@taskforcehq/taskforce 0.3.328 → 0.3.330

package/dist/server/routes/admin.d.ts

@@ -21,6 +21,7 @@
  *   GET       /api/taskforce/admin/collaboration-telemetry
  *   PATCH     /api/taskforce/admin/system-users/:id/disable
  *   PATCH     /api/taskforce/admin/system-users/:id/beta-access
+ *   PATCH     /api/taskforce/admin/system-users/:id/feature-grants/:featureKey
  *   PATCH     /api/taskforce/admin/system-users/:id/verify-email
  *   GET/POST  /api/taskforce/admin/email-settings
  *   GET       /api/taskforce/admin/email-settings/health
@@ -48,8 +49,10 @@
  *   GET/POST  /oauth/mcp/authorize
  *   POST      /oauth/mcp/token
  *   GET/POST  /api/taskforce/settings/mcp/tokens (+ revoke, regenerate)
+ *   PATCH     /api/taskforce/settings/mcp/tokens/:id/tool-profile
  *   GET       /api/taskforce/settings/mcp/connectors
  *   POST      /api/taskforce/settings/mcp/connectors/:id/disconnect
+ *   PATCH     /api/taskforce/settings/mcp/connectors/:id/tool-profile
  *   POST      /api/taskforce/settings/mcp/test-connection
  */
 import type { IncomingMessage, ServerResponse } from 'http';
@@ -68,6 +71,7 @@ export interface AdminRouteDependencies {
     requestRole: (req: IncomingMessage) => string;
     ensureAppAccess: (req: IncomingMessage, res: ServerResponse) => boolean;
     ensureAdminRole: (req: IncomingMessage) => boolean;
+    ensureWorkspaceAdminRole: (req: IncomingMessage, workspaceIdOverride?: string | null) => boolean;
     ensureCloudPlanData: (req: IncomingMessage, res: ServerResponse) => boolean;
     requireCloudRuntime: (res: ServerResponse, feature: string) => boolean;
     resolveAuthenticatedUserId: (req: IncomingMessage) => string;

package/dist/server/routes/admin.js

@@ -21,6 +21,7 @@
  *   GET       /api/taskforce/admin/collaboration-telemetry
  *   PATCH     /api/taskforce/admin/system-users/:id/disable
  *   PATCH     /api/taskforce/admin/system-users/:id/beta-access
+ *   PATCH     /api/taskforce/admin/system-users/:id/feature-grants/:featureKey
  *   PATCH     /api/taskforce/admin/system-users/:id/verify-email
  *   GET/POST  /api/taskforce/admin/email-settings
  *   GET       /api/taskforce/admin/email-settings/health
@@ -48,14 +49,17 @@
  *   GET/POST  /oauth/mcp/authorize
  *   POST      /oauth/mcp/token
  *   GET/POST  /api/taskforce/settings/mcp/tokens (+ revoke, regenerate)
+ *   PATCH     /api/taskforce/settings/mcp/tokens/:id/tool-profile
  *   GET       /api/taskforce/settings/mcp/connectors
  *   POST      /api/taskforce/settings/mcp/connectors/:id/disconnect
+ *   PATCH     /api/taskforce/settings/mcp/connectors/:id/tool-profile
  *   POST      /api/taskforce/settings/mcp/test-connection
  */
 import * as fs from 'fs';
 import * as path from 'path';
 import { TaskforceRuleError } from '../../core/Taskforce.js';
 import { classifyMcpOAuthClientProduct } from '../../mcp/clientRegistry.js';
+import { getCloudMcpToolProfileMembership } from '../../mcp/toolProfiles.js';
 import { escapeHtml, formatApiErrorResponse, parseFormBody, parseJsonBody } from './primitives.js';
 import { resolveRequestAccess } from '../auth.js';
 import { sendEmail } from '../email.js';
@@ -70,19 +74,27 @@ import { randomUUID } from 'crypto';
 import { resolveDeploymentConfig } from '../../config/deployment.js';
 import { getTaskforceCloudEnvironmentConfig, resolveTaskforceCloudEnvironmentFromBaseUrl, resolveTaskforceMcpBaseUrlFromBaseUrl } from '../../config/cloudEnvironment.js';
 import { makeHandleCloudMcpRequest, resolveErrorStatusCode } from './shared.js';
+import * as mcpRuntime from '../../mcp/runtime.js';
 import { buildAuthBehavior, buildSiteBehavior, getRouteEmailConfig, resolvePublicAuthBaseUrl, resolveRuntimeConfigBaseUrl, } from './authSupport.js';
 import { applyWorkspaceRepair, scanWorkspaceRepair } from '../../sync/workspaceRepair.js';
 import { testMintAppleClientSecret } from '../auth/providers/appleClientSecret.js';
 import { isAiProfileAvatarStorageKey } from '../../utils/aiProfileAvatarPaths.js';
+import { WorkspaceSyncContentPullObligationStore } from '../../sync/engine/workspaceSyncContentPullObligationStore.js';
+import { isSupportedInternalUserFeatureKey } from '../../shared/userFeatureGrants.js';
 const PRICING_PAGE_DESCRIPTION_MAX_LENGTH = 2000;
 const OPENAI_APPS_CHALLENGE_TOKEN = 'o9iBeJDuKPMtnKm5-B8OROga3bWDkJS6PBIg6JT9Izs';
 // === SECTION: Registration ===
 export function registerAdminRoutes(deps) {
-    const { addRoute, core, context, requestWorkspaceId, requestUserId, requestRole, ensureAppAccess, ensureAdminRole, ensureCloudPlanData, requireCloudRuntime, resolveAuthenticatedUserId, resolveAdminRequestActor, auditAdminAction, resolveEffectiveObjectStorageConfig, getObjectStorageClient, taskAssetStore, publishedContentResolver, normalizeDocumentPathInput, ensureWithinDir, getAssetMetadata, markAssetDeleted, clearAssetDeleted, removeAssetMetadata, getStorageTelemetry, appendStorageTelemetry, getStorageIntegrityHistory, appendStorageIntegrityHistory, getDocumentPurgeHistory, appendDocumentPurgeHistory, getCollaborationTelemetry, isCollaborationPolicyEnabled, normalizeMcpOauthScopeString, MCP_TOKEN_SCOPE_VALUES, MCP_WRITE_RATE_LIMIT_ENABLED, MCP_WRITE_RATE_LIMIT_ACTOR_MAX_REQUESTS, MCP_WRITE_RATE_LIMIT_WORKSPACE_MAX_REQUESTS, MCP_WRITE_RATE_LIMIT_WINDOW_MS, } = deps;
+    const { addRoute, core, context, requestWorkspaceId, requestUserId, requestRole, ensureAppAccess, ensureAdminRole, ensureWorkspaceAdminRole, ensureCloudPlanData, requireCloudRuntime, resolveAuthenticatedUserId, resolveAdminRequestActor, auditAdminAction, resolveEffectiveObjectStorageConfig, getObjectStorageClient, taskAssetStore, publishedContentResolver, normalizeDocumentPathInput, ensureWithinDir, getAssetMetadata, markAssetDeleted, clearAssetDeleted, removeAssetMetadata, getStorageTelemetry, appendStorageTelemetry, getStorageIntegrityHistory, appendStorageIntegrityHistory, getDocumentPurgeHistory, appendDocumentPurgeHistory, getCollaborationTelemetry, isCollaborationPolicyEnabled, normalizeMcpOauthScopeString, MCP_TOKEN_SCOPE_VALUES, MCP_WRITE_RATE_LIMIT_ENABLED, MCP_WRITE_RATE_LIMIT_ACTOR_MAX_REQUESTS, MCP_WRITE_RATE_LIMIT_WORKSPACE_MAX_REQUESTS, MCP_WRITE_RATE_LIMIT_WINDOW_MS, } = deps;
     const baseVirusScanConfig = resolveVirusScanConfigFromEnv(process.env);
     const workspaceAssetStore = typeof core.getDatabaseAdapter === 'function' && typeof core.getTenantId === 'function'
         ? new WorkspaceAssetStore(core.getDatabaseAdapter(), core.getTenantId())
         : null;
+    const mcpToolProfileOptions = ['default', 'extended'].map((id) => ({
+        id,
+        label: id === 'extended' ? 'All cloud tools' : 'Standard',
+        toolCount: getCloudMcpToolProfileMembership(id).length,
+    }));
     const listReferencedAiProfileAvatarStorageKeys = (workspaceId) => {
         const referenced = new Set();
         const profiles = typeof core.listAiProfiles === 'function'
@@ -334,6 +346,8 @@ export function registerAdminRoutes(deps) {
     const handleCloudMcpRequest = makeHandleCloudMcpRequest(core, {
         ensureAppAccess,
         resolveAuthenticatedUserId,
+        // Keep the production factory unchanged while preserving the route-test injection seam.
+        createMcpServer: (options) => mcpRuntime.createTaskforceMcpServer(options),
         writeRateLimit: {
             enabled: MCP_WRITE_RATE_LIMIT_ENABLED,
             actorMaxRequests: MCP_WRITE_RATE_LIMIT_ACTOR_MAX_REQUESTS,
@@ -1039,6 +1053,42 @@ export function registerAdminRoutes(deps) {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ success: true }));
     });
+    // PATCH /api/taskforce/admin/system-users/:id/feature-grants/:featureKey - Grant/revoke an internal user feature
+    addRoute('PATCH', '/api/taskforce/admin/system-users/:id/feature-grants/:featureKey', async (req, res, params) => {
+        if (!ensureAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: system admin role required.' }));
+            return;
+        }
+        if (!requireCloudRuntime(res, 'Internal user feature grants'))
+            return;
+        const featureKey = String(params.featureKey || '').trim();
+        if (!isSupportedInternalUserFeatureKey(featureKey)) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Unsupported internal feature key.' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        if (typeof body?.enabled !== 'boolean') {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'enabled must be a boolean.' }));
+            return;
+        }
+        const actor = resolveAdminRequestActor(req);
+        const success = core.setUserFeatureGrant(params.id, featureKey, body.enabled, actor.userId);
+        if (!success) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'User not found' }));
+            return;
+        }
+        auditAdminAction(req, 'set-user-feature-grant', {
+            targetUserId: params.id,
+            featureKey,
+            enabled: body.enabled,
+        });
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ success: true, featureKey, enabled: body.enabled }));
+    });
     // PATCH /api/taskforce/admin/system-users/:id/verify-email - Mark a user's email as verified
     addRoute('PATCH', '/api/taskforce/admin/system-users/:id/verify-email', async (req, res, params) => {
         if (!ensureAdminRole(req)) {
@@ -1953,6 +2003,8 @@ export function registerAdminRoutes(deps) {
             workspaceAssetStore,
             publishedContentResolver,
             repairMissingAssetLinks: true,
+            repairMissingContentFiles: body?.repairMissingContentFiles === true,
+            contentPullObligationStore: new WorkspaceSyncContentPullObligationStore(core.getDatabaseAdapter()),
             aiProfiles: typeof core.listAiProfiles === 'function'
                 ? core.listAiProfiles(workspaceId, { includeArchived: true }) || []
                 : [],
@@ -2750,7 +2802,7 @@ export function registerAdminRoutes(deps) {
         try {
             const result = core.listMcpAccessTokens({ userId, workspaceId: requestWorkspaceId(req), page, pageSize });
             res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ success: true, ...result }));
+            res.end(JSON.stringify({ success: true, ...result, profileOptions: mcpToolProfileOptions }));
         }
         catch (error) {
             const statusCode = resolveErrorStatusCode(error);
@@ -2772,7 +2824,7 @@ export function registerAdminRoutes(deps) {
         try {
             const items = core.listMcpOAuthConnectorGrants({ userId, workspaceId: requestWorkspaceId(req), provider: provider || null });
             res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ success: true, items }));
+            res.end(JSON.stringify({ success: true, items, profileOptions: mcpToolProfileOptions }));
         }
         catch (error) {
             const statusCode = resolveErrorStatusCode(error);
@@ -2802,6 +2854,34 @@ export function registerAdminRoutes(deps) {
             res.end(JSON.stringify({ success: false, error: error.message, code: error?.code || 'MCP_CONNECTOR_DISCONNECT_FAILED' }));
         }
     });
+    addRoute('PATCH', '/api/taskforce/settings/mcp/connectors/:id/tool-profile', async (req, res, params) => {
+        if (!ensureAppAccess(req, res))
+            return;
+        const userId = resolveAuthenticatedUserId(req);
+        if (!userId || userId === 'anonymous') {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Authentication required.' }));
+            return;
+        }
+        const wid = requestWorkspaceId(req);
+        if (!ensureWorkspaceAdminRole(req, wid)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Workspace owner or admin access is required.', code: 'MCP_TOOL_PROFILE_ADMIN_REQUIRED' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        try {
+            const updated = core.updateMcpOAuthConnectorGrantToolProfile({ actorUserId: userId, workspaceId: wid, grantId: params.id, toolProfile: body?.toolProfile });
+            core.addAdminAuditLog({ action: 'mcp.connector.tool_profile.update', actorUserId: userId, actorRole: requestRole(req), workspaceId: wid, details: { grantId: updated.record.id, provider: updated.record.provider, clientId: updated.record.clientId, previousToolProfile: updated.previousToolProfile, toolProfile: updated.record.toolProfile } });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true, record: updated.record }));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: error.message, code: error?.code || 'MCP_CONNECTOR_TOOL_PROFILE_UPDATE_FAILED' }));
+        }
+    });
     addRoute('POST', '/api/taskforce/settings/mcp/tokens', async (req, res) => {
         if (!ensureAppAccess(req, res))
             return;
@@ -2883,6 +2963,34 @@ export function registerAdminRoutes(deps) {
             res.end(JSON.stringify({ success: false, error: error.message, code: error?.code || 'MCP_TOKEN_REGENERATE_FAILED' }));
         }
     });
+    addRoute('PATCH', '/api/taskforce/settings/mcp/tokens/:id/tool-profile', async (req, res, params) => {
+        if (!ensureAppAccess(req, res))
+            return;
+        const userId = resolveAuthenticatedUserId(req);
+        if (!userId || userId === 'anonymous') {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Authentication required.' }));
+            return;
+        }
+        const wid = requestWorkspaceId(req);
+        if (!ensureWorkspaceAdminRole(req, wid)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Workspace owner or admin access is required.', code: 'MCP_TOOL_PROFILE_ADMIN_REQUIRED' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        try {
+            const updated = core.updateMcpAccessTokenToolProfile({ actorUserId: userId, workspaceId: wid, tokenId: params.id, toolProfile: body?.toolProfile });
+            core.addAdminAuditLog({ action: 'mcp.token.tool_profile.update', actorUserId: userId, actorRole: requestRole(req), workspaceId: wid, details: { tokenId: updated.record.id, previousToolProfile: updated.previousToolProfile, toolProfile: updated.record.toolProfile } });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true, record: updated.record }));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: error.message, code: error?.code || 'MCP_TOKEN_TOOL_PROFILE_UPDATE_FAILED' }));
+        }
+    });
     addRoute('POST', '/api/taskforce/settings/mcp/test-connection', async (req, res) => {
         if (!ensureAppAccess(req, res))
             return;
@@ -2948,6 +3056,8 @@ export function registerAdminRoutes(deps) {
                     workspaceId: wid,
                     workspaceName: String(workspace?.name || wid),
                     scopes: inspection.scopes,
+                    toolProfile: inspection.toolProfile,
+                    toolCount: getCloudMcpToolProfileMembership(inspection.toolProfile, inspection.scopes).length,
                     requiredScopes,
                     endpoint: probe.endpoint,
                     serverName: probe.serverName,

package/dist/server/routes/agentRoles.js

@@ -1,4 +1,5 @@
-import { TASKFORCE_AGENTS_WORKSPACE_FEATURE_KEY, resolveAppGateAccess, } from '../../runtime/appGates.js';
+import { TASKFORCE_AGENTS_WORKSPACE_FEATURE_KEY, } from '../../runtime/appGates.js';
+import { resolveNodeAppGateAccess } from '../../runtime/nodeAppGates.js';
 import { AgentRoleDefinitionValidationError } from '../../shared/agentRoleDefinition.js';
 import { AgentRoleConflictError, AgentRoleNotFoundError, AgentRoleRetiredError, AgentRoleStore, } from '../../storage/agentRoleStore.js';
 import { parseJsonBody } from './primitives.js';
@@ -128,7 +129,7 @@ export function registerAgentRolesRoutes(deps) {
     const guard = (req, res) => {
         if (!ensureAppAccess(req, res))
             return false;
-        const gate = resolveAppGateAccess(TASKFORCE_AGENTS_WORKSPACE_FEATURE_KEY);
+        const gate = resolveNodeAppGateAccess(TASKFORCE_AGENTS_WORKSPACE_FEATURE_KEY);
         if (gate.allowed)
             return true;
         writeJson(res, 403, {

package/dist/server/routes/agentSkills.js

@@ -1,4 +1,5 @@
-import { TASKFORCE_AGENTS_WORKSPACE_FEATURE_KEY, resolveAppGateAccess, } from '../../runtime/appGates.js';
+import { TASKFORCE_AGENTS_WORKSPACE_FEATURE_KEY, } from '../../runtime/appGates.js';
+import { resolveNodeAppGateAccess } from '../../runtime/nodeAppGates.js';
 import { compileTaskforceAgentSkillPrompt } from '../../shared/taskforceAgentSkill.js';
 import { TaskforceAgentStore } from '../../storage/taskforceAgentStore.js';
 import { TaskforceAgentSkillConflictError, TaskforceAgentSkillStore, } from '../../storage/taskforceAgentSkillStore.js';
@@ -73,7 +74,7 @@ export function registerAgentSkillsRoutes(deps) {
     const ensureFeatureAccess = (req, res) => {
         if (!ensureAppAccess(req, res))
             return false;
-        const gate = resolveAppGateAccess(TASKFORCE_AGENTS_WORKSPACE_FEATURE_KEY);
+        const gate = resolveNodeAppGateAccess(TASKFORCE_AGENTS_WORKSPACE_FEATURE_KEY);
         if (gate.allowed)
             return true;
         writeJson(res, 403, {

package/dist/server/routes/agents.d.ts

@@ -6,6 +6,9 @@
  *   POST   /api/taskforce/agents
  *   PATCH  /api/taskforce/agents/:agentId
  *   DELETE /api/taskforce/agents/:agentId
+ *   GET    /api/taskforce/agents/:agentId/connection-binding
+ *   PUT    /api/taskforce/agents/:agentId/connection-binding
+ *   DELETE /api/taskforce/agents/:agentId/connection-binding
  *   GET    /api/taskforce/agents/:agentId/conversations
  *   POST   /api/taskforce/agents/:agentId/conversation/new
  *   POST   /api/taskforce/agents/model-gateway/test
@@ -13,6 +16,7 @@
  */
 import type { IncomingMessage, ServerResponse } from 'http';
 import type { TaskforceCore } from '../../core/Taskforce.js';
+import { ModelProviderConnectionService } from '../../services/modelProviderConnectionService.js';
 import { saveAiProfileAvatarAssets, type AiProfileAvatarAssetDeps } from '../aiProfileAvatarAssets.js';
 import type { ModelGateway, ModelGatewaySelection } from '../../services/modelGateway.js';
 import { type TaskforceAgentAvatarImageProvider } from '../../services/taskforceAgentAvatarImageProvider.js';
@@ -20,6 +24,7 @@ import { type PreparedTaskforceAgentMcpBridge, type PrepareTaskforceAgentMcpBrid
 import { TaskforceAgentConversationStore } from '../../storage/taskforceAgentConversationStore.js';
 import { TaskforceAgentStore } from '../../storage/taskforceAgentStore.js';
 import { TaskforceAgentSkillStore } from '../../storage/taskforceAgentSkillStore.js';
+import { TaskforceAgentConnectionBindingService } from '../../services/taskforceAgentConnectionBindingService.js';
 import { type TaskforceAgentRuntimeReferenceResolvers } from '../../shared/taskforceAgentRuntimeResolution.js';
 import { type RouteHandler } from './primitives.js';
 type SaveAiProfileAvatarAssets = typeof saveAiProfileAvatarAssets;
@@ -35,6 +40,8 @@ export interface AgentsRouteDependencies {
     agentStore?: TaskforceAgentStore;
     skillStore?: TaskforceAgentSkillStore;
     conversationStore?: TaskforceAgentConversationStore;
+    connectionBindingService?: Pick<TaskforceAgentConnectionBindingService, 'inspect' | 'bind' | 'clear' | 'resolveSaved' | 'resolveDraft'>;
+    modelConnectionService?: Pick<ModelProviderConnectionService, 'assertReady' | 'withConnectionLease'>;
     createModelGateway?: (selection?: ModelGatewaySelection) => ModelGateway;
     prepareMcpBridge?: (input: PrepareTaskforceAgentMcpBridgeInput) => Promise<PreparedTaskforceAgentMcpBridge | null>;
     agentRuntimeReferenceResolvers?: TaskforceAgentRuntimeReferenceResolvers;