@cohortapp/agent-sdk 2.16.0 → 2.17.0

package/scripts/daemon/lib/session-router.test.mjs

@@ -11,7 +11,17 @@ import { promises as fsp } from "fs";
 import { tmpdir } from "os";
 import { join } from "path";
 
-import { routingKey, createRouter } from "./session-router.mjs";
+import {
+  routingKey,
+  createRouter,
+  createRouterSync,
+  decideRoute,
+  routerItemFromDaemonItem,
+  claimSession,
+  releaseSession,
+  isSessionInFlight,
+  _resetInFlightForTests,
+} from "./session-router.mjs";
 
 function tmpRegistryPath(suffix = "") {
   const name = `session-router-test-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}${suffix}.json`;
@@ -293,3 +303,252 @@ test("registry round-trip — second router instance reads persisted state", asy
   assert.equal(dec.decision, "RESUME");
   assert.equal(dec.resumeId, "cli-A");
 });
+
+// ---------------------------------------------------------------------------
+// 4. Conversation-shaped services (design §3 R10 / §5.6).
+//
+// `cohort` fell through to the throw, so every turn in the agent's own
+// workspace was keyed by nothing and spawned cold. telegram / whatsapp /
+// orgmail were in the same position.
+// ---------------------------------------------------------------------------
+
+test("routingKey — cohort channel with no thread is keyed by the room", () => {
+  assert.equal(routingKey({ source: "cohort", channel: "chan-abc" }), "cohort:chan-abc");
+});
+
+test("routingKey — cohort thread narrows the key, so two threads never share a session", () => {
+  const a = routingKey({ source: "cohort", channel: "chan-abc", thread_root_id: "msg-1" });
+  const b = routingKey({ source: "cohort", channel: "chan-abc", thread_root_id: "msg-2" });
+  assert.equal(a, "cohort:chan-abc:msg-1");
+  assert.notEqual(a, b);
+});
+
+test("routingKey — telegram / whatsapp / orgmail share the shape", () => {
+  assert.equal(routingKey({ source: "telegram", channel: "12345" }), "telegram:12345");
+  assert.equal(routingKey({ source: "whatsapp", channel: "4471@s.whatsapp.net" }), "whatsapp:4471@s.whatsapp.net");
+  assert.equal(routingKey({ source: "orgmail", channel: "mb-1", thread_id: "t-9" }), "orgmail:mb-1:t-9");
+});
+
+test("routingKey — a cohort item with no channel throws rather than colliding on a blank key", () => {
+  assert.throws(() => routingKey({ source: "cohort" }), /missing channel/);
+});
+
+// ---------------------------------------------------------------------------
+// 5. routerItemFromDaemonItem — ONE translation, both callers.
+// ---------------------------------------------------------------------------
+
+test("routerItemFromDaemonItem — a cohort item keys on channel_id, never the label", () => {
+  const out = routerItemFromDaemonItem({
+    service: "cohort",
+    channel: "task/Ship the thing",   // the DISPLAY label
+    channel_id: "chan-real",
+    thread_id: "root-7",
+  });
+  assert.deepEqual(out, { source: "cohort", channel: "chan-real", thread_root_id: "root-7" });
+  assert.equal(routingKey(out), "cohort:chan-real:root-7");
+});
+
+test("routerItemFromDaemonItem — a cohort item with only a label has no session to continue", () => {
+  assert.equal(routerItemFromDaemonItem({ service: "cohort", channel: "doc/Pricing memo" }), null);
+});
+
+test("routerItemFromDaemonItem — slack / gmail / calendar are unchanged", () => {
+  assert.deepEqual(routerItemFromDaemonItem({ service: "slack", channel: "C1", thread_id: "1.2", ts: "3.4" }),
+    { source: "slack", channel: "C1", thread_ts: "1.2", ts: "3.4" });
+  assert.deepEqual(routerItemFromDaemonItem({ service: "gmail", thread_id: "t1" }), { source: "gmail", thread_id: "t1" });
+  assert.deepEqual(routerItemFromDaemonItem({ service: "calendar", event_id: "e1" }), { source: "calendar", event_id: "e1" });
+});
+
+test("routerItemFromDaemonItem — an unknown service is not keyed", () => {
+  assert.equal(routerItemFromDaemonItem({ service: "carrier-pigeon", channel_id: "x" }), null);
+  assert.equal(routerItemFromDaemonItem(null), null);
+});
+
+// ---------------------------------------------------------------------------
+// 6. decideRoute — the pure rule both IO shells share.
+// ---------------------------------------------------------------------------
+
+test("decideRoute — the memo §4.4 table", () => {
+  const live = { claude_session_id: "S1", last_used_at: 1000, status: "live", last_exit_code: 0 };
+  assert.deepEqual(decideRoute(undefined, { now: 1000, ttlSeconds: 30 }), { decision: "EPHEMERAL", resumeId: null });
+  assert.deepEqual(decideRoute(live, { now: 1000, ttlSeconds: 30 }), { decision: "RESUME", resumeId: "S1" });
+  assert.equal(decideRoute(live, { now: 1000 + 31_000, ttlSeconds: 30 }).decision, "EPHEMERAL_REPLACE");
+  assert.equal(decideRoute({ ...live, status: "killed" }, { now: 1000, ttlSeconds: 30 }).decision, "EPHEMERAL_REPLACE");
+  assert.equal(decideRoute({ ...live, last_exit_code: 1 }, { now: 1000, ttlSeconds: 30 }).decision, "EPHEMERAL_REPLACE");
+});
+
+// ---------------------------------------------------------------------------
+// 7. createRouterSync — the dispatcher's face of the SAME registry.
+// ---------------------------------------------------------------------------
+
+test("createRouterSync — a cold key is EPHEMERAL; a touched key then RESUMEs", async () => {
+  const path = tmpRegistryPath("-sync");
+  try {
+    const r = createRouterSync({ registryPath: path });
+    assert.equal(r.route("cohort:c1").decision, "EPHEMERAL");
+    r.touch("cohort:c1", { claudeSessionId: "S-live", daemonSessionId: "s-1", model: "sonnet" });
+    const again = r.route("cohort:c1");
+    assert.equal(again.decision, "RESUME");
+    assert.equal(again.resumeId, "S-live");
+  } finally {
+    await safeUnlink(path);
+  }
+});
+
+test("createRouterSync — the SYNC and ASYNC routers read the same file", async () => {
+  const path = tmpRegistryPath("-shared");
+  try {
+    const sync = createRouterSync({ registryPath: path });
+    sync.touch("cohort:c2", { claudeSessionId: "S-shared" });
+    const async_ = await createRouter({ registryPath: path });
+    const d = async_.route("cohort:c2");
+    assert.equal(d.decision, "RESUME");
+    assert.equal(d.resumeId, "S-shared", "one registry, or the dispatcher and the responder key two sessions per room");
+  } finally {
+    await safeUnlink(path);
+  }
+});
+
+test("createRouterSync — a non-zero exit stops the next turn resuming into a broken session", async () => {
+  const path = tmpRegistryPath("-exit");
+  try {
+    const r = createRouterSync({ registryPath: path });
+    r.touch("cohort:c3", { claudeSessionId: "S-bad" });
+    r.recordExit("cohort:c3", 1);
+    assert.equal(r.route("cohort:c3").decision, "EPHEMERAL_REPLACE");
+  } finally {
+    await safeUnlink(path);
+  }
+});
+
+test("createRouterSync — an unreadable registry routes cold rather than throwing", () => {
+  const r = createRouterSync({ registryPath: join(tmpdir(), "definitely", "not", "a", "path", "registry.json") });
+  assert.equal(r.route("cohort:c4").decision, "EPHEMERAL");
+  assert.equal(r.recordExit("cohort:c4", 0), false);
+});
+
+test("createRouterSync — a corrupt registry routes cold rather than throwing", async () => {
+  const path = tmpRegistryPath("-corrupt");
+  try {
+    await fsp.writeFile(path, "{ this is not json", "utf-8");
+    const r = createRouterSync({ registryPath: path });
+    assert.equal(r.route("cohort:c5").decision, "EPHEMERAL");
+  } finally {
+    await safeUnlink(path);
+  }
+});
+
+test("createRouterSync — the LRU cap is enforced", async () => {
+  const path = tmpRegistryPath("-lru");
+  try {
+    const r = createRouterSync({ registryPath: path, maxLiveSessions: 2 });
+    r.touch("cohort:a", { claudeSessionId: "A" });
+    r.touch("cohort:b", { claudeSessionId: "B" });
+    r.touch("cohort:c", { claudeSessionId: "C" });
+    assert.equal(r.route("cohort:a").decision, "EPHEMERAL", "oldest evicted");
+    assert.equal(r.route("cohort:c").decision, "RESUME");
+  } finally {
+    await safeUnlink(path);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// TWO SHELLS, ONE FILE
+//
+// The dispatcher writes this registry through createRouterSync and the
+// responder through createRouter. The async shell used to read the file once
+// and keep the object for the daemon's life, so its `touch()` wrote a stale
+// snapshot back — and the LRU sweep at the end of `touch()` deletes every key
+// absent from that snapshot, which means one ordinary quick reply erased the
+// dispatcher's live rows. The converse was worse than a lost row: the cached
+// shell could answer RESUME for a session the other shell had already recorded
+// as killed, handing a 60-second --print reply the transcript of a long
+// agentic session.
+// ---------------------------------------------------------------------------
+
+test("an async touch() does not delete rows the SYNC shell wrote", async (t) => {
+  const path = tmpRegistryPath("-two-shells");
+  t.after(() => safeUnlink(path));
+
+  const async_ = await createRouter({ registryPath: path });
+  const sync = createRouterSync({ registryPath: path });
+
+  await async_.touch("slack:D1", { claudeSessionId: "S-QUICK" });
+  sync.touch("cohort:C-eng", { claudeSessionId: "S-LONG" });
+
+  // One perfectly ordinary quick reply on the other key.
+  await async_.touch("slack:D1", { claudeSessionId: "S-QUICK" });
+
+  const onDisk = JSON.parse(await fsp.readFile(path, "utf-8"));
+  assert.deepEqual(
+    Object.keys(onDisk.sessions).sort(),
+    ["cohort:C-eng", "slack:D1"],
+    "the async shell must merge onto what is on disk, not overwrite it with a snapshot",
+  );
+  assert.equal(sync.route("cohort:C-eng").decision, "RESUME", "§5.6 continuity survives an interleaved quick reply");
+});
+
+test("an async route() sees an exit the SYNC shell recorded — no resume into a killed session", async (t) => {
+  const path = tmpRegistryPath("-two-shells-exit");
+  t.after(() => safeUnlink(path));
+
+  const async_ = await createRouter({ registryPath: path });
+  const sync = createRouterSync({ registryPath: path });
+
+  sync.touch("cohort:C-eng", { claudeSessionId: "S-LONG" });
+  assert.equal(async_.route("cohort:C-eng").decision, "RESUME", "a live row resumes from either shell");
+
+  sync.recordExit("cohort:C-eng", 137);
+  const after = async_.route("cohort:C-eng");
+  assert.equal(after.decision, "EPHEMERAL_REPLACE", "a killed session must not be resumed by the other shell");
+  assert.equal(after.resumeId, null);
+});
+
+test("an async recordExit() is visible to the sync shell, and vice versa", async (t) => {
+  const path = tmpRegistryPath("-two-shells-sym");
+  t.after(() => safeUnlink(path));
+
+  const async_ = await createRouter({ registryPath: path });
+  const sync = createRouterSync({ registryPath: path });
+
+  sync.touch("cohort:C-x", { claudeSessionId: "S-1" });
+  await async_.recordExit("cohort:C-x", 1);
+  assert.equal(sync.route("cohort:C-x").decision, "EPHEMERAL_REPLACE");
+});
+
+
+// ---------------------------------------------------------------------------
+// the in-flight lease — one CLI process per session id
+// ---------------------------------------------------------------------------
+
+test("claimSession is exclusive, and releaseSession is idempotent", () => {
+  _resetInFlightForTests();
+  assert.equal(claimSession("cohort:C-eng"), true);
+  assert.equal(claimSession("cohort:C-eng"), false, "a second claim on a live key is refused");
+  assert.equal(isSessionInFlight("cohort:C-eng"), true);
+  releaseSession("cohort:C-eng");
+  releaseSession("cohort:C-eng");
+  assert.equal(isSessionInFlight("cohort:C-eng"), false);
+  assert.equal(claimSession("cohort:C-eng"), true);
+  _resetInFlightForTests();
+  assert.equal(claimSession(""), false, "an empty key is not a key");
+});
+
+test("neither shell resumes a key that already has a process on it", async (t) => {
+  const path = tmpRegistryPath("-inflight");
+  t.after(() => { _resetInFlightForTests(); return safeUnlink(path); });
+  _resetInFlightForTests();
+
+  const sync = createRouterSync({ registryPath: path });
+  const async_ = await createRouter({ registryPath: path });
+  sync.touch("cohort:C-busy", { claudeSessionId: "S-LIVE" });
+
+  assert.equal(sync.route("cohort:C-busy").decision, "RESUME", "idle: the row is resumable");
+  claimSession("cohort:C-busy");
+  assert.deepEqual(sync.route("cohort:C-busy"), { decision: "EPHEMERAL", resumeId: null });
+  assert.deepEqual(async_.route("cohort:C-busy"), { decision: "EPHEMERAL", resumeId: null },
+    "a 60-second quick reply must not be handed a running agentic session's transcript");
+
+  releaseSession("cohort:C-busy");
+  assert.equal(sync.route("cohort:C-busy").decision, "RESUME", "continuity returns when the room goes quiet");
+});

package/scripts/daemon/prompt-builder.mjs

@@ -13,6 +13,7 @@ import { isEnabled as orgEnabled } from "../../lib/org/client.mjs";
 import { recall as orgRecall } from "../../lib/org/knowledge.mjs";
 import { outcomeSourceShareable } from "./session-outcomes.mjs";
 import { withParallelism } from "../../lib/prompts/parallelism.mjs";
+import { isPrivateConversation, historyDirNames } from "../../lib/context/history-scope.mjs";
 
 const AGENT_REPO_DIR = process.env.AGENT_DIR || join(new URL(".", import.meta.url).pathname, "../..");
 
@@ -38,6 +39,74 @@ function loadAgent() {
 // Legacy: Maximum lines of conversation history (used when DAEMON_CONTEXT_COMPILER is off)
 const MAX_HISTORY_LINES = 30;
 
+/**
+ * Is the compiled-context path on?
+ *
+ * IT DEFAULTS ON, and that is the fix. The code read `=== "1"` while
+ * `.env.example:231` shipped `DAEMON_CONTEXT_COMPILER=1`, so which of two
+ * materially different context paths ran depended on whether the operator had
+ * copied the example env — an agent set up by hand got the legacy path and an
+ * agent set up from the template got the compiled one, with nothing anywhere
+ * saying so (design §3 R11).
+ *
+ * One path ships. The legacy path stays reachable for a seat that has to turn
+ * it off in a hurry (`DAEMON_CONTEXT_COMPILER=0`), which is why the flag is not
+ * simply deleted.
+ *
+ * A value that is neither a recognised on nor a recognised off is the dangerous
+ * case, because it selects between two materially different context paths and
+ * an operator who wrote `disabled` meant OFF. The word lists below are wide
+ * enough to cover what people actually write, and {@link contextCompilerSetting}
+ * reports the leftovers so the caller can say so out loud instead of resolving
+ * a typo in silence.
+ *
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {boolean}
+ */
+export function contextCompilerEnabled(env = process.env) {
+  return contextCompilerSetting(env).enabled;
+}
+
+/** Values that mean OFF. Wider than `"0"` because operators write words. */
+const CONTEXT_COMPILER_OFF = Object.freeze(["0", "false", "off", "no", "n", "disabled", "disable", "none"]);
+
+/** Values that mean ON. */
+const CONTEXT_COMPILER_ON = Object.freeze(["1", "true", "on", "yes", "y", "enabled", "enable"]);
+
+/**
+ * The flag, and whether the operator's word was one we know.
+ *
+ * PURE — the env arrives on the argument.
+ *
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {{enabled:boolean, recognised:boolean, raw:string}}
+ */
+export function contextCompilerSetting(env = process.env) {
+  const raw = String((env && env.DAEMON_CONTEXT_COMPILER) ?? "").trim().toLowerCase();
+  if (!raw) return { enabled: true, recognised: true, raw };
+  if (CONTEXT_COMPILER_OFF.includes(raw)) return { enabled: false, recognised: true, raw };
+  if (CONTEXT_COMPILER_ON.includes(raw)) return { enabled: true, recognised: true, raw };
+  return { enabled: true, recognised: false, raw };
+}
+
+/** Warn once per process about a DAEMON_CONTEXT_COMPILER value we do not know. */
+let warnedAboutContextCompiler = false;
+function warnIfContextCompilerUnrecognised(env = process.env) {
+  if (warnedAboutContextCompiler) return;
+  const setting = contextCompilerSetting(env);
+  if (setting.recognised) return;
+  warnedAboutContextCompiler = true;
+  console.warn(
+    `[prompt-builder] DAEMON_CONTEXT_COMPILER="${setting.raw}" is not a value this reads. ` +
+    `Using the compiled context path. Set it to 0 to use the legacy path.`,
+  );
+}
+
+/** For tests: allow the one-time warning to fire again. */
+export function _resetContextCompilerWarning() {
+  warnedAboutContextCompiler = false;
+}
+
 // Org shared-knowledge injection (org enrollment). Bounded so a large recall can
 // never blow up the prompt: at most this many facts, each truncated.
 const ORG_RECALL_MAX_FACTS = 6;
@@ -603,8 +672,22 @@ function today() {
 
 /**
  * Load recent conversation history for a sender/channel from interaction logs.
- * Searches memory/interactions/slack/{channel-or-sender}/ for recent JSONL entries.
- * Returns the most recent entries as formatted context text.
+ *
+ * IT READS THE ITEM'S OWN SERVICE. `responder.mjs#logInteraction` files every
+ * exchange under `memory/interactions/<service>/…` and has done since the
+ * write-half was fixed; this read looked only under `…/slack/…`, so a Cohort,
+ * Telegram or WhatsApp conversation was written down and then never found
+ * (design §3 R12). The agent had the record and could not see it.
+ *
+ * Slack keeps its legacy `<sender-slug>` directory alongside the `dm-` one —
+ * historical logs live there and must not go dark on this change.
+ *
+ * AND IT READS ONLY WHAT THIS ROOM MAY SEE. `logInteraction` files every
+ * exchange under BOTH the room and `dm-<sender-slug>`; merging all of them into
+ * one block put a person's private DM sentence into the prompt built for a
+ * public channel the moment this read stopped being Slack-only. The gate is
+ * `lib/context/history-scope.mjs`, shared with the writer and with the compiled
+ * path so the three cannot drift (design §5.5, resource scope).
  */
 function loadConversationHistory(item) {
   if (!item) return null;
@@ -613,13 +696,14 @@ function loadConversationHistory(item) {
   // Try multiple paths where interaction logs may live
   const channelId = extractChannelId(item);
   const senderSlug = item.sender ? item.sender.replace(/\s+/g, "-").toLowerCase() : null;
+  const service = String(item.service || "slack");
 
-  const candidateDirs = [];
-  if (channelId) candidateDirs.push(join(AGENT_REPO_DIR, "memory", "interactions", "slack", channelId));
-  if (senderSlug) {
-    candidateDirs.push(join(AGENT_REPO_DIR, "memory", "interactions", "slack", `dm-${senderSlug}`));
-    candidateDirs.push(join(AGENT_REPO_DIR, "memory", "interactions", "slack", senderSlug));
-  }
+  const candidateDirs = historyDirNames({
+    channelId,
+    senderSlug,
+    isPrivate: isPrivateConversation(item),
+    service,
+  }).map((name) => join(AGENT_REPO_DIR, "memory", "interactions", service, name));
 
   const entries = [];
 
@@ -681,7 +765,7 @@ function loadConversationHistory(item) {
  */
 function extractChannelId(item) {
   if (!item) return null;
-  // Direct channel ID field
+  // Direct channel ID field — every non-Slack service sets this.
   if (item.channel_id) return item.channel_id;
   // From raw_ref format: "slack:D099N1JGKRQ:1775331885.690669"
   if (item.raw_ref) {
@@ -1007,7 +1091,8 @@ export async function buildPrompt(item, classResult, options = {}) {
   // (context-compiler.mjs → loadOrgMemory), so skip here to avoid a duplicate
   // recall + duplicated context in the same prompt. Backlog items pass their
   // queueItem into compileContext (below) so entity coverage is preserved.
-  if (process.env.DAEMON_CONTEXT_COMPILER !== "1") {
+  warnIfContextCompilerUnrecognised();
+  if (!contextCompilerEnabled()) {
     const orgBlock = await buildOrgKnowledgeBlock(item, classResult, queueItem);
     if (orgBlock) {
       parts.push(orgBlock);
@@ -1016,7 +1101,7 @@ export async function buildPrompt(item, classResult, options = {}) {
   }
 
   // 4. Compiled context (profile + history + disclosure boundaries + active sessions + sent messages)
-  if (process.env.DAEMON_CONTEXT_COMPILER === "1" && (type === "inbox" ? item : true)) {
+  if (contextCompilerEnabled() && (type === "inbox" ? item : true)) {
     try {
       const { contextBlock } = await compileContext(
         item || {},
@@ -1056,7 +1141,7 @@ export async function buildPrompt(item, classResult, options = {}) {
   parts.push("");
 
   // 6. User profile lookup — legacy only (when feature flag is off, profile is in compiled context)
-  if (process.env.DAEMON_CONTEXT_COMPILER !== "1" && type === "inbox" && item && item.sender) {
+  if (!contextCompilerEnabled() && type === "inbox" && item && item.sender) {
     const profileName = item.sender.replace(/\s+/g, "-").toLowerCase();
     parts.push(`Before responding, read memory/profiles/users/${profileName}.yaml for sender preferences, standing instructions, and relationship context. If the file does not exist, proceed without it.`);
     parts.push("");