@taskforcehq/taskforce 0.3.329 → 0.3.332

package/dist/server/localServiceSessions.js

@@ -1,7 +1,6 @@
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from 'crypto';
 export const LOCAL_SERVICE_SESSION_IDLE_TTL_MS = 24 * 60 * 60 * 1_000;
 export const LOCAL_SERVICE_SESSION_CAP = 256;
-export const LOCAL_SERVICE_OPERATION_BINDING_CAP = 4_096;
 export const LOCAL_SERVICE_CANCELLATION_BINDING_CAP = 1_024;
 export const LOCAL_SERVICE_CANCELLATION_TOMBSTONE_TTL_MS = 60_000;
 export class LocalServiceSessionError extends Error {
@@ -14,41 +13,174 @@ export class LocalServiceSessionError extends Error {
     }
 }
 function digestToken(token) {
-    return createHash('sha256').update(token, 'utf8').digest();
+    return createHash('sha256').update(token, 'utf8').digest('hex');
 }
 function publicSession(session) {
-    const { tokenDigest: _tokenDigest, lastUsedAtMs: _lastUsedAtMs, ...result } = session;
-    return { ...result, permissions: [...result.permissions] };
+    const { tokenDigest: _tokenDigest, ...result } = session;
+    return {
+        ...result,
+        permissions: [...result.permissions],
+        runtimeContract: { ...result.runtimeContract },
+    };
+}
+function runtimeContractJson(contract) {
+    return JSON.stringify({
+        schemaVersion: contract.schemaVersion,
+        fingerprint: contract.fingerprint,
+        coverageVersion: contract.coverageVersion,
+    });
+}
+function parsePermissions(value) {
+    try {
+        const parsed = JSON.parse(String(value || '[]'));
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+}
+function storedSession(row) {
+    return {
+        id: String(row.id || ''),
+        tokenDigest: String(row.token_digest || ''),
+        workspaceId: String(row.workspace_id || ''),
+        clientId: String(row.client_id || ''),
+        connectionInstance: String(row.connection_instance || ''),
+        permissions: parsePermissions(row.permissions_json),
+        toolProfile: String(row.tool_profile || ''),
+        protocolVersion: String(row.protocol_version || ''),
+        generation: String(row.generation || ''),
+        runtimeContract: JSON.parse(String(row.runtime_contract_json || '{}')),
+        aiProfileId: row.ai_profile_id ? String(row.ai_profile_id) : null,
+        createdAt: String(row.created_at || ''),
+        lastUsedAt: String(row.last_used_at || ''),
+        expiresAt: String(row.expires_at || ''),
+        revokedAt: row.revoked_at ? String(row.revoked_at) : null,
+    };
+}
+export function ensureLocalServiceCredentialSchema(db) {
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS local_service_credential_generations (
+            tenant_id TEXT PRIMARY KEY,
+            generation TEXT NOT NULL,
+            runtime_contract_json TEXT NOT NULL,
+            activated_at TEXT NOT NULL
+        );
+
+        CREATE TABLE IF NOT EXISTS local_service_credentials (
+            tenant_id TEXT NOT NULL,
+            id TEXT NOT NULL,
+            token_digest TEXT NOT NULL,
+            workspace_id TEXT NOT NULL,
+            client_id TEXT NOT NULL,
+            connection_instance TEXT NOT NULL,
+            permissions_json TEXT NOT NULL,
+            tool_profile TEXT NOT NULL,
+            protocol_version TEXT NOT NULL,
+            generation TEXT NOT NULL,
+            runtime_contract_json TEXT NOT NULL,
+            ai_profile_id TEXT,
+            created_at TEXT NOT NULL,
+            last_used_at TEXT NOT NULL,
+            expires_at TEXT NOT NULL,
+            revoked_at TEXT,
+            PRIMARY KEY (tenant_id, id)
+        );
+
+        CREATE UNIQUE INDEX IF NOT EXISTS local_service_credentials_active_connection
+            ON local_service_credentials (
+                tenant_id, generation, workspace_id, client_id, connection_instance
+            )
+            WHERE revoked_at IS NULL;
+
+        CREATE INDEX IF NOT EXISTS local_service_credentials_active_generation
+            ON local_service_credentials (tenant_id, generation, expires_at)
+            WHERE revoked_at IS NULL;
+    `);
 }
 export class LocalServiceSessionManager {
     generation;
+    db;
+    tenantId;
+    runtimeContract;
     options;
-    sessions = new Map();
     inFlightBySession = new Map();
-    operationBindings = new Map();
     cancellationBindings = new Map();
     cancellationTombstones = new Map();
     drainWaiters = new Set();
     lifecycleState = 'accepting';
-    constructor(generation, options = {}) {
+    runtimeContractJson;
+    authenticateStatement;
+    touchStatement;
+    constructor(generation, db, tenantId, runtimeContract, options = {}) {
         this.generation = generation;
+        this.db = db;
+        this.tenantId = tenantId;
+        this.runtimeContract = runtimeContract;
         this.options = options;
+        this.runtimeContractJson = runtimeContractJson(runtimeContract);
+        ensureLocalServiceCredentialSchema(db);
+        this.authenticateStatement = db.prepare(`
+            SELECT c.*,
+                   g.generation AS active_generation,
+                   g.runtime_contract_json AS active_runtime_contract_json
+            FROM local_service_credentials AS c
+            LEFT JOIN local_service_credential_generations AS g
+              ON g.tenant_id = c.tenant_id
+            WHERE c.tenant_id = ? AND c.id = ?
+            LIMIT 1
+        `);
+        this.touchStatement = db.prepare(`
+            UPDATE local_service_credentials
+            SET last_used_at = ?, expires_at = ?
+            WHERE tenant_id = ? AND id = ? AND generation = ?
+              AND runtime_contract_json = ? AND revoked_at IS NULL AND expires_at > ?
+        `);
+        const activatedAt = new Date(this.nowMs()).toISOString();
+        db.transaction(() => {
+            const existing = db.prepare(`
+                SELECT generation, runtime_contract_json
+                FROM local_service_credential_generations
+                WHERE tenant_id = ?
+                LIMIT 1
+            `).get(tenantId);
+            if (existing?.generation === generation
+                && existing.runtime_contract_json !== this.runtimeContractJson) {
+                throw new LocalServiceSessionError('Local service runtime contract mismatch for the active generation.', 409, 'RUNTIME_CONTRACT_MISMATCH');
+            }
+            db.prepare(`
+                INSERT INTO local_service_credential_generations (
+                    tenant_id, generation, runtime_contract_json, activated_at
+                ) VALUES (?, ?, ?, ?)
+                ON CONFLICT (tenant_id) DO UPDATE SET
+                    generation = excluded.generation,
+                    runtime_contract_json = excluded.runtime_contract_json,
+                    activated_at = excluded.activated_at
+            `).run(tenantId, generation, this.runtimeContractJson, activatedAt);
+        })();
     }
     nowMs() {
         return this.options.nowMs?.() ?? Date.now();
     }
     prune() {
-        const cutoff = this.nowMs() - (this.options.idleTtlMs ?? LOCAL_SERVICE_SESSION_IDLE_TTL_MS);
-        let pruned = 0;
-        for (const [id, session] of this.sessions) {
-            if (session.lastUsedAtMs > cutoff)
+        const now = new Date(this.nowMs()).toISOString();
+        const expired = this.db.prepare(`
+            SELECT id
+            FROM local_service_credentials
+            WHERE tenant_id = ? AND revoked_at IS NULL AND expires_at <= ?
+        `).all(this.tenantId, now);
+        const result = this.db.prepare(`
+            UPDATE local_service_credentials
+            SET revoked_at = ?
+            WHERE tenant_id = ? AND revoked_at IS NULL AND expires_at <= ?
+        `).run(now, this.tenantId, now);
+        for (const row of expired) {
+            const id = String(row.id || '');
+            if (!id)
                 continue;
-            this.sessions.delete(id);
-            this.removeOperationBindings(id);
             this.removeCancellationBindings(id);
-            pruned += 1;
         }
-        return pruned;
+        return Number(result?.changes || 0);
     }
     create(input, options = {}) {
         this.prune();
@@ -58,64 +190,142 @@ export class LocalServiceSessionManager {
         if (input.generation !== this.generation) {
             throw new LocalServiceSessionError('Local service generation mismatch.', 409, 'GENERATION_MISMATCH');
         }
-        if (this.sessions.size >= (this.options.cap ?? LOCAL_SERVICE_SESSION_CAP)) {
-            throw new LocalServiceSessionError('Local service session capacity reached.', 503, 'SESSION_CAPACITY_REACHED');
-        }
-        const connectionInUse = Array.from(this.sessions.values()).some((session) => (session.workspaceId === input.workspaceId
-            && session.clientId === input.clientId
-            && session.connectionInstance === input.connectionInstance));
-        if (connectionInUse) {
-            throw new LocalServiceSessionError('This client connection instance already has an active local service session.', 409, 'CONNECTION_INSTANCE_IN_USE');
-        }
         const id = this.options.randomId?.() ?? randomUUID();
         const secret = this.options.randomSecret?.() ?? randomBytes(32).toString('base64url');
         const token = `${id}.${secret}`;
         const nowMs = this.nowMs();
         const now = new Date(nowMs).toISOString();
+        const expiresAt = new Date(nowMs + (this.options.idleTtlMs ?? LOCAL_SERVICE_SESSION_IDLE_TTL_MS)).toISOString();
         const stored = {
             ...input,
             permissions: [...new Set(input.permissions)],
             id,
+            runtimeContract: { ...this.runtimeContract },
             createdAt: now,
             lastUsedAt: now,
-            lastUsedAtMs: nowMs,
+            expiresAt,
+            revokedAt: null,
             aiProfileId: options.aiProfileId || null,
             tokenDigest: digestToken(token),
         };
-        this.sessions.set(id, stored);
+        this.db.transaction(() => {
+            const activeGeneration = this.db.prepare(`
+                SELECT generation, runtime_contract_json
+                FROM local_service_credential_generations
+                WHERE tenant_id = ?
+                LIMIT 1
+            `).get(this.tenantId);
+            if (activeGeneration?.generation !== this.generation) {
+                throw new LocalServiceSessionError('Local service generation mismatch.', 409, 'GENERATION_MISMATCH');
+            }
+            if (activeGeneration.runtime_contract_json !== this.runtimeContractJson) {
+                throw new LocalServiceSessionError('Local service runtime contract mismatch.', 409, 'RUNTIME_CONTRACT_MISMATCH');
+            }
+            const activeCount = this.db.prepare(`
+                SELECT COUNT(*) AS count
+                FROM local_service_credentials
+                WHERE tenant_id = ? AND generation = ? AND runtime_contract_json = ?
+                  AND revoked_at IS NULL AND expires_at > ?
+            `).get(this.tenantId, this.generation, this.runtimeContractJson, now);
+            if (Number(activeCount?.count || 0) >= (this.options.cap ?? LOCAL_SERVICE_SESSION_CAP)) {
+                throw new LocalServiceSessionError('Local service session capacity reached.', 503, 'SESSION_CAPACITY_REACHED');
+            }
+            const connectionInUse = this.db.prepare(`
+                SELECT 1 AS active
+                FROM local_service_credentials
+                WHERE tenant_id = ? AND generation = ? AND workspace_id = ?
+                  AND client_id = ? AND connection_instance = ?
+                  AND revoked_at IS NULL AND expires_at > ?
+                LIMIT 1
+            `).get(this.tenantId, this.generation, input.workspaceId, input.clientId, input.connectionInstance, now);
+            if (connectionInUse) {
+                throw new LocalServiceSessionError('This client connection instance already has an active local service session.', 409, 'CONNECTION_INSTANCE_IN_USE');
+            }
+            this.db.prepare(`
+                INSERT INTO local_service_credentials (
+                    tenant_id, id, token_digest, workspace_id, client_id, connection_instance,
+                    permissions_json, tool_profile, protocol_version, generation,
+                    runtime_contract_json, ai_profile_id, created_at, last_used_at, expires_at, revoked_at
+                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)
+            `).run(this.tenantId, stored.id, stored.tokenDigest, stored.workspaceId, stored.clientId, stored.connectionInstance, JSON.stringify(stored.permissions), stored.toolProfile, stored.protocolVersion, stored.generation, this.runtimeContractJson, stored.aiProfileId, stored.createdAt, stored.lastUsedAt, stored.expiresAt);
+        })();
         return { session: publicSession(stored), token };
     }
     authenticate(token, options = {}) {
-        this.prune();
         const separator = token.indexOf('.');
         const id = separator > 0 ? token.slice(0, separator) : '';
-        const candidate = this.sessions.get(id);
-        const actualDigest = digestToken(token);
-        const expectedDigest = candidate?.tokenDigest ?? Buffer.alloc(actualDigest.length);
-        if (!candidate || !timingSafeEqual(actualDigest, expectedDigest))
+        if (!id)
             return null;
-        if (candidate.generation !== this.generation)
+        const row = this.authenticateStatement.get(this.tenantId, id);
+        const actualDigest = Buffer.from(digestToken(token), 'hex');
+        const expectedDigest = Buffer.from(String(row?.token_digest || '').padEnd(64, '0').slice(0, 64), 'hex');
+        if (!row || expectedDigest.length !== actualDigest.length
+            || !timingSafeEqual(actualDigest, expectedDigest))
             return null;
-        if (options.touch !== false) {
-            const nowMs = this.nowMs();
-            candidate.lastUsedAtMs = nowMs;
-            candidate.lastUsedAt = new Date(nowMs).toISOString();
+        if (row.generation !== this.generation || row.active_generation !== this.generation) {
+            throw new LocalServiceSessionError('Local service generation mismatch.', 409, 'GENERATION_MISMATCH');
+        }
+        if (row.runtime_contract_json !== this.runtimeContractJson
+            || row.active_runtime_contract_json !== this.runtimeContractJson) {
+            throw new LocalServiceSessionError('Local service runtime contract mismatch.', 409, 'RUNTIME_CONTRACT_MISMATCH');
+        }
+        const nowMs = this.nowMs();
+        const now = new Date(nowMs).toISOString();
+        if (row.revoked_at || String(row.expires_at || '') <= now) {
+            if (!row.revoked_at) {
+                this.db.prepare(`
+                    UPDATE local_service_credentials
+                    SET revoked_at = ?
+                    WHERE tenant_id = ? AND id = ? AND revoked_at IS NULL
+                `).run(now, this.tenantId, id);
+            }
+            return null;
+        }
+        const idleTtlMs = this.options.idleTtlMs ?? LOCAL_SERVICE_SESSION_IDLE_TTL_MS;
+        const touchIntervalMs = Math.min(60_000, Math.max(1, Math.floor(idleTtlMs / 2)));
+        const lastUsedAtMs = Date.parse(String(row.last_used_at || ''));
+        if (options.touch !== false
+            && (!Number.isFinite(lastUsedAtMs) || nowMs - lastUsedAtMs >= touchIntervalMs)) {
+            const expiresAt = new Date(nowMs + idleTtlMs).toISOString();
+            const touched = this.touchStatement.run(now, expiresAt, this.tenantId, id, this.generation, this.runtimeContractJson, now);
+            if (Number(touched?.changes || 0) !== 1)
+                return null;
+            row.last_used_at = now;
+            row.expires_at = expiresAt;
         }
-        return publicSession(candidate);
+        return publicSession(storedSession(row));
     }
     revoke(id) {
-        const revoked = this.sessions.delete(id);
-        if (revoked)
-            this.removeOperationBindings(id);
+        const now = new Date(this.nowMs()).toISOString();
+        const result = this.db.transaction(() => this.db.prepare(`
+            UPDATE local_service_credentials
+            SET revoked_at = ?
+            WHERE tenant_id = ? AND id = ? AND generation = ?
+              AND runtime_contract_json = ? AND revoked_at IS NULL
+        `).run(now, this.tenantId, id, this.generation, this.runtimeContractJson))();
+        const revoked = Number(result?.changes || 0) === 1;
         if (revoked)
             this.removeCancellationBindings(id);
         return revoked;
     }
+    hasActiveCredential(id) {
+        const now = new Date(this.nowMs()).toISOString();
+        return Boolean(this.db.prepare(`
+            SELECT 1 AS active
+            FROM local_service_credentials AS c
+            JOIN local_service_credential_generations AS g ON g.tenant_id = c.tenant_id
+            WHERE c.tenant_id = ? AND c.id = ?
+              AND c.generation = ? AND g.generation = ?
+              AND c.runtime_contract_json = ? AND g.runtime_contract_json = ?
+              AND c.revoked_at IS NULL AND c.expires_at > ?
+            LIMIT 1
+        `).get(this.tenantId, id, this.generation, this.generation, this.runtimeContractJson, this.runtimeContractJson, now));
+    }
     beginRequest(id) {
         if (this.lifecycleState !== 'accepting') {
             throw new LocalServiceSessionError('Local service is shutting down.', 503, 'SERVICE_QUIESCING');
         }
-        if (!this.sessions.has(id)) {
+        if (!this.hasActiveCredential(id)) {
             throw new LocalServiceSessionError('Local service session not found.', 401, 'SESSION_NOT_FOUND');
         }
         this.inFlightBySession.set(id, (this.inFlightBySession.get(id) || 0) + 1);
@@ -152,7 +362,7 @@ export class LocalServiceSessionManager {
             throw new LocalServiceSessionError('Local service is already shutting down.', 409, 'SERVICE_QUIESCING');
         }
         if (mode === 'refuse') {
-            if (this.sessions.size > 0 || this.inFlightCount() > 0) {
+            if (this.activeCount() > 0 || this.inFlightCount() > 0) {
                 throw new LocalServiceSessionError('Active sessions prevent shutdown.', 409, 'ACTIVE_SESSIONS');
             }
             this.lifecycleState = 'draining';
@@ -189,13 +399,18 @@ export class LocalServiceSessionManager {
     revokeAll() {
         for (const cancel of this.cancellationBindings.values())
             cancel();
-        this.sessions.clear();
-        this.operationBindings.clear();
+        const now = new Date(this.nowMs()).toISOString();
+        this.db.transaction(() => this.db.prepare(`
+            UPDATE local_service_credentials
+            SET revoked_at = ?
+            WHERE tenant_id = ? AND generation = ? AND runtime_contract_json = ?
+              AND revoked_at IS NULL
+        `).run(now, this.tenantId, this.generation, this.runtimeContractJson))();
         this.cancellationBindings.clear();
         this.cancellationTombstones.clear();
     }
     registerCancellation(sessionId, correlationId, cancel) {
-        if (!this.sessions.has(sessionId)) {
+        if (!this.hasActiveCredential(sessionId)) {
             throw new LocalServiceSessionError('Local service session not found.', 401, 'SESSION_NOT_FOUND');
         }
         const key = `${sessionId}:${correlationId}`;
@@ -213,7 +428,7 @@ export class LocalServiceSessionManager {
         };
     }
     cancelRequest(sessionId, correlationId) {
-        if (!this.sessions.has(sessionId))
+        if (!this.hasActiveCredential(sessionId))
             return false;
         this.pruneCancellationTombstones();
         const key = `${sessionId}:${correlationId}`;
@@ -230,44 +445,6 @@ export class LocalServiceSessionManager {
         this.cancellationTombstones.set(key, this.nowMs() + LOCAL_SERVICE_CANCELLATION_TOMBSTONE_TTL_MS);
         return true;
     }
-    recordOperation(input) {
-        if (!this.sessions.has(input.sessionId)) {
-            throw new LocalServiceSessionError('Local service session not found.', 401, 'SESSION_NOT_FOUND');
-        }
-        const key = `${input.sessionId}:${input.operationId}`;
-        const existing = this.operationBindings.get(key);
-        if (existing && (existing.mutationKind !== input.mutationKind
-            || existing.payloadFingerprint !== input.payloadFingerprint)) {
-            throw new LocalServiceSessionError('Operation identity conflicts with an earlier payload in this session.', 409, 'OPERATION_IDENTITY_CONFLICT');
-        }
-        if (existing)
-            return existing;
-        if (this.operationBindings.size >= LOCAL_SERVICE_OPERATION_BINDING_CAP) {
-            const oldestKey = this.operationBindings.keys().next().value;
-            if (oldestKey)
-                this.operationBindings.delete(oldestKey);
-        }
-        const binding = { ...input, recordedAt: new Date(this.nowMs()).toISOString() };
-        this.operationBindings.set(key, binding);
-        return binding;
-    }
-    getOperationBinding(sessionId, operationId, expected) {
-        const binding = this.operationBindings.get(`${sessionId}:${operationId}`) || null;
-        if (!binding)
-            return null;
-        if (expected?.mutationKind && expected.mutationKind !== binding.mutationKind)
-            return null;
-        if (expected?.payloadFingerprint && expected.payloadFingerprint !== binding.payloadFingerprint)
-            return null;
-        return { ...binding };
-    }
-    removeOperationBindings(sessionId) {
-        const prefix = `${sessionId}:`;
-        for (const key of this.operationBindings.keys()) {
-            if (key.startsWith(prefix))
-                this.operationBindings.delete(key);
-        }
-    }
     removeCancellationBindings(sessionId) {
         const prefix = `${sessionId}:`;
         for (const [key, cancel] of this.cancellationBindings) {
@@ -289,21 +466,58 @@ export class LocalServiceSessionManager {
         }
     }
     bindAiProfile(id, profileId) {
-        const session = this.sessions.get(id);
-        if (!session)
-            throw new LocalServiceSessionError('Local service session not found.', 401, 'SESSION_NOT_FOUND');
-        if (session.aiProfileId && session.aiProfileId !== profileId) {
-            throw new LocalServiceSessionError('This local service session is already bound to a different AI profile.', 409, 'AI_PROFILE_BINDING_CONFLICT');
-        }
-        session.aiProfileId = profileId;
-        return publicSession(session);
+        const now = new Date(this.nowMs()).toISOString();
+        return this.db.transaction(() => {
+            const row = this.db.prepare(`
+                SELECT *
+                FROM local_service_credentials
+                WHERE tenant_id = ? AND id = ? AND generation = ?
+                  AND runtime_contract_json = ? AND revoked_at IS NULL AND expires_at > ?
+                LIMIT 1
+            `).get(this.tenantId, id, this.generation, this.runtimeContractJson, now);
+            if (!row) {
+                throw new LocalServiceSessionError('Local service session not found.', 401, 'SESSION_NOT_FOUND');
+            }
+            if (row.ai_profile_id && row.ai_profile_id !== profileId) {
+                throw new LocalServiceSessionError('This local service session is already bound to a different AI profile.', 409, 'AI_PROFILE_BINDING_CONFLICT');
+            }
+            if (!row.ai_profile_id) {
+                const result = this.db.prepare(`
+                    UPDATE local_service_credentials
+                    SET ai_profile_id = ?
+                    WHERE tenant_id = ? AND id = ? AND ai_profile_id IS NULL
+                      AND generation = ? AND runtime_contract_json = ?
+                      AND revoked_at IS NULL AND expires_at > ?
+                `).run(profileId, this.tenantId, id, this.generation, this.runtimeContractJson, now);
+                if (Number(result?.changes || 0) !== 1) {
+                    throw new LocalServiceSessionError('This local service session could not be bound.', 409, 'AI_PROFILE_BINDING_CONFLICT');
+                }
+                row.ai_profile_id = profileId;
+            }
+            return publicSession(storedSession(row));
+        })();
     }
     activeCount() {
         this.prune();
-        return this.sessions.size;
+        const now = new Date(this.nowMs()).toISOString();
+        const row = this.db.prepare(`
+            SELECT COUNT(*) AS count
+            FROM local_service_credentials
+            WHERE tenant_id = ? AND generation = ? AND runtime_contract_json = ?
+              AND revoked_at IS NULL AND expires_at > ?
+        `).get(this.tenantId, this.generation, this.runtimeContractJson, now);
+        return Number(row?.count || 0);
     }
     list() {
         this.prune();
-        return Array.from(this.sessions.values(), publicSession);
+        const now = new Date(this.nowMs()).toISOString();
+        const rows = this.db.prepare(`
+            SELECT *
+            FROM local_service_credentials
+            WHERE tenant_id = ? AND generation = ? AND runtime_contract_json = ?
+              AND revoked_at IS NULL AND expires_at > ?
+            ORDER BY created_at, id
+        `).all(this.tenantId, this.generation, this.runtimeContractJson, now);
+        return rows.map((row) => publicSession(storedSession(row)));
     }
 }

package/dist/server/localWorkspaceSyncServerRuntime.js

@@ -3,7 +3,7 @@ import { LocalSyncCoordinatorStore } from '../sync/coordinator/localSyncCoordina
 import { LocalSyncDispatchTracker } from '../sync/coordinator/localSyncDispatchTracker.js';
 import { LocalSyncExecutionPermitStore } from '../sync/coordinator/localSyncExecutionPermitStore.js';
 import { LocalSyncOwnershipDrainBarrier } from '../sync/coordinator/localSyncOwnershipDrainBarrier.js';
-import { LocalWorkspaceSyncRunner, } from '../sync/coordinator/localWorkspaceSyncRunner.js';
+import { canCoordinatorRecoveryPreemptRetry, LocalWorkspaceSyncRunner, } from '../sync/coordinator/localWorkspaceSyncRunner.js';
 import { reconcileSettledV3DispatchRecoveryObligations, } from '../sync/coordinator/localSyncV3DispatchRecoveryReconciler.js';
 import { LocalWorkspaceSyncRunnerStateStore } from '../sync/coordinator/localWorkspaceSyncRunnerState.js';
 import { WorkspaceSyncCredentialBroker, } from '../sync/coordinator/workspaceSyncCredentialBroker.js';
@@ -15,7 +15,7 @@ import { createWorkspaceSyncEngineServerRunnerOperations } from '../sync/engine/
 import { workspaceSyncTransferEvidenceEvent } from '../sync/engine/workspaceSyncTransferEvidence.js';
 import { createWorkspaceSyncEngineServerPushCandidateProvider, createWorkspaceSyncEngineServerSnapshotReader, } from '../sync/engine/workspaceSyncEngineServerSnapshotReader.js';
 import { readWorkspaceSyncLocalOwnershipSnapshot } from '../sync/v3/workspaceSyncLocalOwnershipSnapshot.js';
-import { resolveRequestedCombinedFeedCoverage } from '../sync/v3/combinedFeedCapability.js';
+import { resolveCombinedFeedCapability } from '../sync/v3/combinedFeedCapability.js';
 import { resolveWorkspaceSyncV3CombinedWireContract, } from '../sync/v3/workspaceSyncV3CombinedWireContract.js';
 import { LocalWorkspaceSyncServerOutboxDispatcher, } from '../sync/v3/localWorkspaceSyncServerOutboxDispatcher.js';
 import { readWorkspaceSyncV3LocalOutboxStatus, } from '../sync/v3/workspaceSyncV3LocalOutboxStatus.js';
@@ -518,7 +518,13 @@ export class LocalWorkspaceSyncServerRuntime {
         if (!status.checkpoint?.checkpoint.syncEnabled)
             return;
         const retry = status.checkpoint.checkpoint.retry;
-        if (retry && Date.parse(retry.retryAt) > this.now().getTime()) {
+        const coordinatorRecoveryPlan = this.permitStore.inspectAuthoritativeRepairRecoveryObligations(bundle.context.workspaceId);
+        const retryWaiting = Boolean(retry && Date.parse(retry.retryAt) > this.now().getTime());
+        const recoveryPreemptsRetry = Boolean(retryWaiting
+            && retry
+            && coordinatorRecoveryPlan.total > 0
+            && canCoordinatorRecoveryPreemptRetry(retry.kind));
+        if (retryWaiting && retry && !recoveryPreemptsRetry) {
             // Authoritative repair cannot proceed while covered local
             // operations remain active. Keep settling those operations during
             // the repair backoff window so a dependency that becomes due
@@ -534,9 +540,8 @@ export class LocalWorkspaceSyncServerRuntime {
             }
             return;
         }
-        const retryDue = Boolean(retry);
+        const retryDue = Boolean(retry) && !recoveryPreemptsRetry;
         const wakeEpoch = this.ordinaryWakeEpoch;
-        const coordinatorRecoveryPlan = this.permitStore.inspectAuthoritativeRepairRecoveryObligations(bundle.context.workspaceId);
         if (retry?.kind === 'v2-content-push') {
             // This retry exists specifically to publish content required by a
             // blocked durable operation. Re-dispatching that same operation
@@ -585,7 +590,10 @@ export class LocalWorkspaceSyncServerRuntime {
             || state.coordinatorGeneration !== bundle.context.coordinatorGeneration) {
             return;
         }
-        if (retryDue) {
+        if (recoveryPreemptsRetry) {
+            await bundle.runner.recoverCoordinatorObligationsDue(() => this.permitStore.inspectAuthoritativeRepairRecoveryObligations(bundle.context.workspaceId).total > 0);
+        }
+        else if (retryDue) {
             await bundle.runner.retryDue();
         }
         else if (wakeSources.size === 1
@@ -945,29 +953,27 @@ export class LocalWorkspaceSyncServerRuntime {
                     workspaceId,
                 });
                 const combined = ownership.combinedProjection;
+                const configuredCombined = resolveCombinedFeedCapability({
+                    runtimeMode: 'local',
+                    env: this.options.env || process.env,
+                }).combinedFeed;
                 const combinedContract = combined.owner === 'v3'
                     ? resolveWorkspaceSyncV3CombinedWireContract(combined)
                     : null;
                 if (combined.owner === 'v3' && !combinedContract) {
                     throw Object.assign(new Error('The persisted combined-feed ownership contract is invalid.'), { code: 'SYNC_RUNNER_V3_OWNERSHIP_INVALID' });
                 }
-                const desiredCombinedCoverage = combined.owner === 'v3'
-                    ? resolveRequestedCombinedFeedCoverage(this.options.env || process.env)
-                    : null;
-                const desiredCombinedContract = desiredCombinedCoverage
-                    ? resolveWorkspaceSyncV3CombinedWireContract(desiredCombinedCoverage)
-                    : null;
+                const desiredCombinedContract = resolveWorkspaceSyncV3CombinedWireContract(configuredCombined.coverage);
+                if (!desiredCombinedContract) {
+                    throw Object.assign(new Error('The configured combined-feed ownership contract is invalid.'), { code: 'SYNC_RUNNER_V3_OWNERSHIP_INVALID' });
+                }
                 return {
                     initiativeFeedActivationEnabled: ownership.initiativeProjection.owner === 'v3',
                     initiativeProjection: ownership.initiativeProjection,
-                    combinedFeedActivationEnabled: combined.owner === 'v3',
+                    combinedFeedActivationEnabled: configuredCombined.activationReady,
                     combinedProjection: combined,
-                    ...(combinedContract && desiredCombinedContract
-                        ? {
-                            combinedFeedCoverage: desiredCombinedContract.coverage,
-                            combinedFeedExcludedProjections: desiredCombinedContract.excludedProjections,
-                        }
-                        : {}),
+                    combinedFeedCoverage: desiredCombinedContract.coverage,
+                    combinedFeedExcludedProjections: desiredCombinedContract.excludedProjections,
                 };
             },
             createLocalServices: ({ checkpointPort }) => {

package/dist/server/routes/admin.d.ts

@@ -21,6 +21,7 @@
  *   GET       /api/taskforce/admin/collaboration-telemetry
  *   PATCH     /api/taskforce/admin/system-users/:id/disable
  *   PATCH     /api/taskforce/admin/system-users/:id/beta-access
+ *   PATCH     /api/taskforce/admin/system-users/:id/feature-grants/:featureKey
  *   PATCH     /api/taskforce/admin/system-users/:id/verify-email
  *   GET/POST  /api/taskforce/admin/email-settings
  *   GET       /api/taskforce/admin/email-settings/health
@@ -48,8 +49,10 @@
  *   GET/POST  /oauth/mcp/authorize
  *   POST      /oauth/mcp/token
  *   GET/POST  /api/taskforce/settings/mcp/tokens (+ revoke, regenerate)
+ *   PATCH     /api/taskforce/settings/mcp/tokens/:id/tool-profile
  *   GET       /api/taskforce/settings/mcp/connectors
  *   POST      /api/taskforce/settings/mcp/connectors/:id/disconnect
+ *   PATCH     /api/taskforce/settings/mcp/connectors/:id/tool-profile
  *   POST      /api/taskforce/settings/mcp/test-connection
  */
 import type { IncomingMessage, ServerResponse } from 'http';
@@ -68,6 +71,7 @@ export interface AdminRouteDependencies {
     requestRole: (req: IncomingMessage) => string;
     ensureAppAccess: (req: IncomingMessage, res: ServerResponse) => boolean;
     ensureAdminRole: (req: IncomingMessage) => boolean;
+    ensureWorkspaceAdminRole: (req: IncomingMessage, workspaceIdOverride?: string | null) => boolean;
     ensureCloudPlanData: (req: IncomingMessage, res: ServerResponse) => boolean;
     requireCloudRuntime: (res: ServerResponse, feature: string) => boolean;
     resolveAuthenticatedUserId: (req: IncomingMessage) => string;