comisai 1.0.45 → 1.0.46

package/node_modules/@comis/daemon/dist/wiring/setup-terminal-tools.d.ts

@@ -16,13 +16,15 @@
  * architecture cap. State (the per-agent registry map) lives in the `setupTools`
  * closure and is threaded in here — there is NO module-global mutable state.
  *
- * Fail-closed by construction at this stage: the operator
- * `TerminalDriverConfig.allow[]` is not yet threaded into `PerAgentConfig` (that
- * config-plumbing + the worker process entrypoint are later work), so
- * the wired allow-set is EMPTY — every `terminal_session_create` is rejected by
- * the allowlist gate (`matchAllowEntry` returns undefined) before any worker is
- * spawned. The surface is live + governed; the worker is never spawned until both
- * the allow-set and the worker main land. The seam is clean.
+ * Fail-closed by construction, config-gated:
+ * `buildTerminalSharedDeps` populates the allow-set from the threaded operator config
+ * (`deps.config?.allow.map(mapAllowEntry)`) and the production worker-spawn posture is
+ * wired, so a `terminal_session_create` matching an allowlisted binary spawns a jailed
+ * worker. When an agent has NO `skills.terminal` config (or an empty `allow[]`), the
+ * wired allow-set is EMPTY and every create is rejected by the allowlist gate
+ * (`matchAllowEntry` returns undefined) before any worker is spawned — the
+ * fail-closed posture for an unconfigured agent. The surface is always live + governed;
+ * a worker spawns only for an operator-allowlisted entry.
  *
  * @module
  */
@@ -109,13 +111,13 @@ export interface TerminalWiringDeps {
      */
     readonly caps?: SessionCaps;
     /**
-     * The parsed operator terminal-driver config (124-09 — the WR-01 closure). When present,
+     * The parsed operator terminal-driver config. When present,
      * `config.allow` POPULATES the per-agent allow-set (`config.allow.map(mapAllowEntry)`) so
      * the create gate matches an allowlisted binary + the per-session caps go live; the
      * mapped `scope`/`approveOnCreate`/`limits` ride the create frame, and `autoAnswer`/
      * `hintPatterns`/`backend` are consumed by the wake-FSM woken turn (auto-answer policy)
      * + the worker (backend selection). Absent ⇒ the wired allow-set is EMPTY (every create
-     * fail-closes) — the pre-P5 posture.
+     * fail-closes) — the fail-closed posture for an unconfigured agent.
      */
     readonly config?: TerminalDriverConfig;
 }
@@ -141,7 +143,7 @@ export declare function mapAllowEntry(entry: TerminalAllowEntry): AllowEntryLike
  * mirrors the `onSpawnFailed` template. `onEvict` closes the observability loop on
  * EVERY reaped session: it emits `terminal:session_evicted` (the audited reason) +
  * `terminal:session_state` (state→`lost`, the lifecycle transition) + a WARN
- * (`hint` + `errorKind: "resource"`, §2.7) — so a reap is reconstructable from
+ * (`hint` + `errorKind: "resource"`) — so a reap is reconstructable from
  * logs+events alone. `onCapForget` is wired to the shared `caps.forget` so the
  * per-session cap state is dropped on the reap path (no SessionCaps Map
  * leak). Exported so the audit wiring is unit-testable in isolation.
@@ -151,26 +153,26 @@ export declare function buildTerminalReaperHooks(agentId: string, deps: Terminal
     onCapForget: (sessionId: string) => void;
 };
 /**
- * Build the daemon-side fd3 attention emit hook for one agent (124-09 Task 1; TR-11 /
- * SEC-11/12 / OPS-04) — the 3rd emit-hook site, mirroring {@link buildTerminalReaperHooks}
+ * Build the daemon-side fd3 attention emit hook for one agent — the 3rd emit-hook site,
+ * mirroring {@link buildTerminalReaperHooks}
  * + the `onSpawnFailed` template. The returned `onTerminalEvent` closure is bound on the
  * registry deps (next to `onSpawnFailed`): for each decoded {@link TerminalEventFrame} the
- * worker pushes on fd3 (124-05, the no-poll attention channel), it RE-PUBLISHES the frame
+ * worker pushes on fd3 (the no-poll attention channel), it RE-PUBLISHES the frame
  * onto the daemon's `TypedEventBus` as the matching closed `terminal:*` event — injecting
  * `agentId` (the worker is owner-agnostic) + `timestamp` and copying ONLY the structural
- * fields off `frame.payload`. This is the re-publish seam the wake-FSM (Task 2) subscribes.
+ * fields off `frame.payload`. This is the re-publish seam the wake-FSM subscribes.
  *
- * REDACTION-SAFE BY CONSTRUCTION (T-124-25): the hook copies ONLY the typed structural
+ * REDACTION-SAFE BY CONSTRUCTION: the hook copies ONLY the typed structural
  * fields per event (`state`/`reason`/`noProgressMs`) — a `screen`/`text`/`payload` field
  * on the worker frame is NEVER read, so screen text physically cannot cross the bus. The
- * worker frame is already redaction-safe (124-05); this is defense-in-depth.
+ * worker frame is already redaction-safe; this is defense-in-depth.
  *
- * §2.7 observability: a wake (`input_needed`) is an INFO completion-style line (step-
+ * Observability: a wake (`input_needed`) is an INFO completion-style line (step-
  * tagged); an `escalated` frame is a WARN carrying `hint` + `errorKind` so the next
  * escalation is reconstructable from logs+events alone. An unknown/unmodeled event kind
  * is dropped (no emit, no throw) — the hook never forwards an unmodeled frame.
  *
- * Exported so the re-publish wiring is unit-testable in isolation (Task 1).
+ * Exported so the re-publish wiring is unit-testable in isolation.
  */
 export declare function buildTerminalEventHook(agentId: string, deps: TerminalWiringDeps): {
     onTerminalEvent: (frame: TerminalEventFrame) => void;
@@ -229,18 +231,18 @@ export interface TerminalWiringBaseDeps {
      * The resolved per-agent workspace dir (`workspaceDirs.get(agentId) ?? default`,
      * the same dir the agent's read/write/exec tools use). When present, the registry
      * roots each session in `<agentWorkspaceDir>/projects` (PERSISTENT, no-op cleanup)
-     * instead of a throwaway `/tmp` dir — so a driven milestone's work survives the
+     * instead of a throwaway `/tmp` dir — so a driven build's work survives the
      * session and the agent can see it. Absent ⇒ the ephemeral default (test paths).
      */
     readonly agentWorkspaceDir?: string;
 }
 /**
- * Fold the per-agent operator terminal config onto the base wiring deps (124-09 — the
- * WR-01 closure call-site helper). Derives `workerCaps` from `config.worker.{maxSessions,
+ * Fold the per-agent operator terminal config onto the base wiring deps. Derives
+ * `workerCaps` from `config.worker.{maxSessions,
  * idleTtlMs,stuckMs}` (so the reaper composes when `timers` is present + maxSessions > 0)
  * and threads `config` (so `buildTerminalSharedDeps` populates the allow-set + per-session
  * caps). When `config` is absent the result has no `config`/`workerCaps` ⇒ the wiring
- * fail-closes (empty allow-set, no reaper) — the pre-P5 posture for an unconfigured agent.
+ * fail-closes (empty allow-set, no reaper) — the fail-closed posture for an unconfigured agent.
  *
  * `wallClockMs` is sourced as 0 at the registry/reaper level (the per-ENTRY
  * `limits.wallClockMs` is the operative wall-clock budget, enforced per-send via the caps;
@@ -276,7 +278,7 @@ export declare function buildTerminalSharedDeps(registries: Map<string, Terminal
     caps: SessionCaps;
 };
 /**
- * The per-agent attention config the wake-FSM woken turn reads (124-09 Task 2). Derived
+ * The per-agent attention config the wake-FSM woken turn reads. Derived
  * from the operator terminal config: the `autoAnswer`/`hintPatterns` come from the MATCHED
  * allow-entry (the forcing use case is a single entry per agent — the first entry's policy),
  * and the FSM caps from `worker.maxConcurrentAttentionTurns`. Operator-dialable ONLY (never
@@ -298,7 +300,7 @@ export declare function deriveTerminalAttentionConfig(config: TerminalDriverConf
  * calls — folds the base deps + the operator config into the registry + nine tools in ONE
  * call, keeping `setup-tools.ts` under its 800-line cap. `buildTerminalWiringDeps` folds the
  * operator config (allow-set + caps + reaper + autoAnswer/backend; absent ⇒ empty set + no
- * reaper); the 165-07 durability (descriptor store + has-session probe + isBusy + recover-on-
+ * reaper); the durability (descriptor store + has-session probe + isBusy + recover-on-
  * boot hooks) is wired inside `getOrCreateTerminalRegistry`.
  */
 export declare function wireAgentTerminalTools(tools: AgentToolArray, registries: Map<string, TerminalSessionRegistry>, agentId: string, base: TerminalWiringBaseDeps, config: TerminalDriverConfig | undefined): void;

package/node_modules/@comis/daemon/dist/wiring/setup-terminal-tools.js

@@ -17,13 +17,15 @@
  * architecture cap. State (the per-agent registry map) lives in the `setupTools`
  * closure and is threaded in here — there is NO module-global mutable state.
  *
- * Fail-closed by construction at this stage: the operator
- * `TerminalDriverConfig.allow[]` is not yet threaded into `PerAgentConfig` (that
- * config-plumbing + the worker process entrypoint are later work), so
- * the wired allow-set is EMPTY — every `terminal_session_create` is rejected by
- * the allowlist gate (`matchAllowEntry` returns undefined) before any worker is
- * spawned. The surface is live + governed; the worker is never spawned until both
- * the allow-set and the worker main land. The seam is clean.
+ * Fail-closed by construction, config-gated:
+ * `buildTerminalSharedDeps` populates the allow-set from the threaded operator config
+ * (`deps.config?.allow.map(mapAllowEntry)`) and the production worker-spawn posture is
+ * wired, so a `terminal_session_create` matching an allowlisted binary spawns a jailed
+ * worker. When an agent has NO `skills.terminal` config (or an empty `allow[]`), the
+ * wired allow-set is EMPTY and every create is rejected by the allowlist gate
+ * (`matchAllowEntry` returns undefined) before any worker is spawned — the
+ * fail-closed posture for an unconfigured agent. The surface is always live + governed;
+ * a worker spawns only for an operator-allowlisted entry.
  *
  * @module
  */
@@ -86,13 +88,13 @@ function resolveWorkerJsPath(_dataDir) {
     return resolveWorkerMainPath();
 }
 /**
- * RECUR-03 (option A, per-generation tmux server): this daemon generation's PER-BOOT tmux `-S`
+ * A per-generation tmux server: this daemon generation's PER-BOOT tmux `-S`
  * socket — `<dataDir>/terminal-worker/tmux-<daemonPid>.sock`. MEMOIZED so EVERY agent's registry
  * (the descriptor/handle stamp) AND the worker (`COMIS_TERMINAL_TMUX_SOCKET`) share ONE socket per
  * daemon process. Keyed on the daemon PID: stable for the daemon's life (so a worker respawn reuses
  * it), unique per restart (a new daemon PID → a new socket). So a restart's NEW sessions are created
  * on a fresh server in the LIVE mount namespace — a stranded prior-generation ns (PrivateTmp/
- * ProtectHome + KillMode=process, RECUR-02) never breaks new bwrap sessions — while a surviving
+ * ProtectHome + KillMode=process) never breaks new bwrap sessions — while a surviving
  * durable re-attaches from its OWN (prior-boot) socket recorded on its descriptor.
  */
 let cachedBootTmuxSocket;
@@ -107,7 +109,7 @@ function bootTmuxSocketPath(dataDir) {
  * mirrors the `onSpawnFailed` template. `onEvict` closes the observability loop on
  * EVERY reaped session: it emits `terminal:session_evicted` (the audited reason) +
  * `terminal:session_state` (state→`lost`, the lifecycle transition) + a WARN
- * (`hint` + `errorKind: "resource"`, §2.7) — so a reap is reconstructable from
+ * (`hint` + `errorKind: "resource"`) — so a reap is reconstructable from
  * logs+events alone. `onCapForget` is wired to the shared `caps.forget` so the
  * per-session cap state is dropped on the reap path (no SessionCaps Map
  * leak). Exported so the audit wiring is unit-testable in isolation.
@@ -125,26 +127,26 @@ export function buildTerminalReaperHooks(agentId, deps) {
     };
 }
 /**
- * Build the daemon-side fd3 attention emit hook for one agent (124-09 Task 1; TR-11 /
- * SEC-11/12 / OPS-04) — the 3rd emit-hook site, mirroring {@link buildTerminalReaperHooks}
+ * Build the daemon-side fd3 attention emit hook for one agent — the 3rd emit-hook site,
+ * mirroring {@link buildTerminalReaperHooks}
  * + the `onSpawnFailed` template. The returned `onTerminalEvent` closure is bound on the
  * registry deps (next to `onSpawnFailed`): for each decoded {@link TerminalEventFrame} the
- * worker pushes on fd3 (124-05, the no-poll attention channel), it RE-PUBLISHES the frame
+ * worker pushes on fd3 (the no-poll attention channel), it RE-PUBLISHES the frame
  * onto the daemon's `TypedEventBus` as the matching closed `terminal:*` event — injecting
  * `agentId` (the worker is owner-agnostic) + `timestamp` and copying ONLY the structural
- * fields off `frame.payload`. This is the re-publish seam the wake-FSM (Task 2) subscribes.
+ * fields off `frame.payload`. This is the re-publish seam the wake-FSM subscribes.
  *
- * REDACTION-SAFE BY CONSTRUCTION (T-124-25): the hook copies ONLY the typed structural
+ * REDACTION-SAFE BY CONSTRUCTION: the hook copies ONLY the typed structural
  * fields per event (`state`/`reason`/`noProgressMs`) — a `screen`/`text`/`payload` field
  * on the worker frame is NEVER read, so screen text physically cannot cross the bus. The
- * worker frame is already redaction-safe (124-05); this is defense-in-depth.
+ * worker frame is already redaction-safe; this is defense-in-depth.
  *
- * §2.7 observability: a wake (`input_needed`) is an INFO completion-style line (step-
+ * Observability: a wake (`input_needed`) is an INFO completion-style line (step-
  * tagged); an `escalated` frame is a WARN carrying `hint` + `errorKind` so the next
  * escalation is reconstructable from logs+events alone. An unknown/unmodeled event kind
  * is dropped (no emit, no throw) — the hook never forwards an unmodeled frame.
  *
- * Exported so the re-publish wiring is unit-testable in isolation (Task 1).
+ * Exported so the re-publish wiring is unit-testable in isolation.
  */
 export function buildTerminalEventHook(agentId, deps) {
     return {
@@ -155,24 +157,24 @@ export function buildTerminalEventHook(agentId, deps) {
             const p = (frame.payload ?? {});
             switch (frame.event) {
                 case "terminal:input_needed": {
-                    // The attention wake (TR-11). state ∈ {awaiting-input, stuck}; reason is the
+                    // The attention wake. state ∈ {awaiting-input, stuck}; reason is the
                     // classifier's structural tag (e.g. "settled_cursor_parked") — never screen text.
                     const state = p.state === "stuck" ? "stuck" : "awaiting-input";
                     const reason = typeof p.reason === "string" ? p.reason : "input_needed";
-                    // CLASS-02: the classifier confidence rides the wake event (for the autonomous
-                    // policy 164–166 + a future `comis explain`). Read DEFENSIVELY off the untrusted
-                    // frame (T-163-11) — an out-of-enum value falls back to "medium", never raw.
+                    // The classifier confidence rides the wake event (for the autonomous
+                    // policy + a future `comis explain`). Read DEFENSIVELY off the untrusted
+                    // frame — an out-of-enum value falls back to "medium", never raw.
                     const confidence = p.confidence === "high" || p.confidence === "medium" ? p.confidence : "medium";
                     deps.eventBus.emit("terminal:input_needed", { sessionId: frame.sessionId, agentId, state, reason, confidence, timestamp });
                     deps.skillsLogger.info({ sessionId: frame.sessionId, agentId, state, reason, confidence, step: "terminal_input_needed" }, "terminal session needs input (re-published from fd3)");
                     break;
                 }
                 case "terminal:stuck": {
-                    // Settled, no affordance, no progress past stuckMs (OPS-04) — a duration signal.
+                    // Settled, no affordance, no progress past stuckMs — a duration signal.
                     const noProgressMs = typeof p.noProgressMs === "number" ? p.noProgressMs : 0;
-                    // CLASS-02: stuck now carries the classifier reason + confidence (observability
-                    // symmetry with input_needed). Both read DEFENSIVELY off the untrusted frame
-                    // (T-163-11), mirroring the existing noProgressMs narrow — never a raw value.
+                    // stuck carries the classifier reason + confidence (observability
+                    // symmetry with input_needed). Both read DEFENSIVELY off the untrusted frame,
+                    // mirroring the existing noProgressMs narrow — never a raw value.
                     const reason = typeof p.reason === "string" ? p.reason : "no_progress";
                     const confidence = p.confidence === "high" || p.confidence === "medium" ? p.confidence : "medium";
                     deps.eventBus.emit("terminal:stuck", { sessionId: frame.sessionId, agentId, noProgressMs, reason, confidence, timestamp });
@@ -186,7 +188,7 @@ export function buildTerminalEventHook(agentId, deps) {
                     break;
                 }
                 case "terminal:escalated": {
-                    // An escalation audit (SEC-11/12). Typed closed reason ONLY; the prompt rides the LOG.
+                    // An escalation audit. Typed closed reason ONLY; the prompt rides the LOG.
                     const reason = ESCALATION_REASONS.has(p.reason) ? p.reason : "no_safe_match";
                     deps.eventBus.emit("terminal:escalated", { sessionId: frame.sessionId, agentId, reason, timestamp });
                     deps.skillsLogger.warn({
@@ -199,7 +201,7 @@ export function buildTerminalEventHook(agentId, deps) {
                     break;
                 }
                 case "terminal:auto_answered": {
-                    // A safe-pattern answer was sent (SEC-12): the matched index + keystroke COUNT only.
+                    // A safe-pattern answer was sent: the matched index + keystroke COUNT only.
                     const matchedPatternIndex = typeof p.matchedPatternIndex === "number" ? p.matchedPatternIndex : -1;
                     const keystrokeCount = typeof p.keystrokeCount === "number" ? p.keystrokeCount : 0;
                     deps.eventBus.emit("terminal:auto_answered", { sessionId: frame.sessionId, agentId, matchedPatternIndex, keystrokeCount, timestamp });
@@ -224,9 +226,9 @@ function getOrCreateTerminalRegistry(registries, agentId, deps, caps) {
         // Thread the SHARED per-agent caps instance into the reaper hooks so onCapForget
         // forgets the SAME cap-state map the tool deps consume (one instance for both).
         const reaperHooks = buildTerminalReaperHooks(agentId, { ...deps, caps });
-        // DUR-01 / ENDURE-01 (165-07): the per-agent durability wiring — the descriptor store +
-        // has-session probe + recover/unrecoverable hooks (the registry's recover-on-boot, 165-06)
-        // + the reaper isBusy idle-exclusion predicate (165-08's seam, bound to busyOrHung). The
+        // The per-agent durability wiring — the descriptor store +
+        // has-session probe + recover/unrecoverable hooks (the registry's recover-on-boot)
+        // + the reaper isBusy idle-exclusion predicate (bound to busyOrHung). The
         // isBusy reads the live handle via the registries map (resolved by agentId at sweep time);
         // it is constructed BEFORE the registry but only invoked AFTER it is in the map (the reaper
         // sweep runs on a timer post-construction), so the lazy `registries.get(agentId)` resolves.
@@ -247,7 +249,7 @@ function getOrCreateTerminalRegistry(registries, agentId, deps, caps) {
         const agentWs = deps.agentWorkspaceDir;
         registry = createTerminalSessionRegistry({
             spawnWorker: buildProductionSpawnWorker(resolveWorkerJsPath(deps.dataDir), deps.dataDir, bootTmuxSocketPath(deps.dataDir)),
-            // RECUR-03: stamp this boot's per-boot socket on durable handles/descriptors (MUST match the
+            // Stamp this boot's per-boot socket on durable handles/descriptors (MUST match the
             // worker's COMIS_TERMINAL_TMUX_SOCKET above — both from bootTmuxSocketPath).
             currentTmuxSocket: bootTmuxSocketPath(deps.dataDir),
             logger: deps.skillsLogger,
@@ -260,7 +262,7 @@ function getOrCreateTerminalRegistry(registries, agentId, deps, caps) {
             egressControl: deps.egressControl,
             // Agent-workspace persistence: root each session in the agent's OWN workspace
             // (`<agentWorkspaceDir>/projects`) with a NO-OP cleanup, so a driven session's
-            // work (e.g. a full GSD milestone's app) survives the session end and the agent
+            // work (e.g. a full multi-hour build) survives the session end and the agent
             // sees it under its workspace — instead of a throwaway /tmp dir rm'd on kill.
             // `buildScopeArgs` re-binds ONLY this subtree RW after the ~/.comis carve-out,
             // so the agent's secrets + its other workspace files stay masked in the jail.
@@ -286,12 +288,12 @@ function getOrCreateTerminalRegistry(registries, agentId, deps, caps) {
                     timestamp: systemNowMs(),
                 });
             },
-            // 124-09 (TR-11): re-publish each fd3 attention frame (terminal:input_needed /
+            // Re-publish each fd3 attention frame (terminal:input_needed /
             // stuck / session_state / escalated / auto_answered) onto the TypedEventBus —
-            // the no-poll seam the wake-FSM (setup-terminal-wake.ts) subscribes. The HR-02
+            // the no-poll seam the wake-FSM (setup-terminal-wake.ts) subscribes. The frame-integrity
             // guard runs BEFORE this; a corrupt frame drops the worker and never reaches it.
             onTerminalEvent: buildTerminalEventHook(agentId, deps).onTerminalEvent,
-            // P4 (TR-06/OPS-06): the reaper caps + TimerPort + the audited eviction hooks.
+            // The reaper caps + TimerPort + the audited eviction hooks.
             // worker.{maxSessions,idleTtlMs} + the entry limits.wallClockMs (0 while the
             // allow-set is empty) bound the per-agent session footprint; onCapForget wires
             // caps.forget so the cap-state map is dropped on EVERY reap path.
@@ -301,14 +303,14 @@ function getOrCreateTerminalRegistry(registries, agentId, deps, caps) {
             timers: deps.timers,
             onEvict: reaperHooks.onEvict,
             onCapForget: reaperHooks.onCapForget,
-            // ENDURE-01 / I9 (165-08's seam): the alive-busy idle-exclusion predicate (bound to
+            // The alive-busy idle-exclusion predicate (bound to
             // busyOrHung). A quiet-but-busy multi-hour compile is excluded from idle eviction; the
             // deliberate wall_clock/max_interactions caps still fire (a named bound, not a mystery).
             isBusy,
-            // DUR-01 (165-06/165-07): the durability seams — descriptor store + has-session probe +
+            // The durability seams — descriptor store + has-session probe +
             // the content-free re-attach / unrecoverable hooks. Recover-on-boot re-attaches a
-            // surviving detached tmux session instead of flipping it lost (I10); absent tmux ⇒ the
-            // lost floor at runtime (I1). The descriptor is persisted at create-time (Pitfall 6).
+            // surviving detached tmux session instead of flipping it lost; absent tmux ⇒ the
+            // lost floor at runtime. The descriptor is persisted at create-time.
             durability,
         });
         registries.set(agentId, registry);
@@ -340,12 +342,12 @@ export function buildTerminalEgressDeps(logger, sandboxProvider) {
     return { egressControl, bwrapPath };
 }
 /**
- * Fold the per-agent operator terminal config onto the base wiring deps (124-09 — the
- * WR-01 closure call-site helper). Derives `workerCaps` from `config.worker.{maxSessions,
+ * Fold the per-agent operator terminal config onto the base wiring deps. Derives
+ * `workerCaps` from `config.worker.{maxSessions,
  * idleTtlMs,stuckMs}` (so the reaper composes when `timers` is present + maxSessions > 0)
  * and threads `config` (so `buildTerminalSharedDeps` populates the allow-set + per-session
  * caps). When `config` is absent the result has no `config`/`workerCaps` ⇒ the wiring
- * fail-closes (empty allow-set, no reaper) — the pre-P5 posture for an unconfigured agent.
+ * fail-closes (empty allow-set, no reaper) — the fail-closed posture for an unconfigured agent.
  *
  * `wallClockMs` is sourced as 0 at the registry/reaper level (the per-ENTRY
  * `limits.wallClockMs` is the operative wall-clock budget, enforced per-send via the caps;
@@ -387,10 +389,10 @@ export function buildTerminalWiringDeps(base, config) {
  * registry map is passed in.
  */
 export function buildTerminalSharedDeps(registries, agentId, deps) {
-    // SEC-01 trust source: the operator allow-set. 124-09 (WR-01 closure) POPULATES it from
+    // The trust source: the operator allow-set. POPULATES it from
     // the threaded `config.allow` via the single `mapAllowEntry` site (the per-entry scope
-    // SEC-02 + approveOnCreate SEC-06 + limits OPS-03/06 ride along, no silent drop). Absent
-    // config ⇒ EMPTY (every create fail-closes) — the pre-P5 fail-closed posture is preserved.
+    // + approveOnCreate + limits ride along, no silent drop). Absent
+    // config ⇒ EMPTY (every create fail-closes) — the fail-closed posture is preserved.
     const allowEntries = deps.config?.allow.map(mapAllowEntry) ?? [];
     // Construct ONE shared per-agent SessionCaps instance, fed into BOTH
     // the tool deps (consume*/startSession/forget) AND the registry onCapForget
@@ -400,17 +402,17 @@ export function buildTerminalSharedDeps(registries, agentId, deps) {
     // the forcing use case). The allow-set is EMPTY today, so the limits are undefined (no
     // caps tripped).
     //
-    // WIRING NOW LIVE (124-09 — the WR-01 closure; RESEARCH Open Q3 resolved). Two pieces:
-    //   1. PER-SESSION caps (consumeRequest/consumeInteraction/checkWallClock): LIVE now the
+    // Two pieces are wired live:
+    //   1. PER-SESSION caps (consumeRequest/consumeInteraction/checkWallClock): live once the
     //      allow-set is POPULATED from config — `allowEntries[0].limits` feeds
     //      createSessionCaps below (the entry's maxInteractions/maxRequestsPerSession/
     //      wallClockMs go enforceable).
-    //   2. The REAPER (idle-TTL / wall-clock-age / max-sessions overflow): LIVE now the
+    //   2. The REAPER (idle-TTL / wall-clock-age / max-sessions overflow): live once the
     //      `setup-tools.ts` call site threads `workerCaps` (+ the shared `caps` and `timers`
     //      TimerPort) — `wireRegistryReaper` composes (it needs `timers !== undefined &&
     //      maxSessions > 0`, terminal-reaper.ts). The reaper sweeps the per-agent registry.
     // Both fail-closed when config/workerCaps are absent (empty allow-set ⇒ undefined limits
-    // ⇒ no caps tripped; no workerCaps ⇒ no reaper) — the pre-P5 posture for an unconfigured agent.
+    // ⇒ no caps tripped; no workerCaps ⇒ no reaper) — the posture for an unconfigured agent.
     const entryLimits = allowEntries[0]?.limits;
     const caps = deps.caps ?? createSessionCaps(entryLimits, systemNowMs);
     const registry = getOrCreateTerminalRegistry(registries, agentId, deps, caps);
@@ -430,19 +432,19 @@ export function buildTerminalSharedDeps(registries, agentId, deps) {
         // tryGetContext().sessionKey ?? "") — derived PER CALL inside the tool (resolveOwner),
         // so the daemon needs no new owner arg. This agentId is the fallback half of that key.
         agentId,
-        // DRIVE-02 (164-04) / DELIVER-02: thread the operator's RAW promotion mode (`drive.mode`, may be
+        // Thread the operator's RAW promotion mode (`drive.mode`, may be
         // undefined). The skills wait tool resolves the EFFECTIVE mode via resolveDriveMode(mode, durable):
         // an explicit mode wins; ABSENT, a DURABLE drive (the default long backgrounded drive) defaults to
         // `detached` (it backgrounds at the first wait → the backstop tracks it → a completion notification
-        // fires when the CLI idles), a pty one-shot to `auto` (inline, I1 — byte-identical to today). The
+        // fires when the CLI idles), a pty one-shot to `auto` (inline — byte-identical to the non-detached path). The
         // skills layer reads no config (layer purity) — it only applies the pure resolver to these
         // daemon-supplied values (`driveMode` + `durable` below). Closes the un-promoted short-build gap.
         driveMode: deps.config?.drive?.mode,
-        // READ-01 (164-06): the operator-resolved read mode for the read tool's bounded digest.
-        // Same layer-purity posture as driveMode; `?? "digest"` is the schema default (plan 05's
-        // drive.readMode) + the safe pre-block posture (the bounded current screen).
+        // The operator-resolved read mode for the read tool's bounded digest.
+        // Same layer-purity posture as driveMode; `?? "digest"` is the schema default
+        // (drive.readMode) + the safe pre-block posture (the bounded current screen).
         readMode: deps.config?.drive?.readMode ?? "digest",
-        // DUR-01 (FINDING-B): drive.durable threaded to the create tool → create stamps req.durable:true → the registry derives the tmux name + selects the tmux backend (the survive-a-daemon-restart drive). DEFAULT-ON (`?? true`): the tmux backend is now both DRIVEABLE (the node-pty `attach` rework) and SURVIVE-A-RESTART (KillMode=process + the data-dir socket), so it is the default working setup. Explicit `drive.durable:false` opts out to the non-durable pty backend; a tmux-less host degrades to pty + a logged WARN (§7.1.5).
+        // drive.durable threaded to the create tool → create stamps req.durable:true → the registry derives the tmux name + selects the tmux backend (the survive-a-daemon-restart drive). DEFAULT-ON (`?? true`): the tmux backend is both DRIVEABLE (the node-pty `attach` path) and SURVIVE-A-RESTART (KillMode=process + the data-dir socket), so it is the default working setup. Explicit `drive.durable:false` opts out to the non-durable pty backend; a tmux-less host degrades to pty + a logged WARN.
         durable: deps.config?.drive?.durable ?? true,
         // The operator approval gate — consulted only when a matched entry sets
         // approveOnCreate (else the create path is unchanged); a demanding entry with no
@@ -462,7 +464,7 @@ export function buildTerminalSharedDeps(registries, agentId, deps) {
     };
 }
 /**
- * The per-agent attention config the wake-FSM woken turn reads (124-09 Task 2). Derived
+ * The per-agent attention config the wake-FSM woken turn reads. Derived
  * from the operator terminal config: the `autoAnswer`/`hintPatterns` come from the MATCHED
  * allow-entry (the forcing use case is a single entry per agent — the first entry's policy),
  * and the FSM caps from `worker.maxConcurrentAttentionTurns`. Operator-dialable ONLY (never
@@ -492,7 +494,7 @@ export function deriveTerminalAttentionConfig(config) {
  * calls — folds the base deps + the operator config into the registry + nine tools in ONE
  * call, keeping `setup-tools.ts` under its 800-line cap. `buildTerminalWiringDeps` folds the
  * operator config (allow-set + caps + reaper + autoAnswer/backend; absent ⇒ empty set + no
- * reaper); the 165-07 durability (descriptor store + has-session probe + isBusy + recover-on-
+ * reaper); the durability (descriptor store + has-session probe + isBusy + recover-on-
  * boot hooks) is wired inside `getOrCreateTerminalRegistry`.
  */
 export function wireAgentTerminalTools(tools, registries, agentId, base, config) {
@@ -500,6 +502,6 @@ export function wireAgentTerminalTools(tools, registries, agentId, base, config)
 }
 export function wireTerminalTools(tools, registries, agentId, deps) {
     const sharedDeps = buildTerminalSharedDeps(registries, agentId, deps);
-    tools.push(createTerminalSessionCreateTool(sharedDeps), createTerminalSessionReadTool(sharedDeps), createTerminalSessionListTool(sharedDeps), createTerminalSessionKillTool(sharedDeps), createTerminalSessionSendTextTool(sharedDeps), createTerminalSessionSendKeyTool(sharedDeps), createTerminalSessionWaitTool(sharedDeps), createTerminalSessionStatusTool(sharedDeps), // 124-06: the stub is now a deps-taking, classifier-backed tool
+    tools.push(createTerminalSessionCreateTool(sharedDeps), createTerminalSessionReadTool(sharedDeps), createTerminalSessionListTool(sharedDeps), createTerminalSessionKillTool(sharedDeps), createTerminalSessionSendTextTool(sharedDeps), createTerminalSessionSendKeyTool(sharedDeps), createTerminalSessionWaitTool(sharedDeps), createTerminalSessionStatusTool(sharedDeps), // a deps-taking, classifier-backed tool
     createTerminalSessionResizeTool(sharedDeps));
 }

package/node_modules/@comis/daemon/dist/wiring/setup-terminal-wake.d.ts

@@ -1,39 +1,38 @@
 /**
- * The daemon-side wake-FSM SUBSCRIBE wiring (124-09 Task 2, THE KEYSTONE; TR-07 /
- * SEC-11 / SEC-12 / OPS-08 / OPS-09) — modeled on `setup-background-completion-runner.ts`.
+ * The daemon-side wake-FSM subscribe wiring — modeled on `setup-background-completion-runner.ts`.
  *
- * `setupTerminalWake(deps)` makes the attention loop LIVE end-to-end:
- *   1. Constructs the recurring wake-FSM (`createTerminalWakeDispatcher`, 124-07) against
- *      a NARROW adapter bus that translates the daemon's re-published
- *      `terminal:input_needed` (124-09 Task 1) into the FSM's `TerminalInputNeededWake`
+ * `setupTerminalWake(deps)` makes the attention loop live end-to-end:
+ *   1. Constructs the recurring wake-FSM (`createTerminalWakeDispatcher`) against
+ *      a narrow adapter bus that translates the daemon's re-published
+ *      `terminal:input_needed` into the FSM's `TerminalInputNeededWake`
  *      (deriving the owner-scoped `owner` + a per-frame `requestId` the redaction-safe
  *      core event omits).
- *   2. Binds `isSessionActive` to the P4 owner-scoped registry (`registries.get(agentId)?
+ *   2. Binds `isSessionActive` to the owner-scoped registry (`registries.get(agentId)?
  *      .get(sessionId, owner) !== undefined`) — a wake for a killed/evicted/cross-owner
  *      session is dropped.
- *   3. Binds `wakeOneTurn` to the §4.4 woken-turn driver (`terminal-wake-turn.ts`):
+ *   3. Binds `wakeOneTurn` to the woken-turn driver (`terminal-wake-turn.ts`):
  *      status → read → decideAutoAnswer (safe-only) → send (audited) | escalate, with the
- *      loop-guard (SEC-11) escalating a re-rendered prompt.
+ *      loop-guard escalating a re-rendered prompt.
  *   4. Binds `escalate` (the FSM's hop-limit path) to a `terminal:escalated` emit + the
- *      NotifyFn chain (§4.7).
+ *      NotifyFn chain.
  *
- * **Owner derivation (the keystone seam).** The fd3 attention frame is unsolicited and the
+ * **Owner derivation (the central seam).** The fd3 attention frame is unsolicited and the
  * worker is owner-agnostic, so the re-published `terminal:input_needed` carries `agentId`
  * but neither `sessionKey` nor `requestId`. The wake `owner = { agentId, sessionKey }` is the
  * AGENT-TURN identity; the REGISTRY owner (status/read/send/active-check) is RECOVERED from the
- * session's STAMPED owner via `registry.getOwner` (ISSUE-3 — a channel/API drive is stamped
+ * session's STAMPED owner via `registry.getOwner` (a channel/API drive is stamped
  * under `(userId, sessionKey)`, which the re-publish drops), so a DETACHED drive's woken turns
  * resolve the LIVE session instead of dropping cross-owner. The `requestId` correlation key is
  * synthesized from `(sessionId, reason)` so N re-publishes of ONE unanswered frame coalesce
- * to ONE woken turn (OPS-09), and a distinct subsequent prompt (a fresh `reason`) is a fresh
+ * to ONE woken turn, and a distinct subsequent prompt (a fresh `reason`) is a fresh
  * wake.
  *
  * **One-per-daemon** (like the completion runner): subscribes the shared `TypedEventBus`
  * ONCE at startup; `shutdown()` unsubscribes + drains in-flight turns (reverse-order vs the
- * Task-1 emit hook, which is per-agent on the registry).
+ * emit hook, which is per-agent on the registry).
  *
  * Per AGENTS §2.4: composition root + factories. This wiring lives in `@comis/daemon`; the
- * FSM body (124-07) and the policy modules (124-04) live in `@comis/daemon` / `@comis/skills`.
+ * FSM body and the policy modules live in `@comis/daemon` / `@comis/skills`.
  *
  * @module
  */
@@ -54,95 +53,95 @@ export interface SetupTerminalWakeDeps {
      * turn escalates `no_safe_match` (the SAFE default).
      */
     getTerminalAttentionConfig: (agentId: string) => TerminalAttentionConfig | undefined;
-    /** The human-escalation NotifyFn (§4.7). Optional; absent ⇒ bus-only escalation audit. */
+    /** The human-escalation NotifyFn. Optional; absent ⇒ bus-only escalation audit. */
     notify?: WokenTurnNotify;
     /** Base data dir (~/.comis) — the FSM's durable wake-state lives under `terminal-wake/`. */
     dataDir: string;
     /**
-     * DUR-02 (165-07): the daemon-bound durable journal store — the single persistence
+     * The daemon-bound durable journal store — the single persistence
      * point for a PROMOTED drive's rolling journal. The holder persists on every
-     * `journal.set` (so a 40h drive's progress survives a daemon restart) and seeds the
+     * `journal.set` (so a multi-hour drive's progress survives a daemon restart) and seeds the
      * resumed journal from `load` on a `terminal:drive_reattached` (so a re-attached drive
-     * resumes its objective + answered prompts rather than starting over, I10). Optional:
-     * ABSENT ⇒ no durable persistence (the Phase-164 in-memory-only behavior, byte-identical
-     * I1). The store wraps the `@comis/observability` fs-safe `persistDriveJournal` /
-     * `loadDriveJournal` / `removeDriveJournal` bound to `dataDir` (165-07 Task 4); a fake
+     * resumes its objective + answered prompts rather than starting over). Optional:
+     * ABSENT ⇒ no durable persistence (in-memory-only, byte-identical to the store-present
+     * path when nothing is persisted). The store wraps the `@comis/observability` fs-safe
+     * `persistDriveJournal` / `loadDriveJournal` / `removeDriveJournal` bound to `dataDir`; a fake
      * is injected in unit tests. ALL methods best-effort (never throw — the in-memory holder
      * is the runtime source of truth). `remove` is the DISTINCT explicit delete called ONLY
-     * on a clean exit/evict, NEVER on a lost/crash (I10 preserve-on-failure).
+     * on a clean exit/evict, NEVER on a lost/crash (preserve-on-failure so a fresh drive can resume).
      */
     driveJournalStore?: DriveJournalStorePort;
     /**
-     * LIVE-01 (165-07): the injected TimerPort the coarse liveness BACKSTOP arms its
+     * The injected TimerPort the coarse liveness BACKSTOP arms its
      * `setInterval(...).unref()` on (mirroring the reaper). The daemon passes
-     * `createSystemTimers()` (165-07 Task 4); a test passes a fake. ABSENT (or absent
-     * `checkLiveness`) ⇒ NO backstop (the pre-165 event-only behavior, byte-identical I1).
+     * `createSystemTimers()`; a test passes a fake. ABSENT (or absent
+     * `checkLiveness`) ⇒ NO backstop (event-only behavior, byte-identical when the timer is absent).
      */
     timers?: TimerPort;
     /**
-     * LIVE-01 (165-07): the backstop cadence in ms (`drive.heartbeatMs`, default 90_000). The
+     * The backstop cadence in ms (`drive.heartbeatMs`, default 90_000). The
      * timer fires this often; on a tick it acts ONLY for a promoted session that has had NO
-     * wake within this window (I2 — fires only in the ABSENCE of a wake). Default 90_000.
+     * wake within this window (fires only in the ABSENCE of a wake). Default 90_000.
      */
     heartbeatMs?: number;
     /**
-     * LIVE-01 (165-07): the injected SINGLE liveness check the backstop performs on a tick —
+     * The injected SINGLE liveness check the backstop performs on a tick —
      * the worker's `has-session` + `noProgressMs` + the `stuckMs` window (the {@link LivenessSignal}
-     * the pure `busyOrHung` predicate consumes; `awaitingInput` rides it for DELIVER-01), with NO
-     * per-tick SCREEN read (I2 — the
+     * the pure `busyOrHung` predicate consumes; `awaitingInput` rides it for the completion
+     * notification), with NO per-tick SCREEN read (the
      * signature carries no grid/cursor; the daemon binds it to the registry's `status`
      * round-trip, which returns the worker's CLASSIFIER perception — `working`/`stuck`/`exited` —
      * never the screen bytes). Async: the single check is a worker round-trip, awaited inside the
      * fire-and-forget tick. Receives the owning `agentId` (the backstop resolves it from the
      * per-session bridge) so the daemon binding scopes the registry `status` round-trip. Returns
-     * `undefined` for a session that is already gone (the backstop skips it). The daemon (165-07
-     * Task 4) binds it; a test injects a fake. ABSENT ⇒ no backstop (I1).
+     * `undefined` for a session that is already gone (the backstop skips it). The daemon
+     * binds it; a test injects a fake. ABSENT ⇒ no backstop.
      */
     checkLiveness?: (sessionId: string, agentId: string) => Promise<LivenessSignal | undefined> | LivenessSignal | undefined;
     /**
-     * NOTIFY-01 (166-03): the operator `drive.notify` policy that gates the user-facing
+     * The operator `drive.notify` policy that gates the user-facing
      * `done`/`failed` outcome notifications (a `needs-you` escalation is NEVER gated — it rides
-     * the existing escalate() path, I4). `"terminal"` (default) + `"all"` fire `done`/`failed`;
+     * the existing escalate() path). `"terminal"` (default) + `"all"` fire `done`/`failed`;
      * `"none"` suppresses them (the escalation still fires). Resolved per-daemon from the default
-     * agent's `drive` block (terminal-durable-wiring.ts). Default `"terminal"` (today's intent).
+     * agent's `drive` block (terminal-durable-wiring.ts). Default `"terminal"`.
      */
     notifyPolicy?: NotifyPolicy;
     /**
-     * NOTIFY-02 (166-03): the COARSE user-facing heartbeat cadence in ms (`drive.heartbeatNotifyMs`,
-     * default 3_600_000 / 1h). A SECOND timer (distinct from the LIVE-01 internal backstop's
+     * The COARSE user-facing heartbeat cadence in ms (`drive.heartbeatNotifyMs`,
+     * default 3_600_000 / 1h). A SECOND timer (distinct from the internal backstop's
      * `heartbeatMs`) fires this often; on a tick it emits a content-free progress digest for each
      * PROMOTED drive due at the cadence. `0` ⇒ terminal-only (the timer is NEVER armed). The timer
      * is also NOT armed under `notifyPolicy:"none"` (the heartbeat is a non-escalation notification).
      * Default 3_600_000.
      */
     heartbeatNotifyMs?: number;
-    /** ENDURE-01 (165-07): the operator per-drive spend ceiling (`drive.maxCostUsd`), `null` = uncapped (default, I1). FORWARDED to the woken-turn driver below; the lone consumer STOPS+escalates a breach (see {@link WokenTurnDriverDeps.maxCostUsd}). */
+    /** The operator per-drive spend ceiling (`drive.maxCostUsd`), `null` = uncapped (default). FORWARDED to the woken-turn driver below; the lone consumer STOPS+escalates a breach (see {@link WokenTurnDriverDeps.maxCostUsd}). */
     maxCostUsd?: number | null;
     /** Injected clock (no raw global). Default `systemNowMs`. */
     nowMs?: () => number;
     logger: ComisLogger;
 }
 /**
- * The daemon-bound durable journal store the wake-holder consumes (DUR-02). A thin
- * per-`dataDir` wrapper over the 165-04 `terminal-drive-journal-persistence.ts` module
+ * The daemon-bound durable journal store the wake-holder consumes. A thin
+ * per-`dataDir` wrapper over the `terminal-drive-journal-persistence.ts` module
  * functions, agent-keyed (the holder is daemon-wide; the store is confined per-agent). The
- * daemon (165-07 Task 4) binds the real fs impl; unit tests inject a fake. Every method is
+ * daemon binds the real fs impl; unit tests inject a fake. Every method is
  * best-effort + total (a fault is swallowed inside the impl — the in-memory holder already
- * updated). `remove` is the I10 explicit-only delete (persist/recover/load NEVER delete).
+ * updated). `remove` is the explicit-only delete (persist/recover/load NEVER delete).
  */
 export interface DriveJournalStorePort {
-    /** Persist (or overwrite) the journal for a promoted session — the single DUR-02 persistence point. */
+    /** Persist (or overwrite) the journal for a promoted session — the single persistence point. */
     persist(agentId: string, sessionId: string, journal: DriveJournal): void;
     /**
-     * Load ONE persisted journal — the resume read (DUR-02 / I10). The holder calls it
+     * Load ONE persisted journal — the resume read. The holder calls it
      * LAZILY on the first woken turn of a recovered/promoted session whose in-memory
-     * journal is empty (165-REVIEW BL-02 — order-independent, so the boot-time
+     * journal is empty (order-independent, so the boot-time
      * `terminal:drive_reattached` event is NOT load-bearing for resume). `undefined`
      * when no journal is persisted. There is deliberately NO bulk `recover(agentId)`
-     * (the resume design reads one journal per re-attach; 165-REVIEW ME-03).
+     * (the resume design reads one journal per re-attach).
      */
     load(agentId: string, sessionId: string): DriveJournal | undefined;
-    /** Remove a journal file — the DISTINCT explicit delete (clean exit only, NEVER on crash, I10). */
+    /** Remove a journal file — the DISTINCT explicit delete (clean exit only, NEVER on crash). */
     remove(agentId: string, sessionId: string): void;
 }
 /** The handle the composition root keeps for shutdown. */