comisai 1.0.45 → 1.0.46

package/node_modules/@comis/skills/dist/platform-tools/tools/cron-tool.js

@@ -46,6 +46,13 @@ const CronToolParams = Type.Object({
     model: Type.Optional(Type.String({
         description: "Model to use when this cron job fires (e.g. gemini-2.5-flash). Only applies to agent_turn payload kind.",
     })),
+    // wake-gate (monitoring) params — see the tool description for the verdict protocol
+    wake_gate_script: Type.Optional(Type.String({
+        description: "Optional pre-run gate script for a monitoring job (add/update). When set, the scheduler runs it before each fire and wakes the model ONLY if the script signals a change; otherwise the fire is skipped cheaply. The script prints its verdict on stdout — see this tool's description for the protocol and a worked example.",
+    })),
+    wake_gate_language: Type.Optional(Type.Union([Type.Literal("js"), Type.Literal("ts")], {
+        description: "Language of wake_gate_script. Valid values: js, ts. Default: js.",
+    })),
     // update/remove/runs/run params
     job_name: Type.Optional(Type.String({ description: "Job name (required for update, remove, runs, run)" })),
     enabled: Type.Optional(Type.Boolean({ description: "Enable or disable a job (for update)" })),
@@ -86,7 +93,8 @@ export function createCronTool(rpcCall) {
         name: "cron",
         label: "Cron Scheduler",
         description: "Manage cron jobs, scheduled tasks, wake events. Write reminder text as user-facing message. " +
-            "SCHEDULING RULE: for a RELATIVE reminder ('in 2 minutes', 'in an hour', 'remind me in 30 seconds', 'N minutes from now') you MUST use schedule_kind='in' with schedule_in_seconds = the number of seconds — do NOT compute an absolute datetime or timezone for a relative request (that is the #1 source of wrong-time reminders). Use schedule_kind='at' ONLY for an explicit clock time like 'at 9am tomorrow', and then always pass the user's timezone.",
+            "SCHEDULING RULE: for a RELATIVE reminder ('in 2 minutes', 'in an hour', 'remind me in 30 seconds', 'N minutes from now') you MUST use schedule_kind='in' with schedule_in_seconds = the number of seconds — do NOT compute an absolute datetime or timezone for a relative request (that is the #1 source of wrong-time reminders). Use schedule_kind='at' ONLY for an explicit clock time like 'at 9am tomorrow', and then always pass the user's timezone. " +
+            "MONITORING (wake-gate): for a job that watches something, supply a wake_gate_script that fetches or greps the thing to watch and prints a JSON verdict on stdout — {\"wake\":false} when nothing changed (the fire is skipped cheaply), or {\"wake\":true,\"context\":\"what you found\"} otherwise. The model runs ONLY when the gate wakes it, so a quiet monitor costs almost nothing. Example: a wake_gate_script that fetches a CI status prints {\"wake\":false} while the build is green, else {\"wake\":true,\"context\":\"build #123 failed\"}; set wake_gate_language to js (default) or ts. This wake-gate is NOT the `wake` action — that action just wakes/replays the scheduler loop to re-check due jobs, it is not a pre-run gate.",
         parameters: CronToolParams,
         async execute(_toolCallId, params) {
             try {
@@ -115,6 +123,8 @@ export function createCronTool(rpcCall) {
                             session_strategy: readStringParam(p, "session_strategy", false),
                             max_history_turns: readNumberParam(p, "max_history_turns", false),
                             model: readStringParam(p, "model", false),
+                            wake_gate_script: readStringParam(p, "wake_gate_script", false),
+                            wake_gate_language: readStringParam(p, "wake_gate_language", false),
                         });
                         return jsonResult(result);
                     }
@@ -126,7 +136,13 @@ export function createCronTool(rpcCall) {
                         const jobName = readStringParam(p, "job_name");
                         const enabled = readBooleanParam(p, "enabled", false);
                         const name = readStringParam(p, "name", false);
-                        const result = await rpcCall("cron.update", { jobName, enabled, name });
+                        const result = await rpcCall("cron.update", {
+                            jobName,
+                            enabled,
+                            name,
+                            wake_gate_script: readStringParam(p, "wake_gate_script", false),
+                            wake_gate_language: readStringParam(p, "wake_gate_language", false),
+                        });
                         return jsonResult(result);
                     }
                     case "remove": {

package/node_modules/@comis/skills/dist/platform-tools/tools/describe-video-tool.js

@@ -11,7 +11,7 @@
 import { Type } from "typebox";
 import { registerActivityLabelSpec } from "@comis/core";
 import { jsonResult, readStringParam } from "../tool-helpers.js";
-// Activity label spec (§17.6). Descriptor name == emitted name.
+// Activity label spec. Descriptor name == emitted name.
 registerActivityLabelSpec("describe_video", {
     semanticPhase: "media",
     label: "describing video",

package/node_modules/@comis/skills/dist/platform-tools/tools/discord-action-tool.js

@@ -13,7 +13,7 @@
 import { Type } from "typebox";
 import { registerActivityLabelSpec } from "@comis/core";
 import { createPlatformActionTool } from "../platform-action-tool.js";
-// Activity label spec (§17.6). Descriptor name == emitted name. The
+// Activity label spec. Descriptor name == emitted name. The
 // 19-action enum is summarized by the tool-level label; the per-channel action
 // surfaces in the action arg rather than 19 inline overrides.
 registerActivityLabelSpec("discord_action", {

package/node_modules/@comis/skills/dist/platform-tools/tools/extract-document-tool.js

@@ -11,7 +11,7 @@
 import { Type } from "typebox";
 import { registerActivityLabelSpec } from "@comis/core";
 import { jsonResult, readStringParam, readNumberParam } from "../tool-helpers.js";
-// Activity label spec (§17.6). Descriptor name == emitted name.
+// Activity label spec. Descriptor name == emitted name.
 registerActivityLabelSpec("extract_document", {
     semanticPhase: "media",
     label: "extracting document",

package/node_modules/@comis/skills/dist/platform-tools/tools/heartbeat-manage-tool.js

@@ -12,7 +12,7 @@ import { Type } from "typebox";
 import { registerActivityLabelSpec } from "@comis/core";
 import { readStringParam } from "../tool-helpers.js";
 import { createAdminManageTool } from "../admin-manage-factory.js";
-// Activity label spec (§17.6). Descriptor name == emitted name.
+// Activity label spec. Descriptor name == emitted name.
 // Per-action overrides use the tool's REAL action enum.
 registerActivityLabelSpec("heartbeat_manage", {
     semanticPhase: "tool",

package/node_modules/@comis/skills/dist/platform-tools/tools/image-generate-tool.js

@@ -12,7 +12,7 @@
 import { Type } from "typebox";
 import { registerActivityLabelSpec } from "@comis/core";
 import { createRpcDispatchTool } from "../messaging-factory.js";
-// Activity label spec (§17.6). Descriptor name == emitted name.
+// Activity label spec. Descriptor name == emitted name.
 registerActivityLabelSpec("image_generate", {
     semanticPhase: "media",
     label: "generating image",

package/node_modules/@comis/skills/dist/platform-tools/tools/image-tool.js

@@ -11,7 +11,7 @@
 import { Type } from "typebox";
 import { registerActivityLabelSpec } from "@comis/core";
 import { jsonResult, readStringParam } from "../tool-helpers.js";
-// Activity label spec (§17.6). Keyed on the EMITTED tool name
+// Activity label spec. Keyed on the EMITTED tool name
 // `image_analyze` (NOT the `image` descriptor name).
 registerActivityLabelSpec("image_analyze", {
     semanticPhase: "media",

package/node_modules/@comis/skills/dist/platform-tools/tools/mcp-manage-tool.js

@@ -16,9 +16,9 @@ import { Type } from "typebox";
 import { registerActivityLabelSpec } from "@comis/core";
 import { readStringParam, throwToolError } from "../tool-helpers.js";
 import { createAdminManageTool } from "../admin-manage-factory.js";
-// Activity label spec (§17.6). Descriptor name == emitted name.
+// Activity label spec. Descriptor name == emitted name.
 // Per-action overrides use the tool's REAL action enum
-// (list/status/connect/disconnect/reconnect — NOT the spec §6.1 example).
+// (list/status/connect/disconnect/reconnect), not a placeholder example.
 registerActivityLabelSpec("mcp_manage", {
     semanticPhase: "tool",
     label: "managing MCP servers",

package/node_modules/@comis/skills/dist/platform-tools/tools/memory-ask-tool.d.ts

@@ -11,9 +11,9 @@
  * This tool is a THIN rpcCall dispatcher: it holds NO model and NO DB handle
  * (the `@comis/skills` tier discipline). It MUST NOT import the LLM-call package
  * (`@earendil-works/pi`-agent's ai module) or resolve a model — the synthesis
- * seam lives in the daemon. Registration + the opt-in
- * `dialectic.enabled` gate land later (this file only defines the
- * factory).
+ * seam lives in the daemon. Registration and the opt-in
+ * `dialectic.enabled` gate live in the registry/setup-tools layer (this file
+ * only defines the factory).
  *
  * @module
  */

package/node_modules/@comis/skills/dist/platform-tools/tools/memory-ask-tool.js

@@ -12,16 +12,16 @@
  * This tool is a THIN rpcCall dispatcher: it holds NO model and NO DB handle
  * (the `@comis/skills` tier discipline). It MUST NOT import the LLM-call package
  * (`@earendil-works/pi`-agent's ai module) or resolve a model — the synthesis
- * seam lives in the daemon. Registration + the opt-in
- * `dialectic.enabled` gate land later (this file only defines the
- * factory).
+ * seam lives in the daemon. Registration and the opt-in
+ * `dialectic.enabled` gate live in the registry/setup-tools layer (this file
+ * only defines the factory).
  *
  * @module
  */
 import { Type } from "typebox";
 import { registerActivityLabelSpec } from "@comis/core";
 import { jsonResult, readStringParam, readNumberParam } from "../tool-helpers.js";
-// Activity label spec (§17.6). Descriptor name == emitted name.
+// Activity label spec. Descriptor name == emitted name.
 registerActivityLabelSpec("memory_ask", {
     semanticPhase: "memory",
     label: "asking memory",

package/node_modules/@comis/skills/dist/platform-tools/tools/memory-get-tool.js

@@ -12,7 +12,7 @@
 import { Type } from "typebox";
 import { registerActivityLabelSpec } from "@comis/core";
 import { jsonResult, readStringParam, readNumberParam } from "../tool-helpers.js";
-// Activity label spec (§17.6). Descriptor name == emitted name.
+// Activity label spec. Descriptor name == emitted name.
 registerActivityLabelSpec("memory_get", {
     semanticPhase: "memory",
     label: "reading memory",

package/node_modules/@comis/skills/dist/platform-tools/tools/memory-manage-tool.js

@@ -12,7 +12,7 @@
 import { Type } from "typebox";
 import { tryGetContext, registerActivityLabelSpec } from "@comis/core";
 import { jsonResult, throwToolError, readEnumParam, createTrustGuard, } from "../tool-helpers.js";
-// Activity label spec (§17.6). Descriptor name == emitted name.
+// Activity label spec. Descriptor name == emitted name.
 // Per-action overrides use the tool's REAL action enum.
 registerActivityLabelSpec("memory_manage", {
     semanticPhase: "memory",

package/node_modules/@comis/skills/dist/platform-tools/tools/memory-search-tool.js

@@ -10,7 +10,7 @@
 import { Type } from "typebox";
 import { registerActivityLabelSpec } from "@comis/core";
 import { jsonResult, readStringParam, readNumberParam } from "../tool-helpers.js";
-// Activity label spec (§17.6). Descriptor name == emitted name.
+// Activity label spec. Descriptor name == emitted name.
 registerActivityLabelSpec("memory_search", {
     semanticPhase: "memory",
     label: "searching memory",

package/node_modules/@comis/skills/dist/platform-tools/tools/memory-store-tool.js

@@ -10,7 +10,7 @@
 import { Type } from "typebox";
 import { registerActivityLabelSpec } from "@comis/core";
 import { jsonResult, readStringParam } from "../tool-helpers.js";
-// Activity label spec (§17.6). Descriptor name == emitted name.
+// Activity label spec. Descriptor name == emitted name.
 registerActivityLabelSpec("memory_store", {
     semanticPhase: "memory",
     label: "storing memory",

package/node_modules/@comis/skills/dist/platform-tools/tools/obs-query-tool.js

@@ -47,7 +47,7 @@ const ObsQueryToolParams = Type.Object({
     trace_id: Type.Optional(Type.String({ description: "Trace ID (for explain, trace, session_report)" })),
     depth: Type.Optional(Type.String({ description: "Report depth for explain/session_report: summary | full" })),
     since_hours: Type.Optional(Type.Integer({ description: "Window in hours for fleet_health (default 24)" })),
-    // AUDIT-05 (the 9th action): the audit-log filter surface. All optional; an
+    // The audit-log filter surface (the 9th action). All optional; an
     // absent filter widens the scan. since_ms/agent_id/limit are shared above.
     kind: Type.Optional(Type.String({ description: "Audit event family filter (e.g. secret_access, injection_detected) — for audit" })),
     classification: Type.Optional(Type.String({ description: "Audit risk class filter: read | mutate | destructive — for audit" })),
@@ -215,7 +215,7 @@ export function createObsQueryTool(rpcCall) {
                     return jsonResult(result);
                 }
                 if (action === "audit") {
-                    // AUDIT-05 (the 9th action): the durable security-decision audit log.
+                    // The durable security-decision audit log (the 9th action).
                     // Reuses the existing admin trustGuard — NO new auth surface. Delegates
                     // to the admin-gated obs.audit.query RPC; the rows are content-free.
                     const kind = readStringParam(p, "kind", false);

package/node_modules/@comis/skills/dist/platform-tools/tools/pipeline-tool.js

@@ -14,7 +14,7 @@
  */
 import { Type } from "typebox";
 import { tryGetContext } from "@comis/core";
-// AUTHOR-02 (Phase 174-04): the deterministic intent → ExecutionGraph
+// The deterministic intent → ExecutionGraph
 // synthesizer. It RETURNS a validated graph; the from_intent action below
 // dispatches it through the EXISTING graph.execute path (so governance applies
 // automatically — the synthesizer never executes). skills→agent is a clean
@@ -56,8 +56,8 @@ const PipelineNode = Type.Object({
     // typeless open record whose value schema the missing-type injection
     // stamps `type:"string"` — the wire schema then contradicts the daemon
     // drivers (debate wants `agents: array`, `rounds: number`) and the model
-    // oscillates between the two validators' errors (small-model e2e
-    // 2026-06-12, UC-1/UC-6). Field VALUE validation (required-ness, ranges,
+    // oscillates between the two validators' errors on small models. Field VALUE
+    // validation (required-ness, ranges,
     // strictness per type_id) stays with the daemon driver Zod schemas — the
     // single source of truth; this schema only declares accurate wire types.
     type_config: Type.Optional(Type.Object({
@@ -136,7 +136,7 @@ const PipelineParams = Type.Object({
     variables: Type.Optional(Type.Record(Type.String(), Type.String(), {
         description: "Key-value map of ${VAR} substitutions to apply before execution",
     })),
-    // AUTHOR-02 (Phase 174-04): from_intent params. These are TOP-LEVEL tool
+    // from_intent params. These are TOP-LEVEL tool
     // params, distinct from the NESTED type_config.agents / type_config.rounds on
     // a PipelineNode (different scope — no field collision). Consumed ONLY by the
     // from_intent action; ignored by every other action.
@@ -148,10 +148,10 @@ const PipelineParams = Type.Object({
     ], { description: "from_intent: the canonical multi-agent pattern to synthesize. research-fanout (N researchers → synthesize), debate (pro vs con → moderator), vote (N voters → aggregate), map-reduce (N mappers → reduce)." })),
     tasks: Type.Optional(Type.Array(Type.String(), { description: "from_intent: the topic/task the synthesized graph works on (tasks[0] fills the TOPIC/TASK slot). Use instead of, or alongside, agents." })),
     agents: Type.Optional(Type.Array(Type.String(), { description: "from_intent: agent names for the pattern's roles — debate: [PRO, CON] (e.g. [\"bull\", \"bear\"]); vote: the voter pool; map-reduce: the mapper pool." })),
-    // WR-02: from_intent produces TEMPLATE-shaped graphs (plain agent nodes), NOT
-    // the typed orchestration drivers — so a top-level `rounds` param had no
-    // effect (the synthesizer never expanded it). It is intentionally NOT exposed
-    // here (no no-op param, §2.3). To run a multi-round debate DRIVER, use
+    // from_intent produces TEMPLATE-shaped graphs (plain agent nodes), NOT
+    // the typed orchestration drivers — so a top-level `rounds` param would have no
+    // effect (the synthesizer never expands it). It is intentionally NOT exposed
+    // here (no no-op param). To run a multi-round debate DRIVER, use
     // action: define/execute with a node `type_id: "debate"` + `type_config.rounds`.
 });
 // ---------------------------------------------------------------------------
@@ -317,20 +317,20 @@ export function createPipelineTool(rpcCall, logger, approvalGate) {
                     return jsonResult(result);
                 }
                 if (action === "from_intent") {
-                    // AUTHOR-02 (Phase 174-04): synthesize a graph from a one-line intent
+                    // Synthesize a graph from a one-line intent
                     // (a canonical pattern + a few names) via the deterministic
                     // @comis/agent synthesizer, then dispatch it through the EXISTING
                     // graph.execute path. The synthesizer RETURNS a validated graph; it
                     // NEVER executes one — flowing through graph.execute means the
                     // synthesized graph hits the SAME define-time governance
                     // (parse/sort/validateTypeConfigs) AND spawn-time governance
-                    // (denylist + child⊆parent) a hand-authored graph hits (§9). The gate
+                    // (denylist + child⊆parent) a hand-authored graph hits. The gate
                     // (orchestration.authoring.intentAction) + the audit emit are
                     // DAEMON-SIDE, keyed off the _synthesizedFromIntent marker — so the
                     // daemon refuses an un-flagged from_intent at the chokepoint and the
                     // tool surface stays uniform (no flag read here).
                     //
-                    // WR-02: from_intent expands the canonical TEMPLATE — plain agent
+                    // from_intent expands the canonical TEMPLATE — plain agent
                     // nodes ({nodeId, task, dependsOn}), NOT the typed orchestration
                     // drivers (a synthesized "debate" is a one-shot pro/con fan-in, not
                     // the multi-round `type_id: debate` driver). For the typed driver,

package/node_modules/@comis/skills/dist/platform-tools/tools/video-generate-tool.d.ts

@@ -2,7 +2,7 @@
  * Video Generate tool: text-to-video generation via provider abstraction.
  *
  * Allows agents to generate videos from text prompts. Delegates to the
- * daemon-side video.generate RPC handler (lands Phase 188 Plan 04) which
+ * daemon-side video.generate RPC handler, which
  * resolves the agent's main provider's video backend (or explicit FAL),
  * applies a per-agent rate limit + a pre-submit worst-case cost ceiling, runs
  * the inline submit→poll→download loop through one VideoGenerationPort, and
@@ -21,10 +21,10 @@ import type { RpcCall } from "./cron-tool.js";
  * Uses the createRpcDispatchTool factory to dispatch to the daemon-side
  * video.generate RPC handler. The RPC handler resolves the provider, applies
  * rate limiting + the pre-submit cost ceiling, validates the params against the
- * active backend's capability matrix (IN-02), and executes the submit→poll→
+ * active backend's capability matrix, and executes the submit→poll→
  * download loop before delivering the generated video to the current channel.
  *
- * IN-03: when `provider` is supplied (the registry threads the boot-selected
+ * When `provider` is supplied (the registry threads the boot-selected
  * `ctx.videoGenProvider`), the tool description is built at registration from
  * that backend's real capability matrix. With no provider it keeps the shipped
  * STATIC_FALLBACK string (defensive — the parity STUB_CTX path).

package/node_modules/@comis/skills/dist/platform-tools/tools/video-generate-tool.js

@@ -3,7 +3,7 @@
  * Video Generate tool: text-to-video generation via provider abstraction.
  *
  * Allows agents to generate videos from text prompts. Delegates to the
- * daemon-side video.generate RPC handler (lands Phase 188 Plan 04) which
+ * daemon-side video.generate RPC handler, which
  * resolves the agent's main provider's video backend (or explicit FAL),
  * applies a per-agent rate limit + a pre-submit worst-case cost ceiling, runs
  * the inline submit→poll→download loop through one VideoGenerationPort, and
@@ -53,7 +53,7 @@ const VideoGenerateToolParams = Type.Object({
  * The shipped static description, used when no backend is resolved at build
  * (the defensive path — e.g. the parity STUB_CTX with no videoGenProvider). It
  * carries NO config value, key, or env — only the generic capability prose
- * (T-191-08: the description must not leak config/secrets).
+ * (the description must not leak config/secrets).
  */
 const STATIC_FALLBACK = "Generate a video from a text prompt, optionally from a source image (image-to-video) and with an explicit model. The generated video is automatically delivered to the current channel.";
 /** Human-readable duration set for the description: enum `4/6/8s`, range `1-15s`. */
@@ -61,15 +61,15 @@ function formatDurations(d) {
     return d.kind === "enum" ? `${d.values.join("/")}s` : `${d.min}-${d.max}s`;
 }
 /**
- * IN-03: build the `video_generate` description at registration time from the
+ * Build the `video_generate` description at registration time from the
  * ACTIVE backend's VIDEO_MODELS capability matrix, so the agent sees the active
  * provider's REAL options (durations/resolutions/aspect/i2v) — not a static
- * superset (Hermes `_build_dynamic_video_schema`, hardened with structured
- * enums). Built ONLY from the matrix's capability data + the backend id
- * (fal/veo/grok — not a secret): NO config value, key, or env is interpolated
- * (T-191-08). An unknown/blocked backend (the SEC-04 `isBlockedObjectKey` guard
- * in `listVideoModelCaps` returns `undefined`, T-191-09) or a backend with no
- * t2v entry falls back to STATIC_FALLBACK — never throws.
+ * superset, using structured enums. Built ONLY from the matrix's capability data
+ * + the backend id (fal/veo/grok — not a secret): NO config value, key, or env
+ * is interpolated (the description must not leak config/secrets). An
+ * unknown/blocked backend (the `isBlockedObjectKey` guard in `listVideoModelCaps`
+ * returns `undefined`) or a backend with no t2v entry falls back to
+ * STATIC_FALLBACK — never throws.
  *
  * Registration-time / default-agent-scoped: `AgentTool.description` is a static
  * string fixed at `build`, so changing the active `provider` needs a daemon
@@ -79,7 +79,7 @@ function formatDurations(d) {
 function buildVideoDescription(backend) {
     if (!backend)
         return STATIC_FALLBACK;
-    const t2v = listVideoModelCaps(backend, "t2v"); // SEC-04 guarded; undefined if blocked/unknown
+    const t2v = listVideoModelCaps(backend, "t2v"); // blocked-object-key guarded; undefined if blocked/unknown
     if (!t2v)
         return STATIC_FALLBACK;
     const i2v = listVideoModelCaps(backend, "i2v");
@@ -99,10 +99,10 @@ function buildVideoDescription(backend) {
  * Uses the createRpcDispatchTool factory to dispatch to the daemon-side
  * video.generate RPC handler. The RPC handler resolves the provider, applies
  * rate limiting + the pre-submit cost ceiling, validates the params against the
- * active backend's capability matrix (IN-02), and executes the submit→poll→
+ * active backend's capability matrix, and executes the submit→poll→
  * download loop before delivering the generated video to the current channel.
  *
- * IN-03: when `provider` is supplied (the registry threads the boot-selected
+ * When `provider` is supplied (the registry threads the boot-selected
  * `ctx.videoGenProvider`), the tool description is built at registration from
  * that backend's real capability matrix. With no provider it keeps the shipped
  * STATIC_FALLBACK string (defensive — the parity STUB_CTX path).

package/node_modules/@comis/skills/dist/platform-tools/tools/video-status-tool.d.ts

@@ -1,5 +1,5 @@
 /**
- * Video Status tool (Phase 189 / JOB-04): check the progress + result of a
+ * Video Status tool: check the progress + result of a
  * video-generation job by its job handle.
  *
  * The read side of the async video lifecycle. `video_generate` returns a job
@@ -9,10 +9,10 @@
  *
  * Delegates to the daemon-side `video.status` RPC handler (createVideoStatusHandlers),
  * which reads the agent-scoped VideoJobStore — a job belonging to another agent
- * returns not-found, never the other agent's data (JOB-04 / TARGET-01).
+ * returns not-found, never the other agent's data.
  *
  * SECURITY: this tool is `mcpExportPolicy:"never-export"` (reserved in
- * tool-metadata-registry.ts; SEC-01) — it reads daemon-side job state and is
+ * tool-metadata-registry.ts) — it reads daemon-side job state and is
  * NOT exposed to external MCP clients. This module only adds the tool descriptor;
  * it does NOT touch the metadata reservation.
  *

package/node_modules/@comis/skills/dist/platform-tools/tools/video-status-tool.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Video Status tool (Phase 189 / JOB-04): check the progress + result of a
+ * Video Status tool: check the progress + result of a
  * video-generation job by its job handle.
  *
  * The read side of the async video lifecycle. `video_generate` returns a job
@@ -10,10 +10,10 @@
  *
  * Delegates to the daemon-side `video.status` RPC handler (createVideoStatusHandlers),
  * which reads the agent-scoped VideoJobStore — a job belonging to another agent
- * returns not-found, never the other agent's data (JOB-04 / TARGET-01).
+ * returns not-found, never the other agent's data.
  *
  * SECURITY: this tool is `mcpExportPolicy:"never-export"` (reserved in
- * tool-metadata-registry.ts; SEC-01) — it reads daemon-side job state and is
+ * tool-metadata-registry.ts) — it reads daemon-side job state and is
  * NOT exposed to external MCP clients. This module only adds the tool descriptor;
  * it does NOT touch the metadata reservation.
  *

package/node_modules/@comis/skills/dist/skills/audit/skill-audit.js

@@ -11,7 +11,7 @@ import { classifyAction, createAuditEvent, systemNowMs } from "@comis/core";
 export function emitSkillAudit(eventBus, opts) {
     const classification = classifyAction(opts.action);
     // Emit the generic audit:event. Skill-audit records are the generic
-    // `audit` family (AUDIT-03 / E4) and keep a meaningful access-class
+    // `audit` family and keep a meaningful access-class
     // classification (read|mutate|destructive from classifyAction).
     const auditEvent = createAuditEvent({
         agentId: opts.agentId,

package/node_modules/@comis/skills/dist/skills/bridge/register-failure-detector-metadata.d.ts

@@ -2,7 +2,7 @@
  * Failure-detector tool metadata (§16.10/§16.11).
  *
  * Extracted from `tool-metadata-registry.ts` to keep that file under the
- * 800-line cap (the v2.22/v2.23 closures-extraction protocol — never an
+ * 800-line cap (the closures-extraction protocol — never an
  * allowlist entry). Behavior-neutral: `registerFailureDetectorMetadata()` is
  * called once from `registerAllToolMetadata()` and registers the identical
  * web_search / web_fetch `failureDetector` metadata via spread-merge onto the

package/node_modules/@comis/skills/dist/skills/bridge/register-failure-detector-metadata.js

@@ -3,7 +3,7 @@
  * Failure-detector tool metadata (§16.10/§16.11).
  *
  * Extracted from `tool-metadata-registry.ts` to keep that file under the
- * 800-line cap (the v2.22/v2.23 closures-extraction protocol — never an
+ * 800-line cap (the closures-extraction protocol — never an
  * allowlist entry). Behavior-neutral: `registerFailureDetectorMetadata()` is
  * called once from `registerAllToolMetadata()` and registers the identical
  * web_search / web_fetch `failureDetector` metadata via spread-merge onto the

package/node_modules/@comis/skills/dist/skills/bridge/tool-metadata-registry.js

@@ -57,7 +57,7 @@ export function registerAllToolMetadata() {
     registerToolMetadata("obs_query", { isReadOnly: true });
     registerToolMetadata("models_manage", { isReadOnly: true });
     registerToolMetadata("discover_tools", { isReadOnly: true });
-    // Context expansion (3) — in-session lossless-store recovery (E1/E2). They
+    // Context expansion (3) — in-session lossless-store recovery. They
     // only READ the LCD store, so they are read-only (parallel-execution safe).
     registerToolMetadata("ctx_search", { isReadOnly: true });
     registerToolMetadata("ctx_inspect", { isReadOnly: true });
@@ -90,7 +90,7 @@ export function registerAllToolMetadata() {
     registerToolMetadata("tts_synthesize", { isReadOnly: false });
     // --- Concurrency-safe mutating tool ---
     registerToolMetadata("message", { isReadOnly: false, isConcurrencySafe: true });
-    // --- Read-only concurrency-safe pacing primitive (STREAM-03) ---
+    // --- Read-only concurrency-safe pacing primitive ---
     // sleep mutates NO state: read-only + concurrency-safe so the parallel-execution
     // serializer lets it overlap concurrency-safe reads (it must not serialize them
     // behind a pure timer) and the input-strip / read-only detection see it correctly.
@@ -115,9 +115,9 @@ export function registerAllToolMetadata() {
     const VALID_CRON_ACTIONS = ["add", "list", "update", "remove", "status", "runs", "run", "wake"];
     // "in" = deterministic relative one-shot (now + schedule_in_seconds), the
     // reliable path for "remind me in N minutes" — keep in lockstep with
-    // CronScheduleSchema (CRON-IN-01). Omitting it here silently rejected the
-    // model's correct `schedule_kind:"in"` with "Valid: cron, every, at", forcing
-    // it back onto the timezone-error-prone `at` path (live 2026-06-20).
+    // CronScheduleSchema. Omitting it here silently rejected the model's correct
+    // `schedule_kind:"in"` with "Valid: cron, every, at", forcing it back onto the
+    // timezone-error-prone `at` path.
     const VALID_SCHEDULE_KINDS = ["cron", "every", "at", "in"];
     registerToolMetadata("cron", {
         validateInput: (params) => {
@@ -573,7 +573,7 @@ export function registerAllToolMetadata() {
     registerToolMetadata("session_status", { mcpExportPolicy: "permission-gated" });
     registerToolMetadata("sessions_list", { mcpExportPolicy: "permission-gated" });
     registerToolMetadata("sessions_history", { mcpExportPolicy: "permission-gated" });
-    // Observability (3) — all permission-gated; operator allowlists by query scope. obs_explain (154-03) + obs_fleet_health (161-02) are READ-ONLY digests that run their assembler directly under daemon authority (NOT the admin RPC); the allowlist is the grant (merged comments to stay under the 800-line cap).
+    // Observability (3) — all permission-gated; operator allowlists by query scope. obs_explain + obs_fleet_health are READ-ONLY digests that run their assembler directly under daemon authority (NOT the admin RPC); the allowlist is the grant.
     registerToolMetadata("obs_query", { mcpExportPolicy: "permission-gated" });
     registerToolMetadata("obs_explain", { mcpExportPolicy: "permission-gated", isReadOnly: true, maxResultSizeChars: 100_000, searchHint: "explain incident root-cause post-mortem session report" });
     registerToolMetadata("obs_fleet_health", { mcpExportPolicy: "permission-gated", isReadOnly: true, maxResultSizeChars: 100_000, searchHint: "fleet health cross-session degradation rate errorKinds breaker trips config posture model health" });
@@ -625,8 +625,8 @@ export function registerAllToolMetadata() {
     registerToolMetadata("slack_action", { mcpExportPolicy: "never-export" });
     // Cost-bearing synthesis (3).
     registerToolMetadata("tts_synthesize", { mcpExportPolicy: "never-export" });
-    // Video generation (188-02 SEC-01) — cost-bearing + outbound delivery; never
-    // MCP-exported. video_status is reserved (its tool lands Phase 189).
+    // Video generation — cost-bearing + outbound delivery; never MCP-exported.
+    // video_status is reserved so its policy is pinned before the tool exists.
     registerToolMetadata("video_generate", { mcpExportPolicy: "never-export" });
     registerToolMetadata("video_status", { mcpExportPolicy: "never-export" });
     // Terminal driver (9) — never-export; inside Comis's trust boundary, NOT an MCP-exported surface.
@@ -641,17 +641,16 @@ export function registerAllToolMetadata() {
     registerToolMetadata("terminal_session_status", { mcpExportPolicy: "never-export", exitCodeIsDrivenSession: true });
     registerToolMetadata("terminal_session_resize", { mcpExportPolicy: "never-export" });
     registerToolMetadata("terminal_session_kill", { mcpExportPolicy: "never-export" });
-    // Context expansion (3) — never-export; in-session lossless-store recovery (E1/E2),
+    // Context expansion (3) — never-export; in-session lossless-store recovery,
     // NOT an MCP-exported surface and DISTINCT from cross-session recall.
     registerToolMetadata("ctx_search", { mcpExportPolicy: "never-export" });
     registerToolMetadata("ctx_inspect", { mcpExportPolicy: "never-export" });
     registerToolMetadata("ctx_expand", { mcpExportPolicy: "never-export" });
-    // Sleep (STREAM-03) — never-export; an internal between-turns pacing primitive
+    // Sleep — never-export; an internal between-turns pacing primitive
     // inside Comis's trust boundary, not a capability an external MCP client needs.
     registerToolMetadata("sleep", { mcpExportPolicy: "never-export" });
-    // Failure Detectors (§16.10/§16.11) — web_search / web_fetch structured-field
-    // failure classification. Extracted to keep this file ≤800 lines (the
-    // closures-extraction protocol; behavior-neutral spread-merge onto the
-    // existing entries — the unique-tool count is unchanged).
+    // Failure Detectors — web_search / web_fetch structured-field failure
+    // classification. Extracted to keep this file ≤800 lines; a behavior-neutral
+    // spread-merge onto the existing entries — the unique-tool count is unchanged.
     registerFailureDetectorMetadata();
 }

package/node_modules/@comis/skills/dist/skills/index.js

@@ -110,8 +110,8 @@ export { createFileStateTracker, isDeviceFile } from "../tools/builtin/file/file
 export { parseInstallDetour } from "../tools/builtin/install-detour.js";
 // Built-in tools -- Exec sandbox detection
 export { detectSandboxProvider } from "../tools/builtin/sandbox/detect-provider.js";
-// JAIL-03 namespace preflight (Phase 211) — the boot probe consumed by the
-// daemon (211-06) to feed the shipped degradeAutonomy. See tools/index.ts.
+// Namespace preflight — the boot probe consumed by the daemon to feed
+// degradeAutonomy. See tools/index.ts.
 export { namespacePreflight } from "../tools/builtin/sandbox/detect-provider.js";
 // Browser -- service
 export { createBrowserService } from "../tools/browser/index.js";
@@ -146,8 +146,8 @@ export { createPdfPageRenderer } from "../tools/integrations/document/pdf-page-r
 export { createCompositeFileExtractor } from "../tools/integrations/document/composite-extractor.js";
 // Image generation (provider adapters, factory, rate limiter)
 export { createImageGenProvider, createImageGenRateLimiter } from "../tools/integrations/image-gen/index.js";
-// Video generation (FAL queue adapter, factory, rate limiter) — Phase 188 / Plan
-// 04 consumes these from the bare @comis/skills barrel exactly like the image
+// Video generation (FAL queue adapter, factory, rate limiter) — the daemon
+// consumes these from the bare @comis/skills barrel exactly like the image
 // route (the daemon bundle imports the factory + rate limiter; the deps type
 // imports VideoGenRateLimiter).
 export { createVideoGenProvider, createVideoGenRateLimiter } from "../tools/integrations/video-gen/index.js";

package/node_modules/@comis/skills/dist/skills/integrations/mcp-client/mcp-client-discover.d.ts

@@ -26,8 +26,7 @@ export { scrubStdioEnv, MCP_STDIO_BUILTIN_ENV_ALLOWLIST };
  * Wrap a stdio command so:
  *   1. NODE_OPTIONS strip — child Node process does NOT inherit the daemon's
  *      `--permission` flags. `env -u NODE_OPTIONS` clears it before Node reads
- *      it. Non-Node servers (uvx, Python) pass through as no-op. See
- *      COMIS-E2E-FOLLOWUP-DESIGN.md Issue 2.
+ *      it. Non-Node servers (uvx, Python) pass through as no-op.
  *   2. Per-server rlimits via `prlimit(1)`. When `rlimits`
  *      is set AND prlimit is available, prepends `prlimit --as=N --nofile=N
  *      --cpu=N --`. Partial overrides accepted (`{ cpu: 600 }` → only `--cpu`).

package/node_modules/@comis/skills/dist/skills/integrations/mcp-client/mcp-client-discover.js

@@ -48,8 +48,7 @@ const INSTRUCTIONS_TRUNCATED_SUFFIX = " [truncated]";
  * Wrap a stdio command so:
  *   1. NODE_OPTIONS strip — child Node process does NOT inherit the daemon's
  *      `--permission` flags. `env -u NODE_OPTIONS` clears it before Node reads
- *      it. Non-Node servers (uvx, Python) pass through as no-op. See
- *      COMIS-E2E-FOLLOWUP-DESIGN.md Issue 2.
+ *      it. Non-Node servers (uvx, Python) pass through as no-op.
  *   2. Per-server rlimits via `prlimit(1)`. When `rlimits`
  *      is set AND prlimit is available, prepends `prlimit --as=N --nofile=N
  *      --cpu=N --`. Partial overrides accepted (`{ cpu: 600 }` → only `--cpu`).

package/node_modules/@comis/skills/dist/skills/integrations/mcp-client/mcp-client-redirect-policy.js

@@ -21,7 +21,8 @@ const SENSITIVE_HEADERS_TO_STRIP_ON_CROSS_HOST = [
     "authorization",
     "cookie",
     "proxy-authorization",
-    // Extended auth headers (OpenClaw 13-header set — cross-origin exfil vectors)
+    // Extended vendor auth headers — these also carry credentials, so they are
+    // cross-origin exfil vectors and must be stripped on cross-host redirect.
     "x-auth-token",
     "x-api-key",
     "x-authorization",

package/node_modules/@comis/skills/dist/skills/integrations/mcp-client/oauth/browser-callback.d.ts

@@ -9,9 +9,9 @@
  * rejection — so no port or file descriptor lingers.
  *
  * ── ZERO module-scope mutables ──────────────────────────────────────────────
- * Hermes kept the callback port in a MODULE-GLOBAL (`_oauth_port`); two
- * concurrent logins then clobbered each other's port (a TOCTOU that could
- * mis-route an authorization code). THIS file therefore has NO module-scope
+ * A module-global callback port (e.g. `_oauth_port`) would let two concurrent
+ * logins clobber each other's port — a TOCTOU that could mis-route an
+ * authorization code. THIS file therefore has NO module-scope
  * `let`/`var`. Every piece of mutable state — the server handle, the port, the
  * `state`, the `code_verifier`, the resolve/reject, the timeout timer, the
  * "already settled" guard — lives inside the closure of a single