@taskforcehq/taskforce 0.3.324 → 0.3.327

package/dist/server/routes.js

@@ -7,12 +7,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { createHash, randomUUID } from 'crypto';
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
 import { TaskforceRuleError } from '../core/Taskforce.js';
-import { parseAiProfileBootstrapHeaders } from '../mcp/aiProfileBootstrap.js';
-import { createTaskforceMcpServer, isMcpWriteToolName } from '../mcp/runtime.js';
-import { applyPrefixedRateLimitHeaders } from './rateLimit.js';
 import { createSessionTokenCookie, resolveRequestAccess } from './auth.js';
 import { sendEmail } from './email.js';
 import { normalizeTaskDataRelativePath, ObjectStorageClient } from '../storage/objectStorageClient.js';
@@ -22,6 +17,7 @@ import { WorkspaceAssetStore } from '../storage/workspaceAssetStore.js';
 import { getDocumentReferenceLabel } from '../utils/documentReferences.js';
 import { getImageReferenceLabel } from '../utils/imageReferences.js';
 import { inferCanonicalAssetKind, isValidCanonicalDocumentAsset } from '../utils/canonicalAssetKind.js';
+import { IMAGE_NOTE_ASSET_SEGMENT } from '../utils/imageNoteStoragePaths.js';
 import { isReservedWorkspaceId } from '../utils/workspaceIdentity.js';
 import { normalizeRelativeStorageKey, resolveExistingStorageKeyFilePathInsideRoot } from '../utils/pathSafety.js';
 import { resolveVirusScanConfigFromEnv, scanBufferForThreats } from '../security/virusScan.js';
@@ -35,13 +31,23 @@ import { registerResourceRoutes } from './routes/resources.js';
 import { registerDocumentRoutes } from './routes/documents.js';
 import { registerDocumentReviewRoutes } from './routes/documentReviews.js';
 import { registerAnnotatedAttachmentRoutes } from './routes/annotatedAttachments.js';
-import { escapeHtml, parseJsonBody } from './routes/primitives.js';
-import { getRouteEmailConfig, resolvePublicAuthBaseUrl, resolveRuntimeConfigBaseUrl } from './routes/authSupport.js';
-import { buildCloudMcpRuntimeAuth, requestHeader, requestRole, requestRuntimeMode, requestUserId, makeAuditAdminAction, makeAuditAuthAction, makeEnsureAdminRole, makeEnsureAppAccess, makeEnsureAuthenticatedUser, makeEnsureCloudPlanData, makeRequestWorkspaceId, makeRequireCloudRuntime, makeResolveAdminRequestActor, makeResolveAuthenticatedUserId, makeResolveAuthenticatedMutationUserId, } from './routes/shared.js';
+import { registerAgentsRoutes } from './routes/agents.js';
+import { registerAgentRolesRoutes } from './routes/agentRoles.js';
+import { registerAgentSkillsRoutes } from './routes/agentSkills.js';
+import { registerWorkflowRoutes } from './routes/workflows.js';
+import { AgentRoleStore } from '../storage/agentRoleStore.js';
+import { createAgentRoleBehaviorReferenceResolver } from '../services/agentRoleResolver.js';
+import { registerLocalMcpHealthRoutes } from './routes/localMcpHealth.js';
+import { registerLocalUpdateRoutes } from './routes/localUpdate.js';
+import { registerLocalServiceRoutes } from './routes/localService.js';
+import { escapeHtml } from './routes/primitives.js';
+import { getRouteEmailConfig, resolvePublicAuthBaseUrl, resolveRuntimeConfigBaseUrl, shouldExposeDevAuthTokens } from './routes/authSupport.js';
+import { requestHeader, requestRole, requestRuntimeMode, requestUserId, makeAuditAdminAction, makeAuditAuthAction, makeEnsureAdminRole, makeEnsureAppAccess, makeEnsureAuthenticatedUser, makeEnsureCloudPlanData, makeRequestWorkspaceId, makeRequireCloudRuntime, makeResolveAdminRequestActor, makeResolveAuthenticatedUserId, makeResolveAuthenticatedMutationUserId, } from './routes/shared.js';
 import { resolveDeploymentConfig } from '../config/deployment.js';
 import { getTaskforceCloudEnvironmentConfig, resolveTaskforceCloudEnvironmentFromBaseUrl } from '../config/cloudEnvironment.js';
 import { getCanonicalDocumentName } from '../utils/documentNames.js';
-import { MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS } from '../mcp/toolRegistry.js';
+import { WorkspaceSyncContentVersionStore } from '../sync/engine/workspaceSyncContentVersionStore.js';
+import { verifyWorkspaceSyncPublishedContentBody, WorkspaceSyncPublishedContentResolver, } from '../sync/engine/workspaceSyncPublishedContentResolver.js';
 export { parseJsonBody } from './routes/primitives.js';
 function pathMatchesRouteAuthExclusion(pathname, excludedPaths) {
     if (!Array.isArray(excludedPaths))
@@ -112,18 +118,6 @@ function resolveErrorStatusCode(error, fallback = 400) {
     }
     return fallback;
 }
-function writeMcpHttpError(res, statusCode, message, data) {
-    res.writeHead(statusCode, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify({
-        jsonrpc: '2.0',
-        error: {
-            code: -32000,
-            message,
-            ...(data ? { data } : {}),
-        },
-        id: null,
-    }));
-}
 function normalizeMcpOauthScopeString(raw) {
     const tokens = String(raw || '')
         .split(/\s+/)
@@ -140,6 +134,14 @@ function inferMcpOauthProviderFromRedirectUris(redirectUris) {
             const hostname = new URL(String(value || '').trim()).hostname.toLowerCase();
             if (hostname.includes('anthropic.com') || hostname.includes('claude.ai'))
                 return 'claude';
+            if (hostname === 'grok.com' || hostname.endsWith('.grok.com') || hostname === 'x.ai' || hostname.endsWith('.x.ai'))
+                return 'grok';
+            if (hostname === 'gemini.google.com' || hostname.endsWith('.gemini.google.com'))
+                return 'gemini';
+            if (hostname === 'mistral.ai' || hostname.endsWith('.mistral.ai'))
+                return 'mistral';
+            if (hostname === 'perplexity.ai' || hostname.endsWith('.perplexity.ai'))
+                return 'perplexity';
             if (hostname.includes('openai.com') || hostname.includes('chatgpt.com') || hostname.includes('chat.openai.com'))
                 return 'chatgpt';
         }
@@ -180,18 +182,13 @@ function inferMcpOauthProviderFromRedirectUris(redirectUris) {
  * - GET /api/taskforce/taxonomies
  * - POST /api/taskforce/taxonomies
  *
- * **Workflow Settings**
- * - GET /api/taskforce/approaches
- * - POST /api/taskforce/approaches
- *
  * **Templates & Setup**
  * - GET /api/taskforce/initiative-templates
  * - POST /api/taskforce/initiative-templates/create
  *
- * **Advanced Features (3 routes)**
+ * **Advanced Features**
  * - GET /api/taskforce/folders
  * - POST /api/taskforce/validate-paths
- * - POST /api/taskforce/export-resources
  * - GET /api/taskforce/health
  */
 export function createRoutes(core, context = {}) {
@@ -308,7 +305,8 @@ export function createRoutes(core, context = {}) {
         const path = kind === 'verify-email'
             ? `/login?mode=verify&token=${encodeURIComponent(token)}`
             : `/login?mode=reset&token=${encodeURIComponent(token)}`;
-        console.info(`[Taskforce Auth] ${kind} email=${email} link=${base}${path}`);
+        const linkLabel = shouldExposeDevAuthTokens(context.authConfig?.runtimeMode) ? `${base}${path}` : '(redacted)';
+        console.info(`[Taskforce Auth] ${kind} email=${email} link=${linkLabel}`);
     };
     const deliverAuthEmail = async (kind, email, token, req) => {
         const base = resolvePublicAuthBaseUrl(req);
@@ -379,7 +377,7 @@ export function createRoutes(core, context = {}) {
         if (kind === 'document')
             return 'documents';
         if (kind === 'image')
-            return 'images';
+            return IMAGE_NOTE_ASSET_SEGMENT;
         return 'files';
     };
     const buildCanonicalWorkspaceAssetRelativePath = (params) => {
@@ -392,7 +390,9 @@ export function createRoutes(core, context = {}) {
             .replace(/-+/g, '-')
             .replace(/^-+|-+$/g, '')
             .slice(0, 64) || 'file';
-        const assetId = `asset-${randomUUID().replace(/-/g, '')}`;
+        const assetId = /^asset-[a-zA-Z0-9_-]+$/.test(String(params.assetId || ''))
+            ? String(params.assetId)
+            : `asset-${randomUUID().replace(/-/g, '')}`;
         const folderPart = Array.isArray(params.folderSegments) && params.folderSegments.length > 0
             ? `${params.folderSegments.join('/')}/`
             : '';
@@ -473,6 +473,9 @@ export function createRoutes(core, context = {}) {
     const workspaceAssetStore = typeof core.getDatabaseAdapter === 'function' && typeof core.getTenantId === 'function'
         ? new WorkspaceAssetStore(core.getDatabaseAdapter(), core.getTenantId())
         : null;
+    const publishedContentResolver = typeof core.getDatabaseAdapter === 'function'
+        ? new WorkspaceSyncPublishedContentResolver(new WorkspaceSyncContentVersionStore(core.getDatabaseAdapter()))
+        : null;
     const resolveEffectiveVirusScanSettings = () => {
         const settings = core.getGlobalSettings().objectStorage || {};
         const asyncEnabled = typeof settings.virusScanAsyncEnabled === 'boolean'
@@ -789,14 +792,43 @@ export function createRoutes(core, context = {}) {
         const resolvedObjectStorage = resolveEffectiveObjectStorageConfig();
         const objectStorageClient = getObjectStorageClient();
         const { basePath } = core.getPaths();
-        const storageKey = normalizeRelativeStorageKey(params.asset.storageKey);
-        if (!storageKey)
+        const logicalStorageKey = normalizeRelativeStorageKey(params.asset.storageKey);
+        if (!logicalStorageKey)
+            return { statusCode: 404 };
+        const resolverOwnedProvider = params.asset.storageProvider === 'r2'
+            ? 'r2'
+            : params.asset.storageProvider === 'local'
+                ? 'local'
+                : null;
+        const resolvedContent = publishedContentResolver && resolverOwnedProvider
+            ? publishedContentResolver.resolve({
+                tenantId: core.getTenantId(),
+                workspaceId: params.asset.workspaceId,
+                kind: 'document',
+                logicalPath: logicalStorageKey,
+                legacyProvider: resolverOwnedProvider
+            })
+            : {
+                source: 'legacy',
+                kind: 'document',
+                logicalPath: logicalStorageKey,
+                physicalKey: logicalStorageKey,
+                storageProvider: params.asset.storageProvider
+            };
+        if (resolvedContent.source === 'deleted') {
+            return { statusCode: 404 };
+        }
+        const physicalStorageKey = normalizeRelativeStorageKey(resolvedContent.physicalKey);
+        if (!physicalStorageKey)
             return { statusCode: 404 };
-        const ext = path.extname(storageKey).toLowerCase();
+        const ext = path.extname(logicalStorageKey).toLowerCase();
+        const resolvedMimeType = resolvedContent.source === 'versioned'
+            ? resolvedContent.mimeType
+            : params.asset.mimeType;
         const resolvedDownloadNameBase = sanitizeDownloadFilename(String(params.requestedFilename || '').trim()
             || params.asset.logicalName
             || params.asset.originalFilename
-            || path.basename(storageKey, ext)
+            || path.basename(logicalStorageKey, ext)
             || 'download');
         const resolvedDownloadName = ext && !resolvedDownloadNameBase.toLowerCase().endsWith(ext)
             ? `${resolvedDownloadNameBase}${ext}`
@@ -809,41 +841,51 @@ export function createRoutes(core, context = {}) {
                 return { statusCode: 404 };
             }
             if (!params.forceDownload) {
-                const object = await objectStorageClient.getObject(storageKey);
+                const object = await objectStorageClient.getObject(physicalStorageKey);
                 if (!object) {
                     return { statusCode: 404 };
                 }
                 return {
                     statusCode: 200,
                     headers: {
-                        'Content-Type': object.contentType || params.asset.mimeType || contentTypeForExt(ext),
+                        'Content-Type': object.contentType || resolvedMimeType || contentTypeForExt(ext),
                         'Content-Disposition': contentDisposition
                     },
-                    body: object.body
+                    body: resolvedContent.source === 'versioned'
+                        ? verifyWorkspaceSyncPublishedContentBody(object.body, resolvedContent, `Document ${params.asset.assetId}`)
+                        : object.body
                 };
             }
             return {
                 statusCode: 302,
                 headers: {
-                    Location: objectStorageClient.createSignedGetUrl(storageKey, resolvedObjectStorage.r2.signedDownloadTtlSeconds, { responseContentDisposition: contentDisposition })
+                    Location: objectStorageClient.createSignedGetUrl(physicalStorageKey, resolvedObjectStorage.r2.signedDownloadTtlSeconds, { responseContentDisposition: contentDisposition })
                 }
             };
         };
-        if (params.asset.storageProvider === 'r2' && objectStorageClient && resolvedObjectStorage.provider === 'r2' && resolvedObjectStorage.r2) {
+        if (resolvedContent.storageProvider === 'r2'
+            && objectStorageClient
+            && resolvedObjectStorage.provider === 'r2'
+            && resolvedObjectStorage.r2) {
             return readFromObjectStorage();
         }
-        const filePath = resolveExistingStorageKeyFilePathInsideRoot(basePath, storageKey);
+        const filePath = resolveExistingStorageKeyFilePathInsideRoot(basePath, physicalStorageKey);
         if (filePath) {
+            const body = fs.readFileSync(filePath);
             return {
                 statusCode: 200,
                 headers: {
-                    'Content-Type': params.asset.mimeType || contentTypeForExt(ext),
+                    'Content-Type': resolvedMimeType || contentTypeForExt(ext),
                     'Content-Disposition': contentDisposition
                 },
-                body: fs.readFileSync(filePath)
+                body: resolvedContent.source === 'versioned'
+                    ? verifyWorkspaceSyncPublishedContentBody(body, resolvedContent, `Document ${params.asset.assetId}`)
+                    : body
             };
         }
-        return readFromObjectStorage();
+        return resolvedContent.source === 'legacy'
+            ? readFromObjectStorage()
+            : { statusCode: 404 };
     };
     const getAssetMetadata = (pathValue) => {
         const canonical = getCanonicalAssetMetadata(pathValue);
@@ -1149,98 +1191,6 @@ export function createRoutes(core, context = {}) {
         return true;
     };
     const ensureAppAccess = makeEnsureAppAccess(core, context);
-    const authenticateCloudMcpRequest = (req, res) => {
-        const authorization = requestHeader(req, 'authorization', '').trim();
-        const bearerToken = authorization.toLowerCase().startsWith('bearer ')
-            ? authorization.slice(7).trim()
-            : '';
-        const requestedWorkspaceId = requestHeader(req, 'x-taskforce-workspace-id', '').trim();
-        const bootstrap = parseAiProfileBootstrapHeaders(req.headers);
-        if (bearerToken) {
-            const tokenAuth = core.authenticateMcpAccessToken(bearerToken);
-            const oauthAuth = tokenAuth ? null : core.authenticateMcpOAuthAccessToken(bearerToken);
-            if ((!tokenAuth || tokenAuth.status !== 'active') && (!oauthAuth || oauthAuth.status !== 'active')) {
-                core.addMcpAuditLog({
-                    workspaceId: requestedWorkspaceId || 'default',
-                    actorType: 'token',
-                    actorUserId: 'anonymous',
-                    toolName: 'auth',
-                    details: {
-                        requestId: String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || randomUUID(),
-                        ip: req.socket?.remoteAddress || null,
-                        userAgent: requestHeader(req, 'user-agent', '') || null,
-                        outcome: 'deny',
-                        reasonCode: 'invalid_credential',
-                        workspaceIdHint: requestedWorkspaceId || null
-                    }
-                });
-                writeMcpHttpError(res, 401, 'Unauthorized.');
-                return null;
-            }
-            const resolvedWorkspaceId = tokenAuth?.workspaceId || oauthAuth?.workspaceId || '';
-            if (requestedWorkspaceId && requestedWorkspaceId !== resolvedWorkspaceId) {
-                core.addMcpAuditLog({
-                    workspaceId: resolvedWorkspaceId || requestedWorkspaceId || 'default',
-                    actorType: tokenAuth ? 'token' : 'oauth',
-                    actorUserId: tokenAuth?.userId || oauthAuth?.userId || 'anonymous',
-                    tokenId: tokenAuth?.tokenId || oauthAuth?.grantId || null,
-                    toolName: 'auth',
-                    details: {
-                        requestId: String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || randomUUID(),
-                        ip: req.socket?.remoteAddress || null,
-                        userAgent: requestHeader(req, 'user-agent', '') || null,
-                        outcome: 'deny',
-                        reasonCode: 'workspace_mismatch',
-                        requestedWorkspaceId,
-                        credentialWorkspaceId: resolvedWorkspaceId
-                    }
-                });
-                writeMcpHttpError(res, 403, 'Forbidden.');
-                return null;
-            }
-            return {
-                workspaceId: resolvedWorkspaceId,
-                authenticatedViaToken: tokenAuth || null,
-                authenticatedViaOAuth: oauthAuth || null,
-                userId: null,
-                ...bootstrap,
-                aiProfileToken: bootstrap.aiProfileToken || oauthAuth?.aiProfileToken || null,
-                aiProfileName: bootstrap.aiProfileName || oauthAuth?.aiProfileName || null,
-            };
-        }
-        core.addMcpAuditLog({
-            workspaceId: requestedWorkspaceId || 'default',
-            actorType: 'user',
-            actorUserId: resolveAuthenticatedUserId(req) || 'anonymous',
-            toolName: 'auth',
-            details: {
-                requestId: String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || randomUUID(),
-                ip: req.socket?.remoteAddress || null,
-                userAgent: requestHeader(req, 'user-agent', '') || null,
-                outcome: 'deny',
-                reasonCode: 'missing_bearer'
-            }
-        });
-        writeMcpHttpError(res, 401, 'Unauthorized.');
-        return null;
-    };
-    const recordCloudMcpCredentialUsage = (req, tokenAuth, oauthAuth) => {
-        if (tokenAuth) {
-            core.recordMcpAccessTokenUsage({
-                tokenId: tokenAuth.tokenId,
-                workspaceId: tokenAuth.workspaceId,
-                ip: req.socket?.remoteAddress || null,
-                userAgent: requestHeader(req, 'user-agent', '') || null,
-            });
-            return;
-        }
-        if (oauthAuth) {
-            core.recordMcpOAuthConnectorGrantUsage({
-                grantId: oauthAuth.grantId,
-                workspaceId: oauthAuth.workspaceId,
-            });
-        }
-    };
     const resolveMcpOauthIssuer = (req) => {
         const runtimeBaseUrl = resolveRuntimeConfigBaseUrl(req);
         if (runtimeBaseUrl)
@@ -1348,205 +1298,6 @@ export function createRoutes(core, context = {}) {
 </body>
 </html>`;
     };
-    const extractMcpWriteToolNames = (body) => {
-        const messages = Array.isArray(body) ? body : [body];
-        const names = messages.flatMap((message) => {
-            if (!message || typeof message !== 'object')
-                return [];
-            const method = String(message.method || '').trim();
-            if (method !== 'tools/call')
-                return [];
-            const toolName = String(message?.params?.name || '').trim();
-            return toolName && isMcpWriteToolName(toolName) ? [toolName] : [];
-        });
-        return Array.from(new Set(names));
-    };
-    const extractFirstMcpToolName = (body) => {
-        const messages = Array.isArray(body) ? body : [body];
-        for (const message of messages) {
-            if (!message || typeof message !== 'object')
-                continue;
-            if (String(message.method || '').trim() !== 'tools/call')
-                continue;
-            const toolName = String(message?.params?.name || '').trim();
-            if (toolName)
-                return toolName;
-        }
-        return null;
-    };
-    const findDeniedCloudMcpToolName = (body, scopes) => {
-        const messages = Array.isArray(body) ? body : [body];
-        for (const message of messages) {
-            if (!message || typeof message !== 'object')
-                continue;
-            if (String(message.method || '').trim() !== 'tools/call')
-                continue;
-            const toolName = String(message?.params?.name || '').trim();
-            if (!toolName)
-                continue;
-            const requiredScope = MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS[toolName];
-            if (!requiredScope || !scopes.includes(requiredScope)) {
-                return toolName;
-            }
-        }
-        return null;
-    };
-    const applyCloudMcpWriteRateLimit = (req, res, auth, body) => {
-        if (!MCP_WRITE_RATE_LIMIT_ENABLED)
-            return true;
-        const writeTools = extractMcpWriteToolNames(body);
-        if (writeTools.length === 0)
-            return true;
-        const actorKey = auth.authenticatedViaToken?.tokenId
-            ? `token:${auth.authenticatedViaToken.tokenId}`
-            : auth.authenticatedViaOAuth?.grantId
-                ? `oauth:${auth.authenticatedViaOAuth.grantId}`
-                : auth.userId
-                    ? `user:${auth.userId}`
-                    : `workspace:${auth.workspaceId}`;
-        const actorResult = core.checkMcpRateLimit({
-            scope: 'actor',
-            key: actorKey,
-            limit: MCP_WRITE_RATE_LIMIT_ACTOR_MAX_REQUESTS,
-            windowMs: MCP_WRITE_RATE_LIMIT_WINDOW_MS
-        });
-        const workspaceResult = core.checkMcpRateLimit({
-            scope: 'workspace',
-            key: auth.workspaceId,
-            limit: MCP_WRITE_RATE_LIMIT_WORKSPACE_MAX_REQUESTS,
-            windowMs: MCP_WRITE_RATE_LIMIT_WINDOW_MS
-        });
-        applyPrefixedRateLimitHeaders(res, actorResult, 'X-MCP-Write-RateLimit');
-        applyPrefixedRateLimitHeaders(res, workspaceResult, 'X-MCP-Write-Workspace-RateLimit');
-        if (actorResult.allowed && workspaceResult.allowed)
-            return true;
-        const retryAfterSeconds = Math.max(actorResult.retryAfterSeconds, workspaceResult.retryAfterSeconds);
-        res.setHeader('Retry-After', String(retryAfterSeconds));
-        core.addMcpAuditLog({
-            workspaceId: auth.workspaceId,
-            actorType: auth.authenticatedViaToken ? 'token' : auth.authenticatedViaOAuth ? 'oauth' : 'user',
-            actorUserId: auth.authenticatedViaToken?.userId || auth.authenticatedViaOAuth?.userId || auth.userId || 'anonymous',
-            tokenId: auth.authenticatedViaToken?.tokenId || auth.authenticatedViaOAuth?.grantId || null,
-            toolName: extractFirstMcpToolName(body) || 'rate_limit',
-            details: {
-                requestId: String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || randomUUID(),
-                ip: req.socket?.remoteAddress || null,
-                userAgent: requestHeader(req, 'user-agent', '') || null,
-                outcome: 'deny',
-                reasonCode: actorResult.allowed ? 'workspace_write_rate_limited' : 'actor_write_rate_limited',
-                actorLimit: actorResult.limit,
-                workspaceLimit: workspaceResult.limit
-            }
-        });
-        writeMcpHttpError(res, 429, 'Write rate limit exceeded. Retry later.');
-        return false;
-    };
-    const handleCloudMcpRequest = async (req, res) => {
-        if (requestRuntimeMode(req) !== 'cloud') {
-            writeMcpHttpError(res, 400, 'The /mcp HTTP endpoint is only available in cloud runtime. In local runtime, use the local stdio MCP server (for example: `taskforce mcp <project-path>`).');
-            return;
-        }
-        if (!ensureAppAccess(req, res))
-            return;
-        if (req.method !== 'POST' && req.method !== 'GET' && req.method !== 'DELETE') {
-            writeMcpHttpError(res, 405, 'Method not allowed.');
-            return;
-        }
-        const auth = authenticateCloudMcpRequest(req, res);
-        if (!auth)
-            return;
-        if (req.method !== 'POST') {
-            writeMcpHttpError(res, 405, 'Method not allowed.');
-            return;
-        }
-        let body = undefined;
-        try {
-            body = await parseJsonBody(req);
-        }
-        catch (error) {
-            writeMcpHttpError(res, resolveErrorStatusCode(error, 400), 'Invalid JSON body.');
-            return;
-        }
-        const authScopes = auth.authenticatedViaToken?.scopes || auth.authenticatedViaOAuth?.scopes || [];
-        const requestId = String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || randomUUID();
-        const deniedToolName = findDeniedCloudMcpToolName(body, authScopes);
-        if (deniedToolName) {
-            core.addMcpAuditLog({
-                workspaceId: auth.workspaceId,
-                actorType: auth.authenticatedViaToken ? 'token' : auth.authenticatedViaOAuth ? 'oauth' : 'user',
-                actorUserId: auth.authenticatedViaToken?.userId || auth.authenticatedViaOAuth?.userId || auth.userId || 'anonymous',
-                tokenId: auth.authenticatedViaToken?.tokenId || auth.authenticatedViaOAuth?.grantId || null,
-                toolName: deniedToolName,
-                details: {
-                    requestId,
-                    ip: req.socket?.remoteAddress || null,
-                    userAgent: requestHeader(req, 'user-agent', '') || null,
-                    outcome: 'deny',
-                    reasonCode: 'scope_denied',
-                    scopes: authScopes
-                }
-            });
-            writeMcpHttpError(res, 403, 'Forbidden.');
-            return;
-        }
-        if (!applyCloudMcpWriteRateLimit(req, res, auth, body)) {
-            return;
-        }
-        let runtime = null;
-        try {
-            runtime = createTaskforceMcpServer({
-                projectRoot: core.getPaths().projectRoot,
-                tenantId: core.getTenantId(),
-                workspaceId: auth.workspaceId,
-                core: core,
-                serverName: 'taskforce-cloud',
-                logStartup: false,
-                runtimeMode: 'cloud',
-                auth: buildCloudMcpRuntimeAuth({
-                    req,
-                    auth,
-                    requestHeader,
-                    requestId,
-                    authScopes,
-                }),
-            });
-            const transport = new StreamableHTTPServerTransport({
-                sessionIdGenerator: undefined,
-                enableJsonResponse: true,
-            });
-            await runtime.server.connect(transport);
-            if (!isInitializeRequest(body)) {
-                // Stateless cloud sessions still require a valid MCP JSON-RPC request;
-                // let the SDK validate and respond rather than trying to track sessions server-side.
-            }
-            await transport.handleRequest(req, res, body);
-            recordCloudMcpCredentialUsage(req, auth.authenticatedViaToken, auth.authenticatedViaOAuth);
-        }
-        catch (error) {
-            console.error('[Taskforce MCP] Cloud transport request failed:', {
-                requestId,
-                kind: 'tool_transport_failure',
-                message: error instanceof Error ? error.message : String(error),
-            });
-            if (!res.headersSent) {
-                writeMcpHttpError(res, 500, 'MCP transport failure.', {
-                    kind: 'tool_transport_failure',
-                    retryable: true,
-                    requestId,
-                });
-            }
-        }
-        finally {
-            if (runtime) {
-                try {
-                    await runtime.server.close();
-                }
-                catch (closeError) {
-                    console.warn('[Taskforce MCP] Cloud transport cleanup failed:', closeError);
-                }
-            }
-        }
-    };
     const resolveAdminRequestActor = makeResolveAdminRequestActor(core, context);
     const auditAdminAction = makeAuditAdminAction(core, context);
     const auditAuthAction = makeAuditAuthAction(core, requestWorkspaceId, context);
@@ -1605,7 +1356,18 @@ export function createRoutes(core, context = {}) {
         };
     };
     const requireCloudRuntime = makeRequireCloudRuntime(context);
-    registerSyncRoutes({ addRoute, core, context, auditAuthAction, resolveErrorStatusCode, requestWorkspaceId, resolveRequestAccess, isReservedWorkspaceId, createSessionTokenCookie });
+    registerSyncRoutes({
+        addRoute,
+        core,
+        context,
+        auditAuthAction,
+        resolveErrorStatusCode,
+        requestWorkspaceId,
+        resolveRequestAccess,
+        isReservedWorkspaceId,
+        createSessionTokenCookie,
+        serverDataServices: context.workspaceSyncDataServices,
+    });
     registerBillingRoutes({
         addRoute,
         core,
@@ -1652,6 +1414,7 @@ export function createRoutes(core, context = {}) {
         sanitizeTaskIdForPath,
         normalizeDocumentPathInput,
     });
+    registerLocalServiceRoutes({ addRoute, core, context: context.localService });
     registerAdminRoutes({
         addRoute,
         core,
@@ -1659,8 +1422,6 @@ export function createRoutes(core, context = {}) {
         requestWorkspaceId,
         requestUserId,
         requestRole,
-        requestHeader,
-        requestRuntimeMode,
         ensureAppAccess,
         ensureAdminRole,
         ensureCloudPlanData,
@@ -1671,6 +1432,7 @@ export function createRoutes(core, context = {}) {
         resolveEffectiveObjectStorageConfig,
         getObjectStorageClient,
         taskAssetStore,
+        publishedContentResolver: publishedContentResolver,
         normalizeDocumentPathInput,
         ensureWithinDir,
         getAssetMetadata,
@@ -1687,7 +1449,6 @@ export function createRoutes(core, context = {}) {
         isCollaborationPolicyEnabled,
         normalizeMcpOauthScopeString,
         MCP_TOKEN_SCOPE_VALUES,
-        MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS,
         MCP_WRITE_RATE_LIMIT_ENABLED,
         MCP_WRITE_RATE_LIMIT_ACTOR_MAX_REQUESTS,
         MCP_WRITE_RATE_LIMIT_WORKSPACE_MAX_REQUESTS,
@@ -1704,6 +1465,8 @@ export function createRoutes(core, context = {}) {
         CLOUD_SAFE_CONFIG_PATHS,
     });
     registerResourceRoutes({ addRoute, core });
+    registerLocalMcpHealthRoutes({ addRoute, core, context });
+    registerLocalUpdateRoutes({ addRoute, context });
     registerDocumentRoutes({
         addRoute,
         core,
@@ -1742,7 +1505,9 @@ export function createRoutes(core, context = {}) {
         addRoute,
         core,
         requestWorkspaceId,
-        resolveAuthenticatedUserId: resolveAuthenticatedMutationUserId,
+        resolveAuthenticatedUserId,
+        resolveAuthenticatedMutationUserId,
+        ensureWorkspaceAdminRole,
         ensureAppAccess,
     });
     registerAnnotatedAttachmentRoutes({
@@ -1752,6 +1517,50 @@ export function createRoutes(core, context = {}) {
         resolveAuthenticatedUserId: resolveAuthenticatedMutationUserId,
         ensureAppAccess,
     });
+    registerAgentsRoutes({
+        addRoute,
+        ensureAppAccess,
+        core,
+        requestWorkspaceId,
+        resolveAuthenticatedUserId,
+        resolveRuntimeMode: (req) => (context.authConfig?.runtimeMode === 'cloud' ? 'cloud' : requestRuntimeMode(req)),
+        ensureWorkspaceAdminRole,
+        aiProfileAvatarAssetDeps: {
+            core,
+            workspaceAssetStore,
+            getObjectStorageClient,
+            ensureWithinDir,
+            markAssetDeleted,
+            appendStorageTelemetry,
+        },
+        agentRuntimeReferenceResolversForWorkspace: (workspaceId) => ({
+            resolveBehaviorReference: createAgentRoleBehaviorReferenceResolver(new AgentRoleStore(core.getDatabaseAdapter(), core.getTenantId()), workspaceId),
+        }),
+    });
+    registerAgentRolesRoutes({
+        addRoute,
+        ensureAppAccess,
+        core,
+        requestWorkspaceId,
+        resolveAuthenticatedMutationUserId,
+    });
+    registerAgentSkillsRoutes({
+        addRoute,
+        ensureAppAccess,
+        core,
+        requestWorkspaceId,
+        resolveAuthenticatedUserId,
+        resolveAuthenticatedMutationUserId,
+    });
+    registerWorkflowRoutes({
+        addRoute,
+        ensureAppAccess,
+        ensureAuthenticatedUser,
+        requireCloudRuntime,
+        requestWorkspaceId,
+        resolveAuthenticatedUserId,
+        core,
+    });
     return routes;
 }
 // Match incoming request to route