comisai 1.0.44 → 1.0.46

package/node_modules/@comis/daemon/dist/wiring/video-delivery-limits.js

@@ -1,9 +1,9 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * DEL-03 (Phase 192 / Plan 03) — the per-channelType video-size limit table +
- * the override-aware resolver + the link-vs-notice support map.
+ * The per-channelType video-size limit table + the override-aware resolver + the
+ * link-vs-notice support map.
  *
- * THE DEL-03 RECONCILIATION (RESEARCH Open Q3). The design forbids BOTH:
+ * THE RECONCILIATION. The design forbids BOTH:
  *   (a) one hardcoded global per-platform byte cap, AND
  *   (b) an invented per-platform byte table baked across the 9 adapter files.
  * The reconciliation is a SINGLE per-channelType table here, where each entry is
@@ -16,9 +16,9 @@
  *
  * THIS IS NOT THE SILENT-DROP PATH. `packages/channels/src/shared/media-compressor.ts`
  * `compressAttachments` REMOVES an oversized attachment and appends an
- * `[Attachment too large]` placeholder — the v2.23 anti-pattern DEL-03 exists to
- * replace (PATTERNS §5b / Pitfall 5). The delivery site consults THIS table and
- * sends a link/notice instead; an oversized clip is NEVER silently dropped.
+ * `[Attachment too large]` placeholder — the anti-pattern this table exists to
+ * replace. The delivery site consults THIS table and sends a link/notice instead;
+ * an oversized clip is NEVER silently dropped.
  *
  * @module
  */
@@ -34,7 +34,7 @@ const MB = 1024 * 1024;
 export const DEFAULT_VIDEO_SIZE_LIMIT = 25 * MB;
 /**
  * Per-channelType documented bot/upload limit, in bytes. Each entry cites the
- * platform's real limit (DEL-03: per-adapter, not an invented global). These are
+ * platform's real limit (per-adapter, not an invented global). These are
  * the HONEST defaults; an operator overrides any of them via the media-compressor
  * `maxVideoBytes` config (passed as the `override` arg to `resolveVideoSizeLimit`).
  *
@@ -52,7 +52,7 @@ export const DEFAULT_VIDEO_SIZE_LIMIT = 25 * MB;
  *   - email     : common provider attachment cap ≈ 25 MB (Gmail).
  *   - echo      : the in-tree test/echo adapter — generous (no real platform cap).
  * IRC is intentionally ABSENT: it has no attachment surface (no `sendAttachment`),
- * so it degrades via the DEL-02 capability gate (a notice), never a size check.
+ * so it degrades via the capability gate (a notice), never a size check.
  */
 export const VIDEO_SIZE_LIMITS = Object.freeze({
     telegram: 50 * MB,
@@ -66,10 +66,10 @@ export const VIDEO_SIZE_LIMITS = Object.freeze({
     echo: 1024 * MB,
 });
 /**
- * Channels that render a clickable URL message — DEL-03's `link` degrade policy
+ * Channels that render a clickable URL message — the `link` degrade policy
  * (send the RETAINED provider/workspace path as a message). A channel ABSENT here
  * (and IRC, which has no attachment surface at all) degrades with a `notice`
- * instead. Verified against the per-adapter audit (RESEARCH Open Q4/A4):
+ * instead. Verified against the per-adapter audit:
  * Discord/Slack/Telegram/LINE/WhatsApp/Signal/iMessage/Email render a link in a
  * text message; IRC does not (notice-only).
  */
@@ -88,17 +88,17 @@ const CHANNELS_RENDERING_VIDEO_LINK = Object.freeze({
  *
  *   `override ?? VIDEO_SIZE_LIMITS[channelType] ?? DEFAULT_VIDEO_SIZE_LIMIT`
  *
- * - `override` is the operator's media-compressor `maxVideoBytes` (it WINS — DEL-03
- *   "overridable via maxVideoBytes").
+ * - `override` is the operator's media-compressor `maxVideoBytes` (it WINS —
+ *   overridable via maxVideoBytes).
  * - an UNKNOWN channelType (or a proto-pollution key) falls back to the 25 MB
- *   default — NEVER throws, NEVER reads the prototype chain (SEC-04 guard).
+ *   default — NEVER throws, NEVER reads the prototype chain (the proto-pollution guard).
  */
 export function resolveVideoSizeLimit(channelType, override) {
     if (typeof override === "number" && override > 0)
         return override;
     if (isBlockedObjectKey(channelType))
         return DEFAULT_VIDEO_SIZE_LIMIT;
-    // eslint-disable-next-line security/detect-object-injection -- channelType is a platform-internal label, guarded by isBlockedObjectKey above (SEC-04 defense-in-depth); the table is a frozen own-property map.
+    // eslint-disable-next-line security/detect-object-injection -- channelType is a platform-internal label, guarded by isBlockedObjectKey above (defense-in-depth); the table is a frozen own-property map.
     const limit = VIDEO_SIZE_LIMITS[channelType];
     return typeof limit === "number" ? limit : DEFAULT_VIDEO_SIZE_LIMIT;
 }
@@ -113,7 +113,7 @@ export function channelRendersVideoLink(channelType) {
     return CHANNELS_RENDERING_VIDEO_LINK[channelType] === true;
 }
 /**
- * WR-03 (Phase 192): hosts whose video `sourceUrl` is KEYED/private — fetchable
+ * Hosts whose video `sourceUrl` is KEYED/private — fetchable
  * ONLY with a secret the adapter correctly WITHHOLDS from the shared URL. Sharing
  * such a URL as a `link` hands the user a DEAD link (a 403 without the key), and a
  * keyed variant would LEAK the credential to the channel. So these are excluded
@@ -130,7 +130,7 @@ const KEYED_VIDEO_URL_HOST_SUFFIXES = Object.freeze([
     "x.ai",
 ]);
 /**
- * WR-03: true when a provider `sourceUrl` is publicly fetchable WITHOUT a secret
+ * True when a provider `sourceUrl` is publicly fetchable WITHOUT a secret
  * (so it is safe + useful to share as a `link`). False for a keyed/private host
  * (Veo/Grok download URLs) and for a malformed/non-http URL (conservative — a URL
  * we cannot classify is not shared). The clip's workspace path is always the
@@ -169,19 +169,19 @@ export function formatVideoBytes(bytes) {
     return `${(bytes / (1024 * MB)).toFixed(1)} GB`;
 }
 /**
- * Build the DEL-03 oversized-video degrade message for the delivery site. Where
- * the channel renders links AND a retained provider URL is available AND that URL
- * is PUBLICLY FETCHABLE without a secret (WR-03), the `link` policy shares that
- * URL; otherwise the `notice` policy carries the local workspace path. EITHER WAY
+ * Build the oversized-video degrade message for the delivery site. Where the
+ * channel renders links AND a retained provider URL is available AND that URL
+ * is PUBLICLY FETCHABLE without a secret, the `link` policy shares that URL;
+ * otherwise the `notice` policy carries the local workspace path. EITHER WAY
  * the persisted `filePath` is included so the clip is recoverable, and the text
- * NEVER contains the v2.23 `[Attachment too large]` silent-drop marker (this is
- * the visible-degrade replacement for it).
+ * NEVER contains the `[Attachment too large]` silent-drop marker (this is the
+ * visible-degrade replacement for it).
  */
 export function buildOversizedDegradeMessage(args) {
     const { channelType, sizeBytes, limit, filePath, sourceUrl } = args;
     const sizeStr = formatVideoBytes(sizeBytes);
     const limitStr = formatVideoBytes(limit);
-    // WR-03: only share `sourceUrl` as a link when the channel renders links AND the
+    // Only share `sourceUrl` as a link when the channel renders links AND the
     // URL is publicly fetchable WITHOUT a secret. A keyed/private provider URL
     // (Veo/Grok) would be a DEAD link to the user (403 without the key) or LEAK the
     // key if keyed — degrade those to `notice` + the always-recoverable workspace path.

package/node_modules/@comis/daemon/dist/wiring/video-log-redaction.d.ts

@@ -13,8 +13,8 @@ export declare function redactErr(cause: Error): RedactedErr;
 /**
  * Resolve the video creds (their VALUES, never the env-ref names) from the secret
  * manager for the poller's exact-match log scrub. Absent keys drop out → the
- * poller falls back to the pattern scrub only (no crash). Lives here (the SEC-03
- * module) so the wiring site stays small (file-size discipline).
+ * poller falls back to the pattern scrub only (no crash). Lives here (this
+ * redaction module) so the wiring site stays small (file-size discipline).
  *
  * @param secretManager - any object exposing `get(name): string | undefined`
  *   (the daemon `SecretManager`; typed structurally to avoid a core type dep here).

package/node_modules/@comis/daemon/dist/wiring/video-log-redaction.js

@@ -1,7 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * SEC-03 (Phase 192): redaction-safe shaping of a RAW provider/channel Error
- * before it rides a log line.
+ * Redaction-safe shaping of a RAW provider/channel Error before it rides a log line.
  *
  * The off-turn video poller logs failure causes — a FAL/Veo/Grok SDK error, a
  * channel-adapter send error, a SQLite store error — whose free-text `message`
@@ -11,10 +10,10 @@
  * `err.message` or `err.cause`. So a raw cause logged as `err: cause` leaks any
  * secret in its (possibly nested) message.
  *
- * `redactErr` (CR-01) walks a BOUNDED `err.cause` chain, folds every level's
+ * `redactErr` walks a BOUNDED `err.cause` chain, folds every level's
  * message into one carrier, runs it through `sanitizeLogString` (the SECOND line
  * of defense — Bearer/sk-/AIza/the FAL uuid:hex shape/etc. → `[REDACTED]`), and
- * exact-match-scrubs any BOUND resolved video secret (the v2.20 OutputGuard
+ * exact-match-scrubs any BOUND resolved video secret (the OutputGuard
  * `knownSecrets` precedent — catches ANY shape, incl. future ones, with zero
  * false-positive risk). It returns a spreadable `{ errName, errMessage }`
  * (bounded) for the log payload. The cause chain is preserved so the failure
@@ -75,14 +74,14 @@ export function redactErr(cause) {
  * @param knownSecrets - Resolved secret VALUES (the agent's GOOGLE_API_KEY /
  *   XAI_API_KEY / FAL_KEY / the Grok bearer) — never the env-ref names.
  */
-/** The names of the video creds resolved for the SEC-03 exact-match log scrub —
- *  the SAME creds the adapters use (CRED-01, no video-specific secret). */
+/** The names of the video creds resolved for the exact-match log scrub —
+ *  the SAME creds the adapters use (no video-specific secret). */
 const VIDEO_SECRET_NAMES = ["GOOGLE_API_KEY", "XAI_API_KEY", "FAL_KEY"];
 /**
  * Resolve the video creds (their VALUES, never the env-ref names) from the secret
  * manager for the poller's exact-match log scrub. Absent keys drop out → the
- * poller falls back to the pattern scrub only (no crash). Lives here (the SEC-03
- * module) so the wiring site stays small (file-size discipline).
+ * poller falls back to the pattern scrub only (no crash). Lives here (this
+ * redaction module) so the wiring site stays small (file-size discipline).
  *
  * @param secretManager - any object exposing `get(name): string | undefined`
  *   (the daemon `SecretManager`; typed structurally to avoid a core type dep here).

package/node_modules/@comis/daemon/dist/wiring/wake-gate-runner.d.ts

@@ -0,0 +1,136 @@
+/**
+ * `wake-gate-runner` — the exception-safe, fail-open pre-payload gate runner.
+ *
+ * A scheduled job may carry a gate: a small, model-authored (untrusted) script
+ * that runs BEFORE the payload and decides whether to invoke the model at all.
+ * {@link createWakeGateRunner} runs that gate in the SAME cap-socket bwrap jail
+ * the `orchestrate` tool uses and resolves the outcome through the pure verdict
+ * parser.
+ *
+ * Two invariants are load-bearing:
+ *   - FAIL-OPEN. A gate that errors, times out, over-caps, emits no verdict, or
+ *     whose per-fire lease mint faults WAKES the model. The shared jailed runner
+ *     REJECTS on a SIGKILL-timeout / 4 MiB stdout-overflow / non-zero exit /
+ *     spawn error / unavailable jail, and the mint can throw on a LeaseManager /
+ *     OutputGuard invariant; the WHOLE body runs inside one try and every one of
+ *     those is caught and mapped to `{ wake: true }`. This runner NEVER throws to
+ *     the scheduler — a broken gate can never silently drop a monitored job
+ *     (which would fail CLOSED: status:error → backoff → auto-suspend).
+ *   - LEAST-PRIVILEGE, per fire. Each fire mints a FRESH attenuated lease under a
+ *     distinct `root-wakegate-<jobId>-<ts>-<nonce>` root, registers the bearer with the
+ *     OutputGuard so it is never logged, and threads it into the jail env as
+ *     `COMIS_CAP_LEASE` (+ `COMIS_ORCH_SOCKET`). The gate's tool reach is bounded
+ *     by the agent's RESOLVED autonomy capabilities enforced at the cap socket —
+ *     not the job's delivery/tool policy.
+ *
+ * When the host cannot isolate (the namespace preflight failed) or the agent's
+ * autonomy is disabled, the runner honestly degrades: it returns a run-as-today
+ * signal — no lease, no jailed run — and the caller runs the job unchanged.
+ *
+ * @module
+ */
+import { type ComisLogger, type OutputGuardPort, type PerAgentConfig, type TypedEventBus } from "@comis/core";
+import { type WakeGateVerdict } from "@comis/scheduler";
+import { type JailedScriptRunnerDeps, type JailedScriptResultStore, type SandboxProvider } from "@comis/skills/tools";
+import type { LeaseManager } from "@comis/infra";
+/** Per-fire context the scheduler hook passes when running a gate. */
+export interface WakeGateRunContext {
+    readonly agentId: string;
+    readonly jobId: string;
+    /** The formatted main-session key for the job's agent (the lease's session). */
+    readonly sessionKey: string;
+}
+/**
+ * The content-free outcome of a gated fire. A run that reached a verdict carries
+ * the verdict plus two counts an operator can reconstruct the fire from — the
+ * `durationMs` the gate took (measured on the clean AND the fail-open path) and
+ * the `toolCalls` it made (the scoped allow-decision cap-audit count) — plus
+ * `failedOpen`: `true` when the runner CAUGHT a run failure and woke defensively
+ * (the jailed run rejected — SIGKILL-timeout / 4 MiB overflow / non-zero exit /
+ * spawn error / unavailable jail — or the per-fire lease mint threw), rather than
+ * resolving a verdict from a clean run. (A clean run that the PARSER fail-opens on
+ * — empty/bare/non-verdict stdout — is `failedOpen:false`: the gate ran fine, it
+ * just did not print a verdict; that softer case is not a broken run.) It
+ * distinguishes a broken gate (fails open every fire — saves nothing, costs its
+ * cap-calls + jail spawn) from a healthy monitor that legitimately always wakes;
+ * both otherwise look identical (`wake:true`, `skipRate 0`) in the fleet lens. A host that cannot
+ * jail / has autonomy disabled honestly degrades to `runAsToday` (the job ran as
+ * today) and carries NO metrics — there was no gate to measure.
+ */
+export type WakeGateOutcome = {
+    verdict: WakeGateVerdict;
+    durationMs: number;
+    toolCalls: number;
+    failedOpen: boolean;
+    /** The per-fire `root-wakegate-<jobId>-<ts>-<nonce>` the gate's cap-calls are
+     *  audited under. Surfaced so an operator can reconstruct a fire's tool.invoke
+     *  sequence with `comis explain <rootRunId>` (the cap-audit stream keys on it).
+     *  Absent only on the rare pre-mint throw (nothing was audited to explain). */
+    rootRunId?: string;
+} | {
+    runAsToday: true;
+};
+/** The late-bound runner the scheduler holds a ref to. */
+export interface WakeGateRunner {
+    /**
+     * Run the gate. NEVER throws. Returns a verdict WITH its per-fire counts
+     * ({@link WakeGateOutcome}), OR a run-as-today signal when the host cannot jail
+     * / autonomy is disabled.
+     */
+    runWakeGate(gate: {
+        script: string;
+        language: "js" | "ts";
+        timeoutSeconds: number;
+    }, ctx: WakeGateRunContext): Promise<WakeGateOutcome>;
+}
+/** Injected collaborators for {@link createWakeGateRunner} (AGENTS §2.4). */
+export interface WakeGateRunnerDeps {
+    /** Structured logger — the fail-open WARN + the degrade DEBUG ride it. */
+    readonly logger: ComisLogger;
+    /** From the cap-layer handle — mints the per-fire lease. */
+    readonly leaseManager: LeaseManager;
+    /** The daemon OutputGuard — the bearer is registered here at mint (never logged). */
+    readonly outputGuard: OutputGuardPort;
+    /** The cap socket path threaded into the jail as `COMIS_ORCH_SOCKET`. */
+    readonly capSocketPath: string;
+    /** `boundedAutonomy.registerRoot` — anchors the per-fire root at mint. */
+    readonly registerRoot: (rootRunId: string, leaseId: string, parentLeaseId?: string) => void;
+    /** The OS sandbox provider (bwrap on Linux) — the jail arg generator. */
+    readonly sandbox: SandboxProvider;
+    /** Per-agent jailed-workspace resolver (the writable jail root). */
+    readonly resolveWorkspace: (agentId: string) => string;
+    /** The agents config map — `resolveAutonomy(agents[agentId]?.autonomy)`. */
+    readonly agents: Record<string, PerAgentConfig>;
+    /** The credential-free inherited env the jailed core scrubs (daemon exec env). */
+    readonly baseEnv: Record<string, string | undefined>;
+    /** The boot namespace-preflight boolean — false ⇒ honest degrade (no jail). */
+    readonly namespacePreflightOk: boolean;
+    /**
+     * The daemon event bus — the runner scopes a `capability:audited` subscription
+     * to THIS fire's `rootRunId` to count the gate's allow-decision cap-calls
+     * (`toolCalls`). Narrowed to the subscribe/unsubscribe port. OPTIONAL: when
+     * absent the count degrades honestly to 0 (never fabricated), and every
+     * bus-less test still constructs valid deps.
+     */
+    readonly eventBus?: Pick<TypedEventBus, "on" | "off">;
+    /** Injected wall clock (default {@link systemNowMs}) — the `-<ts>` root suffix. */
+    readonly now?: () => number;
+    /**
+     * The jailed-run seam (default the real {@link runJailedScript}) — injected so
+     * the exception-safety + bearer tests run WITHOUT a real bwrap jail.
+     */
+    readonly runJailedScriptFn?: (deps: JailedScriptRunnerDeps, params: {
+        script: string;
+        language: "js" | "ts";
+        timeoutMs?: number;
+    }) => Promise<string>;
+    /** The ResultRef store (default `createResultRefStore({ logger })`). */
+    readonly store?: JailedScriptResultStore;
+}
+/**
+ * Build the wake-gate runner. `runWakeGate` is total: it resolves to a verdict on
+ * a clean run, to `{ wake: true }` on ANY jailed-run failure (fail-open), or to
+ * `{ runAsToday: true }` when the host cannot jail / autonomy is disabled — it
+ * never rejects.
+ */
+export declare function createWakeGateRunner(deps: WakeGateRunnerDeps): WakeGateRunner;

package/node_modules/@comis/daemon/dist/wiring/wake-gate-runner.js

@@ -0,0 +1,217 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * `wake-gate-runner` — the exception-safe, fail-open pre-payload gate runner.
+ *
+ * A scheduled job may carry a gate: a small, model-authored (untrusted) script
+ * that runs BEFORE the payload and decides whether to invoke the model at all.
+ * {@link createWakeGateRunner} runs that gate in the SAME cap-socket bwrap jail
+ * the `orchestrate` tool uses and resolves the outcome through the pure verdict
+ * parser.
+ *
+ * Two invariants are load-bearing:
+ *   - FAIL-OPEN. A gate that errors, times out, over-caps, emits no verdict, or
+ *     whose per-fire lease mint faults WAKES the model. The shared jailed runner
+ *     REJECTS on a SIGKILL-timeout / 4 MiB stdout-overflow / non-zero exit /
+ *     spawn error / unavailable jail, and the mint can throw on a LeaseManager /
+ *     OutputGuard invariant; the WHOLE body runs inside one try and every one of
+ *     those is caught and mapped to `{ wake: true }`. This runner NEVER throws to
+ *     the scheduler — a broken gate can never silently drop a monitored job
+ *     (which would fail CLOSED: status:error → backoff → auto-suspend).
+ *   - LEAST-PRIVILEGE, per fire. Each fire mints a FRESH attenuated lease under a
+ *     distinct `root-wakegate-<jobId>-<ts>-<nonce>` root, registers the bearer with the
+ *     OutputGuard so it is never logged, and threads it into the jail env as
+ *     `COMIS_CAP_LEASE` (+ `COMIS_ORCH_SOCKET`). The gate's tool reach is bounded
+ *     by the agent's RESOLVED autonomy capabilities enforced at the cap socket —
+ *     not the job's delivery/tool policy.
+ *
+ * When the host cannot isolate (the namespace preflight failed) or the agent's
+ * autonomy is disabled, the runner honestly degrades: it returns a run-as-today
+ * signal — no lease, no jailed run — and the caller runs the job unchanged.
+ *
+ * @module
+ */
+import { resolveAutonomy, degradeAutonomy, systemNowMs, } from "@comis/core";
+import { parseWakeGateVerdict } from "@comis/scheduler";
+import { runJailedScript, createResultRefStore, } from "@comis/skills/tools";
+import { buildBrokerSpawnEnv } from "./setup-broker-activation.js";
+/**
+ * Classify a fail-open cause into the closed {@link ErrorKind} union so the WARN
+ * an operator filters on ("why does this gate always wake?") names the real
+ * fault, not a blanket `"timeout"`. A SIGKILL-timeout is `"timeout"`; a stdout
+ * size-cap overflow is `"resource"`; everything else — the gate script's
+ * non-zero exit, a spawn error, an unavailable jail, or a lease-broker mint
+ * fault — is a `"dependency"` failure (the gate is an external untrusted script
+ * and the jail/broker is an external dependency). The precise `err` still rides
+ * the WARN payload, so the exact cause stays visible.
+ */
+function classifyWakeGateFailure(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (/timeout/i.test(message))
+        return "timeout";
+    if (/hard cap/i.test(message))
+        return "resource";
+    return "dependency";
+}
+/**
+ * Build the wake-gate runner. `runWakeGate` is total: it resolves to a verdict on
+ * a clean run, to `{ wake: true }` on ANY jailed-run failure (fail-open), or to
+ * `{ runAsToday: true }` when the host cannot jail / autonomy is disabled — it
+ * never rejects.
+ */
+export function createWakeGateRunner(deps) {
+    const log = deps.logger.child({ submodule: "wake-gate-runner" });
+    // A per-runner monotonic nonce disambiguates two fires of the SAME job that
+    // start within one millisecond: `now()` has millisecond resolution, so the
+    // `-<ts>` root suffix alone can repeat. Captured in this closure, the counter
+    // is deterministic and collision-free within a process (no entropy source).
+    let fireSeq = 0;
+    return {
+        async runWakeGate(gate, ctx) {
+            // The WHOLE body is fail-open: the degrade, the per-fire lease mint, the
+            // deps assembly, and the jailed run all sit inside ONE try. Any throw —
+            // including a mintLease / registerSecret / registerRoot fault — maps to a
+            // wake, never a rethrow, so a broken gate can never fail CLOSED (a
+            // status:error would trigger scheduler backoff → auto-suspend). The
+            // `runAsToday` degrade is a normal return from inside the try (not a throw),
+            // so the catch is skipped for it.
+            //
+            // Metrics wrap the WHOLE fail-open region: `startedAt` (and the tool-call
+            // counter) are captured BEFORE the try so the catch still reports a real
+            // `durationMs` — a rejected / timed-out gate has a genuine span — and the
+            // count survives into the fail-open return.
+            const now = deps.now ?? systemNowMs;
+            const startedAt = now();
+            let toolCalls = 0;
+            // Hoisted so the fail-open catch can still report the root the fire's cap-calls
+            // were audited under (a gate can fetch then crash — those calls are explainable).
+            let rootRunId;
+            try {
+                // 1. Honest degrade. Resolve the agent's autonomy through the SAME
+                //    preflight-driven downshift the tool wiring uses; a disabled posture
+                //    (assistant, or a host that cannot build the jail) runs the job as
+                //    today — no lease, no jailed run, never a silent unjailed run.
+                const resolved = degradeAutonomy(resolveAutonomy(deps.agents[ctx.agentId]?.autonomy), {
+                    namespacePreflightOk: deps.namespacePreflightOk,
+                }).resolved;
+                if (!resolved.enabled) {
+                    log.debug({ agentId: ctx.agentId, jobId: ctx.jobId, step: "degrade" }, "wake-gate skipped (autonomy disabled or sandbox unavailable) — running the job as today");
+                    return { runAsToday: true };
+                }
+                // 2. Mint the per-fire lease WITH the bearer threaded. Reuse the shipped
+                //    mint (mintLease → registerSecret(bearer) → registerRoot →
+                //    COMIS_CAP_LEASE/COMIS_ORCH_SOCKET). Caps are the agent's RESOLVED
+                //    autonomy caps enforced at the cap socket — never a job tool policy.
+                //    A fault here is caught below and fails OPEN (waking), never closed.
+                //    The `-<nonce>` suffix keeps the root unique even for two same-job
+                //    fires that start in the same millisecond, so the scoped toolCalls
+                //    counter (which filters by THIS root) can never cross-count a
+                //    concurrent fire and the per-fire lease/root index never collides.
+                const ts = now().toString(36);
+                rootRunId = `root-wakegate-${ctx.jobId}-${ts}-${(fireSeq++).toString(36)}`;
+                const capMint = {
+                    leaseManager: deps.leaseManager,
+                    outputGuard: deps.outputGuard,
+                    capSocketPath: deps.capSocketPath,
+                    resolvedCaps: resolved.capabilities,
+                    budgetRef: `run-wakegate-${ctx.jobId}-${ts}`,
+                    sessionKey: ctx.sessionKey,
+                    rootRunId,
+                    registerRoot: deps.registerRoot,
+                };
+                const spawnEnv = buildBrokerSpawnEnv(undefined, ctx.agentId, capMint);
+                // 3. Assemble the per-fire jailed-run deps (the SAME shared jail the
+                //    orchestrate tool drives). The lease env rides brokerSpawnEnv.
+                const runnerDeps = {
+                    logger: deps.logger,
+                    workspaceResolver: () => deps.resolveWorkspace(ctx.agentId),
+                    capSocketPath: deps.capSocketPath,
+                    sandbox: deps.sandbox,
+                    brokerSpawnEnv: spawnEnv,
+                    store: deps.store ?? createResultRefStore({ logger: deps.logger }),
+                    baseEnv: deps.baseEnv,
+                    ...(deps.now ? { now: deps.now } : {}),
+                };
+                const runFn = deps.runJailedScriptFn ?? runJailedScript;
+                // 3b. Scope a tool-call counter to THIS fire's rootRunId. Each cap-call
+                //     the gate makes emits one `capability:audited` on the same bus, tagged
+                //     with the fire's root; count only ALLOW decisions (a deny is a blocked
+                //     call — no cost incurred) under our OWN root (a foreign root is another
+                //     fire, never counted). Content-free: the handler reads ONLY `rootRunId`
+                //     + `decision`, never the tool name / args / any payload body. The
+                //     listener is removed in the `finally` below — even on the fail-open
+                //     reject — so no listener leaks across fires. Absent bus ⇒ toolCalls
+                //     stays 0 (honest degrade, never a fabricated count).
+                const onAudited = (p) => {
+                    if (p.rootRunId === rootRunId && p.decision === "allow")
+                        toolCalls += 1;
+                };
+                deps.eventBus?.on("capability:audited", onAudited);
+                try {
+                    // 4. Run the gate; fail open on EVERY rejection. The runner rejects on a
+                    //    SIGKILL-timeout / 4 MiB overflow / non-zero exit / spawn error / an
+                    //    unavailable jail — each maps to a wake. Never rethrow to the scheduler.
+                    const stdout = await runFn(runnerDeps, {
+                        script: gate.script,
+                        language: gate.language,
+                        timeoutMs: gate.timeoutSeconds * 1000,
+                    });
+                    // A clean resolve means the child exited 0 without timing out/overflowing
+                    // (those paths REJECT). The parser fails open on empty/unparseable stdout.
+                    const verdict = parseWakeGateVerdict({ stdout, exitCode: 0, timedOut: false, overflowed: false });
+                    // 5. Egress-scrub the delivered status HERE, in the gate, before the
+                    //    verdict leaves. The cron-delivery listener ships `result` VERBATIM on
+                    //    its raw/system_event branch (no filterResponse, OutputGuard not
+                    //    applied there), so an untrusted, model-authored `deliver` string is
+                    //    scrubbed at the gate or a registered secret/canary could reach the
+                    //    channel. `context` is model-only (wrapped elsewhere) and `wake` is a
+                    //    boolean — only `deliver` egresses verbatim, so only `deliver` is scanned.
+                    if (verdict.deliver !== undefined) {
+                        const scanned = deps.outputGuard.scan(verdict.deliver);
+                        if (scanned.ok) {
+                            return {
+                                verdict: { ...verdict, deliver: scanned.value.sanitized },
+                                durationMs: now() - startedAt,
+                                toolCalls,
+                                failedOpen: false,
+                                rootRunId,
+                            };
+                        }
+                        // A scrub fault must never egress unscrubbed untrusted text: DROP the
+                        // deliver, degrading to a plain skip (no delivery). The pure-skip path
+                        // is always safe. `wake`/`context` are preserved as parsed.
+                        log.warn({
+                            err: scanned.error,
+                            agentId: ctx.agentId,
+                            jobId: ctx.jobId,
+                            errorKind: "internal",
+                            hint: "output-guard scan failed on the gate deliver text — dropping the deliver (skip, no delivery) to avoid unscrubbed egress",
+                        }, "Wake-gate deliver scrub failed — dropping deliver");
+                        return {
+                            verdict: { wake: verdict.wake, ...(verdict.context !== undefined ? { context: verdict.context } : {}) },
+                            durationMs: now() - startedAt,
+                            toolCalls,
+                            failedOpen: false,
+                            rootRunId,
+                        };
+                    }
+                    return { verdict, durationMs: now() - startedAt, toolCalls, failedOpen: false, rootRunId };
+                }
+                finally {
+                    // Unsubscribe on EVERY exit of the run region — clean return, deliver-scrub
+                    // return, or a runFn reject that propagates to the outer fail-open catch.
+                    deps.eventBus?.off("capability:audited", onAudited);
+                }
+            }
+            catch (err) {
+                log.warn({
+                    err,
+                    agentId: ctx.agentId,
+                    jobId: ctx.jobId,
+                    errorKind: classifyWakeGateFailure(err),
+                    hint: "wake-gate failed — waking the model (fail-open)",
+                }, "Wake-gate failed — waking (fail-open)");
+                return { verdict: { wake: true }, durationMs: now() - startedAt, toolCalls, failedOpen: true, rootRunId };
+            }
+        },
+    };
+}

package/node_modules/@comis/daemon/dist/wiring/wire-wake-gate-runner.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Assemble {@link WakeGateRunnerDeps} from the daemon's capability layer + boot
+ * context. Extracted from the composition root so daemon.ts stays thin; the
+ * populate itself (`createWakeGateRunner(...)` behind the `capEndpointHandle`
+ * guard) stays in daemon.ts where the boot-order guard reads it.
+ *
+ * The runner's tool reach is bounded by each agent's RESOLVED autonomy caps
+ * enforced at the cap socket — the caps ride the fresh per-fire lease the runner
+ * mints, NOT a job tool policy. This builder only threads the collaborators: the
+ * lease manager / output guard / cap socket / registerRoot all come from the SAME
+ * `capEndpointHandle` the cron-fire mint uses.
+ * @module
+ */
+import type { ComisLogger, PerAgentConfig, TypedEventBus } from "@comis/core";
+import type { SandboxProvider } from "@comis/skills/tools";
+import type { WakeGateRunnerDeps } from "./wake-gate-runner.js";
+import type { CapabilityLayerHandle } from "./setup-capability-endpoint-boot.js";
+export { createWakeGateRunner } from "./wake-gate-runner.js";
+export type { WakeGateRunner } from "./wake-gate-runner.js";
+/** The boot-context fields the wake-gate runner is assembled from (a structural
+ *  cut of BootContext — the daemon `handle` satisfies it). */
+export interface WakeGateRunnerBootInputs {
+    readonly skillsLogger: ComisLogger;
+    readonly workspaceDirs: Map<string, string>;
+    readonly defaultWorkspaceDir: string;
+    readonly agentsConfig: Record<string, PerAgentConfig>;
+    readonly execToolEnv: Record<string, string | undefined>;
+    /**
+     * The daemon container — its `eventBus` is the SAME bus the socket cap
+     * chokepoint emits `capability:audited` on, so the runner scope-counts a fire's
+     * allow-decision cap-calls (`toolCalls`) off it.
+     */
+    readonly container: {
+        readonly eventBus: TypedEventBus;
+    };
+}
+/** Build the {@link WakeGateRunnerDeps} from the boot context + the built cap layer. */
+export declare function buildWakeGateRunnerDeps(boot: WakeGateRunnerBootInputs, capEndpointHandle: CapabilityLayerHandle, sandbox: SandboxProvider, namespacePreflightOk: boolean): WakeGateRunnerDeps;

package/node_modules/@comis/daemon/dist/wiring/wire-wake-gate-runner.js

@@ -0,0 +1,20 @@
+// Re-exported so the composition root threads the runner through a single import.
+export { createWakeGateRunner } from "./wake-gate-runner.js";
+/** Build the {@link WakeGateRunnerDeps} from the boot context + the built cap layer. */
+export function buildWakeGateRunnerDeps(boot, capEndpointHandle, sandbox, namespacePreflightOk) {
+    return {
+        logger: boot.skillsLogger,
+        leaseManager: capEndpointHandle.leaseManager,
+        outputGuard: capEndpointHandle.outputGuard,
+        capSocketPath: capEndpointHandle.capSocketPath,
+        registerRoot: (rootRunId, leaseId, parentLeaseId) => capEndpointHandle.boundedAutonomy.registerRoot(rootRunId, leaseId, parentLeaseId),
+        sandbox,
+        resolveWorkspace: (agentId) => boot.workspaceDirs.get(agentId) ?? boot.defaultWorkspaceDir,
+        agents: boot.agentsConfig,
+        baseEnv: boot.execToolEnv,
+        namespacePreflightOk,
+        // The bus the socket cap chokepoint emits `capability:audited` on — the runner
+        // scope-counts a fire's own allow-decisions off it (toolCalls).
+        eventBus: boot.container.eventBus,
+    };
+}

package/node_modules/@comis/daemon/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/daemon",
   "private": true,
-  "version": "1.0.44",
+  "version": "1.0.46",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Background daemon and orchestrator for the Comis platform",

package/node_modules/@comis/gateway/dist/acp/acp-plan-bridge.d.ts

@@ -1,7 +1,7 @@
 /**
  * acp-plan-bridge — drives the IDE's native plan panel from the Silent
  * Execution Planner (SEP) by emitting ACP `session/update { sessionUpdate:
- * "plan" }` frames (spec §16.7 / §16.8). The milestone adds NO new plan-state
+ * "plan" }` frames (spec §16.7 / §16.8). This bridge adds NO new plan-state
  * tool — SEP remains the single plan-state source; the bridge ONLY READS the
  * live plan through the core `ExecutionPlanPort` (the holder impl).
  *