@cohortapp/agent-sdk 2.18.12 → 2.18.13

package/lib/org/inbound/conversation-frame.mjs

@@ -0,0 +1,289 @@
+/**
+ * conversation-frame.mjs — the block that tells a reply prompt it is joining a
+ * conversation ALREADY IN PROGRESS, with people who already know who the agent is.
+ *
+ * WHY THIS EXISTS
+ *   Seats were posting a self-introduction into the middle of live threads — a
+ *   rendering of `channels.<c>.identity_line` from policies/ai-disclosure.yaml,
+ *   the opener naming the agent's own nature and pairing it with its principal
+ *   — on a release-status post and on a correction to the agent's
+ *   OWN earlier figures, in the org's own #risk-compliance channel. Removing the
+ *   send-gate that DEMANDED a disclosure line (2.18.9/2.18.12) stopped the gate
+ *   training the behaviour, but it did not give the model any reason to stop:
+ *   the quick-reply prompt never said this was an ongoing conversation.
+ *
+ *   Rendering the real prompt (scripts/daemon/responder.mjs #realGenerateResponse)
+ *   for a mid-thread channel reply showed why a competent model would introduce
+ *   itself there:
+ *     - the item's transcript arrived as a bare "Recent conversation history"
+ *       dump with no statement that the agent is a PARTICIPANT in it;
+ *     - the agent's own earlier turns were unmarked, so lines authored by the
+ *       seat read as a third party's;
+ *     - nothing named the surface as a room inside the agent's own organisation,
+ *       and nothing said the other speakers are colleagues;
+ *     - the standing instruction was "You are generating a direct response to
+ *       this message" — the frame of a one-shot, not of a turn in a thread.
+ *   A model handed a transcript it is not told it is part of behaves correctly
+ *   when it introduces itself. The defect is the frame, not the model.
+ *
+ * WHAT THIS IS NOT
+ *   It is NOT a disclosure policy and it must never render one. The truthfulness
+ *   invariant lives in policies/ai-disclosure.yaml and lib/comms/send-gate.mjs
+ *   and is untouched: a sincere question about whether someone is an AI is still
+ *   answered plainly, on any message, internal or external. What this block
+ *   suppresses is the UNPROMPTED self-introduction, which nobody asked for and
+ *   which no policy ever required inside the agent's own workspace.
+ *
+ * PURE. No I/O, no clock, no env — every input is a parameter, so the exact text
+ * a given item produces is a unit test (conversation-frame.test.mjs).
+ */
+
+/**
+ * A transcript line as both history renderers emit it: `[<iso>] <Name>: <text>`.
+ * The timestamp is optional because `thread_context` hydrators and the local
+ * interaction mirror both sometimes omit it.
+ */
+const SPEAKER_LINE = /^(\s*(?:\[[^\]]*\]\s*)?)([^:\n]{1,80}?):(\s|$)/;
+
+/** Trim to a string, "" for anything nullish/non-scalar. */
+function s(v) {
+  return typeof v === "string" ? v.trim() : "";
+}
+
+/** Drop a trailing "(you)" marker from a speaker label. @param {string} n @returns {string} */
+function stripOwnMarker(n) {
+  return String(n || "").replace(/\s*\(you\)\s*$/i, "").trim();
+}
+
+/**
+ * The speaker names in a transcript, in first-appearance order.
+ *
+ * Deliberately conservative: a line that does not match `[ts] Name:` contributes
+ * nothing rather than guessing, so a wrapped continuation line cannot invent a
+ * participant. Names are capped at 80 chars by the pattern itself.
+ *
+ * @param {string|null|undefined} transcript
+ * @returns {string[]}
+ */
+export function parseSpeakers(transcript) {
+  const out = [];
+  const seen = new Set();
+  for (const line of s(transcript).split("\n")) {
+    const m = SPEAKER_LINE.exec(line);
+    if (!m) continue;
+    const name = m[2].trim();
+    if (!name) continue;
+    const key = name.toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(name);
+  }
+  return out;
+}
+
+/**
+ * Mark the agent's own turns in a transcript so the model can see that it is
+ * already IN this conversation.
+ *
+ * Only the speaker label is touched — the body is never rewritten, because the
+ * body is attacker-influenced inbound text and this function is not a sanitiser.
+ * A transcript with no line by `agentName` comes back byte-identical.
+ *
+ * @param {string|null|undefined} transcript
+ * @param {string|null|undefined} agentName
+ * @returns {string} "" when the transcript is empty
+ */
+export function markOwnTurns(transcript, agentName) {
+  const text = s(transcript);
+  const me = s(agentName);
+  if (!text || !me) return text;
+  const meKey = me.toLowerCase();
+  return text
+    .split("\n")
+    .map((line) => {
+      const m = SPEAKER_LINE.exec(line);
+      if (!m) return line;
+      const name = m[2].trim();
+      if (name.toLowerCase() !== meKey) return line;
+      // Already marked (re-entrant call, or an upstream renderer did it).
+      if (/\(you\)\s*$/.test(name)) return line;
+      return `${m[1]}${name} (you):${m[3]}${line.slice(m[0].length)}`;
+    })
+    .join("\n");
+}
+
+/**
+ * Drop from `threadContext` every line the channel history already carries.
+ *
+ * The quick-reply user content used to render BOTH blocks in full, and for a
+ * mid-thread channel reply they overlap almost completely: the same three or
+ * four turns arrived twice, worth up to COHORT_HISTORY_LIMIT ×
+ * COHORT_HISTORY_CHARS of budget, and read as two different records of the same
+ * exchange. Comparison is on the whole trimmed line, so a turn truncated to a
+ * different length in the two renderers is kept rather than silently dropped —
+ * a duplicate is cheap, a lost turn is not.
+ *
+ * @param {string|null|undefined} history
+ * @param {string|null|undefined} threadContext
+ * @returns {string} "" when nothing survives
+ */
+export function dedupeThreadAgainstHistory(history, threadContext) {
+  const thread = s(threadContext);
+  if (!thread) return "";
+  const seen = new Set(
+    s(history).split("\n").map((l) => l.trim()).filter(Boolean),
+  );
+  if (seen.size === 0) return thread;
+  const kept = thread.split("\n").filter((l) => {
+    const t = l.trim();
+    return t ? !seen.has(t) : false;
+  });
+  return kept.join("\n").trim();
+}
+
+/**
+ * Services whose INBOUND items are internal by construction.
+ *
+ * An item on the org plane reached this agent because hq's ACL put it in reach:
+ * it is a row inside the workspace the agent is a member of. There is no such
+ * thing as an inbound Cohort channel post from outside the org.
+ *
+ * Both spellings are live in the tree — `lib/org/messaging` says "cohort",
+ * `lib/org/tool-surface` says "cohort-org" — so both are listed rather than one
+ * of them being quietly wrong. (The same pair is enumerated in
+ * lib/comms/send-gate.mjs#classifyRecipient for the same reason.)
+ */
+const ORG_PLANE_SERVICES = new Set(["cohort", "cohort-org"]);
+
+/**
+ * Which branch of the frame this item gets: are the other speakers colleagues
+ * inside the agent's own organisation, or correspondents outside it?
+ *
+ * THIS IS NOT A SECURITY DECISION AND MUST NEVER BECOME ONE. It selects one
+ * sentence of prose. The gate that decides whether a message may be SENT, and
+ * which information-barrier walls apply, is lib/comms/send-gate.mjs — it runs on
+ * the outbound path, on the real recipient, and nothing here can relax it.
+ *
+ * WHY IT IS NOT SIMPLY `classifyRecipient(service, channel_id || channel)`.
+ * That was the first shape, and it is wrong in a way that says nothing when it
+ * misses. `classifyRecipient` is default-DENY: its Cohort case returns
+ * "internal" only for a cuid/uuid-shaped id, so an item projected WITHOUT a
+ * `channel_id` — or one carrying a human channel slug like "#risk-compliance" —
+ * fell to "external" and the frame told the agent that colleagues in its own
+ * #risk-compliance channel were outside correspondents. Default-deny is exactly
+ * right for a send gate and exactly wrong for a description of a room, because
+ * the failure is silent: the external branch still renders no disclosure and
+ * still says "no self-introduction", so nothing downstream goes red.
+ *
+ * So origin decides first, shape second. Off the org plane the gate's own
+ * predicate is used unchanged, and its default-deny is inherited — an email or
+ * an unrecognised handle is external, which is both conservative and true.
+ *
+ * PURE: the classifier is a PARAMETER, so this module still has no imports with
+ * state and the branch a given item takes is a unit test.
+ *
+ * @param {{service?:string, channel_id?:string, recipient?:string, channel?:string}} item
+ * @param {((channel:string, recipient:string)=>string)|null} [classify]
+ *        lib/comms/send-gate.mjs#classifyRecipient, injected
+ * @returns {"internal"|"external"}
+ */
+export function frameRecipientClass(item = {}, classify = null) {
+  const service = s(item.service).toLowerCase();
+  if (ORG_PLANE_SERVICES.has(service)) return "internal";
+  const handle = s(item.channel_id) || s(item.recipient) || s(item.channel);
+  if (!handle || typeof classify !== "function") return "external";
+  try {
+    return classify(service, handle) === "external" ? "external" : "internal";
+  } catch {
+    return "external";
+  }
+}
+
+/**
+ * How the room should be described to the model.
+ * @param {{service?:string, channel?:string, is_dm?:boolean}} item
+ * @returns {string}
+ */
+function surfaceLabel(item) {
+  const channel = s(item.channel);
+  const service = s(item.service) || "this workspace";
+  if (item.is_dm) {
+    return `a direct message on ${service}`;
+  }
+  return channel ? `the ${channel} channel on ${service}` : `a channel on ${service}`;
+}
+
+/**
+ * The frame block.
+ *
+ * BUDGET. Six lines of standing frame plus at most two derived lines — under
+ * ~120 tokens, and it is spent only when there is actually a conversation to
+ * frame (`turns > 0`). It is paid for several times over by
+ * `dedupeThreadAgainstHistory`, which removes a duplicate transcript worth up to
+ * ~1,200 tokens from the same prompt.
+ *
+ * WHAT IS INCLUDED — the four things the rendered prompt was missing and a model
+ * would otherwise have to infer: that the exchange is ongoing, that the agent is
+ * already a participant in it, who the other participants are, and whether they
+ * are colleagues inside the agent's own organisation.
+ *
+ * WHAT IS EXCLUDED, deliberately: the room's full member list (unbounded, and
+ * the speakers are what matters for a reply), member titles and profiles (the
+ * context compiler's job, and only for the sender), the channel topic/purpose
+ * (an extra round trip on a 60-second path), and anything about the agent's
+ * nature — see the module header.
+ *
+ * @param {object} o
+ * @param {object} o.item                    the inbox item
+ * @param {string} [o.agentName]             the seat's own full name
+ * @param {"internal"|"external"} [o.recipientClass="internal"]
+ * @param {string} [o.history]               channel transcript
+ * @param {string} [o.threadContext]         thread transcript (already deduped)
+ * @returns {string} "" when there is no prior conversation to frame
+ */
+export function conversationFrame({
+  item = {},
+  agentName = "",
+  recipientClass = "internal",
+  history = "",
+  threadContext = "",
+} = {}) {
+  const transcript = [s(history), s(threadContext)].filter(Boolean).join("\n");
+  if (!transcript) return "";
+
+  const me = s(agentName);
+  const meKey = me.toLowerCase();
+  // The transcript handed in has usually already been through markOwnTurns, so
+  // the agent's own label reads "<Name> (you)". Compare on the bare name or the
+  // seat lands in its own list of "others who have spoken here".
+  const all = parseSpeakers(transcript).map((n) => ({ name: n, key: stripOwnMarker(n).toLowerCase() }));
+  const speakers = all.filter((x) => x.key !== meKey).map((x) => stripOwnMarker(x.name));
+  const iHaveSpoken = meKey !== "" && all.some((x) => x.key === meKey);
+
+  const internal = recipientClass !== "external";
+  const who = internal
+    ? "The people in it are colleagues in your own organisation. They know who you are"
+    : "The people in it are already in correspondence with you";
+
+  const lines = [];
+  lines.push("## This conversation");
+  lines.push("");
+  lines.push(
+    `You are already part of this exchange — it is ${surfaceLabel(item)}, in progress. ${who}; they do not need to be told, and nobody has asked.`,
+  );
+  if (speakers.length > 0) {
+    lines.push(
+      `Others who have spoken here: ${speakers.slice(0, 8).join(", ")}${speakers.length > 8 ? ", and others" : ""}.`,
+    );
+  }
+  if (iHaveSpoken) {
+    lines.push(`Lines marked "(you)" below are your OWN earlier turns — you are continuing them, including when you are correcting one.`);
+  }
+  lines.push(
+    "Write the next turn and nothing else: no greeting, no preamble, no self-introduction, no statement of your role, your reporting line or what you are. Pick up where the thread left off.",
+  );
+
+  return lines.join("\n");
+}
+
+export const _test = { SPEAKER_LINE, surfaceLabel, ORG_PLANE_SERVICES };

package/lib/org/inbound/directedness.mjs

@@ -480,7 +480,11 @@ function yes(surface, reason, extra = {}) {
  * @param {import("./facts.mjs").Facts} facts
  * @param {{enabled?: Record<string,boolean>, meAliases?: string[]}} [opts]
  *   `meAliases` — additional identity strings for this seat (slug, member id,
- *   agent email). Used ONLY to widen own-echo suppression; never to widen reach.
+ *   agent email). Widens own-echo suppression AND, as of TD-001, is also
+ *   load-bearing for reach: branch (5) matches a structured mentions[] row
+ *   against this same alias set, not against bare `me`, so a seat called with
+ *   its slug still resolves a mentions[] row keyed by CUID. A caller that
+ *   omits meAliases here loses that match, not just echo suppression.
  * @returns {{directed:boolean, surface:string|null, reason:string, why:string}}
  */
 export function resolveDirected(cand, me, facts = {}, opts = {}) {
@@ -535,7 +539,7 @@ export function resolveDirected(cand, me, facts = {}, opts = {}) {
 
   switch (cand.family) {
     case "messaging":
-      return resolveMessaging(cand, meId, facts, on);
+      return resolveMessaging(cand, meId, facts, on, meAliases);
     case "calling":
       return resolveCalling(cand, meId, facts, on);
     case "board":
@@ -603,7 +607,7 @@ function resolveCalendar(cand, me, facts, on) {
  *   6. thread root I have spoken in / been named in → `thread_reply`
  *   7. otherwise                            → ambient chatter, not directed
  */
-function resolveMessaging(cand, me, facts, on) {
+function resolveMessaging(cand, me, facts, on, meAliases) {
   const channelId = cand.ids.channelId;
   const visible = asSet(facts.visibleChannelIds);
   const members = asSet(facts.memberChannelIds);
@@ -656,8 +660,20 @@ function resolveMessaging(cand, me, facts, on) {
 
   // (5) An explicit @mention of my member id. The mention list is NOT in the
   //     chain payload; it comes from `messaging.history`, which hq ACLs to rooms
-  //     I may read.
-  if (msg && Array.isArray(msg.mentions) && me && msg.mentions.map(String).includes(me)) {
+  //     I may read. mentions[] holds member CUIDs, but the caller cannot always
+  //     know which namespace it handed us as `me` (slug vs cuid) — so match the
+  //     row against the SAME alias set the own-echo drop uses, not bare `me`.
+  //     Otherwise a seat called with its slug never matches a CUID mention row,
+  //     and the prose fallback below (now gated on an empty mentions[]) is the
+  //     only remaining catch — which the gate removes. Fall back to bare `me`
+  //     if no alias set was threaded through.
+  const mentionRow = msg && Array.isArray(msg.mentions) ? msg.mentions : null;
+  const mentionsMe =
+    mentionRow &&
+    (meAliases instanceof Set
+      ? mentionRow.some((m) => meAliases.has(String(m).trim()))
+      : me && mentionRow.map(String).includes(me));
+  if (mentionsMe) {
     return on("mention") ? yes("mention", "mention") : no("surface_disabled");
   }
 
@@ -670,8 +686,12 @@ function resolveMessaging(cand, me, facts, on) {
 
   // A mention by DISPLAY NAME, when the org has no structured mention row (an
   // agent addressed as "@Isla" in prose). Only ever consulted for a space I can
-  // already read, and only when the caller supplied its own names.
-  if (msg && matchesMyName(facts, msg.body ?? msg.text)) {
+  // already read, only when the caller supplied its own names, and — per
+  // matchesMyName's own contract — only as a LAST RESORT: a populated
+  // mentions[] row means hq already told us who this was for, and prose
+  // naming someone else in the same breath must not override that.
+  const hasStructuredMentions = msg && Array.isArray(msg.mentions) && msg.mentions.length > 0;
+  if (msg && !hasStructuredMentions && matchesMyName(facts, msg.body ?? msg.text)) {
     return on("mention") ? yes("mention", "named") : no("surface_disabled");
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cohortapp/agent-sdk",
-  "version": "2.18.12",
+  "version": "2.18.13",
   "description": "Cohort Agent SDK — autonomous AI colleague runtime. Deploy senior AI colleagues on dedicated Mac minis, wired to the Cohort operating surface.",
   "type": "module",
   "bin": {

package/plugins/maestro-skills/skills/persona-discipline.md

@@ -37,11 +37,33 @@ actor is needed, it is a person-shaped one: team, colleague, analyst.
 
 ## Being straight about what you are
 
+**Never open a message by announcing what you are.** No standing identity
+line in any shape: nothing that pairs your name with your own nature, nothing
+that pairs it with the person you work for, no throat-clearing preamble whose
+only job is to flag what you are before you say anything. Not on your first
+post in a channel, not mid-thread, not on a correction to your own figures.
+Cohort marks every AI member on every surface it has: the member row, the
+directory, the mailbox list, the message header. A colleague reading you has
+already seen it. The sentence tells them nothing new and reads as you
+disclaiming your own work before you have said anything.
+
+The renderings of that line live in `policies/ai-disclosure.yaml` as
+`channels.<c>.identity_line`, scoped to an external first contact. They are
+deliberately not reproduced here, or anywhere else in this tree: a banned
+string quoted as an example is how the next author reads it in good faith and
+writes it back into the product. This file is loaded into a live session's
+context, so it is one of the places that would happen from.
+
 If someone sincerely asks whether they are dealing with an AI, say yes,
 plainly, once, and carry on. That is an honest answer to a direct question,
 not a disclaimer to attach to your work, and it does not license naming the
-machinery. `policies/ai-disclosure.yaml` says where proactive disclosure is
-required.
+machinery. The two rules are one rule: **honest when asked, silent when not.**
+
+Proactive disclosure is owed in exactly one place — an EXTERNAL first contact
+— and it is not yours to decide. `policies/ai-disclosure.yaml` scopes it
+(`posture.internal_recipients_exempt`, `channels.<c>.identity_scope`) and the
+send-gate applies it. Inside your own workspace the duty does not arise, so
+volunteering the line there is not caution; it is noise.
 
 ## When the send gate blocks you
 

package/scripts/ci/run-tests.mjs

@@ -75,7 +75,17 @@ function main(argv) {
   }
 
   if (argv.includes("--list")) {
-    for (const f of files) console.log(relative(REPO_ROOT, f));
+    // ONE write, not one per file. `console.log` to a PIPE is asynchronous, and
+    // the caller below used to `process.exit()` the moment main() returned —
+    // which discards whatever has not drained yet. It only shows up under load:
+    // run-tests.test.mjs#"--list prints the discovered set" spawns this with a
+    // pipe from INSIDE the full suite, where a machine running `node --test`
+    // across every core does not drain it in time, and the child exited 0
+    // having printed a list truncated mid-alphabet. A green run and a silently
+    // short inventory is exactly the failure this module exists to prevent —
+    // see the header — so it is fixed on both halves: one write here, and
+    // `process.exitCode` rather than `process.exit()` at the bottom.
+    process.stdout.write(files.map((f) => relative(REPO_ROOT, f)).join("\n") + "\n");
     console.error(`run-tests: ${files.length} test file(s) discovered (nothing was run).`);
     return 0;
   }
@@ -95,5 +105,9 @@ function main(argv) {
 }
 
 if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  process.exit(main(process.argv.slice(2)));
+  // `process.exitCode`, NOT `process.exit()`: the latter tears the process down
+  // immediately and drops any stdout still queued on a pipe. Node exits with
+  // this code on its own once the event loop drains, which is the only way a
+  // piped `--list` is guaranteed to arrive whole.
+  process.exitCode = main(process.argv.slice(2));
 }

package/scripts/daemon/context-compiler.mjs

@@ -17,6 +17,7 @@ import { join } from "path";
 import { isEnabled as orgEnabled, loadOrgConfig } from "../../lib/org/client.mjs";
 import { recall as orgRecall } from "../../lib/org/knowledge.mjs";
 import { isPrivateConversation, historyDirNames } from "../../lib/context/history-scope.mjs";
+import { stripDisclosureInstructionsAndWarn } from "../../lib/identity/disclosure-instructions.mjs";
 import { fitSections } from "../../lib/context/budget.mjs";
 import { currentWorkBlock, audienceForItem } from "../../lib/session/current-work.mjs";
 
@@ -590,9 +591,16 @@ export async function compileContext(item, classResult, options = {}) {
     sections.push("--- COMPILED CONTEXT (do not repeat verbatim) ---");
     sections.push("");
 
+    // The sender profile is SEAT-AUTHORED prose (memory/profiles/users/*.yaml),
+    // not inbound data, and it lands in a context block the model reads as
+    // guidance. A profile line ordering a self-introduction would defeat the
+    // rest of the fix for exactly one correspondent — the hardest version of
+    // the bug to reproduce — and the repo cannot see the file. Filtered like
+    // the CLAUDE.md scrape; the transcript below is deliberately NOT filtered,
+    // because it is a record of what people said, not an instruction.
     if (profileText) {
       sections.push("## Sender Profile");
-      sections.push(profileText);
+      sections.push(stripDisclosureInstructionsAndWarn(profileText, "memory/profiles/users/*.yaml"));
       sections.push("");
     }