@desplega.ai/agent-swarm 1.146.0 → 1.147.0

package/src/tools/slack-download-file.ts

@@ -3,16 +3,23 @@ import * as z from "zod";
 import { getAgentById } from "@/be/db";
 import { getSlackApp } from "@/slack/app";
 import { DEFAULT_DOWNLOAD_DIR, downloadFile, getFileInfo } from "@/slack/files";
+import { attachableTask, attachSlackFilesForAgent } from "@/slack/inbound-files";
 import { createToolRegistrar, swarmToolOutputSchema, toolErr, toolOk } from "@/tools/utils";
 
+/** `F0123ABCD` out of a `files.slack.com/files-pri/<team>-<file>/…` URL. */
+function fileIdFromUrl(url: string): string | undefined {
+  return /\/files-pri\/[A-Z0-9]+-([A-Z0-9]+)\//.exec(url)?.[1];
+}
+
 export const registerSlackDownloadFileTool = (server: McpServer) => {
   createToolRegistrar(server)(
     "slack-download-file",
     {
       title: "Download file from Slack",
       description:
-        "Download a file from Slack by file ID or URL. Files are saved to the agent's download directory on the shared disk by default.",
-      annotations: { readOnlyHint: true, openWorldHint: true },
+        "Download a file from Slack by file ID or URL. From a task, the file is stored as an attachment of that task and the result carries a ready-to-run `fetchCommand` to get the bytes into your container. Without a task, the file is saved on the API server's disk, which your container usually can't read.",
+      // Not read-only: from a task it uploads the file and records an attachment.
+      annotations: { readOnlyHint: false, openWorldHint: true },
 
       inputSchema: z.object({
         fileId: z
@@ -24,11 +31,17 @@ export const registerSlackDownloadFileTool = (server: McpServer) => {
           .url()
           .optional()
           .describe("Direct URL to download (url_private_download from a file object)."),
+        taskId: z
+          .uuid()
+          .optional()
+          .describe(
+            "Task to attach the file to. Defaults to the task you are working on; must be a task you own or created.",
+          ),
         savePath: z
           .string()
           .optional()
           .describe(
-            "Where to save the file. Can be a directory or full path. Defaults to /workspace/shared/downloads/{agentId}/slack/",
+            "Only without a task: where to save the file on the API server (directory or full path). Defaults to /workspace/shared/downloads/{agentId}/slack/.",
           ),
         filename: z
           .string()
@@ -36,7 +49,15 @@ export const registerSlackDownloadFileTool = (server: McpServer) => {
           .describe("Filename to use when saving. Only used if savePath is a directory."),
       }),
       outputSchema: swarmToolOutputSchema({
-        savedPath: z.string().optional(),
+        taskId: z.string().optional(),
+        attachmentId: z.string().optional(),
+        fetchCommand: z.string().optional(),
+        savedPath: z
+          .string()
+          .optional()
+          .describe(
+            "Only without a task: the path on the API server's disk, not in your container.",
+          ),
         fileInfo: z
           .looseObject({
             id: z.string().optional(),
@@ -47,7 +68,7 @@ export const registerSlackDownloadFileTool = (server: McpServer) => {
           .optional(),
       }),
     },
-    async ({ fileId, url, savePath, filename }, requestInfo, _meta) => {
+    async ({ fileId, url, taskId, savePath, filename }, requestInfo, _meta) => {
       if (!requestInfo.agentId) {
         return toolErr("Agent ID not found.");
       }
@@ -72,33 +93,42 @@ export const registerSlackDownloadFileTool = (server: McpServer) => {
         return toolErr("Slack bot token not configured.");
       }
 
+      const task = await attachableTask(agent.id, taskId ?? requestInfo.sourceTaskId);
+      if (taskId && !task) {
+        return toolErr("You don't have context for this task.");
+      }
+
       try {
-        let downloadUrl = url;
-        let fileInfo:
-          | {
-              id: string;
-              name: string;
-              mimetype: string;
-              size: number;
-            }
-          | undefined;
-
-        // If fileId provided, get file info first
-        if (fileId) {
-          const info = await getFileInfo(app.client, fileId);
+        const id = fileId ?? (url ? fileIdFromUrl(url) : undefined);
+        const info = id ? await getFileInfo(app.client, id) : null;
+        if (fileId && !info) {
+          return toolErr(`File not found: ${fileId}`);
+        }
+        const fileInfo = info
+          ? { id: info.id, name: info.name, mimetype: info.mimetype, size: info.size }
+          : undefined;
+
+        if (task) {
           if (!info) {
-            return toolErr(`File not found: ${fileId}`);
+            return toolErr("Could not identify the Slack file in that URL; pass fileId instead.");
           }
-
-          downloadUrl = info.url_private_download;
-          fileInfo = {
-            id: info.id,
-            name: info.name,
-            mimetype: info.mimetype,
-            size: info.size,
-          };
+          const outcome = (await attachSlackFilesForAgent(app.client, task, [info], agent.id)).get(
+            info.id,
+          );
+          if (!outcome || "reason" in outcome) {
+            return toolErr(`Failed to attach file: ${outcome?.reason ?? "unknown error"}`);
+          }
+          const { attachment, fetchCommand } = outcome;
+          return toolOk(
+            `Attached ${attachment.name} to task ${task.id} (attachment ${attachment.id}).`,
+            {
+              details: `Get it into your container with:\n${fetchCommand}`,
+              data: { taskId: task.id, attachmentId: attachment.id, fetchCommand, fileInfo },
+            },
+          );
         }
 
+        const downloadUrl = info?.url_private_download ?? url;
         if (!downloadUrl) {
           return toolErr("No download URL available.");
         }
@@ -125,8 +155,9 @@ export const registerSlackDownloadFileTool = (server: McpServer) => {
           return toolErr(`Failed to download file: ${result.error}`);
         }
 
-        const successMsg = `File downloaded successfully to ${result.savedPath}`;
-        return toolOk(successMsg, { data: { savedPath: result.savedPath, fileInfo } });
+        return toolOk(`File saved on the API server at ${result.savedPath}.`, {
+          data: { savedPath: result.savedPath, fileInfo },
+        });
       } catch (error) {
         const errorMsg = error instanceof Error ? error.message : String(error);
         return toolErr(`Failed to download file: ${errorMsg}`);

package/src/tools/slack-read.ts

@@ -4,13 +4,16 @@ import { getAgentById, getInboxMessageById, getTaskById } from "@/be/db";
 import { can } from "@/rbac";
 import { getSlackApp } from "@/slack/app";
 import { withAutoJoin } from "@/slack/channel-join";
-import { downloadFile } from "@/slack/files";
+import { downloadFile, type SlackFile } from "@/slack/files";
+import { attachableTask, attachSlackFilesForAgent } from "@/slack/inbound-files";
 import { extractSlackMessageText } from "@/slack/message-text";
 import { createToolRegistrar, swarmToolOutputSchema, toolErr, toolOk } from "@/tools/utils";
+import type { AgentTask } from "@/types";
 
 /**
- * Default download directory for auto-downloaded Slack files (inside MCP container).
- * This differs from the agent's /workspace/shared path as the MCP server runs in a separate container.
+ * Where files are auto-downloaded when there is no task to attach them to.
+ * This is the API server's disk: a worker container only sees it if the
+ * deployment mounts the shared volume there.
  */
 const AUTO_DOWNLOAD_DIR = "/app/shared/downloads/slack";
 
@@ -21,7 +24,13 @@ const SlackFileSchema = z.looseObject({
   filetype: z.string().optional(),
   size: z.number().optional(),
   url_private_download: z.string().optional(),
-  localPath: z.string().optional(),
+  attachmentId: z.string().optional(),
+  fetchCommand: z.string().optional(),
+  notAttached: z.string().optional(),
+  localPath: z
+    .string()
+    .optional()
+    .describe("Only without a task: the path on the API server's disk, not in your container."),
 });
 
 const SlackMessageSchema = z.looseObject({
@@ -39,8 +48,9 @@ export const registerSlackReadTool = (server: McpServer) => {
     {
       title: "Read Slack thread/channel history",
       description:
-        "Read messages from a Slack thread or channel. Use inboxMessageId or taskId to read from a thread you have context for, or provide channelId directly for channel history (leads only).",
-      annotations: { readOnlyHint: true, openWorldHint: true },
+        "Read messages from a Slack thread or channel. Use inboxMessageId or taskId to read from a thread you have context for, or provide channelId directly for channel history (leads only). From a task, files in the messages are stored as attachments of that task, each with a ready-to-run `fetchCommand`.",
+      // Not read-only: from a task it uploads the thread's files as attachments.
+      annotations: { readOnlyHint: false, openWorldHint: true },
 
       inputSchema: z.object({
         inboxMessageId: z.uuid().optional().describe("Read thread history for an inbox message."),
@@ -63,7 +73,9 @@ export const registerSlackReadTool = (server: McpServer) => {
         includeFiles: z
           .boolean()
           .default(true)
-          .describe("Include file attachments in the response (default: true)."),
+          .describe(
+            "Include file attachments in the response (default: true). From a task, they are also stored as attachments of that task.",
+          ),
       }),
       outputSchema: swarmToolOutputSchema({
         channelId: z.string().optional(),
@@ -87,6 +99,7 @@ export const registerSlackReadTool = (server: McpServer) => {
 
       let slackChannelId: string | undefined = channelId;
       let slackThreadTs: string | undefined = threadTs;
+      let contextTask: AgentTask | null = null;
 
       // Determine Slack context from inbox message or task
       if (inboxMessageId) {
@@ -110,6 +123,7 @@ export const registerSlackReadTool = (server: McpServer) => {
         }
         slackChannelId = task.slackChannelId;
         slackThreadTs = task.slackThreadTs;
+        contextTask = task;
       } else if (channelId) {
         // Direct channel access requires lead privileges
         const decision = can({
@@ -209,6 +223,27 @@ export const registerSlackReadTool = (server: McpServer) => {
         // Get token for auto-download
         const token = process.env.SLACK_BOT_TOKEN;
 
+        // Files go to the calling task's attachments; without one, to the API disk.
+        const attachTo =
+          contextTask ?? (await attachableTask(agent.id, taskId ?? requestInfo.sourceTaskId));
+        if (taskId && !attachTo) {
+          return toolErr("You don't have context for this task.", { data: { messages: [] } });
+        }
+
+        type FileInfo = {
+          id: string;
+          name: string;
+          mimetype: string;
+          filetype: string;
+          size: number;
+          url_private_download: string;
+          attachmentId?: string;
+          fetchCommand?: string;
+          notAttached?: string;
+          localPath?: string;
+        };
+        const toAttach: Array<{ raw: RawFile; info: FileInfo }> = [];
+
         // Format messages
         const messages: Array<{
           user: string | undefined;
@@ -216,15 +251,7 @@ export const registerSlackReadTool = (server: McpServer) => {
           isBot: boolean;
           text: string;
           ts: string;
-          files?: Array<{
-            id: string;
-            name: string;
-            mimetype: string;
-            filetype: string;
-            size: number;
-            url_private_download: string;
-            localPath?: string;
-          }>;
+          files?: FileInfo[];
         }> = [];
 
         for (const m of rawMessages) {
@@ -243,22 +270,12 @@ export const registerSlackReadTool = (server: McpServer) => {
           }
 
           // Extract file information if includeFiles is true
-          let files:
-            | Array<{
-                id: string;
-                name: string;
-                mimetype: string;
-                filetype: string;
-                size: number;
-                url_private_download: string;
-                localPath?: string;
-              }>
-            | undefined;
+          let files: FileInfo[] | undefined;
 
           if (includeFiles && m.files && m.files.length > 0) {
             files = [];
             for (const f of m.files) {
-              const fileInfo: (typeof files)[number] = {
+              const fileInfo: FileInfo = {
                 id: f.id,
                 name: f.name,
                 mimetype: f.mimetype,
@@ -267,8 +284,10 @@ export const registerSlackReadTool = (server: McpServer) => {
                 url_private_download: f.url_private_download,
               };
 
-              // Auto-download file if token is available
-              if (token && f.url_private_download) {
+              if (attachTo) {
+                toAttach.push({ raw: f, info: fileInfo });
+              } else if (token && f.url_private_download) {
+                // Auto-download file if token is available
                 const savePath = `${AUTO_DOWNLOAD_DIR}/${f.id}_${f.name}`;
                 try {
                   const downloadResult = await downloadFile({
@@ -298,6 +317,24 @@ export const registerSlackReadTool = (server: McpServer) => {
           });
         }
 
+        if (attachTo && toAttach.length > 0) {
+          const outcomes = await attachSlackFilesForAgent(
+            client,
+            attachTo,
+            toAttach.map(({ raw }) => raw as SlackFile),
+            agent.id,
+          );
+          for (const { info } of toAttach) {
+            const outcome = outcomes.get(info.id);
+            if (outcome && "attachment" in outcome) {
+              info.attachmentId = outcome.attachment.id;
+              info.fetchCommand = outcome.fetchCommand;
+            } else {
+              info.notAttached = outcome?.reason ?? "not downloaded";
+            }
+          }
+        }
+
         // Format for text output
         const textOutput = messages
           .map((m) => {
@@ -306,8 +343,12 @@ export const registerSlackReadTool = (server: McpServer) => {
               const fileList = m.files
                 .map((f) => {
                   let line = `  - ${f.name} (${f.mimetype}, ${Math.round(f.size / 1024)} KB)`;
-                  if (f.localPath) {
-                    line += ` [Downloaded: ${f.localPath}]`;
+                  if (f.fetchCommand) {
+                    line += ` [Task attachment ${f.attachmentId}: ${f.fetchCommand}]`;
+                  } else if (f.notAttached) {
+                    line += ` [Not attached: ${f.notAttached}]`;
+                  } else if (f.localPath) {
+                    line += ` [Downloaded on the API server: ${f.localPath}]`;
                   }
                   return line;
                 })

package/src/tools/store-progress.ts

@@ -7,25 +7,20 @@ import {
   getAgentById,
   getDbClient,
   getResolvedConfig,
-  getSessionLogsByTaskId,
   getTaskById,
   insertTaskAttachment,
   updateAgentStatusFromCapacity,
   updateTaskProgress,
 } from "@/be/db";
-import { getEmbeddingProvider, getMemoryStore } from "@/be/memory";
-import { getRetrievalsForTask } from "@/be/memory/raters/retrieval";
-import { runServerRaters } from "@/be/memory/raters/run-server-raters";
 import { AgentFsProvider } from "@/fs/agent-fs-provider";
-import { shouldPersistTaskCompletionMemory } from "@/memory/automatic-task-gate";
+import { runTaskTerminalEffects } from "@/tasks/task-terminal-effects";
 import {
   getTaskOutputValidationError,
   guardTerminalTaskResultWrite,
 } from "@/tasks/terminal-result-guard";
-import { createWorkerTaskFollowUp } from "@/tasks/worker-follow-up";
 import { createToolRegistrar, swarmToolOutputSchema, toolErr, toolOk } from "@/tools/utils";
 import { AgentTaskStatusSchema, AttachmentInputSchema, isTerminalTaskStatus } from "@/types";
-import { scrubSecrets } from "../utils/secret-scrubber";
+import { scrubSecrets } from "@/utils/secret-scrubber";
 
 // Phase 11: the `cost` / `costData` field was removed from this tool's input
 // schema. Adapters (claude/codex/pi/opencode/devin/claude-managed) are the
@@ -406,145 +401,20 @@ export const registerStoreProgressTool = (server: McpServer) => {
         !("wasNoOp" in result && result.wasNoOp) &&
         !("wasForcedOverwrite" in result && result.wasForcedOverwrite);
 
-      // Index completed and failed tasks as memory (async, non-blocking).
-      // Skip on no-op (idempotent re-call on terminal task) to avoid duplicate
-      // memory entries / vector index pollution.
-      // Automatic/recurring tasks are noisy by default; require explicit opt-in.
-      if (
-        shouldRunTerminalSideEffects &&
-        shouldPersistTaskCompletionMemory(result.task, persistMemory)
-      ) {
-        (async () => {
-          try {
-            const taskContent =
-              status === "completed"
-                ? `Task: ${result.task!.task}\n\nOutput:\n${output || "(no output)"}`
-                : `Task: ${result.task!.task}\n\nFailure reason:\n${failureReason || "No reason provided"}\n\nThis task failed. Learn from this to avoid repeating the mistake.`;
-
-            // Skip indexing if there's truly no content
-            if (taskContent.length < 30) return;
-
-            const store = getMemoryStore();
-            const provider = getEmbeddingProvider();
-
-            const memory = await store.store({
-              agentId: requestInfo.agentId ?? null,
-              content: taskContent,
-              name: `Task: ${result.task!.task.slice(0, 80)}`,
-              scope: "agent",
-              source: "task_completion",
-              sourceTaskId: taskId,
-            });
-            const embedding = await provider.embed(taskContent);
-            if (embedding) {
-              await store.updateEmbedding(memory.id, embedding, provider.name);
-            }
-
-            // Auto-promote high-value completions to swarm memory (P3)
-            const shouldShareWithSwarm =
-              status === "completed" &&
-              (result.task!.taskType === "research" ||
-                result.task!.tags?.includes("knowledge") ||
-                result.task!.tags?.includes("shared"));
-
-            if (shouldShareWithSwarm) {
-              try {
-                const swarmMemory = await store.store({
-                  agentId: requestInfo.agentId ?? null,
-                  scope: "swarm",
-                  name: `Shared: ${result.task!.task.slice(0, 80)}`,
-                  content: `Task completed by agent ${requestInfo.agentId}:\n\n${taskContent}`,
-                  source: "task_completion",
-                  sourceTaskId: taskId,
-                });
-                const swarmEmbedding = await provider.embed(taskContent);
-                if (swarmEmbedding) {
-                  await store.updateEmbedding(swarmMemory.id, swarmEmbedding, provider.name);
-                }
-              } catch {
-                // Non-blocking — swarm memory promotion failure is not critical
-              }
-            }
-          } catch {
-            // Non-blocking — task completion memory failure should not affect task status
-          }
-        })().catch((err) =>
-          console.error(
-            "[store-progress] task completion memory write failed:",
-            scrubSecrets(err instanceof Error ? err.message : String(err)),
-          ),
-        );
-      }
-
-      if (shouldRunTerminalSideEffects) {
-        // Memory rater v1.5 — fire server-side raters on task completion.
-        // Plan: thoughts/taras/plans/2026-05-05-memory-rater-v1.5/step-2.md §5
-        //
-        // Read `memory_retrieval` rows for this task + concatenated session_logs
-        // and hand both to `runServerRaters`, which iterates the allow-listed
-        // server raters (currently just `implicit-citation`), stamps source,
-        // applies the configured weight multiplier, and persists via
-        // `applyRating`. The orchestration is extracted so it can be unit-tested
-        // with stub raters (see `src/tests/run-server-raters.test.ts`).
-        //
-        // Fire-and-forget: rater failure must NEVER affect task status.
-        (async () => {
-          try {
-            const retrievals = await getRetrievalsForTask(taskId);
-            if (retrievals.length === 0) return;
-
-            const retrievedMemoryIds = retrievals.map((r) => r.memoryId);
-            const logs = await getSessionLogsByTaskId(taskId);
-            const evidence = logs.map((l) => l.content).join("\n");
-
-            await runServerRaters({
-              taskId,
-              agentId: requestInfo.agentId ?? "",
-              retrievedMemoryIds,
-              evidence,
-            });
-          } catch (err) {
-            console.error(
-              "[store-progress] server-rater fire failed:",
-              err instanceof Error ? err.message : String(err),
-            );
-          }
-        })().catch((err) =>
-          console.error(
-            "[store-progress] server rater run failed:",
-            scrubSecrets(err instanceof Error ? err.message : String(err)),
-          ),
-        );
-      }
-
-      // Create follow-up task for the lead when a worker task finishes.
-      // This replaces the old poll-based tasks_finished trigger which was unreliable.
-      // Skip for workflow-managed tasks — the workflow engine handles sequencing via resume.ts.
-      // Skip on no-op (idempotent re-call on terminal task) to avoid duplicate follow-ups.
-      if (
-        status &&
-        result.success &&
-        result.task &&
-        !result.task.workflowRunId &&
-        !("wasNoOp" in result && result.wasNoOp) &&
-        !("wasForcedOverwrite" in result && result.wasForcedOverwrite)
-      ) {
-        try {
-          const followUp = await createWorkerTaskFollowUp({
-            task: result.task,
-            status,
-            output,
-            failureReason,
-          });
-          if (followUp) {
-            console.log(
-              `[store-progress] Created follow-up task ${followUp.id.slice(0, 8)} for ${status} task ${taskId.slice(0, 8)}`,
-            );
-          }
-        } catch (err) {
-          // Non-blocking — follow-up task creation failure should not affect the store-progress response
-          console.warn(`[store-progress] Failed to create follow-up task: ${err}`);
-        }
+      // Post-commit terminal side effects (completion memory, server raters,
+      // lead follow-up). Shared with `defer-task` — see
+      // src/tasks/task-terminal-effects.ts. Skipped on no-op (idempotent
+      // re-call on a terminal task) and on forced text-only overwrites, so a
+      // replay never duplicates memories or follow-up tasks.
+      if (shouldRunTerminalSideEffects && status) {
+        await runTaskTerminalEffects({
+          task: result.task!,
+          status,
+          output,
+          failureReason,
+          agentId: requestInfo.agentId,
+          persistMemory,
+        });
       }
 
       const { success, message } = result;

package/src/tools/tool-config.ts

@@ -22,6 +22,7 @@ export const CORE_TOOLS = new Set([
   "task-action", // claim/release/accept/reject
   "send-task", // delegate subtasks
   "get-tasks", // list/filter tasks
+  "defer-task", // complete now, wake up later to continue
 
   // Memory (used at session start)
   "memory-search", // recall relevant context

package/src/tools/utils.ts

@@ -229,6 +229,23 @@ const scriptRunNudge = (r: SwarmToolResult): string | undefined => {
   return !r.ok && body?.error === "timeout" ? SCRIPT_RUN_TIMEOUT_NUDGE : scriptAuthoringNudge(r);
 };
 
+const SLACK_API_DISK_NUDGE =
+  "That path is on the API server's disk, not in your container — call this from a task you own (or pass its taskId) to get the file as a task attachment with a fetchCommand.";
+
+const slackDownloadFileNudge = (r: SwarmToolResult): string | undefined =>
+  r.ok && (r.data as { savedPath?: unknown } | undefined)?.savedPath
+    ? SLACK_API_DISK_NUDGE
+    : undefined;
+
+const slackReadNudge = (r: SwarmToolResult): string | undefined => {
+  if (!r.ok) return undefined;
+  const messages = (r.data as { messages?: Array<{ files?: Array<{ localPath?: unknown }> }> })
+    ?.messages;
+  return messages?.some((m) => m.files?.some((f) => Boolean(f.localPath)))
+    ? SLACK_API_DISK_NUDGE
+    : undefined;
+};
+
 const workflowLongScriptTimeoutNudge = (r: SwarmToolResult): string | undefined => {
   if (!r.ok) return undefined;
   const hint = (r.data as { longScriptTimeoutHint?: unknown } | undefined)?.longScriptTimeoutHint;
@@ -241,6 +258,8 @@ const workflowLongScriptTimeoutNudge = (r: SwarmToolResult): string | undefined
  * single sentence; derive only from already-scrubbed result fields.
  */
 export const NUDGES: Record<string, (result: SwarmToolResult) => string | undefined> = {
+  "defer-task": (r) =>
+    r.ok ? "Stop working on this task now; the wake-up task will carry your note." : undefined,
   "script-run": scriptRunNudge,
   "script-upsert": scriptAuthoringNudge,
   "launch-script-run": scriptAuthoringNudge,
@@ -249,6 +268,8 @@ export const NUDGES: Record<string, (result: SwarmToolResult) => string | undefi
   "update-workflow": workflowLongScriptTimeoutNudge,
   "patch-workflow": workflowLongScriptTimeoutNudge,
   "patch-workflow-node": workflowLongScriptTimeoutNudge,
+  "slack-download-file": slackDownloadFileNudge,
+  "slack-read": slackReadNudge,
   "script-search": (r) => {
     if (!r.ok) return undefined;
     // proxyScriptsApi wraps the parsed HTTP body as data = { status, data },

package/src/types.ts

@@ -1145,8 +1145,8 @@ export type AgentLatestModel = z.infer<typeof AgentLatestModelSchema>;
 
 /**
  * Worker-reported Bedrock enumeration block. Only present when the pi harness
- * is in Bedrock SDK mode (`BEDROCK_AUTH_MODE=sdk` or
- * `MODEL_OVERRIDE=amazon-bedrock/*`). Rides inside `cred_status` JSON (no new
+ * is in a Bedrock mode (`BEDROCK_AUTH_MODE=sdk`, `BEDROCK_AUTH_MODE=bearer`,
+ * or `MODEL_OVERRIDE=amazon-bedrock/*`). Rides inside `cred_status` JSON (no new
  * DB column). `models` is the intersection of the models invocable by this
  * account/region (on-demand/ACTIVE foundation models ∪ inference profiles) with
  * the set the pi-ai Converse harness can actually drive — Converse-incompatible
@@ -1287,6 +1287,20 @@ export type VersionMeta = {
   changeReason?: string | null;
 };
 
+/**
+ * Compare-and-set token for a profile update, per field: the content hash the
+ * writer based its edit on (e.g. what a session materialized from the DB). A
+ * field whose current DB hash differs is dropped: the DB moved since the writer
+ * read it, so its copy is stale, not an edit.
+ */
+export type ProfileExpectedHashes = Partial<Record<VersionableField, string>>;
+
+export type ProfileSyncConflict = {
+  field: VersionableField;
+  expectedHash: string;
+  currentHash: string;
+};
+
 // Channel Types
 export const ChannelTypeSchema = z.enum(["public", "dm"]);
 
@@ -1534,6 +1548,7 @@ export const EventNameSchema = z.enum([
   "system.error",
   "system.profile_sync_rejected",
   "system.profile_sync_reconciled",
+  "system.profile_sync_conflict",
   // Script catalog events
   "script.global_upsert",
   // Schedule events
@@ -1599,6 +1614,9 @@ export const ScheduledTaskSchema = z
     lastRunAt: z.iso.datetime().optional(),
     nextRunAt: z.iso.datetime().optional(),
     createdByAgentId: z.string().optional(),
+    // Set only by `defer-task`: the task this schedule wakes up to continue.
+    // Passed through as the created task's `parentTaskId`.
+    parentTaskId: z.string().optional(),
     timezone: z.string().default("UTC"),
     consecutiveErrors: z.number().int().min(0).default(0),
     lastErrorAt: z.iso.datetime().optional(),
@@ -1692,6 +1710,21 @@ export const RepoGuidelinesSchema = z
 
 export type RepoGuidelines = z.infer<typeof RepoGuidelinesSchema>;
 
+/** Upper bound per guideline list. The repository prompt section renders every
+ * entry outside the bootstrap budget, so the cap lives at the write boundary. */
+export const REPO_GUIDELINES_MAX_ENTRIES = 50;
+
+/** Write-side guidelines schema: same shape, bounded lists. Reads keep the
+ * unbounded `RepoGuidelinesSchema` so an older row never fails a response. */
+export const RepoGuidelinesInputSchema = z
+  .object({
+    prChecks: z.array(z.string()).max(REPO_GUIDELINES_MAX_ENTRIES),
+    mergeChecks: z.array(z.string()).max(REPO_GUIDELINES_MAX_ENTRIES),
+    allowMerge: z.boolean().optional().default(false),
+    review: z.array(z.string()).max(REPO_GUIDELINES_MAX_ENTRIES),
+  })
+  .openapi("RepoGuidelinesInput");
+
 export const RepoHooksSchema = z
   .object({
     enabled: z.boolean().default(false),
@@ -2212,10 +2245,10 @@ export type WorkflowVersion = z.infer<typeof WorkflowVersionSchema>;
 // Pages — DB-backed lightweight artifacts (HTML or JSON spec) stored in
 // SQLite and served at /p/:id. See plan: thoughts/taras/plans/2026-05-12-db-backed-pages/.
 // PageContentTypeSchema + PageAuthModeSchema MUST stay in sync with the SQL
-// CHECK constraints in src/be/migrations/059_pages.sql.
+// CHECK constraints in src/be/migrations/148_pages_svg.sql.
 // ---------------------------------------------------------------------------
 
-export const PageContentTypeSchema = z.enum(["text/html", "application/json"]);
+export const PageContentTypeSchema = z.enum(["text/html", "application/json", "image/svg+xml"]);
 export type PageContentType = z.infer<typeof PageContentTypeSchema>;
 
 export const PageAuthModeSchema = z.enum(["public", "authed", "password"]);