@cohortapp/agent-sdk 2.17.0 → 2.18.5

package/lib/org/inbound/index.test.mjs

@@ -1,429 +0,0 @@
-/**
- * index.test.mjs — end-to-end `pullWideInbound` over an injected fake org.
- *
- * One realistic ledger window carrying ten families is pulled and the result is
- * asserted twice: as MessageEvents, and as the flat inbox items the daemon
- * actually consumes. The negative half is asserted by CALL LOG — a private room
- * this agent is not in must produce no history fetch, no body, and no item.
- *
- * Run: node --test lib/org/inbound/index.test.mjs
- */
-
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import { pullWideInbound } from "./index.mjs";
-import { eventToInboxItem } from "../../channels/inbox-item.mjs";
-
-const ME = "M-me";
-const THEM = "M-them";
-const BOSS = "M-boss";
-
-const okFrame = (result) => ({ ok: true, result });
-const okRead = (payload) => ({ ok: true, payload, status: 200 });
-
-/** An org fake: routes for `call` + `read`, with a full call log. */
-function fakeIo(routes = {}) {
-  const calls = [];
-  const logs = [];
-  return {
-    calls,
-    logs,
-    stats: { calls: 0, reads: 0, failures: 0, methods: [] },
-    log: (level, message, meta) => logs.push({ level, message, meta }),
-    async call(method, params) {
-      calls.push({ method, params });
-      this.stats.calls += 1;
-      const h = routes[method];
-      if (!h) return { ok: false, error: { code: "NOT_FOUND", message: method } };
-      return typeof h === "function" ? await h(params) : h;
-    },
-    async read(path) {
-      const base = String(path).split("?")[0];
-      calls.push({ method: `read:${base}`, path });
-      this.stats.reads += 1;
-      const h = routes[`read:${base}`];
-      if (!h) return { ok: false, error: { code: "NOT_FOUND", message: base }, status: 404 };
-      return typeof h === "function" ? await h(path) : h;
-    },
-  };
-}
-
-/** A cfg that passes `isEnabled` + `configFromAgent`. */
-const CFG = { org: { cohort: { enabled: true, base: "https://os.cohortapp.com/adaptic", token: "tok" } } };
-
-// A ledger window with one row per surface, plus three rows that must NOT reach me.
-const LEDGER = [
-  // (1) DM to me
-  { seq: 1, family: "messaging", kind: "send", entity_id: "m-dm", actor: THEM, at: "2026-08-11T09:00:00.000Z",
-    payload: { actor: THEM, channelId: "C-dm", channelKind: "DM", mentionCount: 0, threaded: false } },
-  // (2) @mention in a public space — THE headline gap
-  { seq: 2, family: "messaging", kind: "send", entity_id: "m-mention", actor: THEM, at: "2026-08-11T09:01:00.000Z",
-    payload: { actor: THEM, channelId: "C-pub", channelKind: "PUBLIC", mentionCount: 1, threaded: false } },
-  // (3) thread reply in a thread I started
-  { seq: 3, family: "messaging", kind: "send", entity_id: "m-thread", actor: THEM, at: "2026-08-11T09:02:00.000Z",
-    payload: { actor: THEM, channelId: "C-pub", channelKind: "PUBLIC", mentionCount: 0, threaded: true } },
-  // (4) NEGATIVE: someone else's DM
-  { seq: 4, family: "messaging", kind: "send", entity_id: "m-theirs", actor: THEM, at: "2026-08-11T09:03:00.000Z",
-    payload: { actor: THEM, channelId: "C-theirs", channelKind: "DM", mentionCount: 0, threaded: false } },
-  // (5) NEGATIVE: ambient public chatter
-  { seq: 5, family: "messaging", kind: "send", entity_id: "m-noise", actor: THEM, at: "2026-08-11T09:04:00.000Z",
-    payload: { actor: THEM, channelId: "C-pub", channelKind: "PUBLIC", mentionCount: 0, threaded: false } },
-  // (6) board assignment to me
-  { seq: 6, family: "board", kind: "item.assigned", entity_id: "T-1", actor: BOSS, at: "2026-08-11T09:05:00.000Z",
-    payload: { actor: BOSS, assignee: ME, assignedBy: BOSS } },
-  // (7) comment on my task
-  { seq: 7, family: "board", kind: "item.commented", entity_id: "T-1", actor: THEM, at: "2026-08-11T09:06:00.000Z",
-    payload: { actor: THEM, kind: "human" } },
-  // (8) NEGATIVE: comment on someone else's task
-  { seq: 8, family: "board", kind: "item.commented", entity_id: "T-99", actor: THEM, at: "2026-08-11T09:07:00.000Z",
-    payload: { actor: THEM, kind: "human" } },
-  // (9) doc comment on a doc I own
-  { seq: 9, family: "files", kind: "doc.comment", entity_id: "F-1", actor: THEM, at: "2026-08-11T09:08:00.000Z",
-    payload: { name: "Spec", commentId: "dc1", anchored: false } },
-  // (10) approval on my desk
-  { seq: 10, family: "approval", kind: "approval.requested", entity_id: "A-1", actor: THEM, at: "2026-08-11T09:09:00.000Z",
-    payload: { requester: THEM, actionClass: "spend.over_1k", payloadHash: "h" } },
-  // (11) decision I proposed gets an adjustment request
-  { seq: 11, family: "decision", kind: "decision.adjustment_requested", entity_id: "D-1", actor: THEM, at: "2026-08-11T09:10:00.000Z",
-    payload: { commentId: "c1", authorId: THEM, isAdjustment: true, length: 12 } },
-  // (12) handoff offered to me
-  { seq: 12, family: "handoff", kind: "handoff.offered", entity_id: "R-1", actor: THEM, at: "2026-08-11T09:11:00.000Z",
-    payload: { itemId: "T-1", from: THEM, to: ME, intent: "take this over", handoffId: "H-1" } },
-  // (13) inbound email to my mailbox (surface OFF by default)
-  { seq: 13, family: "email", kind: "received", entity_id: "EM-1", actor: "system", at: "2026-08-11T09:12:00.000Z",
-    payload: { emailMessageId: "EM-1", threadId: "ET-1", mailboxId: "MB-1", memberId: ME, autoSubmitted: false } },
-  // (14) noise family the daemon must never be woken for
-  { seq: 14, family: "presence", kind: "beat", entity_id: null, actor: THEM, at: "2026-08-11T09:13:00.000Z",
-    payload: { focus: "x" } },
-  // (15) my OWN message — the echo that must never come back
-  { seq: 15, family: "messaging", kind: "send", entity_id: "m-mine", actor: ME, at: "2026-08-11T09:14:00.000Z",
-    payload: { actor: ME, channelId: "C-pub", channelKind: "PUBLIC", mentionCount: 1, threaded: false } },
-];
-
-function routes(over = {}) {
-  return {
-    "read:events": okRead({ events: LEDGER }),
-    "messaging.channels": okFrame({
-      channels: [
-        { id: "C-dm", kind: "DM", slug: "dm-them", name: "them" },
-        { id: "C-pub", kind: "PUBLIC", slug: "general", name: "General" },
-      ],
-    }),
-    "messaging.history": ({ channelId }) => {
-      if (channelId === "C-dm") {
-        return okFrame({ channelId, messages: [{ id: "m-dm", authorId: THEM, authorName: "Casey", body: "are you free at 3?", mentions: [] }] });
-      }
-      if (channelId === "C-pub") {
-        return okFrame({
-          channelId,
-          messages: [
-            { id: "root-1", authorId: ME, authorName: "Isla", body: "kicking off the migration", mentions: [] },
-            { id: "m-mention", authorId: THEM, authorName: "Casey", body: "@Isla can you review this?", mentions: [ME] },
-            { id: "m-thread", authorId: THEM, authorName: "Casey", body: "one more thing on that", threadRootId: "root-1", mentions: [] },
-            { id: "m-noise", authorId: THEM, authorName: "Casey", body: "standup at 10", mentions: [] },
-            { id: "m-mine", authorId: ME, authorName: "Isla", body: "on it", mentions: [ME] },
-          ],
-        });
-      }
-      throw new Error(`history fetched for a channel outside my roster: ${channelId}`);
-    },
-    "read:board.context": okRead({
-      lanes: [{ columns: { doing: [{ id: "T-1", title: "Migrate the DB", col: "doing", assigneeId: ME, reviewerId: null, detail: "zero downtime" }] } }],
-    }),
-    "board.taskComments": ({ taskId }) => okFrame({ taskId, comments: [{ id: "c1", authorId: THEM, authorName: "Casey", body: "how is this going?" }] }),
-    "files.get": ({ fileId }) =>
-      fileId === "F-1"
-        ? okFrame({ file: { id: "F-1", name: "Spec", ownerId: ME }, permission: "owner" })
-        : { ok: false, error: { code: "NOT_FOUND", message: "no" } },
-    "files.comments": okFrame({ comments: [{ id: "dc1", authorId: THEM, authorName: "Casey", body: "can we cut section 4?" }] }),
-    "approval.get": ({ id }) => okFrame({ id, requester: THEM, approver: ME, status: "pending", actionClass: "spend.over_1k", reason: "vendor renewal" }),
-    "read:decision.list": okRead({ decisions: [{ id: "D-1", title: "Adopt X", status: "proposed", proposedBy: ME, body: "we adopt X" }] }),
-    "decision.listComments": okFrame({ comments: [{ id: "c1", authorId: THEM, authorName: "Casey", body: "what about Y?" }] }),
-    "email.thread": ({ threadId }) =>
-      okFrame({ thread: { id: threadId, subject: "Contract" }, messages: [{ id: "EM-1", subject: "Contract", text: "please review", from: { name: "Dana", address: "dana@acme.com" } }] }),
-    ...over,
-  };
-}
-
-// ---------------------------------------------------------------------------
-
-test("one pull delivers every surface the agent is entitled to", async () => {
-  const io = fakeIo(routes());
-  const { events, nextCursor, stats } = await pullWideInbound({ cfg: CFG, agentId: ME, cursor: 0, io });
-
-  assert.equal(nextCursor, 15, "the cursor advances past every scanned row, delivered or not");
-  const bySurface = {};
-  for (const e of events) bySurface[e.cohort.surface] = (bySurface[e.cohort.surface] || 0) + 1;
-
-  assert.deepEqual(bySurface, {
-    dm: 1,
-    mention: 1,
-    thread_reply: 1,
-    task_assigned: 1,
-    task_comment: 1,
-    doc_comment: 1,
-    approval: 1,
-    decision: 1,
-    handoff: 1,
-  });
-  assert.equal(stats.scanned, 15);
-  assert.equal(stats.delivered, 9);
-});
-
-test("the typed reason rides along on every delivered item", async () => {
-  const io = fakeIo(routes());
-  const { events } = await pullWideInbound({ cfg: CFG, agentId: ME, io });
-  const reasons = Object.fromEntries(events.map((e) => [e.cohort.surface, e.cohort.reason]));
-  assert.deepEqual(reasons, {
-    dm: "dm",
-    mention: "mention",
-    thread_reply: "thread",
-    task_assigned: "assignee",
-    task_comment: "assignee",
-    doc_comment: "owner",
-    approval: "approver",
-    decision: "proposer",
-    handoff: "direct",
-  });
-});
-
-test("NEGATIVE: nothing from someone else's private room, my own echo, or ambient noise", async () => {
-  const io = fakeIo(routes());
-  const { events, stats } = await pullWideInbound({ cfg: CFG, agentId: ME, io });
-
-  const ids = events.map((e) => e.message_id);
-  assert.equal(ids.includes("m-theirs"), false, "someone else's DM must never be delivered");
-  assert.equal(ids.includes("m-mine"), false, "my own message must never come back");
-  assert.equal(ids.includes("m-noise"), false, "ambient public chatter is not inbound");
-  assert.equal(events.some((e) => e.cohort.entity_id === "T-99"), false, "another seat's task is not mine");
-
-  // Asserted by CALL LOG, not just by absence of output: the private room was
-  // never even probed.
-  const probed = io.calls.filter((c) => c.method === "messaging.history").map((c) => c.params.channelId);
-  assert.deepEqual(probed.sort(), ["C-dm", "C-pub"]);
-  assert.ok(stats.dropped.own_echo >= 1);
-  assert.ok(stats.dropped.channel_not_visible >= 1);
-});
-
-test("REGRESSION: a slug-valued agentId still drops my own echo, via meAliases", async () => {
-  // The production shape on 2026-08-26: COHORT_AGENT_ID is a SLUG, hq stamps
-  // `actor` with the member cuid. `agentId` alone then matches nothing and the
-  // own-echo drop silently stops existing — no throw, no log, just the seat
-  // answering itself. The daemon hands BOTH namespaces down as `meAliases`, so
-  // the drop survives regardless of which one `agentId` resolved to.
-  const io = fakeIo(routes());
-  const { events, stats } = await pullWideInbound({
-    cfg: CFG,
-    agentId: "A028",
-    meAliases: ["A028", ME],
-    io,
-  });
-
-  assert.ok(stats.dropped.own_echo >= 1, "own_echo must still fire when me is the slug");
-  assert.equal(
-    events.some((e) => e.message_id === "m-mine"),
-    false,
-    "my own message must never come back, whichever id namespace the caller passed",
-  );
-});
-
-test("email is OFF by default and is not even hydrated", async () => {
-  const io = fakeIo(routes());
-  const { events } = await pullWideInbound({ cfg: CFG, agentId: ME, io });
-  assert.equal(events.some((e) => e.cohort.surface === "email"), false);
-  assert.equal(io.calls.some((c) => c.method === "email.thread"), false, "a disabled surface costs nothing");
-});
-
-test("email switches on explicitly (for a fleet with the orgmail adapter off)", async () => {
-  const io = fakeIo(routes());
-  const { events } = await pullWideInbound({ cfg: CFG, agentId: ME, io, surfaces: { email: true } });
-  const mail = events.find((e) => e.cohort.surface === "email");
-  assert.ok(mail, "email must be deliverable when enabled");
-  assert.equal(mail.kind, "email");
-  assert.equal(mail.text, "please review");
-});
-
-test("a surface subset turns everything else off", async () => {
-  const io = fakeIo(routes());
-  const { events } = await pullWideInbound({ cfg: CFG, agentId: ME, io, surfaces: ["mention"] });
-  assert.deepEqual(events.map((e) => e.cohort.surface), ["mention"]);
-});
-
-test("the delivered events survive eventToInboxItem with their routing hints intact", async () => {
-  const io = fakeIo(routes());
-  const { events } = await pullWideInbound({ cfg: CFG, agentId: ME, io });
-  const items = events.map(eventToInboxItem);
-
-  for (const item of items) {
-    assert.equal(item.service, "cohort");
-    assert.ok(item.id, "every item needs a dedup id");
-    assert.ok(item.content, "every item needs a body");
-    assert.ok(item.timestamp);
-  }
-  const kinds = items.map((i) => i.kind || "message").sort();
-  assert.deepEqual(kinds, [
-    "approval", "decision", "file_comment", "handoff", "mention",
-    "message", "task_assigned", "task_comment", "thread_reply",
-  ]);
-});
-
-test("the DM item is unchanged in shape from what ships today", async () => {
-  const io = fakeIo(routes());
-  const { events } = await pullWideInbound({ cfg: CFG, agentId: ME, io });
-  const dm = eventToInboxItem(events.find((e) => e.cohort.surface === "dm"));
-  assert.equal(dm.id, "cohort-m-dm");
-  assert.equal("kind" in dm, false);
-  assert.equal(dm.subject, "Cohort message");
-  assert.equal(dm.content, "are you free at 3?");
-  assert.equal(dm.sender, "Casey");
-  assert.equal(dm.source, "cohort");
-});
-
-// ---------------------------------------------------------------------------
-// failure modes
-// ---------------------------------------------------------------------------
-
-test("no agentId → refuses to pull, LOUDLY (own echoes would come back)", async () => {
-  const logs = [];
-  const io = fakeIo(routes());
-  const out = await pullWideInbound({ cfg: CFG, agentId: "", io, log: (l, m) => logs.push(`${l}:${m}`) });
-  assert.deepEqual(out.events, []);
-  assert.equal(io.calls.length, 0);
-  assert.ok(logs.some((l) => l.startsWith("error:") && /agentId/.test(l)));
-});
-
-test("org not configured → inert, no throw", async () => {
-  const out = await pullWideInbound({ cfg: { org: { cohort: { enabled: false } } }, agentId: ME });
-  assert.deepEqual(out.events, []);
-  assert.equal(out.nextCursor, 0);
-});
-
-test("events read fails → cursor HELD so nothing is skipped", async () => {
-  const io = fakeIo({ ...routes(), "read:events": { ok: false, error: { code: "INTERNAL", message: "boom" }, status: 500 } });
-  const out = await pullWideInbound({ cfg: CFG, agentId: ME, cursor: 7, io });
-  assert.deepEqual(out.events, []);
-  assert.equal(out.nextCursor, 7);
-});
-
-test("a degraded fact set closes surfaces rather than opening them", async () => {
-  // Roster unreadable: every messaging surface must go quiet, and say why.
-  const io = fakeIo({ ...routes(), "messaging.channels": { ok: false, error: { code: "INTERNAL", message: "down" } } });
-  const { events, stats } = await pullWideInbound({ cfg: CFG, agentId: ME, io });
-  assert.equal(events.some((e) => e.cohort.family === "messaging"), false);
-  assert.ok(stats.degraded.includes("channels"));
-  // The families that do not need the roster still work.
-  assert.ok(events.some((e) => e.cohort.surface === "task_assigned"));
-});
-
-test("an unhydratable directed item is dropped with a WARNING, not delivered blank", async () => {
-  const io = fakeIo({ ...routes(), "board.taskComments": { ok: false, error: { code: "INTERNAL", message: "down" } }, "files.get": { ok: false, error: { code: "INTERNAL", message: "down" } } });
-  const logs = [];
-  const { events } = await pullWideInbound({ cfg: CFG, agentId: ME, io, log: (l, m) => logs.push(`${l}:${m}`) });
-  // The board item still renders from the task card; the doc has no ACL entry so
-  // it never becomes directed in the first place.
-  assert.equal(events.some((e) => e.cohort.surface === "doc_comment"), false);
-  for (const e of events) assert.ok(e.text.trim(), "no blank body may ever be delivered");
-});
-
-test("stats report what was spent and why things were dropped", async () => {
-  const io = fakeIo(routes());
-  const { stats } = await pullWideInbound({ cfg: CFG, agentId: ME, io });
-  assert.equal(stats.scanned, 15);
-  // 15 rows in, 1 (`presence`) has no rule at all → never becomes a candidate.
-  assert.equal(stats.classified, 14, "noise families are dropped before any RPC is spent");
-  assert.ok(stats.calls > 0 && stats.reads > 0);
-  assert.ok(Object.keys(stats.dropped).length > 0);
-});
-
-test("an empty ledger window is a no-op that still advances nothing", async () => {
-  const io = fakeIo({ ...routes(), "read:events": okRead({ events: [] }) });
-  const out = await pullWideInbound({ cfg: CFG, agentId: ME, cursor: 5, io });
-  assert.deepEqual(out.events, []);
-  assert.equal(out.nextCursor, 5);
-});
-
-// ---------------------------------------------------------------------------
-// Calendar (JOINT 3) — the surface hq's own agent.wait lanes do not carry
-// ---------------------------------------------------------------------------
-
-/**
- * The calendar payload is redacted like every other family: `event.created`
- * carries `attendeeCount` and the CALENDAR OWNER, never the attendee list. So
- * "am I in this meeting?" is answered by `calendar.list` — hq's seat-scoped
- * query (owner OR attendeeRows, under the PERSONAL_RESTRICTED lens floor) — and
- * NEVER by widening the chain payload.
- */
-test("calendar: an event I attend arrives; a colleague's event never does", async () => {
-  const io = fakeIo({
-    "read:events": okRead({
-      events: [
-        // Mine — I am an attendee (owner is someone else).
-        { seq: 900, family: "calendar", kind: "event.created", entity_id: "EV-mine", actor: BOSS,
-          at: "2026-08-11T10:00:00.000Z",
-          payload: { title: "Transport review", startsAt: "2026-08-12T10:00:00.000Z", endsAt: "2026-08-12T11:00:00.000Z",
-                     eventKind: "MEETING", attendeeCount: 4, calendarMemberId: BOSS } },
-        // NOT mine — a meeting between two colleagues. `calendar.list` will not
-        // return it, so it must never be delivered or hydrated.
-        { seq: 901, family: "calendar", kind: "event.created", entity_id: "EV-theirs", actor: THEM,
-          at: "2026-08-11T10:05:00.000Z",
-          payload: { title: "Their 1:1", startsAt: "2026-08-12T14:00:00.000Z",
-                     eventKind: "MEETING", attendeeCount: 2, calendarMemberId: THEM } },
-      ],
-      nextCursor: 901,
-    }),
-    "calendar.list": okFrame({
-      events: [
-        { id: "EV-mine", title: "Transport review", startsAt: "2026-08-12T10:00:00.000Z",
-          endsAt: "2026-08-12T11:00:00.000Z", location: "Huddle 2", description: "Walk the five hops",
-          calendarMemberId: BOSS, channelId: "C-pub" },
-      ],
-    }),
-  });
-
-  const res = await pullWideInbound({ cfg: CFG, agentId: ME, cursor: 899, io });
-
-  assert.equal(res.events.length, 1, "exactly one calendar item — the one I am in");
-  const ev = res.events[0];
-  assert.equal(ev.kind, "calendar");
-  assert.equal(ev.cohort.surface, "calendar");
-  assert.equal(ev.cohort.reason, "attendee", "attendance was proven by an ACL'd read, not by a payload");
-  assert.match(ev.text, /Calendar event created — "Transport review"/);
-  assert.match(ev.text, /Walk the five hops/);
-  assert.equal(res.stats.bySurface.calendar, 1);
-  assert.equal(res.stats.dropped.calendar_not_mine, 1, "the colleague's meeting was dropped with a named reason");
-
-  // ACL by call log: hq was asked ONE seat-scoped question, and we never probed
-  // the event we were not entitled to.
-  const calendarCalls = io.calls.filter((c) => c.method === "calendar.list");
-  assert.equal(calendarCalls.length, 1, "one list read per pull, not one probe per event");
-  assert.ok(
-    calendarCalls[0].params.calendarMemberId === undefined,
-    "no calendarMemberId → hq uses the ACTING SEAT's viewpoint; naming one would be asking about someone else's calendar",
-  );
-  assert.equal(io.calls.filter((c) => c.method === "calendar.get").length, 0, "no per-event probe at all");
-});
-
-test("calendar: an unreadable calendar fails CLOSED and says so", async () => {
-  const io = fakeIo({
-    "read:events": okRead({
-      events: [
-        { seq: 910, family: "calendar", kind: "event.rescheduled", entity_id: "EV-mine", actor: BOSS,
-          at: "2026-08-11T10:00:00.000Z", payload: { title: "Transport review", to: "2026-08-13T10:00:00.000Z" } },
-      ],
-      nextCursor: 910,
-    }),
-    // calendar.list not routed → the fake returns NOT_FOUND, i.e. a failed read.
-  });
-
-  const res = await pullWideInbound({ cfg: CFG, agentId: ME, cursor: 909, io });
-  assert.equal(res.events.length, 0, "a private surface guesses CLOSED, never open");
-  assert.equal(res.stats.dropped.calendar_unknown, 1);
-  assert.ok(res.stats.degraded.includes("calendar"), "and the degradation is reported, not swallowed");
-  assert.ok(
-    io.logs.some((l) => l.level === "warn" && /calendar\.list unreadable/.test(l.message)),
-    `fail-open is fine, silent is not; got ${JSON.stringify(io.logs)}`,
-  );
-});