comisai 1.0.44 → 1.0.46

package/node_modules/@comis/daemon/dist/api/classify-veo-video-error.d.ts

@@ -1,7 +1,7 @@
 /**
- * Pure classifier for Google Veo video-generation failures (VEO-02).
+ * Pure classifier for Google Veo video-generation failures.
  *
- * Veo signals failure two ways (RESEARCH §Veo operation → normalized status):
+ * Veo signals failure two ways:
  *   1. a long-running `operation.error` (a `Record<string,unknown>`, NOT an
  *      Error) on a `.done` operation, or
  *   2. a thrown SDK error from `generateVideos`/`getVideosOperation` (HTTP 4xx/5xx),

package/node_modules/@comis/daemon/dist/api/codex-image-adapter.d.ts

@@ -1,15 +1,15 @@
 /**
- * Per-call-bearer Codex image adapter (CDX-01 + CDX-02 wiring).
+ * Per-call-bearer Codex image adapter.
  *
  * An `ImageGenerationPort` for the Codex (ChatGPT-login) provider that, on
  * EVERY `execute()`:
  *   1. resolves the OAuth bearer via `oauthManager.getApiKey("openai-codex",
  *      {oauthProfiles})` — PER CALL, so an expired token refreshes inside
- *      getApiKey (CDX-01). `getApiKey` self-short-circuits on a still-valid
+ *      getApiKey. `getApiKey` self-short-circuits on a still-valid
  *      token (60s buffer), so per-call is cheap in the common case.
  *   2. on a `!ok` result (any `OAuthError.code`: NO_CREDENTIALS / REFRESH_FAILED
  *      / PROFILE_NOT_FOUND / …) → throws a typed `ImageGenError(auth_required)`
- *      with a `comis auth login` hint (success-criterion 3). The image port
+ *      with a `comis auth login` hint. The image port
  *      maps ALL auth-resolution failures to `auth_required` (it never falls
  *      through to a plain key — unlike the completion path).
  *   3. builds the CF headers from THAT SAME freshly-resolved bearer's JWT
@@ -24,10 +24,10 @@
  * openrouter static-key path untouched (no regression).
  *
  * The custom `openai-codex-images` transport (`generateImagesCodex`) must be
- * registered in pi-ai's registry before this adapter runs (Plan 02's PI-02
- * seam extension); this file does not register it.
+ * registered in pi-ai's registry before this adapter runs; this file does not
+ * register it.
  *
- * SEC-03 (Pitfall 3): the bearer flows ONLY via `ImagesOptions.apiKey`, the CF
+ * Secret discipline: the bearer flows ONLY via `ImagesOptions.apiKey`, the CF
  * headers ONLY via `ImagesOptions.headers`; neither is ever logged. The only
  * log surface is `toImageGenOutput`'s WARN (`{errorKind, imageErrorKind,
  * hint}` — never the key/account-id/headers).
@@ -38,11 +38,12 @@ import { type ImagesModel } from "@earendil-works/pi-ai";
 import { type OAuthTokenManager, type ImageGenerationPort } from "@comis/core";
 import type { ComisLogger } from "@comis/infra";
 /**
- * Hand-built codex `ImagesModel` (Pitfall 5 — pi-ai's image catalog is
+ * Hand-built codex `ImagesModel` (pi-ai's image catalog is
  * openrouter-only, so `getImageModel("openai-codex", …)` has no entry). The
  * transport reads only `model.baseUrl`/`model.id`/`model.api`/`model.provider`.
- * `cost: 0` is fine for 184 — real cost mapping is Phase 186 (OBS-03). The
- * model id is overridable later by config/tool (A2); for 184 it defaults to
+ * `cost: 0` is a placeholder — no real cost mapping exists yet (the codex
+ * transport never populates `usage`, so codex image generations are recorded
+ * at $0). The model id is overridable via `opts.model`; it defaults to
  * `gpt-image-1` (the hosted tool may select the image model server-side under
  * `tool_choice:image_generation` regardless of this top-level value).
  */
@@ -55,8 +56,8 @@ export declare const CODEX_IMAGE_MODEL: ImagesModel<"openai-codex-images">;
  * @param opts.oauthProfiles - The agent's `Record<provider, profileId>` map,
  *   passed to `getApiKey` for per-agent profile preference.
  * @param opts.model         - Optional override of {@link CODEX_IMAGE_MODEL}.
- * @param opts.timeoutMs     - Optional HTTP timeout (ms). WR-02 (184-REVIEW):
- *   the custom codex transport does NOT honor `ImagesOptions.timeoutMs` (only
+ * @param opts.timeoutMs     - Optional HTTP timeout (ms).
+ *   The custom codex transport does NOT honor `ImagesOptions.timeoutMs` (only
  *   pi-ai's openrouter builtin does), so the adapter enforces it here by
  *   aborting the request's `AbortSignal` after `timeoutMs` — a hung SSE stream
  *   surfaces as `imageErrorKind:"timeout"` instead of blocking forever.
@@ -74,7 +75,7 @@ export declare function createCodexImageAdapter(opts: {
      * `hasCredentials` is cache-only — cold at boot in encrypted-store mode — so a
      * logged-in Codex profile read as unavailable. `isAvailable()` prefers this
      * flag; it falls back to the cache-only check only when it is not threaded
-     * (callers/tests). Absent ⇒ the legacy sync behavior.
+     * (callers/tests). Absent ⇒ the cache-only sync check.
      */
     credentialsAvailable?: boolean;
 }): ImageGenerationPort;

package/node_modules/@comis/daemon/dist/api/codex-image-adapter.js

@@ -1,46 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0
-// @allow-throw: integration/SDK boundary. The `execute()` async throws a
-// classified `ImageGenError` (auth failure) or lets the reused
-// `toImageGenOutput` throw one (provider failure); EVERY throw is caught by
-// `fromPromise` at the `execute()` boundary and converted to a `Result` err —
-// no throw escapes the port. Mirrors the pi-image-adapter.ts precedent.
-/**
- * Per-call-bearer Codex image adapter (CDX-01 + CDX-02 wiring).
- *
- * An `ImageGenerationPort` for the Codex (ChatGPT-login) provider that, on
- * EVERY `execute()`:
- *   1. resolves the OAuth bearer via `oauthManager.getApiKey("openai-codex",
- *      {oauthProfiles})` — PER CALL, so an expired token refreshes inside
- *      getApiKey (CDX-01). `getApiKey` self-short-circuits on a still-valid
- *      token (60s buffer), so per-call is cheap in the common case.
- *   2. on a `!ok` result (any `OAuthError.code`: NO_CREDENTIALS / REFRESH_FAILED
- *      / PROFILE_NOT_FOUND / …) → throws a typed `ImageGenError(auth_required)`
- *      with a `comis auth login` hint (success-criterion 3). The image port
- *      maps ALL auth-resolution failures to `auth_required` (it never falls
- *      through to a plain key — unlike the completion path).
- *   3. builds the CF headers from THAT SAME freshly-resolved bearer's JWT
- *      (`buildCodexImageHeaders` — one JWT → its own account-id, so the
- *      identity cannot diverge from the credential), and
- *   4. drives the ONE `generateImages()` call site, mapping the result via the
- *      reused `toImageGenOutput` (base64→buffer + classify + WARN).
- *
- * Why a separate adapter (not `createPiImageAdapter`): the shipped pi adapter
- * resolves `apiKey` at construction — correct for openrouter's static
- * SecretManager key, WRONG for an expiring OAuth bearer. This keeps the
- * openrouter static-key path untouched (no regression).
- *
- * The custom `openai-codex-images` transport (`generateImagesCodex`) must be
- * registered in pi-ai's registry before this adapter runs (Plan 02's PI-02
- * seam extension); this file does not register it.
- *
- * SEC-03 (Pitfall 3): the bearer flows ONLY via `ImagesOptions.apiKey`, the CF
- * headers ONLY via `ImagesOptions.headers`; neither is ever logged. The only
- * log surface is `toImageGenOutput`'s WARN (`{errorKind, imageErrorKind,
- * hint}` — never the key/account-id/headers).
- *
- * @module
- */
-import { generateImages } from "@earendil-works/pi-ai";
+import { generateImages } from "@earendil-works/pi-ai/compat";
 import { systemSetTimeout, systemClearTimeout, } from "@comis/core";
 import { fromPromise } from "@comis/shared";
 import { ImageGenError, toImageGenOutput } from "./pi-image-adapter.js";
@@ -48,11 +6,12 @@ import { buildCodexImageHeaders } from "./codex-images-transport.js";
 /** The Codex OAuth provider id (distinct from "openai"). */
 const CODEX_PROVIDER_ID = "openai-codex";
 /**
- * Hand-built codex `ImagesModel` (Pitfall 5 — pi-ai's image catalog is
+ * Hand-built codex `ImagesModel` (pi-ai's image catalog is
  * openrouter-only, so `getImageModel("openai-codex", …)` has no entry). The
  * transport reads only `model.baseUrl`/`model.id`/`model.api`/`model.provider`.
- * `cost: 0` is fine for 184 — real cost mapping is Phase 186 (OBS-03). The
- * model id is overridable later by config/tool (A2); for 184 it defaults to
+ * `cost: 0` is a placeholder — no real cost mapping exists yet (the codex
+ * transport never populates `usage`, so codex image generations are recorded
+ * at $0). The model id is overridable via `opts.model`; it defaults to
  * `gpt-image-1` (the hosted tool may select the image model server-side under
  * `tool_choice:image_generation` regardless of this top-level value).
  */
@@ -74,8 +33,8 @@ export const CODEX_IMAGE_MODEL = {
  * @param opts.oauthProfiles - The agent's `Record<provider, profileId>` map,
  *   passed to `getApiKey` for per-agent profile preference.
  * @param opts.model         - Optional override of {@link CODEX_IMAGE_MODEL}.
- * @param opts.timeoutMs     - Optional HTTP timeout (ms). WR-02 (184-REVIEW):
- *   the custom codex transport does NOT honor `ImagesOptions.timeoutMs` (only
+ * @param opts.timeoutMs     - Optional HTTP timeout (ms).
+ *   The custom codex transport does NOT honor `ImagesOptions.timeoutMs` (only
  *   pi-ai's openrouter builtin does), so the adapter enforces it here by
  *   aborting the request's `AbortSignal` after `timeoutMs` — a hung SSE stream
  *   surfaces as `imageErrorKind:"timeout"` instead of blocking forever.
@@ -84,7 +43,7 @@ export const CODEX_IMAGE_MODEL = {
 export function createCodexImageAdapter(opts) {
     return {
         id: CODEX_PROVIDER_ID,
-        // CRED-01: codex credential availability is the OAuth credential, NOT the
+        // Codex credential availability is the OAuth credential, NOT the
         // SecretManager (the bearer is OAuth, not an env key). Prefer the boot-
         // resolved STORE-AWARE snapshot (the selector's codexCredentialsAvailable);
         // fall back to the sync cache-only check only when it was not threaded — the
@@ -93,7 +52,7 @@ export function createCodexImageAdapter(opts) {
         isAvailable: () => opts.credentialsAvailable ?? opts.oauthManager.hasCredentials(CODEX_PROVIDER_ID),
         execute(input) {
             return fromPromise((async () => {
-                // CDX-01: resolve the bearer PER CALL — refresh fires inside getApiKey
+                // Resolve the bearer PER CALL — refresh fires inside getApiKey
                 // on expiry; self-short-circuits when the cached token is still valid.
                 const tok = await opts.oauthManager.getApiKey(CODEX_PROVIDER_ID, {
                     oauthProfiles: opts.oauthProfiles,
@@ -108,7 +67,7 @@ export function createCodexImageAdapter(opts) {
                     });
                 }
                 const bearer = tok.value;
-                // WR-02 (184-REVIEW): the custom codex transport never reads
+                // The custom codex transport never reads
                 // `options.timeoutMs` (it is only honored by pi-ai's openrouter
                 // builtin), so a hung SSE stream would block `reader.read()` — and
                 // this image RPC + a rate-limiter slot — forever. Enforce the timeout
@@ -120,10 +79,10 @@ export function createCodexImageAdapter(opts) {
                     ? systemSetTimeout(() => ac.abort(), opts.timeoutMs)
                     : undefined;
                 try {
-                    // CDX-02: headers from the SAME freshly-resolved JWT (one JWT → its
-                    // own account-id; cannot diverge — T-184-05). The bearer rides
-                    // options.apiKey; the headers ride options.headers. Neither is
-                    // logged. WR-03 (184-REVIEW): no `maxRetries` — the custom codex
+                    // Headers from the SAME freshly-resolved JWT (one JWT → its
+                    // own account-id; the identity cannot diverge from the credential).
+                    // The bearer rides options.apiKey; the headers ride options.headers.
+                    // Neither is logged. No `maxRetries` — the custom codex
                     // transport is single-shot (it has no retry loop and never reads
                     // `options.maxRetries`), so the option would be a lie.
                     const options = {
@@ -131,7 +90,7 @@ export function createCodexImageAdapter(opts) {
                         headers: buildCodexImageHeaders(bearer),
                         signal: ac.signal,
                     };
-                    // ── THE ONE generateImages call site (I1) ───────────────────────
+                    // ── THE ONE generateImages call site ────────────────────────────
                     const res = await generateImages(opts.model ?? CODEX_IMAGE_MODEL, { input: [{ type: "text", text: input.prompt }] }, options);
                     if (res.stopReason !== "stop") {
                         // OBS (troubleshooting-feedback-loop): the transport captures the
@@ -141,7 +100,7 @@ export function createCodexImageAdapter(opts) {
                         // the actual Codex rejection was INVISIBLE in the logs (the
                         // "returned no image twice" incident: the agent only ever saw
                         // "non-image response", never the status). Surface it at WARN so it
-                        // is diagnosable at the default level. SEC-03: res.errorMessage is
+                        // is diagnosable at the default level. res.errorMessage is
                         // the status/cause only — never the bearer/account-id/headers
                         // (those ride options.apiKey/options.headers, never the response).
                         opts.logger.warn({ step: "codex_image_failed", stopReason: res.stopReason, cause: res.errorMessage }, "Codex image generation returned no image; surfacing the transport cause");

package/node_modules/@comis/daemon/dist/api/codex-images-transport.d.ts

@@ -1,16 +1,16 @@
 /**
- * Custom Codex Responses image transport (CDX-02 + CDX-03).
+ * Custom Codex Responses image transport.
  *
  * pi-ai's IMAGES registry ships only the built-in `openrouter-images`
  * transport, so the Codex (ChatGPT-login) IMAGE path is custom: it POSTs the
  * Responses-API hosted `image_generation` tool to the ChatGPT-backend Codex
  * endpoint (`https://chatgpt.com/backend-api/codex/responses`), sends the
  * first-party Cloudflare request identity, and parses the image SSE to base64.
- * It is registered into pi-ai's module-level registry (PI-02 seam, Plan 02)
+ * It is registered into pi-ai's module-level registry
  * under the `openai-codex-images` api and dispatched through the ONE
  * `generateImages()` call site.
  *
- * In-repo analog (WR-01 / IN-02, 184-REVIEW): pi-ai ALSO ships a Codex
+ * In-repo analog: pi-ai ALSO ships a Codex
  * *Responses* TEXT transport — `@earendil-works/pi-ai/.../openai-codex-responses.js`
  * (`buildBaseCodexHeaders`/`buildSSEHeaders`/`extractAccountId`) — against the
  * SAME endpoint. It is not an image transport (it parses message SSE, not
@@ -19,47 +19,47 @@
  * against it (see `buildCodexImageHeaders`).
  *
  * Design boundaries:
- *   - `generateImagesCodex` is an `ImagesApiFunction` (pi-ai contract). It
+ *   - `generateImagesCodex` is an `ImagesFunction` (pi-ai contract). It
  *     reads the bearer from `options.apiKey` and the CF headers from
- *     `options.headers` (both supplied by the per-call adapter — Plan 02).
+ *     `options.headers` (both supplied by the per-call adapter).
  *   - It NEVER throws out of the transport: any miss (no bearer, non-2xx, empty
  *     SSE, malformed body, thrown fetch) returns `stopReason:"error"` (or
  *     `"aborted"`) with an `errorMessage` the SHIPPED `classifyImageError`
  *     (`pi-image-adapter.ts`) maps (`401|403|auth` → `auth_required`,
- *     content/quota → `content_blocked`/`quota_exceeded` via WR-04, else
+ *     content/quota → `content_blocked`/`quota_exceeded`, else
  *     → `empty_response`). So this file needs NO `@allow-throw`.
- *   - SEC-03 (Pitfall 3): NEVER log the `headers` object, the bearer, or the
+ *   - Secret-logging discipline: NEVER log the `headers` object, the bearer, or the
  *     `ChatGPT-Account-ID` (the account-id is NOT in the redaction set). If a
  *     logger is threaded for diagnostics, log only `{ step, errorKind }`.
  *
- * The header VALUES are an authorized compatibility shim (CONTEXT
- * §security-framing): they reproduce the OFFICIAL `openai/codex` (codex-rs)
+ * The header VALUES are an authorized compatibility shim, not detection
+ * evasion: they reproduce the OFFICIAL `openai/codex` (codex-rs)
  * first-party CLI's wire identity using the operator's OWN ChatGPT/Codex OAuth
  * credentials against the SAME endpoint that client uses — NOT detection
  * evasion. `originator: "codex_cli_rs"` is the official codex-rs originator
  * (pi-mono #1828 documents that pi-ai's `originator:"pi"` is Cloudflare-403'd;
  * Comis's own login-flow `ORIGINATOR="comis"` is a different concern).
  *
- * LIVE-UNVERIFIED (Assumption A1, 184-RESEARCH): the EXACT header set + values
+ * LIVE-UNVERIFIED: the EXACT header set + values
  * for the codex-backend IMAGE round-trip can only be confirmed by an operator
  * UAT with a real ChatGPT login — the fetch-boundary mocks here cannot prove
  * Cloudflare accepts them. The values match the SDK's proven codex TEXT path
  * (`buildSSEHeaders`) and #1828's originator, but if a live UAT 403s, the
- * documented escape hatch is `provider:"openrouter"` (design Risk).
+ * documented escape hatch is `provider:"openrouter"`.
  *
  * @module
  */
-import { type ImagesApiFunction } from "@earendil-works/pi-ai";
+import { type ImagesFunction } from "@earendil-works/pi-ai";
 /**
  * Cosmetic version string in the codex `User-Agent`. pi-mono #1828 indicates
  * Cloudflare gates on the `codex_cli_rs` originator/prefix; the exact UA
- * version is BELIEVED cosmetic (Assumption A3, 184-RESEARCH — live-unverified),
+ * version is BELIEVED cosmetic (live-unverified),
  * so this is a stable constant. Bump only if a future gate tightens on the UA
  * version.
  */
 export declare const CODEX_UA_VERSION = "0.0.1";
 /**
- * IN-01 (184-REVIEW): cap the SSE line buffer so a hostile/huge no-newline
+ * Cap the SSE line buffer so a hostile/huge no-newline
  * stream cannot grow memory without bound. A complete `response.completed`
  * event can legitimately carry a multi-MB base64 image inline, so the ceiling
  * is generous (32 MiB); past it the parser bails to `empty_response` (honest
@@ -69,15 +69,15 @@ export declare const CODEX_UA_VERSION = "0.0.1";
 export declare const CODEX_SSE_MAX_BUFFER_BYTES: number;
 /**
  * Build the first-party Codex Cloudflare/request headers from the freshly-
- * resolved access-token JWT (CDX-02), reconciled against the SDK's proven codex
- * Responses path (`openai-codex-responses.js` `buildSSEHeaders`) — WR-01.
+ * resolved access-token JWT, reconciled against the SDK's proven codex
+ * Responses path (`openai-codex-responses.js` `buildSSEHeaders`).
  *
  * The account-id is decoded from the SAME bearer used for the request (one JWT
  * → its own `chatgpt_account_id`, so the identity can never diverge from the
- * credential — T-184-05). The `Authorization: Bearer <token>` header is set by
+ * credential). The `Authorization: Bearer <token>` header is set by
  * the transport from `options.apiKey`; it is deliberately NOT set here.
  *
- * Header values (LIVE-UNVERIFIED — Assumption A1, see the module docstring):
+ * Header values (LIVE-UNVERIFIED — see the module docstring):
  *   - `originator: "codex_cli_rs"` — the OFFICIAL `openai/codex` (codex-rs)
  *     originator (pi-mono #1828: the SDK's `originator:"pi"` is Cloudflare-
  *     403'd). NOT "comis" (that is Comis's OAuth login-flow originator).
@@ -88,8 +88,8 @@ export declare const CODEX_SSE_MAX_BUFFER_BYTES: number;
  *     SDK uses lowercase `chatgpt-account-id` to the same effect. Omitted (not
  *     empty) when the JWT carries no account claim.
  *   - `session-id` + `x-client-request-id` — the SDK's `buildSSEHeaders` sends
- *     BOTH (equal) as part of the first-party SSE request identity; this
- *     transport previously sent NEITHER (WR-01). One fresh UUID per request
+ *     BOTH (equal) as part of the first-party SSE request identity, so this
+ *     transport must too. One fresh UUID per request
  *     (mirrors the SDK's `createCodexRequestId()` → both headers).
  *
  * @param bearer - The Codex OAuth access token (a JWT). Never logged.
@@ -97,18 +97,18 @@ export declare const CODEX_SSE_MAX_BUFFER_BYTES: number;
  */
 export declare function buildCodexImageHeaders(bearer: string): Record<string, string>;
 /**
- * The custom `openai-codex-images` transport (CDX-03).
+ * The custom `openai-codex-images` transport.
  *
- * Registered into pi-ai's registry (Plan 02) and dispatched through the single
+ * Registered into pi-ai's registry and dispatched through the single
  * `generateImages()` call site. Reads the bearer from `options.apiKey` and the
  * CF headers from `options.headers`; NEVER throws out (every failure → an
  * `AssistantImages` with `stopReason:"error"`/`"aborted"` the shipped
  * classifier maps).
  *
- * NOTE: pi-ai's `ImagesApiFunction` contract is `(model, context, options)` —
+ * NOTE: pi-ai's `ImagesFunction` contract is `(model, context, options)` —
  * `generateImages()` NEVER passes a 4th arg, so a `logger` param here would be
  * permanently `undefined` (dead). The redacted failure CAUSE is logged by the
  * ADAPTER (`codex-image-adapter.ts`, which holds the real logger and WARNs
  * `res.errorMessage` on a non-image result) — never from this transport.
  */
-export declare const generateImagesCodex: ImagesApiFunction;
+export declare const generateImagesCodex: ImagesFunction;

package/node_modules/@comis/daemon/dist/api/codex-images-transport.js

@@ -4,7 +4,7 @@ import { randomUUID } from "node:crypto";
 /**
  * Cosmetic version string in the codex `User-Agent`. pi-mono #1828 indicates
  * Cloudflare gates on the `codex_cli_rs` originator/prefix; the exact UA
- * version is BELIEVED cosmetic (Assumption A3, 184-RESEARCH — live-unverified),
+ * version is BELIEVED cosmetic (live-unverified),
  * so this is a stable constant. Bump only if a future gate tightens on the UA
  * version.
  */
@@ -12,7 +12,7 @@ export const CODEX_UA_VERSION = "0.0.1";
 /** The Codex Responses claim path carrying the ChatGPT account id. */
 const CODEX_AUTH_CLAIM = "https://api.openai.com/auth";
 /**
- * IN-01 (184-REVIEW): cap the SSE line buffer so a hostile/huge no-newline
+ * Cap the SSE line buffer so a hostile/huge no-newline
  * stream cannot grow memory without bound. A complete `response.completed`
  * event can legitimately carry a multi-MB base64 image inline, so the ceiling
  * is generous (32 MiB); past it the parser bails to `empty_response` (honest
@@ -22,15 +22,15 @@ const CODEX_AUTH_CLAIM = "https://api.openai.com/auth";
 export const CODEX_SSE_MAX_BUFFER_BYTES = 32 * 1024 * 1024;
 /**
  * Build the first-party Codex Cloudflare/request headers from the freshly-
- * resolved access-token JWT (CDX-02), reconciled against the SDK's proven codex
- * Responses path (`openai-codex-responses.js` `buildSSEHeaders`) — WR-01.
+ * resolved access-token JWT, reconciled against the SDK's proven codex
+ * Responses path (`openai-codex-responses.js` `buildSSEHeaders`).
  *
  * The account-id is decoded from the SAME bearer used for the request (one JWT
  * → its own `chatgpt_account_id`, so the identity can never diverge from the
- * credential — T-184-05). The `Authorization: Bearer <token>` header is set by
+ * credential). The `Authorization: Bearer <token>` header is set by
  * the transport from `options.apiKey`; it is deliberately NOT set here.
  *
- * Header values (LIVE-UNVERIFIED — Assumption A1, see the module docstring):
+ * Header values (LIVE-UNVERIFIED — see the module docstring):
  *   - `originator: "codex_cli_rs"` — the OFFICIAL `openai/codex` (codex-rs)
  *     originator (pi-mono #1828: the SDK's `originator:"pi"` is Cloudflare-
  *     403'd). NOT "comis" (that is Comis's OAuth login-flow originator).
@@ -41,8 +41,8 @@ export const CODEX_SSE_MAX_BUFFER_BYTES = 32 * 1024 * 1024;
  *     SDK uses lowercase `chatgpt-account-id` to the same effect. Omitted (not
  *     empty) when the JWT carries no account claim.
  *   - `session-id` + `x-client-request-id` — the SDK's `buildSSEHeaders` sends
- *     BOTH (equal) as part of the first-party SSE request identity; this
- *     transport previously sent NEITHER (WR-01). One fresh UUID per request
+ *     BOTH (equal) as part of the first-party SSE request identity, so this
+ *     transport must too. One fresh UUID per request
  *     (mirrors the SDK's `createCodexRequestId()` → both headers).
  *
  * @param bearer - The Codex OAuth access token (a JWT). Never logged.
@@ -68,7 +68,7 @@ function extractPrompt(input) {
     const textItem = input.find((c) => c.type === "text");
     return textItem?.text ?? "";
 }
-/** Build the Responses `image_generation` request body (CDX-03). */
+/** Build the Responses `image_generation` request body. */
 function buildRequestBody(modelId, prompt) {
     // The body MIRRORS pi-ai's proven codex TEXT body (openai-codex-responses.js
     // buildRequestBody) for the fields the ChatGPT backend REQUIRES, plus the
@@ -96,7 +96,7 @@ async function parseCodexImageSse(body, signal) {
     // (out-of-order) does not clobber a better one.
     let bestPartialIndex = -1;
     let bestPartial;
-    // WR-04: capture the terminal failure cause so the caller can classify it.
+    // Capture the terminal failure cause so the caller can classify it.
     let failedMessage;
     const consumeEvent = (raw) => {
         const data = raw.startsWith("data:") ? raw.slice("data:".length).trim() : raw.trim();
@@ -140,7 +140,7 @@ async function parseCodexImageSse(body, signal) {
             return;
         }
         if (type === "response.failed") {
-            // WR-04: the Codex Responses API emits the real cause (quota / content
+            // The Codex Responses API emits the real cause (quota / content
             // policy / auth / server error) in response.error.message. Capture it so
             // the caller surfaces it to classifyImageError (quota_exceeded /
             // content_blocked / auth_required) instead of the generic empty_response.
@@ -151,7 +151,7 @@ async function parseCodexImageSse(body, signal) {
                 failedMessage = message;
         }
     };
-    // IN-01: set when the un-drained buffer exceeds the cap — bail to a miss
+    // Set when the un-drained buffer exceeds the cap — bail to a miss
     // (empty_response) rather than grow without bound on a no-newline stream.
     let oversized = false;
     try {
@@ -170,7 +170,7 @@ async function parseCodexImageSse(body, signal) {
                     consumeEvent(line);
                 lineEnd = buffer.indexOf("\n");
             }
-            // IN-01: after draining every complete line, the residue is one
+            // After draining every complete line, the residue is one
             // unterminated line. If it alone exceeds the cap, the stream is sending
             // an unbounded no-newline body — stop reading and degrade honestly.
             if (buffer.length > CODEX_SSE_MAX_BUFFER_BYTES) {
@@ -189,15 +189,15 @@ async function parseCodexImageSse(body, signal) {
     return { b64: completed ?? bestPartial, failedMessage };
 }
 /**
- * The custom `openai-codex-images` transport (CDX-03).
+ * The custom `openai-codex-images` transport.
  *
- * Registered into pi-ai's registry (Plan 02) and dispatched through the single
+ * Registered into pi-ai's registry and dispatched through the single
  * `generateImages()` call site. Reads the bearer from `options.apiKey` and the
  * CF headers from `options.headers`; NEVER throws out (every failure → an
  * `AssistantImages` with `stopReason:"error"`/`"aborted"` the shipped
  * classifier maps).
  *
- * NOTE: pi-ai's `ImagesApiFunction` contract is `(model, context, options)` —
+ * NOTE: pi-ai's `ImagesFunction` contract is `(model, context, options)` —
  * `generateImages()` NEVER passes a 4th arg, so a `logger` param here would be
  * permanently `undefined` (dead). The redacted failure CAUSE is logged by the
  * ADAPTER (`codex-image-adapter.ts`, which holds the real logger and WARNs
@@ -243,7 +243,7 @@ export const generateImagesCodex = async (model, context, options) => {
             // OBS: read the error body (truncated) so the REAL 4xx reason (e.g. an
             // invalid model or unsupported tool) reaches the caller — it was just
             // "codex <status>" with no reason, which the classifier collapsed into a
-            // generic "non-image response" (the HTTP-400 incident, where the cause —
+            // generic "non-image response" (a live HTTP 400 incident, where the cause —
             // the gpt-image-1 model id — was invisible). The body is the API error
             // description (no secret: the bearer/CF headers are request-side, never
             // echoed). Best-effort; a body read that throws degrades to the bare status.
@@ -260,7 +260,7 @@ export const generateImagesCodex = async (model, context, options) => {
         const { b64, failedMessage } = await parseCodexImageSse(resp.body, options?.signal);
         if (!b64) {
             out.stopReason = "error";
-            // WR-04: prefer the terminal response.failed cause (quota / content /
+            // Prefer the terminal response.failed cause (quota / content /
             // auth) so the shipped classifier maps the RIGHT kind; only a genuinely
             // empty/unparseable stream falls back to empty_response. The cause is
             // surfaced via errorMessage for classification (+ the adapter's WARN),

package/node_modules/@comis/daemon/dist/api/config-handlers/config-export.d.ts

@@ -9,7 +9,7 @@
  *
  * Rate limiter: shares the SAME `patchBucket` instance as `config.patch`
  * (constructed in `index.ts`) so the 5-ops-per-60s budget covers patch +
- * apply combined (matches the pre-split merged limit).
+ * apply combined (one shared budget, not one per method).
  *
  * @module
  */

package/node_modules/@comis/daemon/dist/api/config-handlers/config-export.js

@@ -11,7 +11,7 @@
  *
  * Rate limiter: shares the SAME `patchBucket` instance as `config.patch`
  * (constructed in `index.ts`) so the 5-ops-per-60s budget covers patch +
- * apply combined (matches the pre-split merged limit).
+ * apply combined (one shared budget, not one per method).
  *
  * @module
  */
@@ -204,7 +204,7 @@ export function bindConfigExportHandlers(deps, patchBucket) {
             if (!deps.configGitManager) {
                 throw new Error("Config versioning not available");
             }
-            // Bespoke pre-Zod check FIRST: matches the legacy error UX
+            // Bespoke pre-Zod check FIRST: preserves the user-facing error message
             // ("sha parameter is required for config rollback"). The contract's
             // `z.string().min(1)` enforces the same condition but with a
             // Zod-style message.
@@ -218,7 +218,7 @@ export function bindConfigExportHandlers(deps, patchBucket) {
             if (!rollbackResult.ok) {
                 throw new Error(`Config rollback failed: ${rollbackResult.error}`);
             }
-            // Trigger daemon restart (same pattern as gateway.restart) per user decision.
+            // Trigger daemon restart (same pattern as gateway.restart).
             // `.unref()` so the timer doesn't keep the event loop alive on its own
             // (production gateway/ws server keeps it alive so the timer still fires;
             // tests can exit cleanly).

package/node_modules/@comis/daemon/dist/api/config-handlers/config-helpers.d.ts

@@ -28,14 +28,13 @@ export type { ConfigHandlerDeps };
  */
 export declare const IS_DEV: boolean;
 /**
- * Content-free change-indicator for the config.patch audit:event metadata
- * (AUDIT-04 / H1).
+ * Content-free change-indicator for the config.patch audit:event metadata.
  *
  * The raw config `value` MUST NOT land in the durable security-audit: a
  * no-prefix secret value (a 32-hex key, a DB password, an internal hostname) is
  * invisible to the credential-keyed-field drop AND to the prefixed/keyworded
  * pattern redactor, so it would persist UNREDACTED in the obs_audit_events row +
- * security-audit.jsonl (the H1 review leak). The value already lives in the 0600
+ * security-audit.jsonl. The value already lives in the 0600
  * config YAML + git + the config-audit log — the audit only needs a
  * change-indicator, never the value. Emit a non-reversible `valueSha256` (first
  * 12 hex of the SHA-256 of the JSON-stringified value) + `valueLength`.

package/node_modules/@comis/daemon/dist/api/config-handlers/config-helpers.js

@@ -29,14 +29,13 @@ import { resolveProviderCredential } from "../shared/credential-resolver.js";
  */
 export const IS_DEV = systemGetEnv("NODE_ENV") !== "production";
 /**
- * Content-free change-indicator for the config.patch audit:event metadata
- * (AUDIT-04 / H1).
+ * Content-free change-indicator for the config.patch audit:event metadata.
  *
  * The raw config `value` MUST NOT land in the durable security-audit: a
  * no-prefix secret value (a 32-hex key, a DB password, an internal hostname) is
  * invisible to the credential-keyed-field drop AND to the prefixed/keyworded
  * pattern redactor, so it would persist UNREDACTED in the obs_audit_events row +
- * security-audit.jsonl (the H1 review leak). The value already lives in the 0600
+ * security-audit.jsonl. The value already lives in the 0600
  * config YAML + git + the config-audit log — the audit only needs a
  * change-indicator, never the value. Emit a non-reversible `valueSha256` (first
  * 12 hex of the SHA-256 of the JSON-stringified value) + `valueLength`.

package/node_modules/@comis/daemon/dist/api/config-handlers/config-write.d.ts

@@ -12,8 +12,8 @@
  *
  * Rate limiter: the `patchBucket` is constructed in `index.ts` (the composition
  * root) and passed to both `config-write` and `config-export` bundles so the
- * 5-patches-per-60s budget covers patch + apply combined (the merged limit
- * pre-split).
+ * 5-patches-per-60s budget covers patch + apply combined (one shared budget,
+ * not one per method).
  *
  * @module
  */

package/node_modules/@comis/daemon/dist/api/config-handlers/config-write.js

@@ -14,8 +14,8 @@
  *
  * Rate limiter: the `patchBucket` is constructed in `index.ts` (the composition
  * root) and passed to both `config-write` and `config-export` bundles so the
- * 5-patches-per-60s budget covers patch + apply combined (the merged limit
- * pre-split).
+ * 5-patches-per-60s budget covers patch + apply combined (one shared budget,
+ * not one per method).
  *
  * @module
  */
@@ -72,9 +72,9 @@ export function bindConfigWriteHandlers(deps, patchBucket) {
             }
             const startMs = systemNowMs();
             // Bespoke pre-Zod: require `section` BEFORE contract parse so the
-            // error message is more actionable than Zod's. Legacy `path: "a.b.c"`
-            // shape was removed; callers must send the canonical
-            // {section, key, value} shape.
+            // error message is more actionable than Zod's. A dot-notation
+            // `path: "a.b.c"` shape is not accepted; callers must send the
+            // canonical {section, key, value} shape.
             const section = rawParams.section;
             if (!section) {
                 throw new Error('Missing required parameter "section" for config.patch');
@@ -93,18 +93,18 @@ export function bindConfigWriteHandlers(deps, patchBucket) {
             // patch still surfaces in the JSONL log. When
             // deps.auditEnabled === false, skip the build —
             // appendConfigAuditWithOutcome no-ops on base === undefined, so the
-            // gate covers both halves of the two-phase pattern. Default-true
-            // semantics preserve prior behavior.
+            // gate covers both halves of the two-phase pattern. An unset
+            // auditEnabled defaults to true (audit on).
             const localPathForAudit = deps.configPaths.length > 0
                 ? deps.configPaths[deps.configPaths.length - 1]
                 : deps.defaultConfigPaths[deps.defaultConfigPaths.length - 1];
             const auditBase = deps.auditEnabled === false ? undefined : buildConfigAuditBase(localPathForAudit);
             let wroteFile = false;
             let writeError;
-            // Track the validator's rejection message so the `finally` block
-            // can thread it into the audit outcome. Previously the message was
-            // scoped to the `catch` block and the `rejected` audit record
-            // carried no reason.
+            // Track the validator's rejection message at this scope so the
+            // `finally` block can thread it into the audit outcome — a message
+            // scoped to the `catch` block would leave the `rejected` audit
+            // record with no reason.
             let rejectionMessage;
             try {
                 // Check immutable paths.
@@ -242,7 +242,7 @@ export function bindConfigWriteHandlers(deps, patchBucket) {
                     });
                 }
                 const durationMs = systemNowMs() - startMs;
-                // AUDIT-04 / H1: a content-free indicator (sha256 prefix + length), NEVER the raw `value`.
+                // A content-free indicator (sha256 prefix + length), NEVER the raw `value`.
                 deps.container.eventBus.emit("audit:event", {
                     timestamp: systemNowMs(),
                     agentId: ctx?.agentId ?? rawParams._agentId ?? "system",
@@ -292,7 +292,7 @@ export function bindConfigWriteHandlers(deps, patchBucket) {
                 // Surface the rejection reason to the `finally` block so
                 // the audit outcome carries it.
                 rejectionMessage = errMsg;
-                // AUDIT-04 / H1: same content-free indicator — a rejected patch's value is just as secret-bearing.
+                // Same content-free indicator — a rejected patch's value is just as secret-bearing.
                 deps.container.eventBus.emit("audit:event", {
                     timestamp: systemNowMs(),
                     agentId: ctx?.agentId ?? rawParams._agentId ?? "system",