@taskforcehq/taskforce 0.3.328 → 0.3.330

package/dist/core/Taskforce.js

@@ -27,6 +27,7 @@ import { listTaskAttachmentLinksForDurableSync as listTaskAttachmentLinksForDura
 import { EntityEventIdentityCollisionError, addEntityEventService, addTaskEventService, buildEntityActivityService, buildTaskActivityService, getEntityEventForSyncService, getTaskEventForSyncService, listEntityEventsInternalService, listWorkspaceEntityEventsForSyncService, listTaskEventsInternalService, listWorkspaceTaskEventsForSyncService, replaceEntityEventsService, replaceTaskCommentsService, replaceTaskEventsService, upsertEntityEventForSyncService, deleteEntityEventForSyncService, upsertTaskEventForSyncService, } from './TaskActivityService.js';
 import { addDeletedTaskRecordService, getDeletedTaskService, listDeletedTasksService, listDeletedTasksReadOnlyService, mapDeletedTaskRowService, normalizeTaskSnapshotForRestoreService, normalizeDeletedTaskRestoreLifecycleService, purgeExpiredDeletedTasksService, } from './DeletedTaskLifecycleService.js';
 import { DELETED_TASK_RETENTION_DAYS } from '../shared/deletedTaskRetention.js';
+import { INTERNAL_SUBSCRIPTION_MODEL_FEATURE_KEY, isSupportedInternalUserFeatureKey, } from '../shared/userFeatureGrants.js';
 import { applyWorkspaceSyncSnapshotService, claimPushIdempotencyService, completePushIdempotencyClaimService, deleteDocumentWatermarkService, deleteDocumentWatermarkStrictService, getDocumentWatermarkService, listTasksForSyncService, listWorkspaceSyncDeletesSinceService, readPushIdempotencyService, releasePushIdempotencyClaimService, renewPushIdempotencyClaimService, recordSyncEventDurablyService, recordSyncEventService, upsertDocumentWatermarkService, upsertDocumentWatermarkStrictService, writePushIdempotencyService, } from './SyncReconciliationService.js';
 import { getGlobalSettingsService, hasPersistedGlobalSettingsService, readGlobalConfigService, updateGlobalSettingsService, writeGlobalConfigService, } from './GlobalSettingsService.js';
 import { getWorkspaceTaxonomyStateService, upsertWorkspaceTaxonomyStateService, } from './TaxonomySettingsService.js';
@@ -61,7 +62,8 @@ import { getImageReferenceLabel } from '../utils/imageReferences.js';
 import { getCanonicalDocumentName } from '../utils/documentNames.js';
 import { isPathInsideRoot, resolveStorageKeyPathInsideRoot } from '../utils/pathSafety.js';
 import { DEFAULT_TASKFORCE_THEME } from '../utils/theme.js';
-import { ensureAssigneeTaskSchema, ensureAnnotatedAttachmentSessionsSchema, ensureAuthIdentitySchema, backfillPlanningAttachmentAssetIdentities, ensureBillingSchema, ensureDocumentReviewSessionsSchema, ensureDocumentReferenceSchema, ensureEntitlementsSchema, ensurePlanningReferenceSchema, ensureScheduleTaskSchema, ensureWorkstreamTaskOrderSchema, ensureTaskAssetsSchema, ensureTaskApproachRemoved, ensureAgentRolesSchema, ensureTaskforceAgentsSchema, ensureTaskforceAgentSkillsSchema, ensureTaskReferenceSchema, ensureTenantSchema, ensureWorkflowSchema, ensureWorkspaceAssetsSchema, ensureWorkspaceSchema, ensureLocalSyncCoordinatorSchema, ensureWorkspaceSyncDurabilitySchema } from '../migrations/taskSchemaMigrations.js';
+import { normalizeTaskSearchQuery } from '../utils/taskSearch.js';
+import { ensureAssigneeTaskSchema, ensureAnnotatedAttachmentSessionsSchema, ensureAuthIdentitySchema, backfillPlanningAttachmentAssetIdentities, ensureBillingSchema, ensureDocumentReviewSessionsSchema, ensureDocumentReferenceSchema, ensureEntitlementsSchema, ensurePlanningReferenceSchema, ensureScheduleTaskSchema, ensureWorkstreamTaskOrderSchema, ensureTaskAssetsSchema, ensureTaskApproachRemoved, ensureAgentRolesSchema, ensureGitHubReviewEvidenceInstallationBindingsSchema, ensureExecutorPhaseAApprovalReceiptsSchema, ensureExecutorPhaseARunAuthorizationsSchema, ensureModelProviderConnectionsSchema, ensureTaskforceAgentConnectionBindingsSchema, ensureTaskforceAgentsSchema, ensureTaskforceAgentSkillsSchema, ensureTaskReferenceSchema, ensureTenantSchema, ensureWorkflowSchema, ensureWorkspaceAssetsSchema, ensureWorkspaceSchema, ensureLocalSyncCoordinatorSchema, ensureWorkspaceSyncDurabilitySchema } from '../migrations/taskSchemaMigrations.js';
 import { repairTaskUpdatedAtOnlySyncDrift } from '../migrations/taskUpdatedAtSyncDriftMigration.js';
 export class TaskforceRuleError extends Error {
     statusCode;
@@ -1456,7 +1458,14 @@ export class TaskforceCore {
             ensureDocumentReferenceSchema(this.db);
             ensureDocumentReviewSessionsSchema(this.db);
             ensureAnnotatedAttachmentSessionsSchema(this.db);
+            ensureModelProviderConnectionsSchema(this.db);
             ensureTaskforceAgentsSchema(this.db);
+            ensureTaskforceAgentConnectionBindingsSchema(this.db);
+            ensureGitHubReviewEvidenceInstallationBindingsSchema(this.db);
+            if (this.runtimeMode === 'cloud') {
+                ensureExecutorPhaseAApprovalReceiptsSchema(this.db);
+                ensureExecutorPhaseARunAuthorizationsSchema(this.db);
+            }
             ensureAgentRolesSchema(this.db);
             ensureTaskforceAgentSkillsSchema(this.db);
             ensureWorkflowSchema(this.db);
@@ -1968,6 +1977,18 @@ export class TaskforceCore {
                 PRIMARY KEY (tenant_id, user_id, prefs_key)
             );
 
+            CREATE TABLE IF NOT EXISTS user_feature_grants (
+                tenant_id TEXT NOT NULL DEFAULT 'default',
+                user_id TEXT NOT NULL,
+                feature_key TEXT NOT NULL,
+                enabled INTEGER NOT NULL DEFAULT 0,
+                created_at TEXT NOT NULL,
+                updated_at TEXT NOT NULL,
+                updated_by TEXT,
+                PRIMARY KEY (tenant_id, user_id, feature_key),
+                FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+            );
+
             CREATE TABLE IF NOT EXISTS admin_audit_logs (
                 id TEXT PRIMARY KEY,
                 tenant_id TEXT NOT NULL DEFAULT 'default',
@@ -2046,6 +2067,7 @@ export class TaskforceCore {
                 user_id TEXT NOT NULL,
                 workspace_id TEXT NOT NULL DEFAULT 'default',
                 scopes_json TEXT NOT NULL,
+                tool_profile TEXT NOT NULL DEFAULT 'default',
                 token_prefix TEXT NOT NULL,
                 token_hash TEXT NOT NULL,
                 status TEXT NOT NULL DEFAULT 'active',
@@ -2187,6 +2209,7 @@ export class TaskforceCore {
             CREATE INDEX IF NOT EXISTS idx_ui_state_workspace_key ON ui_state(workspace_id, state_key);
             CREATE INDEX IF NOT EXISTS idx_workspace_settings_workspace_key ON workspace_settings(workspace_id, settings_key);
             CREATE INDEX IF NOT EXISTS idx_user_preferences_user_key ON user_preferences(user_id, prefs_key);
+            CREATE INDEX IF NOT EXISTS idx_user_feature_grants_feature_enabled ON user_feature_grants(tenant_id, feature_key, enabled);
             CREATE INDEX IF NOT EXISTS idx_admin_audit_logs_tenant_created ON admin_audit_logs(tenant_id, created_at);
             CREATE INDEX IF NOT EXISTS idx_admin_audit_logs_workspace_created ON admin_audit_logs(workspace_id, created_at);
             CREATE INDEX IF NOT EXISTS idx_task_events_task_created ON task_events(tenant_id, workspace_id, task_id, created_at);
@@ -2375,6 +2398,9 @@ export class TaskforceCore {
             if (!mcpOauthGrantColumns.some((c) => c.name === 'ai_profile_name')) {
                 this.db.exec(`ALTER TABLE mcp_oauth_connector_grants ADD COLUMN ai_profile_name TEXT`);
             }
+            if (!mcpOauthGrantColumns.some((c) => c.name === 'tool_profile')) {
+                this.db.exec(`ALTER TABLE mcp_oauth_connector_grants ADD COLUMN tool_profile TEXT NOT NULL DEFAULT 'default'`);
+            }
         }
         else {
             try {
@@ -2383,6 +2409,7 @@ export class TaskforceCore {
                 this.db.exec(`ALTER TABLE mcp_oauth_connector_grants ADD COLUMN IF NOT EXISTS ai_profile_id TEXT`);
                 this.db.exec(`ALTER TABLE mcp_oauth_connector_grants ADD COLUMN IF NOT EXISTS ai_profile_token TEXT`);
                 this.db.exec(`ALTER TABLE mcp_oauth_connector_grants ADD COLUMN IF NOT EXISTS ai_profile_name TEXT`);
+                this.db.exec(`ALTER TABLE mcp_oauth_connector_grants ADD COLUMN IF NOT EXISTS tool_profile TEXT NOT NULL DEFAULT 'default'`);
             }
             catch {
                 // Best-effort schema repair for existing deployments.
@@ -3158,7 +3185,17 @@ export class TaskforceCore {
         return ['manualComplexityEnabled'];
     }
     getUserBackedProjectConfigKeys() {
-        return ['theme', 'jsonBackupEnabled', 'checklistDropdownEnabled', 'showTaskCardStatusLabel'];
+        return [
+            'theme',
+            'jsonBackupEnabled',
+            'checklistDropdownEnabled',
+            'showTaskCardStatusLabel',
+            'showTaskCardDescription',
+            'showTaskCardAttachments',
+            'showTaskCardChecklistProgress',
+            'showTaskCardLatestActivity',
+            'tintTaskCardActivityBackground',
+        ];
     }
     isWorkspaceBackedProjectConfigKey(key) {
         return this.getWorkspaceBackedProjectConfigKeys().includes(key);
@@ -3201,6 +3238,21 @@ export class TaskforceCore {
         if (typeof source.showTaskCardStatusLabel === 'boolean') {
             next.showTaskCardStatusLabel = source.showTaskCardStatusLabel;
         }
+        if (typeof source.showTaskCardDescription === 'boolean') {
+            next.showTaskCardDescription = source.showTaskCardDescription;
+        }
+        if (typeof source.showTaskCardAttachments === 'boolean') {
+            next.showTaskCardAttachments = source.showTaskCardAttachments;
+        }
+        if (typeof source.showTaskCardChecklistProgress === 'boolean') {
+            next.showTaskCardChecklistProgress = source.showTaskCardChecklistProgress;
+        }
+        if (typeof source.showTaskCardLatestActivity === 'boolean') {
+            next.showTaskCardLatestActivity = source.showTaskCardLatestActivity;
+        }
+        if (typeof source.tintTaskCardActivityBackground === 'boolean') {
+            next.tintTaskCardActivityBackground = source.tintTaskCardActivityBackground;
+        }
         return next;
     }
     stripPersistedProjectConfigKeys(config) {
@@ -4019,7 +4071,7 @@ export class TaskforceCore {
              AND identity.entity_type = 'initiative'
              AND identity.entity_id = i.id
             WHERE i.tenant_id = ? AND i.workspace_id = ?
-            ORDER BY COALESCE(i.sort_order, 2147483647), i.created_at ASC
+            ORDER BY COALESCE(i.sort_order, 2147483647), i.created_at ASC, i.id ASC
         `).all(this.tenantId, normalizedWorkspaceId);
         return rows.map((row) => this.rowToInitiative(row));
     }
@@ -4326,7 +4378,7 @@ export class TaskforceCore {
              AND identity.entity_type = 'workstream'
              AND identity.entity_id = w.id
             WHERE w.tenant_id = ? AND w.workspace_id = ?
-            ORDER BY COALESCE(w.sort_order, 2147483647), w.created_at ASC
+            ORDER BY COALESCE(w.sort_order, 2147483647), w.created_at ASC, w.id ASC
         `).all(this.tenantId, normalizedWorkspaceId);
         return rows.map((row) => this.rowToWorkstream(row));
     }
@@ -5493,6 +5545,7 @@ export class TaskforceCore {
             generateEntityId: (prefix) => this.generateEntityId(prefix),
             normalizeWorkspaceId: (workspaceId) => this.normalizeWorkspaceId(workspaceId),
             resolveWorkspaceActor: (workspaceId, actorRef) => this.resolveWorkspaceActor(workspaceId, actorRef),
+            resolveWorkspaceActors: (workspaceId, actorRefs) => this.resolveWorkspaceActors(workspaceId, actorRefs),
             sanitizeOrderInDay: (value) => this.sanitizeOrderInDay(value),
             sanitizeDateOnly: (value) => this.sanitizeDateOnly(value),
             normalizeTaskEventActor: (actorRef, workspaceId) => this.normalizeTaskEventActor(actorRef, workspaceId),
@@ -5572,6 +5625,489 @@ export class TaskforceCore {
             config: this.readConfig()
         };
     }
+    listTaskSummaries(workspaceId, archived) {
+        const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
+        const rows = this.db.prepare(`
+            WITH ranked_events AS (
+                SELECT e.entity_id,
+                       e.id,
+                       e.action,
+                       e.actor,
+                       e.actor_type,
+                       e.details_json,
+                       e.created_at,
+                       ROW_NUMBER() OVER (
+                           PARTITION BY e.entity_id
+                           ORDER BY e.created_at DESC, e.id DESC
+                       ) AS event_rank
+                FROM entity_events e
+                JOIN tasks scoped_task
+                  ON scoped_task.tenant_id = e.tenant_id
+                 AND scoped_task.workspace_id = e.workspace_id
+                 AND scoped_task.id = e.entity_id
+                WHERE e.tenant_id = ? AND e.workspace_id = ?
+                  AND e.entity_type = 'task'
+                  AND scoped_task.is_archived = ?
+                  -- Comment activity is represented by the comment itself; the
+                  -- paired audit event is intentionally hidden by taskActivity.
+                  AND e.action <> 'task-comment-added'
+                  -- Durable text-only autosaves retain an empty task-updated event
+                  -- for stable replay identity, but full task activity hides it.
+                  -- Match that visibility rule before ranking so an internal event
+                  -- cannot displace the latest meaningful card activity. REPLACE is
+                  -- intentionally used instead of dialect-specific JSON operators.
+                  AND NOT (
+                      e.action = 'task-updated'
+                      AND REPLACE(COALESCE(e.details_json, ''), ' ', '') LIKE '%"saveSource":"autosave"%'
+                      AND REPLACE(COALESCE(e.details_json, ''), ' ', '') LIKE '%"changes":{}%'
+                  )
+            )
+            SELECT t.id, t.reference_number, t.local_reference_number, t.title, t.status, t.priority,
+                   t.complexity, t.type, t.category, t.created_at, t.updated_at, t.completed_at,
+                   t.canceled_reason, t.is_archived, t.scheduled_date, t.due_date,
+                   t.scheduled_week_key, t.order_in_day, t.workstream_order, t.workstream_id,
+                   t.card_cover_asset_id, t.taxonomies, t.created_by, t.assignee,
+                   event.id AS latest_event_id,
+                   event.action AS latest_event_action,
+                   event.actor AS latest_event_actor,
+                   event.actor_type AS latest_event_actor_type,
+                   event.details_json AS latest_event_details_json,
+                   event.created_at AS latest_event_at
+            FROM tasks t
+            LEFT JOIN ranked_events event
+              ON event.entity_id = t.id AND event.event_rank = 1
+            WHERE t.tenant_id = ? AND t.workspace_id = ? AND t.is_archived = ?
+            ORDER BY ${archived ? 't.completed_at DESC, t.created_at DESC' : 't.created_at DESC'}
+        `).all(this.tenantId, normalizedWorkspaceId, archived ? 1 : 0, this.tenantId, normalizedWorkspaceId, archived ? 1 : 0);
+        const comments = this.db.prepare(`
+            WITH ranked_comments AS (
+                SELECT c.task_id,
+                       c.id,
+                       c.text,
+                       c.author,
+                       c.timestamp,
+                       COUNT(*) OVER (PARTITION BY c.task_id) AS count,
+                       MAX(c.timestamp) OVER (PARTITION BY c.task_id) AS revision,
+                       ROW_NUMBER() OVER (
+                           PARTITION BY c.task_id
+                           ORDER BY c.timestamp DESC, c.id DESC
+                       ) AS comment_rank
+                FROM comments c
+                JOIN tasks t
+                  ON t.tenant_id = c.tenant_id
+                 AND t.workspace_id = c.workspace_id
+                 AND t.id = c.task_id
+                WHERE c.tenant_id = ? AND c.workspace_id = ? AND t.is_archived = ?
+            )
+            SELECT task_id, id, text, author, timestamp, count, revision
+            FROM ranked_comments
+            WHERE comment_rank = 1
+        `).all(this.tenantId, normalizedWorkspaceId, archived ? 1 : 0);
+        const checklist = this.db.prepare(`
+            SELECT c.task_id, COUNT(*) AS count,
+                   SUM(CASE WHEN c.is_completed = 1 THEN 1 ELSE 0 END) AS completed_count,
+                   MAX(COALESCE(c.updated_at, c.created_at)) AS revision
+            FROM checklist_items c
+            JOIN tasks t ON t.tenant_id = c.tenant_id AND t.workspace_id = c.workspace_id AND t.id = c.task_id
+            WHERE c.tenant_id = ? AND c.workspace_id = ? AND t.is_archived = ?
+            GROUP BY c.task_id
+        `).all(this.tenantId, normalizedWorkspaceId, archived ? 1 : 0);
+        const attachments = this.db.prepare(`
+            SELECT l.task_id, COUNT(a.asset_id) AS count,
+                   MAX(CASE WHEN l.asset_id = t.card_cover_asset_id THEN l.asset_id ELSE NULL END) AS cover_asset_id,
+                   MAX(CASE WHEN l.asset_id = t.card_cover_asset_id THEN a.storage_provider ELSE NULL END) AS cover_storage_provider,
+                   MAX(CASE WHEN l.asset_id = t.card_cover_asset_id THEN a.storage_key ELSE NULL END) AS cover_storage_key,
+                   MAX(CASE WHEN l.asset_id = t.card_cover_asset_id THEN a.original_filename ELSE NULL END) AS cover_original_filename,
+                   MAX(CASE WHEN l.asset_id = t.card_cover_asset_id THEN COALESCE(l.display_name, a.logical_name) ELSE NULL END) AS cover_display_name,
+                   MAX(CASE
+                       WHEN COALESCE(a.updated_at, '') > COALESCE(l.updated_at, '') THEN a.updated_at
+                       ELSE l.updated_at
+                   END) AS revision
+            FROM workspace_asset_links l
+            JOIN tasks t ON t.tenant_id = l.tenant_id AND t.workspace_id = l.workspace_id AND t.id = l.task_id
+            JOIN workspace_assets a ON a.tenant_id = l.tenant_id AND a.workspace_id = l.workspace_id AND a.asset_id = l.asset_id AND a.deleted_at IS NULL
+            WHERE l.tenant_id = ? AND l.workspace_id = ? AND t.is_archived = ? AND l.target_type = 'task' AND l.deleted_at IS NULL
+            GROUP BY l.task_id
+        `).all(this.tenantId, normalizedWorkspaceId, archived ? 1 : 0);
+        const relationships = this.db.prepare(`
+            SELECT task_id, COUNT(*) AS count, MAX(updated_at) AS revision
+            FROM (
+                SELECT r.source_task_id AS task_id, r.updated_at
+                FROM task_relationships r
+                JOIN tasks t ON t.tenant_id = r.tenant_id AND t.workspace_id = r.workspace_id AND t.id = r.source_task_id
+                WHERE r.tenant_id = ? AND r.workspace_id = ? AND r.deleted_at IS NULL AND t.is_archived = ?
+                UNION ALL
+                SELECT r.target_task_id AS task_id, r.updated_at
+                FROM task_relationships r
+                JOIN tasks t ON t.tenant_id = r.tenant_id AND t.workspace_id = r.workspace_id AND t.id = r.target_task_id
+                WHERE r.tenant_id = ? AND r.workspace_id = ? AND r.deleted_at IS NULL
+                  AND r.target_task_id <> r.source_task_id AND t.is_archived = ?
+            ) scoped_relationships
+            GROUP BY task_id
+        `).all(this.tenantId, normalizedWorkspaceId, archived ? 1 : 0, this.tenantId, normalizedWorkspaceId, archived ? 1 : 0);
+        const countByTask = (entries) => new Map(entries.map((entry) => [String(entry.task_id || ''), Number(entry.count || 0)]));
+        const commentCountByTask = countByTask(comments);
+        const attachmentCountByTask = countByTask(attachments);
+        const commentRevisionByTask = new Map(comments.map((entry) => [String(entry.task_id || ''), String(entry.revision || '')]));
+        const attachmentRevisionByTask = new Map(attachments.map((entry) => [String(entry.task_id || ''), String(entry.revision || '')]));
+        const coverAttachmentByTask = new Map(attachments.flatMap((entry) => {
+            const taskId = String(entry.task_id || '');
+            const assetId = String(entry.cover_asset_id || '').trim();
+            const storageKey = String(entry.cover_storage_key || '').trim();
+            const storageProvider = String(entry.cover_storage_provider || 'local').trim();
+            if (!taskId || !assetId || !storageKey)
+                return [];
+            const isExternalHttpReference = storageProvider === 'external' && /^https?:\/\//i.test(storageKey);
+            return [[taskId, {
+                        assetId,
+                        path: isExternalHttpReference
+                            ? storageKey
+                            : storageProvider === 'external'
+                                ? `/api/taskforce/context-link?path=${encodeURIComponent(storageKey)}`
+                                : `/api/taskforce/context/${encodeURIComponent(storageKey)}`,
+                        ...(isExternalHttpReference ? {} : { fsPath: storageKey }),
+                        displayName: entry.cover_display_name ? String(entry.cover_display_name) : undefined,
+                        originalFilename: entry.cover_original_filename ? String(entry.cover_original_filename) : undefined,
+                        linkRole: 'image',
+                        taskId,
+                    }]];
+        }));
+        const checklistByTask = new Map(checklist.map((entry) => [String(entry.task_id || ''), {
+                total: Number(entry.count || 0),
+                completed: Number(entry.completed_count || 0),
+                revision: String(entry.revision || ''),
+            }]));
+        const relationshipCountByTask = countByTask(relationships);
+        const relationshipRevisionByTask = new Map(relationships.map((entry) => [
+            String(entry.task_id || ''),
+            String(entry.revision || ''),
+        ]));
+        const latestActivityByTask = new Map();
+        const latestActivityRevisionByTask = new Map();
+        const considerLatestActivity = (taskId, item) => {
+            const existing = latestActivityByTask.get(taskId);
+            const nextTimestamp = Date.parse(String(item.timestamp || ''));
+            const existingTimestamp = existing ? Date.parse(String(existing.timestamp || '')) : Number.NaN;
+            const isNewer = !existing
+                || (Number.isFinite(nextTimestamp) && !Number.isFinite(existingTimestamp))
+                || (Number.isFinite(nextTimestamp) && Number.isFinite(existingTimestamp) && nextTimestamp > existingTimestamp)
+                || (nextTimestamp === existingTimestamp && item.id.localeCompare(existing.id) > 0);
+            if (!isNewer)
+                return;
+            latestActivityByTask.set(taskId, item);
+            latestActivityRevisionByTask.set(taskId, `${item.timestamp}:${item.id}`);
+        };
+        for (const entry of comments) {
+            const taskId = String(entry.task_id || '').trim();
+            const commentId = String(entry.id || '').trim();
+            const timestamp = String(entry.timestamp || '');
+            if (!taskId || !commentId)
+                continue;
+            considerLatestActivity(taskId, {
+                id: `comment:${commentId}`,
+                type: 'comment',
+                timestamp,
+                comment: {
+                    text: String(entry.text || ''),
+                    author: String(entry.author || 'user').trim() || 'user',
+                },
+            });
+        }
+        for (const row of rows) {
+            const taskId = String(row.id || '').trim();
+            const eventId = String(row.latest_event_id || '').trim();
+            const timestamp = String(row.latest_event_at || '');
+            if (!taskId || !eventId)
+                continue;
+            let details = {};
+            try {
+                const parsed = row.latest_event_details_json ? JSON.parse(String(row.latest_event_details_json)) : {};
+                details = parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+            }
+            catch {
+                details = {};
+            }
+            considerLatestActivity(taskId, {
+                id: `event:${eventId}`,
+                type: 'event',
+                timestamp,
+                event: {
+                    action: String(row.latest_event_action || ''),
+                    actor: String(row.latest_event_actor || 'system').trim() || 'system',
+                    actorType: row.latest_event_actor_type === 'human' || row.latest_event_actor_type === 'ai'
+                        ? row.latest_event_actor_type
+                        : 'system',
+                    details,
+                },
+            });
+        }
+        return rows.map((row) => {
+            const id = String(row.id || '').trim();
+            const scheduledDate = this.sanitizeDateOnly(row.scheduled_date);
+            const dueDate = this.sanitizeDateOnly(row.due_date);
+            const referenceNumber = this.sanitizeTaskReferenceNumber(row.reference_number);
+            const localReferenceNumber = this.sanitizeTaskReferenceNumber(row.local_reference_number);
+            let taxonomies = {};
+            try {
+                taxonomies = JSON.parse(row.taxonomies || '{}');
+            }
+            catch {
+                taxonomies = {};
+            }
+            const checklistCounts = checklistByTask.get(id) || { total: 0, completed: 0, revision: '' };
+            const commentCount = commentCountByTask.get(id) || 0;
+            const attachmentCount = attachmentCountByTask.get(id) || 0;
+            const relationshipCount = relationshipCountByTask.get(id) || 0;
+            const detailRevision = JSON.stringify([
+                String(row.updated_at || row.created_at || ''),
+                commentCount,
+                commentRevisionByTask.get(id) || '',
+                checklistCounts.total,
+                checklistCounts.completed,
+                checklistCounts.revision,
+                attachmentCount,
+                attachmentRevisionByTask.get(id) || '',
+                relationshipCount,
+                relationshipRevisionByTask.get(id) || '',
+                latestActivityRevisionByTask.get(id) || '',
+            ]);
+            return {
+                id,
+                referenceNumber,
+                localReferenceNumber,
+                referenceLabel: deriveTaskReferenceLabel({ referenceNumber, localReferenceNumber }),
+                title: String(row.title || ''),
+                status: this.normalizeStatusValue(row.status),
+                priority: this.normalizePriorityValue(row.priority),
+                complexity: Number(row.complexity || 3),
+                type: String(row.type || 'task'),
+                category: String(row.category || 'default'),
+                createdAt: String(row.created_at || ''),
+                updatedAt: row.updated_at ? String(row.updated_at) : undefined,
+                completedAt: row.completed_at ? String(row.completed_at) : null,
+                canceledReason: row.canceled_reason ? String(row.canceled_reason) : null,
+                isArchived: row.is_archived === 1 || row.is_archived === true,
+                scheduledDate,
+                dueDate,
+                scheduledWeekKey: row.scheduled_week_key || (scheduledDate ? this.dateOnlyToIsoWeekKey(scheduledDate) : null),
+                orderInDay: this.sanitizeOrderInDay(row.order_in_day),
+                workstreamOrder: this.sanitizeOrderInDay(row.workstream_order),
+                workstreamId: this.sanitizeWorkstreamId(row.workstream_id),
+                cardCoverAssetId: typeof row.card_cover_asset_id === 'string' && row.card_cover_asset_id.trim()
+                    ? row.card_cover_asset_id.trim()
+                    : null,
+                cardCoverAttachment: coverAttachmentByTask.get(id) || null,
+                taxonomies,
+                createdBy: this.normalizeCreatedBy(row.created_by, normalizedWorkspaceId, { preserveGenericAi: true }),
+                assignee: this.sanitizeAssignee(row.assignee, normalizedWorkspaceId),
+                isSummary: true,
+                commentCount,
+                checklistCount: checklistCounts.total,
+                completedChecklistCount: checklistCounts.completed,
+                attachmentCount,
+                relationshipCount,
+                latestActivity: latestActivityByTask.get(id) || null,
+                detailRevision,
+            };
+        });
+    }
+    listActiveTaskSummaries(workspaceId) {
+        return { tasks: this.listTaskSummaries(workspaceId, false) };
+    }
+    listArchiveSummaries(workspaceId) {
+        return { archived: this.listTaskSummaries(workspaceId, true) };
+    }
+    getTaskDetailRevision(id, workspaceId) {
+        const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
+        const taskId = String(id || '').trim();
+        if (!taskId)
+            return null;
+        const row = this.db.prepare(`
+            WITH target_task AS (
+                SELECT id, created_at, updated_at
+                FROM tasks
+                WHERE tenant_id = ? AND workspace_id = ? AND id = ?
+            ),
+            comment_stats AS (
+                SELECT COUNT(*) AS count, MAX(c.timestamp) AS revision
+                FROM comments c
+                JOIN target_task t ON t.id = c.task_id
+                WHERE c.tenant_id = ? AND c.workspace_id = ?
+            ),
+            latest_comment AS (
+                SELECT c.id, c.timestamp
+                FROM comments c
+                JOIN target_task t ON t.id = c.task_id
+                WHERE c.tenant_id = ? AND c.workspace_id = ?
+                ORDER BY c.timestamp DESC, c.id DESC
+                LIMIT 1
+            ),
+            checklist_stats AS (
+                SELECT COUNT(*) AS count,
+                       SUM(CASE WHEN c.is_completed = 1 THEN 1 ELSE 0 END) AS completed_count,
+                       MAX(COALESCE(c.updated_at, c.created_at)) AS revision
+                FROM checklist_items c
+                JOIN target_task t ON t.id = c.task_id
+                WHERE c.tenant_id = ? AND c.workspace_id = ?
+            ),
+            attachment_stats AS (
+                SELECT COUNT(a.asset_id) AS count,
+                       MAX(CASE
+                           WHEN COALESCE(a.updated_at, '') > COALESCE(l.updated_at, '') THEN a.updated_at
+                           ELSE l.updated_at
+                       END) AS revision
+                FROM workspace_asset_links l
+                JOIN target_task t ON t.id = l.task_id
+                JOIN workspace_assets a
+                  ON a.tenant_id = l.tenant_id
+                 AND a.workspace_id = l.workspace_id
+                 AND a.asset_id = l.asset_id
+                 AND a.deleted_at IS NULL
+                WHERE l.tenant_id = ? AND l.workspace_id = ?
+                  AND l.target_type = 'task' AND l.deleted_at IS NULL
+            ),
+            relationship_rows AS (
+                SELECT r.updated_at
+                FROM task_relationships r
+                JOIN target_task t ON t.id = r.source_task_id
+                WHERE r.tenant_id = ? AND r.workspace_id = ? AND r.deleted_at IS NULL
+                UNION ALL
+                SELECT r.updated_at
+                FROM task_relationships r
+                JOIN target_task t ON t.id = r.target_task_id
+                WHERE r.tenant_id = ? AND r.workspace_id = ? AND r.deleted_at IS NULL
+                  AND r.target_task_id <> r.source_task_id
+            ),
+            relationship_stats AS (
+                SELECT COUNT(*) AS count, MAX(updated_at) AS revision
+                FROM relationship_rows
+            ),
+            latest_event AS (
+                SELECT e.id, e.created_at
+                FROM entity_events e
+                JOIN target_task t ON t.id = e.entity_id
+                WHERE e.tenant_id = ? AND e.workspace_id = ?
+                  AND e.entity_type = 'task'
+                  AND e.action <> 'task-comment-added'
+                  AND NOT (
+                      e.action = 'task-updated'
+                      AND REPLACE(COALESCE(e.details_json, ''), ' ', '') LIKE '%"saveSource":"autosave"%'
+                      AND REPLACE(COALESCE(e.details_json, ''), ' ', '') LIKE '%"changes":{}%'
+                  )
+                ORDER BY e.created_at DESC, e.id DESC
+                LIMIT 1
+            )
+            SELECT t.created_at, t.updated_at,
+                   comments.count AS comment_count, comments.revision AS comment_revision,
+                   latest_comment.id AS latest_comment_id,
+                   latest_comment.timestamp AS latest_comment_at,
+                   checklist.count AS checklist_count,
+                   checklist.completed_count AS completed_checklist_count,
+                   checklist.revision AS checklist_revision,
+                   attachments.count AS attachment_count,
+                   attachments.revision AS attachment_revision,
+                   relationships.count AS relationship_count,
+                   relationships.revision AS relationship_revision,
+                   latest_event.id AS latest_event_id,
+                   latest_event.created_at AS latest_event_at
+            FROM target_task t
+            CROSS JOIN comment_stats comments
+            CROSS JOIN checklist_stats checklist
+            CROSS JOIN attachment_stats attachments
+            CROSS JOIN relationship_stats relationships
+            LEFT JOIN latest_comment ON 1 = 1
+            LEFT JOIN latest_event ON 1 = 1
+        `).get(this.tenantId, normalizedWorkspaceId, taskId, this.tenantId, normalizedWorkspaceId, this.tenantId, normalizedWorkspaceId, this.tenantId, normalizedWorkspaceId, this.tenantId, normalizedWorkspaceId, this.tenantId, normalizedWorkspaceId, this.tenantId, normalizedWorkspaceId, this.tenantId, normalizedWorkspaceId);
+        if (!row)
+            return null;
+        const latestCommentId = String(row.latest_comment_id || '').trim();
+        const latestCommentAt = String(row.latest_comment_at || '');
+        const latestEventId = String(row.latest_event_id || '').trim();
+        const latestEventAt = String(row.latest_event_at || '');
+        const commentTimestamp = Date.parse(latestCommentAt);
+        const eventTimestamp = Date.parse(latestEventAt);
+        const commentActivityId = latestCommentId ? `comment:${latestCommentId}` : '';
+        const eventActivityId = latestEventId ? `event:${latestEventId}` : '';
+        const latestActivityRevision = !latestEventId
+            || (latestCommentId && ((Number.isFinite(commentTimestamp) && !Number.isFinite(eventTimestamp))
+                || commentTimestamp > eventTimestamp
+                || (commentTimestamp === eventTimestamp && commentActivityId.localeCompare(eventActivityId) > 0)))
+            ? (latestCommentId ? `${latestCommentAt}:${commentActivityId}` : '')
+            : `${latestEventAt}:${eventActivityId}`;
+        return JSON.stringify([
+            String(row.updated_at || row.created_at || ''),
+            Number(row.comment_count || 0),
+            String(row.comment_revision || ''),
+            Number(row.checklist_count || 0),
+            Number(row.completed_checklist_count || 0),
+            String(row.checklist_revision || ''),
+            Number(row.attachment_count || 0),
+            String(row.attachment_revision || ''),
+            Number(row.relationship_count || 0),
+            String(row.relationship_revision || ''),
+            latestActivityRevision,
+        ]);
+    }
+    getTaskDetailSnapshot(id, workspaceId) {
+        const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
+        return this.db.transaction(() => {
+            if (this.db.provider === 'postgres') {
+                this.db.exec('SET TRANSACTION ISOLATION LEVEL REPEATABLE READ');
+            }
+            const task = this.getTask(id, normalizedWorkspaceId);
+            if (!task)
+                return null;
+            const detailRevision = this.getTaskDetailRevision(id, normalizedWorkspaceId);
+            return detailRevision ? { ...task, detailRevision } : null;
+        })();
+    }
+    updateTaskIfDetailRevisionMatches(id, expectedDetailRevision, updates, workspaceId, options) {
+        const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
+        const updated = this.db.transaction(() => {
+            if (this.db.provider === 'postgres') {
+                this.db.exec('SET TRANSACTION ISOLATION LEVEL SERIALIZABLE');
+            }
+            const currentDetailRevision = this.getTaskDetailRevision(id, normalizedWorkspaceId);
+            if (currentDetailRevision === null)
+                return null;
+            if (currentDetailRevision !== expectedDetailRevision) {
+                throw new TaskforceRuleError('Task changed after this editor was loaded. Reload the latest task before saving.', 409, 'TASK_DETAIL_REVISION_CONFLICT', { currentDetailRevision });
+            }
+            const task = this.updateTask(id, updates, normalizedWorkspaceId, {
+                actorRef: options?.actorRef,
+                saveSource: options?.saveSource,
+                persistBackup: false,
+                emitRealtime: false,
+            });
+            if (!task)
+                return null;
+            const detailRevision = this.getTaskDetailRevision(id, normalizedWorkspaceId);
+            return detailRevision ? { ...task, detailRevision } : null;
+        })();
+        if (updated) {
+            this.persistBackup();
+            this.emitRealtimeMutation({
+                workspaceId: normalizedWorkspaceId,
+                entityType: 'task',
+                changeType: 'upsert',
+                entityIds: [updated.id],
+            });
+        }
+        return updated;
+    }
+    assertTaskDetailRevisionForUpdate(id, expectedDetailRevision, workspaceId) {
+        const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
+        const lockSql = this.db.provider === 'postgres'
+            ? `SELECT id FROM tasks WHERE tenant_id = ? AND workspace_id = ? AND id = ? FOR UPDATE`
+            : `SELECT id FROM tasks WHERE tenant_id = ? AND workspace_id = ? AND id = ?`;
+        const task = this.db.prepare(lockSql).get(this.tenantId, normalizedWorkspaceId, id);
+        if (!task)
+            throw new TaskforceRuleError('Task not found.', 404, 'TASK_NOT_FOUND');
+        const currentDetailRevision = this.getTaskDetailRevision(id, normalizedWorkspaceId);
+        if (currentDetailRevision !== expectedDetailRevision) {
+            throw new TaskforceRuleError('Task changed after this editor was loaded. Reload the latest task before saving.', 409, 'TASK_DETAIL_REVISION_CONFLICT', { currentDetailRevision });
+        }
+    }
     /**
      * Filter-pushdown listing used by read-only surfaces that don't need the
      * full task graph (MCP list_tasks, CLI summaries). Avoids the per-task
@@ -5750,41 +6286,53 @@ export class TaskforceCore {
             };
         });
     }
-    searchTaskSummaries(query, scope = 'all', workspaceId) {
+    searchTaskSummaries(query, scope = 'all', workspaceId, options) {
         const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
-        const normalizedQuery = String(query || '').trim();
-        if (!normalizedQuery)
+        const normalizedQuery = normalizeTaskSearchQuery(String(query || ''));
+        if (!normalizedQuery.raw)
             return [];
-        const exactReferenceNumber = parseTaskReference(normalizedQuery);
-        const exactLocalReferenceNumber = parseLocalTaskReference(normalizedQuery);
-        const term = `%${normalizedQuery}%`;
+        const exactReferenceNumber = parseTaskReference(normalizedQuery.raw);
+        const exactLocalReferenceNumber = parseLocalTaskReference(normalizedQuery.raw);
+        const searchableText = `
+            COALESCE(title, '') || ' ' ||
+            COALESCE(description, '') || ' ' ||
+            COALESCE(id, '') || ' ' ||
+            CASE WHEN reference_number IS NULL THEN '' ELSE 'T-' || CAST(reference_number AS TEXT) END || ' ' ||
+            CASE WHEN local_reference_number IS NULL THEN '' ELSE 'LT-' || CAST(local_reference_number AS TEXT) END || ' ' ||
+            COALESCE(category, '') || ' ' ||
+            COALESCE(type, '') || ' ' ||
+            COALESCE(CAST(priority AS TEXT), '') || ' ' ||
+            COALESCE(status, '') || ' ' ||
+            COALESCE(assignee, '') || ' ' ||
+            COALESCE(canceled_reason, '')
+        `;
+        const escapedTerms = normalizedQuery.tokens.map((token) => (`%${token.replace(/[\\%_]/g, '\\$&')}%`));
         const clauses = [
             'tenant_id = ?',
             'workspace_id = ?',
-            '(title LIKE ? OR description LIKE ? OR id LIKE ? OR reference_number = ? OR local_reference_number = ?)',
+            ...escapedTerms.map(() => `LOWER(${searchableText}) LIKE ? ESCAPE '\\'`),
         ];
         const params = [
             this.tenantId,
             normalizedWorkspaceId,
-            term,
-            term,
-            term,
-            exactReferenceNumber || -1,
-            exactLocalReferenceNumber || -1,
+            ...escapedTerms,
         ];
         if (scope === 'active')
             clauses.push('is_archived = 0');
         if (scope === 'archive')
             clauses.push('is_archived = 1');
+        const limit = Math.max(1, Math.min(51, Math.trunc(options?.limit ?? 50)));
+        const offset = Math.max(0, Math.trunc(options?.offset ?? 0));
         const rows = this.db.prepare(`
-            SELECT id, reference_number, local_reference_number, title, status, assignee, category, priority
+            SELECT id, reference_number, local_reference_number, title, status, assignee, category, priority, is_archived
             FROM tasks
             WHERE ${clauses.join(' AND ')}
             ORDER BY
                 CASE WHEN id = ? OR reference_number = ? OR local_reference_number = ? THEN 0 ELSE 1 END,
-                created_at DESC
-            LIMIT 50
-        `).all(...params, normalizedQuery, exactReferenceNumber || -1, exactLocalReferenceNumber || -1);
+                created_at DESC,
+                id DESC
+            LIMIT ? OFFSET ?
+        `).all(...params, normalizedQuery.raw, exactReferenceNumber || -1, exactLocalReferenceNumber || -1, limit, offset);
         return rows.map((row) => {
             const referenceNumber = this.sanitizeTaskReferenceNumber(row.reference_number);
             const localReferenceNumber = this.sanitizeTaskReferenceNumber(row.local_reference_number);
@@ -5798,6 +6346,7 @@ export class TaskforceCore {
                 assignee: String(row.assignee || '').trim() || null,
                 category: String(row.category || ''),
                 priority: this.normalizePriorityValue(row.priority),
+                isArchived: row.is_archived === 1 || row.is_archived === true,
             };
         });
     }
@@ -6433,7 +6982,7 @@ export class TaskforceCore {
                 OR LOWER(COALESCE(u.system_role, 'user')) LIKE ?
               )`
             : '';
-        const params = [this.tenantId];
+        const params = [INTERNAL_SUBSCRIPTION_MODEL_FEATURE_KEY, this.tenantId];
         if (query) {
             params.push(queryPattern, queryPattern, queryPattern, queryPattern, queryPattern, queryPattern, queryPattern);
         }
@@ -6446,6 +6995,14 @@ export class TaskforceCore {
                 COALESCE(u.system_role, 'user') AS system_role,
                 COALESCE(u.beta_access, 1) AS beta_access,
                 COALESCE(u.is_disabled, 0) AS is_disabled,
+                CASE WHEN EXISTS (
+                    SELECT 1
+                    FROM user_feature_grants g
+                    WHERE g.tenant_id = u.tenant_id
+                      AND g.user_id = u.id
+                      AND g.feature_key = ?
+                      AND g.enabled = 1
+                ) THEN 1 ELSE 0 END AS subscription_model_access,
                 u.created_at,
                 u.updated_at,
                 u.email_verified_at,
@@ -6477,6 +7034,9 @@ export class TaskforceCore {
             systemRole: this.normalizeSystemRole(row.system_role, 'user'),
             betaAccess: row.beta_access === undefined || row.beta_access === null ? true : Boolean(row.beta_access),
             disabled: Boolean(row.is_disabled),
+            internalFeatureGrants: Boolean(row.subscription_model_access)
+                ? [INTERNAL_SUBSCRIPTION_MODEL_FEATURE_KEY]
+                : [],
             planId: row.plan_id ? String(row.plan_id) : null,
             planName: row.plan_name ? String(row.plan_name) : null,
             planVersionId: row.plan_version_id ? String(row.plan_version_id) : null,
@@ -6550,6 +7110,53 @@ export class TaskforceCore {
         `).run(enabled ? 1 : 0, new Date().toISOString(), this.tenantId, normalizedUserId);
         return Number(result?.changes || 0) > 0;
     }
+    hasUserFeatureGrant(userId, featureKey) {
+        const normalizedUserId = String(userId || '').trim();
+        if (!normalizedUserId || !isSupportedInternalUserFeatureKey(featureKey))
+            return false;
+        const row = this.db.prepare(`
+            SELECT enabled
+            FROM user_feature_grants
+            WHERE tenant_id = ? AND user_id = ? AND feature_key = ?
+            LIMIT 1
+        `).get(this.tenantId, normalizedUserId, featureKey);
+        return Boolean(row?.enabled);
+    }
+    listUserFeatureGrants(userId) {
+        const normalizedUserId = String(userId || '').trim();
+        if (!normalizedUserId)
+            return [];
+        const rows = this.db.prepare(`
+            SELECT feature_key
+            FROM user_feature_grants
+            WHERE tenant_id = ? AND user_id = ? AND enabled = 1
+            ORDER BY feature_key
+        `).all(this.tenantId, normalizedUserId);
+        return rows
+            .map((row) => row.feature_key)
+            .filter(isSupportedInternalUserFeatureKey);
+    }
+    setUserFeatureGrant(userId, featureKey, enabled, updatedBy) {
+        const normalizedUserId = String(userId || '').trim();
+        if (!normalizedUserId || !isSupportedInternalUserFeatureKey(featureKey))
+            return false;
+        const user = this.db.prepare(`
+            SELECT id FROM users WHERE tenant_id = ? AND id = ? LIMIT 1
+        `).get(this.tenantId, normalizedUserId);
+        if (!user?.id)
+            return false;
+        const now = new Date().toISOString();
+        this.db.prepare(`
+            INSERT INTO user_feature_grants (
+                tenant_id, user_id, feature_key, enabled, created_at, updated_at, updated_by
+            ) VALUES (?, ?, ?, ?, ?, ?, ?)
+            ON CONFLICT (tenant_id, user_id, feature_key) DO UPDATE SET
+                enabled = excluded.enabled,
+                updated_at = excluded.updated_at,
+                updated_by = excluded.updated_by
+        `).run(this.tenantId, normalizedUserId, featureKey, enabled ? 1 : 0, now, now, String(updatedBy || '').trim() || null);
+        return true;
+    }
     markUserEmailVerified(userId) {
         const normalizedUserId = String(userId || '').trim();
         if (!normalizedUserId)
@@ -6656,6 +7263,14 @@ export class TaskforceCore {
             if (hasCommercialBillingState) {
                 throw new TaskforceRuleError('Cannot purge a user with active commercial billing state', 409, 'SYSTEM_USER_PURGE_BLOCKED_BILLING_STATE');
             }
+            const modelConnectionCount = Number(this.db.prepare(`
+                SELECT COUNT(*) AS count
+                FROM model_provider_connections
+                WHERE tenant_id = ? AND owner_user_id = ?
+            `).get(this.tenantId, targetUserId)?.count || 0);
+            if (modelConnectionCount > 0) {
+                throw new TaskforceRuleError('Disconnect and clean up the user model connections before purging this account', 409, 'SYSTEM_USER_PURGE_BLOCKED_MODEL_CONNECTIONS');
+            }
             const now = new Date().toISOString();
             const runCount = (sql, ...params) => Number(this.db.prepare(sql).run(...params)?.changes || 0);
             const workspaceIds = this.db.prepare(`
@@ -6755,6 +7370,11 @@ export class TaskforceCore {
                 WHERE tenant_id = ?
                   AND user_id = ?
             `, this.tenantId, targetUserId);
+            const deletedUserFeatureGrantCount = runCount(`
+                DELETE FROM user_feature_grants
+                WHERE tenant_id = ?
+                  AND user_id = ?
+            `, this.tenantId, targetUserId);
             const deletedUserBillingCount = runCount(`
                 DELETE FROM user_billing
                 WHERE tenant_id = ?
@@ -6782,6 +7402,7 @@ export class TaskforceCore {
                 deletedMcpOauthConnectorGrantCount,
                 deletedUiStateCount,
                 deletedUserPreferenceCount,
+                deletedUserFeatureGrantCount,
                 deletedEntitlementCount,
                 deletedUserBillingCount,
                 deletedUserCount
@@ -7229,6 +7850,20 @@ export class TaskforceCore {
             runTaskMetadataOwnershipTransaction: (input) => this.runTaskMetadataOwnershipTransaction(input),
         };
     }
+    buildUnresolvedWorkspaceActor(raw) {
+        const normalized = raw.toLowerCase();
+        const unresolvedKind = (normalized.startsWith('ai-profile-') || this.isKnownAiModelName(normalized)) ? 'ai' : 'human';
+        return {
+            id: raw,
+            kind: unresolvedKind,
+            label: this.formatActorLabel(raw),
+            username: this.normalizeAiProfileUsername(raw, raw),
+            icon: unresolvedKind === 'ai' ? GENERIC_AI_ACTOR_ICON : 'User',
+            color: unresolvedKind === 'ai' ? GENERIC_AI_ACTOR_COLOR : '#22c55e',
+            isNamed: true,
+            meta: { unresolved: true }
+        };
+    }
     resolveWorkspaceActor(workspaceId, actorRef) {
         const raw = String(actorRef || '').trim();
         const normalized = raw.toLowerCase();
@@ -7258,17 +7893,81 @@ export class TaskforceCore {
         if (workspaceUser) {
             return this.workspaceUserToActor(workspaceUser);
         }
-        const unresolvedKind = (normalized.startsWith('ai-profile-') || this.isKnownAiModelName(normalized)) ? 'ai' : 'human';
-        return {
-            id: raw,
-            kind: unresolvedKind,
-            label: this.formatActorLabel(raw),
-            username: this.normalizeAiProfileUsername(raw, raw),
-            icon: unresolvedKind === 'ai' ? GENERIC_AI_ACTOR_ICON : 'User',
-            color: unresolvedKind === 'ai' ? GENERIC_AI_ACTOR_COLOR : '#22c55e',
-            isNamed: true,
-            meta: { unresolved: true }
-        };
+        return this.buildUnresolvedWorkspaceActor(raw);
+    }
+    resolveWorkspaceActors(workspaceId, actorRefs) {
+        const rawActorRefs = [...new Set(actorRefs
+                .map((actorRef) => String(actorRef || '').trim())
+                .filter(Boolean))];
+        const resolvedActors = new Map();
+        const lookupActorRefs = [];
+        for (const raw of rawActorRefs) {
+            const normalized = raw.toLowerCase();
+            if (normalized === 'unassigned' || normalized === 'none' || normalized === 'null') {
+                resolvedActors.set(raw, null);
+            }
+            else if (this.isHumanActorReference(raw)) {
+                resolvedActors.set(raw, this.buildHumanActorFallback());
+            }
+            else if (this.isGenericAiActorReference(raw)) {
+                resolvedActors.set(raw, this.buildGenericAiActor());
+            }
+            else {
+                lookupActorRefs.push(raw);
+            }
+        }
+        if (lookupActorRefs.length === 0)
+            return resolvedActors;
+        const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
+        const aiProfileRows = this.db.prepare(`
+            SELECT *
+            FROM ai_profiles
+            WHERE tenant_id = ?
+              AND workspace_id = ?
+            ORDER BY COALESCE(last_active_at, updated_at, created_at) DESC, id ASC
+        `).all(this.tenantId, normalizedWorkspaceId);
+        const aiProfileRowsById = new Map(aiProfileRows
+            .map((row) => [String(row.id || '').trim(), row])
+            .filter(([id]) => Boolean(id)));
+        const aiProfileRowsByAlias = new Map();
+        for (const row of aiProfileRows) {
+            const aliases = new Set([String(row.name || '').trim().toLowerCase(), String(row.username || '').trim().toLowerCase()]);
+            for (const alias of aliases) {
+                if (!alias)
+                    continue;
+                const matches = aiProfileRowsByAlias.get(alias) ?? [];
+                matches.push(row);
+                aiProfileRowsByAlias.set(alias, matches);
+            }
+        }
+        const workspaceUsersById = new Map(this.listWorkspaceUsers(normalizedWorkspaceId)
+            .map((user) => [user.userId, user]));
+        for (const raw of lookupActorRefs) {
+            const directAiProfileRow = aiProfileRowsById.get(raw);
+            if (directAiProfileRow) {
+                resolvedActors.set(raw, this.aiProfileToActor(this.aiProfileRowToRecord(directAiProfileRow)));
+                continue;
+            }
+            const aliasMatches = aiProfileRowsByAlias.get(raw.toLowerCase()) ?? [];
+            const aliasRowsById = new Map(aliasMatches
+                .map((row) => [String(row.id || '').trim(), row])
+                .filter(([id]) => Boolean(id)));
+            const canonicalAliasIds = [...new Set(aliasMatches
+                    .map((row) => this.resolveCanonicalAiProfileId(aliasRowsById, String(row.id || '').trim()))
+                    .filter(Boolean))];
+            if (canonicalAliasIds.length === 1) {
+                const canonicalAiProfileRow = aiProfileRowsById.get(canonicalAliasIds[0]);
+                if (canonicalAiProfileRow) {
+                    resolvedActors.set(raw, this.aiProfileToActor(this.aiProfileRowToRecord(canonicalAiProfileRow)));
+                    continue;
+                }
+            }
+            const workspaceUser = workspaceUsersById.get(raw);
+            resolvedActors.set(raw, workspaceUser
+                ? this.workspaceUserToActor(workspaceUser)
+                : this.buildUnresolvedWorkspaceActor(raw));
+        }
+        return resolvedActors;
     }
     listAssignableActors(workspaceId) {
         const normalizedWorkspaceId = this.normalizeWorkspaceId(workspaceId);
@@ -8142,6 +8841,9 @@ export class TaskforceCore {
     regenerateMcpAccessToken(input) {
         return this.mcpTokenService.regenerateMcpAccessToken(input);
     }
+    updateMcpAccessTokenToolProfile(input) {
+        return this.mcpTokenService.updateMcpAccessTokenToolProfile(input);
+    }
     authenticateMcpAccessToken(token, workspaceId) {
         return this.mcpTokenService.authenticateMcpAccessToken(token, workspaceId);
     }
@@ -8169,6 +8871,9 @@ export class TaskforceCore {
     revokeMcpOAuthConnectorGrant(input) {
         return this.mcpTokenService.revokeMcpOAuthConnectorGrant(input);
     }
+    updateMcpOAuthConnectorGrantToolProfile(input) {
+        return this.mcpTokenService.updateMcpOAuthConnectorGrantToolProfile(input);
+    }
     authenticateMcpOAuthAccessToken(token, workspaceId) {
         return this.mcpTokenService.authenticateMcpOAuthAccessToken(token, workspaceId);
     }
@@ -9716,9 +10421,11 @@ export class TaskforceCore {
                 return null;
             const patchFields = Object.keys(patch);
             const archivedNestedContentWrite = options?.allowArchivedNestedContentSyncWrite === true
-                && patchFields.some((field) => ['comments', 'attachments', 'checklistItems'].includes(field))
+                && patchFields.some((field) => [
+                    'comments', 'attachments', 'checklistItems', 'cardCoverAssetId',
+                ].includes(field))
                 && patchFields.every((field) => [
-                    'id', 'comments', 'attachments', 'checklistItems',
+                    'id', 'comments', 'attachments', 'checklistItems', 'cardCoverAssetId',
                 ].includes(field));
             if (existing.isArchived && !archivedNestedContentWrite) {
                 throw new TaskforceRuleError('Archived tasks are read-only. Unarchive first to make changes.', 409, 'TASK_ARCHIVED_READ_ONLY');
@@ -10050,8 +10757,25 @@ export class TaskforceCore {
             return null;
         const submittedAuthor = String(author || '').trim() || 'user';
         const normalizedAuthor = this.normalizeCommentAuthor(author, normalizedWorkspaceId);
+        const explicitCommentId = String(options?.commentId || '').trim();
+        if (explicitCommentId) {
+            const persisted = this.db.prepare(`
+                SELECT task_id, text, author, submitted_author
+                FROM comments
+                WHERE tenant_id = ? AND workspace_id = ? AND id = ?
+            `).get(this.tenantId, normalizedWorkspaceId, explicitCommentId);
+            if (persisted) {
+                if (persisted.task_id !== id
+                    || persisted.text !== text
+                    || persisted.author !== normalizedAuthor
+                    || String(persisted.submitted_author || persisted.author) !== submittedAuthor) {
+                    throw new TaskforceRuleError('Task comment identity is assigned to different content.', 409, 'TASK_COMMENT_IDENTITY_CONFLICT');
+                }
+                return this.getTask(id, normalizedWorkspaceId);
+            }
+        }
         const comment = {
-            id: this.generateEntityId('comment'),
+            id: explicitCommentId || this.generateEntityId('comment'),
             author: normalizedAuthor,
             submittedAuthor,
             text,
@@ -10094,7 +10818,7 @@ export class TaskforceCore {
         if (options?.persistBackup !== false)
             this.persistBackup();
         const updated = this.getTask(id, normalizedWorkspaceId);
-        if (updated) {
+        if (updated && options?.emitRealtime !== false) {
             this.emitRealtimeMutation({
                 workspaceId: normalizedWorkspaceId,
                 entityType: 'task',