@taskforcehq/taskforce 0.3.329 → 0.3.332

package/dist/server/routes/admin.js

@@ -21,6 +21,7 @@
  *   GET       /api/taskforce/admin/collaboration-telemetry
  *   PATCH     /api/taskforce/admin/system-users/:id/disable
  *   PATCH     /api/taskforce/admin/system-users/:id/beta-access
+ *   PATCH     /api/taskforce/admin/system-users/:id/feature-grants/:featureKey
  *   PATCH     /api/taskforce/admin/system-users/:id/verify-email
  *   GET/POST  /api/taskforce/admin/email-settings
  *   GET       /api/taskforce/admin/email-settings/health
@@ -48,14 +49,17 @@
  *   GET/POST  /oauth/mcp/authorize
  *   POST      /oauth/mcp/token
  *   GET/POST  /api/taskforce/settings/mcp/tokens (+ revoke, regenerate)
+ *   PATCH     /api/taskforce/settings/mcp/tokens/:id/tool-profile
  *   GET       /api/taskforce/settings/mcp/connectors
  *   POST      /api/taskforce/settings/mcp/connectors/:id/disconnect
+ *   PATCH     /api/taskforce/settings/mcp/connectors/:id/tool-profile
  *   POST      /api/taskforce/settings/mcp/test-connection
  */
 import * as fs from 'fs';
 import * as path from 'path';
 import { TaskforceRuleError } from '../../core/Taskforce.js';
 import { classifyMcpOAuthClientProduct } from '../../mcp/clientRegistry.js';
+import { getCloudMcpToolProfileMembership } from '../../mcp/toolProfiles.js';
 import { escapeHtml, formatApiErrorResponse, parseFormBody, parseJsonBody } from './primitives.js';
 import { resolveRequestAccess } from '../auth.js';
 import { sendEmail } from '../email.js';
@@ -70,19 +74,27 @@ import { randomUUID } from 'crypto';
 import { resolveDeploymentConfig } from '../../config/deployment.js';
 import { getTaskforceCloudEnvironmentConfig, resolveTaskforceCloudEnvironmentFromBaseUrl, resolveTaskforceMcpBaseUrlFromBaseUrl } from '../../config/cloudEnvironment.js';
 import { makeHandleCloudMcpRequest, resolveErrorStatusCode } from './shared.js';
+import * as mcpRuntime from '../../mcp/runtime.js';
 import { buildAuthBehavior, buildSiteBehavior, getRouteEmailConfig, resolvePublicAuthBaseUrl, resolveRuntimeConfigBaseUrl, } from './authSupport.js';
 import { applyWorkspaceRepair, scanWorkspaceRepair } from '../../sync/workspaceRepair.js';
 import { testMintAppleClientSecret } from '../auth/providers/appleClientSecret.js';
 import { isAiProfileAvatarStorageKey } from '../../utils/aiProfileAvatarPaths.js';
+import { WorkspaceSyncContentPullObligationStore } from '../../sync/engine/workspaceSyncContentPullObligationStore.js';
+import { isSupportedInternalUserFeatureKey } from '../../shared/userFeatureGrants.js';
 const PRICING_PAGE_DESCRIPTION_MAX_LENGTH = 2000;
 const OPENAI_APPS_CHALLENGE_TOKEN = 'o9iBeJDuKPMtnKm5-B8OROga3bWDkJS6PBIg6JT9Izs';
 // === SECTION: Registration ===
 export function registerAdminRoutes(deps) {
-    const { addRoute, core, context, requestWorkspaceId, requestUserId, requestRole, ensureAppAccess, ensureAdminRole, ensureCloudPlanData, requireCloudRuntime, resolveAuthenticatedUserId, resolveAdminRequestActor, auditAdminAction, resolveEffectiveObjectStorageConfig, getObjectStorageClient, taskAssetStore, publishedContentResolver, normalizeDocumentPathInput, ensureWithinDir, getAssetMetadata, markAssetDeleted, clearAssetDeleted, removeAssetMetadata, getStorageTelemetry, appendStorageTelemetry, getStorageIntegrityHistory, appendStorageIntegrityHistory, getDocumentPurgeHistory, appendDocumentPurgeHistory, getCollaborationTelemetry, isCollaborationPolicyEnabled, normalizeMcpOauthScopeString, MCP_TOKEN_SCOPE_VALUES, MCP_WRITE_RATE_LIMIT_ENABLED, MCP_WRITE_RATE_LIMIT_ACTOR_MAX_REQUESTS, MCP_WRITE_RATE_LIMIT_WORKSPACE_MAX_REQUESTS, MCP_WRITE_RATE_LIMIT_WINDOW_MS, } = deps;
+    const { addRoute, core, context, requestWorkspaceId, requestUserId, requestRole, ensureAppAccess, ensureAdminRole, ensureWorkspaceAdminRole, ensureCloudPlanData, requireCloudRuntime, resolveAuthenticatedUserId, resolveAdminRequestActor, auditAdminAction, resolveEffectiveObjectStorageConfig, getObjectStorageClient, taskAssetStore, publishedContentResolver, normalizeDocumentPathInput, ensureWithinDir, getAssetMetadata, markAssetDeleted, clearAssetDeleted, removeAssetMetadata, getStorageTelemetry, appendStorageTelemetry, getStorageIntegrityHistory, appendStorageIntegrityHistory, getDocumentPurgeHistory, appendDocumentPurgeHistory, getCollaborationTelemetry, isCollaborationPolicyEnabled, normalizeMcpOauthScopeString, MCP_TOKEN_SCOPE_VALUES, MCP_WRITE_RATE_LIMIT_ENABLED, MCP_WRITE_RATE_LIMIT_ACTOR_MAX_REQUESTS, MCP_WRITE_RATE_LIMIT_WORKSPACE_MAX_REQUESTS, MCP_WRITE_RATE_LIMIT_WINDOW_MS, } = deps;
     const baseVirusScanConfig = resolveVirusScanConfigFromEnv(process.env);
     const workspaceAssetStore = typeof core.getDatabaseAdapter === 'function' && typeof core.getTenantId === 'function'
         ? new WorkspaceAssetStore(core.getDatabaseAdapter(), core.getTenantId())
         : null;
+    const mcpToolProfileOptions = ['default', 'extended'].map((id) => ({
+        id,
+        label: id === 'extended' ? 'All cloud tools' : 'Standard',
+        toolCount: getCloudMcpToolProfileMembership(id).length,
+    }));
     const listReferencedAiProfileAvatarStorageKeys = (workspaceId) => {
         const referenced = new Set();
         const profiles = typeof core.listAiProfiles === 'function'
@@ -334,6 +346,8 @@ export function registerAdminRoutes(deps) {
     const handleCloudMcpRequest = makeHandleCloudMcpRequest(core, {
         ensureAppAccess,
         resolveAuthenticatedUserId,
+        // Keep the production factory unchanged while preserving the route-test injection seam.
+        createMcpServer: (options) => mcpRuntime.createTaskforceMcpServer(options),
         writeRateLimit: {
             enabled: MCP_WRITE_RATE_LIMIT_ENABLED,
             actorMaxRequests: MCP_WRITE_RATE_LIMIT_ACTOR_MAX_REQUESTS,
@@ -1039,6 +1053,42 @@ export function registerAdminRoutes(deps) {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ success: true }));
     });
+    // PATCH /api/taskforce/admin/system-users/:id/feature-grants/:featureKey - Grant/revoke an internal user feature
+    addRoute('PATCH', '/api/taskforce/admin/system-users/:id/feature-grants/:featureKey', async (req, res, params) => {
+        if (!ensureAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: system admin role required.' }));
+            return;
+        }
+        if (!requireCloudRuntime(res, 'Internal user feature grants'))
+            return;
+        const featureKey = String(params.featureKey || '').trim();
+        if (!isSupportedInternalUserFeatureKey(featureKey)) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Unsupported internal feature key.' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        if (typeof body?.enabled !== 'boolean') {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'enabled must be a boolean.' }));
+            return;
+        }
+        const actor = resolveAdminRequestActor(req);
+        const success = core.setUserFeatureGrant(params.id, featureKey, body.enabled, actor.userId);
+        if (!success) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'User not found' }));
+            return;
+        }
+        auditAdminAction(req, 'set-user-feature-grant', {
+            targetUserId: params.id,
+            featureKey,
+            enabled: body.enabled,
+        });
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ success: true, featureKey, enabled: body.enabled }));
+    });
     // PATCH /api/taskforce/admin/system-users/:id/verify-email - Mark a user's email as verified
     addRoute('PATCH', '/api/taskforce/admin/system-users/:id/verify-email', async (req, res, params) => {
         if (!ensureAdminRole(req)) {
@@ -1954,6 +2004,7 @@ export function registerAdminRoutes(deps) {
             publishedContentResolver,
             repairMissingAssetLinks: true,
             repairMissingContentFiles: body?.repairMissingContentFiles === true,
+            contentPullObligationStore: new WorkspaceSyncContentPullObligationStore(core.getDatabaseAdapter()),
             aiProfiles: typeof core.listAiProfiles === 'function'
                 ? core.listAiProfiles(workspaceId, { includeArchived: true }) || []
                 : [],
@@ -2381,7 +2432,7 @@ export function registerAdminRoutes(deps) {
     addRoute('OPTIONS', '/mcp', async (_req, res) => {
         res.writeHead(204, {
             'Access-Control-Allow-Origin': '*',
-            'Access-Control-Allow-Headers': 'authorization, content-type, accept, last-event-id, mcp-protocol-version, mcp-session-id, x-taskforce-workspace-id, x-taskforce-mcp-client-id, x-taskforce-ai-profile-token, x-taskforce-ai-name, x-taskforce-ai-icon, x-taskforce-ai-color, x-taskforce-ai-description, x-taskforce-ai-role, x-taskforce-ai-provider, x-taskforce-ai-model, x-taskforce-ai-surface-type',
+            'Access-Control-Allow-Headers': 'authorization, content-type, accept, mcp-protocol-version, mcp-method, mcp-name, x-taskforce-workspace-id, x-taskforce-mcp-client-id, x-taskforce-ai-profile-token, x-taskforce-ai-name, x-taskforce-ai-icon, x-taskforce-ai-color, x-taskforce-ai-description, x-taskforce-ai-role, x-taskforce-ai-provider, x-taskforce-ai-model, x-taskforce-ai-surface-type',
             'Access-Control-Allow-Methods': 'GET, HEAD, POST, DELETE, OPTIONS'
         });
         res.end();
@@ -2389,7 +2440,7 @@ export function registerAdminRoutes(deps) {
     addRoute('OPTIONS', '/mcp/', async (_req, res) => {
         res.writeHead(204, {
             'Access-Control-Allow-Origin': '*',
-            'Access-Control-Allow-Headers': 'authorization, content-type, accept, last-event-id, mcp-protocol-version, mcp-session-id, x-taskforce-workspace-id, x-taskforce-mcp-client-id, x-taskforce-ai-profile-token, x-taskforce-ai-name, x-taskforce-ai-icon, x-taskforce-ai-color, x-taskforce-ai-description, x-taskforce-ai-role, x-taskforce-ai-provider, x-taskforce-ai-model, x-taskforce-ai-surface-type',
+            'Access-Control-Allow-Headers': 'authorization, content-type, accept, mcp-protocol-version, mcp-method, mcp-name, x-taskforce-workspace-id, x-taskforce-mcp-client-id, x-taskforce-ai-profile-token, x-taskforce-ai-name, x-taskforce-ai-icon, x-taskforce-ai-color, x-taskforce-ai-description, x-taskforce-ai-role, x-taskforce-ai-provider, x-taskforce-ai-model, x-taskforce-ai-surface-type',
             'Access-Control-Allow-Methods': 'GET, HEAD, POST, DELETE, OPTIONS'
         });
         res.end();
@@ -2423,6 +2474,7 @@ export function registerAdminRoutes(deps) {
             token_endpoint_auth_methods_supported: ['none'],
             code_challenge_methods_supported: ['S256'],
             scopes_supported: ['tasks:read', 'tasks:write', 'workspace:read'],
+            authorization_response_iss_parameter_supported: true,
         }));
     });
     addRoute('HEAD', '/.well-known/oauth-authorization-server', async (req, res) => {
@@ -2438,6 +2490,7 @@ export function registerAdminRoutes(deps) {
             token_endpoint_auth_methods_supported: ['none'],
             code_challenge_methods_supported: ['S256'],
             scopes_supported: ['tasks:read', 'tasks:write', 'workspace:read'],
+            authorization_response_iss_parameter_supported: true,
         }));
     });
     addRoute('GET', '/.well-known/oauth-protected-resource', async (req, res) => {
@@ -2465,6 +2518,12 @@ export function registerAdminRoutes(deps) {
             return;
         const body = await parseJsonBody(req);
         try {
+            const applicationType = (() => {
+                const value = String(body?.application_type || 'web').trim().toLowerCase();
+                if (value === 'native' || value === 'web')
+                    return value;
+                throw new TaskforceRuleError('application_type must be native or web', 400, 'MCP_OAUTH_APPLICATION_TYPE_INVALID');
+            })();
             const provider = (() => {
                 const explicit = String(body?.provider || '').trim().toLowerCase();
                 if (explicit === 'chatgpt' || explicit === 'claude' || explicit === 'grok' || explicit === 'gemini' || explicit === 'mistral' || explicit === 'perplexity')
@@ -2494,6 +2553,7 @@ export function registerAdminRoutes(deps) {
                 provider,
                 clientName: body?.client_name,
                 redirectUris: body?.redirect_uris,
+                applicationType,
                 productClientId: classifyMcpOAuthClientProduct({
                     provider,
                     clientName: body?.client_name,
@@ -2508,6 +2568,7 @@ export function registerAdminRoutes(deps) {
                 grant_types: ['authorization_code'],
                 response_types: ['code'],
                 token_endpoint_auth_method: 'none',
+                application_type: client.applicationType,
                 scope: 'tasks:read tasks:write workspace:read',
             }));
         }
@@ -2664,6 +2725,7 @@ export function registerAdminRoutes(deps) {
             denyTarget.searchParams.set('error', 'access_denied');
             if (state)
                 denyTarget.searchParams.set('state', state);
+            denyTarget.searchParams.set('iss', resolveMcpOauthIssuer(req));
             res.writeHead(302, { Location: denyTarget.toString() });
             res.end();
             return;
@@ -2694,6 +2756,7 @@ export function registerAdminRoutes(deps) {
             approveTarget.searchParams.set('code', issued.code);
             if (state)
                 approveTarget.searchParams.set('state', state);
+            approveTarget.searchParams.set('iss', resolveMcpOauthIssuer(req));
             res.writeHead(302, { Location: approveTarget.toString() });
             res.end();
         }
@@ -2751,7 +2814,7 @@ export function registerAdminRoutes(deps) {
         try {
             const result = core.listMcpAccessTokens({ userId, workspaceId: requestWorkspaceId(req), page, pageSize });
             res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ success: true, ...result }));
+            res.end(JSON.stringify({ success: true, ...result, profileOptions: mcpToolProfileOptions }));
         }
         catch (error) {
             const statusCode = resolveErrorStatusCode(error);
@@ -2773,7 +2836,7 @@ export function registerAdminRoutes(deps) {
         try {
             const items = core.listMcpOAuthConnectorGrants({ userId, workspaceId: requestWorkspaceId(req), provider: provider || null });
             res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ success: true, items }));
+            res.end(JSON.stringify({ success: true, items, profileOptions: mcpToolProfileOptions }));
         }
         catch (error) {
             const statusCode = resolveErrorStatusCode(error);
@@ -2803,6 +2866,34 @@ export function registerAdminRoutes(deps) {
             res.end(JSON.stringify({ success: false, error: error.message, code: error?.code || 'MCP_CONNECTOR_DISCONNECT_FAILED' }));
         }
     });
+    addRoute('PATCH', '/api/taskforce/settings/mcp/connectors/:id/tool-profile', async (req, res, params) => {
+        if (!ensureAppAccess(req, res))
+            return;
+        const userId = resolveAuthenticatedUserId(req);
+        if (!userId || userId === 'anonymous') {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Authentication required.' }));
+            return;
+        }
+        const wid = requestWorkspaceId(req);
+        if (!ensureWorkspaceAdminRole(req, wid)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Workspace owner or admin access is required.', code: 'MCP_TOOL_PROFILE_ADMIN_REQUIRED' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        try {
+            const updated = core.updateMcpOAuthConnectorGrantToolProfile({ actorUserId: userId, workspaceId: wid, grantId: params.id, toolProfile: body?.toolProfile });
+            core.addAdminAuditLog({ action: 'mcp.connector.tool_profile.update', actorUserId: userId, actorRole: requestRole(req), workspaceId: wid, details: { grantId: updated.record.id, provider: updated.record.provider, clientId: updated.record.clientId, previousToolProfile: updated.previousToolProfile, toolProfile: updated.record.toolProfile } });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true, record: updated.record }));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: error.message, code: error?.code || 'MCP_CONNECTOR_TOOL_PROFILE_UPDATE_FAILED' }));
+        }
+    });
     addRoute('POST', '/api/taskforce/settings/mcp/tokens', async (req, res) => {
         if (!ensureAppAccess(req, res))
             return;
@@ -2884,6 +2975,34 @@ export function registerAdminRoutes(deps) {
             res.end(JSON.stringify({ success: false, error: error.message, code: error?.code || 'MCP_TOKEN_REGENERATE_FAILED' }));
         }
     });
+    addRoute('PATCH', '/api/taskforce/settings/mcp/tokens/:id/tool-profile', async (req, res, params) => {
+        if (!ensureAppAccess(req, res))
+            return;
+        const userId = resolveAuthenticatedUserId(req);
+        if (!userId || userId === 'anonymous') {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Authentication required.' }));
+            return;
+        }
+        const wid = requestWorkspaceId(req);
+        if (!ensureWorkspaceAdminRole(req, wid)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: 'Workspace owner or admin access is required.', code: 'MCP_TOOL_PROFILE_ADMIN_REQUIRED' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        try {
+            const updated = core.updateMcpAccessTokenToolProfile({ actorUserId: userId, workspaceId: wid, tokenId: params.id, toolProfile: body?.toolProfile });
+            core.addAdminAuditLog({ action: 'mcp.token.tool_profile.update', actorUserId: userId, actorRole: requestRole(req), workspaceId: wid, details: { tokenId: updated.record.id, previousToolProfile: updated.previousToolProfile, toolProfile: updated.record.toolProfile } });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true, record: updated.record }));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: false, error: error.message, code: error?.code || 'MCP_TOKEN_TOOL_PROFILE_UPDATE_FAILED' }));
+        }
+    });
     addRoute('POST', '/api/taskforce/settings/mcp/test-connection', async (req, res) => {
         if (!ensureAppAccess(req, res))
             return;
@@ -2949,6 +3068,8 @@ export function registerAdminRoutes(deps) {
                     workspaceId: wid,
                     workspaceName: String(workspace?.name || wid),
                     scopes: inspection.scopes,
+                    toolProfile: inspection.toolProfile,
+                    toolCount: getCloudMcpToolProfileMembership(inspection.toolProfile, inspection.scopes).length,
                     requiredScopes,
                     endpoint: probe.endpoint,
                     serverName: probe.serverName,

package/dist/server/routes/agents.d.ts

@@ -6,6 +6,9 @@
  *   POST   /api/taskforce/agents
  *   PATCH  /api/taskforce/agents/:agentId
  *   DELETE /api/taskforce/agents/:agentId
+ *   GET    /api/taskforce/agents/:agentId/connection-binding
+ *   PUT    /api/taskforce/agents/:agentId/connection-binding
+ *   DELETE /api/taskforce/agents/:agentId/connection-binding
  *   GET    /api/taskforce/agents/:agentId/conversations
  *   POST   /api/taskforce/agents/:agentId/conversation/new
  *   POST   /api/taskforce/agents/model-gateway/test
@@ -13,6 +16,7 @@
  */
 import type { IncomingMessage, ServerResponse } from 'http';
 import type { TaskforceCore } from '../../core/Taskforce.js';
+import { ModelProviderConnectionService } from '../../services/modelProviderConnectionService.js';
 import { saveAiProfileAvatarAssets, type AiProfileAvatarAssetDeps } from '../aiProfileAvatarAssets.js';
 import type { ModelGateway, ModelGatewaySelection } from '../../services/modelGateway.js';
 import { type TaskforceAgentAvatarImageProvider } from '../../services/taskforceAgentAvatarImageProvider.js';
@@ -20,6 +24,7 @@ import { type PreparedTaskforceAgentMcpBridge, type PrepareTaskforceAgentMcpBrid
 import { TaskforceAgentConversationStore } from '../../storage/taskforceAgentConversationStore.js';
 import { TaskforceAgentStore } from '../../storage/taskforceAgentStore.js';
 import { TaskforceAgentSkillStore } from '../../storage/taskforceAgentSkillStore.js';
+import { TaskforceAgentConnectionBindingService } from '../../services/taskforceAgentConnectionBindingService.js';
 import { type TaskforceAgentRuntimeReferenceResolvers } from '../../shared/taskforceAgentRuntimeResolution.js';
 import { type RouteHandler } from './primitives.js';
 type SaveAiProfileAvatarAssets = typeof saveAiProfileAvatarAssets;
@@ -35,6 +40,8 @@ export interface AgentsRouteDependencies {
     agentStore?: TaskforceAgentStore;
     skillStore?: TaskforceAgentSkillStore;
     conversationStore?: TaskforceAgentConversationStore;
+    connectionBindingService?: Pick<TaskforceAgentConnectionBindingService, 'inspect' | 'bind' | 'clear' | 'resolveSaved' | 'resolveDraft'>;
+    modelConnectionService?: Pick<ModelProviderConnectionService, 'assertReady' | 'withConnectionLease'>;
     createModelGateway?: (selection?: ModelGatewaySelection) => ModelGateway;
     prepareMcpBridge?: (input: PrepareTaskforceAgentMcpBridgeInput) => Promise<PreparedTaskforceAgentMcpBridge | null>;
     agentRuntimeReferenceResolvers?: TaskforceAgentRuntimeReferenceResolvers;