@taskforcehq/taskforce 0.3.327 → 0.3.328

package/dist/server/routes/shared.js

@@ -17,7 +17,9 @@ import { resolveCanonicalMcpToolName } from '../../mcp/toolCallCompatibility.js'
 import { applyPrefixedRateLimitHeaders } from '../rateLimit.js';
 import { parseAiProfileBootstrapHeaders } from '../../mcp/aiProfileBootstrap.js';
 import { parseMcpClientId } from '../../mcp/clientRegistry.js';
+import { resolveAppAccessDeniedResponse } from '../appAccess.js';
 import { resolveCloudApplicationBaseUrl } from '../../config/applicationBaseUrl.js';
+import { getRequestPerformanceDiagnostics, runWithRequestPerformanceDiagnostics, } from '../../storage/postgresRequestDiagnostics.js';
 // === SECTION: Error helpers ===
 export function resolveErrorStatusCode(error, fallback = 400) {
     if (error instanceof TaskforceRuleError)
@@ -39,6 +41,7 @@ export function buildCloudMcpProfileConnectionId(input) {
 // === SECTION: Route timing helpers ===
 export const BOOTSTRAP_ROUTE_SLOW_THRESHOLD_MS = 1500;
 export const BOOTSTRAP_ROUTE_SEVERE_THRESHOLD_MS = 5000;
+export const TASKFORCE_PERFORMANCE_TRACE_HEADER = 'x-taskforce-performance-trace';
 function sanitizeServerTimingMetricName(name) {
     return String(name || 'taskforce-route')
         .trim()
@@ -68,6 +71,55 @@ export function serializeJsonWithTiming(payload, startedAt = getRouteTimingNow()
         durationMs: Math.max(0, getRouteTimingNow() - startedAt),
     };
 }
+export function runWithPerformanceTrace(req, callback) {
+    const enabled = requestHeader(req, TASKFORCE_PERFORMANCE_TRACE_HEADER, '').trim() === '1';
+    return runWithRequestPerformanceDiagnostics(enabled, callback);
+}
+export function currentPerformanceTraceDiagnostics() {
+    return getRequestPerformanceDiagnostics();
+}
+export function performanceTraceServerTimingMetrics(diagnostics) {
+    return diagnostics ? [{ name: 'postgres-worker-wait', durationMs: diagnostics.postgresWorkerWaitMs }] : [];
+}
+export function setPerformanceTraceHeaders(res, diagnostics, responseBytes) {
+    if (!diagnostics)
+        return;
+    res.setHeader('X-Taskforce-Postgres-Query-Count', String(diagnostics.postgresQueryCount));
+    res.setHeader('X-Taskforce-Postgres-Worker-Call-Count', String(diagnostics.postgresWorkerCallCount));
+    res.setHeader('X-Taskforce-Response-Bytes', String(responseBytes));
+}
+export function respondWithPerformanceTraceJson(input) {
+    runWithPerformanceTrace(input.req, () => {
+        const startedAt = getRouteTimingNow();
+        const data = input.load();
+        const loadCompletedAt = getRouteTimingNow();
+        const serialized = serializeJsonWithTiming(data);
+        const diagnostics = getRequestPerformanceDiagnostics();
+        const totalDurationMs = Math.max(0, getRouteTimingNow() - startedAt);
+        setServerTimingHeader(input.res, [
+            { name: 'route-total', durationMs: totalDurationMs },
+            { name: 'route-load', durationMs: loadCompletedAt - startedAt },
+            { name: 'route-json', durationMs: serialized.durationMs },
+            ...performanceTraceServerTimingMetrics(diagnostics),
+        ]);
+        setPerformanceTraceHeaders(input.res, diagnostics, serialized.byteLength);
+        logSlowBootstrapRoute({
+            route: input.route,
+            workspaceId: input.workspaceId,
+            traceId: requestBootstrapTraceId(input.req),
+            durationMs: totalDurationMs,
+            details: diagnostics ? {
+                responseBytes: serialized.byteLength,
+                postgresQueryCount: diagnostics.postgresQueryCount,
+                postgresWorkerCallCount: diagnostics.postgresWorkerCallCount,
+                postgresWorkerWaitMs: Math.round(diagnostics.postgresWorkerWaitMs),
+                jsonSerializeMs: serialized.durationMs,
+            } : { responseBytes: serialized.byteLength },
+        });
+        input.res.writeHead(200, { 'Content-Type': 'application/json' });
+        input.res.end(serialized.body);
+    });
+}
 export function requestBootstrapTraceId(req) {
     return requestHeader(req, 'x-taskforce-bootstrap-trace-id', '').trim();
 }
@@ -100,6 +152,7 @@ export function buildCloudMcpRuntimeAuth(input) {
         tokenId: auth.authenticatedViaToken?.tokenId || auth.authenticatedViaOAuth?.grantId || null,
         aiProfileToken: auth.aiProfileToken,
         aiProfileId: auth.authenticatedViaOAuth?.aiProfileId || null,
+        aiProfileIdentityAsserted: auth.aiProfileIdentityAsserted === true,
         aiProfileName: auth.aiProfileName,
         aiProfileIcon: auth.aiProfileIcon,
         aiProfileColor: auth.aiProfileColor,
@@ -183,6 +236,7 @@ export function makeAuthenticateCloudMcpRequest(core, deps) {
                 userId: null,
                 ...bootstrap,
                 aiProfileId: oauthAuth?.aiProfileId || null,
+                aiProfileIdentityAsserted: Boolean(bootstrap.aiProfileName || bootstrap.aiProfileProvider),
                 aiProfileToken: bootstrap.aiProfileToken || oauthAuth?.aiProfileToken || null,
                 aiProfileName: bootstrap.aiProfileName || oauthAuth?.aiProfileName || null,
                 mcpClientId: oauthAuth
@@ -337,6 +391,9 @@ export function makeHandleCloudMcpRequest(core, deps) {
     };
     return async function handleCloudMcpRequest(req, res) {
         const requestStartedAtMs = Date.now();
+        let authMs = 0;
+        let bodyParseMs = 0;
+        let rateLimitMs = 0;
         if (requestRuntimeMode(req) !== 'cloud') {
             writeMcpHttpError(res, 400, 'The /mcp HTTP endpoint is only available in cloud runtime. In local runtime, use the local stdio MCP server (for example: `taskforce mcp <project-path>`).');
             return;
@@ -347,7 +404,9 @@ export function makeHandleCloudMcpRequest(core, deps) {
             writeMcpHttpError(res, 405, 'Method not allowed.');
             return;
         }
+        const authStartedAtMs = Date.now();
         const auth = authenticateCloudMcpRequest(req, res);
+        authMs = Date.now() - authStartedAtMs;
         if (!auth)
             return;
         if (req.method !== 'POST') {
@@ -356,7 +415,9 @@ export function makeHandleCloudMcpRequest(core, deps) {
         }
         let body = undefined;
         try {
+            const bodyParseStartedAtMs = Date.now();
             body = await parseJsonBody(req);
+            bodyParseMs = Date.now() - bodyParseStartedAtMs;
         }
         catch (error) {
             writeMcpHttpError(res, resolveErrorStatusCode(error, 400), 'Invalid JSON body.');
@@ -364,6 +425,7 @@ export function makeHandleCloudMcpRequest(core, deps) {
         }
         const authScopes = auth.authenticatedViaToken?.scopes || auth.authenticatedViaOAuth?.scopes || [];
         const requestId = String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || randomUUID();
+        res.setHeader('X-Request-ID', requestId);
         const mcpMethod = !Array.isArray(body) && body !== null && typeof body === 'object'
             ? String(body.method || '')
             : '';
@@ -389,7 +451,11 @@ export function makeHandleCloudMcpRequest(core, deps) {
             writeMcpHttpError(res, 403, 'Forbidden.');
             return;
         }
-        if (!applyCloudMcpWriteRateLimit(req, res, auth, body))
+        const writeToolNames = extractMcpWriteToolNames(body);
+        const rateLimitStartedAtMs = Date.now();
+        const rateLimitAllowed = applyCloudMcpWriteRateLimit(req, res, auth, body);
+        rateLimitMs = Date.now() - rateLimitStartedAtMs;
+        if (!rateLimitAllowed)
             return;
         let runtime = null;
         let runtimeConstructionMs = 0;
@@ -397,6 +463,7 @@ export function makeHandleCloudMcpRequest(core, deps) {
         let requestHandlingMs = 0;
         let cleanupMs = 0;
         let outcome = 'success';
+        const toolTimingState = { value: null };
         try {
             const runtimeStartedAtMs = Date.now();
             // Intentionally isolate the MCP runtime per HTTP request. The runtime closes over
@@ -420,6 +487,25 @@ export function makeHandleCloudMcpRequest(core, deps) {
                     requestId,
                     authScopes,
                 }),
+                onToolCallTiming: (timing) => {
+                    toolTimingState.value = timing;
+                    if (!res.headersSent) {
+                        setServerTimingHeader(res, [
+                            { name: 'auth', durationMs: authMs },
+                            { name: 'body-parse', durationMs: bodyParseMs },
+                            { name: 'rate-limit', durationMs: rateLimitMs },
+                            { name: 'runtime', durationMs: runtimeConstructionMs },
+                            { name: 'transport-connect', durationMs: transportConnectMs },
+                            { name: 'tool-envelope-prepare', durationMs: timing.preparationMs },
+                            { name: 'tool-envelope-validate', durationMs: timing.validationMs },
+                            { name: 'tool-handler', durationMs: timing.handlerMs },
+                            ...Object.entries(timing.subphases).map(([phase, durationMs]) => ({
+                                name: `tool-${phase}`,
+                                durationMs,
+                            })),
+                        ]);
+                    }
+                },
             });
             runtimeConstructionMs = Date.now() - runtimeStartedAtMs;
             const transport = new StreamableHTTPServerTransport({
@@ -465,7 +551,8 @@ export function makeHandleCloudMcpRequest(core, deps) {
                 cleanupMs = Date.now() - cleanupStartedAtMs;
             }
             const totalDurationMs = Date.now() - requestStartedAtMs;
-            if (initializeRequest || mcpMethod === 'tools/list' || totalDurationMs >= 250) {
+            if (initializeRequest || mcpMethod === 'tools/list' || writeToolNames.length > 0 || totalDurationMs >= 250) {
+                const timingSnapshot = toolTimingState.value;
                 console.info(`[Taskforce MCP] ${JSON.stringify({
                     event: 'cloud_request_timing',
                     requestId,
@@ -477,13 +564,23 @@ export function makeHandleCloudMcpRequest(core, deps) {
                     method: mcpMethod || null,
                     toolName: extractFirstMcpToolName(body),
                     workspaceId: auth.workspaceId,
+                    databaseProvider: core.getDatabaseProvider(),
+                    authMode: auth.authenticatedViaToken ? 'token' : auth.authenticatedViaOAuth ? 'oauth' : 'user',
+                    batchSize: Array.isArray(body) ? body.length : 1,
+                    isWrite: writeToolNames.length > 0,
                     outcome,
+                    httpStatus: res.statusCode,
+                    responseBytes: timingSnapshot?.responseBytes ?? null,
                     totalDurationMs,
                     preRuntimeMs: Math.max(0, totalDurationMs - runtimeConstructionMs - transportConnectMs - requestHandlingMs - cleanupMs),
+                    authMs,
+                    bodyParseMs,
+                    rateLimitMs,
                     runtimeConstructionMs,
                     transportConnectMs,
                     requestHandlingMs,
                     cleanupMs,
+                    toolTiming: timingSnapshot,
                 })}`);
             }
         }
@@ -521,6 +618,17 @@ export function requestSystemRole(req) {
 export function requestUserId(req) {
     return requestHeader(req, 'x-taskforce-user-id', 'anonymous') || 'anonymous';
 }
+/**
+ * Resolve the human actor recorded by ordinary HTTP mutations. The standalone
+ * server has already replaced this header with authenticated cloud identity
+ * when available; local signed-in clients provide the same account id through
+ * the request-scoped mutation header. Anonymous sessions retain the legacy
+ * generic actor for compatibility.
+ */
+export function requestHumanActorRef(req) {
+    const userId = String(requestUserId(req) || '').trim();
+    return userId && userId !== 'anonymous' ? userId : 'user';
+}
 // === SECTION: Workspace ID resolution ===
 export function makeRequestWorkspaceId(core, context) {
     return function requestWorkspaceId(req) {
@@ -625,23 +733,11 @@ export function makeEnsureAppAccess(core, context) {
         if (!access.authenticated || !access.userId || access.userId === 'anonymous')
             return true;
         const accountAccess = core.getAccountAccessStatus(access.userId);
-        if (accountAccess.canAccessApp)
+        const denied = resolveAppAccessDeniedResponse(accountAccess);
+        if (!denied)
             return true;
-        const code = accountAccess.gate === 'plan_selection_required'
-            ? 'PLAN_SELECTION_REQUIRED'
-            : accountAccess.gate === 'checkout_pending'
-                ? 'CHECKOUT_PENDING'
-                : accountAccess.gate === 'misconfigured'
-                    ? 'ACCOUNT_ACCESS_MISCONFIGURED'
-                    : 'ACCOUNT_ENTITLEMENT_REQUIRED';
-        res.writeHead(403, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            error: accountAccess.message || 'This account cannot access the app.',
-            code,
-            gate: accountAccess.gate,
-            canAccessPlans: accountAccess.canAccessPlans,
-            planSelectionRequired: accountAccess.planSelectionRequired
-        }));
+        res.writeHead(denied.statusCode, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(denied.body));
         return false;
     };
 }

package/dist/server/routes/sync.js

@@ -2,6 +2,7 @@ import { parseJsonBody } from './primitives.js';
 import { resolveSessionCookieAttributesForRequest } from '../auth.js';
 import { isAiProfileSurfaceType, parseAiProfileSurfaceType } from '../../shared/aiProfileSurfaceType.js';
 import { isAiProfileSeatScope } from '../../shared/aiProfileSeatScope.js';
+import { assertPlanningIdentityColor, assertPlanningIdentityIcon } from '../../shared/planningIdentity.js';
 import { serializeBinaryAssetSyncPayload, serializeDocumentSyncPayload, } from '../../sync/contentSyncPayload.js';
 import { normalizeAiProfileSyncPayload, normalizeAgentConversationSyncPayload, normalizeAgentRoleSyncPayload, normalizeAnnotatedAttachmentSessionSyncPayload, normalizeDocumentReviewCommentSyncPayload, normalizeDocumentReviewSessionSyncPayload, normalizeTaskforceAgentSkillSyncPayload, normalizeTaskforceAgentSyncPayload, } from '../../sync/collaborationSyncPayload.js';
 import { normalizeInitiativeSyncPayload, normalizeTaxonomySyncPayload, normalizeWorkstreamSyncPayload, } from '../../sync/planningSyncPayload.js';
@@ -451,6 +452,27 @@ export function registerSyncRoutes(deps) {
                     op: 'workstream-upsert',
                     workstream
                 })),
+                ...[
+                    ...incomingInitiatives.map((entity) => ({
+                        entityType: 'initiative',
+                        entityId: String(entity.id || '').trim(),
+                        icon: assertPlanningIdentityIcon(entity.icon),
+                        color: assertPlanningIdentityColor(entity.color),
+                        updatedAt: String(entity.identityUpdatedAt || '').trim(),
+                    })),
+                    ...incomingWorkstreams.map((entity) => ({
+                        entityType: 'workstream',
+                        entityId: String(entity.id || '').trim(),
+                        icon: assertPlanningIdentityIcon(entity.icon),
+                        color: assertPlanningIdentityColor(entity.color),
+                        updatedAt: String(entity.identityUpdatedAt || '').trim(),
+                    })),
+                ]
+                    .filter((identity) => identity.entityId.length > 0 && Number.isFinite(Date.parse(identity.updatedAt)))
+                    .map((identity) => ({
+                    op: 'planning-identity-upsert',
+                    identity,
+                })),
                 ...incomingAiProfiles
                     .map((profile) => normalizeAiProfileSyncPayload(profile, cloudWorkspaceId, normalizeIncomingAiProfileSurfaceType, normalizeIncomingAiProfileSeatScope, 'push.aiProfileUpsert'))
                     .filter((profile) => Boolean(profile && profile.id.length > 0))

package/dist/server/routes/syncV3FeedRoutes.js

@@ -352,7 +352,8 @@ export function registerWorkspaceSyncV3FeedRoutes(input) {
                         pageSize: Number.isFinite(limit) ? limit : undefined,
                         nestedCoverage: coverage.wire.nestedWriterPrerequisitesRequired,
                         workflowCoverage: coverage.wire.workflowWriterPrerequisitesRequired,
-                        planningOrderCoverage: coverage.wire.planningOrderWriterPrerequisitesRequired })
+                        planningOrderCoverage: coverage.wire.planningOrderWriterPrerequisitesRequired,
+                        coveredLegacyWritesFenced: combinedLegacyPushDisabled })
                     : buildWorkspaceSyncV3InitiativeRepairPage({ core: input.core, workspaceId,
                         cursorKeyring: cursorKeyring, cursor: repairCursor,
                         pageSize: Number.isFinite(limit) ? limit : undefined });
@@ -397,7 +398,8 @@ export function registerWorkspaceSyncV3FeedRoutes(input) {
                         cursorKeyring: cursorKeyring, pageSize: Number.isFinite(limit) ? limit : undefined,
                         nestedCoverage: coverage.wire.nestedWriterPrerequisitesRequired,
                         workflowCoverage: coverage.wire.workflowWriterPrerequisitesRequired,
-                        planningOrderCoverage: coverage.wire.planningOrderWriterPrerequisitesRequired })
+                        planningOrderCoverage: coverage.wire.planningOrderWriterPrerequisitesRequired,
+                        coveredLegacyWritesFenced: combinedLegacyPushDisabled })
                     : buildWorkspaceSyncV3InitiativeRepairPage({ core: input.core, workspaceId,
                         cursorKeyring: cursorKeyring, pageSize: Number.isFinite(limit) ? limit : undefined });
                 const repair = coverage.kind === 'combined' ? page : { ...page,

package/dist/server/routes/syncV3LocalCaptureRoutes.js

@@ -203,7 +203,8 @@ function parseEnvelope(raw) {
         return { ...common, domain: 'task-checklist', mutationKind: 'replace', items };
     }
     if (operation.domain === 'task-attachment-links' && operation.mutationKind === 'replace') {
-        assertExactKeys(payload, ['links'], 'operation.payload');
+        const hasCardCoverAssetId = Object.prototype.hasOwnProperty.call(payload, 'cardCoverAssetId');
+        assertExactKeys(payload, hasCardCoverAssetId ? ['links', 'cardCoverAssetId'] : ['links'], 'operation.payload');
         let links;
         try {
             links = validateWorkspaceSyncV3TaskAttachmentLinksPayload({ taskId: common.entityId, links: payload.links }).links;
@@ -211,7 +212,21 @@ function parseEnvelope(raw) {
         catch (error) {
             throw new LocalCaptureRequestError(error instanceof Error ? error.message : 'operation.payload.links is invalid.');
         }
-        return { ...common, domain: 'task-attachment-links', mutationKind: 'replace', links };
+        if (hasCardCoverAssetId && payload.cardCoverAssetId !== null
+            && (typeof payload.cardCoverAssetId !== 'string' || !payload.cardCoverAssetId.trim())) {
+            throw new LocalCaptureRequestError('operation.payload.cardCoverAssetId must be a non-empty string or null.');
+        }
+        return {
+            ...common,
+            domain: 'task-attachment-links',
+            mutationKind: 'replace',
+            links,
+            ...(hasCardCoverAssetId ? {
+                cardCoverAssetId: payload.cardCoverAssetId === null
+                    ? null
+                    : String(payload.cardCoverAssetId).trim(),
+            } : {}),
+        };
     }
     if (operation.domain === 'initiative') {
         const base = {
@@ -701,6 +716,9 @@ export function registerWorkspaceSyncV3LocalCaptureRoutes(input) {
                                                 identity,
                                                 taskId: envelope.entityId,
                                                 links: envelope.links,
+                                                ...(Object.prototype.hasOwnProperty.call(envelope, 'cardCoverAssetId')
+                                                    ? { cardCoverAssetId: envelope.cardCoverAssetId ?? null }
+                                                    : {}),
                                                 now: acceptedAt,
                                                 actorRef: 'user',
                                                 onPostCommitError: input.onPostCommitError,

package/dist/server/routes/syncV3OperationRoutes.js

@@ -471,7 +471,11 @@ export function parseWorkspaceSyncV3OperationEnvelope(body) {
         if (baseLifecycleRevision !== '0') {
             throw new SyncV3RequestError('Task attachment-link lifecycle revision must be 0.');
         }
-        assertExactKeys(payload, payload.originActor === undefined ? ['links'] : ['links', 'originActor'], 'operation.payload');
+        assertExactKeys(payload, [
+            'links',
+            ...(payload.cardCoverAssetId === undefined ? [] : ['cardCoverAssetId']),
+            ...(payload.originActor === undefined ? [] : ['originActor']),
+        ], 'operation.payload');
         let links;
         try {
             links = validateWorkspaceSyncV3TaskAttachmentLinksPayload({ taskId: entityId, links: payload.links }).links;
@@ -482,10 +486,21 @@ export function parseWorkspaceSyncV3OperationEnvelope(body) {
         const originActor = payload.originActor === undefined
             ? undefined
             : requireOriginActor(payload.originActor);
+        const cardCoverAssetId = payload.cardCoverAssetId === undefined
+            ? undefined
+            : payload.cardCoverAssetId === null
+                ? null
+                : typeof payload.cardCoverAssetId === 'string' && payload.cardCoverAssetId.trim()
+                    ? payload.cardCoverAssetId.trim()
+                    : (() => { throw new SyncV3RequestError('operation.payload.cardCoverAssetId must be a string or null.'); })();
         return { ...common, operation: {
                 domain: 'task-attachment-links', entityId, mutationKind: 'replace', baseEntityRevision,
                 baseLifecycleRevision: '0',
-                payload: { links, ...(originActor ? { originActor } : {}) },
+                payload: {
+                    links,
+                    ...(cardCoverAssetId !== undefined ? { cardCoverAssetId } : {}),
+                    ...(originActor ? { originActor } : {}),
+                },
             } };
     }
     if (operation.domain === 'entity-event'