@cohortapp/agent-sdk 2.3.0

package/scripts/daemon/responder.mjs

@@ -0,0 +1,854 @@
+/**
+ * responder.mjs — Quick response layer
+ *
+ * Handles two scenarios with a single short-lived `claude --print` call:
+ *
+ * 1. SIMPLE REPLIES: Invokes the Claude Code CLI to generate a response,
+ *    then posts directly via Slack/Gmail API.
+ *
+ * 2. HOLDING MESSAGES: For complex items that need a full session,
+ *    generates and sends an immediate acknowledgment so the sender
+ *    knows it's being worked on.
+ *
+ * Migrated off `@anthropic-ai/sdk` per CEO directive (Slack DM
+ * D099N1JGKRQ, 2026-04-27 09:38Z + 11:33Z): all agent daemon model
+ * calls must funnel through Claude Code CLI sessions (Max
+ * subscription), not the Anthropic API.
+ */
+
+import { readFileSync, writeFileSync, readdirSync, appendFileSync, mkdirSync } from "fs";
+import { execFileSync, spawn } from "child_process";
+import { join } from "path";
+import { randomUUID } from "crypto";
+import { checkRecentlySent, registerSent } from "./session-lock.mjs";
+import { routingKey as deriveRoutingKey, createRouter } from "./lib/session-router.mjs";
+// Permission scoping (security CRITICAL / audit H1). sessionPermissionArgs()
+// preserves the historical "--dangerously-skip-permissions" by default and only
+// scopes tools when the operator opts in (MAESTRO_SCOPED_PERMISSIONS=1), so the
+// quick-reply / holding spawn path honours the same gate as every other spawn.
+import { sessionPermissionArgs } from "../../lib/session-permissions.mjs";
+import { screenOutbound } from "../../lib/comms/send-gate.mjs";
+// Observability spine (WS — diagnostics). emitEvent("sent") marks a successful
+// quick-reply / holding send (interaction-end on the quick path); counters.bump
+// ("send.blocked") tallies a guard / send-gate / dedup block. When the send-gate
+// itself fails OPEN (infra error on an internal Slack channel) we emit
+// "onGuardFail" on the lifecycle bus so the daemon's real subscriber counts it —
+// proving the bus is live with a real consumer. All fail-open (never throw).
+import { emitEvent, EVENT_TYPES } from "../../lib/diagnostics/events.mjs";
+import * as counters from "../../lib/diagnostics/counters.mjs";
+import { getHookBus } from "../../lib/hooks/bus.mjs";
+
+const AGENT_REPO_DIR = process.env.AGENT_DIR || join(new URL(".", import.meta.url).pathname, "../..");
+const SONNET_MODEL = "claude-sonnet-4-6";
+// Resolve claude against the agent's PATH (not launchd's bare env).
+import { resolveClaudeBin, augmentedPath, daemonClaudeArgs } from "../../lib/claude-bin.mjs";
+const CLAUDE_BIN = resolveClaudeBin();
+const CLAUDE_CLI_TIMEOUT_MS = 60_000;
+const SESSION_REGISTRY_PATH = join(AGENT_REPO_DIR, "state", "daemon", "session-router-registry.json");
+
+// Identity loaded from config/agent.json (canonical SOT). Fall back to a
+// neutral placeholder if the file isn't present — the daemon must still
+// run even on a partially-configured repo.
+let _agent = null;
+function loadAgent() {
+  if (_agent) return _agent;
+  try {
+    _agent = JSON.parse(readFileSync(join(AGENT_REPO_DIR, "config/agent.json"), "utf-8"));
+  } catch {
+    _agent = { firstName: "Agent", fullName: "Agent", title: "agent", principal: { fullName: "the principal" }, company: "the company" };
+  }
+  return _agent;
+}
+
+// Singleton router — lazily created on first generateResponse() call. The
+// scaffold's createRouter is async (eager registry read), so we cache the
+// promise and await it inside generateResponse.
+let routerPromise = null;
+function getRouter() {
+  if (!routerPromise) {
+    routerPromise = createRouter({ registryPath: SESSION_REGISTRY_PATH });
+  }
+  return routerPromise;
+}
+
+/**
+ * Translate a daemon-shaped item into the source/channel/thread_ts shape
+ * that session-router's routingKey() expects.
+ *
+ * Daemon items use {service, channel, thread_id, sender_email, ...}; the
+ * router's pure key fn was specced against {source, channel, thread_ts,
+ * thread_id, ...} per memo §4.2. This adapter is the seam between them.
+ *
+ * Returns null for items the router can't key (e.g. service we don't yet
+ * support, or missing required fields). Caller falls back to a fresh
+ * pre-minted UUID + EPHEMERAL semantics.
+ */
+function deriveRouterItem(item) {
+  if (!item || typeof item !== "object") return null;
+
+  if (item.service === "slack") {
+    const channel = item.channel || item.channel_id;
+    if (!channel) return null;
+    return {
+      source: "slack",
+      channel,
+      thread_ts: item.thread_id || item.thread_ts || null,
+      ts: item.ts || item.timestamp || null,
+    };
+  }
+
+  if (item.service === "gmail") {
+    const tid = item.thread_id || item.threadId;
+    if (!tid) return null;
+    return { source: "gmail", thread_id: tid };
+  }
+
+  if (item.service === "calendar") {
+    const eid = item.event_id || item.eventId;
+    if (!eid) return null;
+    return { source: "calendar", event_id: eid };
+  }
+
+  return null;
+}
+
+// Lazy token access — dotenv loads in daemon main before these are called
+function getSlackToken() {
+  return process.env.SLACK_USER_TOKEN || process.env.SLACK_BOT_TOKEN;
+}
+
+let cachedPreamble = null;
+
+// Spawn `claude --print` with the supplied system + user prompts and model.
+// Mirrors the pattern used in classifier.mjs:
+//   • child_process.spawn (not exec) — avoids shell-escape injection on
+//     potentially-hostile sender content.
+//   • System prompt rides on --append-system-prompt; user prompt is written
+//     to stdin and the pipe is closed.
+//   • Non-zero exit, timeout, spawn error or stdin write error all reject
+//     so the caller can surface the failure.
+//
+// Session-router wire-up (b2-b4, cycle 474): when the caller supplies a
+// `sessionId` (pre-minted UUID) and a `router` + `routingKey`, the spawn
+// adds `--session-id <uuid> --output-format json`, parses the one-line JSON
+// stdout into {session_id, result, is_error}, calls router.touch on success
+// and router.recordExit on close. Per b1 flag-verification report, NEVER
+// combine `--resume` with `--session-id` (not needed: pre-minting + reusing
+// the same UUID across spawns is the resume mechanism).
+//
+// @returns {Promise<{ text: string, jsonResult: object|null, exitCode: number }>}
+function runClaudeCLI(systemPrompt, userPrompt, model, opts = {}) {
+  const { sessionId = null, router = null, routingKey = null } = opts;
+
+  return new Promise((resolvePromise, rejectPromise) => {
+    const args = [
+      "--print",
+      ...sessionPermissionArgs({ source: "responder" }),
+      ...daemonClaudeArgs(),
+      "--model", model,
+      "--append-system-prompt", systemPrompt,
+    ];
+    if (sessionId) {
+      // --output-format json is only valid in combination with --print (per
+      // b1 report). We always pass --print above, so this is safe.
+      args.push("--session-id", sessionId, "--output-format", "json");
+    }
+
+    const proc = spawn(CLAUDE_BIN, args, {
+      stdio: ["pipe", "pipe", "pipe"],
+      // Force claude CLI onto keychain OAuth (Max subscription); strip any
+      // stale ANTHROPIC_API_KEY/AUTH_TOKEN inherited from the daemon env.
+      // Augment PATH so the subsession finds homebrew/nvm tools.
+      env: { ...process.env, PATH: augmentedPath(), ANTHROPIC_API_KEY: "", ANTHROPIC_AUTH_TOKEN: "" },
+    });
+
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      try { proc.kill("SIGTERM"); } catch (_) { /* noop */ }
+      setTimeout(() => { try { if (!proc.killed) proc.kill("SIGKILL"); } catch (_) { /* noop */ } }, 2000);
+      rejectPromise(new Error(`claude CLI timed out after ${CLAUDE_CLI_TIMEOUT_MS}ms`));
+    }, CLAUDE_CLI_TIMEOUT_MS);
+
+    proc.stdout.on("data", (chunk) => { stdout += chunk.toString(); });
+    proc.stderr.on("data", (chunk) => { stderr += chunk.toString(); });
+
+    proc.on("error", (err) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      rejectPromise(new Error(`claude CLI spawn error: ${err.message}`));
+    });
+
+    proc.on("close", (code) => {
+      // (b4) Always notify the router of the exit, regardless of whether
+      // the promise has already settled (timeout path) or not. recordExit
+      // is a no-op for keys the router has never touched, so the only
+      // cost is a registry write — which we want for non-zero exits so
+      // the next route() returns EPHEMERAL_REPLACE.
+      if (router && routingKey) {
+        // Fire-and-forget; recordExit is async but failure here must not
+        // mask the real result. Errors swallowed because the router has
+        // its own atomic-write semantics and bubbling here would crash
+        // the daemon over a non-critical bookkeeping write.
+        Promise.resolve(router.recordExit(routingKey, code)).catch((err) => {
+          console.warn(`[responder] router.recordExit failed for ${routingKey}: ${err.message}`);
+        });
+      }
+
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (code !== 0) {
+        const tail = (stderr || "").trim().slice(-500);
+        rejectPromise(new Error(`claude CLI exited ${code}: ${tail || "no stderr"}`));
+        return;
+      }
+
+      // (b3) If we asked for JSON, parse it. Otherwise return raw text.
+      if (sessionId) {
+        const trimmed = (stdout || "").trim();
+        try {
+          const parsed = JSON.parse(trimmed);
+          // Per b1 report: top-level `session_id` (snake_case UUID), `result`
+          // (text), `is_error` (bool). Top-level `uuid` is the message UUID,
+          // NOT the session id — do NOT use it.
+          resolvePromise({ text: parsed.result ?? "", jsonResult: parsed, exitCode: code });
+        } catch (parseErr) {
+          // Legacy fallback (rollout-safety): older CLIs or unexpected output
+          // shapes shouldn't crash the daemon. Log a warning, surface the raw
+          // text, and let the caller decide whether to call router.touch.
+          console.warn(`[responder] claude CLI JSON parse failed (sessionId=${sessionId}): ${parseErr.message} — falling back to raw stdout`);
+          resolvePromise({ text: trimmed, jsonResult: null, exitCode: code });
+        }
+      } else {
+        resolvePromise({ text: stdout, jsonResult: null, exitCode: code });
+      }
+    });
+
+    try {
+      proc.stdin.end(userPrompt, "utf8");
+    } catch (err) {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      rejectPromise(new Error(`claude CLI stdin write error: ${err.message}`));
+    }
+  });
+}
+
+function today() {
+  return new Date().toISOString().split("T")[0];
+}
+
+function logDir() {
+  const dir = join(AGENT_REPO_DIR, "logs", "daemon");
+  mkdirSync(dir, { recursive: true });
+  return dir;
+}
+
+function logResponse(entry) {
+  const path = join(logDir(), `${today()}-responses.jsonl`);
+  appendFileSync(path, JSON.stringify({ timestamp: new Date().toISOString(), ...entry }) + "\n");
+}
+
+/**
+ * Write an interaction record so future sessions can see this exchange.
+ * Both the incoming message and the agent's reply are logged.
+ */
+function logInteraction(item, responseText) {
+  if (!item || !item.sender || item.service !== "slack") return;
+  const senderSlug = item.sender.replace(/\s+/g, "-").toLowerCase();
+  const channelId = resolveSlackChannel(item);
+
+  // Write to both channel-ID and sender-slug directories
+  const dirs = [];
+  if (channelId) dirs.push(join(AGENT_REPO_DIR, "memory", "interactions", "slack", channelId));
+  dirs.push(join(AGENT_REPO_DIR, "memory", "interactions", "slack", `dm-${senderSlug}`));
+
+  const incomingEntry = {
+    ts: item.ts || item.timestamp || new Date().toISOString(),
+    from: item.sender,
+    channel: channelId || item.channel,
+    type: item.is_reply ? "thread_reply" : "dm",
+    content: item.content || "",
+    received_at: new Date().toISOString(),
+    classification: "quick_reply",
+    response_sent: true,
+  };
+
+  const responseEntry = {
+    ts: new Date().toISOString(),
+    from: loadAgent().firstName.toLowerCase(),
+    channel: channelId || item.channel,
+    type: "reply",
+    content: responseText,
+    sent_at: new Date().toISOString(),
+    via: "quick_reply_responder",
+  };
+
+  for (const dir of dirs) {
+    try {
+      mkdirSync(dir, { recursive: true });
+      const logPath = join(dir, `${today()}.jsonl`);
+      appendFileSync(logPath, JSON.stringify(incomingEntry) + "\n");
+      appendFileSync(logPath, JSON.stringify(responseEntry) + "\n");
+    } catch (err) {
+      console.warn(`[responder] Failed to log interaction to ${dir}: ${err.message}`);
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Identity preamble (cached)
+// ---------------------------------------------------------------------------
+
+function loadPreamble() {
+  if (cachedPreamble) return cachedPreamble;
+  try {
+    const raw = readFileSync(join(AGENT_REPO_DIR, "CLAUDE.md"), "utf-8");
+    // Extract just the identity and communication rules
+    const lines = raw.split("\n");
+    const sections = [];
+    let capturing = false;
+    const targets = ["## Identity", "## Company Context", "## Communication Rules"];
+    for (const line of lines) {
+      if (targets.some((h) => line.startsWith(h))) { capturing = true; sections.push(line); continue; }
+      if (capturing && /^## [A-Z]/.test(line) && !targets.some((h) => line.startsWith(h))) { capturing = false; continue; }
+      if (capturing) sections.push(line);
+    }
+    cachedPreamble = sections.join("\n").trim();
+    if (cachedPreamble.length < 100) cachedPreamble = FALLBACK_PREAMBLE;
+  } catch {
+    cachedPreamble = FALLBACK_PREAMBLE;
+  }
+  return cachedPreamble;
+}
+
+function buildFallbackPreamble() {
+  const a = loadAgent();
+  const principalName = a.principal?.fullName || "the principal";
+  const principalTitle = a.principal?.title || "principal";
+  return `You are ${a.fullName}, ${a.title} to ${principalName}, ${principalTitle} of ${a.company}.
+You operate as the autonomous executive command layer. Be concise, direct, and professional.
+For ${a.principal?.firstName || "principal"} messages: prioritise speed and directness. For others: be warm but efficient.`;
+}
+const FALLBACK_PREAMBLE = buildFallbackPreamble();
+
+// ---------------------------------------------------------------------------
+// Load user profile for context
+// ---------------------------------------------------------------------------
+
+function loadUserProfile(sender) {
+  try {
+    const profileName = sender.replace(/\s+/g, "-").toLowerCase();
+    const path = join(AGENT_REPO_DIR, "memory", "profiles", "users", `${profileName}.yaml`);
+    return readFileSync(path, "utf-8");
+  } catch {
+    return null;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Load recent conversation history for context
+// ---------------------------------------------------------------------------
+
+function loadConversationHistory(item) {
+  if (!item || !item.sender) return null;
+
+  const senderSlug = item.sender.replace(/\s+/g, "-").toLowerCase();
+  const channelId = resolveSlackChannel(item);
+
+  const candidateDirs = [];
+  if (channelId) candidateDirs.push(join(AGENT_REPO_DIR, "memory", "interactions", "slack", channelId));
+  candidateDirs.push(join(AGENT_REPO_DIR, "memory", "interactions", "slack", `dm-${senderSlug}`));
+
+  const entries = [];
+  for (const dir of candidateDirs) {
+    try {
+      const files = readdirSync(dir)
+        .filter((f) => f.endsWith(".jsonl"))
+        .sort().reverse().slice(0, 2);
+      for (const file of files) {
+        try {
+          const content = readFileSync(join(dir, file), "utf-8").trim();
+          if (!content) continue;
+          for (const line of content.split("\n").filter(Boolean)) {
+            try { entries.push(JSON.parse(line)); } catch {}
+          }
+        } catch {}
+      }
+    } catch {}
+  }
+
+  if (entries.length === 0) return null;
+
+  entries.sort((a, b) => (a.ts || a.received_at || "").localeCompare(b.ts || b.received_at || ""));
+  const recent = entries.slice(-15);
+
+  return recent.map((e) => {
+    const from = e.from || e.user_name || e.sender || "unknown";
+    const text = e.content || e.text || "";
+    return `[${e.received_at || e.ts || ""}] ${from}: ${text.substring(0, 200)}`;
+  }).join("\n");
+}
+
+// ---------------------------------------------------------------------------
+// Generate response text via `claude --print` CLI
+// ---------------------------------------------------------------------------
+//
+// Indirection so a test can supply deterministic reply text WITHOUT spawning a
+// `claude` child (mirrors the dispatcher's _spawn seam). Production default is
+// the real generator, so behaviour is unchanged. The public senders call
+// generateResponse() through this slot.
+let _generateResponse;
+/**
+ * Test seam: replace the response generator. Pass a function `(item,
+ * classResult, isHolding) => Promise<string>` to force reply text; pass nothing
+ * to restore the real CLI-backed generator. Returns a restore fn.
+ */
+export function setGenerateResponseForTests(fn) {
+  const prev = _generateResponse;
+  _generateResponse = typeof fn === "function" ? fn : realGenerateResponse;
+  return () => { _generateResponse = prev; };
+}
+
+async function realGenerateResponse(item, classResult, isHolding = false) {
+  const preamble = loadPreamble();
+  const profile = loadUserProfile(item.sender);
+  // Use Sonnet for holding messages (speed matters), but the classifier's
+  // recommended model for actual replies (Opus for CEO, Sonnet for routine)
+  const model = isHolding ? SONNET_MODEL : (classResult.model === "opus" ? "claude-opus-4-6" : SONNET_MODEL);
+
+  let systemPrompt;
+  if (isHolding) {
+    systemPrompt = `${preamble}
+
+You are generating a brief acknowledgment/holding message. The sender has made a request that requires complex work. You need to:
+1. Acknowledge receipt of their message
+2. Briefly confirm what you understand they need
+3. Let them know you're working on it
+4. Give a rough timeframe if appropriate (e.g., "I'll have this ready within the hour")
+
+Keep it to 2-3 sentences max. Be warm but efficient. Match the sender's communication style.
+Do NOT use phrases like "I'm on it!" or overly casual language. Be professional.
+${profile ? `\nSender profile:\n${profile}` : ""}`;
+  } else {
+    systemPrompt = `${preamble}
+
+You are generating a direct response to this message. Be concise and actionable.
+If it's a question, answer it. If it's a request, confirm and describe what you'll do or have done.
+If it's informational, acknowledge appropriately.
+
+Keep responses focused — 1-4 sentences for simple items, up to a short paragraph for more nuanced ones.
+Match the sender's tone and urgency level.
+${profile ? `\nSender profile:\n${profile}` : ""}`;
+  }
+
+  const conversationHistory = loadConversationHistory(item);
+
+  const userContent = [
+    `From: ${item.sender} (${item.sender_privilege || "unknown"})`,
+    `Via: ${item.service} / ${item.channel}`,
+    item.subject ? `Subject: ${item.subject}` : null,
+    conversationHistory ? `\nRecent conversation history:\n${conversationHistory}` : null,
+    `\nCurrent message:\n${item.content || "(empty)"}`,
+    item.thread_context ? `\nThread context:\n${item.thread_context}` : null,
+    `\nClassification: ${classResult.summary}`,
+  ].filter(Boolean).join("\n");
+
+  // (b2) Session-router decision. Compute the routing key from a daemon→router
+  // adapter view of the item. If the item can't be keyed (unknown service,
+  // missing channel/thread), fall back to pure ephemeral with no router calls.
+  const router = await getRouter();
+  const routerItem = deriveRouterItem(item);
+  let key = null;
+  let sessionId = null;
+  if (routerItem) {
+    try {
+      key = deriveRoutingKey(routerItem);
+      const decision = router.route(key);
+      if (decision.decision === "RESUME" && decision.resumeId) {
+        sessionId = decision.resumeId;
+      } else {
+        // EPHEMERAL or EPHEMERAL_REPLACE — pre-mint a fresh UUID. Reusing
+        // the same key on next call (with a different sessionId) is fine;
+        // touch() will overwrite the registry entry.
+        sessionId = randomUUID();
+      }
+    } catch (err) {
+      // routingKey() throws on malformed items. Don't crash — fall back to
+      // pure ephemeral with no session-router participation.
+      console.warn(`[responder] routingKey derivation failed: ${err.message} — falling back to non-routed ephemeral`);
+      key = null;
+      sessionId = null;
+    }
+  }
+
+  const cliResult = await runClaudeCLI(systemPrompt, userContent, model, {
+    sessionId,
+    router: key ? router : null,
+    routingKey: key,
+  });
+
+  const text = (cliResult.text || "").trim();
+  if (!text) {
+    throw new Error("claude CLI returned empty result text in generateResponse");
+  }
+
+  // (b3) On success, touch the registry with the CLI-resolved session_id so
+  // the next call routed to this key gets a RESUME decision. Skip touch on
+  // is_error responses or when JSON parsing failed (legacy fallback path).
+  if (key && cliResult.jsonResult && cliResult.jsonResult.is_error !== true) {
+    const claudeSessionId = cliResult.jsonResult.session_id || sessionId;
+    try {
+      await router.touch(key, { claudeSessionId, model });
+    } catch (err) {
+      console.warn(`[responder] router.touch failed for ${key}: ${err.message}`);
+    }
+  }
+
+  return text;
+}
+
+// Default the generator slot to the real CLI-backed implementation. (Declared
+// after the function so the binding exists; setGenerateResponseForTests swaps it.)
+_generateResponse = realGenerateResponse;
+
+// ---------------------------------------------------------------------------
+// Lightweight outbound validation (inline — no Python dependency)
+// Catches the most critical issues before sending quick replies
+// ---------------------------------------------------------------------------
+
+function validateQuickReply(text) {
+  const issues = [];
+  const lower = text.toLowerCase();
+
+  // Rule 1: AI self-disclosure — the agent must never reveal she/he is AI
+  const aiPatterns = [
+    /\bi am an? ai\b/i, /\bi'?m an? ai\b/i, /\bas an ai\b/i,
+    /\blanguage model\b/i, /\bartificial intelligence\b/i,
+    /\bi am a? ?virtual\b/i, /\bi don'?t have (?:feelings|emotions|a body)\b/i,
+    /\bclaude\b/i, /\banthropic\b/i, /\bchatbot\b/i,
+  ];
+  for (const p of aiPatterns) {
+    if (p.test(text)) {
+      issues.push({ rule: "ai_disclosure", severity: "block", detail: `Matched: ${p}` });
+      break;
+    }
+  }
+
+  // Rule 2: No local file paths in outbound messages
+  if (/(?:outputs|docs|knowledge|memory|state|scripts|config)\/[^\s]+/.test(text)) {
+    issues.push({ rule: "local_path_reference", severity: "block", detail: "Message references a local file path" });
+  }
+
+  // Rule 3: the agent should not schedule themselves for in-person meetings
+  const meetingPatterns = [
+    /\bi(?:'ll| will) (?:come|attend|be there|join (?:you |the meeting )?in person)\b/i,
+    /\blet'?s meet (?:at|in)\b/i,
+    /\bi(?:'ll| will) (?:swing by|pop by|stop by|come by)\b/i,
+  ];
+  for (const p of meetingPatterns) {
+    if (p.test(text)) {
+      issues.push({ rule: "agent_inperson", severity: "block", detail: `Matched: ${p}` });
+      break;
+    }
+  }
+
+  return issues;
+}
+
+// ---------------------------------------------------------------------------
+// Send via Slack API
+// ---------------------------------------------------------------------------
+
+async function sendSlackMessage(channel, text, threadTs = null) {
+  // Unified send-gate (P0-3): the daemon quick-reply/holding path must pass the
+  // same chokepoint as the shell senders + BaseAdapter — banned-phrase, AI
+  // disclosure, and information-barrier screening at one place. Block on deny.
+  try {
+    const gate = await screenOutbound({ channel: "slack", recipient: channel, text, agentRoot: AGENT_REPO_DIR });
+    if (gate && gate.allow === false) {
+      throw new Error(`send-gate blocked Slack reply: ${gate.reason}`);
+    }
+  } catch (err) {
+    if (/send-gate blocked/.test(err.message)) throw err; // a real block propagates
+    // gate infra error (module/policy unreadable): fail-open for internal Slack
+    // channels (matches send-gate's internal posture) — never silently drop.
+    console.warn(`[responder] send-gate check errored (allowing internal Slack): ${err.message}`);
+    // Observability: the send-gate just FAILED OPEN — surface it on the lifecycle
+    // bus so the daemon's onGuardFail subscriber counts it (the bus's one real
+    // consumer). Fire-and-forget; emit is fully isolated and never throws.
+    try {
+      Promise.resolve(getHookBus().emit("onGuardFail", { guard: "send_gate", channel: "slack", recipient: channel, reason: err.message, failed_open: true }))
+        .catch(() => { /* bus emit is isolated; never propagate */ });
+    } catch { /* never let telemetry break the send path */ }
+  }
+
+  // Always use user token — bot tokens can't access DM channels
+  const token = getSlackToken();
+  if (!token) throw new Error("No Slack token available (set SLACK_USER_TOKEN in .env)");
+
+  const body = {
+    channel,
+    text,
+    ...(threadTs ? { thread_ts: threadTs } : {}),
+  };
+
+  const res = await fetch("https://slack.com/api/chat.postMessage", {
+    method: "POST",
+    headers: {
+      "Authorization": `Bearer ${token}`,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify(body),
+  });
+
+  const data = await res.json();
+  if (!data.ok) {
+    throw new Error(`Slack API error: ${data.error}`);
+  }
+
+  return data;
+}
+
+// ---------------------------------------------------------------------------
+// Send via Gmail API (draft or send)
+// Currently logs the response — full Gmail send integration can be added
+// ---------------------------------------------------------------------------
+
+async function sendGmailResponse(item, text) {
+  const to = item.sender_email || item.sender;
+  const subject = `Re: ${item.subject || "(no subject)"}`;
+  const sendScript = join(AGENT_REPO_DIR, "scripts", "send-email-threaded.py");
+
+  try {
+    const args = [sendScript, to, subject, text];
+    if (item.subject) {
+      args.push("--reply-to-subject", item.subject);
+    }
+
+    execFileSync("python3", args, {
+      cwd: AGENT_REPO_DIR,
+      timeout: 30000,
+      encoding: "utf-8",
+      env: { ...process.env },
+    });
+
+    return { sent: true, via: "smtp", to };
+  } catch (err) {
+    console.error(`[responder] Gmail send failed for ${to}: ${err.message}`);
+    // Fall back to draft file so the response is not lost
+    const draftPath = join(AGENT_REPO_DIR, "outputs", "drafts",
+      `${today()}-quick-reply-${item.sender.replace(/[^a-z0-9]/gi, "-")}.md`);
+    mkdirSync(join(AGENT_REPO_DIR, "outputs", "drafts"), { recursive: true });
+    const content = `# Quick Reply Draft (SEND FAILED)\n\nTo: ${to}\nSubject: ${subject}\nGenerated: ${new Date().toISOString()}\nError: ${err.message}\n\n---\n\n${text}\n`;
+    writeFileSync(draftPath, content);
+    return { sent: false, via: "draft_fallback", draft_path: draftPath, error: err.message };
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Resolve Slack channel ID from item
+// ---------------------------------------------------------------------------
+
+function resolveSlackChannel(item) {
+  // Direct channel ID (starts with D for DM, C for channel)
+  if (item.channel && /^[DC][A-Z0-9]{8,}$/.test(item.channel)) return item.channel;
+  if (item.channel_id) return item.channel_id;
+
+  // Extract from raw_ref format: "slack:D099N1JGKRQ:1775331885.690669"
+  if (item.raw_ref) {
+    const match = item.raw_ref.match(/slack:([DC][A-Z0-9]+):/);
+    if (match) return match[1];
+    // Also try bare channel ID in raw_ref
+    const bare = item.raw_ref.match(/^([DC][A-Z0-9]{8,})$/);
+    if (bare) return bare[1];
+  }
+
+  return null;
+}
+
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+
+/**
+ * Send a quick response to a simple item. No claude --print session needed.
+ * Uses Sonnet API to generate text, then posts directly via Slack/Gmail.
+ *
+ * @returns {{ sent: boolean, text: string, channel: string }} result
+ */
+export async function sendQuickResponse(item, classResult) {
+  const startTime = Date.now();
+
+  try {
+    const text = await _generateResponse(item, classResult, false);
+
+    // Validate before sending — block replies that violate critical rules
+    const validationIssues = validateQuickReply(text);
+    const blocked = validationIssues.filter((i) => i.severity === "block");
+    if (blocked.length > 0) {
+      console.warn(`[responder] Quick reply BLOCKED for ${item.sender}: ${blocked.map((b) => b.rule).join(", ")}`);
+      logResponse({
+        type: "quick_response_blocked",
+        sender: item.sender,
+        service: item.service,
+        issues: blocked,
+        text_preview: text.substring(0, 100),
+      });
+      // Observability: a send-gate / validation block — count it (never throws).
+      counters.bump("send.blocked", { stage: "validation", service: item.service, rules: blocked.map((b) => b.rule) });
+      // Fall through to full session which has richer validation
+      return { sent: false, text: null, blocked: true, issues: blocked };
+    }
+
+    let sendResult = { sent: false };
+
+    if (item.service === "slack") {
+      const channel = resolveSlackChannel(item);
+      if (channel) {
+        // Check sent-message registry for duplicates
+        const threadTs = item.thread_id || null;
+        const dupCheck = checkRecentlySent(channel, threadTs, "quick_reply");
+        if (!dupCheck.allowed) {
+          console.log(`[responder] Quick reply blocked by sent-registry: ${dupCheck.reason}`);
+          logResponse({ type: "quick_response_dedup_blocked", sender: item.sender, reason: dupCheck.reason });
+          // Observability: a send-gate (dedup registry) block — count it.
+          counters.bump("send.blocked", { stage: "dedup", service: "slack", reason: dupCheck.reason });
+          return { sent: false, text: null, blocked: true, reason: dupCheck.reason };
+        }
+
+        await sendSlackMessage(channel, text, threadTs);
+        registerSent(channel, threadTs, "quick_reply", "quick-responder", text.substring(0, 100));
+        sendResult = { sent: true, channel, via: "slack_api" };
+        // Observability: a quick reply actually left the agent — interaction-end
+        // on the quick path. Ambient trace_id (set by the daemon at item_received)
+        // correlates it; item.trace_id is carried explicitly as a belt-and-braces
+        // hand-off. Never throws.
+        emitEvent({ type: EVENT_TYPES.SENT, trace_id: item.trace_id || undefined, attrs: { service: "slack", channel, via: "quick_reply" } });
+        // Log interaction to memory so future sessions have context
+        logInteraction(item, text);
+      } else {
+        console.warn(`[responder] Could not resolve Slack channel for ${item.sender} (channel: ${item.channel}, raw_ref: ${item.raw_ref})`);
+        sendResult = { sent: false, reason: "no_channel_id" };
+      }
+    } else if (item.service === "gmail") {
+      const gmailResult = await sendGmailResponse(item, text);
+      sendResult = { sent: gmailResult.sent, via: gmailResult.via, ...(gmailResult.draft_path ? { draft_path: gmailResult.draft_path } : {}), ...(gmailResult.to ? { to: gmailResult.to } : {}) };
+      if (gmailResult.sent) {
+        emitEvent({ type: EVENT_TYPES.SENT, trace_id: item.trace_id || undefined, attrs: { service: "gmail", via: gmailResult.via } });
+        logInteraction(item, text);
+      }
+    }
+
+    const duration = Date.now() - startTime;
+    logResponse({
+      type: "quick_response",
+      sender: item.sender,
+      service: item.service,
+      duration_ms: duration,
+      text_length: text.length,
+      ...sendResult,
+    });
+
+    console.log(`[responder] Quick reply to ${item.sender} (${duration}ms) — ${sendResult.via || "not_sent"}`);
+    return { sent: sendResult.sent, text, ...sendResult };
+
+  } catch (err) {
+    console.error(`[responder] Quick response failed for ${item.sender}:`, err.message);
+    logResponse({ type: "quick_response_error", sender: item.sender, error: err.message });
+    return { sent: false, text: null, error: err.message };
+  }
+}
+
+/**
+ * Send a holding message for a complex item, then return the message text
+ * so it can be included in the dispatched session's prompt.
+ *
+ * @returns {{ sent: boolean, holdingText: string }} result
+ */
+export async function sendHoldingMessage(item, classResult) {
+  const startTime = Date.now();
+
+  try {
+    const text = await _generateResponse(item, classResult, true);
+    let sendResult = { sent: false };
+
+    if (item.service === "slack") {
+      const channel = resolveSlackChannel(item);
+      if (channel) {
+        // Check sent-message registry for duplicates
+        const threadTs = item.thread_id || null;
+        const dupCheck = checkRecentlySent(channel, threadTs, "holding");
+        if (!dupCheck.allowed) {
+          console.log(`[responder] Holding message blocked by sent-registry: ${dupCheck.reason}`);
+          logResponse({ type: "holding_dedup_blocked", sender: item.sender, reason: dupCheck.reason });
+          counters.bump("send.blocked", { stage: "dedup", service: "slack", kind: "holding", reason: dupCheck.reason });
+          return { sent: false, holdingText: null, blocked: true, reason: dupCheck.reason };
+        }
+
+        await sendSlackMessage(channel, text, threadTs);
+        registerSent(channel, threadTs, "holding", "quick-responder", text.substring(0, 100));
+        sendResult = { sent: true, channel, via: "slack_api" };
+      } else {
+        console.warn(`[responder] Could not resolve Slack channel for holding msg to ${item.sender} (channel: ${item.channel}, raw_ref: ${item.raw_ref})`);
+      }
+    } else if (item.service === "gmail") {
+      const gmailResult = await sendGmailResponse(item, text);
+      sendResult = { sent: gmailResult.sent, via: gmailResult.via, ...(gmailResult.draft_path ? { draft_path: gmailResult.draft_path } : {}), ...(gmailResult.to ? { to: gmailResult.to } : {}) };
+    }
+
+    const duration = Date.now() - startTime;
+    logResponse({
+      type: "holding_message",
+      sender: item.sender,
+      service: item.service,
+      duration_ms: duration,
+      text_length: text.length,
+      ...sendResult,
+    });
+
+    console.log(`[responder] Holding msg to ${item.sender} (${duration}ms) — ${sendResult.via || "not_sent"}`);
+    return { sent: sendResult.sent, holdingText: text, ...sendResult };
+
+  } catch (err) {
+    console.error(`[responder] Holding message failed for ${item.sender}:`, err.message);
+    logResponse({ type: "holding_message_error", sender: item.sender, error: err.message });
+    return { sent: false, holdingText: null, error: err.message };
+  }
+}
+
+/**
+ * Determine if an item can be handled with a quick response
+ * (no session needed) vs requiring a full claude --print session.
+ *
+ * Critical/high-priority messages and CEO DMs MUST go through full sessions
+ * so they get tool access, conversation history, and memory lookup.
+ * Quick replies are only for truly simple, low-stakes messages.
+ */
+export function isQuickReply(classResult) {
+  // These always need full sessions — never quick reply
+  if (classResult.action === "research") return false;
+  if (classResult.action === "draft") return false;
+  if (classResult.action === "queue") return false;
+
+  // Critical and high-priority items need full sessions for proper context
+  if (classResult.priority === "critical") return false;
+  if (classResult.priority === "high") return false;
+
+  // Opus-routed items are complex by definition — need full sessions
+  if (classResult.model === "opus") return false;
+
+  // Only normal/low priority simple responses get quick reply path
+  if (classResult.action === "respond") return true;
+  if (classResult.action === "archive") return true;
+  if (classResult.action === "ignore") return true;
+
+  return false;
+}