@cohortapp/agent-sdk 2.3.1 → 2.3.2

package/scripts/poller/inbox-scan-poller.test.mjs

@@ -16,6 +16,7 @@ import { join } from "node:path";
 import { parseInboxItemYaml, scanInbox } from "./inbox-scan-poller.mjs";
 import { markDispatched, markInboxProcessed, writeInboxItem } from "./utils.mjs";
 import { eventToInboxItem } from "../../lib/channels/inbox-item.mjs";
+import { outcomeSourceShareable } from "../daemon/session-outcomes.mjs";
 
 async function makeRoot() {
   const p = join(tmpdir(), `inbox-scan-test-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`);
@@ -229,3 +230,66 @@ raw_ref: "${item.raw_ref || ""}"
   if (item.kind) yaml += `kind: "${item.kind}"\n`;
   return yaml;
 }
+
+// ---------------------------------------------------------------------------
+// CONFIDENTIALITY — the privacy signal must survive the YAML round-trip
+// ---------------------------------------------------------------------------
+//
+// The daemon's outcome gate (scripts/daemon/session-outcomes.mjs) is fail-closed
+// and admits a turn's commitments as ORG-VISIBLE only on a POSITIVE public
+// signal, because Slack's conversation-ID prefix is not a reliable type
+// indicator — private channels carry `C…` ids too. That signal is minted at
+// ingest and reaches the daemon only through this writer/reader pair, so the
+// round-trip is part of the security boundary and is tested as such.
+
+test("privacy signals survive writeInboxItem → scanInbox, and drive the outcome gate", async () => {
+  const root = await makeRoot();
+  try {
+    const base = {
+      service: "slack",
+      sender: "casey",
+      sender_privilege: "unknown",
+      timestamp: "2026-06-09T10:00:00.000Z",
+      content: "hello",
+      thread_id: "",
+      is_reply: false,
+      priority_signals: { from_ceo: false, tagged_urgent: false, contains_deadline: false, mentions_agent: true },
+    };
+    writeInboxItem("slack", {
+      ...base, id: "pub-1", channel: "general", channel_id: "C0GENERAL",
+      channel_type: "channel", is_private: false, is_dm: false,
+      subject: "#general", raw_ref: "slack:C0GENERAL:1",
+    }, root);
+    // A PRIVATE channel that Slack minted with a `C…` id — the case the old
+    // prefix test admitted, and the leak this whole chain exists to stop.
+    writeInboxItem("slack", {
+      ...base, id: "priv-1", channel: "leadership", channel_id: "C0LEADERSHIP",
+      channel_type: "group", is_private: true, is_dm: false,
+      subject: "#leadership", raw_ref: "slack:C0LEADERSHIP:2",
+    }, root);
+    // An item minted before/without any privacy resolution.
+    writeInboxItem("slack", {
+      ...base, id: "unk-1", channel: "mystery", channel_id: "C0MYSTERY",
+      subject: "#mystery", raw_ref: "slack:C0MYSTERY:3",
+    }, root);
+
+    const byId = Object.fromEntries(
+      scanInbox("slack", { agentRoot: root }).items.map((i) => [i.id, i])
+    );
+    assert.equal(Object.keys(byId).length, 3);
+
+    assert.equal(byId["pub-1"].channel_type, "channel");
+    assert.equal(byId["pub-1"].is_private, false, "an explicit false must survive as false, not vanish");
+    assert.equal(byId["priv-1"].channel_type, "group");
+    assert.equal(byId["priv-1"].is_private, true);
+    assert.equal(
+      "is_private" in byId["unk-1"], false,
+      "an unresolved item must carry NO privacy field — a defaulted `false` would forge a public verdict"
+    );
+    assert.equal("channel_type" in byId["unk-1"], false);
+
+    assert.deepEqual(outcomeSourceShareable(byId["pub-1"]), { shareable: true, reason: "public-channel" });
+    assert.deepEqual(outcomeSourceShareable(byId["priv-1"]), { shareable: false, reason: "private-channel" });
+    assert.deepEqual(outcomeSourceShareable(byId["unk-1"]), { shareable: false, reason: "privacy-unknown" });
+  } finally { await rmRoot(root); }
+});

package/scripts/poller/slack-cloud-relay-client.mjs

@@ -306,6 +306,11 @@ function handleWebhook(webhook, identity, peerSlackIds) {
   const payload = {
     ...webhook,
     channel_id: event.channel || "",
+    // CONFIDENTIALITY: carry Slack's conversation type through to the reader
+    // (slack-poller's events-JSON branch). The id prefix is not a reliable type
+    // indicator, so this is the only signal that lets the daemon's outcome gate
+    // establish a source as public. Omitted when Slack didn't send one.
+    ...(event.channel_type ? { channel_type: event.channel_type } : {}),
     received_at: new Date().toISOString(),
     source: "cloud-relay",
   };

package/scripts/poller/slack-poller.mjs

@@ -12,6 +12,9 @@ import {
   AGENT_REPO_DIR,
   extractSlackAttachments,
   downloadSlackAttachment,
+  // One shared decoder for Slack's `channel_type` → the confidentiality fields
+  // (channel_type / is_private / is_dm) every ingest path stamps on an item.
+  slackChannelPrivacy,
 } from "./utils.mjs";
 
 import {
@@ -82,6 +85,12 @@ async function getMonitoredChannels() {
         id: c.id,
         name: c.name || c.id,
         priority: CHANNEL_PRIORITY_OVERRIDES[c.name] || "normal",
+        // CONFIDENTIALITY. `types` includes private_channel, and a private
+        // channel can carry a `C…` id — the prefix proves nothing. Keep Slack's
+        // own verdict so items minted from this channel can carry it downstream
+        // to the daemon's fail-closed outcome gate. Only a real boolean counts;
+        // anything else stays undefined (unknown ⇒ not established as public).
+        is_private: typeof c.is_private === "boolean" ? c.is_private : undefined,
       }));
     channelsCachedAt = Date.now();
     return cachedChannels;
@@ -318,6 +327,9 @@ export async function pollSlack() {
             },
             raw_ref: rawRef,
             channel_id: im.id,
+            channel_type: "im",
+            is_private: true,
+            is_dm: true,
           });
         }
       }
@@ -411,6 +423,12 @@ export async function pollSlack() {
           thread_id: msg.thread_ts || "",
           thread_context: channelThreadContext,
           is_reply: !!msg.thread_ts,
+          // Slack's own privacy verdict (see getMonitoredChannels); undefined
+          // when unknown so the downstream gate stays fail-closed.
+          is_private: channel.is_private,
+          channel_type: typeof channel.is_private === "boolean"
+            ? (channel.is_private ? "group" : "channel")
+            : undefined,
           attachments: attachments.length > 0 ? attachments : undefined,
           priority_signals: {
             from_ceo: isCeo,
@@ -538,6 +556,9 @@ export async function pollSlack() {
               mentions_agent: true,
             },
             raw_ref: `slack:${im.id}:${msg.ts}`,
+            channel_type: "im",
+            is_private: true,
+            is_dm: true,
           });
         }
 
@@ -722,6 +743,13 @@ export async function pollSlack() {
               mentions_agent: isDmThread || (loadAgent().firstName && new RegExp(loadAgent().firstName, "i").test(replyText)),
             },
             raw_ref: `slack:${channelId}:${reply.ts}`,
+            // Same privacy verdict as the parent conversation: an im is private
+            // by construction, a channel carries whatever Slack said it is.
+            ...(isDmThread
+              ? { channel_type: "im", is_private: true, is_dm: true }
+              : (chanInfo && typeof chanInfo.is_private === "boolean"
+                  ? { channel_type: chanInfo.is_private ? "group" : "channel", is_private: chanInfo.is_private }
+                  : {})),
           });
         }
       } catch (err) {
@@ -824,6 +852,10 @@ export async function pollSlack() {
             mentions_agent: loadAgent().firstName ? new RegExp(loadAgent().firstName, "i").test(content) : false,
           },
           raw_ref: eventRef,
+          // Slack's conversation type off the delivered envelope — the only
+          // dependable privacy signal (the id prefix is not one). Absent on
+          // older payloads, in which case we assert nothing.
+          ...slackChannelPrivacy(data.channel_type || evt.channel_type),
           _inbox_file: file,
         });
 

package/scripts/poller/slack-socket-mode.mjs

@@ -37,7 +37,7 @@ import { existsSync, readFileSync, mkdirSync, appendFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
-import { writeInboxItem, resolvePrivilege, resolveName, AGENT_REPO_DIR } from "./utils.mjs";
+import { writeInboxItem, resolvePrivilege, resolveName, slackChannelPrivacy, AGENT_REPO_DIR } from "./utils.mjs";
 import { handleSlashCommand, postSlashResponse } from "./lib/slash-command-handlers.mjs";
 
 /**
@@ -276,6 +276,20 @@ export function shouldKeepEvent(envelope, { ownSlackId, peerSlackIds, reactions,
 // Translation — Slack envelope → poller-compatible inbox item
 // ---------------------------------------------------------------------------
 
+/**
+ * CONFIDENTIALITY SIGNAL. Slack's conversation-ID prefix is NOT a reliable type
+ * indicator — a private channel can carry a `C…` id, and only `D` for a DM is
+ * dependable. The dependable signal is the event envelope's own `channel_type`,
+ * which this listener used to drop on the floor. We now carry it onto the inbox
+ * item, together with the booleans it implies, because the daemon's outcome gate
+ * (scripts/daemon/session-outcomes.mjs `outcomeSourceShareable`) requires a
+ * POSITIVE public signal before a turn's commitments may become org-visible.
+ *
+ * Re-exported from ./utils.mjs, the one place the decoding is defined (the
+ * Web-API poller stamps the same fields).
+ */
+export { slackChannelPrivacy } from "./utils.mjs";
+
 /**
  * Convert a Slack Socket Mode envelope to the same inbox-item shape that
  * `slack-poller.mjs` produces. Pure function; all I/O happens at the caller.
@@ -307,6 +321,9 @@ export function eventToInboxItem(envelope, { ownSlackId, principalSlackId, agent
     const channelLabel = isDm ? `dm/${senderName}` : channelId;
     const verb = event.type === "reaction_added" ? "added" : "removed";
     const targetText = typeof threadContext === "string" ? threadContext : "";
+    // A reaction envelope carries no `channel_type`; only the `D` prefix is
+    // dependable, so that is all we assert (and only in the private direction).
+    const reactionPrivacy = isDm ? { channel_type: "im", is_private: true, is_dm: true } : {};
     return {
       id: `${targetTs.replace(".", "-")}-reaction-${reactor}`,
       service: "slack",
@@ -329,6 +346,7 @@ export function eventToInboxItem(envelope, { ownSlackId, principalSlackId, agent
       raw_ref: `slack:${channelId}:${targetTs}:reaction`,
       source: "socket-mode",
       kind: "reaction",
+      ...reactionPrivacy,
     };
   }
 
@@ -338,6 +356,12 @@ export function eventToInboxItem(envelope, { ownSlackId, principalSlackId, agent
   const channelId = event.channel || "";
   const threadTs = event.thread_ts || "";
   const isReply = !!threadTs && threadTs !== ts;
+  // Slack's own conversation type, when the envelope carries one. See
+  // `slackChannelPrivacy` — this, not the id prefix, is the privacy signal.
+  const privacy = slackChannelPrivacy(event.channel_type);
+  // Routing/labelling stays on the historical `D`-prefix test (an `im` always
+  // has a `D` id anyway, and promoting an `mpim` to "DM" would change who the
+  // agent auto-replies to). `privacy` only informs the confidentiality fields.
   const isDm = typeof channelId === "string" && channelId.startsWith("D");
 
   // Friendly labels. We can't resolve a channel name without an API call
@@ -383,6 +407,8 @@ export function eventToInboxItem(envelope, { ownSlackId, principalSlackId, agent
     },
     raw_ref: `slack:${channelId}:${ts}`,
     source: "socket-mode",
+    // channel_type / is_private / is_dm — only when Slack actually told us.
+    ...privacy,
   };
   if (isCc) item.kind = "channel_cc";
   return item;

package/scripts/poller/slack-socket-mode.test.mjs

@@ -279,6 +279,58 @@ test("eventToInboxItem: thread reply preserves thread_id + is_reply", () => {
   assert.equal(item.thread_id, "1735689500.000100");
 });
 
+test("eventToInboxItem: carries Slack's channel_type as the privacy signal", () => {
+  // CONFIDENTIALITY. The listener used to drop `event.channel_type` entirely and
+  // derive privacy from the id prefix alone — but Slack mints `C…` ids for
+  // PRIVATE channels too, so downstream (the daemon's fail-closed outcome gate)
+  // had nothing dependable to admit on. Every kept event now carries the type,
+  // and the booleans it implies, verbatim off the envelope.
+  const mk = (channel, channelType) => eventToInboxItem(
+    makeEnvelope({
+      event: {
+        user: HUMAN_SLACK_ID,
+        channel,
+        ...(channelType === undefined ? {} : { channel_type: channelType }),
+        text: `<@${AGENT_SLACK_ID}> noted`,
+        ts: "1735689700.002000",
+      },
+    }),
+    { ownSlackId: AGENT_SLACK_ID, principalSlackId: PRINCIPAL_SLACK_ID, agentFirstName: "Ravi" }
+  );
+
+  const pub = mk("C0CHANNEL1", "channel");
+  assert.equal(pub.channel_type, "channel");
+  assert.equal(pub.is_private, false);
+  assert.equal(pub.is_dm, false);
+
+  // A private channel WITH a public-looking `C…` id — the leak vector.
+  const priv = mk("C0PRIVATE1", "group");
+  assert.equal(priv.channel_type, "group");
+  assert.equal(priv.is_private, true);
+
+  const mpim = mk("C0MPIM0001", "mpim");
+  assert.equal(mpim.channel_type, "mpim");
+  assert.equal(mpim.is_private, true);
+  assert.equal(mpim.is_dm, true);
+  assert.equal(mpim.channel, "C0MPIM0001", "an mpim is still routed as a channel, not promoted to a DM");
+
+  const im = mk("DABCDEF01", "im");
+  assert.equal(im.channel_type, "im");
+  assert.equal(im.is_private, true);
+  assert.equal(im.is_dm, true);
+
+  // No type on the envelope ⇒ assert NOTHING (a defaulted `is_private:false`
+  // would forge a public verdict the gate then admits on).
+  const unknown = mk("C0CHANNEL1", undefined);
+  assert.equal("channel_type" in unknown, false);
+  assert.equal("is_private" in unknown, false);
+  assert.equal("is_dm" in unknown, false);
+
+  // An unrecognised type is likewise not decoded into a verdict.
+  const weird = mk("C0CHANNEL1", "external_shared");
+  assert.equal("is_private" in weird, false);
+});
+
 test("eventToInboxItem: first-name mention (no @) still flips mentions_agent", () => {
   // "Hey Ravi, can you …" in a channel — no explicit @-mention but the
   // agent's first name appears. The poller uses this same heuristic.

package/scripts/poller/utils.mjs

@@ -10,6 +10,35 @@ export const AGENT_REPO_DIR = process.env.AGENT_DIR || join(__dirname, "../..");
 export const SOPHIE_AI_DIR = AGENT_REPO_DIR;
 export const ATTACHMENTS_DIR = join(AGENT_REPO_DIR, "state", "inbox", "attachments");
 
+/**
+ * CONFIDENTIALITY SIGNAL — decode Slack's conversation type into the fields an
+ * inbox item carries. Every Slack ingest path (Socket Mode, the Web-API poller,
+ * the cloud relay) routes through this one decoder so the meaning of
+ * `channel_type` / `is_private` / `is_dm` is defined in exactly one place.
+ *
+ * WHY IT EXISTS: Slack's conversation-ID prefix is NOT a reliable type
+ * indicator — a private channel can and does carry a `C…` id; only `D` for a DM
+ * is dependable. The dependable signal is `channel_type` on the event envelope
+ * ("channel" public | "group" private | "im" DM | "mpim" group DM), so that is
+ * what we decode and carry to the daemon's fail-closed outcome gate
+ * (scripts/daemon/session-outcomes.mjs `outcomeSourceShareable`).
+ *
+ * Returns `{}` for anything unrecognised or missing: asserting nothing keeps
+ * that gate closed, which is the safe direction.
+ *
+ * @param {unknown} channelType raw Slack `channel_type`
+ * @returns {{channel_type?:string, is_private?:boolean, is_dm?:boolean}}
+ */
+export function slackChannelPrivacy(channelType) {
+  switch (String(channelType || "").trim().toLowerCase()) {
+    case "channel": return { channel_type: "channel", is_private: false, is_dm: false };
+    case "group":   return { channel_type: "group", is_private: true, is_dm: false };
+    case "im":      return { channel_type: "im", is_private: true, is_dm: true };
+    case "mpim":    return { channel_type: "mpim", is_private: true, is_dm: true };
+    default:        return {};
+  }
+}
+
 export function writeInboxItem(service, item, agentRoot = AGENT_REPO_DIR) {
   const dir = join(agentRoot, "state", "inbox", service);
   mkdirSync(dir, { recursive: true });
@@ -159,6 +188,24 @@ raw_ref: "${item.raw_ref || ""}"
     yaml += `channel_id: "${item.channel_id}"\n`;
   }
 
+  // CONFIDENTIALITY SIGNALS. Slack's conversation-ID prefix is not a reliable
+  // type indicator (a private channel can carry a `C…` id), so downstream
+  // consumers — notably the daemon's fail-closed outcome gate,
+  // scripts/daemon/session-outcomes.mjs `outcomeSourceShareable` — need the
+  // conversation type/privacy the ingest layer read off the event itself.
+  // Written ONLY when actually known: an absent line must stay absent, because
+  // `is_private: false` is a positive "this is public" assertion and the reader
+  // (inbox-scan-poller.mjs `parseInboxItemYaml`) decodes it as a tri-state.
+  if (item.channel_type) {
+    yaml += `channel_type: "${item.channel_type}"\n`;
+  }
+  if (typeof item.is_private === "boolean") {
+    yaml += `is_private: ${item.is_private}\n`;
+  }
+  if (typeof item.is_dm === "boolean") {
+    yaml += `is_dm: ${item.is_dm}\n`;
+  }
+
   // Add event_type if present (e.g., message_changed, reaction)
   if (item.event_type) {
     yaml += `event_type: "${item.event_type}"\n`;