comisai 1.0.42 → 1.0.44

package/node_modules/@comis/agent/dist/model/effective-context-window.js

@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Effective context window resolver: deterministic min() reconciliation across
+ * the three sources that can constrain an agent's usable context window.
+ *
+ * Pure function — no side effects, no async, no DI. All context passed
+ * as parameters. Mirrors the operation-model-resolver.ts pattern.
+ *
+ * Sources (in priority order for tie-breaking — earlier wins on equal value):
+ *   1. configured  — operator config (contextWindow in providers/agents config)
+ *   2. served      — Ollama /api/ps num_ctx (present only when probe ran)
+ *   3. capability  — ModelProfile capabilityCap (Infinity for frontier/mid)
+ *
+ * Infinity capabilityCap is excluded from the min race: frontier/mid models
+ * carry Infinity to signal "no capability upper bound", so it must not shrink
+ * the configured window.
+ *
+ * @module
+ */
+// ---------------------------------------------------------------------------
+// Main resolver
+// ---------------------------------------------------------------------------
+/**
+ * Resolve the effective context window as min(configured, served?, capabilityCap).
+ *
+ * Rules:
+ * - `Infinity` capabilityCap is excluded from the race (not a constraint).
+ * - `undefined` served is excluded from the race (probe not available).
+ * - Ties resolve to the earlier candidate: configured > served > capability.
+ *   (The reduce uses strict `<`, so equal values keep the first/earlier entry.)
+ *
+ * @param input - The three possible window constraints
+ * @returns The minimum active constraint and the source that provided it
+ */
+export function resolveEffectiveContextWindow(input) {
+    const { configured, served, capabilityCap } = input;
+    // Build the candidate list in tie-break priority order (earlier wins on equal).
+    const candidates = [
+        { value: configured, source: "configured" },
+    ];
+    // served=undefined means the probe didn't run — exclude from the race.
+    if (served !== undefined) {
+        candidates.push({ value: served, source: "served" });
+    }
+    // Infinity capabilityCap means "no class-level upper bound" (frontier/mid).
+    // Exclude it so it does not constrain the configured window.
+    if (isFinite(capabilityCap)) {
+        candidates.push({ value: capabilityCap, source: "capability" });
+    }
+    // Stable min: strict `<` means ties keep the first (earlier) candidate.
+    const winner = candidates.reduce((a, b) => (b.value < a.value ? b : a));
+    return { effectiveWindow: winner.value, source: winner.source };
+}

package/node_modules/@comis/agent/dist/model/fresh-tail-clamp.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Resolve the clamped fresh-tail turn count, bounded so the verbatim fresh
+ * tail cannot alone consume more than 30% of the effective context window.
+ *
+ * Rules:
+ * - If effectiveWindow is not finite (frontier/mid models), returns
+ *   configuredTurns UNCHANGED — byte-identical guarantee.
+ * - Conservative 30% budget floor (§7 open measurement question):
+ *   affordable = floor(effectiveWindow * 0.3 / avgTokPerStep)
+ * - Returns min(configuredTurns, affordable), minimum 1.
+ * - The 30% fraction is a placeholder until the Phase-171 harness measures
+ *   actual recall impact. Do not treat it as a calibrated constant.
+ *
+ * Pure function — no side effects, no async, no DI. All context passed
+ * as parameters. Mirrors the effective-context-window.ts pattern.
+ *
+ * @module
+ */
+/**
+ * Resolve a clamped fresh-tail turn count from the effective context window.
+ *
+ * @param effectiveWindow - The reconciled effective window in tokens
+ *   (pass `Infinity` for frontier/mid — clamp will not fire).
+ * @param configuredTurns - The operator-configured freshTailTurns value
+ *   (from schema default 8, min 1, max 50).
+ * @param avgTokensPerStep - Optional estimated tokens per conversation step.
+ *   If omitted, estimated as `max(1, floor(effectiveWindow / 20))` (5% floor).
+ * @returns The clamped turn count — always ≥ 1, always ≤ configuredTurns.
+ *
+ * NB (ISSUE #1, 2026-06-22): this turn-count clamp is the COARSE upper bound only.
+ * The PRECISE residual enforcement for the protected fresh tail (so it always fits a
+ * small window where the system prompt dominates) lives in the lcd-assembler as a
+ * post-B-8 TOTAL token bound (boundFreshTailTotalToResidual) — a turn-count clamp is
+ * unreliable there because one oversized message (which B-8 bounds anyway) skews the
+ * per-step estimate.
+ */
+export declare function resolveClampedFreshTailTurns(effectiveWindow: number, configuredTurns: number, avgTokensPerStep?: number): number;

package/node_modules/@comis/agent/dist/model/fresh-tail-clamp.js

@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Resolve the clamped fresh-tail turn count, bounded so the verbatim fresh
+ * tail cannot alone consume more than 30% of the effective context window.
+ *
+ * Rules:
+ * - If effectiveWindow is not finite (frontier/mid models), returns
+ *   configuredTurns UNCHANGED — byte-identical guarantee.
+ * - Conservative 30% budget floor (§7 open measurement question):
+ *   affordable = floor(effectiveWindow * 0.3 / avgTokPerStep)
+ * - Returns min(configuredTurns, affordable), minimum 1.
+ * - The 30% fraction is a placeholder until the Phase-171 harness measures
+ *   actual recall impact. Do not treat it as a calibrated constant.
+ *
+ * Pure function — no side effects, no async, no DI. All context passed
+ * as parameters. Mirrors the effective-context-window.ts pattern.
+ *
+ * @module
+ */
+/**
+ * Resolve a clamped fresh-tail turn count from the effective context window.
+ *
+ * @param effectiveWindow - The reconciled effective window in tokens
+ *   (pass `Infinity` for frontier/mid — clamp will not fire).
+ * @param configuredTurns - The operator-configured freshTailTurns value
+ *   (from schema default 8, min 1, max 50).
+ * @param avgTokensPerStep - Optional estimated tokens per conversation step.
+ *   If omitted, estimated as `max(1, floor(effectiveWindow / 20))` (5% floor).
+ * @returns The clamped turn count — always ≥ 1, always ≤ configuredTurns.
+ *
+ * NB (ISSUE #1, 2026-06-22): this turn-count clamp is the COARSE upper bound only.
+ * The PRECISE residual enforcement for the protected fresh tail (so it always fits a
+ * small window where the system prompt dominates) lives in the lcd-assembler as a
+ * post-B-8 TOTAL token bound (boundFreshTailTotalToResidual) — a turn-count clamp is
+ * unreliable there because one oversized message (which B-8 bounds anyway) skews the
+ * per-step estimate.
+ */
+export function resolveClampedFreshTailTurns(effectiveWindow, configuredTurns, avgTokensPerStep) {
+    if (!isFinite(effectiveWindow))
+        return configuredTurns; // frontier/mid: byte-identical
+    // Estimate tokens per step if not provided (5% of effectiveWindow as single-step floor)
+    const tokPerStep = avgTokensPerStep !== undefined && avgTokensPerStep > 0
+        ? avgTokensPerStep
+        : Math.max(1, Math.floor(effectiveWindow / 20));
+    const budget = Math.floor(effectiveWindow * 0.3);
+    const affordable = Math.max(1, Math.floor(budget / tokPerStep));
+    return Math.min(configuredTurns, affordable);
+}

package/node_modules/@comis/agent/dist/model/model-registry-adapter.d.ts

@@ -14,7 +14,22 @@ import type { Api, Model } from "@earendil-works/pi-ai";
 import type { ThinkingLevel } from "@earendil-works/pi-agent-core";
 import type { SecretManager } from "@comis/core";
 import type { ModelAllowlist } from "./model-allowlist.js";
-/** Result of initial model resolution. */
+/**
+ * Result of initial model resolution.
+ *
+ * SA6a: This interface mirrors the shape of `InitialModelResult` in
+ * `@earendil-works/pi-coding-agent` (dist/core/model-resolver.d.ts).
+ * The SDK type is structurally identical but is NOT re-exported from the
+ * package root and `./core/model-resolver` is absent from the package's
+ * `exports` map (which only exposes `.` and `./hooks`). With
+ * `moduleResolution:NodeNext`, importing from that subpath is a hard
+ * TS2307 error. This local definition is therefore retained as-is.
+ *
+ * Migration path: when @earendil-works/pi-coding-agent adds
+ * `"./core/model-resolver"` to its exports map, replace this interface
+ * with: `export type { InitialModelResult } from
+ * "@earendil-works/pi-coding-agent/core/model-resolver";`
+ */
 export interface InitialModelResult {
     /** Resolved model, or undefined if no match / blocked by allowlist. */
     model: Model<Api> | undefined;
@@ -31,6 +46,14 @@ export interface InitialModelResult {
  * have API keys configured in AuthStorage.
  */
 export declare function createModelRegistryAdapter(authStorage: AuthStorage): ModelRegistry;
+/**
+ * Normalize a user-supplied baseUrl for {@link OPENAI_COMPAT_V1_TYPES} so a
+ * host-only origin reaches the `/v1` OpenAI-compat mount. A baseUrl that
+ * already carries a path (including `/v1`, or a custom reverse-proxy path) is
+ * returned unchanged — we only fill in the missing mount for the bare-root
+ * case. Unparseable values and non-local types pass through untouched.
+ */
+export declare function normalizeOpenAICompatBaseUrl(baseUrl: string | undefined, type: string): string | undefined;
 /** Subset of `ProviderEntry` (from `@comis/core`) we read for pi registration. */
 export interface CustomProviderRegistration {
     type: string;

package/node_modules/@comis/agent/dist/model/model-registry-adapter.js

@@ -11,6 +11,7 @@
  */
 import { ModelRegistry } from "@earendil-works/pi-coding-agent";
 import { getModels, getProviders } from "@earendil-works/pi-ai";
+import { KEYLESS_PROVIDER_TYPES, KEYLESS_API_KEY_SENTINEL } from "@comis/core";
 /**
  * Create a ModelRegistry from an AuthStorage instance.
  *
@@ -21,18 +22,6 @@ import { getModels, getProviders } from "@earendil-works/pi-ai";
 export function createModelRegistryAdapter(authStorage) {
     return ModelRegistry.inMemory(authStorage);
 }
-/**
- * Provider types that can register without an API key.
- *
- * Ollama (and similar local inference servers) do not require authentication
- * by default. When a provider entry has a type in this set and no apiKeyName
- * is configured (or the named secret is missing), registration proceeds with
- * the "ollama-no-auth" sentinel instead of being skipped.
- *
- * The sentinel reaches the wire as `Authorization: Bearer ollama-no-auth`.
- * Ollama ignores Authorization unless `OLLAMA_API_KEY` is set server-side.
- */
-const KEYLESS_PROVIDER_TYPES = new Set(["ollama"]);
 const _builtInProviders = new Set(getProviders());
 /**
  * Infer pi-ai wire API from the live catalog.
@@ -78,6 +67,39 @@ function getBuiltInBaseUrl(type) {
     const models = getModels(type);
     return models[0]?.baseUrl;
 }
+/**
+ * Local self-hosted providers whose OpenAI-compatible API is mounted under
+ * `/v1` (`/v1/chat/completions`). Users naturally configure the bare server
+ * root for these (e.g. ollama's documented `http://127.0.0.1:11434`), but the
+ * `openai-completions` transport POSTs to `<baseUrl>/chat/completions` — so a
+ * root-only baseUrl yields `<root>/chat/completions`, which both servers
+ * answer with a bare "404 page not found" and the whole turn fails with empty
+ * content. pi-ai ships no built-in baseUrl for either, so the override is the
+ * only source and we must make the obvious value work.
+ */
+const OPENAI_COMPAT_V1_TYPES = new Set(["ollama", "lm-studio"]);
+/**
+ * Normalize a user-supplied baseUrl for {@link OPENAI_COMPAT_V1_TYPES} so a
+ * host-only origin reaches the `/v1` OpenAI-compat mount. A baseUrl that
+ * already carries a path (including `/v1`, or a custom reverse-proxy path) is
+ * returned unchanged — we only fill in the missing mount for the bare-root
+ * case. Unparseable values and non-local types pass through untouched.
+ */
+export function normalizeOpenAICompatBaseUrl(baseUrl, type) {
+    if (!baseUrl || !OPENAI_COMPAT_V1_TYPES.has(type))
+        return baseUrl;
+    let parsed;
+    try {
+        parsed = new URL(baseUrl);
+    }
+    catch {
+        return baseUrl; // malformed — leave for downstream validation to reject
+    }
+    // Only fill in the mount when the user gave a host-only origin ("" or "/").
+    if (parsed.pathname && parsed.pathname !== "/")
+        return baseUrl;
+    return `${parsed.origin}/v1`;
+}
 function getBuiltInModelIds(type) {
     if (!_builtInProviders.has(type))
         return new Set();
@@ -207,8 +229,8 @@ export function registerCustomProviders(registry, entries, secretManager, logger
             ?? FALLBACK_API_FOR_CUSTOM_TYPES[entry.type]
             ?? "openai-completions";
         const headersResolved = Object.keys(entry.headers).length > 0 ? entry.headers : undefined;
-        const resolvedApiKey = apiKey ?? (isKeylessType ? "ollama-no-auth" : undefined);
-        if (resolvedApiKey === "ollama-no-auth") {
+        const resolvedApiKey = apiKey ?? (isKeylessType ? KEYLESS_API_KEY_SENTINEL : undefined);
+        if (resolvedApiKey === KEYLESS_API_KEY_SENTINEL) {
             logger.debug({
                 providerName,
                 hint: "Using keyless sentinel for type='ollama'. If your Ollama server requires an OLLAMA_API_KEY, set the provider's apiKeyName explicitly via providers_manage update.",
@@ -217,7 +239,8 @@ export function registerCustomProviders(registry, entries, secretManager, logger
         try {
             registry.registerProvider(providerName, {
                 api,
-                baseUrl: entry.baseUrl || getBuiltInBaseUrl(entry.type),
+                baseUrl: normalizeOpenAICompatBaseUrl(entry.baseUrl, entry.type) ||
+                    getBuiltInBaseUrl(entry.type),
                 apiKey: resolvedApiKey,
                 headers: headersResolved,
                 models: hasModels

package/node_modules/@comis/agent/dist/model/oauth-token-manager.d.ts

@@ -112,8 +112,22 @@ export interface OAuthTokenManager {
     getApiKey(providerId: string, agentContext?: {
         oauthProfiles?: Record<string, string>;
     }): Promise<Result<string, OAuthError>>;
-    /** Check if credentials for a provider exist (in cache, store, or env-var). */
+    /**
+     * Synchronous best-effort check: the in-memory cache + env-var (SecretManager)
+     * ONLY. Does NOT consult the async persisted credential store — so in
+     * encrypted-store mode it UNDER-REPORTS a logged-in OAuth profile until the
+     * cache warms (the first getApiKey). For a store-aware answer (e.g. a
+     * boot-time availability probe) use {@link hasStoredCredentials}.
+     */
     hasCredentials(providerId: string): boolean;
+    /**
+     * Store-aware availability check: the in-memory cache, the env-var, OR the
+     * persisted credential store. The async companion to {@link hasCredentials} —
+     * use this where the cache may be cold (the image-provider boot probe in
+     * encrypted-store mode) so a `comis auth login` profile counts as available at
+     * boot rather than only after the first completion. Never throws.
+     */
+    hasStoredCredentials(providerId: string): Promise<boolean>;
     /** Store credentials for a provider (e.g., after a login flow completes). */
     storeCredentials(providerId: string, creds: OAuthCredentials): void;
     /** Get the list of pi-ai built-in OAuth provider IDs. */
@@ -123,6 +137,13 @@ export interface OAuthTokenManager {
      * No-op when watchPath was undefined at construction. Idempotent.
      */
     dispose(): Promise<void>;
+    /**
+     * Invalidate the in-memory profile cache so the next getApiKey() call
+     * re-fetches from the credential store. Used by the encrypted-mode event
+     * subscription in setup-agents-oauth.ts to apply cross-process auth.set
+     * writes (CLI `comis auth login`) without a daemon restart.
+     */
+    invalidate(): void;
 }
 /**
  * Create an OAuth token manager wrapping pi-ai's OAuth subsystem.

package/node_modules/@comis/agent/dist/model/oauth-token-manager.js

@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: Apache-2.0
+// @allow-throw: boundary rethrow in `raceWithTimeout` — caught `TimeoutError` is translated to the local Result-ish `{ ok: false, reason: "timeout" }` discriminator; non-timeout exceptions (unexpected programming errors from the wrapped pi-ai promise) propagate to the surrounding lock-held Result flow rather than being silently swallowed or fabricated into a non-timeout Result shape. The throw is structurally identical to pi-ai's existing throw-to-Result translation in this module.
 /**
  * OAuth Token Manager: Wraps pi-ai's OAuth subsystem for Comis patterns.
  *
@@ -33,8 +34,8 @@
  *
  * @module
  */
-import { ok, err, fromPromise, } from "@comis/shared";
-import { safePath, systemNowMs, systemSetTimeout, systemClearTimeout, } from "@comis/core";
+import { ok, err, fromPromise, withTimeout, TimeoutError, } from "@comis/shared";
+import { safePath, systemNowMs, systemSetTimeout, systemClearTimeout, systemScheduleTimeout, withDedup, } from "@comis/core";
 import { getOAuthProvider, getOAuthApiKey, getOAuthProviders, } from "@earendil-works/pi-ai/oauth";
 import { watch } from "chokidar";
 import { resolveCodexAuthIdentity, redactEmailForLog, rewriteOAuthError, } from "@comis/core";
@@ -108,25 +109,26 @@ function parseEnvCredentials(raw) {
     }
 }
 /**
- * Race a promise against a setTimeout-based timeout. setTimeout (rather than
- * AbortSignal.timeout) is used so vi.useFakeTimers() in tests can advance the
- * timer deterministically. Returns "timeout" on timeout, else the resolved value.
+ * Wrap `@comis/shared`'s canonical `withTimeout` (which throws `TimeoutError`)
+ * into the local `Result`-ish discriminator the two refresh call sites consume.
+ * Preserving `{ ok, value | reason: "timeout" }` keeps the surrounding
+ * branching unchanged when collapsing onto the shared primitive.
+ *
+ * Uses `systemScheduleTimeout` from `@comis/core/runtime` — `setTimeout` under
+ * the hood so `vi.useFakeTimers()` in tests still advances the timer
+ * deterministically (the existing timeout tests at L1127 / L2075 keep
+ * working).
  */
-async function withTimeout(promise, timeoutMs) {
-    let timer;
-    const timeoutPromise = new Promise((resolve) => {
-        timer = systemSetTimeout(() => resolve({ ok: false, reason: "timeout" }), timeoutMs);
-    });
+async function raceWithTimeout(promise, timeoutMs, label) {
     try {
-        const winner = await Promise.race([
-            promise.then((value) => ({ ok: true, value })),
-            timeoutPromise,
-        ]);
-        return winner;
+        const value = await withTimeout(promise, timeoutMs, systemScheduleTimeout, label);
+        return { ok: true, value };
     }
-    finally {
-        if (timer !== undefined)
-            systemClearTimeout(timer);
+    catch (e) {
+        if (e instanceof TimeoutError) {
+            return { ok: false, reason: "timeout" };
+        }
+        throw e;
     }
 }
 /**
@@ -139,7 +141,7 @@ async function withTimeout(promise, timeoutMs) {
  * use pi-ai's wrapper (which works correctly for them — they don't need the
  * wire-body classification).
  *
- * Never throws — wraps network errors in {ok:false} per AGENTS.md §2.1.
+ * Never throws — wraps network errors in {ok:false}.
  */
 async function refreshOpenAICodexTokenLocal(profile) {
     const tokenUrl = "https://auth.openai.com/oauth/token";
@@ -306,10 +308,12 @@ export function createOAuthTokenManager(deps) {
     // (in-memory only). Updated inside the per-profile-ID lock on every
     // successful resolve (refresh OR cached-hit).
     const lastGood = new Map();
-    // Logger de-dup: fire INFO once per (provider, configured-profile, process)
-    // when the configured profile is first used. Mirrors bootstrappedProviders
-    // pattern.
-    const loggedConfiguredProviders = new Set();
+    // Logger de-dup: fire the configured-profile-resolved INFO once per
+    // (provider, configured-profile, process) when the configured profile is
+    // first used. withDedup (@comis/core — NOT @comis/infra; agent↛infra)
+    // replaces the prior hand-rolled loggedConfiguredProviders Set with the
+    // shared decorator; same process-lifetime semantics (default TTL = unbounded).
+    const dedupLogger = withDedup(logger);
     // -------------------------------------------------------------------------
     // chokidar watcher on auth-profiles.json (file adapter only). chokidar's
     // atomic: 100 coalesces the tmp+rename atomic-write sequence into a single
@@ -323,8 +327,7 @@ export function createOAuthTokenManager(deps) {
     // can already be executing inside `await credentialStore.list()` when
     // dispose() is called — clearing the timer does nothing for an
     // already-fired callback. Track the promise so dispose() can await it
-    // and avoid emitting events / clearing cache against a disposed manager
-    // (WR-04).
+    // and avoid emitting events / clearing cache against a disposed manager.
     let inflightReload;
     // Snapshot of profileIds the manager has seen — used to diff against
     // store.list() after a watcher fire to emit auth:profile_added for new
@@ -590,8 +593,9 @@ export function createOAuthTokenManager(deps) {
                         return ok(profile.access);
                     }
                     // Bypass never throws (it returns a tagged outcome on every path),
-                    // so feed the bare promise into `withTimeout` — no fromPromise wrap.
-                    const raceResult = await withTimeout(refreshOpenAICodexTokenLocal(profile), REFRESH_TIMEOUT_MS);
+                    // so feed the bare promise into the local `raceWithTimeout`
+                    // helper — no fromPromise wrap.
+                    const raceResult = await raceWithTimeout(refreshOpenAICodexTokenLocal(profile), REFRESH_TIMEOUT_MS, "OAuth refresh (Codex bypass)");
                     if (!raceResult.ok) {
                         // timeout — bypass branch
                         logger.warn({
@@ -681,7 +685,7 @@ export function createOAuthTokenManager(deps) {
                     // Non-Codex: original pi-ai path UNCHANGED.
                     // 30s timeout wrapper — pi-ai has no built-in timeout.
                     const piAiCall = fromPromise(getOAuthApiKey(providerId, credsRecord));
-                    const raceResult = await withTimeout(piAiCall, REFRESH_TIMEOUT_MS);
+                    const raceResult = await raceWithTimeout(piAiCall, REFRESH_TIMEOUT_MS, "OAuth refresh (pi-ai)");
                     if (!raceResult.ok) {
                         // timeout
                         logger.warn({
@@ -779,7 +783,6 @@ export function createOAuthTokenManager(deps) {
                     // — use directly, do NOT multiply by 1000.
                     eventBus.emit("auth:token_rotated", {
                         provider: providerId,
-                        profileName: toSecretKey(providerId, keyPrefix),
                         profileId: profile.profileId,
                         expiresAtMs: newProfile.expires,
                         timestamp: systemNowMs(),
@@ -894,16 +897,14 @@ export function createOAuthTokenManager(deps) {
                     });
                 }
                 // Once-per-(provider, configured-profile, process) INFO log when the
-                // configured profile is first used.
-                const dedupKey = `${providerId}::${configured}`;
-                if (!loggedConfiguredProviders.has(dedupKey)) {
-                    loggedConfiguredProviders.add(dedupKey);
-                    logger.info({
-                        provider: providerId,
-                        profileId: configured,
-                        submodule: "oauth-resolver",
-                    }, "OAuth profile resolved via agent config");
-                }
+                // configured profile is first used. withDedup collapses repeats by the
+                // dedupKey field (process-lifetime), replacing the prior Set guard.
+                dedupLogger.info({
+                    dedupKey: `${providerId}::${configured}`,
+                    provider: providerId,
+                    profileId: configured,
+                    submodule: "oauth-resolver",
+                }, "OAuth profile resolved via agent config");
                 logger.debug({
                     provider: providerId,
                     source: "agent-config",
@@ -1045,13 +1046,30 @@ export function createOAuthTokenManager(deps) {
         },
         hasCredentials(providerId) {
             // Cache-only synchronous check — sufficient for "has any candidate".
-            // Async store/list checks live in getApiKey.
+            // Async store/list checks live in getApiKey + hasStoredCredentials.
             const cached = Array.from(cache.values()).some((p) => p.provider === providerId);
             if (cached)
                 return true;
             const secretKey = toSecretKey(providerId, keyPrefix);
             return secretManager.has(secretKey);
         },
+        async hasStoredCredentials(providerId) {
+            // Store-AWARE companion to the sync, cache-only hasCredentials(). Honors
+            // the interface's "cache, store, OR env-var" contract that the sync
+            // method cannot (the credential store is async). The image-provider boot
+            // probe MUST use this: in encrypted-store mode the in-memory cache is
+            // cold at boot, so a logged-in OAuth profile (e.g. Codex via
+            // `comis auth login`, persisted in the store) reads as ABSENT through
+            // hasCredentials — which froze a Codex agent's image generation
+            // unavailable for the daemon's life even though the SAME OAuth credential
+            // answered its text completions (the CRED-01/CDX-01 follow-main regression).
+            if (Array.from(cache.values()).some((p) => p.provider === providerId))
+                return true;
+            if (secretManager.has(toSecretKey(providerId, keyPrefix)))
+                return true;
+            const listResult = await credentialStore.list({ provider: providerId });
+            return listResult.ok && listResult.value.length > 0;
+        },
         storeCredentials(providerId, creds) {
             // Best-effort cache-only store; persistent storage uses bootstrapFromEnv
             // or the lock-protected refresh path. Used by tests + future login flows.
@@ -1077,5 +1095,8 @@ export function createOAuthTokenManager(deps) {
                 await inflightReload;
             }
         },
+        invalidate() {
+            cache.clear();
+        },
     };
 }

package/node_modules/@comis/agent/dist/model/ollama-capacity-probe.d.ts

@@ -0,0 +1,137 @@
+/**
+ * Ollama Capacity Probe: boot-time probe of the served context window for
+ * local Ollama providers.
+ *
+ * Queries GET /api/ps (loaded model context_length) then falls back to
+ * POST /api/show (model info). Fail-open: any failure returns err() and
+ * the caller falls back to the configured contextWindow + emits WARN.
+ *
+ * The production composition root (daemon.ts / bootAgents) passes
+ * `globalThis.fetch` as `fetchFn`. In tests, a mock function is injected.
+ *
+ * Never call raw `fetch()` in this module — always use the injected `fetchFn`.
+ *
+ * @module
+ */
+import type { ErrorKind } from "@comis/core";
+import { type Result } from "@comis/shared";
+/** Dependencies for the Ollama capacity probe (injectable for testing). */
+export interface OllamaCapacityProbeDeps {
+    /** HTTP fetch function (injectable — never use raw fetch in this module). */
+    fetchFn: (url: string, init: RequestInit) => Promise<Response>;
+    /** Probe timeout per provider in ms. */
+    timeoutMs: number;
+}
+/** Successful probe result. */
+export interface OllamaProbeResult {
+    /** The discovered served num_ctx (context_length). */
+    servedWindow: number;
+    /** Which Ollama API endpoint provided the value. */
+    source: "api/ps" | "api/show";
+    /** Elapsed milliseconds for the full probe (AGENTS.md §2.7 INFO completion). */
+    durationMs: number;
+}
+/** Probe failure. */
+export interface OllamaProbeError {
+    /** Human-readable failure message. */
+    message: string;
+    /** Structured error kind for logging. */
+    errorKind: ErrorKind;
+    /** Elapsed milliseconds at the point of failure (for observability). */
+    durationMs?: number;
+}
+/**
+ * Strip the trailing /v1 or /v1/ path segment from a configured baseUrl to
+ * obtain the native Ollama host URL.
+ *
+ * "http://localhost:11434"      → "http://localhost:11434"
+ * "http://localhost:11434/v1"   → "http://localhost:11434"
+ * "http://localhost:11434/v1/"  → "http://localhost:11434"
+ */
+export declare function deriveOllamaNativeBase(configuredBaseUrl: string): string;
+/**
+ * Probe a single Ollama provider's served context window.
+ *
+ * Strategy:
+ * 1. GET {nativeBaseUrl}/api/ps — running models; read context_length for modelId.
+ * 2. If model not in /api/ps (cold start), POST {nativeBaseUrl}/api/show — model info.
+ * 3. Any error → return err() with the appropriate errorKind (fail-open).
+ *
+ * @param nativeBaseUrl - Host-only URL (e.g. "http://localhost:11434").
+ *   Always call deriveOllamaNativeBase() on the configured baseUrl first.
+ * @param modelId - Model to probe (e.g. "qwen3.6:35b"). Empty string → accept any loaded model.
+ * @param deps - Injectable fetchFn and timeoutMs.
+ */
+export declare function probeOllamaServedWindow(nativeBaseUrl: string, modelId: string, deps: OllamaCapacityProbeDeps): Promise<Result<OllamaProbeResult, OllamaProbeError>>;
+/** Parameters for probing all Ollama providers at boot. */
+export interface ProbeAllOllamaProvidersParams {
+    /** Providers config entries (keyed by provider ID). */
+    providerEntries: Record<string, {
+        type?: string;
+        /** Whether the provider is enabled. Disabled providers (enabled: false) are skipped. */
+        enabled?: boolean;
+        baseUrl?: string;
+        capabilities?: {
+            probeServedWindow?: boolean;
+        };
+        defaultModel?: string;
+        /** Configured models for this provider. `ProviderEntrySchema` stores the
+         *  model under `models[].id` (there is NO `defaultModel` field), so the
+         *  probe must read the model id from here for the /api/show cold-start path. */
+        models?: Array<{
+            id?: string;
+        }>;
+    }>;
+    /** Injectable fetch function. */
+    fetchFn: (url: string, init: RequestInit) => Promise<Response>;
+    /** Timeout per provider probe in ms. */
+    timeoutMs: number;
+    /**
+     * IMP-2a (package-delivery-20260628): also fire a fire-and-forget LOAD-ONLY warm-up
+     * (`prewarmOllamaModel`) per ollama provider so the model is resident before the first user
+     * turn — a cold model's first inference can exceed the per-inference stall budget and abort the
+     * first turn after a (re)start "request took too long". Default false (byte-identical when unset).
+     */
+    prewarm?: boolean;
+    /** Logger for probe outcome (INFO on success, WARN on failure). */
+    logger: {
+        info(obj: Record<string, unknown>, msg: string): void;
+        warn(obj: Record<string, unknown>, msg: string): void;
+    };
+}
+/**
+ * Single source for "which model did the probe use" (KNOB-01's served-window
+ * comparator shares it — the 17fdd1e5 bug class was two sites deriving this
+ * expression differently). ProviderEntrySchema has NO `defaultModel`; the
+ * model lives under `models[].id`. Falling back to the first configured model
+ * lets the /api/show cold-start path (boot, before any inference, when
+ * /api/ps is empty) send a real model name instead of "" (which Ollama
+ * rejects with HTTP 400 → served window never found).
+ */
+export declare function resolveProbedModelId(entry: {
+    defaultModel?: string;
+    models?: Array<{
+        id?: string;
+    }>;
+} | undefined): string;
+/**
+ * Fire-and-forget LOAD-ONLY warm-up: POST {nativeBaseUrl}/api/generate with the model + keep_alive and an
+ * EMPTY prompt, which loads the model into memory WITHOUT generating (the Ollama preload idiom).
+ *
+ * Why (IMP-2a, package-delivery-20260628, local qwen3.6:35b): a cold local model's FIRST inference —
+ * prompt-processing the full tool-corpus prompt — emits no tokens for a long time and can exceed the
+ * per-inference stall budget (`agents.<id>.promptTimeout.promptTimeoutMs`, default 180s), so the FIRST
+ * user turn after a daemon (re)start aborts "request took too long" BEFORE any tool call. Warming at boot
+ * loads the model in parallel with the rest of boot so the first real turn runs warm.
+ *
+ * Best-effort + non-fatal (a failure just means the model loads on first use, as before). NEVER throws.
+ */
+export declare function prewarmOllamaModel(nativeBaseUrl: string, modelId: string, deps: {
+    fetchFn: (url: string, init: RequestInit) => Promise<Response>;
+    timeoutMs?: number;
+    logger?: {
+        info(o: Record<string, unknown>, m: string): void;
+        warn(o: Record<string, unknown>, m: string): void;
+    };
+}): Promise<void>;
+export declare function probeAllOllamaProviders(params: ProbeAllOllamaProvidersParams): Promise<Map<string, number>>;