@taskforcehq/taskforce 0.3.329 → 0.3.330

package/dist/server/routes/modelConnections.js

@@ -0,0 +1,205 @@
+import { INTERNAL_SUBSCRIPTION_MODEL_FEATURE_KEY } from '../../shared/userFeatureGrants.js';
+import { ModelProviderConnectionError, ModelProviderConnectionStore, } from '../../storage/modelProviderConnectionStore.js';
+import { ModelProviderCredentialHomeManager } from '../../services/modelProviderCredentialHome.js';
+import { ModelProviderConnectionService, } from '../../services/modelProviderConnectionService.js';
+import { CodexDeviceCodeLoginManager, } from '../../services/codexDeviceCodeLoginManager.js';
+import { createCodexModelProviderConnectionLifecycleHandlers } from '../../services/codexModelProviderConnectionLifecycle.js';
+import { parseJsonBody } from './primitives.js';
+function writeJson(res, statusCode, payload) {
+    res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(payload));
+}
+function writeError(res, error) {
+    const knownError = error instanceof ModelProviderConnectionError;
+    const statusCode = Number(error?.statusCode);
+    const safeStatusCode = Number.isInteger(statusCode) && statusCode >= 400 && statusCode <= 599
+        ? statusCode
+        : 500;
+    const code = knownError && typeof error?.code === 'string'
+        ? String(error.code)
+        : 'MODEL_CONNECTION_REQUEST_FAILED';
+    const message = knownError
+        ? String(error?.message || 'Model connection request failed.')
+        : 'Model connection request failed.';
+    writeJson(res, safeStatusCode, { success: false, error: message, code });
+}
+export function registerModelConnectionsRoutes(deps) {
+    const { addRoute, ensureAppAccess, resolveAuthenticatedUserId, resolveRuntimeMode, core, } = deps;
+    let resolvedService = deps.service;
+    let resolvedLoginManager = deps.loginManager;
+    let resolvedStore = null;
+    const store = () => {
+        if (resolvedStore)
+            return resolvedStore;
+        if (!core)
+            throw new Error('Model connection store is unavailable.');
+        resolvedStore = new ModelProviderConnectionStore(core.getDatabaseAdapter(), core.getTenantId());
+        return resolvedStore;
+    };
+    const service = () => {
+        if (resolvedService)
+            return resolvedService;
+        if (!core)
+            throw new Error('Model connection service is unavailable.');
+        const lifecycleHandlers = deps.lifecycleHandlers || [{
+                providerKey: 'openai',
+                authenticationType: 'chatgpt_device_code',
+                lifecycle: createCodexModelProviderConnectionLifecycleHandlers(),
+            }];
+        resolvedService = new ModelProviderConnectionService(store(), new ModelProviderCredentialHomeManager(deps.credentialStoragePath), (userId) => core.hasUserFeatureGrant(userId, INTERNAL_SUBSCRIPTION_MODEL_FEATURE_KEY), lifecycleHandlers);
+        return resolvedService;
+    };
+    const loginManager = () => {
+        if (resolvedLoginManager)
+            return resolvedLoginManager;
+        const connectionService = service();
+        if (!(connectionService instanceof ModelProviderConnectionService)) {
+            throw new Error('Model connection login manager is unavailable.');
+        }
+        resolvedLoginManager = new CodexDeviceCodeLoginManager(connectionService, store());
+        return resolvedLoginManager;
+    };
+    const authorize = (req, res) => {
+        if (!ensureAppAccess(req, res))
+            return null;
+        if (resolveRuntimeMode(req) !== 'cloud') {
+            writeJson(res, 404, {
+                success: false,
+                error: 'Model connections are unavailable in this runtime.',
+                code: 'MODEL_CONNECTIONS_CLOUD_ONLY',
+            });
+            return null;
+        }
+        const userId = String(resolveAuthenticatedUserId(req) || '').trim();
+        if (!userId) {
+            writeJson(res, 401, {
+                success: false,
+                error: 'Authentication is required.',
+                code: 'AUTH_REQUIRED',
+            });
+            return null;
+        }
+        return userId;
+    };
+    addRoute('GET', '/api/taskforce/model-connections', async (req, res) => {
+        const ownerUserId = authorize(req, res);
+        if (!ownerUserId)
+            return;
+        try {
+            writeJson(res, 200, {
+                success: true,
+                eligible: core ? core.hasUserFeatureGrant(ownerUserId, INTERNAL_SUBSCRIPTION_MODEL_FEATURE_KEY) : true,
+                connections: service().list(ownerUserId),
+            });
+        }
+        catch (error) {
+            writeError(res, error);
+        }
+    });
+    addRoute('POST', '/api/taskforce/model-connections', async (req, res) => {
+        const ownerUserId = authorize(req, res);
+        if (!ownerUserId)
+            return;
+        try {
+            const body = await parseJsonBody(req, 16 * 1024);
+            const connection = service().create({
+                ownerUserId,
+                providerKey: String(body?.providerKey || ''),
+                authenticationType: String(body?.authenticationType || ''),
+            });
+            writeJson(res, 201, { success: true, connection });
+        }
+        catch (error) {
+            writeError(res, error);
+        }
+    });
+    addRoute('GET', '/api/taskforce/model-connections/:connectionId', async (req, res, params) => {
+        const ownerUserId = authorize(req, res);
+        if (!ownerUserId)
+            return;
+        try {
+            writeJson(res, 200, {
+                success: true,
+                connection: service().get(ownerUserId, params.connectionId),
+            });
+        }
+        catch (error) {
+            writeError(res, error);
+        }
+    });
+    addRoute('PATCH', '/api/taskforce/model-connections/:connectionId', async (req, res, params) => {
+        const ownerUserId = authorize(req, res);
+        if (!ownerUserId)
+            return;
+        try {
+            const body = await parseJsonBody(req, 16 * 1024);
+            const connection = service().rename(ownerUserId, params.connectionId, body?.displayName);
+            writeJson(res, 200, { success: true, connection });
+        }
+        catch (error) {
+            writeError(res, error);
+        }
+    });
+    addRoute('POST', '/api/taskforce/model-connections/:connectionId/login', async (req, res, params) => {
+        const ownerUserId = authorize(req, res);
+        if (!ownerUserId)
+            return;
+        try {
+            const login = await loginManager().start(ownerUserId, params.connectionId);
+            writeJson(res, 202, { success: true, login });
+        }
+        catch (error) {
+            writeError(res, error);
+        }
+    });
+    addRoute('GET', '/api/taskforce/model-connections/:connectionId/login/:sessionId', async (req, res, params) => {
+        const ownerUserId = authorize(req, res);
+        if (!ownerUserId)
+            return;
+        try {
+            const login = loginManager().get(ownerUserId, params.connectionId, params.sessionId);
+            writeJson(res, 200, { success: true, login });
+        }
+        catch (error) {
+            writeError(res, error);
+        }
+    });
+    addRoute('POST', '/api/taskforce/model-connections/:connectionId/login/:sessionId/cancel', async (req, res, params) => {
+        const ownerUserId = authorize(req, res);
+        if (!ownerUserId)
+            return;
+        try {
+            const login = await loginManager().cancel(ownerUserId, params.connectionId, params.sessionId);
+            writeJson(res, 200, { success: true, login });
+        }
+        catch (error) {
+            writeError(res, error);
+        }
+    });
+    for (const operation of ['verify', 'refresh', 'disconnect']) {
+        addRoute('POST', `/api/taskforce/model-connections/:connectionId/${operation}`, async (req, res, params) => {
+            const ownerUserId = authorize(req, res);
+            if (!ownerUserId)
+                return;
+            try {
+                const connection = await service()[operation](ownerUserId, params.connectionId);
+                writeJson(res, 200, { success: true, connection });
+            }
+            catch (error) {
+                writeError(res, error);
+            }
+        });
+    }
+    addRoute('DELETE', '/api/taskforce/model-connections/:connectionId', async (req, res, params) => {
+        const ownerUserId = authorize(req, res);
+        if (!ownerUserId)
+            return;
+        try {
+            const result = await service().cleanup(ownerUserId, params.connectionId);
+            writeJson(res, 200, { success: true, ...result });
+        }
+        catch (error) {
+            writeError(res, error);
+        }
+    });
+}

package/dist/server/routes/shared.d.ts

@@ -6,9 +6,11 @@
  * routes.ts at runtime.
  */
 import { IncomingMessage, ServerResponse } from 'http';
+import { NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';
 import { TaskforceCore } from '../../core/Taskforce.js';
 import type { McpAccessTokenAuthResult, McpOAuthAccessTokenAuthResult, McpAccessTokenScope } from '../../core/Taskforce.js';
 import { type RouteContext } from './primitives.js';
+import { type McpRuntimeFactory, type TaskforceMcpServerOptions } from '../../mcp/runtime.js';
 import { type AiProfileBootstrapConfig } from '../../mcp/aiProfileBootstrap.js';
 import type { AiProfileSeatScope } from '../../shared/aiProfileSeatScope.js';
 import { type RequestPerformanceDiagnostics } from '../../storage/postgresRequestDiagnostics.js';
@@ -100,6 +102,20 @@ export declare function makeAuthenticateCloudMcpRequest(core: TaskforceCore, dep
     resolveAuthenticatedUserId: (req: IncomingMessage) => string;
     writeMcpHttpError: (res: ServerResponse, statusCode: number, message: string, data?: Record<string, unknown>) => void;
 }): (req: IncomingMessage, res: ServerResponse) => CloudMcpRequestAuth | null;
+export type CloudMcpToolPolicy = {
+    requiredScope: McpAccessTokenScope | null;
+    isWrite: boolean;
+};
+export type CloudMcpToolPolicyResolver = (toolName: string) => CloudMcpToolPolicy;
+export interface CloudMcpRuntimeLease {
+    runtime: ReturnType<McpRuntimeFactory>;
+    transport: NodeStreamableHTTPServerTransport;
+    release(): Promise<void>;
+}
+export type AcquireCloudMcpRuntime = (input: {
+    req: IncomingMessage;
+    options: TaskforceMcpServerOptions;
+}) => Promise<CloudMcpRuntimeLease>;
 export declare function makeHandleCloudMcpRequest(core: TaskforceCore, deps: {
     ensureAppAccess: (req: IncomingMessage, res: ServerResponse) => boolean;
     resolveAuthenticatedUserId: (req: IncomingMessage) => string;
@@ -109,6 +125,9 @@ export declare function makeHandleCloudMcpRequest(core: TaskforceCore, deps: {
         workspaceMaxRequests: number;
         windowMs: number;
     };
+    createMcpServer?: McpRuntimeFactory;
+    resolveMcpToolPolicy?: CloudMcpToolPolicyResolver;
+    acquireMcpRuntime?: AcquireCloudMcpRuntime;
 }): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
 export declare function requestHeader(req: IncomingMessage, name: string, fallback?: string): string;
 export declare function requestWorkspaceHeader(req: IncomingMessage): string;

package/dist/server/routes/shared.js

@@ -6,17 +6,18 @@
  * routes.ts at runtime.
  */
 import { randomUUID } from 'crypto';
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
+import { NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';
+import { isInitializeRequest, isJsonContentType } from '@modelcontextprotocol/server';
 import { TaskforceRuleError } from '../../core/Taskforce.js';
 import { resolveRequestAccess, } from '../auth.js';
 import { parseJsonBody } from './primitives.js';
-import { createTaskforceMcpServer, isMcpWriteToolName } from '../../mcp/runtime.js';
+import { createStatelessTaskforceMcpServer, createTaskforceMcpServer, isMcpWriteToolName, } from '../../mcp/runtime.js';
 import { MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS } from '../../mcp/toolRegistry.js';
 import { resolveCanonicalMcpToolName } from '../../mcp/toolCallCompatibility.js';
 import { applyPrefixedRateLimitHeaders } from '../rateLimit.js';
 import { parseAiProfileBootstrapHeaders } from '../../mcp/aiProfileBootstrap.js';
 import { parseMcpClientId } from '../../mcp/clientRegistry.js';
+import { handleModernMcpHttpRequest, isModernMcpHttpRequest, } from '../../mcp/httpProtocolRouting.js';
 import { resolveAppAccessDeniedResponse } from '../appAccess.js';
 import { resolveCloudApplicationBaseUrl } from '../../config/applicationBaseUrl.js';
 import { getRequestPerformanceDiagnostics, runWithRequestPerformanceDiagnostics, } from '../../storage/postgresRequestDiagnostics.js';
@@ -273,7 +274,14 @@ function writeMcpHttpError(res, statusCode, message, data) {
         id: null,
     }));
 }
-function extractMcpWriteToolNames(body) {
+function resolveProductionCloudMcpToolPolicy(requestedToolName) {
+    const toolName = resolveCanonicalMcpToolName(requestedToolName);
+    return {
+        requiredScope: MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS[toolName] || null,
+        isWrite: isMcpWriteToolName(requestedToolName),
+    };
+}
+function extractMcpWriteToolNames(body, resolveToolPolicy) {
     const messages = Array.isArray(body) ? body : [body];
     const names = messages.flatMap((message) => {
         if (!message || typeof message !== 'object')
@@ -282,7 +290,7 @@ function extractMcpWriteToolNames(body) {
         if (method !== 'tools/call')
             return [];
         const toolName = String(message?.params?.name || '').trim();
-        return toolName && isMcpWriteToolName(toolName) ? [toolName] : [];
+        return toolName && resolveToolPolicy(toolName).isWrite ? [toolName] : [];
     });
     return Array.from(new Set(names));
 }
@@ -299,7 +307,7 @@ function extractFirstMcpToolName(body) {
     }
     return null;
 }
-function findDeniedCloudMcpToolName(body, scopes) {
+function findDeniedCloudMcpToolName(body, scopes, resolveToolPolicy) {
     const messages = Array.isArray(body) ? body : [body];
     for (const message of messages) {
         if (!message || typeof message !== 'object')
@@ -309,15 +317,14 @@ function findDeniedCloudMcpToolName(body, scopes) {
         const requestedToolName = String(message?.params?.name || '').trim();
         if (!requestedToolName)
             continue;
-        const toolName = resolveCanonicalMcpToolName(requestedToolName);
-        const requiredScope = MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS[toolName];
+        const requiredScope = resolveToolPolicy(requestedToolName).requiredScope;
         if (!requiredScope || !scopes.includes(requiredScope))
             return requestedToolName;
     }
     return null;
 }
 export function makeHandleCloudMcpRequest(core, deps) {
-    const { ensureAppAccess, resolveAuthenticatedUserId, writeRateLimit } = deps;
+    const { ensureAppAccess, resolveAuthenticatedUserId, writeRateLimit, createMcpServer = createTaskforceMcpServer, resolveMcpToolPolicy = resolveProductionCloudMcpToolPolicy, acquireMcpRuntime, } = deps;
     const authenticateCloudMcpRequest = makeAuthenticateCloudMcpRequest(core, {
         resolveAuthenticatedUserId,
         writeMcpHttpError,
@@ -342,7 +349,7 @@ export function makeHandleCloudMcpRequest(core, deps) {
     const applyCloudMcpWriteRateLimit = (req, res, auth, body) => {
         if (!writeRateLimit.enabled)
             return true;
-        const writeTools = extractMcpWriteToolNames(body);
+        const writeTools = extractMcpWriteToolNames(body, resolveMcpToolPolicy);
         if (writeTools.length === 0)
             return true;
         const actorKey = auth.authenticatedViaToken?.tokenId
@@ -413,6 +420,10 @@ export function makeHandleCloudMcpRequest(core, deps) {
             writeMcpHttpError(res, 405, 'Method not allowed.');
             return;
         }
+        if (!isJsonContentType(requestHeader(req, 'content-type', ''))) {
+            writeMcpHttpError(res, 415, 'Unsupported Media Type: Content-Type must be application/json');
+            return;
+        }
         let body = undefined;
         try {
             const bodyParseStartedAtMs = Date.now();
@@ -431,7 +442,8 @@ export function makeHandleCloudMcpRequest(core, deps) {
             : '';
         const initializeRequest = isInitializeRequest(body)
             || mcpMethod === 'initialize';
-        const deniedToolName = findDeniedCloudMcpToolName(body, authScopes);
+        const modernProtocolRequest = await isModernMcpHttpRequest(req, body);
+        const deniedToolName = findDeniedCloudMcpToolName(body, authScopes, resolveMcpToolPolicy);
         if (deniedToolName) {
             core.addMcpAuditLog({
                 workspaceId: auth.workspaceId,
@@ -451,13 +463,14 @@ export function makeHandleCloudMcpRequest(core, deps) {
             writeMcpHttpError(res, 403, 'Forbidden.');
             return;
         }
-        const writeToolNames = extractMcpWriteToolNames(body);
+        const writeToolNames = extractMcpWriteToolNames(body, resolveMcpToolPolicy);
         const rateLimitStartedAtMs = Date.now();
         const rateLimitAllowed = applyCloudMcpWriteRateLimit(req, res, auth, body);
         rateLimitMs = Date.now() - rateLimitStartedAtMs;
         if (!rateLimitAllowed)
             return;
         let runtime = null;
+        let runtimeLease = null;
         let runtimeConstructionMs = 0;
         let transportConnectMs = 0;
         let requestHandlingMs = 0;
@@ -466,12 +479,13 @@ export function makeHandleCloudMcpRequest(core, deps) {
         const toolTimingState = { value: null };
         try {
             const runtimeStartedAtMs = Date.now();
-            // Intentionally isolate the MCP runtime per HTTP request. The runtime closes over
+            // Production intentionally isolates the MCP runtime per HTTP request. The runtime closes over
             // workspace auth, AI identity, permissions, subscriptions, and mutable helper state;
             // sharing it could leak state across tenants or callers. Keep the transport stateless
             // too. The timing event below measures construction cost so caching is only revisited
-            // with evidence and must preserve these boundaries (including dynamic tool schemas).
-            runtime = createTaskforceMcpServer({
+            // with evidence and must preserve these boundaries (including dynamic tool schemas). The optional
+            // lease seam exists only for transport conformance tests that must carry legacy bidirectional calls.
+            const runtimeOptions = {
                 projectRoot: core.getPaths().projectRoot,
                 tenantId: core.getTenantId(),
                 workspaceId: auth.workspaceId,
@@ -479,6 +493,7 @@ export function makeHandleCloudMcpRequest(core, deps) {
                 serverName: 'taskforce-cloud',
                 logStartup: false,
                 runtimeMode: 'cloud',
+                toolProfile: auth.authenticatedViaToken?.toolProfile || auth.authenticatedViaOAuth?.toolProfile || 'default',
                 applicationBaseUrl: resolveCloudApplicationBaseUrl(),
                 auth: buildCloudMcpRuntimeAuth({
                     req,
@@ -506,15 +521,66 @@ export function makeHandleCloudMcpRequest(core, deps) {
                         ]);
                     }
                 },
-            });
+            };
+            if (modernProtocolRequest) {
+                const requestHandlingStartedAtMs = Date.now();
+                await handleModernMcpHttpRequest({
+                    req,
+                    res,
+                    parsedBody: body,
+                    factory: ({ era }) => {
+                        const constructionStartedAtMs = Date.now();
+                        const modernRuntime = createStatelessTaskforceMcpServer({
+                            ...runtimeOptions,
+                            protocolEra: era,
+                        }, createMcpServer);
+                        runtimeConstructionMs = Date.now() - constructionStartedAtMs;
+                        if (!res.headersSent) {
+                            setServerTimingHeader(res, [
+                                { name: 'auth', durationMs: authMs },
+                                { name: 'body-parse', durationMs: bodyParseMs },
+                                { name: 'rate-limit', durationMs: rateLimitMs },
+                                { name: 'runtime', durationMs: runtimeConstructionMs },
+                            ]);
+                        }
+                        return modernRuntime.server;
+                    },
+                    onerror: (error) => {
+                        console.warn('[Taskforce MCP] Modern cloud request rejected:', {
+                            requestId,
+                            message: error.message,
+                        });
+                    },
+                });
+                requestHandlingMs = Date.now() - requestHandlingStartedAtMs;
+                recordCloudMcpCredentialUsage(req, auth.authenticatedViaToken, auth.authenticatedViaOAuth);
+                return;
+            }
+            runtimeLease = acquireMcpRuntime
+                ? await acquireMcpRuntime({ req, options: runtimeOptions })
+                : null;
+            runtime = runtimeLease?.runtime
+                || createStatelessTaskforceMcpServer(runtimeOptions, createMcpServer);
             runtimeConstructionMs = Date.now() - runtimeStartedAtMs;
-            const transport = new StreamableHTTPServerTransport({
+            const transport = runtimeLease?.transport || new NodeStreamableHTTPServerTransport({
                 sessionIdGenerator: undefined,
                 enableJsonResponse: true,
             });
             const transportStartedAtMs = Date.now();
-            await runtime.server.connect(transport);
+            if (!runtimeLease)
+                await runtime.server.connect(transport);
             transportConnectMs = Date.now() - transportStartedAtMs;
+            // Set request-level phases before the SDK writes response headers. Tool calls replace this
+            // with the richer envelope/handler breakdown from onToolCallTiming above.
+            if (!res.headersSent) {
+                setServerTimingHeader(res, [
+                    { name: 'auth', durationMs: authMs },
+                    { name: 'body-parse', durationMs: bodyParseMs },
+                    { name: 'rate-limit', durationMs: rateLimitMs },
+                    { name: 'runtime', durationMs: runtimeConstructionMs },
+                    { name: 'transport-connect', durationMs: transportConnectMs },
+                ]);
+            }
             if (!initializeRequest) {
                 // Stateless cloud sessions still require a valid MCP JSON-RPC request;
                 // let the SDK validate and respond rather than trying to track sessions server-side.
@@ -540,7 +606,17 @@ export function makeHandleCloudMcpRequest(core, deps) {
             }
         }
         finally {
-            if (runtime) {
+            if (runtimeLease) {
+                const cleanupStartedAtMs = Date.now();
+                try {
+                    await runtimeLease.release();
+                }
+                catch (closeError) {
+                    console.warn('[Taskforce MCP] Cloud test runtime lease cleanup failed:', closeError);
+                }
+                cleanupMs = Date.now() - cleanupStartedAtMs;
+            }
+            else if (runtime) {
                 const cleanupStartedAtMs = Date.now();
                 try {
                     await runtime.server.close();

package/dist/server/routes/sync.js

@@ -573,6 +573,7 @@ export function registerSyncRoutes(deps) {
             }
             const { result } = await dispatchWorkspaceSyncChanges(cloudWorkspaceId, fenced.changes, {
                 coexistenceDirection: 'cloud-push',
+                actorUserId: access.userId,
                 assertedActiveV3TaskMetadataIds,
                 assertedActiveV3TaskLifecycleIds,
                 assertedActiveV3TaskReopenAssigneeIds,

package/dist/server/routes/syncAuxRoutes.js

@@ -1,4 +1,5 @@
 import { applyWorkspaceRepair } from '../../sync/workspaceRepair.js';
+import { WorkspaceSyncContentPullObligationStore } from '../../sync/engine/workspaceSyncContentPullObligationStore.js';
 import { normalizeSyncEventDetails } from '../../utils/syncEventDetails.js';
 import { parseJsonBody } from './primitives.js';
 import { requireAuthenticatedSyncRequest } from './syncRouteGuards.js';
@@ -54,7 +55,9 @@ export function registerWorkspaceSyncAuxRoutes({ addRoute, core, context, resolv
     // stale links. Does NOT tombstone metadata for files that appear missing locally — a single
     // failed existence check at startup can mean the content is only temporarily unavailable
     // (e.g. storage not yet mounted/synced), not deleted; that requires explicit admin
-    // confirmation via /api/taskforce/admin/workspace-repair/apply. Never deletes files.
+    // confirmation via /api/taskforce/admin/workspace-repair/apply. Never deletes files. When
+    // content availability genuinely can't be verified, queues a durable content-pull recovery
+    // obligation instead, which resolves automatically once a later scan confirms the content.
     // Called once by the sync orchestrator when the workspace becomes active.
     addRoute('POST', '/api/taskforce/sync/workspace/repair-startup', async (req, res) => {
         const authConfig = context.authConfig;
@@ -83,6 +86,7 @@ export function registerWorkspaceSyncAuxRoutes({ addRoute, core, context, resolv
             deletedTasks: core.listWorkspaceSyncDeletes(workspaceId) || [],
             workspaceAssetStore,
             publishedContentResolver,
+            contentPullObligationStore: new WorkspaceSyncContentPullObligationStore(core.getDatabaseAdapter()),
             aiProfiles: typeof core.listAiProfiles === 'function'
                 ? core.listAiProfiles(workspaceId, { includeArchived: true }) || []
                 : [],

package/dist/server/routes/syncPushRoutes.d.ts

@@ -21,6 +21,7 @@ interface RegisterWorkspacePushSyncRoutesArgs {
     dispatchWorkspaceSyncChanges: (workspaceId: string, incomingChanges: WorkspaceSyncChange[], options?: {
         allowReferenceNumberReassignment?: boolean;
         coexistenceDirection?: 'cloud-push';
+        actorUserId?: string;
         assertedActiveV3TaskMetadataIds?: ReadonlySet<string>;
         assertedActiveV3TaskLifecycleIds?: ReadonlySet<string>;
         assertedActiveV3TaskReopenAssigneeIds?: ReadonlySet<string>;

package/dist/server/routes/syncPushRoutes.js

@@ -270,6 +270,7 @@ export function registerWorkspacePushSyncRoutes({ addRoute, core, context, audit
             const { result, deleteCount, emittedEventIds } = await dispatchWorkspaceSyncChanges(targetWorkspaceId, incomingChanges, {
                 allowReferenceNumberReassignment,
                 coexistenceDirection: 'cloud-push',
+                actorUserId: String(access.userId || '').trim(),
                 assertedActiveV3TaskMetadataIds,
                 assertedActiveV3TaskLifecycleIds,
                 assertedActiveV3TaskReopenAssigneeIds,

package/dist/server/routes/syncV3FeedRoutes.js

@@ -5,7 +5,7 @@ import { buildWorkspaceSyncV3InitiativeRepairPage, decodeWorkspaceSyncV3Initiati
 import { WORKSPACE_SYNC_V3_COVERAGE_PROFILE } from '../../sync/v3/workspaceSyncV3FeedProfile.js';
 import { isWorkspaceSyncV3InitiativeLegacyPushDisabled } from '../../sync/v3/planningActivation.js';
 import { WORKSPACE_SYNC_V3_COMBINED_COVERAGE_PROFILE } from '../../sync/v3/workspaceSyncV3CombinedCoverage.js';
-import { buildWorkspaceSyncV3CombinedRepairPage, decodeWorkspaceSyncV3CombinedRepairCursor, decodeWorkspaceSyncV3NestedRepairCursor, decodeWorkspaceSyncV3PlanningOrderRepairCursor, decodeWorkspaceSyncV3TaskCoverRepairCursor, decodeWorkspaceSyncV3WorkflowRepairCursor, WorkspaceSyncV3CombinedRepairSnapshotUnavailableError, } from '../../sync/v3/workspaceSyncV3CombinedRepairMaterialization.js';
+import { buildWorkspaceSyncV3CombinedRepairPage, decodeWorkspaceSyncV3CombinedRepairCursor, decodeWorkspaceSyncV3NestedRepairCursor, decodeWorkspaceSyncV3PlanningOrderRepairCursor, decodeWorkspaceSyncV3TaskCoverRepairCursor, decodeWorkspaceSyncV3WorkflowRepairCursor, decodeWorkspaceSyncV3WorkflowTaskCoverRepairCursor, WorkspaceSyncV3CombinedRepairSnapshotUnavailableError, } from '../../sync/v3/workspaceSyncV3CombinedRepairMaterialization.js';
 import { isWorkspaceSyncV3CombinedLegacyFenceEnabled } from '../../sync/v3/workspaceSyncV2ProjectionExclusions.js';
 import { resolveCombinedFeedCapability } from '../../sync/v3/combinedFeedCapability.js';
 import { resolveWorkspaceSyncV3RegisteredCoverage } from '../../sync/v3/workspaceSyncV3CoverageRegistry.js';
@@ -22,6 +22,9 @@ function json(res, status, body) {
     res.end(JSON.stringify(body));
 }
 function decodeCombinedRepairCursorForContract(rawCursor, keyring, wire) {
+    if (wire.taskCoverProjectionRequired && wire.workflowWriterPrerequisitesRequired) {
+        return decodeWorkspaceSyncV3WorkflowTaskCoverRepairCursor(rawCursor, keyring);
+    }
     if (wire.taskCoverProjectionRequired)
         return decodeWorkspaceSyncV3TaskCoverRepairCursor(rawCursor, keyring);
     if (wire.workflowWriterPrerequisitesRequired)
@@ -236,6 +239,8 @@ export function registerWorkspaceSyncV3FeedRoutes(input) {
                 cursorKeyring: keyring, cursor, pageSize: Number.isFinite(limit) ? limit : undefined,
                 nestedCoverage: requestedWire.nestedWriterPrerequisitesRequired,
                 workflowCoverage: requestedWire.workflowWriterPrerequisitesRequired,
+                workflowTaskCoverCoverage: requestedWire.workflowWriterPrerequisitesRequired
+                    && requestedWire.taskCoverProjectionRequired,
                 planningOrderCoverage: requestedWire.planningOrderWriterPrerequisitesRequired,
                 taskCoverCoverage: requestedWire.taskCoverProjectionRequired });
             json(res, 200, attestLegacyPushBoundary({ ...page }, {
@@ -352,6 +357,8 @@ export function registerWorkspaceSyncV3FeedRoutes(input) {
                         pageSize: Number.isFinite(limit) ? limit : undefined,
                         nestedCoverage: coverage.wire.nestedWriterPrerequisitesRequired,
                         workflowCoverage: coverage.wire.workflowWriterPrerequisitesRequired,
+                        workflowTaskCoverCoverage: coverage.wire.workflowWriterPrerequisitesRequired
+                            && coverage.wire.taskCoverProjectionRequired,
                         planningOrderCoverage: coverage.wire.planningOrderWriterPrerequisitesRequired,
                         taskCoverCoverage: coverage.wire.taskCoverProjectionRequired,
                         coveredLegacyWritesFenced: combinedLegacyPushDisabled })
@@ -399,6 +406,8 @@ export function registerWorkspaceSyncV3FeedRoutes(input) {
                         cursorKeyring: cursorKeyring, pageSize: Number.isFinite(limit) ? limit : undefined,
                         nestedCoverage: coverage.wire.nestedWriterPrerequisitesRequired,
                         workflowCoverage: coverage.wire.workflowWriterPrerequisitesRequired,
+                        workflowTaskCoverCoverage: coverage.wire.workflowWriterPrerequisitesRequired
+                            && coverage.wire.taskCoverProjectionRequired,
                         planningOrderCoverage: coverage.wire.planningOrderWriterPrerequisitesRequired,
                         taskCoverCoverage: coverage.wire.taskCoverProjectionRequired,
                         coveredLegacyWritesFenced: combinedLegacyPushDisabled })