@cohortapp/agent-sdk 2.3.1 → 2.4.0

package/scripts/daemon/typing-registry.mjs

@@ -19,9 +19,31 @@
 
 "use strict";
 
+import { cohortTypingAdapter } from "../../lib/org/typing.mjs";
+
 /** @type {Map<string, { startTypingHeartbeat:Function, stopTypingHeartbeat:Function }>} */
 const ADAPTERS = new Map();
 
+/**
+ * Services whose adapter is BUILT IN rather than created by the daemon's
+ * channel-bus loop, resolved on first use.
+ *
+ * `cohort` is the org substrate itself: there is no channel adapter object for
+ * it anywhere (the messaging-inbound cadence writes inbox YAML directly), so
+ * nothing would ever have called `registerTypingAdapter("cohort", …)` — and an
+ * SDK-driven agent, which is now the ONLY responder for its own rooms
+ * (hq `llm-responder/sdk-driven.ts` stands hq down for a live daemon), would
+ * show no "composing" indicator at all while it worked. The adapter is a plain
+ * `messaging.typing` client (`lib/org/typing.mjs`) that no-ops when the agent is
+ * not enrolled, so resolving it lazily here costs nothing for an agent that has
+ * no org.
+ *
+ * @type {Record<string, () => object>}
+ */
+const BUILTIN_ADAPTERS = {
+  cohort: () => cohortTypingAdapter(),
+};
+
 /** Register a channel adapter under its service name (e.g. "telegram"). */
 export function registerTypingAdapter(service, adapter) {
   if (!service || !adapter) return;
@@ -29,6 +51,37 @@ export function registerTypingAdapter(service, adapter) {
   ADAPTERS.set(service, adapter);
 }
 
+/**
+ * Resolve the adapter for a service: an explicitly registered one wins (so a
+ * test or a future real cohort adapter can override), else a built-in.
+ * Fail-open: a built-in that cannot be constructed yields null and the caller
+ * no-ops, but the reason is logged — a silently missing indicator is exactly
+ * the class of bug this module exists to fix.
+ */
+function adapterFor(service) {
+  if (!service) return null;
+  const registered = ADAPTERS.get(service);
+  if (registered) return registered;
+  const builtin = BUILTIN_ADAPTERS[service];
+  if (!builtin) return null;
+  try {
+    const made = builtin();
+    if (!made || typeof made.startTypingHeartbeat !== "function") return null;
+    ADAPTERS.set(service, made);
+    return made;
+  } catch (err) {
+    try {
+      console.warn(
+        `[typing-registry] built-in typing adapter for "${service}" failed to load ` +
+          `(${err && err.message}) — sessions will run without a typing indicator`
+      );
+    } catch {
+      /* never throw from logging */
+    }
+    return null;
+  }
+}
+
 export function clearTypingAdapters() {
   ADAPTERS.clear();
 }
@@ -57,7 +110,7 @@ export function sourceFromItem(item) {
 export function startTyping(item) {
   try {
     const service = item?.service;
-    const adapter = service && ADAPTERS.get(service);
+    const adapter = adapterFor(service);
     if (!adapter) return null;
     const source = sourceFromItem(item);
     if (!source || !source.chatId) return null;
@@ -71,7 +124,7 @@ export function startTyping(item) {
 export function stopTyping(item) {
   try {
     const service = item?.service;
-    const adapter = service && ADAPTERS.get(service);
+    const adapter = adapterFor(service);
     if (!adapter) return;
     const source = sourceFromItem(item);
     if (!source || !source.chatId) return;

package/scripts/daemon/typing-registry.test.mjs

@@ -16,6 +16,7 @@ import {
   stopTyping,
   sourceFromItem,
 } from "./typing-registry.mjs";
+import { resetCohortTypingAdapter } from "../../lib/org/typing.mjs";
 
 function fakeAdapter() {
   return {
@@ -68,6 +69,30 @@ test("sourceFromItem prefers a structured source, else reconstructs from item",
   assert.equal(group.threadRef, "77");
 });
 
+test("cohort resolves the BUILT-IN adapter with nothing registered (the SDK parity gap)", () => {
+  clearTypingAdapters();
+  resetCohortTypingAdapter();
+  // No registerTypingAdapter("cohort", …) anywhere — nothing constructs a
+  // cohort channel adapter, which is why the indicator was missing entirely.
+  const item = { service: "cohort", channel_id: "ch_1", channel: "#build", thread_id: "" };
+  assert.doesNotThrow(() => startTyping(item));
+  assert.doesNotThrow(() => stopTyping(item));
+  clearTypingAdapters();
+  resetCohortTypingAdapter();
+});
+
+test("an explicitly registered cohort adapter still wins over the built-in", () => {
+  clearTypingAdapters();
+  resetCohortTypingAdapter();
+  const fake = fakeAdapter();
+  registerTypingAdapter("cohort", fake);
+  startTyping({ service: "cohort", channel_id: "ch_1", channel: "#build" });
+  assert.equal(fake.started.length, 1);
+  assert.equal(fake.started[0].chatId, "ch_1");
+  clearTypingAdapters();
+  resetCohortTypingAdapter();
+});
+
 test("registerTypingAdapter ignores adapters lacking startTypingHeartbeat", () => {
   clearTypingAdapters();
   registerTypingAdapter("bad", { foo: 1 });

package/scripts/local-triggers/generate-plists.test.mjs

@@ -107,7 +107,7 @@ function listPlists(agentRoot) {
 // Tests
 // ---------------------------------------------------------------------------
 
-test("generator emits 21 standard plists with the agent's first name", async () => {
+test("generator emits 22 standard plists with the agent's first name", async () => {
   // Standard inventory (cadence-bus v1 + slack-socket-mode v1), with NO
   // config/.cadence-plists.tsv present (no archetype cadences):
   //   daemon, poll-relay, slack-socket (3 infra), PLUS one trigger plist per
@@ -118,8 +118,8 @@ test("generator emits 21 standard plists with the agent's first name", async ()
   //   economics/scheduling cadences nightly-cost-reconcile, fleet-cost-digest,
   //   org-cost-sync, monitoring-alerts, dynamic-jobs (5), PLUS the SP10
   //   messaging-inbound cadence (1), PLUS the 2026-07 Directory & Design
-  //   stewards directory-hygiene + brand-steward (2). = 3 infra + 18 trigger
-  //   = 21 total.
+  //   stewards directory-hygiene + brand-steward (2), PLUS the D3 self-directed
+  //   loop goal-steward (1). = 3 infra + 19 trigger = 22 total.
   // org-pulse used to be declared standard but was OMITTED by the old hardcoded
   // list (it never got a plist); deriving from the SoT fixes that drift.
   // The former weekly-* cadences are still ARCHETYPE-DRIVEN (function × altitude),
@@ -129,7 +129,7 @@ test("generator emits 21 standard plists with the agent's first name", async ()
     const r = runGenerator(root);
     assert.equal(r.status, 0, r.stderr);
     const plists = listPlists(root);
-    assert.equal(plists.length, 21, `expected 21 standard plists; got ${plists.join(",")}`);
+    assert.equal(plists.length, 22, `expected 22 standard plists; got ${plists.join(",")}`);
     assert.ok(plists.includes("ai.maestro.alice-messaging-inbound.plist"),
       "messaging-inbound (SP10 standard cadence) must get a SoT-derived plist");
     for (const id of ["directory-hygiene", "brand-steward"]) {
@@ -200,7 +200,7 @@ test("archetype cadences from config/.cadence-plists.tsv emit extra trigger plis
     const r = runGenerator(root);
     assert.equal(r.status, 0, r.stderr);
     const plists = listPlists(root);
-    assert.equal(plists.length, 23, `expected 21 standard + 2 archetype; got ${plists.join(",")}`);
+    assert.equal(plists.length, 24, `expected 22 standard + 2 archetype; got ${plists.join(",")}`);
     const dir = join(root, "scripts/local-triggers/plists");
     const eng = readFileSync(join(dir, "ai.maestro.erin-engineering-health.plist"), "utf-8");
     assert.match(eng, /<key>Weekday<\/key>\s*<integer>3<\/integer>/); // base64 schedule decoded

package/scripts/poller/inbox-scan-poller.mjs

@@ -57,6 +57,19 @@ export function parseInboxItemYaml(body) {
     const m = body.match(new RegExp(`^\\s{2}${key}:\\s*(\\S+)`, "m"));
     return /true/i.test((m || [])[1] || "");
   };
+  // TRI-STATE. The confidentiality fields must distinguish "absent" from
+  // "false": `is_private: false` is a positive assertion that the source is
+  // public, and the daemon's fail-closed outcome gate
+  // (scripts/daemon/session-outcomes.mjs) admits on it. Decoding a missing line
+  // as `false` — which `bool()` does — would forge that assertion for every
+  // item ever written, which is exactly the leak the gate exists to prevent.
+  const triBool = (key) => {
+    const m = body.match(new RegExp(`^${key}:\\s*(\\S+)`, "m"));
+    if (!m) return undefined;
+    if (/^true$/i.test(m[1])) return true;
+    if (/^false$/i.test(m[1])) return false;
+    return undefined;
+  };
 
   // Block scalar `content: |` — capture the indented block.
   const blockScalar = (key) => {
@@ -66,7 +79,11 @@ export function parseInboxItemYaml(body) {
     return m[1].replace(/^ {2}/gm, "").replace(/\n+$/, "");
   };
 
-  return {
+  const channelType = scalar("channel_type");
+  const isPrivate = triBool("is_private");
+  const isDm = triBool("is_dm");
+
+  const item = {
     id: scalar("id"),
     service: scalar("service"),
     channel: scalar("channel"),
@@ -88,6 +105,14 @@ export function parseInboxItemYaml(body) {
     },
     raw_ref: scalar("raw_ref"),
   };
+
+  // Only attached when the writer actually knew (see triBool) — an item with no
+  // privacy signal must stay signal-less so the outcome gate fails closed.
+  if (channelType) item.channel_type = channelType;
+  if (isPrivate !== undefined) item.is_private = isPrivate;
+  if (isDm !== undefined) item.is_dm = isDm;
+
+  return item;
 }
 
 /**

package/scripts/poller/inbox-scan-poller.test.mjs

@@ -16,6 +16,7 @@ import { join } from "node:path";
 import { parseInboxItemYaml, scanInbox } from "./inbox-scan-poller.mjs";
 import { markDispatched, markInboxProcessed, writeInboxItem } from "./utils.mjs";
 import { eventToInboxItem } from "../../lib/channels/inbox-item.mjs";
+import { outcomeSourceShareable } from "../daemon/session-outcomes.mjs";
 
 async function makeRoot() {
   const p = join(tmpdir(), `inbox-scan-test-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`);
@@ -229,3 +230,66 @@ raw_ref: "${item.raw_ref || ""}"
   if (item.kind) yaml += `kind: "${item.kind}"\n`;
   return yaml;
 }
+
+// ---------------------------------------------------------------------------
+// CONFIDENTIALITY — the privacy signal must survive the YAML round-trip
+// ---------------------------------------------------------------------------
+//
+// The daemon's outcome gate (scripts/daemon/session-outcomes.mjs) is fail-closed
+// and admits a turn's commitments as ORG-VISIBLE only on a POSITIVE public
+// signal, because Slack's conversation-ID prefix is not a reliable type
+// indicator — private channels carry `C…` ids too. That signal is minted at
+// ingest and reaches the daemon only through this writer/reader pair, so the
+// round-trip is part of the security boundary and is tested as such.
+
+test("privacy signals survive writeInboxItem → scanInbox, and drive the outcome gate", async () => {
+  const root = await makeRoot();
+  try {
+    const base = {
+      service: "slack",
+      sender: "casey",
+      sender_privilege: "unknown",
+      timestamp: "2026-06-09T10:00:00.000Z",
+      content: "hello",
+      thread_id: "",
+      is_reply: false,
+      priority_signals: { from_ceo: false, tagged_urgent: false, contains_deadline: false, mentions_agent: true },
+    };
+    writeInboxItem("slack", {
+      ...base, id: "pub-1", channel: "general", channel_id: "C0GENERAL",
+      channel_type: "channel", is_private: false, is_dm: false,
+      subject: "#general", raw_ref: "slack:C0GENERAL:1",
+    }, root);
+    // A PRIVATE channel that Slack minted with a `C…` id — the case the old
+    // prefix test admitted, and the leak this whole chain exists to stop.
+    writeInboxItem("slack", {
+      ...base, id: "priv-1", channel: "leadership", channel_id: "C0LEADERSHIP",
+      channel_type: "group", is_private: true, is_dm: false,
+      subject: "#leadership", raw_ref: "slack:C0LEADERSHIP:2",
+    }, root);
+    // An item minted before/without any privacy resolution.
+    writeInboxItem("slack", {
+      ...base, id: "unk-1", channel: "mystery", channel_id: "C0MYSTERY",
+      subject: "#mystery", raw_ref: "slack:C0MYSTERY:3",
+    }, root);
+
+    const byId = Object.fromEntries(
+      scanInbox("slack", { agentRoot: root }).items.map((i) => [i.id, i])
+    );
+    assert.equal(Object.keys(byId).length, 3);
+
+    assert.equal(byId["pub-1"].channel_type, "channel");
+    assert.equal(byId["pub-1"].is_private, false, "an explicit false must survive as false, not vanish");
+    assert.equal(byId["priv-1"].channel_type, "group");
+    assert.equal(byId["priv-1"].is_private, true);
+    assert.equal(
+      "is_private" in byId["unk-1"], false,
+      "an unresolved item must carry NO privacy field — a defaulted `false` would forge a public verdict"
+    );
+    assert.equal("channel_type" in byId["unk-1"], false);
+
+    assert.deepEqual(outcomeSourceShareable(byId["pub-1"]), { shareable: true, reason: "public-channel" });
+    assert.deepEqual(outcomeSourceShareable(byId["priv-1"]), { shareable: false, reason: "private-channel" });
+    assert.deepEqual(outcomeSourceShareable(byId["unk-1"]), { shareable: false, reason: "privacy-unknown" });
+  } finally { await rmRoot(root); }
+});

package/scripts/poller/slack-cloud-relay-client.mjs

@@ -306,6 +306,11 @@ function handleWebhook(webhook, identity, peerSlackIds) {
   const payload = {
     ...webhook,
     channel_id: event.channel || "",
+    // CONFIDENTIALITY: carry Slack's conversation type through to the reader
+    // (slack-poller's events-JSON branch). The id prefix is not a reliable type
+    // indicator, so this is the only signal that lets the daemon's outcome gate
+    // establish a source as public. Omitted when Slack didn't send one.
+    ...(event.channel_type ? { channel_type: event.channel_type } : {}),
     received_at: new Date().toISOString(),
     source: "cloud-relay",
   };

package/scripts/poller/slack-poller.mjs

@@ -12,6 +12,9 @@ import {
   AGENT_REPO_DIR,
   extractSlackAttachments,
   downloadSlackAttachment,
+  // One shared decoder for Slack's `channel_type` → the confidentiality fields
+  // (channel_type / is_private / is_dm) every ingest path stamps on an item.
+  slackChannelPrivacy,
 } from "./utils.mjs";
 
 import {
@@ -82,6 +85,12 @@ async function getMonitoredChannels() {
         id: c.id,
         name: c.name || c.id,
         priority: CHANNEL_PRIORITY_OVERRIDES[c.name] || "normal",
+        // CONFIDENTIALITY. `types` includes private_channel, and a private
+        // channel can carry a `C…` id — the prefix proves nothing. Keep Slack's
+        // own verdict so items minted from this channel can carry it downstream
+        // to the daemon's fail-closed outcome gate. Only a real boolean counts;
+        // anything else stays undefined (unknown ⇒ not established as public).
+        is_private: typeof c.is_private === "boolean" ? c.is_private : undefined,
       }));
     channelsCachedAt = Date.now();
     return cachedChannels;
@@ -318,6 +327,9 @@ export async function pollSlack() {
             },
             raw_ref: rawRef,
             channel_id: im.id,
+            channel_type: "im",
+            is_private: true,
+            is_dm: true,
           });
         }
       }
@@ -411,6 +423,12 @@ export async function pollSlack() {
           thread_id: msg.thread_ts || "",
           thread_context: channelThreadContext,
           is_reply: !!msg.thread_ts,
+          // Slack's own privacy verdict (see getMonitoredChannels); undefined
+          // when unknown so the downstream gate stays fail-closed.
+          is_private: channel.is_private,
+          channel_type: typeof channel.is_private === "boolean"
+            ? (channel.is_private ? "group" : "channel")
+            : undefined,
           attachments: attachments.length > 0 ? attachments : undefined,
           priority_signals: {
             from_ceo: isCeo,
@@ -538,6 +556,9 @@ export async function pollSlack() {
               mentions_agent: true,
             },
             raw_ref: `slack:${im.id}:${msg.ts}`,
+            channel_type: "im",
+            is_private: true,
+            is_dm: true,
           });
         }
 
@@ -722,6 +743,13 @@ export async function pollSlack() {
               mentions_agent: isDmThread || (loadAgent().firstName && new RegExp(loadAgent().firstName, "i").test(replyText)),
             },
             raw_ref: `slack:${channelId}:${reply.ts}`,
+            // Same privacy verdict as the parent conversation: an im is private
+            // by construction, a channel carries whatever Slack said it is.
+            ...(isDmThread
+              ? { channel_type: "im", is_private: true, is_dm: true }
+              : (chanInfo && typeof chanInfo.is_private === "boolean"
+                  ? { channel_type: chanInfo.is_private ? "group" : "channel", is_private: chanInfo.is_private }
+                  : {})),
           });
         }
       } catch (err) {
@@ -824,6 +852,10 @@ export async function pollSlack() {
             mentions_agent: loadAgent().firstName ? new RegExp(loadAgent().firstName, "i").test(content) : false,
           },
           raw_ref: eventRef,
+          // Slack's conversation type off the delivered envelope — the only
+          // dependable privacy signal (the id prefix is not one). Absent on
+          // older payloads, in which case we assert nothing.
+          ...slackChannelPrivacy(data.channel_type || evt.channel_type),
           _inbox_file: file,
         });
 

package/scripts/poller/slack-socket-mode.mjs

@@ -37,7 +37,7 @@ import { existsSync, readFileSync, mkdirSync, appendFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
-import { writeInboxItem, resolvePrivilege, resolveName, AGENT_REPO_DIR } from "./utils.mjs";
+import { writeInboxItem, resolvePrivilege, resolveName, slackChannelPrivacy, AGENT_REPO_DIR } from "./utils.mjs";
 import { handleSlashCommand, postSlashResponse } from "./lib/slash-command-handlers.mjs";
 
 /**
@@ -276,6 +276,20 @@ export function shouldKeepEvent(envelope, { ownSlackId, peerSlackIds, reactions,
 // Translation — Slack envelope → poller-compatible inbox item
 // ---------------------------------------------------------------------------
 
+/**
+ * CONFIDENTIALITY SIGNAL. Slack's conversation-ID prefix is NOT a reliable type
+ * indicator — a private channel can carry a `C…` id, and only `D` for a DM is
+ * dependable. The dependable signal is the event envelope's own `channel_type`,
+ * which this listener used to drop on the floor. We now carry it onto the inbox
+ * item, together with the booleans it implies, because the daemon's outcome gate
+ * (scripts/daemon/session-outcomes.mjs `outcomeSourceShareable`) requires a
+ * POSITIVE public signal before a turn's commitments may become org-visible.
+ *
+ * Re-exported from ./utils.mjs, the one place the decoding is defined (the
+ * Web-API poller stamps the same fields).
+ */
+export { slackChannelPrivacy } from "./utils.mjs";
+
 /**
  * Convert a Slack Socket Mode envelope to the same inbox-item shape that
  * `slack-poller.mjs` produces. Pure function; all I/O happens at the caller.
@@ -307,6 +321,9 @@ export function eventToInboxItem(envelope, { ownSlackId, principalSlackId, agent
     const channelLabel = isDm ? `dm/${senderName}` : channelId;
     const verb = event.type === "reaction_added" ? "added" : "removed";
     const targetText = typeof threadContext === "string" ? threadContext : "";
+    // A reaction envelope carries no `channel_type`; only the `D` prefix is
+    // dependable, so that is all we assert (and only in the private direction).
+    const reactionPrivacy = isDm ? { channel_type: "im", is_private: true, is_dm: true } : {};
     return {
       id: `${targetTs.replace(".", "-")}-reaction-${reactor}`,
       service: "slack",
@@ -329,6 +346,7 @@ export function eventToInboxItem(envelope, { ownSlackId, principalSlackId, agent
       raw_ref: `slack:${channelId}:${targetTs}:reaction`,
       source: "socket-mode",
       kind: "reaction",
+      ...reactionPrivacy,
     };
   }
 
@@ -338,6 +356,12 @@ export function eventToInboxItem(envelope, { ownSlackId, principalSlackId, agent
   const channelId = event.channel || "";
   const threadTs = event.thread_ts || "";
   const isReply = !!threadTs && threadTs !== ts;
+  // Slack's own conversation type, when the envelope carries one. See
+  // `slackChannelPrivacy` — this, not the id prefix, is the privacy signal.
+  const privacy = slackChannelPrivacy(event.channel_type);
+  // Routing/labelling stays on the historical `D`-prefix test (an `im` always
+  // has a `D` id anyway, and promoting an `mpim` to "DM" would change who the
+  // agent auto-replies to). `privacy` only informs the confidentiality fields.
   const isDm = typeof channelId === "string" && channelId.startsWith("D");
 
   // Friendly labels. We can't resolve a channel name without an API call
@@ -383,6 +407,8 @@ export function eventToInboxItem(envelope, { ownSlackId, principalSlackId, agent
     },
     raw_ref: `slack:${channelId}:${ts}`,
     source: "socket-mode",
+    // channel_type / is_private / is_dm — only when Slack actually told us.
+    ...privacy,
   };
   if (isCc) item.kind = "channel_cc";
   return item;

package/scripts/poller/slack-socket-mode.test.mjs

@@ -279,6 +279,58 @@ test("eventToInboxItem: thread reply preserves thread_id + is_reply", () => {
   assert.equal(item.thread_id, "1735689500.000100");
 });
 
+test("eventToInboxItem: carries Slack's channel_type as the privacy signal", () => {
+  // CONFIDENTIALITY. The listener used to drop `event.channel_type` entirely and
+  // derive privacy from the id prefix alone — but Slack mints `C…` ids for
+  // PRIVATE channels too, so downstream (the daemon's fail-closed outcome gate)
+  // had nothing dependable to admit on. Every kept event now carries the type,
+  // and the booleans it implies, verbatim off the envelope.
+  const mk = (channel, channelType) => eventToInboxItem(
+    makeEnvelope({
+      event: {
+        user: HUMAN_SLACK_ID,
+        channel,
+        ...(channelType === undefined ? {} : { channel_type: channelType }),
+        text: `<@${AGENT_SLACK_ID}> noted`,
+        ts: "1735689700.002000",
+      },
+    }),
+    { ownSlackId: AGENT_SLACK_ID, principalSlackId: PRINCIPAL_SLACK_ID, agentFirstName: "Ravi" }
+  );
+
+  const pub = mk("C0CHANNEL1", "channel");
+  assert.equal(pub.channel_type, "channel");
+  assert.equal(pub.is_private, false);
+  assert.equal(pub.is_dm, false);
+
+  // A private channel WITH a public-looking `C…` id — the leak vector.
+  const priv = mk("C0PRIVATE1", "group");
+  assert.equal(priv.channel_type, "group");
+  assert.equal(priv.is_private, true);
+
+  const mpim = mk("C0MPIM0001", "mpim");
+  assert.equal(mpim.channel_type, "mpim");
+  assert.equal(mpim.is_private, true);
+  assert.equal(mpim.is_dm, true);
+  assert.equal(mpim.channel, "C0MPIM0001", "an mpim is still routed as a channel, not promoted to a DM");
+
+  const im = mk("DABCDEF01", "im");
+  assert.equal(im.channel_type, "im");
+  assert.equal(im.is_private, true);
+  assert.equal(im.is_dm, true);
+
+  // No type on the envelope ⇒ assert NOTHING (a defaulted `is_private:false`
+  // would forge a public verdict the gate then admits on).
+  const unknown = mk("C0CHANNEL1", undefined);
+  assert.equal("channel_type" in unknown, false);
+  assert.equal("is_private" in unknown, false);
+  assert.equal("is_dm" in unknown, false);
+
+  // An unrecognised type is likewise not decoded into a verdict.
+  const weird = mk("C0CHANNEL1", "external_shared");
+  assert.equal("is_private" in weird, false);
+});
+
 test("eventToInboxItem: first-name mention (no @) still flips mentions_agent", () => {
   // "Hey Ravi, can you …" in a channel — no explicit @-mention but the
   // agent's first name appears. The poller uses this same heuristic.

package/scripts/poller/utils.mjs

@@ -10,6 +10,35 @@ export const AGENT_REPO_DIR = process.env.AGENT_DIR || join(__dirname, "../..");
 export const SOPHIE_AI_DIR = AGENT_REPO_DIR;
 export const ATTACHMENTS_DIR = join(AGENT_REPO_DIR, "state", "inbox", "attachments");
 
+/**
+ * CONFIDENTIALITY SIGNAL — decode Slack's conversation type into the fields an
+ * inbox item carries. Every Slack ingest path (Socket Mode, the Web-API poller,
+ * the cloud relay) routes through this one decoder so the meaning of
+ * `channel_type` / `is_private` / `is_dm` is defined in exactly one place.
+ *
+ * WHY IT EXISTS: Slack's conversation-ID prefix is NOT a reliable type
+ * indicator — a private channel can and does carry a `C…` id; only `D` for a DM
+ * is dependable. The dependable signal is `channel_type` on the event envelope
+ * ("channel" public | "group" private | "im" DM | "mpim" group DM), so that is
+ * what we decode and carry to the daemon's fail-closed outcome gate
+ * (scripts/daemon/session-outcomes.mjs `outcomeSourceShareable`).
+ *
+ * Returns `{}` for anything unrecognised or missing: asserting nothing keeps
+ * that gate closed, which is the safe direction.
+ *
+ * @param {unknown} channelType raw Slack `channel_type`
+ * @returns {{channel_type?:string, is_private?:boolean, is_dm?:boolean}}
+ */
+export function slackChannelPrivacy(channelType) {
+  switch (String(channelType || "").trim().toLowerCase()) {
+    case "channel": return { channel_type: "channel", is_private: false, is_dm: false };
+    case "group":   return { channel_type: "group", is_private: true, is_dm: false };
+    case "im":      return { channel_type: "im", is_private: true, is_dm: true };
+    case "mpim":    return { channel_type: "mpim", is_private: true, is_dm: true };
+    default:        return {};
+  }
+}
+
 export function writeInboxItem(service, item, agentRoot = AGENT_REPO_DIR) {
   const dir = join(agentRoot, "state", "inbox", service);
   mkdirSync(dir, { recursive: true });
@@ -159,6 +188,24 @@ raw_ref: "${item.raw_ref || ""}"
     yaml += `channel_id: "${item.channel_id}"\n`;
   }
 
+  // CONFIDENTIALITY SIGNALS. Slack's conversation-ID prefix is not a reliable
+  // type indicator (a private channel can carry a `C…` id), so downstream
+  // consumers — notably the daemon's fail-closed outcome gate,
+  // scripts/daemon/session-outcomes.mjs `outcomeSourceShareable` — need the
+  // conversation type/privacy the ingest layer read off the event itself.
+  // Written ONLY when actually known: an absent line must stay absent, because
+  // `is_private: false` is a positive "this is public" assertion and the reader
+  // (inbox-scan-poller.mjs `parseInboxItemYaml`) decodes it as a tri-state.
+  if (item.channel_type) {
+    yaml += `channel_type: "${item.channel_type}"\n`;
+  }
+  if (typeof item.is_private === "boolean") {
+    yaml += `is_private: ${item.is_private}\n`;
+  }
+  if (typeof item.is_dm === "boolean") {
+    yaml += `is_dm: ${item.is_dm}\n`;
+  }
+
   // Add event_type if present (e.g., message_changed, reaction)
   if (item.event_type) {
     yaml += `event_type: "${item.event_type}"\n`;

package/scripts/setup/gen-subagent-manifest.mjs

@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+/**
+ * gen-subagent-manifest.mjs — generate `agents/manifest.json`, layer 0's index
+ * (Sub-Agent Registry v1 §2.2).
+ *
+ * WHY THIS SCRIPT EXISTS. `agents/` ships in the npm package and is copied
+ * verbatim by `maestro create`, then MERGED (never overwritten) by
+ * `UPGRADE_PATHS`. That means an SDK fix to a shipped agent.md can never reach a
+ * deployed agent — an upgraded file and a hand-edited one look identical on disk.
+ * The manifest's per-agent sha256 breaks the tie: a file whose hash matches a
+ * manifest sha is a pristine copy and may be re-materialised; anything else is a
+ * human's edit and is sacred. That single fact is what lets `create`'s copy list
+ * and `UPGRADE_PATHS` stay EXACTLY as they are — no migration, no breaking change.
+ *
+ * Run at prepublish and commit the result:
+ *   node scripts/setup/gen-subagent-manifest.mjs
+ *   node scripts/setup/gen-subagent-manifest.mjs --check   # CI: fail on drift
+ *
+ * `--check` is the CI gate: it rebuilds the manifest in memory and fails when it
+ * differs from the committed one, so a shipped agent.md can never change without
+ * its sha changing with it (which would silently reclassify every deployed copy
+ * as a local edit and freeze it forever).
+ *
+ * Exit codes: 0 ok · 1 drift (with --check) · 2 an agent.md failed validation.
+ *
+ * Node builtins only. ESM.
+ *
+ * @module scripts/setup/gen-subagent-manifest
+ */
+
+"use strict";
+
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { buildManifest, manifestPath, readManifest, writeManifest } from "../../lib/subagents/manifest.mjs";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const MAESTRO_ROOT =
+  process.env.MAESTRO_ROOT && existsSync(join(process.env.MAESTRO_ROOT, "lib", "subagents", "manifest.mjs"))
+    ? process.env.MAESTRO_ROOT
+    : resolve(HERE, "..", "..");
+
+/** Read the package version so the manifest can name the release it describes. */
+function sdkVersion(root) {
+  try { return String(JSON.parse(readFileSync(join(root, "package.json"), "utf8")).version || ""); }
+  catch { return ""; }
+}
+
+/**
+ * Compare two manifests ignoring `generatedAt` — a timestamp differing on every
+ * run would make `--check` permanently red and train everyone to ignore it.
+ */
+function sameManifest(a, b) {
+  const strip = (m) => JSON.stringify({ sdkVersion: m.sdkVersion || "", agents: m.agents || {}, emptyDirs: m.emptyDirs || [] });
+  return strip(a || {}) === strip(b || {});
+}
+
+export function main(argv = process.argv.slice(2), root = MAESTRO_ROOT) {
+  const check = argv.includes("--check");
+  const strict = argv.includes("--strict");
+  const previous = readManifest(root);
+  const { manifest, invalid } = buildManifest({ maestroRoot: root, sdkVersion: sdkVersion(root), previous });
+
+  for (const bad of invalid) {
+    console.error(`[gen-subagent-manifest] agents/${bad.slug}/agent.md is invalid:`);
+    for (const e of bad.errors) console.error(`    - ${e}`);
+  }
+
+  if (check) {
+    if (!existsSync(manifestPath(root))) {
+      console.error(`[gen-subagent-manifest] ${manifestPath(root)} does not exist — run this script and commit it.`);
+      return 1;
+    }
+    if (!sameManifest(previous, manifest)) {
+      console.error("[gen-subagent-manifest] agents/manifest.json is STALE — an agent.md changed without regenerating it.");
+      console.error("    fix: node scripts/setup/gen-subagent-manifest.mjs && git add agents/manifest.json");
+      return 1;
+    }
+    console.log(`[gen-subagent-manifest] up to date (${Object.keys(manifest.agents).length} agents).`);
+    return invalid.length && strict ? 2 : 0;
+  }
+
+  const p = writeManifest(root, manifest);
+  console.log(`[gen-subagent-manifest] wrote ${p} (${Object.keys(manifest.agents).length} agents, sdk ${manifest.sdkVersion || "?"}).`);
+  if (manifest.emptyDirs && manifest.emptyDirs.length) {
+    console.warn(`[gen-subagent-manifest] ${manifest.emptyDirs.length} agents/ directory(ies) have no agent.md: ${manifest.emptyDirs.join(", ")}`);
+  }
+  return invalid.length && strict ? 2 : 0;
+}
+
+// Only run when invoked directly (importable for tests).
+if (process.argv[1] && resolve(process.argv[1]) === resolve(fileURLToPath(import.meta.url))) {
+  process.exit(main());
+}