@starasia/task-management-mcp 1.0.2 → 1.1.0

package/dist/tools.js

@@ -1,5 +1,8 @@
+import { randomBytes } from "node:crypto";
+import { createServer, } from "node:http";
 import { z } from "zod";
 import { TaskManagementApiError } from "./api.js";
+import { SsoApiError } from "./sso-api.js";
 import { categorySchema, dryRunSchema, paginationSchema, prioritySchema, } from "./schemas.js";
 const json = (data) => ({
     content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
@@ -45,16 +48,105 @@ function resolveUserId(bearerToken, userId) {
         return jwtSubject;
     throw new Error("Unable to derive userId from bearer token JWT subject. Provide userId explicitly or use a JWT access token with a string sub claim.");
 }
-const authStatus = (context) => ({
+const authStatus = (context, pendingSsoSession) => ({
     configured: Boolean(context),
     environment: context?.environment,
     userId: context?.userId,
     organizationId: context?.organizationId,
     hasToken: Boolean(context?.bearerToken),
     expiresAt: context?.expiresAt,
+    ...(pendingSsoSession
+        ? {
+            pendingSsoOrganizationSelection: true,
+            pendingOrganizationCount: pendingSsoSession.organizations.length,
+        }
+        : {}),
 });
-export function registerTools(server, api, maxBulkSize, authTtlMs) {
-    let activeContext;
+function publicOrganization(option) {
+    return {
+        id: option.id,
+        name: option.name,
+        isActive: option.isActive,
+        application: option.application,
+        role: option.role,
+    };
+}
+function normalizeOrganizationName(value) {
+    return value
+        .toLowerCase()
+        .normalize("NFKD")
+        .replace(/[\u0300-\u036f]/g, "")
+        .replace(/[^a-z0-9\s]/g, " ")
+        .split(/\s+/)
+        .filter((part) => part && !["pt", "tbk", "cv", "inc", "ltd"].includes(part))
+        .join(" ")
+        .trim();
+}
+function organizationMatchScore(input, option) {
+    const query = normalizeOrganizationName(input);
+    const target = normalizeOrganizationName(option.name);
+    if (!query || !target)
+        return 0;
+    if (query === target)
+        return 100;
+    if (target.includes(query))
+        return 90 + Math.min(9, query.length / 4);
+    if (query.includes(target))
+        return 85;
+    const queryTokens = new Set(query.split(" ").filter(Boolean));
+    const targetTokens = new Set(target.split(" ").filter(Boolean));
+    if (!queryTokens.size || !targetTokens.size)
+        return 0;
+    let matches = 0;
+    for (const token of queryTokens) {
+        if (targetTokens.has(token) ||
+            [...targetTokens].some((targetToken) => targetToken.startsWith(token) ||
+                token.startsWith(targetToken) ||
+                levenshteinDistance(token, targetToken) <= 1))
+            matches += 1;
+    }
+    return (matches / queryTokens.size) * 80;
+}
+function levenshteinDistance(a, b) {
+    const dp = Array.from({ length: a.length + 1 }, (_, index) => [index]);
+    for (let j = 1; j <= b.length; j += 1)
+        dp[0][j] = j;
+    for (let i = 1; i <= a.length; i += 1) {
+        for (let j = 1; j <= b.length; j += 1) {
+            dp[i][j] = Math.min(dp[i - 1][j] + 1, dp[i][j - 1] + 1, dp[i - 1][j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+        }
+    }
+    return dp[a.length][b.length];
+}
+function matchOrganization(organizations, input) {
+    const organizationId = input.organizationId?.trim();
+    if (organizationId) {
+        return { selected: organizations.find((org) => org.id === organizationId) };
+    }
+    const organizationName = input.organizationName?.trim();
+    if (!organizationName)
+        return {};
+    const scored = organizations
+        .map((org) => ({
+        org,
+        score: organizationMatchScore(organizationName, org),
+    }))
+        .filter((item) => item.score >= 55)
+        .sort((a, b) => b.score - a.score);
+    if (!scored.length)
+        return {};
+    const [best, second] = scored;
+    if (second && best.score - second.score < 12) {
+        return { ambiguous: scored.slice(0, 5).map((item) => item.org) };
+    }
+    return { selected: best.org };
+}
+export function registerTools(server, api, ssoApi, hrisApi, options) {
+    const { maxBulkSize, authTtlMs, defaultSsoClientId, authStore, webLogin } = options;
+    let activeContext = authStore.load();
+    let pendingSsoSession;
+    const webSsoSessions = new Map();
+    const webLoginServerState = {};
     const requireContext = () => {
         if (!activeContext) {
             throw new Error("Authentication context is not configured. Ask the user for bearerToken and organizationId, then call set_auth_context first. userId is derived from the token JWT sub claim unless explicitly provided.");
@@ -65,6 +157,550 @@ export function registerTools(server, api, maxBulkSize, authTtlMs) {
         }
         return activeContext;
     };
+    const validateAndActivateContext = async (nextContext, validate) => {
+        if (validate) {
+            try {
+                await api.get("spaces", undefined, nextContext);
+            }
+            catch (error) {
+                if (error instanceof TaskManagementApiError) {
+                    throw new Error(`Auth context validation failed with API status ${error.status}. Verify the SSO token, selected organization, derived userId, and environment-specific Task Management API URL.`, { cause: error });
+                }
+                throw error;
+            }
+        }
+        activeContext = nextContext;
+        authStore.save(nextContext);
+        return activeContext;
+    };
+    const listHrisOrganizations = async (bearerToken) => {
+        const organizations = await hrisApi.listSwitchOrganizations({ bearerToken });
+        if (!organizations.length) {
+            throw new Error("No active HRIS organization was found for this user.");
+        }
+        return organizations;
+    };
+    const exchangeForTaskManagementAccessToken = async (input) => {
+        if (!input.sessionId || !input.secret) {
+            throw new Error("Task Management access-token exchange requires a web handoff session.");
+        }
+        const tokenResult = await ssoApi.exchangeTaskManagementMcpAccessToken({
+            sessionId: input.sessionId,
+            secret: input.secret,
+            clientId: input.clientId,
+            organizationId: input.organizationId,
+        });
+        if (!tokenResult.accessToken) {
+            throw new Error("SSO API did not return a Task Management access token.");
+        }
+        return tokenResult;
+    };
+    const buildWebLoginUrl = (session) => {
+        if (webLogin.publicBaseUrl) {
+            const url = new URL("/login", webLogin.publicBaseUrl.replace(/\/$/, "") + "/");
+            url.searchParams.set("clientId", session.clientId);
+            url.searchParams.set("mcpSessionId", session.id);
+            if (session.handoffSecret)
+                url.searchParams.set("mcpSecret", session.handoffSecret);
+            url.searchParams.set("mcpTarget", "task-management");
+            if (session.environment)
+                url.searchParams.set("environment", session.environment);
+            return url.toString();
+        }
+        const baseUrl = webLoginServerState.baseUrl;
+        if (!baseUrl)
+            throw new Error("Web login server is not ready.");
+        return `${baseUrl.replace(/\/$/, "")}/task-management-mcp/sso-login/${encodeURIComponent(session.id)}`;
+    };
+    const ensureWebLoginServer = async () => {
+        if (webLoginServerState.server && webLoginServerState.baseUrl)
+            return;
+        const httpServer = createServer((request, response) => {
+            handleWebLoginRequest(request, response).catch((error) => {
+                response.statusCode = 500;
+                response.setHeader("Content-Type", "text/html; charset=utf-8");
+                response.end(renderPage("Login failed", `<p>${escapeHtml(errorMessage(error))}</p>`));
+            });
+        });
+        await new Promise((resolve) => httpServer.listen(webLogin.port, webLogin.host, resolve));
+        const address = httpServer.address();
+        const actualPort = typeof address === "object" && address
+            ? address.port
+            : webLogin.port;
+        webLoginServerState.server = httpServer;
+        webLoginServerState.baseUrl =
+            webLogin.publicBaseUrl?.replace(/\/$/, "") ??
+                `http://${webLogin.host}:${actualPort}`;
+    };
+    const handleWebLoginRequest = async (request, response) => {
+        const url = new URL(request.url ?? "/", "http://127.0.0.1");
+        const match = /^\/task-management-mcp\/sso-login\/([^/]+)$/.exec(url.pathname);
+        if (!match) {
+            response.statusCode = 404;
+            response.end("Not Found");
+            return;
+        }
+        const sessionId = decodeURIComponent(match[1]);
+        const session = webSsoSessions.get(sessionId);
+        if (!session || new Date(session.expiresAt).getTime() <= Date.now()) {
+            webSsoSessions.delete(sessionId);
+            response.statusCode = 410;
+            response.setHeader("Content-Type", "text/html; charset=utf-8");
+            response.end(renderPage("Login expired", "<p>This login link is expired. Ask the agent for a new login link.</p>"));
+            return;
+        }
+        if (request.method === "GET") {
+            response.setHeader("Content-Type", "text/html; charset=utf-8");
+            response.end(renderWebSession(session));
+            return;
+        }
+        if (request.method !== "POST") {
+            response.statusCode = 405;
+            response.end("Method Not Allowed");
+            return;
+        }
+        const form = new URLSearchParams(await readRequestBody(request));
+        try {
+            if (session.status === "pending") {
+                const email = form.get("email")?.trim() ?? "";
+                const password = form.get("password") ?? "";
+                if (!email || !password)
+                    throw new Error("Email and password are required.");
+                const loginResult = await ssoApi.login({
+                    email,
+                    password,
+                    clientId: session.clientId,
+                    mode: "web",
+                });
+                if (loginResult.requirePasswordChange) {
+                    throw new Error("SSO requires a password change before MCP login can continue.");
+                }
+                if (!loginResult.authToken)
+                    throw new Error("SSO login did not return an authToken.");
+                const userId = resolveUserId(loginResult.authToken);
+                const organizations = await listHrisOrganizations(loginResult.authToken);
+                session.bearerToken = loginResult.authToken;
+                session.userId = userId;
+                if (!webLogin.publicBaseUrl && session.handoffSecret) {
+                    await ssoApi.completeTaskManagementMcpHandoff({
+                        sessionId: session.id,
+                        secret: session.handoffSecret,
+                        authToken: loginResult.authToken,
+                    });
+                }
+                session.organizations = organizations;
+                if (organizations.length === 1) {
+                    await completeWebSession(session, organizations[0]);
+                }
+                else {
+                    session.status = "organization_selection";
+                }
+            }
+            else if (session.status === "organization_selection") {
+                const organizationId = form.get("organizationId")?.trim();
+                const selected = session.organizations?.find((org) => org.id === organizationId);
+                if (!selected)
+                    throw new Error("Selected organization is not available for this login session.");
+                await completeWebSession(session, selected);
+            }
+            response.setHeader("Content-Type", "text/html; charset=utf-8");
+            response.end(renderWebSession(session));
+        }
+        catch (error) {
+            session.status = "failed";
+            session.error = errorMessage(error);
+            response.statusCode = 400;
+            response.setHeader("Content-Type", "text/html; charset=utf-8");
+            response.end(renderWebSession(session));
+        }
+    };
+    const completeWebSession = async (session, selectedOrganization) => {
+        if (!session.bearerToken || !session.userId) {
+            throw new Error("Web SSO session is missing token context.");
+        }
+        const tokenResult = await exchangeForTaskManagementAccessToken({
+            sessionId: session.id,
+            secret: session.handoffSecret,
+            clientId: session.clientId,
+            organizationId: selectedOrganization.id,
+        });
+        session.status = "completed";
+        session.selectedOrganization = selectedOrganization;
+        session.context = {
+            bearerToken: tokenResult.accessToken,
+            userId: tokenResult.userId ?? session.userId,
+            organizationId: selectedOrganization.id,
+            environment: session.environment,
+            expiresAt: new Date(Date.now() + authTtlMs).toISOString(),
+        };
+    };
+    server.registerTool("start_web_sso_login", {
+        title: "Start Web SSO Login",
+        description: "Create a short-lived HTTPS/web login handoff URL so chat users can enter SSO email/password in a masked browser form instead of the agent chat. The returned link contains no token.",
+        inputSchema: {
+            clientId: z.string().min(1).optional(),
+            environment: z.string().optional(),
+            validate: z.boolean().default(true).optional(),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: true,
+        },
+    }, async (args) => {
+        const clientId = args.clientId?.trim() || defaultSsoClientId?.trim();
+        if (!clientId) {
+            throw new Error("TASK_MANAGEMENT_SSO_CLIENT_ID is not configured. Set it to the Task Management module client ID from SSO, or pass clientId explicitly.");
+        }
+        if (!webLogin.publicBaseUrl)
+            await ensureWebLoginServer();
+        const sessionId = randomBytes(18).toString("base64url");
+        const handoffSecret = randomBytes(32).toString("base64url");
+        const expiresAt = new Date(Date.now() + webLogin.ttlMs).toISOString();
+        const session = {
+            id: sessionId,
+            clientId,
+            environment: args.environment,
+            expiresAt,
+            validate: args.validate ?? true,
+            status: "pending",
+            handoffSecret,
+        };
+        webSsoSessions.set(sessionId, session);
+        return json({
+            sessionId,
+            loginUrl: buildWebLoginUrl(session),
+            expiresAt,
+            status: "pending",
+            message: "Open the loginUrl in a browser/Telegram WebView. Do not ask the user to paste their password into chat.",
+        });
+    });
+    server.registerTool("check_web_sso_login", {
+        title: "Check Web SSO Login",
+        description: "Check a pending web SSO login session. When completed, validates and activates the Task Management auth context without returning the token.",
+        inputSchema: {
+            sessionId: z.string().min(1),
+            validate: z.boolean().optional(),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: true,
+        },
+    }, async (args) => {
+        const session = webSsoSessions.get(args.sessionId);
+        if (!session)
+            return json({ status: "not_found", configured: false });
+        if (new Date(session.expiresAt).getTime() <= Date.now()) {
+            webSsoSessions.delete(args.sessionId);
+            return json({ status: "expired", configured: false });
+        }
+        if (session.status === "completed" && session.context && session.selectedOrganization) {
+            const validate = args.validate ?? session.validate;
+            const context = await validateAndActivateContext(session.context, validate);
+            webSsoSessions.delete(args.sessionId);
+            return json({
+                status: "completed",
+                ...authStatus(context),
+                selectedOrganization: publicOrganization(session.selectedOrganization),
+                validated: validate,
+            });
+        }
+        if (session.handoffSecret) {
+            const handoff = await ssoApi.consumeTaskManagementMcpHandoff({
+                sessionId: session.id,
+                secret: session.handoffSecret,
+            });
+            if (handoff.status !== "completed") {
+                return json({
+                    status: "pending",
+                    configured: false,
+                    expiresAt: session.expiresAt,
+                });
+            }
+            if (!handoff.authToken || !handoff.userId) {
+                throw new Error("Completed MCP handoff is missing token context.");
+            }
+            const expiresAt = handoff.expiresAt ?? session.expiresAt;
+            const validate = args.validate ?? session.validate;
+            if (handoff.organizationId && handoff.organizationName) {
+                const selectedOrganization = {
+                    id: handoff.organizationId,
+                    name: handoff.organizationName,
+                };
+                const tokenResult = await exchangeForTaskManagementAccessToken({
+                    sessionId: session.id,
+                    secret: session.handoffSecret,
+                    clientId: session.clientId,
+                    organizationId: handoff.organizationId,
+                });
+                const context = await validateAndActivateContext({
+                    bearerToken: tokenResult.accessToken,
+                    userId: tokenResult.userId ?? handoff.userId,
+                    organizationId: handoff.organizationId,
+                    environment: session.environment,
+                    expiresAt,
+                }, validate);
+                webSsoSessions.delete(args.sessionId);
+                return json({
+                    status: "completed",
+                    ...authStatus(context),
+                    selectedOrganization: publicOrganization(selectedOrganization),
+                    validated: validate,
+                });
+            }
+            const organizations = await listHrisOrganizations(handoff.authToken);
+            if (organizations.length === 1) {
+                const selectedOrganization = organizations[0];
+                const tokenResult = await exchangeForTaskManagementAccessToken({
+                    sessionId: session.id,
+                    secret: session.handoffSecret,
+                    clientId: session.clientId,
+                    organizationId: selectedOrganization.id,
+                });
+                const context = await validateAndActivateContext({
+                    bearerToken: tokenResult.accessToken,
+                    userId: tokenResult.userId ?? handoff.userId,
+                    organizationId: selectedOrganization.id,
+                    environment: session.environment,
+                    expiresAt,
+                }, validate);
+                webSsoSessions.delete(args.sessionId);
+                return json({
+                    status: "completed",
+                    ...authStatus(context),
+                    selectedOrganization: publicOrganization(selectedOrganization),
+                    validated: validate,
+                });
+            }
+            pendingSsoSession = {
+                bearerToken: handoff.authToken,
+                userId: handoff.userId,
+                clientId: session.clientId,
+                environment: session.environment,
+                organizations,
+                expiresAt,
+                validate,
+                handoffSessionId: session.id,
+                handoffSecret: session.handoffSecret,
+            };
+            webSsoSessions.delete(args.sessionId);
+            return json({
+                status: "organization_selection",
+                configured: false,
+                pendingSsoOrganizationSelection: true,
+                userId: handoff.userId,
+                organizationCount: organizations.length,
+                organizations: organizations.map(publicOrganization),
+                message: "Multiple HRIS organizations were found. Present the organization names to the user and call select_sso_organization with the typed organization name.",
+            });
+        }
+        if (session.status === "completed") {
+            if (!session.context || !session.selectedOrganization) {
+                throw new Error("Completed web SSO session is missing context.");
+            }
+            const validate = args.validate ?? session.validate;
+            const context = await validateAndActivateContext(session.context, validate);
+            webSsoSessions.delete(args.sessionId);
+            return json({
+                status: "completed",
+                ...authStatus(context),
+                selectedOrganization: publicOrganization(session.selectedOrganization),
+                validated: validate,
+            });
+        }
+        return json({
+            status: session.status,
+            configured: false,
+            expiresAt: session.expiresAt,
+            error: session.error,
+            ...(session.status === "organization_selection" && session.organizations
+                ? { organizations: session.organizations.map(publicOrganization) }
+                : {}),
+        });
+    });
+    server.registerTool("cancel_web_sso_login", {
+        title: "Cancel Web SSO Login",
+        description: "Cancel and forget a pending web SSO login handoff session.",
+        inputSchema: { sessionId: z.string().min(1) },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+    }, async (args) => {
+        const deleted = webSsoSessions.delete(args.sessionId);
+        return json({
+            status: deleted ? "cancelled" : "not_found",
+            configured: Boolean(activeContext),
+        });
+    });
+    server.registerTool("sso_login", {
+        title: "SSO Login",
+        description: "Authenticate through Starasia SSO using email and password, then list or auto-select organizations for Task Management. Prefer this over asking users for raw bearer tokens. Password and token stay in process memory and are never returned.",
+        inputSchema: {
+            email: z.string().email(),
+            password: z
+                .string()
+                .min(1)
+                .describe("SSO password supplied by the active user. Do not log or repeat it."),
+            clientId: z
+                .string()
+                .min(1)
+                .optional()
+                .describe("Optional override for the Task Management module SSO client ID. Defaults to TASK_MANAGEMENT_SSO_CLIENT_ID."),
+            environment: z.string().optional(),
+            validate: z
+                .boolean()
+                .default(true)
+                .optional()
+                .describe("When true, verify the final context with GET /spaces."),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: true,
+        },
+    }, async (args) => {
+        const clientId = args.clientId?.trim() || defaultSsoClientId?.trim();
+        if (!clientId) {
+            throw new Error("TASK_MANAGEMENT_SSO_CLIENT_ID is not configured. Set it to the Task Management module client ID from SSO, or pass clientId explicitly.");
+        }
+        let loginResult;
+        try {
+            loginResult = await ssoApi.login({
+                email: args.email,
+                password: args.password,
+                clientId,
+                mode: "web",
+            });
+        }
+        catch (error) {
+            if (error instanceof SsoApiError) {
+                throw new Error(`SSO login failed with status ${error.status}: ${error.message}`, {
+                    cause: error,
+                });
+            }
+            throw error;
+        }
+        if (loginResult.requirePasswordChange) {
+            throw new Error("SSO login requires a password change. Please update the password through SSO first, then retry MCP login.");
+        }
+        if (!loginResult.authToken) {
+            throw new Error("SSO login did not return an authToken.");
+        }
+        const userId = resolveUserId(loginResult.authToken);
+        const organizations = await listHrisOrganizations(loginResult.authToken);
+        const expiresAt = new Date(Date.now() + authTtlMs).toISOString();
+        const validate = args.validate ?? true;
+        if (organizations.length === 1) {
+            const selectedOrganization = organizations[0];
+            const context = await validateAndActivateContext({
+                bearerToken: loginResult.authToken,
+                userId,
+                organizationId: selectedOrganization.id,
+                environment: args.environment,
+                expiresAt,
+            }, validate);
+            pendingSsoSession = undefined;
+            return json({
+                ...authStatus(context),
+                selectedOrganization: publicOrganization(selectedOrganization),
+                validated: validate,
+            });
+        }
+        activeContext = undefined;
+        pendingSsoSession = {
+            bearerToken: loginResult.authToken,
+            userId,
+            clientId,
+            environment: args.environment,
+            organizations,
+            expiresAt,
+            validate,
+        };
+        return json({
+            configured: false,
+            pendingSsoOrganizationSelection: true,
+            userId,
+            organizationCount: organizations.length,
+            organizations: organizations.map(publicOrganization),
+            message: "Multiple organizations were found. Present the organization names to the user and call select_sso_organization with the typed organization name. Do not ask the user to copy an organization ID unless names are ambiguous.",
+        });
+    });
+    server.registerTool("select_sso_organization", {
+        title: "Select SSO Organization",
+        description: "Select an organization from the pending SSO login session. Prefer organizationName from natural user input; fuzzy matching handles close-but-not-exact names. organizationId is only an internal/expert fallback.",
+        inputSchema: {
+            organizationName: z.string().min(1).optional(),
+            organizationId: z.string().min(1).optional(),
+            validate: z.boolean().optional(),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: true,
+        },
+    }, async (args) => {
+        if (!pendingSsoSession) {
+            throw new Error("No pending SSO organization selection. Call sso_login first.");
+        }
+        if (new Date(pendingSsoSession.expiresAt).getTime() <= Date.now()) {
+            pendingSsoSession = undefined;
+            throw new Error("Pending SSO login expired. Call sso_login again.");
+        }
+        if (Boolean(args.organizationId) === Boolean(args.organizationName)) {
+            throw new Error("Provide exactly one of organizationName or organizationId. Prefer organizationName for user input.");
+        }
+        const match = matchOrganization(pendingSsoSession.organizations, {
+            organizationId: args.organizationId,
+            organizationName: args.organizationName,
+        });
+        if (match.ambiguous?.length) {
+            return json({
+                configured: false,
+                pendingSsoOrganizationSelection: true,
+                ambiguousOrganizations: match.ambiguous.map(publicOrganization),
+                message: "Several organizations look similar. Ask the user to clarify by organization name; do not ask them to copy an ID unless necessary.",
+            });
+        }
+        if (!match.selected) {
+            return json({
+                configured: false,
+                pendingSsoOrganizationSelection: true,
+                organizations: pendingSsoSession.organizations.map(publicOrganization),
+                message: "No organization matched that input. Ask the user to choose one of these organization names.",
+            });
+        }
+        const session = pendingSsoSession;
+        const validate = args.validate ?? session.validate;
+        const tokenResult = session.handoffSessionId && session.handoffSecret
+            ? await exchangeForTaskManagementAccessToken({
+                sessionId: session.handoffSessionId,
+                secret: session.handoffSecret,
+                clientId: session.clientId,
+                organizationId: match.selected.id,
+            })
+            : undefined;
+        const context = await validateAndActivateContext({
+            bearerToken: tokenResult?.accessToken ?? session.bearerToken,
+            userId: tokenResult?.userId ?? session.userId,
+            organizationId: match.selected.id,
+            environment: session.environment,
+            expiresAt: session.expiresAt,
+        }, validate);
+        pendingSsoSession = undefined;
+        return json({
+            ...authStatus(context),
+            selectedOrganization: publicOrganization(match.selected),
+            validated: validate,
+        });
+    });
     server.registerTool("set_auth_context", {
         title: "Set Auth Context",
         description: "Set the active user authentication context for this MCP process. Ask the user for bearerToken and organizationId before calling this tool. userId is derived from the token JWT sub claim unless explicitly provided. The token is kept only in process memory and is never returned.",
@@ -108,20 +744,10 @@ export function registerTools(server, api, maxBulkSize, authTtlMs) {
             environment: args.environment,
             expiresAt: new Date(Date.now() + authTtlMs).toISOString(),
         };
-        if (args.validate ?? true) {
-            try {
-                await api.get("spaces", undefined, nextContext);
-            }
-            catch (error) {
-                if (error instanceof TaskManagementApiError) {
-                    throw new Error(`Auth context validation failed with API status ${error.status}. Verify the bearer token, organizationId, derived/explicit userId, and environment-specific API URL.`, { cause: error });
-                }
-                throw error;
-            }
-        }
-        activeContext = nextContext;
+        const context = await validateAndActivateContext(nextContext, args.validate ?? true);
+        pendingSsoSession = undefined;
         return json({
-            ...authStatus(activeContext),
+            ...authStatus(context),
             validated: args.validate ?? true,
         });
     });
@@ -130,7 +756,7 @@ export function registerTools(server, api, maxBulkSize, authTtlMs) {
         description: "Return whether an auth context is configured. Never returns the bearer token.",
         inputSchema: {},
         annotations: { readOnlyHint: true, openWorldHint: false },
-    }, async () => json(authStatus(activeContext)));
+    }, async () => json(authStatus(activeContext, pendingSsoSession)));
     server.registerTool("clear_auth_context", {
         title: "Clear Auth Context",
         description: "Clear the active user authentication context from process memory.",
@@ -143,6 +769,9 @@ export function registerTools(server, api, maxBulkSize, authTtlMs) {
         },
     }, async () => {
         activeContext = undefined;
+        pendingSsoSession = undefined;
+        webSsoSessions.clear();
+        authStore.clear();
         return json(authStatus(activeContext));
     });
     server.registerTool("list_spaces", {
@@ -736,4 +1365,91 @@ function workloadByUser(tasks) {
 function isComplete(task) {
     return task.statusRef?.category === "Complete";
 }
+function readRequestBody(request) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        request.on("data", (chunk) => chunks.push(chunk));
+        request.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+        request.on("error", reject);
+    });
+}
+function renderWebSession(session) {
+    if (session.status === "completed") {
+        return renderPage("Login successful", `<div class="status-card success">
+        <p>Login berhasil untuk organisasi <strong>${escapeHtml(session.selectedOrganization?.name ?? "selected organization")}</strong>.</p>
+        <p class="muted">Silakan kembali ke chat agent.</p>
+      </div>`);
+    }
+    if (session.status === "organization_selection") {
+        const options = (session.organizations ?? [])
+            .map((org) => `<label class="option-card"><input type="radio" name="organizationId" value="${escapeHtml(org.id)}" required /><span>${escapeHtml(org.name)}</span></label>`)
+            .join("");
+        return renderPage("Choose organization", `<form method="post"><p class="muted">Pilih organisasi Task Management:</p><div class="options">${options}</div><button type="submit">Continue</button></form>`);
+    }
+    if (session.status === "failed") {
+        return renderPage("Login failed", `<div class="status-card error">
+        <p>${escapeHtml(session.error ?? "Login failed")}</p>
+        <p class="muted">Ask the agent for a new login link.</p>
+      </div>`);
+    }
+    return renderPage("Task Management SSO Login", `<form method="post" autocomplete="on">
+      <label>Email<input type="email" name="email" autocomplete="username" inputmode="email" required /></label>
+      <label>Password<input type="password" name="password" autocomplete="current-password" required /></label>
+      <button type="submit">Login</button>
+    </form>`);
+}
+function renderPage(title, body) {
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
+  <title>${escapeHtml(title)}</title>
+  <style>
+    :root { color-scheme: light; font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
+    * { box-sizing: border-box; }
+    html { min-height: 100%; background: #f8fafc; }
+    body { min-height: 100dvh; margin: 0; padding: max(1rem, env(safe-area-inset-top)) max(1rem, env(safe-area-inset-right)) max(1rem, env(safe-area-inset-bottom)) max(1rem, env(safe-area-inset-left)); color: #111827; display: grid; place-items: center; }
+    main { width: min(100%, 28rem); background: #ffffff; border: 1px solid #e5e7eb; border-radius: 1.25rem; box-shadow: 0 1.25rem 3rem rgba(15, 23, 42, 0.10); padding: clamp(1.25rem, 5vw, 2rem); }
+    h1 { margin: 0 0 1.25rem; font-size: clamp(1.5rem, 7vw, 2rem); line-height: 1.1; letter-spacing: -0.035em; }
+    form { display: grid; gap: 1rem; }
+    label { display: grid; gap: .45rem; font-size: .95rem; font-weight: 600; color: #374151; }
+    input { width: 100%; min-height: 3rem; padding: .8rem .9rem; border: 1px solid #d1d5db; border-radius: .8rem; color: #111827; background: #ffffff; font: inherit; font-size: 1rem; }
+    input:focus { outline: 3px solid rgba(17, 24, 39, .14); border-color: #111827; }
+    input[type="radio"] { width: 1.1rem; min-height: 1.1rem; margin: .15rem .7rem 0 0; flex: 0 0 auto; }
+    button { width: 100%; min-height: 3rem; padding: .85rem 1rem; border: 0; border-radius: .8rem; background: #111827; color: #ffffff; font: inherit; font-weight: 700; cursor: pointer; touch-action: manipulation; }
+    button:active { transform: translateY(1px); }
+    .muted { color: #6b7280; margin: 0 0 .75rem; line-height: 1.5; }
+    .options { display: grid; gap: .75rem; margin-bottom: .25rem; }
+    .option-card { display: flex; align-items: flex-start; gap: 0; padding: .9rem; border: 1px solid #e5e7eb; border-radius: .9rem; background: #f9fafb; line-height: 1.35; }
+    .status-card { border-radius: .9rem; padding: 1rem; line-height: 1.5; }
+    .status-card p { margin: 0 0 .5rem; }
+    .status-card p:last-child { margin-bottom: 0; }
+    .success { background: #ecfdf5; border: 1px solid #bbf7d0; }
+    .error { background: #fef2f2; border: 1px solid #fecaca; }
+    @media (max-width: 480px) {
+      body { align-items: stretch; padding: 0; background: #ffffff; }
+      main { min-height: 100dvh; width: 100%; border: 0; border-radius: 0; box-shadow: none; padding: max(1.25rem, env(safe-area-inset-top)) max(1rem, env(safe-area-inset-right)) max(1.25rem, env(safe-area-inset-bottom)) max(1rem, env(safe-area-inset-left)); display: flex; flex-direction: column; justify-content: center; }
+    }
+  </style>
+</head>
+<body>
+  <main>
+    <h1>${escapeHtml(title)}</h1>
+    ${body}
+  </main>
+</body>
+</html>`;
+}
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
 //# sourceMappingURL=tools.js.map