harmony-mcp 1.13.0 → 1.13.2

package/dist/cli.js

@@ -25371,6 +25371,31 @@ async function extractMidSessionLearnings(client2, ctx) {
   const now = Date.now();
   const entityIds = [];
   const history = sessionTaskHistory.get(ctx.cardId);
+  if (ctx.currentTask) {
+    const previousTask = history?.lastTask || "";
+    const similarity = levenshteinSimilarity(previousTask, ctx.currentTask);
+    const existingSteps = history?.steps || [];
+    if (existingSteps.length === 0 || similarity < 0.6 && previousTask.length > 0) {
+      const newStep = {
+        task: ctx.currentTask,
+        progress: ctx.progressPercent ?? 0,
+        timestamp: now
+      };
+      if (existingSteps.length === 0 && previousTask.length > 0) {
+        existingSteps.push({
+          task: previousTask,
+          progress: 0,
+          timestamp: history?.lastExtractionAt ?? now
+        });
+      }
+      existingSteps.push(newStep);
+      sessionTaskHistory.set(ctx.cardId, {
+        lastTask: ctx.currentTask,
+        lastExtractionAt: history?.lastExtractionAt ?? 0,
+        steps: existingSteps
+      });
+    }
+  }
   if (history && now - history.lastExtractionAt < MID_SESSION_RATE_LIMIT_MS) {
     if (ctx.status !== "blocked" || !ctx.blockers?.length) {
       return { count: 0, entityIds: [] };
@@ -25408,7 +25433,8 @@ Progress: ${ctx.progressPercent ?? "unknown"}%`,
     }
     sessionTaskHistory.set(ctx.cardId, {
       lastTask: ctx.currentTask || "",
-      lastExtractionAt: now
+      lastExtractionAt: now,
+      steps: history?.steps || []
     });
     return { count: entityIds.length, entityIds };
   }
@@ -25444,9 +25470,11 @@ Progress: ${ctx.progressPercent ?? "unknown"}%`,
           entityIds.push(entity.id);
       } catch {}
     }
+    const currentHistory = sessionTaskHistory.get(ctx.cardId);
     sessionTaskHistory.set(ctx.cardId, {
       lastTask: ctx.currentTask,
-      lastExtractionAt: entityIds.length > 0 ? now : history?.lastExtractionAt ?? 0
+      lastExtractionAt: entityIds.length > 0 ? now : currentHistory?.lastExtractionAt ?? 0,
+      steps: currentHistory?.steps || []
     });
   }
   return { count: entityIds.length, entityIds };
@@ -25454,6 +25482,128 @@ Progress: ${ctx.progressPercent ?? "unknown"}%`,
 function clearMidSessionTracking(cardId) {
   sessionTaskHistory.delete(cardId);
 }
+function enrichSteps(steps) {
+  return steps.map((step, i) => {
+    const prevProgress = i > 0 ? steps[i - 1].progress : 0;
+    const prevTimestamp = i > 0 ? steps[i - 1].timestamp : step.timestamp;
+    const progressDelta = step.progress - prevProgress;
+    return {
+      task: step.task,
+      progress: step.progress,
+      progressDelta,
+      durationMs: step.timestamp - prevTimestamp,
+      isKeyDecision: progressDelta >= 20
+    };
+  });
+}
+function buildProcedureContent(session, enrichedSteps, wikiLinksLine) {
+  const triggerLabels = session.cardLabels.length > 0 ? `Labels: ${session.cardLabels.join(", ")}` : "";
+  const stepsMarkdown = enrichedSteps.map((s, i) => {
+    const marker = s.isKeyDecision ? " **[key step]**" : "";
+    const duration3 = s.durationMs > 0 ? ` (~${Math.round(s.durationMs / 60000)}min)` : "";
+    return `${i + 1}. ${s.task} (${s.progress}%, +${s.progressDelta}%)${marker}${duration3}`;
+  }).join(`
+`);
+  const subtaskSection = session.cardSubtasks && session.cardSubtasks.length > 0 ? [
+    "",
+    "## Subtasks Completed",
+    ...session.cardSubtasks.map((s) => `- [${s.done ? "x" : " "}] ${s.title}`)
+  ].join(`
+`) : "";
+  const durationInfo = session.sessionDurationMs ? `
+Duration: ${Math.round(session.sessionDurationMs / 60000)} minutes` : "";
+  return [
+    "## Trigger",
+    `When working on: "${session.cardTitle}"`,
+    triggerLabels,
+    "",
+    "## Steps",
+    stepsMarkdown,
+    subtaskSection,
+    "",
+    "## Outcome",
+    `Completed at ${session.progressPercent ?? "unknown"}%`,
+    session.currentTask ? `Final state: ${session.currentTask}` : "",
+    `Agent: ${session.agentName}`,
+    durationInfo,
+    wikiLinksLine
+  ].filter((line) => line !== undefined).join(`
+`);
+}
+async function extractOrReinforceProcedure(client2, session, steps, workspaceId, projectId, wikiLinksLine = "") {
+  const enrichedSteps = enrichSteps(steps);
+  const newContent = buildProcedureContent(session, enrichedSteps, wikiLinksLine);
+  const tags = [
+    "auto-extracted",
+    "procedure",
+    ...session.cardLabels.slice(0, 3)
+  ];
+  try {
+    const similar = await findSimilarEntities(client2, `Procedure: ${session.cardTitle}`, newContent, workspaceId, { projectId, limit: 5, minRrfScore: 0.03 });
+    const matchingProcedure = similar.find((e) => e.type === "procedure" && (e.rrf_score ?? 0) >= 0.05);
+    if (matchingProcedure) {
+      const { entity: rawEntity } = await client2.getMemoryEntity(matchingProcedure.id);
+      const fullEntity = rawEntity;
+      const currentMeta = fullEntity.metadata || {};
+      const sourceCards = (currentMeta.source_cards || []).slice();
+      if (!sourceCards.includes(session.cardId)) {
+        sourceCards.push(session.cardId);
+      }
+      const reuseCount = (currentMeta.reuse_count || 0) + 1;
+      const currentConfidence = fullEntity.confidence ?? 0.7;
+      const newConfidence = Math.min(0.95, currentConfidence + 0.05);
+      const stepsAppendix = enrichedSteps.map((s, i) => `${i + 1}. ${s.task} (${s.progress}%)`).join(`
+`);
+      const appendix = `
+
+---
+### Execution ${reuseCount + 1}: ${session.cardTitle}
+${stepsAppendix}
+Agent: ${session.agentName} | ${new Date().toISOString().split("T")[0]}`;
+      const updatedMeta = {
+        ...currentMeta,
+        reuse_count: reuseCount,
+        source_cards: sourceCards,
+        last_reinforced_at: new Date().toISOString(),
+        step_count: Math.max(currentMeta.step_count || 0, steps.length)
+      };
+      const shouldPromote = reuseCount >= 2 && fullEntity.memory_tier !== "reference";
+      await client2.updateMemoryEntity(fullEntity.id, {
+        content: (fullEntity.content || "") + appendix,
+        confidence: newConfidence,
+        metadata: {
+          ...updatedMeta,
+          ...shouldPromote ? {
+            promoted_reason: `Reinforced by ${reuseCount + 1} successful sessions`,
+            promoted_at: new Date().toISOString()
+          } : {}
+        },
+        ...shouldPromote ? { memory_tier: "reference" } : {}
+      });
+      return { mode: "reinforced", entityId: fullEntity.id };
+    }
+  } catch {}
+  return {
+    mode: "created",
+    learning: {
+      title: `Procedure: ${session.cardTitle}`,
+      content: newContent,
+      type: "procedure",
+      tier: "episode",
+      confidence: 0.7,
+      tags,
+      metadata: {
+        source: "active_learning",
+        card_id: session.cardId,
+        source_cards: [session.cardId],
+        step_count: steps.length,
+        key_step_count: enrichedSteps.filter((s) => s.isKeyDecision).length,
+        reuse_count: 0,
+        review_status: "pending"
+      }
+    }
+  };
+}
 async function extractLearnings(client2, session) {
   const workspaceId = getActiveWorkspaceId();
   if (!workspaceId) {
@@ -25554,6 +25704,19 @@ Agent: ${session.agentName}`,
     });
   }
   const entityIds = [];
+  const stepHistory = sessionTaskHistory.get(session.cardId);
+  const hasEnoughSteps = stepHistory && stepHistory.steps.length >= 2;
+  const isSuccessful = session.status === "completed" && (session.progressPercent === undefined || session.progressPercent >= 85) && !session.blockers?.length;
+  if (isSuccessful && hasEnoughSteps) {
+    const procedureResult = await extractOrReinforceProcedure(client2, session, stepHistory.steps, workspaceId, projectId, wikiLinksLine);
+    if (procedureResult) {
+      if (procedureResult.mode === "created") {
+        learnings.push(procedureResult.learning);
+      } else {
+        entityIds.push(procedureResult.entityId);
+      }
+    }
+  }
   const createdPairs = [];
   for (const learning of learnings) {
     try {
@@ -26456,75 +26619,6 @@ function deriveClusterTitle(cluster, type) {
   return `Consolidated ${type}: ${suffix}`;
 }
 
-// src/lifecycle-maintenance.ts
-async function runLifecycleMaintenance(client3, workspaceId, projectId) {
-  const result = {
-    archived: 0,
-    pruned: 0,
-    promoted: 0,
-    reviewed: 0,
-    errors: 0
-  };
-  let entities;
-  try {
-    const listResult = await client3.listMemoryEntities({
-      workspace_id: workspaceId,
-      project_id: projectId,
-      limit: 200
-    });
-    entities = listResult.entities || [];
-  } catch {
-    return result;
-  }
-  if (entities.length === 0)
-    return result;
-  const now = Date.now();
-  const STALE_DRAFT_MAX_AGE_DAYS = 30;
-  for (const entity of entities) {
-    try {
-      const lifecycle2 = evaluateLifecycle(entity);
-      if (lifecycle2.shouldArchive) {
-        await client3.deleteMemoryEntity(entity.id);
-        result.archived++;
-        continue;
-      }
-      if (entity.memory_tier === "draft") {
-        const ageDays = (now - new Date(entity.created_at).getTime()) / (1000 * 60 * 60 * 24);
-        if (ageDays > STALE_DRAFT_MAX_AGE_DAYS && lifecycle2.decay.score < 0.3) {
-          await client3.deleteMemoryEntity(entity.id);
-          result.pruned++;
-          continue;
-        }
-      }
-      if (lifecycle2.promotion.eligible && lifecycle2.promotion.targetTier) {
-        await client3.updateMemoryEntity(entity.id, {
-          memory_tier: lifecycle2.promotion.targetTier,
-          metadata: {
-            promoted_at: new Date().toISOString(),
-            promotion_reason: lifecycle2.promotion.reason,
-            promoted_from: entity.memory_tier
-          }
-        });
-        result.promoted++;
-        continue;
-      }
-      if (lifecycle2.shouldFlagForReview) {
-        await client3.updateMemoryEntity(entity.id, {
-          metadata: {
-            needs_review: true,
-            review_reason: lifecycle2.reviewReason,
-            flagged_at: new Date().toISOString()
-          }
-        });
-        result.reviewed++;
-      }
-    } catch {
-      result.errors++;
-    }
-  }
-  return result;
-}
-
 // src/context-assembly.ts
 var DEFAULT_TOKEN_BUDGET = 4000;
 var MAX_TOKENS_PER_ENTITY = 500;
@@ -26931,6 +27025,75 @@ async function recordContextFeedback(client3, cardId, sessionStatus, progressPer
   return { adjusted };
 }
 
+// src/lifecycle-maintenance.ts
+async function runLifecycleMaintenance(client3, workspaceId, projectId) {
+  const result = {
+    archived: 0,
+    pruned: 0,
+    promoted: 0,
+    reviewed: 0,
+    errors: 0
+  };
+  let entities;
+  try {
+    const listResult = await client3.listMemoryEntities({
+      workspace_id: workspaceId,
+      project_id: projectId,
+      limit: 200
+    });
+    entities = listResult.entities || [];
+  } catch {
+    return result;
+  }
+  if (entities.length === 0)
+    return result;
+  const now = Date.now();
+  const STALE_DRAFT_MAX_AGE_DAYS = 30;
+  for (const entity of entities) {
+    try {
+      const lifecycle2 = evaluateLifecycle(entity);
+      if (lifecycle2.shouldArchive) {
+        await client3.deleteMemoryEntity(entity.id);
+        result.archived++;
+        continue;
+      }
+      if (entity.memory_tier === "draft") {
+        const ageDays = (now - new Date(entity.created_at).getTime()) / (1000 * 60 * 60 * 24);
+        if (ageDays > STALE_DRAFT_MAX_AGE_DAYS && lifecycle2.decay.score < 0.3) {
+          await client3.deleteMemoryEntity(entity.id);
+          result.pruned++;
+          continue;
+        }
+      }
+      if (lifecycle2.promotion.eligible && lifecycle2.promotion.targetTier) {
+        await client3.updateMemoryEntity(entity.id, {
+          memory_tier: lifecycle2.promotion.targetTier,
+          metadata: {
+            promoted_at: new Date().toISOString(),
+            promotion_reason: lifecycle2.promotion.reason,
+            promoted_from: entity.memory_tier
+          }
+        });
+        result.promoted++;
+        continue;
+      }
+      if (lifecycle2.shouldFlagForReview) {
+        await client3.updateMemoryEntity(entity.id, {
+          metadata: {
+            needs_review: true,
+            review_reason: lifecycle2.reviewReason,
+            flagged_at: new Date().toISOString()
+          }
+        });
+        result.reviewed++;
+      }
+    } catch {
+      result.errors++;
+    }
+  }
+  return result;
+}
+
 // src/prompt-builder.ts
 var LABEL_CATEGORY_MAP = {
   bug: "bug",
@@ -27233,6 +27396,12 @@ ${assembledContext}`);
       sections.push(memory.content);
     }
   }
+  const oneThingLine = synthesizeOneThing(card, subtasks, links);
+  if (oneThingLine) {
+    sections.push(`
+## Recommended Next Step
+${oneThingLine}`);
+  }
   if (variant === "execute") {
     sections.push(`
 ## Progress Tracking
@@ -27272,6 +27441,32 @@ ${customConstraints}`);
     ...assemblyId && { assemblyId }
   };
 }
+function synthesizeOneThing(card, subtasks, links) {
+  if (card.done)
+    return null;
+  const blockers = links.filter((l) => l.display_type === "is_blocked_by" && l.direction === "incoming");
+  if (blockers.length > 0) {
+    const blocker = blockers[0];
+    return `Unblock first: resolve #${blocker.target_card.short_id} "${blocker.target_card.title}" which is blocking this card.`;
+  }
+  if (subtasks.length > 0) {
+    const completed = subtasks.filter((s) => s.completed).length;
+    if (completed === subtasks.length) {
+      return "All subtasks completed. Review the work and mark the card as done.";
+    }
+    const nextSubtask = subtasks.find((s) => !s.completed);
+    if (nextSubtask) {
+      return `Work on next subtask: "${nextSubtask.title}" (${completed}/${subtasks.length} done).`;
+    }
+  }
+  if (card.due_date && (card.priority === "urgent" || card.priority === "high")) {
+    return `High-priority task with deadline ${card.due_date}. Start implementation immediately.`;
+  }
+  if (card.description) {
+    return "Analyze the description, identify the approach, and begin implementation.";
+  }
+  return null;
+}
 
 // src/server.ts
 var TOOLS = {
@@ -27834,7 +28029,8 @@ var TOOLS = {
             "commitment",
             "lesson",
             "project",
-            "handoff"
+            "handoff",
+            "procedure"
           ],
           description: "Entity type (default: context)"
         },
@@ -27893,7 +28089,8 @@ var TOOLS = {
             "commitment",
             "lesson",
             "project",
-            "handoff"
+            "handoff",
+            "procedure"
           ],
           description: "Filter by entity type"
         },
@@ -27953,7 +28150,8 @@ var TOOLS = {
             "commitment",
             "lesson",
             "project",
-            "handoff"
+            "handoff",
+            "procedure"
           ],
           description: "New entity type"
         },
@@ -28051,7 +28249,8 @@ var TOOLS = {
             "commitment",
             "lesson",
             "project",
-            "handoff"
+            "handoff",
+            "procedure"
           ],
           description: "Filter results by entity type"
         },
@@ -28096,7 +28295,8 @@ var TOOLS = {
             "commitment",
             "lesson",
             "project",
-            "handoff"
+            "handoff",
+            "procedure"
           ],
           description: "Filter by entity type"
         },
@@ -28683,7 +28883,7 @@ async function handleToolCall(name, args, deps) {
   };
   switch (name) {
     case "harmony_create_card": {
-      const title = exports_external.string().min(1).parse(args.title);
+      const title = exports_external.string().min(1).max(500).parse(args.title);
       const projectId = args.projectId || getProjectId();
       const result = await client3.createCard(projectId, {
         title,
@@ -28709,7 +28909,8 @@ async function handleToolCall(name, args, deps) {
     case "harmony_move_card": {
       const cardId = exports_external.string().uuid().parse(args.cardId);
       const columnId = exports_external.string().uuid().parse(args.columnId);
-      const result = await client3.moveCard(cardId, columnId, args.position);
+      const position = args.position !== undefined ? exports_external.number().int().min(0).parse(args.position) : undefined;
+      const result = await client3.moveCard(cardId, columnId, position);
       let sessionEnded = false;
       try {
         const { card } = result;
@@ -28754,7 +28955,7 @@ async function handleToolCall(name, args, deps) {
       return { success: true, ...result };
     }
     case "harmony_search_cards": {
-      const query = exports_external.string().min(1).parse(args.query);
+      const query = exports_external.string().min(1).max(500).parse(args.query);
       const result = await client3.searchCards(query, {
         projectId: args.projectId
       });
@@ -28772,14 +28973,14 @@ async function handleToolCall(name, args, deps) {
       return { success: true, ...result };
     }
     case "harmony_create_column": {
-      const name2 = exports_external.string().min(1).parse(args.name);
+      const name2 = exports_external.string().min(1).max(100).parse(args.name);
       const projectId = args.projectId || getProjectId();
       const result = await client3.createColumn(projectId, name2);
       return { success: true, ...result };
     }
     case "harmony_update_column": {
       const columnId = exports_external.string().uuid().parse(args.columnId);
-      const name2 = exports_external.string().min(1).parse(args.name);
+      const name2 = exports_external.string().min(1).max(100).parse(args.name);
       const result = await client3.updateColumn(columnId, name2);
       return { success: true, ...result };
     }
@@ -28789,7 +28990,7 @@ async function handleToolCall(name, args, deps) {
       return { success: true };
     }
     case "harmony_create_label": {
-      const name2 = exports_external.string().min(1).parse(args.name);
+      const name2 = exports_external.string().min(1).max(50).parse(args.name);
       const color = exports_external.string().regex(/^#[0-9a-fA-F]{6}$/).parse(args.color);
       const projectId = args.projectId || getProjectId();
       const board = await client3.getBoard(projectId, { summary: true });
@@ -28831,7 +29032,7 @@ async function handleToolCall(name, args, deps) {
     }
     case "harmony_create_subtask": {
       const cardId = exports_external.string().uuid().parse(args.cardId);
-      const title = exports_external.string().min(1).parse(args.title);
+      const title = exports_external.string().min(1).max(500).parse(args.title);
       const result = await client3.createSubtask(cardId, title);
       return { success: true, ...result };
     }
@@ -28895,7 +29096,7 @@ async function handleToolCall(name, args, deps) {
       };
     }
     case "harmony_process_command": {
-      const command = exports_external.string().min(1).parse(args.command);
+      const command = exports_external.string().min(1).max(500).parse(args.command);
       const result = await client3.processNLU({
         command,
         projectId: args.projectId || deps.getActiveProjectId() || undefined,
@@ -28907,8 +29108,8 @@ async function handleToolCall(name, args, deps) {
     }
     case "harmony_start_agent_session": {
       const cardId = exports_external.string().uuid().parse(args.cardId);
-      const agentIdentifier = exports_external.string().min(1).parse(args.agentIdentifier);
-      const agentName = exports_external.string().min(1).parse(args.agentName);
+      const agentIdentifier = exports_external.string().min(1).max(100).parse(args.agentIdentifier);
+      const agentName = exports_external.string().min(1).max(100).parse(args.agentName);
       const moveToColumn = args.moveToColumn;
       const addLabels = args.addLabels;
       let movedTo = null;
@@ -29007,13 +29208,14 @@ async function handleToolCall(name, args, deps) {
     }
     case "harmony_update_agent_progress": {
       const cardId = exports_external.string().uuid().parse(args.cardId);
-      const agentIdentifier = exports_external.string().min(1).parse(args.agentIdentifier);
-      const agentName = exports_external.string().min(1).parse(args.agentName);
+      const agentIdentifier = exports_external.string().min(1).max(100).parse(args.agentIdentifier);
+      const agentName = exports_external.string().min(1).max(100).parse(args.agentName);
+      const progressPercent = args.progressPercent !== undefined ? exports_external.number().min(0).max(100).parse(args.progressPercent) : undefined;
       const result = await client3.updateAgentProgress(cardId, {
         agentIdentifier,
         agentName,
         status: args.status,
-        progressPercent: args.progressPercent,
+        progressPercent,
         currentTask: args.currentTask,
         blockers: args.blockers,
         estimatedMinutesRemaining: args.estimatedMinutesRemaining
@@ -29030,7 +29232,7 @@ async function handleToolCall(name, args, deps) {
           currentTask: args.currentTask,
           status: args.status,
           blockers: args.blockers,
-          progressPercent: args.progressPercent
+          progressPercent
         });
         midSessionLearnings = midResult.count;
       } catch {}
@@ -29040,19 +29242,27 @@ async function handleToolCall(name, args, deps) {
       const cardId = exports_external.string().uuid().parse(args.cardId);
       const moveToColumn = args.moveToColumn;
       const sessionStatus = args.status || "completed";
+      const endProgressPercent = args.progressPercent !== undefined ? exports_external.number().min(0).max(100).parse(args.progressPercent) : undefined;
       const result = await client3.endAgentSession(cardId, {
         status: sessionStatus,
-        progressPercent: args.progressPercent
+        progressPercent: endProgressPercent
       });
       let movedTo = null;
       let learningsExtracted = 0;
       let cardTitle = "";
       let cardLabels = [];
+      let cardDescription = "";
+      let cardSubtasks = [];
       try {
         const { card } = await client3.getCard(cardId);
         const typedCard = card;
         cardTitle = typedCard.title || "";
         cardLabels = (typedCard.labels || []).map((l) => l.name);
+        cardDescription = typedCard.description || "";
+        cardSubtasks = (typedCard.subtasks || []).map((s) => ({
+          title: s.title,
+          done: s.done
+        }));
         const projectId = typedCard.project_id;
         if (moveToColumn && projectId) {
           const board = await client3.getBoard(projectId, {
@@ -29068,6 +29278,13 @@ async function handleToolCall(name, args, deps) {
       } catch {}
       try {
         const session = result.session;
+        let sessionDurationMs;
+        if (session?.created_at) {
+          const startTime = new Date(session.created_at).getTime();
+          if (!Number.isNaN(startTime)) {
+            sessionDurationMs = Date.now() - startTime;
+          }
+        }
         const sessionContext = {
           cardId,
           cardTitle,
@@ -29075,9 +29292,12 @@ async function handleToolCall(name, args, deps) {
           agentIdentifier: session?.agent_identifier || "unknown",
           agentName: session?.agent_name || "Unknown Agent",
           status: sessionStatus,
-          progressPercent: args.progressPercent,
+          progressPercent: endProgressPercent,
           blockers: session?.blockers || undefined,
-          currentTask: session?.current_task || undefined
+          currentTask: session?.current_task || undefined,
+          sessionDurationMs,
+          cardDescription: cardDescription || undefined,
+          cardSubtasks: cardSubtasks.length > 0 ? cardSubtasks : undefined
         };
         const learningResult = await extractLearnings(client3, sessionContext);
         learningsExtracted = learningResult.count;
@@ -29085,7 +29305,7 @@ async function handleToolCall(name, args, deps) {
       let feedbackAdjusted = 0;
       try {
         const session = result.session;
-        const feedbackResult = await recordContextFeedback(client3, cardId, sessionStatus, args.progressPercent, (session?.blockers?.length ?? 0) > 0);
+        const feedbackResult = await recordContextFeedback(client3, cardId, sessionStatus, endProgressPercent, (session?.blockers?.length ?? 0) > 0);
         feedbackAdjusted = feedbackResult.adjusted;
       } catch {}
       let maintenanceResult;
@@ -29233,8 +29453,8 @@ async function handleToolCall(name, args, deps) {
       };
     }
     case "harmony_remember": {
-      const title = exports_external.string().min(1).parse(args.title);
-      const content = exports_external.string().min(1).parse(args.content);
+      const title = exports_external.string().min(1).max(300).parse(args.title);
+      const content = exports_external.string().min(1).max(50000).parse(args.content);
       const workspaceId = args.workspaceId || deps.getActiveWorkspaceId();
       if (!workspaceId) {
         throw new Error("No workspace specified. Use harmony_set_workspace_context or provide workspaceId.");
@@ -29250,7 +29470,7 @@ async function handleToolCall(name, args, deps) {
         title,
         content,
         metadata: args.metadata,
-        confidence: args.confidence,
+        confidence: args.confidence !== undefined ? exports_external.number().min(0).max(1).parse(args.confidence) : undefined,
         tags: entityTags.length > 0 ? entityTags : undefined,
         agent_identifier: "claude-code"
       });
@@ -29334,9 +29554,9 @@ async function handleToolCall(name, args, deps) {
       const entityId = exports_external.string().uuid().parse(args.entityId);
       const updates = {};
       if (args.title !== undefined)
-        updates.title = args.title;
+        updates.title = exports_external.string().min(1).max(300).parse(args.title);
       if (args.content !== undefined)
-        updates.content = args.content;
+        updates.content = exports_external.string().max(50000).parse(args.content);
       if (args.type !== undefined)
         updates.type = args.type;
       if (args.scope !== undefined)
@@ -29344,7 +29564,7 @@ async function handleToolCall(name, args, deps) {
       if (args.tags !== undefined)
         updates.tags = args.tags;
       if (args.confidence !== undefined)
-        updates.confidence = args.confidence;
+        updates.confidence = exports_external.number().min(0).max(1).parse(args.confidence);
       if (args.metadata !== undefined)
         updates.metadata = args.metadata;
       const result = await client3.updateMemoryEntity(entityId, updates);
@@ -29372,12 +29592,12 @@ async function handleToolCall(name, args, deps) {
         source_id: sourceId,
         target_id: targetId,
         relation_type: relationType,
-        confidence: args.confidence
+        confidence: args.confidence !== undefined ? exports_external.number().min(0).max(1).parse(args.confidence) : undefined
       });
       return { success: true, ...result };
     }
     case "harmony_memory_search": {
-      const query = exports_external.string().min(1).parse(args.query);
+      const query = exports_external.string().min(1).max(500).parse(args.query);
       const workspaceId = args.workspaceId || deps.getActiveWorkspaceId();
       if (!workspaceId) {
         throw new Error("No workspace specified. Use harmony_set_workspace_context or provide workspaceId.");
@@ -29474,7 +29694,7 @@ async function handleToolCall(name, args, deps) {
       };
     }
     case "harmony_create_plan": {
-      const title = exports_external.string().min(1).parse(args.title);
+      const title = exports_external.string().min(1).max(200).parse(args.title);
       const projectId = args.projectId || getProjectId();
       const result = await client3.createPlan(projectId, {
         title,
@@ -29521,7 +29741,7 @@ async function handleToolCall(name, args, deps) {
       const planId = exports_external.string().uuid().parse(args.planId);
       const updates = {};
       if (args.title !== undefined)
-        updates.title = exports_external.string().min(1).parse(args.title);
+        updates.title = exports_external.string().min(1).max(200).parse(args.title);
       if (args.content !== undefined)
         updates.content = args.content;
       if (args.status !== undefined) {
@@ -29661,7 +29881,7 @@ async function handleToolCall(name, args, deps) {
     }
     case "harmony_debug_context": {
       const entityId = exports_external.string().uuid().parse(args.entityId);
-      const taskContext = exports_external.string().min(1).parse(args.taskContext);
+      const taskContext = exports_external.string().min(1).max(2000).parse(args.taskContext);
       const cardLabels = args.cardLabels || [];
       const entityResult = await client3.getMemoryEntity(entityId);
       const entity = mapToContextEntity(entityResult.entity);
@@ -29875,7 +30095,7 @@ async function handleToolCall(name, args, deps) {
       const entityId = exports_external.string().uuid().parse(args.entityId);
       const action = exports_external.enum(["approve", "reject"]).parse(args.action);
       if (action === "approve") {
-        await approveLearning(client3, entityId, args.confidence);
+        await approveLearning(client3, entityId, args.confidence !== undefined ? exports_external.number().min(0).max(1).parse(args.confidence) : undefined);
         return {
           success: true,
           action: "approved",
@@ -29890,7 +30110,7 @@ async function handleToolCall(name, args, deps) {
       };
     }
     case "harmony_get_context_manifest": {
-      const assemblyId = exports_external.string().min(1).parse(args.assemblyId);
+      const assemblyId = exports_external.string().min(1).max(100).parse(args.assemblyId);
       const manifest = getCachedManifest(assemblyId);
       if (!manifest) {
         throw new Error(`Manifest not found for assembly '${assemblyId}'. Manifests are cached in-memory and expire after server restart.`);
@@ -29909,7 +30129,7 @@ async function handleToolCall(name, args, deps) {
     case "harmony_promote_memory": {
       const entityId = exports_external.string().uuid().parse(args.entityId);
       const targetTier = exports_external.enum(["episode", "reference"]).parse(args.targetTier);
-      const reason = exports_external.string().min(1).parse(args.reason);
+      const reason = exports_external.string().min(1).max(500).parse(args.reason);
       const entityResult = await client3.getMemoryEntity(entityId);
       const entity = entityResult.entity;
       const currentTier = entity.memory_tier || "reference";
@@ -29936,9 +30156,9 @@ async function handleToolCall(name, args, deps) {
       };
     }
     case "harmony_signup": {
-      const email3 = exports_external.string().email().parse(args.email);
-      const password = exports_external.string().min(8).parse(args.password);
-      const fullName = exports_external.string().min(1).parse(args.fullName);
+      const email3 = exports_external.string().email().max(254).parse(args.email);
+      const password = exports_external.string().min(8).max(128).parse(args.password);
+      const fullName = exports_external.string().min(1).max(100).parse(args.fullName);
       const apiUrl = deps.getApiUrl();
       const result = await signupUser(apiUrl, {
         email: email3,
@@ -29952,7 +30172,7 @@ async function handleToolCall(name, args, deps) {
       };
     }
     case "harmony_create_workspace": {
-      const name2 = exports_external.string().min(1).parse(args.name);
+      const name2 = exports_external.string().min(1).max(100).parse(args.name);
       const result = await client3.createWorkspace({
         name: name2,
         description: args.description
@@ -29961,7 +30181,7 @@ async function handleToolCall(name, args, deps) {
     }
     case "harmony_create_project": {
       const workspaceId = exports_external.string().uuid().parse(args.workspaceId);
-      const name2 = exports_external.string().min(1).parse(args.name);
+      const name2 = exports_external.string().min(1).max(100).parse(args.name);
       const result = await client3.createProject({
         workspaceId,
         name: name2,
@@ -29973,7 +30193,7 @@ async function handleToolCall(name, args, deps) {
     }
     case "harmony_send_invitations": {
       const workspaceId = exports_external.string().uuid().parse(args.workspaceId);
-      const emails = exports_external.array(exports_external.string().email()).min(1).parse(args.emails);
+      const emails = exports_external.array(exports_external.string().email().max(254)).min(1).parse(args.emails);
       const result = await client3.sendInvitations({
         workspaceId,
         emails,
@@ -29983,14 +30203,14 @@ async function handleToolCall(name, args, deps) {
       return { success: true, ...result };
     }
     case "harmony_generate_api_key": {
-      const name2 = exports_external.string().min(1).parse(args.name);
+      const name2 = exports_external.string().min(1).max(100).parse(args.name);
       const result = await client3.generateApiKey(name2);
       return { success: true, ...result };
     }
     case "harmony_onboard": {
-      const email3 = exports_external.string().email().parse(args.email);
-      const password = exports_external.string().min(8).parse(args.password);
-      const fullName = exports_external.string().min(1).parse(args.fullName);
+      const email3 = exports_external.string().email().max(254).parse(args.email);
+      const password = exports_external.string().min(8).max(128).parse(args.password);
+      const fullName = exports_external.string().min(1).max(100).parse(args.fullName);
       const workspaceName = args.workspaceName || `${fullName}'s Workspace`;
       const projectName = args.projectName || "My First Project";
       const template = args.template || "kanban";