comisai 1.0.9 → 1.0.11

package/README.md

@@ -9,13 +9,13 @@
 <p align="center">
   <a href="https://www.npmjs.com/package/comisai"><img src="https://img.shields.io/npm/v/comisai" alt="npm version" /></a>
   <a href="https://github.com/comisai/comis/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-06B6D4?style=flat" alt="License" /></a>
-  <a href="https://discord.gg/comis"><img src="https://img.shields.io/badge/discord-join-5865F2?style=flat&logo=discord&logoColor=white" alt="Discord" /></a>
+  <a href="https://discord.gg/FsqgJkpp"><img src="https://img.shields.io/badge/discord-join-5865F2?style=flat&logo=discord&logoColor=white" alt="Discord" /></a>
   <a href="https://nodejs.org"><img src="https://img.shields.io/node/v/comisai" alt="Node" /></a>
 </p>
 
 <p align="center">
   <a href="https://docs.comis.ai">Docs</a> &middot;
-  <a href="https://discord.gg/comis">Discord</a> &middot;
+  <a href="https://discord.gg/FsqgJkpp">Discord</a> &middot;
   <a href="https://twitter.com/comis_ai">Twitter</a> &middot;
   <a href="#quick-start">Quick Start</a>
 </p>
@@ -168,7 +168,7 @@ shared (Result type, utilities)
 <p align="center">
   <a href="https://github.com/comisai/comis"><strong>GitHub</strong></a> &middot;
   <a href="https://docs.comis.ai"><strong>Docs</strong></a> &middot;
-  <a href="https://discord.gg/comis"><strong>Discord</strong></a> &middot;
+  <a href="https://discord.gg/FsqgJkpp"><strong>Discord</strong></a> &middot;
   <a href="https://twitter.com/comis_ai"><strong>Twitter</strong></a> &middot;
   <a href="https://github.com/comisai/comis/issues"><strong>Issues</strong></a>
 </p>

package/node_modules/@comis/agent/dist/executor/executor-post-execution.js

@@ -332,6 +332,7 @@ export async function postExecution(params) {
     // Strip verbose <functions> blocks from discover_tools results
     // in session history. Runs post-execution so the current turn's model
     // saw full schemas. Safe no-op when no discover_tools results exist.
-    stripDiscoverySchemas(sm, deps.logger);
+    // Fence-aware: entries at or below the cache fence are not stripped to preserve prefix stability.
+    stripDiscoverySchemas(sm, deps.logger, finalBreakpointIdx);
     session.dispose();
 }

package/node_modules/@comis/agent/dist/executor/executor-response-filter.js

@@ -85,6 +85,11 @@ export function scanWithOutputGuard(params) {
 // ---------------------------------------------------------------------------
 /** Silent tokens that indicate the final message has no visible content. */
 const SILENT_FINAL_TOKENS = ["NO_REPLY", "HEARTBEAT_OK"];
+/** Tool names whose successful invocation means the agent already delivered
+ *  content to the user through a side-channel. When one of these tools was
+ *  called during the execution, a silent final token (NO_REPLY) is intentional
+ *  and recovery must be suppressed to avoid leaking internal narration. */
+const DELIVERY_TOOL_NAMES = ["message", "notify"];
 /**
  * When the final assistant message is thinking-only or a
  * silent token (NO_REPLY, HEARTBEAT_OK) but text was emitted in earlier
@@ -107,6 +112,17 @@ export function recoverEmptyFinalResponse(params) {
     const isSilentFinalToken = SILENT_FINAL_TOKENS.includes(extractedResponse.trim());
     if ((extractedResponse === "" || isSilentFinalToken) && textEmitted) {
         if (Array.isArray(messages)) {
+            // Guard: if the agent already delivered content via a delivery tool
+            // (message, notify), the silent final token is intentional — skip
+            // recovery to avoid leaking internal narration (e.g. "Now let me
+            // generate the chart:" surfaced as a user-visible message).
+            if (isSilentFinalToken && hasDeliveryToolCall(messages, lowerBound)) {
+                logger.debug({
+                    hint: "Silent final token after delivery tool call — recovery suppressed",
+                    extractedResponse,
+                }, "Skipping empty-response recovery (delivery tool used)");
+                return extractedResponse;
+            }
             /* eslint-disable @typescript-eslint/no-explicit-any */
             // Pass 1: backward walk — prefer the most recent standalone response
             // (assistant turns that have text but NO tool call blocks)
@@ -172,6 +188,23 @@ function extractVisibleText(content) {
     return undefined;
 }
 /* eslint-enable @typescript-eslint/no-explicit-any */
+/** Check whether any assistant turn (from lowerBound onward) contains a tool
+ *  call to a delivery tool (message, notify). These tools send content to the
+ *  user through a side-channel, so a subsequent NO_REPLY is intentional. */
+/* eslint-disable @typescript-eslint/no-explicit-any */
+function hasDeliveryToolCall(messages, lowerBound) {
+    for (let i = lowerBound; i < messages.length; i++) {
+        const msg = messages[i]; // eslint-disable-line security/detect-object-injection
+        if (msg?.role === "assistant" && Array.isArray(msg.content)) {
+            const hasDelivery = msg.content.some((b) => (b?.type === "toolCall" || b?.type === "tool_use") &&
+                DELIVERY_TOOL_NAMES.includes(b?.name));
+            if (hasDelivery)
+                return true;
+        }
+    }
+    return false;
+}
+/* eslint-enable @typescript-eslint/no-explicit-any */
 // ---------------------------------------------------------------------------
 // SEP plan extraction (extracted from execute() success path)
 // ---------------------------------------------------------------------------

package/node_modules/@comis/agent/dist/executor/pi-executor.d.ts

@@ -50,7 +50,10 @@ import type { AgentExecutor } from "./types.js";
  *
  * Extracted as a named function for independent unit testing.
  */
-export declare function createBeforeToolCallGuard(stepCounter: StepCounter, budgetGuard: BudgetGuard, circuitBreaker: CircuitBreaker, toolRetryBreaker?: ToolRetryBreaker, messageSendLimiter?: MessageSendLimiter): (context: unknown, _signal?: AbortSignal) => Promise<import("../safety/message-send-limiter.js").MessageSendVerdict | undefined>;
+export declare function createBeforeToolCallGuard(stepCounter: StepCounter, budgetGuard: BudgetGuard, circuitBreaker: CircuitBreaker, toolRetryBreaker?: ToolRetryBreaker, messageSendLimiter?: MessageSendLimiter): (context: unknown, _signal?: AbortSignal) => Promise<{
+    block: boolean;
+    reason: string;
+} | undefined>;
 /**
  * Merge SDK session stats into execution result for token totals (R-13).
  *

package/node_modules/@comis/agent/dist/executor/prompt-assembly.d.ts

@@ -46,6 +46,11 @@ export declare function clearSessionToolNameSnapshot(sessionKey: string): void;
  * Call during session cleanup to prevent the Map from growing unbounded.
  */
 export declare function clearSessionBootstrapFileSnapshot(sessionKey: string): void;
+/**
+ * Clear the cached prompt skills XML snapshot for a session.
+ * Call during session cleanup to prevent the Map from growing unbounded.
+ */
+export declare function clearSessionPromptSkillsXmlSnapshot(sessionKey: string): void;
 /** Frozen prompt state captured after first-turn assembly for sub-agent cache prefix sharing.
  *  When propagated to sub-agents via SpawnPacket, allows prefix reuse instead of independent assembly. */
 export interface CacheSafeParams {

package/node_modules/@comis/agent/dist/executor/prompt-assembly.js

@@ -57,6 +57,11 @@ const sessionBootstrapFileSnapshots = new Map();
  *  Captured once per session at the end of first assembleExecutionPrompt call.
  *  Sub-agents read this via getCacheSafeParams() to reuse parent prefix. */
 const sessionCacheSafeParams = new Map();
+/** Per-session prompt skills XML snapshot for stable system prompt assembly.
+ *  On first execution, captures the promptSkillsXml string. Subsequent executions
+ *  reuse the snapshot so skills XML fed to assembleRichSystemPrompt stays constant,
+ *  preventing cache-invalidating changes when the agent creates skills mid-session. */
+const sessionPromptSkillsXmlSnapshots = new Map();
 // ---------------------------------------------------------------------------
 // Feature flag hash for tool cache key invalidation.
 // Computes a stable string from config fields that affect tool rendering.
@@ -95,6 +100,13 @@ export function clearSessionToolNameSnapshot(sessionKey) {
 export function clearSessionBootstrapFileSnapshot(sessionKey) {
     sessionBootstrapFileSnapshots.delete(sessionKey);
 }
+/**
+ * Clear the cached prompt skills XML snapshot for a session.
+ * Call during session cleanup to prevent the Map from growing unbounded.
+ */
+export function clearSessionPromptSkillsXmlSnapshot(sessionKey) {
+    sessionPromptSkillsXmlSnapshots.delete(sessionKey);
+}
 /**
  * Get the frozen prompt state for a session (sub-agent cache prefix sharing).
  * Returns undefined if no params captured yet (session hasn't completed first turn).
@@ -458,7 +470,14 @@ export async function assembleExecutionPrompt(params) {
         sessionToolNameSnapshots.set(snapshotKey, toolNames);
     }
     const hasMemoryTools = stableToolNames.includes("memory_store") || stableToolNames.includes("memory_search");
-    const promptSkillsXml = deps.getPromptSkillsXml?.() ?? undefined;
+    // Snapshot promptSkillsXml on first turn to keep system prompt stable.
+    // Skills created mid-session grow the XML (~540 chars per skill), invalidating
+    // the entire system prompt cache prefix on every subsequent turn.
+    let promptSkillsXml = sessionPromptSkillsXmlSnapshots.get(snapshotKey);
+    if (promptSkillsXml === undefined && !sessionPromptSkillsXmlSnapshots.has(snapshotKey)) {
+        promptSkillsXml = deps.getPromptSkillsXml?.() ?? undefined;
+        sessionPromptSkillsXmlSnapshots.set(snapshotKey, promptSkillsXml);
+    }
     const activePromptSkillContent = msg.metadata?.promptSkillContent;
     // Extract user's preferred language from USER.md (if present)
     const userLanguage = extractUserLanguage(bootstrapContextFiles);

package/node_modules/@comis/agent/dist/executor/schema-stripping.d.ts

@@ -16,4 +16,4 @@
  */
 export declare function stripDiscoverySchemas(sm: unknown, logger?: {
     debug: (obj: Record<string, unknown>, msg: string) => void;
-}): void;
+}, cacheFenceIndex?: number): void;

package/node_modules/@comis/agent/dist/executor/schema-stripping.js

@@ -26,15 +26,19 @@
  * @param sm - SessionManager instance (from withSession callback)
  * @param logger - Optional logger for DEBUG-level stripping stats
  */
-export function stripDiscoverySchemas(sm, logger) {
+export function stripDiscoverySchemas(sm, logger, cacheFenceIndex) {
     /* eslint-disable @typescript-eslint/no-explicit-any */
     const sessionManager = sm;
     const fileEntries = sessionManager.fileEntries;
     if (!Array.isArray(fileEntries))
         return;
+    const fence = cacheFenceIndex ?? -1;
     let strippedCount = 0;
     let totalCharsSaved = 0;
+    let messageIdx = -1;
     for (const entry of fileEntries) {
+        if (entry.type === "message")
+            messageIdx++;
         if (entry.type !== "message")
             continue;
         const msg = entry.message;
@@ -42,6 +46,9 @@ export function stripDiscoverySchemas(sm, logger) {
             continue;
         if (msg.toolName !== "discover_tools")
             continue;
+        // Entries at or below the cache fence must not be modified to preserve prefix stability
+        if (messageIdx <= fence)
+            continue;
         const content = msg.content;
         if (!Array.isArray(content) || content.length === 0)
             continue;

package/node_modules/@comis/agent/dist/executor/session-snapshot-cleanup.js

@@ -14,7 +14,7 @@
  * @module
  */
 import { formatSessionKey } from "@comis/core";
-import { clearSessionToolNameSnapshot, clearSessionBootstrapFileSnapshot, clearCacheSafeParams } from "./prompt-assembly.js";
+import { clearSessionToolNameSnapshot, clearSessionBootstrapFileSnapshot, clearSessionPromptSkillsXmlSnapshot, clearCacheSafeParams } from "./prompt-assembly.js";
 import { clearSessionDeliveredGuides, clearSessionToolSchemaSnapshot, clearSessionToolSchemaSnapshotHash, clearSessionBreakpointIndex, clearSessionCacheWarm, clearSessionLatches, clearSessionEvictionCooldown, clearSessionCacheSavings } from "./executor-session-state.js";
 import { clearSessionTracker } from "./tool-lifecycle.js";
 import { clearDiscoveryTracker } from "./discovery-tracker.js";
@@ -31,6 +31,7 @@ import { clearSessionBlockStability } from "./block-stability-tracker.js";
 export function clearSessionState(formattedKey) {
     clearSessionToolNameSnapshot(formattedKey);
     clearSessionBootstrapFileSnapshot(formattedKey);
+    clearSessionPromptSkillsXmlSnapshot(formattedKey);
     clearCacheSafeParams(formattedKey);
     clearSessionDeliveredGuides(formattedKey);
     clearSessionToolSchemaSnapshot(formattedKey);

package/node_modules/@comis/agent/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/agent",
   "private": true,
-  "version": "1.0.9",
+  "version": "1.0.11",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "AI agent executor, budget control, and session management for Comis",

package/node_modules/@comis/channels/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/channels",
   "private": true,
-  "version": "1.0.9",
+  "version": "1.0.11",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Chat platform adapters — Discord, Telegram, Slack, WhatsApp, Signal, iMessage, IRC, LINE",

package/node_modules/@comis/cli/dist/commands/agent.js

@@ -28,9 +28,7 @@ export function registerAgentCommand(program) {
         .action(async (options) => {
         try {
             const result = await withSpinner("Fetching agents...", () => withClient(async (client) => {
-                const agentsResult = (await client.call("config.get", { section: "agents" }));
-                const routingResult = (await client.call("config.get", { section: "routing" }));
-                return { ...agentsResult, ...routingResult };
+                return (await client.call("config.get", { section: "agents" }));
             }));
             const agents = extractAgents(result);
             if (agents.length === 0) {
@@ -64,14 +62,13 @@ export function registerAgentCommand(program) {
         try {
             const agentConfig = { name };
             if (options.provider)
-                agentConfig["defaultProvider"] = options.provider;
+                agentConfig["provider"] = options.provider;
             if (options.model)
-                agentConfig["defaultModel"] = options.model;
+                agentConfig["model"] = options.model;
             await withSpinner(`Creating agent "${name}"...`, () => withClient(async (client) => {
-                return await client.call("config.set", {
-                    section: "routing",
-                    key: `agents.${name}`,
-                    value: agentConfig,
+                return await client.call("agents.create", {
+                    agentId: name,
+                    config: agentConfig,
                 });
             }));
             // Initialize dedicated workspace for the new agent
@@ -109,14 +106,13 @@ export function registerAgentCommand(program) {
         try {
             const updates = {};
             if (options.provider)
-                updates["defaultProvider"] = options.provider;
+                updates["provider"] = options.provider;
             if (options.model)
-                updates["defaultModel"] = options.model;
+                updates["model"] = options.model;
             await withSpinner(`Updating agent "${name}"...`, () => withClient(async (client) => {
-                return await client.call("config.set", {
-                    section: "routing",
-                    key: `agents.${name}`,
-                    value: updates,
+                return await client.call("agents.update", {
+                    agentId: name,
+                    config: updates,
                 });
             }));
             success(`Agent "${name}" updated`);
@@ -162,10 +158,8 @@ export function registerAgentCommand(program) {
         }
         try {
             await withSpinner(`Deleting agent "${name}"...`, () => withClient(async (client) => {
-                return await client.call("config.set", {
-                    section: "routing",
-                    key: `agents.${name}`,
-                    value: null,
+                return await client.call("agents.delete", {
+                    agentId: name,
                 });
             }));
             success(`Agent "${name}" deleted`);
@@ -223,16 +217,16 @@ export function registerAgentCommand(program) {
     });
 }
 /**
- * Extract agent entries from routing config response.
+ * Extract agent entries from config.get response for the agents section.
  *
  * Handles various response shapes from the config.get RPC call,
  * normalizing into a flat array of AgentEntry objects.
  */
 function extractAgents(config) {
+    if (!config || typeof config !== "object")
+        return [];
     const agents = [];
-    // Try routing.agents or agents directly
-    const agentsObj = config["agents"] ??
-        config["routing"]?.["agents"];
+    const agentsObj = config["agents"];
     if (agentsObj && typeof agentsObj === "object") {
         for (const [name, value] of Object.entries(agentsObj)) {
             if (value && typeof value === "object") {
@@ -250,10 +244,8 @@ function extractAgents(config) {
             }
         }
     }
-    // Also check top-level or routing-nested bindings for agent references
-    const routing = config["routing"];
-    const bindings = config["bindings"] ??
-        routing?.["bindings"];
+    // Also check bindings for agent references
+    const bindings = config["bindings"];
     if (Array.isArray(bindings)) {
         for (const binding of bindings) {
             const agentId = typeof binding["agentId"] === "string" ? binding["agentId"] : undefined;

package/node_modules/@comis/cli/dist/commands/models.js

@@ -180,8 +180,8 @@ export function registerModelsCommand(program) {
                 return; // Unreachable but satisfies TS control flow
             }
             // Find the agent entry
-            const agentsNode = doc.getIn(["agents"]) ?? doc.getIn(["routing", "agents"]);
-            const agentsPath = doc.getIn(["agents"]) ? ["agents"] : ["routing", "agents"];
+            const agentsNode = doc.getIn(["agents"]);
+            const agentsPath = ["agents"];
             if (!agentsNode || typeof agentsNode !== "object") {
                 error("No agents section found in config");
                 info("Configure agents first with 'comis init' or edit config manually");

package/node_modules/@comis/cli/dist/commands/reset.js

@@ -67,20 +67,36 @@ function safeUnlink(filePath) {
         }
     }
 }
+/**
+ * Check whether an error indicates the daemon is unreachable (not running,
+ * wrong port, connection refused) vs. a method-level RPC error.
+ */
+function isDaemonUnreachable(err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return msg.includes("Cannot connect to daemon") || msg.includes("timed out") || msg.includes("ECONNREFUSED");
+}
 /**
  * Execute reset for sessions target.
  *
- * Tries RPC-based session deletion first (daemon running).
+ * Tries RPC-based session deletion first (daemon running): lists all sessions
+ * via session.list, then deletes each via session.delete.
  * Falls back to direct SQLite database file removal if daemon is not running.
  */
 async function resetSessions(dataDir) {
     try {
         await withSpinner("Clearing sessions via daemon...", () => withClient(async (client) => {
-            return await client.call("session.reset");
+            const result = await client.call("session.list");
+            if (result.total === 0)
+                return;
+            for (const session of result.sessions) {
+                await client.call("session.delete", { session_key: session.sessionKey });
+            }
         }));
         success("All sessions deleted");
     }
-    catch {
+    catch (err) {
+        if (!isDaemonUnreachable(err))
+            throw err;
         // Daemon not running -- try direct file deletion
         const dbPath = dataDir + "/memory.db";
         try {

package/node_modules/@comis/cli/dist/wizard/steps/06-channels.js

@@ -130,6 +130,37 @@ async function validateLineLive(channelToken) {
         clearTimeout(timeout);
     }
 }
+/**
+ * Fetch the most recent sender's user ID from the bot's getUpdates endpoint.
+ *
+ * Calls getUpdates with a short timeout. Returns the first message sender's
+ * user ID and name, or null if no messages are available.
+ */
+async function fetchTelegramSenderId(token) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 5000);
+    try {
+        const response = await fetch(`https://api.telegram.org/bot${token}/getUpdates?limit=5&allowed_updates=["message"]`, { method: "GET", signal: controller.signal });
+        if (!response.ok)
+            return null;
+        const data = (await response.json());
+        if (!data.ok || !data.result.length)
+            return null;
+        for (const update of data.result.reverse()) {
+            const from = update.message?.from;
+            if (from) {
+                return { userId: from.id, firstName: from.first_name };
+            }
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
 // ---------- Per-Channel Handlers ----------
 /**
  * Collect Discord bot token and optional guild IDs with live validation.
@@ -456,17 +487,63 @@ export const channelsStep = {
                 message: "Grant admin access to specific senders?",
             });
             if (wantTrust) {
-                prompter.note(info("Enter YOUR user ID (not the bot ID).\nTelegram: message @userinfobot to get yours.\nDiscord: enable Developer Mode → right-click your name → Copy User ID."));
-                const input = await prompter.text({
-                    message: "Your sender IDs (comma-separated)",
-                    placeholder: "e.g. 678314278",
-                    validate: (v) => v.trim().length === 0 ? "At least one sender ID required" : undefined,
-                });
-                const entries = input
-                    .split(",")
-                    .map((s) => s.trim())
-                    .filter((s) => s.length > 0)
-                    .map((senderId) => ({ senderId, level: "admin" }));
+                const telegramConfig = configs.find((c) => c.type === "telegram");
+                let detectedId = null;
+                if (telegramConfig?.botToken) {
+                    const wantDetect = await prompter.confirm({
+                        message: "Auto-detect your Telegram user ID? (send any message to your bot first)",
+                    });
+                    if (wantDetect) {
+                        const spin = prompter.spinner();
+                        spin.start("Checking for messages...");
+                        const sender = await fetchTelegramSenderId(telegramConfig.botToken);
+                        if (sender) {
+                            spin.stop(`Found: ${sender.firstName} (${sender.userId})`);
+                            const useIt = await prompter.confirm({
+                                message: `Use ${sender.userId} as your admin sender ID?`,
+                            });
+                            if (useIt) {
+                                detectedId = String(sender.userId);
+                            }
+                        }
+                        else {
+                            spin.stop("No messages found");
+                            prompter.log.warn("Send a message to your bot in Telegram and try again, or enter your ID manually below.");
+                        }
+                    }
+                }
+                const hasOtherChannels = configs.some((c) => c.type !== "telegram" && c.type !== "whatsapp" && c.type !== "signal" && c.type !== "irc");
+                let senderIds;
+                if (detectedId && !hasOtherChannels) {
+                    senderIds = [detectedId];
+                }
+                else {
+                    if (detectedId) {
+                        prompter.note(info("Add sender IDs for your other channels.\nDiscord: enable Developer Mode → right-click your name → Copy User ID."));
+                    }
+                    else {
+                        prompter.note(info("Enter YOUR user ID (not the bot ID).\nTelegram: send a message to your bot, then re-run setup to auto-detect — or find it via Telegram API.\nDiscord: enable Developer Mode → right-click your name → Copy User ID."));
+                    }
+                    const input = await prompter.text({
+                        message: "Your sender IDs (comma-separated)",
+                        placeholder: detectedId ? `e.g. ${detectedId}, <discord-id>` : "e.g. 678314278",
+                        defaultValue: detectedId ? `${detectedId}, ` : "",
+                        validate: (v) => v.trim().length === 0 ? "At least one sender ID required" : undefined,
+                    });
+                    senderIds = input
+                        .split(",")
+                        .map((s) => s.trim())
+                        .filter((s) => s.length > 0);
+                }
+                const entries = senderIds.map((senderId) => ({ senderId, level: "admin" }));
+                if (telegramConfig && senderIds.length > 0) {
+                    const restrictBot = await prompter.confirm({
+                        message: "Restrict Telegram bot to only respond to these senders?",
+                    });
+                    if (restrictBot) {
+                        telegramConfig.allowFrom = senderIds;
+                    }
+                }
                 return updateState(state, { channels: configs, senderTrustEntries: entries });
             }
         }

package/node_modules/@comis/cli/dist/wizard/steps/10-write-config.js

@@ -131,6 +131,10 @@ function buildConfigObject(state) {
             if (ch.type === "discord" && ch.guildIds && ch.guildIds.length > 0) {
                 entry.guildIds = ch.guildIds;
             }
+            // Sender allowlist
+            if (ch.allowFrom && ch.allowFrom.length > 0) {
+                entry.allowFrom = ch.allowFrom;
+            }
             channels[ch.type] = entry;
         }
         config.channels = channels;

package/node_modules/@comis/cli/dist/wizard/types.d.ts

@@ -49,6 +49,7 @@ export type ChannelConfig = {
     appToken?: string;
     channelSecret?: string;
     guildIds?: string[];
+    allowFrom?: string[];
     validated?: boolean;
 };
 /** Per-tool-provider collected credentials. */

package/node_modules/@comis/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/cli",
   "private": true,
-  "version": "1.0.9",
+  "version": "1.0.11",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Command-line interface for the Comis AI agent platform",

package/node_modules/@comis/core/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/core",
   "private": true,
-  "version": "1.0.9",
+  "version": "1.0.11",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Core domain types, ports, event bus, security, and config for Comis",

package/node_modules/@comis/daemon/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/daemon",
   "private": true,
-  "version": "1.0.9",
+  "version": "1.0.11",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Background daemon and orchestrator for the Comis platform",

package/node_modules/@comis/gateway/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/gateway",
   "private": true,
-  "version": "1.0.9",
+  "version": "1.0.11",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "HTTP, JSON-RPC, and WebSocket gateway for Comis",

package/node_modules/@comis/infra/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/infra",
   "private": true,
-  "version": "1.0.9",
+  "version": "1.0.11",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Structured logging infrastructure for Comis",

package/node_modules/@comis/memory/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/memory",
   "private": true,
-  "version": "1.0.9",
+  "version": "1.0.11",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "SQLite memory, embeddings, and RAG storage for Comis agents",

package/node_modules/@comis/scheduler/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/scheduler",
   "private": true,
-  "version": "1.0.9",
+  "version": "1.0.11",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Task scheduling and cron management for Comis",

package/node_modules/@comis/shared/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/shared",
   "private": true,
-  "version": "1.0.9",
+  "version": "1.0.11",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Shared types and utilities for the Comis platform",

package/node_modules/@comis/skills/dist/builtin/exec-security.js

@@ -284,11 +284,11 @@ export const DANGEROUS_COMMAND_PATTERNS = [
     { pattern: /\beval\s/, reason: "Shell eval executes arbitrary code" },
     {
         pattern: /\bsource\s/,
-        reason: "Shell source executes arbitrary script file",
+        reason: "Shell source executes arbitrary script file. For virtualenvs, call the venv binary directly (e.g. .venv/bin/python3, .venv/bin/pip) instead of sourcing activate",
     },
     {
         pattern: /^\.\s+\//,
-        reason: "POSIX source (.) executes arbitrary script file",
+        reason: "POSIX source (.) executes arbitrary script file. For virtualenvs, call the venv binary directly (e.g. .venv/bin/python3, .venv/bin/pip) instead of sourcing activate",
     },
     // Category H -- Indirect command execution
     {

package/node_modules/@comis/skills/dist/builtin/exec-tool.js

@@ -366,7 +366,7 @@ export function createExecTool(workspacePath, registry, secretManager, platformS
                 }
                 // Detect --break-system-packages for post-execution warning
                 const breakSystemWarning = command.includes("--break-system-packages")
-                    ? "\u26a0\ufe0f WARNING: --break-system-packages modifies the system Python. Use a virtualenv instead: python3 -m venv .venv && source .venv/bin/activate && pip install ...\n\n"
+                    ? "\u26a0\ufe0f WARNING: --break-system-packages modifies the system Python. Use a virtualenv instead: python3 -m venv .venv && .venv/bin/pip install ...\n\n"
                     : "";
                 // Log command start (truncate command to 200 chars for security)
                 logger?.debug({ toolName: "exec", command: command.slice(0, 200), background, pty, ...(description && { description }) }, "Exec command start");

package/node_modules/@comis/skills/dist/integrations/media-handler-audio.js

@@ -58,5 +58,5 @@ export async function processAudioAttachment(att, deps, buildHint) {
         deps.logger.warn({ url: att.url, error: String(e), hint: "Unexpected STT error; voice message will not be transcribed", errorKind: "internal" }, "Transcription threw unexpectedly");
         deps.logger.debug?.({ url: att.url, reason: "stt-failed", err: String(e) }, "Transcription threw unexpectedly");
     }
-    return {};
+    return { textPrefix: "[Voice message received but transcription failed — ask the user to send a text message instead]" };
 }

package/node_modules/@comis/skills/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/skills",
   "private": true,
-  "version": "1.0.9",
+  "version": "1.0.11",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Skill system, MCP integration, and tool sandbox for Comis agents",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "comisai",
-  "version": "1.0.9",
+  "version": "1.0.11",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Security-first AI agent platform — connects AI agents to Discord, Telegram, Slack, WhatsApp, and more",
@@ -115,17 +115,17 @@
     "@comis/daemon"
   ],
   "dependencies": {
-    "@comis/shared": "1.0.9",
-    "@comis/core": "1.0.9",
-    "@comis/infra": "1.0.9",
-    "@comis/memory": "1.0.9",
-    "@comis/gateway": "1.0.9",
-    "@comis/skills": "1.0.9",
-    "@comis/scheduler": "1.0.9",
-    "@comis/agent": "1.0.9",
-    "@comis/channels": "1.0.9",
-    "@comis/cli": "1.0.9",
-    "@comis/daemon": "1.0.9",
+    "@comis/shared": "1.0.11",
+    "@comis/core": "1.0.11",
+    "@comis/infra": "1.0.11",
+    "@comis/memory": "1.0.11",
+    "@comis/gateway": "1.0.11",
+    "@comis/skills": "1.0.11",
+    "@comis/scheduler": "1.0.11",
+    "@comis/agent": "1.0.11",
+    "@comis/channels": "1.0.11",
+    "@comis/cli": "1.0.11",
+    "@comis/daemon": "1.0.11",
     "@agentclientprotocol/sdk": "^0.15.0",
     "@clack/core": "^1.1.0",
     "@clack/prompts": "^1.1.0",