comisai 1.0.44 → 1.0.46

package/node_modules/@comis/cli/dist/util/exit-codes.d.ts

@@ -1,8 +1,8 @@
 /**
  * CLI exit-code constants — single source of truth.
  *
- * Replaces scattered inline `process.exit(N)` literals.
- *   - 1: general failure (many sites — kept as-is, default for unknown errors)
+ * Canonical meanings for `process.exit(N)` codes:
+ *   - 1: general failure (default for unknown errors; many sites still exit 1 inline)
  *   - 2: validation/usage error (e.g., commands/auth.ts:247,259,265,280)
  *   - 3: config error (commands/config.ts:457,479,484)
  *   - 4: daemon required but unreachable
@@ -17,7 +17,7 @@ export declare const ExitCode: {
     readonly ConfigError: 3;
     /** Daemon required but unreachable. */
     readonly DaemonRequired: 4;
-    /** Daemon self-restart signal (carry-forward; do not reassign). */
+    /** Daemon SIGUSR2 self-restart signal — the installed systemd unit pins RestartForceExitStatus=42; do not reassign. */
     readonly DaemonRestartSignal: 42;
 };
 export type ExitCodeValue = (typeof ExitCode)[keyof typeof ExitCode];

package/node_modules/@comis/cli/dist/util/exit-codes.js

@@ -2,8 +2,8 @@
 /**
  * CLI exit-code constants — single source of truth.
  *
- * Replaces scattered inline `process.exit(N)` literals.
- *   - 1: general failure (many sites — kept as-is, default for unknown errors)
+ * Canonical meanings for `process.exit(N)` codes:
+ *   - 1: general failure (default for unknown errors; many sites still exit 1 inline)
  *   - 2: validation/usage error (e.g., commands/auth.ts:247,259,265,280)
  *   - 3: config error (commands/config.ts:457,479,484)
  *   - 4: daemon required but unreachable
@@ -18,6 +18,6 @@ export const ExitCode = {
     ConfigError: 3,
     /** Daemon required but unreachable. */
     DaemonRequired: 4,
-    /** Daemon self-restart signal (carry-forward; do not reassign). */
+    /** Daemon SIGUSR2 self-restart signal — the installed systemd unit pins RestartForceExitStatus=42; do not reassign. */
     DaemonRestartSignal: 42,
 };

package/node_modules/@comis/cli/dist/util/offline-learning.d.ts

@@ -1,20 +1,19 @@
 /**
- * OBS-02 (Phase 198): OFFLINE outcome-learning telemetry for `comis memory
- * learning`.
+ * OFFLINE outcome-learning telemetry for `comis memory learning`.
  *
  * The outcome ledger (`outcome_events`) lives in the local `~/.comis/memory.db`,
  * so a coverage read must not require a live gateway — the CLI reads the table
  * directly (the same offline-disk discipline `offline-obs.ts` uses for
  * `comis explain`/`fleet`). The CLI cannot import `@comis/agent`/`@comis/skills`
  * (closed graph) and the in-process daemon coverage gauge is not yet a queryable
- * RPC (Plan 04 "Known Stub"), so the offline `@comis/memory` read is the
+ * RPC, so the offline `@comis/memory` read is the
  * sanctioned path — CLI→@comis/memory + better-sqlite3 are already allowed edges.
  *
- * COUNTS/IDS ONLY (T-198-27): the aggregates are pure COUNT(*) / COUNT(DISTINCT
+ * COUNTS/IDS ONLY: the aggregates are pure COUNT(*) / COUNT(DISTINCT
  * trajectory_id) / GROUP BY over the closed-enum `outcome`/`source` columns + the
  * `(tenant_id, agent_id)` scope — never a body, a confidence value, or a
  * recalled/skill id (the ledger stores no
- * bodies by construction; SEC-01). The db is opened in WAL mode (concurrent with
+ * bodies by construction). The db is opened in WAL mode (concurrent with
  * a live daemon) and ONLY when the file already exists — the offline read never
  * creates it; a missing/unreadable store soft-fails to `undefined` so the command
  * prints an honest "no outcome events" message instead of a misleading empty table.
@@ -33,12 +32,12 @@ export interface LearningAgentStats {
     coverage: number;
     /** Row counts per closed-enum outcome. */
     outcomes: Record<string, number>;
-    /** Distinct trajectories carrying a signal of each closed-enum source (WR-03). */
+    /** Distinct trajectories carrying a signal of each closed-enum source. */
     sources: Record<string, number>;
 }
 /** The whole-ledger outcome-learning telemetry (counts only). */
 export interface LearningStats {
-    /** Total distinct-trajectory signals across all sources (NOT raw rows; WR-03). */
+    /** Total distinct-trajectory signals across all sources (NOT raw rows). */
     totalRows: number;
     totalTrajectories: number;
     totalResolved: number;

package/node_modules/@comis/cli/dist/util/offline-learning.js

@@ -1,22 +1,21 @@
 // SPDX-License-Identifier: Apache-2.0
 // @allow-throw: CLI entry point — errors propagate to the Commander error handler.
 /**
- * OBS-02 (Phase 198): OFFLINE outcome-learning telemetry for `comis memory
- * learning`.
+ * OFFLINE outcome-learning telemetry for `comis memory learning`.
  *
  * The outcome ledger (`outcome_events`) lives in the local `~/.comis/memory.db`,
  * so a coverage read must not require a live gateway — the CLI reads the table
  * directly (the same offline-disk discipline `offline-obs.ts` uses for
  * `comis explain`/`fleet`). The CLI cannot import `@comis/agent`/`@comis/skills`
  * (closed graph) and the in-process daemon coverage gauge is not yet a queryable
- * RPC (Plan 04 "Known Stub"), so the offline `@comis/memory` read is the
+ * RPC, so the offline `@comis/memory` read is the
  * sanctioned path — CLI→@comis/memory + better-sqlite3 are already allowed edges.
  *
- * COUNTS/IDS ONLY (T-198-27): the aggregates are pure COUNT(*) / COUNT(DISTINCT
+ * COUNTS/IDS ONLY: the aggregates are pure COUNT(*) / COUNT(DISTINCT
  * trajectory_id) / GROUP BY over the closed-enum `outcome`/`source` columns + the
  * `(tenant_id, agent_id)` scope — never a body, a confidence value, or a
  * recalled/skill id (the ledger stores no
- * bodies by construction; SEC-01). The db is opened in WAL mode (concurrent with
+ * bodies by construction). The db is opened in WAL mode (concurrent with
  * a live daemon) and ONLY when the file already exists — the offline read never
  * creates it; a missing/unreadable store soft-fails to `undefined` so the command
  * prints an honest "no outcome events" message instead of a misleading empty table.
@@ -39,7 +38,7 @@ export function readLearningStatsOffline(dataDir) {
     let db;
     try {
         db = openSqliteDatabase({ dbPath, initSchema: () => undefined });
-        // A store whose outcome_events table is absent (an old/reset db) → honest empty.
+        // A store whose outcome_events table is absent (a reset or partially-initialized db) → honest empty.
         const present = db
             .prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='outcome_events'")
             .get();
@@ -57,9 +56,9 @@ export function readLearningStatsOffline(dataDir) {
         const byOutcome = db
             .prepare("SELECT tenant_id, agent_id, outcome AS key, COUNT(*) AS n FROM outcome_events GROUP BY tenant_id, agent_id, outcome")
             .all();
-        // Per-source volume is counted as DISTINCT trajectories (WR-03), so the figure
+        // Per-source volume is counted as DISTINCT trajectories, so the figure
         // reads as "trajectories carrying a <source> signal" rather than raw rows — a
-        // single trajectory with several same-source rows (the WR-02 per-node residual,
+        // single trajectory with several same-source rows (per-node residual rows,
         // or any future multi-row source) does not inflate it. `totalRows` (the headline)
         // is the sum of these per-source distinct-trajectory counts.
         const bySource = db

package/node_modules/@comis/cli/dist/util/offline-obs.d.ts

@@ -1,6 +1,5 @@
 /**
- * W14 (obs-llm-troubleshooting): OFFLINE assembly for `comis explain` and
- * `comis fleet`.
+ * OFFLINE assembly for `comis explain` and `comis fleet`.
  *
  * The session telemetry these commands read lives on LOCAL disk
  * (`<dataDir>/workspace/sessions/...`, `<dataDir>/logs/...`, `memory.db`), so a
@@ -23,13 +22,14 @@
  */
 import type { FleetHealthReport, IncidentReport } from "@comis/core";
 import type { CostBucketFilter, QuarterHourBucket } from "@comis/memory";
+import type { AuditSummary } from "../support-bundle/types.js";
 /**
  * The CLI's offline data dir. Honors `COMIS_DATA_DIR` (the daemon's + the wizard's
  * data-dir env, `04-oauth-helpers.ts`), falling back to `<homedir>/.comis`. Without the
  * env check, `comis explain --offline` / `comis fleet --offline` read the INVOKING user's
  * home — so running the CLI as a different user than the daemon (or against a non-default
  * `COMIS_DATA_DIR` install) silently reads an empty dir and reports a false "nothing
- * happened" for a session that succeeded (webhook-claude-cli-tdd-20260630-rerun).
+ * happened" for a session that succeeded.
  */
 export declare function resolveOfflineDataDir(): string;
 /** Assemble an IncidentReport from the local data dir without a daemon. */
@@ -41,7 +41,26 @@ export declare function assembleIncidentReportOffline(dataDir: string, params: {
 }): Promise<IncidentReport>;
 /** Assemble a FleetHealthReport from the local data dir without a daemon. */
 export declare function assembleFleetHealthReportOffline(dataDir: string, sinceHours: number): Promise<FleetHealthReport>;
-/** Options for the offline cost-export read (COST-03). */
+/**
+ * Resolve a formatted sessionKey to its REAL session `.jsonl` path offline,
+ * through the single bounded `@comis/daemon` seam.
+ *
+ * The daemon owns the authoritative pointer-discipline resolver
+ * (`resolveSessionFilePath` — the `sessionKeyToPath` fast path plus the on-disk
+ * pointer-`sessionId` fallback for lossy webhook keys). The CLI must NOT rebuild
+ * it: `sessionKeyToPath` lives in the agent package, which cli/src is forbidden
+ * to import (the arch gate), and a hand-built `<dataDir>/sessions/<id>` path never
+ * existed on disk (it shipped two broken readers). This thin wrapper reaches the
+ * daemon export via the same LAZY seam the assemblers use and passes the miss
+ * through as `undefined` — the resolver returns a path ONLY when the session
+ * artifacts exist, so a caller can warn instead of stat-failing a fabricated path.
+ *
+ * @param dataDir - the `~/.comis` root.
+ * @param sessionKey - a formatted SessionKey (`tenant:user:channel[:peer:...]`).
+ * @returns the absolute session `.jsonl` path, or `undefined` on a genuine miss.
+ */
+export declare function resolveSessionFileOffline(dataDir: string, sessionKey: string): Promise<string | undefined>;
+/** Options for the offline cost-export read. */
 export interface CostExportOptions extends CostBucketFilter {
     /** Lower time bound (inclusive), epoch ms. Absent → all time. */
     sinceMs?: number;
@@ -49,11 +68,12 @@ export interface CostExportOptions extends CostBucketFilter {
     granularity: "hourly" | "quarter-hour";
 }
 /**
- * COST-03: read the corrected-cost buckets (with the E1 pricing-coverage column)
+ * Read the corrected-cost buckets (with the pricing-coverage column)
  * from the LOCAL ~/.comis observability store, WITHOUT contacting the daemon —
  * the telemetry lives on disk, so an export must not require a live gateway. This
  * is the `comis cost export` data source (there is no admin aggregate RPC for the
- * quarter-hour buckets yet; a dedicated export RPC is 179-04's, not invented here).
+ * quarter-hour buckets yet; a dedicated export RPC would be a separate addition,
+ * not invented here).
  *
  * The filter (agent/provider/model) + `sinceMs` are passed straight to the store's
  * `aggregateHourlyCost`/`aggregateQuarterHourly`, which bind them as parameters.
@@ -61,3 +81,45 @@ export interface CostExportOptions extends CostBucketFilter {
  * export, never a crash or a fabricated zero-cost bucket).
  */
 export declare function readCostExportOffline(dataDir: string, options: CostExportOptions): Promise<QuarterHourBucket[]>;
+/**
+ * Read the window-scoped audit `{ total, byKind }` from the LOCAL observability
+ * store — the offline support-bundle audit read — WITHOUT the daemon.
+ *
+ * The audit trail must be diagnosable when the daemon is DOWN (when it is most
+ * needed), so this reads the offline store directly (`openObsStoreIfPresent`),
+ * NOT the daemon-required `obs.audit.query` RPC. Aggregation is WINDOW-scoped
+ * across all sessions — every in-window row is counted by its closed `kind`
+ * label with NO traceId narrowing (unlike the per-session `IncidentReport.audit`,
+ * which filters to one session's traceId). Content-free: only the `kind` label
+ * is read, never an `action`/`actor`/`refs` value.
+ *
+ * `total` is bounded by the store's clamped row ceiling; when the read fills a
+ * full page the count is a lower bound, surfaced via `capped`. A missing or
+ * unreadable `memory.db` soft-fails to `undefined` so the caller emits an honest
+ * manifest warning instead of a fabricated zero.
+ *
+ * @param dataDir - the `~/.comis` root.
+ * @param sinceHours - the diagnostic window in hours.
+ * @param nowMs - the caller-stamped generation instant (epoch ms).
+ * @returns the `{ schemaVersion, total, byKind, capped? }` digest, or `undefined`
+ *   when the store is absent/unreadable.
+ */
+export declare function readAuditSummaryOffline(dataDir: string, sinceHours: number, nowMs: number): AuditSummary | undefined;
+/**
+ * The CLI stopgap for a worst-session hint: rank the LOCAL session rollups
+ * CLI-side and return the worst one's key.
+ *
+ * `FleetHealthReport` exposes no worst sessionKey today (only
+ * `autonomy.worstRootRunId`); an authoritative `worstSessions` field is a
+ * deferred daemon-side follow-on. Until then this bounded, tenant/channel-scoped
+ * scan reads each session's `_session-metadata.json` rollup
+ * (`sessionEnd.{ degraded, costUsd }`) and its co-located pointer's `sessionId`
+ * (the verbatim key), ranking degraded sessions first and then by `costUsd`
+ * descending. Every read soft-fails; the scan is hard-capped so a large tree
+ * cannot unbound it. All path composition goes through `safePath`.
+ *
+ * @param dataDir - the `~/.comis` root.
+ * @returns the worst session's formatted key, or `undefined` over an empty or
+ *   unreadable sessions tree.
+ */
+export declare function suggestWorstSessionOffline(dataDir: string): string | undefined;

package/node_modules/@comis/cli/dist/util/offline-obs.js

@@ -1,8 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 // @allow-throw: CLI entry point — errors propagate to Commander error handler.
 /**
- * W14 (obs-llm-troubleshooting): OFFLINE assembly for `comis explain` and
- * `comis fleet`.
+ * OFFLINE assembly for `comis explain` and `comis fleet`.
  *
  * The session telemetry these commands read lives on LOCAL disk
  * (`<dataDir>/workspace/sessions/...`, `<dataDir>/logs/...`, `memory.db`), so a
@@ -26,6 +25,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import { safePath, systemGetEnv, systemNowDate, systemNowMs } from "@comis/core";
+import { resolveTrajectoryPointerFilePath } from "@comis/observability";
 import { createObservabilityStore, openSqliteDatabase, } from "./offline-secrets-store.js";
 /**
  * The CLI's offline data dir. Honors `COMIS_DATA_DIR` (the daemon's + the wizard's
@@ -33,7 +33,7 @@ import { createObservabilityStore, openSqliteDatabase, } from "./offline-secrets
  * env check, `comis explain --offline` / `comis fleet --offline` read the INVOKING user's
  * home — so running the CLI as a different user than the daemon (or against a non-default
  * `COMIS_DATA_DIR` install) silently reads an empty dir and reports a false "nothing
- * happened" for a session that succeeded (webhook-claude-cli-tdd-20260630-rerun).
+ * happened" for a session that succeeded.
  */
 export function resolveOfflineDataDir() {
     return systemGetEnv("COMIS_DATA_DIR") ?? safePath(os.homedir(), ".comis");
@@ -107,7 +107,7 @@ export async function assembleFleetHealthReportOffline(dataDir, sinceHours) {
     const { store, close } = openObsStoreIfPresent(dataDir);
     try {
         return await assembleFleetHealthReport(
-        // FLEET-01/02/04 (Phase 220-03): the offline CLI is daemon-less — there is no
+        // The offline CLI is daemon-less — there is no
         // durable-run store edge here, so pass `durableRuns: undefined` explicitly. The
         // assembler soft-fails and the autonomy block is honestly OMITTED (the documented
         // coverage degradation, NOT a divergence from the RPC/MCP surfaces, which DO wire it).
@@ -118,11 +118,34 @@ export async function assembleFleetHealthReportOffline(dataDir, sinceHours) {
     }
 }
 /**
- * COST-03: read the corrected-cost buckets (with the E1 pricing-coverage column)
+ * Resolve a formatted sessionKey to its REAL session `.jsonl` path offline,
+ * through the single bounded `@comis/daemon` seam.
+ *
+ * The daemon owns the authoritative pointer-discipline resolver
+ * (`resolveSessionFilePath` — the `sessionKeyToPath` fast path plus the on-disk
+ * pointer-`sessionId` fallback for lossy webhook keys). The CLI must NOT rebuild
+ * it: `sessionKeyToPath` lives in the agent package, which cli/src is forbidden
+ * to import (the arch gate), and a hand-built `<dataDir>/sessions/<id>` path never
+ * existed on disk (it shipped two broken readers). This thin wrapper reaches the
+ * daemon export via the same LAZY seam the assemblers use and passes the miss
+ * through as `undefined` — the resolver returns a path ONLY when the session
+ * artifacts exist, so a caller can warn instead of stat-failing a fabricated path.
+ *
+ * @param dataDir - the `~/.comis` root.
+ * @param sessionKey - a formatted SessionKey (`tenant:user:channel[:peer:...]`).
+ * @returns the absolute session `.jsonl` path, or `undefined` on a genuine miss.
+ */
+export async function resolveSessionFileOffline(dataDir, sessionKey) {
+    const { resolveSessionFilePath } = await loadDaemonAssemblers();
+    return resolveSessionFilePath(dataDir, sessionKey);
+}
+/**
+ * Read the corrected-cost buckets (with the pricing-coverage column)
  * from the LOCAL ~/.comis observability store, WITHOUT contacting the daemon —
  * the telemetry lives on disk, so an export must not require a live gateway. This
  * is the `comis cost export` data source (there is no admin aggregate RPC for the
- * quarter-hour buckets yet; a dedicated export RPC is 179-04's, not invented here).
+ * quarter-hour buckets yet; a dedicated export RPC would be a separate addition,
+ * not invented here).
  *
  * The filter (agent/provider/model) + `sinceMs` are passed straight to the store's
  * `aggregateHourlyCost`/`aggregateQuarterHourly`, which bind them as parameters.
@@ -147,3 +170,183 @@ export async function readCostExportOffline(dataDir, options) {
         close();
     }
 }
+/**
+ * The store's own hard row ceiling for an audit query — the read is bounded to
+ * this regardless of audit volume (the store clamps `limit` to it). Kept as a
+ * literal here: `@comis/memory` keeps `MAX_AUDIT_QUERY_LIMIT` internal to its
+ * observability-store barrel, and a re-declared constant that tracks it is a
+ * smaller surface than re-exporting store internals to the CLI.
+ */
+const AUDIT_SUMMARY_QUERY_LIMIT = 1_000;
+/**
+ * Read the window-scoped audit `{ total, byKind }` from the LOCAL observability
+ * store — the offline support-bundle audit read — WITHOUT the daemon.
+ *
+ * The audit trail must be diagnosable when the daemon is DOWN (when it is most
+ * needed), so this reads the offline store directly (`openObsStoreIfPresent`),
+ * NOT the daemon-required `obs.audit.query` RPC. Aggregation is WINDOW-scoped
+ * across all sessions — every in-window row is counted by its closed `kind`
+ * label with NO traceId narrowing (unlike the per-session `IncidentReport.audit`,
+ * which filters to one session's traceId). Content-free: only the `kind` label
+ * is read, never an `action`/`actor`/`refs` value.
+ *
+ * `total` is bounded by the store's clamped row ceiling; when the read fills a
+ * full page the count is a lower bound, surfaced via `capped`. A missing or
+ * unreadable `memory.db` soft-fails to `undefined` so the caller emits an honest
+ * manifest warning instead of a fabricated zero.
+ *
+ * @param dataDir - the `~/.comis` root.
+ * @param sinceHours - the diagnostic window in hours.
+ * @param nowMs - the caller-stamped generation instant (epoch ms).
+ * @returns the `{ schemaVersion, total, byKind, capped? }` digest, or `undefined`
+ *   when the store is absent/unreadable.
+ */
+export function readAuditSummaryOffline(dataDir, sinceHours, nowMs) {
+    const { store, close } = openObsStoreIfPresent(dataDir);
+    try {
+        if (store === undefined)
+            return undefined;
+        const sinceMs = nowMs - sinceHours * 3_600_000;
+        const rows = store.queryAuditEvents({ since: sinceMs, limit: AUDIT_SUMMARY_QUERY_LIMIT });
+        const byKind = {};
+        for (const row of rows) {
+            byKind[row.kind] = (byKind[row.kind] ?? 0) + 1;
+        }
+        return {
+            schemaVersion: 1,
+            total: rows.length,
+            byKind,
+            ...(rows.length === AUDIT_SUMMARY_QUERY_LIMIT ? { capped: true } : {}),
+        };
+    }
+    finally {
+        close();
+    }
+}
+/** The `_session-metadata.json` companion suffix the session manager writes. */
+const SESSION_METADATA_SUFFIX = "_session-metadata.json";
+/**
+ * Runaway backstop on the worst-session scan: at most this many rollups are read.
+ * A tree with more sessions than this loses only the overflow from the ranking.
+ */
+const MAX_SESSION_SCAN = 5_000;
+/**
+ * Extract the pointer's verbatim `sessionId` (the authoritative key record on
+ * disk) from a `<sessionFile>.trajectory-path.json` pointer. Soft-fails to
+ * `undefined` on a missing/corrupt pointer or a failed fence-check.
+ */
+function readPointerSessionId(pointerPath) {
+    let pointer;
+    try {
+        pointer = JSON.parse(fs.readFileSync(pointerPath, "utf-8"));
+    }
+    catch {
+        return undefined; // Missing/corrupt pointer — soft-fail.
+    }
+    const sessionId = pointer["sessionId"];
+    if (pointer["traceSchema"] === "comis-trajectory-pointer" &&
+        typeof sessionId === "string" &&
+        sessionId.length > 0) {
+        return sessionId;
+    }
+    return undefined;
+}
+/**
+ * Read the `sessionEnd.{ degraded, costUsd }` rollup from a
+ * `_session-metadata.json` companion. Soft-fails to `undefined` on a
+ * missing/corrupt file or an absent `sessionEnd`; a missing `costUsd` reads as 0.
+ */
+function readSessionEndRollup(metadataPath) {
+    let meta;
+    try {
+        meta = JSON.parse(fs.readFileSync(metadataPath, "utf-8"));
+    }
+    catch {
+        return undefined; // Missing/corrupt rollup — soft-fail.
+    }
+    const sessionEnd = meta["sessionEnd"];
+    if (sessionEnd === null || typeof sessionEnd !== "object")
+        return undefined;
+    const end = sessionEnd;
+    const costUsd = typeof end["costUsd"] === "number" ? end["costUsd"] : 0;
+    return { degraded: end["degraded"] === true, costUsd };
+}
+/** True when `candidate` ranks worse than `best`: degraded first, then costUsd desc. */
+function rollupRanksWorse(candidate, best) {
+    if (candidate.degraded !== best.degraded)
+        return candidate.degraded;
+    return candidate.costUsd > best.costUsd;
+}
+/**
+ * The CLI stopgap for a worst-session hint: rank the LOCAL session rollups
+ * CLI-side and return the worst one's key.
+ *
+ * `FleetHealthReport` exposes no worst sessionKey today (only
+ * `autonomy.worstRootRunId`); an authoritative `worstSessions` field is a
+ * deferred daemon-side follow-on. Until then this bounded, tenant/channel-scoped
+ * scan reads each session's `_session-metadata.json` rollup
+ * (`sessionEnd.{ degraded, costUsd }`) and its co-located pointer's `sessionId`
+ * (the verbatim key), ranking degraded sessions first and then by `costUsd`
+ * descending. Every read soft-fails; the scan is hard-capped so a large tree
+ * cannot unbound it. All path composition goes through `safePath`.
+ *
+ * @param dataDir - the `~/.comis` root.
+ * @returns the worst session's formatted key, or `undefined` over an empty or
+ *   unreadable sessions tree.
+ */
+export function suggestWorstSessionOffline(dataDir) {
+    const sessionsBase = safePath(dataDir, "workspace", "sessions");
+    let tenants;
+    try {
+        tenants = fs.readdirSync(sessionsBase, { withFileTypes: true });
+    }
+    catch {
+        return undefined; // No sessions tree — soft-fail.
+    }
+    let best;
+    let scanned = 0;
+    for (const tenant of tenants) {
+        if (!tenant.isDirectory())
+            continue;
+        const tenantDir = safePath(sessionsBase, tenant.name);
+        let channels;
+        try {
+            channels = fs.readdirSync(tenantDir, { withFileTypes: true });
+        }
+        catch {
+            continue; // Unreadable tenant dir — skip.
+        }
+        for (const channel of channels) {
+            if (!channel.isDirectory())
+                continue;
+            const channelDir = safePath(tenantDir, channel.name);
+            let entries;
+            try {
+                entries = fs.readdirSync(channelDir);
+            }
+            catch {
+                continue; // Unreadable channel dir — skip.
+            }
+            for (const name of entries) {
+                if (!name.endsWith(SESSION_METADATA_SUFFIX))
+                    continue;
+                if (scanned >= MAX_SESSION_SCAN)
+                    return best?.sessionKey; // Runaway backstop.
+                scanned++;
+                // Session file basename: `<base>_session-metadata.json` → `<base>.jsonl`.
+                const base = name.slice(0, -SESSION_METADATA_SUFFIX.length);
+                const sessionFile = safePath(channelDir, `${base}.jsonl`);
+                const sessionKey = readPointerSessionId(resolveTrajectoryPointerFilePath(sessionFile));
+                if (sessionKey === undefined)
+                    continue; // No authoritative key on disk.
+                const rollup = readSessionEndRollup(safePath(channelDir, name));
+                if (rollup === undefined)
+                    continue;
+                const candidate = { sessionKey, degraded: rollup.degraded, costUsd: rollup.costUsd };
+                if (best === undefined || rollupRanksWorse(candidate, best))
+                    best = candidate;
+            }
+        }
+    }
+    return best?.sessionKey;
+}

package/node_modules/@comis/cli/dist/util/offline-secrets-store.js

@@ -12,13 +12,13 @@
 import { offlineSecretSet as _offlineSecretSet, offlineSecretsList as _offlineSecretsList, offlineSecretGet as _offlineSecretGet, offlineOAuthProfileSet as _offlineOAuthProfileSet, openSqliteDatabase as _openSqliteDatabase, createObservabilityStore as _createObservabilityStore, } from "@comis/memory";
 export const offlineSecretSet = _offlineSecretSet;
 export const offlineSecretsList = _offlineSecretsList;
-// W15: daemon-free decrypted read — breaks the gateway-token chicken-and-egg
-// (`secrets get COMIS_GATEWAY_TOKEN` needed the RPC that needed the token).
+// Daemon-free decrypted read — breaks the gateway-token chicken-and-egg
+// (`secrets get COMIS_GATEWAY_TOKEN` would need the RPC that needs the token).
 export const offlineSecretGet = _offlineSecretGet;
 // OAuth profiles collected during `comis init` (encrypted mode, daemon down)
 // are sealed into secrets.db through this same L11-allowed re-open site.
 export const offlineOAuthProfileSet = _offlineOAuthProfileSet;
-// W14 (obs-llm-troubleshooting): the offline obs fallback opens the local
+// The offline obs fallback opens the local
 // memory.db (WAL — concurrent with a live daemon) to feed the daemon's pure
 // report assemblers when the gateway is unreachable. Same L11 seam: this file
 // remains the ONLY @comis/cli → @comis/memory import site.

package/node_modules/@comis/cli/dist/util/offline-skills.d.ts

@@ -1,6 +1,5 @@
 /**
- * OBS-02 (Phase 201, P2 skills shadow): OFFLINE procedural-learning telemetry
- * for `comis memory skills`.
+ * OFFLINE procedural-learning telemetry for `comis memory skills`.
  *
  * The learned-skill funnel (the `kind='skill'` rows of `mental_models`) lives in
  * the local `~/.comis/memory.db`, so reading it must not require a live gateway —
@@ -10,12 +9,12 @@
  * offline `@comis/memory` read is the sanctioned path — CLI→@comis/memory +
  * better-sqlite3 are already allowed edges.
  *
- * COUNTS/IDS ONLY (T-201-44): the SELECT projects `name` (the skill id) +
+ * COUNTS/IDS ONLY: the SELECT projects `name` (the skill id) +
  * `state`/`proof_count`/`confidence`/`mutating` (closed enum + counts/booleans) +
  * the `(tenant_id, agent_id)` scope — and NEVER `body`, `structured_body`,
  * `history`, `description`, `params_schema`, `required_tools`, `source_traj_ids`,
  * or `validation_result` (the doc-body columns). A body never crosses into the
- * CLI output (SEC-01). The db is opened in WAL mode (concurrent with a live
+ * CLI output. The db is opened in WAL mode (concurrent with a live
  * daemon) and ONLY when the file already exists — the offline read never creates
  * it; a missing/unreadable/empty store soft-fails to `undefined` so the command
  * prints an honest "no learned skills" default-off message instead of a misleading
@@ -61,13 +60,13 @@ export interface SkillStats {
     /** Row counts per closed-enum state, store-wide. */
     byState: Record<string, number>;
     /**
-     * Promotion roll-up (SURFACE-06) — the count of skills that reached `active`
+     * Promotion roll-up — the count of skills that reached `active`
      * (= `byState.active`). DERIVED from the existing `byState` tally: a count,
      * NEVER a body. The funnel's "how many candidates were promoted" lens.
      */
     promoted: number;
     /**
-     * Demotion roll-up (SURFACE-06) — the count of skills that left `active` for
+     * Demotion roll-up — the count of skills that left `active` for
      * `stale`/`archived` (= `byState.stale` + `byState.archived`). DERIVED from
      * `byState`: a count, never a body. The "how many were demoted" lens.
      */

package/node_modules/@comis/cli/dist/util/offline-skills.js

@@ -1,8 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 // @allow-throw: CLI entry point — errors propagate to the Commander error handler.
 /**
- * OBS-02 (Phase 201, P2 skills shadow): OFFLINE procedural-learning telemetry
- * for `comis memory skills`.
+ * OFFLINE procedural-learning telemetry for `comis memory skills`.
  *
  * The learned-skill funnel (the `kind='skill'` rows of `mental_models`) lives in
  * the local `~/.comis/memory.db`, so reading it must not require a live gateway —
@@ -12,12 +11,12 @@
  * offline `@comis/memory` read is the sanctioned path — CLI→@comis/memory +
  * better-sqlite3 are already allowed edges.
  *
- * COUNTS/IDS ONLY (T-201-44): the SELECT projects `name` (the skill id) +
+ * COUNTS/IDS ONLY: the SELECT projects `name` (the skill id) +
  * `state`/`proof_count`/`confidence`/`mutating` (closed enum + counts/booleans) +
  * the `(tenant_id, agent_id)` scope — and NEVER `body`, `structured_body`,
  * `history`, `description`, `params_schema`, `required_tools`, `source_traj_ids`,
  * or `validation_result` (the doc-body columns). A body never crosses into the
- * CLI output (SEC-01). The db is opened in WAL mode (concurrent with a live
+ * CLI output. The db is opened in WAL mode (concurrent with a live
  * daemon) and ONLY when the file already exists — the offline read never creates
  * it; a missing/unreadable/empty store soft-fails to `undefined` so the command
  * prints an honest "no learned skills" default-off message instead of a misleading
@@ -69,7 +68,7 @@ export function readSkillStatsOffline(dataDir) {
     let db;
     try {
         db = openSqliteDatabase({ dbPath, initSchema: () => undefined });
-        // A store whose mental_models table is absent (an old/reset db) → honest empty.
+        // A store whose mental_models table is absent (a reset or partially-initialized db) → honest empty.
         const present = db
             .prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='mental_models'")
             .get();
@@ -78,7 +77,7 @@ export function readSkillStatsOffline(dataDir) {
         // Counts/ids projection ONLY — name is the id; state/proof_count/confidence/
         // mutating are closed-enum/counts/booleans. NO body/structured_body/description/etc.
         // Scoped to kind='skill' — the `comis memory skills` verb is the learned-skill
-        // lens onto the kind-generic mental_models store (D-02: surface stays skill-flavored).
+        // lens onto the kind-generic mental_models store (the surface stays skill-flavored).
         const rows = db
             .prepare("SELECT tenant_id, agent_id, name, state, proof_count, confidence, mutating " +
             "FROM mental_models WHERE kind = 'skill' ORDER BY tenant_id, agent_id, name")
@@ -114,7 +113,7 @@ export function readSkillStatsOffline(dataDir) {
         }
         if (total === 0)
             return undefined; // every row dropped (all off-vocabulary) → honest empty
-        // Derive the promotion/demotion roll-ups (SURFACE-06) from the per-state
+        // Derive the promotion/demotion roll-ups from the per-state
         // tallies — counts only, no new SELECT columns, no body egress.
         const perAgent = [...byAgent.values()];
         for (const a of perAgent) {

package/node_modules/@comis/cli/dist/wizard/index.d.ts

@@ -3,12 +3,9 @@
  *
  * Barrel file re-exporting all types, constants, classes, functions,
  * and validators that make up the init wizard. Consuming code (the
- * init command, tests, future phases) imports from this single entry
+ * init command, tests, future callers) imports from this single entry
  * point rather than reaching into individual wizard files.
  *
- * Legacy wizard files (flow-types.ts, quickstart-flow.ts, manual-flow.ts,
- * config-writer.ts) were removed -- superseded by the step-based architecture.
- *
  * @module
  */
 export type { FlowType, WizardStepId, WizardState, WizardStep, WizardResult, WizardError, ValidationResult, AuthMethod, ChannelConfig, GatewayConfig, ProviderConfig, ToolProviderConfig, SupportedToolProvider, VideoProviderConfig, SupportedVideoProvider, ImageProviderConfig, SupportedImageProvider, TranscriptionProviderConfig, SupportedTranscriptionProvider, TtsProviderConfig, SupportedTtsProvider, } from "./types.js";

package/node_modules/@comis/cli/dist/wizard/index.js

@@ -4,12 +4,9 @@
  *
  * Barrel file re-exporting all types, constants, classes, functions,
  * and validators that make up the init wizard. Consuming code (the
- * init command, tests, future phases) imports from this single entry
+ * init command, tests, future callers) imports from this single entry
  * point rather than reaching into individual wizard files.
  *
- * Legacy wizard files (flow-types.ts, quickstart-flow.ts, manual-flow.ts,
- * config-writer.ts) were removed -- superseded by the step-based architecture.
- *
  * @module
  */
 export { INITIAL_STATE, SUPPORTED_CHANNELS, SUPPORTED_TOOL_PROVIDERS, SUPPORTED_VIDEO_PROVIDERS, SUPPORTED_IMAGE_PROVIDERS, SUPPORTED_TRANSCRIPTION_PROVIDERS, SUPPORTED_TTS_PROVIDERS, PROVIDER_ENV_KEYS, CHANNEL_ENV_KEYS, TOOL_PROVIDER_ENV_KEYS, VIDEO_PROVIDER_ENV_KEYS, IMAGE_PROVIDER_ENV_KEYS, TRANSCRIPTION_PROVIDER_ENV_KEYS, TTS_PROVIDER_ENV_KEYS, } from "./types.js";

package/node_modules/@comis/cli/dist/wizard/non-interactive.d.ts

@@ -37,6 +37,10 @@ export type NonInteractiveOptions = {
     slackAppToken?: string;
     lineToken?: string;
     lineSecret?: string;
+    msteamsAppId?: string;
+    msteamsAppPassword?: string;
+    msteamsTenantId?: string;
+    msteamsAuthMode?: "secret" | "certificate" | "managedIdentity";
     imageProvider?: string;
     imageApiKey?: string;
     videoProvider?: string;