comisai 1.0.42 → 1.0.44

package/node_modules/@comis/daemon/dist/wiring/video-delivery-limits.js

@@ -0,0 +1,205 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * DEL-03 (Phase 192 / Plan 03) — the per-channelType video-size limit table +
+ * the override-aware resolver + the link-vs-notice support map.
+ *
+ * THE DEL-03 RECONCILIATION (RESEARCH Open Q3). The design forbids BOTH:
+ *   (a) one hardcoded global per-platform byte cap, AND
+ *   (b) an invented per-platform byte table baked across the 9 adapter files.
+ * The reconciliation is a SINGLE per-channelType table here, where each entry is
+ * the platform's DOCUMENTED bot/upload limit (cited inline) — so each channel
+ * "owns its real limit" while the degrade DECISION stays at the central delivery
+ * site (the poller's `sendAttachment` branch), not scattered across adapters.
+ * The per-channel constant is OVERRIDABLE via the media-compressor `maxVideoBytes`
+ * config (the operator knob); an UNKNOWN channelType falls back to the same 25 MB
+ * default the media-compressor uses (`DEFAULT_COMPRESSION_CONFIG.maxVideoBytes`).
+ *
+ * THIS IS NOT THE SILENT-DROP PATH. `packages/channels/src/shared/media-compressor.ts`
+ * `compressAttachments` REMOVES an oversized attachment and appends an
+ * `[Attachment too large]` placeholder — the v2.23 anti-pattern DEL-03 exists to
+ * replace (PATTERNS §5b / Pitfall 5). The delivery site consults THIS table and
+ * sends a link/notice instead; an oversized clip is NEVER silently dropped.
+ *
+ * @module
+ */
+import { isBlockedObjectKey } from "@comis/core";
+const MB = 1024 * 1024;
+/**
+ * The honest conservative default — the media-compressor's `maxVideoBytes`
+ * default (`DEFAULT_COMPRESSION_CONFIG.maxVideoBytes = 25 * 1024 * 1024`). Used
+ * for an unknown channelType (and as the floor the per-channel constants are
+ * cited against). Kept as a literal (not an import) so this daemon-wiring file
+ * stays decoupled from the channels package's compression config.
+ */
+export const DEFAULT_VIDEO_SIZE_LIMIT = 25 * MB;
+/**
+ * Per-channelType documented bot/upload limit, in bytes. Each entry cites the
+ * platform's real limit (DEL-03: per-adapter, not an invented global). These are
+ * the HONEST defaults; an operator overrides any of them via the media-compressor
+ * `maxVideoBytes` config (passed as the `override` arg to `resolveVideoSizeLimit`).
+ *
+ * Sources (documented platform limits, conservative where a platform varies):
+ *   - telegram  : Bot API `sendVideo` cloud limit ≈ 50 MB (a self-hosted local
+ *                 Bot API server allows up to 2 GB, but 50 MB is the default).
+ *   - discord   : default (non-boosted) upload limit = 25 MB (raised from 8 MB
+ *                 in 2022; boosted servers go higher but 25 MB is the honest floor).
+ *   - slack     : file uploads up to ~1 GB, capped CONSERVATIVELY here to 100 MB
+ *                 (a clip over 100 MB is link-degraded rather than a slow upload).
+ *   - whatsapp  : video message limit ≈ 16 MB.
+ *   - line      : Messaging API video send ≈ 200 MB (renders a link reliably).
+ *   - signal    : attachment limit ≈ 100 MB.
+ *   - imessage  : attachment limit ≈ 100 MB.
+ *   - email     : common provider attachment cap ≈ 25 MB (Gmail).
+ *   - echo      : the in-tree test/echo adapter — generous (no real platform cap).
+ * IRC is intentionally ABSENT: it has no attachment surface (no `sendAttachment`),
+ * so it degrades via the DEL-02 capability gate (a notice), never a size check.
+ */
+export const VIDEO_SIZE_LIMITS = Object.freeze({
+    telegram: 50 * MB,
+    discord: 25 * MB,
+    slack: 100 * MB,
+    whatsapp: 16 * MB,
+    line: 200 * MB,
+    signal: 100 * MB,
+    imessage: 100 * MB,
+    email: 25 * MB,
+    echo: 1024 * MB,
+});
+/**
+ * Channels that render a clickable URL message — DEL-03's `link` degrade policy
+ * (send the RETAINED provider/workspace path as a message). A channel ABSENT here
+ * (and IRC, which has no attachment surface at all) degrades with a `notice`
+ * instead. Verified against the per-adapter audit (RESEARCH Open Q4/A4):
+ * Discord/Slack/Telegram/LINE/WhatsApp/Signal/iMessage/Email render a link in a
+ * text message; IRC does not (notice-only).
+ */
+const CHANNELS_RENDERING_VIDEO_LINK = Object.freeze({
+    telegram: true,
+    discord: true,
+    slack: true,
+    line: true,
+    whatsapp: true,
+    signal: true,
+    imessage: true,
+    email: true,
+});
+/**
+ * Resolve the video-size limit (bytes) for a channelType.
+ *
+ *   `override ?? VIDEO_SIZE_LIMITS[channelType] ?? DEFAULT_VIDEO_SIZE_LIMIT`
+ *
+ * - `override` is the operator's media-compressor `maxVideoBytes` (it WINS — DEL-03
+ *   "overridable via maxVideoBytes").
+ * - an UNKNOWN channelType (or a proto-pollution key) falls back to the 25 MB
+ *   default — NEVER throws, NEVER reads the prototype chain (SEC-04 guard).
+ */
+export function resolveVideoSizeLimit(channelType, override) {
+    if (typeof override === "number" && override > 0)
+        return override;
+    if (isBlockedObjectKey(channelType))
+        return DEFAULT_VIDEO_SIZE_LIMIT;
+    // eslint-disable-next-line security/detect-object-injection -- channelType is a platform-internal label, guarded by isBlockedObjectKey above (SEC-04 defense-in-depth); the table is a frozen own-property map.
+    const limit = VIDEO_SIZE_LIMITS[channelType];
+    return typeof limit === "number" ? limit : DEFAULT_VIDEO_SIZE_LIMIT;
+}
+/**
+ * True when the channel renders a clickable URL message (the `link` degrade
+ * policy). Proto-pollution-safe; an unknown channel is conservatively notice-only.
+ */
+export function channelRendersVideoLink(channelType) {
+    if (isBlockedObjectKey(channelType))
+        return false;
+    // eslint-disable-next-line security/detect-object-injection -- channelType is a platform-internal label, guarded by isBlockedObjectKey above; the map is a frozen own-property record.
+    return CHANNELS_RENDERING_VIDEO_LINK[channelType] === true;
+}
+/**
+ * WR-03 (Phase 192): hosts whose video `sourceUrl` is KEYED/private — fetchable
+ * ONLY with a secret the adapter correctly WITHHOLDS from the shared URL. Sharing
+ * such a URL as a `link` hands the user a DEAD link (a 403 without the key), and a
+ * keyed variant would LEAK the credential to the channel. So these are excluded
+ * from the `link` policy → they degrade to `notice` + the workspace path.
+ *   - generativelanguage.googleapis.com : the Veo Dev-API download host (the
+ *     un-keyed video.uri 403s without the `&key=GOOGLE_API_KEY` the adapter
+ *     appends only for its OWN download — veo-adapter.ts:132).
+ *   - api.x.ai / *.x.ai : the xAI/Grok private download host (bearer-gated).
+ * FAL renders to a PUBLIC CDN (fal.media / *.fal.media) needing no secret — that
+ * link IS shareable and stays the `link` policy.
+ */
+const KEYED_VIDEO_URL_HOST_SUFFIXES = Object.freeze([
+    "generativelanguage.googleapis.com",
+    "x.ai",
+]);
+/**
+ * WR-03: true when a provider `sourceUrl` is publicly fetchable WITHOUT a secret
+ * (so it is safe + useful to share as a `link`). False for a keyed/private host
+ * (Veo/Grok download URLs) and for a malformed/non-http URL (conservative — a URL
+ * we cannot classify is not shared). The clip's workspace path is always the
+ * recoverable artifact regardless, so a `false` here only downgrades to `notice`.
+ */
+export function isPubliclyFetchableVideoUrl(sourceUrl) {
+    let host;
+    try {
+        const u = new URL(sourceUrl);
+        if (u.protocol !== "https:" && u.protocol !== "http:")
+            return false;
+        host = u.hostname.toLowerCase();
+    }
+    catch {
+        return false; // malformed URL — never share
+    }
+    for (const suffix of KEYED_VIDEO_URL_HOST_SUFFIXES) {
+        if (host === suffix || host.endsWith(`.${suffix}`))
+            return false;
+    }
+    return true;
+}
+/**
+ * Human-readable byte formatter for the oversized-degrade notice text (e.g.
+ * "50.0 MB", "128 KB"). A local copy of the media-compressor `formatBytes` (that
+ * one is module-private + the media-compressor is the silent-drop file we must NOT
+ * import the drop logic from). Behavior-identical to the channels formatter.
+ */
+export function formatVideoBytes(bytes) {
+    if (bytes < 1024)
+        return `${bytes} B`;
+    if (bytes < MB)
+        return `${(bytes / 1024).toFixed(1)} KB`;
+    if (bytes < 1024 * MB)
+        return `${(bytes / MB).toFixed(1)} MB`;
+    return `${(bytes / (1024 * MB)).toFixed(1)} GB`;
+}
+/**
+ * Build the DEL-03 oversized-video degrade message for the delivery site. Where
+ * the channel renders links AND a retained provider URL is available AND that URL
+ * is PUBLICLY FETCHABLE without a secret (WR-03), the `link` policy shares that
+ * URL; otherwise the `notice` policy carries the local workspace path. EITHER WAY
+ * the persisted `filePath` is included so the clip is recoverable, and the text
+ * NEVER contains the v2.23 `[Attachment too large]` silent-drop marker (this is
+ * the visible-degrade replacement for it).
+ */
+export function buildOversizedDegradeMessage(args) {
+    const { channelType, sizeBytes, limit, filePath, sourceUrl } = args;
+    const sizeStr = formatVideoBytes(sizeBytes);
+    const limitStr = formatVideoBytes(limit);
+    // WR-03: only share `sourceUrl` as a link when the channel renders links AND the
+    // URL is publicly fetchable WITHOUT a secret. A keyed/private provider URL
+    // (Veo/Grok) would be a DEAD link to the user (403 without the key) or LEAK the
+    // key if keyed — degrade those to `notice` + the always-recoverable workspace path.
+    const link = channelRendersVideoLink(channelType) &&
+        typeof sourceUrl === "string" &&
+        sourceUrl.length > 0 &&
+        isPubliclyFetchableVideoUrl(sourceUrl)
+        ? sourceUrl
+        : undefined;
+    if (link !== undefined) {
+        return {
+            policy: "link",
+            text: `Your video (${sizeStr}) exceeds ${channelType}'s ${limitStr} upload limit, ` +
+                `so it is shared as a link: ${link}\nSaved to ${filePath}`,
+        };
+    }
+    return {
+        policy: "notice",
+        text: `Video too large for ${channelType} (${sizeStr} > ${limitStr}); saved to ${filePath}`,
+    };
+}

package/node_modules/@comis/daemon/dist/wiring/video-log-redaction.d.ts

@@ -0,0 +1,25 @@
+/** The redacted `{ errName, errMessage }` carrier spread into a log payload. */
+export interface RedactedErr {
+    errName: string;
+    errMessage: string;
+}
+/**
+ * Shape a raw Error for a log payload: the error name + its scrubbed,
+ * length-bounded message folded across the `err.cause` chain. Pattern-only scrub
+ * (`sanitizeLogString`) — use `makeRedactErr` to additionally exact-match-scrub
+ * bound secrets. Spread into the structured payload in place of a raw `err: cause`.
+ */
+export declare function redactErr(cause: Error): RedactedErr;
+/**
+ * Resolve the video creds (their VALUES, never the env-ref names) from the secret
+ * manager for the poller's exact-match log scrub. Absent keys drop out → the
+ * poller falls back to the pattern scrub only (no crash). Lives here (the SEC-03
+ * module) so the wiring site stays small (file-size discipline).
+ *
+ * @param secretManager - any object exposing `get(name): string | undefined`
+ *   (the daemon `SecretManager`; typed structurally to avoid a core type dep here).
+ */
+export declare function resolveVideoSecretsForRedaction(secretManager: {
+    get(name: string): string | undefined;
+}): string[];
+export declare function makeRedactErr(knownSecrets: readonly string[]): (cause: Error) => RedactedErr;

package/node_modules/@comis/daemon/dist/wiring/video-log-redaction.js

@@ -0,0 +1,109 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * SEC-03 (Phase 192): redaction-safe shaping of a RAW provider/channel Error
+ * before it rides a log line.
+ *
+ * The off-turn video poller logs failure causes — a FAL/Veo/Grok SDK error, a
+ * channel-adapter send error, a SQLite store error — whose free-text `message`
+ * (AND the message of every nested `err.cause`) can echo a key / bearer / the Veo
+ * `&key=AIza…` download URL / a FAL `<uuid>:<hex>` key. The Pino redact set only
+ * scrubs credential-NAMED structured keys; it never touches free-text inside
+ * `err.message` or `err.cause`. So a raw cause logged as `err: cause` leaks any
+ * secret in its (possibly nested) message.
+ *
+ * `redactErr` (CR-01) walks a BOUNDED `err.cause` chain, folds every level's
+ * message into one carrier, runs it through `sanitizeLogString` (the SECOND line
+ * of defense — Bearer/sk-/AIza/the FAL uuid:hex shape/etc. → `[REDACTED]`), and
+ * exact-match-scrubs any BOUND resolved video secret (the v2.20 OutputGuard
+ * `knownSecrets` precedent — catches ANY shape, incl. future ones, with zero
+ * false-positive risk). It returns a spreadable `{ errName, errMessage }`
+ * (bounded) for the log payload. The cause chain is preserved so the failure
+ * CLASS (DNS vs refused vs TLS — undici puts it in `err.cause`) stays diagnosable
+ * (§2.7 / the troubleshooting feedback loop), while any secret in it is redacted.
+ *
+ * The stack (which can also carry a URL) is intentionally dropped — AGENTS.md
+ * §2.7 keeps stack traces at DEBUG only, and the threat model forbids a credential
+ * at ANY level, so the redacted message is the safe carrier on WARN/ERROR.
+ *
+ * Use `makeRedactErr(videoSecrets)` at the wiring site (where the resolved
+ * GOOGLE_API_KEY/XAI_API_KEY/FAL_KEY/Grok-bearer are already in hand) to bind the
+ * exact-match scrub; the bare `redactErr` export is the pattern-only variant for
+ * call sites with no bound secret in scope.
+ *
+ * @module
+ */
+import { sanitizeLogString } from "@comis/core";
+/** Max logged message length (mirrors the pi-event-bridge sanitized-error bound). */
+const MAX_ERR_MESSAGE_CHARS = 1500;
+/** Bounded `err.cause` walk depth — folds the realistic undici
+ *  `TypeError("fetch failed", { cause })` chain without looping on a cyclic cause. */
+const MAX_CAUSE_DEPTH = 4;
+/** Minimum length for a bound known-secret to be eligible for exact-match scrub —
+ *  guards against a short/empty value redacting ordinary text (the OutputGuard
+ *  `KNOWN_SECRET_MIN_LENGTH` precedent). */
+const KNOWN_SECRET_MIN_LENGTH = 8;
+/** Fold an Error + its bounded `cause` chain into one " <- "-joined message. A
+ *  non-Error cause (string/undefined/cyclic past the depth bound) terminates the
+ *  walk. Preserves each level's text so the failure class survives redaction. */
+function foldCauseChain(cause) {
+    const parts = [];
+    let cur = cause;
+    for (let d = 0; d < MAX_CAUSE_DEPTH && cur instanceof Error; d++) {
+        parts.push(cur.message);
+        cur = cur.cause;
+    }
+    return parts.join(" <- ");
+}
+/**
+ * Shape a raw Error for a log payload: the error name + its scrubbed,
+ * length-bounded message folded across the `err.cause` chain. Pattern-only scrub
+ * (`sanitizeLogString`) — use `makeRedactErr` to additionally exact-match-scrub
+ * bound secrets. Spread into the structured payload in place of a raw `err: cause`.
+ */
+export function redactErr(cause) {
+    return makeRedactErr([])(cause);
+}
+/**
+ * Build a `redactErr`-shaped scrubber bound to the resolved video secrets
+ * (`knownSecrets`) so they are removed by EXACT MATCH from every log surface —
+ * the robust, shape-independent guard (catches the FAL `uuid:hex` shape and any
+ * future shape a regex would miss) with zero false-positive risk. Empty or
+ * sub-`KNOWN_SECRET_MIN_LENGTH` values are ignored so a misconfigured short value
+ * can never redact ordinary text, and the absent-key case (no secret bound) falls
+ * back to the pattern scrub only (no crash). The bound list is never logged.
+ *
+ * @param knownSecrets - Resolved secret VALUES (the agent's GOOGLE_API_KEY /
+ *   XAI_API_KEY / FAL_KEY / the Grok bearer) — never the env-ref names.
+ */
+/** The names of the video creds resolved for the SEC-03 exact-match log scrub —
+ *  the SAME creds the adapters use (CRED-01, no video-specific secret). */
+const VIDEO_SECRET_NAMES = ["GOOGLE_API_KEY", "XAI_API_KEY", "FAL_KEY"];
+/**
+ * Resolve the video creds (their VALUES, never the env-ref names) from the secret
+ * manager for the poller's exact-match log scrub. Absent keys drop out → the
+ * poller falls back to the pattern scrub only (no crash). Lives here (the SEC-03
+ * module) so the wiring site stays small (file-size discipline).
+ *
+ * @param secretManager - any object exposing `get(name): string | undefined`
+ *   (the daemon `SecretManager`; typed structurally to avoid a core type dep here).
+ */
+export function resolveVideoSecretsForRedaction(secretManager) {
+    return VIDEO_SECRET_NAMES.map((name) => secretManager.get(name)).filter((s) => typeof s === "string" && s.length > 0);
+}
+export function makeRedactErr(knownSecrets) {
+    // Bind + dedupe the eligible secrets ONCE (longest-first so a secret that is a
+    // substring of another is removed deterministically). Mirrors createOutputGuard.
+    const bound = Array.from(new Set((knownSecrets ?? []).filter((s) => typeof s === "string" && s.trim().length >= KNOWN_SECRET_MIN_LENGTH))).sort((a, b) => b.length - a.length);
+    return (cause) => {
+        let merged = sanitizeLogString(foldCauseChain(cause));
+        // Exact-match scrub the bound resolved secrets (after the pattern pass, so a
+        // shape the regex missed is still removed). replaceAll → every occurrence. The
+        // labeled placeholder mirrors the OutputGuard `[REDACTED:known_secret]` idiom
+        // (NOT the bare `[REDACTED]` literal banned in production source).
+        for (const secret of bound) {
+            if (merged.includes(secret))
+                merged = merged.replaceAll(secret, "[REDACTED:video_secret]");
+        }
+        return { errName: cause.name, errMessage: merged.slice(0, MAX_ERR_MESSAGE_CHARS) };
+    };
+}

package/node_modules/@comis/daemon/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/daemon",
   "private": true,
-  "version": "1.0.42",
+  "version": "1.0.44",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Background daemon and orchestrator for the Comis platform",
@@ -13,7 +13,7 @@
     "orchestrator"
   ],
   "engines": {
-    "node": ">=22"
+    "node": ">=22.19.0"
   },
   "files": [
     "dist",
@@ -43,8 +43,5 @@
   "scripts": {
     "build": "tsc",
     "test": "vitest run"
-  },
-  "optionalDependencies": {
-    "sd-notify": "2.8.0"
   }
 }

package/node_modules/@comis/gateway/dist/acp/acp-activity-bridge.d.ts

@@ -0,0 +1,64 @@
+/**
+ * acp-activity-bridge — maps redacted {@link ActivityEvent}s to ACP
+ * `session/update` frames while NEVER letting raw tool params cross
+ * the wire (spec §19.6).
+ *
+ * The bridge subscribes a single turn's activity stream via the
+ * `ActivityStreamPort`, and for each redacted event:
+ *
+ *   - pushes it into a LOCAL 256-slot FIFO drop-oldest queue
+ *     (`createAcpBoundedQueue`, NOT the observability one — gateway depends on
+ *     `@comis/core` + `@comis/shared` + the SDK only; spec §5.1 line 717),
+ *   - drains the queue SEQUENTIALLY, awaiting each `connection.sessionUpdate`
+ *     so the SDK write-queue preserves enqueue order,
+ *   - resolves the ACP session id from `event.sessionKey` via
+ *     `parseFormattedSessionKey(...).peerId` (the AcpSessionMap keys
+ *     `peerId === acpSessionId`), and no-ops if no connection is retained.
+ *
+ * Phase → SessionUpdate is a closed-union switch (AGENTS.md §2.8): `start` →
+ * `tool_call`, `progress | end` → `tool_call_update`, with an exhaustive
+ * `const _exhaustive: never` default.
+ *
+ * §19.6: the produced `tool_call` / `tool_call_update` objects
+ * carry ONLY `toolCallId` / `title` / `status`. The SDK's raw-input/raw-output
+ * fields are NEVER referenced, and the redacted event params (even though
+ * sanitized at emit) are NEVER forwarded to any SDK field — carrying them would
+ * re-open the data-protection surface and make this guarantee fragile. The bridge is a
+ * void-emitter (it does not throw and carries no allow-throw annotation); the
+ * logger is injected via Deps (no module-level logger factory, no
+ * infra-package import).
+ *
+ * @module
+ */
+import type { ActivityStreamPort, ComisLogger, TurnActivityContext } from "@comis/core";
+import type { AgentSideConnection } from "@agentclientprotocol/sdk";
+/** Dependencies for {@link createAcpActivityBridge}. */
+export interface CreateAcpActivityBridgeDeps {
+    /**
+     * Per-turn activity subscription seam. The concrete impl lives in
+     * the observability package; the gateway receives the bound port shape from
+     * `@comis/core`.
+     */
+    readonly activityStreamPort: ActivityStreamPort;
+    /**
+     * Look up the retained `AgentSideConnection` for an ACP session id.
+     * Returns `undefined` for an unknown / dropped session — the bridge
+     * then no-ops for that event.
+     */
+    readonly getConnection: (acpSessionId: string) => AgentSideConnection | undefined;
+    /** Injected bound logger. Optional — DEBUG-level drop/no-op traces. */
+    readonly logger?: ComisLogger;
+}
+/** A subscribed ACP activity bridge — call `subscribe(ctx)` to start a turn. */
+export interface AcpActivityBridge {
+    /**
+     * Begin mapping a single turn's redacted ActivityEvents to ACP
+     * `session/update` frames. Returns an `unsubscribe()` that detaches the
+     * underlying activity-stream subscription (cleanup symmetry).
+     */
+    subscribe(ctx: TurnActivityContext): () => void;
+}
+/**
+ * Create the ACP activity bridge. Pure factory — no I/O until `subscribe()`.
+ */
+export declare function createAcpActivityBridge(deps: CreateAcpActivityBridgeDeps): AcpActivityBridge;

package/node_modules/@comis/gateway/dist/acp/acp-activity-bridge.js

@@ -0,0 +1,115 @@
+import { parseFormattedSessionKey } from "@comis/core";
+import { createAcpBoundedQueue, DEFAULT_ACP_QUEUE_CAPACITY, } from "./acp-bounded-queue.js";
+/**
+ * Map a redacted {@link ActivityEvent} to its SDK {@link SessionUpdate}.
+ *
+ * §19.6: carries ONLY `toolCallId` / `title` / `status`. The SDK's
+ * raw-input/raw-output fields are never set and the redacted event params are
+ * never forwarded.
+ */
+function toSessionUpdate(e) {
+    switch (e.phase) {
+        case "start":
+            return {
+                sessionUpdate: "tool_call",
+                toolCallId: e.toolCallId ?? e.activityId,
+                // ToolCall.title is REQUIRED; source from the redacted label/toolName.
+                title: e.defaultLabel ?? e.toolName ?? "tool",
+                status: "pending",
+            };
+        case "progress":
+        case "end":
+            return {
+                sessionUpdate: "tool_call_update",
+                toolCallId: e.toolCallId ?? e.activityId,
+                status: e.status === "completed"
+                    ? "completed"
+                    : e.status === "failed"
+                        ? "failed"
+                        : "in_progress",
+            };
+        default: {
+            // Exhaustive closed-union guard (AGENTS.md §2.8): a new phase fails tsc.
+            const _exhaustive = e.phase;
+            return _exhaustive;
+        }
+    }
+}
+/**
+ * Create the ACP activity bridge. Pure factory — no I/O until `subscribe()`.
+ */
+export function createAcpActivityBridge(deps) {
+    return {
+        subscribe(ctx) {
+            // Local 256-slot bounded queue. Drop-oldest backpressure caps
+            // memory if the IDE consumer is slow (spec §5.1 line 717 = 256).
+            const queue = createAcpBoundedQueue({
+                capacity: DEFAULT_ACP_QUEUE_CAPACITY,
+            });
+            // Serialize the async drain so enqueue order is preserved on the wire
+            // even when multiple events arrive before a drain completes.
+            let draining = Promise.resolve();
+            const pump = () => {
+                draining = draining.then(async () => {
+                    for (const event of queue.drain()) {
+                        const acpSessionId = parseFormattedSessionKey(event.sessionKey)?.peerId;
+                        if (acpSessionId === undefined) {
+                            deps.logger?.debug?.({
+                                sessionKey: event.sessionKey,
+                                submodule: "acp-activity-bridge",
+                                step: "resolve-session",
+                            }, "activity event sessionKey has no acp peerId — dropping");
+                            continue;
+                        }
+                        const connection = deps.getConnection(acpSessionId);
+                        if (connection === undefined) {
+                            // No retained connection (dropped / unknown session) — no-op.
+                            continue;
+                        }
+                        // SINGLE-ARG sessionUpdate({ sessionId, update }) (acp.d.ts:45).
+                        // await so the SDK write-queue preserves enqueue order. The await
+                        // is isolated in a try/catch INSIDE the .then callback so a single
+                        // rejected frame (e.g. the IDE disconnects mid-turn and the writer
+                        // closes) is logged and dropped WITHOUT rejecting the `draining`
+                        // chain — a rejected chain would poison every later pump's
+                        // `.then`, silently dropping all remaining frames for the turn
+                        // The bridge stays a non-throwing void-emitter (no
+                        // allow-throw); only the redacted SDK error is logged, never the
+                        // params.
+                        try {
+                            await connection.sessionUpdate({
+                                sessionId: acpSessionId,
+                                update: toSessionUpdate(event),
+                            });
+                        }
+                        catch (err) {
+                            deps.logger?.debug?.({
+                                err,
+                                acpSessionId,
+                                submodule: "acp-activity-bridge",
+                                step: "session-update",
+                                hint: "IDE connection may have closed; frame dropped, chain preserved",
+                                errorKind: "dependency",
+                            }, "acp sessionUpdate failed — dropping frame, chain preserved");
+                        }
+                    }
+                });
+            };
+            const subscription = deps.activityStreamPort.subscribeForTurn(ctx, (event) => {
+                const dropped = queue.push(event);
+                if (dropped > 0) {
+                    deps.logger?.debug?.({
+                        agentId: event.agentId,
+                        droppedCount: queue.droppedCount(),
+                        submodule: "acp-activity-bridge",
+                        step: "queue-overflow",
+                    }, "acp activity queue overflow — dropped oldest event");
+                }
+                pump();
+            });
+            return function unsubscribe() {
+                subscription.unsubscribe();
+            };
+        },
+    };
+}

package/node_modules/@comis/gateway/dist/acp/acp-approval-bridge.d.ts

@@ -0,0 +1,65 @@
+/**
+ * acp-approval-bridge — maps a redacted `kind:"approval"` {@link ActivityEvent}
+ * to a single SDK `connection.requestPermission(...)` round-trip on the
+ * retained per-session connection (spec §6.4 / §16.8). Surfaces the
+ * agent's approval gate as a native IDE permission modal.
+ *
+ * The bridge subscribes a single turn's activity stream via the
+ * `ActivityStreamPort` (the same seam as the activity bridge),
+ * and for each `kind:"approval"` event:
+ *
+ *   - resolves the ACP session id from `event.sessionKey` via
+ *     `parseFormattedSessionKey(...).peerId` (the AcpSessionMap keys
+ *     `peerId === acpSessionId`), no-opping if no connection is retained;
+ *   - builds a {@link RequestPermissionRequest} whose `options` are derived
+ *     from `event.approval.choices` (`id→optionId`, `defaultLabel→name`,
+ *     `id→kind`), and calls `connection.requestPermission(req)` exactly once;
+ *   - reads the SDK outcome and LOGS it (`"selected"` w/ optionId | `"cancelled"`).
+ *
+ * EMIT-AND-LOG (decision): no server-side ACP approval-response SINK exists yet,
+ * so the outcome is logged for the audit trail but NOT routed back into the §6.4
+ * approval gate. Routing is a deferred follow-up; the emission + the verified SDK
+ * contract are sufficient for the current bridge.
+ *
+ * §19.6: the produced `toolCall` (a `ToolCallUpdate`) carries ONLY
+ * `toolCallId` + `title`. The SDK's raw-input/raw-output fields are NEVER
+ * referenced, and the redacted event `params` are NEVER forwarded — the source
+ * `ApprovalCorrelation` deliberately has no full request id (only `shortId`),
+ * so nothing identifying crosses the wire. The bridge is a void-emitter (it does
+ * not throw and carries no allow-throw annotation); the logger is injected via
+ * Deps (no module-level logger factory, no infra-package import).
+ *
+ * @module
+ */
+import type { ActivityStreamPort, ComisLogger, TurnActivityContext } from "@comis/core";
+import type { AgentSideConnection } from "@agentclientprotocol/sdk";
+/** Dependencies for {@link createAcpApprovalBridge}. */
+export interface CreateAcpApprovalBridgeDeps {
+    /**
+     * Per-turn activity subscription seam. The concrete impl lives in
+     * the observability package; the gateway receives the bound port shape from
+     * `@comis/core`.
+     */
+    readonly activityStreamPort: ActivityStreamPort;
+    /**
+     * Look up the retained `AgentSideConnection` for an ACP session id.
+     * Returns `undefined` for an unknown / dropped session — the bridge
+     * then no-ops for that event.
+     */
+    readonly getConnection: (acpSessionId: string) => AgentSideConnection | undefined;
+    /** Injected bound logger. Optional — records the permission outcome. */
+    readonly logger?: ComisLogger;
+}
+/** A subscribed ACP approval bridge — call `subscribe(ctx)` to start a turn. */
+export interface AcpApprovalBridge {
+    /**
+     * Begin mapping a single turn's `kind:"approval"` ActivityEvents to SDK
+     * `requestPermission(...)` round-trips. Returns an `unsubscribe()` that
+     * detaches the underlying activity-stream subscription (cleanup symmetry).
+     */
+    subscribe(ctx: TurnActivityContext): () => void;
+}
+/**
+ * Create the ACP approval bridge. Pure factory — no I/O until `subscribe()`.
+ */
+export declare function createAcpApprovalBridge(deps: CreateAcpApprovalBridgeDeps): AcpApprovalBridge;