@cohortapp/agent-sdk 2.18.13 → 2.18.15

package/scripts/daemon/agent-daemon.mjs

@@ -67,6 +67,7 @@ import { classifyItem, isDirectedAtAgent } from "./classifier.mjs";
 // gets a deterministic classification (no LLM triage), no holding ack, and a
 // per-seat jitter so thirteen answers do not land in the same second.
 import { isRollCallItem, rollCallJitterMs } from "../../lib/org/inbound/broadcast.mjs";
+import { stampFirstReplyPlan } from "../../lib/assurance/first-reply.mjs";
 import { isRoomSurface } from "../../lib/org/inbound/surfaces.mjs";
 import { isMembershipReason } from "../../lib/org/inbound/directedness.mjs";
 import { cohortSurfaceOf, cohortSurfaceLabel, cohortSurfaceIsDeclared } from "./deliver.mjs";
@@ -96,7 +97,7 @@ import {
   isPidAlive,
 } from "./assurance.mjs";
 import { recordPoll, recordClassification, recordSession, writeHealthDashboard } from "./health.mjs";
-import { acquireLock, releaseLock, updateLock, scanStaleLocks, acquireThreadLock, claimRequest, hasActiveClaim, sweepStaleItemClaims, sanitiseItemId } from "./session-lock.mjs";
+import { acquireLock, releaseLock, updateLock, scanStaleLocks, acquireThreadLock, threadLockKey, claimRequest, hasActiveClaim, sweepStaleItemClaims, sanitiseItemId } from "./session-lock.mjs";
 import { markDeferred } from "./inbox-deferral.mjs";
 import { parseQueueItems, rankBacklog, resolveBacklogWeights } from "../../lib/backlog.mjs";
 import { readLatestGaps } from "../../lib/goals/gaps.mjs";
@@ -322,10 +323,23 @@ async function reviveFrontDoorIfShut(state, deps = {}) {
   return verdict;
 }
 
-async function pollService(svc) {
+/**
+ * Drain one service's inbox: poll, dedup, stamp the flurry plan, process.
+ *
+ * @param {{name:string, fn:Function}} svc
+ * @param {object} [deps] TEST-ONLY seams; PRODUCTION PASSES NOTHING, so the
+ *   defaults are the real collaborators and behaviour is byte-identical. The
+ *   same idiom as `processItem`/`sweepBacklog` above. Exported (and seamed) so
+ *   the ONE-FIRST-REPLY-PER-FLURRY stamping has a test that fails when the call
+ *   is removed — see `notice-emission.test.mjs`.
+ *   @param {object} [deps.frontDoorGate] override the front-door gate
+ *   @param {Function} [deps.processItem] override processItem
+ */
+export async function pollService(svc, deps = {}) {
+  const processItemImpl = deps.processItem || processItem;
   try {
     // Front door: a live main session owns this service's inbox — leave it.
-    const fd = _frontDoorGate.check(svc.name);
+    const fd = (deps.frontDoorGate || _frontDoorGate).check(svc.name);
     if (fd.changed) console.log(`[daemon] front door for ${svc.name}: ${fd.dispatch ? "daemon dispatches" : "main session owns intake"} (${fd.reason})`);
     if (!fd.dispatch) return 0;
     const result = await svc.fn();
@@ -358,8 +372,33 @@ async function pollService(svc) {
       return lock.acquired;
     });
 
+    // ── ONE FIRST REPLY PER FLURRY ───────────────────────────────────────
+    // "If there's a flurry of 4 messages in one go by others, instead of having
+    // a generic reply per message, it would be responding to the batch of
+    // messages." (owner, 2026-09-25.) The batch is computed HERE, over the whole
+    // poll, because this is the only place that sees more than one item at a
+    // time — `processItem` is called per item and structurally cannot know it is
+    // the third of four. Every non-leader carries `covered_by_batch`, which
+    // `assurance.shouldAcknowledge` turns into `ack:false` and the daemon makes
+    // durable as `interimForbidden`, so no later sweep in any process speaks for
+    // it either. The leader is told how many it stands for, so the one line it
+    // writes can answer all of them.
+    //
+    // WORK IS UNAFFECTED. Every item still gets its own `processItem`, its own
+    // obligation and its own answer; what is batched is only the FIRST thing
+    // said. Silence about timing is not silence about outcome.
+    //
+    // The stamping itself is `assurance/first-reply.stampFirstReplyPlan`, not
+    // four lines here, because four lines here had NO TEST THAT COULD SEE THEM:
+    // the only call site was inside this module-internal function, so deleting
+    // them left the whole suite green — including a test named "wired, not just
+    // available". `first-reply.test.mjs` now exercises the stamp and
+    // `notice-emission.test.mjs` drives THIS function through `pollService`'s
+    // injected seams, so removing the call is red in both.
+    stampFirstReplyPlan(newItems);
+
     for (const item of newItems) {
-      await processItem(item, svc.name);
+      await processItemImpl(item, svc.name);
     }
 
     if (result.errors.length > 0) {
@@ -1107,7 +1146,38 @@ export async function answerItem(item, service, itemId, trace_id, deps = {}, rou
     // This check runs BEFORE quick reply to prevent ALL duplicate responses.
     {
       const channel = item.channel_id || (item.raw_ref ? item.raw_ref.match(/slack:([^:]+):/)?.[1] : null) || item.channel;
-      const threadTs = item.thread_id || (isDm ? `dm-channel` : null);
+      // THE UNTREADED CHANNEL POST USED TO TAKE NO LOCK AT ALL.
+      //
+      // `item.thread_id || (isDm ? "dm-channel" : null)` is null for exactly
+      // one shape: a message posted to the main surface of a channel or group,
+      // not in a thread, not a DM. That is the shape the owner screenshotted —
+      // a flurry of messages into a room — and it was the one shape with no
+      // dedup: each message cleared this block, spawned its own session, and
+      // opened its own obligation, so the room got N sessions and N chances at
+      // a holding line for one conversation.
+      //
+      // `channel-main` is the DM lock's counterpart for that surface: one
+      // session at a time on a room's main feed, the rest deferred and
+      // promoted at session close exactly like a DM burst.
+      //
+      // THIS IS ONLY SAFE BECAUSE OF THE BUNDLING FIX BESIDE IT. Deferral ends
+      // in `promoteDeferred`, which collapses a group to its latest member and
+      // marks the rest `.processed-bundled`. On a shared channel the deferred
+      // set is several PEOPLE, not one person's flurry, so an unconditional
+      // collapse here would silently bin a colleague's question — which is why
+      // inbox-deferral.mjs now splits a group by sender unless the winner
+      // actually carries the room's history. Widening this lock without that
+      // change would trade a message storm for lost messages.
+      //
+      // The off-switch is real and deliberate: MAESTRO_CHANNEL_MAIN_LOCK=0
+      // restores the previous behaviour on a seat without a code change, in
+      // the same style as every other threshold in the assurance stack.
+      const threadTs = threadLockKey({
+        channel,
+        threadId: item.thread_id,
+        isDm,
+        channelMainLock: String(process.env.MAESTRO_CHANNEL_MAIN_LOCK ?? "1") !== "0",
+      });
       if (threadTs && channel) {
         const threadCheck = acquireThreadLock(channel, threadTs);
         if (!threadCheck.allowed) {