npm - @taskforcehq/taskforce - Versions diffs - 0.3.329 → 0.3.332 - Mend

@taskforcehq/taskforce 0.3.329 → 0.3.332

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (363) hide show

package/dist/server/routes/executorPhaseAApprovals.js ADDED Viewed

@@ -0,0 +1,140 @@
+import { ExecutorPhaseAApprovalError } from '../../services/executorPhaseAApprovalService.js';
+import { ExecutorPhaseAApprovalConflictError } from '../../storage/executorPhaseAApprovalReceiptStore.js';
+import { EXECUTOR_PHASE_A_ISSUANCE_REQUEST_SCHEMA, EXECUTOR_PHASE_A_MAX_PREFLIGHT_BYTES } from '../../shared/executorPhaseAApprovalReceipt.js';
+import { parseJsonBody } from './primitives.js';
+export const EXECUTOR_PHASE_A_APPROVAL_PAGE_PATH = '/taskforce/admin/executor/phase-a-approval';
+export const EXECUTOR_PHASE_A_APPROVAL_PAGE_SCRIPT_PATH = '/taskforce/admin/executor/phase-a-approval.js';
+export const EXECUTOR_PHASE_A_APPROVAL_ISSUE_PATH = '/api/taskforce/admin/executor/phase-a-approval-receipts';
+function writeJson(res, statusCode, body) {
+    res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(body));
+}
+function isSameOriginJson(req, allowedOrigin) {
+    const contentType = String(req.headers['content-type'] || '').split(';')[0].trim().toLowerCase();
+    if (contentType !== 'application/json')
+        return false;
+    const origin = String(req.headers.origin || '').trim();
+    if (!origin || origin === 'null')
+        return false;
+    if (String(req.headers['sec-fetch-site'] || '').trim().toLowerCase() === 'cross-site')
+        return false;
+    try {
+        return origin === allowedOrigin && new URL(origin).origin === allowedOrigin;
+    }
+    catch {
+        return false;
+    }
+}
+function renderPage(issuePath) {
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width,initial-scale=1" />
+  <title>Phase A Approval</title>
+  <style>
+    body{margin:0;background:#f5f6f8;color:#17191d;font:15px system-ui,sans-serif}.bar{height:56px;background:#fff;border-bottom:1px solid #dfe2e7;display:flex;align-items:center;padding:0 24px;font-weight:700}.main{max-width:760px;margin:40px auto;padding:0 24px}.panel{background:#fff;border:1px solid #dfe2e7;border-radius:8px;padding:24px}h1{font-size:24px;margin:0 0 24px}label{display:block;font-weight:650;margin-bottom:8px}input{width:100%;box-sizing:border-box;border:1px solid #aeb4bd;padding:12px;border-radius:6px}button{margin-top:20px;background:#176b4d;color:#fff;border:0;border-radius:6px;padding:11px 16px;font-weight:700;cursor:pointer}button:disabled{opacity:.45;cursor:not-allowed}pre{white-space:pre-wrap;background:#f7f8fa;border:1px solid #e2e5e9;padding:12px;min-height:48px;max-height:280px;overflow:auto}
+  </style>
+</head>
+<body><div class="bar">Taskforce System Administration</div><main class="main" data-issue-path="${issuePath}" data-request-schema="${EXECUTOR_PHASE_A_ISSUANCE_REQUEST_SCHEMA}"><section class="panel">
+  <h1>Phase A Approval</h1>
+  <label for="preflight">Canonical preflight JSON</label><input id="preflight" type="file" accept="application/json,.json" />
+  <pre id="summary">No preflight selected.</pre><button id="approve" type="button" disabled>Approve and download receipt</button>
+</section></main><script src="${EXECUTOR_PHASE_A_APPROVAL_PAGE_SCRIPT_PATH}" defer></script></body></html>`;
+}
+function renderPageScript() {
+    return `const root=document.querySelector('main[data-issue-path]'),file=document.getElementById('preflight'),button=document.getElementById('approve'),summary=document.getElementById('summary');let encoded='';
+file.addEventListener('change',async()=>{button.disabled=true;encoded='';const selected=file.files[0];if(!selected)return;const bytes=new Uint8Array(await selected.arrayBuffer());let binary='';for(const value of bytes)binary+=String.fromCharCode(value);encoded=btoa(binary).replace(/\\+/g,'-').replace(/\\//g,'_').replace(/=+$/,'');try{const value=JSON.parse(new TextDecoder().decode(bytes));summary.textContent=JSON.stringify({runId:value.runId,status:value.status,failures:value.failures,authority:value.approvalContext,target:value.target,source:value.source,budgets:value.budgets,pricing:value.pricing,cleanupInventory:value.logicalEnvelope?.cleanupInventory,collectedAt:value.collectedAt,expiresAt:value.expiresAt},null,2);button.disabled=false}catch{summary.textContent='Invalid JSON.'}});
+button.addEventListener('click',async()=>{button.disabled=true;const response=await fetch(root.dataset.issuePath,{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({schema:root.dataset.requestSchema,preflightBase64Url:encoded})});if(!response.ok){let message='Approval failed.';try{message=(await response.json()).error||message}catch{}summary.textContent=message;button.disabled=false;return}const blob=await response.blob(),link=document.createElement('a');link.href=URL.createObjectURL(blob);link.download='taskforce-phase-a-approval-receipt.json';link.click();URL.revokeObjectURL(link.href);summary.textContent='Approval receipt issued.'});`;
+}
+export function registerExecutorPhaseAApprovalRoutes(deps) {
+    const authorize = (req, res) => {
+        if (!deps.requireCloudRuntime(res, 'Executor Phase A approvals'))
+            return null;
+        if (!deps.performanceEnvironment) {
+            writeJson(res, 404, { error: 'Executor Phase A approvals are available only in the performance environment.' });
+            return null;
+        }
+        if (!deps.ensureAppAccess(req, res))
+            return null;
+        const actorUserId = String(deps.resolveHumanSystemAdminActor(req) || '').trim();
+        if (!actorUserId) {
+            deps.auditAuthAction(req, 'executor.phase-a.approval.denied', { code: 'human_system_admin_required' }, deps.workspaceId);
+            writeJson(res, 403, { error: 'Human system administrator access is required.' });
+            return null;
+        }
+        if (!deps.hasActiveWorkspaceMembership(deps.workspaceId, actorUserId)) {
+            deps.auditAuthAction(req, 'executor.phase-a.approval.denied', { code: 'active_workspace_membership_required' }, deps.workspaceId);
+            writeJson(res, 403, { error: 'Active membership in the Phase A workspace is required.' });
+            return null;
+        }
+        return actorUserId;
+    };
+    deps.addRoute('GET', EXECUTOR_PHASE_A_APPROVAL_PAGE_PATH, async (req, res) => {
+        if (!authorize(req, res))
+            return;
+        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' });
+        res.end(renderPage(EXECUTOR_PHASE_A_APPROVAL_ISSUE_PATH));
+    });
+    deps.addRoute('GET', EXECUTOR_PHASE_A_APPROVAL_PAGE_SCRIPT_PATH, async (req, res) => {
+        if (!authorize(req, res))
+            return;
+        res.writeHead(200, { 'Content-Type': 'application/javascript; charset=utf-8', 'Cache-Control': 'no-store' });
+        res.end(renderPageScript());
+    });
+    deps.addRoute('POST', EXECUTOR_PHASE_A_APPROVAL_ISSUE_PATH, async (req, res) => {
+        const actorUserId = authorize(req, res);
+        if (!actorUserId)
+            return;
+        if (!isSameOriginJson(req, deps.allowedOrigin)) {
+            deps.auditAuthAction(req, 'executor.phase-a.approval.denied', { code: 'same_origin_json_required' }, deps.workspaceId);
+            writeJson(res, 403, { error: 'Same-origin application/json submission is required.' });
+            return;
+        }
+        if (!deps.service) {
+            deps.auditAuthAction(req, 'executor.phase-a.approval.denied', { code: 'issuer_not_configured' }, deps.workspaceId);
+            writeJson(res, 503, { error: 'Phase A approval receipt signing is not configured.' });
+            return;
+        }
+        try {
+            const body = await parseJsonBody(req, Math.ceil(EXECUTOR_PHASE_A_MAX_PREFLIGHT_BYTES * 1.4));
+            if (!body || typeof body !== 'object' || Array.isArray(body) || Object.keys(body).length !== 2
+                || body.schema !== EXECUTOR_PHASE_A_ISSUANCE_REQUEST_SCHEMA || typeof body.preflightBase64Url !== 'string') {
+                throw new ExecutorPhaseAApprovalError('Request does not match the Phase A issuance request schema.');
+            }
+            const encoded = body.preflightBase64Url;
+            if (!/^[A-Za-z0-9_-]+$/.test(encoded)) {
+                throw new ExecutorPhaseAApprovalError('preflightBase64Url must be unpadded base64url.');
+            }
+            const preflightBytes = Buffer.from(encoded, 'base64url');
+            if (preflightBytes.toString('base64url') !== encoded) {
+                throw new ExecutorPhaseAApprovalError('preflightBase64Url is not canonical base64url.');
+            }
+            const result = deps.service.issue(preflightBytes, actorUserId);
+            deps.auditAuthAction(req, result.created ? 'executor.phase-a.approval.issued' : 'executor.phase-a.approval.retried', {
+                receiptId: result.receiptId,
+                receiptSha256: result.digest,
+            }, deps.workspaceId);
+            res.writeHead(result.created ? 201 : 200, {
+                'Content-Type': 'application/json',
+                'Content-Disposition': 'attachment; filename="taskforce-phase-a-approval-receipt.json"',
+                'Cache-Control': 'no-store',
+                'X-Taskforce-Receipt-Sha256': result.digest,
+            });
+            res.end(result.bytes);
+        }
+        catch (error) {
+            const statusCode = error instanceof ExecutorPhaseAApprovalError || error instanceof ExecutorPhaseAApprovalConflictError
+                ? error.statusCode
+                : Number(error?.statusCode) || 500;
+            const code = error instanceof ExecutorPhaseAApprovalError || error instanceof ExecutorPhaseAApprovalConflictError
+                ? error.code
+                : 'internal_error';
+            deps.auditAuthAction(req, 'executor.phase-a.approval.denied', { code }, deps.workspaceId);
+            writeJson(res, statusCode, {
+                error: statusCode >= 500 ? 'Internal server error.' : String(error?.message || 'Approval failed.'),
+                code,
+            });
+        }
+    });
+}

package/dist/server/routes/executorPhaseAIssuerRedemptions.d.ts ADDED Viewed

@@ -0,0 +1,11 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { RouteHandler } from './primitives.js';
+export interface ExecutorPhaseAIssuerRedemptionRouteDependencies {
+    addRoute: (method: string, path: string, handler: RouteHandler) => void;
+    requireCloudRuntime: (res: ServerResponse, feature: string) => boolean;
+    performanceEnvironment: boolean;
+    featureEnabled: boolean;
+    auditAuthAction: (req: IncomingMessage, action: string, details: Record<string, unknown>, workspaceIdOverride?: string | null) => void;
+    workspaceId: string;
+}
+export declare function registerExecutorPhaseAIssuerRedemptionRoutes(deps: ExecutorPhaseAIssuerRedemptionRouteDependencies): void;

package/dist/server/routes/executorPhaseAIssuerRedemptions.js ADDED Viewed

@@ -0,0 +1,24 @@
+import { EXECUTOR_PHASE_A_ISSUER_REDEMPTION_PATH } from '../../shared/executorPhaseAIssuerContracts.js';
+function writeJson(res, statusCode, body) {
+    res.writeHead(statusCode, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+    res.end(JSON.stringify(body));
+}
+export function registerExecutorPhaseAIssuerRedemptionRoutes(deps) {
+    deps.addRoute('POST', EXECUTOR_PHASE_A_ISSUER_REDEMPTION_PATH, async (req, res) => {
+        if (!deps.requireCloudRuntime(res, 'Executor Phase A issuer redemption'))
+            return;
+        if (!deps.performanceEnvironment || !deps.featureEnabled) {
+            writeJson(res, 404, { error: 'Not found.' });
+            return;
+        }
+        // Package 1 deliberately has no integration path. Package 2 must install the
+        // independently reviewed pre-Lambda machine-authentication gate first.
+        deps.auditAuthAction(req, 'executor.phase-a.issuer-redemption.denied', {
+            code: 'broker_preintegration_authentication_not_configured',
+        }, deps.workspaceId);
+        writeJson(res, 503, {
+            error: 'Phase A broker authentication is not configured.',
+            code: 'broker_preintegration_authentication_not_configured',
+        });
+    });
+}

package/dist/server/routes/githubReviewEvidence.d.ts ADDED Viewed

@@ -0,0 +1,19 @@
+import type { IncomingMessage, ServerResponse } from 'http';
+import { type GitHubReviewEvidenceInstallationStore } from '../../storage/githubReviewEvidenceInstallationStore.js';
+import type { GitHubInstallationInspection } from '../../services/githubReviewEvidenceService.js';
+import { type RouteHandler } from './primitives.js';
+export interface GitHubReviewEvidenceRouteDependencies {
+    addRoute: (method: string, path: string, handler: RouteHandler) => void;
+    store: GitHubReviewEvidenceInstallationStore;
+    configured: boolean;
+    inspectInstallation: (installationId: string) => Promise<GitHubInstallationInspection>;
+    requestWorkspaceId: (req: IncomingMessage) => string;
+    requestRole: (req: IncomingMessage) => string;
+    resolveAuthenticatedUserId: (req: IncomingMessage) => string;
+    ensureAppAccess: (req: IncomingMessage, res: ServerResponse) => boolean;
+    ensureWorkspaceAdminRole: (req: IncomingMessage, workspaceIdOverride?: string | null) => boolean;
+    ensureAdminRole: (req: IncomingMessage) => boolean;
+    requireCloudRuntime: (res: ServerResponse, feature: string) => boolean;
+    auditAuthAction: (req: IncomingMessage, action: string, details: Record<string, unknown>, workspaceIdOverride?: string | null) => void;
+}
+export declare function registerGitHubReviewEvidenceRoutes(deps: GitHubReviewEvidenceRouteDependencies): void;

package/dist/server/routes/githubReviewEvidence.js ADDED Viewed

@@ -0,0 +1,116 @@
+import { GitHubReviewEvidenceInstallationConflictError, } from '../../storage/githubReviewEvidenceInstallationStore.js';
+import { GitHubReviewEvidenceError } from '../../services/githubReviewEvidenceService.js';
+import { parseJsonBody } from './primitives.js';
+const SETTINGS_PATH = '/api/taskforce/settings/github-review-evidence/installation';
+function writeJson(res, statusCode, body) {
+    res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(body));
+}
+function publicBinding(binding) {
+    if (!binding)
+        return null;
+    return {
+        installationId: binding.installationId,
+        accountId: binding.accountId,
+        accountLogin: binding.accountLogin,
+        accountType: binding.accountType,
+        repositorySelection: binding.repositorySelection,
+        createdAt: binding.createdAt,
+        updatedAt: binding.updatedAt,
+    };
+}
+function writeProviderError(res, error) {
+    if (error instanceof GitHubReviewEvidenceError) {
+        if (error.retryAfterSeconds)
+            res.setHeader('Retry-After', String(error.retryAfterSeconds));
+        writeJson(res, error.statusCode, { error: error.message, code: error.code });
+        return;
+    }
+    if (error instanceof GitHubReviewEvidenceInstallationConflictError) {
+        writeJson(res, error.statusCode, { error: error.message, code: error.code });
+        return;
+    }
+    writeJson(res, 500, { error: 'Internal server error.' });
+}
+export function registerGitHubReviewEvidenceRoutes(deps) {
+    const { addRoute, store, configured, inspectInstallation, requestWorkspaceId, requestRole, resolveAuthenticatedUserId, ensureAppAccess, ensureWorkspaceAdminRole, ensureAdminRole, requireCloudRuntime, auditAuthAction, } = deps;
+    const authorize = (req, res, systemAdminRequired = false) => {
+        if (!ensureAppAccess(req, res))
+            return null;
+        if (!requireCloudRuntime(res, 'GitHub review evidence'))
+            return null;
+        const workspaceId = String(requestWorkspaceId(req) || '').trim();
+        if (!workspaceId) {
+            writeJson(res, 400, { error: 'Workspace ID is required.' });
+            return null;
+        }
+        const actorUserId = String(resolveAuthenticatedUserId(req) || '').trim();
+        if (!actorUserId || actorUserId === 'anonymous') {
+            writeJson(res, 401, { error: 'Authentication is required.' });
+            return null;
+        }
+        if (systemAdminRequired ? !ensureAdminRole(req) : !ensureWorkspaceAdminRole(req, workspaceId)) {
+            writeJson(res, 403, {
+                error: systemAdminRequired
+                    ? 'System administrator access is required.'
+                    : 'Workspace owner or admin access is required.',
+            });
+            return null;
+        }
+        return workspaceId;
+    };
+    addRoute('GET', SETTINGS_PATH, async (req, res) => {
+        const workspaceId = authorize(req, res);
+        if (!workspaceId)
+            return;
+        writeJson(res, 200, { configured, installation: publicBinding(store.get(workspaceId)) });
+    });
+    addRoute('PUT', SETTINGS_PATH, async (req, res) => {
+        const workspaceId = authorize(req, res, true);
+        if (!workspaceId)
+            return;
+        try {
+            const body = await parseJsonBody(req, 16 * 1024);
+            const installation = await inspectInstallation(String(body?.installationId || '').trim());
+            const actorUserId = String(resolveAuthenticatedUserId(req) || '').trim();
+            const binding = store.put({
+                workspaceId,
+                installationId: installation.installationId,
+                accountId: installation.accountId,
+                accountLogin: installation.accountLogin,
+                accountType: installation.accountType,
+                repositorySelection: installation.repositorySelection,
+                boundByUserId: actorUserId,
+            });
+            auditAuthAction(req, 'github.review-evidence.installation.bound', {
+                installationId: binding.installationId,
+                accountId: binding.accountId,
+                accountLogin: binding.accountLogin,
+                repositorySelection: binding.repositorySelection,
+            }, workspaceId);
+            writeJson(res, 200, { success: true, installation: publicBinding(binding) });
+        }
+        catch (error) {
+            auditAuthAction(req, 'github.review-evidence.installation.bind-failed', {
+                code: error instanceof GitHubReviewEvidenceError || error instanceof GitHubReviewEvidenceInstallationConflictError
+                    ? error.code
+                    : 'internal_error',
+            }, workspaceId);
+            writeProviderError(res, error);
+        }
+    });
+    addRoute('DELETE', SETTINGS_PATH, async (req, res) => {
+        const workspaceId = authorize(req, res);
+        if (!workspaceId)
+            return;
+        const existing = store.get(workspaceId);
+        const removed = store.delete(workspaceId);
+        auditAuthAction(req, 'github.review-evidence.installation.unbound', {
+            installationId: existing?.installationId || null,
+            accountId: existing?.accountId || null,
+            removed,
+            actorRole: requestRole(req),
+        }, workspaceId);
+        writeJson(res, 200, { success: true, removed });
+    });
+}

package/dist/server/routes/localService.d.ts CHANGED Viewed

@@ -1,13 +1,24 @@
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import type { IncomingMessage } from 'http';
+import { NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';
 import type { TaskforceCore } from '../../core/Taskforce.js';
-import { createTaskforceMcpServer } from '../../mcp/runtime.js';
+import { type McpRuntimeFactory, type TaskforceMcpServerOptions } from '../../mcp/runtime.js';
 import { type LocalServiceRouteContext, type RouteHandler } from './primitives.js';
+export interface LocalMcpRuntimeLease {
+    runtime: ReturnType<McpRuntimeFactory>;
+    transport: NodeStreamableHTTPServerTransport;
+    release(): Promise<void>;
+}
+export type AcquireLocalMcpRuntime = (input: {
+    req: IncomingMessage;
+    options: TaskforceMcpServerOptions;
+}) => Promise<LocalMcpRuntimeLease>;
 interface LocalServiceRouteDependencies {
     addRoute: (method: string, path: string, handler: RouteHandler) => void;
     core: TaskforceCore;
     context: LocalServiceRouteContext | undefined;
-    createMcpServer?: typeof createTaskforceMcpServer;
-    createMcpTransport?: () => StreamableHTTPServerTransport;
+    createMcpServer?: McpRuntimeFactory;
+    createMcpTransport?: () => NodeStreamableHTTPServerTransport;
+    acquireMcpRuntime?: AcquireLocalMcpRuntime;
 }
 export declare function registerLocalServiceRoutes(deps: LocalServiceRouteDependencies): void;
 export {};

package/dist/server/routes/localService.js CHANGED Viewed

@@ -1,10 +1,15 @@
 import { createHash, timingSafeEqual } from 'crypto';
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';
+import { isJsonContentType } from '@modelcontextprotocol/server';
 import { parseMcpClientId } from '../../mcp/clientRegistry.js';
-import { createTaskforceMcpServer } from '../../mcp/runtime.js';
+import { handleModernMcpHttpRequest, isModernMcpHttpRequest, } from '../../mcp/httpProtocolRouting.js';
+import { createStatelessTaskforceMcpServer, createTaskforceMcpServer, } from '../../mcp/runtime.js';
 import { MCP_TOOL_PROFILES } from '../../mcp/toolRegistry.js';
 import { parseJsonBody } from './primitives.js';
+import { setServerTimingHeader } from './shared.js';
 import { LocalServiceSessionError } from '../localServiceSessions.js';
+import { WorkspaceSyncDurabilityStore } from '../../sync/v3/syncDurabilityStore.js';
+import { assertDurableOperationIdentity, DurableOperationReplayIdentityConflictError, } from '../../sync/v3/durableOperationReplay.js';
 const API_BASE = '/api/taskforce/local-service/v1';
 const ALLOWED_SCOPES = new Set(['tasks:read', 'tasks:write', 'workspace:read']);
 const MAX_REGISTRATION_BODY_BYTES = 32 * 1024;
@@ -16,6 +21,13 @@ function writeJson(res, statusCode, body) {
 function fail(res, statusCode, error, code) {
     writeJson(res, statusCode, { error, code });
 }
+function failMcp(res, statusCode, message) {
+    writeJson(res, statusCode, {
+        jsonrpc: '2.0',
+        error: { code: -32000, message },
+        id: null,
+    });
+}
 function isLoopback(req) {
     const address = String(req.socket.remoteAddress || '').toLowerCase();
     return address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1';
@@ -59,7 +71,17 @@ function authenticateSession(req, res, context) {
         fail(res, 401, 'A valid local service session bearer is required.', 'SESSION_AUTH_REQUIRED');
         return null;
     }
-    const session = context.sessions.authenticate(token);
+    let session;
+    try {
+        session = context.sessions.authenticate(token);
+    }
+    catch (error) {
+        if (error instanceof LocalServiceSessionError) {
+            fail(res, error.statusCode, error.message, error.code);
+            return null;
+        }
+        throw error;
+    }
     if (!session) {
         fail(res, 401, 'The local service session is invalid or expired.', 'SESSION_INVALID');
         return null;
@@ -110,42 +132,60 @@ function normalizeRegistration(body, context) {
         profileToken: profileToken || null,
     };
 }
-function lookupBoundOperation(core, context, session, operationId, req) {
+function lookupDurableOperation(core, context, session, operationId, req) {
     const url = new URL(req.url || '/', 'http://127.0.0.1');
     const expectedMutationKind = String(url.searchParams.get('mutationKind') || '').trim() || null;
     const expectedPayloadFingerprint = String(url.searchParams.get('payloadFingerprint') || '').trim() || null;
-    const binding = context.sessions.getOperationBinding(session.id, operationId, {
-        mutationKind: expectedMutationKind,
-        payloadFingerprint: expectedPayloadFingerprint,
+    const row = new WorkspaceSyncDurabilityStore(core.getDatabaseAdapter()).readOutboxOperationLookup({
+        tenantId: core.getTenantId(),
+        workspaceId: session.workspaceId,
+        clientId: context.operationClientId,
+        operationId,
     });
-    if (!binding)
-        return null;
-    const row = core.getDatabaseAdapter().prepare(`
-        SELECT status, authoritative_response_json, created_at,
-               mutation_kind, payload_fingerprint
-        FROM workspace_sync_outbox
-        WHERE tenant_id = ?
-          AND workspace_id = ?
-          AND client_id = ?
-          AND operation_id = ?
-        LIMIT 1
-    `).get(core.getTenantId(), session.workspaceId, context.operationClientId, operationId);
     if (!row)
         return null;
-    const responseJson = typeof row.authoritative_response_json === 'string'
-        ? row.authoritative_response_json
-        : null;
+    try {
+        assertDurableOperationIdentity({
+            operationId: row.operationId,
+            domain: row.domain,
+            entityId: row.entityId,
+            mutationKind: row.mutationKind,
+            payloadFingerprint: row.payloadFingerprint,
+        }, {
+            operationId,
+            domain: row.domain,
+            entityId: row.entityId,
+            mutationKind: expectedMutationKind || row.mutationKind,
+            payloadFingerprint: expectedPayloadFingerprint || row.payloadFingerprint,
+        });
+    }
+    catch (error) {
+        if (!(error instanceof DurableOperationReplayIdentityConflictError))
+            throw error;
+        throw new LocalServiceSessionError('Operation identity is assigned to a different durable mutation.', 409, 'OPERATION_IDENTITY_CONFLICT');
+    }
+    const responseJson = row.authoritativeResponseJson;
     if (responseJson && Buffer.byteLength(responseJson, 'utf8') > MAX_MCP_BODY_BYTES) {
         throw new LocalServiceSessionError('Operation response exceeds the local service limit.', 500, 'OPERATION_RESPONSE_INVALID');
     }
+    let response = null;
+    if (responseJson) {
+        try {
+            response = JSON.parse(responseJson);
+        }
+        catch {
+            throw new LocalServiceSessionError('Operation response is invalid.', 500, 'OPERATION_RESPONSE_INVALID');
+        }
+    }
     return {
         operationId,
         status: row.status,
-        createdAt: row.created_at,
-        mutationKind: row.mutation_kind,
-        payloadFingerprint: binding.payloadFingerprint,
-        durablePayloadFingerprint: row.payload_fingerprint,
-        response: responseJson ? JSON.parse(responseJson) : null,
+        createdAt: row.createdAt,
+        mutationKind: row.mutationKind,
+        payloadFingerprint: row.payloadFingerprint,
+        domain: row.domain,
+        entityId: row.entityId,
+        response,
     };
 }
 function auditShutdown(core, context, input) {
@@ -255,7 +295,7 @@ export function registerLocalServiceRoutes(deps) {
         if (!session)
             return;
         try {
-            const operation = lookupBoundOperation(deps.core, context, session, params.operationId, req);
+            const operation = lookupDurableOperation(deps.core, context, session, params.operationId, req);
             if (!operation) {
                 fail(res, 404, 'Operation not found.', 'OPERATION_NOT_FOUND');
                 return;
@@ -343,21 +383,34 @@ export function registerLocalServiceRoutes(deps) {
     deps.addRoute('POST', '/mcp', async (req, res) => {
         if (!guardLocalRequest(req, res))
             return;
+        const authStartedAtMs = Date.now();
         const session = authenticateSession(req, res, context);
         if (!session)
             return;
+        if (!isJsonContentType(header(req, 'content-type'))) {
+            failMcp(res, 415, 'Unsupported Media Type: Content-Type must be application/json');
+            return;
+        }
+        const authMs = Date.now() - authStartedAtMs;
         let runtime = null;
+        let runtimeLease = null;
+        let bodyParseMs = 0;
+        let runtimeConstructionMs = 0;
+        let transportConnectMs = 0;
         let requestStarted = false;
         let unregisterCancellation = () => { };
         let resolveCancellation = () => { };
         const cancellation = new Promise((resolve) => { resolveCancellation = resolve; });
         try {
+            const bodyParseStartedAtMs = Date.now();
             const body = await parseJsonBody(req, MAX_MCP_BODY_BYTES);
+            bodyParseMs = Date.now() - bodyParseStartedAtMs;
+            const modernProtocolRequest = await isModernMcpHttpRequest(req, body);
             const cancellationId = body?.method === 'notifications/cancelled'
                 && (typeof body?.params?.requestId === 'string' || typeof body?.params?.requestId === 'number')
                 ? body.params.requestId
                 : null;
-            if (cancellationId !== null) {
+            if (cancellationId !== null && !modernProtocolRequest) {
                 const correlationId = requestCorrelation(req, 'x-taskforce-mcp-cancel-correlation');
                 if (correlationId)
                     context.sessions.cancelRequest(session.id, correlationId);
@@ -377,7 +430,8 @@ export function registerLocalServiceRoutes(deps) {
             }
             if (cancelled)
                 return;
-            runtime = (deps.createMcpServer || createTaskforceMcpServer)({
+            const runtimeStartedAtMs = Date.now();
+            const runtimeOptions = {
                 projectRoot: deps.core.getPaths().projectRoot,
                 tenantId: deps.core.getTenantId(),
                 workspaceId: session.workspaceId,
@@ -386,8 +440,6 @@ export function registerLocalServiceRoutes(deps) {
                 logStartup: false,
                 runtimeMode: 'local',
                 operationIdentityScope: {
-                    generation: context.generation,
-                    sessionId: session.id,
                     connectionInstance: session.connectionInstance,
                 },
                 toolProfile: session.toolProfile,
@@ -404,18 +456,59 @@ export function registerLocalServiceRoutes(deps) {
                     userAgent: header(req, 'user-agent').trim() || null,
                 },
                 onAiProfileBound: (profileId) => context.sessions.bindAiProfile(session.id, profileId),
-                onOperationAccepted: (operation) => context.sessions.recordOperation({
-                    sessionId: session.id,
-                    ...operation,
-                }),
-            });
-            const transport = deps.createMcpTransport?.() || new StreamableHTTPServerTransport({
+            };
+            if (modernProtocolRequest) {
+                const handling = handleModernMcpHttpRequest({
+                    req,
+                    res,
+                    parsedBody: body,
+                    factory: ({ era }) => {
+                        const constructionStartedAtMs = Date.now();
+                        const modernRuntime = createStatelessTaskforceMcpServer({ ...runtimeOptions, protocolEra: era }, deps.createMcpServer || createTaskforceMcpServer);
+                        runtimeConstructionMs = Date.now() - constructionStartedAtMs;
+                        if (!res.headersSent) {
+                            setServerTimingHeader(res, [
+                                { name: 'auth', durationMs: authMs },
+                                { name: 'body-parse', durationMs: bodyParseMs },
+                                { name: 'runtime', durationMs: runtimeConstructionMs },
+                            ]);
+                        }
+                        return modernRuntime.server;
+                    },
+                });
+                await Promise.race([handling, cancellation]);
+                if (cancelled)
+                    void handling.catch(() => undefined);
+                if (cancellationId !== null && res.statusCode === 202) {
+                    const cancellationCorrelation = requestCorrelation(req, 'x-taskforce-mcp-cancel-correlation');
+                    if (cancellationCorrelation) {
+                        context.sessions.cancelRequest(session.id, cancellationCorrelation);
+                    }
+                }
+                return;
+            }
+            runtimeLease = deps.acquireMcpRuntime
+                ? await deps.acquireMcpRuntime({ req, options: runtimeOptions })
+                : null;
+            runtime = runtimeLease?.runtime
+                || createStatelessTaskforceMcpServer(runtimeOptions, deps.createMcpServer || createTaskforceMcpServer);
+            runtimeConstructionMs = Date.now() - runtimeStartedAtMs;
+            const transport = runtimeLease?.transport || deps.createMcpTransport?.() || new NodeStreamableHTTPServerTransport({
                 sessionIdGenerator: undefined,
                 enableJsonResponse: true,
             });
-            await runtime.server.connect(transport);
+            const transportStartedAtMs = Date.now();
+            if (!runtimeLease)
+                await runtime.server.connect(transport);
+            transportConnectMs = Date.now() - transportStartedAtMs;
             if (cancelled)
                 return;
+            setServerTimingHeader(res, [
+                { name: 'auth', durationMs: authMs },
+                { name: 'body-parse', durationMs: bodyParseMs },
+                { name: 'runtime', durationMs: runtimeConstructionMs },
+                { name: 'transport-connect', durationMs: transportConnectMs },
+            ]);
             const handling = transport.handleRequest(req, res, body);
             await Promise.race([handling, cancellation]);
             if (cancelled)
@@ -430,7 +523,10 @@ export function registerLocalServiceRoutes(deps) {
         }
         finally {
             unregisterCancellation();
-            await runtime?.server.close().catch(() => undefined);
+            if (runtimeLease)
+                await runtimeLease.release().catch(() => undefined);
+            else
+                await runtime?.server.close().catch(() => undefined);
             if (requestStarted)
                 context.sessions.endRequest(session.id);
         }

package/dist/server/routes/modelConnections.d.ts ADDED Viewed

@@ -0,0 +1,24 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { TaskforceCore } from '../../core/Taskforce.js';
+import { ModelProviderConnectionService, type ModelProviderConnectionLifecycleHandlers } from '../../services/modelProviderConnectionService.js';
+import { CodexDeviceCodeLoginManager } from '../../services/codexDeviceCodeLoginManager.js';
+import { type RouteHandler } from './primitives.js';
+type ConnectionService = Pick<ModelProviderConnectionService, 'create' | 'list' | 'get' | 'rename' | 'verify' | 'refresh' | 'disconnect' | 'cleanup'>;
+type DeviceCodeLoginManager = Pick<CodexDeviceCodeLoginManager, 'start' | 'get' | 'cancel'>;
+export interface ModelConnectionsRouteDependencies {
+    addRoute: (method: string, path: string, handler: RouteHandler) => void;
+    ensureAppAccess: (req: IncomingMessage, res: ServerResponse) => boolean;
+    resolveAuthenticatedUserId: (req: IncomingMessage) => string | null;
+    resolveRuntimeMode: (req: IncomingMessage) => 'local' | 'cloud';
+    core?: TaskforceCore;
+    service?: ConnectionService;
+    loginManager?: DeviceCodeLoginManager;
+    credentialStoragePath?: string | null;
+    lifecycleHandlers?: Array<{
+        providerKey: string;
+        authenticationType: string;
+        lifecycle: ModelProviderConnectionLifecycleHandlers;
+    }>;
+}
+export declare function registerModelConnectionsRoutes(deps: ModelConnectionsRouteDependencies): void;
+export {};