@cohortapp/agent-sdk 2.11.15 → 2.13.0

package/scripts/daemon/dispatcher-resume.test.mjs

@@ -0,0 +1,166 @@
+/**
+ * dispatcher-resume.test.mjs — audit F11: `defaultSpawnResume` built a BARE
+ * env (no router, no scrub) and a bare argv (no --output-format json, no
+ * knobs). A session originally routed to a third-party backend therefore
+ * resumed against api.anthropic.com with a foreign model id, and every
+ * resumed run recorded $0 because nothing parsed its usage.
+ *
+ * The resume now goes through the SAME resolveSpawnTarget / buildChildEnv
+ * path as a fresh spawnSession. The pure builder is tested directly; the
+ * real defaultSpawnResume is exercised through setSpawnForTests so the argv
+ * and env handed to `claude` are asserted byte-for-byte.
+ */
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { promises as fsp } from "node:fs";
+import { writeFileSync, mkdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+async function freshDispatcher() {
+  const dir = join(tmpdir(), `dispatcher-resume-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`);
+  mkdirSync(join(dir, "state/sessions"), { recursive: true });
+  mkdirSync(join(dir, "logs/daemon"), { recursive: true });
+  process.env.AGENT_DIR = dir;
+  const url = new URL("./dispatcher.mjs", import.meta.url);
+  const mod = await import(`${url.href}?resume=${Math.random()}`);
+  return { mod, dir };
+}
+async function cleanup(dir) { try { await fsp.rm(dir, { recursive: true, force: true }); } catch { /* */ } }
+function plantMarker(dir, sessionId, marker) {
+  const d = join(dir, "state/sessions/resume-pending");
+  mkdirSync(d, { recursive: true });
+  writeFileSync(join(d, `${sessionId}.json`), JSON.stringify({
+    sessionId, claudeSessionId: `cs-${sessionId}`, source: "backlog", itemId: "BL-1", sourceFile: "q.yaml",
+    prompt: "finish the memo", modelFlag: "claude-opus-4-6", model: "opus", priority: "normal",
+    startedAt: Date.now(), recoveryAttempts: 0, ...marker,
+  }, null, 2));
+}
+function writeV2Config(dir) {
+  mkdirSync(join(dir, "config"), { recursive: true });
+  writeFileSync(join(dir, "config/model-routing.json"), JSON.stringify({
+    schema_version: 2,
+    aliases: { frontier: "anthropic/claude-opus-4-8", default: "anthropic/claude-sonnet-4-6", fast: "anthropic/claude-haiku-4-5" },
+    defaults: { needs_tool_use_for_sessions: true, data_class: "sensitive", cache_ttl: "1h" },
+    backends: { anthropic: { allowed_data_classes: ["public", "internal", "sensitive"] } },
+    routing_policy: [{ default: true, chain: ["default", "fast"] }],
+    fallback_to_anthropic: true,
+  }, null, 2));
+}
+function fakeProc() {
+  const handlers = {};
+  return { stdout: { on: () => {} }, stderr: { on: () => {} }, on: (ev, cb) => { handlers[ev] = cb; }, kill: () => {}, killed: false, _handlers: handlers };
+}
+
+const ANTHROPIC_TARGET = { modelFlag: "claude-sonnet-4-6", envForSpawn: {}, decisionId: "d-1", backend: "anthropic", transport: "anthropic-cli", maxTurns: 40, effort: null, agentsJson: { "Haiku-Explore": { model: "haiku" } } };
+const RETARGET = { modelFlag: "kimi-k2", envForSpawn: { ANTHROPIC_BASE_URL: "https://moon.example", ANTHROPIC_AUTH_TOKEN: "tok-xyz", ANTHROPIC_API_KEY: "" }, decisionId: "d-2", backend: "moonshot", transport: "anthropic-compatible", maxTurns: 40, effort: "high", agentsJson: null };
+
+test("buildResumeSpawn (Anthropic): --print --output-format json + knobs + --session-id + marker model + prompt last; legacy key strip; session id in env", async () => {
+  const { mod, dir } = await freshDispatcher();
+  try {
+    const marker = { sessionId: "s-1", claudeSessionId: "CS-1", prompt: "finish the memo", modelFlag: "claude-opus-4-6", model: "opus" };
+    const { args, env, modelFlag } = mod.buildResumeSpawn({
+      marker, target: ANTHROPIC_TARGET,
+      baseEnv: { PATH: "/usr/bin", ANTHROPIC_API_KEY: "sk-live", ANTHROPIC_AUTH_TOKEN: "at", FOO_API_KEY: "foo", CLAUDE_CODE_OAUTH_TOKEN: "oauth-1" },
+      permissionArgs: ["--dangerously-skip-permissions"], daemonArgs: ["--strict-mcp-config"], augmentedPath: () => "/aug",
+    });
+    assert.equal(args[0], "--print");
+    assert.equal(args[args.indexOf("--output-format") + 1], "json", "usage is measurable on a resumed run");
+    assert.ok(args.includes("--dangerously-skip-permissions"));
+    assert.ok(args.includes("--strict-mcp-config"));
+    assert.equal(args[args.indexOf("--max-turns") + 1], "40", "the router's knob args ride the resume");
+    assert.ok(/Haiku-Explore/.test(args[args.indexOf("--agents") + 1]));
+    assert.equal(args[args.indexOf("--session-id") + 1], "CS-1");
+    assert.equal(args[args.indexOf("--model") + 1], "claude-opus-4-6", "an Anthropic session resumes on the exact flag it used");
+    assert.equal(modelFlag, "claude-opus-4-6");
+    assert.equal(args[args.length - 1], "finish the memo");
+    assert.ok(!args.includes("--resume"));
+    // Env: the non-retarget path keeps the historical explicit-empty-key posture (keychain/OAuth fallthrough).
+    assert.equal(env.ANTHROPIC_API_KEY, "");
+    assert.equal(env.ANTHROPIC_AUTH_TOKEN, "");
+    assert.equal(env.PATH, "/aug");
+    assert.equal(env.MAESTRO_SESSION_ID, "s-1", "delivery receipts attribute to the resumed session");
+    assert.equal(env.CLAUDE_CODE_OAUTH_TOKEN, "oauth-1", "the subscription token reaches the resumed session");
+  } finally { await cleanup(dir); }
+});
+
+test("buildResumeSpawn (retarget): env goes through buildChildEnv — base URL + token injected, foreign credentials scrubbed", async () => {
+  const { mod, dir } = await freshDispatcher();
+  try {
+    const marker = { sessionId: "s-2", claudeSessionId: "CS-2", prompt: "p", modelFlag: "kimi-k2", model: "sonnet" };
+    const { args, env } = mod.buildResumeSpawn({
+      marker, target: RETARGET,
+      baseEnv: { PATH: "/usr/bin", ANTHROPIC_API_KEY: "sk-live", FOO_API_KEY: "foo", HOME: "/h" },
+      permissionArgs: [], daemonArgs: [], augmentedPath: () => "/aug",
+    });
+    assert.equal(env.ANTHROPIC_BASE_URL, "https://moon.example", "the resumed session is retargeted like the original");
+    assert.equal(env.ANTHROPIC_AUTH_TOKEN, "tok-xyz");
+    assert.equal(env.ANTHROPIC_API_KEY, "", "empty-string discipline: no keychain fallthrough on a retarget");
+    assert.equal(env.FOO_API_KEY, undefined, "§7.3 scrub: no foreign credential leaks");
+    assert.equal(env.HOME, "/h");
+    assert.equal(env.PATH, "/aug");
+    assert.equal(env.MAESTRO_SESSION_ID, "s-2");
+    assert.equal(args[args.indexOf("--model") + 1], "kimi-k2");
+    assert.equal(args[args.indexOf("--effort") + 1], "high");
+  } finally { await cleanup(dir); }
+});
+
+test("resumeModelFlag: a foreign model id never resumes against Anthropic (F11) — the router's current flag wins", async () => {
+  const { mod, dir } = await freshDispatcher();
+  try {
+    // Original ran on a third party; the router now resolves Anthropic (provider down / config changed).
+    assert.equal(mod.resumeModelFlag({ modelFlag: "moonshot/kimi-k2" }, ANTHROPIC_TARGET), "claude-sonnet-4-6");
+    assert.equal(mod.resumeModelFlag({ modelFlag: "kimi-k2" }, ANTHROPIC_TARGET), "claude-sonnet-4-6");
+    // Original ran on Anthropic; still Anthropic → the exact flag it used (H1 pin).
+    assert.equal(mod.resumeModelFlag({ modelFlag: "claude-opus-4-6" }, ANTHROPIC_TARGET), "claude-opus-4-6");
+    assert.equal(mod.resumeModelFlag({ modelFlag: "opus" }, ANTHROPIC_TARGET), "opus");
+    // A retarget: the router's flag for that backend.
+    assert.equal(mod.resumeModelFlag({ modelFlag: "claude-opus-4-6" }, RETARGET), "kimi-k2");
+    // No router at all (target null) → marker flag, then coarse class, then sonnet.
+    assert.equal(mod.resumeModelFlag({ modelFlag: "claude-opus-4-6" }, null), "claude-opus-4-6");
+    assert.equal(mod.resumeModelFlag({ model: "opus" }, null), "opus");
+    assert.equal(mod.resumeModelFlag({}, null), "sonnet");
+  } finally { await cleanup(dir); }
+});
+
+test("defaultSpawnResume (real path, v2 config): argv carries --output-format json + router knobs; env carries the session id and the key strip", async () => {
+  const { mod, dir } = await freshDispatcher();
+  try {
+    writeV2Config(dir);
+    plantMarker(dir, "s-real", { claudeSessionId: "CS-FIXED", prompt: "finish drafting the board memo", modelFlag: "claude-opus-4-6" });
+    const calls = [];
+    const restore = mod.setSpawnForTests((bin, args, opts) => { calls.push({ bin, args, opts }); return fakeProc(); });
+    try {
+      const stats = mod.reconcileResumePending();
+      assert.equal(stats.resumed, 1);
+    } finally { restore(); }
+    assert.equal(calls.length, 1);
+    const { args, opts } = calls[0];
+    assert.equal(args[0], "--print");
+    assert.equal(args[args.indexOf("--output-format") + 1], "json");
+    assert.equal(args[args.indexOf("--max-turns") + 1], "40", "v2 knobs are no longer dropped on resume");
+    assert.ok(args.includes("--agents"));
+    assert.equal(args[args.indexOf("--session-id") + 1], "CS-FIXED");
+    assert.equal(args[args.indexOf("--model") + 1], "claude-opus-4-6");
+    assert.equal(args[args.length - 1], "finish drafting the board memo");
+    assert.ok(!args.includes("--resume"));
+    assert.equal(opts.env.MAESTRO_SESSION_ID, "s-real");
+    assert.equal(opts.env.ANTHROPIC_API_KEY, "");
+    assert.equal(opts.cwd, dir);
+  } finally { await cleanup(dir); }
+});
+
+test("defaultSpawnResume (no routing config): still a --print --output-format json spawn on the marker's flag", async () => {
+  const { mod, dir } = await freshDispatcher();
+  try {
+    plantMarker(dir, "s-plain", { claudeSessionId: "CS-P", prompt: "p", modelFlag: "claude-sonnet-4-6" });
+    const calls = [];
+    const restore = mod.setSpawnForTests((bin, args, opts) => { calls.push({ args, opts }); return fakeProc(); });
+    try { mod.reconcileResumePending(); } finally { restore(); }
+    const { args } = calls[0];
+    assert.equal(args[args.indexOf("--output-format") + 1], "json");
+    assert.equal(args[args.indexOf("--model") + 1], "claude-sonnet-4-6");
+    assert.ok(!args.includes("--max-turns"), "no router → no knobs (unchanged)");
+  } finally { await cleanup(dir); }
+});

package/scripts/daemon/dispatcher.mjs

@@ -610,6 +610,93 @@ export function reconcileResumePending(opts = {}) {
   return stats;
 }
 
+/**
+ * Does a `--model` flag name an Anthropic model (a catalog id or a CLI alias)?
+ * A third-party id (`moonshot/kimi-k2`, `kimi-k2`) is anything else.
+ */
+function isAnthropicModelFlag(flag) {
+  const f = String(flag || "");
+  return !!f && !f.includes("/") && !f.includes(":") && /claude|sonnet|opus|haiku/i.test(f);
+}
+
+/**
+ * Which `--model` a resume passes (audit F11). PURE.
+ *
+ * The original spawn's exact flag is pinned in the marker (H1) so an
+ * Anthropic session resumes on the model it used. But a flag is only
+ * meaningful on the backend that minted it: a marker from a third-party
+ * session whose router decision has since moved to Anthropic (provider down,
+ * config changed) must NOT hand Anthropic a foreign id — that was the F11
+ * failure. So: a retarget takes the router's flag for THAT backend; an
+ * Anthropic target keeps the marker's flag only when it is Anthropic-shaped;
+ * no router at all keeps the historical marker → class → sonnet ladder.
+ *
+ * @param {object} marker  the resume-pending marker
+ * @param {object|null} target  resolveSpawnTarget() output, or null (no router)
+ * @returns {string}
+ */
+export function resumeModelFlag(marker, target) {
+  const m = marker && typeof marker === "object" ? marker : {};
+  const pinned = m.modelFlag || m.model || null;
+  if (!target || typeof target !== "object") return pinned || "sonnet";
+  const retargeting = !!(target.envForSpawn && target.envForSpawn.ANTHROPIC_BASE_URL);
+  if (retargeting) return target.modelFlag || pinned || "sonnet";
+  if (pinned && isAnthropicModelFlag(pinned)) return pinned;
+  return target.modelFlag || (pinned && isAnthropicModelFlag(pinned) ? pinned : null) || m.model || "sonnet";
+}
+
+/**
+ * Build the argv + child env for a resume. PURE — every input injected, so
+ * the exact bytes handed to `claude` are testable. Mirrors spawnSession:
+ *
+ *   [--print, --output-format json, <permission args>, <daemon args>,
+ *    <router knobs>, --session-id <id>, --model <flag>, <prompt>]
+ *
+ * and the same env rule: a retarget (envForSpawn carries ANTHROPIC_BASE_URL)
+ * goes through buildChildEnv's §7.3 credential scrub; the Anthropic path keeps
+ * the explicit empty-key posture (keychain / OAuth-token fallthrough).
+ * MAESTRO_SESSION_ID rides the env so delivery receipts attribute correctly.
+ *
+ * @param {object} o
+ * @param {object} o.marker
+ * @param {object|null} o.target  resolveSpawnTarget() output or null
+ * @param {object} o.baseEnv
+ * @param {string[]} [o.permissionArgs]
+ * @param {string[]} [o.daemonArgs]
+ * @param {Function} [o.augmentedPath]
+ * @returns {{args:string[], env:object, modelFlag:string, retargeting:boolean}}
+ */
+export function buildResumeSpawn(o = {}) {
+  const marker = o.marker || {};
+  const target = o.target && typeof o.target === "object" ? o.target : null;
+  const pathFn = typeof o.augmentedPath === "function" ? o.augmentedPath : augmentedPath;
+  const modelFlag = resumeModelFlag(marker, target);
+  const knobArgs = [];
+  if (target) {
+    if (target.maxTurns != null && Number.isFinite(Number(target.maxTurns))) knobArgs.push("--max-turns", String(target.maxTurns));
+    if (target.effort) knobArgs.push("--effort", String(target.effort));
+    if (target.agentsJson) knobArgs.push("--agents", typeof target.agentsJson === "string" ? target.agentsJson : JSON.stringify(target.agentsJson));
+  }
+  const args = [
+    "--print",
+    "--output-format", "json",
+    ...(Array.isArray(o.permissionArgs) ? o.permissionArgs : []),
+    ...(Array.isArray(o.daemonArgs) ? o.daemonArgs : []),
+    ...knobArgs,
+    "--session-id", marker.claudeSessionId,
+    "--model", modelFlag,
+    marker.prompt,
+  ];
+  const base = o.baseEnv && typeof o.baseEnv === "object" ? o.baseEnv : {};
+  const envForSpawn = (target && target.envForSpawn) || {};
+  const retargeting = !!envForSpawn.ANTHROPIC_BASE_URL;
+  const env = retargeting
+    ? { ...buildChildEnv({ ...base, PATH: pathFn() }, envForSpawn), PATH: pathFn() }
+    : { ...base, PATH: pathFn(), ANTHROPIC_API_KEY: "", ANTHROPIC_AUTH_TOKEN: "", ...envForSpawn };
+  if (marker.sessionId) env.MAESTRO_SESSION_ID = String(marker.sessionId);
+  return { args, env, modelFlag, retargeting };
+}
+
 /**
  * Real resume spawner. Mirrors responder.mjs's blessed session-continuation
  * pattern (see runClaudeCLI ~L116-122 + generateResponse ~L461-465): a
@@ -625,34 +712,55 @@ export function reconcileResumePending(opts = {}) {
  * report cited in responder.mjs). The CLI rehydrates the session-id's history
  * and the fresh prompt continues the work.
  *
- * The resumed session inherits the same permission/env posture as a fresh
- * spawn. Best-effort; failures are logged, the marker stays (next reconcile
- * retries up to the strike cap). On a clean close the resumed session's own
- * close handler clears the marker.
+ * Audit F11: the argv and env are built through the SAME resolveSpawnTarget /
+ * buildChildEnv path as spawnSession (buildResumeSpawn), so a retargeted
+ * session resumes on its backend, the router's knobs ride along, and
+ * `--output-format json` makes the run's usage measurable for the ledger.
+ *
+ * The resumed session inherits the same permission posture as a fresh spawn.
+ * Best-effort; failures are logged, the marker stays (next reconcile retries
+ * up to the strike cap). On a clean close the marker is cleared here.
  */
 function defaultSpawnResume({ marker }) {
-  const args = [
-    "--print",
-    ...sessionPermissionArgs({ source: "dispatcher-resume" }),
-    ...daemonClaudeArgs(),
-    "--session-id", marker.claudeSessionId,
-    "--model", marker.modelFlag || marker.model || "sonnet",
-    marker.prompt,
-  ];
-  const spawnEnv = {
-    ...process.env,
-    PATH: augmentedPath(),
-    ANTHROPIC_API_KEY: "",
-    ANTHROPIC_AUTH_TOKEN: "",
-  };
+  const source = marker.source || "backlog";
+  // The router's CURRENT decision for this work. resolveSpawnTarget never
+  // throws (it degrades to the v1 path / stock CLI internally); the request is
+  // rebuilt from what the marker kept of the original classification.
+  let target = null;
+  try {
+    const routingConfig = getRoutingConfig();
+    if (routingConfig) {
+      const classResult = { model: marker.model || "sonnet", priority: marker.priority || "normal", summary: marker.summary || null };
+      const routingRequest = requestFromClassifierResult(classResult, { source, role: "responder" });
+      target = resolveSpawnTarget(routingConfig, routingRequest, classResult, source, marker.modelFlag || marker.model || "sonnet");
+    }
+  } catch (err) {
+    // A router fault must not block a resume: fall back to the marker's flag.
+    console.warn(`[dispatcher] resume routing failed for ${marker.sessionId}, using marker flag: ${err.message}`);
+    target = null;
+  }
+  const { args, env: spawnEnv, modelFlag } = buildResumeSpawn({
+    marker,
+    target,
+    baseEnv: process.env,
+    permissionArgs: sessionPermissionArgs({ source: "dispatcher-resume", priority: marker.priority }),
+    daemonArgs: daemonClaudeArgs(),
+  });
+  const decisionId = (target && target.decisionId) || marker.decision_id || null;
+  const startedAt = Date.now();
   const proc = _spawn(CLAUDE_BIN, args, { cwd: AGENT_REPO_DIR, env: spawnEnv, stdio: ["ignore", "pipe", "pipe"] });
+  let stdout = "";
   let stderr = "";
+  proc.stdout.on("data", (c) => { stdout += c.toString(); });
   proc.stderr.on("data", (c) => { stderr += c.toString(); });
   proc.on("close", (code) => {
+    // A resumed run costs money too: parse its --output-format json usage.
+    try { recordDispatcherCost({ stdout, model: marker.model, durationMs: Date.now() - startedAt, exitCode: code, decisionId }); }
+    catch { /* cost tracking is best-effort */ }
     if (code === 0) {
       // Resume succeeded — the underlying work is done; clear the marker.
       clearResumePending(marker.sessionId);
-      logSession({ event: "resume_completed", sessionId: marker.sessionId, item_id: marker.itemId });
+      logSession({ event: "resume_completed", sessionId: marker.sessionId, item_id: marker.itemId, model_flag: modelFlag });
     } else {
       // A usage limit or 429 during resume must open the breaker so subsequent
       // spawns gate. Usage-limit → hold until reset; 429 → transient backoff.

package/scripts/daemon/health.mjs

@@ -1,12 +1,21 @@
 #!/usr/bin/env node
 // Health — periodic health metrics and status logging
 
-import { writeFileSync, mkdirSync } from "fs";
+import { writeFileSync, mkdirSync, readFileSync } from "fs";
 import { join } from "path";
 import { getStatus } from "./dispatcher.mjs";
+import { resolveRunningSdkVersion } from "./sdk-version.mjs";
 
 const AGENT_REPO_DIR = process.env.AGENT_DIR || join(new URL(".", import.meta.url).pathname, "../..");
 
+// The SDK version THIS daemon process started on — read once at load, never
+// again: autoupdate installs the next version into node_modules while this
+// process is still running the old (copied) code, and `maestro upgrade
+// --verify` reads `sdk_version` off the dashboard to tell the two apart. The
+// order of trust (sdk-version.mjs): the manifest of the copied tree, then
+// node_modules, then the package this file ships in.
+const DAEMON_SDK_VERSION = resolveRunningSdkVersion({ agentDir: AGENT_REPO_DIR, ownPackagePath: join(new URL(".", import.meta.url).pathname, "../../package.json") }).version;
+
 let stats = {
   daemon_start: new Date().toISOString(),
   polls_total: 0,
@@ -47,6 +56,8 @@ export function writeHealthDashboard() {
   const dashboard = {
     updated: new Date().toISOString(),
     uptime_s: Math.floor((Date.now() - new Date(stats.daemon_start).getTime()) / 1000),
+    pid: process.pid,
+    sdk_version: DAEMON_SDK_VERSION,
     ...stats,
     dispatcher,
   };

package/scripts/daemon/inbox-deferral-session.test.mjs

@@ -0,0 +1,49 @@
+/**
+ * inbox-deferral-session.test.mjs — promoteDeferred must leave a SESSION
+ * deferral alone (design §3.3). Both actors park items at `.yaml.deferred`:
+ * the daemon for a thread-lock burst (promoted on session close), the main
+ * session with `maestro inbox defer --until` (carries a column-0
+ * `deferred_until:` marker; the daemon's assurance sweep reopens it when due).
+ * A session close for the same channel must neither promote a session
+ * deferral early nor fold it away as `.processed-bundled`.
+ */
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, readdirSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { promoteDeferred } from "./inbox-deferral.mjs";
+
+function makeAgentRoot() {
+  const root = mkdtempSync(join(tmpdir(), "maestro-deferral-session-"));
+  mkdirSync(join(root, "state", "inbox", "cohort"), { recursive: true });
+  return root;
+}
+function item(id, ts, extra = "") {
+  return `id: "${id}"\nservice: "cohort"\nchannel_id: "D001"\nthread_id: "t1"\ntimestamp: "${ts}"\ncontent: |\n  body\n${extra}`;
+}
+function ls(root) { return readdirSync(join(root, "state", "inbox", "cohort")).sort(); }
+
+test("promoteDeferred: a session deferral (deferred_until marker) is neither promoted nor bundled; legacy deferrals in the same thread still promote", () => {
+  const root = makeAgentRoot();
+  try {
+    // A: session deferral, oldest in the thread.
+    writeFileSync(join(root, "state/inbox/cohort/a.yaml.deferred"), item("A", "2026-09-08T09:00:00Z", 'deferred_until: "2026-09-09T09:00:00.000Z"\ndeferred_reason: "waiting on finance"\n'));
+    // C: daemon thread-lock deferral, newest — the one a session close promotes.
+    writeFileSync(join(root, "state/inbox/cohort/c.yaml.deferred"), item("C", "2026-09-08T10:00:00Z"));
+    const r = promoteDeferred("D001", root);
+    assert.equal(r.promoted, 1);
+    assert.equal(r.bundled, 0, "a session deferral is not a burst duplicate — it must not be folded away");
+    assert.deepEqual(ls(root), ["a.yaml.deferred", "c.yaml"]);
+    // With no daemon deferral at all, a session close promotes nothing (A is not due yet).
+    rmSync(join(root, "state/inbox/cohort/c.yaml"));
+    assert.deepEqual(promoteDeferred("D001", root), { promoted: 0, bundled: 0, service: null });
+    assert.deepEqual(ls(root), ["a.yaml.deferred"]);
+    // An indented look-alike inside the body is NOT a marker (column-0 only).
+    writeFileSync(join(root, "state/inbox/cohort/b.yaml.deferred"), `id: "B"\nservice: "cohort"\nchannel_id: "D001"\nthread_id: "t1"\ntimestamp: "2026-09-08T11:00:00Z"\ncontent: |\n  deferred_until: "2099-01-01T00:00:00Z"\n`);
+    assert.equal(promoteDeferred("D001", root).promoted, 1);
+    assert.deepEqual(ls(root), ["a.yaml.deferred", "b.yaml"]);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});

package/scripts/daemon/inbox-deferral.mjs

@@ -196,6 +196,12 @@ export function promoteDeferred(channel, agentRoot) {
       }
       const fileChannel = readScalar(body, "channel_id");
       if (fileChannel !== channel) continue;
+      // A SESSION deferral (`maestro inbox defer --until`, lib/session/
+      // inbox-claims) shares the `.deferred` suffix but is not a thread-lock
+      // burst: it is reopened by the daemon's assurance sweep when its time
+      // comes. Promoting it here would surface it early; bundling it would
+      // fold it away as `.processed-bundled` for good. Column-0 key only.
+      if (readScalar(body, "deferred_until")) continue;
       matches.push({
         file,
         timestamp: readScalar(body, "timestamp") || "",

package/scripts/daemon/lib/self-echo.mjs

@@ -0,0 +1,201 @@
+/**
+ * self-echo.mjs — "is this inbound event actually MY OWN outbound send?"
+ *
+ * THE DEFECT THIS EXISTS TO FIX (observed 2026-08-25 / 08-27 / 08-30, fleet-wide)
+ *
+ * The daemon's poll lane re-ingested the agent's own outbound messages as fresh
+ * inbound events, classified them, and fired a holding acknowledgement at them —
+ * so agents replied to their own messages, and in shared DMs two agents acked
+ * each other's echoes ("Looking now." / "Looking now.") in a self-sustaining
+ * loop that burned a sub-session per cycle and posted into real rooms.
+ *
+ * There WAS a defensive check in the poll filter, and it is exactly why the
+ * defect survived three recurrences: it compared the item's `sender` against
+ * `fullName.toLowerCase().replace(/\s+/g, "-")` — "isla-roselli" — while the
+ * real events carry the display name verbatim: `sender: "Isla Roselli"`. The
+ * normalised forms never met. This module owns the match so it can be tested
+ * against the REAL event shapes instead of an assumed one.
+ *
+ * WHAT A MATCH MEANS AND WHAT WE DO WITH IT
+ *
+ * A match is dropped at ingestion, LOUDLY: every drop is appended to
+ * `logs/daemon/self-echo-drops.jsonl` so an echo that was dropped is auditable
+ * and an echo that got through is disprovable. The drop also retires the inbox
+ * file (caller's job, via markProcessed) so the same echo is not re-scanned and
+ * re-dropped every tick forever.
+ *
+ * MATCH DISCIPLINE
+ *
+ * Identity fields actually observed on inbound items (see
+ * state/inbox/<service>/*.yaml): `sender` is a display name ("Isla Roselli").
+ * Some lanes carry a member id (`sender_id`, `author_id`, `from.id`). We match:
+ *
+ *   - any carried id against the agent's member cuid / org slug / slack id;
+ *   - `sender_email` against the agent's own email;
+ *   - the normalised display name against the agent's fullName and
+ *     preferredName — NOT the bare firstName, which collides with any
+ *     colleague sharing it — where "normalised" folds case and treats
+ *     space / dash / underscore / dot as the same separator, so
+ *     "Isla Roselli", "isla-roselli" and "Isla_Roselli" are all the same
+ *     person.
+ *
+ * EVIDENCE ORDER MATTERS. An id or email is authoritative where a display name
+ * is circumstantial: when an item CARRIES an id-ish field or an email and it
+ * does NOT match this agent, that positively identifies the sender as someone
+ * else, and the display-name rung is never consulted — a namesake ("Isla
+ * Roselli", different member cuid) must not be dropped on the name collision.
+ *
+ * Fail-open in the SAFE direction: an unconfigured identity (no config/agent.json)
+ * matches nothing, so no genuine inbound is ever dropped by a half-set-up repo.
+ *
+ * @module scripts/daemon/lib/self-echo
+ */
+
+"use strict";
+
+import { readFileSync, mkdirSync, appendFileSync } from "node:fs";
+import { join } from "node:path";
+
+function defaultRoot() {
+  return process.env.AGENT_DIR || join(new URL(".", import.meta.url).pathname, "../../..");
+}
+
+/** Fold a display name to a comparable form: case, and the separator zoo
+ *  ("Isla Roselli" / "isla-roselli" / "Isla_Roselli" / "isla.roselli"). */
+export function normalizeName(s) {
+  return String(s || "").toLowerCase().replace(/[\s_.\-/]+/g, " ").trim();
+}
+
+// Cached per agentRoot — the daemon calls this on every polled item.
+const _cache = new Map();
+
+/** Test seam: forget every cached identity (e.g. after writing config/agent.json). */
+export function _resetSelfIdentity() { _cache.clear(); }
+
+/**
+ * The agent's own identity, in matchable form.
+ *
+ * @param {string} [agentRoot]
+ * @returns {{names:Set<string>, ids:Set<string>, emails:Set<string>, firstName:string|null, fullName:string|null}}
+ */
+export function loadSelfIdentity(agentRoot) {
+  const root = agentRoot || defaultRoot();
+  if (_cache.has(root)) return _cache.get(root);
+
+  let cfg = {};
+  try { cfg = JSON.parse(readFileSync(join(root, "config/agent.json"), "utf-8")); }
+  catch { cfg = {}; }
+
+  // Full / preferred forms ONLY. The bare firstName is deliberately absent:
+  // "Isla" as a sender display name is any colleague, contact or CC'd namesake
+  // who shares the first name, and dropping their genuine inbound on that
+  // collision is a silent-loss bug. The separator-folded FULL name is what the
+  // real echo events carry ("Isla Roselli" / "isla-roselli"), and that match
+  // is preserved.
+  const names = new Set(
+    [cfg.fullName, cfg.preferredName]
+      .map(normalizeName)
+      .filter(Boolean),
+  );
+  const ids = new Set(
+    [
+      cfg.memberId,                                   // the org member cuid — what hq stamps as actor
+      cfg.slackMemberId,
+      cfg.org && cfg.org.cohort && cfg.org.cohort.agentId, // the seat slug ("A016")
+      process.env.COHORT_AGENT_ID,
+    ]
+      .map((v) => String(v || "").trim().toLowerCase())
+      .filter(Boolean),
+  );
+  const emails = new Set(
+    [cfg.email, cfg.workEmail]
+      .map((v) => String(v || "").trim().toLowerCase())
+      .filter(Boolean),
+  );
+
+  const identity = {
+    names,
+    ids,
+    emails,
+    firstName: cfg.firstName || null,
+    fullName: cfg.fullName || null,
+  };
+  _cache.set(root, identity);
+  return identity;
+}
+
+/**
+ * Does this inbound item name the agent itself as its sender?
+ *
+ * @param {object} item   a daemon inbox item ({sender, sender_email, sender_id?, ...})
+ * @param {object} [identity] injectable identity (tests); defaults to loadSelfIdentity()
+ * @returns {boolean}
+ */
+export function isSelfSender(item, identity) {
+  if (!item || typeof item !== "object") return false;
+  const me = identity || loadSelfIdentity();
+  if (me.names.size === 0 && me.ids.size === 0 && me.emails.size === 0) return false;
+
+  // 1. Member / seat ids, wherever a lane put one. Strongest evidence.
+  const idCandidates = [
+    item.sender_id,
+    item.sender_member_id,
+    item.author_id,
+    item.authorId,
+    item.from && (typeof item.from === "object" ? item.from.id : item.from),
+  ]
+    .map((c) => String(c || "").trim().toLowerCase())
+    .filter(Boolean);
+  for (const v of idCandidates) {
+    if (me.ids.has(v)) return true;
+  }
+
+  // 2. Email (gmail/orgmail lanes).
+  const email = String(item.sender_email || "").trim().toLowerCase();
+  if (email && me.emails.has(email)) return true;
+
+  // 3. EXONERATION before the name rung. The item carried an id or an email
+  // and NONE of them matched: that is positive evidence the sender is someone
+  // else, and it outranks a display-name collision. A namesake with their own
+  // member cuid ("Isla Roselli", cuid ≠ ours) must never be dropped as self.
+  if (idCandidates.length > 0) return false;
+  if (email) return false;
+
+  // 4. Display name — what the cohort lane actually carries ("Isla Roselli").
+  // Reached only when the item carried NO id and NO email at all.
+  const sender = normalizeName(item.sender);
+  if (sender && me.names.has(sender)) return true;
+
+  return false;
+}
+
+/**
+ * Audit-log a dropped self-echo. Fail-open: a logging failure must never take
+ * the poll loop down, and never resurrects the echo.
+ *
+ * @param {object} item
+ * @param {object} [o] {stage, service, agentRoot}
+ */
+export function logSelfEchoDrop(item, o = {}) {
+  const root = o.agentRoot || defaultRoot();
+  const row = {
+    ts: new Date().toISOString(),
+    stage: o.stage || "poll",
+    service: o.service || (item && item.service) || null,
+    id: (item && (item.id || null)),
+    raw_ref: (item && (item.raw_ref || null)),
+    sender: (item && (item.sender || null)),
+    channel: (item && (item.channel_id || item.channel || null)),
+    event_kind: (item && (item.event_kind || null)),
+  };
+  try {
+    const dir = join(root, "logs", "daemon");
+    mkdirSync(dir, { recursive: true });
+    appendFileSync(join(dir, "self-echo-drops.jsonl"), `${JSON.stringify(row)}\n`);
+  } catch { /* never throw from the audit trail */ }
+  try {
+    console.log(`[daemon] SELF-ECHO dropped at ${row.stage}: ${row.raw_ref || row.id} (sender "${row.sender}" is this agent)`);
+  } catch { /* */ }
+}
+
+export default { loadSelfIdentity, isSelfSender, logSelfEchoDrop, normalizeName, _resetSelfIdentity };