@desplega.ai/agent-swarm 2.7.0 → 2.7.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@desplega.ai/agent-swarm",
-  "version": "2.7.0",
+  "version": "2.7.1",
   "description": "agent-swarm.dev — an open-source operating system for AI work: a lead agent breaks goals into tasks, routes them to specialized workers such as Claude Code or Codex, runs each worker in an isolated container, and preserves shared memory, tools, schedules, and review gates so delegated work compounds across sessions.",
   "keywords": [
     "agent-swarm.dev",
@@ -203,7 +203,7 @@
   "dependencies": {
     "@agentclientprotocol/sdk": "2.0.2",
     "@ai-sdk/openai": "^3.0.41",
-    "@anthropic-ai/claude-agent-sdk": "0.3.310",
+    "@anthropic-ai/claude-agent-sdk": "0.3.311",
     "@anthropic-ai/sdk": "^1.3.0",
     "@asteasolutions/zod-to-openapi": "^8.0.0",
     "@aws-sdk/client-bedrock": "3.1048.0",
@@ -211,7 +211,7 @@
     "@chat-adapter/slack": "4.41.1",
     "@chat-adapter/teams": "4.41.1",
     "@chat-adapter/telegram": "4.41.1",
-    "@cursor/sdk": "1.0.40",
+    "@cursor/sdk": "1.1.0",
     "@desplega.ai/agent-fs-just-bash": "0.18.9",
     "@desplega.ai/business-use": "^0.4.2",
     "@earendil-works/pi-agent-core": "^1.4.0",

package/src/be/connector-codes.ts

@@ -1,21 +1,34 @@
 /**
- * Single-use connect codes for the agent-swarm.dev ChatGPT connector.
+ * Single-use codes that a browser or connector trades once for an `aswt_` token.
  *
- * The dashboard asks for a code (`POST /api/users/:id/connector-codes`) and
- * opens the connector's connect page with it. The connector trades the code
- * once (`POST /api/connector/exchange`) for a user-bound `aswt_` token. The
- * token is minted only at exchange time, through the regular `mintToken`
- * path, so an unused code never leaves a token behind.
+ * Two kinds share the `connector_codes` table:
+ *
+ * - `connector`: the agent-swarm.dev ChatGPT connector. The dashboard asks for
+ *   a code (`POST /api/users/:id/connector-codes`) and opens the connector's
+ *   connect page with it. The connector trades the code once
+ *   (`POST /api/connector/exchange`).
+ * - `invite`: a teammate invite (`POST /api/invites`). The teammate's browser
+ *   trades it once (`POST /api/invites/exchange`). The exchange also flips the
+ *   user from `invited` to `active`, because `aswt_` auth admits only active
+ *   users.
+ *
+ * The token is minted only at exchange time, through the regular `mintToken`
+ * path, so an unused code never leaves a token behind. Each exchange redeems
+ * only its own kind.
  */
 
 import { createHash, randomBytes } from "node:crypto";
 import { getDbClient } from "./db";
-import { type IdentityActor, mintToken } from "./users";
+import { type IdentityActor, mintToken, recordIdentityEvent } from "./users";
+
+export type ConnectorCodeKind = "connector" | "invite";
 
 export const CONNECTOR_CODE_TTL_MS = 10 * 60 * 1000;
+export const INVITE_CODE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 /** Expired rows stay this long before the heartbeat sweep deletes them. */
 const CONNECTOR_CODE_RETENTION_MS = 60 * 60 * 1000;
 export const DEFAULT_CONNECTOR_CODE_LABEL = "ChatGPT connector";
+export const DEFAULT_INVITE_CODE_LABEL = "Dashboard invite";
 
 function sha256Hex(input: string): string {
   return createHash("sha256").update(input).digest("hex");
@@ -27,27 +40,34 @@ export async function createConnectorCode(
   label: string,
   actor: IdentityActor,
   now = new Date(),
+  opts: { kind?: ConnectorCodeKind; ttlMs?: number } = {},
 ): Promise<{ code: string; expiresAt: string }> {
+  const kind = opts.kind ?? "connector";
+  const ttlMs = opts.ttlMs ?? CONNECTOR_CODE_TTL_MS;
   const code = randomBytes(32).toString("base64url");
-  const expiresAt = new Date(now.getTime() + CONNECTOR_CODE_TTL_MS).toISOString();
+  const expiresAt = new Date(now.getTime() + ttlMs).toISOString();
   await getDbClient().run(
     `INSERT INTO connector_codes
-       (code_hash, user_id, label, actor_kind, actor_id, created_at, expires_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?)`,
-    [sha256Hex(code), userId, label, actor.kind, actor.id, now.toISOString(), expiresAt],
+       (code_hash, user_id, label, actor_kind, actor_id, created_at, expires_at, kind)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+    [sha256Hex(code), userId, label, actor.kind, actor.id, now.toISOString(), expiresAt, kind],
   );
   return { code, expiresAt };
 }
 
 /**
  * Consume a code and mint its token in one transaction. Returns null when the
- * code is unknown, expired, or already used (callers must not tell these apart).
+ * code is unknown, expired, already used, or of another kind (callers must not
+ * tell these apart). For an invite code, also returns null when the user is
+ * no longer `invited` (suspended or merged since): the code is spent and no
+ * token is minted.
  */
 export async function exchangeConnectorCode(
   code: string,
-  now = new Date(),
+  opts: { kind?: ConnectorCodeKind; now?: Date } = {},
 ): Promise<{ token: string; userId: string } | null> {
-  const nowIso = now.toISOString();
+  const kind = opts.kind ?? "connector";
+  const nowIso = (opts.now ?? new Date()).toISOString();
   return getDbClient().transaction(async (tx) => {
     const row = await tx.get<{
       user_id: string;
@@ -56,21 +76,44 @@ export async function exchangeConnectorCode(
       actor_id: string;
     }>(
       `UPDATE connector_codes SET used_at = ?
-        WHERE code_hash = ? AND used_at IS NULL AND expires_at > ?
+        WHERE code_hash = ? AND used_at IS NULL AND expires_at > ? AND kind = ?
         RETURNING user_id, label, actor_kind, actor_id`,
-      [nowIso, sha256Hex(code), nowIso],
+      [nowIso, sha256Hex(code), nowIso, kind],
     );
     if (!row) return null;
-    const { plaintext } = await mintToken(
-      row.user_id,
-      row.label,
-      { kind: row.actor_kind, id: row.actor_id },
-      { source: "connector_exchange" },
-    );
+    const actor: IdentityActor = { kind: row.actor_kind, id: row.actor_id };
+
+    if (kind === "invite") {
+      const activated = await tx.run(
+        "UPDATE users SET status = 'active', lastUpdatedAt = ? WHERE id = ? AND status = 'invited'",
+        [nowIso, row.user_id],
+      );
+      if (activated.changes === 0) return null;
+      await recordIdentityEvent(
+        row.user_id,
+        "status_changed",
+        actor,
+        { status: "invited" },
+        { status: "active", source: "invite_exchange" },
+      );
+    }
+
+    const { plaintext } = await mintToken(row.user_id, row.label, actor, {
+      source: kind === "invite" ? "invite_exchange" : "connector_exchange",
+    });
     return { token: plaintext, userId: row.user_id };
   });
 }
 
+/** Delete a user's unused invite codes, so a re-invite leaves one live link. */
+export async function deleteUnusedInviteCodes(userId: string): Promise<number> {
+  const result = await getDbClient().run(
+    "DELETE FROM connector_codes WHERE user_id = ? AND kind = 'invite' AND used_at IS NULL",
+    [userId],
+  );
+  return result.changes;
+}
+
 /** Delete codes that expired more than 1h ago. Returns the number of deleted rows. */
 export async function deleteExpiredConnectorCodes(now = new Date()): Promise<number> {
   const cutoff = new Date(now.getTime() - CONNECTOR_CODE_RETENTION_MS).toISOString();

package/src/be/memory/boot-reembed.ts

@@ -56,7 +56,10 @@ export async function runBootReembed(): Promise<void> {
   for (let i = 0; i < rows.length; i += BATCH_SIZE) {
     const batch = rows.slice(i, i + BATCH_SIZE);
     try {
-      const embeddings = await provider.embedBatch(batch.map((m) => m.content));
+      const embeddings = await provider.embedBatch(
+        batch.map((m) => m.content),
+        { kind: "document" },
+      );
       for (let j = 0; j < embeddings.length; j++) {
         if (embeddings[j]) {
           await store.updateEmbedding(batch[j]!.id, embeddings[j]!, provider.name);

package/src/be/memory/constants.ts

@@ -72,6 +72,12 @@ export function minSimilarity(): number {
   return numEnv("MEMORY_MIN_SIMILARITY", 0.1);
 }
 
+// Raw cosine at or above which a store-progress learning is a near duplicate of
+// an existing swarm memory and is not stored. Measured on production
+// `/learnings` rows: a confirmed twin pair scored 0.877, the closest distinct
+// pair 0.705.
+export const LEARNING_DUPLICATE_MIN_SIMILARITY = 0.8;
+
 // Reranking parameters
 export function accessBoostMaxMultiplier(): number {
   return numEnv("MEMORY_ACCESS_BOOST_MAX", 1.5);

package/src/be/memory/embedding-recovery.ts

@@ -0,0 +1,48 @@
+/**
+ * A memory or script written while the embeddings endpoint is down keeps no
+ * vector, and the backfills (`runBootReembed`, `runBootReembedScripts`) run
+ * only at boot or when a config reload turns embeddings on. When an embedding
+ * call works again after a failed one (for example, a local TEI restarted),
+ * run both backfills once more, so those rows do not wait for the next API
+ * restart.
+ */
+
+let failedSinceBackfill = false;
+let backfill: Promise<void> | null = null;
+
+/** An embedding call failed (network, server error, rejected request). */
+export function noteEmbeddingFailure(): void {
+  failedSinceBackfill = true;
+}
+
+/** An embedding call returned a vector. Starts the backfill after a failure. */
+export function noteEmbeddingSuccess(): void {
+  if (!failedSinceBackfill || backfill) return;
+  failedSinceBackfill = false;
+  const report = (what: string) => (err: unknown) => {
+    console.error(
+      `[memory] ${what} backfill after embeddings recovered failed:`,
+      (err as Error).message,
+    );
+  };
+  backfill = Promise.all([
+    import("./boot-reembed").then(({ runBootReembed }) => runBootReembed()).catch(report("Memory")),
+    import("../scripts/boot-reembed")
+      .then(({ runBootReembedScripts }) => runBootReembedScripts())
+      .catch(report("Script")),
+  ])
+    .then(() => undefined)
+    .finally(() => {
+      backfill = null;
+    });
+}
+
+/** The backfill started by the last recovery, if it still runs. For tests. */
+export function pendingRecoveryBackfill(): Promise<void> | null {
+  return backfill;
+}
+
+/** Forget a failure seen by an earlier test. */
+export function resetEmbeddingRecoveryForTests(): void {
+  failedSinceBackfill = false;
+}

package/src/be/memory/index-content.ts

@@ -104,7 +104,7 @@ export async function indexMemoryContent(
         intent: "re-index memory source path",
         changedByAgentId: agentId,
       });
-      const embedding = await provider.embed(result.memory.content);
+      const embedding = await provider.embed(result.memory.content, { kind: "document" });
       if (embedding) await store.updateEmbedding(result.memory.id, embedding, provider.name);
       try {
         // Re-index of an existing memory: prune stale content-derived links.
@@ -162,7 +162,10 @@ export async function indexMemoryContent(
   // Async batch embed (fire and forget)
   (async () => {
     try {
-      const embeddings = await provider.embedBatch(memories.map((m) => m.content));
+      const embeddings = await provider.embedBatch(
+        memories.map((m) => m.content),
+        { kind: "document" },
+      );
       for (let i = 0; i < embeddings.length; i++) {
         if (embeddings[i]) {
           await store.updateEmbedding(memories[i]!.id, embeddings[i]!, provider.name);

package/src/be/memory/providers/openai-embedding.ts

@@ -2,7 +2,8 @@ import OpenAI from "openai";
 import { selectCredential } from "../../../utils/credentials";
 import { getOpenRouterAttributionHeaders } from "../../../utils/openrouter-base-url";
 import { DEFAULT_EMBEDDING_MODEL, EMBEDDING_DIMENSIONS } from "../constants";
-import type { EmbeddingProvider } from "../types";
+import { noteEmbeddingFailure, noteEmbeddingSuccess } from "../embedding-recovery";
+import type { EmbeddingInputKind, EmbeddingProvider, EmbedOptions } from "../types";
 
 // text-embedding-3-* reject any input over 8,192 tokens with a 400, and one
 // such input fails every input in its request. There is no tokenizer here, and
@@ -18,13 +19,19 @@ interface OpenAIEmbeddingConfig {
   apiKey?: string;
   model?: string;
   dimensions?: number;
+  queryPrefix?: string;
+  documentPrefix?: string;
 }
 
-function cleanInput(text: string): string {
-  return text
-    .replace(/[\n\r]/g, " ")
-    .trim()
-    .slice(0, MAX_EMBEDDING_INPUT_CHARS);
+/**
+ * Flatten and trim the input, then prepend the task prefix. The cleaned text
+ * is cut so that prefix plus text stays within MAX_EMBEDDING_INPUT_CHARS. An
+ * empty input stays empty, so it is skipped and never embeds a bare prefix.
+ */
+function cleanInput(text: string, prefix = ""): string {
+  const cleaned = text.replace(/[\n\r]/g, " ").trim();
+  if (!cleaned) return "";
+  return prefix + cleaned.slice(0, Math.max(0, MAX_EMBEDDING_INPUT_CHARS - prefix.length));
 }
 
 /** A 400 is about the request's inputs, so the other inputs can still embed. */
@@ -32,12 +39,36 @@ function isInputRejection(err: unknown): boolean {
   return err instanceof OpenAI.APIError && err.status === 400;
 }
 
+/**
+ * The server rejected the request for its size, not for an input: a 413, or a
+ * 422 about the batch size (TEI: "batch size 70 > maximum allowed batch size
+ * 32"). One request per input then fits. Any other 422 (TEI also answers 422
+ * for a bad `dimensions` value) stays a plain failure, so it is not repeated
+ * once per input.
+ */
+function isBatchTooLarge(err: unknown): boolean {
+  if (!(err instanceof OpenAI.APIError)) return false;
+  if (err.status === 413) return true;
+  return err.status === 422 && /batch size/i.test(err.message ?? "");
+}
+
 function isInputTooLong(err: unknown): boolean {
   return (
     isInputRejection(err) && /maximum (context|input) length/i.test((err as Error).message ?? "")
   );
 }
 
+/**
+ * The endpoint was down or overloaded (no HTTP response, a 5xx or a 429), so the
+ * same input can embed later. Only these start a backfill once calls work again:
+ * an input the endpoint rejects would fail again on every backfill.
+ */
+function isOutage(err: unknown): boolean {
+  if (!(err instanceof OpenAI.APIError)) return true;
+  const status = err.status;
+  return status === undefined || status === 429 || status >= 500;
+}
+
 export class OpenAIEmbeddingProvider implements EmbeddingProvider {
   readonly name: string;
   readonly dimensions: number;
@@ -45,6 +76,8 @@ export class OpenAIEmbeddingProvider implements EmbeddingProvider {
   private client: OpenAI | null = null;
   private readonly model: string;
   private readonly apiKey: string | undefined;
+  private readonly queryPrefix: string;
+  private readonly documentPrefix: string;
 
   constructor(config?: OpenAIEmbeddingConfig) {
     const apiKey = config?.apiKey ?? process.env.EMBEDDING_API_KEY ?? process.env.OPENAI_API_KEY;
@@ -59,6 +92,17 @@ export class OpenAIEmbeddingProvider implements EmbeddingProvider {
     this.name = config?.model
       ? `openai/${config.model}`
       : (process.env.EMBEDDING_MODEL ?? DEFAULT_EMBEDDING_MODEL);
+
+    // Read once here: a config reload builds a new provider. Used verbatim,
+    // so a trailing space (nomic: "search_query: ") is kept.
+    this.queryPrefix = config?.queryPrefix ?? process.env.EMBEDDING_QUERY_PREFIX ?? "";
+    this.documentPrefix = config?.documentPrefix ?? process.env.EMBEDDING_DOCUMENT_PREFIX ?? "";
+  }
+
+  private prefixFor(kind: EmbeddingInputKind | undefined): string {
+    if (kind === "query") return this.queryPrefix;
+    if (kind === "document") return this.documentPrefix;
+    return "";
   }
 
   isConfigured(): boolean {
@@ -107,7 +151,9 @@ export class OpenAIEmbeddingProvider implements EmbeddingProvider {
     while (true) {
       try {
         const response = await this.request(client, input);
-        return this.toVector(response.data[0]?.embedding, "Embedding");
+        const vector = this.toVector(response.data[0]?.embedding, "Embedding");
+        if (vector) noteEmbeddingSuccess();
+        return vector;
       } catch (err) {
         const message = (err as Error).message;
         if (isInputTooLong(err) && input.length > MIN_EMBEDDING_INPUT_CHARS) {
@@ -119,26 +165,28 @@ export class OpenAIEmbeddingProvider implements EmbeddingProvider {
           continue;
         }
         console.error("[memory] Embedding failed:", message);
+        if (isOutage(err)) noteEmbeddingFailure();
         return null;
       }
     }
   }
 
-  async embed(text: string): Promise<Float32Array | null> {
+  async embed(text: string, opts?: EmbedOptions): Promise<Float32Array | null> {
     const client = this.getClient();
     if (!client) return null;
 
-    const cleaned = cleanInput(text);
+    const cleaned = cleanInput(text, this.prefixFor(opts?.kind));
     if (!cleaned) return null;
     return this.embedOne(client, cleaned);
   }
 
-  async embedBatch(texts: string[]): Promise<(Float32Array | null)[]> {
+  async embedBatch(texts: string[], opts?: EmbedOptions): Promise<(Float32Array | null)[]> {
     const results: (Float32Array | null)[] = texts.map(() => null);
     const client = this.getClient();
     if (!client) return results;
 
-    const cleaned = texts.map(cleanInput);
+    const prefix = this.prefixFor(opts?.kind);
+    const cleaned = texts.map((text) => cleanInput(text, prefix));
     const groups: number[][] = [];
     let group: number[] = [];
     let groupChars = 0;
@@ -166,13 +214,16 @@ export class OpenAIEmbeddingProvider implements EmbeddingProvider {
           if (originalIndex === undefined) continue;
           results[originalIndex] = this.toVector(item.embedding, "Batch embedding");
         }
+        if (indices.some((i) => results[i])) noteEmbeddingSuccess();
       } catch (err) {
-        if (!isInputRejection(err)) {
+        if (!isInputRejection(err) && !isBatchTooLarge(err)) {
           console.error("[memory] Batch embedding failed:", (err as Error).message);
+          if (isOutage(err)) noteEmbeddingFailure();
           continue;
         }
-        // One rejected input fails the whole request: embed each input alone so
-        // only that input is cut down, and the rest embed as they are.
+        // One rejected input fails the whole request, and a server with a low
+        // batch cap rejects the request for its size: embed each input alone so
+        // only a bad input is cut down, and the rest embed as they are.
         console.warn(
           `[memory] Batch embedding rejected, embedding ${indices.length} inputs one by one: ${(err as Error).message}`,
         );

package/src/be/memory/task-learning.ts

@@ -5,9 +5,18 @@
  *
  * Source stays `manual` so nightly curation (memtax B1 reads only manual and
  * file_index rows) picks learnings up without a new source value.
+ *
+ * A learning close to an existing swarm memory (raw cosine at or above
+ * LEARNING_DUPLICATE_MIN_SIMILARITY) is not stored: the existing row gets a
+ * positive rating instead. Known gap: embeddings are written in the background,
+ * so two near-identical learnings seconds apart can both pass the check.
+ * Nightly curation catches those.
  */
 import { getDbClient } from "@/be/db";
+import { getEmbeddingProvider, getMemoryStore } from "@/be/memory";
+import { LEARNING_DUPLICATE_MIN_SIMILARITY } from "@/be/memory/constants";
 import { indexMemoryContent } from "@/be/memory/index-content";
+import { applyRating } from "@/be/memory/raters/store";
 import { contentSha256 } from "@/commands/profile-sync";
 import type { AgentTask } from "@/types";
 import { scrubSecrets } from "@/utils/secret-scrubber";
@@ -18,12 +27,17 @@ export const LEARNING_MAX_TAGS = 5;
 const LEARNINGS_ROOT = "/learnings";
 const SEGMENT_MAX_CHARS = 60;
 const KEY_ATTEMPTS = 4;
+/** Where a near duplicate can already live: any workstream's learnings and the workstream digests. */
+const DUPLICATE_SEARCH_PREFIXES = [`${LEARNINGS_ROOT}/`, "/longterm/workstreams/"];
+/** memory_rating.source for the positive rating a duplicate gives the existing row. */
+export const LEARNING_DUPLICATE_RATING_SOURCE = "learning-duplicate";
 
 export type TaskLearningInput = string | { text: string; workstream?: string; tags?: string[] };
 
 export type TaskLearningResult =
   | { status: "stored"; memoryId: string; key: string; workstream: string }
   | { status: "replayed"; memoryId: string; key: string }
+  | { status: "duplicate"; memoryId: string; key: string; similarity: number }
   | { status: "failed"; error: string };
 
 /** Lowercase kebab slug: `Agent Swarm!` -> `agent-swarm`. Empty when nothing usable is left. */
@@ -86,6 +100,15 @@ export async function storeTaskLearning(params: {
   );
 
   try {
+    // Replay first: the same text on the same task is a retry, not a duplicate.
+    const replay = await findReplay(task.id, contentSha256(text));
+    if (replay) return replay;
+    // Outside the write transaction: the embedding call goes over the network.
+    const duplicate = await findNearDuplicate({ agentId, isLead, text });
+    if (duplicate) {
+      await rateDuplicate(duplicate, task.id);
+      return duplicate;
+    }
     // One write transaction for the replay check and the insert, so two
     // overlapping calls with the same learning store it once.
     return await getDbClient().transaction(() =>
@@ -99,6 +122,91 @@ export async function storeTaskLearning(params: {
   }
 }
 
+async function findReplay(
+  taskId: string,
+  contentHash: string,
+): Promise<Extract<TaskLearningResult, { status: "replayed" }> | null> {
+  const replay = await getDbClient().get<{ id: string; key: string }>(
+    `SELECT id, key FROM agent_memory
+     WHERE sourceTaskId = ? AND contentHash = ? AND key LIKE '${LEARNINGS_ROOT}/%'
+     LIMIT 1`,
+    [taskId, contentHash],
+  );
+  return replay ? { status: "replayed", memoryId: replay.id, key: replay.key } : null;
+}
+
+/**
+ * The closest swarm memory under the duplicate prefixes when its raw cosine to
+ * the learning reaches the threshold. No `queryText`, so the store takes the
+ * vector or brute-force path and `similarity` is raw cosine, not an FTS rank or
+ * a fused score. Any failure (no embedding provider, a search error) returns
+ * null so the learning is stored as usual.
+ */
+async function findNearDuplicate(params: {
+  agentId: string;
+  isLead: boolean;
+  text: string;
+}): Promise<Extract<TaskLearningResult, { status: "duplicate" }> | null> {
+  try {
+    const embedding = await getEmbeddingProvider().embed(params.text);
+    if (!embedding) return null;
+    const store = getMemoryStore();
+    const results = await Promise.all(
+      DUPLICATE_SEARCH_PREFIXES.map((keyPrefix) =>
+        store.search(embedding, params.agentId, {
+          scope: "swarm",
+          isLead: params.isLead,
+          keyPrefix,
+          limit: 1,
+        }),
+      ),
+    );
+    const best = results
+      .flat()
+      .filter((candidate) => candidate.key)
+      .sort((a, b) => b.similarity - a.similarity)[0];
+    if (!best || best.similarity < LEARNING_DUPLICATE_MIN_SIMILARITY) return null;
+    return {
+      status: "duplicate",
+      memoryId: best.id,
+      key: best.key!,
+      similarity: Math.round(best.similarity * 1000) / 1000,
+    };
+  } catch (err) {
+    console.warn(
+      "[task-learning] near-duplicate check failed; storing the learning:",
+      scrubSecrets(err instanceof Error ? err.message : String(err)),
+    );
+    return null;
+  }
+}
+
+/** A repeated lesson is evidence the existing row is useful. A failed rating never fails the call. */
+async function rateDuplicate(
+  duplicate: Extract<TaskLearningResult, { status: "duplicate" }>,
+  taskId: string,
+): Promise<void> {
+  try {
+    await applyRating(
+      [
+        {
+          memoryId: duplicate.memoryId,
+          signal: 1,
+          weight: 1,
+          source: LEARNING_DUPLICATE_RATING_SOURCE,
+          reasoning: `store-progress learning matched at cosine ${duplicate.similarity}`,
+        },
+      ],
+      { taskId },
+    );
+  } catch (err) {
+    console.warn(
+      "[task-learning] duplicate rating failed:",
+      scrubSecrets(err instanceof Error ? err.message : String(err)),
+    );
+  }
+}
+
 async function insertLearning(params: {
   agentId: string;
   isLead: boolean;
@@ -110,14 +218,8 @@ async function insertLearning(params: {
   const { agentId, isLead, taskId, text, tags, workstream } = params;
   // indexMemoryContent stores text this short as one trimmed chunk, so this
   // hash is the row's contentHash: a replayed call finds its own earlier write.
-  const contentHash = contentSha256(text);
-  const replay = await getDbClient().get<{ id: string; key: string }>(
-    `SELECT id, key FROM agent_memory
-     WHERE sourceTaskId = ? AND contentHash = ? AND key LIKE '${LEARNINGS_ROOT}/%'
-     LIMIT 1`,
-    [taskId, contentHash],
-  );
-  if (replay) return { status: "replayed", memoryId: replay.id, key: replay.key };
+  const replay = await findReplay(taskId, contentSha256(text));
+  if (replay) return replay;
 
   const title = text.split(/\r?\n/, 1)[0]!.trim().slice(0, 200);
   const baseKey = `${LEARNINGS_ROOT}/${workstream}/${toKebab(title) || "learning"}`;

package/src/be/memory/types.ts

@@ -4,11 +4,22 @@ import type { AgentMemory, AgentMemoryScope, AgentMemorySource } from "@/types";
 // EmbeddingProvider — text to vector, swappable
 // ============================================================================
 
+/**
+ * What an input is for. Some models (nomic-embed) need a task prefix on each
+ * input: one for search queries, another for stored documents. No kind means
+ * no prefix.
+ */
+export type EmbeddingInputKind = "query" | "document";
+
+export interface EmbedOptions {
+  kind?: EmbeddingInputKind;
+}
+
 export interface EmbeddingProvider {
   readonly name: string;
   readonly dimensions: number;
-  embed(text: string): Promise<Float32Array | null>;
-  embedBatch(texts: string[]): Promise<(Float32Array | null)[]>;
+  embed(text: string, opts?: EmbedOptions): Promise<Float32Array | null>;
+  embedBatch(texts: string[], opts?: EmbedOptions): Promise<(Float32Array | null)[]>;
   /** True when the provider has a usable API key — no network call. */
   isConfigured(): boolean;
 }

package/src/be/migrations/246_connector_code_kind.sql

@@ -0,0 +1,11 @@
+-- Kind of single-use code in connector_codes.
+--
+-- `connector`: the agent-swarm.dev ChatGPT connector code (10 minute TTL).
+-- `invite`: a teammate invite from `POST /api/invites` (7 day TTL). Its
+-- exchange at `POST /api/invites/exchange` also flips the user from
+-- `invited` to `active`.
+--
+-- Each exchange route redeems only its own kind. Existing rows are connector
+-- codes, so they keep today's behavior.
+ALTER TABLE connector_codes ADD COLUMN kind TEXT NOT NULL DEFAULT 'connector'
+  CHECK (kind IN ('connector', 'invite'));