@taskforcehq/taskforce 0.3.329 → 0.3.330

package/dist/components/views/standalone/modals/SyncStatusModal.js

@@ -1,18 +1,28 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useEffect, useMemo, useState } from 'react';
-import { AlertTriangle, ChevronDown, Copy, Loader2, RefreshCw } from 'lucide-react';
+import { AlertTriangle, ChevronDown, Copy, Loader2 } from 'lucide-react';
 import { Modal } from '../../../ui/Modal';
 import modalStyles from '../../../ui/Modal.module.css';
 import syncStatusStyles from '../../SyncStatusModal.module.css';
 import styles from '../../../../Taskforce.module.css';
 import { isWorkspaceSyncAuthenticationError } from '../../../../utils/workspaceSyncPresentation';
-export function SyncStatusModal({ isOpen, theme, currentWorkspaceLabel, syncStatus, syncStatusMeta, workspaceCloudSyncEnabled, syncControlBusy, canManageWorkspaceSync, workspaceSyncSummary, workspaceSyncRecommendedAction, workspaceSyncRepairBusy, referenceMismatchCount, syncStageLabel, workspaceSyncPendingChanges, incomingCloudChanges, formattedLastSyncTime, formattedLastPullTime, formattedLastPushTime, syncLastError, activeReferenceMismatchSummaries, syncDiagnosticsSummary, syncEventRows, syncEventsListRef, workspaceSyncRepairQueued, workspaceSyncBusy, workspaceSyncCopied, coordinatorOwnershipMode, coordinatorOwnershipTransferBusy, coordinatorOwnershipTransferDisabled, onClose, onToggleWorkspaceSync, onRepairSync, onCopyReport, onRetrySync, onTransferCoordinatorOwnership, }) {
+export function SyncStatusModal({ isOpen, theme, currentWorkspaceLabel, syncStatus, syncStatusMeta, workspaceCloudSyncEnabled, syncControlBusy, syncControlIntent, canManageWorkspaceSync, workspaceSyncSummary, workspaceSyncRecommendedAction, workspaceSyncRepairBusy, referenceMismatchCount, syncStageLabel, workspaceSyncPendingChanges, incomingCloudChanges, formattedLastSyncTime, formattedLastPullTime, formattedLastPushTime, syncLastError, activeReferenceMismatchSummaries, syncDiagnosticsSummary, syncEventRows, syncEventsListRef, workspaceSyncRepairQueued, workspaceSyncBusy, workspaceSyncCopied, coordinatorOwnershipMode, coordinatorOwnershipTransferBusy, coordinatorOwnershipTransferDisabled, onClose, onToggleWorkspaceSync, onRepairSync, onCopyReport, onTransferCoordinatorOwnership, }) {
     const [eventFilter, setEventFilter] = useState('all');
     useEffect(() => {
         if (isOpen)
             setEventFilter('all');
     }, [isOpen]);
     const needsAttention = syncStatus === 'attention';
+    const displayedSyncEnabled = syncControlIntent === 'enabling'
+        ? true
+        : syncControlIntent === 'disabling'
+            ? false
+            : workspaceCloudSyncEnabled;
+    const syncControlTransitionLabel = syncControlIntent === 'enabling'
+        ? 'Turning on…'
+        : syncControlIntent === 'disabling'
+            ? 'Turning off…'
+            : null;
     const activeIssue = workspaceSyncRepairBusy
         ? referenceMismatchCount > 0
             ? `Repair is reconciling cloud state, including ${referenceMismatchCount} reference mismatch${referenceMismatchCount === 1 ? '' : 'es'}.`
@@ -26,58 +36,43 @@ export function SyncStatusModal({ isOpen, theme, currentWorkspaceLabel, syncStat
     const coordinatorOwnedByOtherProcess = /\banother local taskforce process owns workspace synchronization\b/i.test(syncLastError);
     const coordinatorAuthenticationRequired = isWorkspaceSyncAuthenticationError(syncLastError);
     const repairActionAvailable = workspaceCloudSyncEnabled
+        && syncStatus !== 'checking'
         && !coordinatorOwnedByOtherProcess
         && !coordinatorAuthenticationRequired
         && (needsAttention
             || workspaceSyncBusy
             || workspaceSyncRepairBusy
             || workspaceSyncRepairQueued);
-    const retryActionAvailable = workspaceCloudSyncEnabled
-        && !coordinatorOwnedByOtherProcess
-        && !coordinatorAuthenticationRequired
-        && (workspaceSyncBusy
-            || needsAttention
-            || /\bpress sync\b/i.test(workspaceSyncRecommendedAction));
     const visibleEventRows = useMemo(() => eventFilter === 'issues'
         ? syncEventRows.filter((row) => row.tone === 'error')
         : syncEventRows, [eventFilter, syncEventRows]);
-    const footer = (_jsxs("div", { className: syncStatusStyles.syncStatusFooter, children: [_jsxs("button", { className: styles.cancelBtn, onClick: onCopyReport, title: "Copy the current sync manager report for support or AI troubleshooting.", children: [_jsx(Copy, { size: 14 }), _jsx("span", { children: workspaceSyncCopied ? 'Copied' : 'Copy Report' })] }), _jsxs("div", { className: syncStatusStyles.syncStatusFooterPrimary, children: [_jsx("button", { className: styles.cancelBtn, onClick: onRepairSync, disabled: !repairActionAvailable
-                            || workspaceSyncRepairBusy
-                            || workspaceSyncRepairQueued, title: workspaceSyncRepairBusy
-                            ? 'Repair is running now.'
-                            : workspaceSyncRepairQueued
-                                ? 'Repair is queued and will start when the current sync finishes.'
-                                : !workspaceCloudSyncEnabled
-                                    ? 'Turn on workspace sync before running Repair.'
-                                    : coordinatorOwnedByOtherProcess
-                                        ? 'Repair is unavailable in this process. Use the Taskforce process that owns workspace synchronization.'
-                                        : coordinatorAuthenticationRequired
-                                            ? 'Sign out and sign back in before running Repair.'
-                                            : workspaceSyncBusy
-                                                ? 'Queue a repair to start automatically when the current sync finishes.'
-                                                : !repairActionAvailable
-                                                    ? 'Repair is available when sync needs attention.'
-                                                    : 'Advanced recovery: clear the saved pull cursor and re-fetch cloud state from the beginning.', children: workspaceSyncRepairBusy ? (_jsxs(_Fragment, { children: [_jsx(Loader2, { size: 14, className: styles.spinner }), "Repairing..."] })) : workspaceSyncRepairQueued ? ('Repair Queued') : ('Repair') }), _jsx("button", { className: styles.submitBtn, onClick: onRetrySync, disabled: !retryActionAvailable || workspaceSyncBusy, title: workspaceSyncBusy
-                            ? 'A sync request is already running.'
+    const footer = (_jsxs("div", { className: syncStatusStyles.syncStatusFooter, children: [_jsxs("button", { className: styles.cancelBtn, onClick: onCopyReport, title: "Copy the current sync manager report for support or AI troubleshooting.", children: [_jsx(Copy, { size: 14 }), _jsx("span", { children: workspaceSyncCopied ? 'Copied' : 'Copy Report' })] }), _jsx("div", { className: syncStatusStyles.syncStatusFooterPrimary, children: _jsx("button", { className: styles.cancelBtn, onClick: onRepairSync, disabled: !repairActionAvailable
+                        || workspaceSyncRepairBusy
+                        || workspaceSyncRepairQueued, title: workspaceSyncRepairBusy
+                        ? 'Repair is running now.'
+                        : workspaceSyncRepairQueued
+                            ? 'Repair is queued and will start when the current sync finishes.'
                             : !workspaceCloudSyncEnabled
-                                ? 'Turn on workspace sync before retrying.'
+                                ? 'Turn on workspace sync before running Repair.'
                                 : coordinatorOwnedByOtherProcess
-                                    ? 'Retry is unavailable in this process. Use the Taskforce process that owns workspace synchronization.'
+                                    ? 'Repair is unavailable in this process. Use the Taskforce process that owns workspace synchronization.'
                                     : coordinatorAuthenticationRequired
-                                        ? 'Sign out and sign back in before retrying sync.'
-                                        : !retryActionAvailable
-                                            ? 'No retry is currently needed.'
-                                            : 'Retry workspace synchronization now.', children: workspaceSyncBusy ? (_jsxs(_Fragment, { children: [_jsx(Loader2, { size: 14, className: styles.spinner }), "Syncing..."] })) : (_jsxs(_Fragment, { children: [_jsx(RefreshCw, { size: 14 }), "Retry now"] })) })] })] }));
+                                        ? 'Sign out and sign back in before running Repair.'
+                                        : workspaceSyncBusy
+                                            ? 'Queue a repair to start automatically when the current sync finishes.'
+                                            : !repairActionAvailable
+                                                ? 'Repair is available when sync needs attention.'
+                                                : 'Advanced recovery: clear the saved pull cursor and re-fetch cloud state from the beginning.', children: workspaceSyncRepairBusy ? (_jsxs(_Fragment, { children: [_jsx(Loader2, { size: 14, className: styles.spinner }), "Repairing..."] })) : workspaceSyncRepairQueued ? ('Repair Queued') : ('Repair') }) })] }));
     return (_jsx(Modal, { isOpen: isOpen, onClose: onClose, title: "Sync Manager", size: "mdWide", theme: theme, draggable: true, className: syncStatusStyles.syncStatusOverlay, footer: footer, children: _jsxs("div", { className: `${modalStyles.form} ${syncStatusStyles.syncStatusModal}`, children: [_jsxs("div", { className: syncStatusStyles.syncStatusTop, children: [_jsxs("div", { className: syncStatusStyles.syncStatusMetaHeader, children: [_jsx("div", { className: syncStatusStyles.syncStatusBadge, style: {
                                         borderColor: syncStatusMeta.border,
                                         background: syncStatusMeta.background,
                                         color: syncStatusMeta.color
-                                    }, children: syncStatusMeta.label }), _jsxs("span", { className: syncStatusStyles.syncStatusLabel, children: ["Workspace: ", _jsx("code", { children: currentWorkspaceLabel })] })] }), _jsx("label", { className: syncStatusStyles.syncToggle, children: _jsxs("span", { className: [
-                                    syncStatusStyles.syncToggleControl,
-                                    workspaceCloudSyncEnabled ? syncStatusStyles.syncToggleControlEnabled : syncStatusStyles.syncToggleControlDisabled,
-                                    syncControlBusy ? syncStatusStyles.syncToggleControlBusy : '',
-                                    !canManageWorkspaceSync ? syncStatusStyles.syncToggleControlBlocked : ''
-                                ].filter(Boolean).join(' '), children: [_jsx("input", { className: syncStatusStyles.syncToggleInput, type: "checkbox", role: "switch", "aria-label": "Enable Sync", checked: workspaceCloudSyncEnabled, disabled: !canManageWorkspaceSync || syncControlBusy, onChange: (event) => onToggleWorkspaceSync(event.target.checked) }), _jsx("span", { className: `${syncStatusStyles.syncToggleState} ${syncStatusStyles.syncToggleStateOn}`, children: "On" }), _jsx("span", { className: `${syncStatusStyles.syncToggleState} ${syncStatusStyles.syncToggleStateOff}`, children: "Off" }), _jsx("span", { className: syncStatusStyles.syncToggleThumb })] }) })] }), _jsxs("section", { className: syncStatusStyles.syncStatusOverview, "aria-label": "Sync status", children: [_jsxs("div", { className: syncStatusStyles.syncStatusOverviewRow, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Health" }), _jsx("span", { className: syncStatusStyles.syncStatusSummaryValue, children: workspaceSyncSummary })] }), _jsxs("div", { className: syncStatusStyles.syncStatusOverviewRow, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Next step" }), _jsx("span", { className: syncStatusStyles.syncStatusSummaryValue, children: workspaceSyncRecommendedAction })] }), _jsxs("div", { className: [
+                                    }, children: syncStatusMeta.label }), _jsxs("span", { className: syncStatusStyles.syncStatusLabel, children: ["Workspace: ", _jsx("code", { children: currentWorkspaceLabel })] })] }), _jsxs("label", { className: syncStatusStyles.syncToggle, children: [syncControlTransitionLabel ? (_jsx("span", { className: syncStatusStyles.syncToggleTransition, "aria-live": "polite", children: syncControlTransitionLabel })) : null, _jsxs("span", { className: [
+                                        syncStatusStyles.syncToggleControl,
+                                        displayedSyncEnabled ? syncStatusStyles.syncToggleControlEnabled : syncStatusStyles.syncToggleControlDisabled,
+                                        syncControlBusy ? syncStatusStyles.syncToggleControlBusy : '',
+                                        !canManageWorkspaceSync ? syncStatusStyles.syncToggleControlBlocked : ''
+                                    ].filter(Boolean).join(' '), children: [_jsx("input", { className: syncStatusStyles.syncToggleInput, type: "checkbox", role: "switch", "aria-label": syncControlTransitionLabel || 'Enable Sync', checked: displayedSyncEnabled, disabled: !canManageWorkspaceSync || syncControlBusy, onChange: (event) => onToggleWorkspaceSync(event.target.checked) }), _jsx("span", { className: `${syncStatusStyles.syncToggleState} ${syncStatusStyles.syncToggleStateOn}`, children: "On" }), _jsx("span", { className: `${syncStatusStyles.syncToggleState} ${syncStatusStyles.syncToggleStateOff}`, children: "Off" }), _jsx("span", { className: syncStatusStyles.syncToggleThumb })] })] })] }), _jsxs("section", { className: syncStatusStyles.syncStatusOverview, "aria-label": "Sync status", children: [_jsxs("div", { className: syncStatusStyles.syncStatusOverviewRow, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Health" }), _jsx("span", { className: syncStatusStyles.syncStatusSummaryValue, children: workspaceSyncSummary })] }), _jsxs("div", { className: syncStatusStyles.syncStatusOverviewRow, children: [_jsx("span", { className: syncStatusStyles.syncStatusLabel, children: "Next step" }), _jsx("span", { className: syncStatusStyles.syncStatusSummaryValue, children: workspaceSyncRecommendedAction })] }), _jsxs("div", { className: [
                                 syncStatusStyles.syncStatusOverviewRow,
                                 syncStatusStyles.syncStatusIssueRow,
                                 activeIssueIsError ? syncStatusStyles.syncStatusIssueRowError : '',

package/dist/config/envSchema.js

@@ -1,6 +1,7 @@
 import { resolveDeploymentConfig } from './deployment.js';
 import { MIGRATION_COMPAT_ENABLED } from '../runtime/migrationFlags.js';
 import { parseWorkspaceSyncV3FeedCursorKeyring } from '../sync/v3/workspaceSyncV3FeedCursorKeys.js';
+import { resolveExecutorPhaseAApprovalSigningConfig } from '../services/executorPhaseAApprovalService.js';
 const SPECS = [
     { key: 'PORT', description: 'Standalone server port.', category: 'Core', defaultValue: '8080', targets: ['server', 'all'] },
     { key: 'TASKFORCE_TENANT_ID', description: 'Tenant identifier.', category: 'Core', defaultValue: 'default', targets: ['server', 'all'] },
@@ -66,7 +67,7 @@ const SPECS = [
     { key: 'TASKFORCE_SYNC_V3_LOCAL_FEED_APPLY_ENABLED', description: 'Enable the local-only atomic v3 initiative feed apply boundary.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
     { key: 'TASKFORCE_SYNC_V3_COMBINED_FEED_ENABLED', description: 'Expose registered task-planning-metadata cloud feed and repair contracts.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
     { key: 'TASKFORCE_SYNC_V3_COMBINED_FEED_ACTIVATION_ENABLED', description: 'Request combined coordinator activation; activation still requires exact local prerequisites and a matching ready cloud capability attestation.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
-    { key: 'TASKFORCE_SYNC_V3_COMBINED_FEED_COVERAGE_VERSION', description: 'Request a frozen combined-feed coverage profile by registered version. Omit for version 3; version 4 adds nested task and entity-event coverage; version 5 adds workflow runtime coverage; version 6 extends version 4 with workstream task order.', category: 'Core', defaultValue: '3', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_COMBINED_FEED_COVERAGE_VERSION', description: 'Request a frozen combined-feed coverage profile by registered version. Omit for version 3; version 4 adds nested task and entity-event coverage; version 5 adds workflow runtime coverage; version 6 adds workstream task order; version 7 adds explicit task card covers; version 8 composes workflow runtime with version 7.', category: 'Core', defaultValue: '3', targets: ['server', 'all'] },
     { key: 'TASKFORCE_SYNC_V3_COMBINED_LOCAL_FEED_APPLY_ENABLED', description: 'Enable local atomic apply for registered task-planning-metadata coverage profiles.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
     { key: 'TASKFORCE_SYNC_V3_COMBINED_LEGACY_FENCE_ENABLED', description: 'Configure the combined stale-v2 fence; it becomes effective only after every covered cloud HTTP and MCP writer boundary is ready.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
     { key: 'TASKFORCE_SYNC_V3_NESTED_LEGACY_FENCE_ENABLED', description: 'Fence the four v4-only legacy projections after every nested cloud writer boundary is ready.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
@@ -75,6 +76,7 @@ const SPECS = [
     { key: 'TASKFORCE_SYNC_V3_WORKFLOW_RUNTIME_DISPATCH_ENABLED', description: 'Enable local durable workflow runtime outbox dispatch when the shared dispatcher is enabled.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
     { key: 'TASKFORCE_SYNC_V3_WORKFLOW_RUNTIME_HTTP_ACTIVATION_ENABLED', description: 'Route workflow runtime HTTP commands through durable v3 acceptance or local capture.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
     { key: 'TASKFORCE_SYNC_V3_WORKFLOW_RUNTIME_MCP_ACTIVATION_ENABLED', description: 'Route workflow runtime MCP commands through durable v3 acceptance or local capture.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_SYNC_V3_WORKFLOW_RUNTIME_MUTATIONS_FENCED', description: 'Temporarily reject workflow execution mutations during projection rollback.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
     { key: 'TASKFORCE_SYNC_V3_WORKFLOW_RUNTIME_CARRIER_COEXISTENCE_ENABLED', description: 'Acknowledge that task-status workflow activation remains the v5 bootstrap and rollback carrier.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
     { key: 'TASKFORCE_SYNC_V3_WORKSTREAM_TASK_ORDER_ENABLED', description: 'Enable cloud acceptance for durable v3 workstream task-order operations.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
     { key: 'TASKFORCE_SYNC_V3_WORKSTREAM_TASK_ORDER_CAPTURE_ENABLED', description: 'Enable local durable workstream task-order capture when the shared local capture and dispatch boundaries are enabled.', category: 'Core', defaultValue: 'false', targets: ['server', 'all'] },
@@ -89,6 +91,10 @@ const SPECS = [
     { key: 'TASKFORCE_AUTH_EXCLUDED_PATHS', description: 'Comma-separated API paths excluded from auth checks.', category: 'Auth', defaultValue: '/api/taskforce/health,/api/taskforce/version,/api/taskforce/auth,/api/taskforce/public/pricing,/api/taskforce/public/site-config,/api/taskforce/public/site-config-script', targets: ['server', 'all'] },
     { key: 'TASKFORCE_AUTH_DEFAULT_ROLE', description: 'Default role for unauthenticated context (owner|admin|member|read-only).', category: 'Auth', defaultValue: 'member', targets: ['server', 'all'] },
     { key: 'TASKFORCE_AUTH_SESSION_COOKIE', description: 'Session cookie name.', category: 'Auth', defaultValue: 'taskforce_session', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_ADMIN_PROXY_UPSTREAM_SESSION_COOKIE', description: 'Upstream cloud session cookie name used by every admin proxy target unless overridden per environment.', category: 'Auth', defaultValue: 'taskforce_session', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_ADMIN_PROXY_UPSTREAM_SESSION_COOKIE_PRODUCTION', description: 'Optional Production upstream session cookie name override for the admin proxy.', category: 'Auth', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_ADMIN_PROXY_UPSTREAM_SESSION_COOKIE_STAGING', description: 'Optional Staging upstream session cookie name override for the admin proxy.', category: 'Auth', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_ADMIN_PROXY_UPSTREAM_SESSION_COOKIE_PERFORMANCE', description: 'Optional Performance upstream session cookie name override for the admin proxy.', category: 'Auth', targets: ['server', 'all'] },
     { key: 'TASKFORCE_AUTH_SESSION_SECRET', description: 'Session signing secret.', category: 'Auth', secret: true, targets: ['server', 'all'] },
     { key: 'TASKFORCE_AUTH_SESSION_TTL_SECONDS', description: 'Session max age in seconds.', category: 'Auth', defaultValue: '2592000', targets: ['server', 'all'] },
     { key: 'TASKFORCE_AUTH_SESSION_SAMESITE', description: 'SameSite policy (Lax|Strict|None).', category: 'Auth', defaultValue: 'None', targets: ['server', 'all'] },
@@ -146,6 +152,7 @@ const SPECS = [
     { key: 'TASKFORCE_AGENT_SUBSCRIPTION_DEV_MODELS', description: 'Enable internal local-development-only Taskforce Agent subscription-auth model adapters such as OpenAI Codex app-server.', category: 'AI', defaultValue: 'false', targets: ['server', 'all'] },
     { key: 'TASKFORCE_CODEX_APP_SERVER_COMMAND', description: 'Optional Codex CLI command path for the internal OpenAI Codex app-server Taskforce Agent adapter.', category: 'AI', defaultValue: 'codex', targets: ['server', 'all'] },
     { key: 'TASKFORCE_CODEX_APP_SERVER_CWD', description: 'Optional working directory for the internal Codex app-server subprocess. Defaults to the system temp directory.', category: 'AI', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_MODEL_CONNECTION_STORAGE_PATH', description: 'Restricted durable volume root for isolated user-owned model provider credential homes.', category: 'AI', targets: ['server', 'all'] },
     { key: 'TASKFORCE_ALLOWED_ORIGINS', description: 'Allowed CORS origins (comma-separated).', category: 'Security', targets: ['server', 'all'] },
     { key: 'TASKFORCE_API_RATE_LIMIT_ENABLED', description: 'Enable API rate limiter.', category: 'Security', defaultValue: 'true', targets: ['server', 'all'] },
     { key: 'TASKFORCE_API_RATE_LIMIT_MAX_REQUESTS', description: 'API rate limit max requests per window.', category: 'Security', defaultValue: '120', targets: ['server', 'all'] },
@@ -165,6 +172,12 @@ const SPECS = [
     { key: 'TASKFORCE_ADMIN_AUDIT_SYNC_RETENTION_DAYS', description: 'Retention period for non-routine sync audit failures and exceptional events.', category: 'Security', defaultValue: '30', targets: ['server', 'all'] },
     { key: 'TASKFORCE_ADMIN_AUDIT_RETENTION_DAYS', description: 'Default retention period for administrative and security audit events.', category: 'Security', defaultValue: '365', targets: ['server', 'all'] },
     { key: 'TASKFORCE_SYNC_KEY', description: 'Optional sync encryption key.', category: 'Security', secret: true, targets: ['server', 'all'] },
+    { key: 'TASKFORCE_GITHUB_REVIEW_APP_ID', description: 'GitHub App identifier used for private-repository review evidence.', category: 'Security', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_GITHUB_REVIEW_APP_PRIVATE_KEY_BASE64', description: 'Base64-encoded GitHub App private key used only to mint short-lived installation tokens.', category: 'Security', secret: true, targets: ['server', 'all'] },
+    { key: 'TASKFORCE_PHASE_A_APPROVAL_ISSUER_ENABLED', description: 'Enable performance-cloud Phase A approval receipt issuance.', category: 'Security', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_PHASE_A_ISSUER_REDEMPTION_ENABLED', description: 'Expose the disabled performance-cloud Phase A issuer redemption boundary.', category: 'Security', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_PHASE_A_APPROVAL_SIGNING_KEY_ID', description: 'Active source-pinned Ed25519 key ID for performance Phase A approval receipts.', category: 'Security', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_PHASE_A_APPROVAL_SIGNING_PRIVATE_KEY_PKCS8_BASE64', description: 'Base64-encoded PKCS#8 Ed25519 private key for performance Phase A approval receipts.', category: 'Security', secret: true, targets: ['server', 'all'] },
     { key: 'TASKFORCE_STRIPE_SECRET_KEY', description: 'Stripe secret API key used by server-side billing routes.', category: 'Security', secret: true, targets: ['server', 'all'] },
     { key: 'TASKFORCE_STRIPE_WEBHOOK_SECRET', description: 'Stripe webhook signing secret used to verify incoming webhooks.', category: 'Security', secret: true, targets: ['server', 'all'] },
     { key: 'TASKFORCE_BUILD_VERSION', description: 'Build version metadata.', category: 'Build', targets: ['server', 'all'] },
@@ -206,6 +219,8 @@ const SPECS = [
     { key: 'SYNC_SOAK_OVERNIGHT_MAX_ACTIONS', description: 'Overnight hard cap on action count.', category: 'Soak', defaultValue: '10000', targets: ['soak', 'all'] },
     { key: 'SYNC_SOAK_OVERNIGHT_MIN_ACTIONS', description: 'Overnight minimum actions expected before pass.', category: 'Soak', defaultValue: '80', targets: ['soak', 'all'] },
     { key: 'SYNC_SOAK_OVERNIGHT_CLEAN_BASELINE_EVERY_ACTION', description: 'Require coordinator settlement before each accelerated overnight action.', category: 'Soak', defaultValue: 'false', targets: ['soak', 'all'] },
+    { key: 'SYNC_SOAK_SERVER_FAULT_PROFILE', description: 'Deterministic server-owned sync transport fault profile (none|operation-response-loss-once).', category: 'Soak', defaultValue: 'none', targets: ['soak', 'all'] },
+    { key: 'SYNC_SOAK_CLEAN_BASELINE_TIMEOUT_MS', description: 'Bounded wait for coordinator recovery and clean-baseline settlement.', category: 'Soak', defaultValue: '180000', targets: ['soak', 'all'] },
     { key: 'CF_ACCESS_CLIENT_ID', description: 'Cloudflare Access service token client id (soak).', category: 'Cloudflare', secret: true, targets: ['soak', 'all'] },
     { key: 'CF_ACCESS_CLIENT_SECRET', description: 'Cloudflare Access service token client secret (soak).', category: 'Cloudflare', secret: true, targets: ['soak', 'all'] }
 ];
@@ -357,6 +372,38 @@ function validateServerEnv(env, errors, warnings) {
     if (provider === 'postgres' && !hasValue(env, 'TASKFORCE_DATABASE_URL')) {
         errors.push('TASKFORCE_DATABASE_URL is required when TASKFORCE_DB_PROVIDER=postgres.');
     }
+    const hasGitHubReviewAppId = hasValue(env, 'TASKFORCE_GITHUB_REVIEW_APP_ID');
+    const hasGitHubReviewPrivateKey = hasValue(env, 'TASKFORCE_GITHUB_REVIEW_APP_PRIVATE_KEY_BASE64');
+    if (hasGitHubReviewAppId !== hasGitHubReviewPrivateKey) {
+        errors.push('TASKFORCE_GITHUB_REVIEW_APP_ID and TASKFORCE_GITHUB_REVIEW_APP_PRIVATE_KEY_BASE64 must be configured together.');
+    }
+    if (hasGitHubReviewPrivateKey) {
+        const encoded = String(env.TASKFORCE_GITHUB_REVIEW_APP_PRIVATE_KEY_BASE64 || '').trim();
+        const decoded = Buffer.from(encoded, 'base64').toString('utf8');
+        if (!/^[A-Za-z0-9+/]+={0,2}$/.test(encoded) || !decoded.includes('-----BEGIN') || !decoded.includes('PRIVATE KEY-----')) {
+            errors.push('TASKFORCE_GITHUB_REVIEW_APP_PRIVATE_KEY_BASE64 must contain a base64-encoded PEM private key.');
+        }
+    }
+    const phaseAIssuerEnabled = parseBoolean(env.TASKFORCE_PHASE_A_APPROVAL_ISSUER_ENABLED) === true;
+    const phaseARedemptionEnabled = parseBoolean(env.TASKFORCE_PHASE_A_ISSUER_REDEMPTION_ENABLED) === true;
+    const hasPhaseAKeyId = hasValue(env, 'TASKFORCE_PHASE_A_APPROVAL_SIGNING_KEY_ID');
+    const hasPhaseAPrivateKey = hasValue(env, 'TASKFORCE_PHASE_A_APPROVAL_SIGNING_PRIVATE_KEY_PKCS8_BASE64');
+    if (phaseAIssuerEnabled || hasPhaseAKeyId || hasPhaseAPrivateKey) {
+        if (runtimeMode !== 'cloud' || deployment.cloudEnvironment !== 'performance') {
+            errors.push('Phase A approval receipt signing is allowed only in the performance cloud runtime.');
+        }
+    }
+    if (phaseARedemptionEnabled && (runtimeMode !== 'cloud' || deployment.cloudEnvironment !== 'performance')) {
+        errors.push('Phase A issuer redemption is allowed only in the performance cloud runtime.');
+    }
+    if (hasValue(env, 'TASKFORCE_PHASE_A_APPROVAL_ISSUER_ENABLED') || hasPhaseAKeyId || hasPhaseAPrivateKey) {
+        try {
+            resolveExecutorPhaseAApprovalSigningConfig(env);
+        }
+        catch (error) {
+            errors.push(String(error?.message || error));
+        }
+    }
     if (billingEnabled && !hasValue(env, 'TASKFORCE_STRIPE_SECRET_KEY')) {
         errors.push('TASKFORCE_STRIPE_SECRET_KEY is required when TASKFORCE_BILLING_ENABLED=true.');
     }

package/dist/core/McpTokenService.d.ts

@@ -1,5 +1,5 @@
 import type { DatabaseAdapter } from '../storage/databaseAdapter.js';
-import type { McpOAuthProvider, McpAccessTokenRecord, McpAccessTokenListResult, McpAccessTokenIssueResult, McpAccessTokenAuthResult, McpAccessTokenInspectionResult, McpOAuthClientRecord, McpOAuthConnectorGrantRecord, McpOAuthTokenExchangeResult, McpOAuthAccessTokenAuthResult } from './types.js';
+import type { McpCloudToolProfile, McpOAuthProvider, McpAccessTokenRecord, McpAccessTokenListResult, McpAccessTokenIssueResult, McpAccessTokenAuthResult, McpAccessTokenInspectionResult, McpOAuthClientRecord, McpOAuthConnectorGrantRecord, McpOAuthTokenExchangeResult, McpOAuthAccessTokenAuthResult } from './types.js';
 export interface McpTokenServiceDeps {
     /** Resolve plan/account access state for a given user */
     getAccountAccessStatus: (userId: string) => {
@@ -19,6 +19,8 @@ export declare class McpTokenService {
     private normalizeAccessRole;
     private normalizePermissionMode;
     private normalizeMcpAccessTokenScopes;
+    private normalizeMcpCloudToolProfile;
+    private requireMcpCloudToolProfile;
     private createMcpAccessTokenPrefix;
     private parseMcpAccessToken;
     private normalizeMcpOAuthProvider;
@@ -38,6 +40,7 @@ export declare class McpTokenService {
     private resolveMcpAccessTokenStatus;
     private rowToMcpAccessTokenRecord;
     private assertCanManageOwnMcpAccessToken;
+    private requireMcpToolProfileAdministrator;
     private countActiveMcpAccessTokens;
     revokeMcpCredentialsForUserWorkspace(userId: string, workspaceId: string, revokedByUserId?: string | null): void;
     revokeMcpCredentialsForWorkspace(workspaceId: string, revokedByUserId?: string | null): void;
@@ -52,6 +55,7 @@ export declare class McpTokenService {
         workspaceId: string;
         name: string;
         scopes: unknown;
+        toolProfile?: McpCloudToolProfile;
         expiresAt?: string | null;
         createdByIp?: string | null;
     }): McpAccessTokenIssueResult;
@@ -71,6 +75,15 @@ export declare class McpTokenService {
         tokenId: string;
         createdByIp?: string | null;
     }): McpAccessTokenIssueResult;
+    updateMcpAccessTokenToolProfile(input: {
+        actorUserId: string;
+        workspaceId: string;
+        tokenId: string;
+        toolProfile: unknown;
+    }): {
+        record: McpAccessTokenRecord;
+        previousToolProfile: McpCloudToolProfile;
+    };
     authenticateMcpAccessToken(token: string, workspaceId?: string): McpAccessTokenAuthResult | null;
     inspectMcpAccessToken(token: string): McpAccessTokenInspectionResult | null;
     recordMcpAccessTokenUsage(input: {
@@ -116,6 +129,15 @@ export declare class McpTokenService {
         workspaceId: string;
         grantId: string;
     }): McpOAuthConnectorGrantRecord;
+    updateMcpOAuthConnectorGrantToolProfile(input: {
+        actorUserId: string;
+        workspaceId: string;
+        grantId: string;
+        toolProfile: unknown;
+    }): {
+        record: McpOAuthConnectorGrantRecord;
+        previousToolProfile: McpCloudToolProfile;
+    };
     authenticateMcpOAuthAccessToken(token: string, workspaceId?: string): McpOAuthAccessTokenAuthResult | null;
     bindMcpOAuthConnectorGrantAiProfile(input: {
         grantId: string;

package/dist/core/McpTokenService.js

@@ -7,6 +7,7 @@ const MCP_ACCESS_TOKEN_DEFAULT_PAGE_SIZE = 20;
 const MCP_ACCESS_TOKEN_MAX_PAGE_SIZE = 100;
 const MCP_ACCESS_TOKEN_ALLOWED_SCOPES = ['tasks:read', 'tasks:write', 'workspace:read'];
 const MCP_OAUTH_AUTH_CODE_TTL_MS = 10 * 60 * 1000;
+const MCP_CLOUD_TOOL_PROFILES = ['default', 'extended'];
 /**
  * Handles MCP direct-access tokens and MCP OAuth connector flow
  * (client registration, authorization codes, token exchange, grant lifecycle).
@@ -52,6 +53,19 @@ export class McpTokenService {
         }
         return unique;
     }
+    normalizeMcpCloudToolProfile(value, fallback = 'default') {
+        const normalized = String(value || '').trim().toLowerCase();
+        return MCP_CLOUD_TOOL_PROFILES.includes(normalized)
+            ? normalized
+            : fallback;
+    }
+    requireMcpCloudToolProfile(value) {
+        const normalized = String(value || '').trim().toLowerCase();
+        if (!MCP_CLOUD_TOOL_PROFILES.includes(normalized)) {
+            throw new TaskforceRuleError('toolProfile must be default or extended', 400, 'MCP_TOOL_PROFILE_INVALID');
+        }
+        return normalized;
+    }
     createMcpAccessTokenPrefix() {
         return `tfmcp_${randomBytes(6).toString('hex')}`;
     }
@@ -204,6 +218,7 @@ export class McpTokenService {
             workspaceId: String(row?.workspace_id || ''),
             userId: String(row?.user_id || ''),
             scopes,
+            toolProfile: this.normalizeMcpCloudToolProfile(row?.tool_profile),
             tokenPrefix: String(row?.token_prefix || ''),
             status: this.resolveMcpOAuthGrantStatus(row),
             lastUsedAt: row?.last_used_at ? String(row.last_used_at) : null,
@@ -286,6 +301,7 @@ export class McpTokenService {
                 u.email AS user_email,
                 t.name,
                 t.scopes_json,
+                t.tool_profile,
                 t.token_prefix,
                 t.token_hash,
                 t.status,
@@ -331,6 +347,7 @@ export class McpTokenService {
             userEmail: row.user_email ? String(row.user_email) : null,
             name: String(row.name || ''),
             scopes,
+            toolProfile: this.normalizeMcpCloudToolProfile(row.tool_profile),
             tokenPrefix: String(row.token_prefix || ''),
             status: this.resolveMcpAccessTokenStatus(row),
             lastUsedAt: row.last_used_at ? String(row.last_used_at) : null,
@@ -353,6 +370,12 @@ export class McpTokenService {
             throw new TaskforceRuleError('Forbidden', 403, 'FORBIDDEN');
         }
     }
+    requireMcpToolProfileAdministrator(actorUserId, workspaceId) {
+        const member = this.getActiveWorkspaceMemberForMcp(actorUserId, workspaceId);
+        if (member.role !== 'owner' && member.role !== 'admin') {
+            throw new TaskforceRuleError('Workspace owner or admin access is required', 403, 'MCP_TOOL_PROFILE_ADMIN_REQUIRED');
+        }
+    }
     countActiveMcpAccessTokens(userId, workspaceId) {
         const now = new Date().toISOString();
         const row = this.db.prepare(`
@@ -446,6 +469,7 @@ export class McpTokenService {
                 u.email AS user_email,
                 t.name,
                 t.scopes_json,
+                t.tool_profile,
                 t.token_prefix,
                 t.token_hash,
                 t.status,
@@ -480,6 +504,7 @@ export class McpTokenService {
             throw new TaskforceRuleError('Token name is required', 400, 'MCP_TOKEN_NAME_REQUIRED');
         }
         const scopes = this.normalizeMcpAccessTokenScopes(input.scopes);
+        const toolProfile = this.normalizeMcpCloudToolProfile(input.toolProfile);
         const expiresAt = input.expiresAt ? String(input.expiresAt).trim() : null;
         const now = new Date().toISOString();
         if (expiresAt && expiresAt <= now) {
@@ -501,12 +526,12 @@ export class McpTokenService {
         const createdByIp = input.createdByIp ? String(input.createdByIp).trim() : null;
         this.db.prepare(`
             INSERT INTO mcp_access_tokens (
-                id, tenant_id, workspace_id, user_id, name, scopes_json, token_prefix, token_hash, status,
+                id, tenant_id, workspace_id, user_id, name, scopes_json, tool_profile, token_prefix, token_hash, status,
                 last_used_at, last_used_ip, last_used_user_agent, created_by_ip, expires_at, revoked_at,
                 revoked_by_user_id, created_at, updated_at
             )
-            VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'active', NULL, NULL, NULL, ?, ?, NULL, NULL, ?, ?)
-        `).run(tokenId, this.tenantId, member.workspaceId, member.userId, name, JSON.stringify(scopes), tokenPrefix, tokenHash, createdByIp, expiresAt, now, now);
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', NULL, NULL, NULL, ?, ?, NULL, NULL, ?, ?)
+        `).run(tokenId, this.tenantId, member.workspaceId, member.userId, name, JSON.stringify(scopes), toolProfile, tokenPrefix, tokenHash, createdByIp, expiresAt, now, now);
         const row = this.getMcpAccessTokenRow(tokenId, member.workspaceId);
         if (!row) {
             throw new TaskforceRuleError('Failed to create MCP token', 500, 'MCP_TOKEN_CREATE_FAILED');
@@ -573,18 +598,39 @@ export class McpTokenService {
                 workspaceId: revoked.workspaceId,
                 name: revoked.name,
                 scopes: revoked.scopes,
+                toolProfile: revoked.toolProfile,
                 expiresAt: revoked.expiresAt || null,
                 createdByIp: input.createdByIp || null,
             });
         });
         return tx();
     }
+    updateMcpAccessTokenToolProfile(input) {
+        this.requireMcpToolProfileAdministrator(input.actorUserId, input.workspaceId);
+        const row = this.getMcpAccessTokenRow(input.tokenId, input.workspaceId);
+        if (!row) {
+            throw new TaskforceRuleError('MCP token not found', 404, 'MCP_TOKEN_NOT_FOUND');
+        }
+        const previousToolProfile = this.normalizeMcpCloudToolProfile(row.tool_profile);
+        const toolProfile = this.requireMcpCloudToolProfile(input.toolProfile);
+        const now = new Date().toISOString();
+        this.db.prepare(`
+            UPDATE mcp_access_tokens
+            SET tool_profile = ?, updated_at = ?
+            WHERE tenant_id = ? AND workspace_id = ? AND id = ?
+        `).run(toolProfile, now, this.tenantId, input.workspaceId, row.id);
+        const updated = this.getMcpAccessTokenRow(row.id, input.workspaceId);
+        if (!updated) {
+            throw new TaskforceRuleError('MCP token not found', 404, 'MCP_TOKEN_NOT_FOUND');
+        }
+        return { record: this.rowToMcpAccessTokenRecord(updated), previousToolProfile };
+    }
     authenticateMcpAccessToken(token, workspaceId) {
         const parsed = this.parseMcpAccessToken(token);
         if (!parsed)
             return null;
         const row = this.db.prepare(`
-            SELECT id, workspace_id, user_id, scopes_json, token_hash, status, expires_at, revoked_at
+            SELECT id, workspace_id, user_id, scopes_json, tool_profile, token_hash, status, expires_at, revoked_at
             FROM mcp_access_tokens
             WHERE tenant_id = ?
               AND token_prefix = ?
@@ -612,6 +658,7 @@ export class McpTokenService {
             workspaceId: row.workspace_id,
             userId: row.user_id,
             scopes,
+            toolProfile: this.normalizeMcpCloudToolProfile(row.tool_profile),
             status,
         };
     }
@@ -620,7 +667,7 @@ export class McpTokenService {
         if (!parsed)
             return null;
         const row = this.db.prepare(`
-            SELECT id, workspace_id, user_id, name, scopes_json, token_hash, status, expires_at, revoked_at
+            SELECT id, workspace_id, user_id, name, scopes_json, tool_profile, token_hash, status, expires_at, revoked_at
             FROM mcp_access_tokens
             WHERE tenant_id = ?
               AND token_prefix = ?
@@ -644,6 +691,7 @@ export class McpTokenService {
             userId: row.user_id,
             name: String(row.name || ''),
             scopes,
+            toolProfile: this.normalizeMcpCloudToolProfile(row.tool_profile),
             status: this.resolveMcpAccessTokenStatus(row),
         };
     }
@@ -783,7 +831,7 @@ export class McpTokenService {
         const clientName = String(client.client_name || this.defaultMcpOAuthClientName(provider)).trim() || this.defaultMcpOAuthClientName(provider);
         const tx = this.db.transaction(() => {
             const existingRows = this.db.prepare(`
-                SELECT id, ai_profile_id, ai_profile_token, ai_profile_name
+                SELECT id, tool_profile, ai_profile_id, ai_profile_token, ai_profile_name
                 FROM mcp_oauth_connector_grants
                 WHERE tenant_id = ?
                   AND provider = ?
@@ -794,6 +842,7 @@ export class McpTokenService {
                 ORDER BY created_at DESC
             `).all(this.tenantId, provider, String(client.id), String(row.user_id), String(row.workspace_id));
             const previousBinding = existingRows.find((existing) => existing.ai_profile_id && existing.ai_profile_token && existing.ai_profile_name) || null;
+            const toolProfile = this.normalizeMcpCloudToolProfile(existingRows[0]?.tool_profile);
             const revokeTime = new Date().toISOString();
             existingRows.forEach((existing) => {
                 if (!existing?.id)
@@ -819,12 +868,12 @@ export class McpTokenService {
             const tokenHash = hashMcpOAuthSecret(secret);
             this.db.prepare(`
                 INSERT INTO mcp_oauth_connector_grants (
-                    id, tenant_id, provider, client_id, client_name, product_client_id, user_id, workspace_id, scopes_json,
+                    id, tenant_id, provider, client_id, client_name, product_client_id, user_id, workspace_id, scopes_json, tool_profile,
                     token_prefix, token_hash, status, last_used_at, revoked_at, revoked_by_user_id,
                     ai_profile_id, ai_profile_token, ai_profile_name, created_at, updated_at
                 )
-                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', NULL, NULL, NULL, ?, ?, ?, ?, ?)
-            `).run(grantId, this.tenantId, provider, String(client.id || ''), clientName, client.product_client_id ? String(client.product_client_id) : null, String(row.user_id), String(row.workspace_id), JSON.stringify(scopes), tokenPrefix, tokenHash, previousBinding?.ai_profile_id || null, previousBinding?.ai_profile_token || null, previousBinding?.ai_profile_name || null, now, now);
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', NULL, NULL, NULL, ?, ?, ?, ?, ?)
+            `).run(grantId, this.tenantId, provider, String(client.id || ''), clientName, client.product_client_id ? String(client.product_client_id) : null, String(row.user_id), String(row.workspace_id), JSON.stringify(scopes), toolProfile, tokenPrefix, tokenHash, previousBinding?.ai_profile_id || null, previousBinding?.ai_profile_token || null, previousBinding?.ai_profile_name || null, now, now);
             this.db.prepare(`
                 UPDATE mcp_oauth_auth_codes
                 SET used_at = ?
@@ -909,12 +958,45 @@ export class McpTokenService {
         }
         return this.rowToMcpOAuthConnectorGrantRecord(updated);
     }
+    updateMcpOAuthConnectorGrantToolProfile(input) {
+        this.requireMcpToolProfileAdministrator(input.actorUserId, input.workspaceId);
+        const row = this.db.prepare(`
+            SELECT *
+            FROM mcp_oauth_connector_grants
+            WHERE tenant_id = ? AND workspace_id = ? AND id = ?
+            LIMIT 1
+        `).get(this.tenantId, input.workspaceId, String(input.grantId || '').trim());
+        if (!row?.id) {
+            throw new TaskforceRuleError('MCP connector grant not found', 404, 'MCP_OAUTH_GRANT_NOT_FOUND');
+        }
+        const previousToolProfile = this.normalizeMcpCloudToolProfile(row.tool_profile);
+        const toolProfile = this.requireMcpCloudToolProfile(input.toolProfile);
+        const now = new Date().toISOString();
+        this.db.prepare(`
+            UPDATE mcp_oauth_connector_grants
+            SET tool_profile = ?, updated_at = ?
+            WHERE tenant_id = ? AND workspace_id = ? AND id = ?
+        `).run(toolProfile, now, this.tenantId, input.workspaceId, String(row.id));
+        const updated = this.db.prepare(`
+            SELECT *
+            FROM mcp_oauth_connector_grants
+            WHERE tenant_id = ? AND workspace_id = ? AND id = ?
+            LIMIT 1
+        `).get(this.tenantId, input.workspaceId, String(row.id));
+        if (!updated) {
+            throw new TaskforceRuleError('MCP connector grant not found', 404, 'MCP_OAUTH_GRANT_NOT_FOUND');
+        }
+        return {
+            record: this.rowToMcpOAuthConnectorGrantRecord(updated),
+            previousToolProfile,
+        };
+    }
     authenticateMcpOAuthAccessToken(token, workspaceId) {
         const parsed = this.parseMcpOAuthOpaqueSecret(token, 'tfmcpoauth_');
         if (!parsed)
             return null;
         const row = this.db.prepare(`
-            SELECT id, provider, client_id, product_client_id, user_id, workspace_id, scopes_json, token_hash, status, revoked_at,
+            SELECT id, provider, client_id, product_client_id, user_id, workspace_id, scopes_json, tool_profile, token_hash, status, revoked_at,
                    ai_profile_id, ai_profile_token, ai_profile_name
             FROM mcp_oauth_connector_grants
             WHERE tenant_id = ?
@@ -945,6 +1027,7 @@ export class McpTokenService {
             provider: this.normalizeMcpOAuthProvider(row.provider),
             productClientId: row?.product_client_id ? String(row.product_client_id) : null,
             scopes,
+            toolProfile: this.normalizeMcpCloudToolProfile(row.tool_profile),
             status: this.resolveMcpOAuthGrantStatus(row),
             aiProfileId: row?.ai_profile_id ? String(row.ai_profile_id) : null,
             aiProfileToken: row?.ai_profile_token ? String(row.ai_profile_token) : null,

package/dist/core/TaskChecklistCommandService.d.ts

@@ -9,11 +9,23 @@ export interface TaskChecklistItem {
 }
 export interface TaskChecklistTask {
     id: string;
+    checklistItems?: TaskChecklistItem[];
 }
 export interface TaskChecklistReplaceMutation {
     taskId: string;
     items: TaskChecklistItem[];
     operationId: string;
+    expectedDetailRevision?: string;
+    requireDurableIdempotency?: boolean;
+    itemUpdateIntent?: {
+        kind: 'item-update';
+        itemId: string;
+        patch: {
+            text?: string;
+            done?: boolean;
+            order?: number;
+        };
+    };
 }
 export interface TaskChecklistCommandServiceDependencies {
     resolveTask(identifier: unknown): TaskChecklistTask;
@@ -35,6 +47,9 @@ export type ReplaceTaskChecklistCommandResult = {
 export type AddTaskChecklistItemCommandResult = ReplaceTaskChecklistCommandResult & {
     item: TaskChecklistItem | null;
 };
+export type UpdateTaskChecklistItemCommandResult = ReplaceTaskChecklistCommandResult & {
+    item: TaskChecklistItem;
+};
 export declare function createTaskChecklistCommandService(deps: TaskChecklistCommandServiceDependencies): {
     replace(input: {
         taskId: unknown;
@@ -47,4 +62,16 @@ export declare function createTaskChecklistCommandService(deps: TaskChecklistCom
         isCompleted?: unknown;
         done?: unknown;
     }): AddTaskChecklistItemCommandResult;
+    update(input: {
+        taskId: unknown;
+        itemId: unknown;
+        title?: unknown;
+        text?: unknown;
+        isCompleted?: unknown;
+        done?: unknown;
+        order?: unknown;
+        expectedDetailRevision?: unknown;
+        operationId?: string;
+        requireDurableIdempotency?: boolean;
+    }): UpdateTaskChecklistItemCommandResult;
 };