comisai 1.0.42 → 1.0.45

package/node_modules/@comis/core/dist/event-bus/events-messaging.d.ts

@@ -1,5 +1,6 @@
 import type { NormalizedMessage } from "../domain/normalized-message.js";
 import type { SessionKey } from "../domain/session-key.js";
+import type { ScriptClass } from "../text/script-classes.js";
 import type { SubAgentSpawnPreparedEvent, SubAgentSpawnRejectedEvent, SubAgentSpawnStartedEvent, SubAgentResultCondensedEvent, SubAgentLifecycleEndedEvent } from "../domain/subagent-context-types.js";
 /**
  * MessagingEvents: Message lifecycle, session, compaction, context, response, and command events.
@@ -80,6 +81,25 @@ export interface MessagingEvents {
         ageMs: number;
         timestamp: number;
     };
+    /** Sub-agent progress (COORD-03 — the ~30s read-only progress fork).
+     *  A long-running child surfaces its advance every ~30s WITHOUT completing,
+     *  via a read-only state summary (coordinator-progress-fork.ts) — NOT a
+     *  re-execution: the fork never calls a tool, spawns, or re-runs the child.
+     *  §2.7 CONTENT-FREE (T-218-14): the payload carries ONLY a 3-5 word status
+     *  `progressLine` (e.g. "running, step 4"), the elapsed wall-clock, the steps
+     *  executed, and identifiers — NEVER the child's output, message body, or any
+     *  tool result. The `progressLine` is a status descriptor, not child content. */
+    "session:sub_agent_progress": {
+        runId: string;
+        agentId: string;
+        /** A 3-5 word progress status line (content-free, no payload). */
+        progressLine: string;
+        /** Wall-clock ms since the fork started (from the injected ClockPort). */
+        elapsedMs: number;
+        /** Steps executed so far (a count, never step content). */
+        stepsExecuted: number;
+        timestamp: number;
+    };
     /** Spawn packet built and ready for execution */
     "session:sub_agent_spawn_prepared": SubAgentSpawnPreparedEvent;
     /** Spawn denied due to depth or children limit */
@@ -143,6 +163,18 @@ export interface MessagingEvents {
         keptMessages: number;
         timestamp: number;
     };
+    /** C4/S4: emitted when the compaction layer routes based on capabilityClass (pipeline or LCD).
+     *  strategy="eviction" means no LLM summarization was used (deterministic fallback).
+     *  securityPinnedCount = number of messages excluded from eviction by S4 pinning. */
+    "context:compaction_routed": {
+        agentId: string;
+        sessionKey: string;
+        capabilityClass: "frontier" | "mid" | "small" | "nano";
+        strategy: "llm" | "eviction" | "strong-summarizer" | "deterministic";
+        layer: "pipeline" | "lcd";
+        securityPinnedCount: number;
+        timestamp: number;
+    };
     /** Post-compaction rehydration: critical context re-injected */
     "context:rehydrated": {
         agentId: string;
@@ -171,6 +203,45 @@ export interface MessagingEvents {
         categories: Record<string, number>;
         timestamp: number;
     };
+    /** RETR-02 (Phase 173): the tiered margin arbiter allocated the discretionary
+     *  history pool across tiers by fused rank (relevance-first classes only —
+     *  frontier/mid never run the arbiter, so this event never fires for them).
+     *  CONTENT-FREE (AGENTS.md §2.2/§2.7; T-173-03-04): per-tier kept COUNTS
+     *  (`perTierKept` — e.g. { history, ltm, kg }), the discretionary pool TOKENS
+     *  (offered AND consumed) + the floor-token weight, a `relevanceFirst` BOOLEAN,
+     *  the kept LTM/KG ids + a timestamp ONLY. NEVER message, memory, or query content
+     *  (ids are opaque memory keys, §2.2-safe). The emitter reuses the entry-clock read
+     *  (no new ambient clock). A counts-only internal-health signal (same class as
+     *  context:compaction_routed) — NOT a turn-level trajectory step.
+     *
+     *  WR-03/WR-02 (Phase 173-05): the payload now distinguishes the pool OFFERED
+     *  (`discretionaryPoolTokens`) from the pool CONSUMED (`poolTokensUsed`) and carries
+     *  the unconditional `floorTokens` weight, so an operator diagnosing a small-model
+     *  context-exhaustion can see whether the S4-pinned floors dwarfed the pool. It also
+     *  carries the `keptLtmIds`/`keptKgIds` the arbiter computes — the cross-tier winners
+     *  an operator needs to reconstruct WHICH candidates won (the §2.7 reconstructable-from-
+     *  events bar; empty on the C2 history-only assembly path until Phase 174 flows LTM/KG). */
+    "context:arbitrated": {
+        agentId: string;
+        sessionKey: string;
+        /** Per-tier kept counts, e.g. { history, ltm, kg } — counts only, never content. */
+        perTierKept: Record<string, number>;
+        /** The discretionary pool OFFERED (budget.availableHistoryTokens) to the arbiter. */
+        discretionaryPoolTokens: number;
+        /** WR-03: the discretionary pool CONSUMED (non-floor tokens actually allocated) — always
+         *  ≤ discretionaryPoolTokens. Offered-vs-consumed is the small-model-exhaustion signal. */
+        poolTokensUsed: number;
+        /** WR-03: the UNCONDITIONAL floor weight (T0 fresh-tail + S4-pinned, step-atomic) that
+         *  rides ON TOP of the pool — surfaced so blown-past-pool pinned floors are visible. */
+        floorTokens: number;
+        /** WR-02: the kept LTM candidate ids (content-free memory keys; empty pre-Phase-174). */
+        keptLtmIds: string[];
+        /** WR-02: the kept KG candidate ids (content-free memory keys; empty pre-Phase-174). */
+        keptKgIds: string[];
+        /** Whether the relevance-first arbiter path ran (always true when this fires). */
+        relevanceFirst: boolean;
+        timestamp: number;
+    };
     /** Re-read detector found duplicate tool calls in session */
     "context:reread": {
         agentId: string;
@@ -191,6 +262,154 @@ export interface MessagingEvents {
         durationMs: number;
         timestamp: number;
     };
+    /** An in-session expansion tool (ctx_search/ctx_inspect/ctx_expand) recovered
+     *  compressed detail (O1). Identifiers + the tool + a recovered/hit count +
+     *  durationMs ONLY — NEVER message or summary content (the lossless store;
+     *  AGENTS.md §2.2/§2.7). Distinct from context:reread (the re-read-loop
+     *  detector) — this is a deliberate zoom into the DAG. */
+    "context:dag_expanded": {
+        conversationId: string;
+        agentId: string;
+        sessionKey: string;
+        /** Closed union — the three in-session expansion tools. */
+        tool: "ctx_search" | "ctx_inspect" | "ctx_expand";
+        /** Recovered messages (ctx_expand) / hits (ctx_search) / inspected items (ctx_inspect). */
+        recoveredCount: number;
+        durationMs: number;
+        timestamp: number;
+    };
+    /** LCD entered a DEGRADED path (R3 + R1, Phase 132). A robustness/integrity
+     *  signal — NOT a normal completion. Mirrors `context:dag_compacted`'s
+     *  identifiers + durationMs, but carries a CLOSED-union `reason` instead of
+     *  counts. Payload is identifiers + a reason + durationMs ONLY — NEVER message
+     *  or summary content (the lossless store; AGENTS.md §2.2/§2.8).
+     *  - `fail_closed_rollover`: an ambiguous/malformed scope refused the ingest
+     *    write (132-04, R3) rather than silently reattaching to a prior conversation.
+     *  - `serialized_wait`: an ingest/compaction write waited on the per-conversation
+     *    single-flight serializer (132-04, R3) — reserved for the bounded-wait signal.
+     *  - `breaker_open` / `spend_cap`: the summarizer circuit breaker opened or a
+     *    per-tenant summarizer spend ceiling was hit (132-05, R1) — reserved here so
+     *    the union is closed from the start (no later open-string widening).
+     *  - `live_store_divergence`: the WR-01 afterTurn ingest skipped because the
+     *    live message array is SHORTER than the LCD store high-water mark
+     *    (`lcd-ingest.ts` divergence branch) — Phase 160 I1.
+     *  - `leaf_window_divergence`: a leaf compaction pass skipped because the chunk
+     *    message ids did not resolve to a `context_items` ordinal window
+     *    (`lcd-compaction-trigger.ts`) — Phase 160 I1.
+     *  - `condense_window_divergence`: a condense pass skipped on an inverted
+     *    ordinal window (`lcd-condense-trigger.ts`) — Phase 160 I1. */
+    "context:dag_degraded": {
+        conversationId: string;
+        agentId: string;
+        sessionKey: string;
+        /** Closed union — never an open string (AGENTS.md §2.8). The three
+         *  `*_divergence` members (Phase 160 I1) widen the union with closed
+         *  literals (the sanctioned §2.8 extension) so the LCD-divergence WARN sites
+         *  emit this event for `health_signal` persistence. */
+        reason: "fail_closed_rollover" | "serialized_wait" | "breaker_open" | "spend_cap" | "live_store_divergence" | "leaf_window_divergence" | "condense_window_divergence"
+        /** Phase 164 (RR6): a fresh/disjoint live transcript was detected (JSONL
+         *  re-based) and the ingest continued appending at the store's current max
+         *  seq — NOT a degradation, a correct continuation. Distinct from
+         *  `live_store_divergence` (the genuine-shrink fail-safe) so operators can
+         *  tell "continued after restart" from "skipped due to corruption". */
+         | "session_rebase";
+        durationMs: number;
+        timestamp: number;
+    };
+    /** Per-LLM-call context budget equation from the LCD pre-flight fit check
+     *  (W2 obs-llm-troubleshooting). Emitted once per runPreflightFitCheck —
+     *  verdict "fits" | "downshifted" (thinking governor fired) | "exhausted"
+     *  (ContextExhaustionError thrown right after). Bridged to the trajectory as
+     *  `context.budget` so obs.explain can reconstruct WHY a context_exhausted
+     *  turn aborted without grepping daemon-log DEBUG lines. Payload is
+     *  identifiers + token counts + closed unions only — NO message text. */
+    "context:budget_computed": {
+        agentId: string;
+        sessionKey: string;
+        /** The EFFECTIVE window the fit check ran against (post capability-class cap). */
+        windowTokens: number;
+        /** The model's declared contextWindow before any cap (== windowTokens when uncapped). */
+        rawContextWindowTokens: number;
+        /** What clamped the window (closed union — never an open string). The cap
+         *  members are contextEngine.budget.* knob names; "served" (KNOB-02) means
+         *  the Ollama-served num_ctx bound the window (knobs: OLLAMA_CONTEXT_LENGTH
+         *  env / Modelfile PARAMETER num_ctx); "capabilityClass" (WR-01) means the
+         *  executor-side class cap from the operator's
+         *  providers.entries.<id>.capabilities.capabilityClass pin bound — the pin
+         *  is the lever (the budget knobs are inert on that branch). */
+        windowCapSource: "effectiveContextCapSmall" | "effectiveContextCapNano" | "served" | "capabilityClass" | "none";
+        /** S: system prompt + tool schemas estimate. */
+        systemTokens: number;
+        /** Estimated fresh-tail tokens (latest user message + preamble + pending tool results). */
+        freshTailTokens: number;
+        /** Token sum of the history items kept by budget eviction. */
+        budgetedHistoryTokens: number;
+        /** Count of history items kept by budget eviction (0 = model sees no history). */
+        keptCount: number;
+        /** S + kept history + fresh tail — what is actually dispatched to the LLM. */
+        assembledInputTokens: number;
+        /** Output headroom reserved at the final effective thinking level. */
+        outputHeadroom: number;
+        /** Fit-check outcome (closed union — never an open string). */
+        verdict: "fits" | "downshifted" | "exhausted";
+    };
+    /** A non-Latin search returned zero hits on a CLEANLY-executed lane (OBS-01,
+     *  Phase 180). The milestone's marquee failure mode — "Hebrew finds nothing" —
+     *  made fleet-visible instead of DEBUG-only (the prior `cjkZeroHit` DEBUG line
+     *  in ctx-search-tool.ts). Bridged to the trajectory as
+     *  `context.script_zero_hit` (the explain timeline) AND persisted as a
+     *  `health_signal` row (the fleet path); both paths are required (OBS-01).
+     *  Payload is a closed `ScriptClass` enum + a closed lane union + identifiers
+     *  ONLY — NEVER the query text or any tokens (I8; §2.7 the lossless store).
+     *  Fires only when the lane executed cleanly: a `safeAll`-swallowed FTS5 syntax
+     *  error is NOT a zero-hit and must not emit (signal purity, ROADMAP criterion 4). */
+    "context:script_zero_hit": {
+        conversationId: string;
+        agentId: string;
+        sessionKey: string;
+        /** Closed union — dominant script class of the query (non-latin by construction). */
+        scriptClass: ScriptClass;
+        /** Which lane returned zero: word FTS, trigram twins, or the bounded normalized scan floor. */
+        lane: "word" | "tri" | "scan";
+        timestamp: number;
+    };
+    /** A summary's dominant script diverged from its source chunk's (OBS-01, Phase
+     *  180): a non-Latin source produced a Latin summary. VISIBILITY ONLY — never
+     *  gated (I8; a mixed code-heavy chunk legitimately skews Latin via the 0.3
+     *  dominance threshold in `dominantScript`, so this is a count an operator
+     *  reviews, not an error to block). Bridged to the trajectory as
+     *  `context.summary_language_mismatch` AND persisted as a `health_signal` row;
+     *  both paths required (OBS-01). Payload is closed `ScriptClass` enums + a depth
+     *  count + identifiers ONLY — NEVER the summary or source body (§2.7). */
+    "context:summary_language_mismatch": {
+        agentId: string;
+        sessionKey: string;
+        sourceScript: ScriptClass;
+        summaryScript: ScriptClass;
+        /** dag depth (0 = leaf, >0 = condense); -1 = pipeline compaction (no depth concept). */
+        depth: number;
+        timestamp: number;
+    };
+    /** Context engine mode switched between pipeline and dag (one-time import cost).
+     *  Carries the switch DIRECTION + the one-time reconciliation cost. Emitted on
+     *  an ACTUAL direction change (not on a brand-new DAG-default conversation) from
+     *  the @comis/agent reconciliation seam. Payload is identifiers + counts +
+     *  durations only — NO message text (mirrors context:dag_compacted). */
+    "context:mode_switched": {
+        /** Engine mode before the switch (closed union — never an open string). */
+        from: "pipeline" | "dag";
+        /** Engine mode after the switch (closed union — never an open string). */
+        to: "pipeline" | "dag";
+        conversationId: string;
+        agentId: string;
+        sessionKey: string;
+        /** true = full reconciliation import (empty DAG); false = incremental/gap-only. */
+        fullImport: boolean;
+        /** Messages imported on this switch (the one-time cost). */
+        importedCount: number;
+        durationMs: number;
+        timestamp: number;
+    };
     /** DAG integrity check completed with health report */
     "context:integrity": {
         conversationId: string;
@@ -250,12 +469,34 @@ export interface MessagingEvents {
         suppressedBy: "NO_REPLY" | "HEARTBEAT_OK" | "SILENT" | "empty";
         timestamp: number;
     };
-    /** Execution aborted by user /stop command or programmatic abort */
+    /** Execution aborted by user /stop command or programmatic abort.
+     *  SPEND-02 (Phase 177-01): `spend_exceeded` is the dollars kill-switch abort —
+     *  ADDITIVE, distinct from the token-budget `budget_exceeded` so the
+     *  dollars-vs-tokens cause stays clear in the terminal. The unpriceable nuance
+     *  rides the distinct `observability:spend_unpriceable` event, NOT a second
+     *  reason member (RESEARCH A3).
+     *  BREAK-02 (Phase 217-02): `denial_breaker` is the denial-limit breaker abort —
+     *  N consecutive floor-blocks tripped the per-rootRunId breaker, so the run
+     *  aborts + escalates instead of retry-looping (the "never loop" guarantee).
+     *  ADDITIVE; distinct from `circuit_breaker`, which is the TOOL-FAILURE breaker
+     *  (provider cascade) — this is the CAPABILITY-DENIAL breaker. */
     "execution:aborted": {
         sessionKey: SessionKey;
-        reason: "user_stop" | "budget_exceeded" | "circuit_breaker" | "max_steps" | "context_exhausted" | "pipeline_timeout";
+        reason: "user_stop" | "budget_exceeded" | "circuit_breaker" | "max_steps" | "context_exhausted" | "pipeline_timeout" | "loop_detected" | "spend_exceeded" | "denial_breaker";
         agentId: string;
         timestamp: number;
+        /** OBS-3: on a per-ROOT autonomy.budget abort, the exact tripped limb + its
+         *  numbers in their own unit (token/wall-clock breaches carry tokens/ms, NOT
+         *  dollars). Content-free (closed-enum limb + unit strings + 2 numbers). Lets
+         *  `explain` name the exact knob ("token limb: 30640/60000") instead of an
+         *  operator grepping the "Per-root … budget exceeded" daemon-log line. Absent
+         *  for non-spend aborts and for the priced $-ceiling path. */
+        perRootBudget?: {
+            limb: string;
+            spent: number;
+            cap: number;
+            unit: string;
+        };
     };
     /** Budget trajectory warning: approaching token budget exhaustion */
     "execution:budget_warning": {
@@ -266,12 +507,26 @@ export interface MessagingEvents {
         projectedCallsLeft: number;
         timestamp: number;
     };
-    /** Prompt execution timed out (wall-clock timeout exceeded) */
+    /** Prompt execution timed out (wall-clock timeout exceeded).
+     *  LAT-04 (177-03): all post-v2.20 fields are optional — old rows and
+     *  legacy emitters stay valid. Content-free by construction: numbers,
+     *  closed enums, and the pre-rendered config-KEY string only. */
     "execution:prompt_timeout": {
         agentId: string;
         sessionKey: string;
         timeoutMs: number;
         timestamp: number;
+        /** Elapsed wall-clock ms at kill (clock.now() - retryStartMs). */
+        durationMs?: number;
+        /** Which limit fired: stall budget vs makespan ceiling. Absent = whole-turn (retry-path/pre-LAT-02 rows). */
+        limit?: "stall" | "makespan";
+        /** Binding resolution level (LAT-01). */
+        source?: "operation_explicit" | "operation_default" | "agent_config" | "builtin_default" | "graph_constant";
+        /** Pre-rendered config-key string (content-free — knob NAME + ids only, never values/bodies). */
+        bindingKnob?: string;
+        operationType?: string;
+        stallBudgetMs?: number;
+        makespanMs?: number;
     };
     /** Output escalation triggered: LLM hit max_tokens and retry is being attempted with higher output budget */
     "execution:output_escalated": {
@@ -297,6 +552,29 @@ export interface MessagingEvents {
         succeeded: boolean;
         timestamp: number;
     };
+    /** GBNF-02 self-heal fired: the provider rejected the tool JSON Schema at
+     *  grammar-compile/unmarshal time (llama.cpp "JSON schema conversion
+     *  failed", Ollama Go-side tools unmarshal). The runner stripped
+     *  pattern/format from the named session-held tool schemas and retried
+     *  exactly once per session ('retried' false when nothing was strippable).
+     *  Payload is content-free: tool + keyword NAMES only, never schema bodies
+     *  (I7). 'succeeded' reports whether the retry produced a non-empty
+     *  response. 'reason' discriminates the branch (175-REVIEW WR-05 — the two
+     *  terminal branches were otherwise byte-identical and the obs verdict
+     *  misdirected the operator): "stripped" = strip applied + one retry fired;
+     *  "nothing_to_strip" = no pattern/format anywhere, futile retry skipped;
+     *  "gate_closed" = the session's single strip-retry was already consumed
+     *  earlier (a repair WAS attempted this session). */
+    "execution:tool_schema_unsupported": {
+        agentId: string;
+        sessionKey: string;
+        toolNames: string[];
+        strippedKeywords: string[];
+        retried: boolean;
+        succeeded: boolean;
+        reason: "stripped" | "nothing_to_strip" | "gate_closed";
+        timestamp: number;
+    };
     /** Failed announcement persisted to dead-letter queue */
     "announcement:dead_lettered": {
         runId: string;

package/node_modules/@comis/core/dist/event-bus/events-model.d.ts

@@ -0,0 +1,87 @@
+/**
+ * ModelEvents: model-failover + provider-health lifecycle events
+ * (model:* + provider:*).
+ *
+ * Extracted from `events-agent.ts` (which crossed the 800-line file-size cap
+ * after the v2.28 audit `kind?` payload + the 3 `observability:spend_*` events)
+ * into one cohesive domain group — mirroring how OrchestrationEvents /
+ * TrajectoryEvents / TerminalEvents are their own sub-interfaces folded into
+ * `EventMap` (events.ts). No behavior change: the event names + payload shapes
+ * are byte-identical to their prior declarations in `AgentEvents`, and the
+ * keys reach the typed bus unchanged via the `EventMap` composition.
+ *
+ * Find events by prefix: model:* (failover/auth-cooldown/catalog) and
+ * provider:* (cross-agent degraded/recovered aggregation).
+ *
+ * Emit sites: the model retry loop (`packages/agent/src/executor/model-retry.ts`)
+ * for the model:* failover keys and the provider-health monitor
+ * (`packages/agent/src/safety/provider-health-monitor.ts`) for provider:*.
+ *
+ * @module
+ */
+export interface ModelEvents {
+    /** Model failover: attempt to switch from one model to another.
+     *  Turn-scoping ids (agentId/sessionKey/traceId) are optional — emit sites
+     *  populate them so activity can attribute the event to a turn (§16.9). */
+    "model:fallback_attempt": {
+        fromProvider: string;
+        fromModel: string;
+        toProvider: string;
+        toModel: string;
+        error: string;
+        attemptNumber: number;
+        timestamp: number;
+        agentId?: string;
+        sessionKey?: string;
+        traceId?: string;
+    };
+    /** Model failover: all candidates exhausted */
+    "model:fallback_exhausted": {
+        provider: string;
+        model: string;
+        totalAttempts: number;
+        timestamp: number;
+        agentId?: string;
+        sessionKey?: string;
+        traceId?: string;
+    };
+    /** Last-known-working model fallback: attempt to use a recently successful model */
+    "model:lkw_fallback_attempt": {
+        fromProvider: string;
+        fromModel: string;
+        toProvider: string;
+        toModel: string;
+        timestamp: number;
+        agentId?: string;
+        sessionKey?: string;
+        traceId?: string;
+    };
+    /** Auth profile entered cooldown after failure */
+    "model:auth_cooldown": {
+        keyName: string;
+        provider: string;
+        cooldownMs: number;
+        failureCount: number;
+        timestamp: number;
+        agentId?: string;
+        sessionKey?: string;
+        traceId?: string;
+    };
+    /** Model catalog loaded from pi-ai static registry */
+    "model:catalog_loaded": {
+        providerCount: number;
+        modelCount: number;
+        timestamp: number;
+    };
+    /** Provider declared degraded based on cross-agent failure aggregation */
+    "provider:degraded": {
+        provider: string;
+        failingAgents: number;
+        timestamp: number;
+    };
+    /** Provider recovered after successful call during degraded state */
+    "provider:recovered": {
+        provider: string;
+        timestamp: number;
+    };
+}

package/node_modules/@comis/core/dist/event-bus/events-model.js

@@ -0,0 +1 @@
+export {};