@taskforcehq/taskforce 0.3.328 → 0.3.330

package/dist/runtime/appGates.js

@@ -1,3 +1,4 @@
+import { parseTaskforceCloudEnvironment, } from '../config/cloudEnvironment.js';
 import { APP_GATE_DEFINITIONS as APP_GATE_CONFIG } from './appGateDefinitions.js';
 export const ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY = 'annotated_attachments.workspace_access';
 export const DOCUMENT_WORKSPACE_FEATURE_KEY = 'documents.workspace_access';
@@ -5,16 +6,17 @@ export const WORKFLOW_MANAGER_WORKSPACE_FEATURE_KEY = 'workflow_manager.workspac
 export const TASKFORCE_AGENTS_WORKSPACE_FEATURE_KEY = 'taskforce_agents.workspace_access';
 export const AI_PROFILES_WORKSPACE_FEATURE_KEY = 'ai_profiles.workspace_access';
 export const PLANNING_WORKSPACE_FEATURE_KEY = 'planning.workspace_access';
-export const APP_GATE_DEFINITIONS = Object.entries(APP_GATE_CONFIG).reduce((acc, [key, definition]) => {
-    acc[key] = {
+const appGateDefinitions = Object.fromEntries(Object.entries(APP_GATE_CONFIG).map(([key, definition]) => [
+    key,
+    Object.freeze({
         key: key,
-        enabled: Boolean(definition.enabled),
-        description: String(definition.description || ''),
-        owner: String(definition.owner || ''),
-        removalMilestone: String(definition.removalMilestone || '')
-    };
-    return acc;
-}, {});
+        enabledByEnvironment: Object.freeze({ ...definition.enabledByEnvironment }),
+        description: definition.description,
+        owner: definition.owner,
+        removalMilestone: definition.removalMilestone,
+    }),
+]));
+export const APP_GATE_DEFINITIONS = Object.freeze(appGateDefinitions);
 export function listAppGateDefinitions() {
     return Object.values(APP_GATE_DEFINITIONS);
 }
@@ -24,7 +26,7 @@ export function getAppGateDefinition(featureKey) {
         return null;
     return APP_GATE_DEFINITIONS[normalizedKey] || null;
 }
-export function resolveAppGateAccess(featureKey) {
+export function resolveAppGateAccess(featureKey, environment) {
     const gate = getAppGateDefinition(featureKey);
     if (!gate) {
         return {
@@ -34,7 +36,7 @@ export function resolveAppGateAccess(featureKey) {
             code: 'OK'
         };
     }
-    if (!gate.enabled) {
+    if (!gate.enabledByEnvironment[environment]) {
         return {
             featureKey,
             allowed: false,
@@ -49,6 +51,27 @@ export function resolveAppGateAccess(featureKey) {
         code: 'OK'
     };
 }
-export function resolveFeatureAccess(input) {
-    return resolveAppGateAccess(input.featureKey);
+export function resolveAppGateAccessMap(environment) {
+    return Object.fromEntries(listAppGateDefinitions().map(({ key }) => [key, resolveAppGateAccess(key, environment)]));
+}
+export function resolveClientAppGateAccessMap(accessMap, cloudEnvironment) {
+    if (accessMap && isResolvedFeatureAccessMap(accessMap))
+        return accessMap;
+    const environment = parseTaskforceCloudEnvironment(String(cloudEnvironment || '')) || 'production';
+    return resolveAppGateAccessMap(environment);
+}
+export function isResolvedFeatureAccessMap(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const candidate = value;
+    return listAppGateDefinitions().every(({ key }) => {
+        const access = candidate[key];
+        if (!access || typeof access !== 'object' || Array.isArray(access))
+            return false;
+        const resolved = access;
+        return resolved.featureKey === key
+            && typeof resolved.allowed === 'boolean'
+            && (resolved.source === 'app_gate' || resolved.source === 'cloud_entitlement' || resolved.source === 'none')
+            && typeof resolved.code === 'string';
+    });
 }

package/dist/runtime/nodeAppGates.d.ts

@@ -0,0 +1,8 @@
+import type { TaskforceCloudEnvironment } from '../config/cloudEnvironment.js';
+import { type ResolvedFeatureAccess, type ResolvedFeatureAccessMap } from './appGates.js';
+export interface NodeAppGateResolutionOptions {
+    onWarning?: (message: string) => void;
+}
+export declare function resolveNodeAppGateEnvironment(env?: NodeJS.ProcessEnv, options?: NodeAppGateResolutionOptions): TaskforceCloudEnvironment;
+export declare function resolveNodeAppGateAccess(featureKey: string, env?: NodeJS.ProcessEnv, options?: NodeAppGateResolutionOptions): ResolvedFeatureAccess;
+export declare function resolveNodeAppGateAccessMap(env?: NodeJS.ProcessEnv, options?: NodeAppGateResolutionOptions): ResolvedFeatureAccessMap;

package/dist/runtime/nodeAppGates.js

@@ -0,0 +1,27 @@
+import { resolveDeploymentConfig } from '../config/deployment.js';
+import { resolveAppGateAccess, resolveAppGateAccessMap, } from './appGates.js';
+const warnedEnvironmentSignatures = new WeakMap();
+export function resolveNodeAppGateEnvironment(env = process.env, options = {}) {
+    const deployment = resolveDeploymentConfig(env);
+    const warnings = [...deployment.warnings];
+    if (!deployment.cloudEnvironment) {
+        warnings.push('TASKFORCE_CLOUD_ENVIRONMENT could not be resolved; using the production App Gate profile.');
+    }
+    const warningSignature = warnings.join('\n');
+    if (warnings.length === 0) {
+        warnedEnvironmentSignatures.delete(env);
+    }
+    else if (warnedEnvironmentSignatures.get(env) !== warningSignature) {
+        const onWarning = options.onWarning || ((message) => console.warn(`[Taskforce App Gates] ${message}`));
+        for (const warning of warnings)
+            onWarning(warning);
+        warnedEnvironmentSignatures.set(env, warningSignature);
+    }
+    return deployment.cloudEnvironment || 'production';
+}
+export function resolveNodeAppGateAccess(featureKey, env = process.env, options = {}) {
+    return resolveAppGateAccess(featureKey, resolveNodeAppGateEnvironment(env, options));
+}
+export function resolveNodeAppGateAccessMap(env = process.env, options = {}) {
+    return resolveAppGateAccessMap(resolveNodeAppGateEnvironment(env, options));
+}

package/dist/server/cloudCollectionRead.d.ts

@@ -18,7 +18,7 @@ export interface CloudCollectionReadResponse {
         details: Record<string, number>;
     };
 }
-type CloudCollectionReadCore = Pick<TaskforceCore, 'resolveUserAccess' | 'getSystemRole' | 'getAccountAccessStatus' | 'listTasks' | 'listArchive' | 'listDeletedTasksReadOnly' | 'listPlanningBootstrap'>;
+type CloudCollectionReadCore = Pick<TaskforceCore, 'resolveUserAccess' | 'getSystemRole' | 'getAccountAccessStatus' | 'listActiveTaskSummaries' | 'listArchiveSummaries' | 'listDeletedTasksReadOnly' | 'listPlanningBootstrap'>;
 export declare function resolveCloudCollectionReadOperation(method: string | undefined, pathname: string): CloudCollectionReadOperation | null;
 export declare function executeCloudCollectionRead(core: CloudCollectionReadCore, request: CloudCollectionReadRequest): CloudCollectionReadResponse;
 export declare function cloudCollectionReadRoute(operation: CloudCollectionReadOperation): string;

package/dist/server/cloudCollectionRead.js

@@ -63,9 +63,9 @@ export function executeCloudCollectionRead(core, request) {
         let data;
         const planningDiagnostics = {};
         if (request.operation === 'tasks')
-            data = core.listTasks(workspaceId);
+            data = core.listActiveTaskSummaries(workspaceId);
         else if (request.operation === 'archive')
-            data = core.listArchive(workspaceId);
+            data = core.listArchiveSummaries(workspaceId);
         else if (request.operation === 'deleted')
             data = core.listDeletedTasksReadOnly(workspaceId);
         else

package/dist/server/index.d.ts

@@ -8,6 +8,8 @@ import * as http from 'http';
 import { WebSocketServer } from 'ws';
 export { resolveAuthorizedWorkspaceAccess, resolveDisabledAccessError, isWorkspaceAccessRecoveryRoute, } from './authorizedWorkspaceAccess.js';
 import type { LocalServiceCloudTarget } from '../config/localServiceCloudTarget.js';
+import type { LocalServiceRuntimeContract } from '../config/localServiceRuntimeContract.js';
+import { type TaskforceCloudEnvironment } from '../config/cloudEnvironment.js';
 import type { LocalSyncCoordinatorHost } from '../sync/coordinator/localSyncCoordinatorHost.js';
 import type { LocalSyncProcessLock } from '../sync/coordinator/localSyncProcessLock.js';
 import type { LocalDataOwnerPermit } from './localDataOwnerPermit.js';
@@ -26,6 +28,7 @@ export interface StandaloneServerOptions {
         bootstrapCapability: string;
         ownershipKey: string;
         cloudTarget: LocalServiceCloudTarget;
+        runtimeContract: LocalServiceRuntimeContract;
     };
 }
 export interface TaskforceStandaloneServer extends http.Server {
@@ -46,6 +49,7 @@ export declare const TASKFORCE_PROXY_ORIGIN_PROTO_HEADER = "x-taskforce-origin-p
 export declare const TASKFORCE_PROXY_ORIGIN_BASE_URL_HEADER = "x-taskforce-origin-base-url";
 export declare const TASKFORCE_PROXY_ORIGIN_RUNTIME_HEADER = "x-taskforce-origin-runtime";
 export declare const TASKFORCE_PROXY_CLOUD_ENVIRONMENT_HEADER = "x-taskforce-cloud-environment";
+export declare function sanitizeQaRunIdHeader(raw: unknown): string;
 export declare function shouldProxyCloudPath(pathname: string): boolean;
 export declare function shouldProxyCloudRequest(url: Pick<URL, 'pathname' | 'searchParams'>, env?: NodeJS.ProcessEnv): boolean;
 export declare function resolveCloudProxyUpstreamBaseUrl(req: http.IncomingMessage, fallbackBaseUrl: string): string;
@@ -57,6 +61,8 @@ export declare function writeJsonErrorIfPossible(res: http.ServerResponse, statu
 export declare function applyCloudProxyForwardedHeaders(headers: Headers, req: http.IncomingMessage): void;
 export declare function rewriteProxySetCookieForLocalHost(cookie: string): string;
 export declare function shouldRewriteProxySetCookieDomain(cookie: string, hostHeader: string | undefined): boolean;
+export declare function applyAdminProxyRequestSession(headers: Headers, environment: TaskforceCloudEnvironment, env?: NodeJS.ProcessEnv): void;
+export declare function rewriteAdminProxyResponseCookies(setCookies: string[], environment: TaskforceCloudEnvironment, requestHost: string | undefined, env?: NodeJS.ProcessEnv): string[];
 export declare function shouldForwardCloudProxyResponseHeader(name: string): boolean;
 export declare function shouldApplyAuthRateLimitForPath(pathname: string): boolean;
 export declare function resolveCloudProxyBaseUrl(env?: NodeJS.ProcessEnv): string;

package/dist/server/index.js

@@ -16,7 +16,7 @@ import { createRoutes, matchRoute } from './routes.js';
 import { formatApiErrorResponse } from './routes/primitives.js';
 import { logSlowBootstrapRoute } from './routes/shared.js';
 import { applyCorsHeaders, getAllowedOriginsFromEnv } from './cors.js';
-import { applyPrefixedRateLimitHeaders, applyRateLimitHeaders, InMemoryRateLimiter, resolveRateLimitKey } from './rateLimit.js';
+import { applyPrefixedRateLimitHeaders, applyRateLimitHeaders, InMemoryRateLimiter, isWorkspaceSyncFeedRead, resolveRateLimitKey, } from './rateLimit.js';
 import { isRequestAuthorized, resolveAuthConfigFromEnv, resolveRequestAccess } from './auth.js';
 import { resolveAuthorizedWorkspaceAccess, resolveDisabledAccessError, } from './authorizedWorkspaceAccess.js';
 export { resolveAuthorizedWorkspaceAccess, resolveDisabledAccessError, isWorkspaceAccessRecoveryRoute, } from './authorizedWorkspaceAccess.js';
@@ -31,14 +31,17 @@ import { TaskAssetStore } from '../storage/taskAssetStore.js';
 import { validateEnvironment } from '../config/envSchema.js';
 import { createRealtimeSyncWsManager } from './realtimeSyncWs.js';
 import { resolveDeploymentConfig } from '../config/deployment.js';
-import { TASKFORCE_CLOUD_ENVIRONMENTS, parseTaskforceCloudEnvironment } from '../config/cloudEnvironment.js';
-import { resolveWorkflowRuntimeMutationCapability } from '../sync/v3/durableWorkflowRuntimeMutationRouter.js';
+import { TASKFORCE_CLOUD_ENVIRONMENTS, parseTaskforceCloudEnvironment, } from '../config/cloudEnvironment.js';
+import { resolveAllAdminProxyUpstreamSessionCookieNames, resolveAdminProxyUpstreamSessionCookieName, rewriteAdminProxyRequestCookieHeader, rewriteAdminProxyResponseSetCookie, } from '../shared/adminProxySessionCookies.js';
+import { areWorkflowRuntimeMutationsFenced, resolveWorkflowRuntimeMutationCapability, } from '../sync/v3/durableWorkflowRuntimeMutationRouter.js';
 import { createWorkspaceSyncCloudCredentialValidator } from '../sync/coordinator/workspaceSyncCloudCredentialValidator.js';
 import { bootstrapVerifiedWorkspaceSyncAccess } from '../sync/coordinator/workspaceSyncLocalAccessBootstrap.js';
 import { rewriteSetCookieForLocalHost } from '../utils/httpSetCookie.js';
 import { createWorkspaceSyncServerComposition, shutdownWorkspaceSyncServerComposition, } from './localWorkspaceSyncServerComposition.js';
 import { LocalServiceSessionManager } from './localServiceSessions.js';
 import { LocalSyncIdentityStore } from '../sync/v3/localSyncIdentityStore.js';
+import { pruneExpiredWorkspaceSyncRepairSnapshots, resolveWorkspaceSyncRepairSnapshotRetentionPolicy, } from '../sync/v3/workspaceSyncV3RepairSnapshotRetentionService.js';
+import { pruneRetainedWorkspaceSyncOperations, WORKSPACE_SYNC_OPERATION_RETENTION_INTERVAL_MS, } from '../sync/v3/workspaceSyncOperationRetentionService.js';
 import { shouldBroadcastLocalFileInvalidation } from './localRealtimeFileInvalidation.js';
 import { resolveCloudCollectionReadOperation, } from './cloudCollectionRead.js';
 import { CloudCollectionReadPool, resolveCloudCollectionReadPoolSize, shouldUseCloudCollectionReadPool, } from './cloudCollectionReadPool.js';
@@ -178,6 +181,12 @@ export const TASKFORCE_PROXY_ORIGIN_PROTO_HEADER = 'x-taskforce-origin-proto';
 export const TASKFORCE_PROXY_ORIGIN_BASE_URL_HEADER = 'x-taskforce-origin-base-url';
 export const TASKFORCE_PROXY_ORIGIN_RUNTIME_HEADER = 'x-taskforce-origin-runtime';
 export const TASKFORCE_PROXY_CLOUD_ENVIRONMENT_HEADER = 'x-taskforce-cloud-environment';
+export function sanitizeQaRunIdHeader(raw) {
+    const normalized = String(Array.isArray(raw) ? raw[0] : raw || '')
+        .trim()
+        .replace(/[^A-Za-z0-9._-]+/g, '-');
+    return normalized.slice(0, 128) || '-';
+}
 function shouldLogRefreshDiagnostic(pathname) {
     return REFRESH_DIAGNOSTIC_PATH_PREFIXES.some((prefix) => pathname === prefix || pathname.startsWith(prefix));
 }
@@ -255,7 +264,11 @@ export function shouldProxyCloudPath(pathname) {
         || pathname.startsWith('/api/taskforce/admin/')
         || pathname.startsWith('/api/taskforce/billing/')
         || pathname.startsWith('/api/taskforce/auth/')
+        || pathname === '/api/taskforce/model-connections'
+        || pathname.startsWith('/api/taskforce/model-connections/')
+        || pathname === '/api/taskforce/agents/model-catalog'
         || pathname === '/api/taskforce/agents/model-gateway/test'
+        || /^\/api\/taskforce\/agents\/[^/]+\/connection-binding$/i.test(pathname)
         || isCloudOwnedUserAvatarContextPath(pathname)
         || isTaskforceAgentAvatarGenerationPath(pathname)
         || pathname.startsWith('/api/taskforce/settings/mcp/')
@@ -276,6 +289,8 @@ export function shouldProxyCloudRequest(url, env = process.env) {
     if (isWorkspaceAiProfileAvatarContextPath(url.pathname))
         return true;
     if (/^\/api\/taskforce\/workflow-executions\/[^/]+\/complete-step$/.test(url.pathname)) {
+        if (areWorkflowRuntimeMutationsFenced(env))
+            return false;
         return !resolveWorkflowRuntimeMutationCapability({
             runtimeMode: 'local',
             surface: 'http',
@@ -404,6 +419,26 @@ export function shouldRewriteProxySetCookieDomain(cookie, hostHeader) {
         return false;
     return !requestHost.endsWith(`.${cookieDomain}`);
 }
+export function applyAdminProxyRequestSession(headers, environment, env = process.env) {
+    const upstreamSessionCookieName = resolveAdminProxyUpstreamSessionCookieName(environment, env);
+    const rewrittenCookie = rewriteAdminProxyRequestCookieHeader(headers.get('cookie'), environment, upstreamSessionCookieName, resolveAllAdminProxyUpstreamSessionCookieNames(env));
+    if (rewrittenCookie)
+        headers.set('cookie', rewrittenCookie);
+    else
+        headers.delete('cookie');
+}
+export function rewriteAdminProxyResponseCookies(setCookies, environment, requestHost, env = process.env) {
+    const upstreamSessionCookieName = resolveAdminProxyUpstreamSessionCookieName(environment, env);
+    return setCookies.map((cookie) => {
+        const environmentScopedCookie = rewriteAdminProxyResponseSetCookie(cookie, environment, upstreamSessionCookieName);
+        if (shouldRewriteSetCookieForLocalDevHost(requestHost)) {
+            return rewriteProxySetCookieForLocalHost(environmentScopedCookie);
+        }
+        return shouldRewriteProxySetCookieDomain(environmentScopedCookie, requestHost)
+            ? rewriteProxySetCookieForLocalHost(environmentScopedCookie)
+            : environmentScopedCookie;
+    });
+}
 export function shouldForwardCloudProxyResponseHeader(name) {
     const normalizedName = String(name || '').trim().toLowerCase();
     if (!normalizedName)
@@ -606,7 +641,7 @@ export function createStandaloneServer(options) {
     }
     let localServiceServer = null;
     const localServiceSessions = options.localService
-        ? new LocalServiceSessionManager(options.localService.generation)
+        ? new LocalServiceSessionManager(options.localService.generation, core.getDatabaseAdapter(), core.getTenantId(), options.localService.runtimeContract)
         : null;
     const routes = createRoutes(core, {
         authConfig,
@@ -658,10 +693,13 @@ export function createStandaloneServer(options) {
         : (runtimeMode === 'cloud');
     const rateLimitLimit = Number.parseInt(process.env.TASKFORCE_API_RATE_LIMIT_MAX_REQUESTS || '', 10) || 120;
     const rateLimitWindowMs = Number.parseInt(process.env.TASKFORCE_API_RATE_LIMIT_WINDOW_MS || '', 10) || 60_000;
+    const syncFeedRateLimit = Number.parseInt(process.env.TASKFORCE_SYNC_FEED_RATE_LIMIT_MAX_REQUESTS || '', 10) || 600;
+    const syncFeedRateLimitWindowMs = Number.parseInt(process.env.TASKFORCE_SYNC_FEED_RATE_LIMIT_WINDOW_MS || '', 10) || 60_000;
     const webhookRateLimitMaxRequests = Number.parseInt(process.env.TASKFORCE_STRIPE_WEBHOOK_RATE_LIMIT_MAX_REQUESTS || '', 10) || 600;
     const webhookRateLimitWindowMs = Number.parseInt(process.env.TASKFORCE_STRIPE_WEBHOOK_RATE_LIMIT_WINDOW_MS || '', 10) || 60_000;
     const maxPayloadBytes = Number.parseInt(process.env.TASKFORCE_MAX_PAYLOAD_BYTES || '', 10) || 1_048_576;
     const rateLimiter = new InMemoryRateLimiter(rateLimitLimit, rateLimitWindowMs);
+    const syncFeedRateLimiter = new InMemoryRateLimiter(syncFeedRateLimit, syncFeedRateLimitWindowMs);
     const webhookRateLimiter = new InMemoryRateLimiter(webhookRateLimitMaxRequests, webhookRateLimitWindowMs);
     const resolveAuthRateLimitSettings = () => {
         const auth = core.getGlobalSettings().auth || {};
@@ -765,7 +803,8 @@ export function createStandaloneServer(options) {
         const requestId = String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || '-';
         const workspaceId = String(req.headers['x-taskforce-workspace-id'] || '').trim() || '-';
         const userId = String(req.headers['x-taskforce-user-id'] || '').trim() || '-';
-        console.info(`[Taskforce RefreshDiag] method=${method} path=${pathname} status=${statusCode} durationMs=${durationMs} requestId=${requestId} workspaceId=${workspaceId} userId=${userId}`);
+        const qaRunId = sanitizeQaRunIdHeader(req.headers['x-taskforce-qa-run-id']);
+        console.info(`[Taskforce RefreshDiag] method=${method} path=${pathname} status=${statusCode} durationMs=${durationMs} requestId=${requestId} workspaceId=${workspaceId} userId=${userId} qaRunId=${qaRunId}`);
     };
     // Resolve static files directory at runtime
     // Standalone UI source now lives in apps/app and builds to dist/ui.
@@ -825,6 +864,9 @@ export function createStandaloneServer(options) {
     const adminAuditRetentionEnabled = runtimeMode === 'cloud'
         && process.env.TASKFORCE_ADMIN_AUDIT_RETENTION_ENABLED !== 'false';
     const adminAuditRetentionIntervalMinutes = readPositiveInteger(process.env.TASKFORCE_ADMIN_AUDIT_RETENTION_INTERVAL_MINUTES, 15);
+    const repairSnapshotRetentionEnabled = runtimeMode === 'cloud'
+        && process.env.TASKFORCE_SYNC_REPAIR_SNAPSHOT_RETENTION_ENABLED !== 'false';
+    const repairSnapshotRetentionIntervalMinutes = readPositiveInteger(process.env.TASKFORCE_SYNC_REPAIR_SNAPSHOT_RETENTION_INTERVAL_MINUTES, 1);
     const server = http.createServer(async (req, res) => {
         const requestStartedAt = getRequestTimingNow();
         if (!distUiPath) {
@@ -877,6 +919,7 @@ export function createStandaloneServer(options) {
             }
             try {
                 const method = String(req.method || 'GET').toUpperCase();
+                const adminProxyEnvironment = parseTaskforceCloudEnvironment(req.headers[TASKFORCE_PROXY_CLOUD_ENVIRONMENT_HEADER]);
                 const upstreamBaseUrl = resolveCloudProxyUpstreamBaseUrl(req, cloudProxyBaseUrl);
                 const upstreamUrl = `${upstreamBaseUrl}${url.pathname}${url.search || ''}`;
                 const headers = new Headers();
@@ -894,6 +937,9 @@ export function createStandaloneServer(options) {
                         continue;
                     headers.set(key, serialized);
                 }
+                if (adminProxyEnvironment) {
+                    applyAdminProxyRequestSession(headers, adminProxyEnvironment);
+                }
                 applyCloudProxyForwardedHeaders(headers, req);
                 if (cloudProxyClientId && cloudProxyClientSecret) {
                     headers.set('CF-Access-Client-Id', cloudProxyClientId);
@@ -915,17 +961,22 @@ export function createStandaloneServer(options) {
                         continue;
                     outgoingHeaders[key] = value;
                 }
+                if (adminProxyEnvironment) {
+                    outgoingHeaders['cache-control'] = 'no-store';
+                }
                 const setCookies = upstream.headers.getSetCookie?.();
                 if (Array.isArray(setCookies) && setCookies.length > 0) {
                     const requestHost = String(req.headers.host || '').trim();
-                    const normalizedSetCookies = setCookies.map((cookie) => {
-                        if (shouldRewriteSetCookieForLocalDevHost(requestHost)) {
-                            return rewriteProxySetCookieForLocalHost(cookie);
-                        }
-                        return shouldRewriteProxySetCookieDomain(cookie, requestHost)
-                            ? rewriteProxySetCookieForLocalHost(cookie)
-                            : cookie;
-                    });
+                    const normalizedSetCookies = adminProxyEnvironment
+                        ? rewriteAdminProxyResponseCookies(setCookies, adminProxyEnvironment, requestHost)
+                        : setCookies.map((cookie) => {
+                            if (shouldRewriteSetCookieForLocalDevHost(requestHost)) {
+                                return rewriteProxySetCookieForLocalHost(cookie);
+                            }
+                            return shouldRewriteProxySetCookieDomain(cookie, requestHost)
+                                ? rewriteProxySetCookieForLocalHost(cookie)
+                                : cookie;
+                        });
                     res.setHeader('Set-Cookie', normalizedSetCookies);
                 }
                 res.writeHead(upstream.status, outgoingHeaders);
@@ -992,7 +1043,9 @@ export function createStandaloneServer(options) {
                     });
                     const rateLimitResult = isBillingWebhook
                         ? webhookRateLimiter.check(key)
-                        : rateLimiter.check(key);
+                        : isWorkspaceSyncFeedRead(req.method, url.pathname)
+                            ? syncFeedRateLimiter.check(key)
+                            : rateLimiter.check(key);
                     if (isBillingWebhook) {
                         applyPrefixedRateLimitHeaders(res, rateLimitResult, 'X-Webhook-RateLimit');
                     }
@@ -1168,6 +1221,8 @@ export function createStandaloneServer(options) {
     let purgeTimer = null;
     let integrityScheduleTimer = null;
     let adminAuditRetentionTimer = null;
+    let repairSnapshotRetentionTimer = null;
+    let operationRetentionTimer = null;
     let watcher = null;
     let shutdownPromise = null;
     Object.defineProperty(server, 'localSyncCoordinatorHost', {
@@ -1192,6 +1247,14 @@ export function createStandaloneServer(options) {
                 clearInterval(adminAuditRetentionTimer);
                 adminAuditRetentionTimer = null;
             }
+            if (repairSnapshotRetentionTimer) {
+                clearInterval(repairSnapshotRetentionTimer);
+                repairSnapshotRetentionTimer = null;
+            }
+            if (operationRetentionTimer) {
+                clearInterval(operationRetentionTimer);
+                operationRetentionTimer = null;
+            }
             if (localSyncPermitRecoveryTimer) {
                 clearInterval(localSyncPermitRecoveryTimer);
                 localSyncPermitRecoveryTimer = null;
@@ -1245,6 +1308,52 @@ export function createStandaloneServer(options) {
             adminAuditRetentionTimer = setInterval(runAdminAuditRetention, adminAuditRetentionIntervalMinutes * 60_000);
             adminAuditRetentionTimer.unref?.();
         }
+        const runRepairSnapshotRetention = () => {
+            try {
+                const result = pruneExpiredWorkspaceSyncRepairSnapshots({
+                    db: core.getDatabaseAdapter(),
+                    tenantId: core.getTenantId(),
+                    policy: resolveWorkspaceSyncRepairSnapshotRetentionPolicy(),
+                });
+                if (result.deletedEntries > 0
+                    || result.deletedSnapshots > 0
+                    || result.remainingExpiredSnapshots > 0) {
+                    console.log('[Taskforce] Sync repair snapshot retention: '
+                        + `deletedEntries=${result.deletedEntries} `
+                        + `deletedSnapshots=${result.deletedSnapshots} `
+                        + `remainingExpiredSnapshots=${result.remainingExpiredSnapshots}`);
+                }
+            }
+            catch (error) {
+                console.warn(`[Taskforce] Sync repair snapshot retention failed: ${String(error?.message || error)}`);
+            }
+        };
+        if (repairSnapshotRetentionEnabled) {
+            runRepairSnapshotRetention();
+            repairSnapshotRetentionTimer = setInterval(runRepairSnapshotRetention, repairSnapshotRetentionIntervalMinutes * 60_000);
+            repairSnapshotRetentionTimer.unref?.();
+        }
+        const runOperationRetention = () => {
+            try {
+                const result = pruneRetainedWorkspaceSyncOperations({
+                    db: core.getDatabaseAdapter(),
+                    tenantId: core.getTenantId(),
+                });
+                if (result.deletedOutbox > 0 || result.deletedResults > 0 || result.remainingEligible > 0) {
+                    console.log('[Taskforce] Sync operation retention: '
+                        + `deletedOutbox=${result.deletedOutbox} `
+                        + `deletedResults=${result.deletedResults} `
+                        + `remainingEligible=${result.remainingEligible} `
+                        + `workspacesProcessed=${result.workspacesProcessed}`);
+                }
+            }
+            catch (error) {
+                console.warn(`[Taskforce] Sync operation retention failed: ${String(error?.message || error)}`);
+            }
+        };
+        runOperationRetention();
+        operationRetentionTimer = setInterval(runOperationRetention, WORKSPACE_SYNC_OPERATION_RETENTION_INTERVAL_MS);
+        operationRetentionTimer.unref?.();
         const appendDocumentPurgeHistory = (summary) => {
             const settings = core.getGlobalSettings();
             const existing = Array.isArray(settings?.documentPurgeHistory)

package/dist/server/localDatabaseIdentity.js

@@ -3,6 +3,9 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 const SAFE_POSIX_SOCKET_PATH_BYTES = 100;
+function defaultTemporaryDirectory(platform) {
+    return platform === 'darwin' ? '/tmp' : os.tmpdir();
+}
 function canonicalizePath(value) {
     const resolved = path.resolve(value);
     const missingSegments = [];
@@ -39,7 +42,7 @@ export function resolveLocalSyncProcessLockIdentity(input) {
         };
     }
     const socketName = `taskforce-sync-${shortKey}.sock`;
-    const requestedEndpoint = path.join(input.tempDirectory || os.tmpdir(), socketName);
+    const requestedEndpoint = path.join(input.tempDirectory || defaultTemporaryDirectory(platform), socketName);
     const endpoint = Buffer.byteLength(requestedEndpoint) <= SAFE_POSIX_SOCKET_PATH_BYTES
         ? requestedEndpoint
         : path.join('/tmp', socketName);

package/dist/server/localServiceLease.d.ts

@@ -1,4 +1,5 @@
 import { type LocalServiceCloudTarget } from '../config/localServiceCloudTarget.js';
+import { type LocalServiceRuntimeContract } from '../config/localServiceRuntimeContract.js';
 import { type WindowsAclCommandRunner } from './localServiceWindowsAcl.js';
 export interface LocalServiceDescriptor {
     schemaVersion: 1;
@@ -11,6 +12,7 @@ export interface LocalServiceDescriptor {
     bootstrapCapability: string;
     publishedAt: string;
     cloudTarget?: LocalServiceCloudTarget | null;
+    runtimeContract?: LocalServiceRuntimeContract | null;
 }
 export interface LocalServiceLeaseIdentityInput {
     projectRoot: string;
@@ -30,6 +32,7 @@ export interface LocalServiceDescriptorPublication {
     protocolVersion: string;
     appVersion: string;
     cloudTarget: LocalServiceCloudTarget;
+    runtimeContract: LocalServiceRuntimeContract;
 }
 export interface LocalServiceLease {
     readonly identity: LocalServiceLeaseIdentity;

package/dist/server/localServiceLease.js

@@ -4,6 +4,7 @@ import * as net from 'net';
 import * as os from 'os';
 import * as path from 'path';
 import { parseLocalServiceCloudTarget, } from '../config/localServiceCloudTarget.js';
+import { parseLocalServiceRuntimeContract, } from '../config/localServiceRuntimeContract.js';
 import { resolveLocalSyncProcessLockIdentity } from './localDatabaseIdentity.js';
 import { ensureWindowsUserOnlyDirectoryAcl, } from './localServiceWindowsAcl.js';
 const DESCRIPTOR_SCHEMA_VERSION = 1;
@@ -20,7 +21,8 @@ function defaultRuntimeDirectory(platform) {
     const userKey = typeof process.getuid === 'function'
         ? String(process.getuid())
         : createHash('sha256').update(os.userInfo().username).digest('hex').slice(0, 16);
-    return path.join(os.tmpdir(), `taskforce-${userKey}`, 'local-services');
+    const temporaryDirectory = platform === 'darwin' ? '/tmp' : os.tmpdir();
+    return path.join(temporaryDirectory, `taskforce-${userKey}`, 'local-services');
 }
 export function resolveLocalServiceLeaseIdentity(input) {
     const ownershipKey = resolveLocalSyncProcessLockIdentity(input).ownershipKey;
@@ -168,8 +170,14 @@ function parseDescriptor(value, ownershipKey) {
     if (value.cloudTarget != null && !cloudTarget) {
         throw new Error('Local service descriptor cloud target is invalid.');
     }
+    const runtimeContract = value.runtimeContract == null
+        ? null
+        : parseLocalServiceRuntimeContract(value.runtimeContract);
+    if (value.runtimeContract != null && !runtimeContract) {
+        throw new Error('Local service descriptor runtime contract is invalid.');
+    }
     assertLoopbackEndpoint(value.endpoint);
-    return { ...value, cloudTarget };
+    return { ...value, cloudTarget, runtimeContract };
 }
 function readOptionalDescriptor(identity) {
     try {
@@ -371,6 +379,7 @@ export async function acquireLocalServiceLease(input, dependencies = {}) {
                         bootstrapCapability,
                         publishedAt: (dependencies.now?.() || new Date()).toISOString(),
                         cloudTarget: publication.cloudTarget,
+                        runtimeContract: publication.runtimeContract,
                     };
                     publishJsonFileAtomically(identity.descriptorPath, descriptor, platform);
                     return descriptor;

package/dist/server/localServiceSessions.d.ts

@@ -1,9 +1,10 @@
 import type { McpAccessTokenScope } from '../core/Taskforce.js';
+import type { LocalServiceRuntimeContract } from '../config/localServiceRuntimeContract.js';
 import type { McpClientId } from '../mcp/clientRegistry.js';
 import type { McpToolProfile } from '../mcp/toolRegistry.js';
+import type { DatabaseAdapter } from '../storage/databaseAdapter.js';
 export declare const LOCAL_SERVICE_SESSION_IDLE_TTL_MS: number;
 export declare const LOCAL_SERVICE_SESSION_CAP = 256;
-export declare const LOCAL_SERVICE_OPERATION_BINDING_CAP = 4096;
 export declare const LOCAL_SERVICE_CANCELLATION_BINDING_CAP = 1024;
 export declare const LOCAL_SERVICE_CANCELLATION_TOMBSTONE_TTL_MS = 60000;
 export interface LocalServiceSessionRegistration {
@@ -17,34 +18,35 @@ export interface LocalServiceSessionRegistration {
 }
 export interface LocalServiceSession extends LocalServiceSessionRegistration {
     id: string;
+    runtimeContract: LocalServiceRuntimeContract;
     createdAt: string;
     lastUsedAt: string;
+    expiresAt: string;
+    revokedAt: string | null;
     aiProfileId: string | null;
 }
 export type LocalServiceLifecycleState = 'accepting' | 'draining' | 'forcing';
-export interface LocalServiceOperationBinding {
-    sessionId: string;
-    operationId: string;
-    mutationKind: string;
-    payloadFingerprint: string;
-    recordedAt: string;
-}
 export declare class LocalServiceSessionError extends Error {
     readonly statusCode: number;
     readonly code: string;
     constructor(message: string, statusCode: number, code: string);
 }
+export declare function ensureLocalServiceCredentialSchema(db: DatabaseAdapter): void;
 export declare class LocalServiceSessionManager {
     readonly generation: string;
+    private readonly db;
+    private readonly tenantId;
+    readonly runtimeContract: LocalServiceRuntimeContract;
     private readonly options;
-    private readonly sessions;
     private readonly inFlightBySession;
-    private readonly operationBindings;
     private readonly cancellationBindings;
     private readonly cancellationTombstones;
     private readonly drainWaiters;
     private lifecycleState;
-    constructor(generation: string, options?: {
+    private readonly runtimeContractJson;
+    private readonly authenticateStatement;
+    private readonly touchStatement;
+    constructor(generation: string, db: DatabaseAdapter, tenantId: string, runtimeContract: LocalServiceRuntimeContract, options?: {
         nowMs?: () => number;
         randomId?: () => string;
         randomSecret?: () => string;
@@ -63,6 +65,7 @@ export declare class LocalServiceSessionManager {
         touch?: boolean;
     }): LocalServiceSession | null;
     revoke(id: string): boolean;
+    private hasActiveCredential;
     beginRequest(id: string): void;
     endRequest(id: string): void;
     inFlightCount(): number;
@@ -73,12 +76,6 @@ export declare class LocalServiceSessionManager {
     revokeAll(): void;
     registerCancellation(sessionId: string, correlationId: string, cancel: () => void): () => void;
     cancelRequest(sessionId: string, correlationId: string): boolean;
-    recordOperation(input: Omit<LocalServiceOperationBinding, 'recordedAt'>): LocalServiceOperationBinding;
-    getOperationBinding(sessionId: string, operationId: string, expected?: {
-        mutationKind?: string | null;
-        payloadFingerprint?: string | null;
-    }): LocalServiceOperationBinding | null;
-    private removeOperationBindings;
     private removeCancellationBindings;
     private pruneCancellationTombstones;
     bindAiProfile(id: string, profileId: string): LocalServiceSession;