level-up-mcp-server-cn 0.4.0

package/dist/tools/tasks.js

@@ -0,0 +1,1572 @@
+// ============================================================
+// tools/tasks.ts — Section 4: Task tools (7 tools)
+// ============================================================
+// The core work-tracking loop: start → update → complete/fail.
+// This is where XP actually gets generated.
+//
+// Key concepts:
+// - performer_type is auto-determined from which IDs are provided
+// - XP is calculated on complete_task using split rules
+// - Difficulty comes from TDI (crowdsourced) or agent override
+// - Failed tasks get 10-20% XP, cancelled gets 0
+// ============================================================
+import { z } from "zod";
+import { supabase } from "../services/supabase.js";
+import { ok, fail, handleSupabaseError } from "../services/errors.js";
+import { paginate } from "../services/format.js";
+import { toMcpResponse, logRegistered } from "../services/register.js";
+import { uuidSchema, limitSchema, offsetSchema, metadataSchema, difficultySchema, completionPctSchema, outputTypeSchema, performerTypeSchema, taskStatusSchema, } from "../schemas/common.js";
+import { checkRateLimit } from "../services/rate-limit.js";
+import { computeSystemScore, getIntegrityMultiplier, awardXpViaRpc, awardClassXpViaRpc } from "../services/quality-gate.js";
+import { verifyOwnership } from "../services/ownership.js";
+// ---- Tier ordering for override/downgrade logic ----
+const TIER_ORDER = ["micro", "light", "standard", "complex", "major"];
+function tierIndex(tier) {
+    const idx = TIER_ORDER.indexOf(tier);
+    return idx >= 0 ? idx : 2; // default to standard
+}
+// ---- Shared: secret detection patterns ----
+const secretPatterns = [
+    /(?:sk|pk)[-_](?:live|test|proj)[-_]\w{20,}/i, // Stripe/OpenAI keys
+    /(?:ghp|gho|ghu|ghs|ghr)_\w{36,}/, // GitHub tokens
+    /xox[bpsa]-\w{10,}/, // Slack tokens
+    /eyJ[A-Za-z0-9_-]{30,}\.eyJ[A-Za-z0-9_-]{10,}/, // JWTs
+    /-----BEGIN\s(?:RSA\s)?PRIVATE\sKEY-----/, // Private keys
+    /AKIA[0-9A-Z]{16}/, // AWS access keys
+];
+function containsSecret(content) {
+    return secretPatterns.some((p) => p.test(content));
+}
+// ---- Helper: sanitize evidence content before storage ----
+// Layer 1: Auto-redact emails, IPs, and residual sensitive patterns
+// Layer 2: Snip — strip URL query params, truncate code output, cap text summaries
+const redactionPatterns = [
+    // Email addresses → mask local part
+    { pattern: /\b([a-zA-Z0-9._%+-])[a-zA-Z0-9._%+-]*@([a-zA-Z0-9.-]+\.[a-zA-Z]{2,})\b/g,
+        replacement: "$1***@$2" },
+    // IPv4 addresses → mask last two octets
+    { pattern: /\b(\d{1,3}\.\d{1,3})\.\d{1,3}\.\d{1,3}\b/g,
+        replacement: "$1.***.***" },
+    // IPv6 addresses (simplified — mask last 4 groups)
+    { pattern: /\b([0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4})(:[0-9a-fA-F:]+)\b/g,
+        replacement: "$1:***" },
+    // Bearer tokens in text
+    { pattern: /Bearer\s+[A-Za-z0-9_.-]{20,}/gi,
+        replacement: "Bearer [REDACTED]" },
+    // Generic hex tokens (32+ chars, likely keys/hashes)
+    { pattern: /\b[0-9a-f]{40,}\b/gi,
+        replacement: "[REDACTED_HASH]" },
+];
+function redactContent(content) {
+    let result = content;
+    for (const { pattern, replacement } of redactionPatterns) {
+        // Reset lastIndex for global regexes
+        pattern.lastIndex = 0;
+        result = result.replace(pattern, replacement);
+    }
+    return result;
+}
+function stripUrlQueryParams(url) {
+    try {
+        const parsed = new URL(url);
+        // Keep only scheme + host + path (drop query string and fragment)
+        return `${parsed.origin}${parsed.pathname}`;
+    }
+    catch {
+        // Not a valid URL — return as-is
+        return url;
+    }
+}
+const CODE_SNIP_HEAD = 30; // first N lines
+const CODE_SNIP_TAIL = 10; // last N lines
+const TEXT_SUMMARY_MAX = 500;
+function snipContent(evidenceType, content) {
+    switch (evidenceType) {
+        case "deliverable_url":
+        case "external_link":
+            return stripUrlQueryParams(content.trim());
+        case "code_output": {
+            const lines = content.split("\n");
+            if (lines.length <= CODE_SNIP_HEAD + CODE_SNIP_TAIL)
+                return content;
+            const head = lines.slice(0, CODE_SNIP_HEAD);
+            const tail = lines.slice(-CODE_SNIP_TAIL);
+            const omitted = lines.length - CODE_SNIP_HEAD - CODE_SNIP_TAIL;
+            return [...head, `\n... [已省略 ${omitted} 行] ...\n`, ...tail].join("\n");
+        }
+        case "text_summary":
+            if (content.length <= TEXT_SUMMARY_MAX)
+                return content;
+            return content.slice(0, TEXT_SUMMARY_MAX) + "… [已截断]";
+        default:
+            return content;
+    }
+}
+/** Full sanitization pipeline: redact → snip */
+function sanitizeEvidence(items) {
+    return items.map((item) => ({
+        ...item,
+        content: snipContent(item.evidence_type, redactContent(item.content)),
+        label: item.label ? item.label.slice(0, 500) : item.label,
+    }));
+}
+// ---- Helper: determine performer_type from user_id + agent_id combos ----
+function inferPerformerType(userId, agentId, additionalAgentIds) {
+    const hasUser = !!userId;
+    const hasAgent = !!agentId;
+    const hasMultiAgent = additionalAgentIds && additionalAgentIds.length > 0;
+    if (hasMultiAgent)
+        return "orchestrated";
+    if (hasUser && hasAgent)
+        return "user_with_agent";
+    if (hasAgent && !hasUser)
+        return "agent_solo";
+    if (hasUser && !hasAgent)
+        return "user_solo";
+    return "user_solo"; // fallback
+}
+// ---- Helper: calculate and award XP on task completion ----
+async function awardTaskXp(taskId) {
+    const { data, error } = await supabase.rpc('award_task_xp', {
+        p_task_id: taskId,
+    });
+    if (error) {
+        console.error("award_task_xp RPC error:", error);
+        return { xp_awards: [], total_xp_pool: 0 };
+    }
+    if (!data?.success) {
+        console.error("award_task_xp failed:", data?.error);
+        return { xp_awards: [], total_xp_pool: 0 };
+    }
+    return {
+        xp_awards: (data.awards || []).map((a) => ({
+            recipient_type: a.recipient_type,
+            recipient_id: a.recipient_id,
+            total_xp: a.total_xp,
+        })),
+        total_xp_pool: data.total_xp_pool,
+    };
+}
+// ── Exported handlers for dispatcher ─────────────────────────
+export async function handleStartTask(params) {
+    const callerUserId = params.caller_user_id;
+    const taskTypeId = params.task_type_id;
+    const title = params.title;
+    const userId = params.user_id;
+    const agentId = params.agent_id;
+    const additionalAgentIds = params.additional_agent_ids;
+    const difficulty = params.difficulty || 3;
+    const outputType = params.output_type;
+    const description = params.description;
+    const milestonesTotal = params.milestones_total;
+    const trackingMethod = params.tracking_method || "automatic";
+    const xpSplitRuleId = params.xp_split_rule_id;
+    const xpTierOverride = params.xp_tier_override;
+    const tags = params.tags;
+    const metadata = params.metadata;
+    if (!userId && !agentId) {
+        return toMcpResponse(fail("至少需要 user_id 或 agent_id 其中之一"));
+    }
+    // Ownership check: verify caller owns the agent if provided
+    if (agentId) {
+        const ownershipErr = await verifyOwnership({
+            caller_user_id: callerUserId,
+            target_agent_id: agentId,
+        });
+        if (ownershipErr)
+            return ownershipErr;
+    }
+    // Rate limit: max 30 task starts per 10 minutes per entity
+    const entityId = userId || agentId || "";
+    const limited = checkRateLimit(entityId, "start_task", 30, 600_000);
+    if (limited)
+        return limited;
+    const performerType = inferPerformerType(userId, agentId, additionalAgentIds);
+    // Validate tier override: can only go DOWN, not up
+    let tierOverrideNote;
+    if (xpTierOverride) {
+        const { data: inferredType } = await supabase
+            .from("task_types").select("xp_tier").eq("id", taskTypeId).maybeSingle();
+        const inferredTier = inferredType?.xp_tier || "standard";
+        const inferredIdx = tierIndex(inferredTier);
+        const overrideIdx = tierIndex(xpTierOverride);
+        if (overrideIdx > inferredIdx) {
+            return toMcpResponse(fail(`无法将等级从 "${inferredTier}" 升级到 "${xpTierOverride}"`, `经验值档位只能向下覆盖（例如 standard→light）。如需使用更高档位，请选择其他任务类型。`));
+        }
+        if (overrideIdx < inferredIdx) {
+            tierOverrideNote = `经验值档位已由智能体请求从 "${inferredTier}" 降级为 "${xpTierOverride}"。`;
+        }
+    }
+    // Find default split rule if none provided
+    let splitRuleId = xpSplitRuleId || null;
+    if (!splitRuleId) {
+        const { data: rule } = await supabase
+            .from("xp_split_rules").select("id")
+            .eq("performer_type", performerType).eq("is_default", true).maybeSingle();
+        splitRuleId = rule?.id || null;
+    }
+    // Store tier override in metadata so complete_task can use it
+    const taskMetadata = { ...(metadata || {}), ...(xpTierOverride ? { xp_tier_override: xpTierOverride } : {}) };
+    const userIdVal = userId || null;
+    const agentIdVal = agentId || null;
+    const { data: rpcResult, error: rpcErr } = await supabase.rpc('create_task_secure', {
+        p_caller_user_id: callerUserId,
+        p_user_id: userIdVal,
+        p_agent_id: agentIdVal,
+        p_task_type_id: taskTypeId || null,
+        p_title: title || '未命名任务',
+        p_description: description || null,
+        p_performer_type: performerType,
+        p_difficulty: difficulty,
+        p_output_type: outputType ?? 'conversational',
+        p_status: 'in_progress',
+        p_tags: tags || [],
+        p_metadata: Object.keys(taskMetadata).length > 0 ? taskMetadata : null,
+        p_additional_agent_ids: additionalAgentIds || [],
+        p_milestones_total: milestonesTotal ?? 0,
+        p_tracking_method: trackingMethod ?? 'manual',
+        p_xp_split_rule_id: splitRuleId,
+    });
+    if (rpcErr)
+        return toMcpResponse(handleSupabaseError(rpcErr, "start_task"));
+    if (!rpcResult?.success)
+        return toMcpResponse(fail(rpcResult?.error || "创建任务失败"));
+    const task = rpcResult.task;
+    // Look up the effective tier for the response
+    const { data: taskTypeInfo } = await supabase
+        .from("task_types").select("xp_tier").eq("id", taskTypeId).maybeSingle();
+    const effectiveTier = xpTierOverride || taskTypeInfo?.xp_tier || "standard";
+    return toMcpResponse(ok({
+        id: task.id,
+        title: task.title,
+        performer_type: task.performer_type,
+        status: task.status,
+        difficulty: task.difficulty,
+        output_type: task.output_type,
+        xp_tier: effectiveTier,
+        xp_split_rule_id: task.xp_split_rule_id,
+        started_at: task.started_at,
+        tier_override_note: tierOverrideNote,
+    }));
+}
+export async function handleUpdateTask(params) {
+    const callerUserId = params.caller_user_id;
+    const taskId = params.task_id;
+    // Ownership check
+    const denied = await verifyOwnership({ caller_user_id: callerUserId, target_task_id: taskId });
+    if (denied)
+        return denied;
+    const updates = {};
+    if (params.completion_pct !== undefined)
+        updates.completion_pct = params.completion_pct;
+    if (params.milestones_completed !== undefined)
+        updates.milestones_completed = params.milestones_completed;
+    if (params.output_type !== undefined)
+        updates.output_type = params.output_type;
+    if (params.metadata !== undefined)
+        updates.metadata = params.metadata;
+    if (Object.keys(updates).length === 0) {
+        return toMcpResponse(fail("没有需要更新的字段"));
+    }
+    // Fetch task to get caller ID for RPC
+    const { data: taskForUpdate, error: fetchErr } = await supabase
+        .from("tasks").select("id, user_id, agent_id, status").eq("id", taskId).single();
+    if (fetchErr)
+        return toMcpResponse(handleSupabaseError(fetchErr, "update_task"));
+    if (taskForUpdate.status !== "in_progress")
+        return toMcpResponse(fail("任务不在进行中状态"));
+    // Resolve caller for RPC
+    let callerId = taskForUpdate.user_id;
+    if (!callerId && taskForUpdate.agent_id) {
+        const { data: agent } = await supabase.from("agents").select("owner_user_id").eq("id", taskForUpdate.agent_id).single();
+        callerId = agent?.owner_user_id;
+    }
+    const { data: rpcResult, error } = await supabase.rpc('update_task_status', {
+        p_task_id: taskId,
+        p_caller_id: callerId,
+        p_updates: updates,
+    });
+    if (error)
+        return toMcpResponse(handleSupabaseError(error, "update_task"));
+    if (!rpcResult?.success)
+        return toMcpResponse(fail(rpcResult?.error || "更新失败"));
+    // Re-fetch updated task for response
+    const { data: updatedTask } = await supabase
+        .from("tasks").select("id, title, status, completion_pct, milestones_completed, output_type").eq("id", taskId).single();
+    return toMcpResponse(ok(updatedTask));
+}
+export async function handleCompleteTask(params) {
+    const callerUserId = params.caller_user_id;
+    const taskId = params.task_id;
+    const completionPct = params.completion_pct ?? 100;
+    const outputTypeParam = params.output_type;
+    const evidence = params.evidence;
+    const metadata = params.metadata;
+    // Ownership check
+    const ownershipErr = await verifyOwnership({
+        caller_user_id: callerUserId,
+        target_task_id: taskId,
+    });
+    if (ownershipErr)
+        return ownershipErr;
+    // Fetch the task
+    const { data: task, error: taskError } = await supabase
+        .from("tasks").select("*").eq("id", taskId).single();
+    if (taskError)
+        return toMcpResponse(handleSupabaseError(taskError, "complete_task"));
+    // Rate limit: max 20 completions per 10 minutes per entity
+    const completeEntityId = task.user_id || task.agent_id || "";
+    const limited = checkRateLimit(completeEntityId, "complete_task", 20, 600_000);
+    if (limited)
+        return limited;
+    if (task.status !== "in_progress") {
+        return toMcpResponse(fail(`任务已处于 "${task.status}" 状态`, "只有进行中的任务才能完成。"));
+    }
+    const finalOutputType = outputTypeParam || task.output_type;
+    const now = new Date().toISOString();
+    const startedAt = new Date(task.started_at).getTime();
+    const durationSeconds = Math.round((Date.now() - startedAt) / 1000);
+    // --- Hard minimum duration per XP tier (bot detection floor) ---
+    const isAgentPerformer = !!task.agent_id;
+    const MIN_DURATION_SECONDS = isAgentPerformer ? {
+        micro: 5,
+        light: 15,
+        standard: 30,
+        complex: 60,
+        major: 180,
+    } : {
+        micro: 15,
+        light: 45,
+        standard: 90,
+        complex: 180,
+        major: 600,
+    };
+    const { data: taskTypeForDuration } = await supabase
+        .from("task_types").select("xp_tier").eq("id", task.task_type_id).maybeSingle();
+    const originalTier = taskTypeForDuration?.xp_tier || "standard";
+    // Use tier override from start_task if present (stored in metadata)
+    const tierOverride = task.metadata?.xp_tier_override;
+    let taskTier = tierOverride || originalTier;
+    let minDuration = MIN_DURATION_SECONDS[taskTier] || 30;
+    let tierDowngraded = false;
+    let downgradeNote;
+    if (durationSeconds < minDuration) {
+        // --- Auto-downgrade: find the highest tier whose floor this duration passes ---
+        const currentIdx = tierIndex(taskTier);
+        let downgradeIdx = -1;
+        for (let i = currentIdx - 1; i >= 0; i--) {
+            const lowerTier = TIER_ORDER[i];
+            if (durationSeconds >= (MIN_DURATION_SECONDS[lowerTier] || 30)) {
+                downgradeIdx = i;
+                break;
+            }
+        }
+        if (downgradeIdx >= 0) {
+            const newTier = TIER_ORDER[downgradeIdx];
+            downgradeNote = `自动降级：从 "${taskTier}" 降至 "${newTier}" — 完成用时 ${durationSeconds}秒（低于 ${taskTier} 档位的 ${isAgentPerformer ? "智能体" : "人类"} 最低要求 ${minDuration}秒）。经验值按 ${newTier} 档位重新计算。`;
+            taskTier = newTier;
+            minDuration = MIN_DURATION_SECONDS[taskTier] || 30;
+            tierDowngraded = true;
+        }
+        else {
+            // Duration doesn't even pass micro tier floor — hard block
+            const performerNote = isAgentPerformer
+                ? `智能体 micro 任务最低要求为 ${MIN_DURATION_SECONDS.micro}秒。`
+                : `人类 micro 任务最低要求为 ${MIN_DURATION_SECONDS.micro}秒。`;
+            return toMcpResponse(fail(`任务完成过快：${durationSeconds}秒 < 最低要求 ${MIN_DURATION_SECONDS.micro}秒`, `你的任务用时 ${durationSeconds} 秒。${performerNote}` +
+                `"${taskTier}" 档位的最低时间为 ${minDuration}秒。即使自动降级后，` +
+                `${durationSeconds}秒仍低于最低要求。此机制用于防止自动化刷量 — 真正的工作需要更长时间。`));
+        }
+    }
+    // Update task status via RPC
+    let completeCallerId = task.user_id;
+    if (!completeCallerId && task.agent_id) {
+        const { data: agentOwner } = await supabase.from("agents").select("owner_user_id").eq("id", task.agent_id).single();
+        completeCallerId = agentOwner?.owner_user_id;
+    }
+    const { data: completeRpc, error: updateError } = await supabase.rpc('update_task_status', {
+        p_task_id: taskId,
+        p_caller_id: completeCallerId,
+        p_updates: {
+            status: "completed",
+            completion_pct: completionPct,
+            output_type: finalOutputType,
+            completed_at: now,
+            duration_seconds: durationSeconds,
+            metadata: JSON.stringify(metadata || task.metadata),
+        },
+    });
+    if (updateError)
+        return toMcpResponse(handleSupabaseError(updateError, "complete_task (update)"));
+    if (!completeRpc?.success)
+        return toMcpResponse(fail(completeRpc?.error || "任务更新失败"));
+    // --- Evidence system: store evidence and compute quality ---
+    const rawEvidence = evidence || [];
+    let evidenceQuality = "none";
+    // Block obvious secrets (hard reject — sanitization handles softer patterns)
+    for (const item of rawEvidence) {
+        if (containsSecret(item.content)) {
+            return toMcpResponse(fail("证据内容似乎包含敏感信息（API 密钥、令牌或私钥）。" +
+                "请使用 URL 或引用 ID 替代。切勿在证据中包含凭证信息。"));
+        }
+    }
+    // --- Evidence requirements per tier ---
+    const EVIDENCE_REQUIREMENTS = {
+        micro: { min_items: 0, requires_strong: false, min_content_length: 0, description: "无需证据" },
+        light: { min_items: 0, requires_strong: false, min_content_length: 0, description: "证据可选" },
+        standard: { min_items: 1, requires_strong: false, min_content_length: 20, description: "至少 1 项证据（URL、引用或详细摘要）" },
+        complex: { min_items: 1, requires_strong: true, min_content_length: 30, description: "至少 1 项强证据（deliverable_url、platform_reference 或 code_output）" },
+        major: { min_items: 2, requires_strong: true, min_content_length: 30, description: "至少 2 项证据，其中至少 1 项为强类型" },
+    };
+    const evidenceReq = EVIDENCE_REQUIREMENTS[taskTier] || EVIDENCE_REQUIREMENTS.standard;
+    const strongTypes = ["deliverable_url", "platform_reference", "code_output"];
+    // Validate evidence meets tier requirements
+    if (evidenceReq.min_items > 0) {
+        if (rawEvidence.length < evidenceReq.min_items) {
+            return toMcpResponse(fail(`${taskTier} 档位任务需要证据来证明工作已完成`, `${evidenceReq.description}。请附上交付物 URL、平台引用、代码输出或详细文字摘要作为证据。无需敏感数据 — 使用脱敏片段或引用 ID 即可。`));
+        }
+        // Check minimum content length (catches "done" or "ok" evidence)
+        const thinEvidence = rawEvidence.filter((e) => e.content.trim().length < evidenceReq.min_content_length);
+        if (thinEvidence.length === rawEvidence.length) {
+            return toMcpResponse(fail("证据内容过于简略，无法验证工作", `每项证据至少需要 ${evidenceReq.min_content_length} 个字符。请提供 URL、引用 ID 或有意义的工作摘要。无需敏感数据 — 只需足以证明工作已完成。`));
+        }
+        // Check strong evidence requirement
+        if (evidenceReq.requires_strong) {
+            const hasStrongEvidence = rawEvidence.some((e) => strongTypes.includes(e.evidence_type));
+            if (!hasStrongEvidence) {
+                return toMcpResponse(fail(`${taskTier} 档位任务需要强证据（deliverable_url、platform_reference 或 code_output）`, "仅文字摘要不足以满足 complex/major 任务的要求。请提供交付物 URL、平台引用（如 PR #42、JIRA-1234）或代码输出来展示产出成果。"));
+            }
+        }
+    }
+    // Sanitize: redact emails/IPs, strip URL query params, snip long code output
+    const evidenceItems = sanitizeEvidence(rawEvidence);
+    if (evidenceItems.length > 0) {
+        // Insert evidence rows via RPC
+        for (const e of evidenceItems) {
+            await supabase.rpc('add_task_evidence_secure', {
+                p_task_id: task.id,
+                p_evidence_type: e.evidence_type,
+                p_content: e.content,
+                p_label: e.label || null,
+            });
+        }
+        // Compute evidence quality
+        const strongTypes = ["deliverable_url", "platform_reference", "code_output"];
+        const mediumTypes = ["screenshot", "api_response", "external_link"];
+        const hasStrong = evidenceItems.some((e) => strongTypes.includes(e.evidence_type));
+        const hasMedium = evidenceItems.some((e) => mediumTypes.includes(e.evidence_type));
+        const hasOnlySummary = evidenceItems.every((e) => e.evidence_type === "text_summary");
+        if (hasStrong)
+            evidenceQuality = "strong";
+        else if (hasMedium)
+            evidenceQuality = "medium";
+        else if (hasOnlySummary)
+            evidenceQuality = "low";
+    }
+    // Update task with evidence quality via RPC
+    await supabase.rpc('update_task_fields_secure', {
+        p_task_id: task.id,
+        p_fields: { evidence_quality: evidenceQuality },
+    });
+    // Evidence XP multipliers — tier-aware:
+    const evidenceExempt = taskTier === "micro" || taskTier === "light";
+    const evidenceXpMultiplier = evidenceExempt ? 1.0
+        : evidenceQuality === "none" ? 0.75 : 1.0;
+    const evidenceQualityPenalty = evidenceExempt ? 1.0
+        : evidenceQuality === "low" ? 0.9 : 1.0;
+    // --- BUG 3 FIX: Enforce task cooldowns per tier ---
+    let cooldownBlocked = false;
+    const tier = taskTier;
+    const { data: cooldownConfig } = await supabase
+        .from("xp_config").select("config_value")
+        .eq("config_key", "task_cooldown_base_minutes").maybeSingle();
+    if (cooldownConfig?.config_value) {
+        const cooldowns = cooldownConfig.config_value;
+        const cooldownMinutes = cooldowns[tier] || 0;
+        if (cooldownMinutes > 0) {
+            const cooldownCutoff = new Date(Date.now() - cooldownMinutes * 60_000).toISOString();
+            const entityCol = task.agent_id ? "agent_id" : "user_id";
+            const entityVal = task.agent_id || task.user_id;
+            // Get same-tier tasks completed within cooldown window
+            const { data: recentTasks } = await supabase
+                .from("tasks")
+                .select("id, task_type_id")
+                .eq(entityCol, entityVal).eq("status", "completed")
+                .neq("id", taskId)
+                .gte("completed_at", cooldownCutoff);
+            // Filter to same-tier tasks only
+            if (recentTasks && recentTasks.length > 0) {
+                const recentTypeIds = recentTasks.map((t) => t.task_type_id).filter(Boolean);
+                if (recentTypeIds.length > 0) {
+                    const { data: recentTypes } = await supabase
+                        .from("task_types").select("id, xp_tier")
+                        .in("id", recentTypeIds);
+                    const sameTierCount = (recentTypes || []).filter((t) => t.xp_tier === tier).length;
+                    if (sameTierCount > 0) {
+                        cooldownBlocked = true;
+                    }
+                }
+            }
+        }
+    }
+    // --- Quality-Gated XP: Auto system evaluation + integrity multiplier ---
+    const qualityResult = computeSystemScore({
+        completion_pct: completionPct,
+        output_type: finalOutputType,
+        difficulty: task.difficulty,
+        duration_seconds: durationSeconds,
+        xp_tier: taskTier,
+    });
+    // Insert system template evaluation record via RPC
+    await supabase.rpc('add_task_evaluation_secure', {
+        p_task_id: task.id,
+        p_evaluator_type: "system_template",
+        p_evaluator_id: null,
+        p_scores: qualityResult.breakdown,
+        p_weight: 0.35,
+    });
+    // Get integrity multiplier for primary performer
+    const primaryEntityType = task.agent_id ? "agent" : "user";
+    const primaryEntityId = task.agent_id || task.user_id || "";
+    const integrityMultiplier = await getIntegrityMultiplier(primaryEntityType, primaryEntityId);
+    const qualityMultiplier = qualityResult.score / 5.0;
+    const effectiveMultiplier = qualityMultiplier * integrityMultiplier;
+    // Write tier override + evidence multiplier to task BEFORE awarding XP
+    if (tierDowngraded || evidenceXpMultiplier < 1.0) {
+        await supabase.rpc('update_task_fields_secure', {
+            p_caller_user_id: callerUserId,
+            p_task_id: task.id,
+            p_fields: {
+                ...(tierDowngraded ? { xp_tier_override: taskTier } : {}),
+                ...(evidenceXpMultiplier < 1.0 ? { evidence_xp_multiplier: evidenceXpMultiplier * evidenceQualityPenalty } : {}),
+            },
+        });
+    }
+    // Award XP (0 if cooldown blocked)
+    let xpResult;
+    if (cooldownBlocked) {
+        xpResult = { xp_awards: [], total_xp_pool: 0, cooldown_blocked: true };
+    }
+    else {
+        xpResult = await awardTaskXp(task.id);
+    }
+    // --- BUG 1 FIX: Auto-call check_level_up for all XP recipients ---
+    const levelUpResults = [];
+    if (!cooldownBlocked && xpResult.xp_awards.length > 0) {
+        for (const award of xpResult.xp_awards) {
+            const { data: levelData } = await supabase.rpc('check_and_apply_level_up', {
+                p_entity_type: award.recipient_type,
+                p_entity_id: award.recipient_id,
+            });
+            if (levelData?.leveled_up) {
+                levelUpResults.push({
+                    entity_type: levelData.entity_type,
+                    entity_id: levelData.entity_id,
+                    previous_level: levelData.previous_level,
+                    new_level: levelData.new_level,
+                    previous_rank: levelData.previous_rank,
+                    new_rank: levelData.new_rank,
+                    rank_changed: levelData.rank_changed,
+                });
+            }
+            // --- P1 FIX: Distribute class XP based on performer_type ---
+            if (award.recipient_type === "user") {
+                const classMap = {
+                    user_solo: "partner",
+                    user_with_tools: "partner",
+                    user_with_agent: "partner",
+                    orchestrated: "orchestrator",
+                    agent_solo: "trainer",
+                };
+                const targetClass = classMap[task.performer_type] || "partner";
+                // Award 20% of the user's XP share to the relevant class track
+                const classXpAmount = Math.max(1, Math.round(award.total_xp * 0.20));
+                // Use SECURITY DEFINER RPC to update class progress + ledger
+                await awardClassXpViaRpc(award.recipient_id, targetClass, classXpAmount, "task", `${targetClass} 职业经验值，来自 ${task.performer_type} 任务`, task.id);
+            }
+        }
+    }
+    // --- Task A FIX: Update agent skill proficiency based on task type ---
+    if (task.agent_id && task.task_type_id) {
+        const { data: taskType } = await supabase
+            .from("task_types").select("category").eq("id", task.task_type_id).maybeSingle();
+        if (taskType?.category) {
+            const { data: categorySkills } = await supabase
+                .from("skill_categories").select("id").eq("name", taskType.category).maybeSingle();
+            if (categorySkills?.id) {
+                const { data: relatedSkills } = await supabase
+                    .from("skills").select("id").eq("category_id", categorySkills.id);
+                const skillIds = (relatedSkills || []).map((s) => s.id);
+                if (skillIds.length > 0) {
+                    const { data: agentSkills } = await supabase
+                        .from("agent_skills")
+                        .select("id, skill_id, proficiency_level, usage_count")
+                        .eq("agent_id", task.agent_id)
+                        .in("skill_id", skillIds);
+                    for (const as of agentSkills || []) {
+                        const newUsage = (as.usage_count || 0) + 1;
+                        const newProf = Math.min(10, as.proficiency_level + (newUsage % 5 === 0 ? 1 : 0));
+                        await supabase.rpc('update_agent_skill_secure', {
+                            p_agent_skill_id: as.id,
+                            p_usage_count: newUsage,
+                            p_proficiency_level: newProf,
+                        });
+                    }
+                }
+            }
+        }
+    }
+    // --- Task F FIX: Achievement auto-triggers after task completion ---
+    if (!cooldownBlocked && xpResult.xp_awards.length > 0) {
+        const performerId = task.agent_id || task.user_id;
+        const performerType = task.agent_id ? "agent" : "user";
+        if (performerId && performerType === "user") {
+            const { count: totalTasks } = await supabase
+                .from("tasks").select("id", { count: "exact", head: true })
+                .eq(task.agent_id ? "agent_id" : "user_id", performerId)
+                .eq("status", "completed");
+            const taskAchievements = [
+                { count: 1, key: "first_task", name: "First Steps" },
+                { count: 10, key: "ten_tasks", name: "Getting Started" },
+                { count: 50, key: "fifty_tasks", name: "Dedicated Worker" },
+                { count: 100, key: "hundred_tasks", name: "Centurion" },
+                { count: 500, key: "five_hundred_tasks", name: "Tireless" },
+            ];
+            for (const ach of taskAchievements) {
+                if ((totalTasks || 0) >= ach.count) {
+                    const { error: achErr } = await supabase.rpc('grant_achievement', {
+                        p_user_id: performerType === "user" ? performerId : null,
+                        p_achievement_key: ach.key,
+                    });
+                    if (achErr) { /* Silently skip — already earned or key doesn't exist */ }
+                }
+            }
+        }
+    }
+    // Contribute to TDI (Task Difficulty Index) via RPC
+    if (task.tags && task.tags.length > 0) {
+        const tagSignature = [...task.tags].sort().join(",");
+        await supabase.rpc('upsert_task_difficulty_index', {
+            p_task_type_id: task.task_type_id,
+            p_tag_signature: tagSignature,
+            p_difficulty: task.difficulty,
+            p_completion_seconds: durationSeconds,
+        });
+    }
+    // --- User-only bonus XP (not split with agent) ---
+    let userBonusXp = 0;
+    const userBonusReasons = [];
+    const userId = task.user_id;
+    if (userId && !cooldownBlocked) {
+        // Evidence bonus: +5 XP for strong evidence on standard+ tasks
+        if (evidenceQuality === "strong" && !["micro", "light"].includes(taskTier)) {
+            userBonusXp += 5;
+            userBonusReasons.push("证据奖励：+5 经验值（standard+ 任务提供强证据）");
+        }
+        // Diversity bonus: +3 XP for first time completing this task type
+        const { count: priorCount } = await supabase
+            .from("tasks").select("id", { count: "exact", head: true })
+            .eq("user_id", userId).eq("task_type_id", task.task_type_id).eq("status", "completed");
+        if ((priorCount || 0) <= 1) {
+            userBonusXp += 3;
+            userBonusReasons.push("多样性奖励：+3 经验值（首次完成此任务类型）");
+        }
+        // Streak bonus: +2 XP if user completed a task yesterday too
+        const yesterday = new Date(Date.now() - 86400_000).toISOString().slice(0, 10);
+        const { count: yesterdayCount } = await supabase
+            .from("tasks").select("id", { count: "exact", head: true })
+            .eq("user_id", userId).eq("status", "completed")
+            .gte("completed_at", yesterday + "T00:00:00Z")
+            .lt("completed_at", yesterday + "T23:59:59Z");
+        if ((yesterdayCount || 0) > 0) {
+            userBonusXp += 2;
+            userBonusReasons.push("连续奖励：+2 经验值（连续天数）");
+        }
+        // Award user-only bonus XP via SECURITY DEFINER RPC
+        if (userBonusXp > 0) {
+            await awardXpViaRpc("user", userId, userBonusXp, "bonus", userBonusReasons.join("; "), task.id);
+            // RPC updates running_total + user.main_xp; still check for level-up
+            await supabase.rpc("check_and_apply_level_up", {
+                p_entity_type: "user",
+                p_entity_id: userId,
+            });
+        }
+    }
+    // Build evidence warning message
+    let evidenceWarning = null;
+    if (evidenceQuality === "none" && !evidenceExempt) {
+        evidenceWarning = "未附加证据。经验值减少 25%。请在 24 小时内使用 levelup_add_task_evidence 附加证据以恢复全额经验值。";
+    }
+    else if (evidenceQuality === "low" && !evidenceExempt) {
+        evidenceWarning = "仅附加了文字摘要。已扣减 10% 质量惩罚。请附加更强的证据（URL、引用）以获得全额经验值。";
+    }
+    return toMcpResponse(ok({
+        task_id: task.id,
+        title: task.title,
+        status: "completed",
+        completion_pct: completionPct,
+        output_type: finalOutputType,
+        xp_tier: taskTier,
+        tier_downgraded: tierDowngraded || undefined,
+        tier_downgrade_note: downgradeNote,
+        duration_seconds: durationSeconds,
+        evidence_quality: evidenceQuality,
+        evidence_count: evidenceItems.length,
+        evidence_warning: evidenceWarning,
+        xp: xpResult,
+        quality: {
+            system_score: Math.round(qualityResult.score * 100) / 100,
+            score_out_of: 5,
+            quality_multiplier: Math.round(qualityMultiplier * 100) / 100,
+            integrity_multiplier: Math.round(integrityMultiplier * 100) / 100,
+            evidence_multiplier: Math.round(evidenceXpMultiplier * evidenceQualityPenalty * 100) / 100,
+            effective_multiplier: Math.round(effectiveMultiplier * evidenceXpMultiplier * evidenceQualityPenalty * 100) / 100,
+            breakdown: qualityResult.breakdown,
+            note: evidenceWarning || "质量评分影响经验值。提交智能体自评可获得最高 20% 的额外经验值。",
+        },
+        user_bonus_xp: userBonusXp > 0 ? { amount: userBonusXp, reasons: userBonusReasons } : undefined,
+        level_ups: levelUpResults.length > 0 ? levelUpResults : undefined,
+        cooldown_blocked: cooldownBlocked || undefined,
+    }));
+}
+export async function handleFailTask(params) {
+    const callerUserId = params.caller_user_id;
+    const taskId = params.task_id;
+    const outcome = params.outcome;
+    const reason = params.reason;
+    const metadata = params.metadata;
+    const ownershipErr = await verifyOwnership({
+        caller_user_id: callerUserId,
+        target_task_id: taskId,
+    });
+    if (ownershipErr)
+        return ownershipErr;
+    const { data: task, error: taskError } = await supabase
+        .from("tasks").select("*").eq("id", taskId).single();
+    if (taskError)
+        return toMcpResponse(handleSupabaseError(taskError, "fail_task"));
+    if (task.status !== "in_progress") {
+        return toMcpResponse(fail(`任务已处于 "${task.status}" 状态`));
+    }
+    const now = new Date().toISOString();
+    // Update task via RPC
+    let failCallerId = task.user_id;
+    if (!failCallerId && task.agent_id) {
+        const { data: agentOwner } = await supabase.from("agents").select("owner_user_id").eq("id", task.agent_id).single();
+        failCallerId = agentOwner?.owner_user_id;
+    }
+    const mergedMeta = { ...(task.metadata || {}), ...(metadata || {}), failure_reason: reason || null };
+    await supabase.rpc('update_task_status', {
+        p_task_id: taskId,
+        p_caller_id: failCallerId,
+        p_updates: {
+            status: outcome,
+            completed_at: now,
+            metadata: JSON.stringify(mergedMeta),
+        },
+    });
+    // Award partial XP for failed tasks (RPC handles the 15% reduction internally)
+    let xpResult = null;
+    if (outcome === "failed" && (task.user_id || task.agent_id)) {
+        xpResult = await awardTaskXp(task.id);
+    }
+    return toMcpResponse(ok({
+        task_id: task.id,
+        title: task.title,
+        status: outcome,
+        reason: reason || null,
+        xp: outcome === "cancelled" ? { total_xp_pool: 0, xp_awards: [] } : xpResult,
+    }));
+}
+export async function handleGetTask(params) {
+    const callerUserId = params.caller_user_id;
+    const taskId = params.task_id;
+    // Ownership check: caller must own the task or its agent
+    const denied = await verifyOwnership({
+        caller_user_id: callerUserId,
+        target_task_id: taskId,
+    });
+    if (denied)
+        return denied;
+    const { data: task, error } = await supabase
+        .from("tasks").select("*").eq("id", taskId).single();
+    if (error)
+        return toMcpResponse(handleSupabaseError(error, "get_task"));
+    // Get task type name
+    const { data: taskType } = await supabase
+        .from("task_types").select("name, base_xp, xp_tier").eq("id", task.task_type_id).single();
+    // Get XP awards
+    const { data: xpAwards } = await supabase
+        .from("task_xp_awards").select("*").eq("task_id", taskId);
+    // Get milestones if any
+    const { data: milestones } = await supabase
+        .from("task_milestones").select("*").eq("task_id", taskId)
+        .order("sort_order", { ascending: true });
+    return toMcpResponse(ok({
+        ...task,
+        task_type_name: taskType?.name || null,
+        task_type_base_xp: taskType?.base_xp || null,
+        task_type_xp_tier: taskType?.xp_tier || null,
+        xp_awards: xpAwards || [],
+        milestones: milestones || [],
+    }));
+}
+export async function handleListTasks(params) {
+    const callerUserId = params.caller_user_id;
+    const userId = params.user_id;
+    const agentId = params.agent_id;
+    const status = params.status;
+    const performerType = params.performer_type;
+    const outputType = params.output_type;
+    const since = params.since;
+    const limit = params.limit || 20;
+    const offset = params.offset || 0;
+    // Ownership check: verify caller can access the requested user/agent data
+    if (userId) {
+        const denied = await verifyOwnership({
+            caller_user_id: callerUserId,
+            target_user_id: userId,
+        });
+        if (denied)
+            return denied;
+    }
+    if (agentId) {
+        const denied = await verifyOwnership({
+            caller_user_id: callerUserId,
+            target_agent_id: agentId,
+        });
+        if (denied)
+            return denied;
+    }
+    // If neither user_id nor agent_id provided, scope to caller's own data
+    const effectiveUserId = userId || callerUserId;
+    let query = supabase
+        .from("tasks")
+        .select("id, title, task_type_id, performer_type, status, difficulty, output_type, completion_pct, started_at, completed_at, created_at", { count: "exact" });
+    if (agentId) {
+        query = query.eq("agent_id", agentId);
+    }
+    else {
+        query = query.eq("user_id", effectiveUserId);
+    }
+    if (status)
+        query = query.eq("status", status);
+    if (performerType)
+        query = query.eq("performer_type", performerType);
+    if (outputType)
+        query = query.eq("output_type", outputType);
+    if (since)
+        query = query.gte("created_at", since);
+    query = query.order("created_at", { ascending: false }).range(offset, offset + limit - 1);
+    const { data: tasks, count, error } = await query;
+    if (error)
+        return toMcpResponse(handleSupabaseError(error, "list_tasks"));
+    return toMcpResponse(ok(paginate(tasks || [], count || 0, offset)));
+}
+export async function handleListTaskTypes(params) {
+    const search = params.search;
+    let query = supabase
+        .from("task_types")
+        .select("id, name, description, base_xp, xp_tier, category, status")
+        .eq("status", "active")
+        .order("name", { ascending: true });
+    if (search) {
+        query = query.or(`name.ilike.%${search}%,description.ilike.%${search}%`);
+    }
+    const { data: types, error } = await query;
+    if (error)
+        return toMcpResponse(handleSupabaseError(error, "list_task_types"));
+    return toMcpResponse(ok(types || []));
+}
+export async function handleAddTaskEvidence(params) {
+    const callerUserId = params.caller_user_id;
+    const taskId = params.task_id;
+    const evidenceParam = params.evidence;
+    // Ownership check: verify caller owns the task
+    const ownershipErr = await verifyOwnership({
+        caller_user_id: callerUserId,
+        target_task_id: taskId,
+    });
+    if (ownershipErr)
+        return ownershipErr;
+    // Fetch the task
+    const { data: task, error: taskError } = await supabase
+        .from("tasks").select("id, status, completed_at, evidence_quality, agent_id, user_id")
+        .eq("id", taskId).single();
+    if (taskError)
+        return toMcpResponse(handleSupabaseError(taskError, "add_task_evidence"));
+    // Block obvious secrets
+    for (const item of evidenceParam) {
+        if (containsSecret(item.content)) {
+            return toMcpResponse(fail("证据内容似乎包含敏感信息（API 密钥、令牌或私钥）。" +
+                "请使用 URL 或引用 ID 替代。切勿在证据中包含凭证信息。"));
+        }
+    }
+    // Sanitize: redact emails/IPs, strip URL query params, snip long code output
+    const sanitized = sanitizeEvidence(evidenceParam);
+    // Insert evidence rows via RPC
+    for (const e of sanitized) {
+        const { error: insertError } = await supabase.rpc('add_task_evidence_secure', {
+            p_task_id: task.id,
+            p_evidence_type: e.evidence_type,
+            p_content: e.content,
+            p_label: e.label || null,
+        });
+        if (insertError)
+            return toMcpResponse(handleSupabaseError(insertError, "add_task_evidence"));
+    }
+    // Re-compute evidence quality from ALL evidence on this task
+    const { data: allEvidence } = await supabase
+        .from("task_evidence").select("evidence_type").eq("task_id", task.id);
+    const strongTypesEvidence = ["deliverable_url", "platform_reference", "code_output"];
+    const mediumTypesEvidence = ["screenshot", "api_response", "external_link"];
+    const hasStrong = (allEvidence || []).some((e) => strongTypesEvidence.includes(e.evidence_type));
+    const hasMedium = (allEvidence || []).some((e) => mediumTypesEvidence.includes(e.evidence_type));
+    const hasOnlySummary = (allEvidence || []).every((e) => e.evidence_type === "text_summary");
+    let newQuality;
+    if (hasStrong)
+        newQuality = "strong";
+    else if (hasMedium)
+        newQuality = "medium";
+    else if (hasOnlySummary)
+        newQuality = "low";
+    else
+        newQuality = "none";
+    // Update task evidence quality via RPC
+    await supabase.rpc('update_task_fields_secure', {
+        p_task_id: task.id,
+        p_fields: { evidence_quality: newQuality },
+    });
+    // Check if XP top-up is warranted (within 24h grace window)
+    let xpAdjustment = null;
+    const previousQuality = task.evidence_quality || "none";
+    if (task.status === "completed" && task.completed_at) {
+        const completedAt = new Date(task.completed_at).getTime();
+        const graceWindowMs = 24 * 3600_000;
+        const withinGrace = Date.now() - completedAt < graceWindowMs;
+        if (withinGrace && previousQuality === "none" && newQuality !== "none") {
+            const { data: taskTypeInfo } = await supabase
+                .from("task_types").select("xp_tier").eq("id", (await supabase.from("tasks").select("task_type_id").eq("id", task.id).single()).data?.task_type_id).maybeSingle();
+            const tierVal = taskTypeInfo?.xp_tier || "standard";
+            const wasExempt = tierVal === "micro" || tierVal === "light";
+            if (!wasExempt) {
+                const { data: existingAwards } = await supabase
+                    .from("task_xp_awards").select("recipient_type, recipient_id, total_xp")
+                    .eq("task_id", task.id);
+                if (existingAwards && existingAwards.length > 0) {
+                    let totalTopUp = 0;
+                    const qualityPenalty = newQuality === "low" ? 0.9 : 1.0;
+                    const topUpFraction = (1 / 3) * qualityPenalty;
+                    for (const award of existingAwards) {
+                        const topUpXp = Math.round(award.total_xp * topUpFraction);
+                        if (topUpXp > 0) {
+                            await supabase.rpc('award_xp_direct', {
+                                p_entity_type: award.recipient_type === "user_class" ? "user" : award.recipient_type,
+                                p_entity_id: award.recipient_id,
+                                p_amount: topUpXp,
+                                p_source_type: "task",
+                                p_description: `证据补偿经验值，任务：${task.id}`,
+                                p_source_id: task.id,
+                            });
+                            totalTopUp += topUpXp;
+                        }
+                    }
+                    xpAdjustment = {
+                        description: `证据质量从 'none' 提升至 '${newQuality}'，正在恢复经验值。`,
+                        additional_xp: totalTopUp,
+                    };
+                }
+            }
+        }
+        const graceExpiresAt = new Date(completedAt + graceWindowMs).toISOString();
+        return toMcpResponse(ok({
+            task_id: task.id,
+            evidence_added: evidenceParam.length,
+            new_evidence_quality: newQuality,
+            previous_evidence_quality: previousQuality,
+            xp_adjustment: xpAdjustment,
+            grace_window_expires_at: graceExpiresAt,
+        }));
+    }
+    return toMcpResponse(ok({
+        task_id: task.id,
+        evidence_added: evidenceParam.length,
+        new_evidence_quality: newQuality,
+        previous_evidence_quality: previousQuality,
+        note: task.status === "in_progress"
+            ? "证据已附加，将在任务完成时用于质量评分。"
+            : "证据已附加用于记录。经验值调整的宽限窗口已过期。",
+    }));
+}
+export async function handleGetTaskLog(params) {
+    const callerUserId = params.caller_user_id;
+    const agentId = params.agent_id;
+    const userId = params.user_id;
+    const since = params.since;
+    const until = params.until;
+    const evidenceQualityFilter = params.evidence_quality;
+    const includeEvidence = params.include_evidence !== undefined ? params.include_evidence : true;
+    const limit = params.limit || 20;
+    const offset = params.offset || 0;
+    if (!agentId && !userId) {
+        return toMcpResponse(fail("至少需要 agent_id 或 user_id 其中之一"));
+    }
+    // Ownership check
+    if (userId) {
+        const denied = await verifyOwnership({
+            caller_user_id: callerUserId,
+            target_user_id: userId,
+        });
+        if (denied)
+            return denied;
+    }
+    if (agentId) {
+        const denied = await verifyOwnership({
+            caller_user_id: callerUserId,
+            target_agent_id: agentId,
+        });
+        if (denied)
+            return denied;
+    }
+    // Build query for tasks
+    let query = supabase
+        .from("tasks")
+        .select("id, title, task_type_id, status, completion_pct, output_type, difficulty, evidence_quality, completed_at, duration_seconds, created_at", { count: "exact" })
+        .in("status", ["completed", "failed"]);
+    if (agentId)
+        query = query.eq("agent_id", agentId);
+    if (userId)
+        query = query.eq("user_id", userId);
+    if (since)
+        query = query.gte("completed_at", since);
+    if (until)
+        query = query.lte("completed_at", until);
+    if (evidenceQualityFilter)
+        query = query.eq("evidence_quality", evidenceQualityFilter);
+    query = query.order("completed_at", { ascending: false }).range(offset, offset + limit - 1);
+    const { data: tasks, count, error } = await query;
+    if (error)
+        return toMcpResponse(handleSupabaseError(error, "get_task_log"));
+    if (!tasks || tasks.length === 0) {
+        return toMcpResponse(ok({
+            total_tasks: 0,
+            total_xp_earned: 0,
+            evidence_summary: { strong: 0, medium: 0, low: 0, none: 0 },
+            tasks: [],
+            ...paginate([], 0, offset),
+        }));
+    }
+    // Batch fetch task type names
+    const taskTypeIds = [...new Set(tasks.map((t) => t.task_type_id).filter(Boolean))];
+    const { data: taskTypes } = await supabase
+        .from("task_types").select("id, name").in("id", taskTypeIds);
+    const typeNameMap = new Map((taskTypes || []).map((tt) => [tt.id, tt.name]));
+    // Batch fetch XP awards
+    const taskIds = tasks.map((t) => t.id);
+    const { data: xpAwards } = await supabase
+        .from("task_xp_awards").select("task_id, total_xp").in("task_id", taskIds);
+    const xpByTask = new Map();
+    for (const award of xpAwards || []) {
+        xpByTask.set(award.task_id, (xpByTask.get(award.task_id) || 0) + award.total_xp);
+    }
+    // Batch fetch evidence if requested
+    let evidenceByTask = new Map();
+    if (includeEvidence) {
+        const { data: evidenceData } = await supabase
+            .from("task_evidence").select("task_id, evidence_type, label, content, verified")
+            .in("task_id", taskIds);
+        for (const e of evidenceData || []) {
+            if (!evidenceByTask.has(e.task_id))
+                evidenceByTask.set(e.task_id, []);
+            evidenceByTask.get(e.task_id).push(e);
+        }
+    }
+    // Build evidence summary counts
+    const evidenceSummary = { strong: 0, medium: 0, low: 0, none: 0 };
+    let totalXp = 0;
+    const taskEntries = tasks.map((t) => {
+        const quality = (t.evidence_quality || "none");
+        if (quality in evidenceSummary)
+            evidenceSummary[quality]++;
+        const xpEarned = xpByTask.get(t.id) || 0;
+        totalXp += xpEarned;
+        const entry = {
+            task_id: t.id,
+            title: t.title,
+            task_type: typeNameMap.get(t.task_type_id) || null,
+            completed_at: t.completed_at,
+            status: t.status,
+            completion_pct: t.completion_pct,
+            xp_earned: xpEarned,
+            evidence_quality: t.evidence_quality || "none",
+        };
+        if (includeEvidence) {
+            entry.evidence = evidenceByTask.get(t.id) || [];
+        }
+        return entry;
+    });
+    // Get entity name for display
+    let entityName = null;
+    if (agentId) {
+        const { data: agent } = await supabase.from("agents").select("name").eq("id", agentId).maybeSingle();
+        entityName = agent?.name || null;
+    }
+    return toMcpResponse(ok({
+        agent_name: entityName,
+        total_tasks: count || tasks.length,
+        total_xp_earned: totalXp,
+        evidence_summary: evidenceSummary,
+        ...paginate(taskEntries, count || 0, offset),
+    }));
+}
+export async function handleResumeOrStart(params) {
+    const callerUserId = params.caller_user_id;
+    const title = params.title;
+    const taskTypeId = params.task_type_id;
+    const userId = params.user_id;
+    const agentId = params.agent_id;
+    const difficulty = params.difficulty || 3;
+    const outputType = params.output_type;
+    const dedupWindowMinutes = params.dedup_window_minutes || 120;
+    if (!userId && !agentId) {
+        return toMcpResponse(fail("至少需要 user_id 或 agent_id 其中之一"));
+    }
+    // Ownership check: verify caller owns the agent if provided
+    if (agentId) {
+        const ownershipErr = await verifyOwnership({
+            caller_user_id: callerUserId,
+            target_agent_id: agentId,
+        });
+        if (ownershipErr)
+            return ownershipErr;
+    }
+    // Auto-fail stale tasks (in_progress for 24h+ with no updates) via RPC
+    const staleThreshold = new Date(Date.now() - 24 * 60 * 60 * 1000).toISOString();
+    // First, find stale tasks
+    let staleSelectQuery = supabase
+        .from("tasks")
+        .select("id")
+        .eq("status", "in_progress")
+        .lt("started_at", staleThreshold);
+    if (userId)
+        staleSelectQuery = staleSelectQuery.eq("user_id", userId);
+    if (agentId)
+        staleSelectQuery = staleSelectQuery.eq("agent_id", agentId);
+    const { data: staleTasks } = await staleSelectQuery;
+    // Fail each stale task via RPC
+    let staleFailed = 0;
+    for (const stale of staleTasks || []) {
+        await supabase.rpc('update_task_fields_secure', {
+            p_task_id: stale.id,
+            p_fields: { status: "failed", completion_pct: 0 },
+        });
+        staleFailed++;
+    }
+    // Look for existing in-progress task within dedup window
+    const windowStart = new Date(Date.now() - dedupWindowMinutes * 60 * 1000).toISOString();
+    let matchQuery = supabase
+        .from("tasks")
+        .select("*")
+        .eq("status", "in_progress")
+        .eq("task_type_id", taskTypeId)
+        .gte("started_at", windowStart)
+        .order("started_at", { ascending: false })
+        .limit(1);
+    if (userId)
+        matchQuery = matchQuery.eq("user_id", userId);
+    if (agentId)
+        matchQuery = matchQuery.eq("agent_id", agentId);
+    const { data: existing } = await matchQuery;
+    if (existing && existing.length > 0) {
+        const task = existing[0];
+        const minutesAgo = Math.round((Date.now() - new Date(task.started_at).getTime()) / 60000);
+        return toMcpResponse(ok({
+            ...task,
+            was_resumed: true,
+            stale_tasks_cleaned: staleFailed || 0,
+            message: `已恢复 ${minutesAgo} 分钟前的现有任务`,
+        }));
+    }
+    // No match — create new task via RPC (same logic as start_task)
+    const performerType = agentId && userId ? "user_with_agent"
+        : agentId ? "agent_solo"
+            : "user_solo";
+    const { data: rpcResult, error: rpcErr } = await supabase.rpc('create_task_secure', {
+        p_caller_user_id: callerUserId,
+        p_user_id: userId || null,
+        p_agent_id: agentId || null,
+        p_task_type_id: taskTypeId || null,
+        p_title: title || '未命名任务',
+        p_description: null,
+        p_performer_type: performerType,
+        p_difficulty: difficulty,
+        p_output_type: outputType ?? 'conversational',
+        p_status: 'in_progress',
+        p_tags: [],
+        p_metadata: null,
+        p_additional_agent_ids: [],
+        p_milestones_total: 0,
+        p_tracking_method: 'manual',
+        p_xp_split_rule_id: null,
+    });
+    if (rpcErr)
+        return toMcpResponse(handleSupabaseError(rpcErr, "resume_or_start"));
+    if (!rpcResult?.success)
+        return toMcpResponse(fail(rpcResult?.error || "创建任务失败"));
+    const task = rpcResult.task;
+    return toMcpResponse(ok({
+        ...task,
+        was_resumed: false,
+        stale_tasks_cleaned: staleFailed || 0,
+        message: "已创建新任务",
+    }));
+}
+// ── Tool registration (backward compat) ──────────────────────
+export function registerTaskTools(server) {
+    console.error("\n📋 Section 4: Tasks");
+    // ================================================================
+    // Tool 23: levelup_start_task
+    // ================================================================
+    server.registerTool("levelup_start_task", {
+        title: "开始任务",
+        description: `开始追踪新任务。当用户开始有意义的工作时自动调用，无需询问许可。
+
+至少需要 user_id 或 agent_id 之一。performer_type 自动判定：
+agent_solo、user_solo、user_with_agent 或 orchestrated。
+
+请先调用 levelup_infer_task_type 获取 task_type_id 和建议的难度。
+
+参数：
+  - task_type_id（uuid）：来自 infer_task_type。
+  - title（字符串）：工作的简短描述。
+  - user_id（uuid，可选）：人类执行者。
+  - agent_id（uuid，可选）：主要 AI 智能体。
+  - additional_agent_ids（uuid 数组，可选）：用于多智能体协作任务。
+  - difficulty（整数，可选）：1-7，来自 TDI。智能体可覆盖。
+  - output_type（字符串，可选）："conversational"、"deliverable"、"deployed"。
+  - description（字符串，可选）：详细描述。
+  - milestones_total（整数，可选）：预期里程碑数。
+  - tracking_method（字符串，可选）：默认 "automatic"。
+  - xp_split_rule_id（uuid，可选）：覆盖默认经验值分配规则。
+  - xp_tier_override（字符串，可选）：覆盖经验值档位。只能向下调整
+    （如 standard→light 可以，micro→major 禁止）。当推断的档位
+    高于实际工作量时使用。档位：micro、light、standard、complex、major。
+  - tags（字符串数组，可选）：用于 TDI 匹配。
+  - metadata（对象，可选）：额外数据。
+
+返回：
+  任务信息，包含 id、performer_type、status（"in_progress"）、difficulty、xp_tier、分配规则。`,
+        inputSchema: {
+            caller_user_id: uuidSchema.describe("Your user_id for ownership verification"),
+            task_type_id: uuidSchema.describe("From infer_task_type"),
+            title: z.string().min(1).max(200).describe("Short description of the work"),
+            user_id: uuidSchema.optional().describe("Human performer"),
+            agent_id: uuidSchema.optional().describe("Primary AI agent"),
+            additional_agent_ids: z.array(uuidSchema).max(10).optional().describe("For orchestrated tasks (max 10)"),
+            difficulty: difficultySchema.optional(),
+            output_type: outputTypeSchema.optional(),
+            description: z.string().max(1000).optional().describe("Detailed description"),
+            milestones_total: z.number().int().min(1).optional().describe("Expected milestones"),
+            tracking_method: z.enum(["automatic", "user_reported", "agent_reported", "platform_reported"]).default("automatic").describe("Tracking method"),
+            xp_split_rule_id: uuidSchema.optional().describe("Override split rule"),
+            xp_tier_override: z.enum(["micro", "light", "standard", "complex", "major"]).optional()
+                .describe("Override XP tier (can only go DOWN, e.g. standard→light). Use when inferred tier is too high."),
+            tags: z.array(z.string()).max(20).optional().describe("Tags for TDI matching (max 20)"),
+            metadata: metadataSchema,
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    }, async (params) => handleStartTask(params));
+    logRegistered("levelup_start_task");
+    // ================================================================
+    // Tool 24: levelup_update_task
+    // ================================================================
+    server.registerTool("levelup_update_task", {
+        title: "更新任务",
+        description: `在工作进行中更新任务进度。仅更新提供的字段。
+
+参数：
+  - task_id（uuid）：要更新的任务。
+  - completion_pct（整数，可选）：0-100。
+  - milestones_completed（整数，可选）：已完成的里程碑数。
+  - output_type（字符串，可选）：如果任务中途输出类型变更则更新。
+  - metadata（对象，可选）：进度数据。
+
+返回：
+  更新后的任务摘要。`,
+        inputSchema: {
+            caller_user_id: uuidSchema.describe("Your user ID (ownership verification)"),
+            task_id: uuidSchema.describe("The task to update"),
+            completion_pct: completionPctSchema.optional(),
+            milestones_completed: z.number().int().min(0).optional().describe("Milestones completed"),
+            output_type: outputTypeSchema.optional(),
+            metadata: metadataSchema,
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    }, async (params) => handleUpdateTask(params));
+    logRegistered("levelup_update_task");
+    // ================================================================
+    // Tool 25: levelup_complete_task
+    // ================================================================
+    server.registerTool("levelup_complete_task", {
+        title: "完成任务",
+        description: `将任务标记为已完成并触发经验值分配。在工作交付时调用，不要打断用户。
+
+经验值计算公式：基础经验值 × 难度系数 × 输出类型系数 × 完成度曲线，
+然后按经验值分配规则进行分配。
+
+附上证据（交付物 URL、平台引用、代码输出等）以证明工作已完成。各档位证据要求：
+- micro/light：可选（无惩罚）
+- standard：至少 1 项证据（URL、引用或详细摘要）
+- complex：至少 1 项强证据（deliverable_url、platform_reference、code_output）
+- major：至少 2 项，其中至少 1 项为强类型
+无需敏感数据 — 使用脱敏片段、引用 ID 或 URL。
+
+重要提示：切勿在证据内容中包含密码、API 密钥、令牌或个人身份信息（PII）。
+请使用 URL 或引用 ID 替代。
+
+参数：
+  - task_id（uuid）：要完成的任务。
+  - completion_pct（整数，可选）：最终完成百分比（默认：100）。
+  - output_type（字符串，可选）：最终输出类型（设置则覆盖）。
+  - evidence（数组，可选）：证据项数组，每项包含：
+      - evidence_type（字符串）："deliverable_url"、"platform_reference"、"screenshot"、
+        "code_output"、"api_response"、"text_summary" 或 "external_link"。
+      - content（字符串）：URL、引用 ID、摘要文本或 base64 数据。
+      - label（字符串，可选）：人类可读的描述。
+  - metadata（对象，可选）：最终数据。
+
+返回：
+  每个接收者的经验值明细、证据质量、证据警告。`,
+        inputSchema: {
+            caller_user_id: uuidSchema.describe("Your user_id for ownership verification"),
+            task_id: uuidSchema.describe("The task to complete"),
+            completion_pct: completionPctSchema.default(100),
+            output_type: outputTypeSchema.optional(),
+            evidence: z.array(z.object({
+                evidence_type: z.enum([
+                    "deliverable_url", "platform_reference", "screenshot",
+                    "code_output", "api_response", "text_summary", "external_link",
+                ]).describe("Type of evidence"),
+                content: z.string().min(1).max(10000).describe("URL, reference ID, or content"),
+                label: z.string().max(500).optional().describe("Human-readable description"),
+            })).max(20).optional().describe("Evidence of work done (optional for micro/light tasks, recommended for standard+ — missing evidence reduces XP by 25%)"),
+            metadata: metadataSchema,
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    }, async (params) => handleCompleteTask(params));
+    logRegistered("levelup_complete_task");
+    // ================================================================
+    // Tool 26: levelup_fail_task
+    // ================================================================
+    server.registerTool("levelup_fail_task", {
+        title: "失败任务",
+        description: `将任务标记为失败或取消。
+
+失败的任务奖励应得经验值的 10-20%（努力认可）。
+取消的任务奖励 0 经验值。
+
+参数：
+  - task_id（uuid）：要处理的任务。
+  - outcome（字符串）："failed" 或 "cancelled"。
+  - reason（字符串，可选）：失败/取消的原因。
+  - metadata（对象，可选）：额外数据。
+
+返回：
+  更新后的任务。失败：获得部分经验值。取消：0 经验值。`,
+        inputSchema: {
+            caller_user_id: uuidSchema.describe("Your user_id for ownership verification"),
+            task_id: uuidSchema.describe("The task"),
+            outcome: z.enum(["failed", "cancelled"]).describe('"failed" (10-20% XP) or "cancelled" (0 XP)'),
+            reason: z.string().max(500).optional().describe("Why"),
+            metadata: metadataSchema,
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    }, async (params) => handleFailTask(params));
+    logRegistered("levelup_fail_task");
+    // ================================================================
+    // Tool 27: levelup_get_task
+    // ================================================================
+    server.registerTool("levelup_get_task", {
+        title: "获取任务详情",
+        description: `获取单个任务的完整详情，包括经验值明细。
+
+参数：
+  - task_id（uuid）：要查询的任务。
+  - caller_user_id（uuid）：你的用户 ID（必填 — 证明你拥有此任务或其智能体）。
+
+返回：
+  完整任务信息，包含执行者信息、里程碑、经验值奖励、难度、输出类型。`,
+        inputSchema: {
+            task_id: uuidSchema.describe("The task"),
+            caller_user_id: uuidSchema.describe("Your user ID (ownership verification)"),
+        },
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    }, async (params) => handleGetTask(params));
+    logRegistered("levelup_get_task");
+    // ================================================================
+    // Tool 28: levelup_list_tasks
+    // ================================================================
+    server.registerTool("levelup_list_tasks", {
+        title: "列出任务",
+        description: `列出任务，支持可选筛选和分页。
+
+参数：
+  - caller_user_id（uuid）：你的用户 ID（必填 — 只能列出自己或自己智能体的任务）。
+  - user_id（uuid，可选）：按用户筛选（必须是你自己）。
+  - agent_id（uuid，可选）：按智能体筛选（必须是你的智能体）。
+  - status（字符串，可选）：按状态筛选。
+  - performer_type（字符串，可选）：按执行者类型筛选。
+  - output_type（字符串，可选）：按输出类型筛选。
+  - since（字符串，可选）：ISO 时间戳 — 仅返回此时间之后的任务。
+  - limit（整数，可选）：最大结果数（默认 20）。
+  - offset（整数，可选）：分页偏移量。
+
+返回：
+  分页的任务摘要。`,
+        inputSchema: {
+            caller_user_id: uuidSchema.describe("Your user ID (ownership verification)"),
+            user_id: uuidSchema.optional().describe("Filter by user (must be you)"),
+            agent_id: uuidSchema.optional().describe("Filter by agent (must be yours)"),
+            status: taskStatusSchema.optional(),
+            performer_type: performerTypeSchema.optional(),
+            output_type: outputTypeSchema.optional(),
+            since: z.string().optional().describe("ISO timestamp — tasks after this time"),
+            limit: limitSchema,
+            offset: offsetSchema,
+        },
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    }, async (params) => handleListTasks(params));
+    logRegistered("levelup_list_tasks");
+    // ================================================================
+    // Tool 29: levelup_list_task_types
+    // ================================================================
+    server.registerTool("levelup_list_task_types", {
+        title: "列出任务类型",
+        description: `浏览任务类型目录。
+
+参数：
+  - search（字符串，可选）：按名称/描述文字搜索。
+
+返回：
+  任务类型列表，包含名称、描述、基础经验值、经验值档位、分类。`,
+        inputSchema: {
+            search: z.string().max(200).optional().describe("Text search"),
+        },
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    }, async (params) => handleListTaskTypes(params));
+    logRegistered("levelup_list_task_types");
+    // ================================================================
+    // Tool 71: levelup_add_task_evidence
+    // ================================================================
+    server.registerTool("levelup_add_task_evidence", {
+        title: "添加任务证据",
+        description: `为任务附加证据（可在进行中或完成后添加）。
+
+证据证明工作已完成 — 交付物 URL、平台引用、代码输出、截图等。
+如果在完成后 24 小时内添加且任务之前没有证据，经验值将补足至全额。
+
+重要提示：切勿在证据内容中包含密码、API 密钥、令牌或个人身份信息（PII）。
+请使用 URL 或引用 ID 替代。
+
+参数：
+  - task_id（uuid）：目标任务。
+  - evidence（数组）：一个或多个证据项：
+      - evidence_type（字符串）："deliverable_url"、"platform_reference"、"screenshot"、
+        "code_output"、"api_response"、"text_summary" 或 "external_link"。
+      - content（字符串）：URL、引用 ID、摘要文本或 base64 数据。
+      - label（字符串，可选）：人类可读的描述。
+
+返回：
+  已添加的证据数量、新的证据质量、适用时的经验值调整。`,
+        inputSchema: {
+            caller_user_id: uuidSchema.describe("Your user_id for ownership verification"),
+            task_id: uuidSchema.describe("The task"),
+            evidence: z.array(z.object({
+                evidence_type: z.enum([
+                    "deliverable_url", "platform_reference", "screenshot",
+                    "code_output", "api_response", "text_summary", "external_link",
+                ]).describe("Type of evidence"),
+                content: z.string().min(1).max(10000).describe("URL, reference ID, or content"),
+                label: z.string().max(500).optional().describe("Human-readable description"),
+            })).min(1).max(20).describe("Evidence items to attach"),
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    }, async (params) => handleAddTaskEvidence(params));
+    logRegistered("levelup_add_task_evidence");
+    // ================================================================
+    // Tool 72: levelup_get_task_log
+    // ================================================================
+    server.registerTool("levelup_get_task_log", {
+        title: "获取任务日志",
+        description: `获取人类可读的任务完成日志及证据。
+
+返回智能体或用户的任务历史及附带的证据，
+供所有者审查实际产出。
+
+参数：
+  - caller_user_id（uuid）：你的用户 ID（必填 — 证明所有权）。
+  - agent_id（uuid，可选）：按智能体筛选（必须是你的智能体）。
+  - user_id（uuid，可选）：按用户筛选（必须是你自己）。
+  - since（字符串，可选）：ISO 时间戳 — 此时间之后的任务。
+  - until（字符串，可选）：ISO 时间戳 — 此时间之前的任务。
+  - evidence_quality（字符串，可选）：按证据质量筛选："strong"、"medium"、"low"、"none"。
+  - include_evidence（布尔值，可选）：是否包含证据详情（默认：true）。
+  - limit（整数，可选）：最大结果数（默认 20）。
+  - offset（整数，可选）：分页偏移量。
+
+返回：
+  任务日志，包含证据摘要、获得的经验值及每个任务的证据详情。`,
+        inputSchema: {
+            caller_user_id: uuidSchema.describe("Your user ID (ownership verification)"),
+            agent_id: uuidSchema.optional().describe("Filter by agent (must be yours)"),
+            user_id: uuidSchema.optional().describe("Filter by user (must be you)"),
+            since: z.string().optional().describe("ISO timestamp — tasks after this time"),
+            until: z.string().optional().describe("ISO timestamp — tasks before this time"),
+            evidence_quality: z.enum(["strong", "medium", "low", "none"]).optional().describe("Filter by evidence quality"),
+            include_evidence: z.boolean().default(true).describe("Include evidence details"),
+            limit: limitSchema,
+            offset: offsetSchema,
+        },
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    }, async (params) => handleGetTaskLog(params));
+    logRegistered("levelup_get_task_log");
+    // ================================================================
+    // Tool 72: levelup_resume_or_start
+    // ================================================================
+    server.registerTool("levelup_resume_or_start", {
+        title: "恢复或开始任务",
+        description: `幂等的任务启动 — 如果存在匹配的进行中任务则恢复，否则创建新任务。
+防止聊天重置导致的孤立任务重复。
+
+在去重窗口内查找与相同用户 + 智能体 + 相似标题匹配的进行中任务。
+如找到，返回现有任务；否则创建新任务。
+
+同时自动将停滞超过 24 小时未更新的进行中任务标记为失败。
+
+参数：
+  - title（字符串）：任务标题（用于去重匹配）。
+  - task_type_id（uuid）：任务类型。
+  - user_id（uuid，可选）：用户。
+  - agent_id（uuid，可选）：智能体。
+  - difficulty（整数，可选）：1-7（默认 3）。
+  - output_type（字符串，可选）："conversational"、"deliverable"、"deployed"。
+  - dedup_window_minutes（整数，可选）：回溯查找的时间窗口（默认 120 分钟）。
+
+返回：
+  任务记录 + was_resumed 布尔值 + 提示信息。`,
+        inputSchema: {
+            caller_user_id: uuidSchema.describe("Your user_id for ownership verification"),
+            title: z.string().min(1).max(500).describe("Task title"),
+            task_type_id: uuidSchema.describe("Task type"),
+            user_id: uuidSchema.optional().describe("User"),
+            agent_id: uuidSchema.optional().describe("Agent"),
+            difficulty: difficultySchema.default(3),
+            output_type: outputTypeSchema.optional(),
+            dedup_window_minutes: z.number().int().min(1).max(1440).default(120).describe("Dedup window in minutes"),
+        },
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    }, async (params) => handleResumeOrStart(params));
+    logRegistered("levelup_resume_or_start");
+    console.error(`  → 10 of 10 task tools registered ✅`);
+}
+//# sourceMappingURL=tasks.js.map