@cohortapp/agent-sdk 2.18.14 → 2.18.16

package/scripts/daemon/deliver.mjs

@@ -35,6 +35,7 @@ import { recordOutbound } from "../../lib/comms/receipts.mjs";
 // inbound projection stamps into `raw_ref`. Imported rather than re-listed so a
 // new surface cannot be added upstream without this file's switch noticing.
 import { ROOM_SURFACES, SURFACE_NAMES } from "../../lib/org/inbound/surfaces.mjs";
+import { isRetiredFirstReply } from "../../lib/assurance/first-reply.mjs";
 
 const AGENT_REPO_DIR = process.env.AGENT_DIR || join(new URL(".", import.meta.url).pathname, "../..");
 
@@ -741,11 +742,117 @@ export function scaffoldMarkerLeak(text) {
  *          escalate rather than lose the message to an exception. `permanent`
  *          means retrying cannot help (no route, or a NOT_FOUND/BAD_REQUEST).
  */
+/**
+ * Can this inbound be answered with a REACTION rather than a sentence?
+ *
+ * Only a Cohort message in a real room can: a reaction is attached to a message
+ * id in a channel, and that is the one surface where both exist. A board
+ * comment, a doc comment, an email and a Slack item all answer `false` here
+ * even where the underlying product has reactions, because this daemon has no
+ * route to them — and a shape decision that promises a reaction the transport
+ * cannot make would turn "acknowledge cheaply" into "say nothing at all".
+ *
+ * @param {object} item
+ * @returns {boolean}
+ */
+export function canReactTo(item) {
+  if (!item || item.service !== "cohort") return false;
+  const route = cohortReplyRoute(item);
+  if (route.transport !== "channel") return false;
+  return Boolean(str(item.message_id));
+}
+
+/**
+ * Put a reaction on the message that arrived.
+ *
+ * The cheapest honest acknowledgement there is: it tells the sender their
+ * message reached a person, and it adds no row to the channel. That second
+ * property is the whole argument for it — the measured flood
+ * (`lib/assurance/tier.mjs`) was 3,069 acknowledgement ROWS, and a reaction is
+ * an acknowledgement that is not a row.
+ *
+ * Fail-open and quiet: a reaction that cannot be made is not an error worth
+ * escalating, it is a reason to write the line instead, and the caller treats
+ * `{sent:false}` exactly that way.
+ *
+ * @param {object} item
+ * @param {string} emoji
+ * @param {object} [o] {cfg, agentRoot, reactImpl, fetchImpl} test seams
+ * @returns {Promise<{sent:boolean, via:string|null, error?:string}>}
+ */
+export async function deliverReaction(item, emoji, o = {}) {
+  if (!canReactTo(item)) return { sent: false, via: null, error: "no reaction surface" };
+  const e = str(emoji);
+  if (!e) return { sent: false, via: null, error: "no emoji" };
+  try {
+    const route = cohortReplyRoute(item);
+    const agentRoot = o.agentRoot || process.env.AGENT_ROOT || process.env.AGENT_DIR || process.cwd();
+    const cfg = o.cfg || (await import("../../lib/org/client.mjs")).loadOrgConfig(agentRoot);
+    const reactImpl = o.reactImpl || (await import("../../lib/org/messaging.mjs")).reactMessage;
+    const frame = await reactImpl(
+      { channel: route.channelId, messageId: str(item.message_id), emoji: e },
+      { cfg, agentRoot, idempotencyKey: `react-${str(item.message_id)}-${e}`, ...(o.fetchImpl ? { fetchImpl: o.fetchImpl } : {}) },
+    );
+    if (frame && frame.ok) {
+      recordOutbound({ service: "cohort", channel: route.channelId, kind: "reaction", via: "cohort", chars: 0, agentRoot });
+      return { sent: true, via: "cohort" };
+    }
+    return { sent: false, via: null, error: str(frame && frame.error && frame.error.message) || "react failed" };
+  } catch (err) {
+    return { sent: false, via: null, error: (err && err.message) || String(err) };
+  }
+}
+
 export async function deliver(item, text, o = {}) {
   const kind = o.kind || "reply";
   if (!item || !text || !String(text).trim()) {
     return { sent: false, via: null, error: "nothing to deliver" };
   }
+  // ── THE REGISTER, AT THE CHOKEPOINT ──────────────────────────────────────
+  // Every outbound this daemon makes crosses this function — the answer, the
+  // acknowledgement and the assurance sweep alike — which is why the scaffold
+  // check below lives here rather than at three call sites. The retired
+  // placeholder replies get the same treatment, and for a reason the composer
+  // guards cannot cover:
+  //
+  // On 2026-09-25 two seats (Ravi Patel, Daniel Connors) were still emitting
+  // "On it." / "Looking now." / "On it — digging in now." — 251 of them in six
+  // days, the last at 11:28Z that morning — with `clientMsgId` ending `-ack`,
+  // i.e. through this very path, while `AgentStatus.machine.daemon` reported
+  // sdkVersion 2.18.13 and `versionsAgree: true`. The published package at that
+  // version contains none of those strings and `sanitiseAckText` returns null
+  // for all three. The explanation is that the daemon runs
+  // `$AGENT_ROOT/scripts/daemon/maestro-daemon.mjs` — the seat's PRESERVED
+  // LOCAL COPY — and `versionsAgree` compares two npm version numbers, which
+  // says nothing whatever about that tree.
+  //
+  // WHAT THIS GUARD DOES AND DOES NOT REACH — stated exactly, because the first
+  // version of this comment overclaimed it and a reader would have taken the
+  // stale-seat vector for closed.
+  //
+  //   IT DOES     protect every outbound of an UPDATED daemon, at the last point
+  //               before bytes leave the machine, whatever composed the text:
+  //               the answer, the acknowledgement, the assurance sweep, and any
+  //               composer added later that nobody remembers to guard. That is
+  //               the case for putting it here rather than at three call sites.
+  //   IT DOES NOT reach the two seats that were actually emitting these
+  //               sentences. This file is `scripts/daemon/deliver.mjs`, and it
+  //               lives in the very tree those seats have preserved a stale copy
+  //               of — a stale tree ships a stale deliver.mjs alongside its
+  //               stale composer. THE REMEDY FOR THOSE SEATS IS THE ROLLOUT
+  //               (publish, then `scripts/local-triggers/autoupdate.sh` on each
+  //               box, verified by a server-recorded presence.beat rather than
+  //               by `versionsAgree`). Nothing in this file can shorten that.
+  //
+  // The other plane is covered separately: `lib/comms/send-gate.screenOutbound`
+  // and `screenHookPayload` apply the same register to `messaging_send`,
+  // `email_send`, `email_draft_send` and `org_call_share_step`, which is how a
+  // SPAWNED SESSION typing "On it." itself gets refused — that path never
+  // crosses this function.
+  if (isRetiredFirstReply(text)) {
+    try { console.error(`[deliver] refused: retired placeholder reply in outbound body ${JSON.stringify(String(text).slice(0, 120))} — this is a stale composer, not a message (permanent, not retrying)`); } catch { /* */ }
+    return { sent: false, via: null, permanent: true, channel: item && item.channel_id, code: "FORBIDDEN_SCOPE", error: "FORBIDDEN_SCOPE: retired placeholder reply — the first line must be generated from the actual thread, or nothing" };
+  }
   const leak = scaffoldMarkerLeak(text);
   if (leak) {
     const surface = (item && item.channel_id) ? "room" : "unknown";
@@ -827,6 +934,8 @@ export async function deliverWithRetry(item, text, o = {}) {
 export default {
   deliver,
   deliverWithRetry,
+  canReactTo,
+  deliverReaction,
   resolveSlackChannel,
   replyTargetOf,
   canDeliverTo,

package/scripts/daemon/dispatcher.mjs

@@ -6,7 +6,7 @@ import { spawn } from "child_process";
 import { appendFileSync, mkdirSync, writeFileSync, readFileSync, renameSync, existsSync, readdirSync, unlinkSync } from "fs";
 import { randomUUID } from "crypto";
 import { join, dirname } from "path";
-import { releaseLock, releaseThreadLock, releaseRequestClaim, claimItem, releaseItemClaim } from "./session-lock.mjs";
+import { releaseLock, releaseThreadLock, threadLockKey, releaseRequestClaim, claimItem, releaseItemClaim } from "./session-lock.mjs";
 import { promoteDeferred } from "./inbox-deferral.mjs";
 import { recordSession } from "./health.mjs";
 import { startTyping, stopTyping } from "./typing-registry.mjs";
@@ -2020,7 +2020,16 @@ function spawnSession(entry) {
     {
       const channel = item.channel_id || (item.raw_ref ? (item.raw_ref.match(/slack:([^:]+):/) || [])[1] : null) || item.channel;
       if (channel) {
-        releaseThreadLock(channel, item.thread_id);
+        // THE SAME KEY THE DAEMON TOOK. `item.thread_id` alone is not that
+        // key: an untreaded post locks `channel-main` and a Cohort DM locks
+        // `dm-channel`, and neither is derivable from an empty thread id
+        // without the item's own DM verdict. One derivation, both sides.
+        releaseThreadLock(channel, threadLockKey({
+          channel,
+          threadId: item.thread_id,
+          isDm: item.is_dm === true,
+          channelMainLock: String(process.env.MAESTRO_CHANNEL_MAIN_LOCK ?? "1") !== "0",
+        }));
         // Now that the lock is gone, promote any messages that were
         // deferred behind it. Latest-wins: a burst of N messages
         // collapses into ONE re-dispatch carrying the most recent
@@ -2157,7 +2166,16 @@ function spawnSession(entry) {
     {
       const channel = item.channel_id || (item.raw_ref ? (item.raw_ref.match(/slack:([^:]+):/) || [])[1] : null) || item.channel;
       if (channel) {
-        releaseThreadLock(channel, item.thread_id);
+        // THE SAME KEY THE DAEMON TOOK. `item.thread_id` alone is not that
+        // key: an untreaded post locks `channel-main` and a Cohort DM locks
+        // `dm-channel`, and neither is derivable from an empty thread id
+        // without the item's own DM verdict. One derivation, both sides.
+        releaseThreadLock(channel, threadLockKey({
+          channel,
+          threadId: item.thread_id,
+          isDm: item.is_dm === true,
+          channelMainLock: String(process.env.MAESTRO_CHANNEL_MAIN_LOCK ?? "1") !== "0",
+        }));
         const promo = promoteDeferred(channel, AGENT_REPO_DIR);
         if (promo.promoted > 0) {
           logSession({

package/scripts/daemon/inbox-deferral.mjs

@@ -18,11 +18,26 @@
  *     every `.deferred` file in any service inbox dir whose body
  *     references `channel`. If exactly one is found, renames it back
  *     to its original name (next poll picks it up). If N>1 are found,
- *     keeps only the LATEST (by timestamp), promotes that one, and
- *     marks the others `.processed-bundled` for the audit trail —
- *     the latest item's `thread_context` already contains the prior
- *     messages as conversation history, so Claude sees everything
- *     and can compose a single coherent reply.
+ *     keeps only the LATEST (by timestamp) of each BUNDLING GROUP,
+ *     promotes those, and marks the others `.processed-bundled` for
+ *     the audit trail.
+ *
+ *     WHAT A BUNDLING GROUP IS, AND WHY IT IS NOT JUST "THE SURFACE".
+ *     The collapse is only sound when the promoted item genuinely
+ *     carries what is being folded away. That used to be asserted
+ *     unconditionally — "the latest item's `thread_context` already
+ *     contains the prior messages" — and it is true of a Slack
+ *     channel or DM item and FALSE of a Cohort space post, which
+ *     `lib/org/inbound` never hydrates a thread context for. Fold a
+ *     second person's question into one of those and it is not
+ *     bundled, it is deleted: marked `.processed-bundled` and never
+ *     answered by anyone.
+ *
+ *     So a group is (surface, sender) — a person's own flurry always
+ *     collapses to their latest word — UNLESS the surface's newest
+ *     item carries `thread_context`, in which case the whole surface
+ *     collapses as before, because the session really will see every
+ *     message it stands for.
  *
  * The file format is the YAML emitted by the slack/gmail/calendar
  * pollers (a flat top-level object with quoted scalar fields, plus an
@@ -155,6 +170,42 @@ function readScalar(body, field) {
   return null;
 }
 
+/**
+ * Does this file carry a TOP-LEVEL key at all, block scalar or not?
+ *
+ * `readScalar` answers "what is this field's single-line value", which is the
+ * wrong question for `thread_context`: the pollers write it as a block scalar
+ * (`thread_context: |`), so its value never lives on the key's own line. All
+ * the bundling decision needs to know is whether the field is PRESENT — the
+ * pollers emit it only when there is history to emit (`if (item.thread_context)`
+ * in scripts/poller/utils.mjs), so presence is exactly "this item carries the
+ * conversation around it".
+ *
+ * @param {string} body
+ * @param {string} field
+ * @returns {boolean}
+ */
+function hasTopLevelKey(body, field) {
+  if (typeof body !== "string") return false;
+  // TWO MECHANISMS, ONE PROPERTY, and the redundancy is stated rather than
+  // pretended away: the pattern is anchored at column 0, so an indented line
+  // cannot match it and the `continue` below is a BELT, not the mechanism.
+  // Deleting the `continue` alone changes no behaviour — a mutation of it
+  // leaves the suite green, and that is honest rather than a hole. What the
+  // suite does refuse is the realistic future edit: loosening this anchor to
+  // `^\s*` (the shape `readScalar` had before audit L7) with nothing else in
+  // the way. That is pinned as a BEHAVIOUR, in inbox-deferral.test.mjs — "L7:
+  // body line `thread_context:` in a block scalar does not fake carrying
+  // history" — because the property worth pinning is that a colleague's
+  // question survives, not which of two lines delivered it.
+  const re = new RegExp(`^${escapeRegExp(field)}\\s*:`);
+  for (const line of body.split("\n")) {
+    if (/^\s/.test(line)) continue; // indented — belongs to a block, not top level
+    if (re.test(line)) return true;
+  }
+  return false;
+}
+
 /**
  * Promote every `.deferred` item targeting `channel` back into the
  * live inbox. Bundles bursts: if multiple deferred items exist for
@@ -219,6 +270,26 @@ export function promoteDeferred(channel, agentRoot) {
           readScalar(body, "thread_id") ||
           readScalar(body, "scope_id") ||
           "",
+        // WHO SENT IT, and WHETHER THE ITEM CARRIES ITS CONVERSATION.
+        //
+        // These two decide whether bundling is a bundle or a deletion. The
+        // latest-wins collapse is justified by one sentence in this module's
+        // header — "the latest item's thread_context already contains the
+        // prior messages as conversation history, so Claude sees everything" —
+        // and that sentence is TRUE OF SOME ITEMS AND FALSE OF OTHERS. Slack
+        // channel and DM items carry `thread_context` (slack-poller.mjs:434,
+        // :558); a Cohort space post does NOT, because `lib/org/inbound`
+        // never hydrates one for an untreaded space message. Bundling a
+        // second person's ask into a Cohort item that carries no history is
+        // not folding a duplicate away, it is marking their question
+        // `.processed-bundled` and never answering it.
+        //
+        // So: the collapse now requires evidence. Same sender is always safe
+        // (a person's own flurry — their newest message is their latest word
+        // either way). A DIFFERENT sender may only be folded into an item that
+        // actually carries the room's history.
+        sender: (readScalar(body, "sender") || "").trim().toLowerCase(),
+        carriesHistory: hasTopLevelKey(body, "thread_context"),
       });
     }
     if (matches.length === 0) continue;
@@ -226,13 +297,35 @@ export function promoteDeferred(channel, agentRoot) {
     // Group by surface within the channel, then bundle latest-wins WITHIN each
     // group. Distinct surfaces each promote their own latest; none is dropped
     // just because a newer message landed on a different surface in the room.
-    const groups = new Map();
+    const surfaces = new Map();
     for (const m of matches) {
-      if (!groups.has(m.surface)) groups.set(m.surface, []);
-      groups.get(m.surface).push(m);
+      if (!surfaces.has(m.surface)) surfaces.set(m.surface, []);
+      surfaces.get(m.surface).push(m);
+    }
+
+    // SPLIT A SURFACE BY SENDER UNLESS ITS WINNER CARRIES THE HISTORY.
+    // With history present this is byte-for-byte the old behaviour: one group
+    // per surface, latest wins, everything else bundled. Without it, each
+    // sender keeps their own latest and promotes it — so two people's asks
+    // serialise into two sessions rather than one of them disappearing.
+    const groups = [];
+    for (const group of surfaces.values()) {
+      group.sort((a, b) => a.timestamp.localeCompare(b.timestamp));
+      const winner = group[group.length - 1];
+      const senders = new Set(group.map((m) => m.sender));
+      if (senders.size <= 1 || winner.carriesHistory) {
+        groups.push(group);
+        continue;
+      }
+      const bySender = new Map();
+      for (const m of group) {
+        if (!bySender.has(m.sender)) bySender.set(m.sender, []);
+        bySender.get(m.sender).push(m);
+      }
+      for (const g of bySender.values()) groups.push(g);
     }
 
-    for (const group of groups.values()) {
+    for (const group of groups) {
       // Latest-wins: lex-sort ISO timestamps, take the most recent.
       group.sort((a, b) => a.timestamp.localeCompare(b.timestamp));
       const latest = group[group.length - 1];

package/scripts/daemon/session-lock.mjs

@@ -311,6 +311,37 @@ export function checkRecentlySent(channel, threadTs, type) {
   return { allowed: true };
 }
 
+/**
+ * PURE. The ONE definition of which conversation a thread lock covers.
+ *
+ * WHY THIS EXISTS AS A FUNCTION. The normalisation used to be written twice —
+ * once where the lock is taken (agent-daemon, as an inline ternary) and once
+ * where it is released (`releaseThreadLock`, as a different inline rule) — and
+ * the two did not agree. The acquiring side turned a DM into `dm-channel` from
+ * `item.is_dm`; the releasing side only recognised a DM by a channel id
+ * starting with "D", which is a SLACK id shape. A Cohort DM therefore took a
+ * `dm-channel` lock and released nothing, and the room stayed locked for the
+ * full sixty-minute TTL with every later message deferred behind it. Two
+ * copies of a key derivation is one copy too many; this is now the only one.
+ *
+ * @param {object} o
+ * @param {string} o.channel
+ * @param {string} [o.threadId]  the item's own thread id, if it has one
+ * @param {boolean} [o.isDm]     the daemon's own DM verdict (item.is_dm)
+ * @param {boolean} [o.channelMainLock=true] false restores the pre-2026-09-25
+ *        behaviour where an untreaded channel post took no lock at all
+ * @returns {string|null} the lock key, or null when this item takes no lock
+ */
+export function threadLockKey(o = {}) {
+  const channel = o.channel;
+  if (!channel) return null;
+  // A Slack DM id ("D…") is a DM whatever the caller believed.
+  if (String(channel).startsWith("D")) return "dm-channel";
+  if (o.threadId) return String(o.threadId);
+  if (o.isDm === true) return "dm-channel";
+  return o.channelMainLock === false ? null : "channel-main";
+}
+
 /**
  * Check if a session was already dispatched for the same thread recently.
  * Prevents multiple sessions from responding to the same thread when
@@ -516,7 +547,16 @@ export function releaseThreadLock(channel, threadTs) {
   // the first was skipped with "thread_dedup: DM channel already
   // dispatched 1200s ago").
   if (channel.startsWith("D")) threadTs = "dm-channel";
-  if (!threadTs) return; // non-DM channel without a thread — no lock to release
+  // A caller that hands us nothing is asking us to guess, and the only guess
+  // that mirrors the acquiring side is `threadLockKey`'s: an untreaded, non-DM
+  // channel post locks the room's main feed. Unlinking a lock that was never
+  // taken (the off-switch case, or a genuinely lockless item) is a no-op under
+  // the catch below, so guessing here can only ever free a lock, never wedge
+  // one. The reverse — returning early, as this did — left every
+  // `channel-main` lock to expire on its sixty-minute TTL, which is the whole
+  // channel gagged for an hour after one message.
+  if (!threadTs) threadTs = threadLockKey({ channel, threadId: null, isDm: false });
+  if (!threadTs) return;
   const safeKey = sanitiseItemId(`thread-${channel}-${threadTs}`);
   const lockPath = join(LOCKS_DIR, `${safeKey}.lock`);
   try {