comisai 1.0.42 → 1.0.45

package/node_modules/@comis/gateway/dist/rpc/ws-handler.js

@@ -180,7 +180,11 @@ export function createWsHandler(deps, rpcContext) {
     return {
         onOpen(_evt, ws) {
             connections.add(connectionId, rpcContext.clientId, ws);
-            logger.debug({ connectionId, clientId: rpcContext.clientId, activeConnections: connections.size }, `WebSocket connected: ${rpcContext.clientId}`);
+            // Fix B (log-review): demoted from debug → trace. Connect/disconnect
+            // pairs dominated debug-mode logs (one pair per CLI tick at 75s
+            // intervals); the underlying transport state is observable from
+            // activeConnections in heartbeat lines.
+            logger.trace({ connectionId, clientId: rpcContext.clientId, activeConnections: connections.size }, `WebSocket connected: ${rpcContext.clientId}`);
             // Set up heartbeat ping if enabled
             if (heartbeatMs > 0) {
                 const timer = systemSetInterval(() => {
@@ -290,7 +294,10 @@ export function createWsHandler(deps, rpcContext) {
             const connectionDurationMs = conn ? systemNowMs() - conn.connectedAt : undefined;
             connections.remove(connectionId);
             const isAbnormal = evt.code !== 1000 && evt.code !== 1001 && evt.code !== 1005;
-            const logFn = isAbnormal ? logger.info.bind(logger) : logger.debug.bind(logger);
+            // Fix B (log-review): normal-close demoted from debug → trace
+            // (paired with the onOpen demotion above). Abnormal closes remain
+            // info-level — those are the operator-relevant transitions.
+            const logFn = isAbnormal ? logger.info.bind(logger) : logger.trace.bind(logger);
             logFn({
                 connectionId,
                 clientId: rpcContext.clientId,

package/node_modules/@comis/gateway/dist/server/gateway-logger.d.ts

@@ -6,6 +6,8 @@
  * factory; the route needs the logger type for its deps).
  */
 export interface GatewayLogger {
+    trace(msg: string): void;
+    trace(obj: Record<string, unknown>, msg: string): void;
     debug(msg: string): void;
     debug(obj: Record<string, unknown>, msg: string): void;
     info(msg: string): void;

package/node_modules/@comis/gateway/dist/server/hono-server.d.ts

@@ -1,14 +1,11 @@
-import type { GatewayConfig, TypedEventBus, HookRunner } from "@comis/core";
+import type { GatewayConfig, TypedEventBus } from "@comis/core";
 import type { JSONRPCServer } from "json-rpc-2.0";
 import { Hono } from "hono";
 import type { RpcContext } from "../rpc/method-router.js";
 import type { RpcAdapterDeps } from "../rpc/rpc-adapters.js";
-import type { HmacAlgorithm } from "../webhook/hmac-verifier.js";
-import { type TokenStore } from "../auth/token-auth.js";
+import { type TokenClient, type TokenStore } from "../auth/token-auth.js";
 import { WsConnectionManager } from "../rpc/ws-handler.js";
-import { type WebhookHandler } from "../webhook/webhook-endpoint.js";
-import { type PendingFlow } from "../oauth/oauth-callback-route.js";
-import type { OAuthCredentialStorePort } from "@comis/core";
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { GatewayLogger } from "./gateway-logger.js";
 export type { GatewayLogger };
 /**
@@ -25,27 +22,6 @@ export interface GatewayServerDeps {
     readonly rpcServer: JSONRPCServer<RpcContext>;
     /** WebSocket connection lifecycle tracker */
     readonly wsConnections: WsConnectionManager;
-    /** Optional webhook configuration (mount only if provided) */
-    readonly webhookDeps?: {
-        secret: string;
-        onWebhook: WebhookHandler;
-        algorithm?: HmacAlgorithm;
-        headerName?: string;
-    };
-    /**
-     * Optional OAuth callback deps. When provided, the gateway mounts
-     * GET /oauth/callback/:provider for browser-redirect OAuth flows
-     * (web-UI-initiated logins). Pending-flow map is owned by the caller
-     * (e.g., setup-gateway.ts) so daemon restart cleanly drops all in-flight
-     * states.
-     */
-    readonly oauthCallbackDeps?: {
-        credentialStore: OAuthCredentialStorePort;
-        eventBus: TypedEventBus;
-        pendingFlows: Map<string, PendingFlow>;
-    };
-    /** Optional hook runner for lifecycle hooks (no-op when absent) */
-    readonly hookRunner?: HookRunner;
     /** Optional web dashboard deps (mount REST/SSE/static when provided) */
     readonly webDeps?: {
         /** Event bus for SSE streaming and activity buffer */
@@ -64,6 +40,11 @@ export interface GatewayServerDeps {
         instanceId: string;
         startedAt: string;
     };
+    /** Per-client McpServer factory. When provided, the gateway mounts
+     *  `POST /mcp/v1` between the global rate-limit middleware and the
+     *  catch-all 404 handler. Omit to leave the route unmounted
+     *  (deployments that disable the MCP server). */
+    readonly buildMcpServerForClient?: (client: TokenClient) => McpServer;
 }
 /**
  * Handle returned by createGatewayServer for lifecycle management.
@@ -86,7 +67,6 @@ export interface GatewayServerHandle {
  * Routes:
  * - GET /health — health check (always available)
  * - GET /ws — WebSocket with token auth + rate limiting
- * - POST /hooks/webhook — HMAC-verified webhook endpoint (if webhookDeps provided)
  * - GET /api/* — REST API + SSE endpoints (if webDeps provided)
  * - GET /app/* — Static web dashboard files (if webDeps.webDistPath provided)
  */

package/node_modules/@comis/gateway/dist/server/hono-server.js

@@ -13,8 +13,7 @@ import { createWsHandler } from "../rpc/ws-handler.js";
 import { createRestApi, ActivityRingBuffer, subscribeActivityBuffer } from "../web/rest-api.js";
 import { createSseEndpoint } from "../web/sse-endpoint.js";
 import { createStaticMiddleware } from "../web/static-middleware.js";
-import { createWebhookEndpoint } from "../webhook/webhook-endpoint.js";
-import { createOAuthCallbackRoute, } from "../oauth/oauth-callback-route.js";
+import { mountMcpServerEndpoint } from "../mcp-server-endpoint.js";
 /**
  * Create a gateway server with Hono.
  *
@@ -25,7 +24,6 @@ import { createOAuthCallbackRoute, } from "../oauth/oauth-callback-route.js";
  * Routes:
  * - GET /health — health check (always available)
  * - GET /ws — WebSocket with token auth + rate limiting
- * - POST /hooks/webhook — HMAC-verified webhook endpoint (if webhookDeps provided)
  * - GET /api/* — REST API + SSE endpoints (if webDeps provided)
  * - GET /app/* — Static web dashboard files (if webDeps.webDistPath provided)
  */
@@ -67,6 +65,28 @@ export function createGatewayServer(deps) {
         }
         return rateLimiterMw(c, next);
     });
+    // MCP server endpoint. MUST be mounted AFTER the global rate-limit
+    // middleware (so layer-1 IP caps apply) and BEFORE the catch-all
+    // `app.notFound` handler (so /mcp/v1 doesn't fall through to the 404
+    // branch). Per-client tools/list filter is enforced inside
+    // `buildMcpServerForClient` via the side-channel mcpExportPolicy registry.
+    if (deps.buildMcpServerForClient) {
+        mountMcpServerEndpoint(
+        // The Hono app is constructed without an explicit Bindings parameter,
+        // but `@hono/node-server` injects `{ incoming, outgoing }` into
+        // `c.env` at runtime. Cast narrows the public app type to the
+        // Bindings-aware shape the endpoint helper expects.
+        app, {
+            tokenStore: deps.tokenStore,
+            buildMcpServerForClient: deps.buildMcpServerForClient,
+            logger,
+            // Mirror the body-limit ceiling used by `/api/chat`. The bodyLimit
+            // middleware fires BEFORE the route handler reads c.req.json(), so
+            // an mcp-client cannot exhaust daemon heap by streaming a
+            // multi-GB body.
+            bodyLimitBytes: config.httpBodyLimitBytes,
+        });
+    }
     // Health endpoint — always available.
     // Includes daemon fingerprint (instanceId, startedAt) when provided so
     // external clients can verify which daemon they are actually reaching
@@ -108,6 +128,26 @@ export function createGatewayServer(deps) {
                 },
             };
         }
+        // Reject mcp-client-scoped tokens at WS upgrade time. mcp-client is
+        // the SOLE scope of any token that has it, so `includes("mcp-client")`
+        // is sufficient and means "this is an external MCP credential". Such a
+        // token does not have rpc/ws/admin and would silently fail every RPC
+        // method call after a successful upgrade -- wasting a connection slot,
+        // a rate-limit bucket, a WsConnectionManager entry, and giving the
+        // credential holder a confusing debugging experience. Close with 4003
+        // ("scope not permitted at this endpoint") and surface the correct route.
+        if (client.scopes.includes("mcp-client")) {
+            logger.warn({
+                clientId: client.id,
+                errorKind: "auth",
+                hint: "mcp-client tokens must use POST /mcp/v1 -- mcp-client is the sole scope of its token and cannot be co-issued with rpc/ws/admin",
+            }, "WebSocket connection rejected: mcp-client-scoped token cannot open /ws");
+            return {
+                onOpen(_evt, ws) {
+                    ws.close(4003, "mcp-client tokens must use POST /mcp/v1");
+                },
+            };
+        }
         const rpcContext = { clientId: client.id, scopes: client.scopes };
         return createWsHandler({
             rpcServer: deps.rpcServer,
@@ -119,20 +159,6 @@ export function createGatewayServer(deps) {
             messageRateLimit: config.wsMessageRateLimit,
         }, rpcContext);
     }));
-    // Mount webhook endpoint (if configured)
-    if (deps.webhookDeps) {
-        const webhookApp = createWebhookEndpoint(deps.webhookDeps);
-        app.route("/hooks", webhookApp);
-    }
-    // Mount OAuth callback at GET /oauth/callback/:provider
-    if (deps.oauthCallbackDeps) {
-        const oauthApp = createOAuthCallbackRoute({
-            ...deps.oauthCallbackDeps,
-            logger,
-        });
-        app.route("/oauth", oauthApp);
-        logger.debug({ submodule: "oauth-callback" }, "OAuth callback route mounted at /oauth/callback/:provider");
-    }
     // Mount web dashboard routes (if configured)
     let unsubscribeActivity;
     if (deps.webDeps) {
@@ -235,14 +261,8 @@ export function createGatewayServer(deps) {
             logger.debug("HTTP socket timeout disabled for WebSocket longevity");
             logger.info({ host, port }, `Gateway listening on http://${host}:${port} (dev mode)`);
         }
-        // Run gateway_start hook -- observability for server startup
-        // Hook errors are caught internally by the runner (catchErrors: true)
-        await deps.hookRunner?.runGatewayStart({ port, host, tls: !!tls }, {});
     }
     async function stop() {
-        // Run gateway_stop hook before shutdown
-        // Hook errors are caught internally by the runner (catchErrors: true)
-        await deps.hookRunner?.runGatewayStop({ reason: "shutdown" }, {});
         // Unsubscribe activity buffer from event bus
         if (unsubscribeActivity) {
             unsubscribeActivity();

package/node_modules/@comis/gateway/dist/web/approval-token-route.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Email approval-token route for the Comis gateway.
+ *
+ * Email cannot show interactive buttons, so the `[FAILED]` digest carries a
+ * single-use, time-bounded, signed LINK to this route — the token in the URL IS
+ * the approval credential. Mounted at `ALL /approve/:token` via
+ * `app.route("/approve", createApprovalTokenRoute(deps))`.
+ *
+ * Single-use invariant: the handler cancels the
+ * expiry timer and REMOVES the pending-token entry at the TOP — BEFORE deciding
+ * the outcome and REGARDLESS of HTTP method. A mail client's preview/HEAD
+ * prefetch is therefore a use: a following GET finds a dead token. Even when the
+ * resolution path errors AFTER the revoke, the token is already gone — no
+ * reusable state. The resolution itself is delegated to an injected
+ * `resolveApproval` callback (wired at the daemon composition root to the
+ * orchestrator's InteractiveCallbackRouter / ApprovalGate) so this route — and
+ * the whole gateway package — never imports `@comis/orchestrator`.
+ *
+ * 5-min auto-expiry: `insertPendingApprovalToken` schedules a
+ * `systemSetTimeout` delete after APPROVAL_TOKEN_TIMEOUT_MS (approvals also
+ * default `approvals.defaultTimeoutMs: 300_000`). The token is minted via
+ * `generateStrongToken()` (384-bit) at the composition root.
+ *
+ * Logging discipline: `submodule: "approval-token"` on every line;
+ * NEVER log the token or any secret. Time/timers come from `@comis/core`
+ * (`systemNowMs`/`systemSetTimeout`/`systemClearTimeout`) — no `Date.now()` /
+ * `setTimeout` globals (AGENTS.md §2.8).
+ *
+ * @module
+ */
+import { Hono } from "hono";
+import type { SystemTimeoutHandle } from "@comis/core";
+import type { GatewayLogger } from "../server/gateway-logger.js";
+/** 5-minute pending-token expiry. Exported for test parity (mirrors PENDING_FLOW_TIMEOUT_MS). */
+export declare const APPROVAL_TOKEN_TIMEOUT_MS: number;
+/** The approval choice an email link encodes. Email surfaces approve/deny only. */
+export type ApprovalLinkChoice = "approve" | "deny";
+/**
+ * A pending single-use approval token entry, keyed by the opaque token string.
+ * Created by `insertPendingApprovalToken` at digest-render time; consumed (and
+ * removed) by the route handler on the first touch of `/approve/:token`.
+ *
+ * Carries ONLY the server-side correlation needed to resolve the approval — the
+ * shortId, the chosen outcome, and the originating session/channel/agent so the
+ * injected resolver can route it. The full pending-request UUID never appears.
+ */
+export interface PendingApprovalToken {
+    /** 12-char base62 shortId minted by the approval gate (§6.4.1). */
+    shortId: string;
+    /** The outcome this link encodes (approve/deny). */
+    choice: ApprovalLinkChoice;
+    /** Orchestrator-derived session key (trusted; used for cross-session scoping). */
+    sessionKey: string;
+    /** Originating channel type (e.g. "email"). */
+    channelType: string;
+    /** Originating channel key (recipient id). */
+    channelKey: string;
+    /** Owning agent id. */
+    agentId: string;
+    /** Auto-expiry timer; the handler clears it on consume. */
+    timer: SystemTimeoutHandle;
+}
+/** Dependencies for createApprovalTokenRoute. */
+export interface ApprovalTokenDeps {
+    /** Token -> PendingApprovalToken map; mutated by the handler + insertPendingApprovalToken. */
+    readonly tokens: Map<string, PendingApprovalToken>;
+    /**
+     * Resolve the approval for a consumed token. Injected at the daemon composition
+     * root (delegates to the InteractiveCallbackRouter / ApprovalGate). Returns
+     * `true` when the approval was resolved, `false` when it could not be (already
+     * resolved, expired server-side, cross-session). Called AFTER the token is
+     * already revoked, so a throw/false never re-arms the token.
+     */
+    readonly resolveApproval: (entry: PendingApprovalToken) => Promise<boolean>;
+    /** Gateway-scoped logger. */
+    readonly logger: GatewayLogger;
+}
+/**
+ * Seed the token map with a new token -> PendingApprovalToken entry, scheduling a
+ * 5-minute auto-delete cleanup timer.
+ *
+ * The caller is responsible for generating `token` via `generateStrongToken()`
+ * (384-bit) — never hand-roll a PRNG. The timer NEVER logs the token.
+ */
+export declare function insertPendingApprovalToken(map: Map<string, PendingApprovalToken>, token: string, entry: Omit<PendingApprovalToken, "timer">, logger: GatewayLogger): void;
+/**
+ * Create the approval-token Hono sub-app.
+ *
+ * Mount via:
+ *   const app = new Hono();
+ *   app.route("/approve", createApprovalTokenRoute(deps));
+ * Resulting URL: ALL /approve/:token
+ *
+ * `app.all` matches every HTTP method (GET, HEAD, …) so a mail-client preview
+ * prefetch consumes the token exactly like a real click — the revoke-on-first-
+ * touch invariant holds regardless of method.
+ */
+export declare function createApprovalTokenRoute(deps: ApprovalTokenDeps): Hono;

package/node_modules/@comis/gateway/dist/web/approval-token-route.js

@@ -0,0 +1,143 @@
+// SPDX-License-Identifier: Apache-2.0
+// @allow-throw: approval-token HTTP route; throws caught by Hono error-handler boundary (web-user-facing flows exception).
+/**
+ * Email approval-token route for the Comis gateway.
+ *
+ * Email cannot show interactive buttons, so the `[FAILED]` digest carries a
+ * single-use, time-bounded, signed LINK to this route — the token in the URL IS
+ * the approval credential. Mounted at `ALL /approve/:token` via
+ * `app.route("/approve", createApprovalTokenRoute(deps))`.
+ *
+ * Single-use invariant: the handler cancels the
+ * expiry timer and REMOVES the pending-token entry at the TOP — BEFORE deciding
+ * the outcome and REGARDLESS of HTTP method. A mail client's preview/HEAD
+ * prefetch is therefore a use: a following GET finds a dead token. Even when the
+ * resolution path errors AFTER the revoke, the token is already gone — no
+ * reusable state. The resolution itself is delegated to an injected
+ * `resolveApproval` callback (wired at the daemon composition root to the
+ * orchestrator's InteractiveCallbackRouter / ApprovalGate) so this route — and
+ * the whole gateway package — never imports `@comis/orchestrator`.
+ *
+ * 5-min auto-expiry: `insertPendingApprovalToken` schedules a
+ * `systemSetTimeout` delete after APPROVAL_TOKEN_TIMEOUT_MS (approvals also
+ * default `approvals.defaultTimeoutMs: 300_000`). The token is minted via
+ * `generateStrongToken()` (384-bit) at the composition root.
+ *
+ * Logging discipline: `submodule: "approval-token"` on every line;
+ * NEVER log the token or any secret. Time/timers come from `@comis/core`
+ * (`systemNowMs`/`systemSetTimeout`/`systemClearTimeout`) — no `Date.now()` /
+ * `setTimeout` globals (AGENTS.md §2.8).
+ *
+ * @module
+ */
+import { Hono } from "hono";
+import { systemSetTimeout, systemClearTimeout } from "@comis/core";
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** 5-minute pending-token expiry. Exported for test parity (mirrors PENDING_FLOW_TIMEOUT_MS). */
+export const APPROVAL_TOKEN_TIMEOUT_MS = 5 * 60_000;
+// ---------------------------------------------------------------------------
+// HTML pages
+// ---------------------------------------------------------------------------
+function approvalHtml(title, heading, message, color) {
+    return [
+        "<!DOCTYPE html>",
+        `<html><head><meta charset="utf-8"><title>${title}</title>`,
+        `<style>body{font-family:system-ui,sans-serif;max-width:480px;margin:8em auto;padding:2em;text-align:center;color:#222}h1{color:${color}}</style>`,
+        `</head><body><h1>${heading}</h1>`,
+        `<p>${message}</p>`,
+        "<p>You can close this window.</p>",
+        "</body></html>",
+    ].join("");
+}
+const RESOLVED_HTML = approvalHtml("Approval Recorded", "Approval Recorded", "Your response has been recorded.", "#0a7d2c");
+const INVALID_HTML = approvalHtml("Link Expired", "Link Expired", "This approval link is invalid, already used, or has expired.", "#b00020");
+const ERROR_HTML = approvalHtml("Could Not Record", "Could Not Record", "The link was consumed but the approval could not be recorded. It cannot be retried.", "#b00020");
+// ---------------------------------------------------------------------------
+// Public boundary
+// ---------------------------------------------------------------------------
+/**
+ * Seed the token map with a new token -> PendingApprovalToken entry, scheduling a
+ * 5-minute auto-delete cleanup timer.
+ *
+ * The caller is responsible for generating `token` via `generateStrongToken()`
+ * (384-bit) — never hand-roll a PRNG. The timer NEVER logs the token.
+ */
+export function insertPendingApprovalToken(map, token, entry, logger) {
+    const timer = systemSetTimeout(() => {
+        map.delete(token);
+        logger.debug({
+            shortId: entry.shortId,
+            channelType: entry.channelType,
+            submodule: "approval-token",
+        }, "Pending approval token expired");
+    }, APPROVAL_TOKEN_TIMEOUT_MS);
+    map.set(token, { ...entry, timer });
+}
+/**
+ * Create the approval-token Hono sub-app.
+ *
+ * Mount via:
+ *   const app = new Hono();
+ *   app.route("/approve", createApprovalTokenRoute(deps));
+ * Resulting URL: ALL /approve/:token
+ *
+ * `app.all` matches every HTTP method (GET, HEAD, …) so a mail-client preview
+ * prefetch consumes the token exactly like a real click — the revoke-on-first-
+ * touch invariant holds regardless of method.
+ */
+export function createApprovalTokenRoute(deps) {
+    const app = new Hono();
+    app.all("/:token", async (c) => {
+        const token = c.req.param("token");
+        // Revoke FIRST, regardless of method. A
+        // preview/HEAD prefetch consumes the token; an errored resolution below
+        // still leaves no reusable state because the entry is already gone.
+        const entry = deps.tokens.get(token);
+        if (entry === undefined) {
+            // Unknown / already-consumed / expired token. No log of the token itself.
+            return c.html(INVALID_HTML, 410);
+        }
+        systemClearTimeout(entry.timer);
+        deps.tokens.delete(token);
+        try {
+            const resolved = await deps.resolveApproval(entry);
+            if (!resolved) {
+                // The token was valid + consumed, but the server-side approval was no
+                // longer resolvable (already resolved elsewhere, expired, cross-session).
+                deps.logger.info({
+                    shortId: entry.shortId,
+                    channelType: entry.channelType,
+                    submodule: "approval-token",
+                }, "Approval token consumed but not resolvable");
+                return c.html(INVALID_HTML, 410);
+            }
+            deps.logger.info({
+                shortId: entry.shortId,
+                choice: entry.choice,
+                channelType: entry.channelType,
+                submodule: "approval-token",
+            }, "Approval recorded via email link");
+            return c.html(RESOLVED_HTML);
+        }
+        catch {
+            // The token is already revoked above — no retry is possible.
+            // Never log the caught error verbatim (it could echo request internals).
+            deps.logger.warn({
+                shortId: entry.shortId,
+                channelType: entry.channelType,
+                errorKind: "internal",
+                hint: "Approval resolution threw; the single-use token is already consumed and cannot be retried.",
+                submodule: "approval-token",
+            }, "Approval token resolution failed");
+            // The token is already irrevocably consumed above, so this is a
+            // CONSUMED-but-failed terminal state, not a transient server error. Return a
+            // non-retryable 409 (not 500 — the conventional "retry me" signal) so the
+            // status line agrees with the ERROR_HTML "cannot be retried" body copy and a
+            // mail-client prefetch that trips this path never invites a user retry.
+            return c.html(ERROR_HTML, 409);
+        }
+    });
+    return app;
+}

package/node_modules/@comis/gateway/dist/web/index.d.ts

@@ -5,3 +5,5 @@ export type { SseEndpointDeps } from "./sse-endpoint.js";
 export { createStaticMiddleware } from "./static-middleware.js";
 export { createMediaRoutes } from "./media-routes.js";
 export type { MediaRoutesDeps } from "./media-routes.js";
+export { createApprovalTokenRoute, insertPendingApprovalToken, APPROVAL_TOKEN_TIMEOUT_MS, } from "./approval-token-route.js";
+export type { ApprovalTokenDeps, PendingApprovalToken, ApprovalLinkChoice, } from "./approval-token-route.js";

package/node_modules/@comis/gateway/dist/web/index.js

@@ -4,3 +4,4 @@ export { createRestApi, ActivityRingBuffer, subscribeActivityBuffer } from "./re
 export { createSseEndpoint } from "./sse-endpoint.js";
 export { createStaticMiddleware } from "./static-middleware.js";
 export { createMediaRoutes } from "./media-routes.js";
+export { createApprovalTokenRoute, insertPendingApprovalToken, APPROVAL_TOKEN_TIMEOUT_MS, } from "./approval-token-route.js";

package/node_modules/@comis/gateway/dist/web/media-routes.js

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: Apache-2.0
-// @allow-throw: @allow-throw boundary: gateway HTTP media-routes; throws caught by Hono framework error-handler boundary per AGENTS.md §2.1 web exception.
+// @allow-throw: @allow-throw boundary: gateway HTTP media-routes; throws caught by Hono framework error-handler boundary (web exception).
 /**
  * Media file serving routes -- Hono sub-app for serving stored media files.
  *
@@ -16,7 +16,7 @@ import * as fs from "node:fs/promises";
 import { Hono } from "hono";
 import { z } from "zod";
 import { safePath, PathTraversalError, systemNowMs } from "@comis/core";
-import { extractBearerToken } from "../auth/token-auth.js";
+import { extractBearerToken, checkScope } from "../auth/token-auth.js";
 /** Media ID validation pattern: letters, digits, dots, hyphens, underscores. */
 const MEDIA_ID_PATTERN = /^[\p{L}\p{N}._-]+$/u;
 /** Maximum characters in a media ID. */
@@ -69,9 +69,15 @@ export function createMediaRoutes(deps) {
         app.use("*", async (c, next) => {
             const token = extractBearerToken(c.req.header("authorization") ?? "") ??
                 (c.req.query("token") || null);
-            if (!token || !tokenStore.verify(token)) {
+            const client = token ? tokenStore.verify(token) : null;
+            if (!client) {
                 return c.json({ error: "Unauthorized" }, 401);
             }
+            // Enforce scope: media is a web-dashboard surface — require "rpc" like the
+            // rest of the web API. A sole-scope "mcp-client" token must not fetch it.
+            if (!checkScope(client.scopes, "rpc")) {
+                return c.json({ error: "Forbidden: insufficient scope" }, 403);
+            }
             return next();
         });
     }

package/node_modules/@comis/gateway/dist/web/rest-api.js

@@ -53,7 +53,6 @@ const ACTIVITY_EVENTS = [
     "scheduler:job_started",
     "scheduler:job_completed",
     "scheduler:heartbeat_check",
-    "scheduler:task_extracted",
     "system:error",
 ];
 /**
@@ -149,20 +148,22 @@ export function createRestApi(deps) {
         c.set("clientScopes", client.scopes);
         return next();
     });
-    // GET /agents - Agent configuration
+    // GET /agents - Non-secret agent listing (id/name/provider/model/status).
+    //
+    // Sources from rpcAdapterDeps.listAgentSummaries, NOT getConfig: §17.8
+    // removed `agents` from getConfig's non-secret allowlist, so
+    // getConfig now returns the safe default with no `agents` key. The dedicated
+    // projection returns only non-secret identity/model fields, so this listing
+    // works without re-opening the secret-egress path getConfig closed.
     api.get("/agents", async (c) => {
         try {
-            const result = await rpcAdapterDeps.getConfig({ section: "agents" });
-            const agentsMap = result["agents"];
-            if (!agentsMap) {
-                return c.json({ agents: [] });
-            }
-            const agents = Object.entries(agentsMap).map(([id, cfg]) => ({
-                id,
-                name: cfg.name ?? "Comis",
-                provider: cfg.provider ?? "unknown",
-                model: cfg.model ?? "unknown",
-                status: deps.suspendedAgents?.has(id) ? "suspended" : "active",
+            const summaries = rpcAdapterDeps.listAgentSummaries?.() ?? [];
+            const agents = summaries.map((a) => ({
+                id: a.id,
+                name: a.name,
+                provider: a.provider,
+                model: a.model,
+                status: deps.suspendedAgents?.has(a.id) ? "suspended" : "active",
             }));
             return c.json({ agents });
         }
@@ -171,21 +172,19 @@ export function createRestApi(deps) {
             return c.json({ error: "Internal error" }, 500);
         }
     });
-    // GET /channels - Channel connection status
+    // GET /channels - Channel connection status (non-secret name/enabled only).
+    //
+    // Sources from rpcAdapterDeps.listChannelSummaries, NOT getConfig:
+    // `channels` was removed from getConfig's allowlist (mirrors /agents). The
+    // projection already excludes the internal healthCheck block and every
+    // credential field; here we surface only the enabled adapters.
     api.get("/channels", async (c) => {
         try {
-            const result = await rpcAdapterDeps.getConfig({ section: "channels" });
-            const channelsCfg = result["channels"];
-            if (!channelsCfg) {
-                return c.json({ channels: [] });
-            }
-            // Convert channel config object to array, include only enabled channels
-            // Exclude healthCheck — it's an internal monitoring config, not a channel adapter
-            const channels = Object.entries(channelsCfg)
-                .filter(([name, cfg]) => name !== "healthCheck" && cfg.enabled === true)
-                .map(([name]) => ({
-                type: name,
-                name,
+            const channels = (rpcAdapterDeps.listChannelSummaries?.() ?? [])
+                .filter((ch) => ch.enabled)
+                .map((ch) => ({
+                type: ch.name,
+                name: ch.name,
                 enabled: true,
                 status: "connected",
             }));

package/node_modules/@comis/gateway/dist/web/sse-endpoint.js

@@ -1,7 +1,7 @@
 import { Hono } from "hono";
 import { streamSSE } from "hono/streaming";
 import { suppressError } from "@comis/shared";
-import { extractBearerToken } from "../auth/token-auth.js";
+import { extractBearerToken, checkScope } from "../auth/token-auth.js";
 /**
  * Events forwarded to the SSE event stream.
  */
@@ -33,7 +33,6 @@ const SSE_EVENTS = [
     "diagnostic:billing_snapshot",
     "scheduler:heartbeat_delivered",
     "scheduler:heartbeat_alert",
-    "scheduler:task_extracted",
     "skill:loaded",
     "skill:registry_reset",
     "model:catalog_loaded",
@@ -49,7 +48,6 @@ const SSE_EVENTS = [
     "security:memory_tainted",
     "security:warn",
     "secret:accessed",
-    "secret:modified",
     "model:fallback_attempt",
     "model:fallback_exhausted",
     "model:auth_cooldown",
@@ -89,6 +87,13 @@ export function createSseEndpoint(deps) {
         if (!client) {
             return c.json({ error: "Unauthorized" }, 401);
         }
+        // Enforce scope: SSE streams the cross-session event firehose and can drive
+        // agent turns, so require the same "rpc" scope the REST API does. A
+        // sole-scope "mcp-client" token (contained external credential) must NOT
+        // reach these surfaces — it is rejected here, matching rest-api.ts.
+        if (!checkScope(client.scopes, "rpc")) {
+            return c.json({ error: "Forbidden: insufficient scope" }, 403);
+        }
         // Store client scopes on context for downstream handlers
         c.set("clientScopes", client.scopes);
         return next();