@taskforcehq/taskforce 0.3.330 → 0.3.332

package/dist/server/routes/shared.js

@@ -21,6 +21,7 @@ import { handleModernMcpHttpRequest, isModernMcpHttpRequest, } from '../../mcp/h
 import { resolveAppAccessDeniedResponse } from '../appAccess.js';
 import { resolveCloudApplicationBaseUrl } from '../../config/applicationBaseUrl.js';
 import { getRequestPerformanceDiagnostics, runWithRequestPerformanceDiagnostics, } from '../../storage/postgresRequestDiagnostics.js';
+import { beginCloudMcpCapacityRequest, isCloudMcpCapacityTelemetryEnabled, TASKFORCE_CAPACITY_TRACE_HEADER, } from '../cloudMcpCapacityTelemetry.js';
 // === SECTION: Error helpers ===
 export function resolveErrorStatusCode(error, fallback = 400) {
     if (error instanceof TaskforceRuleError)
@@ -324,7 +325,7 @@ function findDeniedCloudMcpToolName(body, scopes, resolveToolPolicy) {
     return null;
 }
 export function makeHandleCloudMcpRequest(core, deps) {
-    const { ensureAppAccess, resolveAuthenticatedUserId, writeRateLimit, createMcpServer = createTaskforceMcpServer, resolveMcpToolPolicy = resolveProductionCloudMcpToolPolicy, acquireMcpRuntime, } = deps;
+    const { ensureAppAccess, resolveAuthenticatedUserId, writeRateLimit, createMcpServer = createTaskforceMcpServer, resolveMcpToolPolicy = resolveProductionCloudMcpToolPolicy, acquireMcpRuntime, capacityTelemetryEnabled = isCloudMcpCapacityTelemetryEnabled, beginCapacityRequest = beginCloudMcpCapacityRequest, } = deps;
     const authenticateCloudMcpRequest = makeAuthenticateCloudMcpRequest(core, {
         resolveAuthenticatedUserId,
         writeMcpHttpError,
@@ -405,105 +406,209 @@ export function makeHandleCloudMcpRequest(core, deps) {
             writeMcpHttpError(res, 400, 'The /mcp HTTP endpoint is only available in cloud runtime. In local runtime, use the local stdio MCP server (for example: `taskforce mcp <project-path>`).');
             return;
         }
-        if (!ensureAppAccess(req, res))
-            return;
-        if (req.method !== 'POST' && req.method !== 'GET' && req.method !== 'DELETE') {
-            writeMcpHttpError(res, 405, 'Method not allowed.');
-            return;
-        }
-        const authStartedAtMs = Date.now();
-        const auth = authenticateCloudMcpRequest(req, res);
-        authMs = Date.now() - authStartedAtMs;
-        if (!auth)
-            return;
-        if (req.method !== 'POST') {
-            writeMcpHttpError(res, 405, 'Method not allowed.');
-            return;
-        }
-        if (!isJsonContentType(requestHeader(req, 'content-type', ''))) {
-            writeMcpHttpError(res, 415, 'Unsupported Media Type: Content-Type must be application/json');
-            return;
-        }
-        let body = undefined;
-        try {
-            const bodyParseStartedAtMs = Date.now();
-            body = await parseJsonBody(req);
-            bodyParseMs = Date.now() - bodyParseStartedAtMs;
-        }
-        catch (error) {
-            writeMcpHttpError(res, resolveErrorStatusCode(error, 400), 'Invalid JSON body.');
-            return;
-        }
-        const authScopes = auth.authenticatedViaToken?.scopes || auth.authenticatedViaOAuth?.scopes || [];
-        const requestId = String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || randomUUID();
-        res.setHeader('X-Request-ID', requestId);
-        const mcpMethod = !Array.isArray(body) && body !== null && typeof body === 'object'
-            ? String(body.method || '')
-            : '';
-        const initializeRequest = isInitializeRequest(body)
-            || mcpMethod === 'initialize';
-        const modernProtocolRequest = await isModernMcpHttpRequest(req, body);
-        const deniedToolName = findDeniedCloudMcpToolName(body, authScopes, resolveMcpToolPolicy);
-        if (deniedToolName) {
-            core.addMcpAuditLog({
-                workspaceId: auth.workspaceId,
-                actorType: auth.authenticatedViaToken ? 'token' : auth.authenticatedViaOAuth ? 'oauth' : 'user',
-                actorUserId: auth.authenticatedViaToken?.userId || auth.authenticatedViaOAuth?.userId || auth.userId || 'anonymous',
-                tokenId: auth.authenticatedViaToken?.tokenId || auth.authenticatedViaOAuth?.grantId || null,
-                toolName: deniedToolName,
-                details: {
-                    requestId,
-                    ip: req.socket?.remoteAddress || null,
-                    userAgent: requestHeader(req, 'user-agent', '') || null,
-                    outcome: 'deny',
-                    reasonCode: 'scope_denied',
-                    scopes: authScopes
+        const capacityRequest = beginCapacityRequest();
+        const capacityTraceEnabled = requestHeader(req, TASKFORCE_CAPACITY_TRACE_HEADER, '').trim() === '1';
+        return runWithRequestPerformanceDiagnostics(capacityTelemetryEnabled(), async () => {
+            let capacitySettled = false;
+            const settleCapacity = (aborted = false) => {
+                if (capacitySettled)
+                    return;
+                capacitySettled = true;
+                capacityRequest.finish({
+                    statusCode: res.statusCode,
+                    aborted,
+                    postgres: getRequestPerformanceDiagnostics(),
+                });
+            };
+            const onFinish = () => settleCapacity(false);
+            const onClose = () => settleCapacity(!res.writableEnded);
+            res.once('finish', onFinish);
+            res.once('close', onClose);
+            try {
+                if (!ensureAppAccess(req, res))
+                    return;
+                if (req.method !== 'POST' && req.method !== 'GET' && req.method !== 'DELETE') {
+                    writeMcpHttpError(res, 405, 'Method not allowed.');
+                    return;
                 }
-            });
-            writeMcpHttpError(res, 403, 'Forbidden.');
-            return;
-        }
-        const writeToolNames = extractMcpWriteToolNames(body, resolveMcpToolPolicy);
-        const rateLimitStartedAtMs = Date.now();
-        const rateLimitAllowed = applyCloudMcpWriteRateLimit(req, res, auth, body);
-        rateLimitMs = Date.now() - rateLimitStartedAtMs;
-        if (!rateLimitAllowed)
-            return;
-        let runtime = null;
-        let runtimeLease = null;
-        let runtimeConstructionMs = 0;
-        let transportConnectMs = 0;
-        let requestHandlingMs = 0;
-        let cleanupMs = 0;
-        let outcome = 'success';
-        const toolTimingState = { value: null };
-        try {
-            const runtimeStartedAtMs = Date.now();
-            // Production intentionally isolates the MCP runtime per HTTP request. The runtime closes over
-            // workspace auth, AI identity, permissions, subscriptions, and mutable helper state;
-            // sharing it could leak state across tenants or callers. Keep the transport stateless
-            // too. The timing event below measures construction cost so caching is only revisited
-            // with evidence and must preserve these boundaries (including dynamic tool schemas). The optional
-            // lease seam exists only for transport conformance tests that must carry legacy bidirectional calls.
-            const runtimeOptions = {
-                projectRoot: core.getPaths().projectRoot,
-                tenantId: core.getTenantId(),
-                workspaceId: auth.workspaceId,
-                core,
-                serverName: 'taskforce-cloud',
-                logStartup: false,
-                runtimeMode: 'cloud',
-                toolProfile: auth.authenticatedViaToken?.toolProfile || auth.authenticatedViaOAuth?.toolProfile || 'default',
-                applicationBaseUrl: resolveCloudApplicationBaseUrl(),
-                auth: buildCloudMcpRuntimeAuth({
-                    req,
-                    auth,
-                    requestHeader,
-                    requestId,
-                    authScopes,
-                }),
-                onToolCallTiming: (timing) => {
-                    toolTimingState.value = timing;
+                const authStartedAtMs = Date.now();
+                const auth = authenticateCloudMcpRequest(req, res);
+                authMs = Date.now() - authStartedAtMs;
+                if (!auth)
+                    return;
+                if (capacityTraceEnabled)
+                    capacityRequest.setTraceHeaders(res);
+                if (req.method !== 'POST') {
+                    writeMcpHttpError(res, 405, 'Method not allowed.');
+                    return;
+                }
+                if (!isJsonContentType(requestHeader(req, 'content-type', ''))) {
+                    writeMcpHttpError(res, 415, 'Unsupported Media Type: Content-Type must be application/json');
+                    return;
+                }
+                let body = undefined;
+                try {
+                    const bodyParseStartedAtMs = Date.now();
+                    body = await parseJsonBody(req);
+                    bodyParseMs = Date.now() - bodyParseStartedAtMs;
+                }
+                catch (error) {
+                    writeMcpHttpError(res, resolveErrorStatusCode(error, 400), 'Invalid JSON body.');
+                    return;
+                }
+                const authScopes = auth.authenticatedViaToken?.scopes || auth.authenticatedViaOAuth?.scopes || [];
+                const requestId = String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || randomUUID();
+                res.setHeader('X-Request-ID', requestId);
+                const mcpMethod = !Array.isArray(body) && body !== null && typeof body === 'object'
+                    ? String(body.method || '')
+                    : '';
+                const initializeRequest = isInitializeRequest(body)
+                    || mcpMethod === 'initialize';
+                const modernProtocolRequest = await isModernMcpHttpRequest(req, body);
+                const writeToolNames = extractMcpWriteToolNames(body, resolveMcpToolPolicy);
+                const requestClass = initializeRequest
+                    ? 'initialize'
+                    : mcpMethod === 'server/discover'
+                        ? 'discover'
+                        : mcpMethod === 'tools/list'
+                            ? 'tools_list'
+                            : writeToolNames.length > 0
+                                ? 'write'
+                                : extractFirstMcpToolName(body)
+                                    ? 'read'
+                                    : 'other';
+                capacityRequest.classify(requestClass);
+                const deniedToolName = findDeniedCloudMcpToolName(body, authScopes, resolveMcpToolPolicy);
+                if (deniedToolName) {
+                    core.addMcpAuditLog({
+                        workspaceId: auth.workspaceId,
+                        actorType: auth.authenticatedViaToken ? 'token' : auth.authenticatedViaOAuth ? 'oauth' : 'user',
+                        actorUserId: auth.authenticatedViaToken?.userId || auth.authenticatedViaOAuth?.userId || auth.userId || 'anonymous',
+                        tokenId: auth.authenticatedViaToken?.tokenId || auth.authenticatedViaOAuth?.grantId || null,
+                        toolName: deniedToolName,
+                        details: {
+                            requestId,
+                            ip: req.socket?.remoteAddress || null,
+                            userAgent: requestHeader(req, 'user-agent', '') || null,
+                            outcome: 'deny',
+                            reasonCode: 'scope_denied',
+                            scopes: authScopes
+                        }
+                    });
+                    writeMcpHttpError(res, 403, 'Forbidden.');
+                    return;
+                }
+                const rateLimitStartedAtMs = Date.now();
+                const rateLimitAllowed = applyCloudMcpWriteRateLimit(req, res, auth, body);
+                rateLimitMs = Date.now() - rateLimitStartedAtMs;
+                if (!rateLimitAllowed)
+                    return;
+                let runtime = null;
+                let runtimeLease = null;
+                let runtimeConstructionMs = 0;
+                let transportConnectMs = 0;
+                let requestHandlingMs = 0;
+                let cleanupMs = 0;
+                let outcome = 'success';
+                const toolTimingState = { value: null };
+                try {
+                    const runtimeStartedAtMs = Date.now();
+                    // Production intentionally isolates the MCP runtime per HTTP request. The runtime closes over
+                    // workspace auth, AI identity, permissions, subscriptions, and mutable helper state;
+                    // sharing it could leak state across tenants or callers. Keep the transport stateless
+                    // too. The timing event below measures construction cost so caching is only revisited
+                    // with evidence and must preserve these boundaries (including dynamic tool schemas). The optional
+                    // lease seam exists only for transport conformance tests that must carry legacy bidirectional calls.
+                    const runtimeOptions = {
+                        projectRoot: core.getPaths().projectRoot,
+                        tenantId: core.getTenantId(),
+                        workspaceId: auth.workspaceId,
+                        core,
+                        serverName: 'taskforce-cloud',
+                        logStartup: false,
+                        runtimeMode: 'cloud',
+                        toolProfile: auth.authenticatedViaToken?.toolProfile || auth.authenticatedViaOAuth?.toolProfile || 'default',
+                        applicationBaseUrl: resolveCloudApplicationBaseUrl(),
+                        auth: buildCloudMcpRuntimeAuth({
+                            req,
+                            auth,
+                            requestHeader,
+                            requestId,
+                            authScopes,
+                        }),
+                        onToolCallTiming: (timing) => {
+                            toolTimingState.value = timing;
+                            if (!res.headersSent) {
+                                if (capacityTraceEnabled) {
+                                    capacityRequest.setTraceHeaders(res, getRequestPerformanceDiagnostics());
+                                }
+                                setServerTimingHeader(res, [
+                                    { name: 'auth', durationMs: authMs },
+                                    { name: 'body-parse', durationMs: bodyParseMs },
+                                    { name: 'rate-limit', durationMs: rateLimitMs },
+                                    { name: 'runtime', durationMs: runtimeConstructionMs },
+                                    { name: 'transport-connect', durationMs: transportConnectMs },
+                                    { name: 'tool-envelope-prepare', durationMs: timing.preparationMs },
+                                    { name: 'tool-envelope-validate', durationMs: timing.validationMs },
+                                    { name: 'tool-handler', durationMs: timing.handlerMs },
+                                    ...Object.entries(timing.subphases).map(([phase, durationMs]) => ({
+                                        name: `tool-${phase}`,
+                                        durationMs,
+                                    })),
+                                ]);
+                            }
+                        },
+                    };
+                    if (modernProtocolRequest) {
+                        const requestHandlingStartedAtMs = Date.now();
+                        await handleModernMcpHttpRequest({
+                            req,
+                            res,
+                            parsedBody: body,
+                            factory: ({ era }) => {
+                                const constructionStartedAtMs = Date.now();
+                                const modernRuntime = createStatelessTaskforceMcpServer({
+                                    ...runtimeOptions,
+                                    protocolEra: era,
+                                }, createMcpServer);
+                                runtimeConstructionMs = Date.now() - constructionStartedAtMs;
+                                if (!res.headersSent) {
+                                    setServerTimingHeader(res, [
+                                        { name: 'auth', durationMs: authMs },
+                                        { name: 'body-parse', durationMs: bodyParseMs },
+                                        { name: 'rate-limit', durationMs: rateLimitMs },
+                                        { name: 'runtime', durationMs: runtimeConstructionMs },
+                                    ]);
+                                }
+                                return modernRuntime.server;
+                            },
+                            onerror: (error) => {
+                                console.warn('[Taskforce MCP] Modern cloud request rejected:', {
+                                    requestId,
+                                    message: error.message,
+                                });
+                            },
+                        });
+                        requestHandlingMs = Date.now() - requestHandlingStartedAtMs;
+                        recordCloudMcpCredentialUsage(req, auth.authenticatedViaToken, auth.authenticatedViaOAuth);
+                        return;
+                    }
+                    runtimeLease = acquireMcpRuntime
+                        ? await acquireMcpRuntime({ req, options: runtimeOptions })
+                        : null;
+                    runtime = runtimeLease?.runtime
+                        || createStatelessTaskforceMcpServer(runtimeOptions, createMcpServer);
+                    runtimeConstructionMs = Date.now() - runtimeStartedAtMs;
+                    const transport = runtimeLease?.transport || new NodeStreamableHTTPServerTransport({
+                        sessionIdGenerator: undefined,
+                        enableJsonResponse: true,
+                    });
+                    const transportStartedAtMs = Date.now();
+                    if (!runtimeLease)
+                        await runtime.server.connect(transport);
+                    transportConnectMs = Date.now() - transportStartedAtMs;
+                    // Set request-level phases before the SDK writes response headers. Tool calls replace this
+                    // with the richer envelope/handler breakdown from onToolCallTiming above.
                     if (!res.headersSent) {
                         setServerTimingHeader(res, [
                             { name: 'auth', durationMs: authMs },
@@ -511,155 +616,90 @@ export function makeHandleCloudMcpRequest(core, deps) {
                             { name: 'rate-limit', durationMs: rateLimitMs },
                             { name: 'runtime', durationMs: runtimeConstructionMs },
                             { name: 'transport-connect', durationMs: transportConnectMs },
-                            { name: 'tool-envelope-prepare', durationMs: timing.preparationMs },
-                            { name: 'tool-envelope-validate', durationMs: timing.validationMs },
-                            { name: 'tool-handler', durationMs: timing.handlerMs },
-                            ...Object.entries(timing.subphases).map(([phase, durationMs]) => ({
-                                name: `tool-${phase}`,
-                                durationMs,
-                            })),
                         ]);
                     }
-                },
-            };
-            if (modernProtocolRequest) {
-                const requestHandlingStartedAtMs = Date.now();
-                await handleModernMcpHttpRequest({
-                    req,
-                    res,
-                    parsedBody: body,
-                    factory: ({ era }) => {
-                        const constructionStartedAtMs = Date.now();
-                        const modernRuntime = createStatelessTaskforceMcpServer({
-                            ...runtimeOptions,
-                            protocolEra: era,
-                        }, createMcpServer);
-                        runtimeConstructionMs = Date.now() - constructionStartedAtMs;
-                        if (!res.headersSent) {
-                            setServerTimingHeader(res, [
-                                { name: 'auth', durationMs: authMs },
-                                { name: 'body-parse', durationMs: bodyParseMs },
-                                { name: 'rate-limit', durationMs: rateLimitMs },
-                                { name: 'runtime', durationMs: runtimeConstructionMs },
-                            ]);
-                        }
-                        return modernRuntime.server;
-                    },
-                    onerror: (error) => {
-                        console.warn('[Taskforce MCP] Modern cloud request rejected:', {
+                    const requestHandlingStartedAtMs = Date.now();
+                    await transport.handleRequest(req, res, body);
+                    requestHandlingMs = Date.now() - requestHandlingStartedAtMs;
+                    recordCloudMcpCredentialUsage(req, auth.authenticatedViaToken, auth.authenticatedViaOAuth);
+                }
+                catch (error) {
+                    outcome = 'failure';
+                    console.error('[Taskforce MCP] Cloud transport request failed:', {
+                        requestId,
+                        kind: 'tool_transport_failure',
+                        message: error instanceof Error ? error.message : String(error),
+                    });
+                    if (!res.headersSent) {
+                        writeMcpHttpError(res, 500, 'MCP transport failure.', {
+                            kind: 'tool_transport_failure',
+                            retryable: true,
                             requestId,
-                            message: error.message,
                         });
-                    },
-                });
-                requestHandlingMs = Date.now() - requestHandlingStartedAtMs;
-                recordCloudMcpCredentialUsage(req, auth.authenticatedViaToken, auth.authenticatedViaOAuth);
-                return;
-            }
-            runtimeLease = acquireMcpRuntime
-                ? await acquireMcpRuntime({ req, options: runtimeOptions })
-                : null;
-            runtime = runtimeLease?.runtime
-                || createStatelessTaskforceMcpServer(runtimeOptions, createMcpServer);
-            runtimeConstructionMs = Date.now() - runtimeStartedAtMs;
-            const transport = runtimeLease?.transport || new NodeStreamableHTTPServerTransport({
-                sessionIdGenerator: undefined,
-                enableJsonResponse: true,
-            });
-            const transportStartedAtMs = Date.now();
-            if (!runtimeLease)
-                await runtime.server.connect(transport);
-            transportConnectMs = Date.now() - transportStartedAtMs;
-            // Set request-level phases before the SDK writes response headers. Tool calls replace this
-            // with the richer envelope/handler breakdown from onToolCallTiming above.
-            if (!res.headersSent) {
-                setServerTimingHeader(res, [
-                    { name: 'auth', durationMs: authMs },
-                    { name: 'body-parse', durationMs: bodyParseMs },
-                    { name: 'rate-limit', durationMs: rateLimitMs },
-                    { name: 'runtime', durationMs: runtimeConstructionMs },
-                    { name: 'transport-connect', durationMs: transportConnectMs },
-                ]);
-            }
-            if (!initializeRequest) {
-                // Stateless cloud sessions still require a valid MCP JSON-RPC request;
-                // let the SDK validate and respond rather than trying to track sessions server-side.
-            }
-            const requestHandlingStartedAtMs = Date.now();
-            await transport.handleRequest(req, res, body);
-            requestHandlingMs = Date.now() - requestHandlingStartedAtMs;
-            recordCloudMcpCredentialUsage(req, auth.authenticatedViaToken, auth.authenticatedViaOAuth);
-        }
-        catch (error) {
-            outcome = 'failure';
-            console.error('[Taskforce MCP] Cloud transport request failed:', {
-                requestId,
-                kind: 'tool_transport_failure',
-                message: error instanceof Error ? error.message : String(error),
-            });
-            if (!res.headersSent) {
-                writeMcpHttpError(res, 500, 'MCP transport failure.', {
-                    kind: 'tool_transport_failure',
-                    retryable: true,
-                    requestId,
-                });
-            }
-        }
-        finally {
-            if (runtimeLease) {
-                const cleanupStartedAtMs = Date.now();
-                try {
-                    await runtimeLease.release();
-                }
-                catch (closeError) {
-                    console.warn('[Taskforce MCP] Cloud test runtime lease cleanup failed:', closeError);
-                }
-                cleanupMs = Date.now() - cleanupStartedAtMs;
-            }
-            else if (runtime) {
-                const cleanupStartedAtMs = Date.now();
-                try {
-                    await runtime.server.close();
+                    }
                 }
-                catch (closeError) {
-                    console.warn('[Taskforce MCP] Cloud transport cleanup failed:', closeError);
+                finally {
+                    if (runtimeLease) {
+                        const cleanupStartedAtMs = Date.now();
+                        try {
+                            await runtimeLease.release();
+                        }
+                        catch (closeError) {
+                            console.warn('[Taskforce MCP] Cloud test runtime lease cleanup failed:', closeError);
+                        }
+                        cleanupMs = Date.now() - cleanupStartedAtMs;
+                    }
+                    else if (runtime) {
+                        const cleanupStartedAtMs = Date.now();
+                        try {
+                            await runtime.server.close();
+                        }
+                        catch (closeError) {
+                            console.warn('[Taskforce MCP] Cloud transport cleanup failed:', closeError);
+                        }
+                        cleanupMs = Date.now() - cleanupStartedAtMs;
+                    }
+                    const totalDurationMs = Date.now() - requestStartedAtMs;
+                    if (initializeRequest || mcpMethod === 'tools/list' || writeToolNames.length > 0 || totalDurationMs >= 250) {
+                        const timingSnapshot = toolTimingState.value;
+                        console.info(`[Taskforce MCP] ${JSON.stringify({
+                            event: 'cloud_request_timing',
+                            requestId,
+                            requestKind: initializeRequest
+                                ? 'initialize'
+                                : mcpMethod === 'tools/list'
+                                    ? 'tools_list'
+                                    : (extractFirstMcpToolName(body) ? 'tool_call' : 'other'),
+                            method: mcpMethod || null,
+                            toolName: extractFirstMcpToolName(body),
+                            workspaceId: auth.workspaceId,
+                            databaseProvider: core.getDatabaseProvider(),
+                            authMode: auth.authenticatedViaToken ? 'token' : auth.authenticatedViaOAuth ? 'oauth' : 'user',
+                            batchSize: Array.isArray(body) ? body.length : 1,
+                            isWrite: writeToolNames.length > 0,
+                            outcome,
+                            httpStatus: res.statusCode,
+                            responseBytes: timingSnapshot?.responseBytes ?? null,
+                            totalDurationMs,
+                            preRuntimeMs: Math.max(0, totalDurationMs - runtimeConstructionMs - transportConnectMs - requestHandlingMs - cleanupMs),
+                            authMs,
+                            bodyParseMs,
+                            rateLimitMs,
+                            runtimeConstructionMs,
+                            transportConnectMs,
+                            requestHandlingMs,
+                            cleanupMs,
+                            toolTiming: timingSnapshot,
+                        })}`);
+                    }
                 }
-                cleanupMs = Date.now() - cleanupStartedAtMs;
             }
-            const totalDurationMs = Date.now() - requestStartedAtMs;
-            if (initializeRequest || mcpMethod === 'tools/list' || writeToolNames.length > 0 || totalDurationMs >= 250) {
-                const timingSnapshot = toolTimingState.value;
-                console.info(`[Taskforce MCP] ${JSON.stringify({
-                    event: 'cloud_request_timing',
-                    requestId,
-                    requestKind: initializeRequest
-                        ? 'initialize'
-                        : mcpMethod === 'tools/list'
-                            ? 'tools_list'
-                            : (extractFirstMcpToolName(body) ? 'tool_call' : 'other'),
-                    method: mcpMethod || null,
-                    toolName: extractFirstMcpToolName(body),
-                    workspaceId: auth.workspaceId,
-                    databaseProvider: core.getDatabaseProvider(),
-                    authMode: auth.authenticatedViaToken ? 'token' : auth.authenticatedViaOAuth ? 'oauth' : 'user',
-                    batchSize: Array.isArray(body) ? body.length : 1,
-                    isWrite: writeToolNames.length > 0,
-                    outcome,
-                    httpStatus: res.statusCode,
-                    responseBytes: timingSnapshot?.responseBytes ?? null,
-                    totalDurationMs,
-                    preRuntimeMs: Math.max(0, totalDurationMs - runtimeConstructionMs - transportConnectMs - requestHandlingMs - cleanupMs),
-                    authMs,
-                    bodyParseMs,
-                    rateLimitMs,
-                    runtimeConstructionMs,
-                    transportConnectMs,
-                    requestHandlingMs,
-                    cleanupMs,
-                    toolTiming: timingSnapshot,
-                })}`);
+            finally {
+                settleCapacity(Boolean(req.destroyed && !res.writableEnded));
+                res.off('finish', onFinish);
+                res.off('close', onClose);
             }
-        }
+        });
     };
 }
 // === SECTION: Request header helpers ===

package/dist/service/localServiceCli.d.ts

@@ -1,4 +1,4 @@
-import { createStandaloneServer } from '../server/index.js';
+import type { StandaloneServerOptions, TaskforceStandaloneServer } from '../server/index.js';
 import { inspectLocalServiceDescriptor } from '../server/localServiceLease.js';
 import { acquireLocalServiceOwnershipForRuntime } from '../server/localServiceOwnershipBootstrap.js';
 import { type SqliteWalHolder } from '../storage/sqliteWalHealth.js';
@@ -18,7 +18,7 @@ export interface LocalServiceCliOptions {
     executablePath: string;
     cliEntryPath: string;
     execArgv?: readonly string[];
-    createServer?: typeof createStandaloneServer;
+    createServer?: (options: StandaloneServerOptions) => TaskforceStandaloneServer;
     acquireOwnership?: typeof acquireLocalServiceOwnershipForRuntime;
     inspectDescriptor?: typeof inspectLocalServiceDescriptor;
     spawnDetached?: (executablePath: string, args: readonly string[], env: NodeJS.ProcessEnv) => void;

package/dist/service/localServiceCli.js

@@ -2,7 +2,6 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { applyLocalServiceCloudTarget, localServiceCloudTargetsEqual, parseLocalServiceCloudTarget, resolveLocalServiceCloudTarget, } from '../config/localServiceCloudTarget.js';
 import { localServiceRuntimeContractsEqual, parseLocalServiceRuntimeContract, resolveLocalServiceRuntimeContract, } from '../config/localServiceRuntimeContract.js';
-import { createStandaloneServer } from '../server/index.js';
 import { inspectLocalServiceDescriptor, redactLocalServiceDescriptor, } from '../server/localServiceLease.js';
 import { acquireLocalServiceOwnershipForRuntime, } from '../server/localServiceOwnershipBootstrap.js';
 import { discoverOrStartLocalService, LOCAL_SERVICE_API_BASE_PATH, LOCAL_SERVICE_PROTOCOL_VERSION, resolveLocalServiceLeaseInput, spawnDetachedLocalService, waitForLocalServiceDescriptor, } from './localServiceClientLifecycle.js';
@@ -126,7 +125,9 @@ async function runForeground(command, options) {
         });
     };
     try {
-        server = options.createServer({
+        const createServer = options.createServer
+            || (await import('../server/index.js')).createStandaloneServer;
+        server = createServer({
             projectRoot: command.projectRoot,
             port: 0,
             localSyncProcessLock: ownership.syncProcessLock || undefined,
@@ -370,7 +371,7 @@ export async function runLocalServiceCli(argv, input) {
         executablePath: input.executablePath,
         cliEntryPath: input.cliEntryPath,
         execArgv: input.execArgv || [],
-        createServer: input.createServer || createStandaloneServer,
+        createServer: input.createServer,
         acquireOwnership: input.acquireOwnership || acquireLocalServiceOwnershipForRuntime,
         inspectDescriptor: input.inspectDescriptor || inspectLocalServiceDescriptor,
         spawnDetached: input.spawnDetached || spawnDetachedLocalService,

package/dist/services/executorPhaseAIssuerCore.d.ts

@@ -17,6 +17,17 @@ export interface ExecutorPhaseAOidcKey {
     lastIssuedAt: string | null;
     publishUntil: string | null;
 }
+export interface ExecutorPhaseAOidcVerificationKey {
+    keyId: string;
+    publicKey: KeyObject;
+    status: 'active' | 'retiring' | 'disabled';
+    validFrom: string;
+    validUntil: string;
+}
+declare const verifiedWorkloadJwtClaimsBrand: unique symbol;
+export type VerifiedExecutorPhaseAWorkloadJwtClaims = ExecutorPhaseAWorkloadJwtClaims & {
+    readonly [verifiedWorkloadJwtClaimsBrand]: true;
+};
 export interface ExecutorPhaseAWorkloadJwtClaims {
     iss: string;
     aud: string;
@@ -103,6 +114,8 @@ export declare function buildExecutorPhaseAOidcDiscovery(issuer: string): {
 };
 export declare function buildExecutorPhaseAWorkloadJwtClaims(bundle: VerifiedExecutorPhaseAWorkloadGrantBundle, issuer: string, audience: string, tokenId: string, now: Date): ExecutorPhaseAWorkloadJwtClaims;
 export declare function signExecutorPhaseAWorkloadJwt(claims: ExecutorPhaseAWorkloadJwtClaims, signer: ExecutorPhaseARs256Signer): Promise<string>;
+export declare function verifyExecutorPhaseAWorkloadJwt(jwt: string, bundle: VerifiedExecutorPhaseAWorkloadGrantBundle, keys: readonly ExecutorPhaseAOidcVerificationKey[], now?: Date): VerifiedExecutorPhaseAWorkloadJwtClaims;
+export declare function assertVerifiedExecutorPhaseAWorkloadJwtClaims(claims: VerifiedExecutorPhaseAWorkloadJwtClaims): void;
 export declare class ExecutorPhaseAIssuerCore {
     private readonly options;
     constructor(options: {