@taskforcehq/taskforce 0.3.305 → 0.3.307

package/dist/server/routes/tasks.js

@@ -56,10 +56,12 @@ import { resolveBuildInfo } from '../buildInfo.js';
 import { resolveRealtimeSyncFlag } from '../../sync/realtimeFeature.js';
 import { parseJsonBody } from './primitives.js';
 import { resolveRequestAccess } from '../auth.js';
-import { resolveErrorStatusCode, requestHeader, requestRuntimeMode } from './shared.js';
+import { getRouteTimingNow, logSlowBootstrapRoute, requestBootstrapTraceId, requestHeader, requestRuntimeMode, resolveErrorStatusCode, serializeJsonWithTiming, setServerTimingHeader } from './shared.js';
 import { listBuiltInCustomTaxonomyLibraryPacks } from '../../shared/customTaxonomyLibrary.js';
 import { listBuiltInTaxonomyLibraryPacks } from '../../shared/taxonomyLibrary.js';
 import { shouldUseProvisionalTaskReferences } from '../../utils/taskReferences.js';
+// === SECTION: Module dependency interface ===
+const UI_STATE_MAX_JSON_BODY_BYTES = 50 * 1024 * 1024;
 function createUiStateRequestId() {
     return `ui-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
 }
@@ -237,8 +239,9 @@ export function registerTaskRoutes(deps) {
         const requestId = createUiStateRequestId();
         const startedAt = Date.now();
         attachUiStateDebugHeaders(res, requestId);
-        const body = await parseJsonBody(req);
+        let body = {};
         try {
+            body = await parseJsonBody(req, UI_STATE_MAX_JSON_BODY_BYTES);
             const requestedWorkspaceId = String(body?.workspaceId || '').trim();
             let workspaceId = requestWorkspaceId(req);
             if (requestedWorkspaceId && requestRuntimeMode(req) === 'local') {
@@ -506,6 +509,48 @@ export function registerTaskRoutes(deps) {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify(data));
     });
+    // GET /api/taskforce/planning/bootstrap - List planning entities plus lightweight task summaries
+    addRoute('GET', '/api/taskforce/planning/bootstrap', async (req, res) => {
+        if (!ensureAppAccess(req, res))
+            return;
+        const startedAt = getRouteTimingNow();
+        const workspaceId = requestWorkspaceId(req);
+        const traceId = requestBootstrapTraceId(req);
+        const diagnostics = {};
+        const data = core.listPlanningBootstrap(workspaceId, diagnostics);
+        const serializeStartedAt = getRouteTimingNow();
+        const serialized = serializeJsonWithTiming(data, serializeStartedAt);
+        const totalDurationMs = Math.max(0, getRouteTimingNow() - startedAt);
+        const details = diagnostics;
+        setServerTimingHeader(res, [
+            { name: 'planning-bootstrap', durationMs: totalDurationMs },
+            { name: 'planning-bootstrap-initiatives', durationMs: details.initiativeLoadMs ?? 0 },
+            { name: 'planning-bootstrap-workstreams', durationMs: details.workstreamLoadMs ?? 0 },
+            { name: 'planning-bootstrap-tasks', durationMs: details.taskSummaryQueryMs ?? 0 },
+            { name: 'planning-bootstrap-build', durationMs: details.taskSummaryBuildMs ?? 0 },
+            { name: 'planning-bootstrap-json', durationMs: serialized.durationMs },
+        ]);
+        logSlowBootstrapRoute({
+            route: '/api/taskforce/planning/bootstrap',
+            workspaceId,
+            traceId,
+            durationMs: totalDurationMs,
+            details: {
+                initiativeCount: details.initiativeCount ?? 0,
+                workstreamCount: details.workstreamCount ?? 0,
+                workstreamLinkedTaskCount: details.workstreamLinkedTaskCount ?? 0,
+                workstreamTaskSummaryCount: details.workstreamTaskSummaryCount ?? 0,
+                responseBytes: serialized.byteLength,
+                initiativeLoadMs: details.initiativeLoadMs ?? 0,
+                workstreamLoadMs: details.workstreamLoadMs ?? 0,
+                taskSummaryQueryMs: details.taskSummaryQueryMs ?? 0,
+                taskSummaryBuildMs: details.taskSummaryBuildMs ?? 0,
+                jsonSerializeMs: serialized.durationMs,
+            },
+        });
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(serialized.body);
+    });
     // POST /api/taskforce/initiative - Create initiative
     addRoute('POST', '/api/taskforce/initiative', async (req, res) => {
         if (!ensureAppAccess(req, res))
@@ -513,7 +558,7 @@ export function registerTaskRoutes(deps) {
         const body = await parseJsonBody(req);
         try {
             const workspaceId = requestWorkspaceId(req);
-            const initiative = core.createInitiative(body || {}, workspaceId);
+            const initiative = core.createInitiative(body || {}, workspaceId, { actorRef: 'user' });
             res.writeHead(201, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify(initiative));
         }
@@ -545,7 +590,7 @@ export function registerTaskRoutes(deps) {
         const body = await parseJsonBody(req);
         try {
             const workspaceId = requestWorkspaceId(req);
-            const updated = core.updateInitiative(params.id, body || {}, workspaceId);
+            const updated = core.updateInitiative(params.id, body || {}, workspaceId, { actorRef: 'user' });
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify(updated));
         }
@@ -561,7 +606,7 @@ export function registerTaskRoutes(deps) {
             return;
         try {
             const workspaceId = requestWorkspaceId(req);
-            const archived = core.archiveInitiative(params.id, workspaceId);
+            const archived = core.archiveInitiative(params.id, workspaceId, { actorRef: 'user' });
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify(archived));
         }
@@ -577,7 +622,7 @@ export function registerTaskRoutes(deps) {
             return;
         try {
             const workspaceId = requestWorkspaceId(req);
-            const restored = core.unarchiveInitiative(params.id, workspaceId);
+            const restored = core.unarchiveInitiative(params.id, workspaceId, { actorRef: 'user' });
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify(restored));
         }
@@ -604,7 +649,7 @@ export function registerTaskRoutes(deps) {
         const body = await parseJsonBody(req);
         try {
             const workspaceId = requestWorkspaceId(req);
-            const workstream = core.createWorkstream(body || {}, workspaceId);
+            const workstream = core.createWorkstream(body || {}, workspaceId, { actorRef: 'user' });
             res.writeHead(201, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify(workstream));
         }
@@ -636,7 +681,7 @@ export function registerTaskRoutes(deps) {
         const body = await parseJsonBody(req);
         try {
             const workspaceId = requestWorkspaceId(req);
-            const updated = core.updateWorkstream(params.id, body || {}, workspaceId);
+            const updated = core.updateWorkstream(params.id, body || {}, workspaceId, { actorRef: 'user' });
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify(updated));
         }
@@ -652,7 +697,7 @@ export function registerTaskRoutes(deps) {
             return;
         try {
             const workspaceId = requestWorkspaceId(req);
-            const archived = core.archiveWorkstream(params.id, workspaceId);
+            const archived = core.archiveWorkstream(params.id, workspaceId, { actorRef: 'user' });
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify(archived));
         }
@@ -668,7 +713,7 @@ export function registerTaskRoutes(deps) {
             return;
         try {
             const workspaceId = requestWorkspaceId(req);
-            const restored = core.unarchiveWorkstream(params.id, workspaceId);
+            const restored = core.unarchiveWorkstream(params.id, workspaceId, { actorRef: 'user' });
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify(restored));
         }

package/dist/server/routes/workspaces.js

@@ -16,7 +16,7 @@ import * as path from 'path';
 import { parseJsonBody } from './primitives.js';
 import { resolveRequestAccess, createSessionTokenCookie, resolveSessionCookieAttributesForRequest, } from '../auth.js';
 import { isWorkspaceSwitchingEnabledForRuntime } from '../../shared/runtimeContract.js';
-import { resolveErrorStatusCode } from './shared.js';
+import { getRouteTimingNow, logSlowBootstrapRoute, requestBootstrapTraceId, resolveErrorStatusCode, serializeJsonWithTiming, setServerTimingHeader } from './shared.js';
 // === SECTION: Registration ===
 export function registerWorkspaceRoutes(deps) {
     const { addRoute, core, context, ensureAppAccess, auditAuthAction, getObjectStorageClient, ensureWithinDir, sanitizeStorageSegment, sanitizeTaskIdForPath, normalizeDocumentPathInput, } = deps;
@@ -94,6 +94,8 @@ export function registerWorkspaceRoutes(deps) {
     // === SECTION: Workspace CRUD routes ===
     // GET /api/taskforce/workspaces - List authenticated user's accessible workspaces
     addRoute('GET', '/api/taskforce/workspaces', async (req, res) => {
+        const routeStartedAt = getRouteTimingNow();
+        const traceId = requestBootstrapTraceId(req);
         const authConfig = context.authConfig;
         if (!isWorkspaceSwitchingEnabledForRuntime(authConfig?.runtimeMode)) {
             res.writeHead(501, { 'Content-Type': 'application/json' });
@@ -106,6 +108,7 @@ export function registerWorkspaceRoutes(deps) {
             return;
         }
         const access = resolveRequestAccess(req, authConfig);
+        const authResolvedAt = getRouteTimingNow();
         if (!access.authenticated || !access.userId || access.userId === 'anonymous') {
             res.writeHead(401, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ success: false, error: 'Authentication required.' }));
@@ -113,17 +116,45 @@ export function registerWorkspaceRoutes(deps) {
         }
         if (!ensureAppAccess(req, res))
             return;
+        const appAccessCheckedAt = getRouteTimingNow();
         const workspaces = core.listUserWorkspaces(access.userId);
+        const workspacesLoadedAt = getRouteTimingNow();
         const requestedCurrentWorkspaceId = String(access.workspaceId || '').trim();
         const currentWorkspaceId = workspaces.some((workspace) => workspace.id === requestedCurrentWorkspaceId)
             ? requestedCurrentWorkspaceId
             : (workspaces[0]?.id || 'default');
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
+        const currentWorkspaceResolvedAt = getRouteTimingNow();
+        const serialized = serializeJsonWithTiming({
             success: true,
             workspaces,
             currentWorkspaceId: currentWorkspaceId || access.workspaceId
-        }));
+        }, currentWorkspaceResolvedAt);
+        const totalDurationMs = getRouteTimingNow() - routeStartedAt;
+        setServerTimingHeader(res, [
+            { name: 'workspaces', durationMs: totalDurationMs },
+            { name: 'workspaces-auth', durationMs: authResolvedAt - routeStartedAt },
+            { name: 'workspaces-app-access', durationMs: appAccessCheckedAt - authResolvedAt },
+            { name: 'workspaces-list', durationMs: workspacesLoadedAt - appAccessCheckedAt },
+            { name: 'workspaces-current', durationMs: currentWorkspaceResolvedAt - workspacesLoadedAt },
+            { name: 'workspaces-json', durationMs: serialized.durationMs },
+        ]);
+        logSlowBootstrapRoute({
+            route: '/api/taskforce/workspaces',
+            workspaceId: currentWorkspaceId || access.workspaceId || 'default',
+            traceId,
+            durationMs: totalDurationMs,
+            details: {
+                workspaceCount: workspaces.length,
+                payloadBytes: serialized.byteLength,
+                authMs: authResolvedAt - routeStartedAt,
+                appAccessMs: appAccessCheckedAt - authResolvedAt,
+                listWorkspacesMs: workspacesLoadedAt - appAccessCheckedAt,
+                currentWorkspaceMs: currentWorkspaceResolvedAt - workspacesLoadedAt,
+                serializeMs: serialized.durationMs,
+            }
+        });
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(serialized.body);
     });
     // POST /api/taskforce/workspaces - Create workspace for current authenticated user
     addRoute('POST', '/api/taskforce/workspaces', async (req, res) => {
@@ -281,7 +312,7 @@ export function registerWorkspaceRoutes(deps) {
             return;
         }
         const resolved = core.resolveUserAccess(access.userId, workspaceId, access.role);
-        if (!resolved || resolved.role === 'read-only') {
+        if (!resolved || resolved.disabled) {
             res.writeHead(403, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ success: false, error: 'Workspace access is not active for this user.' }));
             return;

package/dist/server/routes.js

@@ -36,12 +36,33 @@ import { registerDocumentReviewRoutes } from './routes/documentReviews.js';
 import { registerAnnotatedAttachmentRoutes } from './routes/annotatedAttachments.js';
 import { escapeHtml, parseJsonBody } from './routes/primitives.js';
 import { getRouteEmailConfig, resolvePublicAuthBaseUrl, resolveRuntimeConfigBaseUrl } from './routes/authSupport.js';
-import { buildCloudMcpRuntimeAuth, requestHeader, requestRole, requestRuntimeMode, requestUserId, makeAuditAdminAction, makeAuditAuthAction, makeEnsureAdminRole, makeEnsureAppAccess, makeEnsureAuthenticatedUser, makeEnsureCloudPlanData, makeRequestWorkspaceId, makeRequireCloudRuntime, makeResolveAdminRequestActor, makeResolveAuthenticatedUserId, makeResolveAuthenticatedMutationUserId, ensureWorkspaceAdminRole, } from './routes/shared.js';
+import { buildCloudMcpRuntimeAuth, requestHeader, requestRole, requestRuntimeMode, requestUserId, makeAuditAdminAction, makeAuditAuthAction, makeEnsureAdminRole, makeEnsureAppAccess, makeEnsureAuthenticatedUser, makeEnsureCloudPlanData, makeRequestWorkspaceId, makeRequireCloudRuntime, makeResolveAdminRequestActor, makeResolveAuthenticatedUserId, makeResolveAuthenticatedMutationUserId, } from './routes/shared.js';
 import { resolveDeploymentConfig } from '../config/deployment.js';
 import { getTaskforceCloudEnvironmentConfig, resolveTaskforceCloudEnvironmentFromBaseUrl } from '../config/cloudEnvironment.js';
 import { getCanonicalDocumentName } from '../utils/documentNames.js';
 import { MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS } from '../mcp/toolRegistry.js';
 export { parseJsonBody } from './routes/primitives.js';
+function pathMatchesRouteAuthExclusion(pathname, excludedPaths) {
+    if (!Array.isArray(excludedPaths))
+        return false;
+    return excludedPaths.some((path) => pathname === path || pathname.startsWith(`${path}/`));
+}
+function shouldRequireAuthenticatedCloudApiRoute(pathname, context) {
+    const authConfig = context.authConfig;
+    if (!authConfig?.enabled)
+        return false;
+    if (!pathname.startsWith('/api/taskforce/'))
+        return false;
+    if (pathname.startsWith('/api/taskforce/sync/'))
+        return false;
+    if (pathMatchesRouteAuthExclusion(pathname, authConfig.excludedPaths))
+        return false;
+    return true;
+}
+function writeRouteAuthenticationRequired(res) {
+    res.writeHead(401, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Authentication required.' }));
+}
 const DEFAULT_DOCUMENT_RETENTION_DAYS = 7;
 const STORAGE_INTEGRITY_HISTORY_LIMIT = 50;
 const MCP_TOKEN_SCOPE_VALUES = new Set(['tasks:read', 'tasks:write', 'workspace:read']);
@@ -90,13 +111,14 @@ function resolveErrorStatusCode(error, fallback = 400) {
     }
     return fallback;
 }
-function writeMcpHttpError(res, statusCode, message) {
+function writeMcpHttpError(res, statusCode, message, data) {
     res.writeHead(statusCode, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({
         jsonrpc: '2.0',
         error: {
             code: -32000,
             message,
+            ...(data ? { data } : {}),
         },
         id: null,
     }));
@@ -175,8 +197,24 @@ export function createRoutes(core, context = {}) {
     const routes = [];
     const uiStateCache = new Map();
     const addRoute = (method, path, handler) => {
+        const wrappedHandler = async (req, res, params) => {
+            const runtimeHeader = requestHeader(req, 'x-taskforce-runtime-mode', '').trim().toLowerCase();
+            const runtimeMode = runtimeHeader === 'cloud'
+                ? 'cloud'
+                : runtimeHeader === 'local'
+                    ? 'local'
+                    : (context.authConfig?.runtimeMode || requestRuntimeMode(req));
+            if (runtimeMode === 'cloud' && shouldRequireAuthenticatedCloudApiRoute(path, context)) {
+                const access = resolveRequestAccess(req, context.authConfig);
+                if (!access.authenticated || !access.userId || access.userId === 'anonymous') {
+                    writeRouteAuthenticationRequired(res);
+                    return;
+                }
+            }
+            await handler(req, res, params);
+        };
         const { pattern, keys } = createRoutePattern(`${method}:${path}`);
-        routes.push({ pattern, keys, handler });
+        routes.push({ pattern, keys, handler: wrappedHandler });
     };
     const buildUiStateCacheKey = (workspaceId, userId, stateKey) => `${workspaceId}::${userId}::${stateKey}`;
     const readCachedUiState = (workspaceId, userId, stateKey) => {
@@ -485,7 +523,10 @@ export function createRoutes(core, context = {}) {
         const primaryLink = canonicalAsset?.assetId
             ? workspaceAssetStore?.listLinksForAsset(canonicalAsset.assetId, inferWorkspaceIdFromStoragePath(normalizedStorageKey)).find((entry) => !entry.deletedAt && (!opts?.taskId || entry.taskId === opts.taskId))
             : null;
+        const isExplicitTaskAttachment = typeof opts?.taskId === 'string' && opts.taskId.trim().length > 0;
         const timestamp = String(opts?.timestamp
+            || primaryLink?.updatedAt
+            || (isExplicitTaskAttachment ? new Date().toISOString() : null)
             || canonicalAsset?.updatedAt
             || canonicalAsset?.createdAt
             || new Date().toISOString()).trim() || new Date().toISOString();
@@ -530,6 +571,45 @@ export function createRoutes(core, context = {}) {
             taskId
         };
     };
+    const taskHasAttachmentForAsset = (task, asset) => {
+        if (!task || !Array.isArray(task.attachments))
+            return false;
+        const canonicalDocumentPath = `/api/taskforce/documents/${encodeURIComponent(asset.assetId)}/content`;
+        const contextPath = `/api/taskforce/context/${encodeURIComponent(asset.storageKey)}`;
+        return task.attachments.some((attachment) => {
+            if (typeof attachment === 'string') {
+                return attachment === canonicalDocumentPath
+                    || attachment === contextPath
+                    || attachment === asset.storageKey;
+            }
+            if (!attachment || typeof attachment !== 'object')
+                return false;
+            return attachment.assetId === asset.assetId
+                || attachment.fsPath === asset.storageKey
+                || attachment.path === canonicalDocumentPath
+                || attachment.path === contextPath;
+        });
+    };
+    const recordTaskAttachmentActivity = (input) => {
+        const afterTask = core.getTask(input.taskId, input.workspaceId);
+        if (!taskHasAttachmentForAsset(afterTask, input.asset))
+            return;
+        core.recordTaskEvent({
+            taskId: input.taskId,
+            workspaceId: input.workspaceId,
+            action: 'task-attachments-changed',
+            actor: 'user',
+            createdAt: input.createdAt || new Date().toISOString(),
+            details: {
+                changes: {
+                    attachments: {
+                        from: input.beforeTask.attachments || [],
+                        to: afterTask?.attachments || [],
+                    },
+                },
+            },
+        });
+    };
     const sanitizeDownloadFilename = (nameRaw, fallback = 'download') => {
         const normalized = String(nameRaw || '').trim()
             .replace(/[\\/:*?"<>|]/g, '-')
@@ -623,6 +703,8 @@ export function createRoutes(core, context = {}) {
                 purgeAfter: null
             });
             const taskId = String(params.taskId || inferTaskIdFromStoragePath(params.relativeToStorage) || '').trim();
+            const taskBeforeLink = taskId ? core.getTask(taskId, workspaceId) : null;
+            const wasAttachedBefore = taskHasAttachmentForAsset(taskBeforeLink, asset);
             if (taskId) {
                 workspaceAssetStore.upsertLink({
                     workspaceId,
@@ -632,6 +714,15 @@ export function createRoutes(core, context = {}) {
                     displayName: null,
                     deletedAt: null
                 });
+                if (taskBeforeLink && !wasAttachedBefore) {
+                    recordTaskAttachmentActivity({
+                        taskId,
+                        workspaceId,
+                        asset,
+                        beforeTask: taskBeforeLink,
+                        createdAt: asset.updatedAt,
+                    });
+                }
             }
             core.notifyDocumentMetadataMutation(workspaceId, [params.relativeToStorage], 'upsert');
         }
@@ -1109,6 +1200,8 @@ export function createRoutes(core, context = {}) {
                 authenticatedViaOAuth: oauthAuth || null,
                 userId: null,
                 ...bootstrap,
+                aiProfileToken: bootstrap.aiProfileToken || oauthAuth?.aiProfileToken || null,
+                aiProfileName: bootstrap.aiProfileName || oauthAuth?.aiProfileName || null,
             };
         }
         core.addMcpAuditLog({
@@ -1348,6 +1441,7 @@ export function createRoutes(core, context = {}) {
             return;
         }
         const authScopes = auth.authenticatedViaToken?.scopes || auth.authenticatedViaOAuth?.scopes || [];
+        const requestId = String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || randomUUID();
         const deniedToolName = findDeniedCloudMcpToolName(body, authScopes);
         if (deniedToolName) {
             core.addMcpAuditLog({
@@ -1357,7 +1451,7 @@ export function createRoutes(core, context = {}) {
                 tokenId: auth.authenticatedViaToken?.tokenId || auth.authenticatedViaOAuth?.grantId || null,
                 toolName: deniedToolName,
                 details: {
-                    requestId: String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || randomUUID(),
+                    requestId,
                     ip: req.socket?.remoteAddress || null,
                     userAgent: requestHeader(req, 'user-agent', '') || null,
                     outcome: 'deny',
@@ -1371,11 +1465,13 @@ export function createRoutes(core, context = {}) {
         if (!applyCloudMcpWriteRateLimit(req, res, auth, body)) {
             return;
         }
+        let runtime = null;
         try {
-            const runtime = createTaskforceMcpServer({
+            runtime = createTaskforceMcpServer({
                 projectRoot: core.getPaths().projectRoot,
                 tenantId: core.getTenantId(),
                 workspaceId: auth.workspaceId,
+                core: core,
                 serverName: 'taskforce-cloud',
                 logStartup: false,
                 runtimeMode: 'cloud',
@@ -1383,7 +1479,7 @@ export function createRoutes(core, context = {}) {
                     req,
                     auth,
                     requestHeader,
-                    requestId: String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || randomUUID(),
+                    requestId,
                     authScopes,
                 }),
             });
@@ -1398,13 +1494,29 @@ export function createRoutes(core, context = {}) {
             }
             await transport.handleRequest(req, res, body);
             recordCloudMcpCredentialUsage(req, auth.authenticatedViaToken, auth.authenticatedViaOAuth);
-            await transport.close().catch(() => undefined);
-            await runtime.server.close().catch(() => undefined);
         }
         catch (error) {
-            console.error('[Taskforce MCP] Cloud transport request failed:', error);
+            console.error('[Taskforce MCP] Cloud transport request failed:', {
+                requestId,
+                kind: 'tool_transport_failure',
+                message: error instanceof Error ? error.message : String(error),
+            });
             if (!res.headersSent) {
-                writeMcpHttpError(res, 500, 'Internal server error');
+                writeMcpHttpError(res, 500, 'MCP transport failure.', {
+                    kind: 'tool_transport_failure',
+                    retryable: true,
+                    requestId,
+                });
+            }
+        }
+        finally {
+            if (runtime) {
+                try {
+                    await runtime.server.close();
+                }
+                catch (closeError) {
+                    console.warn('[Taskforce MCP] Cloud transport cleanup failed:', closeError);
+                }
             }
         }
     };
@@ -1412,7 +1524,26 @@ export function createRoutes(core, context = {}) {
     const auditAdminAction = makeAuditAdminAction(core, context);
     const auditAuthAction = makeAuditAuthAction(core, requestWorkspaceId, context);
     const ensureAdminRole = makeEnsureAdminRole(core, context);
-    const ensureAuthenticatedUser = makeEnsureAuthenticatedUser();
+    const ensureAuthenticatedUser = makeEnsureAuthenticatedUser(context.authConfig);
+    const ensureWorkspaceAdminRole = (req, workspaceIdOverride) => {
+        const hasWorkspaceOverride = typeof workspaceIdOverride === 'string' && workspaceIdOverride.trim().length > 0;
+        const workspaceId = String(hasWorkspaceOverride ? workspaceIdOverride : requestWorkspaceId(req) || '').trim() || 'default';
+        const userId = String(resolveAuthenticatedUserId(req) || '').trim();
+        if (userId && userId !== 'anonymous') {
+            const membership = core.listWorkspaceUsers(workspaceId).find((user) => String(user.userId || '').trim() === userId);
+            if (membership) {
+                const role = String(membership.role || '').trim().toLowerCase();
+                const status = String(membership.status || '').trim().toLowerCase();
+                return membership.disabled !== true
+                    && status === 'active'
+                    && (role === 'owner' || role === 'admin');
+            }
+            if (hasWorkspaceOverride)
+                return false;
+        }
+        const fallbackRole = String(requestRole(req) || '').trim().toLowerCase();
+        return fallbackRole === 'owner' || fallbackRole === 'admin';
+    };
     const isCollaborationPolicyEnabled = () => {
         const rawDefault = String(process.env.TASKFORCE_COLLAB_POLICY_V1 || 'true').trim().toLowerCase();
         const envDefaultEnabled = !(rawDefault === '0' || rawDefault === 'false' || rawDefault === 'off' || rawDefault === 'no');
@@ -1464,6 +1595,7 @@ export function createRoutes(core, context = {}) {
         context,
         requestWorkspaceId,
         requestUserId,
+        resolveAuthenticatedUserId,
         requestRole,
         ensureAppAccess,
         ensureAuthenticatedUser,
@@ -1474,6 +1606,10 @@ export function createRoutes(core, context = {}) {
         resolveAdminRequestActor,
         resolveEffectiveObjectStorageConfig,
         getObjectStorageClient,
+        workspaceAssetStore,
+        ensureWithinDir,
+        markAssetDeleted,
+        appendStorageTelemetry,
     });
     registerWorkspaceRoutes({
         addRoute,