@taskforcehq/taskforce 0.3.168

package/dist/resources/templates/workflows/do.yaml

@@ -0,0 +1,82 @@
+version: 2
+name: do
+description: Dispatcher workflow that routes to specialized workflows based on slash command and approach.
+type: workflow
+metadata:
+  alwaysApply: true
+dispatch:
+  aliases:
+    - /do
+    - "-d"
+  routeByApproach: true
+  approachMap:
+    evaluate: evaluate
+    collaborate: collaborate
+    plan: plan
+    review: review
+    implement: execute
+  default: execute
+compat:
+  minTaskforceVersion: 0.3.13-beta.2
+  requiredToolsCritical:
+    - "{{MCP_PREFIX}}get_task"
+  requiredToolsOptional:
+    - "{{MCP_PREFIX}}list_tasks"
+    - "{{MCP_PREFIX}}search_tasks"
+    - "{{MCP_PREFIX}}attach_context_file"
+    - "{{MCP_PREFIX}}save_task_attachment"
+toolPolicy:
+  requiredToolsPolicy:
+    critical: strict-fail
+    nonCritical: warn-and-fallback
+  criticalTools:
+    - "{{MCP_PREFIX}}get_task"
+  statusTransitions:
+    allowedStatuses:
+      - task
+      - on-hold
+      - in-progress
+      - review
+    forbiddenStatuses:
+      - done
+      - cancelled
+contextPolicy:
+  sourcePriority:
+    - mcp
+  mcp:
+    knownTaskIdTool: "{{MCP_PREFIX}}get_task"
+    unknownTaskIdTools:
+      - "{{MCP_PREFIX}}list_tasks"
+      - "{{MCP_PREFIX}}search_tasks"
+  mcpUnavailableAction: stop-and-request-user-action
+prompts:
+  startupChecklist: |-
+    1.  [ ] **Task Loaded**: [ID] (Status: [Status])
+    2.  [ ] **Dispatch Target**: [evaluate | collaborate | plan | review | execute]
+  handoffChecklist: |-
+    - [ ] Dispatch target selected per slash-command precedence
+    - [ ] Routed to target workflow and exited dispatcher
+content:
+  default: |-
+    # Taskforce Do Dispatcher (v2)
+
+    > **DISPATCH protocol**:
+    > 1. **MCP-first load**:
+    >    - If task ID is known, call `{{MCP_PREFIX}}get_task`.
+    >    - If task ID is unknown, use `{{MCP_PREFIX}}list_tasks` / `{{MCP_PREFIX}}search_tasks` to identify it.
+    >    - If MCP is unavailable, stop and request user action.
+    > 2. Print `prompts.startupChecklist`.
+
+    ---
+
+    ## Routing Rules
+    1. Slash command wins over approach routing.
+    2. If user explicitly invokes:
+       - `/evaluate` -> route to `evaluate`
+       - `/collaborate` -> route to `collaborate`
+       - `/plan` -> route to `plan`
+       - `/review` -> route to `review`
+       - `/execute` -> route to `execute`
+    3. If user invokes `/do`, route by `dispatch.approachMap` when task approach is mapped.
+    4. If no mapped approach exists, route to `dispatch.default` (`execute`).
+    5. After routing, print `prompts.handoffChecklist` and stop. Do not run execution phases in this workflow.

package/dist/resources/templates/workflows/evaluate.yaml

@@ -0,0 +1,111 @@
+version: 2
+name: evaluate
+description: Evaluation workflow for strategic analysis, scoring, and recommendation.
+type: workflow
+metadata:
+  alwaysApply: false
+dispatch:
+  aliases:
+    - /evaluate
+    - "-e"
+  default: evaluate
+compat:
+  minTaskforceVersion: 0.3.13-beta.2
+  requiredToolsCritical:
+    - "{{MCP_PREFIX}}get_task"
+    - "{{MCP_PREFIX}}update_task"
+    - "{{MCP_PREFIX}}add_comment"
+  requiredToolsOptional:
+    - "{{MCP_PREFIX}}list_tasks"
+    - "{{MCP_PREFIX}}search_tasks"
+    - "{{MCP_PREFIX}}get_config"
+    - "{{MCP_PREFIX}}attach_context_file"
+    - "{{MCP_PREFIX}}save_task_attachment"
+toolPolicy:
+  requiredToolsPolicy:
+    critical: strict-fail
+    nonCritical: warn-and-fallback
+  criticalTools:
+    - "{{MCP_PREFIX}}get_task"
+    - "{{MCP_PREFIX}}update_task"
+    - "{{MCP_PREFIX}}add_comment"
+  forbiddenTools:
+    - "{{MCP_PREFIX}}archive_task"
+  statusTransitions:
+    allowedStatuses:
+      - task
+      - on-hold
+      - in-progress
+      - review
+    forbiddenStatuses:
+      - done
+      - cancelled
+artifacts:
+  evaluationReport:
+    path: .taskforce/task-data/{taskId}/attachments/evaluation.md
+    required: false
+    savePolicy: ask-before-save
+contextPolicy:
+  sourcePriority:
+    - mcp
+  mcp:
+    knownTaskIdTool: "{{MCP_PREFIX}}get_task"
+    unknownTaskIdTools:
+      - "{{MCP_PREFIX}}list_tasks"
+      - "{{MCP_PREFIX}}search_tasks"
+  mcpUnavailableAction: stop-and-request-user-action
+prompts:
+  startupChecklist: |-
+    1.  [ ] **Task Loaded**: [ID] (Status: [Status])
+    2.  [ ] **Mode**: [evaluate]
+    3.  [ ] **Specialists Loaded**: [List names or 'None']
+  optionalArtifactPrompt: I prepared the evaluation in-screen. Save as `{path}` and attach it to this task context?
+content:
+  default: |-
+    # Taskforce Evaluate Workflow (v2)
+
+    > **EVALUATION protocol**:
+    > 1. **MCP-first load**:
+    >    - If task ID is known, call `{{MCP_PREFIX}}get_task`.
+    >    - If task ID is unknown, use `{{MCP_PREFIX}}list_tasks` / `{{MCP_PREFIX}}search_tasks` to identify it.
+    >    - If MCP is unavailable, stop and request user action.
+    > 2. Print `prompts.startupChecklist`.
+
+    ---
+
+    ## 1. Strategic Analysis
+
+    1. Validate the problem and business/user impact.
+    2. Evaluate alternatives and opportunity cost.
+    3. Score value and risk with explicit reasoning.
+    4. Recommend: Proceed, Pivot, or Kill.
+
+    ## 2. Task Updates
+
+    1. Use `{{MCP_PREFIX}}update_task` to adjust priority/status only within allowed statuses.
+       - If setting status to `task` or `on-hold`, add explicit comment justification using `{{MCP_PREFIX}}add_comment`.
+    2. Present a structured evaluation in-screen using this exact structure:
+       - `## Evaluation Summary`
+       - `### Recommendation (Proceed | Pivot | Kill)`
+       - `### Value Score (1-5)`
+       - `### Risk Score (1-5)`
+       - `### Alternatives Considered`
+       - `### Key Tradeoffs`
+       - `### Next Step`
+    3. Add a concise evaluation summary comment via `{{MCP_PREFIX}}add_comment` using this exact structure:
+       - `## Evaluation Summary`
+       - `### Recommendation (Proceed | Pivot | Kill)`
+       - `### Value Score (1-5)`
+       - `### Risk Score (1-5)`
+       - `### Next Step`
+    4. Ask whether to save as `{artifacts.evaluationReport.path}`.
+    5. If user confirms, persist task-specific content via `{{MCP_PREFIX}}save_task_attachment` using `filename: "evaluation.md"`.
+       - Use `{{MCP_PREFIX}}attach_context_file` only for linking existing files/URLs (for example, shared docs under `docs/`).
+    6. Never set `done` or `cancelled`, and never call `{{MCP_PREFIX}}archive_task`, unless explicitly instructed by the user.
+
+    ## 3. Optional Report Artifact
+
+    1. Use report files only when user opts in.
+    2. Save to `.taskforce/task-data/{taskId}/attachments/evaluation.md` and attach to task context when approved.
+       - If the document is not task-specific, store it under `docs/` and optionally link it with `{{MCP_PREFIX}}attach_context_file`.
+    3. Stop.

package/dist/resources/templates/workflows/execute.yaml

@@ -0,0 +1,142 @@
+version: 2
+name: execute
+description: Implementation workflow with MCP-first loading and status safety constraints.
+type: workflow
+metadata:
+  alwaysApply: true
+dispatch:
+  aliases:
+    - /execute
+    - "-x"
+  routeByApproach: false
+  default: execute
+compat:
+  minTaskforceVersion: 0.3.13-beta.2
+  requiredToolsCritical:
+    - "{{MCP_PREFIX}}get_task"
+    - "{{MCP_PREFIX}}update_task"
+    - "{{MCP_PREFIX}}add_comment"
+  requiredToolsOptional:
+    - "{{MCP_PREFIX}}list_tasks"
+    - "{{MCP_PREFIX}}search_tasks"
+    - "{{MCP_PREFIX}}get_config"
+    - "{{MCP_PREFIX}}create_task"
+    - "{{MCP_PREFIX}}attach_context_file"
+    - "{{MCP_PREFIX}}save_task_attachment"
+toolPolicy:
+  requiredToolsPolicy:
+    critical: strict-fail
+    nonCritical: warn-and-fallback
+  criticalTools:
+    - "{{MCP_PREFIX}}get_task"
+    - "{{MCP_PREFIX}}update_task"
+    - "{{MCP_PREFIX}}add_comment"
+  forbiddenTools:
+    - "{{MCP_PREFIX}}archive_task"
+  statusTransitions:
+    allowedStatuses:
+      - task
+      - on-hold
+      - in-progress
+      - review
+    forbiddenStatuses:
+      - done
+      - cancelled
+artifacts:
+  walkthrough:
+    path: walkthrough.md
+    required: true
+contextPolicy:
+  sourcePriority:
+    - mcp
+  mcp:
+    knownTaskIdTool: "{{MCP_PREFIX}}get_task"
+    unknownTaskIdTools:
+      - "{{MCP_PREFIX}}list_tasks"
+      - "{{MCP_PREFIX}}search_tasks"
+  mcpUnavailableAction: stop-and-request-user-action
+prompts:
+  startupChecklist: |-
+    1.  [ ] **Task Loaded**: [ID] (Status: [Status])
+    2.  [ ] **Mode**: [execute]
+    3.  [ ] **Specialists Loaded**: [List names or 'None']
+  handoffChecklist: |-
+    - [ ] Status set to `review` unless user explicitly requested another allowed status
+    - [ ] Summary comment added with `{{MCP_PREFIX}}add_comment`
+    - [ ] `walkthrough.md` updated
+    - [ ] Parent/child links changed only when explicitly requested
+    - [ ] Did NOT call `{{MCP_PREFIX}}archive_task`
+    - [ ] Did NOT set `done` or `cancelled` unless explicitly instructed
+content:
+  default: |-
+    # Taskforce Execute Workflow (v2)
+
+    > **EXECUTION protocol**:
+    > 1. **MCP-first load**:
+    >    - If task ID is known, call `{{MCP_PREFIX}}get_task`.
+    >    - If task ID is unknown, use `{{MCP_PREFIX}}list_tasks` / `{{MCP_PREFIX}}search_tasks` to identify it.
+    >    - If MCP is unavailable, stop and request user action.
+    > 2. Print `prompts.startupChecklist`.
+
+    ---
+
+    ## 1. Startup (Mandatory)
+
+    1. **Load specialists**:
+       - Read the task `specialists` array.
+       - Read specialist instructions exported for the active environment.
+       - Acknowledge specialist constraints before implementation.
+
+    ---
+
+    ## 2. Execute Mode
+    **Goal**: Execute and verify changes safely.
+
+    ### Phase A: Preparation
+    1. **Complexity gate**:
+       - If task complexity is `3` to `5`, create or refresh `implementation_plan.md` before major code edits.
+       - If complexity is below `3`, planning is optional.
+    2. **Task management mode gate (required before task mutations)**:
+       - Choose exactly one mode and state it explicitly: `checklist_mode` or `decompose_mode`.
+       - Default to `checklist_mode` for linear/short execution.
+       - Use `decompose_mode` only when at least one is true:
+         - multi-system or multi-owner work
+         - meaningful parallelization
+         - expected duration > 1 day
+         - explicit dependency/risk tracking is needed
+         - user explicitly asks for subtasks
+    3. **Owner strategy gate (required before task creation/update)**:
+       - Set ownership explicitly with `owner` (alias of `assignee`): `user`, `agent`, or `unassigned`.
+       - If user console/credential action is required, set `owner=user`.
+       - If AI can execute independently, set `owner=agent`.
+       - If unclear, set `owner=unassigned` and add a clarification note.
+    4. **Preflight confirmation gate (required before creating multiple tasks)**:
+       - Confirm mode: `checklist_mode` vs `decompose_mode`.
+       - Confirm owner default: `user` / `agent` / `mixed`.
+       - Confirm whether assignment should be set immediately.
+    5. **Config gate**:
+       - Before setting category/type/priority/approach/status/complexity, call `{{MCP_PREFIX}}get_config`.
+    6. **Set active state**:
+       - Set status to `in-progress` with `{{MCP_PREFIX}}update_task`.
+
+    ### Phase B: Execution
+    1. Implement code changes.
+    2. Run validation steps (automated tests + manual checks as needed).
+    3. If user requests relationship work:
+       - Link/unlink/re-parent using `{{MCP_PREFIX}}update_task` (`parentTaskId`).
+       - Create child tasks using `{{MCP_PREFIX}}create_task` with `parentTaskId` set.
+       - Every created child task must include explicit `owner`/`assignee`.
+       - Re-parent only after explicit user confirmation.
+    4. If blocked, switch to Collaborate mode and capture blocker context.
+
+    ### Phase C: Handover
+    1. Update `walkthrough.md` with:
+       - What changed
+       - Validation evidence
+       - Remaining risks
+    2. Add summary comment with `{{MCP_PREFIX}}add_comment`.
+    3. Set status to `review` via `{{MCP_PREFIX}}update_task` unless user explicitly requests another allowed status (`task`, `on-hold`, `in-progress`, `review`).
+       - If setting status to `task` or `on-hold`, add explicit comment justification using `{{MCP_PREFIX}}add_comment`.
+    4. Never set `done` or `cancelled`, and never call `{{MCP_PREFIX}}archive_task`, unless explicitly instructed by the user.
+    5. Do not auto-set parent tasks to `done` or `cancelled` due to child changes; only do so if user explicitly instructs.
+    6. Print `prompts.handoffChecklist` and stop.

package/dist/resources/templates/workflows/plan.yaml

@@ -0,0 +1,112 @@
+version: 2
+name: plan
+description: Planning workflow for implementation strategy and verification design.
+type: workflow
+metadata:
+  alwaysApply: false
+dispatch:
+  aliases:
+    - /plan
+    - "-p"
+  default: plan
+compat:
+  minTaskforceVersion: 0.3.13-beta.2
+  requiredToolsCritical:
+    - "{{MCP_PREFIX}}get_task"
+    - "{{MCP_PREFIX}}update_task"
+    - "{{MCP_PREFIX}}add_comment"
+  requiredToolsOptional:
+    - "{{MCP_PREFIX}}list_tasks"
+    - "{{MCP_PREFIX}}search_tasks"
+    - "{{MCP_PREFIX}}get_config"
+    - "{{MCP_PREFIX}}attach_context_file"
+    - "{{MCP_PREFIX}}save_task_attachment"
+toolPolicy:
+  requiredToolsPolicy:
+    critical: strict-fail
+    nonCritical: warn-and-fallback
+  criticalTools:
+    - "{{MCP_PREFIX}}get_task"
+    - "{{MCP_PREFIX}}update_task"
+    - "{{MCP_PREFIX}}add_comment"
+  forbiddenTools:
+    - "{{MCP_PREFIX}}archive_task"
+  statusTransitions:
+    allowedStatuses:
+      - task
+      - on-hold
+      - in-progress
+      - review
+    forbiddenStatuses:
+      - done
+      - cancelled
+artifacts:
+  implementationPlan:
+    path: .taskforce/task-data/{taskId}/attachments/implementation-plan.md
+    required: false
+    savePolicy: ask-before-save
+contextPolicy:
+  sourcePriority:
+    - mcp
+  mcp:
+    knownTaskIdTool: "{{MCP_PREFIX}}get_task"
+    unknownTaskIdTools:
+      - "{{MCP_PREFIX}}list_tasks"
+      - "{{MCP_PREFIX}}search_tasks"
+  mcpUnavailableAction: stop-and-request-user-action
+prompts:
+  startupChecklist: |-
+    1.  [ ] **Task Loaded**: [ID] (Status: [Status])
+    2.  [ ] **Mode**: [plan]
+    3.  [ ] **Specialists Loaded**: [List names or 'None']
+  optionalArtifactPrompt: I prepared the implementation plan in-screen. Save as `{path}` and attach it to this task context?
+  handoffPrompt: Planning complete. Review the in-screen plan, then run `/do <id>` to execute.
+content:
+  default: |-
+    # Taskforce Plan Workflow (v2)
+
+    > **PLANNING protocol**:
+    > 1. **MCP-first load**:
+    >    - If task ID is known, call `{{MCP_PREFIX}}get_task`.
+    >    - If task ID is unknown, use `{{MCP_PREFIX}}list_tasks` / `{{MCP_PREFIX}}search_tasks` to identify it.
+    >    - If MCP is unavailable, stop and request user action.
+    > 2. Print `prompts.startupChecklist`.
+
+    ---
+
+    ## 1. Startup (Mandatory)
+
+    1. Call `{{MCP_PREFIX}}get_config` before setting category/type/priority/approach/status/complexity.
+    2. Set status to `in-progress` via `{{MCP_PREFIX}}update_task`.
+    3. Load specialist instructions for the active environment and acknowledge constraints.
+    4. Load all relevant context sources tied to the task.
+
+    ---
+
+    ## 2. Planning Deliverable
+
+    0. Choose and record task management mode for follow-on execution:
+       - `checklist_mode` (single parent + in-task checklist) for linear short work.
+       - `decompose_mode` (child tasks) only when dependencies/parallelism/risk tracking justify decomposition.
+       - Record owner strategy: `user`, `agent`, or `mixed`.
+
+    1. Define file-level change plan (exact files and intended changes).
+    2. Identify compatibility and regression risks.
+    3. Define automated and manual verification steps.
+    4. Present the implementation plan in-screen using this exact structure:
+       - `## Implementation Plan`
+       - `### Goal`
+       - `### Change Plan`
+       - `### Risk Analysis`
+       - `### Verification Checklist`
+    5. Add a concise planning summary comment via `{{MCP_PREFIX}}add_comment` using this exact structure:
+       - `## Plan Summary`
+       - `### Goal`
+       - `### Scope`
+       - `### Next Action`
+    6. Ask whether to save as `{artifacts.implementationPlan.path}`.
+    7. If user confirms, persist task-specific content via `{{MCP_PREFIX}}save_task_attachment` using `filename: "implementation-plan.md"`.
+       - Use `{{MCP_PREFIX}}attach_context_file` only for linking existing files/URLs (for example, shared docs under `docs/`).
+    8. If setting status to `task` or `on-hold`, add explicit comment justification using `{{MCP_PREFIX}}add_comment`.
+    9. Never set `done` or `cancelled`, and never call `{{MCP_PREFIX}}archive_task`, unless explicitly instructed by the user.
+    10. Print `prompts.handoffPrompt` and stop.

package/dist/resources/templates/workflows/review.yaml

@@ -0,0 +1,109 @@
+version: 2
+name: review
+description: Review workflow for QA analysis and pass/warn/fail handoff.
+type: workflow
+metadata:
+  alwaysApply: false
+dispatch:
+  aliases:
+    - /review
+    - "-r"
+  default: review
+compat:
+  minTaskforceVersion: 0.3.13-beta.2
+  requiredToolsCritical:
+    - "{{MCP_PREFIX}}get_task"
+    - "{{MCP_PREFIX}}add_comment"
+  requiredToolsOptional:
+    - "{{MCP_PREFIX}}list_tasks"
+    - "{{MCP_PREFIX}}search_tasks"
+    - "{{MCP_PREFIX}}update_task"
+    - "{{MCP_PREFIX}}attach_context_file"
+    - "{{MCP_PREFIX}}save_task_attachment"
+toolPolicy:
+  requiredToolsPolicy:
+    critical: strict-fail
+    nonCritical: warn-and-fallback
+  criticalTools:
+    - "{{MCP_PREFIX}}get_task"
+    - "{{MCP_PREFIX}}add_comment"
+  forbiddenTools:
+    - "{{MCP_PREFIX}}archive_task"
+  statusTransitions:
+    allowedStatuses:
+      - task
+      - on-hold
+      - in-progress
+      - review
+    forbiddenStatuses:
+      - done
+      - cancelled
+artifacts:
+  reviewReport:
+    path: .taskforce/task-data/{taskId}/attachments/review.md
+    required: false
+    savePolicy: ask-before-save
+contextPolicy:
+  sourcePriority:
+    - mcp
+  mcp:
+    knownTaskIdTool: "{{MCP_PREFIX}}get_task"
+    unknownTaskIdTools:
+      - "{{MCP_PREFIX}}list_tasks"
+      - "{{MCP_PREFIX}}search_tasks"
+  mcpUnavailableAction: stop-and-request-user-action
+prompts:
+  startupChecklist: |-
+    1.  [ ] **Task Loaded**: [ID] (Status: [Status])
+    2.  [ ] **Mode**: [review]
+    3.  [ ] **Specialists Loaded**: [List names or 'None']
+  optionalArtifactPrompt: I prepared the review in-screen. Save as `{path}` and attach it to this task context?
+content:
+  default: |-
+    # Taskforce Review Workflow (v2)
+
+    > **REVIEW protocol**:
+    > 1. **MCP-first load**:
+    >    - If task ID is known, call `{{MCP_PREFIX}}get_task`.
+    >    - If task ID is unknown, use `{{MCP_PREFIX}}list_tasks` / `{{MCP_PREFIX}}search_tasks` to identify it.
+    >    - If MCP is unavailable, stop and request user action.
+    > 2. Print `prompts.startupChecklist`.
+
+    ---
+
+    ## 1. Review Analysis
+
+    1. Identify the review target (plan, code, docs, or mixed artifacts).
+    2. Perform QA pass:
+       - risk and safety check
+       - regression check
+       - standards compliance
+    3. Produce verdict: PASS / WARN / FAIL with actionable findings.
+
+    ## 2. Task Updates
+
+    1. Present a structured review in-screen using this exact structure:
+       - `## Review Verdict`
+       - `### Verdict (PASS | WARN | FAIL)`
+       - `### Findings`
+       - `### Regression Risks`
+       - `### Required Fixes`
+       - `### Recommended Next Status`
+    2. Add a concise review summary comment via `{{MCP_PREFIX}}add_comment` using this exact structure:
+       - `## Review Summary`
+       - `### Verdict (PASS | WARN | FAIL)`
+       - `### Findings`
+       - `### Next Status`
+    3. Ask whether to save as `{artifacts.reviewReport.path}`.
+    4. If user confirms, persist task-specific content via `{{MCP_PREFIX}}save_task_attachment` using `filename: "review.md"`.
+       - Use `{{MCP_PREFIX}}attach_context_file` only for linking existing files/URLs (for example, shared docs under `docs/`).
+    5. Keep status within allowed statuses (`task`, `on-hold`, `in-progress`, `review`) unless user explicitly instructs otherwise.
+       - If setting status to `task` or `on-hold`, add explicit comment justification using `{{MCP_PREFIX}}add_comment`.
+    6. Never set `done` or `cancelled`, and never call `{{MCP_PREFIX}}archive_task`, unless explicitly instructed by the user.
+
+    ## 3. Optional Report Artifact
+
+    1. Use report files only when user opts in.
+    2. Save to `.taskforce/task-data/{taskId}/attachments/review.md` and attach to task context when approved.
+       - If the document is not task-specific, store it under `docs/` and optionally link it with `{{MCP_PREFIX}}attach_context_file`.
+    3. Stop.

package/dist/runtime/capabilities.d.ts

@@ -0,0 +1,8 @@
+export type RuntimeMode = 'local' | 'cloud';
+export interface RuntimeCapabilities {
+    runtimeMode: RuntimeMode;
+    supportsCloudAuth: boolean;
+    supportsAdminManagedSetupOverrides: boolean;
+    supportsPackageScriptSetupOverrides: boolean;
+}
+export declare function getRuntimeCapabilities(runtimeMode: RuntimeMode): RuntimeCapabilities;

package/dist/runtime/capabilities.js

@@ -0,0 +1,16 @@
+export function getRuntimeCapabilities(runtimeMode) {
+    if (runtimeMode === 'cloud') {
+        return {
+            runtimeMode,
+            supportsCloudAuth: true,
+            supportsAdminManagedSetupOverrides: true,
+            supportsPackageScriptSetupOverrides: false
+        };
+    }
+    return {
+        runtimeMode: 'local',
+        supportsCloudAuth: false,
+        supportsAdminManagedSetupOverrides: false,
+        supportsPackageScriptSetupOverrides: true
+    };
+}

package/dist/security/virusScan.d.ts

@@ -0,0 +1,16 @@
+export type VirusScanProvider = 'none' | 'clamav';
+export type VirusScanVerdict = 'pending' | 'clean' | 'infected' | 'error';
+export interface VirusScanResult {
+    verdict: VirusScanVerdict;
+    engine: VirusScanProvider;
+    details?: string;
+}
+export interface VirusScanConfig {
+    provider: VirusScanProvider;
+    clamavHost?: string;
+    clamavPort?: number;
+    failClosed: boolean;
+    timeoutMs: number;
+}
+export declare function resolveVirusScanConfigFromEnv(env?: NodeJS.ProcessEnv): VirusScanConfig;
+export declare function scanBufferForThreats(buffer: Buffer, config: VirusScanConfig): Promise<VirusScanResult>;

package/dist/security/virusScan.js

@@ -0,0 +1,83 @@
+import * as net from 'net';
+function readPositiveInteger(value, fallback) {
+    const parsed = Number.parseInt(String(value || '').trim(), 10);
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return fallback;
+    return parsed;
+}
+export function resolveVirusScanConfigFromEnv(env = process.env) {
+    const providerRaw = String(env.TASKFORCE_VIRUS_SCAN_PROVIDER || 'none').trim().toLowerCase();
+    const provider = providerRaw === 'clamav' ? 'clamav' : 'none';
+    const failClosed = String(env.TASKFORCE_VIRUS_SCAN_FAIL_CLOSED || '').trim().toLowerCase() === 'true';
+    const timeoutMs = readPositiveInteger(env.TASKFORCE_VIRUS_SCAN_TIMEOUT_MS, 15_000);
+    const clamavHost = String(env.TASKFORCE_CLAMAV_HOST || '127.0.0.1').trim();
+    const clamavPort = readPositiveInteger(env.TASKFORCE_CLAMAV_PORT, 3310);
+    return {
+        provider,
+        clamavHost,
+        clamavPort,
+        failClosed,
+        timeoutMs
+    };
+}
+async function scanWithClamav(buffer, config) {
+    const host = String(config.clamavHost || '').trim() || '127.0.0.1';
+    const port = Number(config.clamavPort || 3310);
+    return new Promise((resolve) => {
+        const socket = net.createConnection({ host, port });
+        const timeout = setTimeout(() => {
+            socket.destroy(new Error('Virus scan timed out.'));
+        }, config.timeoutMs);
+        let response = '';
+        let settled = false;
+        const settle = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeout);
+            resolve(result);
+        };
+        socket.on('connect', () => {
+            // ClamAV INSTREAM protocol: zINSTREAM\0 + [len][chunk]... + [0]
+            socket.write(Buffer.from('zINSTREAM\0', 'utf8'));
+            const chunkSize = 64 * 1024;
+            let offset = 0;
+            while (offset < buffer.length) {
+                const end = Math.min(offset + chunkSize, buffer.length);
+                const chunk = buffer.subarray(offset, end);
+                const length = Buffer.alloc(4);
+                length.writeUInt32BE(chunk.length, 0);
+                socket.write(length);
+                socket.write(chunk);
+                offset = end;
+            }
+            const zero = Buffer.alloc(4);
+            zero.writeUInt32BE(0, 0);
+            socket.write(zero);
+        });
+        socket.on('data', (data) => {
+            response += data.toString('utf8');
+        });
+        socket.on('end', () => {
+            const normalized = response.trim();
+            if (/FOUND$/i.test(normalized)) {
+                settle({ verdict: 'infected', engine: 'clamav', details: normalized });
+                return;
+            }
+            if (/OK$/i.test(normalized)) {
+                settle({ verdict: 'clean', engine: 'clamav', details: normalized });
+                return;
+            }
+            settle({ verdict: 'error', engine: 'clamav', details: normalized || 'Unknown ClamAV response.' });
+        });
+        socket.on('error', (error) => {
+            settle({ verdict: 'error', engine: 'clamav', details: String(error.message || error) });
+        });
+    });
+}
+export async function scanBufferForThreats(buffer, config) {
+    if (config.provider === 'none') {
+        return { verdict: 'clean', engine: 'none', details: 'Virus scanning disabled.' };
+    }
+    return scanWithClamav(buffer, config);
+}