@taskforcehq/taskforce 0.3.328 → 0.3.330

package/dist/server/routes/shared.js

@@ -6,17 +6,18 @@
  * routes.ts at runtime.
  */
 import { randomUUID } from 'crypto';
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
+import { NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';
+import { isInitializeRequest, isJsonContentType } from '@modelcontextprotocol/server';
 import { TaskforceRuleError } from '../../core/Taskforce.js';
 import { resolveRequestAccess, } from '../auth.js';
 import { parseJsonBody } from './primitives.js';
-import { createTaskforceMcpServer, isMcpWriteToolName } from '../../mcp/runtime.js';
+import { createStatelessTaskforceMcpServer, createTaskforceMcpServer, isMcpWriteToolName, } from '../../mcp/runtime.js';
 import { MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS } from '../../mcp/toolRegistry.js';
 import { resolveCanonicalMcpToolName } from '../../mcp/toolCallCompatibility.js';
 import { applyPrefixedRateLimitHeaders } from '../rateLimit.js';
 import { parseAiProfileBootstrapHeaders } from '../../mcp/aiProfileBootstrap.js';
 import { parseMcpClientId } from '../../mcp/clientRegistry.js';
+import { handleModernMcpHttpRequest, isModernMcpHttpRequest, } from '../../mcp/httpProtocolRouting.js';
 import { resolveAppAccessDeniedResponse } from '../appAccess.js';
 import { resolveCloudApplicationBaseUrl } from '../../config/applicationBaseUrl.js';
 import { getRequestPerformanceDiagnostics, runWithRequestPerformanceDiagnostics, } from '../../storage/postgresRequestDiagnostics.js';
@@ -273,7 +274,14 @@ function writeMcpHttpError(res, statusCode, message, data) {
         id: null,
     }));
 }
-function extractMcpWriteToolNames(body) {
+function resolveProductionCloudMcpToolPolicy(requestedToolName) {
+    const toolName = resolveCanonicalMcpToolName(requestedToolName);
+    return {
+        requiredScope: MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS[toolName] || null,
+        isWrite: isMcpWriteToolName(requestedToolName),
+    };
+}
+function extractMcpWriteToolNames(body, resolveToolPolicy) {
     const messages = Array.isArray(body) ? body : [body];
     const names = messages.flatMap((message) => {
         if (!message || typeof message !== 'object')
@@ -282,7 +290,7 @@ function extractMcpWriteToolNames(body) {
         if (method !== 'tools/call')
             return [];
         const toolName = String(message?.params?.name || '').trim();
-        return toolName && isMcpWriteToolName(toolName) ? [toolName] : [];
+        return toolName && resolveToolPolicy(toolName).isWrite ? [toolName] : [];
     });
     return Array.from(new Set(names));
 }
@@ -299,7 +307,7 @@ function extractFirstMcpToolName(body) {
     }
     return null;
 }
-function findDeniedCloudMcpToolName(body, scopes) {
+function findDeniedCloudMcpToolName(body, scopes, resolveToolPolicy) {
     const messages = Array.isArray(body) ? body : [body];
     for (const message of messages) {
         if (!message || typeof message !== 'object')
@@ -309,15 +317,14 @@ function findDeniedCloudMcpToolName(body, scopes) {
         const requestedToolName = String(message?.params?.name || '').trim();
         if (!requestedToolName)
             continue;
-        const toolName = resolveCanonicalMcpToolName(requestedToolName);
-        const requiredScope = MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS[toolName];
+        const requiredScope = resolveToolPolicy(requestedToolName).requiredScope;
         if (!requiredScope || !scopes.includes(requiredScope))
             return requestedToolName;
     }
     return null;
 }
 export function makeHandleCloudMcpRequest(core, deps) {
-    const { ensureAppAccess, resolveAuthenticatedUserId, writeRateLimit } = deps;
+    const { ensureAppAccess, resolveAuthenticatedUserId, writeRateLimit, createMcpServer = createTaskforceMcpServer, resolveMcpToolPolicy = resolveProductionCloudMcpToolPolicy, acquireMcpRuntime, } = deps;
     const authenticateCloudMcpRequest = makeAuthenticateCloudMcpRequest(core, {
         resolveAuthenticatedUserId,
         writeMcpHttpError,
@@ -342,7 +349,7 @@ export function makeHandleCloudMcpRequest(core, deps) {
     const applyCloudMcpWriteRateLimit = (req, res, auth, body) => {
         if (!writeRateLimit.enabled)
             return true;
-        const writeTools = extractMcpWriteToolNames(body);
+        const writeTools = extractMcpWriteToolNames(body, resolveMcpToolPolicy);
         if (writeTools.length === 0)
             return true;
         const actorKey = auth.authenticatedViaToken?.tokenId
@@ -413,6 +420,10 @@ export function makeHandleCloudMcpRequest(core, deps) {
             writeMcpHttpError(res, 405, 'Method not allowed.');
             return;
         }
+        if (!isJsonContentType(requestHeader(req, 'content-type', ''))) {
+            writeMcpHttpError(res, 415, 'Unsupported Media Type: Content-Type must be application/json');
+            return;
+        }
         let body = undefined;
         try {
             const bodyParseStartedAtMs = Date.now();
@@ -431,7 +442,8 @@ export function makeHandleCloudMcpRequest(core, deps) {
             : '';
         const initializeRequest = isInitializeRequest(body)
             || mcpMethod === 'initialize';
-        const deniedToolName = findDeniedCloudMcpToolName(body, authScopes);
+        const modernProtocolRequest = await isModernMcpHttpRequest(req, body);
+        const deniedToolName = findDeniedCloudMcpToolName(body, authScopes, resolveMcpToolPolicy);
         if (deniedToolName) {
             core.addMcpAuditLog({
                 workspaceId: auth.workspaceId,
@@ -451,13 +463,14 @@ export function makeHandleCloudMcpRequest(core, deps) {
             writeMcpHttpError(res, 403, 'Forbidden.');
             return;
         }
-        const writeToolNames = extractMcpWriteToolNames(body);
+        const writeToolNames = extractMcpWriteToolNames(body, resolveMcpToolPolicy);
         const rateLimitStartedAtMs = Date.now();
         const rateLimitAllowed = applyCloudMcpWriteRateLimit(req, res, auth, body);
         rateLimitMs = Date.now() - rateLimitStartedAtMs;
         if (!rateLimitAllowed)
             return;
         let runtime = null;
+        let runtimeLease = null;
         let runtimeConstructionMs = 0;
         let transportConnectMs = 0;
         let requestHandlingMs = 0;
@@ -466,12 +479,13 @@ export function makeHandleCloudMcpRequest(core, deps) {
         const toolTimingState = { value: null };
         try {
             const runtimeStartedAtMs = Date.now();
-            // Intentionally isolate the MCP runtime per HTTP request. The runtime closes over
+            // Production intentionally isolates the MCP runtime per HTTP request. The runtime closes over
             // workspace auth, AI identity, permissions, subscriptions, and mutable helper state;
             // sharing it could leak state across tenants or callers. Keep the transport stateless
             // too. The timing event below measures construction cost so caching is only revisited
-            // with evidence and must preserve these boundaries (including dynamic tool schemas).
-            runtime = createTaskforceMcpServer({
+            // with evidence and must preserve these boundaries (including dynamic tool schemas). The optional
+            // lease seam exists only for transport conformance tests that must carry legacy bidirectional calls.
+            const runtimeOptions = {
                 projectRoot: core.getPaths().projectRoot,
                 tenantId: core.getTenantId(),
                 workspaceId: auth.workspaceId,
@@ -479,6 +493,7 @@ export function makeHandleCloudMcpRequest(core, deps) {
                 serverName: 'taskforce-cloud',
                 logStartup: false,
                 runtimeMode: 'cloud',
+                toolProfile: auth.authenticatedViaToken?.toolProfile || auth.authenticatedViaOAuth?.toolProfile || 'default',
                 applicationBaseUrl: resolveCloudApplicationBaseUrl(),
                 auth: buildCloudMcpRuntimeAuth({
                     req,
@@ -506,15 +521,66 @@ export function makeHandleCloudMcpRequest(core, deps) {
                         ]);
                     }
                 },
-            });
+            };
+            if (modernProtocolRequest) {
+                const requestHandlingStartedAtMs = Date.now();
+                await handleModernMcpHttpRequest({
+                    req,
+                    res,
+                    parsedBody: body,
+                    factory: ({ era }) => {
+                        const constructionStartedAtMs = Date.now();
+                        const modernRuntime = createStatelessTaskforceMcpServer({
+                            ...runtimeOptions,
+                            protocolEra: era,
+                        }, createMcpServer);
+                        runtimeConstructionMs = Date.now() - constructionStartedAtMs;
+                        if (!res.headersSent) {
+                            setServerTimingHeader(res, [
+                                { name: 'auth', durationMs: authMs },
+                                { name: 'body-parse', durationMs: bodyParseMs },
+                                { name: 'rate-limit', durationMs: rateLimitMs },
+                                { name: 'runtime', durationMs: runtimeConstructionMs },
+                            ]);
+                        }
+                        return modernRuntime.server;
+                    },
+                    onerror: (error) => {
+                        console.warn('[Taskforce MCP] Modern cloud request rejected:', {
+                            requestId,
+                            message: error.message,
+                        });
+                    },
+                });
+                requestHandlingMs = Date.now() - requestHandlingStartedAtMs;
+                recordCloudMcpCredentialUsage(req, auth.authenticatedViaToken, auth.authenticatedViaOAuth);
+                return;
+            }
+            runtimeLease = acquireMcpRuntime
+                ? await acquireMcpRuntime({ req, options: runtimeOptions })
+                : null;
+            runtime = runtimeLease?.runtime
+                || createStatelessTaskforceMcpServer(runtimeOptions, createMcpServer);
             runtimeConstructionMs = Date.now() - runtimeStartedAtMs;
-            const transport = new StreamableHTTPServerTransport({
+            const transport = runtimeLease?.transport || new NodeStreamableHTTPServerTransport({
                 sessionIdGenerator: undefined,
                 enableJsonResponse: true,
             });
             const transportStartedAtMs = Date.now();
-            await runtime.server.connect(transport);
+            if (!runtimeLease)
+                await runtime.server.connect(transport);
             transportConnectMs = Date.now() - transportStartedAtMs;
+            // Set request-level phases before the SDK writes response headers. Tool calls replace this
+            // with the richer envelope/handler breakdown from onToolCallTiming above.
+            if (!res.headersSent) {
+                setServerTimingHeader(res, [
+                    { name: 'auth', durationMs: authMs },
+                    { name: 'body-parse', durationMs: bodyParseMs },
+                    { name: 'rate-limit', durationMs: rateLimitMs },
+                    { name: 'runtime', durationMs: runtimeConstructionMs },
+                    { name: 'transport-connect', durationMs: transportConnectMs },
+                ]);
+            }
             if (!initializeRequest) {
                 // Stateless cloud sessions still require a valid MCP JSON-RPC request;
                 // let the SDK validate and respond rather than trying to track sessions server-side.
@@ -540,7 +606,17 @@ export function makeHandleCloudMcpRequest(core, deps) {
             }
         }
         finally {
-            if (runtime) {
+            if (runtimeLease) {
+                const cleanupStartedAtMs = Date.now();
+                try {
+                    await runtimeLease.release();
+                }
+                catch (closeError) {
+                    console.warn('[Taskforce MCP] Cloud test runtime lease cleanup failed:', closeError);
+                }
+                cleanupMs = Date.now() - cleanupStartedAtMs;
+            }
+            else if (runtime) {
                 const cleanupStartedAtMs = Date.now();
                 try {
                     await runtime.server.close();

package/dist/server/routes/sync.js

@@ -573,6 +573,7 @@ export function registerSyncRoutes(deps) {
             }
             const { result } = await dispatchWorkspaceSyncChanges(cloudWorkspaceId, fenced.changes, {
                 coexistenceDirection: 'cloud-push',
+                actorUserId: access.userId,
                 assertedActiveV3TaskMetadataIds,
                 assertedActiveV3TaskLifecycleIds,
                 assertedActiveV3TaskReopenAssigneeIds,

package/dist/server/routes/syncAuxRoutes.js

@@ -1,4 +1,5 @@
 import { applyWorkspaceRepair } from '../../sync/workspaceRepair.js';
+import { WorkspaceSyncContentPullObligationStore } from '../../sync/engine/workspaceSyncContentPullObligationStore.js';
 import { normalizeSyncEventDetails } from '../../utils/syncEventDetails.js';
 import { parseJsonBody } from './primitives.js';
 import { requireAuthenticatedSyncRequest } from './syncRouteGuards.js';
@@ -50,8 +51,13 @@ export function registerWorkspaceSyncAuxRoutes({ addRoute, core, context, resolv
         res.end(JSON.stringify({ success: true }));
     });
     // POST /api/taskforce/sync/workspace/repair-startup - Auto-repair workspace asset/document
-    // metadata on workspace open. Safe fixups re-register metadata for local files and mark
-    // stale, unreferenced metadata deleted when the file is missing. Never deletes files.
+    // metadata on workspace open. Safe fixups re-register metadata for local files and clean up
+    // stale links. Does NOT tombstone metadata for files that appear missing locally — a single
+    // failed existence check at startup can mean the content is only temporarily unavailable
+    // (e.g. storage not yet mounted/synced), not deleted; that requires explicit admin
+    // confirmation via /api/taskforce/admin/workspace-repair/apply. Never deletes files. When
+    // content availability genuinely can't be verified, queues a durable content-pull recovery
+    // obligation instead, which resolves automatically once a later scan confirms the content.
     // Called once by the sync orchestrator when the workspace becomes active.
     addRoute('POST', '/api/taskforce/sync/workspace/repair-startup', async (req, res) => {
         const authConfig = context.authConfig;
@@ -80,6 +86,7 @@ export function registerWorkspaceSyncAuxRoutes({ addRoute, core, context, resolv
             deletedTasks: core.listWorkspaceSyncDeletes(workspaceId) || [],
             workspaceAssetStore,
             publishedContentResolver,
+            contentPullObligationStore: new WorkspaceSyncContentPullObligationStore(core.getDatabaseAdapter()),
             aiProfiles: typeof core.listAiProfiles === 'function'
                 ? core.listAiProfiles(workspaceId, { includeArchived: true }) || []
                 : [],

package/dist/server/routes/syncPullApplyRoutes.js

@@ -1,7 +1,7 @@
 import { DEFAULT_WORKSPACE_PULL_PAGE_MAX_BYTES, buildWorkspacePullFeed, WorkspacePullEntryTooLargeError, } from '../../sync/workspacePullFeed.js';
 import { applyWorkspaceSyncLocalBatch } from '../../sync/engine/workspaceSyncEngineLocalApply.js';
 import { parseJsonBody } from './primitives.js';
-import { normalizeWorkspaceSyncV2ProjectionExclusions, parseWorkspaceSyncV2ProjectionExclusions, WORKSPACE_SYNC_V3_COMBINED_V2_EXCLUSIONS, } from '../../sync/v3/workspaceSyncV2ProjectionExclusions.js';
+import { normalizeWorkspaceSyncV2ProjectionExclusions, parseWorkspaceSyncV2ProjectionExclusions, WORKSPACE_SYNC_V3_COMBINED_V2_EXCLUSIONS, workspaceSyncV2ProjectionExclusionsEqual, } from '../../sync/v3/workspaceSyncV2ProjectionExclusions.js';
 import { resolveWorkspaceSyncV3AttestedV2Exclusions } from '../../sync/v3/workspaceSyncV3LegacyBoundaryAttestation.js';
 import { requireAuthenticatedSyncRequest, requireEnabledSyncAuth, resolveAuthorizedSyncWorkspace, } from './syncRouteGuards.js';
 import { completeLocalSyncBrowserPushEchoPermitGroup, createLocalSyncBrowserV2ApplyTransactionHooks, parseLocalSyncBrowserApplyPermitContext, resolveLocalSyncBrowserApplyPermitOperationClass, } from '../../sync/coordinator/localSyncBrowserApplyPermitContext.js';
@@ -301,7 +301,16 @@ export function registerWorkspacePullApplySyncRoutes({ addRoute, core, context,
                 };
             }
             if (!change) {
-                missing.push(request);
+                missing.push({
+                    ...request,
+                    disposition: request.kind === 'asset'
+                        && 'assetId' in request
+                        && (!requestedAsset
+                            || requestedAsset.deletedAt
+                            || requestedAsset.storageProvider === 'external')
+                        ? 'terminal-unavailable'
+                        : 'retryable',
+                });
                 consumed += 1;
                 continue;
             }
@@ -554,6 +563,16 @@ export function registerWorkspacePullApplySyncRoutes({ addRoute, core, context,
                 : null;
             let applyResult;
             if (permitContext && coordinatorServices && permitOperationClass === 'push') {
+                const attestedV2ExcludedProjections = v2ExcludedProjections.length > 0
+                    ? (() => {
+                        const attested = resolveWorkspaceSyncV3AttestedV2Exclusions({
+                            coverage: body?.combinedCoverage,
+                            excludedProjections: v2ExcludedProjections,
+                            runtimeMode: 'local',
+                        });
+                        return attested && workspaceSyncV2ProjectionExclusionsEqual(attested, v2ExcludedProjections) ? attested : null;
+                    })()
+                    : [];
                 applyResult = completeLocalSyncBrowserPushEchoPermitGroup({
                     services: coordinatorServices,
                     cookieHeader: req.headers.cookie,
@@ -567,13 +586,13 @@ export function registerWorkspacePullApplySyncRoutes({ addRoute, core, context,
                             || workspaceMembers !== undefined
                             || body?.bootstrapSnapshot !== undefined
                             || allowReferenceNumberReassignment
-                            || v2ExcludedProjections.length > 0) {
+                            || !attestedV2ExcludedProjections) {
                             throw new Error('Browser push echo apply accepts only authoritative task upserts.');
                         }
                         return dispatchWorkspaceSyncMetadataAtomically(workspaceId, incomingChanges, {
                             allowReferenceNumberReassignment: false,
                             coexistenceDirection: 'local-pull',
-                            v2ExcludedProjections: [],
+                            v2ExcludedProjections: attestedV2ExcludedProjections,
                         });
                     },
                 });

package/dist/server/routes/syncPushRoutes.d.ts

@@ -21,6 +21,7 @@ interface RegisterWorkspacePushSyncRoutesArgs {
     dispatchWorkspaceSyncChanges: (workspaceId: string, incomingChanges: WorkspaceSyncChange[], options?: {
         allowReferenceNumberReassignment?: boolean;
         coexistenceDirection?: 'cloud-push';
+        actorUserId?: string;
         assertedActiveV3TaskMetadataIds?: ReadonlySet<string>;
         assertedActiveV3TaskLifecycleIds?: ReadonlySet<string>;
         assertedActiveV3TaskReopenAssigneeIds?: ReadonlySet<string>;

package/dist/server/routes/syncPushRoutes.js

@@ -270,6 +270,7 @@ export function registerWorkspacePushSyncRoutes({ addRoute, core, context, audit
             const { result, deleteCount, emittedEventIds } = await dispatchWorkspaceSyncChanges(targetWorkspaceId, incomingChanges, {
                 allowReferenceNumberReassignment,
                 coexistenceDirection: 'cloud-push',
+                actorUserId: String(access.userId || '').trim(),
                 assertedActiveV3TaskMetadataIds,
                 assertedActiveV3TaskLifecycleIds,
                 assertedActiveV3TaskReopenAssigneeIds,

package/dist/server/routes/syncV3FeedRoutes.js

@@ -5,7 +5,7 @@ import { buildWorkspaceSyncV3InitiativeRepairPage, decodeWorkspaceSyncV3Initiati
 import { WORKSPACE_SYNC_V3_COVERAGE_PROFILE } from '../../sync/v3/workspaceSyncV3FeedProfile.js';
 import { isWorkspaceSyncV3InitiativeLegacyPushDisabled } from '../../sync/v3/planningActivation.js';
 import { WORKSPACE_SYNC_V3_COMBINED_COVERAGE_PROFILE } from '../../sync/v3/workspaceSyncV3CombinedCoverage.js';
-import { buildWorkspaceSyncV3CombinedRepairPage, decodeWorkspaceSyncV3CombinedRepairCursor, decodeWorkspaceSyncV3NestedRepairCursor, decodeWorkspaceSyncV3PlanningOrderRepairCursor, decodeWorkspaceSyncV3WorkflowRepairCursor, WorkspaceSyncV3CombinedRepairSnapshotUnavailableError, } from '../../sync/v3/workspaceSyncV3CombinedRepairMaterialization.js';
+import { buildWorkspaceSyncV3CombinedRepairPage, decodeWorkspaceSyncV3CombinedRepairCursor, decodeWorkspaceSyncV3NestedRepairCursor, decodeWorkspaceSyncV3PlanningOrderRepairCursor, decodeWorkspaceSyncV3TaskCoverRepairCursor, decodeWorkspaceSyncV3WorkflowRepairCursor, decodeWorkspaceSyncV3WorkflowTaskCoverRepairCursor, WorkspaceSyncV3CombinedRepairSnapshotUnavailableError, } from '../../sync/v3/workspaceSyncV3CombinedRepairMaterialization.js';
 import { isWorkspaceSyncV3CombinedLegacyFenceEnabled } from '../../sync/v3/workspaceSyncV2ProjectionExclusions.js';
 import { resolveCombinedFeedCapability } from '../../sync/v3/combinedFeedCapability.js';
 import { resolveWorkspaceSyncV3RegisteredCoverage } from '../../sync/v3/workspaceSyncV3CoverageRegistry.js';
@@ -21,6 +21,20 @@ function json(res, status, body) {
     res.writeHead(status, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
     res.end(JSON.stringify(body));
 }
+function decodeCombinedRepairCursorForContract(rawCursor, keyring, wire) {
+    if (wire.taskCoverProjectionRequired && wire.workflowWriterPrerequisitesRequired) {
+        return decodeWorkspaceSyncV3WorkflowTaskCoverRepairCursor(rawCursor, keyring);
+    }
+    if (wire.taskCoverProjectionRequired)
+        return decodeWorkspaceSyncV3TaskCoverRepairCursor(rawCursor, keyring);
+    if (wire.workflowWriterPrerequisitesRequired)
+        return decodeWorkspaceSyncV3WorkflowRepairCursor(rawCursor, keyring);
+    if (wire.planningOrderWriterPrerequisitesRequired)
+        return decodeWorkspaceSyncV3PlanningOrderRepairCursor(rawCursor, keyring);
+    if (wire.nestedWriterPrerequisitesRequired)
+        return decodeWorkspaceSyncV3NestedRepairCursor(rawCursor, keyring);
+    return decodeWorkspaceSyncV3CombinedRepairCursor(rawCursor, keyring);
+}
 function attestLegacyPushBoundary(body, boundary) {
     const attested = { ...body, ...boundary };
     const mutable = attested;
@@ -215,13 +229,7 @@ export function registerWorkspaceSyncV3FeedRoutes(input) {
                 return;
             }
             const rawCursor = String(url.searchParams.get('cursor') || '').trim();
-            const cursor = requestedWire.workflowWriterPrerequisitesRequired
-                ? decodeWorkspaceSyncV3WorkflowRepairCursor(rawCursor, keyring)
-                : requestedWire.planningOrderWriterPrerequisitesRequired
-                    ? decodeWorkspaceSyncV3PlanningOrderRepairCursor(rawCursor, keyring)
-                    : requestedWire.nestedWriterPrerequisitesRequired
-                        ? decodeWorkspaceSyncV3NestedRepairCursor(rawCursor, keyring)
-                        : decodeWorkspaceSyncV3CombinedRepairCursor(rawCursor, keyring);
+            const cursor = decodeCombinedRepairCursorForContract(rawCursor, keyring, requestedWire);
             if (rawCursor && !cursor) {
                 json(res, 400, { success: false, code: 'INVALID_SYNC_COMBINED_REPAIR_CURSOR', error: 'Invalid combined repair cursor.' });
                 return;
@@ -231,7 +239,10 @@ export function registerWorkspaceSyncV3FeedRoutes(input) {
                 cursorKeyring: keyring, cursor, pageSize: Number.isFinite(limit) ? limit : undefined,
                 nestedCoverage: requestedWire.nestedWriterPrerequisitesRequired,
                 workflowCoverage: requestedWire.workflowWriterPrerequisitesRequired,
-                planningOrderCoverage: requestedWire.planningOrderWriterPrerequisitesRequired });
+                workflowTaskCoverCoverage: requestedWire.workflowWriterPrerequisitesRequired
+                    && requestedWire.taskCoverProjectionRequired,
+                planningOrderCoverage: requestedWire.planningOrderWriterPrerequisitesRequired,
+                taskCoverCoverage: requestedWire.taskCoverProjectionRequired });
             json(res, 200, attestLegacyPushBoundary({ ...page }, {
                 contractVersion: 3,
                 legacyV2Boundary: { cloudWritesFenced: false, excludedProjections: [] },
@@ -328,13 +339,7 @@ export function registerWorkspaceSyncV3FeedRoutes(input) {
             return;
         }
         const repairCursor = coverage.kind === 'combined'
-            ? (coverage.wire.workflowWriterPrerequisitesRequired
-                ? decodeWorkspaceSyncV3WorkflowRepairCursor(rawRepairCursor, cursorKeyring)
-                : coverage.wire.planningOrderWriterPrerequisitesRequired
-                    ? decodeWorkspaceSyncV3PlanningOrderRepairCursor(rawRepairCursor, cursorKeyring)
-                    : coverage.wire.nestedWriterPrerequisitesRequired
-                        ? decodeWorkspaceSyncV3NestedRepairCursor(rawRepairCursor, cursorKeyring)
-                        : decodeWorkspaceSyncV3CombinedRepairCursor(rawRepairCursor, cursorKeyring))
+            ? decodeCombinedRepairCursorForContract(rawRepairCursor, cursorKeyring, coverage.wire)
             : decodeWorkspaceSyncV3InitiativeRepairCursor(rawRepairCursor, cursorKeyring);
         if (rawRepairCursor && (!repairEnabled || !repairCursor)) {
             json(res, 400, { success: false, code: 'INVALID_SYNC_V3_REPAIR_CURSOR', error: 'Invalid repair cursor.' });
@@ -352,7 +357,10 @@ export function registerWorkspaceSyncV3FeedRoutes(input) {
                         pageSize: Number.isFinite(limit) ? limit : undefined,
                         nestedCoverage: coverage.wire.nestedWriterPrerequisitesRequired,
                         workflowCoverage: coverage.wire.workflowWriterPrerequisitesRequired,
+                        workflowTaskCoverCoverage: coverage.wire.workflowWriterPrerequisitesRequired
+                            && coverage.wire.taskCoverProjectionRequired,
                         planningOrderCoverage: coverage.wire.planningOrderWriterPrerequisitesRequired,
+                        taskCoverCoverage: coverage.wire.taskCoverProjectionRequired,
                         coveredLegacyWritesFenced: combinedLegacyPushDisabled })
                     : buildWorkspaceSyncV3InitiativeRepairPage({ core: input.core, workspaceId,
                         cursorKeyring: cursorKeyring, cursor: repairCursor,
@@ -398,7 +406,10 @@ export function registerWorkspaceSyncV3FeedRoutes(input) {
                         cursorKeyring: cursorKeyring, pageSize: Number.isFinite(limit) ? limit : undefined,
                         nestedCoverage: coverage.wire.nestedWriterPrerequisitesRequired,
                         workflowCoverage: coverage.wire.workflowWriterPrerequisitesRequired,
+                        workflowTaskCoverCoverage: coverage.wire.workflowWriterPrerequisitesRequired
+                            && coverage.wire.taskCoverProjectionRequired,
                         planningOrderCoverage: coverage.wire.planningOrderWriterPrerequisitesRequired,
+                        taskCoverCoverage: coverage.wire.taskCoverProjectionRequired,
                         coveredLegacyWritesFenced: combinedLegacyPushDisabled })
                     : buildWorkspaceSyncV3InitiativeRepairPage({ core: input.core, workspaceId,
                         cursorKeyring: cursorKeyring, pageSize: Number.isFinite(limit) ? limit : undefined });

package/dist/server/routes/syncV3LocalCaptureRoutes.js

@@ -96,7 +96,14 @@ function parseEnvelope(raw) {
     };
     if (operation.domain === 'task' && operation.mutationKind === 'metadata-update') {
         const saveSource = payload.saveSource;
-        assertExactKeys(payload, saveSource === undefined ? ['patch'] : ['patch', 'saveSource'], 'operation.payload');
+        const expectedDetailRevision = payload.expectedDetailRevision === undefined
+            ? undefined
+            : requireId(payload.expectedDetailRevision, 'operation.payload.expectedDetailRevision');
+        assertExactKeys(payload, [
+            'patch',
+            ...(saveSource === undefined ? [] : ['saveSource']),
+            ...(expectedDetailRevision === undefined ? [] : ['expectedDetailRevision']),
+        ], 'operation.payload');
         if (saveSource !== undefined && saveSource !== 'manual' && saveSource !== 'autosave') {
             throw new LocalCaptureRequestError('operation.payload.saveSource must be manual or autosave.');
         }
@@ -106,6 +113,7 @@ function parseEnvelope(raw) {
             mutationKind: 'metadata-update',
             patch: requireRecord(payload.patch, 'operation.payload.patch'),
             ...(saveSource ? { saveSource } : {}),
+            ...(expectedDetailRevision ? { expectedDetailRevision } : {}),
         };
     }
     if (operation.domain === 'task' && operation.mutationKind === 'create') {
@@ -170,11 +178,27 @@ function parseEnvelope(raw) {
         };
     }
     if (operation.domain === 'task' && operation.mutationKind === 'set-status') {
+        const expectedDetailRevision = payload.expectedDetailRevision === undefined
+            ? undefined
+            : requireId(payload.expectedDetailRevision, 'operation.payload.expectedDetailRevision');
+        assertExactKeys(payload, [
+            'status',
+            'assigneeIntent',
+            'canceledReason',
+            'metadataPatch',
+            ...(expectedDetailRevision === undefined ? [] : ['expectedDetailRevision']),
+        ], 'operation.payload');
         return {
             ...common,
             domain: 'task',
             mutationKind: 'set-status',
-            payload: validateDurableTaskStatusMutationPayload(payload),
+            payload: validateDurableTaskStatusMutationPayload({
+                status: payload.status,
+                assigneeIntent: payload.assigneeIntent,
+                canceledReason: payload.canceledReason,
+                metadataPatch: payload.metadataPatch,
+            }),
+            ...(expectedDetailRevision ? { expectedDetailRevision } : {}),
         };
     }
     if (operation.domain === 'task-comments' && operation.mutationKind === 'append') {
@@ -731,6 +755,7 @@ export function registerWorkspaceSyncV3LocalCaptureRoutes(input) {
                                                     taskId: envelope.entityId,
                                                     patch: envelope.patch,
                                                     saveSource: envelope.saveSource,
+                                                    expectedDetailRevision: envelope.expectedDetailRevision,
                                                     now: acceptedAt,
                                                     actorRef: 'user',
                                                     onPostCommitError: input.onPostCommitError,
@@ -786,6 +811,7 @@ export function registerWorkspaceSyncV3LocalCaptureRoutes(input) {
                                                                     identity,
                                                                     taskId: envelope.entityId,
                                                                     payload: envelope.payload,
+                                                                    expectedDetailRevision: envelope.expectedDetailRevision,
                                                                     now: acceptedAt,
                                                                     actorRef: 'user',
                                                                     onPostCommitError: input.onPostCommitError,

package/dist/server/routes/syncV3LocalFeedApplyRoutes.d.ts

@@ -1,5 +1,6 @@
 import type { SyncAddRoute, SyncRouteAuthConfig, SyncRouteCore } from './syncRouteTypes.js';
 import type { LocalSyncCoordinatorRouteServices } from '../../sync/coordinator/localSyncCoordinatorRouteServices.js';
+export declare function revisionConflictDetails(error: unknown): Record<string, unknown> | undefined;
 export declare function isWorkspaceSyncV3LocalFeedApplyEnabled(env?: NodeJS.ProcessEnv): boolean;
 export declare function isWorkspaceSyncV3CombinedLocalFeedApplyEnabled(env?: NodeJS.ProcessEnv): boolean;
 export declare function registerWorkspaceSyncV3LocalFeedApplyRoutes(input: {

package/dist/server/routes/syncV3LocalFeedApplyRoutes.js

@@ -8,6 +8,7 @@ import { resolveCombinedFeedCapability, resolveRequestedCombinedFeedCoverage } f
 import { parseJsonBody } from './primitives.js';
 import { applyWorkspaceSyncV3TaskCommentAuditPage, readWorkspaceSyncV3TaskCommentAuditCursor, readWorkspaceSyncV3TaskCommentAuditState, } from '../../sync/v3/workspaceSyncV3TaskCommentAudit.js';
 import { createLocalSyncBrowserApplyPermitTransactionHooks, parseLocalSyncBrowserApplyPermitContext, } from '../../sync/coordinator/localSyncBrowserApplyPermitContext.js';
+import { WorkspaceSyncRevisionConflictError } from '../../sync/v3/syncDurabilityStore.js';
 const ROUTE_PATH = '/api/taskforce/sync/v3/local/feed';
 const TASK_COMMENT_AUDIT_PATH = '/api/taskforce/sync/v3/local/task-comment-audit';
 const MAX_BODY_BYTES = 8 * 1024 * 1024;
@@ -15,6 +16,29 @@ function writeJson(res, statusCode, body) {
     res.writeHead(statusCode, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
     res.end(JSON.stringify(body));
 }
+export function revisionConflictDetails(error) {
+    if (!(error instanceof WorkspaceSyncRevisionConflictError) || !error.details)
+        return undefined;
+    const details = error.details;
+    const coordinates = (value) => {
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            return undefined;
+        const source = value;
+        const sequence = source.sequence ?? source.lastSequence;
+        return {
+            sequence: sequence == null ? null : String(sequence),
+            entityRevision: source.entityRevision == null ? null : String(source.entityRevision),
+            lifecycleRevision: source.lifecycleRevision == null ? null : String(source.lifecycleRevision),
+        };
+    };
+    return {
+        domain: String(details.domain || ''),
+        entityId: String(details.entityId || ''),
+        reason: String(details.reason || ''),
+        ...(coordinates(details.incoming) ? { incoming: coordinates(details.incoming) } : {}),
+        ...(coordinates(details.current) ? { current: coordinates(details.current) } : {}),
+    };
+}
 function workspaceFromUrl(req) {
     try {
         return String(new URL(req.url || ROUTE_PATH, 'http://localhost').searchParams.get('workspaceId') || '').trim();
@@ -481,12 +505,14 @@ export function registerWorkspaceSyncV3LocalFeedApplyRoutes(input) {
         catch (error) {
             const causeCode = String(error?.code || '').trim();
             const causeAssetId = String(error?.assetId || '').trim();
+            const causeDetails = revisionConflictDetails(error);
             writeJson(res, 409, {
                 success: false,
                 code: 'WORKSPACE_SYNC_V3_LOCAL_FEED_APPLY_REJECTED',
                 error: String(error?.message || error),
                 ...(causeCode ? { causeCode } : {}),
                 ...(causeAssetId ? { causeAssetId } : {}),
+                ...(causeDetails ? { causeDetails } : {}),
             });
         }
     });