[Frontend][Inbox] Surface batch triage polling expiry

.codex/memories/00_ACTIVE.md

@@ -30,7 +30,7 @@ Taskdeck ships as a free open beta: the local-first, review-first action-item en
 
 ## Context Fabric pointer (ADR-0065, accepted under delegation; NOT part of the v0.3 lane)
 
-The architecture for "speak, type, paste, or drop" is `docs/decisions/ADR-0065-context-fabric-capture-representation-processing.md`, mapped in `docs/architecture/CONTEXT_FABRIC.md`, tracked on CF-00 `#2254` (children `#2255`-`#2277`, label `context-fabric`, milestones v0.4 foundation / v0.5 payoff / v0.6 rules). PR `#2280` and the reconciliation pass PR `#2320` (SourceAsset foundation, three capture state axes, Worker Protocol v1-alpha, IBlobStore reference semantics, canonical `CaptureIntakeService`) are both merged, so the reconciled contracts are on `main`. Build on those, not on #2280's originals. Do not pull CF issues into the v0.3 lane; do not add `CaptureSource` values or request-type lane predicates anywhere; do not build CF-22 (delegated authority) without its own maintainer go. Review-first automation is unchanged.
+The architecture for "speak, type, paste, or drop" is `docs/decisions/ADR-0065-context-fabric-capture-representation-processing.md`, mapped in `docs/architecture/CONTEXT_FABRIC.md`, tracked on CF-00 `#2254` (children `#2255`-`#2277`, label `context-fabric`, milestones v0.4 foundation / v0.5 payoff / v0.6 rules). The current build base is **PR `#2417`** (merge `eaa996fa2`, 2026-09-03), which reconciles capture text before a disposition stamp lands. It sits on PR `#2344` (merge `a6cc459c9`, CF-01 durable Capture: ID-preserving backfill, dual-write on, Inbox reads through `ICaptureStore`), which in turn sits on PR `#2280` and the reconciliation pass PR `#2320` (SourceAsset foundation, three capture state axes, Worker Protocol v1-alpha, IBlobStore reference semantics, canonical `CaptureIntakeService`). Build on `#2417`, not on `#2344`, `#2320` or `#2280`'s originals. Do not pull CF issues into the v0.3 lane; do not add `CaptureSource` values or request-type lane predicates anywhere; do not build CF-22 (delegated authority) without its own maintainer go. Review-first automation is unchanged.
 
 ## Standing constraints
 

autodoc/AGENT_INDEX.md

@@ -21,7 +21,7 @@ It is the Taskdeck equivalent of the harness `AGENT_MAP.md` (grandfathered name)
   (`.github/**`, `ci/**`, `scripts/ci/**`) and `.claude/rules/docs.md` (`docs/**`, root `*.md`).
   Read those, not the whole repo.
 - Current shipped state: `docs/STATUS.md` (source of truth) — read the relevant section, it is
-  935 lines; do not read it end-to-end. Roadmap: `docs/IMPLEMENTATION_MASTERPLAN.md` (2068
+  970 lines; do not read it end-to-end. Roadmap: `docs/IMPLEMENTATION_MASTERPLAN.md` (2068
   lines — also section-read only, never bulk-read). Human-action file: `OUTSTANDING_TASKS.md`.
   Strategy spine: `docs/strategy/PRODUCT_DIRECTION.md` → `docs/REVIVAL_PLAN.md`. Decisions:
   `docs/decisions/INDEX.md`.

backend/src/Taskdeck.Api/Mcp/ProposalResources.cs

@@ -40,7 +40,8 @@ public async Task<string> ListProposals()
 
         var result = await _proposalService.GetProposalsAsync(new ProposalFilterDto(UserId: userId));
         if (!result.IsSuccess)
-            throw new InvalidOperationException($"MCP: failed to list proposals: {result.ErrorMessage}");
+            throw new InvalidOperationException(
+                $"MCP: failed to list proposals: {PublicFailureMessage(result)}");
 
         var proposals = result.Value.Select(p => new
         {
@@ -77,7 +78,8 @@ public async Task<string> GetProposalDetail(string proposalId)
 
         var result = await _proposalService.GetProposalByIdAsync(proposalGuid);
         if (!result.IsSuccess)
-            throw new InvalidOperationException($"MCP: failed to get proposal: {result.ErrorMessage}");
+            throw new InvalidOperationException(
+                $"MCP: failed to get proposal: {PublicFailureMessage(result)}");
 
         var p = result.Value;
 
@@ -99,11 +101,10 @@ public async Task<string> GetProposalDetail(string proposalId)
             ? await _proposalService.GetTerminalProposalStoredPreviewAsync(p.Id)
             : await _proposalService.GetProposalDiffAsync(p.Id);
 
-        // Surface the service's own error message exactly as the GetProposalByIdAsync failure
-        // above and the MCP write tools do (WriteTools/ProposalTools raise result.ErrorMessage) —
-        // no new MCP error shape is invented for the gate denial.
+        // Keep known domain failures specific, but never carry an unexpected service failure's
+        // raw message across the public MCP boundary.
         if (!previewResult.IsSuccess)
-            throw new InvalidOperationException($"MCP: {previewResult.ErrorMessage}");
+            throw new InvalidOperationException($"MCP: {PublicFailureMessage(previewResult)}");
 
         var operations = p.Operations.Select(op => new
         {
@@ -146,4 +147,7 @@ or ProposalStatus.Rejected
             or ProposalStatus.Failed
             or ProposalStatus.Expired
             or ProposalStatus.Dismissed;
+
+    private static string PublicFailureMessage(Result result) =>
+        SensitiveDataRedactor.SanitizeLlmFailureMessage(result.ErrorCode, result.ErrorMessage);
 }

backend/src/Taskdeck.Api/Mcp/ProposalTools.cs

@@ -4,7 +4,9 @@
 using Taskdeck.Application.DTOs;
 using Taskdeck.Application.Interfaces;
 using Taskdeck.Application.Services;
+using Taskdeck.Domain.Common;
 using Taskdeck.Domain.Entities;
+using Taskdeck.Domain.Exceptions;
 
 namespace Taskdeck.Api.Mcp;
 
@@ -46,7 +48,7 @@ public async Task<string> GetProposalStatus(
 
         var result = await _proposalService.GetProposalByIdAsync(proposalGuid);
         if (!result.IsSuccess)
-            return Error(result.ErrorMessage);
+            return Error(result);
 
         var p = result.Value;
 
@@ -120,7 +122,7 @@ public async Task<string> ListProposals(
 
         var result = await _proposalService.GetProposalsAsync(filter);
         if (!result.IsSuccess)
-            return Error(result.ErrorMessage);
+            return Error(result);
 
         var proposals = result.Value.Select(p => new
         {
@@ -159,14 +161,14 @@ public async Task<string> DismissProposal(
         // Verify the proposal belongs to the current user before dismissing
         var getResult = await _proposalService.GetProposalByIdAsync(proposalGuid);
         if (!getResult.IsSuccess)
-            return Error(getResult.ErrorMessage);
+            return Error(getResult);
 
         if (getResult.Value.RequestedByUserId != userId)
             return Error("Proposal not found or access denied");
 
         var result = await _proposalService.DismissProposalsAsync(new List<Guid> { proposalGuid });
         if (!result.IsSuccess)
-            return Error(result.ErrorMessage);
+            return Error(result);
 
         return JsonSerializer.Serialize(new
         {
@@ -181,4 +183,16 @@ private static string Error(string message)
     {
         return JsonSerializer.Serialize(new { error = message }, BoardResources.SerializerOptions);
     }
+
+    private static string Error(Result result)
+    {
+        var message = string.Equals(
+            result.ErrorCode,
+            ErrorCodes.UnexpectedError,
+            StringComparison.Ordinal)
+                ? SensitiveDataRedactor.GenericUnexpectedFailureMessage
+                : result.ErrorMessage;
+
+        return Error(message);
+    }
 }

backend/src/Taskdeck.Application/Services/AgentRuntime.cs

@@ -263,13 +263,15 @@ public async Task<Result<AgentRunDto>> RunAsync(
         catch (Exception ex)
         {
             _logger?.LogError(ex, "Agent run '{RunId}' failed unexpectedly", run.Id);
-            run.MarkFailed($"Unexpected error: {ex.Message}");
+            run.MarkFailed(SensitiveDataRedactor.GenericUnexpectedFailureMessage);
             try { await _unitOfWork.SaveChangesAsync(CancellationToken.None); }
             catch (Exception saveEx)
             {
                 _logger?.LogError(saveEx, "Failed to persist failure state for run '{RunId}'", run.Id);
             }
-            return Result.Failure<AgentRunDto>(ErrorCodes.UnexpectedError, $"Agent run failed: {ex.Message}");
+            return Result.Failure<AgentRunDto>(
+                ErrorCodes.UnexpectedError,
+                SensitiveDataRedactor.GenericUnexpectedFailureMessage);
         }
 
         if (run.Status == AgentRunStatus.Failed)

backend/tests/Taskdeck.Api.Tests/McpResourcesTests.cs

@@ -111,6 +111,62 @@ await proposalService.CreateProposalAsync(new CreateProposalDto(
         first.TryGetProperty("riskLevel", out _).Should().BeTrue();
     }
 
+    [Fact]
+    public async Task ProposalResources_ListProposals_IsolatesRequesters()
+    {
+        using var scope = _serviceProvider.CreateScope();
+        var userA = await CreateBoardScopedUserAsync(scope, "list-user-a");
+        var userB = await CreateBoardScopedUserAsync(scope, "list-user-b");
+        var (proposalA, _) = await CreateBoardScopedProposalAsync(scope, userA);
+        var (proposalB, _) = await CreateBoardScopedProposalAsync(scope, userB);
+        var proposalService = scope.ServiceProvider.GetRequiredService<IAutomationProposalService>();
+
+        var resourcesA = new ProposalResources(
+            proposalService,
+            new McpBoardResourcesTests.FixedUserContextProvider(userA));
+        var resourcesB = new ProposalResources(
+            proposalService,
+            new McpBoardResourcesTests.FixedUserContextProvider(userB));
+
+        var idsForA = ReadProposalIds(await resourcesA.ListProposals());
+        var idsForB = ReadProposalIds(await resourcesB.ListProposals());
+
+        idsForA.Should().Equal(proposalA);
+        idsForB.Should().Equal(proposalB);
+    }
+
+    [Fact]
+    public async Task ProposalResources_GetProposalDetail_IsolatesRequesters()
+    {
+        using var scope = _serviceProvider.CreateScope();
+        var userA = await CreateBoardScopedUserAsync(scope, "detail-user-a");
+        var userB = await CreateBoardScopedUserAsync(scope, "detail-user-b");
+        var (proposalA, _) = await CreateBoardScopedProposalAsync(scope, userA);
+        var (proposalB, _) = await CreateBoardScopedProposalAsync(scope, userB);
+        var proposalService = scope.ServiceProvider.GetRequiredService<IAutomationProposalService>();
+
+        var resourcesA = new ProposalResources(
+            proposalService,
+            new McpBoardResourcesTests.FixedUserContextProvider(userA));
+        var resourcesB = new ProposalResources(
+            proposalService,
+            new McpBoardResourcesTests.FixedUserContextProvider(userB));
+
+        using var ownDocumentA = JsonDocument.Parse(
+            await resourcesA.GetProposalDetail(proposalA.ToString()));
+        using var ownDocumentB = JsonDocument.Parse(
+            await resourcesB.GetProposalDetail(proposalB.ToString()));
+        ownDocumentA.RootElement.GetProperty("id").GetGuid().Should().Be(proposalA);
+        ownDocumentB.RootElement.GetProperty("id").GetGuid().Should().Be(proposalB);
+
+        var readAAsB = () => resourcesB.GetProposalDetail(proposalA.ToString());
+        var readBAsA = () => resourcesA.GetProposalDetail(proposalB.ToString());
+        (await readAAsB.Should().ThrowAsync<InvalidOperationException>()).Which.Message
+            .Should().Be("MCP: proposal not found or access denied");
+        (await readBAsA.Should().ThrowAsync<InvalidOperationException>()).Which.Message
+            .Should().Be("MCP: proposal not found or access denied");
+    }
+
     [Fact]
     public async Task ProposalResources_GetProposalDetail_ReturnsOperations()
     {
@@ -230,6 +286,16 @@ private async Task<Guid> CreateBoardScopedUserAsync(IServiceScope scope, string
         return (created.Value.Id, board.Value.Id);
     }
 
+    private static Guid[] ReadProposalIds(string json)
+    {
+        using var document = JsonDocument.Parse(json);
+        return document.RootElement
+            .GetProperty("proposals")
+            .EnumerateArray()
+            .Select(proposal => proposal.GetProperty("id").GetGuid())
+            .ToArray();
+    }
+
     private async Task MakeTerminalWithStoredPreviewAsync(IServiceScope scope, Guid userId, Guid proposalId, string preview)
     {
         var uow = scope.ServiceProvider.GetRequiredService<IUnitOfWork>();

backend/tests/Taskdeck.Api.Tests/ProposalResourcesErrorSafetyTests.cs

@@ -0,0 +1,172 @@
+using FluentAssertions;
+using Moq;
+using Taskdeck.Api.Mcp;
+using Taskdeck.Application.DTOs;
+using Taskdeck.Application.Services;
+using Taskdeck.Domain.Common;
+using Taskdeck.Domain.Entities;
+using Taskdeck.Domain.Exceptions;
+using Xunit;
+
+namespace Taskdeck.Api.Tests;
+
+public class ProposalResourcesErrorSafetyTests
+{
+    private const string HostileError =
+        "Bearer tdsk_test_secret C:\\Users\\alice\\taskdeck.db " +
+        "SQLite UNIQUE constraint failed: Users.Email https://provider.example/v1/internal";
+
+    private static readonly string[] HostileMarkers =
+    [
+        "tdsk_test_secret",
+        "C:\\Users\\alice\\taskdeck.db",
+        "UNIQUE constraint failed",
+        "https://provider.example/v1/internal"
+    ];
+
+    [Fact]
+    public async Task ListProposals_UnexpectedFailure_ThrowsGenericErrorForCurrentUserFilter()
+    {
+        var userId = Guid.NewGuid();
+        var proposalService = new Mock<IAutomationProposalService>(MockBehavior.Strict);
+        proposalService
+            .Setup(service => service.GetProposalsAsync(
+                It.Is<ProposalFilterDto?>(filter => filter != null && filter.UserId == userId),
+                It.IsAny<CancellationToken>()))
+            .ReturnsAsync(Result.Failure<IEnumerable<ProposalDto>>(
+                ErrorCodes.UnexpectedError,
+                HostileError));
+
+        var act = () => CreateResources(proposalService.Object, userId).ListProposals();
+
+        var exception = (await act.Should().ThrowAsync<InvalidOperationException>()).Which;
+        AssertGenericError(exception, "MCP: failed to list proposals: ");
+        proposalService.VerifyAll();
+    }
+
+    [Fact]
+    public async Task GetProposalDetail_UnexpectedLookupFailure_ThrowsGenericError()
+    {
+        var userId = Guid.NewGuid();
+        var proposalId = Guid.NewGuid();
+        var proposalService = new Mock<IAutomationProposalService>(MockBehavior.Strict);
+        proposalService
+            .Setup(service => service.GetProposalByIdAsync(
+                proposalId,
+                It.IsAny<CancellationToken>()))
+            .ReturnsAsync(Result.Failure<ProposalDto>(ErrorCodes.UnexpectedError, HostileError));
+
+        var act = () => CreateResources(proposalService.Object, userId)
+            .GetProposalDetail(proposalId.ToString());
+
+        var exception = (await act.Should().ThrowAsync<InvalidOperationException>()).Which;
+        AssertGenericError(exception, "MCP: failed to get proposal: ");
+        proposalService.VerifyAll();
+    }
+
+    [Theory]
+    [InlineData(ProposalStatus.PendingReview)]
+    [InlineData(ProposalStatus.Applied)]
+    public async Task GetProposalDetail_UnexpectedPreviewFailure_ThrowsGenericError(
+        ProposalStatus status)
+    {
+        var userId = Guid.NewGuid();
+        var proposalId = Guid.NewGuid();
+        var proposalService = new Mock<IAutomationProposalService>(MockBehavior.Strict);
+        proposalService
+            .Setup(service => service.GetProposalByIdAsync(
+                proposalId,
+                It.IsAny<CancellationToken>()))
+            .ReturnsAsync(Result.Success(CreateProposal(proposalId, userId, status)));
+
+        if (status == ProposalStatus.Applied)
+        {
+            proposalService
+                .Setup(service => service.GetTerminalProposalStoredPreviewAsync(
+                    proposalId,
+                    It.IsAny<CancellationToken>()))
+                .ReturnsAsync(Result.Failure<string>(ErrorCodes.UnexpectedError, HostileError));
+        }
+        else
+        {
+            proposalService
+                .Setup(service => service.GetProposalDiffAsync(
+                    proposalId,
+                    It.IsAny<CancellationToken>()))
+                .ReturnsAsync(Result.Failure<string>(ErrorCodes.UnexpectedError, HostileError));
+        }
+
+        var act = () => CreateResources(proposalService.Object, userId)
+            .GetProposalDetail(proposalId.ToString());
+
+        var exception = (await act.Should().ThrowAsync<InvalidOperationException>()).Which;
+        AssertGenericError(exception, "MCP: ");
+        proposalService.VerifyAll();
+    }
+
+    [Fact]
+    public async Task GetProposalDetail_KnownDomainFailure_PreservesStableMessage()
+    {
+        const string stableMessage = "Proposal not found.";
+        var userId = Guid.NewGuid();
+        var proposalId = Guid.NewGuid();
+        var proposalService = new Mock<IAutomationProposalService>(MockBehavior.Strict);
+        proposalService
+            .Setup(service => service.GetProposalByIdAsync(
+                proposalId,
+                It.IsAny<CancellationToken>()))
+            .ReturnsAsync(Result.Failure<ProposalDto>(ErrorCodes.NotFound, stableMessage));
+
+        var act = () => CreateResources(proposalService.Object, userId)
+            .GetProposalDetail(proposalId.ToString());
+
+        var exception = (await act.Should().ThrowAsync<InvalidOperationException>()).Which;
+        exception.Message.Should().Be($"MCP: failed to get proposal: {stableMessage}");
+        proposalService.VerifyAll();
+    }
+
+    private static ProposalResources CreateResources(
+        IAutomationProposalService proposalService,
+        Guid userId)
+    {
+        return new ProposalResources(
+            proposalService,
+            new McpBoardResourcesTests.FixedUserContextProvider(userId));
+    }
+
+    private static ProposalDto CreateProposal(
+        Guid proposalId,
+        Guid userId,
+        ProposalStatus status)
+    {
+        var now = DateTimeOffset.UtcNow;
+        return new ProposalDto(
+            proposalId,
+            ProposalSourceType.Chat,
+            null,
+            null,
+            userId,
+            status,
+            RiskLevel.Low,
+            "Safe proposal",
+            null,
+            null,
+            now,
+            now,
+            now.UtcDateTime.AddHours(1),
+            status == ProposalStatus.Applied ? now.UtcDateTime : null,
+            status == ProposalStatus.Applied ? userId : null,
+            status == ProposalStatus.Applied ? now.UtcDateTime : null,
+            null,
+            "mcp-resource-error-safety-test",
+            []);
+    }
+
+    private static void AssertGenericError(Exception exception, string prefix)
+    {
+        exception.Message.Should().Be(prefix + SensitiveDataRedactor.GenericUnexpectedFailureMessage);
+
+        foreach (var marker in HostileMarkers)
+            exception.Message.Should().NotContain(marker);
+    }
+}