@taskforcehq/taskforce 0.3.328 → 0.3.330

package/dist/server/routes/annotatedAttachments.js

@@ -11,7 +11,8 @@
  *   DELETE /api/taskforce/annotated-attachments/sessions/:id
  *   GET    /api/taskforce/annotated-attachments/sessions/:id/payload
  */
-import { ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY, resolveAppGateAccess, } from '../../runtime/appGates.js';
+import { ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY, } from '../../runtime/appGates.js';
+import { resolveNodeAppGateAccess } from '../../runtime/nodeAppGates.js';
 import { parseJsonBody } from './primitives.js';
 import { resolveErrorStatusCode } from './shared.js';
 import { getImageReferenceLabel, parseImageReference } from '../../utils/imageReferences.js';
@@ -37,7 +38,7 @@ export function registerAnnotatedAttachmentRoutes(deps) {
     const ensureAnnotatedAttachmentAccess = (req, res, workspaceId) => {
         if (!ensureAppAccess(req, res))
             return false;
-        const gate = resolveAppGateAccess(ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY);
+        const gate = resolveNodeAppGateAccess(ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY);
         if (gate.allowed)
             return true;
         writeJson(res, 403, {

package/dist/server/routes/auth.js

@@ -60,6 +60,7 @@ import { buildGithubAuthUrl, exchangeGithubCode } from '../auth/providers/github
 import { hasValidSession, createClearSessionCookie, createSessionTokenCookie, resolveRequestAccess, resolveSessionCookieAttributesForRequest, } from '../auth.js';
 import { sendEmail } from '../email.js';
 import { resolveDeploymentConfig } from '../../config/deployment.js';
+import { resolveNodeAppGateAccessMap } from '../../runtime/nodeAppGates.js';
 import { resolveTaskMetadataActivationCapability } from '../../sync/v3/taskMetadataActivation.js';
 import { resolveTaskCreateActivationCapability } from '../../sync/v3/taskCreateActivation.js';
 import { resolveTaskStatusActivationCapability } from '../../sync/v3/taskStatusActivation.js';
@@ -401,7 +402,7 @@ export function registerAuthRoutes(deps) {
             : 'Reset your Taskforce password';
         const text = kind === 'verify-email'
             ? `Welcome to Taskforce.\n\nYou're almost in. Enter this verification token on the verification screen to activate your account:\n\n${token}\n\nPrefer the faster route? Open the link below to verify your email automatically:\n${link}\n\nIf you didn't create a Taskforce account, you can safely ignore this email.`
-            : `Reset your Taskforce password using this link:\n${link}\n\nIf you did not request this reset, you can ignore this message.`;
+            : `Enter this password reset token on the reset screen:\n\n${token}\n\nOr reset your Taskforce password using this link:\n${link}\n\nIf you did not request this reset, you can ignore this message.`;
         const result = await sendEmail({
             to: email,
             subject,
@@ -470,6 +471,7 @@ export function registerAuthRoutes(deps) {
                 authSource: runtimeContract.authSource,
                 workspaceMode: runtimeContract.workspaceMode,
                 workspaceSwitchingEnabled: runtimeContract.workspaceSwitchingEnabled,
+                appGates: resolveNodeAppGateAccessMap(process.env),
                 syncV3
             }
         }));

package/dist/server/routes/billing.js

@@ -1857,7 +1857,11 @@ export function registerBillingRoutes(deps) {
             const userIdentity = core.resolveUserIdentity(userId);
             const normalizedUserEmail = normalizeEmail(userIdentity?.email);
             if (pricing.pricingType === 'free') {
-                if (currentEntitlement?.plan_version_id && String(currentEntitlement.plan_version_id).trim() === planVersionId) {
+                const currentEntitlementPlanVersionId = String(currentEntitlement?.plan_version_id || '').trim();
+                const currentEntitlementState = String(currentEntitlement?.entitlement_state || '').trim();
+                if (currentEntitlementPlanVersionId
+                    && currentEntitlementPlanVersionId === planVersionId
+                    && isCommercialStateAppAccessible(currentEntitlementState)) {
                     res.writeHead(200, { 'Content-Type': 'application/json' });
                     res.end(JSON.stringify({
                         checkoutState: 'already_current_plan',

package/dist/server/routes/durableTaskHttpRouters.d.ts

@@ -10,8 +10,9 @@ export declare function createTaskHttpDurableRouters(input: {
     actorRef: string;
     root: {
         enabled: boolean;
+        hasCommittedOperation(): boolean;
         create(candidate: unknown): import("../../core/Taskforce.js").TaskItem;
-        update(taskIdInput: string, candidate: unknown, saveSource: "manual" | "autosave", activityAction?: "task-updated" | "task-schedule-changed"): import("../../core/Taskforce.js").TaskItem;
+        update(taskIdInput: string, candidate: unknown, saveSource: "manual" | "autosave", activityAction?: "task-updated" | "task-schedule-changed", expectedDetailRevision?: string): import("../../core/Taskforce.js").TaskItem;
         runBatch<T>(routeInput: string, request: unknown, apply: (context: {
             runChild<R>(mutation: () => R): R;
             deferPostCommitNotification(notify: () => void): void;
@@ -41,6 +42,8 @@ export declare function createTaskHttpDurableRouters(input: {
         replace(args: {
             taskId: string;
             items: readonly Partial<import("../../core/Taskforce.js").ChecklistItem>[];
+            expectedDetailRevision?: string;
+            itemUpdateIntent?: import("../../sync/v3/taskChecklistMutationService.js").TaskChecklistItemUpdateIntent;
         }): {
             state: "pending" | "committed";
             route: "local-outbox" | "cloud-acceptance";
@@ -54,6 +57,7 @@ export declare function createTaskHttpDurableRouters(input: {
             taskId: string;
             links: readonly import("../../sync/v3/workspaceSyncV3NestedTaskCodecs.js").WorkspaceSyncV3TaskAttachmentLink[];
             cardCoverAssetId?: string | null;
+            expectedDetailRevision?: string;
         }): {
             state: "pending" | "committed";
             route: "local-outbox" | "cloud-acceptance";
@@ -66,6 +70,8 @@ export declare function createTaskHttpDurableRouters(input: {
         replace(args: {
             taskId: string;
             items: readonly Partial<import("../../core/Taskforce.js").ChecklistItem>[];
+            expectedDetailRevision?: string;
+            itemUpdateIntent?: import("../../sync/v3/taskChecklistMutationService.js").TaskChecklistItemUpdateIntent;
         }): {
             state: "pending" | "committed";
             route: "local-outbox" | "cloud-acceptance";
@@ -79,6 +85,7 @@ export declare function createTaskHttpDurableRouters(input: {
             taskId: string;
             links: readonly import("../../sync/v3/workspaceSyncV3NestedTaskCodecs.js").WorkspaceSyncV3TaskAttachmentLink[];
             cardCoverAssetId?: string | null;
+            expectedDetailRevision?: string;
         }): {
             state: "pending" | "committed";
             route: "local-outbox" | "cloud-acceptance";
@@ -134,6 +141,7 @@ export declare function createTaskHttpDurableRouters(input: {
         }>, options?: {
             saveSource?: "manual" | "autosave";
             atomicItemFailures?: boolean;
+            expectedDetailRevision?: string;
         }): {
             preview: import("../../core/Taskforce.js").BulkUpdateFieldsPreview;
             results: import("../../core/Taskforce.js").TaskItem[];
@@ -149,8 +157,9 @@ export declare function createTaskHttpDurableRouters(input: {
     };
     createRootRouter: (operationId?: string, deferPostCommitNotification?: (notify: () => void) => void) => {
         enabled: boolean;
+        hasCommittedOperation(): boolean;
         create(candidate: unknown): import("../../core/Taskforce.js").TaskItem;
-        update(taskIdInput: string, candidate: unknown, saveSource: "manual" | "autosave", activityAction?: "task-updated" | "task-schedule-changed"): import("../../core/Taskforce.js").TaskItem;
+        update(taskIdInput: string, candidate: unknown, saveSource: "manual" | "autosave", activityAction?: "task-updated" | "task-schedule-changed", expectedDetailRevision?: string): import("../../core/Taskforce.js").TaskItem;
         runBatch<T>(routeInput: string, request: unknown, apply: (context: {
             runChild<R>(mutation: () => R): R;
             deferPostCommitNotification(notify: () => void): void;

package/dist/server/routes/executorPhaseAApprovals.d.ts

@@ -0,0 +1,19 @@
+import type { IncomingMessage, ServerResponse } from 'http';
+import type { ExecutorPhaseAApprovalService } from '../../services/executorPhaseAApprovalService.js';
+import { type RouteHandler } from './primitives.js';
+export declare const EXECUTOR_PHASE_A_APPROVAL_PAGE_PATH = "/taskforce/admin/executor/phase-a-approval";
+export declare const EXECUTOR_PHASE_A_APPROVAL_PAGE_SCRIPT_PATH = "/taskforce/admin/executor/phase-a-approval.js";
+export declare const EXECUTOR_PHASE_A_APPROVAL_ISSUE_PATH = "/api/taskforce/admin/executor/phase-a-approval-receipts";
+export interface ExecutorPhaseAApprovalRouteDependencies {
+    addRoute: (method: string, path: string, handler: RouteHandler) => void;
+    service: ExecutorPhaseAApprovalService | null;
+    requireCloudRuntime: (res: ServerResponse, feature: string) => boolean;
+    ensureAppAccess: (req: IncomingMessage, res: ServerResponse) => boolean;
+    resolveHumanSystemAdminActor: (req: IncomingMessage) => string | null;
+    hasActiveWorkspaceMembership: (workspaceId: string, userId: string) => boolean;
+    auditAuthAction: (req: IncomingMessage, action: string, details: Record<string, unknown>, workspaceIdOverride?: string | null) => void;
+    workspaceId: string;
+    allowedOrigin: string;
+    performanceEnvironment: boolean;
+}
+export declare function registerExecutorPhaseAApprovalRoutes(deps: ExecutorPhaseAApprovalRouteDependencies): void;

package/dist/server/routes/executorPhaseAApprovals.js

@@ -0,0 +1,140 @@
+import { ExecutorPhaseAApprovalError } from '../../services/executorPhaseAApprovalService.js';
+import { ExecutorPhaseAApprovalConflictError } from '../../storage/executorPhaseAApprovalReceiptStore.js';
+import { EXECUTOR_PHASE_A_ISSUANCE_REQUEST_SCHEMA, EXECUTOR_PHASE_A_MAX_PREFLIGHT_BYTES } from '../../shared/executorPhaseAApprovalReceipt.js';
+import { parseJsonBody } from './primitives.js';
+export const EXECUTOR_PHASE_A_APPROVAL_PAGE_PATH = '/taskforce/admin/executor/phase-a-approval';
+export const EXECUTOR_PHASE_A_APPROVAL_PAGE_SCRIPT_PATH = '/taskforce/admin/executor/phase-a-approval.js';
+export const EXECUTOR_PHASE_A_APPROVAL_ISSUE_PATH = '/api/taskforce/admin/executor/phase-a-approval-receipts';
+function writeJson(res, statusCode, body) {
+    res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(body));
+}
+function isSameOriginJson(req, allowedOrigin) {
+    const contentType = String(req.headers['content-type'] || '').split(';')[0].trim().toLowerCase();
+    if (contentType !== 'application/json')
+        return false;
+    const origin = String(req.headers.origin || '').trim();
+    if (!origin || origin === 'null')
+        return false;
+    if (String(req.headers['sec-fetch-site'] || '').trim().toLowerCase() === 'cross-site')
+        return false;
+    try {
+        return origin === allowedOrigin && new URL(origin).origin === allowedOrigin;
+    }
+    catch {
+        return false;
+    }
+}
+function renderPage(issuePath) {
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width,initial-scale=1" />
+  <title>Phase A Approval</title>
+  <style>
+    body{margin:0;background:#f5f6f8;color:#17191d;font:15px system-ui,sans-serif}.bar{height:56px;background:#fff;border-bottom:1px solid #dfe2e7;display:flex;align-items:center;padding:0 24px;font-weight:700}.main{max-width:760px;margin:40px auto;padding:0 24px}.panel{background:#fff;border:1px solid #dfe2e7;border-radius:8px;padding:24px}h1{font-size:24px;margin:0 0 24px}label{display:block;font-weight:650;margin-bottom:8px}input{width:100%;box-sizing:border-box;border:1px solid #aeb4bd;padding:12px;border-radius:6px}button{margin-top:20px;background:#176b4d;color:#fff;border:0;border-radius:6px;padding:11px 16px;font-weight:700;cursor:pointer}button:disabled{opacity:.45;cursor:not-allowed}pre{white-space:pre-wrap;background:#f7f8fa;border:1px solid #e2e5e9;padding:12px;min-height:48px;max-height:280px;overflow:auto}
+  </style>
+</head>
+<body><div class="bar">Taskforce System Administration</div><main class="main" data-issue-path="${issuePath}" data-request-schema="${EXECUTOR_PHASE_A_ISSUANCE_REQUEST_SCHEMA}"><section class="panel">
+  <h1>Phase A Approval</h1>
+  <label for="preflight">Canonical preflight JSON</label><input id="preflight" type="file" accept="application/json,.json" />
+  <pre id="summary">No preflight selected.</pre><button id="approve" type="button" disabled>Approve and download receipt</button>
+</section></main><script src="${EXECUTOR_PHASE_A_APPROVAL_PAGE_SCRIPT_PATH}" defer></script></body></html>`;
+}
+function renderPageScript() {
+    return `const root=document.querySelector('main[data-issue-path]'),file=document.getElementById('preflight'),button=document.getElementById('approve'),summary=document.getElementById('summary');let encoded='';
+file.addEventListener('change',async()=>{button.disabled=true;encoded='';const selected=file.files[0];if(!selected)return;const bytes=new Uint8Array(await selected.arrayBuffer());let binary='';for(const value of bytes)binary+=String.fromCharCode(value);encoded=btoa(binary).replace(/\\+/g,'-').replace(/\\//g,'_').replace(/=+$/,'');try{const value=JSON.parse(new TextDecoder().decode(bytes));summary.textContent=JSON.stringify({runId:value.runId,status:value.status,failures:value.failures,authority:value.approvalContext,target:value.target,source:value.source,budgets:value.budgets,pricing:value.pricing,cleanupInventory:value.logicalEnvelope?.cleanupInventory,collectedAt:value.collectedAt,expiresAt:value.expiresAt},null,2);button.disabled=false}catch{summary.textContent='Invalid JSON.'}});
+button.addEventListener('click',async()=>{button.disabled=true;const response=await fetch(root.dataset.issuePath,{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({schema:root.dataset.requestSchema,preflightBase64Url:encoded})});if(!response.ok){let message='Approval failed.';try{message=(await response.json()).error||message}catch{}summary.textContent=message;button.disabled=false;return}const blob=await response.blob(),link=document.createElement('a');link.href=URL.createObjectURL(blob);link.download='taskforce-phase-a-approval-receipt.json';link.click();URL.revokeObjectURL(link.href);summary.textContent='Approval receipt issued.'});`;
+}
+export function registerExecutorPhaseAApprovalRoutes(deps) {
+    const authorize = (req, res) => {
+        if (!deps.requireCloudRuntime(res, 'Executor Phase A approvals'))
+            return null;
+        if (!deps.performanceEnvironment) {
+            writeJson(res, 404, { error: 'Executor Phase A approvals are available only in the performance environment.' });
+            return null;
+        }
+        if (!deps.ensureAppAccess(req, res))
+            return null;
+        const actorUserId = String(deps.resolveHumanSystemAdminActor(req) || '').trim();
+        if (!actorUserId) {
+            deps.auditAuthAction(req, 'executor.phase-a.approval.denied', { code: 'human_system_admin_required' }, deps.workspaceId);
+            writeJson(res, 403, { error: 'Human system administrator access is required.' });
+            return null;
+        }
+        if (!deps.hasActiveWorkspaceMembership(deps.workspaceId, actorUserId)) {
+            deps.auditAuthAction(req, 'executor.phase-a.approval.denied', { code: 'active_workspace_membership_required' }, deps.workspaceId);
+            writeJson(res, 403, { error: 'Active membership in the Phase A workspace is required.' });
+            return null;
+        }
+        return actorUserId;
+    };
+    deps.addRoute('GET', EXECUTOR_PHASE_A_APPROVAL_PAGE_PATH, async (req, res) => {
+        if (!authorize(req, res))
+            return;
+        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' });
+        res.end(renderPage(EXECUTOR_PHASE_A_APPROVAL_ISSUE_PATH));
+    });
+    deps.addRoute('GET', EXECUTOR_PHASE_A_APPROVAL_PAGE_SCRIPT_PATH, async (req, res) => {
+        if (!authorize(req, res))
+            return;
+        res.writeHead(200, { 'Content-Type': 'application/javascript; charset=utf-8', 'Cache-Control': 'no-store' });
+        res.end(renderPageScript());
+    });
+    deps.addRoute('POST', EXECUTOR_PHASE_A_APPROVAL_ISSUE_PATH, async (req, res) => {
+        const actorUserId = authorize(req, res);
+        if (!actorUserId)
+            return;
+        if (!isSameOriginJson(req, deps.allowedOrigin)) {
+            deps.auditAuthAction(req, 'executor.phase-a.approval.denied', { code: 'same_origin_json_required' }, deps.workspaceId);
+            writeJson(res, 403, { error: 'Same-origin application/json submission is required.' });
+            return;
+        }
+        if (!deps.service) {
+            deps.auditAuthAction(req, 'executor.phase-a.approval.denied', { code: 'issuer_not_configured' }, deps.workspaceId);
+            writeJson(res, 503, { error: 'Phase A approval receipt signing is not configured.' });
+            return;
+        }
+        try {
+            const body = await parseJsonBody(req, Math.ceil(EXECUTOR_PHASE_A_MAX_PREFLIGHT_BYTES * 1.4));
+            if (!body || typeof body !== 'object' || Array.isArray(body) || Object.keys(body).length !== 2
+                || body.schema !== EXECUTOR_PHASE_A_ISSUANCE_REQUEST_SCHEMA || typeof body.preflightBase64Url !== 'string') {
+                throw new ExecutorPhaseAApprovalError('Request does not match the Phase A issuance request schema.');
+            }
+            const encoded = body.preflightBase64Url;
+            if (!/^[A-Za-z0-9_-]+$/.test(encoded)) {
+                throw new ExecutorPhaseAApprovalError('preflightBase64Url must be unpadded base64url.');
+            }
+            const preflightBytes = Buffer.from(encoded, 'base64url');
+            if (preflightBytes.toString('base64url') !== encoded) {
+                throw new ExecutorPhaseAApprovalError('preflightBase64Url is not canonical base64url.');
+            }
+            const result = deps.service.issue(preflightBytes, actorUserId);
+            deps.auditAuthAction(req, result.created ? 'executor.phase-a.approval.issued' : 'executor.phase-a.approval.retried', {
+                receiptId: result.receiptId,
+                receiptSha256: result.digest,
+            }, deps.workspaceId);
+            res.writeHead(result.created ? 201 : 200, {
+                'Content-Type': 'application/json',
+                'Content-Disposition': 'attachment; filename="taskforce-phase-a-approval-receipt.json"',
+                'Cache-Control': 'no-store',
+                'X-Taskforce-Receipt-Sha256': result.digest,
+            });
+            res.end(result.bytes);
+        }
+        catch (error) {
+            const statusCode = error instanceof ExecutorPhaseAApprovalError || error instanceof ExecutorPhaseAApprovalConflictError
+                ? error.statusCode
+                : Number(error?.statusCode) || 500;
+            const code = error instanceof ExecutorPhaseAApprovalError || error instanceof ExecutorPhaseAApprovalConflictError
+                ? error.code
+                : 'internal_error';
+            deps.auditAuthAction(req, 'executor.phase-a.approval.denied', { code }, deps.workspaceId);
+            writeJson(res, statusCode, {
+                error: statusCode >= 500 ? 'Internal server error.' : String(error?.message || 'Approval failed.'),
+                code,
+            });
+        }
+    });
+}

package/dist/server/routes/executorPhaseAIssuerRedemptions.d.ts

@@ -0,0 +1,11 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { RouteHandler } from './primitives.js';
+export interface ExecutorPhaseAIssuerRedemptionRouteDependencies {
+    addRoute: (method: string, path: string, handler: RouteHandler) => void;
+    requireCloudRuntime: (res: ServerResponse, feature: string) => boolean;
+    performanceEnvironment: boolean;
+    featureEnabled: boolean;
+    auditAuthAction: (req: IncomingMessage, action: string, details: Record<string, unknown>, workspaceIdOverride?: string | null) => void;
+    workspaceId: string;
+}
+export declare function registerExecutorPhaseAIssuerRedemptionRoutes(deps: ExecutorPhaseAIssuerRedemptionRouteDependencies): void;

package/dist/server/routes/executorPhaseAIssuerRedemptions.js

@@ -0,0 +1,24 @@
+import { EXECUTOR_PHASE_A_ISSUER_REDEMPTION_PATH } from '../../shared/executorPhaseAIssuerContracts.js';
+function writeJson(res, statusCode, body) {
+    res.writeHead(statusCode, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+    res.end(JSON.stringify(body));
+}
+export function registerExecutorPhaseAIssuerRedemptionRoutes(deps) {
+    deps.addRoute('POST', EXECUTOR_PHASE_A_ISSUER_REDEMPTION_PATH, async (req, res) => {
+        if (!deps.requireCloudRuntime(res, 'Executor Phase A issuer redemption'))
+            return;
+        if (!deps.performanceEnvironment || !deps.featureEnabled) {
+            writeJson(res, 404, { error: 'Not found.' });
+            return;
+        }
+        // Package 1 deliberately has no integration path. Package 2 must install the
+        // independently reviewed pre-Lambda machine-authentication gate first.
+        deps.auditAuthAction(req, 'executor.phase-a.issuer-redemption.denied', {
+            code: 'broker_preintegration_authentication_not_configured',
+        }, deps.workspaceId);
+        writeJson(res, 503, {
+            error: 'Phase A broker authentication is not configured.',
+            code: 'broker_preintegration_authentication_not_configured',
+        });
+    });
+}

package/dist/server/routes/githubReviewEvidence.d.ts

@@ -0,0 +1,19 @@
+import type { IncomingMessage, ServerResponse } from 'http';
+import { type GitHubReviewEvidenceInstallationStore } from '../../storage/githubReviewEvidenceInstallationStore.js';
+import type { GitHubInstallationInspection } from '../../services/githubReviewEvidenceService.js';
+import { type RouteHandler } from './primitives.js';
+export interface GitHubReviewEvidenceRouteDependencies {
+    addRoute: (method: string, path: string, handler: RouteHandler) => void;
+    store: GitHubReviewEvidenceInstallationStore;
+    configured: boolean;
+    inspectInstallation: (installationId: string) => Promise<GitHubInstallationInspection>;
+    requestWorkspaceId: (req: IncomingMessage) => string;
+    requestRole: (req: IncomingMessage) => string;
+    resolveAuthenticatedUserId: (req: IncomingMessage) => string;
+    ensureAppAccess: (req: IncomingMessage, res: ServerResponse) => boolean;
+    ensureWorkspaceAdminRole: (req: IncomingMessage, workspaceIdOverride?: string | null) => boolean;
+    ensureAdminRole: (req: IncomingMessage) => boolean;
+    requireCloudRuntime: (res: ServerResponse, feature: string) => boolean;
+    auditAuthAction: (req: IncomingMessage, action: string, details: Record<string, unknown>, workspaceIdOverride?: string | null) => void;
+}
+export declare function registerGitHubReviewEvidenceRoutes(deps: GitHubReviewEvidenceRouteDependencies): void;

package/dist/server/routes/githubReviewEvidence.js

@@ -0,0 +1,116 @@
+import { GitHubReviewEvidenceInstallationConflictError, } from '../../storage/githubReviewEvidenceInstallationStore.js';
+import { GitHubReviewEvidenceError } from '../../services/githubReviewEvidenceService.js';
+import { parseJsonBody } from './primitives.js';
+const SETTINGS_PATH = '/api/taskforce/settings/github-review-evidence/installation';
+function writeJson(res, statusCode, body) {
+    res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(body));
+}
+function publicBinding(binding) {
+    if (!binding)
+        return null;
+    return {
+        installationId: binding.installationId,
+        accountId: binding.accountId,
+        accountLogin: binding.accountLogin,
+        accountType: binding.accountType,
+        repositorySelection: binding.repositorySelection,
+        createdAt: binding.createdAt,
+        updatedAt: binding.updatedAt,
+    };
+}
+function writeProviderError(res, error) {
+    if (error instanceof GitHubReviewEvidenceError) {
+        if (error.retryAfterSeconds)
+            res.setHeader('Retry-After', String(error.retryAfterSeconds));
+        writeJson(res, error.statusCode, { error: error.message, code: error.code });
+        return;
+    }
+    if (error instanceof GitHubReviewEvidenceInstallationConflictError) {
+        writeJson(res, error.statusCode, { error: error.message, code: error.code });
+        return;
+    }
+    writeJson(res, 500, { error: 'Internal server error.' });
+}
+export function registerGitHubReviewEvidenceRoutes(deps) {
+    const { addRoute, store, configured, inspectInstallation, requestWorkspaceId, requestRole, resolveAuthenticatedUserId, ensureAppAccess, ensureWorkspaceAdminRole, ensureAdminRole, requireCloudRuntime, auditAuthAction, } = deps;
+    const authorize = (req, res, systemAdminRequired = false) => {
+        if (!ensureAppAccess(req, res))
+            return null;
+        if (!requireCloudRuntime(res, 'GitHub review evidence'))
+            return null;
+        const workspaceId = String(requestWorkspaceId(req) || '').trim();
+        if (!workspaceId) {
+            writeJson(res, 400, { error: 'Workspace ID is required.' });
+            return null;
+        }
+        const actorUserId = String(resolveAuthenticatedUserId(req) || '').trim();
+        if (!actorUserId || actorUserId === 'anonymous') {
+            writeJson(res, 401, { error: 'Authentication is required.' });
+            return null;
+        }
+        if (systemAdminRequired ? !ensureAdminRole(req) : !ensureWorkspaceAdminRole(req, workspaceId)) {
+            writeJson(res, 403, {
+                error: systemAdminRequired
+                    ? 'System administrator access is required.'
+                    : 'Workspace owner or admin access is required.',
+            });
+            return null;
+        }
+        return workspaceId;
+    };
+    addRoute('GET', SETTINGS_PATH, async (req, res) => {
+        const workspaceId = authorize(req, res);
+        if (!workspaceId)
+            return;
+        writeJson(res, 200, { configured, installation: publicBinding(store.get(workspaceId)) });
+    });
+    addRoute('PUT', SETTINGS_PATH, async (req, res) => {
+        const workspaceId = authorize(req, res, true);
+        if (!workspaceId)
+            return;
+        try {
+            const body = await parseJsonBody(req, 16 * 1024);
+            const installation = await inspectInstallation(String(body?.installationId || '').trim());
+            const actorUserId = String(resolveAuthenticatedUserId(req) || '').trim();
+            const binding = store.put({
+                workspaceId,
+                installationId: installation.installationId,
+                accountId: installation.accountId,
+                accountLogin: installation.accountLogin,
+                accountType: installation.accountType,
+                repositorySelection: installation.repositorySelection,
+                boundByUserId: actorUserId,
+            });
+            auditAuthAction(req, 'github.review-evidence.installation.bound', {
+                installationId: binding.installationId,
+                accountId: binding.accountId,
+                accountLogin: binding.accountLogin,
+                repositorySelection: binding.repositorySelection,
+            }, workspaceId);
+            writeJson(res, 200, { success: true, installation: publicBinding(binding) });
+        }
+        catch (error) {
+            auditAuthAction(req, 'github.review-evidence.installation.bind-failed', {
+                code: error instanceof GitHubReviewEvidenceError || error instanceof GitHubReviewEvidenceInstallationConflictError
+                    ? error.code
+                    : 'internal_error',
+            }, workspaceId);
+            writeProviderError(res, error);
+        }
+    });
+    addRoute('DELETE', SETTINGS_PATH, async (req, res) => {
+        const workspaceId = authorize(req, res);
+        if (!workspaceId)
+            return;
+        const existing = store.get(workspaceId);
+        const removed = store.delete(workspaceId);
+        auditAuthAction(req, 'github.review-evidence.installation.unbound', {
+            installationId: existing?.installationId || null,
+            accountId: existing?.accountId || null,
+            removed,
+            actorRole: requestRole(req),
+        }, workspaceId);
+        writeJson(res, 200, { success: true, removed });
+    });
+}

package/dist/server/routes/localService.d.ts

@@ -1,13 +1,24 @@
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import type { IncomingMessage } from 'http';
+import { NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';
 import type { TaskforceCore } from '../../core/Taskforce.js';
-import { createTaskforceMcpServer } from '../../mcp/runtime.js';
+import { type McpRuntimeFactory, type TaskforceMcpServerOptions } from '../../mcp/runtime.js';
 import { type LocalServiceRouteContext, type RouteHandler } from './primitives.js';
+export interface LocalMcpRuntimeLease {
+    runtime: ReturnType<McpRuntimeFactory>;
+    transport: NodeStreamableHTTPServerTransport;
+    release(): Promise<void>;
+}
+export type AcquireLocalMcpRuntime = (input: {
+    req: IncomingMessage;
+    options: TaskforceMcpServerOptions;
+}) => Promise<LocalMcpRuntimeLease>;
 interface LocalServiceRouteDependencies {
     addRoute: (method: string, path: string, handler: RouteHandler) => void;
     core: TaskforceCore;
     context: LocalServiceRouteContext | undefined;
-    createMcpServer?: typeof createTaskforceMcpServer;
-    createMcpTransport?: () => StreamableHTTPServerTransport;
+    createMcpServer?: McpRuntimeFactory;
+    createMcpTransport?: () => NodeStreamableHTTPServerTransport;
+    acquireMcpRuntime?: AcquireLocalMcpRuntime;
 }
 export declare function registerLocalServiceRoutes(deps: LocalServiceRouteDependencies): void;
 export {};