@desplega.ai/agent-swarm 1.145.0 → 1.147.0

package/dist/{cli-z9fprcrf.js → cli-atcve9y8.js}

@@ -11,17 +11,17 @@ import {
 import {
   calculateNextRun,
   runScheduleNow
-} from "./cli-59ej1c07.js";
+} from "./cli-smby5m17.js";
 import {
   startPricingRefreshLoop
-} from "./cli-m4j6trn4.js";
+} from "./cli-m8yrsg97.js";
 import {
   seedPricingFromModelsDev
-} from "./cli-gh8y8f36.js";
+} from "./cli-rw51bq3j.js";
 import {
   ensureRbacSeedsSynced,
   getUserGrant
-} from "./cli-q34a0e10.js";
+} from "./cli-8v0g1yc8.js";
 import {
   can,
   decideAdmission,
@@ -48,7 +48,7 @@ import {
   runSavedScriptAsAgent,
   updateApp,
   upgradeAppDefinition
-} from "./cli-gzky0gkr.js";
+} from "./cli-de14znh8.js";
 import {
   require_dist as require_dist2
 } from "./cli-qgm2pfpq.js";
@@ -72,7 +72,7 @@ import {
   updateTrackerSync,
   updateTrackerSyncSwarmId,
   upsertSwarmConfigWithPolicyMirror
-} from "./cli-1fj0chdk.js";
+} from "./cli-f7dsy61y.js";
 import {
   isMultiRuntimeEnabled
 } from "./cli-07jd68a1.js";
@@ -86,7 +86,7 @@ import {
   snapshotWorkflow,
   startWorkflowExecution,
   validateJsonSchema
-} from "./cli-123q2get.js";
+} from "./cli-yz3djrm0.js";
 import {
   ConnectionAuthInputSchema,
   SCRIPT_LONG_TIMEOUT_HINT_MS,
@@ -109,7 +109,7 @@ import {
   upsertCredentialBinding,
   upsertScriptConnection,
   validateDefinition
-} from "./cli-rs6ec3b9.js";
+} from "./cli-3tgwnf43.js";
 import {
   CANDIDATE_SET_MULTIPLIER,
   computeScore,
@@ -121,7 +121,7 @@ import {
   isGraphExpansionEnabled,
   rerank,
   rowToCandidate
-} from "./cli-s2f20r5w.js";
+} from "./cli-1th1728g.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
@@ -139,22 +139,29 @@ import {
   listAuthorizationsForApp,
   onAuthorizationRefreshed,
   upsertOAuthApp
-} from "./cli-wvp6bvy4.js";
+} from "./cli-zhjmqxzh.js";
 import {
   ZodFirstPartyTypeKind,
   objectType
 } from "./cli-fad8m16k.js";
-import {
-  AgentFsProvider
-} from "./cli-fhsz3twr.js";
 import {
   require_dist
 } from "./cli-51tf7ac3.js";
 import {
+  DEFAULT_DOWNLOAD_DIR,
+  MAX_FILE_SIZE,
+  attachSlackFilesForAgent,
+  attachableTask,
   createAdditiveBuffer,
+  downloadFile,
   extractSlackMessageText,
-  parseSlackTs
-} from "./cli-jnf5zghe.js";
+  getFileInfo,
+  parseSlackTs,
+  uploadFile
+} from "./cli-mmemxxdc.js";
+import {
+  AgentFsProvider
+} from "./cli-jsp14b6c.js";
 import {
   findOrCreateUserByEmail,
   findUserByExternalId,
@@ -166,14 +173,15 @@ import {
   recordIdentityEvent,
   recordUnmappedIdentity,
   renderIdentity,
+  resolveBySessionToken,
   resolveIdentity,
   resolveIdentityByEmail,
   resolveUserByToken,
   unlinkIdentity
-} from "./cli-z96t0thj.js";
+} from "./cli-p1d5b073.js";
 import {
   createTaskWithSiblingAwareness
-} from "./cli-axs8e6d4.js";
+} from "./cli-53s590z8.js";
 import {
   ensure,
   getAgentDisplayName,
@@ -184,7 +192,7 @@ import {
   startSlackApp,
   stopSlackApp,
   withSpan
-} from "./cli-jmb7g47h.js";
+} from "./cli-b5bq9crk.js";
 import {
   $OpenAPIRegistry,
   $OpenApiGeneratorV31,
@@ -215,7 +223,7 @@ import {
   PromptTemplateStateSchema,
   ProviderNameSchema,
   ReasoningEffortSchema,
-  RepoGuidelinesSchema,
+  RepoGuidelinesInputSchema,
   RepoHooksSchema,
   ScheduledTaskTargetTypeSchema,
   ScriptRunStatusSchema,
@@ -431,13 +439,13 @@ import {
   upsertPromptTemplate,
   upsertService,
   validateConfigValue
-} from "./cli-f567d5c1.js";
+} from "./cli-ftht3zzj.js";
 import {
   generateDefaultClaudeMd,
   generateDefaultIdentityMd,
   generateDefaultSoulMd,
   init_defaults
-} from "./cli-kpev657q.js";
+} from "./cli-y6b6fb76.js";
 import {
   getTemplateDefinition,
   init_registry,
@@ -446,7 +454,7 @@ import {
   interpolate,
   registerTemplate,
   resolveTemplate
-} from "./cli-7fnkj1hj.js";
+} from "./cli-kpv03zhj.js";
 import {
   MAX_PROFILE_FILE_LENGTH,
   getAppUrl,
@@ -507,7 +515,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-dc9k2ba9.js";
+} from "./cli-w9kb3bk1.js";
 import {
   init_secret_scrubber,
   refreshSecretScrubberCache,
@@ -22295,7 +22303,7 @@ async function notifySlack(text) {
     return;
   }
   try {
-    const { getSlackApp: getSlackApp2 } = await import("./app-zb3rndm8.js");
+    const { getSlackApp: getSlackApp2 } = await import("./app-w066xfy0.js");
     const app = getSlackApp2();
     if (!app) {
       console.warn("[Jira webhook keepalive] Slack not available, cannot send notification");
@@ -22366,7 +22374,7 @@ async function deleteJiraWebhook(webhookId) {
   console.log(`[Jira webhook keepalive] Deleted webhook id=${webhookId}`);
 }
 async function overwriteWebhookIds(next) {
-  const { getDbClient: getDbClient2 } = await import("./db-30p4h2t1.js");
+  const { getDbClient: getDbClient2 } = await import("./db-sfbsc8wt.js");
   await getDbClient2().transaction(async (tx) => {
     const row = await tx.get("SELECT metadata FROM oauth_apps WHERE provider = 'jira'");
     if (!row) {
@@ -95048,156 +95056,6 @@ function warnIfMcpBaseUrlLooksLikeAppUrl2() {
     console.warn(`[Linear] WARNING: MCP_BASE_URL (${mcp}) equals APP_URL — surfaced webhook URL points at the dashboard host, not the API. Configure Linear with this URL only if the dashboard host also serves /api/*.`);
   }
 }
-// src/slack/files.ts
-import { createWriteStream } from "node:fs";
-import { mkdir } from "node:fs/promises";
-import { dirname } from "node:path";
-var MAX_FILE_SIZE = 1073741824;
-var DEFAULT_DOWNLOAD_DIR = `/workspace/shared/downloads/${process.env.AGENT_ID || "default"}/slack`;
-async function uploadFile(client, options) {
-  const { file, filename, channelId, threadTs, initialComment, title } = options;
-  try {
-    if (Buffer.isBuffer(file) && file.length > MAX_FILE_SIZE) {
-      return {
-        success: false,
-        error: `File size ${file.length} bytes exceeds maximum of ${MAX_FILE_SIZE} bytes (1 GB)`
-      };
-    }
-    if (typeof file === "string") {
-      const bunFile = Bun.file(file);
-      const size = bunFile.size;
-      if (size > MAX_FILE_SIZE) {
-        return {
-          success: false,
-          error: `File size ${size} bytes exceeds maximum of ${MAX_FILE_SIZE} bytes (1 GB)`
-        };
-      }
-    }
-    const uploadArgs = {
-      file,
-      filename,
-      title: title || filename
-    };
-    if (channelId) {
-      uploadArgs.channel_id = channelId;
-      if (threadTs) {
-        uploadArgs.thread_ts = threadTs;
-      }
-      if (initialComment) {
-        uploadArgs.initial_comment = initialComment;
-      }
-    }
-    const result = await client.filesUploadV2(uploadArgs);
-    const uploadedFile = result.files?.[0];
-    const fileId = uploadedFile?.files?.[0]?.id;
-    if (!fileId) {
-      return {
-        success: false,
-        error: "Upload succeeded but no file ID returned"
-      };
-    }
-    return {
-      success: true,
-      fileId
-    };
-  } catch (error) {
-    const errorMsg = error instanceof Error ? error.message : String(error);
-    return {
-      success: false,
-      error: errorMsg
-    };
-  }
-}
-async function downloadFile(options) {
-  const { file, savePath, token } = options;
-  try {
-    const downloadUrl = typeof file === "string" ? file : file.url_private_download;
-    if (!downloadUrl) {
-      return {
-        success: false,
-        error: "No download URL available for this file"
-      };
-    }
-    let finalPath = savePath;
-    if (typeof file !== "string" && (savePath.endsWith("/") || !savePath.includes("."))) {
-      finalPath = savePath.endsWith("/") ? `${savePath}${file.name}` : `${savePath}/${file.name}`;
-    }
-    await mkdir(dirname(finalPath), { recursive: true });
-    const response = await fetch(downloadUrl, {
-      headers: {
-        Authorization: `Bearer ${token}`
-      }
-    });
-    if (!response.ok) {
-      return {
-        success: false,
-        error: `HTTP error ${response.status}: ${response.statusText}`
-      };
-    }
-    const body = response.body;
-    if (!body) {
-      return {
-        success: false,
-        error: "No response body"
-      };
-    }
-    const writer = createWriteStream(finalPath);
-    const reader = body.getReader();
-    try {
-      while (true) {
-        const { done, value } = await reader.read();
-        if (done)
-          break;
-        writer.write(value);
-      }
-      writer.end();
-    } finally {
-      reader.releaseLock();
-    }
-    await new Promise((resolve, reject) => {
-      writer.on("finish", resolve);
-      writer.on("error", reject);
-    });
-    return {
-      success: true,
-      savedPath: finalPath
-    };
-  } catch (error) {
-    const errorMsg = error instanceof Error ? error.message : String(error);
-    return {
-      success: false,
-      error: errorMsg
-    };
-  }
-}
-async function getFileInfo(client, fileId) {
-  try {
-    const result = await client.files.info({ file: fileId });
-    if (!result.file) {
-      return null;
-    }
-    const f = result.file;
-    return {
-      id: f.id,
-      name: f.name,
-      title: f.title,
-      mimetype: f.mimetype,
-      filetype: f.filetype,
-      size: f.size,
-      url_private: f.url_private,
-      url_private_download: f.url_private_download,
-      thumb_64: f.thumb_64,
-      thumb_80: f.thumb_80,
-      thumb_160: f.thumb_160,
-      thumb_360: f.thumb_360,
-      thumb_480: f.thumb_480,
-      user: f.user,
-      created: f.created
-    };
-  } catch {
-    return null;
-  }
-}
 // src/http/core.ts
 init_request_auth_context();
 init_secret_scrubber();
@@ -95421,6 +95279,12 @@ async function resolveHttpRequestAuth(req, apiKey) {
       return { kind: "user", userId: user.id, user };
     }
   }
+  if (bearer.startsWith("aseph_")) {
+    const principal = await resolveBySessionToken(bearer);
+    if (principal) {
+      return { kind: "agent", agentId: principal.agentId, taskId: principal.taskId };
+    }
+  }
   return null;
 }
 function isActiveUser(user) {
@@ -95438,14 +95302,68 @@ init_secret_scrubber();
 
 // src/http/utils.ts
 init_db();
+init_env_flag();
 init_secret_scrubber();
+var DEFAULT_ALLOWED_ORIGINS = [
+  "https://*.agent-swarm.dev",
+  "https://*.agent-swarm.cloud",
+  "http://localhost:5274",
+  "http://127.0.0.1:5274",
+  "http://[::1]:5274",
+  "https://ui.swarm.localhost:1355"
+];
+var warnedAboutAllowAnyOrigin = false;
+function warnIfCorsAllowsAnyOrigin() {
+  if (isEnvFlagEnabled("CORS_ALLOW_ANY_ORIGIN", false) && !warnedAboutAllowAnyOrigin) {
+    warnedAboutAllowAnyOrigin = true;
+    console.warn("[CORS] CORS_ALLOW_ANY_ORIGIN=true: any request origin can receive non-credentialed responses; cookie-authenticated responses still require CORS_ALLOWED_ORIGINS. Set CORS_ALLOWED_ORIGINS and disable CORS_ALLOW_ANY_ORIGIN to restrict access.");
+  }
+}
+function getAllowedOrigins() {
+  const raw = process.env.CORS_ALLOWED_ORIGINS;
+  if (!raw || !raw.trim())
+    return DEFAULT_ALLOWED_ORIGINS;
+  return raw.split(",").map((entry) => entry.trim()).filter(Boolean);
+}
+function isOriginAllowedForCredentials(origin) {
+  const allowed = getAllowedOrigins().some((entry) => {
+    if (!entry.includes("*"))
+      return entry === origin;
+    const pattern = /^([a-zA-Z][a-zA-Z0-9+.-]*):\/\/\*\.([a-zA-Z0-9.-]+)(:\d+)?$/.exec(entry);
+    const candidate = /^([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([a-zA-Z0-9.-]+)(:\d+)?$/.exec(origin);
+    if (!pattern || !candidate)
+      return false;
+    if (pattern[1] !== candidate[1] || pattern[3] !== candidate[3])
+      return false;
+    const suffix = pattern[2].toLowerCase();
+    const hostname = candidate[2].toLowerCase();
+    const validLabel = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+    if (![...suffix.split("."), ...hostname.split(".")].every((label) => validLabel.test(label))) {
+      return false;
+    }
+    return hostname.endsWith(`.${suffix}`);
+  });
+  if (!allowed) {
+    console.warn(`[CORS] Denied credentialed origin ${scrubSecrets(JSON.stringify(origin.slice(0, 512)))}; add the trusted SPA origin to CORS_ALLOWED_ORIGINS (custom values replace hosted/dev defaults).`);
+  }
+  return allowed;
+}
 function setCorsHeaders(req, res) {
   const rawOrigin = req.headers.origin;
   const origin = Array.isArray(rawOrigin) ? rawOrigin[0] : rawOrigin;
+  const allowCredentials = origin ? isOriginAllowedForCredentials(origin) : false;
+  const allowAnyOrigin = isEnvFlagEnabled("CORS_ALLOW_ANY_ORIGIN", false);
+  if (allowAnyOrigin)
+    warnIfCorsAllowsAnyOrigin();
+  if (origin && !allowCredentials && !allowAnyOrigin) {
+    res.setHeader("Vary", "Origin");
+    return;
+  }
   if (origin) {
     res.setHeader("Access-Control-Allow-Origin", origin);
     res.setHeader("Vary", "Origin");
-    res.setHeader("Access-Control-Allow-Credentials", "true");
+    if (allowCredentials)
+      res.setHeader("Access-Control-Allow-Credentials", "true");
     const reqHeaders = req.headers["access-control-request-headers"];
     const askedHeaders = Array.isArray(reqHeaders) ? reqHeaders.join(", ") : reqHeaders;
     res.setHeader("Access-Control-Allow-Headers", askedHeaders ?? "Authorization, Content-Type, X-Agent-ID, X-Requested-With");
@@ -95962,7 +95880,7 @@ async function reloadGlobalConfigsAndIntegrations() {
 }
 async function reloadGlobalConfigsAndIntegrationsInner() {
   const updated = await loadGlobalConfigsIntoEnv(true);
-  const { resetFileStorageProvider } = await import("./registry-9kdck5ye.js");
+  const { resetFileStorageProvider } = await import("./registry-v5wytg0s.js");
   resetFileStorageProvider();
   const integrations = [];
   resetAgentMail();
@@ -96418,6 +96336,14 @@ var scriptRunNudge = (r) => {
   const body = r.data?.data;
   return !r.ok && body?.error === "timeout" ? SCRIPT_RUN_TIMEOUT_NUDGE : scriptAuthoringNudge(r);
 };
+var SLACK_API_DISK_NUDGE = "That path is on the API server's disk, not in your container — call this from a task you own (or pass its taskId) to get the file as a task attachment with a fetchCommand.";
+var slackDownloadFileNudge = (r) => r.ok && r.data?.savedPath ? SLACK_API_DISK_NUDGE : undefined;
+var slackReadNudge = (r) => {
+  if (!r.ok)
+    return;
+  const messages = r.data?.messages;
+  return messages?.some((m) => m.files?.some((f) => Boolean(f.localPath))) ? SLACK_API_DISK_NUDGE : undefined;
+};
 var workflowLongScriptTimeoutNudge = (r) => {
   if (!r.ok)
     return;
@@ -96425,6 +96351,7 @@ var workflowLongScriptTimeoutNudge = (r) => {
   return hint ? WORKFLOW_LONG_SCRIPT_TIMEOUT_NUDGE : undefined;
 };
 var NUDGES = {
+  "defer-task": (r) => r.ok ? "Stop working on this task now; the wake-up task will carry your note." : undefined,
   "script-run": scriptRunNudge,
   "script-upsert": scriptAuthoringNudge,
   "launch-script-run": scriptAuthoringNudge,
@@ -96433,6 +96360,8 @@ var NUDGES = {
   "update-workflow": workflowLongScriptTimeoutNudge,
   "patch-workflow": workflowLongScriptTimeoutNudge,
   "patch-workflow-node": workflowLongScriptTimeoutNudge,
+  "slack-download-file": slackDownloadFileNudge,
+  "slack-read": slackReadNudge,
   "script-search": (r) => {
     if (!r.ok)
       return;
@@ -101974,8 +101903,8 @@ var registerCreatePageTool = (server) => {
       key: AssetKeySchema.optional().describe("Logical namespace. Defaults to a shared/page:<id>/ resource key."),
       title: string().min(1).describe("Human-readable title shown in listings."),
       slug: string().min(1).optional().describe("URL slug. Defaults to the kebab-cased title. Same slug → updates the existing row."),
-      body: string().min(1).describe("Full page body (HTML document or JSON-render spec, per contentType)."),
-      contentType: PageContentTypeSchema.describe("'text/html' renders directly at /p/:id; 'application/json' is rendered by the SPA."),
+      body: string().min(1).describe("Full page body (HTML document, SVG image, or JSON-render spec, per contentType)."),
+      contentType: PageContentTypeSchema.describe("'text/html' and 'image/svg+xml' render directly at /p/:id; 'application/json' is rendered by the SPA."),
       authMode: PageAuthModeSchema.default("authed").describe("'authed' — requires page-session cookie (default); 'public' — no gate and must be explicit; 'password' — requires key."),
       password: string().min(1).optional().describe("Plaintext password, hashed before storage. Only meaningful for authMode='password'."),
       description: string().optional().describe("Optional short description, used in listings + OG-tag unfurl."),
@@ -102674,6 +102603,688 @@ ${result.total} rows in ${result.elapsed}ms`;
   });
 };
 
+// src/tools/defer-task.ts
+init_zod();
+init_db();
+
+// src/tasks/task-terminal-effects.ts
+init_db();
+
+// src/be/memory/raters/retrieval.ts
+init_db();
+function dedupeMemoryDocumentIds(memories) {
+  const documents = new Map;
+  for (const memory of memories) {
+    const identity = memory.sourcePath ?? memory.key;
+    if (identity == null)
+      continue;
+    const documentKey = JSON.stringify([memory.agentId, memory.scope, identity]);
+    if (!documents.has(documentKey))
+      documents.set(documentKey, memory.id);
+  }
+  return [...documents.values()];
+}
+async function recordMemoryAccesses(memoryIds) {
+  const ids = [...new Set(memoryIds)].filter(Boolean);
+  if (ids.length === 0)
+    return;
+  const now = new Date().toISOString();
+  await getDbClient().transaction(async (tx) => {
+    for (const id of ids) {
+      await tx.run("UPDATE agent_memory SET accessedAt = ?, accessCount = accessCount + 1 WHERE id = ?", [now, id]);
+    }
+  });
+}
+async function recordRetrievals(taskId, agentId, results, sessionId, extras) {
+  if (!taskId || results.length === 0)
+    return;
+  const insertSql = `INSERT INTO memory_retrieval
+       (id, taskId, agentId, sessionId, memoryId, similarity, retrievedAt, contextKey, intent, eventType, retrievalId, rank, retrievalSource)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`;
+  const now = new Date().toISOString();
+  const retrievalId = crypto.randomUUID();
+  const contextKey = extras?.contextKey ?? null;
+  const intent = extras?.intent ?? null;
+  const eventType = extras?.eventType ?? "search";
+  await getDbClient().transaction(async (tx) => {
+    for (const [rank, r] of results.entries()) {
+      await tx.run(insertSql, [
+        crypto.randomUUID(),
+        taskId,
+        agentId,
+        sessionId ?? null,
+        r.memoryId,
+        r.similarity,
+        now,
+        contextKey,
+        intent,
+        eventType,
+        retrievalId,
+        rank,
+        r.retrievalSource ?? null
+      ]);
+    }
+  });
+  ensure({
+    id: "memory_retrieved",
+    flow: "task",
+    runId: taskId,
+    data: {
+      count: results.length,
+      taskId,
+      agentId
+    },
+    validator: (data) => typeof data.count === "number" && data.count > 0 && typeof data.taskId === "string" && data.taskId.length > 0 && typeof data.agentId === "string" && data.agentId.length > 0
+  });
+}
+async function getRetrievalsForTask(taskId) {
+  return getDbClient().query("SELECT memoryId, similarity FROM memory_retrieval WHERE taskId = ?", [taskId]);
+}
+
+// src/be/memory/raters/explicit-self.ts
+class ExplicitSelfRatingRater {
+  name = "explicit-self";
+  async rate() {
+    return [];
+  }
+}
+
+// src/be/memory/raters/implicit-citation.ts
+class ImplicitCitationRater {
+  name = "implicit-citation";
+  async rate(ctx) {
+    if (ctx.retrievedMemoryIds.length === 0)
+      return [];
+    const evidence = ctx.evidence ?? "";
+    const events = [];
+    for (const memoryId of ctx.retrievedMemoryIds) {
+      if (evidence.length > 0 && evidence.includes(memoryId)) {
+        events.push({ memoryId, signal: 1, weight: 0.5, source: "" });
+      } else {
+        events.push({ memoryId, signal: -1, weight: 0.25, source: "" });
+      }
+    }
+    return events;
+  }
+}
+
+// src/be/memory/raters/noop.ts
+class NoopRater {
+  name = "noop";
+  async rate() {
+    return [];
+  }
+}
+
+// src/be/memory/raters/registry.ts
+var FACTORIES = {
+  noop: () => new NoopRater,
+  "implicit-citation": () => new ImplicitCitationRater,
+  "explicit-self": () => new ExplicitSelfRatingRater,
+  llm: () => new LlmRater
+};
+var SERVER_RATERS = new Set(["implicit-citation"]);
+function getRegisteredRaters() {
+  const raw = process.env.MEMORY_RATERS;
+  if (!raw || raw.trim() === "") {
+    return [new NoopRater];
+  }
+  const names = raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+  const raters = [];
+  for (const name of names) {
+    const factory = FACTORIES[name];
+    if (!factory) {
+      console.warn(`[memory-rater] Unknown rater "${name}" in MEMORY_RATERS — skipping`);
+      continue;
+    }
+    raters.push(factory());
+  }
+  if (raters.length === 0) {
+    return [new NoopRater];
+  }
+  return raters;
+}
+function getRaterWeightMultiplier(name) {
+  const raw = process.env.MEMORY_RATER_WEIGHTS;
+  if (!raw || raw.trim() === "")
+    return 1;
+  for (const pair of raw.split(",")) {
+    const trimmed = pair.trim();
+    if (trimmed === "")
+      continue;
+    const [rawName, rawMult] = trimmed.split(":");
+    if (!rawName || !rawMult)
+      continue;
+    if (rawName.trim() !== name)
+      continue;
+    const mult = Number(rawMult);
+    if (Number.isFinite(mult) && mult >= 0)
+      return mult;
+  }
+  return 1;
+}
+
+// src/be/memory/raters/store.ts
+init_db();
+class ExplicitSelfDuplicateError extends Error {
+  event;
+  constructor(message, event) {
+    super(message);
+    this.event = event;
+    this.name = "ExplicitSelfDuplicateError";
+  }
+}
+async function applyRating(events, ctx = {}) {
+  if (events.length === 0) {
+    return { applied: 0, rejected: [] };
+  }
+  const accepted = [];
+  const rejected = [];
+  for (const event of events) {
+    const reason = validate(event);
+    if (reason) {
+      rejected.push({ event, reason });
+      continue;
+    }
+    let sanitizedReferencesSource = null;
+    if (event.referencesSource !== undefined) {
+      if (event.referencesSource.length === 0) {
+        rejected.push({ event, reason: "referencesSource must be non-empty" });
+        continue;
+      }
+      if (event.referencesSource.length > REFERENCES_SOURCE_MAX_LENGTH) {
+        rejected.push({
+          event,
+          reason: `referencesSource exceeds ${REFERENCES_SOURCE_MAX_LENGTH} chars`
+        });
+        continue;
+      }
+      sanitizedReferencesSource = sanitizeReferencesSource(event.referencesSource);
+      if (sanitizedReferencesSource === null) {
+        rejected.push({
+          event,
+          reason: "referencesSource contains a NUL byte or strips to empty"
+        });
+        continue;
+      }
+    }
+    accepted.push({ event, sanitizedReferencesSource });
+  }
+  if (accepted.length === 0) {
+    return { applied: 0, rejected };
+  }
+  const UPDATE_MEMORY_SQL = "UPDATE agent_memory SET alpha = alpha + ?, beta = beta + ? WHERE id = ?";
+  const CHECK_EXISTS_SQL = "SELECT id FROM agent_memory WHERE id = ?";
+  const INSERT_RATING_SQL = `INSERT INTO memory_rating
+       (id, memoryId, taskId, source, signal, weight, reasoning, createdAt, contextKey)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`;
+  const UPSERT_EDGE_SQL = `INSERT INTO agent_memory_edge (from_id, to_id, type, alpha, beta, createdAt)
+     VALUES (?, ?, 'references-source', ?, ?, ?)
+     ON CONFLICT(from_id, to_id, type) DO UPDATE SET
+       alpha = alpha + excluded.alpha - 1.0,
+       beta  = beta  + excluded.beta  - 1.0`;
+  const { applied, lateRejects, appliedEvents } = await getDbClient().transaction(async (tx) => {
+    let applied2 = 0;
+    const lateRejects2 = [];
+    const appliedEvents2 = [];
+    for (const { event, sanitizedReferencesSource } of accepted) {
+      const exists = await tx.get(CHECK_EXISTS_SQL, [event.memoryId]);
+      if (!exists) {
+        lateRejects2.push({ event, reason: "memoryId not found in agent_memory" });
+        continue;
+      }
+      const alphaDelta = Math.max(0, event.signal) * event.weight;
+      const betaDelta = Math.max(0, -event.signal) * event.weight;
+      await tx.run(UPDATE_MEMORY_SQL, [alphaDelta, betaDelta, event.memoryId]);
+      try {
+        await tx.run(INSERT_RATING_SQL, [
+          crypto.randomUUID(),
+          event.memoryId,
+          ctx.taskId ?? null,
+          event.source,
+          event.signal,
+          event.weight,
+          event.reasoning ?? null,
+          new Date().toISOString(),
+          ctx.contextKey ?? null
+        ]);
+      } catch (err) {
+        if (isUniqueConstraintError(err)) {
+          throw new ExplicitSelfDuplicateError(`duplicate explicit-self rating for memoryId=${event.memoryId} taskId=${ctx.taskId}`, event);
+        }
+        throw err;
+      }
+      if (sanitizedReferencesSource !== null) {
+        await tx.run(UPSERT_EDGE_SQL, [
+          event.memoryId,
+          sanitizedReferencesSource,
+          1 + alphaDelta,
+          1 + betaDelta,
+          new Date().toISOString()
+        ]);
+      }
+      appliedEvents2.push({ event, sanitizedReferencesSource });
+      applied2 += 1;
+    }
+    return { applied: applied2, lateRejects: lateRejects2, appliedEvents: appliedEvents2 };
+  });
+  if (ctx.taskId && appliedEvents.length > 0) {
+    for (const { event, sanitizedReferencesSource } of appliedEvents) {
+      ensure({
+        id: "memory_rated",
+        flow: "task",
+        runId: ctx.taskId,
+        data: {
+          memoryId: event.memoryId,
+          source: event.source,
+          signal: event.signal,
+          weight: event.weight,
+          hasReferencesSource: sanitizedReferencesSource !== null
+        },
+        validator: (data) => typeof data.memoryId === "string" && data.memoryId.length > 0 && typeof data.source === "string" && data.source.length > 0 && typeof data.signal === "number" && data.signal >= -1 && data.signal <= 1 && typeof data.weight === "number" && data.weight >= 0 && data.weight <= 1
+      });
+    }
+  }
+  return { applied, rejected: [...rejected, ...lateRejects] };
+}
+function validate(event) {
+  if (!event.source || event.source.trim() === "") {
+    return "source is required";
+  }
+  if (!Number.isFinite(event.signal) || event.signal < -1 || event.signal > 1) {
+    return "signal must be in [-1, +1]";
+  }
+  if (!Number.isFinite(event.weight) || event.weight < 0 || event.weight > 1) {
+    return "weight must be in [0, 1]";
+  }
+  if (!event.memoryId) {
+    return "memoryId is required";
+  }
+  return null;
+}
+function isUniqueConstraintError(err) {
+  if (!(err instanceof Error))
+    return false;
+  return /UNIQUE constraint failed|SQLITE_CONSTRAINT/i.test(err.message);
+}
+
+// src/be/memory/raters/run-server-raters.ts
+async function runServerRaters(input, deps = {}) {
+  const result = { ratersFired: 0, outcomes: [] };
+  if (input.retrievedMemoryIds.length === 0)
+    return result;
+  const allRaters = deps.raters ?? getRegisteredRaters();
+  const allowed = deps.serverRaterNames ?? SERVER_RATERS;
+  const weightFor = deps.weightMultiplierFor ?? getRaterWeightMultiplier;
+  const applyFn = deps.applyRating ?? applyRating;
+  const serverRaters = allRaters.filter((r) => allowed.has(r.name));
+  for (const rater of serverRaters) {
+    const events = await rater.rate({
+      taskId: input.taskId,
+      agentId: input.agentId,
+      retrievedMemoryIds: input.retrievedMemoryIds,
+      evidence: input.evidence
+    });
+    if (events.length === 0)
+      continue;
+    const multiplier = weightFor(rater.name);
+    const stamped = events.map((e) => ({
+      ...e,
+      source: rater.name,
+      weight: Math.max(0, Math.min(1, e.weight * multiplier))
+    }));
+    const applied = await applyFn(stamped, { taskId: input.taskId });
+    result.ratersFired += 1;
+    result.outcomes.push({ rater: rater.name, events: stamped, result: applied });
+  }
+  return result;
+}
+
+// src/memory/automatic-task-gate.ts
+var SCHEDULE_TAG_PREFIX = "schedule:";
+var AUTOMATIC_TASK_TYPES = new Set([
+  "boot-triage",
+  "heartbeat",
+  "heartbeat-checklist",
+  "health-check",
+  "health-probe",
+  "monitor",
+  "monitoring"
+]);
+function isAutomaticOrRecurringTaskCompletion(task) {
+  const tags = task.tags ?? [];
+  const taskType = task.taskType?.toLowerCase();
+  return task.source === "schedule" || task.source === "system" || tags.includes("scheduled") || tags.includes("auto-generated") || tags.some((tag) => tag.startsWith(SCHEDULE_TAG_PREFIX)) || taskType !== undefined && (AUTOMATIC_TASK_TYPES.has(taskType) || taskType.endsWith("-monitor") || taskType.endsWith("-digest"));
+}
+function shouldPersistAutomaticTaskMemory(task, persistMemory) {
+  if (persistMemory)
+    return true;
+  return !isAutomaticOrRecurringTaskCompletion(task);
+}
+var shouldPersistTaskCompletionMemory = shouldPersistAutomaticTaskMemory;
+
+// src/tasks/task-terminal-effects.ts
+init_secret_scrubber();
+async function runTaskTerminalEffects(args) {
+  const { task, status, output, failureReason, agentId, persistMemory } = args;
+  const taskId = task.id;
+  if (shouldPersistTaskCompletionMemory(task, persistMemory)) {
+    (async () => {
+      try {
+        const taskContent = status === "completed" ? `Task: ${task.task}
+
+Output:
+${output || "(no output)"}` : `Task: ${task.task}
+
+Failure reason:
+${failureReason || "No reason provided"}
+
+This task failed. Learn from this to avoid repeating the mistake.`;
+        if (taskContent.length < 30)
+          return;
+        const store = getMemoryStore();
+        const provider = getEmbeddingProvider();
+        const memory = await store.store({
+          agentId: agentId ?? null,
+          content: taskContent,
+          name: `Task: ${task.task.slice(0, 80)}`,
+          scope: "agent",
+          source: "task_completion",
+          sourceTaskId: taskId
+        });
+        const embedding = await provider.embed(taskContent);
+        if (embedding) {
+          await store.updateEmbedding(memory.id, embedding, provider.name);
+        }
+        const shouldShareWithSwarm = status === "completed" && (task.taskType === "research" || task.tags?.includes("knowledge") || task.tags?.includes("shared"));
+        if (shouldShareWithSwarm) {
+          try {
+            const swarmMemory = await store.store({
+              agentId: agentId ?? null,
+              scope: "swarm",
+              name: `Shared: ${task.task.slice(0, 80)}`,
+              content: `Task completed by agent ${agentId}:
+
+${taskContent}`,
+              source: "task_completion",
+              sourceTaskId: taskId
+            });
+            const swarmEmbedding = await provider.embed(taskContent);
+            if (swarmEmbedding) {
+              await store.updateEmbedding(swarmMemory.id, swarmEmbedding, provider.name);
+            }
+          } catch {}
+        }
+      } catch {}
+    })().catch((err) => console.error("[task-terminal-effects] task completion memory write failed:", scrubSecrets(err instanceof Error ? err.message : String(err))));
+  }
+  (async () => {
+    try {
+      const retrievals = await getRetrievalsForTask(taskId);
+      if (retrievals.length === 0)
+        return;
+      const retrievedMemoryIds = retrievals.map((r) => r.memoryId);
+      const logs = await getSessionLogsByTaskId(taskId);
+      const evidence = logs.map((l) => l.content).join(`
+`);
+      await runServerRaters({
+        taskId,
+        agentId: agentId ?? "",
+        retrievedMemoryIds,
+        evidence
+      });
+    } catch (err) {
+      console.error("[task-terminal-effects] server-rater fire failed:", err instanceof Error ? err.message : String(err));
+    }
+  })().catch((err) => console.error("[task-terminal-effects] server rater run failed:", scrubSecrets(err instanceof Error ? err.message : String(err))));
+  if (!task.workflowRunId) {
+    try {
+      const followUp = await createWorkerTaskFollowUp({ task, status, output, failureReason });
+      if (followUp) {
+        console.log(`[task-terminal-effects] Created follow-up task ${followUp.id.slice(0, 8)} for ${status} task ${taskId.slice(0, 8)}`);
+      }
+    } catch (err) {
+      console.warn(`[task-terminal-effects] Failed to create follow-up task: ${err}`);
+    }
+  }
+}
+
+// src/tasks/terminal-result-guard.ts
+init_db();
+init_types();
+init_secret_scrubber();
+function getTaskOutputValidationError(outputSchema, output) {
+  if (!outputSchema || typeof outputSchema !== "object")
+    return;
+  const schema = outputSchema;
+  if (!output) {
+    return `Task has an outputSchema but no output was provided. You must call store-progress with a valid JSON output matching this schema:
+${JSON.stringify(schema, null, 2)}`;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(output);
+  } catch {
+    return `Task output must be valid JSON matching the outputSchema. Got invalid JSON. Schema:
+${JSON.stringify(schema, null, 2)}`;
+  }
+  let validationErrors;
+  try {
+    validationErrors = validateJsonSchema(schema, parsed);
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return `Task outputSchema is malformed and cannot be validated (${detail}). Ask an operator to correct the task's outputSchema, or force-complete with store-progress force: true.`;
+  }
+  if (validationErrors.length > 0) {
+    return `Task output does not match the outputSchema. Errors:
+${validationErrors.join(`
+`)}
+
+Expected schema:
+${JSON.stringify(schema, null, 2)}
+
+Please fix your output and retry.`;
+  }
+  return;
+}
+async function guardTerminalTaskResultWrite(task, write) {
+  if (!isTerminalTaskStatus(task.status) || !write.status && !write.force) {
+    return { handled: false };
+  }
+  const scrubbedOutput = write.output !== undefined ? scrubSecrets(write.output) : undefined;
+  const scrubbedFailureReason = write.failureReason !== undefined ? scrubSecrets(write.failureReason) : undefined;
+  const hasDifferingOutput = scrubbedOutput !== undefined && scrubbedOutput !== task.output;
+  const hasDifferingFailureReason = scrubbedFailureReason !== undefined && scrubbedFailureReason !== task.failureReason;
+  const hasDifferingResultText = hasDifferingOutput || hasDifferingFailureReason;
+  if (hasDifferingResultText && write.force) {
+    const outputValidationError = hasDifferingOutput ? getTaskOutputValidationError(task.outputSchema, write.output) : undefined;
+    if (outputValidationError) {
+      return { handled: true, success: false, message: outputValidationError, task };
+    }
+    const overwrittenTask = await overwriteTerminalTaskResultText(task.id, {
+      ...write.output !== undefined ? { output: write.output } : {},
+      ...write.failureReason !== undefined ? { failureReason: write.failureReason } : {}
+    });
+    if (!overwrittenTask) {
+      return {
+        handled: true,
+        success: false,
+        message: `Task "${task.id}" terminal result text could not be overwritten.`,
+        task
+      };
+    }
+    return {
+      handled: true,
+      success: true,
+      message: `Task "${task.id}" is already ${task.status}; force-overwrote terminal result text ` + "without replaying completion side effects.",
+      task: overwrittenTask,
+      wasForcedOverwrite: true
+    };
+  }
+  if (hasDifferingResultText) {
+    return {
+      handled: true,
+      success: false,
+      message: `Discarded write for already-${task.status} task "${task.id}"; ` + "existing output/failureReason and finishedAt were preserved. Retry with force: true " + "to overwrite terminal result text without replaying completion side effects.",
+      task
+    };
+  }
+  return {
+    handled: true,
+    success: true,
+    message: `Task "${task.id}" is already ${task.status}; treating as no-op. ` + "Existing output preserved (first-call-wins).",
+    task,
+    wasNoOp: true
+  };
+}
+
+// src/tools/defer-task.ts
+init_types();
+
+class DeferAbortedError extends Error {
+}
+function renderChecks(checks2) {
+  if (!checks2 || checks2.length === 0)
+    return "";
+  return `
+
+Checks:
+${checks2.map((c) => `- ${c}`).join(`
+`)}`;
+}
+var registerDeferTaskTool = (server) => {
+  createToolRegistrar(server)("defer-task", {
+    title: "Defer Task",
+    annotations: { destructiveHint: false, idempotentHint: false },
+    description: "Completes this task now with status `completed` and books a wake-up for you. Use when the result needs time: a build, a deploy, a reply. The task reaches its final state on this call; the lead sees your summary as its output. A one-off schedule wakes you up later with a child task that carries this task as its parent. Provide delayMs or runAt, a summary of what you did, and a note that says what is pending and what to check.",
+    inputSchema: object({
+      taskId: string().describe("The ID of the task you are working on."),
+      delayMs: number().int().positive().optional().describe("Wake up after this many milliseconds (e.g. 1800000 for 30 min)."),
+      runAt: string().datetime().optional().describe("Wake up at this ISO datetime (e.g. '2026-03-06T15:00:00Z'). Must be future."),
+      summary: string().min(1).max(4000).describe("What you did so far and where things stand. This becomes the task's output; the lead and your wake-up run both read it."),
+      note: string().min(1).max(2000).describe("What is pending, and what to check on wake-up."),
+      checks: array(string().min(1)).max(20).optional().describe("Concrete things to verify on wake-up, one per entry.")
+    }),
+    outputSchema: swarmToolOutputSchema({
+      yourAgentId: string().optional(),
+      taskId: string().optional(),
+      scheduleId: string().optional(),
+      nextRunAt: string().optional()
+    })
+  }, async ({ taskId, delayMs, runAt, summary, note, checks: checks2 }, requestInfo, _meta) => {
+    if (!requestInfo.agentId) {
+      return toolErr('Agent ID not found. Set the "X-Agent-ID" header.');
+    }
+    const agent = await getAgentById(requestInfo.agentId);
+    if (!agent) {
+      return toolErr(`Agent not found: ${requestInfo.agentId}`);
+    }
+    const task = await getTaskById(taskId);
+    if (!task) {
+      return toolErr(`Task with ID "${taskId}" not found.`);
+    }
+    const forbidden = assertOwnsTask(ownerCtx(requestInfo), task);
+    if (forbidden)
+      return forbidden;
+    if (task.agentId !== requestInfo.agentId) {
+      return toolErr(`Task "${taskId}" is not assigned to you.`);
+    }
+    if (isTerminalTaskStatus(task.status)) {
+      return toolErr(`Task ${taskId} is already ${task.status}; nothing to defer.`);
+    }
+    if (task.workflowRunId) {
+      return toolErr(`Task ${taskId} is owned by workflow run ${task.workflowRunId}; workflow-owned tasks cannot be deferred.`);
+    }
+    if (!delayMs && !runAt) {
+      return toolErr("Provide either delayMs or runAt.");
+    }
+    if (delayMs && runAt) {
+      return toolErr("Provide either delayMs or runAt, not both.");
+    }
+    if (runAt && new Date(runAt).getTime() <= Date.now()) {
+      return toolErr("runAt must be in the future.");
+    }
+    const nextRunAt = delayMs ? new Date(Date.now() + delayMs).toISOString() : runAt;
+    const checksBlock = renderChecks(checks2);
+    const taskTemplate = `Resume task ${taskId}: ${note}${checksBlock}`;
+    const createdBy = await resolveTaskAuditUserId(requestInfo.sourceTaskId, requestInfo.agentId) ?? undefined;
+    const previewOutput = `${summary}
+
+Deferred until ${nextRunAt} (schedule pending). Pending: ${note}${checksBlock}`;
+    const outputValidationError = getTaskOutputValidationError(task.outputSchema, previewOutput);
+    if (outputValidationError) {
+      return toolErr(`Task ${taskId} has an outputSchema; its terminal output must satisfy it, but a deferral note cannot. ${outputValidationError}`);
+    }
+    try {
+      const committed = await getDbClient().transaction(async () => {
+        const schedule = await createScheduledTask({
+          name: `deferred-${taskId.slice(0, 8)}-${Date.now()}-${crypto.randomUUID()}`,
+          description: note,
+          taskTemplate,
+          targetType: "agent-task",
+          scheduleType: "one_time",
+          nextRunAt,
+          targetAgentId: requestInfo.agentId,
+          createdByAgentId: requestInfo.agentId,
+          taskType: "deferred",
+          tags: ["deferred"],
+          priority: task.priority,
+          modelTier: task.modelTier,
+          parentTaskId: taskId,
+          createdBy
+        });
+        const output = `${summary}
+
+Deferred until ${nextRunAt} (schedule ${schedule.id}). Pending: ${note}${checksBlock}`;
+        const completed = await completeTask(taskId, output);
+        if (!completed) {
+          throw new DeferAbortedError(`Task ${taskId} reached a terminal state before this deferral committed.`);
+        }
+        getDbClient().afterCommit(() => {
+          ensure({
+            id: "completed",
+            flow: "task",
+            runId: taskId,
+            depIds: task.wasPaused ? ["started", "resumed"] : ["started"],
+            data: {
+              taskId,
+              agentId: task.agentId,
+              previousStatus: task.status,
+              hasOutput: true
+            },
+            validator: (data) => data.previousStatus === "in_progress",
+            filter: ({}, ctx) => ctx.deps.length > 0,
+            conditions: [{ timeout_ms: 3600000 }]
+          });
+        });
+        if (task.agentId) {
+          await updateAgentStatusFromCapacity(task.agentId);
+        }
+        return { scheduleId: schedule.id, output, completed };
+      });
+      await runTaskTerminalEffects({
+        task: committed.completed,
+        status: "completed",
+        output: committed.output,
+        agentId: requestInfo.agentId
+      });
+      return toolOk(`Task ${taskId} completed and deferred. Wake-up at ${nextRunAt} (schedule ${committed.scheduleId}). This task is final; the wake-up task continues the work.`, {
+        data: {
+          yourAgentId: requestInfo.agentId,
+          taskId,
+          scheduleId: committed.scheduleId,
+          nextRunAt
+        }
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      return toolErr(`Failed to defer task: ${message}`, {
+        data: { yourAgentId: requestInfo.agentId, taskId }
+      });
+    }
+  });
+};
+
 // src/tools/delete-channel.ts
 init_zod();
 init_db();
@@ -104837,77 +105448,6 @@ async function getLinksForMemory(memoryId, options = {}) {
   return { links, backlinks };
 }
 
-// src/be/memory/raters/retrieval.ts
-init_db();
-function dedupeMemoryDocumentIds(memories) {
-  const documents = new Map;
-  for (const memory of memories) {
-    const identity = memory.sourcePath ?? memory.key;
-    if (identity == null)
-      continue;
-    const documentKey = JSON.stringify([memory.agentId, memory.scope, identity]);
-    if (!documents.has(documentKey))
-      documents.set(documentKey, memory.id);
-  }
-  return [...documents.values()];
-}
-async function recordMemoryAccesses(memoryIds) {
-  const ids = [...new Set(memoryIds)].filter(Boolean);
-  if (ids.length === 0)
-    return;
-  const now = new Date().toISOString();
-  await getDbClient().transaction(async (tx) => {
-    for (const id of ids) {
-      await tx.run("UPDATE agent_memory SET accessedAt = ?, accessCount = accessCount + 1 WHERE id = ?", [now, id]);
-    }
-  });
-}
-async function recordRetrievals(taskId, agentId, results, sessionId, extras) {
-  if (!taskId || results.length === 0)
-    return;
-  const insertSql = `INSERT INTO memory_retrieval
-       (id, taskId, agentId, sessionId, memoryId, similarity, retrievedAt, contextKey, intent, eventType, retrievalId, rank, retrievalSource)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`;
-  const now = new Date().toISOString();
-  const retrievalId = crypto.randomUUID();
-  const contextKey = extras?.contextKey ?? null;
-  const intent = extras?.intent ?? null;
-  const eventType = extras?.eventType ?? "search";
-  await getDbClient().transaction(async (tx) => {
-    for (const [rank, r] of results.entries()) {
-      await tx.run(insertSql, [
-        crypto.randomUUID(),
-        taskId,
-        agentId,
-        sessionId ?? null,
-        r.memoryId,
-        r.similarity,
-        now,
-        contextKey,
-        intent,
-        eventType,
-        retrievalId,
-        rank,
-        r.retrievalSource ?? null
-      ]);
-    }
-  });
-  ensure({
-    id: "memory_retrieved",
-    flow: "task",
-    runId: taskId,
-    data: {
-      count: results.length,
-      taskId,
-      agentId
-    },
-    validator: (data) => typeof data.count === "number" && data.count > 0 && typeof data.taskId === "string" && data.taskId.length > 0 && typeof data.agentId === "string" && data.agentId.length > 0
-  });
-}
-async function getRetrievalsForTask(taskId) {
-  return getDbClient().query("SELECT memoryId, similarity FROM memory_retrieval WHERE taskId = ?", [taskId]);
-}
-
 // src/tools/memory-get.ts
 init_types();
 var NUDGE_ELIGIBLE_SOURCES = new Set(["manual", "file_index"]);
@@ -107062,7 +107602,7 @@ var registerUpdateRepoTool = (server) => {
       defaultBranch: string().optional().describe("New default branch."),
       autoClone: boolean().optional().describe("Whether to auto-clone."),
       hooks: RepoHooksSchema.nullable().optional().describe("Repository hook install config. Set { enabled: true } to opt into best-effort worker hook installation, or null to disable."),
-      guidelines: RepoGuidelinesSchema.nullable().optional().describe("Repository guidelines: prChecks (commands before PR), mergeChecks (conditions before merge), allowMerge (default false), review (guidance for reviewers). Pass null to clear.")
+      guidelines: RepoGuidelinesInputSchema.nullable().optional().describe("Repository guidelines: prChecks (commands before PR), mergeChecks (conditions before merge), allowMerge (default false), review (guidance for reviewers). Pass null to clear.")
     }),
     outputSchema: swarmToolOutputSchema({
       repo: swarmRepoOutputShape2.nullable().optional()
@@ -113654,6 +114194,7 @@ var scheduleDataShape = {
   lastRunAt: string().optional(),
   nextRunAt: string().optional(),
   createdByAgentId: string().optional(),
+  parentTaskId: string().optional(),
   timezone: string().optional(),
   model: string().optional(),
   modelTier: ModelTierSchema.optional(),
@@ -114066,6 +114607,7 @@ var scheduleRowShape = {
   lastRunAt: string().optional(),
   nextRunAt: string().optional(),
   createdByAgentId: string().optional(),
+  parentTaskId: string().optional(),
   timezone: string().optional(),
   consecutiveErrors: number().optional(),
   lastErrorAt: string().optional(),
@@ -114204,6 +114746,7 @@ var scheduleDataShape2 = {
   lastRunAt: string().optional(),
   nextRunAt: string().optional(),
   createdByAgentId: string().optional(),
+  parentTaskId: string().optional(),
   timezone: string().optional(),
   model: string().optional(),
   modelTier: ModelTierSchema.optional(),
@@ -114490,6 +115033,7 @@ var scheduleDataShape3 = {
   lastRunAt: string().optional(),
   nextRunAt: string().optional(),
   createdByAgentId: string().optional(),
+  parentTaskId: string().optional(),
   timezone: string().optional(),
   model: string().optional(),
   modelTier: ModelTierSchema.optional(),
@@ -117046,19 +117590,26 @@ var registerSlackDeleteTool = (server) => {
 // src/tools/slack-download-file.ts
 init_zod();
 init_db();
+function fileIdFromUrl(url) {
+  return /\/files-pri\/[A-Z0-9]+-([A-Z0-9]+)\//.exec(url)?.[1];
+}
 var registerSlackDownloadFileTool = (server) => {
   createToolRegistrar(server)("slack-download-file", {
     title: "Download file from Slack",
-    description: "Download a file from Slack by file ID or URL. Files are saved to the agent's download directory on the shared disk by default.",
-    annotations: { readOnlyHint: true, openWorldHint: true },
+    description: "Download a file from Slack by file ID or URL. From a task, the file is stored as an attachment of that task and the result carries a ready-to-run `fetchCommand` to get the bytes into your container. Without a task, the file is saved on the API server's disk, which your container usually can't read.",
+    annotations: { readOnlyHint: false, openWorldHint: true },
     inputSchema: object({
       fileId: string().optional().describe("The Slack file ID to download (e.g., 'F0RDC39U1')."),
       url: string().url().optional().describe("Direct URL to download (url_private_download from a file object)."),
-      savePath: string().optional().describe("Where to save the file. Can be a directory or full path. Defaults to /workspace/shared/downloads/{agentId}/slack/"),
+      taskId: uuid().optional().describe("Task to attach the file to. Defaults to the task you are working on; must be a task you own or created."),
+      savePath: string().optional().describe("Only without a task: where to save the file on the API server (directory or full path). Defaults to /workspace/shared/downloads/{agentId}/slack/."),
       filename: string().optional().describe("Filename to use when saving. Only used if savePath is a directory.")
     }),
     outputSchema: swarmToolOutputSchema({
-      savedPath: string().optional(),
+      taskId: string().optional(),
+      attachmentId: string().optional(),
+      fetchCommand: string().optional(),
+      savedPath: string().optional().describe("Only without a task: the path on the API server's disk, not in your container."),
       fileInfo: looseObject({
         id: string().optional(),
         name: string().optional(),
@@ -117066,7 +117617,7 @@ var registerSlackDownloadFileTool = (server) => {
         size: number().optional()
       }).optional()
     })
-  }, async ({ fileId, url, savePath, filename }, requestInfo, _meta) => {
+  }, async ({ fileId, url, taskId, savePath, filename }, requestInfo, _meta) => {
     if (!requestInfo.agentId) {
       return toolErr("Agent ID not found.");
     }
@@ -117085,22 +117636,33 @@ var registerSlackDownloadFileTool = (server) => {
     if (!token) {
       return toolErr("Slack bot token not configured.");
     }
+    const task = await attachableTask(agent.id, taskId ?? requestInfo.sourceTaskId);
+    if (taskId && !task) {
+      return toolErr("You don't have context for this task.");
+    }
     try {
-      let downloadUrl = url;
-      let fileInfo;
-      if (fileId) {
-        const info = await getFileInfo(app.client, fileId);
+      const id2 = fileId ?? (url ? fileIdFromUrl(url) : undefined);
+      const info = id2 ? await getFileInfo(app.client, id2) : null;
+      if (fileId && !info) {
+        return toolErr(`File not found: ${fileId}`);
+      }
+      const fileInfo = info ? { id: info.id, name: info.name, mimetype: info.mimetype, size: info.size } : undefined;
+      if (task) {
         if (!info) {
-          return toolErr(`File not found: ${fileId}`);
+          return toolErr("Could not identify the Slack file in that URL; pass fileId instead.");
         }
-        downloadUrl = info.url_private_download;
-        fileInfo = {
-          id: info.id,
-          name: info.name,
-          mimetype: info.mimetype,
-          size: info.size
-        };
+        const outcome = (await attachSlackFilesForAgent(app.client, task, [info], agent.id)).get(info.id);
+        if (!outcome || "reason" in outcome) {
+          return toolErr(`Failed to attach file: ${outcome?.reason ?? "unknown error"}`);
+        }
+        const { attachment, fetchCommand } = outcome;
+        return toolOk(`Attached ${attachment.name} to task ${task.id} (attachment ${attachment.id}).`, {
+          details: `Get it into your container with:
+${fetchCommand}`,
+          data: { taskId: task.id, attachmentId: attachment.id, fetchCommand, fileInfo }
+        });
       }
+      const downloadUrl = info?.url_private_download ?? url;
       if (!downloadUrl) {
         return toolErr("No download URL available.");
       }
@@ -117117,8 +117679,9 @@ var registerSlackDownloadFileTool = (server) => {
       if (!result.success) {
         return toolErr(`Failed to download file: ${result.error}`);
       }
-      const successMsg = `File downloaded successfully to ${result.savedPath}`;
-      return toolOk(successMsg, { data: { savedPath: result.savedPath, fileInfo } });
+      return toolOk(`File saved on the API server at ${result.savedPath}.`, {
+        data: { savedPath: result.savedPath, fileInfo }
+      });
     } catch (error) {
       const errorMsg = error instanceof Error ? error.message : String(error);
       return toolErr(`Failed to download file: ${errorMsg}`);
@@ -117389,7 +117952,10 @@ var SlackFileSchema = looseObject({
   filetype: string().optional(),
   size: number().optional(),
   url_private_download: string().optional(),
-  localPath: string().optional()
+  attachmentId: string().optional(),
+  fetchCommand: string().optional(),
+  notAttached: string().optional(),
+  localPath: string().optional().describe("Only without a task: the path on the API server's disk, not in your container.")
 });
 var SlackMessageSchema = looseObject({
   user: string().optional(),
@@ -117402,15 +117968,15 @@ var SlackMessageSchema = looseObject({
 var registerSlackReadTool = (server) => {
   createToolRegistrar(server)("slack-read", {
     title: "Read Slack thread/channel history",
-    description: "Read messages from a Slack thread or channel. Use inboxMessageId or taskId to read from a thread you have context for, or provide channelId directly for channel history (leads only).",
-    annotations: { readOnlyHint: true, openWorldHint: true },
+    description: "Read messages from a Slack thread or channel. Use inboxMessageId or taskId to read from a thread you have context for, or provide channelId directly for channel history (leads only). From a task, files in the messages are stored as attachments of that task, each with a ready-to-run `fetchCommand`.",
+    annotations: { readOnlyHint: false, openWorldHint: true },
     inputSchema: object({
       inboxMessageId: uuid().optional().describe("Read thread history for an inbox message."),
       taskId: uuid().optional().describe("Read thread history for a task."),
       channelId: string().optional().describe("Slack channel ID to read from (requires lead privileges)."),
       threadTs: string().optional().describe("Thread timestamp (required with channelId for thread history)."),
       limit: number().int().min(1).max(100).default(20).describe("Maximum number of messages to retrieve (default: 20, max: 100)."),
-      includeFiles: boolean().default(true).describe("Include file attachments in the response (default: true).")
+      includeFiles: boolean().default(true).describe("Include file attachments in the response (default: true). From a task, they are also stored as attachments of that task.")
     }),
     outputSchema: swarmToolOutputSchema({
       channelId: string().optional(),
@@ -117427,6 +117993,7 @@ var registerSlackReadTool = (server) => {
     }
     let slackChannelId = channelId;
     let slackThreadTs = threadTs;
+    let contextTask = null;
     if (inboxMessageId) {
       const inboxMsg = await getInboxMessageById(inboxMessageId);
       if (!inboxMsg) {
@@ -117447,6 +118014,7 @@ var registerSlackReadTool = (server) => {
       }
       slackChannelId = task.slackChannelId;
       slackThreadTs = task.slackThreadTs;
+      contextTask = task;
     } else if (channelId) {
       const decision = can({
         principal: { kind: "agent", agentId: agent.id, isLead: agent.isLead },
@@ -117500,6 +118068,11 @@ var registerSlackReadTool = (server) => {
         }
       }
       const token = process.env.SLACK_BOT_TOKEN;
+      const attachTo = contextTask ?? await attachableTask(agent.id, taskId ?? requestInfo.sourceTaskId);
+      if (taskId && !attachTo) {
+        return toolErr("You don't have context for this task.", { data: { messages: [] } });
+      }
+      const toAttach = [];
       const messages = [];
       for (const m of rawMessages) {
         const extractedText = extractSlackMessageText(m);
@@ -117524,7 +118097,9 @@ var registerSlackReadTool = (server) => {
               size: f.size,
               url_private_download: f.url_private_download
             };
-            if (token && f.url_private_download) {
+            if (attachTo) {
+              toAttach.push({ raw: f, info: fileInfo });
+            } else if (token && f.url_private_download) {
               const savePath = `${AUTO_DOWNLOAD_DIR}/${f.id}_${f.name}`;
               try {
                 const downloadResult = await downloadFile({
@@ -117549,13 +118124,29 @@ var registerSlackReadTool = (server) => {
           files
         });
       }
+      if (attachTo && toAttach.length > 0) {
+        const outcomes = await attachSlackFilesForAgent(client, attachTo, toAttach.map(({ raw }) => raw), agent.id);
+        for (const { info } of toAttach) {
+          const outcome = outcomes.get(info.id);
+          if (outcome && "attachment" in outcome) {
+            info.attachmentId = outcome.attachment.id;
+            info.fetchCommand = outcome.fetchCommand;
+          } else {
+            info.notAttached = outcome?.reason ?? "not downloaded";
+          }
+        }
+      }
       const textOutput = messages.map((m) => {
         let text = `[${m.username || m.user || "Unknown"}]: ${m.text}`;
         if (m.files && m.files.length > 0) {
           const fileList = m.files.map((f) => {
             let line = `  - ${f.name} (${f.mimetype}, ${Math.round(f.size / 1024)} KB)`;
-            if (f.localPath) {
-              line += ` [Downloaded: ${f.localPath}]`;
+            if (f.fetchCommand) {
+              line += ` [Task attachment ${f.attachmentId}: ${f.fetchCommand}]`;
+            } else if (f.notAttached) {
+              line += ` [Not attached: ${f.notAttached}]`;
+            } else if (f.localPath) {
+              line += ` [Downloaded on the API server: ${f.localPath}]`;
             }
             return line;
           }).join(`
@@ -118168,379 +118759,6 @@ var registerSteerTaskTool = (server) => {
 // src/tools/store-progress.ts
 init_zod();
 init_db();
-
-// src/be/memory/raters/explicit-self.ts
-class ExplicitSelfRatingRater {
-  name = "explicit-self";
-  async rate() {
-    return [];
-  }
-}
-
-// src/be/memory/raters/implicit-citation.ts
-class ImplicitCitationRater {
-  name = "implicit-citation";
-  async rate(ctx) {
-    if (ctx.retrievedMemoryIds.length === 0)
-      return [];
-    const evidence = ctx.evidence ?? "";
-    const events = [];
-    for (const memoryId of ctx.retrievedMemoryIds) {
-      if (evidence.length > 0 && evidence.includes(memoryId)) {
-        events.push({ memoryId, signal: 1, weight: 0.5, source: "" });
-      } else {
-        events.push({ memoryId, signal: -1, weight: 0.25, source: "" });
-      }
-    }
-    return events;
-  }
-}
-
-// src/be/memory/raters/noop.ts
-class NoopRater {
-  name = "noop";
-  async rate() {
-    return [];
-  }
-}
-
-// src/be/memory/raters/registry.ts
-var FACTORIES = {
-  noop: () => new NoopRater,
-  "implicit-citation": () => new ImplicitCitationRater,
-  "explicit-self": () => new ExplicitSelfRatingRater,
-  llm: () => new LlmRater
-};
-var SERVER_RATERS = new Set(["implicit-citation"]);
-function getRegisteredRaters() {
-  const raw = process.env.MEMORY_RATERS;
-  if (!raw || raw.trim() === "") {
-    return [new NoopRater];
-  }
-  const names = raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
-  const raters = [];
-  for (const name of names) {
-    const factory = FACTORIES[name];
-    if (!factory) {
-      console.warn(`[memory-rater] Unknown rater "${name}" in MEMORY_RATERS — skipping`);
-      continue;
-    }
-    raters.push(factory());
-  }
-  if (raters.length === 0) {
-    return [new NoopRater];
-  }
-  return raters;
-}
-function getRaterWeightMultiplier(name) {
-  const raw = process.env.MEMORY_RATER_WEIGHTS;
-  if (!raw || raw.trim() === "")
-    return 1;
-  for (const pair of raw.split(",")) {
-    const trimmed = pair.trim();
-    if (trimmed === "")
-      continue;
-    const [rawName, rawMult] = trimmed.split(":");
-    if (!rawName || !rawMult)
-      continue;
-    if (rawName.trim() !== name)
-      continue;
-    const mult = Number(rawMult);
-    if (Number.isFinite(mult) && mult >= 0)
-      return mult;
-  }
-  return 1;
-}
-
-// src/be/memory/raters/store.ts
-init_db();
-class ExplicitSelfDuplicateError extends Error {
-  event;
-  constructor(message, event) {
-    super(message);
-    this.event = event;
-    this.name = "ExplicitSelfDuplicateError";
-  }
-}
-async function applyRating(events, ctx = {}) {
-  if (events.length === 0) {
-    return { applied: 0, rejected: [] };
-  }
-  const accepted = [];
-  const rejected = [];
-  for (const event of events) {
-    const reason = validate(event);
-    if (reason) {
-      rejected.push({ event, reason });
-      continue;
-    }
-    let sanitizedReferencesSource = null;
-    if (event.referencesSource !== undefined) {
-      if (event.referencesSource.length === 0) {
-        rejected.push({ event, reason: "referencesSource must be non-empty" });
-        continue;
-      }
-      if (event.referencesSource.length > REFERENCES_SOURCE_MAX_LENGTH) {
-        rejected.push({
-          event,
-          reason: `referencesSource exceeds ${REFERENCES_SOURCE_MAX_LENGTH} chars`
-        });
-        continue;
-      }
-      sanitizedReferencesSource = sanitizeReferencesSource(event.referencesSource);
-      if (sanitizedReferencesSource === null) {
-        rejected.push({
-          event,
-          reason: "referencesSource contains a NUL byte or strips to empty"
-        });
-        continue;
-      }
-    }
-    accepted.push({ event, sanitizedReferencesSource });
-  }
-  if (accepted.length === 0) {
-    return { applied: 0, rejected };
-  }
-  const UPDATE_MEMORY_SQL = "UPDATE agent_memory SET alpha = alpha + ?, beta = beta + ? WHERE id = ?";
-  const CHECK_EXISTS_SQL = "SELECT id FROM agent_memory WHERE id = ?";
-  const INSERT_RATING_SQL = `INSERT INTO memory_rating
-       (id, memoryId, taskId, source, signal, weight, reasoning, createdAt, contextKey)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`;
-  const UPSERT_EDGE_SQL = `INSERT INTO agent_memory_edge (from_id, to_id, type, alpha, beta, createdAt)
-     VALUES (?, ?, 'references-source', ?, ?, ?)
-     ON CONFLICT(from_id, to_id, type) DO UPDATE SET
-       alpha = alpha + excluded.alpha - 1.0,
-       beta  = beta  + excluded.beta  - 1.0`;
-  const { applied, lateRejects, appliedEvents } = await getDbClient().transaction(async (tx) => {
-    let applied2 = 0;
-    const lateRejects2 = [];
-    const appliedEvents2 = [];
-    for (const { event, sanitizedReferencesSource } of accepted) {
-      const exists = await tx.get(CHECK_EXISTS_SQL, [event.memoryId]);
-      if (!exists) {
-        lateRejects2.push({ event, reason: "memoryId not found in agent_memory" });
-        continue;
-      }
-      const alphaDelta = Math.max(0, event.signal) * event.weight;
-      const betaDelta = Math.max(0, -event.signal) * event.weight;
-      await tx.run(UPDATE_MEMORY_SQL, [alphaDelta, betaDelta, event.memoryId]);
-      try {
-        await tx.run(INSERT_RATING_SQL, [
-          crypto.randomUUID(),
-          event.memoryId,
-          ctx.taskId ?? null,
-          event.source,
-          event.signal,
-          event.weight,
-          event.reasoning ?? null,
-          new Date().toISOString(),
-          ctx.contextKey ?? null
-        ]);
-      } catch (err) {
-        if (isUniqueConstraintError(err)) {
-          throw new ExplicitSelfDuplicateError(`duplicate explicit-self rating for memoryId=${event.memoryId} taskId=${ctx.taskId}`, event);
-        }
-        throw err;
-      }
-      if (sanitizedReferencesSource !== null) {
-        await tx.run(UPSERT_EDGE_SQL, [
-          event.memoryId,
-          sanitizedReferencesSource,
-          1 + alphaDelta,
-          1 + betaDelta,
-          new Date().toISOString()
-        ]);
-      }
-      appliedEvents2.push({ event, sanitizedReferencesSource });
-      applied2 += 1;
-    }
-    return { applied: applied2, lateRejects: lateRejects2, appliedEvents: appliedEvents2 };
-  });
-  if (ctx.taskId && appliedEvents.length > 0) {
-    for (const { event, sanitizedReferencesSource } of appliedEvents) {
-      ensure({
-        id: "memory_rated",
-        flow: "task",
-        runId: ctx.taskId,
-        data: {
-          memoryId: event.memoryId,
-          source: event.source,
-          signal: event.signal,
-          weight: event.weight,
-          hasReferencesSource: sanitizedReferencesSource !== null
-        },
-        validator: (data) => typeof data.memoryId === "string" && data.memoryId.length > 0 && typeof data.source === "string" && data.source.length > 0 && typeof data.signal === "number" && data.signal >= -1 && data.signal <= 1 && typeof data.weight === "number" && data.weight >= 0 && data.weight <= 1
-      });
-    }
-  }
-  return { applied, rejected: [...rejected, ...lateRejects] };
-}
-function validate(event) {
-  if (!event.source || event.source.trim() === "") {
-    return "source is required";
-  }
-  if (!Number.isFinite(event.signal) || event.signal < -1 || event.signal > 1) {
-    return "signal must be in [-1, +1]";
-  }
-  if (!Number.isFinite(event.weight) || event.weight < 0 || event.weight > 1) {
-    return "weight must be in [0, 1]";
-  }
-  if (!event.memoryId) {
-    return "memoryId is required";
-  }
-  return null;
-}
-function isUniqueConstraintError(err) {
-  if (!(err instanceof Error))
-    return false;
-  return /UNIQUE constraint failed|SQLITE_CONSTRAINT/i.test(err.message);
-}
-
-// src/be/memory/raters/run-server-raters.ts
-async function runServerRaters(input, deps = {}) {
-  const result = { ratersFired: 0, outcomes: [] };
-  if (input.retrievedMemoryIds.length === 0)
-    return result;
-  const allRaters = deps.raters ?? getRegisteredRaters();
-  const allowed = deps.serverRaterNames ?? SERVER_RATERS;
-  const weightFor = deps.weightMultiplierFor ?? getRaterWeightMultiplier;
-  const applyFn = deps.applyRating ?? applyRating;
-  const serverRaters = allRaters.filter((r) => allowed.has(r.name));
-  for (const rater of serverRaters) {
-    const events = await rater.rate({
-      taskId: input.taskId,
-      agentId: input.agentId,
-      retrievedMemoryIds: input.retrievedMemoryIds,
-      evidence: input.evidence
-    });
-    if (events.length === 0)
-      continue;
-    const multiplier = weightFor(rater.name);
-    const stamped = events.map((e) => ({
-      ...e,
-      source: rater.name,
-      weight: Math.max(0, Math.min(1, e.weight * multiplier))
-    }));
-    const applied = await applyFn(stamped, { taskId: input.taskId });
-    result.ratersFired += 1;
-    result.outcomes.push({ rater: rater.name, events: stamped, result: applied });
-  }
-  return result;
-}
-
-// src/memory/automatic-task-gate.ts
-var SCHEDULE_TAG_PREFIX = "schedule:";
-var AUTOMATIC_TASK_TYPES = new Set([
-  "boot-triage",
-  "heartbeat",
-  "heartbeat-checklist",
-  "health-check",
-  "health-probe",
-  "monitor",
-  "monitoring"
-]);
-function isAutomaticOrRecurringTaskCompletion(task) {
-  const tags = task.tags ?? [];
-  const taskType = task.taskType?.toLowerCase();
-  return task.source === "schedule" || task.source === "system" || tags.includes("scheduled") || tags.includes("auto-generated") || tags.some((tag) => tag.startsWith(SCHEDULE_TAG_PREFIX)) || taskType !== undefined && (AUTOMATIC_TASK_TYPES.has(taskType) || taskType.endsWith("-monitor") || taskType.endsWith("-digest"));
-}
-function shouldPersistAutomaticTaskMemory(task, persistMemory) {
-  if (persistMemory)
-    return true;
-  return !isAutomaticOrRecurringTaskCompletion(task);
-}
-var shouldPersistTaskCompletionMemory = shouldPersistAutomaticTaskMemory;
-
-// src/tasks/terminal-result-guard.ts
-init_db();
-init_types();
-init_secret_scrubber();
-function getTaskOutputValidationError(outputSchema, output) {
-  if (!outputSchema || typeof outputSchema !== "object")
-    return;
-  const schema = outputSchema;
-  if (!output) {
-    return `Task has an outputSchema but no output was provided. You must call store-progress with a valid JSON output matching this schema:
-${JSON.stringify(schema, null, 2)}`;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(output);
-  } catch {
-    return `Task output must be valid JSON matching the outputSchema. Got invalid JSON. Schema:
-${JSON.stringify(schema, null, 2)}`;
-  }
-  let validationErrors;
-  try {
-    validationErrors = validateJsonSchema(schema, parsed);
-  } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
-    return `Task outputSchema is malformed and cannot be validated (${detail}). Ask an operator to correct the task's outputSchema, or force-complete with store-progress force: true.`;
-  }
-  if (validationErrors.length > 0) {
-    return `Task output does not match the outputSchema. Errors:
-${validationErrors.join(`
-`)}
-
-Expected schema:
-${JSON.stringify(schema, null, 2)}
-
-Please fix your output and retry.`;
-  }
-  return;
-}
-async function guardTerminalTaskResultWrite(task, write2) {
-  if (!isTerminalTaskStatus(task.status) || !write2.status && !write2.force) {
-    return { handled: false };
-  }
-  const scrubbedOutput = write2.output !== undefined ? scrubSecrets(write2.output) : undefined;
-  const scrubbedFailureReason = write2.failureReason !== undefined ? scrubSecrets(write2.failureReason) : undefined;
-  const hasDifferingOutput = scrubbedOutput !== undefined && scrubbedOutput !== task.output;
-  const hasDifferingFailureReason = scrubbedFailureReason !== undefined && scrubbedFailureReason !== task.failureReason;
-  const hasDifferingResultText = hasDifferingOutput || hasDifferingFailureReason;
-  if (hasDifferingResultText && write2.force) {
-    const outputValidationError = hasDifferingOutput ? getTaskOutputValidationError(task.outputSchema, write2.output) : undefined;
-    if (outputValidationError) {
-      return { handled: true, success: false, message: outputValidationError, task };
-    }
-    const overwrittenTask = await overwriteTerminalTaskResultText(task.id, {
-      ...write2.output !== undefined ? { output: write2.output } : {},
-      ...write2.failureReason !== undefined ? { failureReason: write2.failureReason } : {}
-    });
-    if (!overwrittenTask) {
-      return {
-        handled: true,
-        success: false,
-        message: `Task "${task.id}" terminal result text could not be overwritten.`,
-        task
-      };
-    }
-    return {
-      handled: true,
-      success: true,
-      message: `Task "${task.id}" is already ${task.status}; force-overwrote terminal result text ` + "without replaying completion side effects.",
-      task: overwrittenTask,
-      wasForcedOverwrite: true
-    };
-  }
-  if (hasDifferingResultText) {
-    return {
-      handled: true,
-      success: false,
-      message: `Discarded write for already-${task.status} task "${task.id}"; ` + "existing output/failureReason and finishedAt were preserved. Retry with force: true " + "to overwrite terminal result text without replaying completion side effects.",
-      task
-    };
-  }
-  return {
-    handled: true,
-    success: true,
-    message: `Task "${task.id}" is already ${task.status}; treating as no-op. ` + "Existing output preserved (first-call-wins).",
-    task,
-    wasNoOp: true
-  };
-}
-
-// src/tools/store-progress.ts
 init_types();
 init_secret_scrubber();
 var storeProgressOutputSchema = swarmToolOutputSchema({
@@ -118760,91 +118978,15 @@ var registerStoreProgressTool = (server) => {
       };
     });
     const shouldRunTerminalSideEffects = (status === "completed" || status === "failed") && result.success && result.task && !(("wasNoOp" in result) && result.wasNoOp) && !(("wasForcedOverwrite" in result) && result.wasForcedOverwrite);
-    if (shouldRunTerminalSideEffects && shouldPersistTaskCompletionMemory(result.task, persistMemory)) {
-      (async () => {
-        try {
-          const taskContent = status === "completed" ? `Task: ${result.task.task}
-
-Output:
-${output || "(no output)"}` : `Task: ${result.task.task}
-
-Failure reason:
-${failureReason || "No reason provided"}
-
-This task failed. Learn from this to avoid repeating the mistake.`;
-          if (taskContent.length < 30)
-            return;
-          const store = getMemoryStore();
-          const provider = getEmbeddingProvider();
-          const memory = await store.store({
-            agentId: requestInfo.agentId ?? null,
-            content: taskContent,
-            name: `Task: ${result.task.task.slice(0, 80)}`,
-            scope: "agent",
-            source: "task_completion",
-            sourceTaskId: taskId
-          });
-          const embedding = await provider.embed(taskContent);
-          if (embedding) {
-            await store.updateEmbedding(memory.id, embedding, provider.name);
-          }
-          const shouldShareWithSwarm = status === "completed" && (result.task.taskType === "research" || result.task.tags?.includes("knowledge") || result.task.tags?.includes("shared"));
-          if (shouldShareWithSwarm) {
-            try {
-              const swarmMemory = await store.store({
-                agentId: requestInfo.agentId ?? null,
-                scope: "swarm",
-                name: `Shared: ${result.task.task.slice(0, 80)}`,
-                content: `Task completed by agent ${requestInfo.agentId}:
-
-${taskContent}`,
-                source: "task_completion",
-                sourceTaskId: taskId
-              });
-              const swarmEmbedding = await provider.embed(taskContent);
-              if (swarmEmbedding) {
-                await store.updateEmbedding(swarmMemory.id, swarmEmbedding, provider.name);
-              }
-            } catch {}
-          }
-        } catch {}
-      })().catch((err) => console.error("[store-progress] task completion memory write failed:", scrubSecrets(err instanceof Error ? err.message : String(err))));
-    }
-    if (shouldRunTerminalSideEffects) {
-      (async () => {
-        try {
-          const retrievals = await getRetrievalsForTask(taskId);
-          if (retrievals.length === 0)
-            return;
-          const retrievedMemoryIds = retrievals.map((r) => r.memoryId);
-          const logs = await getSessionLogsByTaskId(taskId);
-          const evidence = logs.map((l) => l.content).join(`
-`);
-          await runServerRaters({
-            taskId,
-            agentId: requestInfo.agentId ?? "",
-            retrievedMemoryIds,
-            evidence
-          });
-        } catch (err) {
-          console.error("[store-progress] server-rater fire failed:", err instanceof Error ? err.message : String(err));
-        }
-      })().catch((err) => console.error("[store-progress] server rater run failed:", scrubSecrets(err instanceof Error ? err.message : String(err))));
-    }
-    if (status && result.success && result.task && !result.task.workflowRunId && !(("wasNoOp" in result) && result.wasNoOp) && !(("wasForcedOverwrite" in result) && result.wasForcedOverwrite)) {
-      try {
-        const followUp = await createWorkerTaskFollowUp({
-          task: result.task,
-          status,
-          output,
-          failureReason
-        });
-        if (followUp) {
-          console.log(`[store-progress] Created follow-up task ${followUp.id.slice(0, 8)} for ${status} task ${taskId.slice(0, 8)}`);
-        }
-      } catch (err) {
-        console.warn(`[store-progress] Failed to create follow-up task: ${err}`);
-      }
+    if (shouldRunTerminalSideEffects && status) {
+      await runTaskTerminalEffects({
+        task: result.task,
+        status,
+        output,
+        failureReason,
+        agentId: requestInfo.agentId,
+        persistMemory
+      });
     }
     const { success, message } = result;
     const task = result.task ? {
@@ -121296,6 +121438,7 @@ async function createServer(opts = {}) {
   if (hasCapability2("scheduling")) {
     registerListSchedulesTool(server);
     registerCreateScheduleTool(server);
+    registerDeferTaskTool(server);
     registerUpdateScheduleTool(server);
     registerPatchScheduleTool(server);
     registerDeleteScheduleTool(server);
@@ -121456,7 +121599,7 @@ function isExplicitSelfRaterEnabled() {
 
 // src/utils/skill-fs-writer.ts
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readdirSync, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname2, join as join3 } from "node:path";
+import { dirname, join as join3 } from "node:path";
 var SWARM_MARKER_FILE = ".swarm-managed";
 function reconcileManagedSkillFiles(skillDir, currentRelativeFiles) {
   if (!existsSync2(join3(skillDir, SWARM_MARKER_FILE)))
@@ -121560,7 +121703,7 @@ function writeSkillsToFilesystem(entries, harnessType = "all", home) {
         }
         const targetPath = join3(skillDir, file.path);
         try {
-          mkdirSync2(dirname2(targetPath), { recursive: true });
+          mkdirSync2(dirname(targetPath), { recursive: true });
           writeFileSync2(targetPath, file.content, "utf-8");
         } catch (err) {
           const msg = err instanceof Error ? err.message : "Unknown error";
@@ -121593,4 +121736,4 @@ function writeSkillsToFilesystem(entries, harnessType = "all", home) {
   return { synced, removed, errors };
 }
 
-export { safeParseAsync2 as safeParseAsync, normalizeObjectSchema, getParseErrorMessage, DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, isInboxAllowed, isSenderAllowed, handleMessageReceived, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, runtimeInstanceHeader, describeRequestRoute, route, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, mcpOverflowAuthError, markScriptSdkRequestOrigin, toolErr, createToolRegistrar, userCtx, resolveTaskAuditUserId, resolveHttpAuditUserId, resolveHttpFavoriteOwner, handleApps, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, refreshLinks, canReadMemory, getLinksForMemory, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, expandCandidatesWithGraph, indexMemoryContent, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, parseSkillContent, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, guardTerminalTaskResultWrite, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer, SIMILARITY_THRESHOLD, renderMemoriesPrompt, writeSkillsToFilesystem };
+export { safeParseAsync2 as safeParseAsync, normalizeObjectSchema, getParseErrorMessage, DEFAULT_NEGOTIATED_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, isJSONRPCRequest, isJSONRPCResultResponse, isJSONRPCErrorResponse, JSONRPCMessageSchema, isInitializeRequest, McpServer, isGitHubEnabled, initGitHub, verifyWebhookSignature, isAgentMailEnabled, initAgentMail, verifyAgentMailWebhook, isInboxAllowed, isSenderAllowed, handleMessageReceived, enqueueAuditRow, enqueueAdmissionRow, flushAuditBuffer, startAuditWriter, stopAuditWriter, startAuditGc, stopAuditGc, handlePullRequest, handleIssue, handleComment, handlePullRequestReview, handleCheckRun, handleCheckSuite, handleWorkflowRun, isGitLabEnabled, initGitLab, verifyGitLabWebhook, handleMergeRequest, handleIssue2 as handleIssue1, handleNote, handlePipeline, getJiraMetadata, updateJiraMetadata, clearJiraMetadata, registerJiraWebhook, deleteJiraWebhook, isJiraEnabled, initJira, handleJiraWebhook, handleAgentSessionEvent, handleIssueUpdate, handleIssueDelete, handleAgentSessionPrompted, isLinearEnabled, initLinear, parseCookieHeader, extractAndVerifyCookie, issuePageSessionCookie, resolveHttpRequestAuth, warnIfCorsAllowsAnyOrigin, isOriginAllowedForCredentials, setCorsHeaders, parseQueryParams, getPathSegments, wireHttpSpanLifecycle, safeRequestUrlForLog, agentWithCapacity, parseBody, BODY_TOO_LARGE, enforceContentLengthCap, json, jsonError, triggerSchemaErrorResponse, deriveApiBaseUrl, httpServerSemconvAttributes, runtimeInstanceHeader, describeRequestRoute, route, loadGlobalConfigsIntoEnv, reloadGlobalConfigsAndIntegrations, scheduleIntegrationsReload, handleCore, mcpOverflowAuthError, markScriptSdkRequestOrigin, toolErr, createToolRegistrar, userCtx, resolveTaskAuditUserId, resolveHttpAuditUserId, resolveHttpFavoriteOwner, handleApps, getUserCommsPrefs, getTaskDetailsInputSchema, getTaskDetailsOutputSchema, getTaskDetailsHandler, cancelTaskInputSchema, cancelTaskOutputSchema, cancelTaskHandler, executeReadOnlyQuery, assertSelectOnlyQuery, handleDbQuery, snapshotMetric, AssetKeyAuthorizationError, authorizeAssetKeyWrite, snapshotPage, assertOAuthAppUrlsSafe, assertOAuthEgressUrlSafe, listOAuthPresets, listOAuthPresetIds, getOAuthPreset, hydrateOAuthAppFromPreset, scopedResourceScopeIdSchema, resolveScopedResourceId, dedupeMemoryDocumentIds, recordMemoryAccesses, recordRetrievals, ExplicitSelfDuplicateError, applyRating, shouldPersistAutomaticTaskMemory, guardTerminalTaskResultWrite, getTasksInputSchema, getTasksOutputSchema, getTasksHandler, reservedNamespaceError, reservedRoomKeyError, refreshLinks, canReadMemory, getLinksForMemory, expandCandidatesWithGraph, indexMemoryContent, markKapsoMessageRead, sendKapsoReaction, getKapsoConfig, getKapsoNumberMapping, markKapsoMessageSeen, resolveRoomNamespace, roomRequestInfo, authorizeRoomNamespace, RoomOperationSchema, removeAwarenessStates, roomTopic, decodeRoomSnapshot, roomView, getRoom, changeRoom, applyRoomUpdate, resetRoom, sweepRooms, closeRooms, removeNamespaceRooms, createEvent, createEventsBatch, getEventCountsFiltered, getEventsFiltered, mergeScheduleTiming, validateRecurringTiming, checkOutputSchemaShape, sendTaskOutputSchema, sendTaskHandler, parseSkillContent, steerTaskUserInputSchema, steerTaskOutputSchema, steerTaskHandler, canClaim, emitBudgetRefusalSideEffects, taskActionInputSchema, taskActionOutputSchema, taskActionHandler, patchWorkflowDefinition, resolveScriptsOnlyMode, ALL_CAPABILITIES, hasCapability, getEnabledCapabilities, createServer, SIMILARITY_THRESHOLD, renderMemoriesPrompt, writeSkillsToFilesystem };