comisai 1.0.44 → 1.0.46

package/node_modules/@comis/daemon/dist/api/outward-ledger-wrap.js

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
-// @allow-throw: TEST-ONLY crash-injection seam (Phase 216 Plan 08, MED-6). The two
+// @allow-throw: TEST-ONLY crash-injection seam. The two
 // `throw new Error(OUTWARD_SEND_CRASH_SENTINEL)` sites (lines ~158/162) MUST be real
-// throws — they simulate a process crash in the exact invariant-#12 window (BETWEEN
+// throws — they simulate a process crash in the exact crash window (BETWEEN
 // markUnknown and commit) so the post-restart recovery faces a genuine
 // `unknown_after_send` row written by the REAL code path. A `Result.err(...)` cannot
 // model this: the function would return normally and `commit` would NOT be skipped the
@@ -9,10 +9,10 @@
 // would never reproduce. INERT in production (__crashHook is never armed). The throws
 // unwind to the chaos test's `.rejects.toThrow(OUTWARD_SEND_CRASH_SENTINEL)` assertion.
 /**
- * wrapOutwardSend — the three-state outward-send ledger wrapper (Phase 216,
- * ONCE-01/02/04). It turns an irreversible chat-platform send into an
+ * wrapOutwardSend — the three-state outward-send ledger wrapper. It turns an
+ * irreversible chat-platform send into an
  * exactly-once side effect by keying every attempt on the `(rootRunId,
- * stepIndex)` idempotency pair (HIGH-1) the RPC chokepoint allocated.
+ * stepIndex)` idempotency pair the RPC chokepoint allocated.
  *
  * It wraps the EXISTING `deliveryService.deliverToChannel` call at
  * message.send/reply/react — it is inserted AFTER `enforceOutwardQuota`, so the
@@ -24,13 +24,13 @@
  *   begin (send_attempt_started) → markUnknown (unknown_after_send) → doSend →
  *   commit(platformMessageId).
  * The crash window is BETWEEN markUnknown and commit: a crash there leaves an
- * `unknown_after_send` row the recovery scan (Plan 04) finds and reconciles —
+ * `unknown_after_send` row the recovery scan finds and reconciles —
  * never a blind replay.
  *
- * SECURITY (T-216-03): only a sha256 `contentDigest` reaches the ledger; the raw
+ * SECURITY: only a sha256 `contentDigest` reaches the ledger; the raw
  * `text` goes to `createHash` + `doSend` only — never to any ledger method.
  *
- * HIGH-1 (NEW-1/ONCE-02): a MISSING `outwardStepIndex` is a PASS-THROUGH (an
+ * A MISSING `outwardStepIndex` is a PASS-THROUGH (an
  * interactive / non-autonomy send), NOT stepIndex 0 — defaulting to 0 would make
  * two un-indexed sends collide on the idempotency key and silently drop one.
  *
@@ -56,7 +56,7 @@ export const OUTWARD_SEND_CRASH_SENTINEL = "outward-send crash hook (test-only):
  */
 export async function wrapOutwardSend(args) {
     const { ledger, rootRunId, outwardStepIndex, agentId, channelType, channelId, text, doSend, logger } = args;
-    // HIGH-1: a missing ledger / rootRunId / outwardStepIndex is a PASS-THROUGH —
+    // A missing ledger / rootRunId / outwardStepIndex is a PASS-THROUGH —
     // an interactive send, a non-autonomy daemon, or no allocated index. NEVER
     // substitute 0 for a missing index (that would make two un-indexed sends
     // collide on the idempotency key and drop one).
@@ -64,7 +64,7 @@ export async function wrapOutwardSend(args) {
         return doSend();
     }
     const stepIndex = outwardStepIndex; // defined past the guard
-    // ONCE-02 dedup read: a committed row short-circuits a replay to a no-op,
+    // Dedup read: a committed row short-circuits a replay to a no-op,
     // returning the prior platformMessageId — doSend is never reached.
     const existing = await ledger.lookup(rootRunId, stepIndex);
     if (existing.ok && existing.value?.state === "committed") {
@@ -72,9 +72,9 @@ export async function wrapOutwardSend(args) {
         return ok({ messageId: existing.value.platformMessageId ?? "delivered" });
     }
     const startedAt = systemNowMs();
-    // Content-free key (T-216-03): only the sha256 slice — never the body.
+    // Content-free key: only the sha256 slice — never the body.
     const contentDigest = createHash("sha256").update(text).digest("hex").slice(0, 16);
-    // ONCE-01: write send_attempt_started BEFORE the platform call. The UNIQUE
+    // Write send_attempt_started BEFORE the platform call. The UNIQUE
     // (rootRunId, stepIndex) constraint makes a duplicate begin an err the wrap
     // treats as "already in flight" — another attempt owns this send, so we do
     // NOT issue a second platform call (no double send).
@@ -91,7 +91,7 @@ export async function wrapOutwardSend(args) {
     // unknown_after_send — written BEFORE the platform-call window closes, so a
     // crash mid-send leaves a durable row the recovery scan reconciles.
     await ledger.markUnknown(rootRunId, stepIndex);
-    // TEST-ONLY (MED-6): crash in the exact invariant-#12 window. "before_send"
+    // TEST-ONLY: crash in the exact crash window. "before_send"
     // crashes with the platform NOT having recorded the message (truth=not_sent);
     // "after_send" runs the real platform call (truth=sent) THEN crashes before
     // commit. Either way the row is left unknown_after_send for the post-restart
@@ -109,7 +109,7 @@ export async function wrapOutwardSend(args) {
         logger.info({ rootRunId, stepIndex, durationMs: systemNowMs() - startedAt }, "Outward send committed");
         return sent;
     }
-    // ONCE-04: a permanent failure (chat not found / blocked / forbidden) is
+    // A permanent failure (chat not found / blocked / forbidden) is
     // terminal — markFailed and return, skipping the retry budget (no loop).
     if (isPermanentError(sent.error.message)) {
         await ledger.markFailed(rootRunId, stepIndex, "permanent");
@@ -121,7 +121,7 @@ export async function wrapOutwardSend(args) {
         }, "Outward send permanently failed");
         return sent;
     }
-    // A transient failure leaves the row in unknown_after_send: recovery (Plan 04)
+    // A transient failure leaves the row in unknown_after_send: recovery
     // reconciles it against the channel's reconcileSend? — NOT committed, NOT failed.
     logger.warn({
         rootRunId,

package/node_modules/@comis/daemon/dist/api/pi-image-adapter.d.ts

@@ -1,22 +1,21 @@
 /**
- * The single pi-ai image shim (I1 keystone).
+ * The single pi-ai image shim — the one `generateImages` call site.
  *
  * `createPiImageAdapter` implements `ImageGenerationPort.execute()` over EXACTLY
  * ONE `generateImages` call site. pi-ai owns dispatch, cost, retries, abort,
  * and the `ImagesOptions` plumbing; this module only:
- *   1. forwards the full `ImagesOptions` set (PI-03),
- *   2. maps a successful `AssistantImages` → `{ buffer, mimeType }` (PI-01),
- *   3. classifies any non-`"stop"` outcome to an `ImageErrorKind` (Plan-01
- *      domain union) and surfaces it as a `Result` err — never a throw.
+ *   1. forwards the full `ImagesOptions` set,
+ *   2. maps a successful `AssistantImages` → `{ buffer, mimeType }`,
+ *   3. classifies any non-`"stop"` outcome to an `ImageErrorKind` domain union
+ *      and surfaces it as a `Result` err — never a throw.
  *
- * `registerComisImageProviders()` is the once-at-boot registration hook (PI-02);
- * for Phase 183 the only image transport is the built-in `openrouter-images`
- * (auto-registered by pi-ai on import), so this is a near-noop whose forward
- * seam is where the custom `openai-codex-images` / `openai-images` /
- * `google-images` transports get registered in Phases 184/185.
+ * `registerComisImageProviders()` is the once-at-boot registration hook. The
+ * built-in `openrouter-images` transport is auto-registered by pi-ai on import;
+ * this hook registers the custom `openai-codex-images` / `openai-images` /
+ * `google-images` transports.
  *
  * Placement: `@comis/daemon` (NOT `@comis/skills`) — pi-ai is a daemon
- * dependency, not a skills one. The design's skills placement is infeasible.
+ * dependency, not a skills one.
  *
  * @module
  */
@@ -28,9 +27,9 @@ import type { ComisLogger } from "@comis/infra";
  *
  * The adapter throws this inside the `execute()` boundary (caught by
  * `fromPromise`), so the resulting `Result` err carries a structured error —
- * NOT a message-only/string-encoded one. Plan 04's `makeUnavailableImagePort`
+ * NOT a message-only/string-encoded one. `makeUnavailableImagePort`
  * + `extractImageHint` construct/read this exact shape, so the typed-class form
- * is the cross-plan contract. The `message` is user-safe (never echoes the raw
+ * is the contract they share. The `message` is user-safe (never echoes the raw
  * provider error, which could contain a key).
  */
 export declare class ImageGenError extends Error {
@@ -55,7 +54,7 @@ export declare function toImageGenOutput(res: AssistantImages, logger: ComisLogg
  * @param opts.model      - The `ImagesModel` to drive (built by the caller —
  *                          `getImageModel("openrouter", defaultModel)` for 183).
  * @param opts.apiKey     - Resolved by the caller from the SAME secret source
- *                          the main provider uses (Plan 04); forwarded via
+ *                          the main provider uses; forwarded via
  *                          `ImagesOptions.apiKey` (never interpolated).
  * @param opts.signal     - Optional abort signal (construction-time — the port's
  *                          `ImageGenInput` has no `signal`; widening it is a
@@ -72,24 +71,23 @@ export declare function createPiImageAdapter(opts: {
 }): ImageGenerationPort;
 /**
  * Map an image `ImagesApi` to the env-key name its credential lives under, then
- * read it from the SAME `SecretManager` the main provider uses (CRED-01
- * resolution half) — never the raw environment.
+ * read it from the SAME `SecretManager` the main provider uses — never the raw
+ * environment.
  *
- * For Phase 183 only the built-in `openrouter-images` path is exercised
- * (`OPENROUTER_API_KEY`). The codex transport (`openai-codex-images`) resolves
- * its bearer via `OAuthTokenManager` in Phase 184 — added to this switch then.
+ * The codex transport (`openai-codex-images`) is absent from this switch: it
+ * resolves its bearer via `OAuthTokenManager`, not a stored API key.
  */
 export declare function resolveImageApiKey(imagesApi: string, secretManager: {
     get(key: string): string | undefined;
 }): string | undefined;
 /**
  * Register Comis's custom image-api providers with pi-ai's module-level
- * registry — ONCE at daemon boot, BEFORE any `generateImages` call (PI-02).
+ * registry — ONCE at daemon boot, BEFORE any `generateImages` call.
  *
  * Idempotent and safe to call repeatedly (the registry is a Map keyed by api).
  * The built-in `openrouter-images` is auto-registered by pi-ai on import; this
- * is the single place where Comis's CUSTOM transports land. Phase 184 registers
- * the Codex Responses transport (`openai-codex-images`); Phase 185 registers the
- * two genuinely-new SDK transports (`openai-images` + `google-images`).
+ * is the single place where Comis's CUSTOM transports land: the Codex Responses
+ * transport (`openai-codex-images`) and the two SDK transports (`openai-images`
+ * + `google-images`).
  */
 export declare function registerComisImageProviders(): void;

package/node_modules/@comis/daemon/dist/api/pi-image-adapter.js

@@ -1,31 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0
-// @allow-throw: integration/SDK boundary. `toImageGenOutput` throws a classified
-// `ImageGenError` internally; every throw is caught by `fromPromise` at the
-// `execute()` boundary and converted to a `Result` err — no throw escapes the
-// port (the same boundary-throw discipline the relegated skills fal-adapter used).
-/**
- * The single pi-ai image shim (I1 keystone).
- *
- * `createPiImageAdapter` implements `ImageGenerationPort.execute()` over EXACTLY
- * ONE `generateImages` call site. pi-ai owns dispatch, cost, retries, abort,
- * and the `ImagesOptions` plumbing; this module only:
- *   1. forwards the full `ImagesOptions` set (PI-03),
- *   2. maps a successful `AssistantImages` → `{ buffer, mimeType }` (PI-01),
- *   3. classifies any non-`"stop"` outcome to an `ImageErrorKind` (Plan-01
- *      domain union) and surfaces it as a `Result` err — never a throw.
- *
- * `registerComisImageProviders()` is the once-at-boot registration hook (PI-02);
- * for Phase 183 the only image transport is the built-in `openrouter-images`
- * (auto-registered by pi-ai on import), so this is a near-noop whose forward
- * seam is where the custom `openai-codex-images` / `openai-images` /
- * `google-images` transports get registered in Phases 184/185.
- *
- * Placement: `@comis/daemon` (NOT `@comis/skills`) — pi-ai is a daemon
- * dependency, not a skills one. The design's skills placement is infeasible.
- *
- * @module
- */
-import { generateImages, getImagesApiProvider, registerImagesApiProvider, } from "@earendil-works/pi-ai";
+import { generateImages, getImagesApiProvider, registerImagesApiProvider } from "@earendil-works/pi-ai/compat";
 import { IMAGE_ERR_TO_LOG, } from "@comis/core";
 import { fromPromise } from "@comis/shared";
 import { generateImagesCodex } from "./codex-images-transport.js";
@@ -36,9 +9,9 @@ import { generateImagesGoogle } from "./google-images-transport.js";
  *
  * The adapter throws this inside the `execute()` boundary (caught by
  * `fromPromise`), so the resulting `Result` err carries a structured error —
- * NOT a message-only/string-encoded one. Plan 04's `makeUnavailableImagePort`
+ * NOT a message-only/string-encoded one. `makeUnavailableImagePort`
  * + `extractImageHint` construct/read this exact shape, so the typed-class form
- * is the cross-plan contract. The `message` is user-safe (never echoes the raw
+ * is the contract they share. The `message` is user-safe (never echoes the raw
  * provider error, which could contain a key).
  */
 export class ImageGenError extends Error {
@@ -51,10 +24,10 @@ export class ImageGenError extends Error {
         this.hint = opts.hint;
     }
 }
-/** Providers whose transport maps `input.size` to a real SDK size param (WR-04).
+/** Providers whose transport maps `input.size` to a real SDK size param.
  *  OpenAI's images.generate/edit takes `size`; google generateContent + the
  *  openrouter built-in do not, so a `size` on those paths is dropped (and the
- *  drop is WARNed). Extend as later transports gain size support (Phase 186). */
+ *  drop is WARNed). Extend as later transports gain size support. */
 const PROVIDERS_HONORING_SIZE = new Set(["openai"]);
 /** User-safe message per domain error kind (no provider internals, no secrets). */
 const SAFE_MESSAGE = {
@@ -129,11 +102,11 @@ export function toImageGenOutput(res, logger) {
     if (res.stopReason === "stop") {
         const img = res.output.find((o) => o.type === "image");
         if (img) {
-            // OBS-03 (186): carry the generation cost + executing model/provider on the
+            // Carry the generation cost + executing model/provider on the
             // output (additive ImageGenOutput fields). `usage` is optional on
             // AssistantImages, so `res.usage?.cost.total` is undefined when the provider
             // reports no usage — never a throw. The handler logs costUsd on the INFO
-            // completion line (OBS-01) and the trajectory event (OBS-04, Plan 03).
+            // completion line and the trajectory event.
             return {
                 buffer: Buffer.from(img.data, "base64"),
                 mimeType: img.mimeType,
@@ -157,7 +130,7 @@ export function toImageGenOutput(res, logger) {
  * @param opts.model      - The `ImagesModel` to drive (built by the caller —
  *                          `getImageModel("openrouter", defaultModel)` for 183).
  * @param opts.apiKey     - Resolved by the caller from the SAME secret source
- *                          the main provider uses (Plan 04); forwarded via
+ *                          the main provider uses; forwarded via
  *                          `ImagesOptions.apiKey` (never interpolated).
  * @param opts.signal     - Optional abort signal (construction-time — the port's
  *                          `ImageGenInput` has no `signal`; widening it is a
@@ -167,10 +140,10 @@ export function createPiImageAdapter(opts) {
     return {
         id: opts.model.provider,
         // Boolean per the port contract. Honest-unavailable (no creds / incapable
-        // provider) is decided by Plan 04's resolver and surfaces from execute().
+        // provider) is decided by the resolver and surfaces from execute().
         isAvailable: () => true,
         execute(input) {
-            // PI-03 passthrough — every ImagesOptions field forwarded. Typed as the
+            // Passthrough — every ImagesOptions field forwarded. Typed as the
             // SDK's ProviderImagesOptions (= ImagesOptions & Record<string,unknown>).
             const options = {
                 apiKey: opts.apiKey,
@@ -179,16 +152,16 @@ export function createPiImageAdapter(opts) {
                 timeoutMs: opts.timeoutMs,
                 maxRetries: opts.maxRetries ?? 1,
             };
-            // WR-04: thread an agent/operator-supplied `size` to the transport via the
+            // Thread an agent/operator-supplied `size` to the transport via the
             // pi-ai-sanctioned `metadata` passthrough (ImagesContext has no `size`
             // field; ImagesOptions.metadata is "providers extract what they understand
             // and ignore the rest"). The openai transport maps it to the SDK's `size`;
             // providers that CANNOT honor a pixel size (google generateContent has no
-            // size param; the openrouter built-in ignores it — the IN-04 183 deferral)
-            // would otherwise drop it SILENTLY — a confident no-op (the §2.7
-            // anti-silent-misroute class). Make the drop OBSERVABLE with a once-per-call
-            // WARN naming the requested size + provider, mirroring resolveOpenRouterModel's
-            // WARN-on-silent-substitution precedent (setup-image-provider.ts).
+            // size param; the openrouter built-in ignores it) would otherwise drop it
+            // SILENTLY — a confident no-op (the §2.7 anti-silent-misroute class). Make
+            // the drop OBSERVABLE with a once-per-call WARN naming the requested size +
+            // provider, mirroring resolveOpenRouterModel's WARN-on-silent-substitution
+            // precedent (setup-image-provider.ts).
             if (input.size) {
                 options.metadata = { ...(options.metadata ?? {}), size: input.size };
                 if (!PROVIDERS_HONORING_SIZE.has(opts.model.provider)) {
@@ -200,29 +173,28 @@ export function createPiImageAdapter(opts) {
                         step: "image_size_unsupported",
                         hint: `The ${opts.model.provider} image path does not honor an explicit size; the ` +
                             `requested "${input.size}" is ignored. Use provider:"openai" for pixel-size ` +
-                            `control, or omit size. (Per-provider size mapping is Phase 186.)`,
+                            `control, or omit size. (Per-provider size mapping varies.)`,
                     }, "Requested image size is not supported by the executing provider (ignored)");
                 }
             }
             return fromPromise((async () => {
-                // ── THE ONE generateImages call site (I1) ─────────────────────────
-                // WR-04 (185-REVIEW): `input.size` IS now forwarded — via
-                // `options.metadata.size` above (pi-ai's `ImagesContext` exposes only
-                // `input`, so `metadata` is the sanctioned passthrough). The openai
-                // transport maps it to the SDK `size`; non-honoring providers (google
-                // generateContent / openrouter built-in) WARN the drop rather than
-                // silently swallowing it. `input.safetyChecker` is still NOT mapped
-                // for the pi path (no ImagesOptions field; OpenAI/Google enforce
-                // safety server-side) — a documented feature gap, not a misroute/crash.
+                // ── THE ONE generateImages call site ──────────────────────────────
+                // `input.size` IS forwarded — via `options.metadata.size` above
+                // (pi-ai's `ImagesContext` exposes only `input`, so `metadata` is the
+                // sanctioned passthrough). The openai transport maps it to the SDK
+                // `size`; non-honoring providers (google generateContent / openrouter
+                // built-in) WARN the drop rather than silently swallowing it.
+                // `input.safetyChecker` is still NOT mapped for the pi path (no
+                // ImagesOptions field; OpenAI/Google enforce safety server-side) — a
+                // documented feature gap, not a misroute/crash.
                 //
-                // IN-01 (185): append the resolved reference image as a SECOND
-                // ImageContent element ONLY when present (edit/img2img). The
-                // openai-images transport routes it to images.edit, the
-                // google-images transport to an inlineData part. Absence keeps the
-                // array EXACTLY [{type:"text"}] — byte-identical to the text-only
-                // path so the SHARED openrouter built-in + codex transports cannot
-                // regress (Pitfall 3). `input.model` is consumed at the SELECTOR
-                // (sel.model → the model literal id, Plan 02), NOT re-read here.
+                // Append the resolved reference image as a SECOND ImageContent element
+                // ONLY when present (edit/img2img). The openai-images transport routes
+                // it to images.edit, the google-images transport to an inlineData part.
+                // Absence keeps the array EXACTLY [{type:"text"}] — byte-identical to
+                // the text-only path so the SHARED openrouter built-in + codex
+                // transports cannot regress. `input.model` is consumed at the SELECTOR
+                // (sel.model → the model literal id), NOT re-read here.
                 const inputContent = [{ type: "text", text: input.prompt }];
                 if (input.referenceImage) {
                     inputContent.push({
@@ -239,12 +211,11 @@ export function createPiImageAdapter(opts) {
 }
 /**
  * Map an image `ImagesApi` to the env-key name its credential lives under, then
- * read it from the SAME `SecretManager` the main provider uses (CRED-01
- * resolution half) — never the raw environment.
+ * read it from the SAME `SecretManager` the main provider uses — never the raw
+ * environment.
  *
- * For Phase 183 only the built-in `openrouter-images` path is exercised
- * (`OPENROUTER_API_KEY`). The codex transport (`openai-codex-images`) resolves
- * its bearer via `OAuthTokenManager` in Phase 184 — added to this switch then.
+ * The codex transport (`openai-codex-images`) is absent from this switch: it
+ * resolves its bearer via `OAuthTokenManager`, not a stored API key.
  */
 export function resolveImageApiKey(imagesApi, secretManager) {
     switch (imagesApi) {
@@ -253,35 +224,35 @@ export function resolveImageApiKey(imagesApi, secretManager) {
         case "openai-images":
             return secretManager.get("OPENAI_API_KEY");
         case "google-images":
-            // CRED-01 lockstep (185): GOOGLE_API_KEY — the SAME key the completion
-            // path (DEFAULT_PROVIDER_KEYS.google), the vision provider registry, and
-            // the env-vars docs all use for the `google` provider. (Was GEMINI_API_KEY
-            // — a speculative 183 stub that would have reported a GOOGLE_API_KEY-only
-            // agent image-unavailable.)
+            // GOOGLE_API_KEY — the SAME key the completion path
+            // (DEFAULT_PROVIDER_KEYS.google), the vision provider registry, and the
+            // env-vars docs all use for the `google` provider. Do NOT read
+            // GEMINI_API_KEY here: a GOOGLE_API_KEY-only agent would then be reported
+            // image-unavailable.
             return secretManager.get("GOOGLE_API_KEY");
-        // "openai-codex-images" → OAuthTokenManager.getApiKey("openai-codex") in Phase 184.
+        // "openai-codex-images" → OAuthTokenManager.getApiKey("openai-codex").
         default:
             return undefined;
     }
 }
 /**
  * Register Comis's custom image-api providers with pi-ai's module-level
- * registry — ONCE at daemon boot, BEFORE any `generateImages` call (PI-02).
+ * registry — ONCE at daemon boot, BEFORE any `generateImages` call.
  *
  * Idempotent and safe to call repeatedly (the registry is a Map keyed by api).
  * The built-in `openrouter-images` is auto-registered by pi-ai on import; this
- * is the single place where Comis's CUSTOM transports land. Phase 184 registers
- * the Codex Responses transport (`openai-codex-images`); Phase 185 registers the
- * two genuinely-new SDK transports (`openai-images` + `google-images`).
+ * is the single place where Comis's CUSTOM transports land: the Codex Responses
+ * transport (`openai-codex-images`) and the two SDK transports (`openai-images`
+ * + `google-images`).
  */
 export function registerComisImageProviders() {
-    // 184: the custom Codex Responses image transport (CDX-02/03). The built-in
+    // The custom Codex Responses image transport. The built-in
     // openrouter-images provider is auto-registered on pi-ai import
     // (register-builtins.ts); this adds the transports pi-ai lacks. Idempotent
     // — the registry is a Map keyed by api, so re-registration is a harmless set.
     registerImagesApiProvider({ api: "openai-codex-images", generateImages: generateImagesCodex });
-    // 185 (PRV-01/02): the two SDK transports, dispatched by model.api through the
-    // ONE generateImages call site. Registered here so the selector's
+    // The two SDK transports, dispatched by model.api through the ONE
+    // generateImages call site. Registered here so the selector's
     // createPiImageAdapter path can reach them (the built-but-not-wired guard).
     registerImagesApiProvider({ api: "openai-images", generateImages: generateImagesOpenAI });
     registerImagesApiProvider({ api: "google-images", generateImages: generateImagesGoogle });

package/node_modules/@comis/daemon/dist/api/provider-handlers.js

@@ -27,7 +27,7 @@ import { ProviderEntrySchema, ProvidersListContract, ProvidersGetContract, Provi
  * the in-handler logic, not the contract parse.
  */
 const IS_DEV = systemGetEnv("NODE_ENV") !== "production";
-import { getModels, getProviders } from "@earendil-works/pi-ai";
+import { getModels, getProviders } from "@earendil-works/pi-ai/compat";
 import { checkBuiltInProviderRedundancy } from "./shared/builtin-provider-guard.js";
 import { persistToConfig } from "./shared/persist-to-config.js";
 import { probeProviderAuth } from "./shared/probe-provider-auth.js";

package/node_modules/@comis/daemon/dist/api/rpc-dispatch.d.ts

@@ -16,23 +16,21 @@ export type { ApiDispatchDeps };
 /**
  * Classify an RPC error for structured logging.
  *
- * Accepts the raw error object (not just its message) so `instanceof`
- * checks against `PreconditionError` / `ValidationError` resolve. Returns
- * an ErrorKind, an actionable hint, AND a `level` (`"warn" | "error"`)
- * that the dispatcher uses to pick `logger.warn` vs `logger.error`. The
- * goal is to keep operator alerts meaningful: caller mistakes
- * (preconditions, validation) are warn-level via typed-class throws;
- * unmatched cases fall through to `error/internal`.
+ * Returns an ErrorKind, an actionable hint, AND a `level` (`"warn" | "error"`) that the
+ * dispatcher uses to pick `logger.warn` vs `logger.error`. The goal is to keep operator
+ * alerts meaningful: caller mistakes / policy / security refusals (`PreconditionError`,
+ * `ValidationError`, `AuthorizationError`, `RequiredToolsUnreachableError`,
+ * `SandboxDowngradeError`) are warn-level; unmatched cases fall through to `error/internal`.
  *
- * The legacy message-pattern (substring-match) fallbacks were deleted.
- * OBS-10 (reflect-obs-20260627): the admin-trust denials — every `throw new Error(
- * "Admin access required …")` across the ~26 control-plane handlers — were migrated to
- * `throw new AuthorizationError(...)`, so an operator's wrong-trust call classifies as
- * `auth`/`warn` instead of `internal`/`error` (it was reading as a fleet ERROR + tripping
- * operator alerts though the gate fired correctly). The remaining bare-Error handlers
- * ("immutable" preconditions, etc.) still classify as `internal`/`error` until migrated
- * to `PreconditionError`/`ValidationError` — that migration is incremental hardening. The
- * substring-fallback deletion is intentional; typed errors are the sanctioned path.
+ * The typed-refusal → kind/hint/level mapping lives in `@comis/core`
+ * ({@link classifyTypedRpcError}) as the SINGLE source of truth, because the SAME error is
+ * ALSO classified by the `@comis/gateway` method-router trace wrapper — which cannot
+ * `instanceof` these classes (dependency direction) and so keys off `Error.name`. Before
+ * that shared classifier the two layers drifted and the gateway kept logging intentional
+ * refusals as internal/ERROR after this layer was fixed. **Add a new typed refusal
+ * in `@comis/core`, not here.** The legacy substring-match fallbacks remain deleted;
+ * typed errors are the sanctioned path (admin-trust denials throw `AuthorizationError`;
+ * bare-Error handlers still classify internal/error until migrated to a typed class).
  */
 export declare function classifyRpcError(err: unknown): {
     errorKind: ErrorKind;