@taskforcehq/taskforce 0.3.327 → 0.3.329

package/dist/server/routes/durableTaskHttpRouters.d.ts

@@ -10,8 +10,9 @@ export declare function createTaskHttpDurableRouters(input: {
     actorRef: string;
     root: {
         enabled: boolean;
+        hasCommittedOperation(): boolean;
         create(candidate: unknown): import("../../core/Taskforce.js").TaskItem;
-        update(taskIdInput: string, candidate: unknown, saveSource: "manual" | "autosave", activityAction?: "task-updated" | "task-schedule-changed"): import("../../core/Taskforce.js").TaskItem;
+        update(taskIdInput: string, candidate: unknown, saveSource: "manual" | "autosave", activityAction?: "task-updated" | "task-schedule-changed", expectedDetailRevision?: string): import("../../core/Taskforce.js").TaskItem;
         runBatch<T>(routeInput: string, request: unknown, apply: (context: {
             runChild<R>(mutation: () => R): R;
             deferPostCommitNotification(notify: () => void): void;
@@ -41,6 +42,7 @@ export declare function createTaskHttpDurableRouters(input: {
         replace(args: {
             taskId: string;
             items: readonly Partial<import("../../core/Taskforce.js").ChecklistItem>[];
+            expectedDetailRevision?: string;
         }): {
             state: "pending" | "committed";
             route: "local-outbox" | "cloud-acceptance";
@@ -53,6 +55,8 @@ export declare function createTaskHttpDurableRouters(input: {
         replace(args: {
             taskId: string;
             links: readonly import("../../sync/v3/workspaceSyncV3NestedTaskCodecs.js").WorkspaceSyncV3TaskAttachmentLink[];
+            cardCoverAssetId?: string | null;
+            expectedDetailRevision?: string;
         }): {
             state: "pending" | "committed";
             route: "local-outbox" | "cloud-acceptance";
@@ -65,6 +69,7 @@ export declare function createTaskHttpDurableRouters(input: {
         replace(args: {
             taskId: string;
             items: readonly Partial<import("../../core/Taskforce.js").ChecklistItem>[];
+            expectedDetailRevision?: string;
         }): {
             state: "pending" | "committed";
             route: "local-outbox" | "cloud-acceptance";
@@ -77,6 +82,8 @@ export declare function createTaskHttpDurableRouters(input: {
         replace(args: {
             taskId: string;
             links: readonly import("../../sync/v3/workspaceSyncV3NestedTaskCodecs.js").WorkspaceSyncV3TaskAttachmentLink[];
+            cardCoverAssetId?: string | null;
+            expectedDetailRevision?: string;
         }): {
             state: "pending" | "committed";
             route: "local-outbox" | "cloud-acceptance";
@@ -132,6 +139,7 @@ export declare function createTaskHttpDurableRouters(input: {
         }>, options?: {
             saveSource?: "manual" | "autosave";
             atomicItemFailures?: boolean;
+            expectedDetailRevision?: string;
         }): {
             preview: import("../../core/Taskforce.js").BulkUpdateFieldsPreview;
             results: import("../../core/Taskforce.js").TaskItem[];
@@ -147,8 +155,9 @@ export declare function createTaskHttpDurableRouters(input: {
     };
     createRootRouter: (operationId?: string, deferPostCommitNotification?: (notify: () => void) => void) => {
         enabled: boolean;
+        hasCommittedOperation(): boolean;
         create(candidate: unknown): import("../../core/Taskforce.js").TaskItem;
-        update(taskIdInput: string, candidate: unknown, saveSource: "manual" | "autosave", activityAction?: "task-updated" | "task-schedule-changed"): import("../../core/Taskforce.js").TaskItem;
+        update(taskIdInput: string, candidate: unknown, saveSource: "manual" | "autosave", activityAction?: "task-updated" | "task-schedule-changed", expectedDetailRevision?: string): import("../../core/Taskforce.js").TaskItem;
         runBatch<T>(routeInput: string, request: unknown, apply: (context: {
             runChild<R>(mutation: () => R): R;
             deferPostCommitNotification(notify: () => void): void;

package/dist/server/routes/durableTaskHttpRouters.js

@@ -4,12 +4,12 @@ import { createDurableTaskHttpRootMutationRouter } from '../../sync/v3/durableTa
 import { createDurableTaskCommentMutationRouter } from '../../sync/v3/durableTaskCommentMutationRouter.js';
 import { createDurableTaskChecklistMutationRouter } from '../../sync/v3/durableTaskChecklistMutationRouter.js';
 import { createDurableTaskAttachmentLinksMutationRouter } from '../../sync/v3/durableTaskAttachmentLinksMutationRouter.js';
-import { requestHeader, requestRuntimeMode, requestUserId } from './shared.js';
+import { requestHeader, requestHumanActorRef, requestRuntimeMode } from './shared.js';
 export function createTaskHttpDurableRouters(input) {
     const { core, context, req, workspaceId } = input;
     const runtimeMode = context.authConfig?.runtimeMode === 'cloud' ? 'cloud' : requestRuntimeMode(req);
     const parentOperationId = requestHeader(req, 'x-taskforce-operation-id', '').trim();
-    const actorRef = runtimeMode === 'cloud' ? (String(requestUserId(req) || '').trim() || 'user') : 'user';
+    const actorRef = requestHumanActorRef(req);
     const createRootRouter = (operationId = parentOperationId, deferPostCommitNotification) => createDurableTaskHttpRootMutationRouter({
         core,
         runtimeMode,

package/dist/server/routes/localService.js

@@ -185,6 +185,8 @@ export function registerLocalServiceRoutes(deps) {
             endpoint: context.endpoint?.() || null,
             projectIdentity: context.projectIdentity,
             dataIdentity: context.ownershipKey,
+            cloudTarget: context.cloudTarget,
+            runtimeContract: context.runtimeContract,
             transports: ['streamable-http'],
             health: {
                 lifecycle: context.sessions.state(),
@@ -279,6 +281,8 @@ export function registerLocalServiceRoutes(deps) {
             generation: context.generation,
             protocolVersion: context.protocolVersion,
             ownerPid: context.ownerPid,
+            cloudTarget: context.cloudTarget,
+            runtimeContract: context.runtimeContract,
             sessions: context.sessions.list(),
             ...(context.diagnostics?.() || {}),
         });

package/dist/server/routes/primitives.d.ts

@@ -4,6 +4,8 @@ import type { ResolvedObjectStorageConfig } from '../../storage/objectStorage.js
 import type { LocalSyncCoordinatorRouteServices } from '../../sync/coordinator/localSyncCoordinatorRouteServices.js';
 import type { WorkspaceSyncServerDataServices } from '../../sync/engine/workspaceSyncServerDataServices.js';
 import type { LocalServiceSessionManager } from '../localServiceSessions.js';
+import type { LocalServiceCloudTarget } from '../../config/localServiceCloudTarget.js';
+import type { LocalServiceRuntimeContract } from '../../config/localServiceRuntimeContract.js';
 export interface LocalServiceRouteContext {
     generation: string;
     protocolVersion: string;
@@ -11,6 +13,8 @@ export interface LocalServiceRouteContext {
     ownerPid: number;
     bootstrapCapability: string;
     ownershipKey: string;
+    cloudTarget: LocalServiceCloudTarget;
+    runtimeContract: LocalServiceRuntimeContract;
     projectIdentity: string;
     operationClientId: string;
     sessions: LocalServiceSessionManager;

package/dist/server/routes/shared.d.ts

@@ -11,6 +11,7 @@ import type { McpAccessTokenAuthResult, McpOAuthAccessTokenAuthResult, McpAccess
 import { type RouteContext } from './primitives.js';
 import { type AiProfileBootstrapConfig } from '../../mcp/aiProfileBootstrap.js';
 import type { AiProfileSeatScope } from '../../shared/aiProfileSeatScope.js';
+import { type RequestPerformanceDiagnostics } from '../../storage/postgresRequestDiagnostics.js';
 export declare function resolveErrorStatusCode(error: unknown, fallback?: number): number;
 export declare function buildCloudMcpProfileConnectionId(input: {
     oauth?: McpOAuthAccessTokenAuthResult | null;
@@ -19,6 +20,7 @@ export declare function buildCloudMcpProfileConnectionId(input: {
 }): string | null;
 export declare const BOOTSTRAP_ROUTE_SLOW_THRESHOLD_MS = 1500;
 export declare const BOOTSTRAP_ROUTE_SEVERE_THRESHOLD_MS = 5000;
+export declare const TASKFORCE_PERFORMANCE_TRACE_HEADER = "x-taskforce-performance-trace";
 export type ServerTimingMetric = {
     name: string;
     durationMs: number;
@@ -31,6 +33,17 @@ export declare function serializeJsonWithTiming(payload: unknown, startedAt?: nu
     byteLength: number;
     durationMs: number;
 };
+export declare function runWithPerformanceTrace<T>(req: IncomingMessage, callback: () => T): T;
+export declare function currentPerformanceTraceDiagnostics(): RequestPerformanceDiagnostics | null;
+export declare function performanceTraceServerTimingMetrics(diagnostics: RequestPerformanceDiagnostics | null): ServerTimingMetric[];
+export declare function setPerformanceTraceHeaders(res: ServerResponse, diagnostics: RequestPerformanceDiagnostics | null, responseBytes: number): void;
+export declare function respondWithPerformanceTraceJson(input: {
+    req: IncomingMessage;
+    res: ServerResponse;
+    route: string;
+    workspaceId: string;
+    load: () => unknown;
+}): void;
 export declare function requestBootstrapTraceId(req: IncomingMessage): string;
 export declare function logSlowBootstrapRoute(input: {
     route: string;
@@ -47,6 +60,7 @@ export declare function buildCloudMcpRuntimeAuth(input: {
         authenticatedViaToken: McpAccessTokenAuthResult | null;
         authenticatedViaOAuth: McpOAuthAccessTokenAuthResult | null;
         userId: string | null;
+        aiProfileIdentityAsserted?: boolean;
     } & Required<AiProfileBootstrapConfig>;
     requestHeader: (req: IncomingMessage, name: string, fallback?: string) => string;
     requestId?: string | null;
@@ -57,6 +71,7 @@ export declare function buildCloudMcpRuntimeAuth(input: {
     tokenId?: string | null;
     aiProfileToken?: AiProfileBootstrapConfig['aiProfileToken'];
     aiProfileId?: string | null;
+    aiProfileIdentityAsserted?: boolean;
     aiProfileName?: AiProfileBootstrapConfig['aiProfileName'];
     aiProfileIcon?: AiProfileBootstrapConfig['aiProfileIcon'];
     aiProfileColor?: AiProfileBootstrapConfig['aiProfileColor'];
@@ -79,6 +94,7 @@ export type CloudMcpRequestAuth = {
     authenticatedViaOAuth: McpOAuthAccessTokenAuthResult | null;
     userId: string | null;
     aiProfileId?: string | null;
+    aiProfileIdentityAsserted?: boolean;
 } & Required<AiProfileBootstrapConfig>;
 export declare function makeAuthenticateCloudMcpRequest(core: TaskforceCore, deps: {
     resolveAuthenticatedUserId: (req: IncomingMessage) => string;
@@ -101,6 +117,14 @@ export declare function requestRuntimeMode(req: IncomingMessage): 'local' | 'clo
 export declare function requestRole(req: IncomingMessage): string;
 export declare function requestSystemRole(req: IncomingMessage): 'system_admin' | 'user';
 export declare function requestUserId(req: IncomingMessage): string;
+/**
+ * Resolve the human actor recorded by ordinary HTTP mutations. The standalone
+ * server has already replaced this header with authenticated cloud identity
+ * when available; local signed-in clients provide the same account id through
+ * the request-scoped mutation header. Anonymous sessions retain the legacy
+ * generic actor for compatibility.
+ */
+export declare function requestHumanActorRef(req: IncomingMessage): string;
 export declare function makeRequestWorkspaceId(core: TaskforceCore, context: RouteContext): (req: IncomingMessage) => string;
 export declare function makeResolveAuthenticatedUserId(core: TaskforceCore, context: RouteContext, requestWorkspaceId: (req: IncomingMessage) => string): (req: IncomingMessage) => string;
 export declare function makeResolveAuthenticatedMutationUserId(core: TaskforceCore, context: RouteContext, requestWorkspaceId: (req: IncomingMessage) => string): (req: IncomingMessage) => string;

package/dist/server/routes/shared.js

@@ -17,7 +17,9 @@ import { resolveCanonicalMcpToolName } from '../../mcp/toolCallCompatibility.js'
 import { applyPrefixedRateLimitHeaders } from '../rateLimit.js';
 import { parseAiProfileBootstrapHeaders } from '../../mcp/aiProfileBootstrap.js';
 import { parseMcpClientId } from '../../mcp/clientRegistry.js';
+import { resolveAppAccessDeniedResponse } from '../appAccess.js';
 import { resolveCloudApplicationBaseUrl } from '../../config/applicationBaseUrl.js';
+import { getRequestPerformanceDiagnostics, runWithRequestPerformanceDiagnostics, } from '../../storage/postgresRequestDiagnostics.js';
 // === SECTION: Error helpers ===
 export function resolveErrorStatusCode(error, fallback = 400) {
     if (error instanceof TaskforceRuleError)
@@ -39,6 +41,7 @@ export function buildCloudMcpProfileConnectionId(input) {
 // === SECTION: Route timing helpers ===
 export const BOOTSTRAP_ROUTE_SLOW_THRESHOLD_MS = 1500;
 export const BOOTSTRAP_ROUTE_SEVERE_THRESHOLD_MS = 5000;
+export const TASKFORCE_PERFORMANCE_TRACE_HEADER = 'x-taskforce-performance-trace';
 function sanitizeServerTimingMetricName(name) {
     return String(name || 'taskforce-route')
         .trim()
@@ -68,6 +71,55 @@ export function serializeJsonWithTiming(payload, startedAt = getRouteTimingNow()
         durationMs: Math.max(0, getRouteTimingNow() - startedAt),
     };
 }
+export function runWithPerformanceTrace(req, callback) {
+    const enabled = requestHeader(req, TASKFORCE_PERFORMANCE_TRACE_HEADER, '').trim() === '1';
+    return runWithRequestPerformanceDiagnostics(enabled, callback);
+}
+export function currentPerformanceTraceDiagnostics() {
+    return getRequestPerformanceDiagnostics();
+}
+export function performanceTraceServerTimingMetrics(diagnostics) {
+    return diagnostics ? [{ name: 'postgres-worker-wait', durationMs: diagnostics.postgresWorkerWaitMs }] : [];
+}
+export function setPerformanceTraceHeaders(res, diagnostics, responseBytes) {
+    if (!diagnostics)
+        return;
+    res.setHeader('X-Taskforce-Postgres-Query-Count', String(diagnostics.postgresQueryCount));
+    res.setHeader('X-Taskforce-Postgres-Worker-Call-Count', String(diagnostics.postgresWorkerCallCount));
+    res.setHeader('X-Taskforce-Response-Bytes', String(responseBytes));
+}
+export function respondWithPerformanceTraceJson(input) {
+    runWithPerformanceTrace(input.req, () => {
+        const startedAt = getRouteTimingNow();
+        const data = input.load();
+        const loadCompletedAt = getRouteTimingNow();
+        const serialized = serializeJsonWithTiming(data);
+        const diagnostics = getRequestPerformanceDiagnostics();
+        const totalDurationMs = Math.max(0, getRouteTimingNow() - startedAt);
+        setServerTimingHeader(input.res, [
+            { name: 'route-total', durationMs: totalDurationMs },
+            { name: 'route-load', durationMs: loadCompletedAt - startedAt },
+            { name: 'route-json', durationMs: serialized.durationMs },
+            ...performanceTraceServerTimingMetrics(diagnostics),
+        ]);
+        setPerformanceTraceHeaders(input.res, diagnostics, serialized.byteLength);
+        logSlowBootstrapRoute({
+            route: input.route,
+            workspaceId: input.workspaceId,
+            traceId: requestBootstrapTraceId(input.req),
+            durationMs: totalDurationMs,
+            details: diagnostics ? {
+                responseBytes: serialized.byteLength,
+                postgresQueryCount: diagnostics.postgresQueryCount,
+                postgresWorkerCallCount: diagnostics.postgresWorkerCallCount,
+                postgresWorkerWaitMs: Math.round(diagnostics.postgresWorkerWaitMs),
+                jsonSerializeMs: serialized.durationMs,
+            } : { responseBytes: serialized.byteLength },
+        });
+        input.res.writeHead(200, { 'Content-Type': 'application/json' });
+        input.res.end(serialized.body);
+    });
+}
 export function requestBootstrapTraceId(req) {
     return requestHeader(req, 'x-taskforce-bootstrap-trace-id', '').trim();
 }
@@ -100,6 +152,7 @@ export function buildCloudMcpRuntimeAuth(input) {
         tokenId: auth.authenticatedViaToken?.tokenId || auth.authenticatedViaOAuth?.grantId || null,
         aiProfileToken: auth.aiProfileToken,
         aiProfileId: auth.authenticatedViaOAuth?.aiProfileId || null,
+        aiProfileIdentityAsserted: auth.aiProfileIdentityAsserted === true,
         aiProfileName: auth.aiProfileName,
         aiProfileIcon: auth.aiProfileIcon,
         aiProfileColor: auth.aiProfileColor,
@@ -183,6 +236,7 @@ export function makeAuthenticateCloudMcpRequest(core, deps) {
                 userId: null,
                 ...bootstrap,
                 aiProfileId: oauthAuth?.aiProfileId || null,
+                aiProfileIdentityAsserted: Boolean(bootstrap.aiProfileName || bootstrap.aiProfileProvider),
                 aiProfileToken: bootstrap.aiProfileToken || oauthAuth?.aiProfileToken || null,
                 aiProfileName: bootstrap.aiProfileName || oauthAuth?.aiProfileName || null,
                 mcpClientId: oauthAuth
@@ -337,6 +391,9 @@ export function makeHandleCloudMcpRequest(core, deps) {
     };
     return async function handleCloudMcpRequest(req, res) {
         const requestStartedAtMs = Date.now();
+        let authMs = 0;
+        let bodyParseMs = 0;
+        let rateLimitMs = 0;
         if (requestRuntimeMode(req) !== 'cloud') {
             writeMcpHttpError(res, 400, 'The /mcp HTTP endpoint is only available in cloud runtime. In local runtime, use the local stdio MCP server (for example: `taskforce mcp <project-path>`).');
             return;
@@ -347,7 +404,9 @@ export function makeHandleCloudMcpRequest(core, deps) {
             writeMcpHttpError(res, 405, 'Method not allowed.');
             return;
         }
+        const authStartedAtMs = Date.now();
         const auth = authenticateCloudMcpRequest(req, res);
+        authMs = Date.now() - authStartedAtMs;
         if (!auth)
             return;
         if (req.method !== 'POST') {
@@ -356,7 +415,9 @@ export function makeHandleCloudMcpRequest(core, deps) {
         }
         let body = undefined;
         try {
+            const bodyParseStartedAtMs = Date.now();
             body = await parseJsonBody(req);
+            bodyParseMs = Date.now() - bodyParseStartedAtMs;
         }
         catch (error) {
             writeMcpHttpError(res, resolveErrorStatusCode(error, 400), 'Invalid JSON body.');
@@ -364,6 +425,7 @@ export function makeHandleCloudMcpRequest(core, deps) {
         }
         const authScopes = auth.authenticatedViaToken?.scopes || auth.authenticatedViaOAuth?.scopes || [];
         const requestId = String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || randomUUID();
+        res.setHeader('X-Request-ID', requestId);
         const mcpMethod = !Array.isArray(body) && body !== null && typeof body === 'object'
             ? String(body.method || '')
             : '';
@@ -389,7 +451,11 @@ export function makeHandleCloudMcpRequest(core, deps) {
             writeMcpHttpError(res, 403, 'Forbidden.');
             return;
         }
-        if (!applyCloudMcpWriteRateLimit(req, res, auth, body))
+        const writeToolNames = extractMcpWriteToolNames(body);
+        const rateLimitStartedAtMs = Date.now();
+        const rateLimitAllowed = applyCloudMcpWriteRateLimit(req, res, auth, body);
+        rateLimitMs = Date.now() - rateLimitStartedAtMs;
+        if (!rateLimitAllowed)
             return;
         let runtime = null;
         let runtimeConstructionMs = 0;
@@ -397,6 +463,7 @@ export function makeHandleCloudMcpRequest(core, deps) {
         let requestHandlingMs = 0;
         let cleanupMs = 0;
         let outcome = 'success';
+        const toolTimingState = { value: null };
         try {
             const runtimeStartedAtMs = Date.now();
             // Intentionally isolate the MCP runtime per HTTP request. The runtime closes over
@@ -420,6 +487,25 @@ export function makeHandleCloudMcpRequest(core, deps) {
                     requestId,
                     authScopes,
                 }),
+                onToolCallTiming: (timing) => {
+                    toolTimingState.value = timing;
+                    if (!res.headersSent) {
+                        setServerTimingHeader(res, [
+                            { name: 'auth', durationMs: authMs },
+                            { name: 'body-parse', durationMs: bodyParseMs },
+                            { name: 'rate-limit', durationMs: rateLimitMs },
+                            { name: 'runtime', durationMs: runtimeConstructionMs },
+                            { name: 'transport-connect', durationMs: transportConnectMs },
+                            { name: 'tool-envelope-prepare', durationMs: timing.preparationMs },
+                            { name: 'tool-envelope-validate', durationMs: timing.validationMs },
+                            { name: 'tool-handler', durationMs: timing.handlerMs },
+                            ...Object.entries(timing.subphases).map(([phase, durationMs]) => ({
+                                name: `tool-${phase}`,
+                                durationMs,
+                            })),
+                        ]);
+                    }
+                },
             });
             runtimeConstructionMs = Date.now() - runtimeStartedAtMs;
             const transport = new StreamableHTTPServerTransport({
@@ -465,7 +551,8 @@ export function makeHandleCloudMcpRequest(core, deps) {
                 cleanupMs = Date.now() - cleanupStartedAtMs;
             }
             const totalDurationMs = Date.now() - requestStartedAtMs;
-            if (initializeRequest || mcpMethod === 'tools/list' || totalDurationMs >= 250) {
+            if (initializeRequest || mcpMethod === 'tools/list' || writeToolNames.length > 0 || totalDurationMs >= 250) {
+                const timingSnapshot = toolTimingState.value;
                 console.info(`[Taskforce MCP] ${JSON.stringify({
                     event: 'cloud_request_timing',
                     requestId,
@@ -477,13 +564,23 @@ export function makeHandleCloudMcpRequest(core, deps) {
                     method: mcpMethod || null,
                     toolName: extractFirstMcpToolName(body),
                     workspaceId: auth.workspaceId,
+                    databaseProvider: core.getDatabaseProvider(),
+                    authMode: auth.authenticatedViaToken ? 'token' : auth.authenticatedViaOAuth ? 'oauth' : 'user',
+                    batchSize: Array.isArray(body) ? body.length : 1,
+                    isWrite: writeToolNames.length > 0,
                     outcome,
+                    httpStatus: res.statusCode,
+                    responseBytes: timingSnapshot?.responseBytes ?? null,
                     totalDurationMs,
                     preRuntimeMs: Math.max(0, totalDurationMs - runtimeConstructionMs - transportConnectMs - requestHandlingMs - cleanupMs),
+                    authMs,
+                    bodyParseMs,
+                    rateLimitMs,
                     runtimeConstructionMs,
                     transportConnectMs,
                     requestHandlingMs,
                     cleanupMs,
+                    toolTiming: timingSnapshot,
                 })}`);
             }
         }
@@ -521,6 +618,17 @@ export function requestSystemRole(req) {
 export function requestUserId(req) {
     return requestHeader(req, 'x-taskforce-user-id', 'anonymous') || 'anonymous';
 }
+/**
+ * Resolve the human actor recorded by ordinary HTTP mutations. The standalone
+ * server has already replaced this header with authenticated cloud identity
+ * when available; local signed-in clients provide the same account id through
+ * the request-scoped mutation header. Anonymous sessions retain the legacy
+ * generic actor for compatibility.
+ */
+export function requestHumanActorRef(req) {
+    const userId = String(requestUserId(req) || '').trim();
+    return userId && userId !== 'anonymous' ? userId : 'user';
+}
 // === SECTION: Workspace ID resolution ===
 export function makeRequestWorkspaceId(core, context) {
     return function requestWorkspaceId(req) {
@@ -625,23 +733,11 @@ export function makeEnsureAppAccess(core, context) {
         if (!access.authenticated || !access.userId || access.userId === 'anonymous')
             return true;
         const accountAccess = core.getAccountAccessStatus(access.userId);
-        if (accountAccess.canAccessApp)
+        const denied = resolveAppAccessDeniedResponse(accountAccess);
+        if (!denied)
             return true;
-        const code = accountAccess.gate === 'plan_selection_required'
-            ? 'PLAN_SELECTION_REQUIRED'
-            : accountAccess.gate === 'checkout_pending'
-                ? 'CHECKOUT_PENDING'
-                : accountAccess.gate === 'misconfigured'
-                    ? 'ACCOUNT_ACCESS_MISCONFIGURED'
-                    : 'ACCOUNT_ENTITLEMENT_REQUIRED';
-        res.writeHead(403, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({
-            error: accountAccess.message || 'This account cannot access the app.',
-            code,
-            gate: accountAccess.gate,
-            canAccessPlans: accountAccess.canAccessPlans,
-            planSelectionRequired: accountAccess.planSelectionRequired
-        }));
+        res.writeHead(denied.statusCode, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(denied.body));
         return false;
     };
 }

package/dist/server/routes/sync.js

@@ -2,6 +2,7 @@ import { parseJsonBody } from './primitives.js';
 import { resolveSessionCookieAttributesForRequest } from '../auth.js';
 import { isAiProfileSurfaceType, parseAiProfileSurfaceType } from '../../shared/aiProfileSurfaceType.js';
 import { isAiProfileSeatScope } from '../../shared/aiProfileSeatScope.js';
+import { assertPlanningIdentityColor, assertPlanningIdentityIcon } from '../../shared/planningIdentity.js';
 import { serializeBinaryAssetSyncPayload, serializeDocumentSyncPayload, } from '../../sync/contentSyncPayload.js';
 import { normalizeAiProfileSyncPayload, normalizeAgentConversationSyncPayload, normalizeAgentRoleSyncPayload, normalizeAnnotatedAttachmentSessionSyncPayload, normalizeDocumentReviewCommentSyncPayload, normalizeDocumentReviewSessionSyncPayload, normalizeTaskforceAgentSkillSyncPayload, normalizeTaskforceAgentSyncPayload, } from '../../sync/collaborationSyncPayload.js';
 import { normalizeInitiativeSyncPayload, normalizeTaxonomySyncPayload, normalizeWorkstreamSyncPayload, } from '../../sync/planningSyncPayload.js';
@@ -451,6 +452,27 @@ export function registerSyncRoutes(deps) {
                     op: 'workstream-upsert',
                     workstream
                 })),
+                ...[
+                    ...incomingInitiatives.map((entity) => ({
+                        entityType: 'initiative',
+                        entityId: String(entity.id || '').trim(),
+                        icon: assertPlanningIdentityIcon(entity.icon),
+                        color: assertPlanningIdentityColor(entity.color),
+                        updatedAt: String(entity.identityUpdatedAt || '').trim(),
+                    })),
+                    ...incomingWorkstreams.map((entity) => ({
+                        entityType: 'workstream',
+                        entityId: String(entity.id || '').trim(),
+                        icon: assertPlanningIdentityIcon(entity.icon),
+                        color: assertPlanningIdentityColor(entity.color),
+                        updatedAt: String(entity.identityUpdatedAt || '').trim(),
+                    })),
+                ]
+                    .filter((identity) => identity.entityId.length > 0 && Number.isFinite(Date.parse(identity.updatedAt)))
+                    .map((identity) => ({
+                    op: 'planning-identity-upsert',
+                    identity,
+                })),
                 ...incomingAiProfiles
                     .map((profile) => normalizeAiProfileSyncPayload(profile, cloudWorkspaceId, normalizeIncomingAiProfileSurfaceType, normalizeIncomingAiProfileSeatScope, 'push.aiProfileUpsert'))
                     .filter((profile) => Boolean(profile && profile.id.length > 0))

package/dist/server/routes/syncAuxRoutes.js

@@ -50,8 +50,11 @@ export function registerWorkspaceSyncAuxRoutes({ addRoute, core, context, resolv
         res.end(JSON.stringify({ success: true }));
     });
     // POST /api/taskforce/sync/workspace/repair-startup - Auto-repair workspace asset/document
-    // metadata on workspace open. Safe fixups re-register metadata for local files and mark
-    // stale, unreferenced metadata deleted when the file is missing. Never deletes files.
+    // metadata on workspace open. Safe fixups re-register metadata for local files and clean up
+    // stale links. Does NOT tombstone metadata for files that appear missing locally — a single
+    // failed existence check at startup can mean the content is only temporarily unavailable
+    // (e.g. storage not yet mounted/synced), not deleted; that requires explicit admin
+    // confirmation via /api/taskforce/admin/workspace-repair/apply. Never deletes files.
     // Called once by the sync orchestrator when the workspace becomes active.
     addRoute('POST', '/api/taskforce/sync/workspace/repair-startup', async (req, res) => {
         const authConfig = context.authConfig;

package/dist/server/routes/syncPullApplyRoutes.js

@@ -1,7 +1,7 @@
 import { DEFAULT_WORKSPACE_PULL_PAGE_MAX_BYTES, buildWorkspacePullFeed, WorkspacePullEntryTooLargeError, } from '../../sync/workspacePullFeed.js';
 import { applyWorkspaceSyncLocalBatch } from '../../sync/engine/workspaceSyncEngineLocalApply.js';
 import { parseJsonBody } from './primitives.js';
-import { normalizeWorkspaceSyncV2ProjectionExclusions, parseWorkspaceSyncV2ProjectionExclusions, WORKSPACE_SYNC_V3_COMBINED_V2_EXCLUSIONS, } from '../../sync/v3/workspaceSyncV2ProjectionExclusions.js';
+import { normalizeWorkspaceSyncV2ProjectionExclusions, parseWorkspaceSyncV2ProjectionExclusions, WORKSPACE_SYNC_V3_COMBINED_V2_EXCLUSIONS, workspaceSyncV2ProjectionExclusionsEqual, } from '../../sync/v3/workspaceSyncV2ProjectionExclusions.js';
 import { resolveWorkspaceSyncV3AttestedV2Exclusions } from '../../sync/v3/workspaceSyncV3LegacyBoundaryAttestation.js';
 import { requireAuthenticatedSyncRequest, requireEnabledSyncAuth, resolveAuthorizedSyncWorkspace, } from './syncRouteGuards.js';
 import { completeLocalSyncBrowserPushEchoPermitGroup, createLocalSyncBrowserV2ApplyTransactionHooks, parseLocalSyncBrowserApplyPermitContext, resolveLocalSyncBrowserApplyPermitOperationClass, } from '../../sync/coordinator/localSyncBrowserApplyPermitContext.js';
@@ -301,7 +301,16 @@ export function registerWorkspacePullApplySyncRoutes({ addRoute, core, context,
                 };
             }
             if (!change) {
-                missing.push(request);
+                missing.push({
+                    ...request,
+                    disposition: request.kind === 'asset'
+                        && 'assetId' in request
+                        && (!requestedAsset
+                            || requestedAsset.deletedAt
+                            || requestedAsset.storageProvider === 'external')
+                        ? 'terminal-unavailable'
+                        : 'retryable',
+                });
                 consumed += 1;
                 continue;
             }
@@ -554,6 +563,16 @@ export function registerWorkspacePullApplySyncRoutes({ addRoute, core, context,
                 : null;
             let applyResult;
             if (permitContext && coordinatorServices && permitOperationClass === 'push') {
+                const attestedV2ExcludedProjections = v2ExcludedProjections.length > 0
+                    ? (() => {
+                        const attested = resolveWorkspaceSyncV3AttestedV2Exclusions({
+                            coverage: body?.combinedCoverage,
+                            excludedProjections: v2ExcludedProjections,
+                            runtimeMode: 'local',
+                        });
+                        return attested && workspaceSyncV2ProjectionExclusionsEqual(attested, v2ExcludedProjections) ? attested : null;
+                    })()
+                    : [];
                 applyResult = completeLocalSyncBrowserPushEchoPermitGroup({
                     services: coordinatorServices,
                     cookieHeader: req.headers.cookie,
@@ -567,13 +586,13 @@ export function registerWorkspacePullApplySyncRoutes({ addRoute, core, context,
                             || workspaceMembers !== undefined
                             || body?.bootstrapSnapshot !== undefined
                             || allowReferenceNumberReassignment
-                            || v2ExcludedProjections.length > 0) {
+                            || !attestedV2ExcludedProjections) {
                             throw new Error('Browser push echo apply accepts only authoritative task upserts.');
                         }
                         return dispatchWorkspaceSyncMetadataAtomically(workspaceId, incomingChanges, {
                             allowReferenceNumberReassignment: false,
                             coexistenceDirection: 'local-pull',
-                            v2ExcludedProjections: [],
+                            v2ExcludedProjections: attestedV2ExcludedProjections,
                         });
                     },
                 });

package/dist/server/routes/syncV3FeedRoutes.js

@@ -5,7 +5,7 @@ import { buildWorkspaceSyncV3InitiativeRepairPage, decodeWorkspaceSyncV3Initiati
 import { WORKSPACE_SYNC_V3_COVERAGE_PROFILE } from '../../sync/v3/workspaceSyncV3FeedProfile.js';
 import { isWorkspaceSyncV3InitiativeLegacyPushDisabled } from '../../sync/v3/planningActivation.js';
 import { WORKSPACE_SYNC_V3_COMBINED_COVERAGE_PROFILE } from '../../sync/v3/workspaceSyncV3CombinedCoverage.js';
-import { buildWorkspaceSyncV3CombinedRepairPage, decodeWorkspaceSyncV3CombinedRepairCursor, decodeWorkspaceSyncV3NestedRepairCursor, decodeWorkspaceSyncV3PlanningOrderRepairCursor, decodeWorkspaceSyncV3WorkflowRepairCursor, WorkspaceSyncV3CombinedRepairSnapshotUnavailableError, } from '../../sync/v3/workspaceSyncV3CombinedRepairMaterialization.js';
+import { buildWorkspaceSyncV3CombinedRepairPage, decodeWorkspaceSyncV3CombinedRepairCursor, decodeWorkspaceSyncV3NestedRepairCursor, decodeWorkspaceSyncV3PlanningOrderRepairCursor, decodeWorkspaceSyncV3TaskCoverRepairCursor, decodeWorkspaceSyncV3WorkflowRepairCursor, WorkspaceSyncV3CombinedRepairSnapshotUnavailableError, } from '../../sync/v3/workspaceSyncV3CombinedRepairMaterialization.js';
 import { isWorkspaceSyncV3CombinedLegacyFenceEnabled } from '../../sync/v3/workspaceSyncV2ProjectionExclusions.js';
 import { resolveCombinedFeedCapability } from '../../sync/v3/combinedFeedCapability.js';
 import { resolveWorkspaceSyncV3RegisteredCoverage } from '../../sync/v3/workspaceSyncV3CoverageRegistry.js';
@@ -21,6 +21,17 @@ function json(res, status, body) {
     res.writeHead(status, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
     res.end(JSON.stringify(body));
 }
+function decodeCombinedRepairCursorForContract(rawCursor, keyring, wire) {
+    if (wire.taskCoverProjectionRequired)
+        return decodeWorkspaceSyncV3TaskCoverRepairCursor(rawCursor, keyring);
+    if (wire.workflowWriterPrerequisitesRequired)
+        return decodeWorkspaceSyncV3WorkflowRepairCursor(rawCursor, keyring);
+    if (wire.planningOrderWriterPrerequisitesRequired)
+        return decodeWorkspaceSyncV3PlanningOrderRepairCursor(rawCursor, keyring);
+    if (wire.nestedWriterPrerequisitesRequired)
+        return decodeWorkspaceSyncV3NestedRepairCursor(rawCursor, keyring);
+    return decodeWorkspaceSyncV3CombinedRepairCursor(rawCursor, keyring);
+}
 function attestLegacyPushBoundary(body, boundary) {
     const attested = { ...body, ...boundary };
     const mutable = attested;
@@ -215,13 +226,7 @@ export function registerWorkspaceSyncV3FeedRoutes(input) {
                 return;
             }
             const rawCursor = String(url.searchParams.get('cursor') || '').trim();
-            const cursor = requestedWire.workflowWriterPrerequisitesRequired
-                ? decodeWorkspaceSyncV3WorkflowRepairCursor(rawCursor, keyring)
-                : requestedWire.planningOrderWriterPrerequisitesRequired
-                    ? decodeWorkspaceSyncV3PlanningOrderRepairCursor(rawCursor, keyring)
-                    : requestedWire.nestedWriterPrerequisitesRequired
-                        ? decodeWorkspaceSyncV3NestedRepairCursor(rawCursor, keyring)
-                        : decodeWorkspaceSyncV3CombinedRepairCursor(rawCursor, keyring);
+            const cursor = decodeCombinedRepairCursorForContract(rawCursor, keyring, requestedWire);
             if (rawCursor && !cursor) {
                 json(res, 400, { success: false, code: 'INVALID_SYNC_COMBINED_REPAIR_CURSOR', error: 'Invalid combined repair cursor.' });
                 return;
@@ -231,7 +236,8 @@ export function registerWorkspaceSyncV3FeedRoutes(input) {
                 cursorKeyring: keyring, cursor, pageSize: Number.isFinite(limit) ? limit : undefined,
                 nestedCoverage: requestedWire.nestedWriterPrerequisitesRequired,
                 workflowCoverage: requestedWire.workflowWriterPrerequisitesRequired,
-                planningOrderCoverage: requestedWire.planningOrderWriterPrerequisitesRequired });
+                planningOrderCoverage: requestedWire.planningOrderWriterPrerequisitesRequired,
+                taskCoverCoverage: requestedWire.taskCoverProjectionRequired });
             json(res, 200, attestLegacyPushBoundary({ ...page }, {
                 contractVersion: 3,
                 legacyV2Boundary: { cloudWritesFenced: false, excludedProjections: [] },
@@ -328,13 +334,7 @@ export function registerWorkspaceSyncV3FeedRoutes(input) {
             return;
         }
         const repairCursor = coverage.kind === 'combined'
-            ? (coverage.wire.workflowWriterPrerequisitesRequired
-                ? decodeWorkspaceSyncV3WorkflowRepairCursor(rawRepairCursor, cursorKeyring)
-                : coverage.wire.planningOrderWriterPrerequisitesRequired
-                    ? decodeWorkspaceSyncV3PlanningOrderRepairCursor(rawRepairCursor, cursorKeyring)
-                    : coverage.wire.nestedWriterPrerequisitesRequired
-                        ? decodeWorkspaceSyncV3NestedRepairCursor(rawRepairCursor, cursorKeyring)
-                        : decodeWorkspaceSyncV3CombinedRepairCursor(rawRepairCursor, cursorKeyring))
+            ? decodeCombinedRepairCursorForContract(rawRepairCursor, cursorKeyring, coverage.wire)
             : decodeWorkspaceSyncV3InitiativeRepairCursor(rawRepairCursor, cursorKeyring);
         if (rawRepairCursor && (!repairEnabled || !repairCursor)) {
             json(res, 400, { success: false, code: 'INVALID_SYNC_V3_REPAIR_CURSOR', error: 'Invalid repair cursor.' });
@@ -352,7 +352,9 @@ export function registerWorkspaceSyncV3FeedRoutes(input) {
                         pageSize: Number.isFinite(limit) ? limit : undefined,
                         nestedCoverage: coverage.wire.nestedWriterPrerequisitesRequired,
                         workflowCoverage: coverage.wire.workflowWriterPrerequisitesRequired,
-                        planningOrderCoverage: coverage.wire.planningOrderWriterPrerequisitesRequired })
+                        planningOrderCoverage: coverage.wire.planningOrderWriterPrerequisitesRequired,
+                        taskCoverCoverage: coverage.wire.taskCoverProjectionRequired,
+                        coveredLegacyWritesFenced: combinedLegacyPushDisabled })
                     : buildWorkspaceSyncV3InitiativeRepairPage({ core: input.core, workspaceId,
                         cursorKeyring: cursorKeyring, cursor: repairCursor,
                         pageSize: Number.isFinite(limit) ? limit : undefined });
@@ -397,7 +399,9 @@ export function registerWorkspaceSyncV3FeedRoutes(input) {
                         cursorKeyring: cursorKeyring, pageSize: Number.isFinite(limit) ? limit : undefined,
                         nestedCoverage: coverage.wire.nestedWriterPrerequisitesRequired,
                         workflowCoverage: coverage.wire.workflowWriterPrerequisitesRequired,
-                        planningOrderCoverage: coverage.wire.planningOrderWriterPrerequisitesRequired })
+                        planningOrderCoverage: coverage.wire.planningOrderWriterPrerequisitesRequired,
+                        taskCoverCoverage: coverage.wire.taskCoverProjectionRequired,
+                        coveredLegacyWritesFenced: combinedLegacyPushDisabled })
                     : buildWorkspaceSyncV3InitiativeRepairPage({ core: input.core, workspaceId,
                         cursorKeyring: cursorKeyring, pageSize: Number.isFinite(limit) ? limit : undefined });
                 const repair = coverage.kind === 'combined' ? page : { ...page,