@taskforcehq/taskforce 0.3.168

package/dist/storage/postgresWorker.js

@@ -0,0 +1,110 @@
+import { createRequire } from 'module';
+import { parentPort, workerData } from 'worker_threads';
+const RESPONSE_STATUS_INDEX = 0;
+const RESPONSE_LENGTH_INDEX = 1;
+const RESPONSE_READY = 1;
+const encoder = new TextEncoder();
+function createPool(connectionString) {
+    const require = createRequire(import.meta.url);
+    try {
+        const pg = require('pg');
+        return new pg.Pool({ connectionString });
+    }
+    catch (error) {
+        const detail = error instanceof Error ? ` (${error.message})` : '';
+        throw new Error(`[Taskforce] Missing "pg" dependency in worker${detail}`);
+    }
+}
+function writeResponse(statusBuffer, responseBuffer, payload) {
+    const status = new Int32Array(statusBuffer);
+    const responseBytes = new Uint8Array(responseBuffer);
+    const serialized = JSON.stringify(payload);
+    const encoded = encoder.encode(serialized);
+    if (encoded.length > responseBytes.length) {
+        const fallback = encoder.encode(JSON.stringify({
+            ok: false,
+            error: '[Taskforce] Postgres worker response exceeded buffer capacity.'
+        }));
+        responseBytes.fill(0);
+        responseBytes.set(fallback.subarray(0, responseBytes.length));
+        status[RESPONSE_LENGTH_INDEX] = Math.min(fallback.length, responseBytes.length);
+    }
+    else {
+        responseBytes.fill(0);
+        responseBytes.set(encoded);
+        status[RESPONSE_LENGTH_INDEX] = encoded.length;
+    }
+    Atomics.store(status, RESPONSE_STATUS_INDEX, RESPONSE_READY);
+    Atomics.notify(status, RESPONSE_STATUS_INDEX, 1);
+}
+const connectionString = String(workerData?.connectionString || '').trim();
+if (!connectionString) {
+    throw new Error('[Taskforce] Postgres worker requires connection string.');
+}
+const pool = createPool(connectionString);
+const txClients = new Map();
+async function handleMessage(message) {
+    const { payload } = message;
+    const txId = payload.txId ? String(payload.txId) : null;
+    if (payload.op === 'close') {
+        for (const [, client] of txClients) {
+            try {
+                await client.query('ROLLBACK');
+            }
+            catch {
+                // Ignore rollback failures during shutdown.
+            }
+            client.release();
+        }
+        txClients.clear();
+        await pool.end();
+        return { ok: true, result: { rows: [], rowCount: 0 } };
+    }
+    if (payload.op === 'begin') {
+        if (!txId)
+            throw new Error('[Taskforce] begin requires txId');
+        if (txClients.has(txId))
+            throw new Error(`[Taskforce] transaction already exists: ${txId}`);
+        const client = await pool.connect();
+        await client.query('BEGIN');
+        txClients.set(txId, client);
+        return { ok: true, result: { rows: [], rowCount: 0 } };
+    }
+    if (payload.op === 'commit' || payload.op === 'rollback') {
+        if (!txId)
+            throw new Error(`[Taskforce] ${payload.op} requires txId`);
+        const client = txClients.get(txId);
+        if (!client)
+            throw new Error(`[Taskforce] unknown transaction: ${txId}`);
+        try {
+            await client.query(payload.op === 'commit' ? 'COMMIT' : 'ROLLBACK');
+        }
+        finally {
+            client.release();
+            txClients.delete(txId);
+        }
+        return { ok: true, result: { rows: [], rowCount: 0 } };
+    }
+    if (payload.op === 'query') {
+        const sql = String(payload.sql || '').trim();
+        const values = Array.isArray(payload.values) ? payload.values : [];
+        const client = txId ? txClients.get(txId) : null;
+        const executor = client || pool;
+        const result = await executor.query(sql, values);
+        return { ok: true, result };
+    }
+    throw new Error(`[Taskforce] unknown worker op: ${payload.op}`);
+}
+if (!parentPort) {
+    throw new Error('[Taskforce] Postgres worker missing parent port.');
+}
+parentPort.on('message', async (message) => {
+    try {
+        const response = await handleMessage(message);
+        writeResponse(message.statusBuffer, message.responseBuffer, response);
+    }
+    catch (error) {
+        const messageText = error instanceof Error ? error.message : String(error);
+        writeResponse(message.statusBuffer, message.responseBuffer, { ok: false, error: messageText });
+    }
+});

package/dist/storage/providerConfig.d.ts

@@ -0,0 +1,6 @@
+import type { DatabaseProvider } from './databaseAdapter.js';
+export interface ResolvedDatabaseConfig {
+    provider: DatabaseProvider;
+    connectionString?: string;
+}
+export declare function resolveDatabaseConfigFromEnv(env?: NodeJS.ProcessEnv): ResolvedDatabaseConfig;

package/dist/storage/providerConfig.js

@@ -0,0 +1,11 @@
+export function resolveDatabaseConfigFromEnv(env = process.env) {
+    const provider = env.TASKFORCE_DB_PROVIDER === 'postgres' ? 'postgres' : 'sqlite';
+    const connectionString = env.TASKFORCE_DATABASE_URL;
+    if (provider === 'postgres' && !connectionString) {
+        throw new Error('[Taskforce] TASKFORCE_DB_PROVIDER=postgres requires TASKFORCE_DATABASE_URL to be set.');
+    }
+    return {
+        provider,
+        connectionString
+    };
+}

package/dist/storage/sqliteAdapter.d.ts

@@ -0,0 +1,14 @@
+import type { DatabaseAdapter, DatabaseStatement } from './databaseAdapter.js';
+export declare class SqliteAdapter implements DatabaseAdapter {
+    readonly provider: "sqlite";
+    private readonly db;
+    constructor(dbPath: string);
+    get open(): boolean;
+    prepare(sql: string): DatabaseStatement;
+    exec(sql: string): void;
+    transaction<T extends (...args: any[]) => any>(fn: T): T;
+    pragma(name: string, options?: {
+        simple?: boolean;
+    }): unknown;
+    close(): void;
+}

package/dist/storage/sqliteAdapter.js

@@ -0,0 +1,28 @@
+import Database from 'better-sqlite3';
+export class SqliteAdapter {
+    provider = 'sqlite';
+    db;
+    constructor(dbPath) {
+        this.db = new Database(dbPath);
+    }
+    get open() {
+        return this.db.open;
+    }
+    prepare(sql) {
+        return this.db.prepare(sql);
+    }
+    exec(sql) {
+        this.db.exec(sql);
+    }
+    transaction(fn) {
+        return this.db.transaction(fn);
+    }
+    pragma(name, options) {
+        return this.db.pragma(name, options);
+    }
+    close() {
+        if (this.db.open) {
+            this.db.close();
+        }
+    }
+}

package/dist/storage/taskAssetStore.d.ts

@@ -0,0 +1,56 @@
+import type { DatabaseAdapter } from './databaseAdapter.js';
+import type { ObjectStorageProvider } from './objectStorage.js';
+import { DocumentRegistry } from './documentRegistry.js';
+import type { VirusScanResult } from '../security/virusScan.js';
+export type TaskAssetQuarantineStatus = 'none' | 'quarantined' | 'released';
+export interface TaskAssetEntry {
+    tenantId: string;
+    workspaceId: string;
+    path: string;
+    provider: ObjectStorageProvider;
+    version: number;
+    contentType: string;
+    sizeBytes: number;
+    sha256: string;
+    uploadedAt: string;
+    scan: VirusScanResult & {
+        scannedAt: string;
+    };
+    quarantineStatus: TaskAssetQuarantineStatus;
+    deletedAt?: string | null;
+    purgeAfter?: string | null;
+    updatedAt: string;
+}
+export declare class TaskAssetStore {
+    private readonly db;
+    private readonly tenantId;
+    private readonly fallbackRegistry;
+    constructor(db: DatabaseAdapter, tenantId: string, basePath: string, fallbackRegistry?: DocumentRegistry);
+    private backfillFromRegistry;
+    private upsertEntry;
+    get(pathValue: string, workspaceIdRaw?: string): TaskAssetEntry | null;
+    isDeleted(pathValue: string, workspaceIdRaw?: string): boolean;
+    recordUpload(input: {
+        path: string;
+        workspaceId?: string;
+        provider: ObjectStorageProvider;
+        contentType: string;
+        sizeBytes: number;
+        sha256: string;
+        uploadedAt?: string;
+        scan: VirusScanResult;
+    }): TaskAssetEntry;
+    markDeleted(pathValue: string, retentionDays: number, workspaceIdRaw?: string): TaskAssetEntry | null;
+    clearDeleted(pathValue: string, workspaceIdRaw?: string): TaskAssetEntry | null;
+    remove(pathValue: string, workspaceIdRaw?: string): boolean;
+    listPurgeCandidates(now?: Date): TaskAssetEntry[];
+    listAll(limit?: number): TaskAssetEntry[];
+    updateQuarantineStatus(pathValue: string, quarantineStatus: TaskAssetQuarantineStatus, workspaceIdRaw?: string): TaskAssetEntry | null;
+    updateScanResult(input: {
+        path: string;
+        workspaceId?: string;
+        scan: VirusScanResult;
+        quarantineStatus?: TaskAssetQuarantineStatus;
+    }): TaskAssetEntry | null;
+    listQuarantined(limit?: number): TaskAssetEntry[];
+}

package/dist/storage/taskAssetStore.js

@@ -0,0 +1,297 @@
+import { DocumentRegistry } from './documentRegistry.js';
+function normalizeLimit(limitRaw, fallback) {
+    return Number.isFinite(limitRaw) ? Math.max(1, Math.floor(Number(limitRaw))) : fallback;
+}
+function normalizePath(rawPath) {
+    return String(rawPath || '').trim().replace(/\\/g, '/');
+}
+function normalizeWorkspaceId(rawWorkspaceId) {
+    const trimmed = String(rawWorkspaceId || '').trim();
+    return trimmed || 'default';
+}
+function inferWorkspaceIdFromPath(rawPath) {
+    const normalized = normalizePath(rawPath);
+    const match = normalized.match(/^workspaces\/([^/]+)\//);
+    if (match && match[1])
+        return match[1];
+    return 'default';
+}
+function mapRegistryEntry(tenantId, workspaceId, entry) {
+    return {
+        tenantId,
+        workspaceId,
+        path: entry.path,
+        provider: entry.provider,
+        version: entry.version,
+        contentType: entry.contentType,
+        sizeBytes: entry.sizeBytes,
+        sha256: entry.sha256,
+        uploadedAt: entry.uploadedAt,
+        scan: entry.scan,
+        quarantineStatus: entry.scan.verdict === 'infected' ? 'quarantined' : 'none',
+        deletedAt: entry.deletedAt || null,
+        purgeAfter: entry.purgeAfter || null,
+        updatedAt: entry.uploadedAt
+    };
+}
+function mapRow(row) {
+    return {
+        tenantId: String(row.tenant_id || 'default'),
+        workspaceId: String(row.workspace_id || 'default'),
+        path: String(row.path || ''),
+        provider: String(row.provider || 'local') === 'r2' ? 'r2' : 'local',
+        version: Number(row.version || 1),
+        contentType: String(row.content_type || 'application/octet-stream'),
+        sizeBytes: Number(row.size_bytes || 0),
+        sha256: String(row.sha256 || ''),
+        uploadedAt: String(row.uploaded_at || ''),
+        scan: {
+            engine: String(row.scan_engine || 'none'),
+            verdict: String(row.scan_verdict || 'clean'),
+            details: row.scan_details ? String(row.scan_details) : undefined,
+            scannedAt: String(row.scan_scanned_at || row.uploaded_at || new Date().toISOString())
+        },
+        quarantineStatus: String(row.quarantine_status || 'none'),
+        deletedAt: row.deleted_at ? String(row.deleted_at) : null,
+        purgeAfter: row.purge_after ? String(row.purge_after) : null,
+        updatedAt: String(row.updated_at || row.uploaded_at || new Date().toISOString())
+    };
+}
+export class TaskAssetStore {
+    db;
+    tenantId;
+    fallbackRegistry;
+    constructor(db, tenantId, basePath, fallbackRegistry) {
+        this.db = db;
+        this.tenantId = tenantId;
+        this.fallbackRegistry = fallbackRegistry || new DocumentRegistry(basePath);
+    }
+    backfillFromRegistry(pathValue) {
+        const fallback = this.fallbackRegistry.get(pathValue);
+        if (!fallback)
+            return null;
+        const workspaceId = inferWorkspaceIdFromPath(fallback.path);
+        const entry = mapRegistryEntry(this.tenantId, workspaceId, fallback);
+        this.upsertEntry(entry);
+        return this.get(entry.path, entry.workspaceId);
+    }
+    upsertEntry(entry) {
+        this.db.prepare(`
+            INSERT INTO task_assets (
+                tenant_id,
+                workspace_id,
+                path,
+                provider,
+                version,
+                content_type,
+                size_bytes,
+                sha256,
+                uploaded_at,
+                scan_engine,
+                scan_verdict,
+                scan_details,
+                scan_scanned_at,
+                quarantine_status,
+                deleted_at,
+                purge_after,
+                updated_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            ON CONFLICT(tenant_id, workspace_id, path) DO UPDATE SET
+                provider = excluded.provider,
+                version = excluded.version,
+                content_type = excluded.content_type,
+                size_bytes = excluded.size_bytes,
+                sha256 = excluded.sha256,
+                uploaded_at = excluded.uploaded_at,
+                scan_engine = excluded.scan_engine,
+                scan_verdict = excluded.scan_verdict,
+                scan_details = excluded.scan_details,
+                scan_scanned_at = excluded.scan_scanned_at,
+                quarantine_status = excluded.quarantine_status,
+                deleted_at = excluded.deleted_at,
+                purge_after = excluded.purge_after,
+                updated_at = excluded.updated_at
+        `).run(entry.tenantId, entry.workspaceId, entry.path, entry.provider, entry.version, entry.contentType, entry.sizeBytes, entry.sha256, entry.uploadedAt, entry.scan.engine, entry.scan.verdict, entry.scan.details || null, entry.scan.scannedAt, entry.quarantineStatus, entry.deletedAt || null, entry.purgeAfter || null, entry.updatedAt);
+    }
+    get(pathValue, workspaceIdRaw) {
+        const normalizedPath = normalizePath(pathValue);
+        const workspaceId = normalizeWorkspaceId(workspaceIdRaw || inferWorkspaceIdFromPath(normalizedPath));
+        const row = this.db.prepare(`
+            SELECT *
+            FROM task_assets
+            WHERE tenant_id = ? AND workspace_id = ? AND path = ?
+            LIMIT 1
+        `).get(this.tenantId, workspaceId, normalizedPath);
+        if (row)
+            return mapRow(row);
+        return this.backfillFromRegistry(normalizedPath);
+    }
+    isDeleted(pathValue, workspaceIdRaw) {
+        const entry = this.get(pathValue, workspaceIdRaw);
+        return Boolean(entry?.deletedAt);
+    }
+    recordUpload(input) {
+        const normalizedPath = normalizePath(input.path);
+        const workspaceId = normalizeWorkspaceId(input.workspaceId || inferWorkspaceIdFromPath(normalizedPath));
+        const existing = this.db.prepare(`
+            SELECT version
+            FROM task_assets
+            WHERE tenant_id = ? AND workspace_id = ? AND path = ?
+            LIMIT 1
+        `).get(this.tenantId, workspaceId, normalizedPath);
+        const nowIso = new Date().toISOString();
+        const entry = {
+            tenantId: this.tenantId,
+            workspaceId,
+            path: normalizedPath,
+            provider: input.provider,
+            version: Number(existing?.version || 0) + 1,
+            contentType: input.contentType || 'application/octet-stream',
+            sizeBytes: input.sizeBytes,
+            sha256: input.sha256,
+            uploadedAt: input.uploadedAt || nowIso,
+            scan: {
+                ...input.scan,
+                scannedAt: nowIso
+            },
+            quarantineStatus: input.scan.verdict === 'infected' ? 'quarantined' : 'none',
+            deletedAt: null,
+            purgeAfter: null,
+            updatedAt: nowIso
+        };
+        this.upsertEntry(entry);
+        // One-release compatibility mirror.
+        this.fallbackRegistry.recordUpload({
+            path: normalizedPath,
+            provider: input.provider,
+            contentType: entry.contentType,
+            sizeBytes: entry.sizeBytes,
+            sha256: entry.sha256,
+            uploadedAt: entry.uploadedAt,
+            scan: input.scan
+        });
+        return entry;
+    }
+    markDeleted(pathValue, retentionDays, workspaceIdRaw) {
+        const entry = this.get(pathValue, workspaceIdRaw);
+        if (!entry)
+            return null;
+        const now = new Date();
+        const safeDays = Number.isFinite(retentionDays) ? Math.max(1, Math.floor(retentionDays)) : 7;
+        const purgeAt = new Date(now.getTime() + safeDays * 24 * 60 * 60 * 1000).toISOString();
+        const nowIso = now.toISOString();
+        this.db.prepare(`
+            UPDATE task_assets
+            SET deleted_at = ?, purge_after = ?, updated_at = ?
+            WHERE tenant_id = ? AND workspace_id = ? AND path = ?
+        `).run(nowIso, purgeAt, nowIso, this.tenantId, entry.workspaceId, entry.path);
+        this.fallbackRegistry.markDeleted(entry.path, safeDays);
+        return this.get(entry.path, entry.workspaceId);
+    }
+    clearDeleted(pathValue, workspaceIdRaw) {
+        const entry = this.get(pathValue, workspaceIdRaw);
+        if (!entry)
+            return null;
+        const nowIso = new Date().toISOString();
+        this.db.prepare(`
+            UPDATE task_assets
+            SET deleted_at = NULL, purge_after = NULL, updated_at = ?
+            WHERE tenant_id = ? AND workspace_id = ? AND path = ?
+        `).run(nowIso, this.tenantId, entry.workspaceId, entry.path);
+        this.fallbackRegistry.clearDeleted(entry.path);
+        return this.get(entry.path, entry.workspaceId);
+    }
+    remove(pathValue, workspaceIdRaw) {
+        const entry = this.get(pathValue, workspaceIdRaw);
+        if (!entry)
+            return false;
+        const result = this.db.prepare(`
+            DELETE FROM task_assets
+            WHERE tenant_id = ? AND workspace_id = ? AND path = ?
+        `).run(this.tenantId, entry.workspaceId, entry.path);
+        this.fallbackRegistry.remove(entry.path);
+        return Number(result?.changes || 0) > 0;
+    }
+    listPurgeCandidates(now = new Date()) {
+        const nowIso = now.toISOString();
+        const rows = this.db.prepare(`
+            SELECT *
+            FROM task_assets
+            WHERE tenant_id = ?
+              AND deleted_at IS NOT NULL
+              AND purge_after IS NOT NULL
+              AND purge_after <= ?
+            ORDER BY purge_after ASC
+        `).all(this.tenantId, nowIso);
+        return rows.map(mapRow);
+    }
+    listAll(limit = 500) {
+        const safeLimit = normalizeLimit(limit, 500);
+        const rows = this.db.prepare(`
+            SELECT *
+            FROM task_assets
+            WHERE tenant_id = ?
+            ORDER BY path ASC
+            LIMIT ?
+        `).all(this.tenantId, safeLimit);
+        // Opportunistic backfill for compatibility records.
+        for (const legacy of this.fallbackRegistry.listAll()) {
+            const workspaceId = inferWorkspaceIdFromPath(legacy.path);
+            const exists = rows.find((row) => String(row.path || '') === legacy.path && String(row.workspace_id || '') === workspaceId);
+            if (!exists) {
+                this.upsertEntry(mapRegistryEntry(this.tenantId, workspaceId, legacy));
+            }
+        }
+        const refreshed = this.db.prepare(`
+            SELECT *
+            FROM task_assets
+            WHERE tenant_id = ?
+            ORDER BY path ASC
+            LIMIT ?
+        `).all(this.tenantId, safeLimit);
+        return refreshed.map(mapRow);
+    }
+    updateQuarantineStatus(pathValue, quarantineStatus, workspaceIdRaw) {
+        const entry = this.get(pathValue, workspaceIdRaw);
+        if (!entry)
+            return null;
+        const nowIso = new Date().toISOString();
+        this.db.prepare(`
+            UPDATE task_assets
+            SET quarantine_status = ?, updated_at = ?
+            WHERE tenant_id = ? AND workspace_id = ? AND path = ?
+        `).run(quarantineStatus, nowIso, this.tenantId, entry.workspaceId, entry.path);
+        return this.get(entry.path, entry.workspaceId);
+    }
+    updateScanResult(input) {
+        const entry = this.get(input.path, input.workspaceId);
+        if (!entry)
+            return null;
+        const nowIso = new Date().toISOString();
+        const nextQuarantineStatus = input.quarantineStatus
+            || (input.scan.verdict === 'infected' ? 'quarantined' : 'none');
+        this.db.prepare(`
+            UPDATE task_assets
+            SET scan_engine = ?,
+                scan_verdict = ?,
+                scan_details = ?,
+                scan_scanned_at = ?,
+                quarantine_status = ?,
+                updated_at = ?
+            WHERE tenant_id = ? AND workspace_id = ? AND path = ?
+        `).run(input.scan.engine, input.scan.verdict, input.scan.details || null, nowIso, nextQuarantineStatus, nowIso, this.tenantId, entry.workspaceId, entry.path);
+        return this.get(entry.path, entry.workspaceId);
+    }
+    listQuarantined(limit = 200) {
+        const safeLimit = normalizeLimit(limit, 200);
+        const rows = this.db.prepare(`
+            SELECT *
+            FROM task_assets
+            WHERE tenant_id = ?
+              AND quarantine_status = 'quarantined'
+            ORDER BY updated_at DESC
+            LIMIT ?
+        `).all(this.tenantId, safeLimit);
+        return rows.map(mapRow);
+    }
+}

package/dist/sync/cloudSyncApi.d.ts

@@ -0,0 +1,47 @@
+import type { WorkspaceSyncChange } from './workspaceSyncModel';
+export interface SyncHttpResult<T = unknown> {
+    ok: boolean;
+    status: number;
+    data: T;
+    retryAfterMs?: number;
+}
+export declare function pullUserSettings(resolveCloudAuthUrl: (path: string) => string): Promise<SyncHttpResult>;
+export declare function pushUserSettings(resolveCloudAuthUrl: (path: string) => string, payload: {
+    settings: Record<string, unknown>;
+    updatedAt: string;
+}): Promise<SyncHttpResult>;
+export declare function handshakeWorkspace(resolveCloudAuthUrl: (path: string) => string, workspaceId: string): Promise<SyncHttpResult>;
+export declare function provisionWorkspace(resolveCloudAuthUrl: (path: string) => string, input: {
+    workspaceId: string;
+    name: string;
+}): Promise<SyncHttpResult>;
+export declare function pullWorkspaceChanges(resolveCloudAuthUrl: (path: string) => string, input: {
+    workspaceId: string;
+    cursor?: string | null;
+    limit: number;
+}): Promise<SyncHttpResult<{
+    changes?: WorkspaceSyncChange[];
+    nextCursor?: string | null;
+    hasMore?: boolean;
+}>>;
+export declare function pushWorkspaceChanges(resolveCloudAuthUrl: (path: string) => string, input: {
+    workspaceId: string;
+    idempotencyKey: string;
+    changes: WorkspaceSyncChange[];
+}): Promise<SyncHttpResult>;
+export declare function bootstrapPushWorkspaceSnapshot(resolveCloudAuthUrl: (path: string) => string, input: {
+    workspaceId: string;
+    tasks: Array<Record<string, unknown>>;
+    archived: Array<Record<string, unknown>>;
+    taxonomies?: unknown[];
+    documents?: Array<{
+        path: string;
+        updatedAt: string;
+        content: string;
+    }>;
+}): Promise<SyncHttpResult>;
+export declare function applyLocalWorkspaceChanges(workspaceId: string, changes: WorkspaceSyncChange[]): Promise<{
+    ok: boolean;
+    data: unknown;
+    failures: string[];
+}>;