@cohortapp/agent-sdk 2.18.12 → 2.18.13

package/scripts/daemon/responder.mjs

@@ -74,9 +74,53 @@ import { generateAck } from "./assurance.mjs";
 // must be large; attach genuinely verbose content rather than dumping it). The
 // SAME constant leads the full-session prompt in prompt-builder.mjs, so a reactive
 // quick reply and a full inbox/backlog session shape outbound prose identically.
-// This path never renders the persona block, which is why the doctrine is a
-// separately-exported constant rather than part of voiceRules().
-import { MESSAGE_CRAFT } from "../../lib/identity/persona.mjs";
+// This path renders the seat persona through renderSeatPersona() rather than
+// the full voiceRules() block, which is why the doctrine is a separately-
+// exported constant rather than part of voiceRules().
+//
+// SELF_PRESENTATION travels with it, and for a sharper reason. The preamble this
+// path loads is scraped out of the SEAT's CLAUDE.md — a file `maestro upgrade`
+// deliberately never touches, so a seat scaffolded before the "How you write and
+// carry yourself" section existed gets NO instruction about self-presentation on
+// this plane at all. A model with no such instruction falls back to the
+// generic-assistant register it ships with, which is how quick replies came to
+// open with a rendering of the `identity_line` template in
+// policies/ai-disclosure.yaml inside the organisation's own channels — a line
+// owed to an external first contact and to nobody else. Shipping the rules from
+// the repo is what lets the fix reach a seat through `maestro upgrade`, once
+// this is released — nothing here changes a seat that is still on an older SDK.
+//
+// Adding the rule is only half of it. The preamble below is SEAT-LOCAL PROSE,
+// and some seats were hand-edited to carry the opener as a standing rule back
+// when the send gate demanded it. A counter-instruction does not delete a
+// contradiction, and the seat's copy arrives first, so the scrub strips the
+// stale instruction out of the scraped text before the model ever sees it. The
+// truthfulness invariant is exempt from the scrub by construction — see
+// lib/identity/disclosure-scrub.mjs.
+import { MESSAGE_CRAFT, SELF_PRESENTATION, renderSeatPersona } from "../../lib/identity/persona.mjs";
+import { scrubSeatText } from "../../lib/identity/disclosure-scrub.mjs";
+// The CLAUDE.md preamble helpers — one definition, shared with prompt-builder.
+import {
+  scrapeClaudeMdSections as _scrape,
+  stripScaffoldSentinels as _stripSentinels,
+  preambleTargets,
+} from "../../lib/identity/claude-md.mjs";
+// A seat CLAUDE.md line ordering a self-introduction reaches this prompt and the
+// repo cannot see it. The check therefore runs at RUNTIME over the composed
+// preamble — see lib/identity/disclosure-instructions.mjs.
+import { stripDisclosureInstructionsAndWarn } from "../../lib/identity/disclosure-instructions.mjs";
+// The conversation frame. A reply into a live thread used to arrive as a bare
+// transcript with no statement that the agent is IN it — see
+// lib/org/inbound/conversation-frame.mjs for the rendered prompt that proved it.
+import {
+  conversationFrame,
+  dedupeThreadAgainstHistory,
+  frameRecipientClass,
+  markOwnTurns,
+} from "../../lib/org/inbound/conversation-frame.mjs";
+// Internal vs external, by the SAME predicate the send gate uses, so the frame
+// and the gate can never disagree about who the agent is talking to.
+import { classifyRecipient } from "../../lib/comms/send-gate.mjs";
 // A human's roll-call to the whole room. The reply-shaping block (≤ 5 lines,
 // about myself only, no @mentions, no ack) lives with the vocabulary in
 // broadcast.mjs so the session path (prompt-builder) says the same thing this
@@ -561,28 +605,95 @@ function logInteraction(item, responseText, o = {}) {
 // Identity preamble (cached)
 // ---------------------------------------------------------------------------
 
+// The CLAUDE.md scrape and the scaffold-sentinel strip live in
+// lib/identity/claude-md.mjs. They used to be defined HERE, which is how the
+// full-session plane (prompt-builder.mjs) kept its own unfixed copy of the same
+// scrape: one plane got the fix, the other did not, and the other is the tier a
+// substantive reply escalates to. Re-exported for the tests that render this
+// plane, so there is one definition and two callers.
+export { scrapeClaudeMdSections, stripScaffoldSentinels } from "../../lib/identity/claude-md.mjs";
+
+/**
+ * The quick reply's identity + house-style preamble.
+ *
+ * IDENTITY COMES FROM config/agent.json, NOT FROM CLAUDE.md.
+ *
+ * This used to scrape `## Identity` out of the seat's CLAUDE.md and hand it to
+ * the model as-is. On every seat in the fleet that section is the scaffold
+ * template — `You are ` + "`{{agent.fullName}}`, `{{agent.title}}` at" +
+ * " `{{agent.company}}`…" — followed by "If those tokens are still unresolved,
+ * your identity has not been configured yet — run `maestro setup`". Nothing
+ * substitutes those tokens on this path: the responder is a `claude --print`
+ * call that is never shown config/agent.json. So EVERY reactive reply the fleet
+ * sent opened with an identity block that named nobody and then told the model
+ * its identity was unconfigured — which lib/identity/persona.mjs documents, in
+ * its own header, as the exact condition that makes an agent introduce and sign
+ * itself with a rendering of the policy's identity_line.
+ *
+ * `renderSeatPersona` is the renderer the FULL-SESSION path has used since that
+ * header was written. It resolves the real name, title, company, standing and
+ * reporting line from config/agent.json, and it carries `voiceRules()` —
+ * including "Do not introduce, describe or sign yourself as an assistant, a bot,
+ * an AI helper, or as 'working on behalf of' someone" AND the untouched
+ * truthfulness invariant. Using it here is what puts the two planes on one
+ * identity instead of one resolved and one template.
+ *
+ * The CLAUDE.md scrape is kept for the house-style sections the persona block
+ * does not cover, with `## Identity` DROPPED whenever the persona rendered —
+ * two identity blocks, one of them unresolved, is worse than either alone. It is
+ * RESTORED when nothing rendered, because a prompt that says "run maestro setup"
+ * is the honest rendering of a seat nobody has set up
+ * (lib/identity/claude-md.mjs#preambleTargets; pinned by
+ * responder-unconfigured-seat.test.mjs).
+ *
+ * AND THE SCRAPE IS FILTERED. It is seat-authored prose, and a seat file saying
+ * "On first message in any thread, introduce yourself as <the identity_line>."
+ * reaches this prompt verbatim, survives every upgrade,
+ * and defeats everything above — while being invisible from this repo, so no
+ * test that renders the scaffold can catch it. The check therefore runs at
+ * RUNTIME on the text about to go to the model, and warns once per line naming
+ * the file to edit (lib/identity/disclosure-instructions.mjs). It is narrow on
+ * purpose and keeps a line that FORBIDS the behaviour; the truthfulness
+ * invariant is untouched.
+ */
 function loadPreamble() {
   if (cachedPreamble) return cachedPreamble;
+  const persona = renderSeatPersona(AGENT_REPO_DIR);
+  const claudeMd = join(AGENT_REPO_DIR, "CLAUDE.md");
+  let scraped = "";
   try {
-    const raw = readFileSync(join(AGENT_REPO_DIR, "CLAUDE.md"), "utf-8");
-    // Extract just the identity and communication rules
-    const lines = raw.split("\n");
-    const sections = [];
-    let capturing = false;
-    const targets = ["## Identity", "## Company Context", "## Communication Rules"];
-    for (const line of lines) {
-      if (targets.some((h) => line.startsWith(h))) { capturing = true; sections.push(line); continue; }
-      if (capturing && /^## [A-Z]/.test(line) && !targets.some((h) => line.startsWith(h))) { capturing = false; continue; }
-      if (capturing) sections.push(line);
-    }
-    cachedPreamble = sections.join("\n").trim();
-    if (cachedPreamble.length < 100) cachedPreamble = FALLBACK_PREAMBLE;
+    const raw = readFileSync(claudeMd, "utf-8");
+    const targets = preambleTargets(Boolean(persona), ["## Company Context", "## Communication Rules"]);
+    scraped = _stripSentinels(_scrape(raw, targets));
   } catch {
-    cachedPreamble = FALLBACK_PREAMBLE;
+    scraped = "";
   }
+  // The seat file is the one input this repo cannot see. A line in it ordering a
+  // self-introduction survives every upgrade and defeats everything above, so it
+  // is dropped here, on the text about to go to the model, and warned about.
+  scraped = stripDisclosureInstructionsAndWarn(scraped, claudeMd).trim();
+  // Scrubbed as ONE string, and deliberately including the persona: the persona
+  // is rendered from config/agent.json, which is seat-local too, so a
+  // disclosure sentence stuffed into `persona`/`background`/`bio` renders into
+  // this prompt exactly as a CLAUDE.md line would. Scrubbing the composed text
+  // covers both seat inputs with one pass — and it happens BEFORE the length
+  // floor below, so a seat whose identity section is mostly a disclosure
+  // instruction falls through to the framework fallback rather than shipping a
+  // two-line stump. The truthfulness invariant is exempt by construction; see
+  // lib/identity/disclosure-scrub.mjs.
+  const composed = scrubSeatText([persona, scraped].filter(Boolean).join("\n\n").trim());
+  // The floor applies to the WHOLE preamble, not to the scrape alone: a seat
+  // with a resolved persona and an empty CLAUDE.md is configured, and must not
+  // be thrown back to the fallback that knows none of it.
+  cachedPreamble = composed.length < 100 ? FALLBACK_PREAMBLE : composed;
   return cachedPreamble;
 }
 
+/** For tests: drop the cached preamble so a fresh seat dir is re-read. */
+export function _resetPreambleCache() {
+  cachedPreamble = null;
+}
+
 function buildFallbackPreamble() {
   const a = loadAgent();
   const principalName = a.principal?.fullName || "the principal";
@@ -597,11 +708,34 @@ const FALLBACK_PREAMBLE = buildFallbackPreamble();
 // Load user profile for context
 // ---------------------------------------------------------------------------
 
+/**
+ * The seat's own notes about a sender, injected into the SYSTEM prompt.
+ *
+ * Filtered like the CLAUDE.md scrape, and for the same reason: this is
+ * seat-authored prose in an instruction position, written on the seat's own
+ * disk where the repo cannot see it. A profile saying "introduce yourself as an
+ * AI assistant when writing to this person" would defeat every other half of
+ * the fix for exactly one correspondent — the hardest version of the bug to
+ * reproduce. See lib/identity/disclosure-instructions.mjs.
+ *
+ * @param {string} sender
+ * @returns {string|null}
+ */
 function loadUserProfile(sender) {
   try {
     const profileName = sender.replace(/\s+/g, "-").toLowerCase();
     const path = join(AGENT_REPO_DIR, "memory", "profiles", "users", `${profileName}.yaml`);
-    return readFileSync(path, "utf-8");
+    // Both filters, for the same reason the CLAUDE.md preamble gets both: these
+    // files are seat-local, written by the agent itself over months, and land in
+    // the system prompt under a "Sender profile:" heading — i.e. as instruction,
+    // not as quoted data. `scrubSeatText` removes a rendered identity TEMPLATE;
+    // `stripDisclosureInstructionsAndWarn` removes an INSTRUCTION to open with
+    // one and names the file on stderr. A profile that recorded "always
+    // introduces itself to this person as an AI assistant" would otherwise
+    // re-arm the behaviour for that one sender — the hardest version of this
+    // bug to reproduce — no matter what the framework rules say.
+    const raw = readFileSync(path, "utf-8");
+    return stripDisclosureInstructionsAndWarn(scrubSeatText(raw), path) || null;
   } catch {
     return null;
   }
@@ -844,23 +978,65 @@ export async function loadCurrentWork(item, deps = {}) {
  * persona needs: describe it as your own work, and never quote a session name
  * or id (they are internal — `session_status` says the same).
  */
-export function buildQuickReplyUserContent({ item = {}, classResult = {}, conversationHistory = null, currentWork = "", rollCall = false } = {}) {
+export function buildQuickReplyUserContent({
+  item = {},
+  classResult = {},
+  conversationHistory = null,
+  currentWork = "",
+  rollCall = false,
+  agentName = "",
+  recipientClass = "internal",
+} = {}) {
+  // A roll-call's thread context is the room's other answers — not evidence
+  // about this seat, and exactly what the reply must not summarise.
+  const rawThread = !rollCall && item.thread_context ? String(item.thread_context) : "";
+  // The two transcripts overlapped almost completely on a mid-thread channel
+  // reply: the same turns arrived twice, worth up to COHORT_HISTORY_LIMIT ×
+  // COHORT_HISTORY_CHARS, and read as two different records of one exchange.
+  const thread = dedupeThreadAgainstHistory(conversationHistory, rawThread);
+  const history = markOwnTurns(conversationHistory || "", agentName);
+  const threadMarked = markOwnTurns(thread, agentName);
+
+  // The frame is what tells the model it is CONTINUING something. Spent only
+  // when there is a conversation to frame, and paid for by the dedupe above.
+  const frame = conversationFrame({
+    item,
+    agentName,
+    recipientClass,
+    history,
+    threadContext: threadMarked,
+  });
+
   return [
+    frame || null,
+    frame ? "" : null,
     `From: ${item.sender} (${item.sender_privilege || "unknown"})`,
     `Via: ${item.service} / ${item.channel}`,
     item.subject ? `Subject: ${item.subject}` : null,
-    conversationHistory ? `\nRecent conversation history:\n${conversationHistory}` : null,
+    history ? `\nRecent conversation history:\n${history}` : null,
     currentWork
       ? `\n${currentWork}\n(If asked what you are doing, answer from the lines above — as your own work, in your own words, board item ids included where a person could look one up. Never quote session names or ids.)`
       : null,
     `\nCurrent message:\n${item.content || "(empty)"}`,
-    // A roll-call's thread context is the room's other answers — not evidence
-    // about this seat, and exactly what the reply must not summarise.
-    !rollCall && item.thread_context ? `\nThread context:\n${item.thread_context}` : null,
+    threadMarked ? `\nEarlier in this thread:\n${threadMarked}` : null,
     `\nClassification: ${classResult.summary}`,
-  ].filter(Boolean).join("\n");
+  ].filter((l) => l !== null).join("\n");
 }
 
+/**
+ * Says, in the prompt, what the assembly order already implies: everything above
+ * this point on this plane is SEAT-LOCAL (the seat's CLAUDE.md sections and the
+ * per-sender profile), and the framework rules below outrank it.
+ *
+ * lib/identity/disclosure-scrub already removes the one seat-local instruction
+ * known to have caused harm. This sentence covers the variants the scrub's shape
+ * rule does not recognise: a model that is handed two conflicting instructions
+ * and no ordering between them resolves the conflict by position, and the seat's
+ * copy is first.
+ */
+const SEAT_TEXT_PRECEDENCE =
+  "The sections above are this seat's own local notes. The rules that follow are the framework's, they apply to every member of this organisation, and where the two conflict the rules below win.";
+
 /**
  * The real, CLI-backed answer generator. `deps` are test seams only —
  * `{runCLI, currentWorkBlock, forbidsTextFor, loadConversationHistory}` — so
@@ -877,14 +1053,19 @@ export async function realGenerateResponse(item, classResult, deps = {}) {
 
   const systemPrompt = `${preamble}
 
-You are generating a direct response to this message. Be concise and actionable.
+You are writing the next turn in a conversation you are already part of. Be concise and actionable.
 If it's a question, answer it. If it's a request, confirm and describe what you'll do or have done.
 If it's informational, acknowledge appropriately.
+Open with the substance. Do not greet, do not introduce or describe yourself, and do not restate your role, your reporting line or what you are — the people you are writing to already know, and none of them asked.
 
 Keep responses focused — 1-4 sentences for simple items, up to a short paragraph for more nuanced ones.
 Match the sender's tone and urgency level.
 ${profile ? `\nSender profile:\n${profile}` : ""}
 ${rollCall ? `\n${collectiveInstructions({ intent: itemCollectiveIntent(item, isRollCallItem), respondents: item.respondents })}\n` : ""}
+${SEAT_TEXT_PRECEDENCE}
+
+${SELF_PRESENTATION}
+
 ${MESSAGE_CRAFT}`;
 
   // A roll-call is answered from what this seat KNOWS about itself — its main
@@ -897,7 +1078,26 @@ ${MESSAGE_CRAFT}`;
   const conversationHistory = rollCall ? null : await (deps.loadConversationHistory || loadConversationHistory)(item);
   const currentWork = await loadCurrentWork(item, deps);
 
-  const userContent = buildQuickReplyUserContent({ item, classResult, conversationHistory, currentWork, rollCall });
+  // The seat's own name, so its prior turns in the transcript can be marked as
+  // ITS OWN. Without it the model reads lines it authored as a third party's,
+  // which is a conversation it has not joined — and a model joining a
+  // conversation cold introduces itself.
+  const agentName = (() => {
+    const a = loadAgent();
+    const n = (a.fullName || "").trim();
+    if (n && !/^unconfigured\b/i.test(n)) return n;
+    const f = (a.firstName || "").trim();
+    return f && !/^unconfigured\b/i.test(f) ? f : "";
+  })();
+  // Origin first, then the send gate's own predicate — see
+  // conversation-frame.mjs#frameRecipientClass for why a bare
+  // `classifyRecipient(service, channel_id || channel)` put colleagues in the
+  // agent's own #risk-compliance channel on the "external" branch, silently.
+  const recipientClass = frameRecipientClass(item, classifyRecipient);
+
+  const userContent = buildQuickReplyUserContent({
+    item, classResult, conversationHistory, currentWork, rollCall, agentName, recipientClass,
+  });
 
   // (b2) Session-router decision. Compute the routing key from a daemon→router
   // adapter view of the item. If the item can't be keyed (unknown service,