@taskforcehq/taskforce 0.3.330 → 0.3.332

package/dist/server/cloudMcpCapacityTelemetry.js

@@ -0,0 +1,221 @@
+import { monitorEventLoopDelay, performance } from 'node:perf_hooks';
+export const TASKFORCE_CAPACITY_TRACE_HEADER = 'x-taskforce-capacity-trace';
+function finite(value) {
+    return Number.isFinite(value) ? Math.max(0, value) : 0;
+}
+function millisecondsFromNanoseconds(value) {
+    return finite(value) / 1_000_000;
+}
+function percentile(values, rank) {
+    if (values.length === 0)
+        return 0;
+    const sorted = [...values].sort((a, b) => a - b);
+    const index = Math.min(sorted.length - 1, Math.max(0, Math.ceil((rank / 100) * sorted.length) - 1));
+    return finite(sorted[index]);
+}
+function classifyOutcome(statusCode, aborted) {
+    if (aborted)
+        return 'timeout_or_abort';
+    if (statusCode >= 500)
+        return 'server_error';
+    if (statusCode === 401 || statusCode === 403 || statusCode === 405 || statusCode === 415 || statusCode === 429) {
+        return 'rejected';
+    }
+    if (statusCode >= 400)
+        return 'client_error';
+    return 'success';
+}
+function classifyRejection(statusCode) {
+    if (statusCode === 429)
+        return 'rate_limited';
+    if (statusCode === 401 || statusCode === 403)
+        return 'auth_or_scope';
+    if (statusCode === 405 || statusCode === 415)
+        return 'protocol';
+    return statusCode >= 400 && statusCode < 500 ? 'other_client' : null;
+}
+function classifyStatus(statusCode) {
+    if (statusCode >= 200 && statusCode < 300)
+        return '2xx';
+    if (statusCode >= 300 && statusCode < 400)
+        return '3xx';
+    if (statusCode >= 400 && statusCode < 500)
+        return '4xx';
+    if (statusCode >= 500 && statusCode < 600)
+        return '5xx';
+    return 'other';
+}
+export class CloudMcpCapacityTelemetry {
+    emit;
+    eventLoop;
+    now;
+    cpuUsage;
+    memoryUsage;
+    windowMs;
+    maxSamples;
+    activeRequests = 0;
+    maxActiveRequests = 0;
+    samples = [];
+    completedRequests = 0;
+    requestClassCounts = {};
+    outcomeCounts = {};
+    rejectionCounts = {};
+    statusClassCounts = {};
+    windowStartedAt;
+    windowCpuStartedAt;
+    flushTimer;
+    constructor(options = {}) {
+        this.emit = options.emit || ((payload) => console.info(`[Taskforce MCP] ${JSON.stringify(payload)}`));
+        this.eventLoop = options.eventLoop || monitorEventLoopDelay({ resolution: 20 });
+        this.now = options.now || (() => performance.now());
+        this.cpuUsage = options.cpuUsage || process.cpuUsage.bind(process);
+        this.memoryUsage = options.memoryUsage || process.memoryUsage.bind(process);
+        this.windowMs = Math.max(1_000, options.windowMs || 60_000);
+        this.maxSamples = Math.max(10, options.maxSamples || 2_048);
+        this.windowStartedAt = this.now();
+        this.windowCpuStartedAt = this.cpuUsage();
+        this.eventLoop.enable();
+        this.flushTimer = setInterval(() => this.flush(), this.windowMs);
+        this.flushTimer.unref?.();
+    }
+    begin(requestClass = 'other') {
+        const startedAt = this.now();
+        let settled = false;
+        let currentClass = requestClass;
+        this.activeRequests += 1;
+        this.maxActiveRequests = Math.max(this.maxActiveRequests, this.activeRequests);
+        return {
+            classify: (nextClass) => {
+                currentClass = nextClass;
+            },
+            setTraceHeaders: (res, postgres) => {
+                if (res.headersSent)
+                    return;
+                const memory = this.memoryUsage();
+                res.setHeader('X-Taskforce-MCP-Active-Requests', String(this.activeRequests));
+                res.setHeader('X-Taskforce-MCP-Max-Active-Requests', String(this.maxActiveRequests));
+                res.setHeader('X-Taskforce-Event-Loop-P95-Ms', millisecondsFromNanoseconds(this.eventLoop.percentile(95)).toFixed(2));
+                res.setHeader('X-Taskforce-Event-Loop-Max-Ms', millisecondsFromNanoseconds(this.eventLoop.max).toFixed(2));
+                res.setHeader('X-Taskforce-Process-RSS-Bytes', String(memory.rss));
+                res.setHeader('X-Taskforce-Process-Heap-Used-Bytes', String(memory.heapUsed));
+                if (postgres) {
+                    res.setHeader('X-Taskforce-Postgres-Worker-Wait-Ms', postgres.postgresWorkerWaitMs.toFixed(2));
+                    res.setHeader('X-Taskforce-Postgres-Worker-Wait-Max-Ms', postgres.postgresWorkerWaitMaxMs.toFixed(2));
+                    res.setHeader('X-Taskforce-Postgres-Pool-Waiting-Max', String(postgres.postgresPoolWaitingMax));
+                    res.setHeader('X-Taskforce-Postgres-Pool-Total-Max', String(postgres.postgresPoolTotalMax));
+                    if (postgres.postgresPoolIdleMin !== null) {
+                        res.setHeader('X-Taskforce-Postgres-Pool-Idle-Min', String(postgres.postgresPoolIdleMin));
+                    }
+                }
+            },
+            finish: (input) => {
+                if (settled)
+                    return;
+                settled = true;
+                this.activeRequests = Math.max(0, this.activeRequests - 1);
+                const outcome = classifyOutcome(input.statusCode, input.aborted === true);
+                this.completedRequests += 1;
+                this.requestClassCounts[currentClass] = (this.requestClassCounts[currentClass] || 0) + 1;
+                this.outcomeCounts[outcome] = (this.outcomeCounts[outcome] || 0) + 1;
+                const rejection = classifyRejection(input.statusCode);
+                if (rejection)
+                    this.rejectionCounts[rejection] = (this.rejectionCounts[rejection] || 0) + 1;
+                const statusClass = classifyStatus(input.statusCode);
+                this.statusClassCounts[statusClass] = (this.statusClassCounts[statusClass] || 0) + 1;
+                this.samples.push({
+                    requestClass: currentClass,
+                    outcome,
+                    durationMs: finite(this.now() - startedAt),
+                    postgres: input.postgres,
+                });
+                if (this.samples.length > this.maxSamples)
+                    this.samples.splice(0, this.samples.length - this.maxSamples);
+                this.flushIfDue();
+            },
+        };
+    }
+    snapshot() {
+        const memory = this.memoryUsage();
+        const durations = this.samples.map((sample) => sample.durationMs);
+        const workerWaits = this.samples.map((sample) => sample.postgres?.postgresWorkerWaitMs || 0);
+        const cpu = this.cpuUsage(this.windowCpuStartedAt);
+        return {
+            event: 'cloud_mcp_capacity_window',
+            windowMs: Math.max(0, Math.round(this.now() - this.windowStartedAt)),
+            requests: this.completedRequests,
+            activeRequests: this.activeRequests,
+            maxActiveRequests: this.maxActiveRequests,
+            requestClasses: { ...this.requestClassCounts },
+            outcomes: { ...this.outcomeCounts },
+            rejections: { ...this.rejectionCounts },
+            statusClasses: { ...this.statusClassCounts },
+            durationMs: { p50: percentile(durations, 50), p95: percentile(durations, 95), p99: percentile(durations, 99) },
+            eventLoopDelayMs: {
+                p50: millisecondsFromNanoseconds(this.eventLoop.percentile(50)),
+                p95: millisecondsFromNanoseconds(this.eventLoop.percentile(95)),
+                p99: millisecondsFromNanoseconds(this.eventLoop.percentile(99)),
+                max: millisecondsFromNanoseconds(this.eventLoop.max),
+            },
+            process: {
+                cpuUserMs: finite(cpu.user / 1_000),
+                cpuSystemMs: finite(cpu.system / 1_000),
+                rssBytes: memory.rss,
+                heapUsedBytes: memory.heapUsed,
+                heapTotalBytes: memory.heapTotal,
+                externalBytes: memory.external,
+            },
+            postgres: {
+                workerWaitMsP95: percentile(workerWaits, 95),
+                maxPoolWaiting: Math.max(0, ...this.samples.map((sample) => sample.postgres?.postgresPoolWaitingMax || 0)),
+                maxPoolTotal: Math.max(0, ...this.samples.map((sample) => sample.postgres?.postgresPoolTotalMax || 0)),
+                minPoolIdle: this.minimumPoolIdle(),
+            },
+        };
+    }
+    flush() {
+        if (this.completedRequests === 0 && this.activeRequests === 0)
+            return null;
+        const payload = this.snapshot();
+        this.emit(payload);
+        this.samples = [];
+        this.completedRequests = 0;
+        this.requestClassCounts = {};
+        this.outcomeCounts = {};
+        this.rejectionCounts = {};
+        this.statusClassCounts = {};
+        this.maxActiveRequests = this.activeRequests;
+        this.windowStartedAt = this.now();
+        this.windowCpuStartedAt = this.cpuUsage();
+        this.eventLoop.reset();
+        return payload;
+    }
+    shutdown() {
+        clearInterval(this.flushTimer);
+        this.eventLoop.disable?.();
+    }
+    flushIfDue() {
+        if (this.now() - this.windowStartedAt >= this.windowMs)
+            this.flush();
+    }
+    minimumPoolIdle() {
+        const values = this.samples
+            .map((sample) => sample.postgres?.postgresPoolIdleMin)
+            .filter((value) => typeof value === 'number');
+        return values.length > 0 ? Math.min(...values) : null;
+    }
+}
+let defaultTelemetry = null;
+export function isCloudMcpCapacityTelemetryEnabled() {
+    return process.env.TASKFORCE_CLOUD_MCP_CAPACITY_TELEMETRY !== '0';
+}
+export function beginCloudMcpCapacityRequest(requestClass = 'other') {
+    if (!isCloudMcpCapacityTelemetryEnabled()) {
+        return {
+            classify: (_nextClass) => undefined,
+            setTraceHeaders: (_res, _postgres) => undefined,
+            finish: (_input) => undefined,
+        };
+    }
+    defaultTelemetry ||= new CloudMcpCapacityTelemetry();
+    return defaultTelemetry.begin(requestClass);
+}

package/dist/server/localWorkspaceSyncServerRuntime.js

@@ -3,7 +3,7 @@ import { LocalSyncCoordinatorStore } from '../sync/coordinator/localSyncCoordina
 import { LocalSyncDispatchTracker } from '../sync/coordinator/localSyncDispatchTracker.js';
 import { LocalSyncExecutionPermitStore } from '../sync/coordinator/localSyncExecutionPermitStore.js';
 import { LocalSyncOwnershipDrainBarrier } from '../sync/coordinator/localSyncOwnershipDrainBarrier.js';
-import { LocalWorkspaceSyncRunner, } from '../sync/coordinator/localWorkspaceSyncRunner.js';
+import { canCoordinatorRecoveryPreemptRetry, LocalWorkspaceSyncRunner, } from '../sync/coordinator/localWorkspaceSyncRunner.js';
 import { reconcileSettledV3DispatchRecoveryObligations, } from '../sync/coordinator/localSyncV3DispatchRecoveryReconciler.js';
 import { LocalWorkspaceSyncRunnerStateStore } from '../sync/coordinator/localWorkspaceSyncRunnerState.js';
 import { WorkspaceSyncCredentialBroker, } from '../sync/coordinator/workspaceSyncCredentialBroker.js';
@@ -518,7 +518,13 @@ export class LocalWorkspaceSyncServerRuntime {
         if (!status.checkpoint?.checkpoint.syncEnabled)
             return;
         const retry = status.checkpoint.checkpoint.retry;
-        if (retry && Date.parse(retry.retryAt) > this.now().getTime()) {
+        const coordinatorRecoveryPlan = this.permitStore.inspectAuthoritativeRepairRecoveryObligations(bundle.context.workspaceId);
+        const retryWaiting = Boolean(retry && Date.parse(retry.retryAt) > this.now().getTime());
+        const recoveryPreemptsRetry = Boolean(retryWaiting
+            && retry
+            && coordinatorRecoveryPlan.total > 0
+            && canCoordinatorRecoveryPreemptRetry(retry.kind));
+        if (retryWaiting && retry && !recoveryPreemptsRetry) {
             // Authoritative repair cannot proceed while covered local
             // operations remain active. Keep settling those operations during
             // the repair backoff window so a dependency that becomes due
@@ -534,9 +540,8 @@ export class LocalWorkspaceSyncServerRuntime {
             }
             return;
         }
-        const retryDue = Boolean(retry);
+        const retryDue = Boolean(retry) && !recoveryPreemptsRetry;
         const wakeEpoch = this.ordinaryWakeEpoch;
-        const coordinatorRecoveryPlan = this.permitStore.inspectAuthoritativeRepairRecoveryObligations(bundle.context.workspaceId);
         if (retry?.kind === 'v2-content-push') {
             // This retry exists specifically to publish content required by a
             // blocked durable operation. Re-dispatching that same operation
@@ -585,7 +590,10 @@ export class LocalWorkspaceSyncServerRuntime {
             || state.coordinatorGeneration !== bundle.context.coordinatorGeneration) {
             return;
         }
-        if (retryDue) {
+        if (recoveryPreemptsRetry) {
+            await bundle.runner.recoverCoordinatorObligationsDue(() => this.permitStore.inspectAuthoritativeRepairRecoveryObligations(bundle.context.workspaceId).total > 0);
+        }
+        else if (retryDue) {
             await bundle.runner.retryDue();
         }
         else if (wakeSources.size === 1

package/dist/server/routes/admin.js

@@ -2432,7 +2432,7 @@ export function registerAdminRoutes(deps) {
     addRoute('OPTIONS', '/mcp', async (_req, res) => {
         res.writeHead(204, {
             'Access-Control-Allow-Origin': '*',
-            'Access-Control-Allow-Headers': 'authorization, content-type, accept, last-event-id, mcp-protocol-version, mcp-session-id, x-taskforce-workspace-id, x-taskforce-mcp-client-id, x-taskforce-ai-profile-token, x-taskforce-ai-name, x-taskforce-ai-icon, x-taskforce-ai-color, x-taskforce-ai-description, x-taskforce-ai-role, x-taskforce-ai-provider, x-taskforce-ai-model, x-taskforce-ai-surface-type',
+            'Access-Control-Allow-Headers': 'authorization, content-type, accept, mcp-protocol-version, mcp-method, mcp-name, x-taskforce-workspace-id, x-taskforce-mcp-client-id, x-taskforce-ai-profile-token, x-taskforce-ai-name, x-taskforce-ai-icon, x-taskforce-ai-color, x-taskforce-ai-description, x-taskforce-ai-role, x-taskforce-ai-provider, x-taskforce-ai-model, x-taskforce-ai-surface-type',
             'Access-Control-Allow-Methods': 'GET, HEAD, POST, DELETE, OPTIONS'
         });
         res.end();
@@ -2440,7 +2440,7 @@ export function registerAdminRoutes(deps) {
     addRoute('OPTIONS', '/mcp/', async (_req, res) => {
         res.writeHead(204, {
             'Access-Control-Allow-Origin': '*',
-            'Access-Control-Allow-Headers': 'authorization, content-type, accept, last-event-id, mcp-protocol-version, mcp-session-id, x-taskforce-workspace-id, x-taskforce-mcp-client-id, x-taskforce-ai-profile-token, x-taskforce-ai-name, x-taskforce-ai-icon, x-taskforce-ai-color, x-taskforce-ai-description, x-taskforce-ai-role, x-taskforce-ai-provider, x-taskforce-ai-model, x-taskforce-ai-surface-type',
+            'Access-Control-Allow-Headers': 'authorization, content-type, accept, mcp-protocol-version, mcp-method, mcp-name, x-taskforce-workspace-id, x-taskforce-mcp-client-id, x-taskforce-ai-profile-token, x-taskforce-ai-name, x-taskforce-ai-icon, x-taskforce-ai-color, x-taskforce-ai-description, x-taskforce-ai-role, x-taskforce-ai-provider, x-taskforce-ai-model, x-taskforce-ai-surface-type',
             'Access-Control-Allow-Methods': 'GET, HEAD, POST, DELETE, OPTIONS'
         });
         res.end();
@@ -2474,6 +2474,7 @@ export function registerAdminRoutes(deps) {
             token_endpoint_auth_methods_supported: ['none'],
             code_challenge_methods_supported: ['S256'],
             scopes_supported: ['tasks:read', 'tasks:write', 'workspace:read'],
+            authorization_response_iss_parameter_supported: true,
         }));
     });
     addRoute('HEAD', '/.well-known/oauth-authorization-server', async (req, res) => {
@@ -2489,6 +2490,7 @@ export function registerAdminRoutes(deps) {
             token_endpoint_auth_methods_supported: ['none'],
             code_challenge_methods_supported: ['S256'],
             scopes_supported: ['tasks:read', 'tasks:write', 'workspace:read'],
+            authorization_response_iss_parameter_supported: true,
         }));
     });
     addRoute('GET', '/.well-known/oauth-protected-resource', async (req, res) => {
@@ -2516,6 +2518,12 @@ export function registerAdminRoutes(deps) {
             return;
         const body = await parseJsonBody(req);
         try {
+            const applicationType = (() => {
+                const value = String(body?.application_type || 'web').trim().toLowerCase();
+                if (value === 'native' || value === 'web')
+                    return value;
+                throw new TaskforceRuleError('application_type must be native or web', 400, 'MCP_OAUTH_APPLICATION_TYPE_INVALID');
+            })();
             const provider = (() => {
                 const explicit = String(body?.provider || '').trim().toLowerCase();
                 if (explicit === 'chatgpt' || explicit === 'claude' || explicit === 'grok' || explicit === 'gemini' || explicit === 'mistral' || explicit === 'perplexity')
@@ -2545,6 +2553,7 @@ export function registerAdminRoutes(deps) {
                 provider,
                 clientName: body?.client_name,
                 redirectUris: body?.redirect_uris,
+                applicationType,
                 productClientId: classifyMcpOAuthClientProduct({
                     provider,
                     clientName: body?.client_name,
@@ -2559,6 +2568,7 @@ export function registerAdminRoutes(deps) {
                 grant_types: ['authorization_code'],
                 response_types: ['code'],
                 token_endpoint_auth_method: 'none',
+                application_type: client.applicationType,
                 scope: 'tasks:read tasks:write workspace:read',
             }));
         }
@@ -2715,6 +2725,7 @@ export function registerAdminRoutes(deps) {
             denyTarget.searchParams.set('error', 'access_denied');
             if (state)
                 denyTarget.searchParams.set('state', state);
+            denyTarget.searchParams.set('iss', resolveMcpOauthIssuer(req));
             res.writeHead(302, { Location: denyTarget.toString() });
             res.end();
             return;
@@ -2745,6 +2756,7 @@ export function registerAdminRoutes(deps) {
             approveTarget.searchParams.set('code', issued.code);
             if (state)
                 approveTarget.searchParams.set('state', state);
+            approveTarget.searchParams.set('iss', resolveMcpOauthIssuer(req));
             res.writeHead(302, { Location: approveTarget.toString() });
             res.end();
         }

package/dist/server/routes/shared.d.ts

@@ -14,6 +14,7 @@ import { type McpRuntimeFactory, type TaskforceMcpServerOptions } from '../../mc
 import { type AiProfileBootstrapConfig } from '../../mcp/aiProfileBootstrap.js';
 import type { AiProfileSeatScope } from '../../shared/aiProfileSeatScope.js';
 import { type RequestPerformanceDiagnostics } from '../../storage/postgresRequestDiagnostics.js';
+import { beginCloudMcpCapacityRequest } from '../cloudMcpCapacityTelemetry.js';
 export declare function resolveErrorStatusCode(error: unknown, fallback?: number): number;
 export declare function buildCloudMcpProfileConnectionId(input: {
     oauth?: McpOAuthAccessTokenAuthResult | null;
@@ -128,6 +129,8 @@ export declare function makeHandleCloudMcpRequest(core: TaskforceCore, deps: {
     createMcpServer?: McpRuntimeFactory;
     resolveMcpToolPolicy?: CloudMcpToolPolicyResolver;
     acquireMcpRuntime?: AcquireCloudMcpRuntime;
+    capacityTelemetryEnabled?: () => boolean;
+    beginCapacityRequest?: typeof beginCloudMcpCapacityRequest;
 }): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
 export declare function requestHeader(req: IncomingMessage, name: string, fallback?: string): string;
 export declare function requestWorkspaceHeader(req: IncomingMessage): string;