            const rootRunId = rawParams.rootRunId;
+            if (!leaseId && !rootRunId) {
+                throw new Error("Missing required parameter: leaseId or rootRunId");
+            }
+            const userParams = stripInternalFields(rawParams);
+            LeaseRevokeContract.request.parse(userParams);
+            let revoked = 0;
+            if (rootRunId) {
+                // Revoke every lease of the spawn tree (cascading each — Plan 02).
+                revoked = deps.leaseManager.revokeByRootRun(rootRunId).revoked;
+                // DUR-03: ALSO poison the persisted checkpoint so a restart cannot
+                // resurrect the pre-revoke caps (the resurrection-window close).
+                await invalidatePersistedRecord(rootRunId, LeaseRevokeContract.method);
+            }
+            else if (leaseId) {
+                // Single-lease cooperative stop — report the HONEST count: 1 if the lease
+                // existed (now revoked), 0 for an unknown id (never a phantom revoke:1 —
+                // the live VPS finding where a nonexistent leaseId reported revoked:1
+                // while the rootRunId path honestly reported 0).
+                revoked = deps.leaseManager.revoke(leaseId).revoked;
+            }
+            // §2.7: content-free completion line — the COUNT + method only, never the
+            // bearer or the selector bodies.
+            deps.logger.info({ method: LeaseRevokeContract.method, revoked, by: rootRunId ? "rootRunId" : "leaseId" }, "Capability lease(s) revoked");
+            // FLEET-03: a typed content-free event BESIDE the INFO line — only on a
+            // rootRunId revoke (a by-leaseId revoke has no rootRunId). Carries the COUNT
+            // + the id + timestamp ONLY (T-220-02). Absent eventBus ⇒ no emit.
+            if (rootRunId) {
+                deps.eventBus?.emit("autonomy:revoked", {
+                    rootRunId,
+                    revoked,
+                    timestamp: deps.now?.() ?? 0,
+                });
+            }
+            const result = { revoked };
+            if (IS_DEV)
+                LeaseRevokeContract.response.parse(result);
+            return result;
+        },
+        [RunKillContract.method]: async (rawParams) => {
+            // Bespoke pre-Zod guard FIRST.
+            const rootRunId = rawParams.rootRunId;
+            if (!rootRunId) {
+                throw new Error("Missing required parameter: rootRunId");
+            }
+            const userParams = stripInternalFields(rawParams);
+            RunKillContract.request.parse(userParams);
+            // HARD stop: kill every run of the tree (abort the SDK sessions) AND revoke
+            // every lease of the tree so a survivor child cannot keep operating.
+            const { killed } = deps.subAgentRunner.killByRootRun(rootRunId);
+            deps.leaseManager.revokeByRootRun(rootRunId);
+            // DUR-03: ALSO poison the persisted checkpoint so a restart cannot resume
+            // the killed tree under re-minted pre-revoke caps (REVOKE-03 across restart).
+            await invalidatePersistedRecord(rootRunId, RunKillContract.method);
+            // §2.7: content-free completion line — the killed COUNT + method only.
+            deps.logger.info({ method: RunKillContract.method, killed }, "Spawn tree killed (hard stop) and its leases revoked");
+            // FLEET-03: a DISTINCT autonomy:killed event (separate from revoke — kill
+            // flips durable status to 'revoked' INDISTINGUISHABLY from a cooperative
+            // revoke, so the event is the only separator for the killed count). COUNT +
+            // id + timestamp ONLY (T-220-02). Absent eventBus ⇒ no emit.
+            deps.eventBus?.emit("autonomy:killed", {
+                rootRunId,
+                killed,
+                timestamp: deps.now?.() ?? 0,
+            });
+            const result = { killed };
+            if (IS_DEV)
+                RunKillContract.response.parse(result);
+            return result;
+        },
+        // HIGH-1: gate the autonomy.evict handler on the OPTIONAL evictRegistry
+        // (mirrors the dispatch-wiring convention of gating whole handler families on
+        // leaseManager/boundedAutonomy). Absent ⇒ the method key is omitted (Wave-1
+        // partial boot); present ⇒ the closure reads the narrowed non-undefined
+        // registry. The contract↔handler parity gate accepts this conditional
+        // registration (the capabilities.introspect precedent, rpc-dispatch.ts).
+        ...(evictRegistry
+            ? {
+                [AutonomyEvictContract.method]: async (rawParams) => {
+                    // Bespoke pre-Zod guard FIRST (user-friendly message).
+                    const rootRunId = rawParams.rootRunId;
+                    if (!rootRunId) {
+                        throw new Error("Missing required parameter: rootRunId");
+                    }
+                    const userParams = stripInternalFields(rawParams);
+                    AutonomyEvictContract.request.parse(userParams);
+                    // DEMOTE (NOT kill): mark the rootRunId so the chokepoint resolves the
+                    // run's mode to `default` from the NEXT gate decision (EVICT-03). The
+                    // run KEEPS GOING under default — evict does not abort. `newlyEvicted`
+                    // reports whether THIS call changed state (the run is demoted either
+                    // way, so the response is { evicted: true } regardless).
+                    const { newlyEvicted } = evictRegistry.mark(rootRunId);
+                    // §2.7: content-free completion line — method + the newly/already enum
+                    // only, NEVER the selector body (rootRunId is an id, not a payload).
+                    deps.logger.info({ method: AutonomyEvictContract.method, newlyEvicted }, "Run demoted to default (evict-from-mode)");
+                    const result = { evicted: true };
+                    if (IS_DEV)
+                        AutonomyEvictContract.response.parse(result);
+                    return result;
+                },
+            }
+            : {}),
+    };
+}

package/node_modules/@comis/daemon/dist/api/cache-handlers.d.ts

@@ -0,0 +1,8 @@
+import type { RpcHandler } from "./types.js";
+import { type ObsHandlerDeps } from "./obs-handlers/obs-helpers.js";
+/**
+ * Bind the cache-stats RPC handler. Object-spread compatible with
+ * `Record<string, RpcHandler>` (the dispatch's standard handler-map
+ * shape).
+ */
+export declare function createCacheHandlers(deps: ObsHandlerDeps): Record<string, RpcHandler>;