@taskforcehq/taskforce 0.3.329 → 0.3.332

package/dist/server/cloudMcpCapacityTelemetry.js

@@ -0,0 +1,221 @@
+import { monitorEventLoopDelay, performance } from 'node:perf_hooks';
+export const TASKFORCE_CAPACITY_TRACE_HEADER = 'x-taskforce-capacity-trace';
+function finite(value) {
+    return Number.isFinite(value) ? Math.max(0, value) : 0;
+}
+function millisecondsFromNanoseconds(value) {
+    return finite(value) / 1_000_000;
+}
+function percentile(values, rank) {
+    if (values.length === 0)
+        return 0;
+    const sorted = [...values].sort((a, b) => a - b);
+    const index = Math.min(sorted.length - 1, Math.max(0, Math.ceil((rank / 100) * sorted.length) - 1));
+    return finite(sorted[index]);
+}
+function classifyOutcome(statusCode, aborted) {
+    if (aborted)
+        return 'timeout_or_abort';
+    if (statusCode >= 500)
+        return 'server_error';
+    if (statusCode === 401 || statusCode === 403 || statusCode === 405 || statusCode === 415 || statusCode === 429) {
+        return 'rejected';
+    }
+    if (statusCode >= 400)
+        return 'client_error';
+    return 'success';
+}
+function classifyRejection(statusCode) {
+    if (statusCode === 429)
+        return 'rate_limited';
+    if (statusCode === 401 || statusCode === 403)
+        return 'auth_or_scope';
+    if (statusCode === 405 || statusCode === 415)
+        return 'protocol';
+    return statusCode >= 400 && statusCode < 500 ? 'other_client' : null;
+}
+function classifyStatus(statusCode) {
+    if (statusCode >= 200 && statusCode < 300)
+        return '2xx';
+    if (statusCode >= 300 && statusCode < 400)
+        return '3xx';
+    if (statusCode >= 400 && statusCode < 500)
+        return '4xx';
+    if (statusCode >= 500 && statusCode < 600)
+        return '5xx';
+    return 'other';
+}
+export class CloudMcpCapacityTelemetry {
+    emit;
+    eventLoop;
+    now;
+    cpuUsage;
+    memoryUsage;
+    windowMs;
+    maxSamples;
+    activeRequests = 0;
+    maxActiveRequests = 0;
+    samples = [];
+    completedRequests = 0;
+    requestClassCounts = {};
+    outcomeCounts = {};
+    rejectionCounts = {};
+    statusClassCounts = {};
+    windowStartedAt;
+    windowCpuStartedAt;
+    flushTimer;
+    constructor(options = {}) {
+        this.emit = options.emit || ((payload) => console.info(`[Taskforce MCP] ${JSON.stringify(payload)}`));
+        this.eventLoop = options.eventLoop || monitorEventLoopDelay({ resolution: 20 });
+        this.now = options.now || (() => performance.now());
+        this.cpuUsage = options.cpuUsage || process.cpuUsage.bind(process);
+        this.memoryUsage = options.memoryUsage || process.memoryUsage.bind(process);
+        this.windowMs = Math.max(1_000, options.windowMs || 60_000);
+        this.maxSamples = Math.max(10, options.maxSamples || 2_048);
+        this.windowStartedAt = this.now();
+        this.windowCpuStartedAt = this.cpuUsage();
+        this.eventLoop.enable();
+        this.flushTimer = setInterval(() => this.flush(), this.windowMs);
+        this.flushTimer.unref?.();
+    }
+    begin(requestClass = 'other') {
+        const startedAt = this.now();
+        let settled = false;
+        let currentClass = requestClass;
+        this.activeRequests += 1;
+        this.maxActiveRequests = Math.max(this.maxActiveRequests, this.activeRequests);
+        return {
+            classify: (nextClass) => {
+                currentClass = nextClass;
+            },
+            setTraceHeaders: (res, postgres) => {
+                if (res.headersSent)
+                    return;
+                const memory = this.memoryUsage();
+                res.setHeader('X-Taskforce-MCP-Active-Requests', String(this.activeRequests));
+                res.setHeader('X-Taskforce-MCP-Max-Active-Requests', String(this.maxActiveRequests));
+                res.setHeader('X-Taskforce-Event-Loop-P95-Ms', millisecondsFromNanoseconds(this.eventLoop.percentile(95)).toFixed(2));
+                res.setHeader('X-Taskforce-Event-Loop-Max-Ms', millisecondsFromNanoseconds(this.eventLoop.max).toFixed(2));
+                res.setHeader('X-Taskforce-Process-RSS-Bytes', String(memory.rss));
+                res.setHeader('X-Taskforce-Process-Heap-Used-Bytes', String(memory.heapUsed));
+                if (postgres) {
+                    res.setHeader('X-Taskforce-Postgres-Worker-Wait-Ms', postgres.postgresWorkerWaitMs.toFixed(2));
+                    res.setHeader('X-Taskforce-Postgres-Worker-Wait-Max-Ms', postgres.postgresWorkerWaitMaxMs.toFixed(2));
+                    res.setHeader('X-Taskforce-Postgres-Pool-Waiting-Max', String(postgres.postgresPoolWaitingMax));
+                    res.setHeader('X-Taskforce-Postgres-Pool-Total-Max', String(postgres.postgresPoolTotalMax));
+                    if (postgres.postgresPoolIdleMin !== null) {
+                        res.setHeader('X-Taskforce-Postgres-Pool-Idle-Min', String(postgres.postgresPoolIdleMin));
+                    }
+                }
+            },
+            finish: (input) => {
+                if (settled)
+                    return;
+                settled = true;
+                this.activeRequests = Math.max(0, this.activeRequests - 1);
+                const outcome = classifyOutcome(input.statusCode, input.aborted === true);
+                this.completedRequests += 1;
+                this.requestClassCounts[currentClass] = (this.requestClassCounts[currentClass] || 0) + 1;
+                this.outcomeCounts[outcome] = (this.outcomeCounts[outcome] || 0) + 1;
+                const rejection = classifyRejection(input.statusCode);
+                if (rejection)
+                    this.rejectionCounts[rejection] = (this.rejectionCounts[rejection] || 0) + 1;
+                const statusClass = classifyStatus(input.statusCode);
+                this.statusClassCounts[statusClass] = (this.statusClassCounts[statusClass] || 0) + 1;
+                this.samples.push({
+                    requestClass: currentClass,
+                    outcome,
+                    durationMs: finite(this.now() - startedAt),
+                    postgres: input.postgres,
+                });
+                if (this.samples.length > this.maxSamples)
+                    this.samples.splice(0, this.samples.length - this.maxSamples);
+                this.flushIfDue();
+            },
+        };
+    }
+    snapshot() {
+        const memory = this.memoryUsage();
+        const durations = this.samples.map((sample) => sample.durationMs);
+        const workerWaits = this.samples.map((sample) => sample.postgres?.postgresWorkerWaitMs || 0);
+        const cpu = this.cpuUsage(this.windowCpuStartedAt);
+        return {
+            event: 'cloud_mcp_capacity_window',
+            windowMs: Math.max(0, Math.round(this.now() - this.windowStartedAt)),
+            requests: this.completedRequests,
+            activeRequests: this.activeRequests,
+            maxActiveRequests: this.maxActiveRequests,
+            requestClasses: { ...this.requestClassCounts },
+            outcomes: { ...this.outcomeCounts },
+            rejections: { ...this.rejectionCounts },
+            statusClasses: { ...this.statusClassCounts },
+            durationMs: { p50: percentile(durations, 50), p95: percentile(durations, 95), p99: percentile(durations, 99) },
+            eventLoopDelayMs: {
+                p50: millisecondsFromNanoseconds(this.eventLoop.percentile(50)),
+                p95: millisecondsFromNanoseconds(this.eventLoop.percentile(95)),
+                p99: millisecondsFromNanoseconds(this.eventLoop.percentile(99)),
+                max: millisecondsFromNanoseconds(this.eventLoop.max),
+            },
+            process: {
+                cpuUserMs: finite(cpu.user / 1_000),
+                cpuSystemMs: finite(cpu.system / 1_000),
+                rssBytes: memory.rss,
+                heapUsedBytes: memory.heapUsed,
+                heapTotalBytes: memory.heapTotal,
+                externalBytes: memory.external,
+            },
+            postgres: {
+                workerWaitMsP95: percentile(workerWaits, 95),
+                maxPoolWaiting: Math.max(0, ...this.samples.map((sample) => sample.postgres?.postgresPoolWaitingMax || 0)),
+                maxPoolTotal: Math.max(0, ...this.samples.map((sample) => sample.postgres?.postgresPoolTotalMax || 0)),
+                minPoolIdle: this.minimumPoolIdle(),
+            },
+        };
+    }
+    flush() {
+        if (this.completedRequests === 0 && this.activeRequests === 0)
+            return null;
+        const payload = this.snapshot();
+        this.emit(payload);
+        this.samples = [];
+        this.completedRequests = 0;
+        this.requestClassCounts = {};
+        this.outcomeCounts = {};
+        this.rejectionCounts = {};
+        this.statusClassCounts = {};
+        this.maxActiveRequests = this.activeRequests;
+        this.windowStartedAt = this.now();
+        this.windowCpuStartedAt = this.cpuUsage();
+        this.eventLoop.reset();
+        return payload;
+    }
+    shutdown() {
+        clearInterval(this.flushTimer);
+        this.eventLoop.disable?.();
+    }
+    flushIfDue() {
+        if (this.now() - this.windowStartedAt >= this.windowMs)
+            this.flush();
+    }
+    minimumPoolIdle() {
+        const values = this.samples
+            .map((sample) => sample.postgres?.postgresPoolIdleMin)
+            .filter((value) => typeof value === 'number');
+        return values.length > 0 ? Math.min(...values) : null;
+    }
+}
+let defaultTelemetry = null;
+export function isCloudMcpCapacityTelemetryEnabled() {
+    return process.env.TASKFORCE_CLOUD_MCP_CAPACITY_TELEMETRY !== '0';
+}
+export function beginCloudMcpCapacityRequest(requestClass = 'other') {
+    if (!isCloudMcpCapacityTelemetryEnabled()) {
+        return {
+            classify: (_nextClass) => undefined,
+            setTraceHeaders: (_res, _postgres) => undefined,
+            finish: (_input) => undefined,
+        };
+    }
+    defaultTelemetry ||= new CloudMcpCapacityTelemetry();
+    return defaultTelemetry.begin(requestClass);
+}

package/dist/server/index.d.ts

@@ -9,6 +9,7 @@ import { WebSocketServer } from 'ws';
 export { resolveAuthorizedWorkspaceAccess, resolveDisabledAccessError, isWorkspaceAccessRecoveryRoute, } from './authorizedWorkspaceAccess.js';
 import type { LocalServiceCloudTarget } from '../config/localServiceCloudTarget.js';
 import type { LocalServiceRuntimeContract } from '../config/localServiceRuntimeContract.js';
+import { type TaskforceCloudEnvironment } from '../config/cloudEnvironment.js';
 import type { LocalSyncCoordinatorHost } from '../sync/coordinator/localSyncCoordinatorHost.js';
 import type { LocalSyncProcessLock } from '../sync/coordinator/localSyncProcessLock.js';
 import type { LocalDataOwnerPermit } from './localDataOwnerPermit.js';
@@ -60,6 +61,8 @@ export declare function writeJsonErrorIfPossible(res: http.ServerResponse, statu
 export declare function applyCloudProxyForwardedHeaders(headers: Headers, req: http.IncomingMessage): void;
 export declare function rewriteProxySetCookieForLocalHost(cookie: string): string;
 export declare function shouldRewriteProxySetCookieDomain(cookie: string, hostHeader: string | undefined): boolean;
+export declare function applyAdminProxyRequestSession(headers: Headers, environment: TaskforceCloudEnvironment, env?: NodeJS.ProcessEnv): void;
+export declare function rewriteAdminProxyResponseCookies(setCookies: string[], environment: TaskforceCloudEnvironment, requestHost: string | undefined, env?: NodeJS.ProcessEnv): string[];
 export declare function shouldForwardCloudProxyResponseHeader(name: string): boolean;
 export declare function shouldApplyAuthRateLimitForPath(pathname: string): boolean;
 export declare function resolveCloudProxyBaseUrl(env?: NodeJS.ProcessEnv): string;

package/dist/server/index.js

@@ -31,14 +31,17 @@ import { TaskAssetStore } from '../storage/taskAssetStore.js';
 import { validateEnvironment } from '../config/envSchema.js';
 import { createRealtimeSyncWsManager } from './realtimeSyncWs.js';
 import { resolveDeploymentConfig } from '../config/deployment.js';
-import { TASKFORCE_CLOUD_ENVIRONMENTS, parseTaskforceCloudEnvironment } from '../config/cloudEnvironment.js';
-import { resolveWorkflowRuntimeMutationCapability } from '../sync/v3/durableWorkflowRuntimeMutationRouter.js';
+import { TASKFORCE_CLOUD_ENVIRONMENTS, parseTaskforceCloudEnvironment, } from '../config/cloudEnvironment.js';
+import { resolveAllAdminProxyUpstreamSessionCookieNames, resolveAdminProxyUpstreamSessionCookieName, rewriteAdminProxyRequestCookieHeader, rewriteAdminProxyResponseSetCookie, } from '../shared/adminProxySessionCookies.js';
+import { areWorkflowRuntimeMutationsFenced, resolveWorkflowRuntimeMutationCapability, } from '../sync/v3/durableWorkflowRuntimeMutationRouter.js';
 import { createWorkspaceSyncCloudCredentialValidator } from '../sync/coordinator/workspaceSyncCloudCredentialValidator.js';
 import { bootstrapVerifiedWorkspaceSyncAccess } from '../sync/coordinator/workspaceSyncLocalAccessBootstrap.js';
 import { rewriteSetCookieForLocalHost } from '../utils/httpSetCookie.js';
 import { createWorkspaceSyncServerComposition, shutdownWorkspaceSyncServerComposition, } from './localWorkspaceSyncServerComposition.js';
 import { LocalServiceSessionManager } from './localServiceSessions.js';
 import { LocalSyncIdentityStore } from '../sync/v3/localSyncIdentityStore.js';
+import { pruneExpiredWorkspaceSyncRepairSnapshots, resolveWorkspaceSyncRepairSnapshotRetentionPolicy, } from '../sync/v3/workspaceSyncV3RepairSnapshotRetentionService.js';
+import { pruneRetainedWorkspaceSyncOperations, WORKSPACE_SYNC_OPERATION_RETENTION_INTERVAL_MS, } from '../sync/v3/workspaceSyncOperationRetentionService.js';
 import { shouldBroadcastLocalFileInvalidation } from './localRealtimeFileInvalidation.js';
 import { resolveCloudCollectionReadOperation, } from './cloudCollectionRead.js';
 import { CloudCollectionReadPool, resolveCloudCollectionReadPoolSize, shouldUseCloudCollectionReadPool, } from './cloudCollectionReadPool.js';
@@ -261,7 +264,11 @@ export function shouldProxyCloudPath(pathname) {
         || pathname.startsWith('/api/taskforce/admin/')
         || pathname.startsWith('/api/taskforce/billing/')
         || pathname.startsWith('/api/taskforce/auth/')
+        || pathname === '/api/taskforce/model-connections'
+        || pathname.startsWith('/api/taskforce/model-connections/')
+        || pathname === '/api/taskforce/agents/model-catalog'
         || pathname === '/api/taskforce/agents/model-gateway/test'
+        || /^\/api\/taskforce\/agents\/[^/]+\/connection-binding$/i.test(pathname)
         || isCloudOwnedUserAvatarContextPath(pathname)
         || isTaskforceAgentAvatarGenerationPath(pathname)
         || pathname.startsWith('/api/taskforce/settings/mcp/')
@@ -282,6 +289,8 @@ export function shouldProxyCloudRequest(url, env = process.env) {
     if (isWorkspaceAiProfileAvatarContextPath(url.pathname))
         return true;
     if (/^\/api\/taskforce\/workflow-executions\/[^/]+\/complete-step$/.test(url.pathname)) {
+        if (areWorkflowRuntimeMutationsFenced(env))
+            return false;
         return !resolveWorkflowRuntimeMutationCapability({
             runtimeMode: 'local',
             surface: 'http',
@@ -410,6 +419,26 @@ export function shouldRewriteProxySetCookieDomain(cookie, hostHeader) {
         return false;
     return !requestHost.endsWith(`.${cookieDomain}`);
 }
+export function applyAdminProxyRequestSession(headers, environment, env = process.env) {
+    const upstreamSessionCookieName = resolveAdminProxyUpstreamSessionCookieName(environment, env);
+    const rewrittenCookie = rewriteAdminProxyRequestCookieHeader(headers.get('cookie'), environment, upstreamSessionCookieName, resolveAllAdminProxyUpstreamSessionCookieNames(env));
+    if (rewrittenCookie)
+        headers.set('cookie', rewrittenCookie);
+    else
+        headers.delete('cookie');
+}
+export function rewriteAdminProxyResponseCookies(setCookies, environment, requestHost, env = process.env) {
+    const upstreamSessionCookieName = resolveAdminProxyUpstreamSessionCookieName(environment, env);
+    return setCookies.map((cookie) => {
+        const environmentScopedCookie = rewriteAdminProxyResponseSetCookie(cookie, environment, upstreamSessionCookieName);
+        if (shouldRewriteSetCookieForLocalDevHost(requestHost)) {
+            return rewriteProxySetCookieForLocalHost(environmentScopedCookie);
+        }
+        return shouldRewriteProxySetCookieDomain(environmentScopedCookie, requestHost)
+            ? rewriteProxySetCookieForLocalHost(environmentScopedCookie)
+            : environmentScopedCookie;
+    });
+}
 export function shouldForwardCloudProxyResponseHeader(name) {
     const normalizedName = String(name || '').trim().toLowerCase();
     if (!normalizedName)
@@ -612,7 +641,7 @@ export function createStandaloneServer(options) {
     }
     let localServiceServer = null;
     const localServiceSessions = options.localService
-        ? new LocalServiceSessionManager(options.localService.generation)
+        ? new LocalServiceSessionManager(options.localService.generation, core.getDatabaseAdapter(), core.getTenantId(), options.localService.runtimeContract)
         : null;
     const routes = createRoutes(core, {
         authConfig,
@@ -835,6 +864,9 @@ export function createStandaloneServer(options) {
     const adminAuditRetentionEnabled = runtimeMode === 'cloud'
         && process.env.TASKFORCE_ADMIN_AUDIT_RETENTION_ENABLED !== 'false';
     const adminAuditRetentionIntervalMinutes = readPositiveInteger(process.env.TASKFORCE_ADMIN_AUDIT_RETENTION_INTERVAL_MINUTES, 15);
+    const repairSnapshotRetentionEnabled = runtimeMode === 'cloud'
+        && process.env.TASKFORCE_SYNC_REPAIR_SNAPSHOT_RETENTION_ENABLED !== 'false';
+    const repairSnapshotRetentionIntervalMinutes = readPositiveInteger(process.env.TASKFORCE_SYNC_REPAIR_SNAPSHOT_RETENTION_INTERVAL_MINUTES, 1);
     const server = http.createServer(async (req, res) => {
         const requestStartedAt = getRequestTimingNow();
         if (!distUiPath) {
@@ -887,6 +919,7 @@ export function createStandaloneServer(options) {
             }
             try {
                 const method = String(req.method || 'GET').toUpperCase();
+                const adminProxyEnvironment = parseTaskforceCloudEnvironment(req.headers[TASKFORCE_PROXY_CLOUD_ENVIRONMENT_HEADER]);
                 const upstreamBaseUrl = resolveCloudProxyUpstreamBaseUrl(req, cloudProxyBaseUrl);
                 const upstreamUrl = `${upstreamBaseUrl}${url.pathname}${url.search || ''}`;
                 const headers = new Headers();
@@ -904,6 +937,9 @@ export function createStandaloneServer(options) {
                         continue;
                     headers.set(key, serialized);
                 }
+                if (adminProxyEnvironment) {
+                    applyAdminProxyRequestSession(headers, adminProxyEnvironment);
+                }
                 applyCloudProxyForwardedHeaders(headers, req);
                 if (cloudProxyClientId && cloudProxyClientSecret) {
                     headers.set('CF-Access-Client-Id', cloudProxyClientId);
@@ -925,17 +961,22 @@ export function createStandaloneServer(options) {
                         continue;
                     outgoingHeaders[key] = value;
                 }
+                if (adminProxyEnvironment) {
+                    outgoingHeaders['cache-control'] = 'no-store';
+                }
                 const setCookies = upstream.headers.getSetCookie?.();
                 if (Array.isArray(setCookies) && setCookies.length > 0) {
                     const requestHost = String(req.headers.host || '').trim();
-                    const normalizedSetCookies = setCookies.map((cookie) => {
-                        if (shouldRewriteSetCookieForLocalDevHost(requestHost)) {
-                            return rewriteProxySetCookieForLocalHost(cookie);
-                        }
-                        return shouldRewriteProxySetCookieDomain(cookie, requestHost)
-                            ? rewriteProxySetCookieForLocalHost(cookie)
-                            : cookie;
-                    });
+                    const normalizedSetCookies = adminProxyEnvironment
+                        ? rewriteAdminProxyResponseCookies(setCookies, adminProxyEnvironment, requestHost)
+                        : setCookies.map((cookie) => {
+                            if (shouldRewriteSetCookieForLocalDevHost(requestHost)) {
+                                return rewriteProxySetCookieForLocalHost(cookie);
+                            }
+                            return shouldRewriteProxySetCookieDomain(cookie, requestHost)
+                                ? rewriteProxySetCookieForLocalHost(cookie)
+                                : cookie;
+                        });
                     res.setHeader('Set-Cookie', normalizedSetCookies);
                 }
                 res.writeHead(upstream.status, outgoingHeaders);
@@ -1180,6 +1221,8 @@ export function createStandaloneServer(options) {
     let purgeTimer = null;
     let integrityScheduleTimer = null;
     let adminAuditRetentionTimer = null;
+    let repairSnapshotRetentionTimer = null;
+    let operationRetentionTimer = null;
     let watcher = null;
     let shutdownPromise = null;
     Object.defineProperty(server, 'localSyncCoordinatorHost', {
@@ -1204,6 +1247,14 @@ export function createStandaloneServer(options) {
                 clearInterval(adminAuditRetentionTimer);
                 adminAuditRetentionTimer = null;
             }
+            if (repairSnapshotRetentionTimer) {
+                clearInterval(repairSnapshotRetentionTimer);
+                repairSnapshotRetentionTimer = null;
+            }
+            if (operationRetentionTimer) {
+                clearInterval(operationRetentionTimer);
+                operationRetentionTimer = null;
+            }
             if (localSyncPermitRecoveryTimer) {
                 clearInterval(localSyncPermitRecoveryTimer);
                 localSyncPermitRecoveryTimer = null;
@@ -1257,6 +1308,52 @@ export function createStandaloneServer(options) {
             adminAuditRetentionTimer = setInterval(runAdminAuditRetention, adminAuditRetentionIntervalMinutes * 60_000);
             adminAuditRetentionTimer.unref?.();
         }
+        const runRepairSnapshotRetention = () => {
+            try {
+                const result = pruneExpiredWorkspaceSyncRepairSnapshots({
+                    db: core.getDatabaseAdapter(),
+                    tenantId: core.getTenantId(),
+                    policy: resolveWorkspaceSyncRepairSnapshotRetentionPolicy(),
+                });
+                if (result.deletedEntries > 0
+                    || result.deletedSnapshots > 0
+                    || result.remainingExpiredSnapshots > 0) {
+                    console.log('[Taskforce] Sync repair snapshot retention: '
+                        + `deletedEntries=${result.deletedEntries} `
+                        + `deletedSnapshots=${result.deletedSnapshots} `
+                        + `remainingExpiredSnapshots=${result.remainingExpiredSnapshots}`);
+                }
+            }
+            catch (error) {
+                console.warn(`[Taskforce] Sync repair snapshot retention failed: ${String(error?.message || error)}`);
+            }
+        };
+        if (repairSnapshotRetentionEnabled) {
+            runRepairSnapshotRetention();
+            repairSnapshotRetentionTimer = setInterval(runRepairSnapshotRetention, repairSnapshotRetentionIntervalMinutes * 60_000);
+            repairSnapshotRetentionTimer.unref?.();
+        }
+        const runOperationRetention = () => {
+            try {
+                const result = pruneRetainedWorkspaceSyncOperations({
+                    db: core.getDatabaseAdapter(),
+                    tenantId: core.getTenantId(),
+                });
+                if (result.deletedOutbox > 0 || result.deletedResults > 0 || result.remainingEligible > 0) {
+                    console.log('[Taskforce] Sync operation retention: '
+                        + `deletedOutbox=${result.deletedOutbox} `
+                        + `deletedResults=${result.deletedResults} `
+                        + `remainingEligible=${result.remainingEligible} `
+                        + `workspacesProcessed=${result.workspacesProcessed}`);
+                }
+            }
+            catch (error) {
+                console.warn(`[Taskforce] Sync operation retention failed: ${String(error?.message || error)}`);
+            }
+        };
+        runOperationRetention();
+        operationRetentionTimer = setInterval(runOperationRetention, WORKSPACE_SYNC_OPERATION_RETENTION_INTERVAL_MS);
+        operationRetentionTimer.unref?.();
         const appendDocumentPurgeHistory = (summary) => {
             const settings = core.getGlobalSettings();
             const existing = Array.isArray(settings?.documentPurgeHistory)

package/dist/server/localDatabaseIdentity.js

@@ -3,6 +3,9 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 const SAFE_POSIX_SOCKET_PATH_BYTES = 100;
+function defaultTemporaryDirectory(platform) {
+    return platform === 'darwin' ? '/tmp' : os.tmpdir();
+}
 function canonicalizePath(value) {
     const resolved = path.resolve(value);
     const missingSegments = [];
@@ -39,7 +42,7 @@ export function resolveLocalSyncProcessLockIdentity(input) {
         };
     }
     const socketName = `taskforce-sync-${shortKey}.sock`;
-    const requestedEndpoint = path.join(input.tempDirectory || os.tmpdir(), socketName);
+    const requestedEndpoint = path.join(input.tempDirectory || defaultTemporaryDirectory(platform), socketName);
     const endpoint = Buffer.byteLength(requestedEndpoint) <= SAFE_POSIX_SOCKET_PATH_BYTES
         ? requestedEndpoint
         : path.join('/tmp', socketName);

package/dist/server/localServiceLease.js

@@ -21,7 +21,8 @@ function defaultRuntimeDirectory(platform) {
     const userKey = typeof process.getuid === 'function'
         ? String(process.getuid())
         : createHash('sha256').update(os.userInfo().username).digest('hex').slice(0, 16);
-    return path.join(os.tmpdir(), `taskforce-${userKey}`, 'local-services');
+    const temporaryDirectory = platform === 'darwin' ? '/tmp' : os.tmpdir();
+    return path.join(temporaryDirectory, `taskforce-${userKey}`, 'local-services');
 }
 export function resolveLocalServiceLeaseIdentity(input) {
     const ownershipKey = resolveLocalSyncProcessLockIdentity(input).ownershipKey;

package/dist/server/localServiceSessions.d.ts

@@ -1,9 +1,10 @@
 import type { McpAccessTokenScope } from '../core/Taskforce.js';
+import type { LocalServiceRuntimeContract } from '../config/localServiceRuntimeContract.js';
 import type { McpClientId } from '../mcp/clientRegistry.js';
 import type { McpToolProfile } from '../mcp/toolRegistry.js';
+import type { DatabaseAdapter } from '../storage/databaseAdapter.js';
 export declare const LOCAL_SERVICE_SESSION_IDLE_TTL_MS: number;
 export declare const LOCAL_SERVICE_SESSION_CAP = 256;
-export declare const LOCAL_SERVICE_OPERATION_BINDING_CAP = 4096;
 export declare const LOCAL_SERVICE_CANCELLATION_BINDING_CAP = 1024;
 export declare const LOCAL_SERVICE_CANCELLATION_TOMBSTONE_TTL_MS = 60000;
 export interface LocalServiceSessionRegistration {
@@ -17,34 +18,35 @@ export interface LocalServiceSessionRegistration {
 }
 export interface LocalServiceSession extends LocalServiceSessionRegistration {
     id: string;
+    runtimeContract: LocalServiceRuntimeContract;
     createdAt: string;
     lastUsedAt: string;
+    expiresAt: string;
+    revokedAt: string | null;
     aiProfileId: string | null;
 }
 export type LocalServiceLifecycleState = 'accepting' | 'draining' | 'forcing';
-export interface LocalServiceOperationBinding {
-    sessionId: string;
-    operationId: string;
-    mutationKind: string;
-    payloadFingerprint: string;
-    recordedAt: string;
-}
 export declare class LocalServiceSessionError extends Error {
     readonly statusCode: number;
     readonly code: string;
     constructor(message: string, statusCode: number, code: string);
 }
+export declare function ensureLocalServiceCredentialSchema(db: DatabaseAdapter): void;
 export declare class LocalServiceSessionManager {
     readonly generation: string;
+    private readonly db;
+    private readonly tenantId;
+    readonly runtimeContract: LocalServiceRuntimeContract;
     private readonly options;
-    private readonly sessions;
     private readonly inFlightBySession;
-    private readonly operationBindings;
     private readonly cancellationBindings;
     private readonly cancellationTombstones;
     private readonly drainWaiters;
     private lifecycleState;
-    constructor(generation: string, options?: {
+    private readonly runtimeContractJson;
+    private readonly authenticateStatement;
+    private readonly touchStatement;
+    constructor(generation: string, db: DatabaseAdapter, tenantId: string, runtimeContract: LocalServiceRuntimeContract, options?: {
         nowMs?: () => number;
         randomId?: () => string;
         randomSecret?: () => string;
@@ -63,6 +65,7 @@ export declare class LocalServiceSessionManager {
         touch?: boolean;
     }): LocalServiceSession | null;
     revoke(id: string): boolean;
+    private hasActiveCredential;
     beginRequest(id: string): void;
     endRequest(id: string): void;
     inFlightCount(): number;
@@ -73,12 +76,6 @@ export declare class LocalServiceSessionManager {
     revokeAll(): void;
     registerCancellation(sessionId: string, correlationId: string, cancel: () => void): () => void;
     cancelRequest(sessionId: string, correlationId: string): boolean;
-    recordOperation(input: Omit<LocalServiceOperationBinding, 'recordedAt'>): LocalServiceOperationBinding;
-    getOperationBinding(sessionId: string, operationId: string, expected?: {
-        mutationKind?: string | null;
-        payloadFingerprint?: string | null;
-    }): LocalServiceOperationBinding | null;
-    private removeOperationBindings;
     private removeCancellationBindings;
     private pruneCancellationTombstones;
     bindAiProfile(id: string, profileId: string): LocalServiceSession;