@cohortapp/agent-sdk 2.3.0 → 2.3.2

package/lib/org/messaging.mjs

@@ -195,12 +195,19 @@ export async function sendMessage(params = {}, o = {}) {
 
   // (3) the wire — idempotent on the client message id.
   const idempotencyId = params.idempotencyId != null ? String(params.idempotencyId) : "";
+  // WIRE NAMES MUST MATCH hq's zod schema (server/validation/message.sendMessageBase):
+  //   channelId, body, threadRootId, idempotencyId
+  // This sent `channel`, `threadId` and `id`, so EVERY messaging.send from the
+  // SDK was rejected with "channelId: Required" — no agent could post to Cohort
+  // at all. The legacy names are kept alongside for any older server that still
+  // reads them; the canonical ones are what hq validates.
   const wire = {
+    channelId: channel,
     channel,
     body: text,
     ...(Array.isArray(params.mentions) && params.mentions.length ? { mentions: params.mentions.map(String) } : {}),
-    ...(params.threadId != null ? { threadId: String(params.threadId) } : {}),
-    ...(idempotencyId ? { id: idempotencyId } : {}),
+    ...(params.threadId != null ? { threadRootId: String(params.threadId), threadId: String(params.threadId) } : {}),
+    ...(idempotencyId ? { idempotencyId, id: idempotencyId } : {}),
   };
   const frame = await call("messaging.send", wire, {
     base: org.base,
@@ -237,7 +244,7 @@ export async function reactMessage(params = {}, o = {}) {
   const org = resolveOrg(o.cfg);
   if (!org) return errFrame("BAD_REQUEST", "org messaging disabled or unconfigured");
 
-  const frame = await call("messaging.react", { channel, messageId, emoji }, {
+  const frame = await call("messaging.react", { channelId: channel, channel, messageId, emoji }, {
     base: org.base,
     token: org.token,
     idempotencyKey: o.idempotencyKey,
@@ -265,6 +272,11 @@ export async function fetchHistory(params = {}, o = {}) {
   const frame = await call(
     "messaging.history",
     {
+      // hq's handler validates `channelId` (zod). The SDK sent `channel`, so
+      // messaging.history returned BAD_REQUEST on every call and no caller ever
+      // received history. Send both: `channelId` is what the server reads, and
+      // `channel` is kept for any older server still accepting the legacy name.
+      channelId: channel,
       channel,
       ...(params.since != null ? { since: params.since } : {}),
       ...(params.cursor != null ? { cursor: params.cursor } : {}),
@@ -372,10 +384,17 @@ export async function joinCall(params = {}, o = {}) {
  * here as `nextCursor`) so a crash never loses or double-delivers events.
  *
  * Mention detection: an event whose `mentions[]` (or `mentioned_agents[]`)
- * includes this agent's id, OR a DM-kind event addressed to it, counts as
- * directed. We do NOT include the agent's own outbound echoes (`from` == self).
+ * includes this agent's id, OR a message in a PRIVATE ROOM this agent belongs
+ * to (DM / group DM / huddle), counts as directed. We do NOT include the
+ * agent's own outbound echoes (`from` == self).
+ *
+ * The org event feed is org-wide and redacted, so room membership has to come
+ * from the agent itself — we resolve it once per pull via `messaging.channels`
+ * (see {@link isDirectedAtAgent} for why this is load-bearing rather than an
+ * optimisation). Fail-open: if the roster cannot be read we simply pass
+ * `undefined`, and the filter stays conservative rather than guessing.
  *
- * @param {object} o - { cfg, agentId?, cursor?, limit?, fetchImpl? }
+ * @param {object} o - { cfg, agentId?, cursor?, limit?, fetchImpl?, myChannelIds? }
  * @returns {Promise<{events:object[], nextCursor:(number|string|null)}>}
  */
 export async function pullInbound(o = {}) {
@@ -389,6 +408,21 @@ export async function pullInbound(o = {}) {
   const r = await read(path, { base: org.base, token: org.token, fetchImpl: o.fetchImpl });
   if (!r.ok || !r.payload) return { events: [], nextCursor: cursor };
 
+  // Which rooms am I in? Injectable for tests; otherwise one cheap RPC per pull.
+  let myChannelIds = o.myChannelIds;
+  if (myChannelIds == null) {
+    try {
+      const channels = await listChannels({ cfg: o.cfg, fetchImpl: o.fetchImpl });
+      if (Array.isArray(channels)) {
+        myChannelIds = new Set(
+          channels.map((c) => String((c && (c.id || c.channelId)) || "")).filter(Boolean),
+        );
+      }
+    } catch {
+      myChannelIds = undefined; // unknown → conservative filter, never a throw
+    }
+  }
+
   const raw = Array.isArray(r.payload) ? r.payload : (Array.isArray(r.payload.events) ? r.payload.events : []);
   let maxSeq = cursor;
   const events = [];
@@ -396,20 +430,90 @@ export async function pullInbound(o = {}) {
     if (ev && (ev.seq != null) && Number.isFinite(Number(ev.seq))) {
       maxSeq = Math.max(Number(maxSeq) || 0, Number(ev.seq));
     }
-    const directed = isDirectedAtAgent(ev, me);
+    const directed = isDirectedAtAgent(ev, me, { myChannelIds });
     if (!directed) continue;
     events.push(toMessageEvent(ev, me));
   }
-  return { events, nextCursor: raw.length ? maxSeq : cursor };
+
+  // HYDRATE THE BODY. The org event feed is redacted by design — it carries
+  // {actor, channelId, channelKind, counts, ts} and NO message text — so a
+  // projected event arrives with `text: ""`. An empty inbound is worse than no
+  // inbound: the classifier sees nothing to classify and the agent would
+  // "reply" to a blank message.
+  //
+  // The body is fetched over `messaging.history`, which is ACL'd server-side to
+  // rooms this agent belongs to — so hydration cannot widen what the agent can
+  // see, it only re-joins content the agent was always entitled to read. One
+  // fetch per affected channel, not per message.
+  //
+  // Fail-open: a message we cannot hydrate is dropped rather than delivered
+  // blank, because a blank inbound produces a nonsense reply in a real room.
+  const needBody = events.filter((e) => !e.text && e.kind !== "call");
+  if (needBody.length) {
+    const byChannel = new Map();
+    for (const e of needBody) {
+      if (!e.channel_id) continue;
+      if (!byChannel.has(e.channel_id)) byChannel.set(e.channel_id, []);
+      byChannel.get(e.channel_id).push(e);
+    }
+    for (const [channelId, pending] of byChannel) {
+      try {
+        const history = await fetchHistory(
+          { channel: channelId, limit: 50 },
+          { cfg: o.cfg, fetchImpl: o.fetchImpl },
+        );
+        const byId = new Map(
+          (Array.isArray(history) ? history : [])
+            .map((m) => [String((m && (m.id || m.messageId)) || ""), m])
+            .filter(([id]) => id),
+        );
+        for (const e of pending) {
+          const hit = byId.get(String(e.message_id));
+          if (!hit) continue;
+          e.text = String(hit.body ?? hit.text ?? "");
+          if (!e.from.name || e.from.name === e.from.id) {
+            e.from.name = String(hit.authorName || hit.author?.displayName || e.from.name || "");
+          }
+        }
+      } catch {
+        /* fail-open: leave these unhydrated; they are dropped just below */
+      }
+    }
+  }
+
+  const delivered = events.filter((e) => e.kind === "call" || (e.text && e.text.trim()));
+  return { events: delivered, nextCursor: raw.length ? maxSeq : cursor };
 }
 
 /**
  * Decide whether an org event is directed at this agent (an inbound it should
  * react to) vs ambient chatter / its own echo. Pure.
- * @param {object} ev @param {string} me agent id
+ *
+ * WHY THIS NEEDS `myChannelIds`. The `/v1/events` feed is ORG-scoped, not
+ * member-scoped — an agent sees every messaging event in the org — and the
+ * payload is deliberately REDACTED: hq emits only
+ *   { actor, channelId, channelKind, recipientCount, mentionCount, ts }
+ * with no body and, crucially, NO recipient list. That redaction is correct
+ * (an org-wide feed must not leak who DMs whom), but it means "is this for me?"
+ * cannot be answered from the event alone. The agent's OWN channel membership
+ * is the missing half, and the agent already knows it (`messaging.channels`).
+ *
+ * This bit in production: a human DM'd an agent six times and the agent never
+ * saw a single message. The old code looked for a `to` array the payload never
+ * carries, then fell back to `p.kind` containing "dm" — but the event's kind is
+ * "send" and the DM-ness lives in `channelKind: "DM"`, which nothing inspected.
+ * Every human DM was silently dropped.
+ *
+ * Without `myChannelIds` this stays CONSERVATIVE for DMs (returns false rather
+ * than guessing), because the failure mode of guessing yes is an agent barging
+ * into other people's private conversations.
+ *
+ * @param {object} ev
+ * @param {string} me agent id
+ * @param {{myChannelIds?: Set<string>|string[]}} [opts]
  * @returns {boolean}
  */
-export function isDirectedAtAgent(ev, me) {
+export function isDirectedAtAgent(ev, me, opts = {}) {
   if (!ev || typeof ev !== "object") return false;
   const family = ev.family || (ev.kind ? String(ev.kind).split(".")[0] : "");
   if (family && family !== "messaging" && family !== "calling") return false;
@@ -423,21 +527,46 @@ export function isDirectedAtAgent(ev, me) {
     .map((m) => String(m));
   if (me && mentions.includes(String(me))) return true;
 
-  // A DM / direct call-invite addressed to this agent is directed even with no
-  // explicit @mention.
+  // An explicit recipient list, when a producer supplies one.
   const to = []
     .concat(Array.isArray(p.to) ? p.to : (p.to != null ? [p.to] : []))
     .concat(Array.isArray(p.invitees) ? p.invitees : [])
     .map((t) => String(t));
   if (me && to.includes(String(me))) return true;
 
+  // The REAL hq shape: a private room I am a member of. Membership is what makes
+  // it mine — in a DM/group-DM/huddle every message is addressed to the room,
+  // so no @mention is required.
+  const mine = normaliseChannelIds(opts.myChannelIds);
+  const channelId = String(p.channelId || p.channel || p.callId || "");
+  const channelKind = String(p.channelKind || p.channel_kind || "").toUpperCase();
+  const PRIVATE_ROOMS = ["DM", "GROUP_DM", "HUDDLE"];
+  if (mine && channelId && mine.has(channelId)) {
+    if (PRIVATE_ROOMS.includes(channelKind)) return true;
+    // A call event in one of my rooms is an invite I should react to.
+    if (family === "calling") return true;
+  }
+
+  // Legacy/other producers that put the room kind in `kind` rather than
+  // `channelKind`. Unchanged behaviour for them.
   const kind = String(p.kind || ev.kind || "").toLowerCase();
-  if (kind.includes("dm") || kind.includes("invite") || family === "calling") {
+  if (kind.includes("dm") || kind.includes("invite")) {
+    return !me || to.includes(String(me)) || mentions.includes(String(me)) || to.length === 0;
+  }
+  // A bare `calling` event with no room context: only when we cannot scope it.
+  if (family === "calling" && !mine) {
     return !me || to.includes(String(me)) || mentions.includes(String(me)) || to.length === 0;
   }
   return false;
 }
 
+/** Accept a Set, an array, or nothing; null means "membership unknown". */
+function normaliseChannelIds(v) {
+  if (v instanceof Set) return v;
+  if (Array.isArray(v)) return new Set(v.map((x) => String(x)));
+  return null;
+}
+
 /**
  * Project an org messaging/calling event onto the unified MessageEvent contract
  * (lib/channels/contract.MessageEvent) so eventToInboxItem can serialise it into

package/lib/org/messaging.test.mjs

@@ -236,3 +236,80 @@ test("pullInbound: org disabled → empty, cursor preserved (fail-open)", async
   assert.deepEqual(events, []);
   assert.equal(nextCursor, 5);
 });
+
+// ---------------------------------------------------------------------------
+// The REAL hq event shape — regression for the silent-DM-drop
+// ---------------------------------------------------------------------------
+
+/** Exactly what hq appends for a human DM (redacted: no body, no recipients). */
+function hqDmEvent(overrides = {}) {
+  return {
+    seq: 9880,
+    family: "messaging",
+    kind: "send",
+    entityId: "cmsnbhmqy004blj016kot2pwi",
+    actor: "human-1",
+    at: "2026-08-10T14:18:55.978Z",
+    payload: {
+      ts: "2026-08-10T14:18:55.978Z",
+      actor: "human-1",
+      threaded: false,
+      channelId: "dm-human-agent",
+      channelKind: "DM",
+      mentionCount: 0,
+      recipientCount: 2,
+      attachmentCount: 0,
+      ...overrides,
+    },
+  };
+}
+
+test("isDirectedAtAgent: a human DM in MY room is directed (the production silent-drop)", () => {
+  // Six real DMs were dropped: the filter wanted a `to` list the redacted
+  // payload never carries, and checked `kind` for "dm" when the kind is "send"
+  // and the room type lives in `channelKind`.
+  const mine = new Set(["dm-human-agent"]);
+  assert.equal(isDirectedAtAgent(hqDmEvent(), "agent-self", { myChannelIds: mine }), true);
+});
+
+test("isDirectedAtAgent: a DM I am NOT in is NOT mine (org feed is org-wide)", () => {
+  // /v1/events is org-scoped, so an agent sees other people's DM events too.
+  // Reacting to those would be barging into private conversations.
+  const mine = new Set(["dm-human-agent"]);
+  const someoneElses = hqDmEvent({ channelId: "dm-human-other" });
+  assert.equal(isDirectedAtAgent(someoneElses, "agent-self", { myChannelIds: mine }), false);
+});
+
+test("isDirectedAtAgent: without membership context it stays CONSERVATIVE on DMs", () => {
+  // Guessing "yes" without knowing the roster is the dangerous direction.
+  assert.equal(isDirectedAtAgent(hqDmEvent(), "agent-self"), false);
+});
+
+test("isDirectedAtAgent: my own echo in my own DM is still ignored", () => {
+  const mine = new Set(["dm-human-agent"]);
+  const echo = hqDmEvent({ actor: "agent-self" });
+  echo.actor = "agent-self";
+  assert.equal(isDirectedAtAgent(echo, "agent-self", { myChannelIds: mine }), false);
+});
+
+test("isDirectedAtAgent: a PUBLIC channel message in my room is NOT directed on its own", () => {
+  // Membership in a public channel is not an invitation to answer everything;
+  // that needs an @mention (which the redacted payload cannot yet express —
+  // hq emits mentionCount, not the ids).
+  const mine = new Set(["general"]);
+  const pub = hqDmEvent({ channelId: "general", channelKind: "PUBLIC" });
+  assert.equal(isDirectedAtAgent(pub, "agent-self", { myChannelIds: mine }), false);
+});
+
+test("isDirectedAtAgent: an explicit mentions[] still wins anywhere", () => {
+  const mine = new Set(["general"]);
+  const pub = hqDmEvent({ channelId: "general", channelKind: "PUBLIC", mentions: ["agent-self"] });
+  assert.equal(isDirectedAtAgent(pub, "agent-self", { myChannelIds: mine }), true);
+});
+
+test("isDirectedAtAgent: a call event in my room is an invite", () => {
+  const mine = new Set(["room-1"]);
+  const ev = { family: "calling", kind: "start", actor: "human-1",
+               payload: { channelId: "room-1", topic: "standup" } };
+  assert.equal(isDirectedAtAgent(ev, "agent-self", { myChannelIds: mine }), true);
+});

package/package.json

@@ -1,9 +1,10 @@
 {
   "name": "@cohortapp/agent-sdk",
-  "version": "2.3.0",
-  "description": "Cohort Agent SDK — autonomous AI colleague runtime. Deploy senior AI colleagues on dedicated Mac minis, wired to the Cohort operating surface.",
+  "version": "2.3.2",
+  "description": "Cohort Agent SDK \u2014 autonomous AI colleague runtime. Deploy senior AI colleagues on dedicated Mac minis, wired to the Cohort operating surface.",
   "type": "module",
   "bin": {
+    "agent-sdk": "./bin/maestro.mjs",
     "maestro": "./bin/maestro.mjs",
     "cohort": "./bin/maestro.mjs",
     "cohort-mcp": "./bin/cohort-mcp.mjs",

package/scripts/daemon/agent-daemon.mjs

@@ -120,19 +120,46 @@ function logEvent(type, entry) {
 // ---------------------------------------------------------------------------
 
 async function poll() {
-  const services = [
-    { name: "slack", fn: pollSlack },
-    { name: "gmail", fn: pollGmail },
-    { name: "alex-gmail", fn: pollSecondaryGmail },
-    { name: "calendar", fn: pollCalendar },
-    { name: "voice", fn: pollVoice },
+  // COHORT IS THE DEFAULT SUBSTRATE. An agent's messaging, email, calendar,
+  // CRM, directory, spaces, boards, books and calls all live on the Cohort
+  // server. The third-party adapters below are LEGACY BRIDGES for agents that
+  // additionally sit in someone else's Slack or Gmail — they are not what a new
+  // agent should be doing by default.
+  //
+  // They used to be polled unconditionally, which meant every freshly-created
+  // agent burned a poll cycle on Slack, two Gmail accounts, Google Calendar and
+  // voice on a loop, and filled its log with "SLACK_TOKEN not set" /
+  // "App password not set" forever. Worse, the noise made a REAL failure
+  // (Cohort inbound not wired at all) invisible in the same log.
+  //
+  // Each is now gated on evidence that it is actually configured, exactly like
+  // the channel-bus platforms below. Nothing is removed — an agent that IS on
+  // Slack keeps working the moment its token exists.
+  const services = [];
+  const legacyBridges = [
+    { name: "slack", fn: pollSlack, on: () => Boolean(process.env.SLACK_TOKEN || process.env.SLACK_USER_TOKEN) },
+    { name: "gmail", fn: pollGmail, on: () => Boolean(process.env.GMAIL_APP_PASSWORD) },
+    { name: "alex-gmail", fn: pollSecondaryGmail, on: () => Boolean(process.env.SECONDARY_GMAIL_APP_PASSWORD) },
+    { name: "calendar", fn: pollCalendar, on: () => _existsSync(join(AGENT_REPO_DIR, "config/google-calendar.yaml")) || Boolean(process.env.GOOGLE_CALENDAR_CREDENTIALS) },
+    { name: "voice", fn: pollVoice, on: () => _existsSync(join(AGENT_REPO_DIR, "config/voice.yaml")) || Boolean(process.env.TWILIO_ACCOUNT_SID) },
   ];
+  for (const b of legacyBridges) {
+    let enabled = false;
+    try { enabled = b.on(); } catch { enabled = false; }
+    if (enabled) services.push({ name: b.name, fn: b.fn });
+  }
 
   // WS2: channel-bus platforms (Telegram, Baileys WhatsApp) deliver events as
   // inbox YAML via the daemon's channel loop. They have no API poller, so a
   // generic inbox scanner drains their items into the same pipeline. Gate on
   // the platform's config file so we don't scan dirs for disabled channels.
-  for (const [name, gate] of [["telegram", "config/telegram.yaml"], ["whatsapp", "config/whatsapp.yaml"], ["orgmail", "config/orgmail.yaml"]]) {
+  // `cohort` is the SAME shape: the messaging-inbound cadence pulls org
+  // messages / @mentions / call-invites directed at this agent and writes them
+  // as inbox YAML under state/inbox/cohort/ — but nothing drained that
+  // directory, so the items simply accumulated and the agent never answered.
+  // The whole SP10 inbound chain existed except this last hop. Gated on org
+  // enrolment (config/org.yaml) exactly like the other channel sources.
+  for (const [name, gate] of [["telegram", "config/telegram.yaml"], ["whatsapp", "config/whatsapp.yaml"], ["orgmail", "config/orgmail.yaml"], ["cohort", "config/org.yaml"]]) {
     if (_existsSync(join(AGENT_REPO_DIR, gate))) {
       services.push({ name, fn: makeInboxScanPoller(name, { agentRoot: AGENT_REPO_DIR }) });
     }

package/scripts/daemon/cadence-handlers.mjs

@@ -48,6 +48,7 @@ import { fileURLToPath } from "node:url";
 import { spawn } from "node:child_process";
 import { recoverStaleClaims } from "../../lib/cadence-bus.mjs";
 import { isQuarterStartMonth } from "../../lib/cadences.mjs";
+import { loadOrgConfig } from "../../lib/org/client.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -389,13 +390,40 @@ async function guardQuarterlySelfAssessment({ now } = {}) {
 
 /** Read config/agent.json fail-open (for the org legs). Returns null on any error. */
 function loadAgentCfg(agentRoot) {
+  let agent = null;
   try {
     const p = join(agentRoot, "config", "agent.json");
-    if (!existsSync(p)) return null;
-    return JSON.parse(readFileSync(p, "utf8"));
+    if (existsSync(p)) agent = JSON.parse(readFileSync(p, "utf8"));
   } catch {
-    return null;
+    agent = null;
+  }
+
+  // ORG ENROLMENT LIVES IN config/org.yaml, NOT config/agent.json.
+  //
+  // Every org-facing guard below gates on `cfg.org.cohort` and bails out with
+  // "org messaging not configured" when it is absent. `config/agent.json` has no
+  // `org` key at all — enrolment is written to `config/org.yaml` by
+  // `maestro setup` and read by lib/org/client.loadOrgConfig — so all SIX of
+  // those guards were dead on every enrolled agent, silently and permanently.
+  //
+  // Observed in production: a human DM'd an agent repeatedly and the
+  // messaging-inbound cadence ran ~every 45s, each time deciding "org messaging
+  // not configured" and routing nothing. The agent looked healthy the whole time.
+  //
+  // This is the SAME bug class loadOrgConfig was introduced to fix ("the daemon
+  // reading collective.yaml by mistake") — fixed there, missed here. Merging at
+  // this one chokepoint fixes every guard at once rather than per-guard.
+  let org = null;
+  try {
+    org = loadOrgConfig(agentRoot);
+  } catch {
+    org = null;
+  }
+
+  if (org && org.org) {
+    return { ...(agent || {}), org: { ...((agent && agent.org) || {}), ...org.org } };
   }
+  return agent;
 }
 
 /**
@@ -633,7 +661,17 @@ async function guardMessagingInbound({ event, agentRoot, log }, opts = {}) {
     const writeInboxItem = opts.writeImpl || (await import("../poller/utils.mjs")).writeInboxItem;
 
     const cursor = readMessagingCursor(agentRoot);
-    const res = await pull({ cfg, cursor, fetchImpl: opts.fetchImpl });
+    // Pass the agent id explicitly. It is what suppresses the agent's OWN
+    // outbound echoes — without it `me` is null, every echo-filter branch is
+    // skipped, and the agent re-ingests its own replies as fresh inbound (a
+    // conversation with itself). config/org.yaml does not carry an agentId, so
+    // env is the reliable source on a real machine.
+    const agentId =
+      opts.agentId ||
+      process.env.COHORT_AGENT_ID ||
+      (cfg && cfg.org && cfg.org.cohort && cfg.org.cohort.agentId) ||
+      undefined;
+    const res = await pull({ cfg, agentId, cursor, fetchImpl: opts.fetchImpl });
     const events = (res && Array.isArray(res.events)) ? res.events : [];
 
     let routed = 0;

package/scripts/daemon/maestro-daemon.mjs

@@ -33,6 +33,29 @@ const AGENT_DIR = process.env.AGENT_DIR || resolve(__dirname, "../..");
 process.env.AGENT_DIR = AGENT_DIR;
 process.env.AGENT_ROOT = AGENT_DIR;
 
+// ---------------------------------------------------------------------------
+// 0. Environment — BEFORE anything reads a credential
+// ---------------------------------------------------------------------------
+// The core daemon (agent-daemon.mjs, step 4) loads .env itself, but the org
+// mesh connects at step 3b' — EARLIER in this file. Under launchd the process
+// environment is bare, so the mesh was reading COHORT_API_KEY before anything
+// had put it there.
+//
+// That failed SILENTLY and looked healthy: `enabled` comes from config/org.yaml
+// (which should NOT carry the token — it is version-controlled), so the mesh
+// started, logged "connected", and then 401'd on every beat forever. An agent
+// that never beats also never receives the kill switch.
+//
+// Loading .env here, before any org work, is the fix. Idempotent: dotenv does
+// not override variables already set, so a launchd/plist-provided value still
+// wins. Fail-open — dotenv is absent in some CI/unit contexts.
+try {
+  const { config } = await import("dotenv");
+  config({ path: join(AGENT_DIR, ".env") });
+} catch {
+  // No dotenv (CI/dev): rely on the ambient environment.
+}
+
 // Never die silently (P0-6): a stray unhandled rejection / uncaught exception is
 // logged + counted, not a silent process death. Rejections keep the daemon
 // running; an uncaught exception logs+flushes then lets launchd restart us.

package/scripts/daemon/responder.mjs

@@ -684,6 +684,52 @@ function resolveSlackChannel(item) {
  *
  * @returns {{ sent: boolean, text: string, channel: string }} result
  */
+
+/**
+ * Send a reply back onto Cohort (the org's own messaging app).
+ *
+ * The responder dispatched on `item.service` and only ever knew "slack" and
+ * "gmail", so a `cohort` item fell through to `{ sent: false }`: the agent
+ * COMPOSED a reply and dropped it on the floor, logging "not_sent". Observed in
+ * production — an agent quietly did that to a human's DMs three times in a row.
+ *
+ * Routing is by CHANNEL, not by person: `channel_id` is the room the inbound
+ * arrived in, which is also where the answer belongs (a DM room for a DM, the
+ * space for a space). Threading is preserved when the inbound was threaded.
+ *
+ * Goes through lib/org/messaging.sendMessage rather than the raw RPC so the
+ * outbound send-gate, the afterSend hook and cost attribution all still run —
+ * the same chokepoint every other channel uses.
+ */
+async function sendCohortReply(item, text) {
+  try {
+    const channel = item.channel_id || item.channel || "";
+    if (!channel) return { sent: false, via: null, error: "no channel_id on item" };
+    const { sendMessage } = await import("../../lib/org/messaging.mjs");
+    const { loadOrgConfig } = await import("../../lib/org/client.mjs");
+    const agentRoot = process.env.AGENT_ROOT || process.env.AGENT_DIR || process.cwd();
+    const frame = await sendMessage(
+      {
+        channel,
+        body: text,
+        // Stable per (message, kind) so a retry dedupes server-side instead of
+        // double-posting into a real room.
+        idempotencyId: `reply-${item.message_id || item.id || Date.now()}`,
+        ...(item.thread_id ? { threadId: item.thread_id } : {}),
+      },
+      { cfg: loadOrgConfig(agentRoot), agentRoot },
+    );
+    if (frame && frame.ok) return { sent: true, via: "cohort", channel };
+    return {
+      sent: false,
+      via: null,
+      error: (frame && frame.error && frame.error.message) || "send failed",
+    };
+  } catch (err) {
+    return { sent: false, via: null, error: err && err.message };
+  }
+}
+
 export async function sendQuickResponse(item, classResult) {
   const startTime = Date.now();
 
@@ -745,6 +791,13 @@ export async function sendQuickResponse(item, classResult) {
         emitEvent({ type: EVENT_TYPES.SENT, trace_id: item.trace_id || undefined, attrs: { service: "gmail", via: gmailResult.via } });
         logInteraction(item, text);
       }
+    } else if (item.service === "cohort") {
+      const orgResult = await sendCohortReply(item, text);
+      sendResult = { sent: orgResult.sent, via: orgResult.via, ...(orgResult.channel ? { channel: orgResult.channel } : {}), ...(orgResult.error ? { error: orgResult.error } : {}) };
+      if (orgResult.sent) {
+        emitEvent({ type: EVENT_TYPES.SENT, trace_id: item.trace_id || undefined, attrs: { service: "cohort", channel: orgResult.channel, via: "quick_reply" } });
+        logInteraction(item, text);
+      }
     }
 
     const duration = Date.now() - startTime;
@@ -802,6 +855,9 @@ export async function sendHoldingMessage(item, classResult) {
     } else if (item.service === "gmail") {
       const gmailResult = await sendGmailResponse(item, text);
       sendResult = { sent: gmailResult.sent, via: gmailResult.via, ...(gmailResult.draft_path ? { draft_path: gmailResult.draft_path } : {}), ...(gmailResult.to ? { to: gmailResult.to } : {}) };
+    } else if (item.service === "cohort") {
+      const orgResult = await sendCohortReply(item, text);
+      sendResult = { sent: orgResult.sent, via: orgResult.via, ...(orgResult.error ? { error: orgResult.error } : {}) };
     }
 
     const duration = Date.now() - startTime;

package/scripts/poller/inbox-scan-poller.mjs

@@ -57,6 +57,19 @@ export function parseInboxItemYaml(body) {
     const m = body.match(new RegExp(`^\\s{2}${key}:\\s*(\\S+)`, "m"));
     return /true/i.test((m || [])[1] || "");
   };
+  // TRI-STATE. The confidentiality fields must distinguish "absent" from
+  // "false": `is_private: false` is a positive assertion that the source is
+  // public, and the daemon's fail-closed outcome gate
+  // (scripts/daemon/session-outcomes.mjs) admits on it. Decoding a missing line
+  // as `false` — which `bool()` does — would forge that assertion for every
+  // item ever written, which is exactly the leak the gate exists to prevent.
+  const triBool = (key) => {
+    const m = body.match(new RegExp(`^${key}:\\s*(\\S+)`, "m"));
+    if (!m) return undefined;
+    if (/^true$/i.test(m[1])) return true;
+    if (/^false$/i.test(m[1])) return false;
+    return undefined;
+  };
 
   // Block scalar `content: |` — capture the indented block.
   const blockScalar = (key) => {
@@ -66,7 +79,11 @@ export function parseInboxItemYaml(body) {
     return m[1].replace(/^ {2}/gm, "").replace(/\n+$/, "");
   };
 
-  return {
+  const channelType = scalar("channel_type");
+  const isPrivate = triBool("is_private");
+  const isDm = triBool("is_dm");
+
+  const item = {
     id: scalar("id"),
     service: scalar("service"),
     channel: scalar("channel"),
@@ -88,6 +105,14 @@ export function parseInboxItemYaml(body) {
     },
     raw_ref: scalar("raw_ref"),
   };
+
+  // Only attached when the writer actually knew (see triBool) — an item with no
+  // privacy signal must stay signal-less so the outcome gate fails closed.
+  if (channelType) item.channel_type = channelType;
+  if (isPrivate !== undefined) item.is_private = isPrivate;
+  if (isDm !== undefined) item.is_dm = isDm;
+
+  return item;
 }
 
 /**