comisai 1.0.44 → 1.0.46

package/node_modules/@comis/cli/dist/commands/explain.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * `comis explain` — operator CLI for the Phase-153 IncidentReport.
+ * `comis explain` — operator CLI for the IncidentReport.
  *
  * Assembles a bounded, redaction-safe post-mortem (outcome, cost, per-tool
  * stats, failures, breaker timeline, deterministic likely root cause) for a
@@ -9,7 +9,7 @@
  * Usage:
  *   comis explain <sessionKey|traceId|rootRunId> [--format table|json] [--depth summary|full]
  *
- * Arg routing (FLEET-05 adds the 3rd): a `root-` prefix → {rootRunId} (an
+ * Arg routing: a `root-` prefix → {rootRunId} (an
  * autonomy run — the synthetic `root-session-<key>` or a real spawned root,
  * checked FIRST); else a session key contains ':' (tenant:user:channel:ts) →
  * {sessionKey}; a UUID (no ':') → {traceId}. The daemon canonicalizes a traceId
@@ -46,7 +46,7 @@ export function registerExplainCommand(program) {
         .action(async (idArg, options) => {
         try {
             const depth = options.depth;
-            // Route by arg shape (FLEET-05 adds the 3rd): the `root-` prefix is the
+            // Route by arg shape: the `root-` prefix is the
             // disambiguator for an autonomy run's rootRunId (a synthetic in-process
             // root is `root-session-<key>`; a real spawned root is `root-…`) and is
             // checked FIRST — a synthetic root contains ':' yet must NOT route to
@@ -57,14 +57,14 @@ export function registerExplainCommand(program) {
                 : idArg.includes(":")
                     ? { sessionKey: idArg, depth }
                     : { traceId: idArg, depth };
-            // W14 (obs-llm-troubleshooting): the telemetry lives on LOCAL disk —
+            // The telemetry lives on LOCAL disk —
             // a post-mortem must not require a live gateway. --offline assembles
             // locally; an UNREACHABLE gateway falls back automatically. An
             // AUTH-REJECTED gateway does NOT auto-fall-back (the daemon is up;
             // masking the token problem hides a misconfiguration) — the error
             // names COMIS_GATEWAY_TOKEN and --offline remains the explicit out.
             let assembledOffline = options.offline === true;
-            // OBS-5: the reason shown when we assembled offline (set in the catch below). Defaults to the
+            // The reason shown when we assembled offline (set in the catch below). Defaults to the
             // explicit --offline path; overwritten with the real cause (admin-deny vs unreachable) on fallback.
             let offlineReason = "report assembled offline from the local data dir (--offline)";
             const report = await withSpinner(assembledOffline
@@ -80,7 +80,7 @@ export function registerExplainCommand(program) {
                     if (isGatewayAuthRejection(e))
                         throw e;
                     assembledOffline = true;
-                    // OBS-5: distinguish an admin-trust deny (the RPC connected + refused — obs.explain is
+                    // Distinguish an admin-trust deny (the RPC connected + refused — obs.explain is
                     // admin-only by design) from a truly-unreachable daemon, so the fallback message names
                     // the REAL cause instead of always blaming the daemon.
                     offlineReason = /admin access required/i.test(e instanceof Error ? e.message : String(e))
@@ -110,7 +110,7 @@ export function registerExplainCommand(program) {
             info(`Cost:       $${report.cost.costUsd} · ${report.cost.totalTokens} tok`);
             info(`Timing:     ${report.timing.durationMs} ms · ${report.timing.turnCount} turns`);
             info(`Summary:    ${report.summary}`);
-            // TREE-01/02 (215): the root→children spawn tree (present only when the
+            // The root→children spawn tree (present only when the
             // session emitted per-cap audit records). Each node names its leaseId,
             // the parent edge (or "(root)"), the attenuated caps it held, the tool
             // NAMES it invoked, and any CapabilityDeniedError cap (DENIED=[...]) —
@@ -118,7 +118,7 @@ export function registerExplainCommand(program) {
             // whole report (spawnTree included) above.
             if (report.spawnTree && report.spawnTree.length > 0) {
                 info(`Spawn tree:`);
-                // WR-03: bound each per-node list in the table view so a hot root
+                // Bound each per-node list in the table view so a hot root
                 // (many distinct tools/caps) cannot print one unbounded line. The
                 // full lists always ride `--format json` (json(report) above).
                 const MAX_LIST = 12;

package/node_modules/@comis/cli/dist/commands/fleet.js

@@ -47,7 +47,7 @@ export function registerFleetCommand(program) {
         .action(async (options) => {
         try {
             const sinceHours = Number.parseFloat(options.since);
-            // W14: same offline contract as `comis explain` — explicit --offline, or
+            // Same offline contract as `comis explain` — explicit --offline, or
             // automatic fallback when the gateway is UNREACHABLE; an auth-rejection
             // surfaces (the daemon is up — masking the token problem hides a
             // misconfiguration).
@@ -79,7 +79,7 @@ export function registerFleetCommand(program) {
             // this branch and the json branch to hold the coverage floor).
             info(`Window:     last ${report.windowHours}h`);
             info(`Sessions:   ${report.sessions.total} (${report.sessions.degraded} degraded, ${(report.sessions.degradedRate * 100).toFixed(0)}%)`);
-            // QT2/QT3 — the fleet-level degradation detector: degraded counts by
+            // The fleet-level degradation detector: degraded counts by
             // named endReason cause. Surface it in the TABLE view (not only via
             // --format json) so an operator running `comis fleet` SEES the spread.
             // Sorted deterministically (count desc, then cause name asc) to match the
@@ -91,7 +91,7 @@ export function registerFleetCommand(program) {
                 info(`Degraded by cause: ${degradedByCause.map(([cause, count]) => `${cause}=${count}`).join(", ")}`);
             }
             info(`Breaker:    ${report.breakerTripTotal} trips`);
-            // FLEET-01/02/04 — the cross-run AUTONOMY-health slice. Guarded like
+            // The cross-run AUTONOMY-health slice. Guarded like
             // degradedByCause (above): present ONLY when the daemon ran durable
             // (unattended) runs and the durable store was wired; ABSENT under
             // --offline / a non-durability boot (the assembler omits the block —
@@ -104,7 +104,7 @@ export function registerFleetCommand(program) {
             // automatically — this is the human-readable table render only.
             if (report.autonomy) {
                 const a = report.autonomy;
-                // FLEET-02 (Phase 220-05): `denialBreaker` is the capability-DENIAL breaker
+                // `denialBreaker` is the capability-DENIAL breaker
                 // trip count — SEPARATE from `breaker` (the tool-failure breaker). A
                 // denial-breaker-aborted run is invisible to every other count (it lands in
                 // durable status 'completed'), so this is its only fleet surface.
@@ -113,9 +113,9 @@ export function registerFleetCommand(program) {
                     info(`  → worst run: comis explain ${a.worstRootRunId}`);
                 }
             }
-            // WR-03: cost.costUsd is A1-sourced (session-summary store); the token
-            // total is A3-sourced (session-index files) and degrades independently.
-            // When A3 degraded (coverage.sessionIndex.daysMissing > 0) the token
+            // cost.costUsd is sourced from the session-summary store; the token
+            // total is sourced from the session-index files and degrades independently.
+            // When the token read degraded (coverage.sessionIndex.daysMissing > 0) the token
             // figure is an unreliable 0 — printing "$X · 0 tok" alongside a real
             // cost reads as a data bug. Drop the contradictory "0 tok" and surface
             // the honest degraded-coverage signal instead; otherwise the normal line.

package/node_modules/@comis/cli/dist/commands/health.js

@@ -92,7 +92,7 @@ function buildHealthContext(configPaths) {
 /**
  * Build a human-readable footer for the health summary line.
  *
- * Mirrors the pre-fusion behavior:
+ * Output contract:
  *   - "All checks passed" when no fail/warn findings exist
  *   - "{total} issue(s) found ({n} error(s), {n} warning(s))" otherwise
  */
@@ -150,14 +150,13 @@ export function registerHealthCommand(program) {
         }
         else {
             const findings = mapHealthFindings(filtered);
-            // Pre-fusion `renderHealthTable` emitted ONLY the footer line —
-            // either "All checks passed" (green) or "N issues found (X errors,
-            // Y warnings)". There was NO leading "N checks, X fail, Y warn"
-            // preamble. Suppress the preamble by passing total=0 and empty
-            // counts; the renderer's `summaryParts()` then yields no entries
-            // and `emitSummary()` only emits the footer. This also means the
-            // pre-vs-post-filter `total`/`counts` mismatch is moot once no
-            // preamble renders.
+            // `comis health` emits ONLY the footer line — either "All checks
+            // passed" (green) or "N issues found (X errors, Y warnings)" —
+            // with NO leading "N checks, X fail, Y warn" preamble. Suppress
+            // the preamble by passing total=0 and empty counts; the renderer's
+            // `summaryParts()` then yields no entries and `emitSummary()` only
+            // emits the footer. This also means the pre-vs-post-filter
+            // `total`/`counts` mismatch is moot once no preamble renders.
             const summary = {
                 total: 0,
                 counts: {},

package/node_modules/@comis/cli/dist/commands/init.js

@@ -91,6 +91,14 @@ function buildNonInteractiveOptionsFromCommander(options) {
         slackAppToken: options.slackAppToken,
         lineToken: options.lineToken,
         lineSecret: options.lineSecret,
+        msteamsAppId: options.msteamsAppId,
+        msteamsAppPassword: options.msteamsAppPassword,
+        msteamsTenantId: options.msteamsTenantId,
+        // Commander yields an arbitrary string here; this assertion to the closed
+        // union is made sound by validateNonInteractiveOptions, which runs before
+        // any consumer and rejects a value outside secret|certificate|managedIdentity
+        // (same cast-then-validate contract as --storage below).
+        msteamsAuthMode: options.msteamsAuthMode,
         imageProvider: options.imageProvider,
         imageApiKey: options.imageApiKey,
         videoProvider: options.videoProvider,
@@ -151,6 +159,10 @@ export function registerInitCommand(program) {
         .option("--slack-app-token <tok>", "Slack app token")
         .option("--line-token <tok>", "LINE channel token")
         .option("--line-secret <sec>", "LINE channel secret")
+        .option("--msteams-app-id <id>", "Microsoft Teams bot app (client) ID")
+        .option("--msteams-app-password <pw>", "Microsoft Teams app password (client secret)")
+        .option("--msteams-tenant-id <id>", "Microsoft Teams directory (tenant) ID")
+        .option("--msteams-auth-mode <mode>", "Microsoft Teams auth mode: secret|certificate|managedIdentity")
         // Media generation
         .option("--image-provider <id>", "Image generation provider: auto|fal|openai|openai-codex|google|openrouter")
         .option("--image-api-key <key>", "Image provider API key (e.g. FAL_KEY; reuses --api-key for a matching main provider)")

package/node_modules/@comis/cli/dist/commands/memory.js

@@ -30,11 +30,6 @@ export function registerMemoryCommand(program) {
     const memory = program.command("memory").description("Memory management");
     // memory search <query> — the hybrid memory-entry search
     // (memory.search_files: memoryApi.search → FTS + vector fusion).
-    //
-    // Live finding 2026-06-11: this command was a hardcoded exit-1 stub left
-    // over from the Phase-126 demolition, blaming "the context engine is
-    // 'pipeline'" on a DAG-mode daemon — while the contracted search RPC
-    // worked fine. The excuse outlived the era it described.
     memory
         .command("search <query>")
         .description("Search memory entries")
@@ -69,9 +64,6 @@ export function registerMemoryCommand(program) {
     });
     // memory inspect <id> — single-entry detail via memory.browse (no
     // dedicated by-id read RPC exists; the browse page is scanned client-side).
-    //
-    // Live finding 2026-06-11: like `search`, this was a hardcoded exit-1 stub
-    // blaming the demolished pipeline-era context engine.
     memory
         .command("inspect <id>")
         .description("Display full details of a memory entry")
@@ -160,7 +152,7 @@ export function registerMemoryCommand(program) {
             process.exit(1);
         }
     });
-    // memory learning — OBS-02 (Phase 198) outcome-learning telemetry (coverage,
+    // memory learning — outcome-learning telemetry (coverage,
     // volume by source, success/failure ratio per agent). Read OFFLINE from the
     // local outcome_events ledger (~/.comis/memory.db): the CLI cannot import
     // @comis/agent/@comis/skills (closed graph) and the daemon coverage gauge is
@@ -201,7 +193,7 @@ export function registerMemoryCommand(program) {
             Object.entries(a.sources).map(([k, v]) => `${k}:${v}`).join(" "),
         ]));
     });
-    // memory skills — OBS-02 (Phase 201, P2 skills) procedural-learning telemetry:
+    // memory skills — procedural-learning telemetry:
     // the learned-skill admission funnel (synthesized/admitted counts by state, per
     // agent). Read OFFLINE from the local mental_models table (kind='skill' rows,
     // ~/.comis/memory.db):
@@ -233,7 +225,7 @@ export function registerMemoryCommand(program) {
         }
         const byStateStr = (m) => Object.entries(m).map(([k, v]) => `${k}:${v}`).join(" ");
         info(`Learned skills: ${stats.total} (${byStateStr(stats.byState)})`);
-        // SURFACE-06 promotion/demotion roll-up — counts only (DERIVED from byState):
+        // Promotion/demotion roll-up — counts only (DERIVED from byState):
         // promoted = active, demoted = stale+archived. Never a per-procedure body.
         info(`Promoted (active): ${stats.promoted} · Demoted (stale+archived): ${stats.demoted}`);
         renderTable(["Tenant", "Agent", "Total", "Funnel", "Promoted", "Demoted", "Skills (state·proof)"], stats.perAgent.map((a) => [
@@ -265,8 +257,8 @@ export function registerMemoryCommand(program) {
             })));
             const records = (result.records ?? []);
             if (records.length === 0) {
-                // Honest empty (live finding 2026-06-11): say WHY it is empty —
-                // the recorder is opt-in, so a bare "no records" pointed nowhere.
+                // Honest empty: say WHY it is empty — the recorder is opt-in, so
+                // a bare "no records" would point nowhere.
                 const traceResult = result;
                 if (traceResult.hint !== undefined) {
                     info(`No recall-trace records found — ${traceResult.hint}`);
@@ -432,7 +424,7 @@ export function registerMemoryCommand(program) {
     });
     // memory export — versioned, secret-scrubbed envelope export.
     // CLI writes the file (daemon runs under node --permission which disables
-    // fd-based fs APIs: fsync*, fchmod, fchown). T-02-07: mode 0o600 (owner
+    // fd-based fs APIs: fsync*, fchmod, fchown). Mode 0o600 (owner
     // read/write only).
     memory
         .command("export")
@@ -441,7 +433,7 @@ export function registerMemoryCommand(program) {
         .option("--output <path>", "Output file path (default: comis-memory-<agentId>-<timestamp>.json)")
         .option("--limit <n>", "Maximum entries to export (default: 10000)", "10000")
         .action(async (options) => {
-        // WR-02: guard against non-numeric --limit before the RPC call.
+        // Guard against non-numeric --limit before the RPC call.
         const exportLimit = parseInt(options.limit, 10);
         if (isNaN(exportLimit) || exportLimit < 1) {
             error("Invalid limit: must be a positive integer");
@@ -453,7 +445,7 @@ export function registerMemoryCommand(program) {
                 limit: exportLimit,
             })));
             // CLI writes the file — daemon runs node --permission (no fd-based fs APIs).
-            // T-02-07: mode 0o600 (owner read/write only — same pattern as openSqliteDatabase).
+            // Mode 0o600 (owner read/write only — same pattern as openSqliteDatabase).
             const outPath = options.output ?? `comis-memory-${options.agent}-${Date.now()}.json`;
             await fs.writeFile(outPath, JSON.stringify(result, null, 2), { mode: 0o600 });
             success(`Exported ${result.entryCount} entr${result.entryCount === 1 ? "y" : "ies"} → ${outPath}`);
@@ -465,7 +457,7 @@ export function registerMemoryCommand(program) {
         }
     });
     // memory import — firewalled import from comis-memory-export-v1 envelope.
-    // CLI validates envelope client-side (T-02-08 fail-closed layer) before RPC.
+    // CLI validates envelope client-side (fail-closed layer) before RPC.
     // Daemon runs its own Zod validation + memory-poisoning firewall as second line.
     memory
         .command("import <file>")
@@ -474,7 +466,7 @@ export function registerMemoryCommand(program) {
         .option("--dry-run", "Validate and report counts without writing to the store")
         .action(async (file, options) => {
         try {
-            // T-02-08: CLI validates envelope before sending to daemon — fail-closed.
+            // CLI validates the envelope before sending to the daemon — fail-closed.
             let raw;
             try {
                 raw = JSON.parse(await fs.readFile(file, "utf-8"));

package/node_modules/@comis/cli/dist/commands/orchestrate.d.ts

@@ -0,0 +1,32 @@
+/**
+ * `comis orchestrate` — operator commands for durable orchestrate runs.
+ *
+ * Subcommands:
+ *   orchestrate replay <runId> [--format text|json]
+ *     Deterministically re-run a durable orchestrate run's PINNED script bytes
+ *     against a SEPARATE, operator-invoked replay socket that serves the run's
+ *     recorded results, and print the byte-identical stdout. The determinism +
+ *     confused-deputy safety live in the daemon handler
+ *     (setup-orchestrate-replay.ts): the caller supplies ONLY a runId (never a
+ *     script), the RPC is admin-scoped + deny-by-origin, and the re-spawn hits
+ *     the separate replay socket (never the production endpoint — INV-1).
+ *
+ * Per the cli-uses-typed-rpc arch invariant: ONLY `callTyped` is used here —
+ * never raw `client.call`. `callTyped` runs `OrchestrateReplayContract.request.parse`
+ * on `{ runId }` and `OrchestrateReplayContract.response.parse` on the response.
+ *
+ * @module
+ */
+import type { Command } from "commander";
+/**
+ * Register the `orchestrate` command group (currently `orchestrate replay`) on
+ * the program.
+ *
+ * Backed by the frozen `OrchestrateReplayContract` (`orchestrate.replay`, admin
+ * scope). The operator's gateway token carries admin scope, so the daemon-side
+ * deny-by-origin chokepoint passes for this operator-invoked WS RPC (an
+ * agent-origin call is rejected — INV-3).
+ *
+ * @param program - The root Commander program
+ */
+export declare function registerOrchestrateCommand(program: Command): void;

package/node_modules/@comis/cli/dist/commands/orchestrate.js

@@ -0,0 +1,49 @@
+import { OrchestrateReplayContract } from "@comis/core";
+import { callTyped, isGatewayAuthRejection, withClient } from "../client/rpc-client.js";
+import { info, error, json } from "../output/format.js";
+import { withSpinner } from "../output/spinner.js";
+/**
+ * Register the `orchestrate` command group (currently `orchestrate replay`) on
+ * the program.
+ *
+ * Backed by the frozen `OrchestrateReplayContract` (`orchestrate.replay`, admin
+ * scope). The operator's gateway token carries admin scope, so the daemon-side
+ * deny-by-origin chokepoint passes for this operator-invoked WS RPC (an
+ * agent-origin call is rejected — INV-3).
+ *
+ * @param program - The root Commander program
+ */
+export function registerOrchestrateCommand(program) {
+    const orchestrate = program
+        .command("orchestrate")
+        .description("Operate on durable orchestrate runs");
+    orchestrate
+        .command("replay <runId>")
+        .description("Deterministically re-run a durable orchestrate run's pinned script against its recorded results")
+        .option("--format <format>", "Output format: text | json", "text")
+        .action(async (runId, options) => {
+        try {
+            const result = await withSpinner("Replaying orchestrate run...", async () => withClient((client) => callTyped(client, OrchestrateReplayContract, { runId })));
+            if (options.format === "json") {
+                json(result);
+                return;
+            }
+            // A human-readable divergence note (the re-run's cap calls did not line up
+            // with the recorded results) — an annotation on the console channel; the
+            // recorded stdout is still printed below.
+            if (result.diverged) {
+                info("replay diverged from the recorded results (a re-run cap call did not match the recording)");
+            }
+            // Print the recorded stdout VERBATIM (byte-faithful — no chalk/indent/
+            // trailing-newline mangling); the recorded output carries its own newlines.
+            process.stdout.write(result.stdout);
+        }
+        catch (e) {
+            error(`replay failed: ${e instanceof Error ? e.message : String(e)}`);
+            if (isGatewayAuthRejection(e)) {
+                error("tip: orchestrate.replay is admin-only — ensure your gateway token carries admin scope (COMIS_GATEWAY_TOKEN)");
+            }
+            process.exit(1);
+        }
+    });
+}

package/node_modules/@comis/cli/dist/commands/providers.js

@@ -13,7 +13,7 @@
  *
  * @module
  */
-import { getEnvApiKey } from "@earendil-works/pi-ai";
+import { getEnvApiKey } from "@earendil-works/pi-ai/compat";
 import { withClient, callTyped } from "../client/rpc-client.js";
 import { loadProvidersWithFallback } from "../client/provider-list.js";
 import { createModelCatalog, ModelsListContract } from "@comis/core";

package/node_modules/@comis/cli/dist/commands/secrets.d.ts

@@ -5,7 +5,7 @@
  * for managing encrypted secrets.
  *
  * Store-backed subcommands (set, get, list, delete, import) route through
- * daemon RPC -- the CLI no longer opens the encrypted SQLite store directly.
+ * daemon RPC -- the CLI never opens the encrypted SQLite store directly.
  * Each store-backed subcommand gates on a 200ms `requireDaemonOrExit()` probe
  * and exits with code 4 (DaemonRequired) on failure (see util/daemon-required.ts).
  *

package/node_modules/@comis/cli/dist/commands/secrets.js

@@ -7,7 +7,7 @@
  * for managing encrypted secrets.
  *
  * Store-backed subcommands (set, get, list, delete, import) route through
- * daemon RPC -- the CLI no longer opens the encrypted SQLite store directly.
+ * daemon RPC -- the CLI never opens the encrypted SQLite store directly.
  * Each store-backed subcommand gates on a 200ms `requireDaemonOrExit()` probe
  * and exits with code 4 (DaemonRequired) on failure (see util/daemon-required.ts).
  *
@@ -245,7 +245,7 @@ export function registerSecretsCommand(program) {
                 return;
             }
         }
-        // W15 (obs-llm-troubleshooting): explicit offline read. Without it,
+        // Explicit offline read. Without it,
         // `secrets get COMIS_GATEWAY_TOKEN` required the daemon RPC — which
         // required the very token being fetched. The daemon path stays the
         // default (RPC reads are audit-logged daemon-side); --offline is the

package/node_modules/@comis/cli/dist/commands/security-audit-log.d.ts

@@ -1,6 +1,6 @@
 /**
  * `comis security audit-log` — operator CLI for the durable security-decision
- * audit (AUDIT-05, Phase 176 Plan 05). Reads `obs_audit_events` via the
+ * audit. Reads `obs_audit_events` via the
  * admin-scoped `obs.audit.query` RPC and prints the content-free rows as a
  * concise table or as JSON.
  *

package/node_modules/@comis/cli/dist/commands/security-audit-log.js

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
  * `comis security audit-log` — operator CLI for the durable security-decision
- * audit (AUDIT-05, Phase 176 Plan 05). Reads `obs_audit_events` via the
+ * audit. Reads `obs_audit_events` via the
  * admin-scoped `obs.audit.query` RPC and prints the content-free rows as a
  * concise table or as JSON.
  *

package/node_modules/@comis/cli/dist/commands/security.d.ts

@@ -15,7 +15,7 @@ import type { Command } from "commander";
  * Provides:
  * - `comis security audit` -- run security checks
  * - `comis security fix` -- auto-remediate findings (dry-run by default)
- * - `comis security audit-log` -- query the durable security-decision audit log (AUDIT-05)
+ * - `comis security audit-log` -- query the durable security-decision audit log
  *
  * @param program - The root Commander program
  */

package/node_modules/@comis/cli/dist/commands/security.js

@@ -107,7 +107,7 @@ function buildAuditContext(configPaths) {
  * Provides:
  * - `comis security audit` -- run security checks
  * - `comis security fix` -- auto-remediate findings (dry-run by default)
- * - `comis security audit-log` -- query the durable security-decision audit log (AUDIT-05)
+ * - `comis security audit-log` -- query the durable security-decision audit log
  *
  * @param program - The root Commander program
  */
@@ -230,7 +230,7 @@ export function registerSecurityCommand(program) {
             process.exit(1);
         }
     });
-    // security audit-log (AUDIT-05) — the durable security-decision audit query.
+    // security audit-log — the durable security-decision audit query.
     // DISTINCT from `security audit` (the local check-runner): this is a REMOTE
     // admin RPC (obs.audit.query) reading the persisted obs_audit_events. The
     // handler lives in the flat `security-audit-log.ts` (the explain.ts/fleet.ts

package/node_modules/@comis/cli/dist/commands/sessions.js

@@ -175,14 +175,13 @@ export function registerSessionsCommand(program) {
             process.exit(1);
         }
     });
-    // sessions reset — Phase 164-06: complete cross-mode conversation reset.
-    // Supersedes Phase 164-03 sessions reset-lcd (LCD-only).
+    // sessions reset — complete cross-mode conversation reset.
     // Admin-gated destructive operation: clears BOTH the LCD durable history
     // AND the daemon sessionStore working transcript for the given session.
     // After this reset, a follow-up turn has NO prior context in both dag mode
     // (LCD empty) and pipeline mode (sessionStore empty → rehydrates empty).
-    // --memory also clears RAG memories — the GDPR / full-forget path (Phase 172-03
-    // DIST-05): deletes paired + lcd-distilled memories by source_session_key and
+    // --memory also clears RAG memories — the GDPR / full-forget path:
+    // deletes paired + lcd-distilled memories by source_session_key and
     // unlinks consolidated observations. --purge-derived (opt-in, with --memory)
     // nukes EVERY observation derived from this session (destructive).
     // --yes skips confirmation (required for scripted/automated use).
@@ -227,7 +226,7 @@ export function registerSessionsCommand(program) {
             process.exit(1);
         }
     });
-    // sessions backup — SQLite Online Backup API (Phase 170-04 DOC-02)
+    // sessions backup — SQLite Online Backup API.
     // Opens memory.db as readonly and calls db.backup(destPath) — the SQLite
     // Online Backup API — which is hot-backup-safe (daemon can continue writing).
     // The backup file is created with a timestamp suffix and immediately chmod
@@ -248,7 +247,7 @@ export function registerSessionsCommand(program) {
         const ts = new Date().toISOString().replace(/[:.]/g, "");
         const destPath = dbPath + ".backup." + ts;
         const db = new Database(dbPath, { readonly: true });
-        // WR-02: tighten the umask so db.backup() creates the file 0600 FROM THE START.
+        // Tighten the umask so db.backup() creates the file 0600 FROM THE START.
         // The session database is sensitive; a chmod-after-write pattern leaves a brief
         // world-readable window between backup completion and chmod. Restored in finally.
         const prevUmask = process.umask(0o077);

package/node_modules/@comis/cli/dist/commands/support-bundle.d.ts

@@ -0,0 +1,32 @@
+/**
+ * `comis support-bundle` — assemble an offline, paste-ready support bundle.
+ *
+ * The command is the sanctioned throw/exit boundary for the bundle pipeline: it
+ * resolves the data dir + config paths, validates the flag combination, calls
+ * the offline orchestrator, and maps the `Result` to a named `ExitCode`. A
+ * written bundle is a success even when the triage is degraded or the bundle is
+ * partial — the degraded verdict is the content, not a failure. Only a bundle
+ * that could not be produced at all is a `GeneralFailure`, and a misused flag is
+ * a `UsageError`.
+ *
+ * In table format it prints the bundle path, the triage status, the reporter
+ * next-steps, the privacy notice, and the two copy-paste lines — the `tar`
+ * archive command and the `gh issue create` command. Those lines are PRINTED
+ * for the operator to run; the command never runs them itself, so the bundle is
+ * never transmitted or published on the operator's behalf.
+ *
+ * @module
+ */
+import type { Command } from "commander";
+/**
+ * Register the `support-bundle` command on the program.
+ *
+ * Flags: `--since <hours>` (window, default 24), `--format table|json`
+ * (default table), `-c/--config <paths...>`, `--session <ref>`, and `--deep`
+ * (requires `--session`). `--session` focuses the bundle on one session and
+ * embeds its `explain.json` digest; `--deep` additionally embeds that session's
+ * redacted per-session trace bundle.
+ *
+ * @param program - The root Commander program
+ */
+export declare function registerSupportBundleCommand(program: Command): void;