@desplega.ai/agent-swarm 1.73.2 → 1.73.4

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Agent Swarm API",
-    "version": "1.73.2",
+    "version": "1.73.4",
     "description": "Multi-agent orchestration API for Claude Code, Codex, and Gemini CLI. Enables task distribution, agent communication, and service discovery.\n\nMCP tools are documented separately in [MCP.md](./MCP.md)."
   },
   "servers": [
@@ -2914,6 +2914,112 @@
         }
       }
     },
+    "/api/memory/list": {
+      "post": {
+        "summary": "List or semantically search memories across all agents (debug/admin)",
+        "tags": [
+          "Memory"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "query": {
+                    "type": "string",
+                    "description": "Natural-language query. If present, runs semantic search; otherwise lists by recency."
+                  },
+                  "agentId": {
+                    "type": "string",
+                    "format": "uuid",
+                    "description": "Filter to a single agent. Omit for all."
+                  },
+                  "scope": {
+                    "type": "string",
+                    "enum": [
+                      "agent",
+                      "swarm",
+                      "all"
+                    ],
+                    "default": "all"
+                  },
+                  "source": {
+                    "type": "string",
+                    "enum": [
+                      "manual",
+                      "file_index",
+                      "session_summary",
+                      "task_completion"
+                    ]
+                  },
+                  "sourcePath": {
+                    "type": "string",
+                    "description": "Substring match against sourcePath (case-insensitive). Useful for file_index memories."
+                  },
+                  "limit": {
+                    "type": "integer",
+                    "minimum": 1,
+                    "maximum": 100,
+                    "default": 20
+                  },
+                  "offset": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "default": 0
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Memory list / search results"
+          },
+          "400": {
+            "description": "Validation error"
+          }
+        }
+      }
+    },
+    "/api/memory/{id}": {
+      "delete": {
+        "summary": "Delete a single memory by ID (debug/admin)",
+        "tags": [
+          "Memory"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "parameters": [
+          {
+            "schema": {
+              "type": "string",
+              "format": "uuid"
+            },
+            "required": true,
+            "name": "id",
+            "in": "path"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Memory deleted"
+          },
+          "404": {
+            "description": "Memory not found"
+          }
+        }
+      }
+    },
     "/api/prompt-templates/resolved": {
       "get": {
         "summary": "Resolve a prompt template for a given event type and scope chain",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@desplega.ai/agent-swarm",
-  "version": "1.73.2",
+  "version": "1.73.4",
   "description": "Multi-agent orchestration for Claude Code, Codex, Gemini CLI, and other AI coding assistants",
   "license": "MIT",
   "author": "desplega.sh <contact@desplega.sh>",

package/src/be/db.ts

@@ -1196,8 +1196,8 @@ export function getAllTasks(filters?: TaskFilters): AgentTask[] {
   }
 
   if (filters?.search) {
-    conditions.push("task LIKE ?");
-    params.push(`%${filters.search}%`);
+    conditions.push("(task LIKE ? OR id LIKE ?)");
+    params.push(`%${filters.search}%`, `%${filters.search}%`);
   }
 
   // New filters
@@ -1274,8 +1274,8 @@ export function getTasksCount(filters?: Omit<TaskFilters, "limit" | "readyOnly">
   }
 
   if (filters?.search) {
-    conditions.push("task LIKE ?");
-    params.push(`%${filters.search}%`);
+    conditions.push("(task LIKE ? OR id LIKE ?)");
+    params.push(`%${filters.search}%`, `%${filters.search}%`);
   }
 
   if (filters?.unassigned) {
@@ -1571,6 +1571,15 @@ export function findCompletedTaskInThread(
 
 export function completeTask(id: string, output?: string): AgentTask | null {
   const oldTask = getTaskById(id);
+  if (!oldTask) return null;
+
+  // Idempotency guard: don't re-complete a task already in a terminal state.
+  // Mirrors cancelTask. Prevents duplicate task.completed events, duplicate
+  // log entries, and duplicate follow-up tasks when multiple sessions race.
+  if (["completed", "failed", "cancelled"].includes(oldTask.status)) {
+    return null;
+  }
+
   const finishedAt = new Date().toISOString();
   let row = taskQueries.updateStatus().get("completed", finishedAt, id);
   if (!row) return null;
@@ -1607,6 +1616,15 @@ export function completeTask(id: string, output?: string): AgentTask | null {
 
 export function failTask(id: string, reason: string): AgentTask | null {
   const oldTask = getTaskById(id);
+  if (!oldTask) return null;
+
+  // Idempotency guard: don't re-fail a task already in a terminal state.
+  // Mirrors cancelTask / completeTask. Prevents duplicate task.failed events
+  // and duplicate follow-up tasks when multiple sessions race.
+  if (["completed", "failed", "cancelled"].includes(oldTask.status)) {
+    return null;
+  }
+
   const finishedAt = new Date().toISOString();
   const row = taskQueries.setFailure().get(reason, finishedAt, id);
   if (row && oldTask) {

package/src/http/memory.ts

@@ -69,6 +69,52 @@ const reEmbedMemory = route({
   },
 });
 
+const listMemory = route({
+  method: "post",
+  path: "/api/memory/list",
+  pattern: ["api", "memory", "list"],
+  summary: "List or semantically search memories across all agents (debug/admin)",
+  tags: ["Memory"],
+  auth: { apiKey: true },
+  body: z.object({
+    query: z
+      .string()
+      .optional()
+      .describe(
+        "Natural-language query. If present, runs semantic search; otherwise lists by recency.",
+      ),
+    agentId: z.string().uuid().optional().describe("Filter to a single agent. Omit for all."),
+    scope: z.enum(["agent", "swarm", "all"]).default("all"),
+    source: AgentMemorySourceSchema.optional(),
+    sourcePath: z
+      .string()
+      .optional()
+      .describe(
+        "Substring match against sourcePath (case-insensitive). Useful for file_index memories.",
+      ),
+    limit: z.number().int().min(1).max(100).default(20),
+    offset: z.number().int().min(0).default(0),
+  }),
+  responses: {
+    200: { description: "Memory list / search results" },
+    400: { description: "Validation error" },
+  },
+});
+
+const deleteMemoryById = route({
+  method: "delete",
+  path: "/api/memory/{id}",
+  pattern: ["api", "memory", null],
+  summary: "Delete a single memory by ID (debug/admin)",
+  tags: ["Memory"],
+  auth: { apiKey: true },
+  params: z.object({ id: z.string().uuid() }),
+  responses: {
+    200: { description: "Memory deleted" },
+    404: { description: "Memory not found" },
+  },
+});
+
 // ─── Handler ─────────────────────────────────────────────────────────────────
 
 export async function handleMemory(
@@ -182,6 +228,132 @@ export async function handleMemory(
     return true;
   }
 
+  if (listMemory.match(req.method, pathSegments)) {
+    const parsed = await listMemory.parse(req, res, pathSegments, new URLSearchParams());
+    if (!parsed) return true;
+
+    const { query, agentId, scope, source, sourcePath, limit, offset } = parsed.body;
+    const store = getMemoryStore();
+    const pathNeedle = sourcePath?.trim().toLowerCase();
+    const matchesPath = (p: string | null) =>
+      !pathNeedle || (p?.toLowerCase().includes(pathNeedle) ?? false);
+
+    try {
+      if (query && query.trim().length > 0) {
+        const provider = getEmbeddingProvider();
+        const queryEmbedding = await provider.embed(query.trim());
+
+        if (!queryEmbedding) {
+          json(res, { results: [], total: 0, mode: "semantic" });
+          return true;
+        }
+
+        const candidateLimit = Math.min(limit, 100) * CANDIDATE_SET_MULTIPLIER;
+        let candidates = store.search(queryEmbedding, agentId ?? "", {
+          scope,
+          limit: candidateLimit,
+          isLead: true,
+          source,
+        });
+        if (agentId) {
+          candidates = candidates.filter((c) => c.agentId === agentId);
+        }
+        if (pathNeedle) {
+          candidates = candidates.filter((c) => matchesPath(c.sourcePath));
+        }
+        const ranked = rerank(candidates, { limit: Math.min(limit, 100) });
+
+        json(res, {
+          results: ranked.map((r) => ({
+            id: r.id,
+            name: r.name,
+            content: r.content,
+            agentId: r.agentId,
+            scope: r.scope,
+            source: r.source,
+            similarity: r.similarity,
+            createdAt: r.createdAt,
+            accessedAt: r.accessedAt,
+            accessCount: r.accessCount ?? 0,
+            expiresAt: r.expiresAt ?? null,
+            embeddingModel: r.embeddingModel ?? null,
+            sourceTaskId: r.sourceTaskId,
+            sourcePath: r.sourcePath,
+            chunkIndex: r.chunkIndex,
+            totalChunks: r.totalChunks,
+            tags: r.tags,
+          })),
+          total: ranked.length,
+          mode: "semantic",
+        });
+        return true;
+      }
+
+      // When filtering by sourcePath, over-fetch then post-filter so the visible
+      // page isn't gutted by the in-memory filter.
+      const fetchLimit = pathNeedle
+        ? Math.min(500, Math.max(limit * 10, 100))
+        : Math.min(limit, 100);
+      let rows = store.list(agentId ?? "", {
+        scope,
+        limit: fetchLimit,
+        offset,
+        isLead: true,
+      });
+      if (agentId) {
+        rows = rows.filter((r) => r.agentId === agentId);
+      }
+      if (source) {
+        rows = rows.filter((r) => r.source === source);
+      }
+      if (pathNeedle) {
+        rows = rows.filter((r) => matchesPath(r.sourcePath));
+      }
+      rows = rows.slice(0, Math.min(limit, 100));
+
+      json(res, {
+        results: rows.map((r) => ({
+          id: r.id,
+          name: r.name,
+          content: r.content,
+          agentId: r.agentId,
+          scope: r.scope,
+          source: r.source,
+          createdAt: r.createdAt,
+          accessedAt: r.accessedAt,
+          accessCount: r.accessCount ?? 0,
+          expiresAt: r.expiresAt ?? null,
+          embeddingModel: r.embeddingModel ?? null,
+          sourceTaskId: r.sourceTaskId,
+          sourcePath: r.sourcePath,
+          chunkIndex: r.chunkIndex,
+          totalChunks: r.totalChunks,
+          tags: r.tags,
+        })),
+        total: rows.length,
+        mode: "list",
+      });
+    } catch (err) {
+      console.error("[memory-list] Error:", (err as Error).message);
+      jsonError(res, "Memory list failed", 500);
+    }
+    return true;
+  }
+
+  if (deleteMemoryById.match(req.method, pathSegments)) {
+    const parsed = await deleteMemoryById.parse(req, res, pathSegments, new URLSearchParams());
+    if (!parsed) return true;
+
+    const store = getMemoryStore();
+    const deleted = store.delete(parsed.params.id);
+    if (!deleted) {
+      jsonError(res, "Memory not found", 404);
+      return true;
+    }
+    json(res, { deleted: true });
+    return true;
+  }
+
   if (reEmbedMemory.match(req.method, pathSegments)) {
     const parsed = await reEmbedMemory.parse(req, res, pathSegments, new URLSearchParams());
     if (!parsed) return true;

package/src/slack/assistant.ts

@@ -8,6 +8,7 @@ import {
 import { resolveTemplate } from "../prompts/resolver";
 import { slackContextKey } from "../tasks/context-key";
 import { createTaskWithSiblingAwareness } from "../tasks/sibling-awareness";
+import { wasEventSeen } from "./event-dedup";
 import { bufferThreadMessage } from "./thread-buffer";
 // Side-effect import: registers all Slack event templates in the in-memory registry
 import "./templates";
@@ -40,7 +41,15 @@ export function createAssistant(): Assistant {
       await saveThreadContext();
     },
 
-    userMessage: async ({ message, say, setStatus, setTitle, getThreadContext }) => {
+    userMessage: async ({ message, body, say, setStatus, setTitle, getThreadContext }) => {
+      // Slack retries deliveries on 3s timeout / 5xx. Drop duplicates before
+      // any task-creation work runs (DES-293).
+      const eventId = body?.event_id;
+      if (wasEventSeen(eventId)) {
+        console.log(`[Slack] dropping Slack retry: event_id=${eventId}`);
+        return;
+      }
+
       // Wrap setStatus/setTitle to swallow all errors gracefully.
       // These calls can fail for various reasons (no_permission when the thread
       // wasn't started by the assistant, network errors, etc.), so we log and continue.

package/src/slack/event-dedup.test.ts

@@ -0,0 +1,123 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { _createTestCache, _resetForTests, wasEventSeen } from "./event-dedup";
+
+describe("wasEventSeen (production cache)", () => {
+  beforeEach(() => {
+    _resetForTests();
+  });
+  afterEach(() => {
+    _resetForTests();
+  });
+
+  test("first call returns false (not seen)", () => {
+    expect(wasEventSeen("Ev0001")).toBe(false);
+  });
+
+  test("second call with same id returns true (seen)", () => {
+    expect(wasEventSeen("Ev0002")).toBe(false);
+    expect(wasEventSeen("Ev0002")).toBe(true);
+  });
+
+  test("different ids do not collide", () => {
+    expect(wasEventSeen("Ev0003")).toBe(false);
+    expect(wasEventSeen("Ev0004")).toBe(false);
+    expect(wasEventSeen("Ev0003")).toBe(true);
+    expect(wasEventSeen("Ev0004")).toBe(true);
+  });
+
+  test("undefined / null / empty returns false (no-op)", () => {
+    expect(wasEventSeen(undefined)).toBe(false);
+    expect(wasEventSeen(null)).toBe(false);
+    expect(wasEventSeen("")).toBe(false);
+    // Calling again still returns false — empty/null is never inserted.
+    expect(wasEventSeen(undefined)).toBe(false);
+    expect(wasEventSeen(null)).toBe(false);
+    expect(wasEventSeen("")).toBe(false);
+  });
+
+  test("repeated retry deliveries within TTL all return true after first", () => {
+    expect(wasEventSeen("Ev_retry")).toBe(false);
+    // Slack typically retries 3 times within ~60s
+    expect(wasEventSeen("Ev_retry")).toBe(true);
+    expect(wasEventSeen("Ev_retry")).toBe(true);
+    expect(wasEventSeen("Ev_retry")).toBe(true);
+  });
+});
+
+describe("isolated test cache (TTL behavior)", () => {
+  test("entry expires after TTL elapses", () => {
+    const cache = _createTestCache(1000); // 1s TTL
+    try {
+      expect(cache.wasEventSeen("Ev_ttl")).toBe(false);
+      expect(cache.wasEventSeen("Ev_ttl")).toBe(true);
+
+      cache.advance(500);
+      expect(cache.wasEventSeen("Ev_ttl")).toBe(true); // still within TTL
+
+      cache.advance(600); // total 1100ms — past TTL
+      expect(cache.wasEventSeen("Ev_ttl")).toBe(false); // expired, treated as fresh
+      expect(cache.wasEventSeen("Ev_ttl")).toBe(true); // re-inserted
+    } finally {
+      cache.destroy();
+    }
+  });
+
+  test("size() reflects active entries after cleanup", () => {
+    const cache = _createTestCache(1000);
+    try {
+      cache.wasEventSeen("a");
+      cache.wasEventSeen("b");
+      cache.wasEventSeen("c");
+      expect(cache.size()).toBe(3);
+
+      cache.advance(2000); // expire all
+      expect(cache.size()).toBe(0);
+    } finally {
+      cache.destroy();
+    }
+  });
+
+  test("zero-length keys still no-op in isolated cache", () => {
+    const cache = _createTestCache(1000);
+    try {
+      expect(cache.wasEventSeen("")).toBe(false);
+      expect(cache.wasEventSeen(null)).toBe(false);
+      expect(cache.wasEventSeen(undefined)).toBe(false);
+      expect(cache.size()).toBe(0);
+    } finally {
+      cache.destroy();
+    }
+  });
+
+  test("custom TTL is honored independently per cache", () => {
+    const short = _createTestCache(100);
+    const long = _createTestCache(10_000);
+    try {
+      short.wasEventSeen("x");
+      long.wasEventSeen("x");
+
+      short.advance(200);
+      long.advance(200);
+      expect(short.wasEventSeen("x")).toBe(false); // expired
+      expect(long.wasEventSeen("x")).toBe(true); // still alive
+    } finally {
+      short.destroy();
+      long.destroy();
+    }
+  });
+
+  test("simulated double-delivery races: second event returns hit even from concurrent code paths", () => {
+    // Simulates: handler A and handler B both fire on the same event_id.
+    // The first wins, the second drops.
+    const cache = _createTestCache(60_000);
+    try {
+      const eventId = "EvABCDEF";
+      const aSawIt = cache.wasEventSeen(eventId);
+      const bSawIt = cache.wasEventSeen(eventId);
+      expect(aSawIt).toBe(false);
+      expect(bSawIt).toBe(true);
+    } finally {
+      cache.destroy();
+    }
+  });
+});

package/src/slack/event-dedup.ts

@@ -0,0 +1,141 @@
+/**
+ * Slack event idempotency cache.
+ *
+ * Slack's Events API (and Socket Mode delivery) retries event deliveries on
+ * 3-second timeouts or 5xx responses. A slow handler — e.g. one that fetches
+ * thread context before calling `createTaskExtended` — therefore produces N
+ * duplicate task rows from a single user message.
+ *
+ * The canonical idempotency key for Slack deliveries is `event_id` on the
+ * envelope (`body.event_id` in Bolt). It is unique per delivery; retries of
+ * the same logical event reuse the same id.
+ *
+ * This module exposes a single in-memory check-and-insert that returns `false`
+ * the first time we see an event_id (caller should proceed) and `true` on
+ * subsequent retries within the TTL window — i.e. it answers "was this event
+ * already seen?" (default TTL 5 min). Slack's max retry window is 1h with 3
+ * retries, but the second retry typically lands within 60s, so 5 min is a
+ * safe-but-tight bound.
+ *
+ * Single-pod-only. The API server (which owns the Slack socket) runs as a
+ * single PM2 process; if that ever changes, swap this for a DB-backed table.
+ */
+
+const DEFAULT_TTL_MS = 300_000; // 5 minutes
+const CLEANUP_INTERVAL_MS = 60_000; // 1 minute
+
+interface DedupCache {
+  ttlMs: number;
+  entries: Map<string, number>;
+  cleanupTimer: ReturnType<typeof setInterval> | null;
+}
+
+function createCache(ttlMs: number): DedupCache {
+  return {
+    ttlMs,
+    entries: new Map(),
+    cleanupTimer: null,
+  };
+}
+
+const defaultCache: DedupCache = createCache(DEFAULT_TTL_MS);
+
+function cleanup(cache: DedupCache, now: number): void {
+  for (const [key, expiresAt] of cache.entries) {
+    if (expiresAt <= now) {
+      cache.entries.delete(key);
+    }
+  }
+}
+
+function ensureCleanupTimer(cache: DedupCache): void {
+  if (cache.cleanupTimer) return;
+  cache.cleanupTimer = setInterval(() => {
+    cleanup(cache, Date.now());
+  }, CLEANUP_INTERVAL_MS);
+  // Don't keep the event loop alive on this timer.
+  if (
+    typeof cache.cleanupTimer === "object" &&
+    cache.cleanupTimer &&
+    "unref" in cache.cleanupTimer
+  ) {
+    (cache.cleanupTimer as { unref: () => void }).unref();
+  }
+}
+
+/**
+ * Internal check-and-insert. Returns `true` if the event was already seen
+ * (caller should drop), `false` if this is the first sighting (caller should
+ * proceed). Inserts on a miss so subsequent calls dedup.
+ */
+function checkAndInsert(cache: DedupCache, eventId: string, now: number): boolean {
+  ensureCleanupTimer(cache);
+
+  const existing = cache.entries.get(eventId);
+  if (existing !== undefined && existing > now) {
+    return true; // hit — within TTL
+  }
+
+  cache.entries.set(eventId, now + cache.ttlMs);
+  return false;
+}
+
+/**
+ * Has this Slack event_id been seen recently? Returns `true` if it's a retry
+ * we should drop, `false` on the first delivery (and inserts so subsequent
+ * calls return true).
+ *
+ * Pass `null`/`undefined`/empty as a no-op (returns `false`) — defensive against
+ * malformed envelopes; we'd rather process once than block legitimate work.
+ */
+export function wasEventSeen(eventId: string | undefined | null): boolean {
+  if (!eventId) return false;
+  return checkAndInsert(defaultCache, eventId, Date.now());
+}
+
+/**
+ * Test-only helper: build an isolated cache so tests don't leak state into
+ * each other or into production.
+ */
+export function _createTestCache(ttlMs: number = DEFAULT_TTL_MS): {
+  wasEventSeen: (eventId: string | undefined | null) => boolean;
+  size: () => number;
+  advance: (ms: number) => void;
+  destroy: () => void;
+} {
+  const cache = createCache(ttlMs);
+  let nowOffset = 0;
+  const now = () => Date.now() + nowOffset;
+
+  return {
+    wasEventSeen: (eventId) => {
+      if (!eventId) return false;
+      return checkAndInsert(cache, eventId, now());
+    },
+    size: () => {
+      cleanup(cache, now());
+      return cache.entries.size;
+    },
+    advance: (ms) => {
+      nowOffset += ms;
+    },
+    destroy: () => {
+      if (cache.cleanupTimer) {
+        clearInterval(cache.cleanupTimer);
+        cache.cleanupTimer = null;
+      }
+      cache.entries.clear();
+    },
+  };
+}
+
+/**
+ * Test-only helper to reset the production cache. Do not call from app code.
+ */
+export function _resetForTests(): void {
+  defaultCache.entries.clear();
+  if (defaultCache.cleanupTimer) {
+    clearInterval(defaultCache.cleanupTimer);
+    defaultCache.cleanupTimer = null;
+  }
+}

package/src/slack/handlers.ts

@@ -14,6 +14,7 @@ import { slackContextKey } from "../tasks/context-key";
 import { createTaskWithSiblingAwareness } from "../tasks/sibling-awareness";
 import { workflowEventBus } from "../workflows/event-bus";
 import { buildTreeBlocks, type TreeNode } from "./blocks";
+import { wasEventSeen } from "./event-dedup";
 import type { SlackFile } from "./files";
 import { extractTaskFromMessage, hasOtherUserMention, routeMessage } from "./router";
 // Side-effect import: registers all Slack event templates in the in-memory registry
@@ -341,7 +342,15 @@ function checkRateLimit(userId: string): boolean {
 
 export function registerMessageHandler(app: App): void {
   // Handle all message events
-  app.event("message", async ({ event, client, say }) => {
+  app.event("message", async ({ event, body, client, say }) => {
+    // Slack retries deliveries on 3s timeout / 5xx. Drop the duplicates
+    // before any task-creation work runs (DES-293).
+    const eventId = body?.event_id;
+    if (wasEventSeen(eventId)) {
+      console.log(`[Slack] dropping Slack retry: event_id=${eventId}`);
+      return;
+    }
+
     const msg = event as MessageEvent;
 
     // Ignore message_changed events

package/src/tests/task-completion-idempotency.test.ts

@@ -0,0 +1,320 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { unlinkSync } from "node:fs";
+import {
+  cancelTask,
+  closeDb,
+  completeTask,
+  createAgent,
+  createTaskExtended,
+  failTask,
+  getDb,
+  getLogsByTaskId,
+  getTaskById,
+  initDb,
+  startTask,
+} from "../be/db";
+
+const TEST_DB_PATH = "./test-task-completion-idempotency.sqlite";
+
+beforeAll(() => {
+  initDb(TEST_DB_PATH);
+});
+
+afterAll(() => {
+  closeDb();
+  try {
+    unlinkSync(TEST_DB_PATH);
+    unlinkSync(`${TEST_DB_PATH}-wal`);
+    unlinkSync(`${TEST_DB_PATH}-shm`);
+  } catch {
+    // ignore
+  }
+});
+
+describe("completeTask idempotency", () => {
+  test("first call wins; second call on already-completed task returns null", () => {
+    const agent = createAgent({
+      name: "idempotency-worker-1",
+      isLead: false,
+      status: "idle",
+      capabilities: [],
+    });
+
+    const task = createTaskExtended("Task A", { agentId: agent.id });
+    startTask(task.id, agent.id);
+
+    const first = completeTask(task.id, "first output");
+    expect(first).not.toBeNull();
+    expect(first!.status).toBe("completed");
+    expect(first!.output).toBe("first output");
+    const firstFinishedAt = first!.finishedAt;
+    expect(firstFinishedAt).toBeTruthy();
+
+    // Second call should be a no-op and return null
+    const second = completeTask(task.id, "second output");
+    expect(second).toBeNull();
+
+    // First-call-wins: original output and finishedAt preserved
+    const fresh = getTaskById(task.id);
+    expect(fresh!.status).toBe("completed");
+    expect(fresh!.output).toBe("first output");
+    expect(fresh!.finishedAt).toBe(firstFinishedAt);
+  });
+
+  test("does not re-emit task_status_change log on duplicate completion", () => {
+    const agent = createAgent({
+      name: "idempotency-worker-2",
+      isLead: false,
+      status: "idle",
+      capabilities: [],
+    });
+
+    const task = createTaskExtended("Task B", { agentId: agent.id });
+    startTask(task.id, agent.id);
+
+    completeTask(task.id, "done");
+    const logsAfterFirst = getLogsByTaskId(task.id);
+    const completedLogsAfterFirst = logsAfterFirst.filter(
+      (l) => l.eventType === "task_status_change" && l.newValue === "completed",
+    );
+    expect(completedLogsAfterFirst.length).toBe(1);
+
+    // Second completion should not log another status-change row
+    completeTask(task.id, "done again");
+    const logsAfterSecond = getLogsByTaskId(task.id);
+    const completedLogsAfterSecond = logsAfterSecond.filter(
+      (l) => l.eventType === "task_status_change" && l.newValue === "completed",
+    );
+    expect(completedLogsAfterSecond.length).toBe(1);
+  });
+
+  test("returns null when called on a failed task (cross-terminal)", () => {
+    const agent = createAgent({
+      name: "idempotency-worker-3",
+      isLead: false,
+      status: "idle",
+      capabilities: [],
+    });
+
+    const task = createTaskExtended("Task C", { agentId: agent.id });
+    startTask(task.id, agent.id);
+    failTask(task.id, "boom");
+
+    const result = completeTask(task.id, "trying to complete a failed task");
+    expect(result).toBeNull();
+
+    // Original failed status preserved
+    const fresh = getTaskById(task.id);
+    expect(fresh!.status).toBe("failed");
+    expect(fresh!.failureReason).toBe("boom");
+  });
+
+  test("returns null when called on a cancelled task", () => {
+    const agent = createAgent({
+      name: "idempotency-worker-4",
+      isLead: false,
+      status: "idle",
+      capabilities: [],
+    });
+
+    const task = createTaskExtended("Task D", { agentId: agent.id });
+    startTask(task.id, agent.id);
+    cancelTask(task.id, "user cancelled");
+
+    const result = completeTask(task.id, "trying to complete a cancelled task");
+    expect(result).toBeNull();
+
+    const fresh = getTaskById(task.id);
+    expect(fresh!.status).toBe("cancelled");
+  });
+
+  test("returns null for non-existent task", () => {
+    const result = completeTask("00000000-0000-0000-0000-000000000000", "x");
+    expect(result).toBeNull();
+  });
+});
+
+describe("failTask idempotency", () => {
+  test("first call wins; second call on already-failed task returns null", () => {
+    const agent = createAgent({
+      name: "fail-idempotency-1",
+      isLead: false,
+      status: "idle",
+      capabilities: [],
+    });
+
+    const task = createTaskExtended("Fail Task A", { agentId: agent.id });
+    startTask(task.id, agent.id);
+
+    const first = failTask(task.id, "original reason");
+    expect(first).not.toBeNull();
+    expect(first!.status).toBe("failed");
+    expect(first!.failureReason).toBe("original reason");
+    const firstFinishedAt = first!.finishedAt;
+    expect(firstFinishedAt).toBeTruthy();
+
+    const second = failTask(task.id, "second reason");
+    expect(second).toBeNull();
+
+    const fresh = getTaskById(task.id);
+    expect(fresh!.status).toBe("failed");
+    expect(fresh!.failureReason).toBe("original reason");
+    expect(fresh!.finishedAt).toBe(firstFinishedAt);
+  });
+
+  test("does not re-emit task_status_change log on duplicate failure", () => {
+    const agent = createAgent({
+      name: "fail-idempotency-2",
+      isLead: false,
+      status: "idle",
+      capabilities: [],
+    });
+
+    const task = createTaskExtended("Fail Task B", { agentId: agent.id });
+    startTask(task.id, agent.id);
+
+    failTask(task.id, "boom");
+    const logsAfterFirst = getLogsByTaskId(task.id);
+    const failedLogsAfterFirst = logsAfterFirst.filter(
+      (l) => l.eventType === "task_status_change" && l.newValue === "failed",
+    );
+    expect(failedLogsAfterFirst.length).toBe(1);
+
+    failTask(task.id, "boom again");
+    const logsAfterSecond = getLogsByTaskId(task.id);
+    const failedLogsAfterSecond = logsAfterSecond.filter(
+      (l) => l.eventType === "task_status_change" && l.newValue === "failed",
+    );
+    expect(failedLogsAfterSecond.length).toBe(1);
+  });
+
+  test("returns null when called on a completed task", () => {
+    const agent = createAgent({
+      name: "fail-idempotency-3",
+      isLead: false,
+      status: "idle",
+      capabilities: [],
+    });
+
+    const task = createTaskExtended("Fail Task C", { agentId: agent.id });
+    startTask(task.id, agent.id);
+    completeTask(task.id, "all good");
+
+    const result = failTask(task.id, "now fail it");
+    expect(result).toBeNull();
+
+    const fresh = getTaskById(task.id);
+    expect(fresh!.status).toBe("completed");
+    expect(fresh!.output).toBe("all good");
+  });
+
+  test("returns null when called on a cancelled task", () => {
+    const agent = createAgent({
+      name: "fail-idempotency-4",
+      isLead: false,
+      status: "idle",
+      capabilities: [],
+    });
+
+    const task = createTaskExtended("Fail Task D", { agentId: agent.id });
+    startTask(task.id, agent.id);
+    cancelTask(task.id, "user cancelled");
+
+    const result = failTask(task.id, "now fail it");
+    expect(result).toBeNull();
+
+    const fresh = getTaskById(task.id);
+    expect(fresh!.status).toBe("cancelled");
+  });
+
+  test("returns null for non-existent task", () => {
+    const result = failTask("00000000-0000-0000-0000-000000000000", "x");
+    expect(result).toBeNull();
+  });
+});
+
+describe("store-progress idempotency on terminal status (integration via DB layer)", () => {
+  // The store-progress MCP tool short-circuits on terminal status before any
+  // side-effects (event emission, memory write, follow-up task, BU ensure).
+  // The implementation reuses the same DB-layer guards (completeTask/failTask
+  // returning null on terminal state), so these tests verify the underlying
+  // contract that store-progress relies on.
+
+  test("completing an already-completed task is a no-op at the DB layer", () => {
+    const agent = createAgent({
+      name: "sp-idempotency-1",
+      isLead: false,
+      status: "idle",
+      capabilities: [],
+    });
+
+    const task = createTaskExtended("SP Task A", { agentId: agent.id });
+    startTask(task.id, agent.id);
+    completeTask(task.id, "first output");
+
+    // Snapshot the row state
+    const snapshot = getTaskById(task.id);
+    const snapshotLogs = getLogsByTaskId(task.id).length;
+
+    // Simulate store-progress(status="completed") on a terminal task.
+    // The store-progress tool's short-circuit returns wasNoOp=true and
+    // skips completeTask entirely. Even if we were to call completeTask
+    // directly (defense in depth), the row stays unchanged.
+    const result = completeTask(task.id, "second output");
+    expect(result).toBeNull();
+
+    const after = getTaskById(task.id);
+    expect(after!.output).toBe(snapshot!.output);
+    expect(after!.finishedAt).toBe(snapshot!.finishedAt);
+    expect(after!.status).toBe(snapshot!.status);
+    expect(getLogsByTaskId(task.id).length).toBe(snapshotLogs);
+  });
+
+  test("failing an already-failed task is a no-op at the DB layer", () => {
+    const agent = createAgent({
+      name: "sp-idempotency-2",
+      isLead: false,
+      status: "idle",
+      capabilities: [],
+    });
+
+    const task = createTaskExtended("SP Task B", { agentId: agent.id });
+    startTask(task.id, agent.id);
+    failTask(task.id, "first reason");
+
+    const snapshot = getTaskById(task.id);
+    const snapshotLogs = getLogsByTaskId(task.id).length;
+
+    const result = failTask(task.id, "second reason");
+    expect(result).toBeNull();
+
+    const after = getTaskById(task.id);
+    expect(after!.failureReason).toBe(snapshot!.failureReason);
+    expect(after!.finishedAt).toBe(snapshot!.finishedAt);
+    expect(after!.status).toBe(snapshot!.status);
+    expect(getLogsByTaskId(task.id).length).toBe(snapshotLogs);
+  });
+
+  test("completing a task manually marked terminal returns null", () => {
+    // Belt-and-suspenders: even if the row was written outside the normal
+    // code path (e.g. direct UPDATE), the guard catches it.
+    const agent = createAgent({
+      name: "sp-idempotency-3",
+      isLead: false,
+      status: "idle",
+      capabilities: [],
+    });
+
+    const task = createTaskExtended("SP Task C", { agentId: agent.id });
+    getDb().run(
+      "UPDATE agent_tasks SET status = 'completed', output = 'manually written', finishedAt = ? WHERE id = ?",
+      [new Date().toISOString(), task.id],
+    );
+
+    const result = completeTask(task.id, "tried to overwrite");
+    expect(result).toBeNull();
+
+    const after = getTaskById(task.id);
+    expect(after!.output).toBe("manually written");
+  });
+});

package/src/tests/task-search-filter.test.ts

@@ -0,0 +1,57 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { unlink } from "node:fs/promises";
+import { closeDb, createAgent, createTask, getAllTasks, getTasksCount, initDb } from "../be/db";
+
+const TEST_DB_PATH = "./test-task-search-filter.sqlite";
+
+describe("getAllTasks search filter", () => {
+  beforeAll(async () => {
+    for (const suffix of ["", "-wal", "-shm"]) {
+      try {
+        await unlink(`${TEST_DB_PATH}${suffix}`);
+      } catch {}
+    }
+    initDb(TEST_DB_PATH);
+  });
+
+  afterAll(async () => {
+    closeDb();
+    for (const suffix of ["", "-wal", "-shm"]) {
+      try {
+        await unlink(`${TEST_DB_PATH}${suffix}`);
+      } catch {}
+    }
+  });
+
+  test("matches by id prefix and substring, plus description", () => {
+    const agent = createAgent({
+      id: "search-filter-agent",
+      name: "Search Filter Agent",
+      isLead: false,
+      status: "idle",
+    });
+
+    const taskA = createTask(agent.id, "implement partial id search");
+    const taskB = createTask(agent.id, "fix navbar styling");
+
+    // Description-search still works
+    const byDescription = getAllTasks({ search: "partial id" });
+    expect(byDescription.map((t) => t.id)).toContain(taskA.id);
+    expect(byDescription.map((t) => t.id)).not.toContain(taskB.id);
+
+    // First 8 chars of UUID match the task with that ID
+    const idPrefix = taskA.id.slice(0, 8);
+    const byPrefix = getAllTasks({ search: idPrefix });
+    expect(byPrefix.map((t) => t.id)).toContain(taskA.id);
+    expect(byPrefix.map((t) => t.id)).not.toContain(taskB.id);
+
+    // Arbitrary substring of UUID also matches
+    const idMid = taskB.id.slice(9, 17);
+    const byMid = getAllTasks({ search: idMid });
+    expect(byMid.map((t) => t.id)).toContain(taskB.id);
+    expect(byMid.map((t) => t.id)).not.toContain(taskA.id);
+
+    // Count query honors the same filter
+    expect(getTasksCount({ search: idPrefix })).toBe(1);
+  });
+});

package/src/tools/store-progress.ts

@@ -64,6 +64,12 @@ export const registerStoreProgressTool = (server: McpServer) => {
         success: z.boolean(),
         message: z.string(),
         task: AgentTaskSchema.optional(),
+        wasNoOp: z
+          .boolean()
+          .optional()
+          .describe(
+            "True when the call was a no-op because the task was already in a terminal state (completed/failed/cancelled). First-call-wins.",
+          ),
       }),
     },
     async ({ taskId, progress, status, output, failureReason, costData }, requestInfo, _meta) => {
@@ -105,6 +111,22 @@ export const registerStoreProgressTool = (server: McpServer) => {
         let updatedTask = existingTask;
         const isTerminal = ["completed", "failed", "cancelled"].includes(existingTask.status);
 
+        // Idempotency guard: short-circuit terminal-status writes (completed/failed)
+        // BEFORE any side-effects fire (event emission, memory write, follow-up task,
+        // business-use ensure). Without this, a multi-session race causes duplicate
+        // follow-up tasks to lead, vector index pollution, and spurious BU events.
+        // First-call-wins: existing output / finishedAt are preserved.
+        if (status && isTerminal) {
+          return {
+            success: true,
+            message:
+              `Task "${taskId}" is already ${existingTask.status}; treating as no-op. ` +
+              `Existing output preserved (first-call-wins).`,
+            task: existingTask,
+            wasNoOp: true,
+          };
+        }
+
         // Update progress if provided (with deduplication)
         // Skip for tasks already in a terminal state to prevent zombie revival
         if (progress && !isTerminal) {
@@ -244,8 +266,15 @@ export const registerStoreProgressTool = (server: McpServer) => {
 
       const result = txn();
 
-      // Index completed and failed tasks as memory (async, non-blocking)
-      if ((status === "completed" || status === "failed") && result.success && result.task) {
+      // Index completed and failed tasks as memory (async, non-blocking).
+      // Skip on no-op (idempotent re-call on terminal task) to avoid duplicate
+      // memory entries / vector index pollution.
+      if (
+        (status === "completed" || status === "failed") &&
+        result.success &&
+        result.task &&
+        !("wasNoOp" in result && result.wasNoOp)
+      ) {
         (async () => {
           try {
             const taskContent =
@@ -306,7 +335,14 @@ export const registerStoreProgressTool = (server: McpServer) => {
       // Create follow-up task for the lead when a worker task finishes.
       // This replaces the old poll-based tasks_finished trigger which was unreliable.
       // Skip for workflow-managed tasks — the workflow engine handles sequencing via resume.ts.
-      if (status && result.success && result.task && !result.task.workflowRunId) {
+      // Skip on no-op (idempotent re-call on terminal task) to avoid duplicate follow-ups.
+      if (
+        status &&
+        result.success &&
+        result.task &&
+        !result.task.workflowRunId &&
+        !("wasNoOp" in result && result.wasNoOp)
+      ) {
         try {
           const taskAgent = getAgentById(result.task.agentId ?? "");
           // Only create follow-ups for worker tasks (not lead's own tasks)