@taskforcehq/taskforce 0.3.328 → 0.3.329

package/dist/server/workspaceDeletionAdmission.js

@@ -0,0 +1,50 @@
+export const WORKSPACE_DELETE_RETRY_COOLDOWN_MS = 30_000;
+/**
+ * Serializes destructive workspace cleanup inside one server process and
+ * throttles immediate retries after an attempt settles. The caller supplies
+ * time so the admission policy can be verified without timers.
+ */
+export class WorkspaceDeletionAdmission {
+    cooldownMs;
+    entries = new Map();
+    constructor(cooldownMs = WORKSPACE_DELETE_RETRY_COOLDOWN_MS) {
+        this.cooldownMs = cooldownMs;
+    }
+    checkExisting(key, now = Date.now()) {
+        let existing = this.entries.get(key);
+        if (existing?.state === 'cooldown' && existing.retryAt <= now) {
+            this.entries.delete(key);
+            existing = undefined;
+        }
+        if (existing?.state === 'in-flight') {
+            return {
+                allowed: false,
+                code: 'WORKSPACE_DELETE_IN_PROGRESS',
+                retryAfterMs: Math.max(1_000, this.cooldownMs),
+            };
+        }
+        if (existing?.state === 'cooldown') {
+            return {
+                allowed: false,
+                code: 'WORKSPACE_DELETE_RETRY_COOLDOWN',
+                retryAfterMs: Math.max(1_000, existing.retryAt - now),
+            };
+        }
+        return null;
+    }
+    acquire(key, now = Date.now()) {
+        const existing = this.checkExisting(key, now);
+        if (existing)
+            return existing;
+        this.entries.set(key, { state: 'in-flight' });
+        return { allowed: true };
+    }
+    settle(key, now = Date.now()) {
+        if (this.entries.get(key)?.state !== 'in-flight')
+            return;
+        this.entries.set(key, {
+            state: 'cooldown',
+            retryAt: now + this.cooldownMs,
+        });
+    }
+}

package/dist/service/localServiceCli.js

@@ -1,6 +1,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { applyLocalServiceCloudTarget, localServiceCloudTargetsEqual, parseLocalServiceCloudTarget, resolveLocalServiceCloudTarget, } from '../config/localServiceCloudTarget.js';
+import { localServiceRuntimeContractsEqual, parseLocalServiceRuntimeContract, resolveLocalServiceRuntimeContract, } from '../config/localServiceRuntimeContract.js';
 import { createStandaloneServer } from '../server/index.js';
 import { inspectLocalServiceDescriptor, redactLocalServiceDescriptor, } from '../server/localServiceLease.js';
 import { acquireLocalServiceOwnershipForRuntime, } from '../server/localServiceOwnershipBootstrap.js';
@@ -66,6 +67,13 @@ function reportCloudTargetMismatch(descriptorTarget, requestedTarget, error) {
         + 'Stop it with `taskforce service stop --drain`, then retry.');
     return true;
 }
+function reportRuntimeContractMismatch(descriptorContract, requestedContract, error) {
+    if (localServiceRuntimeContractsEqual(descriptorContract, requestedContract))
+        return false;
+    error('Taskforce service is running with a different or unverified local runtime contract. '
+        + 'Stop it with `taskforce service stop --drain`, then retry.');
+    return true;
+}
 function defaultRegisterShutdownSignals(handler) {
     process.once('SIGINT', handler);
     process.once('SIGTERM', handler);
@@ -85,6 +93,7 @@ async function waitForDescriptor(input, expected, options) {
 async function runForeground(command, options) {
     const requestedCloudTarget = resolveLocalServiceCloudTarget(options.env);
     applyLocalServiceCloudTarget(options.env, requestedCloudTarget);
+    const requestedRuntimeContract = resolveLocalServiceRuntimeContract(options.env);
     const ownership = await options.acquireOwnership(command.projectRoot, options.env);
     if (!ownership)
         throw new Error('The shared local service requires local runtime mode.');
@@ -96,6 +105,8 @@ async function runForeground(command, options) {
                 return 2;
             if (reportCloudTargetMismatch(inspection.descriptor.cloudTarget, requestedCloudTarget, options.error))
                 return 2;
+            if (reportRuntimeContractMismatch(inspection.descriptor.runtimeContract, requestedRuntimeContract, options.error))
+                return 2;
             options.log(`Taskforce service is already running at ${inspection.descriptor.endpoint}.`);
             return 0;
         }
@@ -129,6 +140,7 @@ async function runForeground(command, options) {
                 bootstrapCapability: ownership.lease.bootstrapCapability,
                 ownershipKey: ownership.lease.identity.ownershipKey,
                 cloudTarget: requestedCloudTarget,
+                runtimeContract: requestedRuntimeContract,
             },
             afterShutdown: async () => {
                 removeSignals();
@@ -152,6 +164,7 @@ async function runForeground(command, options) {
             protocolVersion: LOCAL_SERVICE_PROTOCOL_VERSION,
             appVersion: options.appVersion,
             cloudTarget: requestedCloudTarget,
+            runtimeContract: requestedRuntimeContract,
         });
         removeSignals = options.registerShutdownSignals(shutdown);
         server.once('error', (error) => {
@@ -231,11 +244,14 @@ async function runStatus(command, options) {
             const payload = await response.json();
             const coordinatorPayload = payload.coordinator;
             const diagnosticCloudTarget = parseLocalServiceCloudTarget(payload.cloudTarget);
+            const diagnosticRuntimeContract = parseLocalServiceRuntimeContract(payload.runtimeContract);
             if (payload.ownerPid !== inspection.descriptor.pid
                 || payload.generation !== inspection.descriptor.generation
                 || payload.protocolVersion !== inspection.descriptor.protocolVersion
                 || (inspection.descriptor.cloudTarget
                     && !localServiceCloudTargetsEqual(diagnosticCloudTarget, inspection.descriptor.cloudTarget))
+                || (inspection.descriptor.runtimeContract
+                    && !localServiceRuntimeContractsEqual(diagnosticRuntimeContract, inspection.descriptor.runtimeContract))
                 || !Array.isArray(payload.sessions)
                 || !coordinatorPayload
                 || typeof coordinatorPayload !== 'object'

package/dist/service/localServiceClientLifecycle.js

@@ -2,6 +2,7 @@ import { spawn } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
 import { applyLocalServiceCloudTarget, localServiceCloudTargetsEqual, parseLocalServiceCloudTarget, resolveLocalServiceCloudTarget, } from '../config/localServiceCloudTarget.js';
+import { localServiceRuntimeContractsEqual, parseLocalServiceRuntimeContract, resolveLocalServiceRuntimeContract, } from '../config/localServiceRuntimeContract.js';
 import { inspectLocalServiceDescriptor, } from '../server/localServiceLease.js';
 import { resolveLocalDatabaseIdentity } from '../server/localDatabaseIdentity.js';
 export const LOCAL_SERVICE_PROTOCOL_VERSION = '1';
@@ -23,6 +24,11 @@ const LOCAL_MCP_CLIENT_ENV_KEYS = [
     'TASKFORCE_AI_SURFACE_TYPE',
     'TASKFORCE_AI_SEAT_SCOPE',
 ];
+function isQaIdentityEnvironmentKey(key) {
+    return key.startsWith('TASKFORCE_E2E_')
+        || key.startsWith('TASKFORCE_PLAYWRIGHT_')
+        || key.startsWith('SYNC_SOAK_');
+}
 export function resolveLocalServiceLeaseInput(projectRoot, env) {
     const provider = env.TASKFORCE_DB_PROVIDER === 'postgres' ? 'postgres' : 'sqlite';
     return {
@@ -44,6 +50,10 @@ function buildLocalServiceProcessEnv(env, cloudTarget) {
     const serviceEnv = { ...env };
     for (const key of LOCAL_MCP_CLIENT_ENV_KEYS)
         delete serviceEnv[key];
+    for (const key of Object.keys(serviceEnv)) {
+        if (isQaIdentityEnvironmentKey(key))
+            delete serviceEnv[key];
+    }
     applyLocalServiceCloudTarget(serviceEnv, cloudTarget);
     return serviceEnv;
 }
@@ -84,10 +94,18 @@ async function validateLocalServiceReadiness(descriptor, fetchFn) {
     const readinessCloudTarget = readinessHasCloudTarget
         ? parseLocalServiceCloudTarget(readiness.cloudTarget)
         : null;
+    const readinessHasRuntimeContract = Object.prototype.hasOwnProperty.call(readiness, 'runtimeContract');
+    const readinessRuntimeContract = readinessHasRuntimeContract
+        ? parseLocalServiceRuntimeContract(readiness.runtimeContract)
+        : null;
     const descriptorCloudTarget = descriptor.cloudTarget || null;
+    const descriptorRuntimeContract = descriptor.runtimeContract || null;
     const cloudTargetsMatch = descriptorCloudTarget || readinessCloudTarget
         ? localServiceCloudTargetsEqual(descriptorCloudTarget, readinessCloudTarget)
         : true;
+    const runtimeContractsMatch = descriptorRuntimeContract || readinessRuntimeContract
+        ? localServiceRuntimeContractsEqual(descriptorRuntimeContract, readinessRuntimeContract)
+        : true;
     if (readiness.ready !== true
         || readiness.protocolVersion !== LOCAL_SERVICE_PROTOCOL_VERSION
         || readiness.protocolVersion !== descriptor.protocolVersion
@@ -96,10 +114,15 @@ async function validateLocalServiceReadiness(descriptor, fetchFn) {
         || readiness.endpoint !== descriptor.endpoint
         || readiness.dataIdentity !== descriptor.ownershipKey
         || (readinessHasCloudTarget && !readinessCloudTarget)
-        || !cloudTargetsMatch) {
+        || !cloudTargetsMatch
+        || (readinessHasRuntimeContract && !readinessRuntimeContract)
+        || !runtimeContractsMatch) {
         throw new Error('Taskforce shared local service readiness does not match its descriptor.');
     }
-    return descriptorCloudTarget;
+    return {
+        cloudTarget: descriptorCloudTarget,
+        runtimeContract: descriptorRuntimeContract,
+    };
 }
 async function requestIdleLocalServiceShutdown(descriptor, fetchFn) {
     let response;
@@ -121,7 +144,7 @@ async function requestIdleLocalServiceShutdown(descriptor, fetchFn) {
         });
     }
     catch (error) {
-        throw new Error('Taskforce service uses a different cloud target and could not be stopped safely. '
+        throw new Error('Taskforce service uses a different cloud target or runtime contract and could not be stopped safely. '
             + `No replacement was started. ${String(error?.message || error)}`);
     }
     if (!response.ok) {
@@ -129,7 +152,7 @@ async function requestIdleLocalServiceShutdown(descriptor, fetchFn) {
         const activeClientHint = response.status === 409
             ? ' It may have active MCP clients; close them or run `taskforce service stop --drain`, then retry.'
             : '';
-        throw new Error(`Taskforce service uses a different cloud target and refused safe idle replacement (${response.status}).`
+        throw new Error(`Taskforce service uses a different cloud target or runtime contract and refused safe idle replacement (${response.status}).`
             + activeClientHint
             + (detail ? ` ${detail}` : ''));
     }
@@ -141,13 +164,15 @@ export async function discoverOrStartLocalService(input) {
     const inspectDescriptor = input.inspectDescriptor || inspectLocalServiceDescriptor;
     const fetchFn = input.fetch || fetch;
     const requestedCloudTarget = resolveLocalServiceCloudTarget(input.env);
+    const requestedRuntimeContract = resolveLocalServiceRuntimeContract(input.env);
     const current = await inspectDescriptor(leaseInput);
     if (current.status === 'live' && current.descriptor) {
         if (current.descriptor.protocolVersion !== LOCAL_SERVICE_PROTOCOL_VERSION) {
             throw new Error(`Taskforce service protocol ${current.descriptor.protocolVersion} is incompatible with client protocol ${LOCAL_SERVICE_PROTOCOL_VERSION}.`);
         }
-        const runningCloudTarget = await validateLocalServiceReadiness(current.descriptor, fetchFn);
-        if (localServiceCloudTargetsEqual(runningCloudTarget, requestedCloudTarget)) {
+        const running = await validateLocalServiceReadiness(current.descriptor, fetchFn);
+        if (localServiceCloudTargetsEqual(running.cloudTarget, requestedCloudTarget)
+            && localServiceRuntimeContractsEqual(running.runtimeContract, requestedRuntimeContract)) {
             return current.descriptor;
         }
         await requestIdleLocalServiceShutdown(current.descriptor, fetchFn);
@@ -157,7 +182,7 @@ export async function discoverOrStartLocalService(input) {
             nowMs: input.nowMs,
         });
         if (stopped.status !== 'stale') {
-            throw new Error('Taskforce service accepted cloud-target replacement but did not release its owner lease. No replacement was started.');
+            throw new Error('Taskforce service accepted configuration replacement but did not release its owner lease. No replacement was started.');
         }
     }
     if (current.status === 'indeterminate') {
@@ -181,9 +206,10 @@ export async function discoverOrStartLocalService(input) {
     if (inspection.descriptor.protocolVersion !== LOCAL_SERVICE_PROTOCOL_VERSION) {
         throw new Error(`Taskforce service protocol ${inspection.descriptor.protocolVersion} is incompatible with client protocol ${LOCAL_SERVICE_PROTOCOL_VERSION}.`);
     }
-    const startedCloudTarget = await validateLocalServiceReadiness(inspection.descriptor, fetchFn);
-    if (!localServiceCloudTargetsEqual(startedCloudTarget, requestedCloudTarget)) {
-        throw new Error('Taskforce service started with a different or unverified cloud target; refusing to attach.');
+    const started = await validateLocalServiceReadiness(inspection.descriptor, fetchFn);
+    if (!localServiceCloudTargetsEqual(started.cloudTarget, requestedCloudTarget)
+        || !localServiceRuntimeContractsEqual(started.runtimeContract, requestedRuntimeContract)) {
+        throw new Error('Taskforce service started with a different or unverified cloud target/runtime contract; refusing to attach.');
     }
     return inspection.descriptor;
 }

package/dist/services/codexAppServerModelGateway.d.ts

@@ -0,0 +1,112 @@
+import type { ModelGateway, ModelGatewayGenerateInput, ModelGatewayGenerateResult } from './modelGateway.js';
+export type CodexAppServerModelKeyIdMap = Partial<Record<string, string>>;
+type CodexAppServerApprovalPolicy = 'never';
+type CodexAppServerSandboxMode = 'read-only';
+type CodexAppServerSandboxPolicy = {
+    type: 'readOnly';
+    networkAccess: false;
+};
+type CodexAppServerRuntimePolicy = {
+    cwd: string;
+    approvalPolicy: CodexAppServerApprovalPolicy;
+    sandbox: CodexAppServerSandboxMode;
+    sandboxPolicy: CodexAppServerSandboxPolicy;
+};
+export interface CodexAppServerClient {
+    initialize(): Promise<void>;
+    assertChatGptSubscriptionAuth(): Promise<void>;
+    startThread(input: {
+        model: string;
+        developerInstructions?: string;
+    } & CodexAppServerRuntimePolicy): Promise<{
+        threadId: string;
+    }>;
+    startTurnAndCollectText(input: {
+        threadId: string;
+        prompt: string;
+        model: string;
+        timeoutMs: number;
+    } & CodexAppServerRuntimePolicy): Promise<{
+        text: string;
+        stopReason?: string;
+    }>;
+    close(): void;
+}
+export interface CodexAppServerModelGatewayOptions {
+    client?: CodexAppServerClient;
+    clientFactory?: () => CodexAppServerClient;
+    command?: string;
+    args?: string[];
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    modelKeyIds?: CodexAppServerModelKeyIdMap;
+    timeoutMs?: number;
+    requestTimeoutMs?: number;
+}
+export declare const DEFAULT_CODEX_APP_SERVER_MODEL_KEY_IDS: CodexAppServerModelKeyIdMap;
+export declare function buildCodexAppServerEnv(source?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function sanitizeCodexAppServerStderr(value: unknown): string;
+export declare function collectCodexAppServerStderr(current: string, chunk: unknown): string;
+export declare function assertCodexChatGptSubscriptionAccount(result: unknown): void;
+export declare function isCodexSubscriptionDevRuntimeAllowed(source?: NodeJS.ProcessEnv): boolean;
+export declare function extractCodexTurnCompletion(messages: unknown[]): {
+    text: string;
+    stopReason: string;
+} | null;
+export declare class CodexAppServerJsonRpcClient implements CodexAppServerClient {
+    private readonly process;
+    private readonly pending;
+    private readonly notifications;
+    private nextId;
+    private initialized;
+    private readonly lineReader;
+    private readonly requestTimeoutMs;
+    private readonly turnRejectors;
+    private terminalError;
+    private stderrTail;
+    constructor(options?: {
+        command?: string;
+        args?: string[];
+        cwd?: string;
+        env?: NodeJS.ProcessEnv;
+        requestTimeoutMs?: number;
+    });
+    initialize(): Promise<void>;
+    assertChatGptSubscriptionAuth(): Promise<void>;
+    startThread(input: {
+        model: string;
+        developerInstructions?: string;
+    } & CodexAppServerRuntimePolicy): Promise<{
+        threadId: string;
+    }>;
+    startTurnAndCollectText(input: {
+        threadId: string;
+        prompt: string;
+        system?: string;
+        model: string;
+        timeoutMs: number;
+    } & CodexAppServerRuntimePolicy): Promise<{
+        text: string;
+        stopReason?: string;
+    }>;
+    close(): void;
+    private request;
+    private sendNotification;
+    private handleLine;
+    private sendResponseError;
+    private waitForTurnCompletion;
+    private rejectAll;
+    private fail;
+}
+export declare class CodexAppServerModelGateway implements ModelGateway {
+    private readonly client?;
+    private readonly clientFactory;
+    private readonly modelKeyIds;
+    private readonly timeoutMs;
+    private readonly cwd;
+    constructor(options?: CodexAppServerModelGatewayOptions);
+    generate(input: ModelGatewayGenerateInput): Promise<ModelGatewayGenerateResult>;
+    private resolveModelId;
+    private formatMessages;
+}
+export {};