comisai 1.0.44 → 1.0.46

package/node_modules/@comis/core/dist/security/cli-subcommand-map.d.ts

@@ -1,14 +1,14 @@
 /**
  * `CLI_SUBCOMMAND_MAP` — the `comis-agent` subcommand→call-target
- * source-of-truth (CLI-01, v8 §7). The in-jail `comis-agent` CLI is Surface 3
+ * source-of-truth. The in-jail `comis-agent` CLI is the third call surface
  * (typed tool / orchestrate script / this CLI all converge on the SAME handlers
- * + the SAME `requireCapability` gate). Its value is shell fluency + Hermes
- * parity, NOT new authority — so this table NEVER restates a capability: each
+ * + the SAME `requireCapability` gate). Its value is shell fluency,
+ * NOT new authority — so this table NEVER restates a capability: each
  * entry is a `{kind:"tool", tool}` (rides `tool.invoke`) or a `{kind:"method",
  * method}` (a direct orchestration / self-scoped-read method), and the CAP is
  * DERIVED from the existing {@link TOOL_CAPABILITY_MAP} / {@link
  * HANDLER_CAPABILITY_MAP} (there is deliberately no `cap` field here). The wire
- * the CLI sends each call over is the lease cap socket (CLI-04), never the
+ * the CLI sends each call over is the lease cap socket, never the
  * loopback gateway WebSocket.
  *
  * The `skill` family is INTENTIONALLY OMITTED — it is NOT a gap. Every
@@ -19,9 +19,9 @@
  * method is reachable over the cap socket. The orchestrate SCRIPT surface hits
  * the SAME closed door. Offering a `skill` subcommand would advertise a path
  * that is always denied — so it is excluded by design (the substrate denylist is
- * NOT relaxed; un-denylisting would contradict the mitigation and sit outside
- * this phase's "no new capability" boundary). The admin verbs
- * (`secrets`/`config`/`tokens`/`gateway`/…) are likewise absent (CLI-03): the
+ * NOT relaxed; un-denylisting would contradict the mitigation and grant a
+ * capability this table must never grant). The admin verbs
+ * (`secrets`/`config`/`tokens`/`gateway`/…) are likewise absent: the
  * real `comis` is not on the jail PATH, the lease holds no admin cap, and admin
  * handlers deny-by-origin.
  *
@@ -31,7 +31,7 @@
  * future re-added `skill`-like entry pointing at a non-orch/denied target aborts
  * module load rather than silently shipping a weaker/false-affordance path. The
  * denylist cross-check itself (the proof that no target is in
- * `DENYLISTED_RPC_METHODS`) is Plan 05's arch-test, which imports the daemon's
+ * `DENYLISTED_RPC_METHODS`) is the companion arch-test, which imports the daemon's
  * exported denylist — kept OUT of here so `@comis/core` never imports
  * `@comis/daemon` (a package cycle).
  *
@@ -62,14 +62,14 @@ export type CliCallTarget = {
     readonly method: GatedMethodName;
 };
 /**
- * The FINAL `comis-agent` subcommand→target table (v8 §7 lines 384-392, minus
+ * The FINAL `comis-agent` subcommand→target table (minus
  * the denylisted `skill`). `as const satisfies Record<string, CliCallTarget>`
  * keeps the literal tool/method strings exact at the type level (a typo'd target
  * fails the build) while typing the whole table.
  *
  * `list` is its OWN top-level key (→ `session.list`) and `status` is its own (→
- * `session.status`) so BOTH are flat enumerable entries the same-gate predicate
- * (Plan 05) iterates; the two-token `status list` is a PARSER-level alias to the
+ * `session.status`) so BOTH are flat enumerable entries the same-gate arch-test
+ * predicate iterates; the two-token `status list` is a PARSER-level alias to the
  * `list` entry (handled in `comis-agent-cli.ts`), NOT a nested value shape that
  * would hide a target from the flat enumeration.
  */
@@ -130,7 +130,7 @@ export declare const CLI_SUBCOMMAND_MAP: {
 /** The subcommand-name keys of {@link CLI_SUBCOMMAND_MAP}. */
 export type CliSubcommand = keyof typeof CLI_SUBCOMMAND_MAP;
 /**
- * Assert the CLI table ↔ cap-map soundness invariants (CLI-01). Pure: takes the
+ * Assert the CLI table ↔ cap-map soundness invariants. Pure: takes the
  * three tables explicitly so the invariant is independently unit-testable over a
  * poisoned copy (the throw branches are the security fail-loud paths). Throws a
  * descriptive `Error` on the first violation.

package/node_modules/@comis/core/dist/security/cli-subcommand-map.js

@@ -1,15 +1,15 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
  * `CLI_SUBCOMMAND_MAP` — the `comis-agent` subcommand→call-target
- * source-of-truth (CLI-01, v8 §7). The in-jail `comis-agent` CLI is Surface 3
+ * source-of-truth. The in-jail `comis-agent` CLI is the third call surface
  * (typed tool / orchestrate script / this CLI all converge on the SAME handlers
- * + the SAME `requireCapability` gate). Its value is shell fluency + Hermes
- * parity, NOT new authority — so this table NEVER restates a capability: each
+ * + the SAME `requireCapability` gate). Its value is shell fluency,
+ * NOT new authority — so this table NEVER restates a capability: each
  * entry is a `{kind:"tool", tool}` (rides `tool.invoke`) or a `{kind:"method",
  * method}` (a direct orchestration / self-scoped-read method), and the CAP is
  * DERIVED from the existing {@link TOOL_CAPABILITY_MAP} / {@link
  * HANDLER_CAPABILITY_MAP} (there is deliberately no `cap` field here). The wire
- * the CLI sends each call over is the lease cap socket (CLI-04), never the
+ * the CLI sends each call over is the lease cap socket, never the
  * loopback gateway WebSocket.
  *
  * The `skill` family is INTENTIONALLY OMITTED — it is NOT a gap. Every
@@ -20,9 +20,9 @@
  * method is reachable over the cap socket. The orchestrate SCRIPT surface hits
  * the SAME closed door. Offering a `skill` subcommand would advertise a path
  * that is always denied — so it is excluded by design (the substrate denylist is
- * NOT relaxed; un-denylisting would contradict the mitigation and sit outside
- * this phase's "no new capability" boundary). The admin verbs
- * (`secrets`/`config`/`tokens`/`gateway`/…) are likewise absent (CLI-03): the
+ * NOT relaxed; un-denylisting would contradict the mitigation and grant a
+ * capability this table must never grant). The admin verbs
+ * (`secrets`/`config`/`tokens`/`gateway`/…) are likewise absent: the
  * real `comis` is not on the jail PATH, the lease holds no admin cap, and admin
  * handlers deny-by-origin.
  *
@@ -32,7 +32,7 @@
  * future re-added `skill`-like entry pointing at a non-orch/denied target aborts
  * module load rather than silently shipping a weaker/false-affordance path. The
  * denylist cross-check itself (the proof that no target is in
- * `DENYLISTED_RPC_METHODS`) is Plan 05's arch-test, which imports the daemon's
+ * `DENYLISTED_RPC_METHODS`) is the companion arch-test, which imports the daemon's
  * exported denylist — kept OUT of here so `@comis/core` never imports
  * `@comis/daemon` (a package cycle).
  *
@@ -45,14 +45,14 @@
 import { HANDLER_CAPABILITY_MAP, SELF_SCOPED_AGENT_READS, } from "./handler-capability-map.js";
 import { TOOL_CAPABILITY_MAP } from "./tool-capability-map.js";
 /**
- * The FINAL `comis-agent` subcommand→target table (v8 §7 lines 384-392, minus
+ * The FINAL `comis-agent` subcommand→target table (minus
  * the denylisted `skill`). `as const satisfies Record<string, CliCallTarget>`
  * keeps the literal tool/method strings exact at the type level (a typo'd target
  * fails the build) while typing the whole table.
  *
  * `list` is its OWN top-level key (→ `session.list`) and `status` is its own (→
- * `session.status`) so BOTH are flat enumerable entries the same-gate predicate
- * (Plan 05) iterates; the two-token `status list` is a PARSER-level alias to the
+ * `session.status`) so BOTH are flat enumerable entries the same-gate arch-test
+ * predicate iterates; the two-token `status list` is a PARSER-level alias to the
  * `list` entry (handled in `comis-agent-cli.ts`), NOT a nested value shape that
  * would hide a target from the flat enumeration.
  */
@@ -69,24 +69,24 @@ export const CLI_SUBCOMMAND_MAP = {
     grep: { kind: "tool", tool: "grep" }, // orch:read
     find: { kind: "tool", tool: "find" }, // orch:read
     ls: { kind: "tool", tool: "ls" }, // orch:read
-    // ── self-scoped reads (Plan 02 audience exception; any valid lease reaches) ──
+    // ── self-scoped reads (the cap-socket audience exception; any valid lease reaches) ──
     whoami: { kind: "method", method: "capabilities.introspect" },
     status: { kind: "method", method: "session.status" },
     list: { kind: "method", method: "session.list" }, // parser aliases `status list` → here
 };
 // ---------------------------------------------------------------------------
-// Module-load soundness assertion (CLI-01 fail-loud).
+// Module-load soundness assertion (fail-loud).
 // Mirrors tool-capability-map.ts + handler-capability-map.ts: assert-at-load so
 // a mis-targeted entry (a non-cap-map tool/method, or a method that is neither
 // orch:* nor a self-scoped read, or a deny-by-origin method) fails LOUD at
 // import — this is what would catch a re-added `skill`-like entry IF it pointed
 // at a non-orch/denied target. The denylist cross-check (no target ∈
-// DENYLISTED_RPC_METHODS) is Plan 05's arch-test (it imports the daemon export;
+// DENYLISTED_RPC_METHODS) is the companion arch-test (it imports the daemon export;
 // @comis/core must NOT import @comis/daemon — a package cycle).
 // ---------------------------------------------------------------------------
 const SELF_SCOPED_READ_SET = new Set(SELF_SCOPED_AGENT_READS);
 /**
- * Assert the CLI table ↔ cap-map soundness invariants (CLI-01). Pure: takes the
+ * Assert the CLI table ↔ cap-map soundness invariants. Pure: takes the
  * three tables explicitly so the invariant is independently unit-testable over a
  * poisoned copy (the throw branches are the security fail-loud paths). Throws a
  * descriptive `Error` on the first violation.

package/node_modules/@comis/core/dist/security/external-content.d.ts

@@ -15,7 +15,7 @@ export declare function detectSuspiciousPatterns(content: string): string[];
  * Security warning prepended to external content.
  */
 export declare const EXTERNAL_CONTENT_WARNING: string;
-export type ExternalContentSource = "email" | "webhook" | "api" | "channel_metadata" | "web_search" | "web_fetch" | "document" | "voice_transcription" | "vision" | "video_description" | "mcp_tool" | "mcp_resource" | "outcome_judge" | "learned_skill_synthesis" | "learned_skill_reflection" | "learned_profile_reflection" | "learned_topic_reflection" | "memory_generalization" | "unknown";
+export type ExternalContentSource = "email" | "webhook" | "api" | "channel_metadata" | "web_search" | "web_fetch" | "document" | "voice_transcription" | "vision" | "video_description" | "mcp_tool" | "mcp_resource" | "orchestrate_checkpoint" | "outcome_judge" | "learned_skill_synthesis" | "learned_skill_reflection" | "learned_profile_reflection" | "learned_topic_reflection" | "learned_procedure_reflection" | "memory_generalization" | "unknown";
 export type WrapExternalContentOptions = {
     /** Source of the external content */
     source: ExternalContentSource;

package/node_modules/@comis/core/dist/security/external-content.js

@@ -121,11 +121,13 @@ const EXTERNAL_SOURCE_LABELS = {
     video_description: "Video description",
     mcp_tool: "MCP tool result",
     mcp_resource: "MCP resource content",
+    orchestrate_checkpoint: "Orchestrate checkpoint state",
     outcome_judge: "Outcome judge input",
     learned_skill_synthesis: "Learned-skill synthesis input",
     learned_skill_reflection: "Learned-skill reflection input",
     learned_profile_reflection: "Learned-profile reflection input",
     learned_topic_reflection: "Learned-topic reflection input",
+    learned_procedure_reflection: "Learned-procedure reflection input",
     memory_generalization: "Memory generalization cluster input",
     unknown: "External",
 };
@@ -153,16 +155,16 @@ function foldMarkerText(input) {
 }
 function replaceMarkers(content) {
     const folded = foldMarkerText(content);
-    // Check for both legacy static markers and new dynamic markers
+    // Check for both the fixed literal markers and the dynamic hex-delimiter markers
     if (!/external_untrusted_content/i.test(folded) && !/untrusted_[a-f0-9]/i.test(folded)) {
         return content;
     }
     const replacements = [];
     const patterns = [
-        // Legacy static markers
+        // Fixed literal markers (a known string an attacker can embed to fake a boundary)
         { regex: /<<<EXTERNAL_UNTRUSTED_CONTENT>>>/gi, value: "[[MARKER_SANITIZED]]" },
         { regex: /<<<END_EXTERNAL_UNTRUSTED_CONTENT>>>/gi, value: "[[END_MARKER_SANITIZED]]" },
-        // New dynamic markers (hex delimiter pattern)
+        // Dynamic markers (hex delimiter pattern)
         { regex: /<<<UNTRUSTED_[a-f0-9]+>>>/gi, value: "[[MARKER_SANITIZED]]" },
         { regex: /<<<END_UNTRUSTED_[a-f0-9]+>>>/gi, value: "[[END_MARKER_SANITIZED]]" },
     ];

package/node_modules/@comis/core/dist/security/handler-capability-map.d.ts

@@ -1,7 +1,7 @@
 /**
  * `HANDLER_CAPABILITY_MAP` — the single auditable source-of-truth that
  * classifies every orchestration-core RPC method to its required
- * {@link AgentCapability} (CAP-04, v8 §3.7).
+ * {@link AgentCapability}.
  *
  * Why a registry (not a fuzzy "every handler" scan): "gated" must be a
  * machine-checkable table, not a notion. Each orchestration method is one of
@@ -11,8 +11,8 @@
  *     in-process gate, because the agent loop skips `checkScope`).
  *   - `"deny-by-origin"` — an admin/control-plane method un-grantable to an
  *     agent origin (the `rpc-dispatch.ts` chokepoint rejects an `_agentId`-bearing
- *     call for every scopes:["admin"] method). 210-GAP populates this class with
- *     the message subset §3.5 keeps admin-only (edit/delete/fetch/attach) + the
+ *     call for every scopes:["admin"] method). This class holds
+ *     the message subset kept admin-only (edit/delete/fetch/attach) + the
  *     arbitrary-session lifecycle ops carrying an in-handler `_trustLevel`-admin
  *     check (session.delete/export/reset_conversation).
  *   - `"ungated"` — a read-only / lifecycle method governed by neither a cap
@@ -28,15 +28,15 @@
  *   2. `packages/core/src/security/handler-capability-map.test.ts` pins the
  *      anchor classifications + the no-typo'd-cap invariant.
  *
- * Phase 212's `tool.invoke` cap-map will REUSE this table (the gate and the
+ * The `tool.invoke` cap-map REUSES this table (the gate and the
  * SDK draw from one source), so it lives in `security/` (importable by both
  * `@comis/daemon` handlers and `@comis/agent` tool-assembly with no package
  * cycle) and OUT of `api-contracts/` (the web-codegen surface).
  *
- * SCOPE (v8 / RESEARCH Open Q3): 210 classifies the orchestration-CORE methods
+ * SCOPE: this table classifies the orchestration-CORE methods
  * only — session.spawn plus the graph, cron, message and skills families. The
- * FULL §3.6 read/web/analyze/write/browse tool-surface map is Phase 212. Do NOT
- * enumerate the full tool surface here.
+ * FULL read/web/analyze/write/browse tool-surface map is
+ * `tool-capability-map.ts`. Do NOT enumerate the full tool surface here.
  *
  * @module
  */
@@ -105,7 +105,7 @@ export declare const HANDLER_CAPABILITY_MAP: {
 export type GatedMethodName = keyof typeof HANDLER_CAPABILITY_MAP;
 /**
  * SELF_SCOPED_AGENT_READS — the tight, named cap-socket audience exception
- * (CLI-01 / CLI-02; v8 §15 "whoami — read, no cap").
+ * ("whoami — read, no cap").
  *
  * These three methods are `"ungated"` in {@link HANDLER_CAPABILITY_MAP} (no
  * `orch:*` cap, not deny-by-origin), `scopes:["rpc"]` (not admin), and each

package/node_modules/@comis/core/dist/security/handler-capability-map.js

@@ -12,8 +12,8 @@
  */
 export const HANDLER_CAPABILITY_MAP = {
     // ── session ── only session.spawn is an orch cap; session.send is governed by
-    // the agentToAgent policy gate. The read/lifecycle ops split two ways
-    // (210-GAP MD-01): list/compact/reset/history/run_status/search/status are
+    // the agentToAgent policy gate. The read/lifecycle ops split two
+    // ways: list/compact/reset/history/run_status/search/status are
     // "ungated" (agent-reachable self-scoped reads, rpc-scoped contracts), while
     // delete/export/reset_conversation are "deny-by-origin" — they carry an
     // in-handler `_trustLevel === "admin"` check AND target an ARBITRARY session
@@ -51,12 +51,12 @@ export const HANDLER_CAPABILITY_MAP = {
     "cron.list": "ungated",
     "cron.status": "ungated",
     "cron.runs": "ungated",
-    // ── message ── 210-GAP / §3.5: `orch:message` exposes ONLY the
+    // ── message ── `orch:message` exposes ONLY the
     // genuinely-outward send subset (send/reply/react). edit/delete/fetch/attach
     // are admin-only and NOT part of the cap → "deny-by-origin" (they stay
     // scopes:["admin"]; an agent origin is denied at the chokepoint, NOT
-    // cap-gated). This corrects the prior over-broad gating that (a) put
-    // edit/delete/attach behind a cap no profile grants and (b) made a
+    // cap-gated). Gating the admin subset on the cap would (a) put
+    // edit/delete/attach behind a cap no profile grants and (b) make a
     // _capabilities-stripped admin gateway caller throw on the (undefined) cap.
     "message.send": "orch:message",
     "message.reply": "orch:message",
@@ -72,7 +72,7 @@ export const HANDLER_CAPABILITY_MAP = {
     "skills.import": "orch:skill",
     "skills.upload": "orch:skill",
     "skills.list": "ungated",
-    // ── capabilities ── INTRO-02 (Phase 215): capabilities.introspect (the
+    // ── capabilities ── capabilities.introspect (the
     // `whoami` read) is read-only + agent-reachable with NO cap — an agent queries
     // its OWN resolved caps + remaining budget/quota. It joins the read-only
     // "ungated" class (beside session.status); the handler enforces _agentId
@@ -81,7 +81,7 @@ export const HANDLER_CAPABILITY_MAP = {
 };
 /**
  * SELF_SCOPED_AGENT_READS — the tight, named cap-socket audience exception
- * (CLI-01 / CLI-02; v8 §15 "whoami — read, no cap").
+ * ("whoami — read, no cap").
  *
  * These three methods are `"ungated"` in {@link HANDLER_CAPABILITY_MAP} (no
  * `orch:*` cap, not deny-by-origin), `scopes:["rpc"]` (not admin), and each

package/node_modules/@comis/core/dist/security/index.js

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 // @comis/core/security — Security utilities
 export { safePath, PathTraversalError } from "./safe-path.js";
-// JAIL-03 bind-mount validator (Phase 211) — pure denylist backstop reusing the
+// Bind-mount validator — pure denylist backstop reusing the
 // safe-path symlink-resolve-through-ancestors primitive.
 export { validateBindMount } from "./bind-mount-validator.js";
 // Master-key file helpers (daemon-free `secrets init` body)
@@ -17,23 +17,23 @@ export { createSecretManager, createSecretManagerWithMutableHandle, envSubset }
 export { classifyAction, requiresConfirmation, registerAction, lockRegistry, isRegistryLocked } from "./action-classifier.js";
 // Audit events
 export { AuditEventSchema, createAuditEvent, AUDIT_KINDS, kindIsSecuritySignal } from "./audit.js";
-// Agent orchestration capabilities (Phase 210)
+// Agent orchestration capabilities
 export { AGENT_CAPABILITIES, checkCapability, requireCapability, CapabilityDeniedError, attenuateCaps } from "./capability.js";
-// HANDLER_CAPABILITY_MAP — the single auditable method→capability source-of-truth (CAP-04)
+// HANDLER_CAPABILITY_MAP — the single auditable method→capability source-of-truth
 export { HANDLER_CAPABILITY_MAP } from "./handler-capability-map.js";
-// SELF_SCOPED_AGENT_READS — the tight cap-socket audience exception (CLI-01/02);
+// SELF_SCOPED_AGENT_READS — the tight cap-socket audience exception;
 // the @comis/infra lease audience imports it so whoami/status reach the agent's
 // own self-scoped reads with any valid lease.
 export { SELF_SCOPED_AGENT_READS } from "./handler-capability-map.js";
-// CLI_SUBCOMMAND_MAP — the `comis-agent` subcommand→{tool|method} 1:1 table
-// (CLI-01, v8 §7). The @comis/skills comis-agent-cli dispatches over it; the
+// CLI_SUBCOMMAND_MAP — the `comis-agent` subcommand→{tool|method} 1:1 table.
+// The @comis/skills comis-agent-cli dispatches over it; the
 // cap is DERIVED from the cap-maps (never restated). `skill` + admin verbs are
-// excluded by design (denylisted orch:skill / CLI-03).
+// excluded by design (orch:skill is denylisted at the cap socket).
 export { CLI_SUBCOMMAND_MAP } from "./cli-subcommand-map.js";
 // TOOL_CAPABILITY_MAP / TOOL_ROUTE_MAP — the single source for the tool.invoke
-// surface (gate + lease audience + SDK codegen) (Phase 212, DISPATCH/READ)
+// surface (gate + lease audience + SDK codegen)
 export { TOOL_CAPABILITY_MAP, TOOL_ROUTE_MAP } from "./tool-capability-map.js";
-// ResultRef — minimal structured result-handle + its pure threshold/GC math (Phase 212, REF)
+// ResultRef — minimal structured result-handle + its pure threshold/GC math
 export { RESULT_REF_THRESHOLDS, DEFAULT_INLINE_THRESHOLD_BYTES, PER_FILE_CAP_BYTES, PER_RUN_AGGREGATE_CAP_BYTES, getResultRefThreshold, shouldMaterialize, isExpired, selectEvictions, checkPerFileCap, computeExpiresAt, } from "./result-ref.js";
 // Log sanitizer
 export { sanitizeLogString, redactErrorMessage } from "./log-sanitizer.js";
@@ -51,10 +51,10 @@ export { validateInput } from "./input-validator.js";
 export { createInputSecurityGuard } from "./input-security-guard.js";
 // Memory write validator
 export { validateMemoryWrite } from "./memory-write-validator.js";
-// Learned-doc static scan (v2.31 Reflection) — the STATIC poison/secret scan an
-// advisory Mental Model doc receives (SKILL-02 / INV-3). Wraps validateMemoryWrite
+// Learned-doc static scan — the STATIC poison/secret scan an
+// advisory Mental Model doc receives. Wraps validateMemoryWrite
 // per-field; no scripts/tool-policy/dynamic surface. Consumed by the agent reflection
-// job (223-04) + the daemon reflect path (223-05).
+// job + the daemon reflect path.
 export { validateLearnedDocBody, MAX_DOC_NAME_LENGTH } from "./validate-learned-doc-body.js";
 // Canary tokens
 export { generateCanaryToken, detectCanaryLeakage } from "./canary-token.js";

package/node_modules/@comis/core/dist/security/injection-patterns.d.ts

@@ -1,7 +1,7 @@
 /**
- * Backward-compatible barrel re-export of all injection pattern families.
+ * Barrel re-export of all injection pattern families under one import surface.
  *
- * Pattern families are now independently importable from
+ * Pattern families are also independently importable from
  * `./patterns/invisible-chars.js`, `./patterns/jailbreak.js`, etc.
  *
  * @module injection-patterns

package/node_modules/@comis/core/dist/security/injection-patterns.js

@@ -1,8 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Backward-compatible barrel re-export of all injection pattern families.
+ * Barrel re-export of all injection pattern families under one import surface.
  *
- * Pattern families are now independently importable from
+ * Pattern families are also independently importable from
  * `./patterns/invisible-chars.js`, `./patterns/jailbreak.js`, etc.
  *
  * @module injection-patterns

package/node_modules/@comis/core/dist/security/input-security-guard.js

@@ -16,7 +16,7 @@
  */
 import { IGNORE_PREV_INSTRUCTIONS, IGNORE_INSTRUCTIONS_BROAD, DISREGARD_PREVIOUS, DISREGARD_INSTRUCTIONS, FORGET_EVERYTHING, FORGET_INSTRUCTIONS_BROAD, YOU_ARE_NOW, YOU_ARE_NOW_ARTICLE, NEW_INSTRUCTIONS, NEW_INSTRUCTIONS_COLON, IMPORTANT_OVERRIDE, OVERRIDE_SAFETY, ACT_AS_ROLE, CONTEXT_RESET, RULE_REPLACEMENT, SYSTEM_TAG, SYSTEM_BRACKET, SYSTEM_COMMAND, SPECIAL_TOKEN_DELIMITERS, ROLE_BOUNDARY, ASSISTANT_ROLE_MARKER, } from "./injection-patterns.js";
 /**
- * Defense-in-depth bound on the scan input (GIANT-INPUT-WEDGE, 30uc-20260624). The scan is a
+ * Defense-in-depth bound on the scan input. The scan is a
  * heuristic over `text` — `stripCodeBlocks` (regex over the whole string) + per-pattern regex
  * tests + a `split(/\s+/)` typoglycemia loop (O(words)). On a multi-MB message that is millions
  * of synchronous string ops that block the Node event loop. A jailbreak directive is realistically

package/node_modules/@comis/core/dist/security/log-sanitizer.d.ts

@@ -22,16 +22,15 @@ export declare function sanitizeLogString(input: string): string;
 /**
  * Redact a free-text error/diagnostic string: strip URLs (`[URL]`), the bare
  * `Authorization:`/`Bearer` credential-scheme markers, and any long token
- * (`[REDACTED]`). The single source of truth for the SEC-01 redaction regex —
+ * (`[REDACTED]`). The single source of truth for this redaction regex —
  * reused by `sanitizeApiError` (adapter API-error bodies in `@comis/skills`),
  * the inbound voice handler's structured-log lines, AND the voice-OUT pipeline's
  * WARN branches in `@comis/channels`.
  *
- * Relocated here from `@comis/skills` (media-adapter-shared.ts) in Phase 197 so
- * BOTH `@comis/skills` and `@comis/channels` resolve ONE definition: channels
- * deliberately does NOT import skills (structural-typing boundary), so the pure
- * primitive lives DOWN in core where both packages already depend. The redaction
- * SEMANTICS are unchanged from the original — only the location moved.
+ * It lives here so BOTH `@comis/skills` and `@comis/channels` resolve ONE
+ * definition: channels deliberately does NOT import skills (structural-typing
+ * boundary), so the pure primitive lives DOWN in core where both packages
+ * already depend.
  *
  * This is intentionally narrower than {@link sanitizeLogString} (which matches a
  * catalog of known credential FORMATS): `redactErrorMessage` is the coarser

package/node_modules/@comis/core/dist/security/log-sanitizer.js

@@ -47,9 +47,9 @@ const CREDENTIAL_PATTERNS = [
     { pattern: URL_PASSWORD, replacement: "://$1:[REDACTED]@" },
     // Discord bot tokens: M/N prefix, three dot-separated segments
     { pattern: DISCORD_BOT_TOKEN, replacement: "[REDACTED_DISCORD_TOKEN]" },
-    // FAL API keys: <uuid-or-token>:<24+ hex> (CR-01, Phase 192). Before the generic
-    // hex pass so the colon-joined key is replaced as one unit; the 24-hex-tail floor
-    // keeps ordinary host:port / key:value prose out.
+    // FAL API keys: <uuid-or-token>:<24+ hex>. Before the generic hex pass so the
+    // colon-joined key is replaced as one unit; the 24-hex-tail floor keeps
+    // ordinary host:port / key:value prose out.
     { pattern: FAL_KEY, replacement: "[REDACTED_FAL]" },
     // Generic hex secrets (40+ chars of hex, commonly git tokens, etc.)
     { pattern: HEX_SECRET_LONG, replacement: "[REDACTED_HEX]" },
@@ -88,16 +88,15 @@ export function sanitizeLogString(input) {
 /**
  * Redact a free-text error/diagnostic string: strip URLs (`[URL]`), the bare
  * `Authorization:`/`Bearer` credential-scheme markers, and any long token
- * (`[REDACTED]`). The single source of truth for the SEC-01 redaction regex —
+ * (`[REDACTED]`). The single source of truth for this redaction regex —
  * reused by `sanitizeApiError` (adapter API-error bodies in `@comis/skills`),
  * the inbound voice handler's structured-log lines, AND the voice-OUT pipeline's
  * WARN branches in `@comis/channels`.
  *
- * Relocated here from `@comis/skills` (media-adapter-shared.ts) in Phase 197 so
- * BOTH `@comis/skills` and `@comis/channels` resolve ONE definition: channels
- * deliberately does NOT import skills (structural-typing boundary), so the pure
- * primitive lives DOWN in core where both packages already depend. The redaction
- * SEMANTICS are unchanged from the original — only the location moved.
+ * It lives here so BOTH `@comis/skills` and `@comis/channels` resolve ONE
+ * definition: channels deliberately does NOT import skills (structural-typing
+ * boundary), so the pure primitive lives DOWN in core where both packages
+ * already depend.
  *
  * This is intentionally narrower than {@link sanitizeLogString} (which matches a
  * catalog of known credential FORMATS): `redactErrorMessage` is the coarser
@@ -110,20 +109,20 @@ export function sanitizeLogString(input) {
 export function redactErrorMessage(body) {
     return (body
         .replace(/https?:\/\/[^\s"')]+/g, "[URL]")
-        // WR-03: redact a credential-scheme marker TOGETHER with the long token it
+        // Redact a credential-scheme marker TOGETHER with the long token it
         // carries, as ONE `[REDACTED]` — and ONLY when a >=20-char credential token
         // actually follows. The optional `Authorization:` / `Bearer ` prefix is
         // part of the match but the `{20,}` token is REQUIRED, so the prefix is
         // consumed only alongside a real credential (no orphaned scheme word, no
         // double-space), while a bare "bearer"/"authorization" used as PROSE — or a
-        // scheme followed by a sub-20-char value — is left verbatim (the prior
-        // non-anchored deletion mangled such prose). Single character class with a
+        // scheme followed by a sub-20-char value — is left verbatim (a non-anchored
+        // deletion would mangle such prose). Single character class with a
         // single `+`/`{20,}` quantifier — linear, no catastrophic backtracking.
         // eslint-disable-next-line no-restricted-syntax, security/detect-unsafe-regex -- media adapter API-error sanitization (not the Pino censor literal); the optional prefixes precede a single character class with one bounded quantifier — no nested/overlapping quantifier, so it is linear-time (safe-regex false positive)
         .replace(/\b(?:Authorization:\s*)?(?:Bearer\s+)?[A-Za-z0-9_-]{20,}/gi, "[REDACTED]")
         // Defense-in-depth: any standalone long token NOT preceded by a scheme
-        // marker (so untouched above) is still redacted — preserves the prior
-        // long-token floor and the no-opaque-leak guarantee.
+        // marker (so untouched above) is still redacted — upholds the long-token
+        // floor and the no-opaque-leak guarantee.
         // eslint-disable-next-line no-restricted-syntax -- media adapter API-error sanitization (not the Pino censor literal)
         .replace(/[A-Za-z0-9_-]{20,}/g, "[REDACTED]")
         // Collapse any residual run of internal whitespace a redaction may have

package/node_modules/@comis/core/dist/security/master-key.js

@@ -42,7 +42,7 @@ export function writeMasterKeyIfAbsent(dataDir) {
     }
     mkdirSync(dataDir, { recursive: true, mode: 0o700 });
     const keyHex = generateMasterKey();
-    // W5: create the file with mode 0o600 atomically. openSync with flag "a"
+    // Create the file with mode 0o600 atomically. openSync with flag "a"
     // only applies the mode on file CREATION (O_CREAT path) — if the file already
     // exists (append mode), the mode argument is ignored and the existing
     // permissions are preserved. This eliminates the brief window where a newly

package/node_modules/@comis/core/dist/security/oauth-helpers.d.ts

@@ -2,22 +2,20 @@
  * Consolidated OAuth helpers for OpenAI Codex.
  *
  * Combines:
- *   - JWT decode + identity resolution (verbatim move from agent/src/model/oauth-identity.ts).
- *     Verbatim port of OpenClaw's openai-codex-auth-identity.ts plus the
- *     email-redaction helper.
- *   - Error catalogue / classifier (verbatim move from agent/src/model/oauth-errors.ts).
- *     Substring matchers for `refresh_token_reused` are lifted from OpenClaw's
- *     auth-profiles/oauth.ts:117-123 (battle-tested in production for ~6 months).
+ *   - JWT decode + identity resolution (including the email-redaction helper).
+ *   - Error catalogue / classifier. The `refresh_token_reused` substring
+ *     matchers cover every error phrasing OpenAI has been observed to emit
+ *     for that condition. Derived from third-party code; see NOTICE.
  *
- * CRITICAL ORDERING (preserved from oauth-errors.ts:14-16): refresh_token_reused
- * MUST be tested BEFORE invalid_grant — refresh_token_reused is a SPECIFIC kind
- * of invalid_grant; the more-specific matcher must win.
+ * CRITICAL ORDERING: refresh_token_reused MUST be tested BEFORE
+ * invalid_grant — refresh_token_reused is a SPECIFIC kind of
+ * invalid_grant; the more-specific matcher must win.
  *
  * Field convention: `code` is the OAuth domain discriminator (consumed by
  * CLI, events, tests via switch on the 6 OAuthErrorCode values).
  * `logErrorKind` is the closed-Pino-ErrorKind mirror (always "auth"); logger
  * payloads use `errorKind: "auth"` directly OR destructure `logErrorKind`. The
- * 9-member closed ErrorKind union prevents domain values from leaking into
+ * closed ErrorKind union prevents domain values from leaking into
  * Pino log streams. Consumers carrying the discriminator into downstream
  * shapes (OAuthError.errorKind, auth:refresh_failed event payload) read
  * `rewritten.code` directly.

package/node_modules/@comis/core/dist/security/oauth-helpers.js

@@ -3,22 +3,20 @@
  * Consolidated OAuth helpers for OpenAI Codex.
  *
  * Combines:
- *   - JWT decode + identity resolution (verbatim move from agent/src/model/oauth-identity.ts).
- *     Verbatim port of OpenClaw's openai-codex-auth-identity.ts plus the
- *     email-redaction helper.
- *   - Error catalogue / classifier (verbatim move from agent/src/model/oauth-errors.ts).
- *     Substring matchers for `refresh_token_reused` are lifted from OpenClaw's
- *     auth-profiles/oauth.ts:117-123 (battle-tested in production for ~6 months).
+ *   - JWT decode + identity resolution (including the email-redaction helper).
+ *   - Error catalogue / classifier. The `refresh_token_reused` substring
+ *     matchers cover every error phrasing OpenAI has been observed to emit
+ *     for that condition. Derived from third-party code; see NOTICE.
  *
- * CRITICAL ORDERING (preserved from oauth-errors.ts:14-16): refresh_token_reused
- * MUST be tested BEFORE invalid_grant — refresh_token_reused is a SPECIFIC kind
- * of invalid_grant; the more-specific matcher must win.
+ * CRITICAL ORDERING: refresh_token_reused MUST be tested BEFORE
+ * invalid_grant — refresh_token_reused is a SPECIFIC kind of
+ * invalid_grant; the more-specific matcher must win.
  *
  * Field convention: `code` is the OAuth domain discriminator (consumed by
  * CLI, events, tests via switch on the 6 OAuthErrorCode values).
  * `logErrorKind` is the closed-Pino-ErrorKind mirror (always "auth"); logger
  * payloads use `errorKind: "auth"` directly OR destructure `logErrorKind`. The
- * 9-member closed ErrorKind union prevents domain values from leaking into
+ * closed ErrorKind union prevents domain values from leaking into
  * Pino log streams. Consumers carrying the discriminator into downstream
  * shapes (OAuthError.errorKind, auth:refresh_failed event payload) read
  * `rewritten.code` directly.
@@ -27,7 +25,7 @@
  */
 const PROFILE_CLAIM_NS = "https://api.openai.com/profile";
 // ============================================================================
-// JWT helpers (lifted verbatim from agent/src/model/oauth-identity.ts)
+// JWT helpers
 // ============================================================================
 function trimNonEmptyString(value) {
     if (typeof value !== "string")
@@ -165,7 +163,8 @@ export function rewriteOAuthError(err) {
     const message = err instanceof Error ? err.message : String(err);
     // CRITICAL ORDERING: refresh_token_reused FIRST — it is a SPECIFIC kind
     // of invalid_grant. Match the more specific pattern before the generic.
-    // Substring set verbatim from OpenClaw auth-profiles/oauth.ts:117-123.
+    // The substring set covers every phrasing OpenAI has been observed to
+    // emit for a reused refresh token — do not narrow it.
     if (/refresh_token_reused/i.test(message) ||
         /refresh token has already been used/i.test(message) ||
         /already been used to generate a new access token/i.test(message)) {

package/node_modules/@comis/core/dist/security/output-guard.js

@@ -119,7 +119,7 @@ export function createOutputGuard(opts) {
             const blocked = findings.some(f => f.severity === "critical");
             return ok({ safe, blocked, findings, sanitized });
         },
-        // ENDPOINT-03 (Phase 211): register a runtime secret (the minted lease
+        // Register a runtime secret (the minted lease
         // bearer) so the NEXT scan redacts it. scan() reads `boundKnownSecrets`
         // live each call, so pushing here is read immediately. The same
         // KNOWN_SECRET_MIN_LENGTH floor + longest-first ordering the constructor

package/node_modules/@comis/core/dist/security/patterns/content-scanner.d.ts

@@ -3,7 +3,8 @@
  *
  * Detects code execution, environment access, cryptocurrency mining,
  * network exfiltration, obfuscation, XML breakout, and workspace
- * injection patterns. Originally from content-scanner.ts.
+ * injection patterns. Consumed by the skills content scanner and the
+ * workspace loader.
  *
  * @module content-scanner
  */

package/node_modules/@comis/core/dist/security/patterns/content-scanner.js

@@ -4,7 +4,8 @@
  *
  * Detects code execution, environment access, cryptocurrency mining,
  * network exfiltration, obfuscation, XML breakout, and workspace
- * injection patterns. Originally from content-scanner.ts.
+ * injection patterns. Consumed by the skills content scanner and the
+ * workspace loader.
  *
  * @module content-scanner
  */