comisai 1.0.42 → 1.0.45

package/node_modules/@comis/skills/dist/tools/builtin/exec-tool/exec-shared.js

@@ -12,11 +12,12 @@
  *
  * @module
  */
-import { existsSync } from "node:fs";
-import { PathTraversalError, safePath, systemEnvSnapshot, systemNowMs, tryGetContext, } from "@comis/core";
+import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { PathTraversalError, safePath, systemEnvSnapshot, systemNowMs, tryGetContext } from "@comis/core";
 import { resolvePaths } from "../file/safe-path-wrapper.js";
 import { throwToolError } from "../../../platform-tools/tool-helpers.js";
-import { parseInstallDetour, } from "../install-detour.js";
+import { parseInstallDetour } from "../install-detour.js";
 import { SECRET_REF_NAME_PATTERN } from "./exec-types.js";
 // ---------------------------------------------------------------------------
 // cwd resolution
@@ -89,6 +90,10 @@ export function buildSpawnCommand(command, cwd, sandboxConfig, workspacePath, te
             readOnlyPaths: allReadOnlyPaths,
             cwd,
             tempDir,
+            // Forward network + secureCredentialHome from ExecSandboxConfig to
+            // SandboxOptions. Undefined = open/unsecured (no regression).
+            network: sandboxConfig.network,
+            secureCredentialHome: sandboxConfig.secureCredentialHome,
         });
         // bwrap handles cwd internally via --chdir; sandbox-exec does not.
         const providerHandlesCwd = sandboxConfig.sandbox.name === "bwrap";
@@ -114,13 +119,7 @@ export function buildSpawnCommand(command, cwd, sandboxConfig, workspacePath, te
 // ---------------------------------------------------------------------------
 // secretRefs helpers
 // ---------------------------------------------------------------------------
-/**
- * Workspace-internal data env resolver. Returns env vars derived from
- * `workspaceDir` so python/matplotlib subprocesses do NOT inherit the
- * daemon's host PATH or cache-dir defaults. Shape mirrors
- * `packages/agent/src/workspace/data-env.ts` verbatim; lifted inline to
- * avoid a cross-package agent import (skills + agent are siblings).
- */
+/** Workspace-local data env — python/matplotlib subprocesses only, not inheriting daemon PATH. */
 function resolveDataEnv(opts) {
     const venvBin = safePath(opts.workspaceDir, "venv", "bin");
     const cacheDir = safePath(opts.workspaceDir, ".cache");
@@ -247,7 +246,10 @@ function buildSoftStopErrorTemplate(decision, port) {
 function buildInstallDetourEventPayload(decision, mode, action) {
     const ctx = tryGetContext();
     return {
-        agentId: ctx?.sessionKey ?? "unknown",
+        // RequestContext has no `agentId` field — `userId` is the agent
+        // identity (matches evaluateInstallDetourGate's approval-gate precedent
+        // below). sessionKey is a separate formatted key and must not shadow it.
+        agentId: ctx?.userId ?? "unknown",
         sessionKey: ctx?.sessionKey ?? "unknown",
         traceId: ctx?.traceId,
         packageManager: decision.packageManager,
@@ -328,7 +330,7 @@ export async function evaluateInstallDetourGate(deps) {
                             commandDigest: installDetourDecision.commandDigest,
                         },
                         agentId: ctx.userId ?? "unknown",
-                        sessionKey: ctx.sessionKey,
+                        sessionKey: ctx.sessionKey ?? "",
                         trustLevel: (ctx.trustLevel ?? "admin"),
                         channelType: ctx.channelType,
                     });
@@ -356,11 +358,74 @@ export async function evaluateInstallDetourGate(deps) {
     }
     return { decision: installDetourDecision, mode: installDetourMode, errorMessage };
 }
+// ---------------------------------------------------------------------------
+// Warm venv seed
+// ---------------------------------------------------------------------------
+/** Sentinel file written inside venv/ once seed packages are installed. */
+const VENV_SEED_SENTINEL = ".seed-done";
 /**
- * Build the final environment record for the subprocess by merging:
- *   baseEnv → dataEnv → userEnv → resolvedSecretEnv (last wins on collision).
- * Block-extracted from the createExecTool factory.
+ * Lock directory serializing concurrent ensureWarmVenvSeed callers. Atomic
+ * `mkdirSync(..., {recursive:false})` gives O_CREAT|O_EXCL semantics on POSIX:
+ * the loser receives EEXIST and bails. Exported for tests.
  */
+export const VENV_SEED_LOCK_DIR = ".seed-lock";
+/**
+ * Install seed packages into the workspace venv on first creation. Idempotent:
+ * skips if `.seed-done` exists; no-op on empty packages.
+ *
+ * Concurrency: two callers passing existsSync would both spawn pip
+ * (wasted CPU + risk on write-locked FS). The mkdir lock serializes; the
+ * finally{} releases on success AND pip-failure so transient errors do not
+ * wedge the venv.
+ *
+ * Packages come from operator config validated by Zod; spawned
+ * via explicit array args (no shell string injection).
+ */
+export function ensureWarmVenvSeed(workspacePath, packages, logger) {
+    if (packages.length === 0)
+        return;
+    const venvDir = safePath(workspacePath, "venv");
+    const sentinelPath = safePath(venvDir, VENV_SEED_SENTINEL);
+    if (existsSync(sentinelPath))
+        return;
+    const lockPath = safePath(venvDir, VENV_SEED_LOCK_DIR);
+    try {
+        mkdirSync(lockPath, { recursive: false });
+    }
+    catch (err) {
+        const code = err.code;
+        const isEexist = code === "EEXIST";
+        logger?.debug({
+            workspaceDir: workspacePath,
+            err: isEexist ? undefined : err instanceof Error ? err.message : String(err),
+            hint: isEexist
+                ? "Concurrent seed caller holds the lock; bailing"
+                : "Failed to acquire venv seed lock; skipping seed",
+        }, isEexist ? "Warm venv seed already in progress (lock held)" : "Warm venv seed skipped (lock acquisition failed)");
+        return;
+    }
+    try {
+        const pip = safePath(safePath(workspacePath, "venv"), "bin", "pip");
+        const result = spawnSync(pip, ["install", "--quiet", ...packages], {
+            encoding: "utf8",
+            stdio: "pipe",
+        });
+        if (result.status === 0) {
+            // Sentinel content = seeded package list (one per line) for diagnostics.
+            // Avoids `new Date()` (globals.test.ts gate).
+            writeFileSync(sentinelPath, packages.join("\n") + "\n");
+            logger?.debug({ workspaceDir: workspacePath, seeded: packages }, "Warm venv seed installed");
+        }
+        else {
+            logger?.debug({ workspaceDir: workspacePath, packages, exitCode: result.status, hint: "pip seed failed; venv will work but may lack default packages" }, "Warm venv seed skipped (pip error)");
+        }
+    }
+    finally {
+        // Release unconditionally — transient pip failure must not wedge the venv.
+        rmSync(lockPath, { recursive: true, force: true });
+    }
+}
+/** Build the subprocess env by merging: baseEnv → dataEnv → userEnv → resolvedSecretEnv → brokerSpawnEnv. */
 export function buildExecEnv(deps) {
     const { workspacePath, subprocessEnv, userEnv, resolvedSecretEnv, sandboxConfig, logger } = deps;
     const baseEnv = subprocessEnv ?? systemEnvSnapshot();
@@ -371,6 +436,11 @@ export function buildExecEnv(deps) {
         if (dataEnv.PATH && baseEnv.PATH) {
             dataEnv.PATH = `${dataEnv.PATH}:${baseEnv.PATH}`;
         }
+        // Seed the venv on first use when warmVenvSeed packages are configured
+        const seedPackages = sandboxConfig?.warmVenvSeed;
+        if (seedPackages !== undefined && seedPackages.length > 0) {
+            ensureWarmVenvSeed(workspacePath, seedPackages, logger);
+        }
     }
     else {
         delete dataEnv.PATH;
@@ -382,5 +452,10 @@ export function buildExecEnv(deps) {
         ...(resolvedSecretEnv ?? {}),
     };
     const finalEnv = sandboxConfig?.sandbox.wrapEnv?.(env, workspacePath) ?? env;
+    // Broker + cap-lease env LAST; proxy vars filtered to the defined ones (a Phase 211 cap-lease-only spawn has none).
+    if (deps.brokerSpawnEnv) {
+        const { HTTPS_PROXY, HTTP_PROXY, NODE_EXTRA_CA_CERTS, placeholders } = deps.brokerSpawnEnv;
+        Object.assign(finalEnv, placeholders, Object.fromEntries(Object.entries({ HTTPS_PROXY, NODE_EXTRA_CA_CERTS, HTTP_PROXY }).filter(([, v]) => v != null)));
+    }
     return finalEnv;
 }

package/node_modules/@comis/skills/dist/tools/builtin/exec-tool/exec-types.d.ts

@@ -44,7 +44,7 @@ export interface ToolLogger {
 }
 /**
  * Dependencies for the exec tool factory. Backward compatibility is NOT
- * preserved (see CLAUDE.md user-memory `feedback_no_backward_compat`).
+ * preserved.
  *
  * `toolCapabilityPort` is REQUIRED — wires the install-detour policy gate
  * inside `execute(...)` consuming `port.getInstallDetourMode()`. Daemon
@@ -53,8 +53,7 @@ export interface ToolLogger {
  * connected-server and skill arrays so the parser sees no overlaps.
  *
  * `approvalGate` is OPTIONAL — only required by the `soft-stop` mode
- * override path. Missing gate → `soft-stop` denies override
- * (fail-closed per AGENTS.md §2.1).
+ * override path. Missing gate → `soft-stop` denies override (fail-closed).
  */
 export interface ExecToolDeps {
     readonly workspacePath: string;
@@ -66,10 +65,24 @@ export interface ExecToolDeps {
     readonly sandboxConfig?: ExecSandboxConfig;
     readonly eventBus?: TypedEventBus;
     readonly getToolResultsDir?: () => string | undefined;
-    /** REQUIRED for v1.1 capability layer. */
+    /** REQUIRED for the capability layer. */
     readonly toolCapabilityPort: ToolCapabilityPort;
     /** Optional. Required only for soft-stop override path. */
     readonly approvalGate?: ApprovalGate;
+    /**
+     * Broker proxy env injected ONLY for the driven-CLI spawn — never for general exec.
+     * When present, these env vars are merged LAST in buildExecEnv so they win over
+     * wrapEnv output. Only the daemon wiring for the driven-CLI call site passes this
+     * field; the general exec call site never passes it (egress security invariant).
+     */
+    readonly brokerSpawnEnv?: {
+        readonly HTTPS_PROXY?: string;
+        /** HTTP_PROXY intentionally omitted — broker is CONNECT-only (HTTPS). */
+        readonly HTTP_PROXY?: string;
+        readonly NODE_EXTRA_CA_CERTS?: string;
+        /** Provider placeholder key env vars. e.g. { ANTHROPIC_API_KEY: "broker-placeholder" } */
+        readonly placeholders: Record<string, string>;
+    };
 }
 export interface EscalationContext {
     command: string;

package/node_modules/@comis/skills/dist/tools/builtin/exec-tool/index.d.ts

@@ -17,7 +17,7 @@ export { killTree, buildSpawnCommand, buildInstallDetourHint } from "./exec-shar
 /**
  * Create an exec tool for shell command execution.
  *
- * Backward compat NOT preserved (memory `feedback_no_backward_compat`).
+ * Backward compat NOT preserved.
  *
  * @param deps - Dependencies bundle. See `ExecToolDeps` for field semantics.
  *   `toolCapabilityPort` is REQUIRED; `approvalGate` is optional but

package/node_modules/@comis/skills/dist/tools/builtin/exec-tool/index.js

@@ -15,18 +15,42 @@
 import { mkdirSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { Type } from "typebox";
-import { safePath, systemNowMs, tryGetContext } from "@comis/core";
+import { safePath, systemNowMs, tryGetContext, registerActivityLabelSpec } from "@comis/core";
+import { redactSecretsInText, parseShellCommand } from "@comis/observability";
 import { jsonResult, throwToolError, readStringParam, readNumberParam, readBooleanParam, } from "../../../platform-tools/tool-helpers.js";
-import { extractHeredoc, validateExecCommand } from "../exec-security/index.js";
+import { extractHeredoc, extractDashCArg, validateExecCommand } from "../exec-security/index.js";
 import { DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS, ExecParams } from "./exec-types.js";
 import { resolveCwd, commandUsesRawInterpreter, resolveSecretRefs, evaluateInstallDetourGate, buildExecEnv, } from "./exec-shared.js";
 import { executeForeground } from "./exec-foreground.js";
 import { executeBackground } from "./exec-background.js";
+// Activity label spec (SPEC §6.3). Descriptor name == emitted name
+// (exec-tool/index.ts:75 → `name: "exec"`). The transform hook wires
+// parseShellCommand for runtime completion; the fallback `label` literal
+// renders when the transform returns "" (empty command).
+//
+// Security (Pitfall 4 — defense-in-depth):
+//   1) parseShellCommand self-redacts via redactValue at
+//      shell-label-parser.ts:53 — `grep sk-… /tmp/log` renders as
+//      `search for \`<redacted>\` in /tmp/log`.
+//   2) applyTemplate step 4 (template-engine.ts:155) re-runs the transform
+//      output through redactValue — a malicious or buggy transform still
+//      cannot leak a secret shape.
+// No detailKeys: the LLM-supplied command string is consumed by the
+// transform (which handles its own redaction) — there is no `{key}`
+// placeholder for the template-engine allowlist to police.
+registerActivityLabelSpec("exec", {
+    semanticPhase: "tool",
+    label: "running command",
+    transform: (params) => {
+        const cmd = typeof params.command === "string" ? params.command : "";
+        return cmd.length > 0 ? parseShellCommand(cmd) : "";
+    },
+});
 export { killTree, buildSpawnCommand, buildInstallDetourHint } from "./exec-shared.js";
 /**
  * Create an exec tool for shell command execution.
  *
- * Backward compat NOT preserved (memory `feedback_no_backward_compat`).
+ * Backward compat NOT preserved.
  *
  * @param deps - Dependencies bundle. See `ExecToolDeps` for field semantics.
  *   `toolCapabilityPort` is REQUIRED; `approvalGate` is optional but
@@ -78,12 +102,23 @@ export function createExecTool(deps) {
                     command = heredoc.command;
                     input = heredoc.input;
                 }
+                // Auto-rewrite `<interp> -c "<multiline body>"` to the stdin
+                // form. Runs AFTER extractHeredoc so a `python3 - <<'PY'` heredoc
+                // continues to take precedence (a command with BOTH forms is
+                // malformed and falls through to Gate-0).
+                const dashC = extractDashCArg(command, input ?? undefined);
+                if (dashC) {
+                    command = dashC.command;
+                    input = dashC.input;
+                }
                 // Validate command and env through security pipeline
                 const validationError = validateExecCommand(command, userEnv);
                 if (validationError) {
                     eventBus?.emit("command:blocked", {
                         agentId: tryGetContext()?.sessionKey ?? "unknown",
-                        commandPrefix: command.slice(0, 200),
+                        // Redact BEFORE slicing so a credential straddling the boundary char
+                        // is fully masked in the event payload sent to SSE consumers.
+                        commandPrefix: redactSecretsInText(command).slice(0, 200),
                         reason: validationError.message,
                         blocker: validationError.blocker,
                         timestamp: systemNowMs(),
@@ -101,7 +136,9 @@ export function createExecTool(deps) {
                 const breakSystemWarning = command.includes("--break-system-packages")
                     ? "⚠️ WARNING: --break-system-packages modifies the system Python. Use a virtualenv: the workspace's pre-warmed venv (venv/bin/pip install ...) or a per-project one (python3 -m venv projects/<name>/.venv).\n\n"
                     : "";
-                logger?.debug({ toolName: "exec", command: command.slice(0, 200), background, pty, ...(description && { description }) }, "Exec command start");
+                // Redact BEFORE slicing so a bare token straddling char 200 cannot
+                // appear as a truncated-but-still-recognizable fragment in the log field.
+                logger?.debug({ toolName: "exec", command: redactSecretsInText(command).slice(0, 200), background, pty, ...(description && { description }) }, "Exec command start");
                 if (userEnv)
                     logger?.debug({ toolName: "exec", envOverrides: Object.keys(userEnv) }, "Exec env override applied");
                 const timeoutMs = Math.min(Math.max(rawTimeout ?? DEFAULT_TIMEOUT_MS, 100), MAX_TIMEOUT_MS);
@@ -121,7 +158,8 @@ export function createExecTool(deps) {
                         for (const name of Object.keys(resolvedSecretEnv)) {
                             eventBus?.emit("secret:accessed", { secretName: name, agentId, outcome: "success", timestamp: systemNowMs() });
                         }
-                        logger?.info({ toolName: "exec", secretRefs: Object.keys(resolvedSecretEnv), commandPrefix: command.slice(0, 80) }, "Exec resolved secretRefs for subprocess");
+                        // Redact BEFORE slicing to prevent boundary-straddle leaks.
+                        logger?.info({ toolName: "exec", secretRefs: Object.keys(resolvedSecretEnv), commandPrefix: redactSecretsInText(command).slice(0, 80) }, "Exec resolved secretRefs for subprocess");
                     }
                 }
                 const finalEnv = buildExecEnv({ workspacePath, subprocessEnv, userEnv, resolvedSecretEnv, sandboxConfig, logger });

package/node_modules/@comis/skills/dist/tools/builtin/file/apply-patch-tool.js

@@ -12,12 +12,21 @@
 import { Type } from "typebox";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { safePath, PathTraversalError } from "@comis/core";
+import { safePath, PathTraversalError, registerActivityLabelSpec } from "@comis/core";
 import { throwToolError } from "../../../platform-tools/tool-helpers.js";
 import { parsePatch } from "./apply-patch-parser.js";
 import { similarity, normalizeLine } from "./apply-patch-similarity.js";
 import { PROTECTED_WORKSPACE_FILES, resolvePaths } from "./safe-path-wrapper.js";
 import { withFileMutationQueue } from "../file-tools/shared/file-mutation-queue.js";
+// Activity label spec. The EMITTED name
+// uses an UNDERSCORE — `apply-patch-tool.ts:475 → name: "apply_patch"` —
+// while the file basename is hyphenated. No detailKeys:
+// the patch body is the only param and is NEVER safe to substitute (it can
+// contain entire files including secret material), so the label is static.
+registerActivityLabelSpec("apply_patch", {
+    semanticPhase: "tool",
+    label: "applying patch",
+});
 const ApplyPatchParams = Type.Object({
     patch: Type.String({
         description: "The patch content in *** Begin Patch format",

package/node_modules/@comis/skills/dist/tools/builtin/file-tools/edit-tool.d.ts

@@ -17,6 +17,12 @@ interface ToolLogger {
     warn(obj: Record<string, unknown>, msg: string): void;
     debug(obj: Record<string, unknown>, msg: string): void;
 }
+/** Minimal config shape for the edit tool guard knob (avoids importing full SecurityConfig). */
+interface EditToolConfig {
+    security?: {
+        writeSecretGuard?: "warn" | "block" | "off";
+    };
+}
 declare const EditParams: Type.TObject<{
     path: Type.TString;
     edits: Type.TArray<Type.TObject<{
@@ -36,6 +42,7 @@ declare const EditParams: Type.TObject<{
  * @param logger - Optional pino-compatible logger
  * @param tracker - Optional FileStateTracker for read-before-edit and staleness
  * @param sharedPaths - Optional shared paths (lazily resolved) accessible by all tools
+ * @param config - Optional config for secret egress guard (security.writeSecretGuard)
  */
-export declare function createComisEditTool(workspacePath: string, logger?: ToolLogger, tracker?: FileStateTracker, sharedPaths?: LazyPaths): AgentTool<typeof EditParams>;
+export declare function createComisEditTool(workspacePath: string, logger?: ToolLogger, tracker?: FileStateTracker, sharedPaths?: LazyPaths, config?: EditToolConfig): AgentTool<typeof EditParams>;
 export {};

package/node_modules/@comis/skills/dist/tools/builtin/file-tools/edit-tool.js

@@ -14,7 +14,7 @@ import { Type } from "typebox";
 import * as fs from "node:fs/promises";
 import { basename, extname } from "node:path";
 import { fromPromise } from "@comis/shared";
-import { safePath, PathTraversalError } from "@comis/core";
+import { safePath, PathTraversalError, scrubSecretsFromText, registerActivityLabelSpec } from "@comis/core";
 import { isDeviceFile } from "../file/file-state-tracker.js";
 import { suggestSimilarPaths } from "../file/path-suggest.js";
 import { PROTECTED_WORKSPACE_FILES, resolvePaths, } from "../file/safe-path-wrapper.js";
@@ -23,6 +23,14 @@ import { readFileWithMetadata, writeFilePreserving, } from "./shared/file-encodi
 import { applyEdits, generateDiffString, detectQuoteStyle, applyCurlyQuotes, cleanupTrailingNewlines, validateConfigContent, } from "./shared/edit-diff.js";
 import { getGitDiffStat } from "./shared/git-diff.js";
 import { withFileMutationQueue } from "./shared/file-mutation-queue.js";
+import { pathOutsideWorkspaceMessage } from "./path-error.js";
+// Activity label spec (SPEC §6.1). Descriptor name == emitted name for
+// builtins (edit-tool.ts:196 → `name: "edit"`).
+registerActivityLabelSpec("edit", {
+    semanticPhase: "tool",
+    label: "editing {path}",
+    detailKeys: ["path"],
+});
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -101,7 +109,7 @@ function resolveEditPath(workspacePath, filePath, sharedPaths) {
                 throw error;
         }
     }
-    throw new Error(`[path_traversal] Path outside workspace bounds: ${filePath}`);
+    throw new Error(pathOutsideWorkspaceMessage(filePath));
 }
 // ---------------------------------------------------------------------------
 // Factory
@@ -117,8 +125,9 @@ function resolveEditPath(workspacePath, filePath, sharedPaths) {
  * @param logger - Optional pino-compatible logger
  * @param tracker - Optional FileStateTracker for read-before-edit and staleness
  * @param sharedPaths - Optional shared paths (lazily resolved) accessible by all tools
+ * @param config - Optional config for secret egress guard (security.writeSecretGuard)
  */
-export function createComisEditTool(workspacePath, logger, tracker, sharedPaths) {
+export function createComisEditTool(workspacePath, logger, tracker, sharedPaths, config) {
     // Comis extension: promptGuidelines (not part of AgentTool type, spread to bypass excess property check)
     const ext = { promptGuidelines: [
             "You MUST read the file before editing in each response (reads from prior messages do not carry over). Strip line number prefixes from read output before using as oldText.",
@@ -162,6 +171,27 @@ export function createComisEditTool(workspacePath, logger, tracker, sharedPaths)
                     throw new Error(`[noop_edit] edits[${i}] is a no-op (oldText === newText). Remove it or provide different replacement text.`);
                 }
             }
+            // --- Secret egress guard on newText content — default "warn" + redirect hint.
+            const editGuardMode = (config?.security?.writeSecretGuard ?? "warn");
+            let editWarnRedactions = 0;
+            if (editGuardMode !== "off") {
+                for (let i = 0; i < edits.length; i++) {
+                    const newText = String(edits[i].newText);
+                    const scrub = scrubSecretsFromText(newText);
+                    if (scrub.redactions > 0) {
+                        if (editGuardMode === "block") {
+                            throw new Error(`[write_secret_blocked] File edit blocked: edits[${i}].newText contains ${scrub.redactions} secret-shaped value(s). ` +
+                                `Store credentials using the secure credential store instead of writing plaintext files.`);
+                        }
+                        // warn (default): replace newText with scrubbed version, track redaction count.
+                        edits[i].newText = scrub.text;
+                        editWarnRedactions += scrub.redactions;
+                    }
+                }
+                if (editWarnRedactions > 0) {
+                    logger?.warn({ hint: "Secret-shaped value redacted from file edit; use secure credential store", errorKind: "internal", redactions: editWarnRedactions }, "Egress guard: edit-tool newText scrubbed");
+                }
+            }
             // --- V4: Path resolution (workspace -> sharedPaths) ---
             const resolvedPath = resolveEditPath(workspacePath, filePath, sharedPaths);
             // --- V5: Protected workspace file check ---
@@ -284,6 +314,9 @@ export function createComisEditTool(workspacePath, logger, tracker, sharedPaths)
             if (editResult.configWarning) {
                 resultText += `\n\n[invalid_config] Warning: ${editResult.configWarning}`;
             }
+            if (editWarnRedactions > 0) {
+                resultText += `\n\n[warn] ${editWarnRedactions} secret-shaped value(s) were redacted from the edit. Use the secure credential store for sensitive values.`;
+            }
             const gitStat = await getGitDiffStat(resolvedPath, workspacePath);
             if (gitStat) {
                 resultText += `\n\n${gitStat}`;

package/node_modules/@comis/skills/dist/tools/builtin/file-tools/find-tool.js

@@ -12,10 +12,18 @@
 import { Type } from "typebox";
 import * as fsp from "node:fs/promises";
 import * as nodePath from "node:path";
-import { safePath, PathTraversalError } from "@comis/core";
+import { safePath, PathTraversalError, registerActivityLabelSpec } from "@comis/core";
 import { resolvePaths } from "../file/safe-path-wrapper.js";
 import { readStringParam, readNumberParam, readBooleanParam } from "../../../platform-tools/tool-helpers.js";
 import ignore from "ignore";
+import { pathOutsideWorkspaceMessage } from "./path-error.js";
+// Activity label spec (SPEC §6.1). Descriptor name == emitted name for
+// builtins (find-tool.ts:295 → `name: "find"`).
+registerActivityLabelSpec("find", {
+    semanticPhase: "tool",
+    label: "finding {pattern}",
+    detailKeys: ["pattern"],
+});
 // ---------------------------------------------------------------------------
 // Parameter schema
 // ---------------------------------------------------------------------------
@@ -77,7 +85,7 @@ function resolveSearchPath(workspacePath, filePath, readOnlyPaths, sharedPaths)
                 throw error;
         }
     }
-    throw new Error(`[path_traversal] Path outside workspace bounds: ${filePath}`);
+    throw new Error(pathOutsideWorkspaceMessage(filePath));
 }
 /**
  * Load .gitignore from the search base directory and create an ignore filter.

package/node_modules/@comis/skills/dist/tools/builtin/file-tools/grep-tool.js

@@ -12,11 +12,21 @@
 import { Type } from "typebox";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { safePath, PathTraversalError } from "@comis/core";
+import { safePath, PathTraversalError, registerActivityLabelSpec } from "@comis/core";
 import { resolvePaths } from "../file/safe-path-wrapper.js";
 import { readStringParam, readNumberParam, readBooleanParam } from "../../../platform-tools/tool-helpers.js";
 import { truncateLine, GREP_MAX_LINE_WIDTH } from "../truncate.js";
 import { ensureTool } from "../tool-provisioner.js";
+import { pathOutsideWorkspaceMessage } from "./path-error.js";
+// Activity label spec (SPEC §6.1). Descriptor name == emitted name for
+// builtins (grep-tool.ts:402 → `name: "grep"`). Two detailKeys (`pattern` +
+// `path`) — the multi-key shape mirrors
+// platform-tools/mcp-manage-tool.ts:23-33.
+registerActivityLabelSpec("grep", {
+    semanticPhase: "tool",
+    label: "searching for {pattern}",
+    detailKeys: ["pattern", "path"],
+});
 /** Valid output mode values for parameter validation. */
 const OUTPUT_MODES = ["content", "files_with_matches", "count"];
 // ---------------------------------------------------------------------------
@@ -117,7 +127,7 @@ function resolveSearchPath(workspacePath, filePath, readOnlyPaths, sharedPaths)
                 throw error;
         }
     }
-    throw new Error(`[path_traversal] Path outside workspace bounds: ${filePath}`);
+    throw new Error(pathOutsideWorkspaceMessage(filePath));
 }
 /**
  * Build ripgrep command-line arguments from pattern and output mode.

package/node_modules/@comis/skills/dist/tools/builtin/file-tools/ls-tool.js

@@ -11,9 +11,17 @@
  */
 import { Type } from "typebox";
 import * as fsp from "node:fs/promises";
-import { safePath, PathTraversalError } from "@comis/core";
+import { safePath, PathTraversalError, registerActivityLabelSpec } from "@comis/core";
 import { resolvePaths } from "../file/safe-path-wrapper.js";
 import { readStringParam, readNumberParam } from "../../../platform-tools/tool-helpers.js";
+import { pathOutsideWorkspaceMessage } from "./path-error.js";
+// Activity label spec (SPEC §6.1). Descriptor name == emitted name for
+// builtins (ls-tool.ts:126 → `name: "ls"`).
+registerActivityLabelSpec("ls", {
+    semanticPhase: "tool",
+    label: "listing {path}",
+    detailKeys: ["path"],
+});
 // ---------------------------------------------------------------------------
 // Parameter schema
 // ---------------------------------------------------------------------------
@@ -68,7 +76,7 @@ function resolveSearchPath(workspacePath, filePath, readOnlyPaths, sharedPaths)
                 throw error;
         }
     }
-    throw new Error(`[path_traversal] Path outside workspace bounds: ${filePath}`);
+    throw new Error(pathOutsideWorkspaceMessage(filePath));
 }
 // ---------------------------------------------------------------------------
 // Factory

package/node_modules/@comis/skills/dist/tools/builtin/file-tools/notebook-edit-tool.js

@@ -13,12 +13,23 @@ import { Type } from "typebox";
 import * as fs from "node:fs/promises";
 import { extname } from "node:path";
 import { fromPromise } from "@comis/shared";
-import { safePath, PathTraversalError } from "@comis/core";
+import { safePath, PathTraversalError, registerActivityLabelSpec } from "@comis/core";
 import { isDeviceFile } from "../file/file-state-tracker.js";
 import { readStringParam } from "../../../platform-tools/tool-helpers.js";
 import { readFileWithMetadata, writeFilePreserving, } from "./shared/file-encoding.js";
 import { parseNotebook } from "./shared/notebook-utils.js";
+import { pathOutsideWorkspaceMessage } from "./path-error.js";
 import { resolveCellIndex, replaceCell, insertCell, deleteCell, serializeNotebook, } from "./shared/notebook-edit-ops.js";
+// Activity label spec (SPEC §6.1). The EMITTED name uses an UNDERSCORE —
+// `notebook-edit-tool.ts:120 → name: "notebook_edit"` — while the file
+// basename is hyphenated. Registering on the hyphen would key the wrong entry
+// and the activity stream would fall back to the humanized default. The
+// coverage-gate test pins the underscore.
+registerActivityLabelSpec("notebook_edit", {
+    semanticPhase: "tool",
+    label: "editing notebook {path}",
+    detailKeys: ["path"],
+});
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -105,7 +116,7 @@ export function createComisNotebookEditTool(workspacePath, logger, tracker) {
             catch (error) {
                 if (!(error instanceof PathTraversalError))
                     throw error;
-                throw new Error(`[path_traversal] Path outside workspace bounds: ${filePath}`, { cause: error });
+                throw new Error(pathOutsideWorkspaceMessage(filePath), { cause: error });
             }
             // V5 -- File existence + stat
             const statResult = await fromPromise(fs.stat(resolvedPath));

package/node_modules/@comis/skills/dist/tools/builtin/file-tools/path-error.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Shared "path outside workspace" error message for the builtin file tools
+ * (read/write/edit/ls/grep/find/notebook).
+ *
+ * Live finding (F-10, 2026-06-12): a small model asked to "write report.md to
+ * your workspace" emitted an absolute `~/Desktop/report.md`, hit the bare
+ * `[path_traversal] Path outside workspace bounds: …` error, could not infer the
+ * fix from it, and gave up (delivering content inline instead of a file). The
+ * error said WHAT was wrong but not WHERE to write — so the model never retried
+ * with the workspace-relative path that would have worked. This message keeps the
+ * stable `[path_traversal] Path outside workspace bounds: <path>` prefix (parsers/
+ * classifiers key on it) and APPENDS a concrete remedy so the model self-corrects.
+ *
+ * @module
+ */
+/**
+ * Build the path-traversal rejection message for a file path that resolved
+ * outside the workspace (and any shared paths). The host workspace ROOT is
+ * intentionally NOT echoed (it can reach logs/channels) — the remedy is the
+ * relative-path shape, which is all the model needs.
+ */
+export declare function pathOutsideWorkspaceMessage(filePath: string): string;

package/node_modules/@comis/skills/dist/tools/builtin/file-tools/path-error.js

@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Shared "path outside workspace" error message for the builtin file tools
+ * (read/write/edit/ls/grep/find/notebook).
+ *
+ * Live finding (F-10, 2026-06-12): a small model asked to "write report.md to
+ * your workspace" emitted an absolute `~/Desktop/report.md`, hit the bare
+ * `[path_traversal] Path outside workspace bounds: …` error, could not infer the
+ * fix from it, and gave up (delivering content inline instead of a file). The
+ * error said WHAT was wrong but not WHERE to write — so the model never retried
+ * with the workspace-relative path that would have worked. This message keeps the
+ * stable `[path_traversal] Path outside workspace bounds: <path>` prefix (parsers/
+ * classifiers key on it) and APPENDS a concrete remedy so the model self-corrects.
+ *
+ * @module
+ */
+/**
+ * Build the path-traversal rejection message for a file path that resolved
+ * outside the workspace (and any shared paths). The host workspace ROOT is
+ * intentionally NOT echoed (it can reach logs/channels) — the remedy is the
+ * relative-path shape, which is all the model needs.
+ */
+export function pathOutsideWorkspaceMessage(filePath) {
+    return (`[path_traversal] Path outside workspace bounds: ${filePath}. ` +
+        `Use a path relative to your workspace (e.g. "report.md" or "notes/report.md"); ` +
+        `absolute paths, "~", and ".." are not allowed.`);
+}