@taskforcehq/taskforce 0.3.329 → 0.3.332

package/dist/server/routes/shared.js

@@ -6,20 +6,22 @@
  * routes.ts at runtime.
  */
 import { randomUUID } from 'crypto';
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
+import { NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';
+import { isInitializeRequest, isJsonContentType } from '@modelcontextprotocol/server';
 import { TaskforceRuleError } from '../../core/Taskforce.js';
 import { resolveRequestAccess, } from '../auth.js';
 import { parseJsonBody } from './primitives.js';
-import { createTaskforceMcpServer, isMcpWriteToolName } from '../../mcp/runtime.js';
+import { createStatelessTaskforceMcpServer, createTaskforceMcpServer, isMcpWriteToolName, } from '../../mcp/runtime.js';
 import { MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS } from '../../mcp/toolRegistry.js';
 import { resolveCanonicalMcpToolName } from '../../mcp/toolCallCompatibility.js';
 import { applyPrefixedRateLimitHeaders } from '../rateLimit.js';
 import { parseAiProfileBootstrapHeaders } from '../../mcp/aiProfileBootstrap.js';
 import { parseMcpClientId } from '../../mcp/clientRegistry.js';
+import { handleModernMcpHttpRequest, isModernMcpHttpRequest, } from '../../mcp/httpProtocolRouting.js';
 import { resolveAppAccessDeniedResponse } from '../appAccess.js';
 import { resolveCloudApplicationBaseUrl } from '../../config/applicationBaseUrl.js';
 import { getRequestPerformanceDiagnostics, runWithRequestPerformanceDiagnostics, } from '../../storage/postgresRequestDiagnostics.js';
+import { beginCloudMcpCapacityRequest, isCloudMcpCapacityTelemetryEnabled, TASKFORCE_CAPACITY_TRACE_HEADER, } from '../cloudMcpCapacityTelemetry.js';
 // === SECTION: Error helpers ===
 export function resolveErrorStatusCode(error, fallback = 400) {
     if (error instanceof TaskforceRuleError)
@@ -273,7 +275,14 @@ function writeMcpHttpError(res, statusCode, message, data) {
         id: null,
     }));
 }
-function extractMcpWriteToolNames(body) {
+function resolveProductionCloudMcpToolPolicy(requestedToolName) {
+    const toolName = resolveCanonicalMcpToolName(requestedToolName);
+    return {
+        requiredScope: MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS[toolName] || null,
+        isWrite: isMcpWriteToolName(requestedToolName),
+    };
+}
+function extractMcpWriteToolNames(body, resolveToolPolicy) {
     const messages = Array.isArray(body) ? body : [body];
     const names = messages.flatMap((message) => {
         if (!message || typeof message !== 'object')
@@ -282,7 +291,7 @@ function extractMcpWriteToolNames(body) {
         if (method !== 'tools/call')
             return [];
         const toolName = String(message?.params?.name || '').trim();
-        return toolName && isMcpWriteToolName(toolName) ? [toolName] : [];
+        return toolName && resolveToolPolicy(toolName).isWrite ? [toolName] : [];
     });
     return Array.from(new Set(names));
 }
@@ -299,7 +308,7 @@ function extractFirstMcpToolName(body) {
     }
     return null;
 }
-function findDeniedCloudMcpToolName(body, scopes) {
+function findDeniedCloudMcpToolName(body, scopes, resolveToolPolicy) {
     const messages = Array.isArray(body) ? body : [body];
     for (const message of messages) {
         if (!message || typeof message !== 'object')
@@ -309,15 +318,14 @@ function findDeniedCloudMcpToolName(body, scopes) {
         const requestedToolName = String(message?.params?.name || '').trim();
         if (!requestedToolName)
             continue;
-        const toolName = resolveCanonicalMcpToolName(requestedToolName);
-        const requiredScope = MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS[toolName];
+        const requiredScope = resolveToolPolicy(requestedToolName).requiredScope;
         if (!requiredScope || !scopes.includes(requiredScope))
             return requestedToolName;
     }
     return null;
 }
 export function makeHandleCloudMcpRequest(core, deps) {
-    const { ensureAppAccess, resolveAuthenticatedUserId, writeRateLimit } = deps;
+    const { ensureAppAccess, resolveAuthenticatedUserId, writeRateLimit, createMcpServer = createTaskforceMcpServer, resolveMcpToolPolicy = resolveProductionCloudMcpToolPolicy, acquireMcpRuntime, capacityTelemetryEnabled = isCloudMcpCapacityTelemetryEnabled, beginCapacityRequest = beginCloudMcpCapacityRequest, } = deps;
     const authenticateCloudMcpRequest = makeAuthenticateCloudMcpRequest(core, {
         resolveAuthenticatedUserId,
         writeMcpHttpError,
@@ -342,7 +350,7 @@ export function makeHandleCloudMcpRequest(core, deps) {
     const applyCloudMcpWriteRateLimit = (req, res, auth, body) => {
         if (!writeRateLimit.enabled)
             return true;
-        const writeTools = extractMcpWriteToolNames(body);
+        const writeTools = extractMcpWriteToolNames(body, resolveMcpToolPolicy);
         if (writeTools.length === 0)
             return true;
         const actorKey = auth.authenticatedViaToken?.tokenId
@@ -398,97 +406,209 @@ export function makeHandleCloudMcpRequest(core, deps) {
             writeMcpHttpError(res, 400, 'The /mcp HTTP endpoint is only available in cloud runtime. In local runtime, use the local stdio MCP server (for example: `taskforce mcp <project-path>`).');
             return;
         }
-        if (!ensureAppAccess(req, res))
-            return;
-        if (req.method !== 'POST' && req.method !== 'GET' && req.method !== 'DELETE') {
-            writeMcpHttpError(res, 405, 'Method not allowed.');
-            return;
-        }
-        const authStartedAtMs = Date.now();
-        const auth = authenticateCloudMcpRequest(req, res);
-        authMs = Date.now() - authStartedAtMs;
-        if (!auth)
-            return;
-        if (req.method !== 'POST') {
-            writeMcpHttpError(res, 405, 'Method not allowed.');
-            return;
-        }
-        let body = undefined;
-        try {
-            const bodyParseStartedAtMs = Date.now();
-            body = await parseJsonBody(req);
-            bodyParseMs = Date.now() - bodyParseStartedAtMs;
-        }
-        catch (error) {
-            writeMcpHttpError(res, resolveErrorStatusCode(error, 400), 'Invalid JSON body.');
-            return;
-        }
-        const authScopes = auth.authenticatedViaToken?.scopes || auth.authenticatedViaOAuth?.scopes || [];
-        const requestId = String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || randomUUID();
-        res.setHeader('X-Request-ID', requestId);
-        const mcpMethod = !Array.isArray(body) && body !== null && typeof body === 'object'
-            ? String(body.method || '')
-            : '';
-        const initializeRequest = isInitializeRequest(body)
-            || mcpMethod === 'initialize';
-        const deniedToolName = findDeniedCloudMcpToolName(body, authScopes);
-        if (deniedToolName) {
-            core.addMcpAuditLog({
-                workspaceId: auth.workspaceId,
-                actorType: auth.authenticatedViaToken ? 'token' : auth.authenticatedViaOAuth ? 'oauth' : 'user',
-                actorUserId: auth.authenticatedViaToken?.userId || auth.authenticatedViaOAuth?.userId || auth.userId || 'anonymous',
-                tokenId: auth.authenticatedViaToken?.tokenId || auth.authenticatedViaOAuth?.grantId || null,
-                toolName: deniedToolName,
-                details: {
-                    requestId,
-                    ip: req.socket?.remoteAddress || null,
-                    userAgent: requestHeader(req, 'user-agent', '') || null,
-                    outcome: 'deny',
-                    reasonCode: 'scope_denied',
-                    scopes: authScopes
+        const capacityRequest = beginCapacityRequest();
+        const capacityTraceEnabled = requestHeader(req, TASKFORCE_CAPACITY_TRACE_HEADER, '').trim() === '1';
+        return runWithRequestPerformanceDiagnostics(capacityTelemetryEnabled(), async () => {
+            let capacitySettled = false;
+            const settleCapacity = (aborted = false) => {
+                if (capacitySettled)
+                    return;
+                capacitySettled = true;
+                capacityRequest.finish({
+                    statusCode: res.statusCode,
+                    aborted,
+                    postgres: getRequestPerformanceDiagnostics(),
+                });
+            };
+            const onFinish = () => settleCapacity(false);
+            const onClose = () => settleCapacity(!res.writableEnded);
+            res.once('finish', onFinish);
+            res.once('close', onClose);
+            try {
+                if (!ensureAppAccess(req, res))
+                    return;
+                if (req.method !== 'POST' && req.method !== 'GET' && req.method !== 'DELETE') {
+                    writeMcpHttpError(res, 405, 'Method not allowed.');
+                    return;
                 }
-            });
-            writeMcpHttpError(res, 403, 'Forbidden.');
-            return;
-        }
-        const writeToolNames = extractMcpWriteToolNames(body);
-        const rateLimitStartedAtMs = Date.now();
-        const rateLimitAllowed = applyCloudMcpWriteRateLimit(req, res, auth, body);
-        rateLimitMs = Date.now() - rateLimitStartedAtMs;
-        if (!rateLimitAllowed)
-            return;
-        let runtime = null;
-        let runtimeConstructionMs = 0;
-        let transportConnectMs = 0;
-        let requestHandlingMs = 0;
-        let cleanupMs = 0;
-        let outcome = 'success';
-        const toolTimingState = { value: null };
-        try {
-            const runtimeStartedAtMs = Date.now();
-            // Intentionally isolate the MCP runtime per HTTP request. The runtime closes over
-            // workspace auth, AI identity, permissions, subscriptions, and mutable helper state;
-            // sharing it could leak state across tenants or callers. Keep the transport stateless
-            // too. The timing event below measures construction cost so caching is only revisited
-            // with evidence and must preserve these boundaries (including dynamic tool schemas).
-            runtime = createTaskforceMcpServer({
-                projectRoot: core.getPaths().projectRoot,
-                tenantId: core.getTenantId(),
-                workspaceId: auth.workspaceId,
-                core,
-                serverName: 'taskforce-cloud',
-                logStartup: false,
-                runtimeMode: 'cloud',
-                applicationBaseUrl: resolveCloudApplicationBaseUrl(),
-                auth: buildCloudMcpRuntimeAuth({
-                    req,
-                    auth,
-                    requestHeader,
-                    requestId,
-                    authScopes,
-                }),
-                onToolCallTiming: (timing) => {
-                    toolTimingState.value = timing;
+                const authStartedAtMs = Date.now();
+                const auth = authenticateCloudMcpRequest(req, res);
+                authMs = Date.now() - authStartedAtMs;
+                if (!auth)
+                    return;
+                if (capacityTraceEnabled)
+                    capacityRequest.setTraceHeaders(res);
+                if (req.method !== 'POST') {
+                    writeMcpHttpError(res, 405, 'Method not allowed.');
+                    return;
+                }
+                if (!isJsonContentType(requestHeader(req, 'content-type', ''))) {
+                    writeMcpHttpError(res, 415, 'Unsupported Media Type: Content-Type must be application/json');
+                    return;
+                }
+                let body = undefined;
+                try {
+                    const bodyParseStartedAtMs = Date.now();
+                    body = await parseJsonBody(req);
+                    bodyParseMs = Date.now() - bodyParseStartedAtMs;
+                }
+                catch (error) {
+                    writeMcpHttpError(res, resolveErrorStatusCode(error, 400), 'Invalid JSON body.');
+                    return;
+                }
+                const authScopes = auth.authenticatedViaToken?.scopes || auth.authenticatedViaOAuth?.scopes || [];
+                const requestId = String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || randomUUID();
+                res.setHeader('X-Request-ID', requestId);
+                const mcpMethod = !Array.isArray(body) && body !== null && typeof body === 'object'
+                    ? String(body.method || '')
+                    : '';
+                const initializeRequest = isInitializeRequest(body)
+                    || mcpMethod === 'initialize';
+                const modernProtocolRequest = await isModernMcpHttpRequest(req, body);
+                const writeToolNames = extractMcpWriteToolNames(body, resolveMcpToolPolicy);
+                const requestClass = initializeRequest
+                    ? 'initialize'
+                    : mcpMethod === 'server/discover'
+                        ? 'discover'
+                        : mcpMethod === 'tools/list'
+                            ? 'tools_list'
+                            : writeToolNames.length > 0
+                                ? 'write'
+                                : extractFirstMcpToolName(body)
+                                    ? 'read'
+                                    : 'other';
+                capacityRequest.classify(requestClass);
+                const deniedToolName = findDeniedCloudMcpToolName(body, authScopes, resolveMcpToolPolicy);
+                if (deniedToolName) {
+                    core.addMcpAuditLog({
+                        workspaceId: auth.workspaceId,
+                        actorType: auth.authenticatedViaToken ? 'token' : auth.authenticatedViaOAuth ? 'oauth' : 'user',
+                        actorUserId: auth.authenticatedViaToken?.userId || auth.authenticatedViaOAuth?.userId || auth.userId || 'anonymous',
+                        tokenId: auth.authenticatedViaToken?.tokenId || auth.authenticatedViaOAuth?.grantId || null,
+                        toolName: deniedToolName,
+                        details: {
+                            requestId,
+                            ip: req.socket?.remoteAddress || null,
+                            userAgent: requestHeader(req, 'user-agent', '') || null,
+                            outcome: 'deny',
+                            reasonCode: 'scope_denied',
+                            scopes: authScopes
+                        }
+                    });
+                    writeMcpHttpError(res, 403, 'Forbidden.');
+                    return;
+                }
+                const rateLimitStartedAtMs = Date.now();
+                const rateLimitAllowed = applyCloudMcpWriteRateLimit(req, res, auth, body);
+                rateLimitMs = Date.now() - rateLimitStartedAtMs;
+                if (!rateLimitAllowed)
+                    return;
+                let runtime = null;
+                let runtimeLease = null;
+                let runtimeConstructionMs = 0;
+                let transportConnectMs = 0;
+                let requestHandlingMs = 0;
+                let cleanupMs = 0;
+                let outcome = 'success';
+                const toolTimingState = { value: null };
+                try {
+                    const runtimeStartedAtMs = Date.now();
+                    // Production intentionally isolates the MCP runtime per HTTP request. The runtime closes over
+                    // workspace auth, AI identity, permissions, subscriptions, and mutable helper state;
+                    // sharing it could leak state across tenants or callers. Keep the transport stateless
+                    // too. The timing event below measures construction cost so caching is only revisited
+                    // with evidence and must preserve these boundaries (including dynamic tool schemas). The optional
+                    // lease seam exists only for transport conformance tests that must carry legacy bidirectional calls.
+                    const runtimeOptions = {
+                        projectRoot: core.getPaths().projectRoot,
+                        tenantId: core.getTenantId(),
+                        workspaceId: auth.workspaceId,
+                        core,
+                        serverName: 'taskforce-cloud',
+                        logStartup: false,
+                        runtimeMode: 'cloud',
+                        toolProfile: auth.authenticatedViaToken?.toolProfile || auth.authenticatedViaOAuth?.toolProfile || 'default',
+                        applicationBaseUrl: resolveCloudApplicationBaseUrl(),
+                        auth: buildCloudMcpRuntimeAuth({
+                            req,
+                            auth,
+                            requestHeader,
+                            requestId,
+                            authScopes,
+                        }),
+                        onToolCallTiming: (timing) => {
+                            toolTimingState.value = timing;
+                            if (!res.headersSent) {
+                                if (capacityTraceEnabled) {
+                                    capacityRequest.setTraceHeaders(res, getRequestPerformanceDiagnostics());
+                                }
+                                setServerTimingHeader(res, [
+                                    { name: 'auth', durationMs: authMs },
+                                    { name: 'body-parse', durationMs: bodyParseMs },
+                                    { name: 'rate-limit', durationMs: rateLimitMs },
+                                    { name: 'runtime', durationMs: runtimeConstructionMs },
+                                    { name: 'transport-connect', durationMs: transportConnectMs },
+                                    { name: 'tool-envelope-prepare', durationMs: timing.preparationMs },
+                                    { name: 'tool-envelope-validate', durationMs: timing.validationMs },
+                                    { name: 'tool-handler', durationMs: timing.handlerMs },
+                                    ...Object.entries(timing.subphases).map(([phase, durationMs]) => ({
+                                        name: `tool-${phase}`,
+                                        durationMs,
+                                    })),
+                                ]);
+                            }
+                        },
+                    };
+                    if (modernProtocolRequest) {
+                        const requestHandlingStartedAtMs = Date.now();
+                        await handleModernMcpHttpRequest({
+                            req,
+                            res,
+                            parsedBody: body,
+                            factory: ({ era }) => {
+                                const constructionStartedAtMs = Date.now();
+                                const modernRuntime = createStatelessTaskforceMcpServer({
+                                    ...runtimeOptions,
+                                    protocolEra: era,
+                                }, createMcpServer);
+                                runtimeConstructionMs = Date.now() - constructionStartedAtMs;
+                                if (!res.headersSent) {
+                                    setServerTimingHeader(res, [
+                                        { name: 'auth', durationMs: authMs },
+                                        { name: 'body-parse', durationMs: bodyParseMs },
+                                        { name: 'rate-limit', durationMs: rateLimitMs },
+                                        { name: 'runtime', durationMs: runtimeConstructionMs },
+                                    ]);
+                                }
+                                return modernRuntime.server;
+                            },
+                            onerror: (error) => {
+                                console.warn('[Taskforce MCP] Modern cloud request rejected:', {
+                                    requestId,
+                                    message: error.message,
+                                });
+                            },
+                        });
+                        requestHandlingMs = Date.now() - requestHandlingStartedAtMs;
+                        recordCloudMcpCredentialUsage(req, auth.authenticatedViaToken, auth.authenticatedViaOAuth);
+                        return;
+                    }
+                    runtimeLease = acquireMcpRuntime
+                        ? await acquireMcpRuntime({ req, options: runtimeOptions })
+                        : null;
+                    runtime = runtimeLease?.runtime
+                        || createStatelessTaskforceMcpServer(runtimeOptions, createMcpServer);
+                    runtimeConstructionMs = Date.now() - runtimeStartedAtMs;
+                    const transport = runtimeLease?.transport || new NodeStreamableHTTPServerTransport({
+                        sessionIdGenerator: undefined,
+                        enableJsonResponse: true,
+                    });
+                    const transportStartedAtMs = Date.now();
+                    if (!runtimeLease)
+                        await runtime.server.connect(transport);
+                    transportConnectMs = Date.now() - transportStartedAtMs;
+                    // Set request-level phases before the SDK writes response headers. Tool calls replace this
+                    // with the richer envelope/handler breakdown from onToolCallTiming above.
                     if (!res.headersSent) {
                         setServerTimingHeader(res, [
                             { name: 'auth', durationMs: authMs },
@@ -496,94 +616,90 @@ export function makeHandleCloudMcpRequest(core, deps) {
                             { name: 'rate-limit', durationMs: rateLimitMs },
                             { name: 'runtime', durationMs: runtimeConstructionMs },
                             { name: 'transport-connect', durationMs: transportConnectMs },
-                            { name: 'tool-envelope-prepare', durationMs: timing.preparationMs },
-                            { name: 'tool-envelope-validate', durationMs: timing.validationMs },
-                            { name: 'tool-handler', durationMs: timing.handlerMs },
-                            ...Object.entries(timing.subphases).map(([phase, durationMs]) => ({
-                                name: `tool-${phase}`,
-                                durationMs,
-                            })),
                         ]);
                     }
-                },
-            });
-            runtimeConstructionMs = Date.now() - runtimeStartedAtMs;
-            const transport = new StreamableHTTPServerTransport({
-                sessionIdGenerator: undefined,
-                enableJsonResponse: true,
-            });
-            const transportStartedAtMs = Date.now();
-            await runtime.server.connect(transport);
-            transportConnectMs = Date.now() - transportStartedAtMs;
-            if (!initializeRequest) {
-                // Stateless cloud sessions still require a valid MCP JSON-RPC request;
-                // let the SDK validate and respond rather than trying to track sessions server-side.
-            }
-            const requestHandlingStartedAtMs = Date.now();
-            await transport.handleRequest(req, res, body);
-            requestHandlingMs = Date.now() - requestHandlingStartedAtMs;
-            recordCloudMcpCredentialUsage(req, auth.authenticatedViaToken, auth.authenticatedViaOAuth);
-        }
-        catch (error) {
-            outcome = 'failure';
-            console.error('[Taskforce MCP] Cloud transport request failed:', {
-                requestId,
-                kind: 'tool_transport_failure',
-                message: error instanceof Error ? error.message : String(error),
-            });
-            if (!res.headersSent) {
-                writeMcpHttpError(res, 500, 'MCP transport failure.', {
-                    kind: 'tool_transport_failure',
-                    retryable: true,
-                    requestId,
-                });
-            }
-        }
-        finally {
-            if (runtime) {
-                const cleanupStartedAtMs = Date.now();
-                try {
-                    await runtime.server.close();
+                    const requestHandlingStartedAtMs = Date.now();
+                    await transport.handleRequest(req, res, body);
+                    requestHandlingMs = Date.now() - requestHandlingStartedAtMs;
+                    recordCloudMcpCredentialUsage(req, auth.authenticatedViaToken, auth.authenticatedViaOAuth);
                 }
-                catch (closeError) {
-                    console.warn('[Taskforce MCP] Cloud transport cleanup failed:', closeError);
+                catch (error) {
+                    outcome = 'failure';
+                    console.error('[Taskforce MCP] Cloud transport request failed:', {
+                        requestId,
+                        kind: 'tool_transport_failure',
+                        message: error instanceof Error ? error.message : String(error),
+                    });
+                    if (!res.headersSent) {
+                        writeMcpHttpError(res, 500, 'MCP transport failure.', {
+                            kind: 'tool_transport_failure',
+                            retryable: true,
+                            requestId,
+                        });
+                    }
+                }
+                finally {
+                    if (runtimeLease) {
+                        const cleanupStartedAtMs = Date.now();
+                        try {
+                            await runtimeLease.release();
+                        }
+                        catch (closeError) {
+                            console.warn('[Taskforce MCP] Cloud test runtime lease cleanup failed:', closeError);
+                        }
+                        cleanupMs = Date.now() - cleanupStartedAtMs;
+                    }
+                    else if (runtime) {
+                        const cleanupStartedAtMs = Date.now();
+                        try {
+                            await runtime.server.close();
+                        }
+                        catch (closeError) {
+                            console.warn('[Taskforce MCP] Cloud transport cleanup failed:', closeError);
+                        }
+                        cleanupMs = Date.now() - cleanupStartedAtMs;
+                    }
+                    const totalDurationMs = Date.now() - requestStartedAtMs;
+                    if (initializeRequest || mcpMethod === 'tools/list' || writeToolNames.length > 0 || totalDurationMs >= 250) {
+                        const timingSnapshot = toolTimingState.value;
+                        console.info(`[Taskforce MCP] ${JSON.stringify({
+                            event: 'cloud_request_timing',
+                            requestId,
+                            requestKind: initializeRequest
+                                ? 'initialize'
+                                : mcpMethod === 'tools/list'
+                                    ? 'tools_list'
+                                    : (extractFirstMcpToolName(body) ? 'tool_call' : 'other'),
+                            method: mcpMethod || null,
+                            toolName: extractFirstMcpToolName(body),
+                            workspaceId: auth.workspaceId,
+                            databaseProvider: core.getDatabaseProvider(),
+                            authMode: auth.authenticatedViaToken ? 'token' : auth.authenticatedViaOAuth ? 'oauth' : 'user',
+                            batchSize: Array.isArray(body) ? body.length : 1,
+                            isWrite: writeToolNames.length > 0,
+                            outcome,
+                            httpStatus: res.statusCode,
+                            responseBytes: timingSnapshot?.responseBytes ?? null,
+                            totalDurationMs,
+                            preRuntimeMs: Math.max(0, totalDurationMs - runtimeConstructionMs - transportConnectMs - requestHandlingMs - cleanupMs),
+                            authMs,
+                            bodyParseMs,
+                            rateLimitMs,
+                            runtimeConstructionMs,
+                            transportConnectMs,
+                            requestHandlingMs,
+                            cleanupMs,
+                            toolTiming: timingSnapshot,
+                        })}`);
+                    }
                 }
-                cleanupMs = Date.now() - cleanupStartedAtMs;
             }
-            const totalDurationMs = Date.now() - requestStartedAtMs;
-            if (initializeRequest || mcpMethod === 'tools/list' || writeToolNames.length > 0 || totalDurationMs >= 250) {
-                const timingSnapshot = toolTimingState.value;
-                console.info(`[Taskforce MCP] ${JSON.stringify({
-                    event: 'cloud_request_timing',
-                    requestId,
-                    requestKind: initializeRequest
-                        ? 'initialize'
-                        : mcpMethod === 'tools/list'
-                            ? 'tools_list'
-                            : (extractFirstMcpToolName(body) ? 'tool_call' : 'other'),
-                    method: mcpMethod || null,
-                    toolName: extractFirstMcpToolName(body),
-                    workspaceId: auth.workspaceId,
-                    databaseProvider: core.getDatabaseProvider(),
-                    authMode: auth.authenticatedViaToken ? 'token' : auth.authenticatedViaOAuth ? 'oauth' : 'user',
-                    batchSize: Array.isArray(body) ? body.length : 1,
-                    isWrite: writeToolNames.length > 0,
-                    outcome,
-                    httpStatus: res.statusCode,
-                    responseBytes: timingSnapshot?.responseBytes ?? null,
-                    totalDurationMs,
-                    preRuntimeMs: Math.max(0, totalDurationMs - runtimeConstructionMs - transportConnectMs - requestHandlingMs - cleanupMs),
-                    authMs,
-                    bodyParseMs,
-                    rateLimitMs,
-                    runtimeConstructionMs,
-                    transportConnectMs,
-                    requestHandlingMs,
-                    cleanupMs,
-                    toolTiming: timingSnapshot,
-                })}`);
+            finally {
+                settleCapacity(Boolean(req.destroyed && !res.writableEnded));
+                res.off('finish', onFinish);
+                res.off('close', onClose);
             }
-        }
+        });
     };
 }
 // === SECTION: Request header helpers ===

package/dist/server/routes/sync.js

@@ -573,6 +573,7 @@ export function registerSyncRoutes(deps) {
             }
             const { result } = await dispatchWorkspaceSyncChanges(cloudWorkspaceId, fenced.changes, {
                 coexistenceDirection: 'cloud-push',
+                actorUserId: access.userId,
                 assertedActiveV3TaskMetadataIds,
                 assertedActiveV3TaskLifecycleIds,
                 assertedActiveV3TaskReopenAssigneeIds,

package/dist/server/routes/syncAuxRoutes.js

@@ -1,4 +1,5 @@
 import { applyWorkspaceRepair } from '../../sync/workspaceRepair.js';
+import { WorkspaceSyncContentPullObligationStore } from '../../sync/engine/workspaceSyncContentPullObligationStore.js';
 import { normalizeSyncEventDetails } from '../../utils/syncEventDetails.js';
 import { parseJsonBody } from './primitives.js';
 import { requireAuthenticatedSyncRequest } from './syncRouteGuards.js';
@@ -54,7 +55,9 @@ export function registerWorkspaceSyncAuxRoutes({ addRoute, core, context, resolv
     // stale links. Does NOT tombstone metadata for files that appear missing locally — a single
     // failed existence check at startup can mean the content is only temporarily unavailable
     // (e.g. storage not yet mounted/synced), not deleted; that requires explicit admin
-    // confirmation via /api/taskforce/admin/workspace-repair/apply. Never deletes files.
+    // confirmation via /api/taskforce/admin/workspace-repair/apply. Never deletes files. When
+    // content availability genuinely can't be verified, queues a durable content-pull recovery
+    // obligation instead, which resolves automatically once a later scan confirms the content.
     // Called once by the sync orchestrator when the workspace becomes active.
     addRoute('POST', '/api/taskforce/sync/workspace/repair-startup', async (req, res) => {
         const authConfig = context.authConfig;
@@ -83,6 +86,7 @@ export function registerWorkspaceSyncAuxRoutes({ addRoute, core, context, resolv
             deletedTasks: core.listWorkspaceSyncDeletes(workspaceId) || [],
             workspaceAssetStore,
             publishedContentResolver,
+            contentPullObligationStore: new WorkspaceSyncContentPullObligationStore(core.getDatabaseAdapter()),
             aiProfiles: typeof core.listAiProfiles === 'function'
                 ? core.listAiProfiles(workspaceId, { includeArchived: true }) || []
                 : [],

package/dist/server/routes/syncPushRoutes.d.ts

@@ -21,6 +21,7 @@ interface RegisterWorkspacePushSyncRoutesArgs {
     dispatchWorkspaceSyncChanges: (workspaceId: string, incomingChanges: WorkspaceSyncChange[], options?: {
         allowReferenceNumberReassignment?: boolean;
         coexistenceDirection?: 'cloud-push';
+        actorUserId?: string;
         assertedActiveV3TaskMetadataIds?: ReadonlySet<string>;
         assertedActiveV3TaskLifecycleIds?: ReadonlySet<string>;
         assertedActiveV3TaskReopenAssigneeIds?: ReadonlySet<string>;

package/dist/server/routes/syncPushRoutes.js

@@ -270,6 +270,7 @@ export function registerWorkspacePushSyncRoutes({ addRoute, core, context, audit
             const { result, deleteCount, emittedEventIds } = await dispatchWorkspaceSyncChanges(targetWorkspaceId, incomingChanges, {
                 allowReferenceNumberReassignment,
                 coexistenceDirection: 'cloud-push',
+                actorUserId: String(access.userId || '').trim(),
                 assertedActiveV3TaskMetadataIds,
                 assertedActiveV3TaskLifecycleIds,
                 assertedActiveV3TaskReopenAssigneeIds,