comisai 1.0.45 → 1.0.46

package/node_modules/@comis/channels/dist/telegram/telegram-adapter/index.js

@@ -34,7 +34,7 @@ export function createTelegramAdapter(deps) {
     // E2E seam: if deps.apiRoot is set, point grammy at that URL instead of
     // api.telegram.org. Production callers leave it unset and grammy uses its
     // default (https://api.telegram.org). The `client` option is included ONLY
-    // when redirected: keeps the production code path byte-identical to before.
+    // when redirected: the production path constructs the Bot with no options object.
     const bot = deps.apiRoot
         ? new Bot(deps.botToken, { client: { apiRoot: deps.apiRoot } })
         : new Bot(deps.botToken);

package/node_modules/@comis/channels/dist/telegram/telegram-adapter/telegram-adapter-types.d.ts

@@ -59,7 +59,7 @@ export interface TelegramAdapterState {
     bot: Bot;
     /** Message handlers registered via handle.onMessage(). */
     handlers: MessageHandler[];
-    /** Reaction handlers registered via handle.onReaction() (REACT-01, WS1). */
+    /** Reaction handlers registered via handle.onReaction(). */
     reactionHandlers: ReactionHandler[];
     /** "telegram-pending" before start(); "telegram-{botId}" after start() succeeds. */
     channelId: string;

package/node_modules/@comis/channels/dist/telegram/telegram-adapter/telegram-inbound.d.ts

@@ -33,5 +33,5 @@ export declare function handleInboundMessage(state: TelegramAdapterState, deps:
 export declare function bindInboundHandlers(state: TelegramAdapterState, deps: TelegramAdapterDeps): void;
 /** Append a MessageHandler to the adapter's dispatch list. */
 export declare function registerMessageHandler(state: TelegramAdapterState, handler: import("@comis/core").MessageHandler): void;
-/** Append a ReactionHandler to the adapter's reaction dispatch list (REACT-01). */
+/** Append a ReactionHandler to the adapter's reaction dispatch list. */
 export declare function registerReactionHandler(state: TelegramAdapterState, handler: import("@comis/core").ReactionHandler): void;

package/node_modules/@comis/channels/dist/telegram/telegram-adapter/telegram-inbound.js

@@ -205,14 +205,14 @@ export function bindInboundHandlers(state, deps) {
             }, "Callback query failed");
         }
     });
-    // REACT-01: inbound reaction-add capture. Requires the runner allowed_updates
+    // Inbound reaction-add capture. Requires the runner allowed_updates
     // opt-in to include "message_reaction" (telegram-lifecycle.ts) — without it
     // Telegram never delivers this update. A reaction-ADD = an emoji present in
     // new_reaction but NOT in old_reaction; a removal-only update is skipped.
     // NOTE (webhook mode): telegram-webhook.ts picks runner vs webhook via
     // shouldUseRunner; the allowed_updates opt-in covers the runner (polling)
     // path. A webhook deployment must pass the same allowed_updates list to
-    // setWebhook (operator-side config, DOC-01) — out of scope for this binder.
+    // setWebhook (operator-side config) — out of scope for this binder.
     state.bot.on("message_reaction", (ctx) => {
         const mr = ctx.messageReaction;
         if (!mr || !mr.user)
@@ -274,7 +274,7 @@ function warnReactionHandlerFailed(deps, handlerErr) {
 export function registerMessageHandler(state, handler) {
     state.handlers.push(handler);
 }
-/** Append a ReactionHandler to the adapter's reaction dispatch list (REACT-01). */
+/** Append a ReactionHandler to the adapter's reaction dispatch list. */
 export function registerReactionHandler(state, handler) {
     state.reactionHandlers.push(handler);
 }

package/node_modules/@comis/channels/dist/telegram/telegram-adapter/telegram-lifecycle.js

@@ -77,7 +77,7 @@ export async function startLifecycle(state, deps) {
     // Wire grammy event handlers (message / edited_message / poll / callback_query)
     bindInboundHandlers(state, deps);
     // Start polling (webhook mode deferred).
-    // REACT-01 (Pitfall 1): once allowed_updates is set it must enumerate EVERY
+    // Once allowed_updates is set it must enumerate EVERY
     // update bindInboundHandlers consumes (message, edited_message,
     // callback_query, poll) PLUS message_reaction — omitting an existing one
     // silently stops its delivery. Telegram excludes message_reaction from the

package/node_modules/@comis/channels/dist/telegram/telegram-adapter/telegram-outbound.js

@@ -201,9 +201,8 @@ export async function sendAttachment(state, deps, chatId, attachment, options) {
         // A successful Telegram send ALWAYS returns a numeric message_id. A missing id
         // means the platform did not accept the media — returning ok(String(undefined))
         // === "undefined" is a false success that hides a real delivery failure
-        // (openclaw-usecases 2026-06-25: image-gen/TTS produced real artifacts but were
-        // never delivered; the adapter logged "attachment sent" with
-        // messageId:"undefined" and the channel oracle showed 0 media sends). Fail
+        // (generated media can produce real artifacts that are never delivered while
+        // the adapter logs "attachment sent" with messageId:"undefined"). Fail
         // honestly + name the knob instead of a silent false-success.
         const sentMessageId = sent?.message_id;
         if (sentMessageId == null) {

package/node_modules/@comis/channels/dist/telegram/telegram-adapter/telegram-webhook.d.ts

@@ -36,7 +36,7 @@ export declare function sanitizeTelegramHtml(text: string): string;
  * Retry a send operation without `message_thread_id` if the target forum
  * topic has been deleted or closed. Non-thread errors re-throw.
  *
- * Design Section 5.4.8: The `sendFn` receives thread params as an argument
+ * The `sendFn` receives thread params as an argument
  * so the wrapper can retry with `undefined` to strip them on fallback.
  */
 export declare function sendWithThreadFallback<T>(sendFn: (threadParams?: {

package/node_modules/@comis/channels/dist/telegram/telegram-adapter/telegram-webhook.js

@@ -65,7 +65,7 @@ export function sanitizeTelegramHtml(text) {
  * Retry a send operation without `message_thread_id` if the target forum
  * topic has been deleted or closed. Non-thread errors re-throw.
  *
- * Design Section 5.4.8: The `sendFn` receives thread params as an argument
+ * The `sendFn` receives thread params as an argument
  * so the wrapper can retry with `undefined` to strip them on fallback.
  */
 export async function sendWithThreadFallback(sendFn, threadParams, logger) {

package/node_modules/@comis/channels/dist/telegram/telegram-plugin.js

@@ -18,7 +18,7 @@ const CAPABILITIES = {
         deleteMessages: true,
         fetchHistory: false,
         attachments: true,
-        // §17.2: Telegram EditPlace — typing indicator + inline keyboard buttons.
+        // Telegram EditPlace — typing indicator + inline keyboard buttons.
         typing: true,
         threads: false,
         buttons: "inline",

package/node_modules/@comis/channels/dist/telegram/telegram-resolver.d.ts

@@ -37,8 +37,8 @@ export interface TelegramResolverDeps {
      * Bot API root override (production: undefined → real Telegram). When set (a self-hosted local
      * Bot API server, or the test emulator), the file-DOWNLOAD URL must use this base too — `getFile`
      * already honors it via the grammy client, but the byte download is a manual fetch. Without this
-     * the download hardcoded `https://api.telegram.org/file/…` and 404'd against real Telegram while
-     * getFile pointed at the override (30uc-20260624 UC-05).
+     * the download would hardcode `https://api.telegram.org/file/…` and 404 against real Telegram
+     * while getFile pointed at the override.
      */
     apiRoot?: string;
 }

package/node_modules/@comis/channels/dist/telegram/telegram-resolver.js

@@ -74,7 +74,7 @@ export function createTelegramResolver(deps) {
                     return err(new Error(sanitizeError(msg)));
                 }
                 const { buffer, mimeType: fetchedMime, sizeBytes } = fetchResult.value;
-                // MEDIA-TYPE (30uc-20260624 UC-05): the MediaResolverPort contract specifies a VERIFIED
+                // The MediaResolverPort contract specifies a VERIFIED
                 // (sniffed, not declared) MIME type. Telegram's getFile `file_path` / the file-server
                 // content-type can mislabel the bytes (e.g. a `.jpg` path / `image/jpeg` header for PNG
                 // bytes), and the model vision API rejects a declared type that mismatches the actual bytes

package/node_modules/@comis/channels/dist/whatsapp/jid-utils.d.ts

@@ -1,8 +1,7 @@
 /**
  * WhatsApp JID (Jabber ID) normalization utilities.
  *
- * Ported from legacy src/whatsapp/normalize.ts with clearer naming
- * and self-contained implementation (no external utility imports).
+ * Self-contained implementation (no external utility imports).
  *
  * WhatsApp JID formats:
  * - User: "41796666864:0@s.whatsapp.net" (phone with device suffix)

package/node_modules/@comis/channels/dist/whatsapp/jid-utils.js

@@ -2,8 +2,7 @@
 /**
  * WhatsApp JID (Jabber ID) normalization utilities.
  *
- * Ported from legacy src/whatsapp/normalize.ts with clearer naming
- * and self-contained implementation (no external utility imports).
+ * Self-contained implementation (no external utility imports).
  *
  * WhatsApp JID formats:
  * - User: "41796666864:0@s.whatsapp.net" (phone with device suffix)

package/node_modules/@comis/channels/dist/whatsapp/whatsapp-activity.js

@@ -1,8 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * WhatsApp windowed EditPlace activity renderer (§7.2 / §18.2 row
- * "EditPlace"). Copies the Telegram canonical shape with a
- * baileys-specific classifier and the windowing semantics. Three parts:
+ * WhatsApp windowed EditPlace activity renderer. Copies the Telegram
+ * canonical shape with a baileys-specific classifier and the windowing
+ * semantics. Three parts:
  *
  *   1. `classifyWhatsAppError` — the single net-new piece of logic here. WhatsApp
  *      Business edit/delete is WINDOWED (~15 min); baileys offers NO numeric
@@ -16,7 +16,7 @@
  *      connected" Error → `{kind:"transient_network", cause}`. Everything else
  *      (5xx, connection 408/428, unknown) → `{kind:"internal", cause}`. The
  *      message text is consulted only to disambiguate; it is never rendered or
- *      logged (§19.3).
+ *      logged.
  *
  *   2. `makeWhatsAppRenderActions` — the `ActivityRenderActions` adapter. `send`
  *      posts a plain-text placeholder (WhatsApp has NO button surface —
@@ -90,7 +90,7 @@ function isNotConnected(e) {
  * edits (no retry loop).
  */
 export function makeWhatsAppRenderActions(adapter, channelId) {
-    /** Set once a window-expiry is seen — all further edits are dropped (§drop-on-not_supported). */
+    /** Set once a window-expiry is seen — all further edits are dropped. */
     let editsDropped = false;
     return {
         async send(text) {
@@ -153,7 +153,7 @@ export function createWhatsAppActivityRenderer(adapter, channelId, deps) {
         markers: deps.markers,
         // WhatsApp has no button surface (`buttons:"none"`), so an approval frame
         // appends the plain-text prompt ("Reply approve or deny …", with shortIds when
-        // >1 pending) to the placeholder (§6.4.6). A non-approval frame yields
+        // >1 pending) to the placeholder. A non-approval frame yields
         // "" (the placeholder text stays byte-identical).
         buildPrompt: buildApprovalPrompt,
     });

package/node_modules/@comis/channels/dist/whatsapp/whatsapp-plugin.js

@@ -17,7 +17,7 @@ const CAPABILITIES = {
         deleteMessages: true,
         fetchHistory: false,
         attachments: true,
-        // §17.2: WhatsApp EditPlace (windowed) — typing, no threads, no buttons.
+        // WhatsApp EditPlace (windowed) — typing, no threads, no buttons.
         typing: true,
         threads: false,
         buttons: "none",

package/node_modules/@comis/channels/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/channels",
   "private": true,
-  "version": "1.0.45",
+  "version": "1.0.46",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Chat platform adapters — Discord, Telegram, Slack, WhatsApp, Signal, iMessage, IRC, LINE",

package/node_modules/@comis/cli/dist/cli.d.ts

@@ -1,3 +1,12 @@
 #!/usr/bin/env node
+/**
+ * Comis CLI entry point.
+ *
+ * Commander.js program that registers all CLI subcommands and handles
+ * top-level error formatting. All commands are registered via their
+ * respective register*Command functions.
+ *
+ * @module
+ */
 import { Command } from "commander";
 export declare const program: Command;

package/node_modules/@comis/cli/dist/cli.js

@@ -9,8 +9,8 @@
  *
  * @module
  */
-import { createRequire } from "node:module";
 import { Command } from "commander";
+import { readCliVersion } from "./util/cli-version.js";
 import { registerAgentCommand } from "./commands/agent.js";
 import { registerAuthCommand } from "./commands/auth.js";
 import { registerCacheCommand } from "./commands/cache.js";
@@ -34,14 +34,14 @@ import { registerSecretsCommand } from "./commands/secrets.js";
 import { registerSignalSetupCommand } from "./commands/signal-setup.js";
 import { registerTraceCommand } from "./commands/trace.js";
 import { registerExplainCommand } from "./commands/explain.js";
+import { registerOrchestrateCommand } from "./commands/orchestrate.js";
 import { registerWhoamiCommand } from "./commands/whoami.js";
 import { registerCostExportCommand } from "./commands/cost-export.js";
 import { registerFleetCommand } from "./commands/fleet.js";
+import { registerSupportBundleCommand } from "./commands/support-bundle.js";
 import { registerUninstallCommand } from "./commands/uninstall.js";
 export const program = new Command();
-const cliRequire = createRequire(import.meta.url);
-const cliPkg = cliRequire("../package.json");
-program.name("comis").description("Comis AI agent management CLI").version(cliPkg.version);
+program.name("comis").description("Comis AI agent management CLI").version(readCliVersion() ?? "");
 // Register command groups
 registerDaemonCommand(program);
 registerConfigCommand(program);
@@ -66,9 +66,11 @@ registerSecretsCommand(program);
 registerSignalSetupCommand(program);
 registerTraceCommand(program);
 registerExplainCommand(program);
+registerOrchestrateCommand(program);
 registerWhoamiCommand(program);
 registerCostExportCommand(program);
 registerFleetCommand(program);
+registerSupportBundleCommand(program);
 registerUninstallCommand(program);
 // Parse and execute
 program.parseAsync(process.argv).catch((err) => {

package/node_modules/@comis/cli/dist/client/rpc-client.d.ts

@@ -60,9 +60,9 @@ export declare function callTyped<Req extends ZodTypeAny, Res extends ZodTypeAny
  * pointed at — e.g. a test/second daemon on another port. Falls back to the
  * standard `~/.comis/config.yaml` when unset or blank.
  *
- * UX-2 (LOCAL re-test 2026-06-20): without this the CLI always read
- * `~/.comis/config.yaml`, so a `COMIS_DATA_DIR`/`COMIS_CONFIG_PATHS` daemon on
- * :4777 was unreachable via the CLI unless you also set `COMIS_GATEWAY_URL`.
+ * Without this the CLI would always read `~/.comis/config.yaml`, so a
+ * `COMIS_DATA_DIR`/`COMIS_CONFIG_PATHS` daemon on a non-default port would be
+ * unreachable via the CLI unless `COMIS_GATEWAY_URL` were also set.
  */
 export declare function resolveGatewayConfigPath(): string;
 /**
@@ -96,7 +96,7 @@ export declare function checkTransportSecurity(url: string, token: string | unde
  * @throws Error if connection times out or is refused
  */
 /**
- * Stable prefix of the gateway token-rejection error (W13 obs-llm-troubleshooting).
+ * Stable prefix of the gateway token-rejection error.
  * The gateway closes an unauthorized WebSocket with code 4001 (hono-server.ts);
  * mapping that close onto this named error lets `isDaemonRunning` treat an
  * auth-rejection as PROOF the daemon is up — the old path collapsed it into

package/node_modules/@comis/cli/dist/client/rpc-client.js

@@ -94,9 +94,9 @@ function resolveEnvRef(value) {
  * pointed at — e.g. a test/second daemon on another port. Falls back to the
  * standard `~/.comis/config.yaml` when unset or blank.
  *
- * UX-2 (LOCAL re-test 2026-06-20): without this the CLI always read
- * `~/.comis/config.yaml`, so a `COMIS_DATA_DIR`/`COMIS_CONFIG_PATHS` daemon on
- * :4777 was unreachable via the CLI unless you also set `COMIS_GATEWAY_URL`.
+ * Without this the CLI would always read `~/.comis/config.yaml`, so a
+ * `COMIS_DATA_DIR`/`COMIS_CONFIG_PATHS` daemon on a non-default port would be
+ * unreachable via the CLI unless `COMIS_GATEWAY_URL` were also set.
  */
 export function resolveGatewayConfigPath() {
     const fromEnv = systemGetEnv("COMIS_CONFIG_PATHS");
@@ -270,7 +270,7 @@ export function checkTransportSecurity(url, token, allowInsecure = false) {
  * @throws Error if connection times out or is refused
  */
 /**
- * Stable prefix of the gateway token-rejection error (W13 obs-llm-troubleshooting).
+ * Stable prefix of the gateway token-rejection error.
  * The gateway closes an unauthorized WebSocket with code 4001 (hono-server.ts);
  * mapping that close onto this named error lets `isDaemonRunning` treat an
  * auth-rejection as PROOF the daemon is up — the old path collapsed it into
@@ -387,9 +387,9 @@ export async function createRpcClient(url, token) {
         ws.on("close", (code, reason) => {
             systemClearTimeout(timeout);
             closed = true;
-            // W13: surface WHY. The gateway closes 4001/4003 for token problems —
-            // collapsing those into the generic message sent operators (and the
-            // live investigation) chasing a daemon that was up the whole time.
+            // Surface WHY the socket closed. The gateway closes 4001/4003 for token
+            // problems — collapsing those into the generic message sends operators
+            // chasing a daemon that was up the whole time.
             const closeErr = closeCodeError(code, reason?.toString() ?? "");
             // A close BEFORE open (handshake-stage rejection) must reject the
             // connection promise instead of hanging until the timeout.

package/node_modules/@comis/cli/dist/commands/agent.js

@@ -30,8 +30,8 @@ export function registerAgentCommand(program) {
         .action(async (options) => {
         try {
             const result = await withSpinner("Fetching agents...", () => withClient(async (client) => {
-                // Retargeted from stale `config.get` method name (daemon implements
-                // `config.read`) to ConfigReadContract.
+                // ConfigReadContract targets `config.read` — the method name the
+                // daemon actually implements (there is no `config.get` RPC).
                 return await callTyped(client, ConfigReadContract, {
                     section: "agents",
                 });
@@ -78,7 +78,7 @@ export function registerAgentCommand(program) {
                 });
             }));
             // Initialize dedicated workspace for the new agent (honors
-            // COMIS_DATA_DIR like the daemon's resolution — 260611 dataDir fix).
+            // COMIS_DATA_DIR so the CLI resolves the same dir as the daemon).
             // systemGetEnv (not raw process.env) per the no-restricted-syntax gate.
             const workspaceDir = resolveWorkspaceDir({ workspacePath: undefined }, name, systemGetEnv("COMIS_DATA_DIR"));
             try {

package/node_modules/@comis/cli/dist/commands/auth.js

@@ -50,7 +50,7 @@ import open from "open";
 import { loadConfigFile, loadEnvFile, validateConfig, preReadStorageMode, safePath, validateProfileId, redactEmailForLog, } from "@comis/core";
 import { selectOAuthCredentialStore, loginOpenAICodexOAuth, isRemoteEnvironment, 
 // createFileLock and OAuth helpers are consumed from @comis/core.
-// CLI no longer routes through the @comis/agent barrel for these.
+// CLI does not route through the @comis/agent barrel for these.
 createFileLock, 
 // createConsoleLogger is the Pino-free logger for CLI use.
 // CLI does not import from @comis/infra.
@@ -75,11 +75,11 @@ const PROVIDER_OPENAI_CODEX = "openai-codex";
 // + the data-dir convention, so `comis auth …` finds the SAME config the daemon
 // uses WITHOUT requiring an explicit COMIS_CONFIG_PATHS on the command line.
 //
-// Before this, auth.ts checked ONLY `${HOME}/.comis/config.yaml` (a single path).
-// A config at `/etc/comis/config.yaml`, a `config.local.yaml`, or a daemon run
-// with COMIS_DATA_DIR pointing elsewhere was therefore MISSED — and on a miss,
-// `loadStorageMode` silently defaulted to FILE (plaintext) OAuth credential
-// storage even when the operator had configured `security.storage: encrypted`,
+// Checking a single hardcoded path (`${HOME}/.comis/config.yaml`) would MISS a
+// config at `/etc/comis/config.yaml`, a `config.local.yaml`, or a daemon run
+// with COMIS_DATA_DIR pointing elsewhere — and on a miss,
+// `loadStorageMode` silently defaults to FILE (plaintext) OAuth credential
+// storage even when the operator has configured `security.storage: encrypted`,
 // writing OAuth tokens to plaintext `auth-profiles.json`. This resolver closes
 // that gap; the loud warning in `loadStorageMode` closes the silent-downgrade.
 // ---------------------------------------------------------------------------
@@ -148,9 +148,9 @@ export async function loadStorageMode() {
     // WARN loudly: writing OAuth tokens to plaintext when the operator may have
     // configured `security.storage: encrypted` is a security footgun (it was
     // exactly how openai-codex tokens once landed in plaintext auth-profiles.json).
-    // This branch now fires ONLY when the file is truly absent — so the message
-    // is accurate again (previously it also fired when the file existed but a
-    // ${VAR} ref failed to resolve, pointing the operator the wrong way).
+    // This branch fires ONLY when the file is truly absent — firing it when the
+    // file exists but a ${VAR} ref fails to resolve would point the operator
+    // the wrong way.
     if (!existsSync(configPath)) {
         info(`No Comis config found at ${configPath} — defaulting to FILE (plaintext) OAuth ` +
             "credential storage. If you intend encrypted storage, point the CLI at your config " +
@@ -410,8 +410,8 @@ export function registerAuthCommand(program) {
             await requireDaemonOrExit();
             try {
                 // callTyped always enforces the AuthListContract request/response
-                // schemas (Zod parse on both sides). The daemon side has always
-                // parsed; the CLI side now matches (no env gating).
+                // schemas (Zod parse on both sides). Both the daemon side and the
+                // CLI side parse unconditionally (no env gating).
                 const result = await withClient(async (client) => callTyped(client, AuthListContract, opts.provider ? { provider: opts.provider } : {}));
                 renderAuthProfileTable(result.profiles, opts.provider);
             }
@@ -584,8 +584,8 @@ export function registerAuthCommand(program) {
                 return; // unreachable
             }
         }
-        // From here down: BYTE-IDENTICAL to the pre-migration auth status
-        // grouping. The encrypted-branch profile rows have the same shape
+        // From here down the grouping is shared by both branches: the
+        // encrypted-branch profile rows have the same shape
         // (provider/profileId/expires/email?/displayName?) as the file-branch
         // projection, so a single grouping algorithm handles both.
         if (profiles.length === 0) {

package/node_modules/@comis/cli/dist/commands/channel.js

@@ -58,10 +58,9 @@ export function registerChannelCommand(program) {
         .action(async (options) => {
         try {
             // Config tells us what is CONFIGURED (enabled/disabled + identity
-            // details); channels.health tells us what is actually RUNNING. The
-            // old config-only read defaulted every enabled channel to
-            // "disconnected" — a static lie against a healthy live adapter
-            // (live C5 finding, 2026-06-12).
+            // details); channels.health tells us what is actually RUNNING. A
+            // config-only read would default every enabled channel to
+            // "disconnected" — a static lie against a healthy live adapter.
             const { config, health } = await withSpinner("Fetching channel status...", () => withClient(async (client) => {
                 const config = await callTyped(client, ConfigReadContract, {
                     section: "channels",
@@ -119,7 +118,7 @@ function extractChannels(config, healthEntries) {
     }
     const channelTypes = [
         "telegram", "discord", "slack", "whatsapp", "signal",
-        "imessage", "line", "irc", "email",
+        "imessage", "line", "irc", "email", "msteams",
     ];
     for (const type of channelTypes) {
         const chConfig = channelsObj[type];

package/node_modules/@comis/cli/dist/commands/cost-export.d.ts

@@ -1,20 +1,19 @@
 /**
- * `comis cost export` — operator CLI for the COST-03 corrected-cost export.
+ * `comis cost export` — operator CLI for the corrected-cost export.
  *
  * Emits the corrected-cost time buckets (hourly by default, or 15-min quarter-hour
  * via `--quarter-hour`) as CSV (default) or JSON, honoring agent/provider/model/since
  * filters. Each row carries the four cost rollups + cacheSaved + costCorrection + the
- * E1 pricing-coverage pair (`pricingState`/`missingPricingCount`) so a finance review
+ * pricing-coverage pair (`pricingState`/`missingPricingCount`) so a finance review
  * sees how trustworthy the dollars are.
  *
  * Data source: the LOCAL ~/.comis observability store, read OFFLINE — the telemetry
  * lives on disk, so an export must not require a live gateway. (There is no admin
- * aggregate RPC for the quarter-hour buckets yet; a dedicated export RPC is 179-04's,
- * NOT invented here — which is also why this command contacts no daemon RPC and so
- * trivially satisfies the cli-uses-typed-rpc gate.)
+ * aggregate RPC for the quarter-hour buckets; this command deliberately contacts no
+ * daemon RPC and so trivially satisfies the cli-uses-typed-rpc gate.)
  *
  * Content-free: the CSV/JSON carries ONLY the explicit column allowlist (the cost
- * buckets + coverage) — never a message body / secret / query (threat T-179-07). The
+ * buckets + coverage) — never a message body / secret / query. The
  * `toCsv` serializer projects only `COST_EXPORT_COLUMNS`, so a stray source-row field
  * can never reach the file.
  *

package/node_modules/@comis/cli/dist/commands/cost-export.js

@@ -1,22 +1,21 @@
 // SPDX-License-Identifier: Apache-2.0
 // @allow-throw: CLI command module — Commander.js boundary catches throws and surfaces user-readable messages. The catch block below converts them to error()/process.exit(1) directly.
 /**
- * `comis cost export` — operator CLI for the COST-03 corrected-cost export.
+ * `comis cost export` — operator CLI for the corrected-cost export.
  *
  * Emits the corrected-cost time buckets (hourly by default, or 15-min quarter-hour
  * via `--quarter-hour`) as CSV (default) or JSON, honoring agent/provider/model/since
  * filters. Each row carries the four cost rollups + cacheSaved + costCorrection + the
- * E1 pricing-coverage pair (`pricingState`/`missingPricingCount`) so a finance review
+ * pricing-coverage pair (`pricingState`/`missingPricingCount`) so a finance review
  * sees how trustworthy the dollars are.
  *
  * Data source: the LOCAL ~/.comis observability store, read OFFLINE — the telemetry
  * lives on disk, so an export must not require a live gateway. (There is no admin
- * aggregate RPC for the quarter-hour buckets yet; a dedicated export RPC is 179-04's,
- * NOT invented here — which is also why this command contacts no daemon RPC and so
- * trivially satisfies the cli-uses-typed-rpc gate.)
+ * aggregate RPC for the quarter-hour buckets; this command deliberately contacts no
+ * daemon RPC and so trivially satisfies the cli-uses-typed-rpc gate.)
  *
  * Content-free: the CSV/JSON carries ONLY the explicit column allowlist (the cost
- * buckets + coverage) — never a message body / secret / query (threat T-179-07). The
+ * buckets + coverage) — never a message body / secret / query. The
  * `toCsv` serializer projects only `COST_EXPORT_COLUMNS`, so a stray source-row field
  * can never reach the file.
  *

package/node_modules/@comis/cli/dist/commands/doctor.d.ts

@@ -12,8 +12,8 @@ import type { Command } from "commander";
  * Register the `doctor` command on the program.
  *
  * Provides:
- * - `comis doctor` -- run 8 health check categories (config, daemon, gateway,
- *   channel, workspace, OAuth, secrets-audit, LCD store)
+ * - `comis doctor` -- run 10 health check categories (config, daemon, gateway,
+ *   version-skew, channel, Teams, workspace, OAuth, secrets-audit, LCD store)
  * - `comis doctor --repair` -- auto-fix repairable issues
  * - `comis doctor --refresh-test` -- opt-in refresh probe per profile.
  *   WARNING: rotates the refresh token at OpenAI.

package/node_modules/@comis/cli/dist/commands/doctor.js

@@ -10,7 +10,6 @@
  */
 import * as os from "node:os";
 import { existsSync } from "node:fs";
-import { createRequire } from "node:module";
 import Database from "better-sqlite3";
 import { success, error, info } from "../output/format.js";
 import { withSpinner } from "../output/spinner.js";
@@ -20,6 +19,7 @@ import { configHealthCheck } from "../doctor/checks/config-health.js";
 import { daemonHealthCheck } from "../doctor/checks/daemon-health.js";
 import { gatewayHealthCheck } from "../doctor/checks/gateway-health.js";
 import { channelHealthCheck } from "../doctor/checks/channel-health.js";
+import { msteamsHealthCheck } from "../doctor/checks/msteams-health.js";
 import { workspaceHealthCheck } from "../doctor/checks/workspace-health.js";
 import { oauthHealthCheck } from "../doctor/checks/oauth-health.js";
 import { lcdHealthCheck } from "../doctor/checks/lcd-health.js";
@@ -31,24 +31,8 @@ import { repairWorkspace } from "../doctor/repairs/repair-workspace.js";
 import { repairConfigAudit } from "../doctor/repairs/repair-config-audit.js";
 import { repairFtsDrift, repairContextItems } from "../doctor/repairs/repair-lcd.js";
 import { resolveDoctorConfig } from "../doctor/config-resolve.js";
-/**
- * This CLI's own version, read from `packages/cli/package.json` (mirrors how
- * `cli.ts` sets `program.version`). Threaded onto the DoctorContext so the
- * version-skew check compares it against the daemon's reported version without
- * re-reading the package at check time. `undefined` if the read fails (the
- * check then degrades to its own package.json fallback / a skip).
- */
-function readCliVersion() {
-    try {
-        const req = createRequire(import.meta.url);
-        const pkg = req("../../package.json");
-        return pkg.version;
-    }
-    catch {
-        return undefined;
-    }
-}
-/** All doctor checks in execution order (9 categories). */
+import { readCliVersion } from "../util/cli-version.js";
+/** All doctor checks in execution order (10 checks). */
 const ALL_CHECKS = [
     configHealthCheck,
     daemonHealthCheck,
@@ -58,6 +42,10 @@ const ALL_CHECKS = [
     // schema failures (stale global `comis` incident).
     versionSkewHealthCheck,
     channelHealthCheck,
+    // Teams is a webhook channel (stale-reap-exempt), so its liveness cannot ride
+    // the health monitor — this check probes creds, the mounted ingress endpoint,
+    // recent INBOUND-ONLY activity, and tenant presence directly.
+    msteamsHealthCheck,
     workspaceHealthCheck,
     oauthHealthCheck,
     secretsAuditHealthCheck,
@@ -119,8 +107,8 @@ function buildDoctorContext(configPaths) {
  * Register the `doctor` command on the program.
  *
  * Provides:
- * - `comis doctor` -- run 8 health check categories (config, daemon, gateway,
- *   channel, workspace, OAuth, secrets-audit, LCD store)
+ * - `comis doctor` -- run 10 health check categories (config, daemon, gateway,
+ *   version-skew, channel, Teams, workspace, OAuth, secrets-audit, LCD store)
  * - `comis doctor --repair` -- auto-fix repairable issues
  * - `comis doctor --refresh-test` -- opt-in refresh probe per profile.
  *   WARNING: rotates the refresh token at OpenAI.
@@ -130,7 +118,7 @@ function buildDoctorContext(configPaths) {
 export function registerDoctorCommand(program) {
     program
         .command("doctor")
-        .description("Diagnose configuration, daemon, gateway, channel, workspace, and OAuth health")
+        .description("Diagnose 10 subsystems: configuration, daemon, gateway, version-skew, channel, Teams, workspace, OAuth, secrets-audit, and LCD health")
         .option("--repair", "Auto-fix repairable issues")
         .option("-c, --config <paths...>", "Config file paths to check")
         .option("--format <format>", 'Output format: "table" or "json"', "table")

package/node_modules/@comis/cli/dist/commands/explain.d.ts

@@ -1,5 +1,5 @@
 /**
- * `comis explain` — operator CLI for the Phase-153 IncidentReport.
+ * `comis explain` — operator CLI for the IncidentReport.
  *
  * Assembles a bounded, redaction-safe post-mortem (outcome, cost, per-tool
  * stats, failures, breaker timeline, deterministic likely root cause) for a
@@ -8,7 +8,7 @@
  * Usage:
  *   comis explain <sessionKey|traceId|rootRunId> [--format table|json] [--depth summary|full]
  *
- * Arg routing (FLEET-05 adds the 3rd): a `root-` prefix → {rootRunId} (an
+ * Arg routing: a `root-` prefix → {rootRunId} (an
  * autonomy run — the synthetic `root-session-<key>` or a real spawned root,
  * checked FIRST); else a session key contains ':' (tenant:user:channel:ts) →
  * {sessionKey}; a UUID (no ':') → {traceId}. The daemon canonicalizes a traceId