@taskforcehq/taskforce 0.3.169 → 0.3.300

package/dist/server/routes/documents.js

@@ -0,0 +1,1113 @@
+/**
+ * Document and context route module.
+ *
+ * Handles context uploads, document reads and writes, document listing,
+ * retention metadata, and plan-to-task generation.
+ *
+ * Routes registered here:
+ *   POST   /api/taskforce/context-upload/init
+ *   POST   /api/taskforce/context-upload/finalize
+ *   POST   /api/taskforce/context-upload
+ *   GET    /api/taskforce/context/:filename
+ *   GET    /api/taskforce/documents/:assetId/content
+ *   GET    /api/taskforce/context-link
+ *   DELETE /api/taskforce/context/:filename
+ *   GET    /api/taskforce/context-metadata
+ *   POST   /api/taskforce/context/purge-expired
+ *   GET    /api/taskforce/documents
+ *   DELETE /api/taskforce/documents/:assetId
+ *   PATCH  /api/taskforce/documents/:assetId
+ *   POST   /api/taskforce/documents/save
+ *   POST   /api/taskforce/documents/generate-tasks/preview
+ *   POST   /api/taskforce/documents/generate-tasks/commit
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { normalizeTaskDataRelativePath } from '../../storage/objectStorageClient.js';
+import { purgeExpiredDocuments } from '../../storage/documentPurge.js';
+import { parsePlan } from '../../utils/planParser.js';
+import { getCanonicalDocumentName, getReadableDocumentName, isGeneratedDocumentName } from '../../utils/documentNames.js';
+import { parseJsonBody } from '../routes.js';
+export function registerDocumentRoutes(deps) {
+    const { addRoute, core, context, requestWorkspaceId, ensureAdminRole, resolveEffectiveObjectStorageConfig, getObjectStorageClient, resolveStorageWorkspaceId, ensureContextUploadAllowed, parseStorageFolderSegments, buildCanonicalWorkspaceAssetRelativePath, inferAssetKindFromPath, appendStorageTelemetry, scanAndRecordDocument, buildTaskAttachmentPayload, workspaceAssetStore, taskAssetStore, normalizeDocumentPathInput, getAssetMetadata, getCanonicalAssetMetadata, documentRetentionDays, appendDocumentPurgeHistory, markAssetDeleted, isAssetDeleted, clearAssetDeleted, ensureWithinDir, sanitizeDownloadFilename, contentTypeForExt, inferInlineDocumentFromPath, resolveCanonicalDocumentRead, inferWorkspaceIdFromStoragePath, inferTaskIdFromStoragePath, } = deps;
+    addRoute('POST', '/api/taskforce/context-upload/init', async (req, res) => {
+        const resolvedObjectStorage = resolveEffectiveObjectStorageConfig();
+        const objectStorageClient = getObjectStorageClient();
+        const body = await parseJsonBody(req);
+        const { originalName, mimeType, taskId, folderPath } = body || {};
+        const workspaceId = resolveStorageWorkspaceId(req, body);
+        if (!workspaceId) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'workspaceId is required and cannot be default for uploads.' }));
+            return;
+        }
+        if (!ensureContextUploadAllowed(req, res, workspaceId))
+            return;
+        const folderSegments = parseStorageFolderSegments(folderPath);
+        if (folderSegments === null) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'folderPath cannot contain . or .. segments.' }));
+            return;
+        }
+        const extFromMime = {
+            'image/png': '.png',
+            'image/jpeg': '.jpg',
+            'image/webp': '.webp',
+            'image/gif': '.gif',
+            'application/pdf': '.pdf',
+            'text/plain': '.txt',
+            'text/markdown': '.md',
+            'text/csv': '.csv',
+            'application/json': '.json',
+            'application/msword': '.doc',
+            'application/vnd.openxmlformats-officedocument.wordprocessingml.document': '.docx'
+        };
+        const safeOriginal = typeof originalName === 'string' ? originalName.trim() : '';
+        const originalExt = safeOriginal ? path.extname(safeOriginal).toLowerCase() : '';
+        const extension = originalExt || extFromMime[String(mimeType || '')] || '.bin';
+        const safeBase = (safeOriginal ? path.basename(safeOriginal, originalExt) : 'context-file')
+            .replace(/[^a-zA-Z0-9._-]/g, '-')
+            .slice(0, 64) || 'context-file';
+        const actualFilename = `${safeBase}-${Date.now()}${extension}`;
+        const { basePath, projectRoot } = core.getPaths();
+        const kind = String(mimeType || '').startsWith('image/')
+            ? 'image'
+            : inferAssetKindFromPath(actualFilename);
+        const canonicalAsset = buildCanonicalWorkspaceAssetRelativePath({
+            workspaceIdRaw: workspaceId,
+            kind,
+            filename: actualFilename,
+            folderSegments
+        });
+        const relativeToStorage = canonicalAsset.relativePath;
+        const relativePath = path.relative(projectRoot, path.join(basePath, relativeToStorage));
+        if (objectStorageClient && resolvedObjectStorage.provider === 'r2' && resolvedObjectStorage.r2) {
+            const uploadUrl = objectStorageClient.createSignedPutUrl(relativeToStorage, resolvedObjectStorage.r2.signedUploadTtlSeconds, String(mimeType || 'application/octet-stream'));
+            appendStorageTelemetry('upload.initiated', {
+                path: relativeToStorage,
+                status: 'signed',
+                provider: 'r2'
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                success: true,
+                mode: 'direct',
+                uploadUrl,
+                method: 'PUT',
+                headers: {
+                    'Content-Type': String(mimeType || 'application/octet-stream')
+                },
+                filename: actualFilename,
+                relativePath: relativeToStorage,
+                path: kind === 'document'
+                    ? `/api/taskforce/documents/${encodeURIComponent(canonicalAsset.assetId)}/content`
+                    : `/api/taskforce/context/${encodeURIComponent(relativeToStorage)}`,
+                fsPath: relativePath,
+                assetId: canonicalAsset.assetId,
+                taskId: typeof taskId === 'string' && taskId.trim().length > 0 ? taskId.trim() : null
+            }));
+            return;
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            success: true,
+            mode: 'server',
+            filename: actualFilename
+        }));
+        appendStorageTelemetry('upload.initiated', {
+            status: 'server',
+            provider: objectStorageClient ? 'r2' : 'local'
+        });
+    });
+    addRoute('POST', '/api/taskforce/context-upload/finalize', async (req, res) => {
+        const objectStorageClient = getObjectStorageClient();
+        const body = await parseJsonBody(req);
+        const relativeToStorage = normalizeTaskDataRelativePath(String(body?.relativePath || body?.path || '').trim());
+        if (!relativeToStorage) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'relativePath is required.' }));
+            return;
+        }
+        const workspaceId = inferWorkspaceIdFromStoragePath(relativeToStorage) || requestWorkspaceId(req);
+        if (!ensureContextUploadAllowed(req, res, workspaceId))
+            return;
+        if (!objectStorageClient) {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true, mode: 'local' }));
+            return;
+        }
+        const object = await objectStorageClient.getObject(relativeToStorage);
+        if (!object) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Uploaded file not found.' }));
+            return;
+        }
+        try {
+            const taskId = typeof body?.taskId === 'string' && body.taskId.trim().length > 0
+                ? body.taskId.trim()
+                : inferTaskIdFromStoragePath(relativeToStorage);
+            const metadata = await scanAndRecordDocument({
+                relativeToStorage,
+                buffer: object.body,
+                contentType: String(body?.mimeType || object.contentType || 'application/octet-stream'),
+                provider: 'r2',
+                workspaceId: inferWorkspaceIdFromStoragePath(relativeToStorage),
+                taskId,
+                originalName: typeof body?.originalName === 'string' ? body.originalName.trim() : null
+            });
+            appendStorageTelemetry('upload.finalized', {
+                path: relativeToStorage,
+                status: metadata.scan?.verdict || 'unknown',
+                provider: 'r2'
+            });
+            const attachment = buildTaskAttachmentPayload(relativeToStorage, {
+                caption: typeof body?.originalName === 'string' ? body.originalName.trim() : null,
+                assetId: workspaceAssetStore?.getByStorageKey(relativeToStorage, inferWorkspaceIdFromStoragePath(relativeToStorage))?.assetId || null,
+                taskId
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                success: true,
+                metadata,
+                ...(attachment ? attachment : {})
+            }));
+        }
+        catch (error) {
+            if (error?.code === 'VIRUS_DETECTED') {
+                await objectStorageClient.deleteObject(relativeToStorage);
+            }
+            throw error;
+        }
+    });
+    addRoute('POST', '/api/taskforce/context-upload', async (req, res) => {
+        const objectStorageClient = getObjectStorageClient();
+        const body = await parseJsonBody(req);
+        const { file, originalName, taskId, folderPath } = body;
+        const workspaceId = resolveStorageWorkspaceId(req, body);
+        if (!workspaceId) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'workspaceId is required and cannot be default for uploads.' }));
+            return;
+        }
+        if (!ensureContextUploadAllowed(req, res, workspaceId))
+            return;
+        const folderSegments = parseStorageFolderSegments(folderPath);
+        if (folderSegments === null) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'folderPath cannot contain . or .. segments.' }));
+            return;
+        }
+        if (!file || typeof file !== 'string') {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'No file data' }));
+            return;
+        }
+        const dataMatch = file.match(/^data:([^;]+);base64,(.+)$/);
+        if (!dataMatch) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid file payload' }));
+            return;
+        }
+        const [, mimeType, base64Data] = dataMatch;
+        const extFromMime = {
+            'image/png': '.png',
+            'image/jpeg': '.jpg',
+            'image/webp': '.webp',
+            'image/gif': '.gif',
+            'application/pdf': '.pdf',
+            'text/plain': '.txt',
+            'text/markdown': '.md',
+            'text/csv': '.csv',
+            'application/json': '.json',
+            'application/msword': '.doc',
+            'application/vnd.openxmlformats-officedocument.wordprocessingml.document': '.docx'
+        };
+        const safeOriginal = typeof originalName === 'string' ? originalName.trim() : '';
+        const originalExt = safeOriginal ? path.extname(safeOriginal).toLowerCase() : '';
+        const extension = originalExt || extFromMime[mimeType] || '.bin';
+        const safeBase = (safeOriginal ? path.basename(safeOriginal, originalExt) : 'context-file')
+            .replace(/[^a-zA-Z0-9._-]/g, '-')
+            .slice(0, 64) || 'context-file';
+        const actualFilename = `${safeBase}-${Date.now()}${extension}`;
+        const { basePath, projectRoot } = core.getPaths();
+        const buffer = Buffer.from(base64Data, 'base64');
+        const relativeToStorage = buildCanonicalWorkspaceAssetRelativePath({
+            workspaceIdRaw: workspaceId,
+            kind: mimeType.startsWith('image/') ? 'image' : inferAssetKindFromPath(actualFilename),
+            filename: actualFilename,
+            folderSegments
+        }).relativePath;
+        let relativePath;
+        if (objectStorageClient) {
+            await objectStorageClient.putObject(relativeToStorage, buffer, mimeType || 'application/octet-stream');
+            await scanAndRecordDocument({
+                relativeToStorage,
+                buffer,
+                contentType: mimeType || 'application/octet-stream',
+                provider: 'r2',
+                workspaceId,
+                taskId,
+                originalName: safeOriginal || actualFilename
+            });
+            appendStorageTelemetry('upload.completed', {
+                path: relativeToStorage,
+                provider: 'r2',
+                status: 'stored'
+            });
+            relativePath = path.relative(projectRoot, path.join(basePath, relativeToStorage));
+        }
+        else {
+            const filePath = path.join(basePath, relativeToStorage);
+            fs.mkdirSync(path.dirname(filePath), { recursive: true });
+            fs.writeFileSync(filePath, buffer);
+            await scanAndRecordDocument({
+                relativeToStorage,
+                buffer,
+                contentType: mimeType || 'application/octet-stream',
+                provider: 'local',
+                workspaceId,
+                taskId,
+                originalName: safeOriginal || actualFilename
+            });
+            appendStorageTelemetry('upload.completed', {
+                path: relativeToStorage,
+                provider: 'local',
+                status: 'stored'
+            });
+            relativePath = path.relative(projectRoot, filePath);
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        const attachment = buildTaskAttachmentPayload(relativeToStorage, {
+            caption: safeOriginal || actualFilename,
+            taskId: typeof taskId === 'string' && taskId.trim().length > 0 ? taskId.trim() : null
+        });
+        res.end(JSON.stringify({
+            success: true,
+            filename: actualFilename,
+            ...(attachment || {
+                path: `/api/taskforce/context/${encodeURIComponent(relativeToStorage)}`,
+                fsPath: relativePath
+            })
+        }));
+    });
+    addRoute('GET', '/api/taskforce/context/:filename', async (req, res, params) => {
+        const resolvedObjectStorage = resolveEffectiveObjectStorageConfig();
+        const objectStorageClient = getObjectStorageClient();
+        const { basePath } = core.getPaths();
+        const url = new URL(req.url || '', 'http://localhost');
+        const forceDownload = url.searchParams.get('download') === '1';
+        const requestedFilename = String(url.searchParams.get('filename') || '').trim();
+        const decoded = decodeURIComponent(params.filename);
+        const normalizedRelative = normalizeTaskDataRelativePath(decoded);
+        const contextAsset = normalizedRelative ? getAssetMetadata(normalizedRelative) : null;
+        const canonicalAsset = normalizedRelative ? getCanonicalAssetMetadata(normalizedRelative) : null;
+        if (normalizedRelative && contextAsset?.quarantineStatus === 'quarantined') {
+            res.writeHead(423, { 'Content-Type': 'text/plain' });
+            res.end('Context file is quarantined');
+            return;
+        }
+        if (normalizedRelative && contextAsset?.scan?.verdict === 'pending') {
+            res.writeHead(425, { 'Content-Type': 'text/plain' });
+            res.end('Context file scan pending');
+            return;
+        }
+        if (normalizedRelative && isAssetDeleted(normalizedRelative)) {
+            res.writeHead(404, { 'Content-Type': 'text/plain' });
+            res.end('Context file not found');
+            return;
+        }
+        const filePath = normalizedRelative
+            ? ensureWithinDir(path.join(basePath, normalizedRelative), basePath)
+            : null;
+        const ext = normalizedRelative ? path.extname(normalizedRelative).toLowerCase() : '';
+        const resolvedDownloadNameBase = sanitizeDownloadFilename(requestedFilename
+            || canonicalAsset?.logicalName
+            || canonicalAsset?.originalFilename
+            || path.basename(normalizedRelative || '', ext)
+            || 'download');
+        const resolvedDownloadName = ext && !resolvedDownloadNameBase.toLowerCase().endsWith(ext)
+            ? `${resolvedDownloadNameBase}${ext}`
+            : resolvedDownloadNameBase;
+        const contentDisposition = forceDownload
+            ? `attachment; filename="${resolvedDownloadName.replace(/"/g, '')}"`
+            : 'inline';
+        const shouldProxyInlineDocument = !forceDownload && (canonicalAsset?.kind === 'document' || inferInlineDocumentFromPath(normalizedRelative));
+        if (canonicalAsset?.kind === 'document' && !canonicalAsset.deletedAt) {
+            const response = await resolveCanonicalDocumentRead({
+                asset: canonicalAsset,
+                forceDownload,
+                requestedFilename
+            });
+            if (response.statusCode === 404) {
+                res.writeHead(404, { 'Content-Type': 'text/plain' });
+                res.end('Context file not found');
+                return;
+            }
+            if (forceDownload && response.statusCode === 302 && response.headers?.Location) {
+                res.writeHead(302, { Location: response.headers.Location });
+                res.end();
+                return;
+            }
+            res.writeHead(200, response.headers || {
+                'Content-Type': contentTypeForExt(ext),
+                'Content-Disposition': contentDisposition
+            });
+            res.end(response.body);
+            return;
+        }
+        if (objectStorageClient && normalizedRelative && resolvedObjectStorage.provider === 'r2' && resolvedObjectStorage.r2) {
+            if (shouldProxyInlineDocument) {
+                const object = await objectStorageClient.getObject(normalizedRelative);
+                if (!object) {
+                    res.writeHead(404, { 'Content-Type': 'text/plain' });
+                    res.end('Context file not found');
+                    return;
+                }
+                res.writeHead(200, {
+                    'Content-Type': object.contentType || contentTypeForExt(ext),
+                    'Content-Disposition': contentDisposition
+                });
+                res.end(object.body);
+                return;
+            }
+            const signedUrl = objectStorageClient.createSignedGetUrl(normalizedRelative, resolvedObjectStorage.r2.signedDownloadTtlSeconds, forceDownload ? { responseContentDisposition: contentDisposition } : undefined);
+            res.writeHead(302, { Location: signedUrl });
+            res.end();
+            return;
+        }
+        if (filePath && fs.existsSync(filePath)) {
+            res.writeHead(200, {
+                'Content-Type': contentTypeForExt(ext),
+                'Content-Disposition': contentDisposition
+            });
+            res.end(fs.readFileSync(filePath));
+            return;
+        }
+        res.writeHead(404, { 'Content-Type': 'text/plain' });
+        res.end('Context file not found');
+    });
+    addRoute('GET', '/api/taskforce/documents/:assetId/content', async (req, res, params) => {
+        const workspaceId = requestWorkspaceId(req);
+        const assetId = String(params.assetId || '').trim();
+        const url = new URL(req.url || '', 'http://localhost');
+        const forceDownload = url.searchParams.get('download') === '1';
+        const requestedFilename = String(url.searchParams.get('filename') || '').trim();
+        if (!workspaceAssetStore || !assetId) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Document not found' }));
+            return;
+        }
+        const asset = workspaceAssetStore.get(assetId, workspaceId);
+        if (!asset || asset.kind !== 'document' || asset.deletedAt) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Document not found' }));
+            return;
+        }
+        if (asset.scanStatus === 'infected') {
+            res.writeHead(423, { 'Content-Type': 'text/plain' });
+            res.end('Document is quarantined');
+            return;
+        }
+        if (asset.scanStatus === 'pending') {
+            res.writeHead(425, { 'Content-Type': 'text/plain' });
+            res.end('Document scan pending');
+            return;
+        }
+        const response = await resolveCanonicalDocumentRead({
+            asset,
+            forceDownload,
+            requestedFilename
+        });
+        if (response.statusCode === 404) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Document content not found' }));
+            return;
+        }
+        if (forceDownload && response.statusCode === 302 && response.headers?.Location) {
+            res.writeHead(302, { Location: response.headers.Location });
+            res.end();
+            return;
+        }
+        res.writeHead(200, response.headers || {
+            'Content-Type': asset.mimeType || 'text/markdown',
+            'Content-Disposition': forceDownload ? 'attachment' : 'inline'
+        });
+        res.end(response.body);
+    });
+    addRoute('GET', '/api/taskforce/context-link', async (req, res) => {
+        const url = new URL(req.url || '', 'http://localhost');
+        const linkedPath = (url.searchParams.get('path') || '').trim();
+        const forceDownload = url.searchParams.get('download') === '1';
+        const requestedFilename = String(url.searchParams.get('filename') || '').trim();
+        const { projectRoot } = core.getPaths();
+        if (!linkedPath) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'path query parameter is required' }));
+            return;
+        }
+        const resolvedPath = path.isAbsolute(linkedPath)
+            ? path.resolve(linkedPath)
+            : path.resolve(projectRoot, linkedPath);
+        const realPath = fs.existsSync(resolvedPath) ? fs.realpathSync(resolvedPath) : resolvedPath;
+        if (!realPath.startsWith(projectRoot)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Linked file must be within project root' }));
+            return;
+        }
+        if (!fs.existsSync(realPath) || !fs.statSync(realPath).isFile()) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Linked file not found' }));
+            return;
+        }
+        const ext = path.extname(realPath).toLowerCase();
+        res.writeHead(200, {
+            'Content-Type': contentTypeForExt(ext),
+            'Content-Disposition': forceDownload
+                ? `attachment; filename="${sanitizeDownloadFilename(requestedFilename || path.basename(realPath)).replace(/"/g, '')}"`
+                : 'inline'
+        });
+        res.end(fs.readFileSync(realPath));
+    });
+    addRoute('DELETE', '/api/taskforce/context/:filename', async (req, res, params) => {
+        const objectStorageClient = getObjectStorageClient();
+        const { basePath } = core.getPaths();
+        const decoded = decodeURIComponent(params.filename);
+        const normalizedRelative = normalizeTaskDataRelativePath(decoded);
+        if (!normalizedRelative) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'File not found' }));
+            return;
+        }
+        const filePath = ensureWithinDir(path.join(basePath, normalizedRelative), basePath);
+        if (!objectStorageClient && (!filePath || !fs.existsSync(filePath)) && !getAssetMetadata(normalizedRelative)) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'File not found' }));
+            return;
+        }
+        const metadata = markAssetDeleted(normalizedRelative);
+        appendStorageTelemetry('delete.soft', {
+            path: normalizedRelative,
+            status: 'soft-deleted',
+            provider: metadata?.provider || (objectStorageClient ? 'r2' : 'local')
+        });
+        core.notifyDocumentMetadataMutation(inferWorkspaceIdFromStoragePath(normalizedRelative) || requestWorkspaceId(req) || 'default', [normalizedRelative], 'delete');
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            success: true,
+            softDeleted: true,
+            retentionDays: documentRetentionDays,
+            purgeAfter: metadata?.purgeAfter || null
+        }));
+    });
+    addRoute('GET', '/api/taskforce/context-metadata', async (req, res) => {
+        if (!ensureAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: admin role required.' }));
+            return;
+        }
+        const url = new URL(req.url || '', 'http://localhost');
+        const normalizedPath = normalizeDocumentPathInput(url.searchParams.get('path'));
+        if (!normalizedPath) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'path query parameter is required' }));
+            return;
+        }
+        const metadata = getAssetMetadata(normalizedPath);
+        const canonicalAsset = getCanonicalAssetMetadata(normalizedPath);
+        if (!metadata) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Metadata not found' }));
+            return;
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            path: normalizedPath,
+            metadata,
+            ...(canonicalAsset ? { canonicalAsset } : {}),
+            retentionDays: documentRetentionDays
+        }));
+    });
+    addRoute('POST', '/api/taskforce/context/purge-expired', async (req, res) => {
+        if (!ensureAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: admin role required.' }));
+            return;
+        }
+        const { basePath } = core.getPaths();
+        const summary = await purgeExpiredDocuments({
+            basePath,
+            objectStorage: resolveEffectiveObjectStorageConfig(),
+            assetStore: taskAssetStore || undefined,
+            workspaceAssetStore: workspaceAssetStore || undefined
+        });
+        appendDocumentPurgeHistory(req, summary);
+        appendStorageTelemetry('purge.run', {
+            status: `purged:${summary.purged}/total:${summary.total}`,
+            provider: resolveEffectiveObjectStorageConfig().provider
+        });
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ success: true, ...summary }));
+    });
+    addRoute('GET', '/api/taskforce/documents', async (req, res) => {
+        const workspaceId = requestWorkspaceId(req);
+        const { basePath, projectRoot } = core.getPaths();
+        const planningDocsDir = path.join(basePath, 'docs');
+        const runtimeMode = context.authConfig?.runtimeMode === 'cloud' ? 'cloud' : 'local';
+        function inferDocType(filename) {
+            const base = path.basename(filename, path.extname(filename)).toLowerCase();
+            if (base.includes('implementation-plan') || base.includes('implementation_plan'))
+                return 'implementation-plan';
+            if (base.includes('review'))
+                return 'review';
+            if (base.includes('walkthrough'))
+                return 'walkthrough';
+            return 'other';
+        }
+        function inferTitle(filename, assetId) {
+            return getReadableDocumentName({
+                assetId,
+                originalFilename: filename,
+            });
+        }
+        function normalizeDocumentRecord(input) {
+            const normalizedPath = normalizeTaskDataRelativePath(input.fsPath) || input.fsPath;
+            const fallbackFilename = path.basename(normalizedPath);
+            const inferredTitle = inferTitle(fallbackFilename, input.assetId || null) || fallbackFilename || 'Untitled document';
+            const originalFilename = String(input.originalFilename || '').trim() || fallbackFilename || null;
+            const displayName = getCanonicalDocumentName({
+                logicalName: String(input.displayName || '').trim() || null,
+                title: String(input.title || '').trim() || null,
+                originalFilename,
+                fsPath: normalizedPath,
+                assetId: input.assetId || null,
+            }) || inferredTitle;
+            const title = String(input.title || '').trim()
+                || displayName
+                || inferredTitle;
+            const taskId = String(input.taskId || '').trim() || null;
+            const attachmentCount = typeof input.attachmentCount === 'number' && Number.isFinite(input.attachmentCount)
+                ? Math.max(0, Math.floor(input.attachmentCount))
+                : (taskId ? 1 : 0);
+            const attachmentState = input.attachmentState === 'attached'
+                || input.attachmentState === 'unattached'
+                || input.attachmentState === 'standalone'
+                ? (attachmentCount > 0 || taskId
+                    ? 'attached'
+                    : input.attachmentState === 'standalone'
+                        ? 'standalone'
+                        : 'unattached')
+                : (attachmentCount > 0 || taskId ? 'attached' : 'unattached');
+            return {
+                id: input.id,
+                assetId: input.assetId || null,
+                referenceNumber: typeof input.referenceNumber === 'number' && Number.isFinite(input.referenceNumber)
+                    ? Math.max(1, Math.floor(input.referenceNumber))
+                    : null,
+                referenceLabel: String(input.referenceLabel || '').trim() || null,
+                fsPath: normalizedPath,
+                apiUrl: input.apiUrl,
+                taskId,
+                displayName,
+                originalFilename,
+                title,
+                docType: input.docType,
+                sizeBytes: typeof input.sizeBytes === 'number' && Number.isFinite(input.sizeBytes) ? Math.max(0, input.sizeBytes) : 0,
+                updatedAt: input.updatedAt || null,
+                editable: input.editable !== false,
+                attachmentCount,
+                attachmentState
+            };
+        }
+        function safeRelative(fullPath) {
+            const rel = path.relative(projectRoot, fullPath);
+            if (rel.startsWith('..'))
+                return null;
+            return rel;
+        }
+        const documents = [];
+        const seenDocumentPaths = new Set();
+        const pushDocument = (doc) => {
+            const normalizedDoc = normalizeDocumentRecord(doc);
+            const key = normalizeTaskDataRelativePath(normalizedDoc.fsPath) || normalizedDoc.fsPath;
+            if (seenDocumentPaths.has(key))
+                return;
+            seenDocumentPaths.add(key);
+            documents.push(normalizedDoc);
+        };
+        const canonicalDocuments = workspaceAssetStore?.listAllByWorkspace(workspaceId, {
+            includeDeleted: false,
+            kind: 'document'
+        }) || [];
+        for (const asset of canonicalDocuments) {
+            const filename = asset.originalFilename || path.basename(asset.storageKey);
+            const repairedReadableName = getCanonicalDocumentName({
+                logicalName: asset.logicalName || null,
+                displayName: null,
+                originalFilename: asset.originalFilename || filename,
+                fsPath: asset.storageKey,
+                assetId: asset.assetId || null,
+            });
+            const activeLinks = (workspaceAssetStore?.listLinksForAsset(asset.assetId, workspaceId) || [])
+                .filter((link) => !link.deletedAt)
+                .filter((link) => !!core.getTask(link.taskId, workspaceId));
+            const firstLink = activeLinks[0] || null;
+            const repairedLogicalName = isGeneratedDocumentName(asset.logicalName || null, asset.assetId || null)
+                ? (String(firstLink?.displayName || '').trim()
+                    || repairedReadableName)
+                : null;
+            if (repairedLogicalName && repairedLogicalName !== asset.logicalName) {
+                workspaceAssetStore?.upsertAsset({
+                    assetId: asset.assetId,
+                    workspaceId: asset.workspaceId,
+                    kind: asset.kind,
+                    logicalName: repairedLogicalName,
+                    originalFilename: asset.originalFilename,
+                    mimeType: asset.mimeType,
+                    storageProvider: asset.storageProvider,
+                    storageKey: asset.storageKey,
+                    contentSha256: asset.contentSha256,
+                    sizeBytes: asset.sizeBytes,
+                    documentId: asset.documentId,
+                    version: asset.version,
+                    isLatest: asset.isLatest,
+                    scanStatus: asset.scanStatus,
+                    scanEngine: asset.scanEngine,
+                    scanDetails: asset.scanDetails,
+                    createdByUserId: asset.createdByUserId,
+                    createdAt: asset.createdAt,
+                    updatedAt: asset.updatedAt || new Date().toISOString(),
+                    deletedAt: asset.deletedAt,
+                    purgeAfter: asset.purgeAfter
+                });
+            }
+            const readableName = repairedLogicalName || repairedReadableName;
+            pushDocument({
+                id: asset.assetId || asset.storageKey,
+                assetId: asset.assetId || null,
+                referenceNumber: asset.referenceNumber,
+                referenceLabel: asset.referenceNumber ? `D-${asset.referenceNumber}` : null,
+                fsPath: asset.storageKey,
+                apiUrl: asset.assetId
+                    ? `/api/taskforce/documents/${encodeURIComponent(asset.assetId)}/content`
+                    : `/api/taskforce/context/${encodeURIComponent(asset.storageKey)}`,
+                taskId: firstLink?.taskId || inferTaskIdFromStoragePath(asset.storageKey),
+                displayName: readableName,
+                originalFilename: asset.originalFilename || null,
+                title: readableName,
+                docType: inferDocType(filename),
+                sizeBytes: asset.sizeBytes ?? 0,
+                updatedAt: asset.updatedAt || null,
+                editable: true,
+                attachmentCount: activeLinks.length,
+                attachmentState: activeLinks.length > 0 ? 'attached' : 'unattached',
+            });
+        }
+        if (runtimeMode !== 'cloud') {
+            const walkMarkdownFiles = (dir, visitor) => {
+                let entries = [];
+                try {
+                    entries = fs.readdirSync(dir, { withFileTypes: true });
+                }
+                catch {
+                    return;
+                }
+                for (const entry of entries) {
+                    const fullPath = path.join(dir, entry.name);
+                    if (entry.isDirectory()) {
+                        walkMarkdownFiles(fullPath, visitor);
+                        continue;
+                    }
+                    if (!entry.isFile() || path.extname(entry.name).toLowerCase() !== '.md') {
+                        continue;
+                    }
+                    let stat;
+                    try {
+                        stat = fs.statSync(fullPath);
+                    }
+                    catch {
+                        continue;
+                    }
+                    const relativePath = safeRelative(fullPath);
+                    if (!relativePath)
+                        continue;
+                    visitor({ relativePath, entryName: entry.name, stat });
+                }
+            };
+            walkMarkdownFiles(planningDocsDir, ({ relativePath, entryName, stat }) => {
+                pushDocument({
+                    id: relativePath,
+                    assetId: null,
+                    referenceNumber: null,
+                    referenceLabel: null,
+                    fsPath: relativePath,
+                    apiUrl: `/api/taskforce/context-link?path=${encodeURIComponent(relativePath)}`,
+                    taskId: null,
+                    displayName: inferTitle(entryName),
+                    originalFilename: entryName,
+                    title: inferTitle(entryName),
+                    docType: 'planning',
+                    sizeBytes: stat.size,
+                    updatedAt: stat.mtime.toISOString(),
+                    editable: true,
+                    attachmentCount: 0,
+                    attachmentState: 'standalone',
+                });
+            });
+        }
+        documents.sort((a, b) => {
+            if (!a.updatedAt && !b.updatedAt)
+                return 0;
+            if (!a.updatedAt)
+                return 1;
+            if (!b.updatedAt)
+                return -1;
+            return b.updatedAt.localeCompare(a.updatedAt);
+        });
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ documents }));
+    });
+    addRoute('DELETE', '/api/taskforce/documents/:assetId', async (req, res, params) => {
+        const workspaceId = requestWorkspaceId(req);
+        const assetId = String(params.assetId || '').trim();
+        if (!workspaceAssetStore || !assetId) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Document not found' }));
+            return;
+        }
+        const asset = workspaceAssetStore.get(assetId, workspaceId);
+        if (!asset || asset.kind !== 'document' || asset.deletedAt) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Document not found' }));
+            return;
+        }
+        const activeLinks = workspaceAssetStore.listLinksForAsset(asset.assetId, workspaceId)
+            .filter((link) => !link.deletedAt)
+            .filter((link) => !!core.getTask(link.taskId, workspaceId));
+        if (activeLinks.length > 0) {
+            res.writeHead(409, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Document is still attached to one or more tasks.' }));
+            return;
+        }
+        const nowIso = new Date().toISOString();
+        const purgeAfter = new Date(Date.now() + documentRetentionDays * 24 * 60 * 60 * 1000).toISOString();
+        const metadata = markAssetDeleted(asset.storageKey);
+        workspaceAssetStore.markDeleted(asset.assetId, workspaceId, nowIso, purgeAfter);
+        appendStorageTelemetry('delete.soft', {
+            path: asset.storageKey,
+            status: 'soft-deleted',
+            provider: asset.storageProvider
+        });
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            success: true,
+            softDeleted: true,
+            retentionDays: documentRetentionDays,
+            purgeAfter: metadata?.purgeAfter || purgeAfter
+        }));
+    });
+    addRoute('PATCH', '/api/taskforce/documents/:assetId', async (req, res, params) => {
+        const workspaceId = requestWorkspaceId(req);
+        const assetId = String(params.assetId || '').trim();
+        const body = await parseJsonBody(req);
+        const displayName = String(body?.displayName || '').trim();
+        if (!workspaceAssetStore || !assetId) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Document not found' }));
+            return;
+        }
+        if (!displayName) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'displayName is required' }));
+            return;
+        }
+        const asset = workspaceAssetStore.get(assetId, workspaceId);
+        if (!asset || asset.kind !== 'document' || asset.deletedAt) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Document not found' }));
+            return;
+        }
+        const updatedAt = new Date().toISOString();
+        const updated = workspaceAssetStore.upsertAsset({
+            assetId: asset.assetId,
+            workspaceId,
+            kind: asset.kind,
+            logicalName: displayName,
+            originalFilename: asset.originalFilename,
+            mimeType: asset.mimeType,
+            storageProvider: asset.storageProvider,
+            storageKey: asset.storageKey,
+            contentSha256: asset.contentSha256,
+            sizeBytes: asset.sizeBytes,
+            documentId: asset.documentId,
+            version: asset.version,
+            isLatest: asset.isLatest,
+            scanStatus: asset.scanStatus,
+            scanEngine: asset.scanEngine,
+            scanDetails: asset.scanDetails,
+            createdByUserId: asset.createdByUserId,
+            createdAt: asset.createdAt,
+            updatedAt,
+            deletedAt: null,
+            purgeAfter: asset.purgeAfter
+        });
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ success: true, assetId: updated.assetId, displayName: updated.logicalName, updatedAt }));
+    });
+    addRoute('POST', '/api/taskforce/documents/save', async (req, res) => {
+        const workspaceId = requestWorkspaceId(req);
+        const { projectRoot, basePath } = core.getPaths();
+        const objectStorageClient = getObjectStorageClient();
+        const MAX_BODY_BYTES = 1_048_576;
+        let body = '';
+        let bodyBytes = 0;
+        let tooLarge = false;
+        await new Promise((resolve) => {
+            req.on('data', (chunk) => {
+                bodyBytes += chunk.length;
+                if (bodyBytes > MAX_BODY_BYTES) {
+                    tooLarge = true;
+                    resolve();
+                    return;
+                }
+                body += chunk.toString();
+            });
+            req.on('end', () => resolve());
+        });
+        if (tooLarge) {
+            res.writeHead(413, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Document exceeds maximum size of 1 MB' }));
+            return;
+        }
+        let fsPath;
+        let content;
+        try {
+            const parsed = JSON.parse(body);
+            fsPath = String(parsed.fsPath || '').trim();
+            content = typeof parsed.content === 'string' ? parsed.content : '';
+        }
+        catch {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid JSON body' }));
+            return;
+        }
+        if (!fsPath) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'fsPath is required' }));
+            return;
+        }
+        const normalizedStoragePath = normalizeTaskDataRelativePath(fsPath.replace(/^\.taskforce[\\/]+/, '').replace(/\\/g, '/'));
+        if (normalizedStoragePath) {
+            const metadata = getAssetMetadata(normalizedStoragePath);
+            if (metadata?.quarantineStatus === 'quarantined') {
+                res.writeHead(423, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'Document is quarantined and cannot be edited.' }));
+                return;
+            }
+            if (metadata?.deletedAt || isAssetDeleted(normalizedStoragePath)) {
+                res.writeHead(404, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'Document not found' }));
+                return;
+            }
+            if (objectStorageClient && metadata?.provider === 'r2') {
+                const requestWorkspace = requestWorkspaceId(req);
+                const assetWorkspaceId = String(metadata.workspaceId || inferWorkspaceIdFromStoragePath(normalizedStoragePath) || 'default').trim() || 'default';
+                if (requestWorkspace !== assetWorkspaceId) {
+                    res.writeHead(403, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'Document belongs to a different workspace.' }));
+                    return;
+                }
+                try {
+                    const buffer = Buffer.from(content, 'utf8');
+                    await objectStorageClient.putObject(normalizedStoragePath, buffer, 'text/markdown; charset=utf-8');
+                    await scanAndRecordDocument({
+                        relativeToStorage: normalizedStoragePath,
+                        buffer,
+                        contentType: 'text/markdown; charset=utf-8',
+                        provider: 'r2',
+                        workspaceId: assetWorkspaceId,
+                        originalName: metadata.logicalName || metadata.originalFilename || path.basename(normalizedStoragePath)
+                    });
+                    clearAssetDeleted(normalizedStoragePath);
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ success: true, updatedAt: new Date().toISOString() }));
+                    return;
+                }
+                catch (e) {
+                    res.writeHead(500, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: e?.message || 'Failed to write cloud document' }));
+                    return;
+                }
+            }
+        }
+        if (fsPath.includes('..') || fsPath.includes('\0')) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid path' }));
+            return;
+        }
+        const storageRelativeLocalPath = normalizedStoragePath
+            ? ensureWithinDir(path.join(basePath, normalizedStoragePath), basePath)
+            : null;
+        const resolvedPath = path.isAbsolute(fsPath)
+            ? path.resolve(fsPath)
+            : storageRelativeLocalPath || path.resolve(projectRoot, fsPath);
+        const realPath = fs.existsSync(resolvedPath) ? fs.realpathSync(resolvedPath) : resolvedPath;
+        if (!realPath.startsWith(projectRoot)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'File must be within project root' }));
+            return;
+        }
+        if (path.extname(realPath).toLowerCase() !== '.md') {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Only .md files may be saved via this endpoint' }));
+            return;
+        }
+        if (!fs.existsSync(realPath) || !fs.statSync(realPath).isFile()) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'File not found' }));
+            return;
+        }
+        try {
+            fs.writeFileSync(realPath, content, 'utf-8');
+            const updatedAt = fs.statSync(realPath).mtime.toISOString();
+            if (normalizedStoragePath) {
+                await scanAndRecordDocument({
+                    relativeToStorage: normalizedStoragePath,
+                    buffer: Buffer.from(content, 'utf8'),
+                    contentType: 'text/markdown; charset=utf-8',
+                    provider: 'local',
+                    workspaceId: workspaceId || inferWorkspaceIdFromStoragePath(normalizedStoragePath),
+                    originalName: path.basename(normalizedStoragePath)
+                });
+                clearAssetDeleted(normalizedStoragePath);
+            }
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true, updatedAt }));
+        }
+        catch (e) {
+            res.writeHead(500, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: e?.message || 'Failed to write file' }));
+        }
+    });
+    addRoute('POST', '/api/taskforce/documents/generate-tasks/preview', async (req, res) => {
+        const MAX_PREVIEW_BYTES = 524_288;
+        let body = '';
+        let bodyBytes = 0;
+        let tooLarge = false;
+        await new Promise((resolve) => {
+            req.on('data', (chunk) => {
+                bodyBytes += chunk.length;
+                if (bodyBytes > MAX_PREVIEW_BYTES) {
+                    tooLarge = true;
+                    resolve();
+                    return;
+                }
+                body += chunk.toString();
+            });
+            req.on('end', () => resolve());
+        });
+        if (tooLarge) {
+            res.writeHead(413, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Content exceeds maximum preview size of 512 KB' }));
+            return;
+        }
+        let content;
+        try {
+            const parsed = JSON.parse(body);
+            content = typeof parsed.content === 'string' ? parsed.content : '';
+        }
+        catch {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid JSON body' }));
+            return;
+        }
+        if (!content.trim()) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'content is required' }));
+            return;
+        }
+        const tasks = parsePlan(content);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ tasks }));
+    });
+    addRoute('POST', '/api/taskforce/documents/generate-tasks/commit', async (req, res) => {
+        const workspaceId = requestWorkspaceId(req);
+        const MAX_COMMIT_BYTES = 524_288;
+        const MAX_TASKS = 200;
+        const MAX_TITLE_LENGTH = 200;
+        const MAX_DEPTH = 4;
+        let body = '';
+        let bodyBytes = 0;
+        let tooLarge = false;
+        await new Promise((resolve) => {
+            req.on('data', (chunk) => {
+                bodyBytes += chunk.length;
+                if (bodyBytes > MAX_COMMIT_BYTES) {
+                    tooLarge = true;
+                    resolve();
+                    return;
+                }
+                body += chunk.toString();
+            });
+            req.on('end', () => resolve());
+        });
+        if (tooLarge) {
+            res.writeHead(413, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Request body too large' }));
+            return;
+        }
+        let tasks;
+        try {
+            const parsed = JSON.parse(body);
+            tasks = Array.isArray(parsed.tasks) ? parsed.tasks : [];
+        }
+        catch {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid JSON body' }));
+            return;
+        }
+        if (tasks.length === 0) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'No tasks provided' }));
+            return;
+        }
+        function sanitiseTitle(raw) {
+            return String(raw || '')
+                .replace(/<[^>]*>/g, '')
+                .replace(/[\x00-\x1F\x7F]/g, ' ')
+                .trim()
+                .slice(0, MAX_TITLE_LENGTH) || 'Untitled task';
+        }
+        const created = [];
+        let totalCreated = 0;
+        function createSelectedTasks(nodes, depth) {
+            if (depth > MAX_DEPTH)
+                return;
+            for (const node of nodes) {
+                if (Array.isArray(node.children) && node.children.length > 0) {
+                    createSelectedTasks(node.children, depth + 1);
+                }
+                if (!node.selected)
+                    continue;
+                if (totalCreated >= MAX_TASKS)
+                    break;
+                try {
+                    const taskItem = core.createTask({
+                        title: sanitiseTitle(node.title),
+                        description: String(node.description || '').slice(0, 2000).trim() || undefined,
+                        type: node.type || 'feature',
+                        priority: typeof node.priority === 'number' ? node.priority : 2,
+                        status: 'task',
+                    }, { workspaceId });
+                    created.push(taskItem.id);
+                    totalCreated++;
+                }
+                catch {
+                    // Skip individual failures and return a partial success summary.
+                }
+            }
+        }
+        createSelectedTasks(tasks, 0);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ created: created.length, taskIds: created }));
+    });
+}