@hotmeshio/long-tail 0.1.14 → 0.1.16

package/build/services/yaml-workflow/pipeline/prompts.js

@@ -2,247 +2,18 @@
 /**
  * Externalized LLM prompt constants for the yaml-workflow pipeline.
  *
- * Consolidates all system/user prompt strings used by compile, validate,
- * and extract stages so they can be reviewed and tuned in one place.
+ * Template strings live in prompt-templates.ts. This file re-exports them
+ * and provides builder functions that compose prompts at runtime.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EXTRACT_DEFAULT_USER_TEMPLATE = exports.EXTRACT_DEFAULT_SYSTEM_PROMPT = exports.VALIDATION_PROMPT = exports.COMPILATION_PROMPT = void 0;
 exports.buildRecompilationHint = buildRecompilationHint;
-// ── Compile stage ─────────────────────────────────────────────────────────────
-exports.COMPILATION_PROMPT = `You are a workflow compiler. You analyze MCP tool execution traces and produce a COMPILATION PLAN — a complete specification for building a deterministic YAML DAG workflow.
-
-Given:
-1. The user's ORIGINAL PROMPT — the single most important signal for understanding intent
-2. EXECUTION STEPS — tool calls with arguments, result structure samples, and server IDs
-3. PATTERN ANNOTATIONS — pre-detected iteration candidates from static analysis
-4. NAIVE INPUT CLASSIFICATION — initial argument classification
-
-Your job: produce a plan that makes the workflow truly reusable and deterministic.
-
-## Critical: Understand Intent
-
-The original prompt describes what the user wanted. The execution trace shows HOW an LLM accomplished it, but may include exploratory detours. Your compilation captures INTENT, not a blind replay.
-
-For example, if the prompt says "login to site X and take screenshots of all pages":
-- INTENT: login → discover pages → iterate and screenshot each one
-- Execution may have included probing steps — exclude those
-- Deterministic version: accept credentials → login → extract links → iterate taking screenshots
-
-## Critical: Preserve Discovery Steps
-
-Many workflows follow a "discover then act" pattern: one step DISCOVERS data (e.g., extract navigation links, query a database, list files) and a later step ACTS on that data (e.g., screenshot each page, process each record, transform each file).
-
-**NEVER collapse discovery + action into a single step with the discovered data as a user input.** If the execution trace shows:
-1. Step A: extract_content → produces \`links: [{text, href}, ...]\`
-2. Step B: capture_pages(pages=[...array built from step A's links...])
-
-The compiled workflow MUST keep BOTH steps: A produces the array, B consumes it. Do NOT make the array a trigger input — it was runtime-discovered, not user-provided.
-
-**How to detect**: If a step's argument contains a large array of items that closely mirrors a prior step's output array (same URLs, same items, possibly reshaped), that array was DERIVED from the prior step. Keep both steps and wire them with a data_flow edge (with a transform if formats differ).
-
-## Rules
-
-### Step Dispositions
-- **core**: Directly serves the workflow intent. Produces data consumed by later steps. **Discovery steps that produce arrays consumed by later action steps are ALWAYS core.**
-- **exploratory**: Probing/debugging/discovery steps that don't produce data needed by the workflow. Exclude these:
-  - Checking if compiled workflows exist (list_workflows, list_yaml_workflows)
-  - Listing files to see what exists (list_files, read_file)
-  - Initial tool calls that failed and were retried with different parameters
-  - Any step whose result is not consumed by a subsequent core step
-  - **NEVER mark a discovery step as exploratory if its output was used to build arguments for a later step**
-
-### Signal Steps (Human-in-the-Loop)
-Steps with kind "signal" represent a durable pause where the workflow waits for human input (e.g., credentials, approval). These are ALWAYS core — they are essential to the workflow's data flow. The signal step receives data from a human and makes it available to subsequent steps. Do NOT mark signal steps as exploratory. The escalation tool call (escalate_and_wait) that precedes a signal step is also always core.
-
-**Signal data flow**: The signal step result contains the human response fields (e.g., password). These MUST be wired via data_flow edges to every downstream step that needs them. Add a data_flow edge from the signal step index to the consuming step with the matching field name.
-
-**Credentials from signals**: When the signal provides a credential (format: password in the schema), downstream tools that need it should receive it as a separate named input argument. The runtime exchanges ephemeral credential tokens automatically. For tools with complex stored arguments (like run_script steps arrays), wire the credential as a top-level argument name — the runtime merges it with stored defaults.
-
-### Iteration Specifications
-When the execution shows repeated tool calls with varying arguments (the pattern detector may have already collapsed these):
-- Identify the SOURCE: which prior step's result contains the array being iterated. This is the step that PRODUCED the list of items — look for a step whose result contains an array field with items matching the iteration's varying values. For example, if the iteration visits multiple URLs, find the step that returned those URLs (e.g., extract_content with links).
-- The source is NEVER a step that doesn't have the array in its output. Double-check: does the source step's resultKeys include the source_field?
-- Specify the source_field: the dot-path to the array (e.g., "links", "results.pages")
-- List varying_keys (change per item) vs constant_args (shared)
-- **KEY MAPPINGS are critical**: array items often use different key names than the tool expects.
-  E.g., extract_content returns \`links: [{text, href}, ...]\` but the screenshot tool wants \`url\`.
-  Map: \`{ "url": "href" }\` — tool arg name → array item key name.
-  Use null for keys that are COMPUTED at runtime, not sourced from the array.
-  For example, screenshot_path is often derived from the link text or URL — it's not a field in the source array directly:
-  \`{ "screenshot_path": null }\` — the value must be computed or provided by the trigger.
-
-### Tool Simplification for Iterations (CRITICAL)
-The iteration pattern works by extracting individual values from array items and passing them as simple key=value arguments to the iterated tool. This means:
-
-**The iterated tool MUST accept simple, flat arguments** (url, path, page_id — not complex nested structures like a \`steps\` array).
-
-If the execution used a complex multi-step scripting tool (e.g., \`run_script\` with a \`steps: [{action, url}, {action, path}]\` array) for each iteration, you MUST replace it with a simpler tool from the same server that accepts flat arguments. Check the server's tool inventory for a simpler alternative.
-
-For example:
-- \`run_script(steps=[navigate, wait, screenshot])\` per page → replace with \`capture_page(url, path, full_page, wait_ms)\` (1 call, flat args)
-- \`run_script(steps=[navigate, fill, click])\` per item → replace with \`submit_form(url, fields)\` (1 call, flat args)
-
-When replacing: use the same server_id but the simpler tool_name. The varying_keys and key_mappings should map directly to the simple tool's argument names.
-
-**If no simpler tool alternative exists**, use a data_flow edge with a transform to feed the array into a batch/composite tool that accepts the full array (like \`capture_authenticated_pages\` which takes a \`pages\` array).
-
-### Data Flow Graph
-Specify directed edges showing how data flows between steps:
-- from_step: "trigger" (user input) or step index number
-- from_field: the output field name (or trigger input key)
-- to_step: the consuming step index
-- to_field: the argument key name
-- is_session_wire: true for session handles (page_id, _handle, session_id)
-
-Session handles are critical — they maintain authenticated browser sessions, database connections, etc. They must be threaded from their producer through ALL subsequent steps that need them.
-
-### Chain Analysis to Downstream Steps
-When a step produces a meaningful result (analysis, extraction, description, computed value) and a later step consumes related data (saving, storing, forwarding, reporting), there MUST be a data_flow edge connecting them. Match by semantic intent, not just field name:
-- Step produces \`description\` → downstream step takes \`value\` → edge with from_field: "description", to_field: "value"
-- Step produces \`analysis.summary\` → downstream step takes \`content\` → edge with appropriate field mapping
-
-If the original execution trace shows that a step's output was used (even indirectly) as input to a later step, the compiled version must preserve that data chain. A broken chain means the downstream step receives no data — the worst possible compilation error.
-
-### Data Flow Transforms (CRITICAL for array reshaping)
-When a source step produces an array of objects in one format but the consuming step expects a DIFFERENT format, add a \`transform\` to the data_flow edge. Compare the source step's result structure with the consuming step's actual arguments from the trace.
-
-**Choosing the correct source field**: When a step produces multiple output fields, check the result sample to determine which field actually contains an ARRAY OF OBJECTS suitable for iteration/reshaping. Prefer structured array fields over raw/unstructured fields. Check the Tool-Specific Compilation Hints section (if present) for guidance on which fields to use for specific tools.
-
-For example: extract_content returns \`links: [{text, href}]\` but capture tool expects \`pages: [{url, screenshot_path, wait_ms, full_page}]\`.
-Add a transform with:
-- \`field_map\`: maps target keys → source keys (e.g., \`{"url": "href"}\`). Use null for keys not in the source.
-- \`defaults\`: static values to inject (e.g., \`{"wait_ms": 3000, "full_page": true}\`)
-- \`derivations\`: for computed keys (null in field_map), how to derive them from source data
-  - strategy: "slugify" (lowercase, replace spaces/special with hyphens), "prefix", "template", "concat"
-  - source_key: which source field to derive from
-  - prefix/suffix/template: string manipulation params
-
-Available derivation strategies:
-- **slugify**: Lowercase, replace spaces/special chars with hyphens. Optionally add prefix/suffix.
-- **prefix**: Prepend a static string.
-- **template**: Format string with \`{value}\` (source field) and \`{date}\` (today's date as YYYY-MM-DD via @date.yyyymmdd).
-- **concat**: Join multiple parts. Each part can use \`{value}\` and \`{date}\` placeholders.
-  Example: \`{ "strategy": "concat", "parts": ["{value}", "-", "{date}"] }\` produces \`my-slug-2026-04-17\`.
-- **passthrough**: No transformation.
-
-Use these when the workflow needs runtime-computed values (date-stamped filenames, slugified URLs, templated paths).
-
-Example edge with transform:
-\`\`\`
-{
-  "from_step": 1, "from_field": "links", "to_step": 2, "to_field": "pages",
-  "is_session_wire": false,
-  "transform": {
-    "field_map": { "url": "href", "screenshot_path": null },
-    "defaults": { "wait_ms": 3000, "full_page": true },
-    "derivations": {
-      "screenshot_path": {
-        "source_key": "href",
-        "strategy": "slugify",
-        "prefix": "screenshots/",
-        "suffix": ".png"
-      }
-    }
-  }
-}
-\`\`\`
-
-IMPORTANT: Check EVERY array-typed data_flow edge. Compare the source step's result item keys with the consuming step's argument item keys. If they differ, add a transform. Look at the actual tool_arguments in the execution trace to determine the correct field_map, defaults, and derivations.
-
-### Scalar Derivations on Data Flow Edges
-When a scalar value needs runtime transformation before reaching its consumer, add a \`derivation\` to the data_flow edge (NOT a \`transform\` — transforms are for array reshaping). Derivations generate runtime expressions for string manipulation.
-
-Common use case: the user's prompt mentions a pattern like "save with key slug-{date}" or "name it {something}-{today's date}". The trigger provides the base value, and the derivation appends or formats it at runtime.
-
-Add a \`derivation\` field to the data_flow edge:
-\`\`\`
-{
-  "from_step": "trigger", "from_field": "key", "to_step": 3, "to_field": "key",
-  "is_session_wire": false,
-  "derivation": { "strategy": "concat", "parts": ["{value}", "-", "{date}"] }
-}
-\`\`\`
-
-This produces a runtime-computed key like \`my-slug-2026-04-17\`. The \`{value}\` placeholder is the source field value; \`{date}\` is today's ISO date (YYYY-MM-DD).
-
-Use derivations when:
-- The user wants date-stamped keys, filenames, or identifiers
-- A value needs a prefix/suffix added at runtime
-- Two values need to be concatenated
-
-### Input Classification
-- **dynamic**: Simple values callers MUST provide: URLs, credentials, file paths, queries, search terms. These are always scalar strings, numbers, or booleans — NEVER complex objects or arrays.
-- **fixed**: Implementation details with sensible defaults: selectors, timeouts, boolean flags, AND complex structured arguments like \`steps\` arrays, \`login\` objects, or \`pages\` arrays. These are baked into stored tool_arguments.
-
-**Complex tool arguments (arrays of objects, nested structures) are ALWAYS fixed.** They represent the implementation recipe, not user input. For example:
-- A \`steps\` array describing browser actions (navigate, fill, click, screenshot) → **fixed**
-- A \`login\` object with selectors and credentials → flatten the credentials (username, password) as dynamic, but the selectors as fixed
-- A \`pages\` array of URLs to capture → **fixed** if hardcoded from the trace, or a data_flow edge if discovered at runtime
-
-Flatten nested objects containing dynamic values. E.g., \`login: {url, username, password}\` → separate \`login_url\`, \`username\`, \`password\` fields. But NEVER expose the full nested object or array as a trigger input.
-
-**Arrays that were DISCOVERED at runtime (by a prior step) are NOT inputs.** They flow between steps via data_flow edges. Only make an array a trigger input if the user explicitly provided it in their prompt. If the array was produced by a discovery step (extract_content, query, list), keep the discovery step as core and wire its output to the consuming step.
-
-### Prompt-Mentioned Values Are Dynamic
-If a scalar value (URL, domain name, file path, key name, slug, query string) appears verbatim or closely paraphrased in the user's original prompt, classify it as **dynamic**. The user explicitly chose that value for this execution and will want to change it next time. Only classify a prompt-mentioned value as fixed if it is unambiguously an implementation constant (a CSS selector, a timeout, a boolean flag).
-
-This is the most common compilation error: treating the user's specific request values as universal defaults. When in doubt, make it dynamic.
-
-### Data Flow Wiring Precision
-- **Only wire inputs that semantically match.** A directory name (e.g., \`screenshot_dir = "screenshots"\`) must NOT be wired to a file path argument (e.g., \`screenshot_path\` which expects \`"screenshots/home.png"\`). If a tool argument needs a specific file path but the trigger only provides a directory, leave that argument unwired — the stored tool_arguments default will provide the correct value.
-- **Trigger inputs should map to the EXACT tool argument they represent.** Don't reuse a trigger input for a different-purpose argument just because the names are vaguely related.
-- **When in doubt, don't wire.** An unwired argument falls back to the stored tool_arguments default from the original execution — this is always correct. An incorrectly wired argument overrides the correct default with a wrong value.
-
-### Session Fields and Threading Rules
-List all fields that represent session tokens/handles that must flow through the DAG (e.g., page_id, _handle, session_id).
-
-**Critical**: When a login/setup step produces a page_id or _handle, ALL subsequent browser/page steps must receive that session wire — including steps inside iterations. The data_flow graph must include session wire edges from the producing step to EVERY downstream step that operates on the same session, not just the immediately next one. For iterations: wire the session from the setup step directly to the iteration body step.
-
-**COMPLETENESS REQUIREMENT**: For EACH step that uses a session field (check the step's argumentKeys — if it includes page_id, _handle, or session_id), you MUST emit a data_flow edge wiring that field from its producer. If step 0 produces _handle and steps 1, 2, and 3 all use it, you need THREE edges: 0→1, 0→2, 0→3. Do NOT assume downstream steps will "inherit" session fields — each consumer needs an explicit edge.
-
-### Data Flow Completeness Check
-Before finalizing the plan, verify:
-1. Every step that has a session field in its argumentKeys has a corresponding is_session_wire edge
-2. Every step that consumes data from a prior step has a data_flow edge for that field
-3. Every dynamic trigger input is wired to at least one step via a data_flow edge from "trigger"
-4. Transform edges include the source field AND the consuming step can access all fields it needs
-
-## Output Format
-
-Return a JSON object (no markdown fences):
-{
-  "intent": "Brief generic description of what this workflow does",
-  "description": "Suggested workflow description for discovery",
-  "steps": [
-    { "index": 0, "purpose": "Navigate to the target site", "disposition": "core" },
-    { "index": 1, "purpose": "Extract navigation links from the page", "disposition": "core" },
-    { "index": 2, "purpose": "List files to check directory structure", "disposition": "exploratory" }
-  ],
-  "core_step_indices": [0, 1, 3],
-  "inputs": [
-    { "key": "base_url", "type": "string", "classification": "dynamic", "description": "The base URL of the site" },
-    { "key": "username", "type": "string", "classification": "dynamic", "description": "Login username" },
-    { "key": "timeout", "type": "number", "classification": "fixed", "description": "Page load timeout", "default": 30000 }
-  ],
-  "iterations": [
-    {
-      "body_step_index": 3,
-      "tool_name": "screenshot",
-      "server_id": "playwright",
-      "source_step_index": 1,
-      "source_field": "links",
-      "varying_keys": ["url", "screenshot_path"],
-      "constant_args": { "full_page": true },
-      "key_mappings": { "url": "href", "screenshot_path": null }
-    }
-  ],
-  "data_flow": [
-    { "from_step": "trigger", "from_field": "base_url", "to_step": 0, "to_field": "url", "is_session_wire": false },
-    { "from_step": 0, "from_field": "page_id", "to_step": 1, "to_field": "page_id", "is_session_wire": true },
-    { "from_step": 0, "from_field": "_handle", "to_step": 1, "to_field": "_handle", "is_session_wire": true }
-  ],
-  "session_fields": ["page_id", "_handle"]
-}`;
+// Re-export all prompt template constants
+var prompt_templates_1 = require("./prompt-templates");
+Object.defineProperty(exports, "COMPILATION_PROMPT", { enumerable: true, get: function () { return prompt_templates_1.COMPILATION_PROMPT; } });
+Object.defineProperty(exports, "VALIDATION_PROMPT", { enumerable: true, get: function () { return prompt_templates_1.VALIDATION_PROMPT; } });
+Object.defineProperty(exports, "EXTRACT_DEFAULT_SYSTEM_PROMPT", { enumerable: true, get: function () { return prompt_templates_1.EXTRACT_DEFAULT_SYSTEM_PROMPT; } });
+Object.defineProperty(exports, "EXTRACT_DEFAULT_USER_TEMPLATE", { enumerable: true, get: function () { return prompt_templates_1.EXTRACT_DEFAULT_USER_TEMPLATE; } });
 // ── Recompilation hint (compile stage retry) ──────────────────────────────────
 /**
  * Build the retry hint injected into the compile stage when
@@ -269,29 +40,3 @@ function buildRecompilationHint(feedback, priorYaml) {
         ] : []),
     ].join('\n');
 }
-// ── Validate stage ────────────────────────────────────────────────────────────
-exports.VALIDATION_PROMPT = `You are a YAML workflow validator. Given a workflow intent, activity manifest, and generated YAML DAG, identify data flow issues.
-
-Check for:
-1. Missing input wiring: a step needs data but no prior step provides it and it's not in the trigger
-2. Broken iteration sources: a cycle references an array field that doesn't exist in the source step's output
-3. Lost session handles: a session field (page_id, _handle) is produced by an early step (e.g., login) but not threaded to later browser/page steps that need it — including steps inside iteration loops
-4. Unparameterized hardcoded values: URLs, credentials, or paths that should be dynamic inputs but are baked in
-5. Iteration array source: verify the referenced items field in a cycle hook actually exists in the source activity's output fields
-6. Trigger completeness: every dynamic input in the trigger schema should be referenced by at least one activity's input maps
-
-IGNORE these internal fields — they are injected by the build system and are always correct:
-- "workflowName" in input maps: internal dispatch routing field, always a literal string — NOT a hardcoded value bug
-- "_scope" in input maps: internal IAM context field, always wired from trigger — NOT a missing trigger input
-
-Return a JSON object:
-{
-  "issues": ["description of issue 1", "description of issue 2"],
-  "valid": true
-}
-
-If no issues, return { "issues": [], "valid": true }.
-Be concise. Only report real problems, not style suggestions.`;
-// ── Extract stage ─────────────────────────────────────────────────────────────
-exports.EXTRACT_DEFAULT_SYSTEM_PROMPT = 'You are a data analysis assistant. Interpret the provided data and return a structured JSON response with: title, summary, sections (array of {heading, content}), and metrics (array of {label, value}).';
-exports.EXTRACT_DEFAULT_USER_TEMPLATE = '{dataRef}\n\nData:\n{input_data}\n\nProvide a concise analysis.';

package/build/services/yaml-workflow/workers/register.js

@@ -138,7 +138,8 @@ async function registerWorkersForWorkflow(workflow) {
         else if (toolSource === 'db') {
             if (!activity.mcp_tool_name)
                 continue;
-            const toolName = activity.mcp_tool_name;
+            const rawToolName = activity.mcp_tool_name;
+            const toolName = rawToolName.includes('__') ? rawToolName.slice(rawToolName.indexOf('__') + 2) : rawToolName;
             const dbServerId = activity.mcp_server_id || 'long-tail-db';
             const toolArgs = activity.tool_arguments;
             workerConfigs.push({
@@ -163,7 +164,8 @@ async function registerWorkersForWorkflow(workflow) {
         else {
             if (!activity.mcp_tool_name)
                 continue;
-            const toolName = activity.mcp_tool_name;
+            const rawToolName = activity.mcp_tool_name;
+            const toolName = rawToolName.includes('__') ? rawToolName.slice(rawToolName.indexOf('__') + 2) : rawToolName;
             const serverId = activity.mcp_server_id;
             if (!serverId)
                 continue;

package/build/start/adapters.js

@@ -16,6 +16,7 @@ const adapter_1 = require("../services/mcp/adapter");
 const escalation_strategy_1 = require("../services/escalation-strategy");
 const default_1 = require("../services/escalation-strategy/default");
 const mcp_2 = require("../services/escalation-strategy/mcp");
+const socket_auth_1 = require("./socket-auth");
 /**
  * Register all adapters (logging, telemetry, events, maintenance,
  * escalation strategy, MCP) based on the startup config.
@@ -46,7 +47,9 @@ function registerAdapters(startConfig) {
         if (startConfig.events?.nats) {
             events_1.eventRegistry.register(new nats_1.NatsEventAdapter(startConfig.events.nats));
         }
-        events_1.eventRegistry.register(new socketio_1.SocketIOEventAdapter());
+        events_1.eventRegistry.register(new socketio_1.SocketIOEventAdapter({
+            authenticate: (0, socket_auth_1.createSocketIOAuthenticator)(startConfig),
+        }));
     }
     // Always register the callback adapter for SDK event subscriptions.
     // Zero-cost when no listeners are registered.

package/build/start/socket-auth.d.ts

@@ -0,0 +1,13 @@
+import type { SocketIOAuthenticator } from '../lib/events/socketio';
+import type { LTStartConfig } from '../types/startup';
+/**
+ * Build a Socket.IO handshake authenticator from the startup config.
+ *
+ * Uses the same JWT secret as `requireAuth` — either the explicit
+ * secret from startConfig.auth.secret or the JWT_SECRET env var.
+ *
+ * Returns `undefined` when no secret is configured (e.g. tests or
+ * deployments that intentionally skip auth), which leaves Socket.IO
+ * open as before.
+ */
+export declare function createSocketIOAuthenticator(startConfig: LTStartConfig): SocketIOAuthenticator | undefined;

package/build/start/socket-auth.js

@@ -0,0 +1,32 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSocketIOAuthenticator = createSocketIOAuthenticator;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const config_1 = require("../modules/config");
+/**
+ * Build a Socket.IO handshake authenticator from the startup config.
+ *
+ * Uses the same JWT secret as `requireAuth` — either the explicit
+ * secret from startConfig.auth.secret or the JWT_SECRET env var.
+ *
+ * Returns `undefined` when no secret is configured (e.g. tests or
+ * deployments that intentionally skip auth), which leaves Socket.IO
+ * open as before.
+ */
+function createSocketIOAuthenticator(startConfig) {
+    const secret = startConfig.auth?.secret ?? config_1.config.JWT_SECRET;
+    if (!secret)
+        return undefined;
+    return (token) => {
+        try {
+            const payload = jsonwebtoken_1.default.verify(token, secret);
+            return !!(payload && typeof payload === 'object' && payload.userId);
+        }
+        catch {
+            return false;
+        }
+    };
+}

package/build/start/workers.js

@@ -132,11 +132,6 @@ async function startWorkers(startConfig, workers, builtinMcpServerFactories) {
             (0, registry_1.registerWorker)(w.workflow.name, w.taskQueue);
         }
         logger_1.loggerRegistry.info(`[long-tail] workers started on queues: ${workers.map((w) => w.taskQueue).join(', ')}`);
-        // Connect event adapters
-        if (events_1.eventRegistry.hasAdapters) {
-            await events_1.eventRegistry.connect();
-            logger_1.loggerRegistry.info('[long-tail] event adapters connected');
-        }
         // Start maintenance cron
         if (maintenance_1.maintenanceRegistry.hasConfig) {
             await maintenance_1.maintenanceRegistry.connect();
@@ -162,6 +157,12 @@ async function startWorkers(startConfig, workers, builtinMcpServerFactories) {
         // Register workers for active YAML (deterministic) workflows
         await yamlWorkflowWorkers.registerAllActiveWorkers();
     }
+    // Connect event adapters (outside workers guard so API-only containers
+    // still connect to NATS and can publish/receive events)
+    if (events_1.eventRegistry.hasAdapters) {
+        await events_1.eventRegistry.connect();
+        logger_1.loggerRegistry.info('[long-tail] event adapters connected');
+    }
     // Seed system MCP servers (always)
     const { seedSystemMcpServers } = await Promise.resolve().then(() => __importStar(require('../system/seed')));
     await seedSystemMcpServers();

package/build/system/activities/file-storage.d.ts

@@ -17,12 +17,16 @@ export declare function readFile(args: {
 export declare function listFiles(args: {
     directory?: string;
     pattern?: string;
+    page_size?: number;
+    continuation_token?: string;
 }): Promise<{
     files: Array<{
         path: string;
         size: number;
         modified_at: string;
     }>;
+    directories?: string[];
+    nextToken?: string;
 }>;
 export declare function deleteFile(args: {
     path: string;

package/build/system/activities/file-storage.js

@@ -64,7 +64,13 @@ async function readFile(args) {
     };
 }
 async function listFiles(args) {
-    return (0, storage_1.getStorageBackend)().list(args.directory, args.pattern);
+    const result = await (0, storage_1.getStorageBackend)().listWithPrefixes(args.directory, args.page_size || 100, args.continuation_token);
+    // Apply glob pattern client-side if provided (S3/GCS don't support server-side glob)
+    if (args.pattern) {
+        const regex = new RegExp(args.pattern.replace(/\./g, '\\.').replace(/\*/g, '.*'));
+        result.files = result.files.filter((f) => regex.test(f.path));
+    }
+    return result;
 }
 async function deleteFile(args) {
     return (0, storage_1.getStorageBackend)().delete(args.path);

package/build/system/activities/knowledge.d.ts

@@ -3,6 +3,7 @@ export declare function storeKnowledge(args: {
     key: string;
     data: Record<string, any>;
     tags?: string[];
+    replace?: boolean;
 }): Promise<{
     id: string;
     domain: string;
@@ -19,6 +20,7 @@ export declare function searchKnowledge(args: {
     query: Record<string, any>;
     tags?: string[];
     limit?: number;
+    offset?: number;
 }): Promise<{
     entries: Record<string, any>[];
     total: number;
@@ -26,6 +28,7 @@ export declare function searchKnowledge(args: {
 export declare function listKnowledge(args: {
     domain: string;
     tags?: string[];
+    search?: string;
     limit?: number;
     offset?: number;
 }): Promise<{
@@ -38,6 +41,26 @@ export declare function deleteKnowledge(args: {
 }): Promise<{
     deleted: boolean;
 }>;
+export declare function setKnowledgeField(args: {
+    domain: string;
+    key: string;
+    path: string;
+    value: any;
+    tags?: string[];
+}): Promise<{
+    id: string;
+    domain: string;
+    key: string;
+    created: boolean;
+    updated_at: string;
+}>;
+export declare function removeKnowledgeField(args: {
+    domain: string;
+    key: string;
+    path: string;
+}): Promise<{
+    removed: boolean;
+}>;
 export declare function listDomains(): Promise<{
     domains: Array<{
         domain: string;

package/build/system/activities/knowledge.js

@@ -5,6 +5,8 @@ exports.getKnowledge = getKnowledge;
 exports.searchKnowledge = searchKnowledge;
 exports.listKnowledge = listKnowledge;
 exports.deleteKnowledge = deleteKnowledge;
+exports.setKnowledgeField = setKnowledgeField;
+exports.removeKnowledgeField = removeKnowledgeField;
 exports.listDomains = listDomains;
 exports.appendKnowledge = appendKnowledge;
 const db_1 = require("../../lib/db");
@@ -22,7 +24,8 @@ async function withClient(fn) {
 }
 async function storeKnowledge(args) {
     return withClient(async (client) => {
-        const { rows } = await client.query(sql_1.UPSERT_KNOWLEDGE, [args.domain, args.key, JSON.stringify(args.data), args.tags || []]);
+        const sql = args.replace ? sql_1.REPLACE_KNOWLEDGE : sql_1.UPSERT_KNOWLEDGE;
+        const { rows } = await client.query(sql, [args.domain, args.key, JSON.stringify(args.data), args.tags || []]);
         return { ...rows[0], updated_at: rows[0].updated_at.toISOString() };
     });
 }
@@ -46,19 +49,24 @@ async function getKnowledge(args) {
 async function searchKnowledge(args) {
     return withClient(async (client) => {
         const limit = Math.min(args.limit || 50, 200);
-        const params = [args.domain, JSON.stringify(args.query), limit];
+        const offset = args.offset || 0;
+        const params = [args.domain, JSON.stringify(args.query)];
         let tagClause = '';
         if (args.tags?.length) {
-            tagClause = ' AND tags && $4';
             params.push(args.tags);
+            tagClause = ` AND tags && $${params.length}`;
         }
+        const countParams = [...params];
         const countResult = await client.query(`SELECT COUNT(*)::int AS total FROM lt_knowledge
-       WHERE domain = $1 AND data @> $2::jsonb${tagClause}`, tagClause ? [args.domain, JSON.stringify(args.query), ...(args.tags ? [args.tags] : [])]
-            : [args.domain, JSON.stringify(args.query)]);
+       WHERE domain = $1 AND data @> $2::jsonb${tagClause}`, countParams);
+        params.push(limit);
+        const limitIdx = params.length;
+        params.push(offset);
+        const offsetIdx = params.length;
         const { rows } = await client.query(`SELECT id, domain, key, data, tags, created_at, updated_at
        FROM lt_knowledge
        WHERE domain = $1 AND data @> $2::jsonb${tagClause}
-       ORDER BY updated_at DESC LIMIT $3`, params);
+       ORDER BY updated_at DESC LIMIT $${limitIdx} OFFSET $${offsetIdx}`, params);
         return {
             entries: rows.map((r) => ({
                 id: r.id, domain: r.domain, key: r.key, data: r.data, tags: r.tags,
@@ -73,17 +81,23 @@ async function listKnowledge(args) {
         const limit = Math.min(args.limit || 50, 200);
         const offset = args.offset || 0;
         const params = [args.domain];
-        let tagClause = '';
+        let extraClauses = '';
         if (args.tags?.length) {
-            tagClause = ' AND tags && $2';
             params.push(args.tags);
+            extraClauses += ` AND tags && $${params.length}`;
         }
-        const countResult = await client.query(`SELECT COUNT(*)::int AS total FROM lt_knowledge WHERE domain = $1${tagClause}`, params);
+        if (args.search) {
+            params.push(`%${args.search}%`);
+            const searchIdx = params.length;
+            // Match key by ILIKE or any tag element by ILIKE
+            extraClauses += ` AND (key ILIKE $${searchIdx} OR EXISTS (SELECT 1 FROM unnest(tags) t WHERE t ILIKE $${searchIdx}))`;
+        }
+        const countResult = await client.query(`SELECT COUNT(*)::int AS total FROM lt_knowledge WHERE domain = $1${extraClauses}`, params);
         const queryParams = [...params, limit, offset];
         const limitIdx = params.length + 1;
         const offsetIdx = params.length + 2;
         const { rows } = await client.query(`SELECT id, domain, key, data, tags, created_at, updated_at
-       FROM lt_knowledge WHERE domain = $1${tagClause}
+       FROM lt_knowledge WHERE domain = $1${extraClauses}
        ORDER BY updated_at DESC LIMIT $${limitIdx} OFFSET $${offsetIdx}`, queryParams);
         return {
             entries: rows.map((r) => ({
@@ -100,6 +114,32 @@ async function deleteKnowledge(args) {
         return { deleted: (rowCount ?? 0) > 0 };
     });
 }
+async function setKnowledgeField(args) {
+    return withClient(async (client) => {
+        const pathParts = args.path.split('.');
+        // Build initial data for INSERT (nested structure from path)
+        let initData = { [pathParts[pathParts.length - 1]]: args.value };
+        for (let i = pathParts.length - 2; i >= 0; i--) {
+            initData = { [pathParts[i]]: initData };
+        }
+        const { rows } = await client.query(sql_1.SET_KNOWLEDGE_FIELD, [
+            args.domain,
+            args.key,
+            JSON.stringify(initData),
+            args.tags || [],
+            pathParts,
+            JSON.stringify(args.value),
+        ]);
+        return { ...rows[0], updated_at: rows[0].updated_at.toISOString() };
+    });
+}
+async function removeKnowledgeField(args) {
+    return withClient(async (client) => {
+        const pathParts = args.path.split('.');
+        const { rowCount } = await client.query(sql_1.REMOVE_KNOWLEDGE_FIELD, [args.domain, args.key, pathParts]);
+        return { removed: (rowCount ?? 0) > 0 };
+    });
+}
 async function listDomains() {
     return withClient(async (client) => {
         const { rows } = await client.query(sql_1.LIST_DOMAINS);

package/build/system/activities/sql.d.ts

@@ -1,4 +1,5 @@
 export declare const UPSERT_KNOWLEDGE = "\n  INSERT INTO lt_knowledge (domain, key, data, tags)\n  VALUES ($1, $2, $3, $4)\n  ON CONFLICT (domain, key) DO UPDATE SET\n    data = CASE\n      WHEN jsonb_typeof(lt_knowledge.data) = 'object'\n      THEN lt_knowledge.data || EXCLUDED.data\n      ELSE EXCLUDED.data\n    END,\n    tags = ARRAY(SELECT DISTINCT unnest(lt_knowledge.tags || EXCLUDED.tags))\n  RETURNING id, domain, key, (xmax = 0) AS created, updated_at";
+export declare const REPLACE_KNOWLEDGE = "\n  INSERT INTO lt_knowledge (domain, key, data, tags)\n  VALUES ($1, $2, $3, $4)\n  ON CONFLICT (domain, key) DO UPDATE SET\n    data = EXCLUDED.data,\n    tags = EXCLUDED.tags\n  RETURNING id, domain, key, (xmax = 0) AS created, updated_at";
 export declare const GET_KNOWLEDGE = "\n  SELECT id, domain, key, data, tags, created_at, updated_at\n  FROM lt_knowledge WHERE domain = $1 AND key = $2";
 export declare const SEARCH_KNOWLEDGE = "\n  SELECT id, domain, key, data, tags, created_at, updated_at\n  FROM lt_knowledge\n  WHERE domain = $1 AND data @> $2::jsonb";
 export declare const COUNT_KNOWLEDGE_SEARCH = "\n  SELECT COUNT(*)::int AS total FROM lt_knowledge\n  WHERE domain = $1 AND data @> $2::jsonb";
@@ -6,4 +7,6 @@ export declare const LIST_KNOWLEDGE = "\n  SELECT id, domain, key, data, tags, c
 export declare const COUNT_KNOWLEDGE_LIST = "\n  SELECT COUNT(*)::int AS total FROM lt_knowledge WHERE domain = $1";
 export declare const DELETE_KNOWLEDGE = "\n  DELETE FROM lt_knowledge WHERE domain = $1 AND key = $2";
 export declare const LIST_DOMAINS = "\n  SELECT domain, COUNT(*)::int AS count, MAX(updated_at) AS latest\n  FROM lt_knowledge GROUP BY domain ORDER BY latest DESC";
+export declare const SET_KNOWLEDGE_FIELD = "\n  INSERT INTO lt_knowledge (domain, key, data, tags)\n  VALUES ($1, $2, $3::jsonb, $4)\n  ON CONFLICT (domain, key) DO UPDATE SET\n    data = jsonb_set(lt_knowledge.data, $5::text[], $6::jsonb, true),\n    tags = ARRAY(SELECT DISTINCT unnest(lt_knowledge.tags || EXCLUDED.tags))\n  RETURNING id, domain, key, (xmax = 0) AS created, updated_at";
+export declare const REMOVE_KNOWLEDGE_FIELD = "\n  UPDATE lt_knowledge\n  SET data = data #- $3::text[]\n  WHERE domain = $1 AND key = $2\n  RETURNING id, domain, key, updated_at";
 export declare const APPEND_KNOWLEDGE = "\n  INSERT INTO lt_knowledge (domain, key, data)\n  VALUES ($1, $2, $3::jsonb)\n  ON CONFLICT (domain, key) DO UPDATE SET\n    data = CASE\n      WHEN lt_knowledge.data #> $4::text[] IS NULL\n      THEN jsonb_set(lt_knowledge.data, $4::text[], jsonb_build_array($5::jsonb))\n      ELSE jsonb_set(lt_knowledge.data, $4::text[], (lt_knowledge.data #> $4::text[]) || jsonb_build_array($5::jsonb))\n    END\n  RETURNING id, domain, key, updated_at";