@cohortapp/agent-sdk 2.3.1 → 2.4.0

package/scripts/daemon/inbox-wake.mjs

@@ -0,0 +1,282 @@
+/**
+ * scripts/daemon/inbox-wake.mjs — the daemon's "something landed" wake signal.
+ *
+ * ## The hop this removes
+ *
+ * The inbound ladder for a Cohort message is: hq commits → the messaging-inbound
+ * cadence pulls it → an inbox YAML file is written under
+ * `state/inbox/<service>/` → **the daemon notices on its next poll** → classify →
+ * dispatch. That last arrow was a flat `setInterval(poll, 60_000)`: a mean 30s
+ * and worst-case 60s of doing nothing while the work sat on disk, already
+ * fetched. With the push channel (`lib/org/push.mjs`) collapsing the two cadence
+ * hops above it from ~47s to ~1s, this became the single dominant term in the
+ * time-to-first-token budget.
+ *
+ * It is also the one hop that no amount of server-side work can fix, because
+ * nothing crosses the process boundary: the writer and the reader are two
+ * processes on the same box sharing a directory. So the fix belongs here.
+ *
+ * ## Design: a wake with a floor, not a watch you have to trust
+ *
+ * `waitForInboxWake()` resolves as soon as a live inbox item exists, and returns
+ * on `timeoutMs` otherwise — so the caller's loop shape is unchanged, only its
+ * sleep gets interrupted. Three independent sources feed it:
+ *
+ *   1. **fs.watch** on each service dir — near-zero latency, cross-process
+ *      (it sees the cadence consumer's write from another PID).
+ *   2. **a 1s rescan** — the FLOOR. fs.watch is genuinely unreliable in the
+ *      cases that matter here (a dir that does not exist yet, a network/synth
+ *      FS, watcher-limit exhaustion, macOS coalescing), and a missed wake is a
+ *      silently late agent — the exact failure class this pipeline keeps
+ *      producing. Correctness therefore does NOT depend on the watcher: with
+ *      every watcher dead this degrades to a 1s poll, not to 60s.
+ *   3. **{@link signalInbox}** — an in-process nudge for a writer in THIS
+ *      process (the dispatcher promoting a deferred item on session close),
+ *      which needs no filesystem round-trip at all.
+ *
+ * ## Why "a live item exists", not "an event fired"
+ *
+ * Every rename in these dirs raises watch events, including
+ * `x.yaml → x.yaml.processed` (which fires for BOTH names). Waking on raw events
+ * would spin the daemon every time it finished an item. The predicate is
+ * therefore a state check — "is there a file with no terminal suffix?" — which
+ * is false immediately after a drain and true only when there is genuine work.
+ * That makes a wake idempotent and a missed event harmless.
+ *
+ * Fail-open and LOUD: a watcher that cannot be created is logged once per
+ * directory and the scan floor carries the load.
+ *
+ * Node builtins only. ESM. Timers/fs injectable for tests.
+ *
+ * @module scripts/daemon/inbox-wake
+ */
+
+"use strict";
+
+import { existsSync, readdirSync, watch } from "node:fs";
+import { join } from "node:path";
+
+import { resolveAgentRoot } from "../../lib/agent-root.mjs";
+
+/** Suffixes the daemon's scanner skips — a file with one of these is not work. */
+const TERMINAL_SUFFIXES = [".processed", ".deferred", ".processed-bundled", ".claimed"];
+
+/** How often the wake rescans regardless of watch events (the floor). */
+export const DEFAULT_SCAN_MS = 1_000;
+
+/**
+ * Coalescing window after a watch event before the predicate is evaluated. A
+ * write + rename burst (the cadence writer does both) must produce ONE wake.
+ */
+export const DEFAULT_DEBOUNCE_MS = 60;
+
+/** The inbox services the daemon drains via a directory scan. */
+export const DEFAULT_SERVICES = Object.freeze([
+  "cohort",
+  "orgmail",
+  "telegram",
+  "whatsapp",
+  "slack",
+  "gmail",
+  "alex-gmail",
+  "calendar",
+  "voice",
+  "internal",
+  "sms",
+]);
+
+/** In-process listeners (see {@link signalInbox}). */
+const listeners = new Set();
+
+/** Directories we already reported an un-watchable error for (log once). */
+const watchWarned = new Set();
+
+/**
+ * Nudge every waiter in THIS process that inbox work may now exist. Used by the
+ * dispatcher's session-close path after promoting a deferred item — the work is
+ * already on disk, and waiting for a watch event or the 1s floor is pure delay.
+ *
+ * Safe to call at any time: a wake with no work costs one predicate evaluation.
+ *
+ * @param {string} [reason] free-form, surfaced to the waiter for logging
+ */
+export function signalInbox(reason = "signal") {
+  for (const fn of [...listeners]) {
+    try {
+      fn(reason);
+    } catch {
+      /* a waiter must never break the signaller */
+    }
+  }
+}
+
+/** Is `name` a live (un-drained) inbox item file? */
+export function isLiveItemName(name) {
+  if (!name || name.startsWith(".")) return false;
+  for (const s of TERMINAL_SUFFIXES) if (name.endsWith(s)) return false;
+  return true;
+}
+
+/**
+ * The wake predicate: the first service whose inbox dir holds a live item, or
+ * null. Cheap — a readdir of a handful of small directories.
+ *
+ * @param {object} o - { agentRoot?, services?, readdir? }
+ * @returns {string|null} the service name with work, else null
+ */
+export function findLiveInboxService(o = {}) {
+  const root = resolveAgentRoot(o.agentRoot);
+  const services = o.services || DEFAULT_SERVICES;
+  const readdirFn = o.readdir || readdirSync;
+  for (const service of services) {
+    const dir = join(root, "state", "inbox", service);
+    let names;
+    try {
+      names = readdirFn(dir);
+    } catch {
+      continue; // dir absent (service not configured) — not an error
+    }
+    for (const name of names) if (isLiveItemName(name)) return service;
+  }
+  return null;
+}
+
+/**
+ * Park until inbox work exists, or `timeoutMs` elapses.
+ *
+ * @param {object} o - {
+ *   agentRoot?, services?, timeoutMs?, scanMs?, debounceMs?,
+ *   log?, watchImpl?, readdir?
+ * }
+ * @returns {Promise<{woke:boolean, reason:string, service:string|null, waitedMs:number}>}
+ */
+export async function waitForInboxWake(o = {}) {
+  const root = resolveAgentRoot(o.agentRoot);
+  const services = o.services || DEFAULT_SERVICES;
+  const timeoutMs = Number.isFinite(o.timeoutMs) ? o.timeoutMs : 60_000;
+  const scanMs = Number.isFinite(o.scanMs) ? o.scanMs : DEFAULT_SCAN_MS;
+  const debounceMs = Number.isFinite(o.debounceMs) ? o.debounceMs : DEFAULT_DEBOUNCE_MS;
+  const watchFn = o.watchImpl || watch;
+  const log =
+    o.log ||
+    ((msg) => {
+      try {
+        console.warn(`[inbox-wake] ${msg}`);
+      } catch {
+        /* never throw from logging */
+      }
+    });
+  const startedAt = Date.now();
+
+  // Work already waiting: never sleep on a full inbox.
+  const immediate = findLiveInboxService({ agentRoot: root, services, readdir: o.readdir });
+  if (immediate) {
+    return { woke: true, reason: "pending", service: immediate, waitedMs: 0 };
+  }
+
+  return new Promise((resolve) => {
+    let settled = false;
+    let debounceTimer = null;
+    const watchers = [];
+    let scanTimer = null;
+    let timeoutTimer = null;
+    let listener = null;
+
+    function cleanup() {
+      if (debounceTimer) clearTimeout(debounceTimer);
+      if (scanTimer) clearInterval(scanTimer);
+      if (timeoutTimer) clearTimeout(timeoutTimer);
+      if (listener) listeners.delete(listener);
+      for (const w of watchers) {
+        try {
+          w.close();
+        } catch {
+          /* already closed */
+        }
+      }
+    }
+
+    function settle(reason, service) {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      resolve({
+        woke: reason !== "timeout",
+        reason,
+        service: service || null,
+        waitedMs: Date.now() - startedAt,
+      });
+    }
+
+    /** Evaluate the predicate; settle only when there is REAL work. */
+    function check(reason) {
+      if (settled) return;
+      const service = findLiveInboxService({ agentRoot: root, services, readdir: o.readdir });
+      if (service) settle(reason, service);
+    }
+
+    function onEvent(reason) {
+      if (settled || debounceTimer) return;
+      debounceTimer = setTimeout(() => {
+        debounceTimer = null;
+        check(reason);
+      }, debounceMs);
+      if (debounceTimer && typeof debounceTimer.unref === "function") debounceTimer.unref();
+    }
+
+    // 1. fs.watch per existing service dir — the fast path.
+    for (const service of services) {
+      const dir = join(root, "state", "inbox", service);
+      if (!existsSync(dir)) continue;
+      try {
+        const w = watchFn(dir, { persistent: false }, () => onEvent("watch"));
+        if (w && typeof w.on === "function") {
+          // A watcher error must degrade to the scan floor, never reject.
+          w.on("error", (err) => {
+            if (!watchWarned.has(dir)) {
+              watchWarned.add(dir);
+              log(`watch failed for ${dir} (${err && err.message}) — falling back to the ${scanMs}ms rescan`);
+            }
+          });
+        }
+        watchers.push(w);
+      } catch (err) {
+        if (!watchWarned.has(dir)) {
+          watchWarned.add(dir);
+          log(`cannot watch ${dir} (${err && err.message}) — falling back to the ${scanMs}ms rescan`);
+        }
+      }
+    }
+
+    // 2. the scan floor — correctness does not depend on the watchers.
+    scanTimer = setInterval(() => check("scan"), scanMs);
+    if (scanTimer && typeof scanTimer.unref === "function") scanTimer.unref();
+
+    // 3. in-process signal.
+    listener = (reason) => onEvent(reason || "signal");
+    listeners.add(listener);
+
+    // Deliberately NOT unref'd: this promise is the caller's sleep, and while it
+    // is pending the process still owes a poll. With every timer unref'd Node
+    // would consider the loop idle and exit mid-wait (or, under the test runner,
+    // report an unsettled promise). The watchers stay `persistent:false` and the
+    // scan/debounce timers stay unref'd so THIS is the only thing holding it.
+    timeoutTimer = setTimeout(() => settle("timeout", null), timeoutMs);
+  });
+}
+
+/** Drop in-process listener state (tests). */
+export function resetInboxWake() {
+  listeners.clear();
+  watchWarned.clear();
+}
+
+export default {
+  waitForInboxWake,
+  signalInbox,
+  findLiveInboxService,
+  isLiveItemName,
+  resetInboxWake,
+  DEFAULT_SERVICES,
+  DEFAULT_SCAN_MS,
+};

package/scripts/daemon/inbox-wake.test.mjs

@@ -0,0 +1,199 @@
+/**
+ * inbox-wake.test.mjs — the daemon's "something landed" wake signal.
+ *
+ * Exercised against a REAL temp filesystem (fs.watch semantics are the thing
+ * under test), plus one injected-watch case that proves the scan floor carries
+ * the load when every watcher is dead — the property that keeps a missed event
+ * from turning into a silently late agent.
+ *
+ * Run: node --test scripts/daemon/inbox-wake.test.mjs
+ */
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, renameSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import {
+  waitForInboxWake,
+  signalInbox,
+  findLiveInboxService,
+  isLiveItemName,
+  resetInboxWake,
+  DEFAULT_SERVICES,
+} from "./inbox-wake.mjs";
+
+function makeRoot() {
+  const root = mkdtempSync(join(tmpdir(), "inbox-wake-"));
+  mkdirSync(join(root, "state", "inbox", "cohort"), { recursive: true });
+  return root;
+}
+
+function writeItem(root, service, name, body = "id: x\n") {
+  writeFileSync(join(root, "state", "inbox", service, name), body);
+}
+
+// --- the predicate ----------------------------------------------------------
+
+test("isLiveItemName: only un-drained, non-dot files count as work", () => {
+  assert.equal(isLiveItemName("2026-08-11-abc.yaml"), true);
+  assert.equal(isLiveItemName("2026-08-11-abc.yaml.processed"), false);
+  assert.equal(isLiveItemName("2026-08-11-abc.yaml.deferred"), false);
+  assert.equal(isLiveItemName("2026-08-11-abc.yaml.processed-bundled"), false);
+  assert.equal(isLiveItemName(".DS_Store"), false);
+  assert.equal(isLiveItemName(""), false);
+});
+
+test("findLiveInboxService: names the service holding work, else null", () => {
+  const root = makeRoot();
+  try {
+    assert.equal(findLiveInboxService({ agentRoot: root }), null);
+    writeItem(root, "cohort", "a.yaml.processed");
+    assert.equal(findLiveInboxService({ agentRoot: root }), null, "a drained item is not work");
+    writeItem(root, "cohort", "b.yaml");
+    assert.equal(findLiveInboxService({ agentRoot: root }), "cohort");
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test("the cohort + orgmail dirs are in the default service set (the ones that were missed)", () => {
+  assert.ok(DEFAULT_SERVICES.includes("cohort"));
+  assert.ok(DEFAULT_SERVICES.includes("orgmail"));
+  assert.ok(DEFAULT_SERVICES.includes("telegram"));
+});
+
+// --- the wake ---------------------------------------------------------------
+
+test("returns immediately when work is already waiting (never sleep on a full inbox)", async () => {
+  const root = makeRoot();
+  try {
+    writeItem(root, "cohort", "a.yaml");
+    const r = await waitForInboxWake({ agentRoot: root, timeoutMs: 5_000 });
+    assert.equal(r.woke, true);
+    assert.equal(r.reason, "pending");
+    assert.equal(r.service, "cohort");
+    assert.equal(r.waitedMs, 0);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test("wakes on a file written by another writer, far inside the 60s poll interval", async () => {
+  const root = makeRoot();
+  try {
+    const started = Date.now();
+    const waiting = waitForInboxWake({ agentRoot: root, timeoutMs: 8_000 });
+    setTimeout(() => writeItem(root, "cohort", "late.yaml"), 50);
+    const r = await waiting;
+    assert.equal(r.woke, true);
+    assert.ok(["watch", "scan"].includes(r.reason), `unexpected reason ${r.reason}`);
+    assert.equal(r.service, "cohort");
+    assert.ok(Date.now() - started < 3_000, "a wake must not take seconds");
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test("does NOT wake when the only change is an item being drained", async () => {
+  const root = makeRoot();
+  try {
+    writeItem(root, "cohort", "a.yaml");
+    // Drain it, then wait: renaming to `.processed` raises watch events for BOTH
+    // names, so an event-driven wake would spin here.
+    renameSync(
+      join(root, "state", "inbox", "cohort", "a.yaml"),
+      join(root, "state", "inbox", "cohort", "a.yaml.processed")
+    );
+    const r = await waitForInboxWake({ agentRoot: root, timeoutMs: 400 });
+    assert.equal(r.woke, false);
+    assert.equal(r.reason, "timeout");
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test("times out cleanly with an empty inbox (the loop shape is unchanged)", async () => {
+  const root = makeRoot();
+  try {
+    const r = await waitForInboxWake({ agentRoot: root, timeoutMs: 200 });
+    assert.deepEqual(
+      { woke: r.woke, reason: r.reason, service: r.service },
+      { woke: false, reason: "timeout", service: null }
+    );
+    assert.ok(r.waitedMs >= 150);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test("signalInbox wakes an in-process waiter (the dispatcher's promote path)", async () => {
+  const root = makeRoot();
+  resetInboxWake();
+  try {
+    const waiting = waitForInboxWake({ agentRoot: root, timeoutMs: 5_000, scanMs: 60_000 });
+    setTimeout(() => {
+      // Simulate promoteDeferred: the file becomes live, then we nudge.
+      writeItem(root, "cohort", "promoted.yaml");
+      signalInbox("promote");
+    }, 20);
+    const r = await waiting;
+    assert.equal(r.woke, true);
+    assert.equal(r.service, "cohort");
+  } finally {
+    resetInboxWake();
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test("signalInbox with no work does NOT wake (a spurious nudge is free)", async () => {
+  const root = makeRoot();
+  resetInboxWake();
+  try {
+    const waiting = waitForInboxWake({ agentRoot: root, timeoutMs: 400, scanMs: 60_000 });
+    setTimeout(() => signalInbox("noise"), 20);
+    const r = await waiting;
+    assert.equal(r.woke, false);
+  } finally {
+    resetInboxWake();
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test("with EVERY watcher dead the scan floor still wakes it — and says so once", async () => {
+  const root = makeRoot();
+  const logs = [];
+  try {
+    const watchImpl = () => {
+      throw new Error("EMFILE: watcher limit reached");
+    };
+    const waiting = waitForInboxWake({
+      agentRoot: root,
+      timeoutMs: 6_000,
+      scanMs: 100,
+      watchImpl,
+      log: (m) => logs.push(m),
+    });
+    setTimeout(() => writeItem(root, "cohort", "floor.yaml"), 30);
+    const r = await waiting;
+    assert.equal(r.woke, true);
+    assert.equal(r.reason, "scan", "correctness must not depend on fs.watch");
+    assert.equal(logs.length, 1, "a dead watcher is reported — fail-open, never silent");
+    assert.match(logs[0], /falling back to the 100ms rescan/);
+  } finally {
+    resetInboxWake();
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test("a missing service dir is not an error (an un-enrolled agent just times out)", async () => {
+  const root = mkdtempSync(join(tmpdir(), "inbox-wake-bare-"));
+  try {
+    const r = await waitForInboxWake({ agentRoot: root, timeoutMs: 200 });
+    assert.equal(r.woke, false);
+    assert.equal(r.reason, "timeout");
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});

package/scripts/daemon/maestro-daemon.mjs

@@ -33,6 +33,29 @@ const AGENT_DIR = process.env.AGENT_DIR || resolve(__dirname, "../..");
 process.env.AGENT_DIR = AGENT_DIR;
 process.env.AGENT_ROOT = AGENT_DIR;
 
+// ---------------------------------------------------------------------------
+// 0. Environment — BEFORE anything reads a credential
+// ---------------------------------------------------------------------------
+// The core daemon (agent-daemon.mjs, step 4) loads .env itself, but the org
+// mesh connects at step 3b' — EARLIER in this file. Under launchd the process
+// environment is bare, so the mesh was reading COHORT_API_KEY before anything
+// had put it there.
+//
+// That failed SILENTLY and looked healthy: `enabled` comes from config/org.yaml
+// (which should NOT carry the token — it is version-controlled), so the mesh
+// started, logged "connected", and then 401'd on every beat forever. An agent
+// that never beats also never receives the kill switch.
+//
+// Loading .env here, before any org work, is the fix. Idempotent: dotenv does
+// not override variables already set, so a launchd/plist-provided value still
+// wins. Fail-open — dotenv is absent in some CI/unit contexts.
+try {
+  const { config } = await import("dotenv");
+  config({ path: join(AGENT_DIR, ".env") });
+} catch {
+  // No dotenv (CI/dev): rely on the ambient environment.
+}
+
 // Never die silently (P0-6): a stray unhandled rejection / uncaught exception is
 // logged + counted, not a silent process death. Rejections keep the daemon
 // running; an uncaught exception logs+flushes then lets launchd restart us.

package/scripts/daemon/prompt-builder.mjs

@@ -6,6 +6,7 @@
 import { readFileSync, readdirSync } from "fs";
 import { join } from "path";
 import { compileContext } from "./context-compiler.mjs";
+import { loadPersonaBlock } from "../../lib/identity/persona.mjs";
 import { wrapExternalContent } from "../../lib/security/external-content.mjs";
 import { isEnabled as orgEnabled } from "../../lib/org/client.mjs";
 import { recall as orgRecall } from "../../lib/org/knowledge.mjs";
@@ -118,6 +119,27 @@ async function buildOrgKnowledgeBlock(item, classResult, queueItem) {
 // Cached identity preamble — extracted from CLAUDE.md on first call
 let cachedPreamble = null;
 
+// Cached persona block — rendered from config/agent.json (the SoT, kept in sync
+// with the Cohort server) on first call. This leads every prompt and is
+// AUTHORITATIVE over the CLAUDE.md-scraped preamble that follows it: a scaffolded
+// repo still carries "your identity has not yet been configured" prose in
+// CLAUDE.md long after the org record is populated, and without an explicit
+// precedence rule the model would take that placeholder at face value and fall
+// back to a generic-assistant register.
+let cachedPersona = null;
+
+/** Render (once per process) the persona block from config/agent.json. */
+function loadPersona() {
+  if (cachedPersona !== null) return cachedPersona;
+  cachedPersona = loadPersonaBlock(AGENT_REPO_DIR) || "";
+  return cachedPersona;
+}
+
+/** For tests: drop the cached persona so a fresh config/agent.json is re-read. */
+export function _resetPersonaCache() {
+  cachedPersona = null;
+}
+
 function loadPreamble() {
   if (cachedPreamble) return cachedPreamble;
 
@@ -185,7 +207,10 @@ function buildFallbackPreamble() {
   const principal = a.principal || {};
   const principalName = principal.fullName || "the principal";
   const principalTitle = principal.title || "principal";
-  return `You are ${a.fullName}, ${a.title} to ${principalName}, ${principalTitle} of ${a.company}.
+  // "<title> to <principal>" only reads correctly for assistant-shaped titles;
+  // for a functional seat ("SVP AI Systems & Agent Platform") it turns the role
+  // into a service relationship. State the seat, then the reporting line.
+  return `You are ${a.fullName}, ${a.title} at ${a.company}. You report to ${principalName}, ${principalTitle}.
 You operate as the autonomous executive command layer for the company.
 
 ${a.companyDescription || a.company}.
@@ -552,6 +577,21 @@ export async function buildPrompt(item, classResult, options = {}) {
 
   const parts = [];
 
+  // 1. Persona block (cached) — rendered from config/agent.json, which the
+  // Cohort enrollment pull keeps current. Leads the prompt and outranks the
+  // CLAUDE.md preamble below, because a scaffolded CLAUDE.md carries
+  // "identity not yet configured" placeholder prose that would otherwise
+  // contradict a perfectly good org record.
+  const persona = loadPersona();
+  if (persona) {
+    parts.push(persona);
+    parts.push("");
+    parts.push(
+      "The section above is your identity, resolved from your organisation's record of you. Where anything below conflicts with it, the section above wins.",
+    );
+    parts.push("");
+  }
+
   // 1. Identity preamble (cached)
   parts.push(preamble);
   parts.push("");

package/scripts/daemon/responder.mjs

@@ -684,6 +684,52 @@ function resolveSlackChannel(item) {
  *
  * @returns {{ sent: boolean, text: string, channel: string }} result
  */
+
+/**
+ * Send a reply back onto Cohort (the org's own messaging app).
+ *
+ * The responder dispatched on `item.service` and only ever knew "slack" and
+ * "gmail", so a `cohort` item fell through to `{ sent: false }`: the agent
+ * COMPOSED a reply and dropped it on the floor, logging "not_sent". Observed in
+ * production — an agent quietly did that to a human's DMs three times in a row.
+ *
+ * Routing is by CHANNEL, not by person: `channel_id` is the room the inbound
+ * arrived in, which is also where the answer belongs (a DM room for a DM, the
+ * space for a space). Threading is preserved when the inbound was threaded.
+ *
+ * Goes through lib/org/messaging.sendMessage rather than the raw RPC so the
+ * outbound send-gate, the afterSend hook and cost attribution all still run —
+ * the same chokepoint every other channel uses.
+ */
+async function sendCohortReply(item, text) {
+  try {
+    const channel = item.channel_id || item.channel || "";
+    if (!channel) return { sent: false, via: null, error: "no channel_id on item" };
+    const { sendMessage } = await import("../../lib/org/messaging.mjs");
+    const { loadOrgConfig } = await import("../../lib/org/client.mjs");
+    const agentRoot = process.env.AGENT_ROOT || process.env.AGENT_DIR || process.cwd();
+    const frame = await sendMessage(
+      {
+        channel,
+        body: text,
+        // Stable per (message, kind) so a retry dedupes server-side instead of
+        // double-posting into a real room.
+        idempotencyId: `reply-${item.message_id || item.id || Date.now()}`,
+        ...(item.thread_id ? { threadId: item.thread_id } : {}),
+      },
+      { cfg: loadOrgConfig(agentRoot), agentRoot },
+    );
+    if (frame && frame.ok) return { sent: true, via: "cohort", channel };
+    return {
+      sent: false,
+      via: null,
+      error: (frame && frame.error && frame.error.message) || "send failed",
+    };
+  } catch (err) {
+    return { sent: false, via: null, error: err && err.message };
+  }
+}
+
 export async function sendQuickResponse(item, classResult) {
   const startTime = Date.now();
 
@@ -745,6 +791,13 @@ export async function sendQuickResponse(item, classResult) {
         emitEvent({ type: EVENT_TYPES.SENT, trace_id: item.trace_id || undefined, attrs: { service: "gmail", via: gmailResult.via } });
         logInteraction(item, text);
       }
+    } else if (item.service === "cohort") {
+      const orgResult = await sendCohortReply(item, text);
+      sendResult = { sent: orgResult.sent, via: orgResult.via, ...(orgResult.channel ? { channel: orgResult.channel } : {}), ...(orgResult.error ? { error: orgResult.error } : {}) };
+      if (orgResult.sent) {
+        emitEvent({ type: EVENT_TYPES.SENT, trace_id: item.trace_id || undefined, attrs: { service: "cohort", channel: orgResult.channel, via: "quick_reply" } });
+        logInteraction(item, text);
+      }
     }
 
     const duration = Date.now() - startTime;
@@ -802,6 +855,9 @@ export async function sendHoldingMessage(item, classResult) {
     } else if (item.service === "gmail") {
       const gmailResult = await sendGmailResponse(item, text);
       sendResult = { sent: gmailResult.sent, via: gmailResult.via, ...(gmailResult.draft_path ? { draft_path: gmailResult.draft_path } : {}), ...(gmailResult.to ? { to: gmailResult.to } : {}) };
+    } else if (item.service === "cohort") {
+      const orgResult = await sendCohortReply(item, text);
+      sendResult = { sent: orgResult.sent, via: orgResult.via, ...(orgResult.error ? { error: orgResult.error } : {}) };
     }
 
     const duration = Date.now() - startTime;