comisai 1.0.45 → 1.0.46

package/node_modules/@comis/cli/dist/wizard/non-interactive.js

@@ -141,6 +141,17 @@ export function validateNonInteractiveOptions(opts) {
             throw new NonInteractiveError(`--tts-provider must be one of: ${known.join(", ")}`, "ttsProvider");
         }
     }
+    // --msteams-auth-mode, when provided, must be one of the closed Bot Framework
+    // auth vocabulary. Like the media-provider enums above (and the --storage
+    // enum) this is a fixed config enum — a typo would be written verbatim into
+    // config.yaml and only rejected by the daemon's MsTeamsChannelEntrySchema at
+    // boot (a FATAL, or a crash loop under --start-daemon). Reject early with a
+    // clear hint. This also restores parity with the interactive path, which
+    // bounds authMode to exactly these three values via a select prompt.
+    if (opts.msteamsAuthMode !== undefined &&
+        !["secret", "certificate", "managedIdentity"].includes(opts.msteamsAuthMode)) {
+        throw new NonInteractiveError("--msteams-auth-mode must be one of: secret, certificate, managedIdentity", "msteamsAuthMode");
+    }
     // Validate channel credentials
     if (opts.channels && opts.channels.length > 0) {
         for (const channel of opts.channels) {
@@ -171,6 +182,17 @@ export function validateNonInteractiveOptions(opts) {
                         throw new NonInteractiveError("--line-secret is required when line channel is enabled", "lineSecret");
                     }
                     break;
+                case "msteams":
+                    if (!opts.msteamsAppId) {
+                        throw new NonInteractiveError("--msteams-app-id is required when msteams channel is enabled", "msteamsAppId");
+                    }
+                    if (!opts.msteamsAppPassword) {
+                        throw new NonInteractiveError("--msteams-app-password is required when msteams channel is enabled", "msteamsAppPassword");
+                    }
+                    if (!opts.msteamsTenantId) {
+                        throw new NonInteractiveError("--msteams-tenant-id is required when msteams channel is enabled", "msteamsTenantId");
+                    }
+                    break;
                 // whatsapp, signal, irc do not require tokens at init time
                 default:
                     // Unknown channel -- allow for forward compatibility
@@ -200,9 +222,8 @@ export function buildNonInteractiveState(opts) {
     };
     // Model selection -- delegate to daemon when not specified.
     // The literal "default" is resolved at agent-execution time via the
-    // pi-ai catalog (builtin-provider-guard.ts:45 baseUrl pattern). The
-    // previous hardcoded provider->model map was removed -- the daemon
-    // decides at runtime.
+    // pi-ai catalog (builtin-provider-guard.ts baseUrl pattern). There is
+    // no CLI-side provider->model map -- the daemon decides at runtime.
     const model = opts.model ?? "default";
     // Channel configs
     const channels = [];
@@ -239,6 +260,16 @@ export function buildNonInteractiveState(opts) {
                         validated: false,
                     });
                     break;
+                case "msteams":
+                    channels.push({
+                        type: "msteams",
+                        appId: opts.msteamsAppId,
+                        appPassword: opts.msteamsAppPassword,
+                        tenantId: opts.msteamsTenantId,
+                        authMode: opts.msteamsAuthMode,
+                        validated: false,
+                    });
+                    break;
                 case "whatsapp":
                     channels.push({ type: "whatsapp", validated: false });
                     break;
@@ -255,7 +286,7 @@ export function buildNonInteractiveState(opts) {
         }
     }
     // Image-generation provider (step 08d, skipped in non-interactive mode).
-    // Mirrors the interactive step (CRED-01): an openai/google/openrouter choice
+    // Mirrors the interactive step's credential-reuse rule: an openai/google/openrouter choice
     // that matches the main provider reuses --api-key; fal or a cross-provider
     // choice uses --image-api-key; auto and openai-codex (OAuth) take no key.
     let imageProvider;
@@ -278,7 +309,7 @@ export function buildNonInteractiveState(opts) {
     }
     // Video-generation provider (step 08c, skipped in non-interactive mode).
     // Build the state the step would have produced from --video-provider. The
-    // credential resolution mirrors the interactive step (CRED-01): a google/xai
+    // credential resolution mirrors the interactive step's reuse rule: a google/xai
     // choice that matches the main provider reuses --api-key (no extra key); fal
     // or a cross-provider google/xai uses --video-api-key.
     let videoProvider;

package/node_modules/@comis/cli/dist/wizard/steps/03-provider.js

@@ -70,7 +70,7 @@ function getProviderHint(id) {
  * May drift from the live catalog (e.g., if pi-ai adds a new provider,
  * users still see the same note). Computing this from
  * PROVIDER_UI_HINTS + the loaded catalog is a future enhancement;
- * static is acceptable for v1 since the categories rarely change.
+ * static is acceptable for now since the categories rarely change.
  */
 const CATEGORY_NOTE = [
     "Recommended: Anthropic, OpenAI",

package/node_modules/@comis/cli/dist/wizard/steps/04-credentials.js

@@ -19,7 +19,7 @@
 import { updateState } from "../state.js";
 import { sectionSeparator, info } from "../theme.js";
 import { validateApiKey, getKeyPrefix } from "../validators/api-key.js";
-import { getModels } from "@earendil-works/pi-ai";
+import { getModels } from "@earendil-works/pi-ai/compat";
 import { systemClearTimeout, systemSetTimeout } from "@comis/core";
 import { handleCodexOAuth } from "./04-oauth-helpers.js";
 // ---------- Provider Help URLs ----------

package/node_modules/@comis/cli/dist/wizard/steps/04-oauth-helpers.js

@@ -118,7 +118,7 @@ export async function handleCodexOAuth(state, prompter) {
             "Set security.storage to 'file' or 'encrypted' in config.yaml to enable OAuth login.");
         return state;
     }
-    // Inline helpNote -- AUTH_METHOD_PROVIDERS no longer has an openai entry,
+    // Inline helpNote -- AUTH_METHOD_PROVIDERS has no openai entry,
     // so we cannot pull the note from the map. Keep the wording user-facing
     // and explicit about what the picker will do.
     prompter.note(info("OpenAI Codex uses your ChatGPT/Codex subscription -- no API key needed. Choose how you want to sign in."), "openai-codex OAuth");

package/node_modules/@comis/cli/dist/wizard/steps/06-channels.d.ts

@@ -1,7 +1,7 @@
 /**
  * Channel setup step -- step 06 of the init wizard.
  *
- * Presents a multiselect of all 7 supported channels with credential hints,
+ * Presents a multiselect of all 8 supported channels with credential hints,
  * collects per-channel credentials inline with format pre-checks and live
  * API validation, shows deferred guidance for WhatsApp/Signal, silently
  * adds IRC, and stores ChannelConfig[] on wizard state.

package/node_modules/@comis/cli/dist/wizard/steps/06-channels.js

@@ -2,7 +2,7 @@
 /**
  * Channel setup step -- step 06 of the init wizard.
  *
- * Presents a multiselect of all 7 supported channels with credential hints,
+ * Presents a multiselect of all 8 supported channels with credential hints,
  * collects per-channel credentials inline with format pre-checks and live
  * API validation, shows deferred guidance for WhatsApp/Signal, silently
  * adds IRC, and stores ChannelConfig[] on wizard state.
@@ -357,6 +357,64 @@ async function handleLine(prompter) {
     }
     return null;
 }
+/**
+ * Collect Microsoft Teams bot credentials.
+ *
+ * Teams authenticates via an Azure bot app registration: a GUID app (client)
+ * ID, an app password (client secret), a GUID directory (tenant) ID, and an
+ * auth mode. There is no lightweight live-validation endpoint (verifying the
+ * credentials requires a full client-credentials token exchange), so the
+ * values are format-checked only and returned validated:false — the daemon
+ * surfaces an honest auth error at first use if they are wrong.
+ */
+async function handleMsTeams(prompter) {
+    prompter.note(sectionSeparator("Microsoft Teams Setup"));
+    prompter.note(info("Register a bot app (Azure portal or Teams Toolkit), then copy its app ID, client secret, and tenant ID."));
+    const appId = await prompter.text({
+        message: "Microsoft Teams app (client) ID",
+        validate: (v) => {
+            if (typeof v !== "string")
+                return undefined;
+            const result = validateChannelCredential("msteams", "appId", v);
+            return result?.message;
+        },
+    });
+    const appPassword = await prompter.password({
+        message: "Microsoft Teams app password (client secret)",
+        validate: (v) => {
+            if (typeof v !== "string")
+                return undefined;
+            const result = validateChannelCredential("msteams", "appPassword", v);
+            return result?.message;
+        },
+    });
+    const tenantId = await prompter.text({
+        message: "Microsoft Teams directory (tenant) ID",
+        validate: (v) => {
+            if (typeof v !== "string")
+                return undefined;
+            const result = validateChannelCredential("msteams", "tenantId", v);
+            return result?.message;
+        },
+    });
+    const authMode = await prompter.select({
+        message: "Authentication mode",
+        options: [
+            { value: "secret", label: "Client secret", hint: "App password (recommended)" },
+            { value: "certificate", label: "Certificate" },
+            { value: "managedIdentity", label: "Managed identity" },
+        ],
+        initialValue: "secret",
+    });
+    return {
+        type: "msteams",
+        appId,
+        appPassword,
+        tenantId,
+        authMode,
+        validated: false,
+    };
+}
 /**
  * WhatsApp: deferred configuration guidance.
  */
@@ -442,6 +500,8 @@ async function handleChannel(channelType, prompter) {
             return { config: await handleSlack(prompter) };
         case "line":
             return { config: await handleLine(prompter) };
+        case "msteams":
+            return { config: await handleMsTeams(prompter) };
         case "whatsapp":
             return { config: handleWhatsApp(prompter) };
         case "signal":

package/node_modules/@comis/cli/dist/wizard/steps/08c-video-providers.d.ts

@@ -11,7 +11,7 @@
  *   - `fal`    — the explicit FAL queue backend: always prompts for a `FAL_KEY`
  *                (no LLM provider ever supplies it).
  *   - `google` — Veo: reuses `GOOGLE_API_KEY`. Prompts ONLY when the agent's main
- *                provider isn't already `google` (CRED-01 — no video-specific key).
+ *                provider isn't already `google` (key reuse — no video-specific key).
  *   - `xai`    — Grok Imagine: reuses `XAI_API_KEY`. Prompts ONLY when the main
  *                provider isn't already `xai`.
  *

package/node_modules/@comis/cli/dist/wizard/steps/08c-video-providers.js

@@ -12,7 +12,7 @@
  *   - `fal`    — the explicit FAL queue backend: always prompts for a `FAL_KEY`
  *                (no LLM provider ever supplies it).
  *   - `google` — Veo: reuses `GOOGLE_API_KEY`. Prompts ONLY when the agent's main
- *                provider isn't already `google` (CRED-01 — no video-specific key).
+ *                provider isn't already `google` (key reuse — no video-specific key).
  *   - `xai`    — Grok Imagine: reuses `XAI_API_KEY`. Prompts ONLY when the main
  *                provider isn't already `xai`.
  *
@@ -47,7 +47,7 @@ export const videoProvidersStep = {
             prompter.log.info("Video generation will follow your agent's main provider (reusing its key).");
             return updateState(state, { videoProvider: { provider } });
         }
-        // 3. CRED-01 reuse: if the agent's MAIN provider already supplies the exact
+        // 3. Key reuse: if the agent's MAIN provider already supplies the exact
         //    env key this backend needs (e.g. a google main + google video → both
         //    GOOGLE_API_KEY), reuse it — no extra prompt, no video-specific secret.
         const mainProvidesKey = state.provider?.apiKey !== undefined &&

package/node_modules/@comis/cli/dist/wizard/steps/08d-image-providers.d.ts

@@ -12,7 +12,7 @@
  *   - `fal`          — the explicit FAL queue backend: always prompts for a
  *                      `FAL_KEY` (no LLM provider supplies it).
  *   - `openai`       — OpenAI Images: reuses `OPENAI_API_KEY`. Prompts ONLY when
- *                      the main provider isn't already `openai` (CRED-01).
+ *                      the main provider isn't already `openai` (key reuse).
  *   - `google`       — Gemini image: reuses `GOOGLE_API_KEY`. Prompts ONLY when
  *                      the main provider isn't already `google`.
  *   - `openrouter`   — FLUX via OpenRouter: reuses `OPENROUTER_API_KEY`. Prompts

package/node_modules/@comis/cli/dist/wizard/steps/08d-image-providers.js

@@ -13,7 +13,7 @@
  *   - `fal`          — the explicit FAL queue backend: always prompts for a
  *                      `FAL_KEY` (no LLM provider supplies it).
  *   - `openai`       — OpenAI Images: reuses `OPENAI_API_KEY`. Prompts ONLY when
- *                      the main provider isn't already `openai` (CRED-01).
+ *                      the main provider isn't already `openai` (key reuse).
  *   - `google`       — Gemini image: reuses `GOOGLE_API_KEY`. Prompts ONLY when
  *                      the main provider isn't already `google`.
  *   - `openrouter`   — FLUX via OpenRouter: reuses `OPENROUTER_API_KEY`. Prompts
@@ -62,7 +62,7 @@ export const imageProvidersStep = {
             }
             return updateState(state, { imageProvider: { provider } });
         }
-        // 3. CRED-01 reuse: if the agent's MAIN provider already supplies the exact
+        // 3. Key reuse: if the agent's MAIN provider already supplies the exact
         //    env key this backend needs (e.g. an openai main + openai images → both
         //    OPENAI_API_KEY), reuse it — no extra prompt.
         const mainProvidesKey = state.provider?.apiKey !== undefined &&

package/node_modules/@comis/cli/dist/wizard/steps/08e-transcription.d.ts

@@ -4,7 +4,7 @@
  * Presents a single-select of all supported speech-to-text providers
  * (auto / local / openai / groq / deepgram, mirroring core's
  * `TranscriptionConfigSchema` enum) and collects a credential ONLY when the
- * choice needs a STATIC one the wizard doesn't already hold (CRED-01):
+ * choice needs a STATIC one the wizard doesn't already hold:
  *
  *   - `auto`     — keyless-first (the recommended default): a keyless local
  *                  engine, or reuse the agent's main audio key. No prompt.

package/node_modules/@comis/cli/dist/wizard/steps/08e-transcription.js

@@ -5,7 +5,7 @@
  * Presents a single-select of all supported speech-to-text providers
  * (auto / local / openai / groq / deepgram, mirroring core's
  * `TranscriptionConfigSchema` enum) and collects a credential ONLY when the
- * choice needs a STATIC one the wizard doesn't already hold (CRED-01):
+ * choice needs a STATIC one the wizard doesn't already hold:
  *
  *   - `auto`     — keyless-first (the recommended default): a keyless local
  *                  engine, or reuse the agent's main audio key. No prompt.
@@ -49,7 +49,7 @@ export const transcriptionStep = {
             prompter.log.info("Transcription will use a keyless local engine (no API key needed).");
             return updateState(state, { transcriptionProvider: { provider } });
         }
-        // CRED-01 reuse: main provider already supplies the matching key (e.g. an
+        // Key reuse: main provider already supplies the matching key (e.g. an
         // openai main + openai STT → both OPENAI_API_KEY).
         const mainProvidesKey = state.provider?.apiKey !== undefined &&
             state.provider.id !== undefined &&

package/node_modules/@comis/cli/dist/wizard/steps/08f-tts.d.ts

@@ -4,7 +4,7 @@
  * Presents a single-select of all supported TTS providers (edge / openai /
  * elevenlabs / local, mirroring core's `TtsConfigSchema` enum, keyless-first)
  * and collects the credential only when a keyed provider is chosen, reusing the
- * agent's MAIN provider key when it already supplies the matching one (CRED-01):
+ * agent's MAIN provider key when it already supplies the matching one:
  *
  *   - `edge`       — Microsoft Edge TTS: free, NO key, no prompt. The keyless
  *                    default (`initialValue`), matching the schema default.
@@ -17,7 +17,7 @@
  *
  * Written to `integrations.media.tts.provider`; the key flows through the same
  * managed-secrets path as the LLM key (step 10). This is the authoritative TTS
- * setup — the tool-providers step (08b) is now search-only, so the ElevenLabs /
+ * setup — the tool-providers step (08b) is search-only, so the ElevenLabs /
  * OpenAI key is collected here exactly once.
  *
  * @module

package/node_modules/@comis/cli/dist/wizard/steps/08f-tts.js

@@ -5,7 +5,7 @@
  * Presents a single-select of all supported TTS providers (edge / openai /
  * elevenlabs / local, mirroring core's `TtsConfigSchema` enum, keyless-first)
  * and collects the credential only when a keyed provider is chosen, reusing the
- * agent's MAIN provider key when it already supplies the matching one (CRED-01):
+ * agent's MAIN provider key when it already supplies the matching one:
  *
  *   - `edge`       — Microsoft Edge TTS: free, NO key, no prompt. The keyless
  *                    default (`initialValue`), matching the schema default.
@@ -18,7 +18,7 @@
  *
  * Written to `integrations.media.tts.provider`; the key flows through the same
  * managed-secrets path as the LLM key (step 10). This is the authoritative TTS
- * setup — the tool-providers step (08b) is now search-only, so the ElevenLabs /
+ * setup — the tool-providers step (08b) is search-only, so the ElevenLabs /
  * OpenAI key is collected here exactly once.
  *
  * @module
@@ -56,7 +56,7 @@ export const ttsStep = {
             }
             return updateState(state, { ttsProvider: { provider } });
         }
-        // CRED-01 reuse: main provider already supplies the matching key (openai).
+        // Key reuse: main provider already supplies the matching key (openai).
         const mainProvidesKey = state.provider?.apiKey !== undefined &&
             state.provider.id !== undefined &&
             PROVIDER_ENV_KEYS[state.provider.id] === requiredEnvKey;

package/node_modules/@comis/cli/dist/wizard/steps/10-write-config.js

@@ -92,8 +92,8 @@ function buildConfigObject(state) {
     config.agents = { default: agentConfig };
     // Security section -- emit the resolved credential storage mode chosen at
     // step 02b so the daemon's storage mode is explicit + auditable in
-    // config.yaml (init previously never wrote security.storage). AppConfig
-    // accepts a top-level security object with a storage enum.
+    // config.yaml. AppConfig accepts a top-level security object with a
+    // storage enum.
     if (state.storageMode) {
         config.security = { storage: state.storageMode };
     }
@@ -146,6 +146,22 @@ function buildConfigObject(state) {
                 entry.channelAccessToken = "${LINE_CHANNEL_ACCESS_TOKEN}";
             if (ch.type === "line" && ch.channelSecret)
                 entry.channelSecret = "${LINE_CHANNEL_SECRET}";
+            // Microsoft Teams: appId/tenantId/authMode are non-secret config written
+            // inline; only appPassword (the client secret) becomes a ${VAR} ref —
+            // mirrors slack signingSecret -> ${SLACK_SIGNING_SECRET}. The generic
+            // botToken fallback below does NOT fit Teams (it has no botToken), so this
+            // explicit block is required (paired with the collectManagedSecrets branch
+            // below, or the reference would dangle).
+            if (ch.type === "msteams") {
+                if (ch.appId)
+                    entry.appId = ch.appId;
+                if (ch.appPassword)
+                    entry.appPassword = "${MSTEAMS_APP_PASSWORD}";
+                if (ch.tenantId)
+                    entry.tenantId = ch.tenantId;
+                if (ch.authMode)
+                    entry.authMode = ch.authMode;
+            }
             // Generic fallback for other channel types
             if (ch.botToken && !entry.botToken && !entry.accessToken && !entry.channelAccessToken) {
                 entry.botToken = `\${${ch.type.toUpperCase()}_BOT_TOKEN}`;
@@ -224,6 +240,14 @@ function collectManagedSecrets(state) {
                 if (lineEnvKeys?.[1])
                     managed.set(lineEnvKeys[1], ch.channelSecret);
             }
+            // Microsoft Teams' secret is appPassword (not botToken/apiKey/channelSecret),
+            // so it needs its own branch — this is the join that keeps the config's
+            // ${MSTEAMS_APP_PASSWORD} reference from being a dangling, boot-fatal ref.
+            if (ch.appPassword && ch.type === "msteams") {
+                const msteamsEnvKeys = CHANNEL_ENV_KEYS["msteams"];
+                if (msteamsEnvKeys?.[0])
+                    managed.set(msteamsEnvKeys[0], ch.appPassword);
+            }
             if (ch.appToken)
                 managed.set(`${ch.type.toUpperCase()}_APP_TOKEN`, ch.appToken);
         }
@@ -239,8 +263,8 @@ function collectManagedSecrets(state) {
     // Image-generation credential (step 08d). Only present when the wizard
     // collected a STATIC key (fal always; cross-provider openai/google/openrouter).
     // A key-reusing choice, `auto`, or `openai-codex` (OAuth) carries no apiKey
-    // here — the matching key is already in the map from the provider section
-    // (CRED-01). Set() is idempotent, so a duplicate same-value write is harmless.
+    // here — the matching key is already in the map from the provider section.
+    // Set() is idempotent, so a duplicate same-value write is harmless.
     if (state.imageProvider?.apiKey) {
         const envKey = IMAGE_PROVIDER_ENV_KEYS[state.imageProvider.provider];
         if (envKey)
@@ -249,7 +273,7 @@ function collectManagedSecrets(state) {
     // Video-generation credential (step 08c). Only present when the wizard
     // collected a key (fal always; cross-provider google/xai). A key-reusing
     // google/xai or `auto` carries no apiKey here — the GOOGLE_API_KEY/XAI_API_KEY
-    // is already in the map from the provider section (CRED-01). Set() is
+    // is already in the map from the provider section. Set() is
     // idempotent, so a duplicate same-value write is harmless.
     if (state.videoProvider?.apiKey) {
         const envKey = VIDEO_PROVIDER_ENV_KEYS[state.videoProvider.provider];
@@ -330,7 +354,7 @@ export const writeConfigStep = {
         // 3. Storage mode is decided at step 02b and carried on state.storageMode.
         // "encrypted" routes collected secrets into the encrypted secrets.db (and
         // writes a placeholder .env); anything else writes a plaintext .env. The
-        // old secrets.db-gated prompt was removed — the choice happens once, early.
+        // choice happens exactly once, at step 02b — this step never re-prompts.
         const useSecretsStore = state.storageMode === "encrypted";
         // 4. Build config object
         const configObj = buildConfigObject(state);
@@ -399,8 +423,7 @@ export const writeConfigStep = {
                 // SECRETS_MASTER_KEY. The encrypted secrets.db is sealed with it; if
                 // this overwrite removed it, the next daemon boot would regenerate a
                 // fresh key that no longer matches the store (DECRYPTION_FAILED), and
-                // every stored secret would be orphaned/lost. (This branch previously
-                // clobbered .env, which bricked the encrypted store after `comis init`.)
+                // every stored secret would be orphaned/lost.
                 const secretsEnvLines = [
                     "# Comis secrets -- managed by secrets store",
                     "# API keys are stored encrypted in secrets.db",
@@ -413,10 +436,10 @@ export const writeConfigStep = {
                 }
                 writeFileSync(envPath, secretsEnvLines.join("\n") + "\n", { mode: 0o600 });
                 spinner.update(".env written (secrets store mode)");
-                // 10a. PERSIST the collected secrets into the encrypted store. The
-                // wizard used to merely PRINT `comis secrets set …` and discard the
-                // values it already held — so the config it wrote referenced ${VAR}s
-                // that were never stored, and the daemon FATAL-crash-looped on boot.
+                // 10a. PERSIST the collected secrets into the encrypted store — the
+                // wizard must never discard values it already holds: a ${VAR}
+                // referenced by the written config but never stored leaves the daemon
+                // FATAL-crash-looping on boot.
                 // The .env (with SECRETS_MASTER_KEY) is already written above, so the
                 // offline store write can decrypt/seal correctly. The daemon is not
                 // running during init, so the daemon-free direct-store path is correct.
@@ -453,7 +476,7 @@ export const writeConfigStep = {
             if (dataDirCreated) {
                 prompter.log.success(themeSuccess(`${dataDir}/ created`));
             }
-            // Secrets store summary: the wizard now PERSISTS the keys it collected
+            // Secrets store summary: the wizard PERSISTS the keys it collected
             // (see step 10a) rather than asking the user to re-enter them.
             if (useSecretsStore) {
                 if (storedCount > 0) {

package/node_modules/@comis/cli/dist/wizard/steps/11-daemon-start.d.ts

@@ -6,9 +6,8 @@
  * readiness, and runs subsystem health checks with per-failure fix
  * guidance.
  *
- * This is the biggest UX win of the redesign: users get immediate
- * feedback on whether their setup works, plus actionable guidance
- * when it does not.
+ * Users get immediate feedback on whether their setup works, plus
+ * actionable guidance when it does not.
  *
  * @module
  */
@@ -27,9 +26,9 @@ export declare const DAEMON_START_PROMPT = "Start the Comis daemon now?";
  *
  * Same contract as {@link DAEMON_START_PROMPT}: the NonInteractivePrompter
  * keys off this literal so `comis init --non-interactive` WITHOUT
- * `--start-daemon` answers "no" (leave running) instead of "restart" — the
- * generic fallback used to pick the first option ("restart") and silently
- * bounce an unrelated running daemon.
+ * `--start-daemon` answers "no" (leave running) instead of "restart" —
+ * without this keying, the generic first-option fallback would pick
+ * "restart" and silently bounce an unrelated running daemon.
  */
 export declare const DAEMON_RESTART_PROMPT = "Daemon is already running. What would you like to do?";
 export declare const daemonStartStep: WizardStep;

package/node_modules/@comis/cli/dist/wizard/steps/11-daemon-start.js

@@ -7,9 +7,8 @@
  * readiness, and runs subsystem health checks with per-failure fix
  * guidance.
  *
- * This is the biggest UX win of the redesign: users get immediate
- * feedback on whether their setup works, plus actionable guidance
- * when it does not.
+ * Users get immediate feedback on whether their setup works, plus
+ * actionable guidance when it does not.
  *
  * @module
  */
@@ -36,9 +35,9 @@ export const DAEMON_START_PROMPT = "Start the Comis daemon now?";
  *
  * Same contract as {@link DAEMON_START_PROMPT}: the NonInteractivePrompter
  * keys off this literal so `comis init --non-interactive` WITHOUT
- * `--start-daemon` answers "no" (leave running) instead of "restart" — the
- * generic fallback used to pick the first option ("restart") and silently
- * bounce an unrelated running daemon.
+ * `--start-daemon` answers "no" (leave running) instead of "restart" —
+ * without this keying, the generic first-option fallback would pick
+ * "restart" and silently bounce an unrelated running daemon.
  */
 export const DAEMON_RESTART_PROMPT = "Daemon is already running. What would you like to do?";
 /** Max time to wait for daemon gateway to become ready (ms). */

package/node_modules/@comis/cli/dist/wizard/types.d.ts

@@ -1,5 +1,5 @@
 /**
- * Foundational types and constants for the init wizard redesign.
+ * Foundational types and constants for the init wizard.
  *
  * Core type system for the wizard architecture: immutable state
  * accumulation, structured validation, and multi-flow support.
@@ -43,7 +43,7 @@ export type WizardError = {
 };
 /** Per-channel collected credentials. */
 export type ChannelConfig = {
-    type: "telegram" | "discord" | "slack" | "whatsapp" | "signal" | "irc" | "line";
+    type: "telegram" | "discord" | "slack" | "whatsapp" | "signal" | "irc" | "line" | "msteams";
     botToken?: string;
     apiKey?: string;
     appToken?: string;
@@ -51,6 +51,10 @@ export type ChannelConfig = {
     guildIds?: string[];
     allowFrom?: string[];
     validated?: boolean;
+    appId?: string;
+    appPassword?: string;
+    tenantId?: string;
+    authMode?: "secret" | "certificate" | "managedIdentity";
 };
 /** Per-tool-provider collected credentials. */
 export type ToolProviderConfig = {
@@ -68,7 +72,7 @@ export type ToolProviderConfig = {
  * collect: `fal` always (`FAL_KEY`), or `google`/`xai` when the agent's MAIN
  * provider doesn't already supply the matching key. `auto` (follow-main, the
  * recommended default) and a key-reusing `google`/`xai` carry no `apiKey` —
- * CRED-01: video reuses the main provider's secret, no video-specific key (I9).
+ * video reuses the main provider's secret, no video-specific key.
  */
 export type VideoProviderConfig = {
     provider: string;
@@ -85,7 +89,7 @@ export type VideoProviderConfig = {
  * always (`FAL_KEY`), or `openai`/`google`/`openrouter` when the agent's MAIN
  * provider doesn't already supply the matching key. `auto` (follow-main) and
  * `openai-codex` (OAuth bearer, set up via `comis auth login`) carry no `apiKey`
- * — CRED-01: image reuses the main provider's secret, no image-specific key.
+ * — image reuses the main provider's secret, no image-specific key.
  */
 export type ImageProviderConfig = {
     provider: string;
@@ -96,7 +100,7 @@ export type ImageProviderConfig = {
  * step. `provider` is one of core's `TranscriptionConfigSchema` enum values
  * (`openai` | `groq` | `deepgram`) written to
  * `integrations.media.transcription.provider`. `apiKey` is present unless the
- * agent's MAIN provider already supplies the matching key (CRED-01) —
+ * agent's MAIN provider already supplies the matching key —
  * `deepgram` always needs its own `DEEPGRAM_API_KEY`.
  */
 export type TranscriptionProviderConfig = {
@@ -241,9 +245,9 @@ export type SupportedToolProvider = {
 /**
  * All supported web-search tool providers with credential guidance.
  *
- * TTS (ElevenLabs / OpenAI) moved to the dedicated `tts` step so the wizard
- * writes `integrations.media.tts.provider` and never asks for the same key
- * twice — this list is now search-only.
+ * This list is search-only: TTS providers (ElevenLabs / OpenAI) belong to the
+ * dedicated `tts` step so the wizard writes `integrations.media.tts.provider`
+ * and never asks for the same key twice.
  */
 export declare const SUPPORTED_TOOL_PROVIDERS: readonly SupportedToolProvider[];
 /** Map tool provider identifier to environment variable key. */
@@ -267,7 +271,7 @@ export type SupportedVideoProvider = {
  * so this list can never diverge from the config vocabulary the daemon accepts.
  *
  * `auto` is the recommended default (provider-following): video generation
- * follows the agent's main provider and reuses its credentials (CRED-01/I9).
+ * follows the agent's main provider and reuses its credentials.
  * `google` → Veo and `xai` → Grok Imagine reuse `GOOGLE_API_KEY`/`XAI_API_KEY`
  * (the same key the completion path uses); only `fal` needs a dedicated `FAL_KEY`.
  */
@@ -276,7 +280,7 @@ export declare const SUPPORTED_VIDEO_PROVIDERS: readonly SupportedVideoProvider[
  * Map a video-generation provider id to the env-var key its credential is
  * stored under. `auto` is absent (follow-main, no dedicated key). `google`/`xai`
  * reuse the SAME env keys as the matching LLM provider (`PROVIDER_ENV_KEYS`), so
- * a `google`/`xai` main agent needs no extra credential (CRED-01).
+ * a `google`/`xai` main agent needs no extra credential.
  */
 export declare const VIDEO_PROVIDER_ENV_KEYS: Record<string, string>;
 /** Supported image-generation provider entry for the selection prompt. */
@@ -299,7 +303,7 @@ export type SupportedImageProvider = {
  * diverge from the config vocabulary the daemon accepts.
  *
  * `auto` is the recommended default (provider-following): image generation
- * follows the agent's main provider and reuses its credentials (CRED-01).
+ * follows the agent's main provider and reuses its credentials.
  * `openai`/`google`/`openrouter` reuse `OPENAI_API_KEY`/`GOOGLE_API_KEY`/
  * `OPENROUTER_API_KEY` (the same key the completion path uses); `fal` needs a
  * dedicated `FAL_KEY`; `openai-codex` uses the Codex OAuth login (no static key).
@@ -310,7 +314,7 @@ export declare const SUPPORTED_IMAGE_PROVIDERS: readonly SupportedImageProvider[
  * is stored under. `auto` and `openai-codex` are absent (follow-main / OAuth).
  * `openai`/`google`/`openrouter` reuse the SAME env keys as the matching LLM
  * provider (`PROVIDER_ENV_KEYS`), so a matching main agent needs no extra
- * credential (CRED-01).
+ * credential.
  */
 export declare const IMAGE_PROVIDER_ENV_KEYS: Record<string, string>;
 /** Supported speech-to-text provider entry for the selection prompt. */
@@ -336,8 +340,8 @@ export type SupportedTranscriptionProvider = {
  * Keyless-first ordering: `auto` (the recommended default — keyless-first /
  * follow-main) and `local` (in-process whisper) come before the keyed cloud
  * providers and OMIT `envKey` (their absence from `TRANSCRIPTION_PROVIDER_ENV_KEYS`
- * drives the no-prompt branch). `openai`/`groq` reuse the matching LLM key
- * (CRED-01); `deepgram` always needs its own `DEEPGRAM_API_KEY`.
+ * drives the no-prompt branch). `openai`/`groq` reuse the matching LLM key;
+ * `deepgram` always needs its own `DEEPGRAM_API_KEY`.
  */
 export declare const SUPPORTED_TRANSCRIPTION_PROVIDERS: readonly SupportedTranscriptionProvider[];
 /** Map a transcription provider id to the env-var key its credential is stored under. */
@@ -358,7 +362,7 @@ export type SupportedTtsProvider = {
  * Keyless-first ordering: `edge` (Microsoft Edge — the recommended keyless
  * default) leads, and `local` (offline Piper — arrives in a later release)
  * trails; both OMIT `envKey` (absent from `TTS_PROVIDER_ENV_KEYS` → no prompt).
- * `openai` reuses `OPENAI_API_KEY` (CRED-01); `elevenlabs` needs
+ * `openai` reuses `OPENAI_API_KEY`; `elevenlabs` needs
  * `ELEVENLABS_API_KEY`.
  */
 export declare const SUPPORTED_TTS_PROVIDERS: readonly SupportedTtsProvider[];