@taskforcehq/taskforce 0.3.169 → 0.3.300

package/scripts/migrate-task-data-assets.mjs

@@ -0,0 +1,408 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import Database from 'better-sqlite3';
+
+function inferMimeType(filename) {
+  const ext = path.extname(filename).toLowerCase();
+  const map = {
+    '.md': 'text/markdown',
+    '.markdown': 'text/markdown',
+    '.txt': 'text/plain',
+    '.json': 'application/json',
+    '.pdf': 'application/pdf',
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.webp': 'image/webp',
+    '.gif': 'image/gif',
+    '.svg': 'image/svg+xml',
+    '.csv': 'text/csv',
+    '.doc': 'application/msword',
+    '.docx': 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+  };
+  return map[ext] || 'application/octet-stream';
+}
+
+function inferKind(filename, mimeType) {
+  if (String(mimeType || '').startsWith('image/')) return 'image';
+  const ext = path.extname(filename).toLowerCase();
+  if (ext === '.md' || ext === '.markdown') return 'document';
+  return 'file';
+}
+
+function sanitizeStorageSegment(value, fallback = 'default') {
+  const sanitized = String(value || '')
+    .trim()
+    .replace(/[^a-zA-Z0-9._-]/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^-+|-+$/g, '');
+  return sanitized || fallback;
+}
+
+function buildCanonicalRelativePath(workspaceId, kind, filename, assetId) {
+  const workspaceIdSafe = sanitizeStorageSegment(workspaceId, 'default');
+  const kindSegment = kind === 'document'
+    ? 'documents'
+    : kind === 'image'
+      ? 'images'
+      : 'files';
+  const filenameSafe = path.basename(filename).replace(/[^a-zA-Z0-9._-]/g, '-');
+  const ext = path.extname(filenameSafe).toLowerCase();
+  const stem = (ext ? filenameSafe.slice(0, -ext.length) : filenameSafe)
+    .replace(/[^a-zA-Z0-9._-]/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 64) || 'file';
+  return `workspaces/${workspaceIdSafe}/assets/${kindSegment}/${assetId}-${stem}${ext}`;
+}
+
+function sha256(buffer) {
+  return createHash('sha256').update(buffer).digest('hex');
+}
+
+function documentIdFor(storageKey) {
+  return `document-${createHash('sha1').update(storageKey).digest('hex').slice(0, 24)}`;
+}
+
+const projectRoot = process.cwd();
+const basePath = path.join(projectRoot, '.taskforce');
+const taskDataDir = path.join(basePath, 'task-data');
+const dbPath = path.join(basePath, 'taskforce.db');
+const registryPath = path.join(basePath, 'document-registry.json');
+
+if (!fs.existsSync(dbPath)) {
+  throw new Error(`Taskforce DB not found at ${dbPath}`);
+}
+
+const db = new Database(dbPath);
+const tenantId = 'default';
+
+const selectWorkspaceForTask = db.prepare(`SELECT workspace_id FROM tasks WHERE id = ? LIMIT 1`);
+const selectAssetByStorageKey = db.prepare(`
+  SELECT *
+  FROM workspace_assets
+  WHERE tenant_id = ? AND workspace_id = ? AND storage_key = ?
+  LIMIT 1
+`);
+const selectTaskAsset = db.prepare(`
+  SELECT *
+  FROM task_assets
+  WHERE tenant_id = ? AND workspace_id = ? AND path = ?
+  LIMIT 1
+`);
+const upsertAsset = db.prepare(`
+  INSERT INTO workspace_assets (
+    asset_id, tenant_id, workspace_id, kind, logical_name, original_filename,
+    mime_type, storage_provider, storage_key, content_sha256, size_bytes,
+    document_id, version, is_latest, scan_status, scan_engine, scan_details,
+    created_by_user_id, created_at, updated_at, deleted_at, purge_after
+  ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  ON CONFLICT(asset_id) DO UPDATE SET
+    workspace_id = excluded.workspace_id,
+    kind = excluded.kind,
+    logical_name = excluded.logical_name,
+    original_filename = excluded.original_filename,
+    mime_type = excluded.mime_type,
+    storage_provider = excluded.storage_provider,
+    storage_key = excluded.storage_key,
+    content_sha256 = excluded.content_sha256,
+    size_bytes = excluded.size_bytes,
+    document_id = excluded.document_id,
+    version = excluded.version,
+    is_latest = excluded.is_latest,
+    scan_status = excluded.scan_status,
+    scan_engine = excluded.scan_engine,
+    scan_details = excluded.scan_details,
+    updated_at = excluded.updated_at,
+    deleted_at = excluded.deleted_at,
+    purge_after = excluded.purge_after
+`);
+const upsertLink = db.prepare(`
+  INSERT INTO workspace_asset_links (
+    tenant_id, workspace_id, asset_id, task_id, role, sort_order, created_at, updated_at, deleted_at
+  ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)
+  ON CONFLICT(tenant_id, workspace_id, asset_id, task_id, role) DO UPDATE SET
+    sort_order = excluded.sort_order,
+    updated_at = excluded.updated_at,
+    deleted_at = NULL
+`);
+const deleteLegacyTaskAsset = db.prepare(`
+  DELETE FROM task_assets
+  WHERE tenant_id = ? AND workspace_id = ? AND path = ?
+`);
+const listLegacyCanonicalAssets = db.prepare(`
+  SELECT *
+  FROM workspace_assets
+  WHERE tenant_id = ?
+    AND (
+      storage_key LIKE 'task-data/%'
+      OR storage_key LIKE 'workspaces/%/assets/document/%'
+      OR storage_key LIKE 'workspaces/%/assets/image/%'
+      OR storage_key LIKE 'workspaces/%/assets/file/%'
+    )
+`);
+const deleteLinksForAsset = db.prepare(`
+  DELETE FROM workspace_asset_links
+  WHERE tenant_id = ? AND workspace_id = ? AND asset_id = ?
+`);
+const deleteAsset = db.prepare(`
+  DELETE FROM workspace_assets
+  WHERE tenant_id = ? AND workspace_id = ? AND asset_id = ?
+`);
+
+let registry = { documents: {} };
+if (fs.existsSync(registryPath)) {
+  try {
+    registry = JSON.parse(fs.readFileSync(registryPath, 'utf8'));
+    if (!registry || typeof registry !== 'object' || typeof registry.documents !== 'object') {
+      registry = { documents: {} };
+    }
+  } catch {
+    registry = { documents: {} };
+  }
+}
+
+const summary = {
+  migrated: 0,
+  skipped: 0,
+  cleanedCanonical: 0,
+  removedStaleCanonical: 0,
+  removedDirs: 0,
+  removedFiles: 0,
+  touchedTasks: new Set(),
+};
+
+const transaction = db.transaction(() => {
+  if (!fs.existsSync(taskDataDir)) return;
+  const taskDirs = fs.readdirSync(taskDataDir).filter((name) => name.startsWith('task-'));
+  for (const taskId of taskDirs) {
+    const attachmentsDir = path.join(taskDataDir, taskId, 'attachments');
+    if (!fs.existsSync(attachmentsDir)) continue;
+    const names = fs.readdirSync(attachmentsDir).filter((name) => {
+      const fullPath = path.join(attachmentsDir, name);
+      return fs.existsSync(fullPath) && fs.statSync(fullPath).isFile();
+    });
+    if (names.length === 0) {
+      fs.rmSync(attachmentsDir, { recursive: true, force: true });
+      summary.removedDirs += 1;
+      continue;
+    }
+
+    const workspaceId = String(selectWorkspaceForTask.get(taskId)?.workspace_id || 'default').trim() || 'default';
+    let sortOrder = 0;
+    for (const name of names) {
+      if (name === '.DS_Store') {
+        fs.rmSync(path.join(attachmentsDir, name), { force: true });
+        summary.removedFiles += 1;
+        continue;
+      }
+      const oldRelative = `task-data/${taskId}/attachments/${name}`;
+      const oldAbsolute = path.join(attachmentsDir, name);
+      const stats = fs.statSync(oldAbsolute);
+      const buffer = fs.readFileSync(oldAbsolute);
+      const mimeType = inferMimeType(name);
+      const kind = inferKind(name, mimeType);
+      const role = kind === 'image' ? 'image' : 'attachment';
+
+      const existingCanonical = selectAssetByStorageKey.get(tenantId, workspaceId, oldRelative);
+      const existingLegacy = selectTaskAsset.get(tenantId, workspaceId, oldRelative);
+      const assetId = String(existingCanonical?.asset_id || `asset-${randomUUID().replace(/-/g, '')}`);
+      const newRelative = buildCanonicalRelativePath(workspaceId, kind, name, assetId);
+      const newAbsolute = path.join(basePath, newRelative);
+      const alreadyCanonical = fs.existsSync(newAbsolute);
+      fs.mkdirSync(path.dirname(newAbsolute), { recursive: true });
+      if (!alreadyCanonical) {
+        fs.renameSync(oldAbsolute, newAbsolute);
+      } else {
+        fs.rmSync(oldAbsolute, { force: true });
+      }
+
+      const createdAt = String(existingCanonical?.created_at || existingLegacy?.uploaded_at || stats.birthtime.toISOString() || stats.mtime.toISOString());
+      const updatedAt = stats.mtime.toISOString();
+      const version = kind === 'document'
+        ? Number(existingCanonical?.version || existingLegacy?.version || 1)
+        : null;
+      const documentId = kind === 'document'
+        ? String(existingCanonical?.document_id || documentIdFor(newRelative))
+        : null;
+      const scanStatus = String(existingCanonical?.scan_status || (existingLegacy?.scan_verdict === 'infected' ? 'infected' : 'clean'));
+      const scanEngine = existingCanonical?.scan_engine || existingLegacy?.scan_engine || 'none';
+      const scanDetails = existingCanonical?.scan_details || existingLegacy?.scan_details || null;
+      const deletedAt = existingCanonical?.deleted_at || existingLegacy?.deleted_at || null;
+      const purgeAfter = existingCanonical?.purge_after || existingLegacy?.purge_after || null;
+
+      upsertAsset.run(
+        assetId,
+        tenantId,
+        workspaceId,
+        kind,
+        name,
+        name,
+        mimeType,
+        'local',
+        newRelative,
+        sha256(buffer),
+        buffer.length,
+        documentId,
+        version,
+        1,
+        scanStatus === 'pending' || scanStatus === 'infected' || scanStatus === 'failed' ? scanStatus : 'clean',
+        scanEngine,
+        scanDetails,
+        null,
+        createdAt,
+        updatedAt,
+        deletedAt,
+        purgeAfter
+      );
+      upsertLink.run(
+        tenantId,
+        workspaceId,
+        assetId,
+        taskId,
+        role,
+        sortOrder,
+        updatedAt,
+        updatedAt
+      );
+      deleteLegacyTaskAsset.run(tenantId, workspaceId, oldRelative);
+
+      if (registry.documents[oldRelative]) {
+        const entry = registry.documents[oldRelative];
+        delete registry.documents[oldRelative];
+        registry.documents[newRelative] = {
+          ...entry,
+          path: newRelative,
+          provider: 'local',
+          sha256: sha256(buffer),
+          sizeBytes: buffer.length,
+        };
+      }
+
+      summary.migrated += 1;
+      summary.touchedTasks.add(taskId);
+      sortOrder += 1;
+    }
+
+    const remaining = fs.existsSync(attachmentsDir) ? fs.readdirSync(attachmentsDir) : [];
+    if (remaining.length === 0) {
+      fs.rmSync(attachmentsDir, { recursive: true, force: true });
+      summary.removedDirs += 1;
+      const taskDir = path.join(taskDataDir, taskId);
+      if (fs.existsSync(taskDir) && fs.readdirSync(taskDir).length === 0) {
+        fs.rmSync(taskDir, { recursive: true, force: true });
+        summary.removedDirs += 1;
+      }
+    }
+  }
+});
+
+transaction();
+
+const canonicalCleanup = db.transaction(() => {
+  const rows = listLegacyCanonicalAssets.all(tenantId);
+  for (const row of rows) {
+    const workspaceId = String(row.workspace_id || 'default').trim() || 'default';
+    const assetId = String(row.asset_id || '').trim();
+    const storageKey = String(row.storage_key || '').trim();
+    if (!assetId || !storageKey) continue;
+    const absolutePath = path.join(basePath, storageKey);
+
+    if (storageKey.startsWith('task-data/')) {
+      if (!fs.existsSync(absolutePath)) {
+        deleteLinksForAsset.run(tenantId, workspaceId, assetId);
+        deleteAsset.run(tenantId, workspaceId, assetId);
+        summary.removedStaleCanonical += 1;
+        continue;
+      }
+      const filename = String(row.original_filename || path.basename(storageKey));
+      const mimeType = inferMimeType(filename);
+      const kind = inferKind(filename, mimeType);
+      const newRelative = buildCanonicalRelativePath(workspaceId, kind, filename, assetId);
+      const newAbsolute = path.join(basePath, newRelative);
+      fs.mkdirSync(path.dirname(newAbsolute), { recursive: true });
+      fs.renameSync(absolutePath, newAbsolute);
+      upsertAsset.run(
+        assetId,
+        tenantId,
+        workspaceId,
+        kind,
+        row.logical_name || filename,
+        filename,
+        row.mime_type || mimeType,
+        row.storage_provider || 'local',
+        newRelative,
+        row.content_sha256 || sha256(fs.readFileSync(newAbsolute)),
+        Number(row.size_bytes || fs.statSync(newAbsolute).size),
+        kind === 'document' ? (row.document_id || documentIdFor(newRelative)) : null,
+        row.version == null ? (kind === 'document' ? 1 : null) : row.version,
+        Number(row.is_latest || 1) === 1 ? 1 : 0,
+        row.scan_status || 'clean',
+        row.scan_engine || 'none',
+        row.scan_details || null,
+        row.created_by_user_id || null,
+        row.created_at || new Date().toISOString(),
+        row.updated_at || new Date().toISOString(),
+        row.deleted_at || null,
+        row.purge_after || null
+      );
+      summary.cleanedCanonical += 1;
+      continue;
+    }
+
+    if (storageKey.includes('/assets/document/') || storageKey.includes('/assets/image/') || storageKey.includes('/assets/file/')) {
+      const kind = String(row.kind || inferKind(String(row.original_filename || storageKey), String(row.mime_type || ''))).trim() || 'file';
+      const currentFilename = String(row.original_filename || path.basename(storageKey));
+      const newRelative = buildCanonicalRelativePath(workspaceId, kind, currentFilename, assetId);
+      const newAbsolute = path.join(basePath, newRelative);
+      if (fs.existsSync(absolutePath)) {
+        fs.mkdirSync(path.dirname(newAbsolute), { recursive: true });
+        fs.renameSync(absolutePath, newAbsolute);
+      }
+      upsertAsset.run(
+        assetId,
+        tenantId,
+        workspaceId,
+        kind,
+        row.logical_name || currentFilename,
+        currentFilename,
+        row.mime_type || inferMimeType(newRelative),
+        row.storage_provider || 'local',
+        newRelative,
+        row.content_sha256 || (fs.existsSync(newAbsolute) ? sha256(fs.readFileSync(newAbsolute)) : ''),
+        Number(row.size_bytes || (fs.existsSync(newAbsolute) ? fs.statSync(newAbsolute).size : 0)),
+        kind === 'document' ? (row.document_id || documentIdFor(newRelative)) : null,
+        row.version == null ? (kind === 'document' ? 1 : null) : row.version,
+        Number(row.is_latest || 1) === 1 ? 1 : 0,
+        row.scan_status || 'clean',
+        row.scan_engine || 'none',
+        row.scan_details || null,
+        row.created_by_user_id || null,
+        row.created_at || new Date().toISOString(),
+        row.updated_at || new Date().toISOString(),
+        row.deleted_at || null,
+        row.purge_after || null
+      );
+      summary.cleanedCanonical += 1;
+    }
+  }
+});
+
+canonicalCleanup();
+
+fs.writeFileSync(registryPath, `${JSON.stringify(registry, null, 2)}\n`, 'utf8');
+const dsStorePath = path.join(taskDataDir, '.DS_Store');
+if (fs.existsSync(dsStorePath)) {
+  fs.rmSync(dsStorePath, { force: true });
+  summary.removedFiles += 1;
+}
+
+console.log(JSON.stringify({
+  migrated: summary.migrated,
+  cleanedCanonical: summary.cleanedCanonical,
+  removedStaleCanonical: summary.removedStaleCanonical,
+  removedDirs: summary.removedDirs,
+  removedFiles: summary.removedFiles,
+  touchedTasks: Array.from(summary.touchedTasks).sort()
+}, null, 2));

package/scripts/playwright-auth.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env sh
+set -eu
+
+LOCAL_ENV_FILE="${TASKFORCE_PLAYWRIGHT_ENV_FILE:-/Users/rossburke/.codex/taskforce-playwright.env}"
+
+if [ -f "$LOCAL_ENV_FILE" ]; then
+  # shellcheck disable=SC1090
+  . "$LOCAL_ENV_FILE"
+fi
+
+exec node scripts/bootstrap-playwright-auth.mjs "$@"

package/scripts/run-dev-proxy.sh

@@ -44,6 +44,8 @@ if [ -z "${client_id}" ] || [ -z "${client_secret}" ]; then
   exit 1
 fi
 
+TASKFORCE_RUNTIME_MODE="local" \
+TASKFORCE_CLOUD_ENVIRONMENT="$target" \
 VITE_TASKFORCE_BASE_URL="$base_url" \
 TASKFORCE_CLOUD_PROXY_BASE_URL="$base_url" \
 npm run dev:runtime

package/scripts/update-homebrew-formula.sh

@@ -67,7 +67,24 @@ if [[ -z "$SHA256" ]]; then
   TMP_TGZ="$(mktemp "/tmp/${PACKAGE_NAME}-${VERSION}.XXXXXX.tgz")"
   trap 'rm -f "$TMP_TGZ"' EXIT
   echo "Downloading npm tarball: $URL"
-  curl -fsSL "$URL" -o "$TMP_TGZ"
+  CURL_ARGS=(-fsSL "$URL" -o "$TMP_TGZ")
+  AUTH_TOKEN="${NODE_AUTH_TOKEN:-${NPM_TOKEN:-}}"
+  if [[ -n "$AUTH_TOKEN" ]]; then
+    CURL_ARGS=(-fsSL -H "Authorization: Bearer ${AUTH_TOKEN}" "$URL" -o "$TMP_TGZ")
+  fi
+  if ! curl "${CURL_ARGS[@]}"; then
+    echo "Direct npm tarball download failed (likely private package auth). Falling back to npm pack..."
+    rm -f "$TMP_TGZ"
+    TMP_DIR="$(mktemp -d "/tmp/${PACKAGE_NAME}-${VERSION}.XXXXXX")"
+    trap 'rm -rf "$TMP_DIR"' EXIT
+    npm pack "${NPM_PACKAGE}@${VERSION}" --pack-destination "$TMP_DIR" >/dev/null
+    PACKED_TGZ="$(ls "$TMP_DIR"/*.tgz | head -n 1)"
+    if [[ -z "$PACKED_TGZ" || ! -f "$PACKED_TGZ" ]]; then
+      echo "Failed to locate tarball produced by npm pack." >&2
+      exit 1
+    fi
+    TMP_TGZ="$PACKED_TGZ"
+  fi
   if command -v shasum >/dev/null 2>&1; then
     SHA256="$(shasum -a 256 "$TMP_TGZ" | awk '{print $1}')"
   else
@@ -76,7 +93,7 @@ if [[ -z "$SHA256" ]]; then
 fi
 
 sed -i.bak \
-  -e "s#homepage \".*\"#homepage \"https://github.com/Stratnexus/taskforce\"#g" \
+  -e "s#homepage \".*\"#homepage \"https://github.com/taskforcehq/taskforce\"#g" \
   -e "s#url \".*\"#url \"${URL}\"#g" \
   -e "s#sha256 \".*\"#sha256 \"${SHA256}\"#g" \
   "$FORMULA_PATH"
@@ -86,6 +103,6 @@ echo "Updated ${FORMULA_PATH}"
 echo "  npm package: ${NPM_PACKAGE}"
 echo "  package scope: ${PACKAGE_SCOPE}"
 echo "  package name: ${PACKAGE_NAME}"
-echo "  homepage: https://github.com/Stratnexus/taskforce"
+echo "  homepage: https://github.com/taskforcehq/taskforce"
 echo "  url:      ${URL}"
 echo "  sha256:   ${SHA256}"

package/scripts/with-esbuild.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env sh
+set -eu
+
+if [ -z "${ESBUILD_BINARY_PATH:-}" ]; then
+  fallback_bin="$(pwd)/node_modules/@esbuild/darwin-arm64/bin/esbuild 2"
+  if [ -x "$fallback_bin" ]; then
+    export ESBUILD_BINARY_PATH="$fallback_bin"
+  fi
+fi
+
+exec "$@"

package/src/resources/templates/WORKFLOW_V2_POLICY.md

@@ -38,7 +38,7 @@ This note defines the canonical policy for v2 workflow templates and environment
 - Artifact paths must be project-root-relative.
 - Do not write artifacts outside the project root by default.
 - Optional artifacts should use `savePolicy: ask-before-save`.
-- Structured docs saved under `.taskforce/task-data/{taskId}/*` should include required section headings; attachment is validated at MCP attach time.
+- Structured docs saved under `task attachments` should include required section headings; attachment is validated at MCP attach time.
 
 ## 7) Artifact Ownership
 - Keep artifacts owned by the workflow that produces them: