comisai 1.0.42 → 1.0.45

package/node_modules/@comis/channels/dist/whatsapp/whatsapp-activity.js

@@ -0,0 +1,160 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * WhatsApp windowed EditPlace activity renderer (§7.2 / §18.2 row
+ * "EditPlace"). Copies the Telegram canonical shape with a
+ * baileys-specific classifier and the windowing semantics. Three parts:
+ *
+ *   1. `classifyWhatsAppError` — the single net-new piece of logic here. WhatsApp
+ *      Business edit/delete is WINDOWED (~15 min); baileys offers NO numeric
+ *      error code dedicated to the windowed-expiry case — it surfaces an
+ *      operation failure as a thrown `Boom` (`@hapi/boom`) carrying a 4xx
+ *      `output.statusCode`. The classifier reads that STRUCTURAL field off the
+ *      error AND off `error.cause` (the live adapter wraps the throw in
+ *      `new Error(msg, { cause })`). A 4xx client rejection (400/403) →
+ *      `{kind:"not_supported", capability:"edit"}` (same drop-further-edits
+ *      semantics as Telegram message-not-found). The distinct "WhatsApp not
+ *      connected" Error → `{kind:"transient_network", cause}`. Everything else
+ *      (5xx, connection 408/428, unknown) → `{kind:"internal", cause}`. The
+ *      message text is consulted only to disambiguate; it is never rendered or
+ *      logged (§19.3).
+ *
+ *   2. `makeWhatsAppRenderActions` — the `ActivityRenderActions` adapter. `send`
+ *      posts a plain-text placeholder (WhatsApp has NO button surface —
+ *      `buttons:"none"`; the approval instruction is plain text). `edit`/`delete`
+ *      GUARD the OPTIONAL `ChannelPort` methods (early
+ *      `not_supported` — never a non-null-asserted call, AGENTS.md §2.8), map
+ *      every `.error` through `classifyWhatsAppError`, and contain any throw the
+ *      port lets escape. Once a window-expiry `not_supported` is seen, ALL
+ *      further edits are dropped (no retry loop) — the EditPlace
+ *      best-effort `flushEdit` tolerates the mid-stream failure; the finalize
+ *      edit propagates the error.
+ *
+ *   3. `createWhatsAppActivityRenderer` — wires the shared
+ *      `createEditPlaceRenderer` (the debounce/edit/delete state machine). It
+ *      does NOT re-implement any rendering logic.
+ *
+ * Unlike Telegram there is NO local 429 retry buffer: baileys does not surface a
+ * `rate_limited`/retry-after for these ops, and the windowed-expiry failure is
+ * TERMINAL for edits (drop), not retryable. Keeping the adapter minimal (KISS).
+ */
+import { ok, err } from "@comis/shared";
+import { createEditPlaceRenderer } from "../shared/strategies/edit-place.js";
+import { buildApprovalPrompt } from "../shared/strategies/approval-render.js";
+/** The bare message the WhatsApp adapter's connection guard returns. */
+const NOT_CONNECTED = "WhatsApp not connected";
+/**
+ * Classify a raw WhatsApp platform error into the closed {@link ActivityRenderError}
+ * union by its STRUCTURAL shape. Reads `output.statusCode` off the error itself
+ * and, when the live adapter wrapped the baileys throw in `new Error(msg, { cause })`,
+ * off `error.cause`. A windowed edit-expiry surfaces as a 4xx client rejection
+ * (baileys has no dedicated numeric code for it); the not-connected guard surfaces
+ * as a distinct message. Neither the status nor the message is ever rendered/logged.
+ */
+export function classifyWhatsAppError(e) {
+    const direct = (e ?? {});
+    // The not-connected guard returns a bare Error (possibly wrapped as cause).
+    // Recognise it by message on the error and on its cause → transient_network.
+    if (isNotConnected(direct)) {
+        return { kind: "transient_network", cause: e };
+    }
+    // Prefer the typed Boom the adapter attached as `cause`; fall back to the error
+    // object itself (the fake injects the Boom shape directly).
+    const boom = direct.output?.statusCode === undefined && direct.cause != null
+        ? (direct.cause ?? direct)
+        : direct;
+    const statusCode = boom.output?.statusCode;
+    // 4xx client rejection = the windowed edit-expiry (baileys offers no dedicated
+    // code). 400 Bad Request / 403 Forbidden are the observed window-closed shapes;
+    // map them to not_supported so the renderer stops editing. 408/428 (connection)
+    // and 5xx (server) are NOT window-expiry — they fall through to internal so the
+    // renderer does not silently drop edits on a transient blip.
+    if (statusCode === 400 || statusCode === 403) {
+        return { kind: "not_supported", capability: "edit" };
+    }
+    return { kind: "internal", cause: e };
+}
+/** True when the error (or its cause) is the WhatsApp not-connected guard error. */
+function isNotConnected(e) {
+    if (typeof e.message === "string" && e.message.includes(NOT_CONNECTED))
+        return true;
+    const cause = e.cause;
+    return (cause != null &&
+        typeof cause.message === "string" &&
+        cause.message.includes(NOT_CONNECTED));
+}
+/**
+ * Build the {@link ActivityRenderActions} for a WhatsApp chat. `send` posts a
+ * plain-text placeholder (no button surface — `buttons:"none"`); `edit`/`delete`
+ * guard the optional port methods, classify platform errors structurally, and
+ * contain any throw. A windowed edit-expiry (`not_supported`) drops all further
+ * edits (no retry loop).
+ */
+export function makeWhatsAppRenderActions(adapter, channelId) {
+    /** Set once a window-expiry is seen — all further edits are dropped (§drop-on-not_supported). */
+    let editsDropped = false;
+    return {
+        async send(text) {
+            // Plain-text placeholder/approval shell: NO buttons (WhatsApp has no button
+            // surface). No silent effect either —
+            // WhatsApp ignores rich effects.
+            const r = await runAdapter(() => adapter.sendMessage(channelId, text));
+            if (!r.ok)
+                return err(classifyWhatsAppError(r.error));
+            return ok(r.value);
+        },
+        async edit(id, text) {
+            if (editsDropped)
+                return err({ kind: "not_supported", capability: "edit" });
+            if (!adapter.editMessage)
+                return err({ kind: "not_supported", capability: "edit" });
+            const editMessage = adapter.editMessage;
+            const r = await runAdapter(() => editMessage(channelId, id, text));
+            if (r.ok)
+                return ok(undefined);
+            const classified = classifyWhatsAppError(r.error);
+            // Window closed → stop editing entirely (drop-further-edits, no retry loop).
+            if (classified.kind === "not_supported")
+                editsDropped = true;
+            return err(classified);
+        },
+        async delete(id) {
+            if (!adapter.deleteMessage)
+                return err({ kind: "not_supported", capability: "delete" });
+            const deleteMessage = adapter.deleteMessage;
+            const r = await runAdapter(() => deleteMessage(channelId, id));
+            return r.ok ? ok(undefined) : err(classifyWhatsAppError(r.error));
+        },
+    };
+}
+/**
+ * Run a port call, containing a throw the port lets escape (baileys throws before
+ * the live adapter's try/catch in some paths). Returns the same `Result<_, Error>`
+ * the port contract promises so the caller classifies one error shape.
+ */
+async function runAdapter(fn) {
+    try {
+        return await fn();
+    }
+    catch (thrown) {
+        return err(thrown instanceof Error ? thrown : new Error(String(thrown), { cause: thrown }));
+    }
+}
+/**
+ * Create the WhatsApp EditPlace activity renderer — wires the shared
+ * {@link createEditPlaceRenderer} with the per-channel render-actions adapter. The
+ * daemon composition root constructs this with its runtime `TimerPort` /
+ * `ClockPort` and the chat id.
+ */
+export function createWhatsAppActivityRenderer(adapter, channelId, deps) {
+    return createEditPlaceRenderer({
+        actions: makeWhatsAppRenderActions(adapter, channelId),
+        timer: deps.timer,
+        clock: deps.clock,
+        markers: deps.markers,
+        // WhatsApp has no button surface (`buttons:"none"`), so an approval frame
+        // appends the plain-text prompt ("Reply approve or deny …", with shortIds when
+        // >1 pending) to the placeholder (§6.4.6). A non-approval frame yields
+        // "" (the placeholder text stays byte-identical).
+        buildPrompt: buildApprovalPrompt,
+    });
+}

package/node_modules/@comis/channels/dist/whatsapp/whatsapp-adapter.js

@@ -18,7 +18,8 @@ import { makeWASocket, DisconnectReason, useMultiFileAuthState, } from "@whiskey
 import { validateWhatsAppAuth } from "./credential-validator.js";
 import { mapBaileysToNormalized } from "./message-mapper.js";
 import { createWhatsAppVoiceSender } from "./voice-sender.js";
-import { systemNowMs, systemSetTimeout } from "@comis/core";
+import { systemNowMs, systemSetTimeout, runWithContext } from "@comis/core";
+import { randomUUID } from "node:crypto";
 // ---------------------------------------------------------------------------
 // Factory
 // ---------------------------------------------------------------------------
@@ -110,15 +111,20 @@ export function createWhatsAppAdapter(deps) {
                 }
                 _lastMessageAt = systemNowMs();
                 const normalized = mapBaileysToNormalized(m);
-                deps.logger.info({ channelType: "whatsapp", messageId: normalized.id, chatId: m.key.remoteJid ?? "", previewLen: (normalized.text ?? "").length }, "Inbound message");
-                for (const handler of handlers) {
-                    try {
-                        Promise.resolve(handler(normalized)).catch((e) => deps.logger.error({ err: e, hint: "Check WhatsApp message handler logic", errorKind: "internal" }, "Handler error"));
+                // Mint traceId at ingress, stamp into metadata.
+                const traceId = randomUUID();
+                normalized.metadata.traceId = traceId;
+                deps.logger.info({ step: "channels-inbound", channelType: "whatsapp", messageId: normalized.id, chatId: m.key.remoteJid ?? "", previewLen: (normalized.text ?? "").length, traceId }, "Inbound message");
+                void runWithContext({ traceId, startedAt: systemNowMs(), channelType: "whatsapp", tenantId: "default", trustLevel: "admin" }, () => {
+                    for (const handler of handlers) {
+                        try {
+                            Promise.resolve(handler(normalized)).catch((e) => deps.logger.error({ err: e, hint: "Check WhatsApp message handler logic", errorKind: "internal" }, "Handler error"));
+                        }
+                        catch (e) {
+                            deps.logger.error({ err: e, hint: "Check WhatsApp message handler logic", errorKind: "internal" }, "Handler error");
+                        }
                     }
-                    catch (e) {
-                        deps.logger.error({ err: e, hint: "Check WhatsApp message handler logic", errorKind: "internal" }, "Handler error");
-                    }
-                }
+                });
             }
         });
         // Save credentials when they're updated
@@ -196,7 +202,7 @@ export function createWhatsAppAdapter(deps) {
                 const messageId = sent?.key?.id ?? "";
                 _lastMessageAt = systemNowMs();
                 _lastError = undefined;
-                deps.logger.debug({ channelType: "whatsapp", messageId, chatId: channelId, preview: text.slice(0, 1500) }, "Outbound message");
+                deps.logger.info({ step: "channels-outbound", channelType: "whatsapp", messageId, chatId: channelId }, "Outbound message");
                 return ok(messageId);
             }
             catch (error) {
@@ -221,12 +227,17 @@ export function createWhatsAppAdapter(deps) {
                     text,
                     edit: { remoteJid: channelId, id: messageId, fromMe: true },
                 });
-                deps.logger.debug({ channelType: "whatsapp", messageId, chatId: channelId, preview: text.slice(0, 1500) }, "Outbound message");
+                deps.logger.info({ step: "channels-outbound", channelType: "whatsapp", messageId, chatId: channelId }, "Outbound message");
                 return ok(undefined);
             }
             catch (error) {
                 const message = error instanceof Error ? error.message : String(error);
-                return err(new Error(`Failed to edit message: ${message}`));
+                // Preserve the typed baileys/Boom error as `cause` for structural
+                // classification (a windowed edit-expiry surfaces as a Boom with
+                // a 4xx output.statusCode → not_supported, drop further edits).
+                // classifyWhatsAppError reads output.statusCode off `cause`, never this
+                // generic string.
+                return err(new Error(`Failed to edit message: ${message}`, { cause: error }));
             }
         },
         async reactToMessage(channelId, messageId, emoji) {
@@ -277,12 +288,12 @@ export function createWhatsAppAdapter(deps) {
             }
             catch (error) {
                 const message = error instanceof Error ? error.message : String(error);
-                return err(new Error(`Failed to delete message: ${message}`));
+                // Preserve the typed baileys/Boom error as `cause` for structural
+                // classification. classifyWhatsAppError reads output.statusCode
+                // off `cause`, never this generic string.
+                return err(new Error(`Failed to delete message: ${message}`, { cause: error }));
             }
         },
-        async fetchMessages(_channelId, _options) {
-            return err(new Error("Fetching message history is not supported on WhatsApp."));
-        },
         async sendAttachment(channelId, attachment, _options) {
             if (!sock || !connected) {
                 const notConnectedErr = new Error("WhatsApp not connected");

package/node_modules/@comis/channels/dist/whatsapp/whatsapp-plugin.js

@@ -11,33 +11,19 @@ import { ok } from "@comis/shared";
 import { createWhatsAppAdapter } from "./whatsapp-adapter.js";
 /** WhatsApp platform capabilities (self-declared, validated at registration). */
 const CAPABILITIES = {
-    chatTypes: ["dm", "group"],
     features: {
         reactions: true,
         editMessages: true,
         deleteMessages: true,
         fetchHistory: false,
         attachments: true,
+        // §17.2: WhatsApp EditPlace (windowed) — typing, no threads, no buttons.
+        typing: true,
         threads: false,
-        mentions: false,
-        formatting: [],
-        buttons: true,
-        cards: false,
-        effects: false,
+        buttons: "none",
     },
     limits: {
         maxMessageChars: 65536,
-        maxAttachmentSizeMb: 100,
-    },
-    streaming: {
-        supported: true,
-        throttleMs: 600,
-        maxChars: 65536,
-        method: "block",
-    },
-    threading: {
-        supported: false,
-        threadType: "none",
     },
     replyToMetaKey: "whatsappMessageId",
 };

package/node_modules/@comis/channels/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/channels",
   "private": true,
-  "version": "1.0.42",
+  "version": "1.0.45",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Chat platform adapters — Discord, Telegram, Slack, WhatsApp, Signal, iMessage, IRC, LINE",
@@ -17,7 +17,7 @@
     "irc"
   ],
   "engines": {
-    "node": ">=22"
+    "node": ">=22.19.0"
   },
   "files": [
     "dist"

package/node_modules/@comis/cli/dist/cli.js

@@ -13,9 +13,11 @@ import { createRequire } from "node:module";
 import { Command } from "commander";
 import { registerAgentCommand } from "./commands/agent.js";
 import { registerAuthCommand } from "./commands/auth.js";
+import { registerCacheCommand } from "./commands/cache.js";
 import { registerChannelCommand } from "./commands/channel.js";
 import { registerConfigCommand } from "./commands/config.js";
 import { registerDaemonCommand } from "./commands/daemon.js";
+import { registerMcpCommand } from "./commands/mcp.js";
 import { registerMemoryCommand } from "./commands/memory.js";
 import { registerSecurityCommand } from "./commands/security.js";
 import { registerDoctorCommand } from "./commands/doctor.js";
@@ -30,6 +32,11 @@ import { registerSessionsCommand } from "./commands/sessions.js";
 import { registerResetCommand } from "./commands/reset.js";
 import { registerSecretsCommand } from "./commands/secrets.js";
 import { registerSignalSetupCommand } from "./commands/signal-setup.js";
+import { registerTraceCommand } from "./commands/trace.js";
+import { registerExplainCommand } from "./commands/explain.js";
+import { registerWhoamiCommand } from "./commands/whoami.js";
+import { registerCostExportCommand } from "./commands/cost-export.js";
+import { registerFleetCommand } from "./commands/fleet.js";
 import { registerUninstallCommand } from "./commands/uninstall.js";
 export const program = new Command();
 const cliRequire = createRequire(import.meta.url);
@@ -40,6 +47,7 @@ registerDaemonCommand(program);
 registerConfigCommand(program);
 registerAgentCommand(program);
 registerAuthCommand(program);
+registerCacheCommand(program);
 registerChannelCommand(program);
 registerMemoryCommand(program);
 registerSecurityCommand(program);
@@ -50,11 +58,17 @@ registerStatusCommand(program);
 registerHealthCommand(program);
 registerModelsCommand(program);
 registerProvidersCommand(program);
+registerMcpCommand(program);
 registerPm2Command(program);
 registerSessionsCommand(program);
 registerResetCommand(program);
 registerSecretsCommand(program);
 registerSignalSetupCommand(program);
+registerTraceCommand(program);
+registerExplainCommand(program);
+registerWhoamiCommand(program);
+registerCostExportCommand(program);
+registerFleetCommand(program);
 registerUninstallCommand(program);
 // Parse and execute
 program.parseAsync(process.argv).catch((err) => {

package/node_modules/@comis/cli/dist/client/rpc-client.d.ts

@@ -6,13 +6,12 @@
  * with descriptive error, and message parse errors.
  *
  * **Typed RPC wrapper:**
- * `callTyped(client, contract, params)` is the typed entry point. It runs
- * `contract.request.parse(...)` + `contract.response.parse(...)` under the
- * `VALIDATE` gate (the gate location is THIS file specifically, not a
- * sibling `typed-rpc.ts`). VALIDATE is on when `NODE_ENV === "development"`
- * OR `COMIS_CLI_VALIDATE === "1"`; production builds skip the parse hop
- * for cold-start budget compliance. The daemon side ALWAYS parses — the
- * trust boundary lives there.
+ * `callTyped(client, contract, params)` is the typed entry point. It ALWAYS
+ * runs `contract.request.parse(...)` + `contract.response.parse(...)` (the
+ * gate location is THIS file specifically, not a sibling `typed-rpc.ts`).
+ * Validation is unconditional on the CLI side — matching the daemon side
+ * which also always parses. The Zod parse cost is sub-ms per call at the
+ * current registry scale, so cold-start budget impact is negligible.
  *
  * `test/architecture/cli-uses-typed-rpc.test.ts` allowlists this file as
  * the sole CLI source that may invoke `client.call(...)` directly; every
@@ -34,15 +33,38 @@ export interface RpcClient {
     onNotification(handler: (method: string, params: unknown) => void): void;
 }
 /**
- * Typed RPC wrapper. Send a contract-defined RPC call and parse the
- * response under the `VALIDATE` gate.
+ * Typed RPC wrapper. Send a contract-defined RPC call and always parse
+ * both the request and response against the contract's Zod schemas.
  *
  * Consumers replace `client.call("<method>", <params>)` with
  * `callTyped(client, <DomainContract>, params)`. The `cli-uses-typed-rpc`
  * architecture test prevents regressions by forbidding raw `client.call(`
  * anywhere in `packages/cli/src/` outside this file.
+ *
+ * Validation is unconditional — the daemon side already always parses,
+ * so this closes the previously-asymmetric CLI-side bypass surface.
  */
 export declare function callTyped<Req extends ZodTypeAny, Res extends ZodTypeAny>(client: RpcClient, contract: ApiContract<Req, Res>, params: z.input<Req>): Promise<z.output<Res>>;
+/**
+ * Resolve gateway URL, token, and TLS status from config file on disk.
+ *
+ * Reads ~/.comis/config.yaml (matching daemon defaults) to extract
+ * gateway.host, gateway.port, TLS configuration, and the first token secret.
+ * Uses a minimal line-based parser to avoid importing the full YAML library.
+ * Resolves `${VAR}` references in token values via ~/.comis/.env.
+ */
+/**
+ * The config file the CLI reads to discover the gateway URL/token. Honors
+ * `COMIS_CONFIG_PATHS` (the first `":"`-separated entry, matching the daemon's
+ * own parsing) so the CLI targets the SAME daemon a non-default `COMIS_CONFIG_PATHS`
+ * pointed at — e.g. a test/second daemon on another port. Falls back to the
+ * standard `~/.comis/config.yaml` when unset or blank.
+ *
+ * UX-2 (LOCAL re-test 2026-06-20): without this the CLI always read
+ * `~/.comis/config.yaml`, so a `COMIS_DATA_DIR`/`COMIS_CONFIG_PATHS` daemon on
+ * :4777 was unreachable via the CLI unless you also set `COMIS_GATEWAY_URL`.
+ */
+export declare function resolveGatewayConfigPath(): string;
 /**
  * Error thrown when attempting to send a bearer token over an unencrypted
  * WebSocket connection to a non-localhost host.
@@ -73,6 +95,17 @@ export declare function checkTransportSecurity(url: string, token: string | unde
  * @returns A connected RpcClient ready for calls
  * @throws Error if connection times out or is refused
  */
+/**
+ * Stable prefix of the gateway token-rejection error (W13 obs-llm-troubleshooting).
+ * The gateway closes an unauthorized WebSocket with code 4001 (hono-server.ts);
+ * mapping that close onto this named error lets `isDaemonRunning` treat an
+ * auth-rejection as PROOF the daemon is up — the old path collapsed it into
+ * "Connection closed unexpectedly" and the liveness probe reported a healthy
+ * daemon as "not running".
+ */
+export declare const GATEWAY_AUTH_REJECTED_PREFIX = "Gateway rejected the token";
+/** True when an error is the gateway token-rejection (WS close 4001/4003). */
+export declare function isGatewayAuthRejection(error: unknown): boolean;
 export declare function createRpcClient(url: string, token?: string): Promise<RpcClient>;
 /**
  * Convenience wrapper that creates a client, runs a function, then closes.