@cohortapp/agent-sdk 2.3.2 → 2.4.0

package/lib/org/messaging.mjs

@@ -431,8 +431,28 @@ export async function pullInbound(o = {}) {
       maxSeq = Math.max(Number(maxSeq) || 0, Number(ev.seq));
     }
     const directed = isDirectedAtAgent(ev, me, { myChannelIds });
-    if (!directed) continue;
-    events.push(toMessageEvent(ev, me));
+    if (directed) {
+      events.push(toMessageEvent(ev, me));
+      continue;
+    }
+    // MENTION CANDIDATE. The org-wide feed says `mentionCount` — a NUMBER —
+    // and deliberately does NOT name who was mentioned: it is readable by every
+    // agent holding `org.read`, so listing member ids there would leak the
+    // association graph of private rooms (the payload is a REDACTED audit row
+    // by design). That redaction is right, and it is also why this filter alone
+    // is deaf to an @mention in a space.
+    //
+    // So resolve it the ACL-safe way: mark it a candidate here and confirm it
+    // below against `messaging.history`, which hq gates PER MEMBER. If this
+    // agent cannot read that room, it gets nothing back and the candidate is
+    // dropped — fail-closed, with no widening of what the shared feed says.
+    const p = ev.payload || ev;
+    const count = Number(p.mentionCount || 0);
+    if (me && count > 0) {
+      const cand = toMessageEvent(ev, me);
+      cand._mentionCandidate = true;
+      events.push(cand);
+    }
   }
 
   // HYDRATE THE BODY. The org event feed is redacted by design — it carries
@@ -448,7 +468,7 @@ export async function pullInbound(o = {}) {
   //
   // Fail-open: a message we cannot hydrate is dropped rather than delivered
   // blank, because a blank inbound produces a nonsense reply in a real room.
-  const needBody = events.filter((e) => !e.text && e.kind !== "call");
+  const needBody = events.filter((e) => (!e.text || e._mentionCandidate) && e.kind !== "call");
   if (needBody.length) {
     const byChannel = new Map();
     for (const e of needBody) {
@@ -471,6 +491,10 @@ export async function pullInbound(o = {}) {
           const hit = byId.get(String(e.message_id));
           if (!hit) continue;
           e.text = String(hit.body ?? hit.text ?? "");
+          // The ACL'd read is the ONLY place mention identities are trusted.
+          e._mentions = Array.isArray(hit.mentions)
+            ? hit.mentions.map((m) => String((m && (m.memberId || m.id)) ?? m))
+            : [];
           if (!e.from.name || e.from.name === e.from.id) {
             e.from.name = String(hit.authorName || hit.author?.displayName || e.from.name || "");
           }
@@ -481,7 +505,19 @@ export async function pullInbound(o = {}) {
     }
   }
 
-  const delivered = events.filter((e) => e.kind === "call" || (e.text && e.text.trim()));
+  // Confirm the mention candidates against what history actually returned. A
+  // candidate survives ONLY if this agent's id is in that message's `mentions`
+  // — proven by an ACL'd read, never inferred from the shared feed.
+  const confirmed = events.filter((e) => {
+    if (!e._mentionCandidate) return true;
+    const ok = Array.isArray(e._mentions) && e._mentions.map(String).includes(String(me));
+    if (!ok) return false;
+    e.reason = "mention";
+    return true;
+  });
+  for (const e of confirmed) { delete e._mentionCandidate; delete e._mentions; }
+
+  const delivered = confirmed.filter((e) => e.kind === "call" || (e.text && e.text.trim()));
   return { events: delivered, nextCursor: raw.length ? maxSeq : cursor };
 }
 

package/lib/org/messaging.test.mjs

@@ -313,3 +313,43 @@ test("isDirectedAtAgent: a call event in my room is an invite", () => {
                payload: { channelId: "room-1", topic: "standup" } };
   assert.equal(isDirectedAtAgent(ev, "agent-self", { myChannelIds: mine }), true);
 });
+
+test("isDirectedAtAgent: the SHARED feed never names who was mentioned", () => {
+  // hq's chain payload is a REDACTED audit row read by every agent holding
+  // `org.read`, so it carries `mentionCount` and deliberately NOT the member
+  // ids — listing them would leak the association graph of private rooms. This
+  // filter therefore cannot resolve a space @mention on its own, BY DESIGN;
+  // pullInbound confirms candidates against the per-member `messaging.history`
+  // read instead. Asserted so nobody "fixes" the deafness by widening the feed.
+  const shared = {
+    family: "messaging", kind: "send", entityId: "msg_1", actor: "human-1",
+    payload: { channelId: "space-general", channelKind: "PUBLIC", mentionCount: 1 },
+  };
+  assert.equal(isDirectedAtAgent(shared, "agent-self"), false);
+});
+
+test("isDirectedAtAgent: an explicit mentions[] still wins when a producer supplies one", () => {
+  // hq's chain payload used to carry `mentionCount` — a NUMBER — so an agent
+  // tailing the feed could see that a mention happened but not that it was the
+  // one mentioned. Combined with hq deferring to live daemons, an @mention in a
+  // public space reached nobody: the server stayed quiet and the agent was deaf.
+  // hq now emits `mentions: [memberId…]`, which this filter already understood.
+  const ev = {
+    seq: 10500,
+    family: "messaging",
+    kind: "send",
+    entityId: "msg_1",
+    actor: "human-1",
+    payload: {
+      channelId: "space-general",
+      channelKind: "PUBLIC",
+      mentions: ["agent-self"],
+      mentionCount: 1,
+      recipientCount: 12,
+    },
+  };
+  // Membership is NOT required for a mention — being named is the invitation.
+  assert.equal(isDirectedAtAgent(ev, "agent-self"), true);
+  // …and someone else's mention in the same space is still not ours.
+  assert.equal(isDirectedAtAgent(ev, "agent-other"), false);
+});