@cohortapp/agent-sdk 2.18.17 → 2.18.19

package/lib/assurance/first-reply.mjs

@@ -421,3 +421,65 @@ export default {
   firstReplyPlan,
   stampFirstReplyPlan,
 };
+
+/**
+ * The AGENT STATUS NOTICE family — a seat narrating its own progress, failure
+ * or recovery to a room.
+ *
+ * ── WHY THIS EXISTS, AND WHY IT IS SEPARATE FROM THE RETIRED REGISTER ───────
+ *
+ * The register above answers "may this seat SEND this line?". This answers a
+ * different question: "is this line, arriving from ANOTHER seat, a piece of
+ * work?" — and the answer is always no. A colleague saying how their own task
+ * went is a status report. It is not an ask, and it must never mint a board row.
+ *
+ * On 2026-09-30 it did. `assurance.isOwnNarratorText` already recognised these
+ * notices, but only for SELF-echo — a seat ignoring its own words. Nothing
+ * stopped Jacob's recovery notice reaching Candace as an ordinary message, and
+ * with no `--title` on the claim the row took the ask's own first sentence as
+ * its title. Production, in three hours:
+ *
+ *   "Here's where I got to: Archived, logged."
+ *   "Here's where I got to: Declined, logged, no reply."
+ *   "Here's where I got to: Here's where I got to: Queued, not archived …"
+ *
+ * Sixty-four rows, several seats each opening and closing the same non-task,
+ * and the doubled title is the output of the path re-entering its own input —
+ * a row minted from a report ABOUT a row. One of them read "eleventh turn".
+ *
+ * FROZEN LITERALS for the same reason the register above is frozen: a notice
+ * arriving from a seat that has not upgraded yet must still be recognised long
+ * after the local composer that produced it has changed.
+ */
+const STATUS_NOTICE_PATTERNS = Object.freeze([
+  // composeSilentSuccess — the recovery notice, with or without an excerpt.
+  // The excerpt is unbounded prose, so this anchors on the head alone.
+  /^finished this but didn'?t get a reply out to you\s*[—–-]\s*my fault\b/i,
+  // composeInterrupted.
+  /^heads up\s*[—–-]\s*my session on this was interrupted\b/i,
+  // notice-voice's generated failure/progress lines, which name the topic:
+  //   The work on "X" broke before it finished: …
+  //   The work on "X" didn't get through: …
+  /^the work (on ".+?"|you asked for)\s+(broke|didn'?t|never|has)\b/i,
+  // The board-status shape that closed the loop on itself.
+  /^here'?s where i got to:/i,
+]);
+
+/**
+ * Is this body a seat narrating its own work, rather than asking for any?
+ *
+ * Judged per PARAGRAPH like the register above, because these notices are
+ * routinely concatenated with an excerpt or with each other.
+ *
+ * @param {unknown} body
+ * @returns {boolean}
+ */
+export function isAgentStatusNotice(body) {
+  const paras = String(body == null ? "" : body).split(/\n\s*\n/);
+  for (const p of paras) {
+    const line = normaliseLine(p);
+    if (!line) continue;
+    if (STATUS_NOTICE_PATTERNS.some((re) => re.test(line))) return true;
+  }
+  return false;
+}

package/lib/runtime/adapter.mjs

@@ -239,6 +239,19 @@ export function sessionArgs(i = {}) {
     : ["--session-id", String(i.sessionId)];
 }
 
+/**
+ * Argv for a lane whose whole job is text in, JSON out (capture, reflect,
+ * curator). The child gets NO tools and NO MCP servers: it reads a transcript
+ * or a memory set, and anything in that text that reads like an instruction
+ * ("merge the PR", "run this") must stay text. A tool-bearing child would
+ * inherit the seat's permission mode and could act on it. The parent parses
+ * the child's stdout, so nothing the lane needs is lost.
+ *
+ * @param {{model: string}} i - the lane input.
+ * @returns {string[]} the claude argv.
+ */
+const TEXT_ONLY_ARGV = (i) => ["--print", "--model", i.model, "--strict-mcp-config", "--tools", ""];
+
 const LANES = Object.freeze({
   dispatcher: {
     posture: "stock-oauth", stdin: false, retarget: true,
@@ -270,15 +283,15 @@ const LANES = Object.freeze({
   },
   capture: {
     posture: "path", stdin: true, retarget: false, collectiveChild: true,
-    argv: (i, x) => ["--print", "--model", i.model, ...x.mcp],
+    argv: (i) => TEXT_ONLY_ARGV(i),
   },
   reflect: {
     posture: "path", stdin: true, retarget: false, collectiveChild: true,
-    argv: (i, x) => ["--print", "--model", i.model, ...x.mcp],
+    argv: (i) => TEXT_ONLY_ARGV(i),
   },
   curator: {
     posture: "path", stdin: true, retarget: false, collectiveChild: true,
-    argv: (i, x) => ["--print", "--model", i.model, ...x.mcp],
+    argv: (i) => TEXT_ONLY_ARGV(i),
   },
   enrich: {
     posture: "inherit", stdin: false, retarget: false,
@@ -490,7 +503,7 @@ export const ENGINE_RUN_FLAGS = Object.freeze([
   "-p", "--print", "--output-format", "--model", "--session-id", "--resume", "--max-turns", "--append-system-prompt",
   // W2-D: MCP, permissions, settings.
   "--mcp-config", "--strict-mcp-config", "--permission-mode", "--dangerously-skip-permissions",
-  "--allowedTools", "--disallowedTools", "--settings",
+  "--allowedTools", "--disallowedTools", "--settings", "--tools",
   // W3-G (CF-45): the router knobs and the daemon's bare mode.
   "--add-dir", "--plugin-dir", "--effort", "--agents", "--bare",
   // W4-E1 (row 24): the per-session spend cap.
@@ -516,6 +529,7 @@ const CLAUDE_TO_ENGINE = Object.freeze({
   "--permission-mode": { flag: "--permission-mode", value: true },
   "--allowedTools": { flag: "--allowedTools", value: true },
   "--disallowedTools": { flag: "--disallowedTools", value: true },
+  "--tools": { flag: "--tools", value: true },
   "--settings": { flag: "--settings", value: true },
   "--add-dir": { flag: "--add-dir", value: true },
   "--plugin-dir": { flag: "--plugin-dir", value: true },

package/lib/session/ask-ledger.mjs

@@ -215,6 +215,28 @@ export function ledgerStepsFor(a = {}) {
  * @returns {Promise<{steps:Array<object>, results:Array<object>}>}
  */
 export async function runAskLedger(a = {}) {
+  // ── A STATUS REPORT IS NOT WORK ──────────────────────────────────────────
+  //
+  // A colleague narrating how their own task went is not an ask, and a row
+  // opened from one is a row nobody requested. On 2026-09-30 this minted 64
+  // rows in three hours — titled "Here's where I got to: Archived, logged."
+  // and once "Here's where I got to: Here's where I got to: …", which is a row
+  // minted from a report ABOUT a row. Several seats each opened and closed the
+  // same non-task; one row's note read "eleventh turn".
+  //
+  // The notice family was already recognised (`assurance.isOwnNarratorText`)
+  // but only for SELF-echo, so a seat ignored its own words and happily
+  // actioned everyone else's. This applies the same recognition to the question
+  // that matters here: not "did I say this?" but "is this work?".
+  //
+  // Deliberately at the LEDGER, not at ingestion: the seat should still READ a
+  // colleague's status notice and may still reply to it. What it must not do is
+  // open a board row for it.
+  const { isAgentStatusNotice } = await import("../assurance/first-reply.mjs");
+  const body = (a.item && (a.item.content || a.item.subject)) || a.text || "";
+  if (isAgentStatusNotice(body)) {
+    return { steps: [], results: [{ tracked: false, reason: "status-notice-not-an-ask" }] };
+  }
   const steps = ledgerStepsFor(a);
   const results = [];
   if (steps.length === 0) return { steps, results };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cohortapp/agent-sdk",
-  "version": "2.18.17",
+  "version": "2.18.19",
   "description": "Cohort Agent SDK — autonomous AI colleague runtime. Deploy senior AI colleagues on dedicated Mac minis, wired to the Cohort operating surface.",
   "type": "module",
   "bin": {