@desplega.ai/agent-swarm 1.136.0 → 1.138.0

package/dist/{cli-ads0hfw2.js → cli-6v4d8r8c.js}

@@ -8,46 +8,16 @@ import {
   REFERENCES_SOURCE_MAX_LENGTH,
   sanitizeReferencesSource
 } from "./cli-8p37s71j.js";
-import {
-  AGENT_MAX_TASKS_CONFIG_KEY,
-  createTrackerAgentMapping,
-  createTrackerSync,
-  createTrackerSyncIfAbsent,
-  createWorkerTaskFollowUp,
-  deleteTrackerSync,
-  getAllTrackerSyncs,
-  getTrackerSync,
-  getTrackerSyncByExternalId,
-  hasTrackerDelivery,
-  markRuntimeInstanceOffline,
-  markTrackerDelivery,
-  reconcileAgentStatusFromRuntimes,
-  repointTrackerSyncBySwarmId,
-  resetAgentMaxTasksMirror,
-  touchRuntimeInstance,
-  updateTrackerSync,
-  updateTrackerSyncSwarmId,
-  upsertSwarmConfigWithPolicyMirror
-} from "./cli-5bnz1t86.js";
-import {
-  isMultiRuntimeEnabled
-} from "./cli-qh4sqfws.js";
-import {
-  calculateNextRun,
-  ensure,
-  require_dist,
-  runScheduleNow
-} from "./cli-fpjmcbhz.js";
 import {
   startPricingRefreshLoop
-} from "./cli-z6e8eqrm.js";
+} from "./cli-47esr8ht.js";
 import {
   seedPricingFromModelsDev
-} from "./cli-tee8w7tq.js";
+} from "./cli-s6t1qv67.js";
 import {
   ensureRbacSeedsSynced,
   getUserGrant
-} from "./cli-3y553gws.js";
+} from "./cli-y294regh.js";
 import {
   can,
   decideAdmission,
@@ -74,7 +44,41 @@ import {
   runSavedScriptAsAgent,
   updateApp,
   upgradeAppDefinition
-} from "./cli-68vayryq.js";
+} from "./cli-tb4csb08.js";
+import {
+  AGENT_MAX_TASKS_CONFIG_KEY,
+  createTrackerAgentMapping,
+  createTrackerSync,
+  createTrackerSyncIfAbsent,
+  createWorkerTaskFollowUp,
+  deleteTrackerSync,
+  getAllTrackerSyncs,
+  getTrackerSync,
+  getTrackerSyncByExternalId,
+  hasTrackerDelivery,
+  markRuntimeInstanceOffline,
+  markTrackerDelivery,
+  reconcileAgentStatusFromRuntimes,
+  repointTrackerSyncBySwarmId,
+  resetAgentMaxTasksMirror,
+  touchRuntimeInstance,
+  updateTrackerSync,
+  updateTrackerSyncSwarmId,
+  upsertSwarmConfigWithPolicyMirror
+} from "./cli-f9skf1v7.js";
+import {
+  isMultiRuntimeEnabled
+} from "./cli-qh4sqfws.js";
+import {
+  ZodFirstPartyTypeKind,
+  objectType
+} from "./cli-fad8m16k.js";
+import {
+  calculateNextRun,
+  ensure,
+  require_dist,
+  runScheduleNow
+} from "./cli-ba87cw29.js";
 import {
   TriggerSchemaError,
   applyDefinitionPatch,
@@ -88,7 +92,7 @@ import {
   startWorkflowExecution,
   validateDefinition,
   validateJsonSchema
-} from "./cli-jjhnma34.js";
+} from "./cli-4jaj24py.js";
 import {
   ConnectionAuthInputSchema,
   SCRIPT_LONG_TIMEOUT_HINT_MS,
@@ -107,7 +111,7 @@ import {
   setScriptConnectionEnabled,
   upsertCredentialBinding,
   upsertScriptConnection
-} from "./cli-bnq8h7ea.js";
+} from "./cli-3719ggyf.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
@@ -122,7 +126,7 @@ import {
   isGraphExpansionEnabled,
   rerank,
   rowToCandidate
-} from "./cli-hz5hp6wn.js";
+} from "./cli-yh2eybyt.js";
 import {
   buildAuthorizationUrl,
   createOAuthApp,
@@ -137,11 +141,7 @@ import {
   listAuthorizationsForApp,
   onAuthorizationRefreshed,
   upsertOAuthApp
-} from "./cli-m3z53bed.js";
-import {
-  ZodFirstPartyTypeKind,
-  objectType
-} from "./cli-fad8m16k.js";
+} from "./cli-b4zdc3x6.js";
 import {
   AgentFsProvider
 } from "./cli-fhsz3twr.js";
@@ -149,7 +149,7 @@ import {
   createAdditiveBuffer,
   extractSlackMessageText,
   parseSlackTs
-} from "./cli-84vrhesc.js";
+} from "./cli-qf34ej1d.js";
 import {
   findOrCreateUserByEmail,
   findUserByExternalId,
@@ -165,10 +165,10 @@ import {
   resolveIdentityByEmail,
   resolveUserByToken,
   unlinkIdentity
-} from "./cli-spf767vc.js";
+} from "./cli-y43043ws.js";
 import {
   createTaskWithSiblingAwareness
-} from "./cli-gpdtxzar.js";
+} from "./cli-23cpnqk9.js";
 import {
   getAgentDisplayName,
   getAgentEmoji,
@@ -177,7 +177,7 @@ import {
   markdownToSlack,
   startSlackApp,
   stopSlackApp
-} from "./cli-d5ygfv18.js";
+} from "./cli-cywkhzqs.js";
 import {
   $OpenAPIRegistry,
   $OpenApiGeneratorV31,
@@ -261,6 +261,7 @@ import {
   deleteSwarmConfig,
   deleteUser,
   deleteWorkflow,
+  emitMcpServerConnectedTelemetry,
   failTask,
   findCompletedTaskInThread,
   findExistingLinearTrackerContextWork,
@@ -422,7 +423,7 @@ import {
   upsertPromptTemplate,
   upsertService,
   validateConfigValue
-} from "./cli-tmn19cdz.js";
+} from "./cli-kq9htgbr.js";
 import {
   generateDefaultClaudeMd,
   generateDefaultIdentityMd,
@@ -454,17 +455,6 @@ import {
   exports_zod,
   init_zod
 } from "./cli-s35981d0.js";
-import {
-  init_secret_scrubber,
-  refreshSecretScrubberCache,
-  registerVolatileSecret,
-  scrubObject,
-  scrubSecrets
-} from "./cli-mkq1rk7b.js";
-import {
-  init_package,
-  package_default
-} from "./cli-4r4jkqep.js";
 import {
   $ZodObject,
   $ZodType,
@@ -506,6 +496,17 @@ import {
   unknown,
   uuid
 } from "./cli-pqv5gvyf.js";
+import {
+  init_package,
+  package_default
+} from "./cli-kkn46gfr.js";
+import {
+  init_secret_scrubber,
+  refreshSecretScrubberCache,
+  registerVolatileSecret,
+  scrubObject,
+  scrubSecrets
+} from "./cli-mkq1rk7b.js";
 import {
   init_event_bus,
   workflowEventBus
@@ -22956,7 +22957,7 @@ async function notifySlack(text) {
     return;
   }
   try {
-    const { getSlackApp: getSlackApp2 } = await import("./app-g2s78xya.js");
+    const { getSlackApp: getSlackApp2 } = await import("./app-wb6bc7tt.js");
     const app = getSlackApp2();
     if (!app) {
       console.warn("[Jira webhook keepalive] Slack not available, cannot send notification");
@@ -23027,7 +23028,7 @@ async function deleteJiraWebhook(webhookId) {
   console.log(`[Jira webhook keepalive] Deleted webhook id=${webhookId}`);
 }
 async function overwriteWebhookIds(next) {
-  const { getDbClient: getDbClient2 } = await import("./db-0npp39zd.js");
+  const { getDbClient: getDbClient2 } = await import("./db-x61ncfa1.js");
   await getDbClient2().transaction(async (tx) => {
     const row = await tx.get("SELECT metadata FROM oauth_apps WHERE provider = 'jira'");
     if (!row) {
@@ -96703,6 +96704,8 @@ var realWithSpanContext;
 var realInjectTraceContext;
 var realShutdown;
 var realRecordSessionCost;
+var realRecordDbRetentionSweep;
+var realRecordDbRetentionStatement;
 function isPollTracingEnabled() {
   const v = (process.env.OTEL_TRACE_POLL ?? "").trim().toLowerCase();
   return v === "1" || v === "true" || v === "yes" || v === "on";
@@ -96712,7 +96715,7 @@ async function initOtel(serviceRole = process.env.AGENT_ROLE || "api") {
     return;
   initialized6 = true;
   try {
-    const impl = await import("./otel-impl-54cra6mw.js");
+    const impl = await import("./otel-impl-k47aj4sd.js");
     await impl.boot(serviceRole);
     realWithSpan = impl.withSpan;
     realStartSpan = impl.startSpan;
@@ -96721,6 +96724,8 @@ async function initOtel(serviceRole = process.env.AGENT_ROLE || "api") {
     realInjectTraceContext = impl.injectTraceContext;
     realShutdown = impl.shutdown;
     realRecordSessionCost = impl.recordSessionCost;
+    realRecordDbRetentionSweep = impl.recordDbRetentionSweep;
+    realRecordDbRetentionStatement = impl.recordDbRetentionStatement;
     console.log(`[OTel] enabled for ${impl.resolveServiceName(serviceRole)} (${serviceRole})`);
   } catch (error) {
     console.warn(`[OTel] disabled after initialization failure: ${error}`);
@@ -96761,6 +96766,16 @@ function recordSessionCost(m) {
     return;
   realRecordSessionCost(m);
 }
+function recordDbRetentionSweep(m) {
+  if (!otelConfigured() || !realRecordDbRetentionSweep)
+    return;
+  realRecordDbRetentionSweep(m);
+}
+function recordDbRetentionStatement(table, dryRun, durationMs) {
+  if (!otelConfigured() || !realRecordDbRetentionStatement)
+    return;
+  realRecordDbRetentionStatement(table, dryRun, durationMs);
+}
 
 // src/tools/utils.ts
 init_secret_scrubber();
@@ -101464,7 +101479,8 @@ var looseRoutingAffinitySchema = looseObject({
   sourceAgentId: string().optional(),
   role: string().optional(),
   harnessProvider: string().optional(),
-  capabilities: array(string()).optional()
+  capabilities: array(string()).optional(),
+  leadOnly: boolean().optional()
 });
 var looseAgentTaskOutputSchema = looseObject({
   id: string().optional(),
@@ -102645,6 +102661,35 @@ var OAUTH_PRESETS = [
       "Notion has no OAuth scopes; capability is configured on the integration in Notion's developer settings.",
       "owner=user is required to receive a user-scoped token and is set here."
     ]
+  },
+  {
+    id: "microsoft",
+    displayName: "Microsoft 365 (Graph)",
+    provider: "microsoft",
+    authorizeUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
+    tokenUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/token",
+    scopes: [
+      "openid",
+      "profile",
+      "offline_access",
+      "User.Read",
+      "User.ReadBasic.All",
+      "Channel.ReadBasic.All",
+      "ChannelMessage.Read.All",
+      "ChannelMessage.Send",
+      "Chat.ReadWrite",
+      "Mail.Read",
+      "Mail.Send",
+      "Files.Read"
+    ],
+    scopeSeparator: " ",
+    tokenAuthStyle: "body",
+    tokenBodyFormat: "form",
+    setupHints: [
+      "Single-tenant apps must replace the common tenant segment in authorizeUrl and tokenUrl with their Microsoft Entra tenant ID by using the endpoint overrides.",
+      "offline_access is required for Microsoft Entra to issue a refresh token and is included in this preset.",
+      "An administrator may need to grant tenant-wide consent for the Teams read scopes before users can authorize the connection."
+    ]
   }
 ];
 function listOAuthPresets() {
@@ -104454,6 +104499,7 @@ var registerMcpServerCreateTool = (server) => {
         headerConfigKeys: args.headerConfigKeys,
         extraAuthorizeParams: args.extraAuthorizeParams
       });
+      await emitMcpServerConnectedTelemetry();
       await installMcpServer(requestInfo.agentId, created.id);
       return toolOk(`Created and installed MCP server "${created.name}" (${created.id}).`, {
         data: { yourAgentId: requestInfo.agentId, server: created }
@@ -105214,6 +105260,29 @@ async function getLinksForMemory(memoryId, options = {}) {
 
 // src/be/memory/raters/retrieval.ts
 init_db();
+function dedupeMemoryDocumentIds(memories) {
+  const documents = new Map;
+  for (const memory of memories) {
+    const identity = memory.sourcePath ?? memory.key;
+    if (identity == null)
+      continue;
+    const documentKey = JSON.stringify([memory.agentId, memory.scope, identity]);
+    if (!documents.has(documentKey))
+      documents.set(documentKey, memory.id);
+  }
+  return [...documents.values()];
+}
+async function recordMemoryAccesses(memoryIds) {
+  const ids = [...new Set(memoryIds)].filter(Boolean);
+  if (ids.length === 0)
+    return;
+  const now = new Date().toISOString();
+  await getDbClient().transaction(async (tx) => {
+    for (const id of ids) {
+      await tx.run("UPDATE agent_memory SET accessedAt = ?, accessCount = accessCount + 1 WHERE id = ?", [now, id]);
+    }
+  });
+}
 async function recordRetrievals(taskId, agentId, results, sessionId, extras) {
   if (!taskId || results.length === 0)
     return;
@@ -105578,6 +105647,7 @@ var memorySearchOutputSchema = swarmToolOutputSchema({
     retrievalSource: _enum(["vec", "fts", "hybrid", "fallback", "graph"]).optional(),
     tags: array(string()).optional(),
     createdAt: string().optional(),
+    accessCount: number().int().optional(),
     rateHint: string().optional()
   })).optional()
 });
@@ -105585,7 +105655,7 @@ var registerMemorySearchTool = (server) => {
   createToolRegistrar(server)("memory-search", {
     title: "Search memories",
     description: "Search your accumulated memories using natural language. Returns summaries with IDs — use memory-get to retrieve full content.",
-    annotations: { readOnlyHint: true },
+    annotations: { readOnlyHint: false },
     inputSchema: object({
       query: string().min(1).describe("Natural language search query."),
       intent: string().min(1).describe("Why you are searching for this memory. Required. E.g. 'looking for auth pattern to fix login bug'."),
@@ -105629,6 +105699,13 @@ var registerMemorySearchTool = (server) => {
           console.error("[memory-search] recordRetrievals failed:", err.message);
         }
       }
+      const consumedIds2 = dedupeMemoryDocumentIds(ranked);
+      try {
+        await recordMemoryAccesses(consumedIds2);
+      } catch (err) {
+        console.error("[memory-search] recordMemoryAccesses failed:", err.message);
+      }
+      const consumedIdSet2 = new Set(consumedIds2);
       const inTaskContext = !!requestInfo.sourceTaskId;
       const mapped2 = ranked.map((r) => ({
         id: r.id,
@@ -105640,6 +105717,7 @@ var registerMemorySearchTool = (server) => {
         retrievalSource: r.retrievalSource,
         tags: r.tags,
         createdAt: r.createdAt,
+        accessCount: (r.accessCount ?? 0) + (consumedIdSet2.has(r.id) ? 1 : 0),
         ...inTaskContext && NUDGE_ELIGIBLE_SOURCES2.has(r.source) ? { rateHint: rateHintFor(r.id) } : {}
       }));
       return toolOk(`Found ${mapped2.length} memories matching "${query}".`, {
@@ -105653,6 +105731,13 @@ var registerMemorySearchTool = (server) => {
       isLead,
       source
     });
+    const consumedIds = dedupeMemoryDocumentIds(recent);
+    try {
+      await recordMemoryAccesses(consumedIds);
+    } catch (err) {
+      console.error("[memory-search] recordMemoryAccesses failed:", err.message);
+    }
+    const consumedIdSet = new Set(consumedIds);
     const mapped = recent.map((r) => ({
       id: r.id,
       name: r.name,
@@ -105660,7 +105745,8 @@ var registerMemorySearchTool = (server) => {
       source: r.source,
       scope: r.scope,
       tags: r.tags,
-      createdAt: r.createdAt
+      createdAt: r.createdAt,
+      accessCount: (r.accessCount ?? 0) + (consumedIdSet.has(r.id) ? 1 : 0)
     }));
     return toolOk(`Embedding unavailable (no OPENAI_API_KEY). Showing ${mapped.length} most recent memories.`, {
       details: renderResults(mapped),
@@ -109586,7 +109672,8 @@ var sendTaskInputSchema = object({
   offerMode: boolean().default(false).describe("If true, offer the task instead of direct assign (agent must accept/reject)."),
   taskType: string().max(50).optional().describe("Task type (e.g., 'bug', 'feature', 'review')."),
   tags: array(string()).optional().describe("Tags for filtering (e.g., ['urgent', 'frontend'])."),
-  requiredCapabilities: array(string()).optional().describe("Capabilities a claiming agent must have (declared via join-swarm/update-profile) to be pool-eligible for this task. Written into the created task's routingAffinity (role is left unset — only enforced when the pool auto-claim/claim-tool paths check it). Most useful when omitting agentId (unassigned pool task); a no-op for a task with an explicit agentId, which bypasses the pool gate entirely."),
+  requiredCapabilities: array(string()).optional().describe("Capabilities required for pool routing."),
+  leadOnly: boolean().default(false).describe("Structured authorization constraint for merge or other privileged work. Only Lead agents may be assigned, offered, or claim it; never inferred from task text."),
   priority: number().int().min(0).max(100).optional().describe("Priority 0-100 (default: 50)."),
   dependsOn: array(uuid()).optional().describe("Task IDs this task depends on."),
   parentTaskId: uuid().optional().describe("Parent task ID for session continuity. Child task will resume the parent's Claude session. Auto-routes to the same worker unless agentId is explicitly provided."),
@@ -109642,6 +109729,7 @@ async function sendTaskHandler(ctx, {
   taskType,
   tags,
   requiredCapabilities,
+  leadOnly,
   priority,
   dependsOn,
   dir,
@@ -109675,6 +109763,12 @@ async function sendTaskHandler(ctx, {
   const normalizedModel = splitLegacyModelAlias({ model, modelTier });
   const effectiveParentTaskId = parentTaskId ?? sourceTaskId;
   const effectiveParentTask = effectiveParentTaskId ? await getTaskById(effectiveParentTaskId) : null;
+  if (effectiveParentTask?.routingAffinityInvalid) {
+    return toolErr("Cannot continue a task with an invalid routing affinity.", {
+      data: { yourAgentId: creatorAgentId }
+    });
+  }
+  const effectiveLeadOnly = leadOnly || effectiveParentTask?.routingAffinity?.leadOnly === true;
   if (!overrideSlackContext) {
     const inheritedContextKey = effectiveParentTask?.contextKey;
     const routingCheck = checkSlackRoutingCoherence({
@@ -109776,7 +109870,7 @@ async function sendTaskHandler(ctx, {
         slackUserId,
         overrideSlackContext,
         followUpConfig,
-        routingAffinity: requiredCapabilities?.length ? { capabilities: requiredCapabilities } : undefined
+        routingAffinity: effectiveLeadOnly || requiredCapabilities?.length ? { leadOnly: effectiveLeadOnly, capabilities: requiredCapabilities ?? [] } : undefined
       });
       await transferTrackerSyncToResumeChild({
         parentTaskId: effectiveParentTaskId,
@@ -109796,10 +109890,10 @@ async function sendTaskHandler(ctx, {
         message: `Agent with ID "${effectiveAgentId}" not found.`
       };
     }
-    if (agent.isLead) {
+    if (effectiveLeadOnly && !agent.isLead) {
       return {
         success: false,
-        message: `Cannot assign tasks to the lead agent "${agent.name}", wtf?`
+        message: `Lead-only task requires a Lead agent; "${agent.name}" is not a Lead.`
       };
     }
     if (!offerMode && !await hasCapacity(effectiveAgentId)) {
@@ -109830,7 +109924,8 @@ async function sendTaskHandler(ctx, {
         slackThreadTs,
         slackUserId,
         overrideSlackContext,
-        followUpConfig
+        followUpConfig,
+        routingAffinity: effectiveLeadOnly || requiredCapabilities?.length ? { leadOnly: effectiveLeadOnly, capabilities: requiredCapabilities ?? [] } : undefined
       });
       await transferTrackerSyncToResumeChild({
         parentTaskId: effectiveParentTaskId,
@@ -109863,7 +109958,8 @@ async function sendTaskHandler(ctx, {
       slackThreadTs,
       slackUserId,
       overrideSlackContext,
-      followUpConfig
+      followUpConfig,
+      routingAffinity: effectiveLeadOnly || requiredCapabilities?.length ? { leadOnly: effectiveLeadOnly, capabilities: requiredCapabilities ?? [] } : undefined
     });
     await transferTrackerSyncToResumeChild({
       parentTaskId: effectiveParentTaskId,
@@ -113368,7 +113464,8 @@ var taskActionInputSchema = object({
   model: string().trim().min(1).optional().describe("Concrete model override for the created task, interpreted by the claiming worker's harness/provider. This does not switch providers. Only used with 'create' action."),
   modelTier: ModelTierSchema.optional().describe("Portable model tier for the created task: 'smol', 'regular', 'smart', or 'ultra'. Resolved when a worker claims/runs the task. Only used with 'create' action."),
   effort: ReasoningEffortSchema.optional().describe("Reasoning effort for the created task: 'off', 'low', 'medium', 'high', 'xhigh', or 'max'. Only used with 'create' action."),
-  requiredCapabilities: array(string()).optional().describe("Capabilities a claiming agent must have (declared via join-swarm/update-profile) to be pool-eligible for this task. Written into the created task's routingAffinity (role is left unset). Only used with 'create' action.")
+  requiredCapabilities: array(string()).optional().describe("Capabilities required for pool routing."),
+  leadOnly: boolean().default(false).describe("Structured authorization constraint: only Lead agents may claim this privileged task.")
 });
 var taskActionOutputSchema = swarmToolOutputSchema({
   yourAgentId: string().optional(),
@@ -113418,7 +113515,8 @@ async function taskActionHandler(ctx, input) {
     reason,
     dir,
     model,
-    requiredCapabilities
+    requiredCapabilities,
+    leadOnly
   } = input;
   const normalizedModel = splitLegacyModelAlias({ model, modelTier: input.modelTier });
   if (ctx.kind === "user") {
@@ -113504,7 +113602,7 @@ async function taskActionHandler(ctx, input) {
           model: normalizedModel.model,
           modelTier: normalizedModel.modelTier,
           effort: input.effort,
-          routingAffinity: requiredCapabilities?.length ? { capabilities: requiredCapabilities } : undefined
+          routingAffinity: leadOnly || requiredCapabilities?.length ? { leadOnly, capabilities: requiredCapabilities ?? [] } : undefined
         });
         return {
           success: true,
@@ -113548,7 +113646,7 @@ async function taskActionHandler(ctx, input) {
         if (claimingAgent && !isAgentEligibleForTask(claimingAgent, existingTask)) {
           return {
             success: false,
-            message: `Task "${taskId}" requires role "${existingTask.routingAffinity?.role ?? "(unspecified)"}"; yours is "${claimingAgent.role ?? "(unspecified)"}". Cannot claim.`
+            message: existingTask.routingAffinity?.leadOnly ? `Task "${taskId}" is Lead-only; you are not authorized to claim it.` : `Task "${taskId}" requires role "${existingTask.routingAffinity?.role ?? "(unspecified)"}"; yours is "${claimingAgent.role ?? "(unspecified)"}". Cannot claim.`
           };
         }
         const claimedTask = await claimTask(taskId, agentId);
@@ -115349,6 +115447,38 @@ async function createServer(opts = {}) {
   return server;
 }
 
+// src/prompts/memories.ts
+var SIMILARITY_THRESHOLD = 0.4;
+var RATE_TOOL_HINT = `
+
+When a memory above genuinely helps you solve this task — or actively
+misleads you — call \`memory_rate\` with the memory id and useful=true/false.
+This trains the swarm to surface better memories next time. Use sparingly:
+2-5 ratings per task is plenty.`;
+function renderMemoriesPrompt(memories) {
+  const useful = memories.filter((m) => m.similarity > SIMILARITY_THRESHOLD);
+  if (useful.length === 0)
+    return null;
+  const memoryContext = useful.map((m) => `- **${m.name}** (id: ${m.id}): ${m.content.substring(0, 300)}`).join(`
+`);
+  let prompt = `
+
+### Relevant Past Knowledge
+
+These memories from your previous sessions may be useful. Use \`memory-get\` with the memory ID to retrieve full details.
+
+${memoryContext}
+`;
+  if (isExplicitSelfRaterEnabled()) {
+    prompt += RATE_TOOL_HINT;
+  }
+  return prompt;
+}
+function isExplicitSelfRaterEnabled() {
+  const ratersEnabled = (process.env.MEMORY_RATERS ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+  return ratersEnabled.includes("explicit-self");
+}
+
 // src/utils/skill-fs-writer.ts
 import { existsSync, mkdirSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { dirname as dirname2, join as join3 } from "node:path";
@@ -115488,4 +115618,4 @@ function writeSkillsToFilesystem(entries, harnessType = "all", home) {
   return { synced, removed, errors };
 }
 
-export { safeParseAsync2 as safeParseAsync, normalizeObjectSchema, getParseErrorMessage, DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, isInboxAllowed, isSenderAllowed, handleMessageReceived, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, runtimeInstanceHeader, describeRequestRoute, route, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, mcpOverflowAuthError, isPollTracingEnabled, initOtel, withSpan, startSpan, withSpanContext, withRemoteContext, injectTraceContext, recordSessionCost, markScriptSdkRequestOrigin, toolErr, createToolRegistrar, userCtx, resolveTaskAuditUserId, resolveHttpAuditUserId, resolveHttpFavoriteOwner, handleApps, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, refreshLinks, canReadMemory, getLinksForMemory, recordRetrievals, expandCandidatesWithGraph, indexMemoryContent, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, sendTaskOutputSchema, sendTaskHandler, parseSkillContent, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, guardTerminalTaskResultWrite, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer, writeSkillsToFilesystem };
+export { safeParseAsync2 as safeParseAsync, normalizeObjectSchema, getParseErrorMessage, DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, isInboxAllowed, isSenderAllowed, handleMessageReceived, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, runtimeInstanceHeader, describeRequestRoute, route, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, mcpOverflowAuthError, isPollTracingEnabled, initOtel, withSpan, startSpan, withSpanContext, withRemoteContext, injectTraceContext, recordSessionCost, recordDbRetentionSweep, recordDbRetentionStatement, markScriptSdkRequestOrigin, toolErr, createToolRegistrar, userCtx, resolveTaskAuditUserId, resolveHttpAuditUserId, resolveHttpFavoriteOwner, handleApps, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, refreshLinks, canReadMemory, getLinksForMemory, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, expandCandidatesWithGraph, indexMemoryContent, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, sendTaskOutputSchema, sendTaskHandler, parseSkillContent, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, guardTerminalTaskResultWrite, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer, SIMILARITY_THRESHOLD, renderMemoriesPrompt, writeSkillsToFilesystem };

package/dist/{cli-mgef08pc.js → cli-8rtyss6g.js}

@@ -1,7 +1,7 @@
 import {
   init_package,
   package_default
-} from "./cli-4r4jkqep.js";
+} from "./cli-kkn46gfr.js";
 
 // src/commands/shared/client-config.ts
 init_package();

package/dist/{cli-35jknh9e.js → cli-9w7vsmbm.js}

@@ -1,13 +1,13 @@
 import {
   createAdditiveBuffer,
   extractSlackMessageText
-} from "./cli-84vrhesc.js";
+} from "./cli-qf34ej1d.js";
 import {
   rewriteSlackMentions
-} from "./cli-y16cesaq.js";
+} from "./cli-vy48y9bx.js";
 import {
   createTaskWithSiblingAwareness
-} from "./cli-gpdtxzar.js";
+} from "./cli-23cpnqk9.js";
 import {
   buildBufferFlushBlocks,
   ensureSlackThreadTree,
@@ -16,7 +16,7 @@ import {
   getSlackApp,
   isSlackRenderV2Enabled,
   registerTreeMessage
-} from "./cli-d5ygfv18.js";
+} from "./cli-cywkhzqs.js";
 import {
   createLogEntry,
   getAgentById,
@@ -29,7 +29,7 @@ import {
   init_steering,
   requestSteering,
   slackContextKey
-} from "./cli-tmn19cdz.js";
+} from "./cli-kq9htgbr.js";
 import {
   init_registry,
   init_steering_enabled,

package/dist/{cli-m3z53bed.js → cli-b4zdc3x6.js}

@@ -7,7 +7,7 @@ import {
   init_date_utils,
   init_db,
   normalizeDateRequired
-} from "./cli-tmn19cdz.js";
+} from "./cli-kq9htgbr.js";
 import {
   init_secret_scrubber,
   registerVolatileSecret,

package/dist/{cli-fpjmcbhz.js → cli-ba87cw29.js}

@@ -2,17 +2,17 @@ import {
   getExecutorRegistry,
   handleScheduleTrigger,
   startWorkflowExecution
-} from "./cli-jjhnma34.js";
+} from "./cli-4jaj24py.js";
 import {
   buildScriptCredentialBindings,
   getScript,
   getScriptApiConnectionDescriptors,
   getScriptMcpConnectionDescriptors,
   runScript
-} from "./cli-bnq8h7ea.js";
+} from "./cli-3719ggyf.js";
 import {
   createTaskWithSiblingAwareness
-} from "./cli-gpdtxzar.js";
+} from "./cli-23cpnqk9.js";
 import {
   getDbClient,
   getDueScheduledTasks,
@@ -25,7 +25,7 @@ import {
   scheduleContextKey,
   telemetry,
   updateScheduledTask
-} from "./cli-tmn19cdz.js";
+} from "./cli-kq9htgbr.js";
 import {
   __commonJS,
   __require,