@taskforcehq/taskforce 0.3.169 → 0.3.300

package/dist/core/AuthTokenService.js

@@ -0,0 +1,207 @@
+import { randomBytes } from 'crypto';
+import { TaskforceRuleError } from './types.js';
+import { hashAuthToken, hashPassword, generateUuidV7 } from './shared.js';
+/**
+ * Handles one-time auth token lifecycle (email verification, password reset, invite acceptance)
+ * and the thin read/write helpers for email-verification and password state.
+ */
+export class AuthTokenService {
+    db;
+    tenantId;
+    constructor(db, tenantId) {
+        this.db = db;
+        this.tenantId = tenantId;
+    }
+    generateEntityId(prefix) {
+        return `${prefix}-${generateUuidV7()}`;
+    }
+    // ─── Internal token primitives ────────────────────────────────────────────
+    // Not truly private so that Taskforce.ts invite methods can delegate through
+    // this service without needing to know the DB schema.
+    createOneTimeAuthToken(userId, purpose, ttlSeconds, workspaceId) {
+        const normalizedUserId = String(userId || '').trim();
+        if (!normalizedUserId) {
+            throw new TaskforceRuleError('userId is required', 400, 'USER_ID_REQUIRED');
+        }
+        const normalizedWorkspaceId = String(workspaceId || '').trim() || null;
+        const safeTtl = Math.max(60, Math.floor(Number(ttlSeconds) || 0));
+        const now = new Date();
+        const expiresAt = new Date(now.getTime() + safeTtl * 1000).toISOString();
+        const token = randomBytes(24).toString('hex');
+        const tokenHash = hashAuthToken(token);
+        const tokenId = this.generateEntityId(`auth-${purpose}`);
+        // Keep previously issued tokens valid until they are consumed or expired.
+        // This avoids accidental invalidation when users request a resend and click an older email link.
+        this.db.prepare(`
+            DELETE FROM auth_tokens
+            WHERE tenant_id = ? AND user_id = ? AND purpose = ? AND (used_at IS NOT NULL OR expires_at < ?)
+        `).run(this.tenantId, normalizedUserId, purpose, now.toISOString());
+        this.db.prepare(`
+            INSERT INTO auth_tokens (id, tenant_id, user_id, workspace_id, purpose, token_hash, expires_at, used_at, revoked_at, created_at)
+            VALUES (?, ?, ?, ?, ?, ?, ?, NULL, NULL, ?)
+        `).run(tokenId, this.tenantId, normalizedUserId, normalizedWorkspaceId, purpose, tokenHash, expiresAt, now.toISOString());
+        return token;
+    }
+    consumeOneTimeAuthToken(token, purpose) {
+        const normalized = String(token || '').trim();
+        if (!normalized)
+            return null;
+        const tokenHash = hashAuthToken(normalized);
+        const now = new Date().toISOString();
+        const row = this.db.prepare(`
+            SELECT id, user_id, workspace_id, expires_at, used_at, revoked_at
+            FROM auth_tokens
+            WHERE tenant_id = ? AND purpose = ? AND token_hash = ?
+            LIMIT 1
+        `).get(this.tenantId, purpose, tokenHash);
+        if (!row?.id || !row.user_id || row.used_at || row.revoked_at)
+            return null;
+        if (!row.expires_at || row.expires_at < now)
+            return null;
+        this.db.prepare(`
+            UPDATE auth_tokens
+            SET used_at = ?
+            WHERE tenant_id = ? AND id = ?
+        `).run(now, this.tenantId, row.id);
+        return {
+            userId: row.user_id,
+            workspaceId: row.workspace_id ? String(row.workspace_id) : undefined
+        };
+    }
+    inspectOneTimeAuthToken(token, purpose) {
+        const normalized = String(token || '').trim();
+        if (!normalized)
+            return { state: 'missing' };
+        const tokenHash = hashAuthToken(normalized);
+        const now = new Date().toISOString();
+        const row = this.db.prepare(`
+            SELECT user_id, workspace_id, expires_at, used_at, revoked_at
+            FROM auth_tokens
+            WHERE tenant_id = ? AND purpose = ? AND token_hash = ?
+            LIMIT 1
+        `).get(this.tenantId, purpose, tokenHash);
+        if (!row?.user_id)
+            return { state: 'missing' };
+        const workspaceId = row.workspace_id ? String(row.workspace_id) : undefined;
+        if (row.revoked_at)
+            return { state: 'revoked', userId: row.user_id, workspaceId };
+        if (row.used_at)
+            return { state: 'used', userId: row.user_id, workspaceId };
+        if (!row.expires_at || row.expires_at < now)
+            return { state: 'expired', userId: row.user_id, workspaceId };
+        return { state: 'valid', userId: row.user_id, workspaceId };
+    }
+    // ─── Public methods ───────────────────────────────────────────────────────
+    isEmailVerified(email) {
+        const normalizedEmail = String(email || '').trim().toLowerCase();
+        if (!normalizedEmail)
+            return false;
+        const row = this.db.prepare(`
+            SELECT email_verified_at
+            FROM users
+            WHERE tenant_id = ? AND email = ?
+            LIMIT 1
+        `).get(this.tenantId, normalizedEmail);
+        return Boolean(row?.email_verified_at);
+    }
+    markEmailVerified(email) {
+        const normalizedEmail = String(email || '').trim().toLowerCase();
+        if (!normalizedEmail || !normalizedEmail.includes('@'))
+            return false;
+        const now = new Date().toISOString();
+        const result = this.db.prepare(`
+            UPDATE users
+            SET email_verified_at = COALESCE(email_verified_at, ?), updated_at = ?
+            WHERE tenant_id = ? AND email = ?
+        `).run(now, now, this.tenantId, normalizedEmail);
+        const changed = Number(result?.changes || 0);
+        return changed > 0;
+    }
+    requestEmailVerification(input) {
+        const normalizedEmail = String(input.email || '').trim().toLowerCase();
+        if (!normalizedEmail || !normalizedEmail.includes('@')) {
+            throw new TaskforceRuleError('Valid email is required', 400, 'EMAIL_REQUIRED');
+        }
+        const row = this.db.prepare(`
+            SELECT id, email_verified_at
+            FROM users
+            WHERE tenant_id = ? AND email = ?
+            LIMIT 1
+        `).get(this.tenantId, normalizedEmail);
+        if (!row?.id || row.email_verified_at)
+            return {};
+        const token = this.createOneTimeAuthToken(row.id, 'email_verification', input.ttlSeconds || 60 * 60 * 24);
+        return { token };
+    }
+    verifyEmailWithToken(token) {
+        const consumed = this.consumeOneTimeAuthToken(token, 'email_verification');
+        if (!consumed?.userId)
+            return false;
+        const now = new Date().toISOString();
+        this.db.prepare(`
+            UPDATE users
+            SET email_verified_at = ?, updated_at = ?
+            WHERE tenant_id = ? AND id = ?
+        `).run(now, now, this.tenantId, consumed.userId);
+        return true;
+    }
+    requestPasswordReset(input) {
+        const normalizedEmail = String(input.email || '').trim().toLowerCase();
+        if (!normalizedEmail || !normalizedEmail.includes('@')) {
+            throw new TaskforceRuleError('Valid email is required', 400, 'EMAIL_REQUIRED');
+        }
+        const row = this.db.prepare(`
+            SELECT id
+            FROM users
+            WHERE tenant_id = ? AND email = ?
+            LIMIT 1
+        `).get(this.tenantId, normalizedEmail);
+        if (!row?.id)
+            return {};
+        const token = this.createOneTimeAuthToken(row.id, 'password_reset', input.ttlSeconds || 60 * 60);
+        return { token };
+    }
+    requestInviteAcceptance(input) {
+        const userId = String(input.userId || '').trim();
+        const workspaceId = String(input.workspaceId || '').trim();
+        if (!userId) {
+            throw new TaskforceRuleError('userId is required', 400, 'USER_ID_REQUIRED');
+        }
+        if (!workspaceId) {
+            throw new TaskforceRuleError('workspaceId is required', 400, 'WORKSPACE_ID_REQUIRED');
+        }
+        const user = this.db.prepare(`
+            SELECT id FROM users WHERE tenant_id = ? AND id = ? LIMIT 1
+        `).get(this.tenantId, userId);
+        if (!user?.id) {
+            throw new TaskforceRuleError('User not found', 404, 'USER_NOT_FOUND');
+        }
+        const membership = this.db.prepare(`
+            SELECT workspace_id
+            FROM workspace_memberships
+            WHERE tenant_id = ? AND user_id = ? AND workspace_id = ?
+            LIMIT 1
+        `).get(this.tenantId, userId, workspaceId);
+        if (!membership?.workspace_id) {
+            throw new TaskforceRuleError('Workspace membership not found', 404, 'WORKSPACE_MEMBERSHIP_NOT_FOUND');
+        }
+        const token = this.createOneTimeAuthToken(userId, 'invite_accept', input.ttlSeconds || 60 * 60 * 24 * 7, workspaceId);
+        return { token };
+    }
+    resetPasswordWithToken(input) {
+        const password = String(input.password || '');
+        if (!password || password.length < 8) {
+            throw new TaskforceRuleError('Password must be at least 8 characters', 400, 'PASSWORD_TOO_SHORT');
+        }
+        const consumed = this.consumeOneTimeAuthToken(input.token, 'password_reset');
+        if (!consumed?.userId)
+            return false;
+        const now = new Date().toISOString();
+        this.db.prepare(`
+            UPDATE users
+            SET password_hash = ?, auth_provider = ?, is_disabled = 0, updated_at = ?
+            WHERE tenant_id = ? AND id = ?
+        `).run(hashPassword(password), 'password', now, this.tenantId, consumed.userId);
+        return true;
+    }
+}

package/dist/core/CreatedBy.test.js

@@ -18,7 +18,7 @@ afterEach(() => {
     }
 });
 describe('TaskforceCore - createdBy Field', () => {
-    it('populates createdBy field correctly on creation', () => {
+    it('does not persist new generic AI createdBy values on creation', () => {
         const projectRoot = createProjectRoot();
         createdRoots.push(projectRoot);
         const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
@@ -26,7 +26,25 @@ describe('TaskforceCore - createdBy Field', () => {
             title: 'AI Task',
             createdBy: 'AI Agent'
         });
-        expect(task.createdBy).toBe('AI Agent');
+        expect(task.createdBy).toBeUndefined();
+    });
+    it('preserves legacy generic AI createdBy values when hydrating stored tasks', () => {
+        const projectRoot = createProjectRoot();
+        createdRoots.push(projectRoot);
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const task = core.createTask({ title: 'Legacy AI task' });
+        core.db.prepare(`
+            UPDATE tasks
+            SET created_by = ?
+            WHERE tenant_id = ? AND workspace_id = ? AND id = ?
+        `).run('agent', 'default', 'default', task.id);
+        const hydrated = core.getTask(task.id);
+        expect(hydrated?.createdBy).toBe('agent');
+        expect(hydrated?.createdByActor).toEqual(expect.objectContaining({
+            id: 'agent',
+            kind: 'ai',
+            isNamed: false
+        }));
     });
     it('defaults createdBy to undefined if not provided', () => {
         const projectRoot = createProjectRoot();
@@ -35,7 +53,7 @@ describe('TaskforceCore - createdBy Field', () => {
         const task = core.createTask({ title: 'User Task' });
         expect(task.createdBy).toBeUndefined();
     });
-    it('infers assignee user from [User] title hint when assignee is missing', () => {
+    it('treats legacy [User] title hints as unassigned when assignee is missing', () => {
         const projectRoot = createProjectRoot();
         createdRoots.push(projectRoot);
         const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
@@ -43,9 +61,9 @@ describe('TaskforceCore - createdBy Field', () => {
             title: '[User] Configure backups',
             createdBy: 'AI Agent'
         });
-        expect(task.assignee).toBe('user');
+        expect(task.assignee).toBe('unassigned');
     });
-    it('overrides unassigned with explicit owner hint for compatibility', () => {
+    it('keeps legacy owner hints unassigned for compatibility', () => {
         const projectRoot = createProjectRoot();
         createdRoots.push(projectRoot);
         const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
@@ -55,6 +73,116 @@ describe('TaskforceCore - createdBy Field', () => {
             assignee: 'unassigned',
             createdBy: 'AI Agent'
         });
-        expect(task.assignee).toBe('user');
+        expect(task.assignee).toBe('unassigned');
+    });
+    it('defaults AI-authored tasks to unassigned when no explicit assignee is provided', () => {
+        const projectRoot = createProjectRoot();
+        createdRoots.push(projectRoot);
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const task = core.createTask({
+            title: 'AI-created task',
+            createdBy: 'AI Agent'
+        });
+        expect(task.assignee).toBe('unassigned');
+    });
+    it('repairs unknown member assignees to unassigned', () => {
+        const projectRoot = createProjectRoot();
+        createdRoots.push(projectRoot);
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const task = core.createTask({
+            title: 'Assign to workspace member',
+            assignee: 'member-123',
+            createdBy: 'AI Agent'
+        });
+        expect(task.assignee).toBe('unassigned');
+    });
+    it('normalizes legacy agent assignees to unassigned on create', () => {
+        const projectRoot = createProjectRoot();
+        createdRoots.push(projectRoot);
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const task = core.createTask({
+            title: 'Legacy AI-owned task',
+            assignee: 'agent',
+            createdBy: 'AI Agent'
+        });
+        expect(task.assignee).toBe('unassigned');
+    });
+    it('preserves registered AI profile assignees', () => {
+        const projectRoot = createProjectRoot();
+        createdRoots.push(projectRoot);
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+        const { profile } = core.resolveAiProfile({
+            workspaceId: 'workspace-1',
+            name: 'Codex'
+        });
+        const task = core.createTask({
+            title: 'Assign to Codex',
+            assignee: profile.id
+        }, { workspaceId: 'workspace-1' });
+        expect(task.assignee).toBe(profile.id);
+    });
+    it('self-repairs stored assignees that no longer exist back to unassigned', () => {
+        const projectRoot = createProjectRoot();
+        createdRoots.push(projectRoot);
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+        const { profile } = core.resolveAiProfile({
+            workspaceId: 'workspace-1',
+            name: 'Codex'
+        });
+        const task = core.createTask({
+            title: 'Task with stale assignee',
+            assignee: profile.id
+        }, { workspaceId: 'workspace-1' });
+        core.db.prepare(`
+            UPDATE tasks
+            SET assignee = ?
+            WHERE tenant_id = ? AND workspace_id = ? AND id = ?
+        `).run('ghost-assignee', 'default', 'workspace-1', task.id);
+        const repaired = core.getTask(task.id, 'workspace-1');
+        expect(repaired?.assignee).toBe('unassigned');
+        const persisted = core.db.prepare(`
+            SELECT assignee
+            FROM tasks
+            WHERE tenant_id = ? AND workspace_id = ? AND id = ?
+        `).get('default', 'workspace-1', task.id);
+        expect(persisted?.assignee).toBe('unassigned');
+    });
+    it('normalizes escaped newlines for AI-authored task descriptions on create', () => {
+        const projectRoot = createProjectRoot();
+        createdRoots.push(projectRoot);
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const task = core.createTask({
+            title: 'AI task with escaped description',
+            description: 'Phase 1\\n\\nPhase 2',
+            createdBy: 'AI Agent'
+        });
+        expect(task.description).toBe('Phase 1\n\nPhase 2');
+    });
+    it('preserves literal escaped newlines for manual task descriptions on create', () => {
+        const projectRoot = createProjectRoot();
+        createdRoots.push(projectRoot);
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const task = core.createTask({
+            title: 'Manual task with literal backslashes',
+            description: 'Keep literal \\n\\n text'
+        });
+        expect(task.description).toBe('Keep literal \\n\\n text');
+    });
+    it('normalizes escaped newlines when updating an AI-authored task description', () => {
+        const projectRoot = createProjectRoot();
+        createdRoots.push(projectRoot);
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const task = core.createTask({
+            title: 'AI task to update',
+            createdBy: 'AI Agent'
+        });
+        const updated = core.updateTask(task.id, {
+            description: 'Line 1\\r\\n\\r\\nLine 2',
+            createdBy: 'AI Agent'
+        });
+        expect(updated?.description).toBe('Line 1\n\nLine 2');
+        expect(updated?.createdBy).toBeUndefined();
     });
 });

package/dist/core/DeletedTaskLifecycleService.d.ts

@@ -0,0 +1,33 @@
+import type { DatabaseAdapter } from '../storage/databaseAdapter.js';
+import type { DeletedTaskDetails, DeletedTaskRecord, DeletedTaskSource, TaskActor, TaskItem } from './Taskforce.js';
+export interface DeletedTaskLifecycleServiceDeps {
+    db: DatabaseAdapter;
+    tenantId: string;
+    createRuleError: (message: string, statusCode?: number, code?: string) => Error;
+    generateEntityId: (prefix: string) => string;
+    normalizeWorkspaceId: (workspaceId: string | undefined) => string;
+    resolveWorkspaceActor: (workspaceId: string, actorRef: unknown) => TaskActor | null;
+    sanitizeOrderInDay: (value: unknown) => number | null;
+    sanitizeDateOnly: (value: unknown) => string | null;
+    normalizeTaskEventActor: (actorRef: unknown, workspaceId: string) => {
+        actor: string;
+        actorType: 'human' | 'ai' | 'system';
+        actorProfile: TaskActor | null;
+    };
+}
+export declare function normalizeTaskSnapshotForRestoreService(deps: DeletedTaskLifecycleServiceDeps, task: TaskItem): TaskItem;
+export declare function mapDeletedTaskRowService(deps: DeletedTaskLifecycleServiceDeps, row: Record<string, unknown>): DeletedTaskRecord | null;
+export declare function pruneDeletedTasksService(deps: DeletedTaskLifecycleServiceDeps, workspaceId?: string, nowIso?: string): number;
+export declare function purgeExpiredDeletedTasksService(deps: DeletedTaskLifecycleServiceDeps, workspaceId?: string, retentionDays?: number): number;
+export declare function addDeletedTaskRecordService(deps: DeletedTaskLifecycleServiceDeps, input: {
+    task: TaskItem;
+    workspaceId: string;
+    actor: unknown;
+    source?: DeletedTaskSource;
+    details?: DeletedTaskDetails;
+    deletedAt?: string;
+}): DeletedTaskRecord;
+export declare function listDeletedTasksService(deps: DeletedTaskLifecycleServiceDeps, workspaceId?: string): {
+    deleted: DeletedTaskRecord[];
+};
+export declare function getDeletedTaskService(deps: DeletedTaskLifecycleServiceDeps, id: string, workspaceId?: string): DeletedTaskRecord | null;

package/dist/core/DeletedTaskLifecycleService.js

@@ -0,0 +1,158 @@
+const DELETED_TASK_RETENTION_MS = 90 * 24 * 60 * 60 * 1000;
+function normalizeDeletedTaskDetails(details) {
+    if (!details || typeof details !== 'object' || Array.isArray(details))
+        return {};
+    return details;
+}
+export function normalizeTaskSnapshotForRestoreService(deps, task) {
+    return {
+        ...task,
+        comments: Array.isArray(task.comments) ? task.comments : [],
+        taskEvents: Array.isArray(task.taskEvents) ? task.taskEvents : [],
+        activity: Array.isArray(task.activity) ? task.activity : [],
+        attachments: Array.isArray(task.attachments) ? task.attachments : [],
+        orderInDay: deps.sanitizeOrderInDay(task.orderInDay),
+        scheduledDate: deps.sanitizeDateOnly(task.scheduledDate),
+        dueDate: deps.sanitizeDateOnly(task.dueDate)
+    };
+}
+export function mapDeletedTaskRowService(deps, row) {
+    const workspaceId = deps.normalizeWorkspaceId(typeof row.workspace_id === 'string' ? row.workspace_id : undefined);
+    const actor = String(row.actor || 'system').trim() || 'system';
+    const source = String(row.source || 'system').trim();
+    let details = {};
+    let taskSnapshot = null;
+    try {
+        details = row.details_json ? JSON.parse(String(row.details_json)) : {};
+    }
+    catch {
+        details = {};
+    }
+    try {
+        const parsed = row.task_snapshot_json ? JSON.parse(String(row.task_snapshot_json)) : null;
+        taskSnapshot = parsed && typeof parsed === 'object'
+            ? normalizeTaskSnapshotForRestoreService(deps, parsed)
+            : null;
+    }
+    catch {
+        taskSnapshot = null;
+    }
+    if (!taskSnapshot)
+        return null;
+    return {
+        id: String(row.id || '').trim(),
+        taskId: String(row.task_id || '').trim(),
+        workspaceId,
+        deletedAt: String(row.deleted_at || '').trim(),
+        actor,
+        actorType: row.actor_type === 'ai' || row.actor_type === 'human' || row.actor_type === 'system'
+            ? row.actor_type
+            : 'system',
+        source: source === 'ui' || source === 'mcp' || source === 'sync' || source === 'workspace-delete' ? source : 'system',
+        details,
+        taskSnapshot,
+        actorProfile: actor === 'system' ? null : deps.resolveWorkspaceActor(workspaceId, actor)
+    };
+}
+export function pruneDeletedTasksService(deps, workspaceId, nowIso) {
+    const cutoff = new Date((nowIso ? Date.parse(nowIso) : Date.now()) - DELETED_TASK_RETENTION_MS).toISOString();
+    if (workspaceId) {
+        const normalizedWorkspaceId = deps.normalizeWorkspaceId(workspaceId);
+        const result = deps.db.prepare(`
+            DELETE FROM deleted_tasks
+            WHERE tenant_id = ?
+              AND workspace_id = ?
+              AND deleted_at < ?
+        `).run(deps.tenantId, normalizedWorkspaceId, cutoff);
+        return Number(result?.changes || 0);
+    }
+    const result = deps.db.prepare(`
+        DELETE FROM deleted_tasks
+        WHERE tenant_id = ?
+          AND deleted_at < ?
+    `).run(deps.tenantId, cutoff);
+    return Number(result?.changes || 0);
+}
+export function purgeExpiredDeletedTasksService(deps, workspaceId, retentionDays = 90) {
+    const cutoff = new Date(Date.now() - (retentionDays * 24 * 60 * 60 * 1000)).toISOString();
+    if (typeof workspaceId === 'string' && workspaceId.trim().length > 0) {
+        const normalizedWorkspaceId = deps.normalizeWorkspaceId(workspaceId);
+        const result = deps.db.prepare(`
+            DELETE FROM deleted_tasks
+            WHERE tenant_id = ?
+              AND workspace_id = ?
+              AND deleted_at < ?
+        `).run(deps.tenantId, normalizedWorkspaceId, cutoff);
+        return Number(result?.changes || 0);
+    }
+    const result = deps.db.prepare(`
+        DELETE FROM deleted_tasks
+        WHERE tenant_id = ?
+          AND deleted_at < ?
+    `).run(deps.tenantId, cutoff);
+    return Number(result?.changes || 0);
+}
+export function addDeletedTaskRecordService(deps, input) {
+    const workspaceId = deps.normalizeWorkspaceId(input.workspaceId);
+    const task = normalizeTaskSnapshotForRestoreService(deps, input.task);
+    const deletedAt = String(input.deletedAt || '').trim() || new Date().toISOString();
+    const { actor, actorType } = deps.normalizeTaskEventActor(input.actor, workspaceId);
+    const recordId = deps.generateEntityId('deleted-task');
+    const details = normalizeDeletedTaskDetails(input.details);
+    deps.db.prepare(`
+        INSERT INTO deleted_tasks (
+            id, tenant_id, workspace_id, task_id, deleted_at, actor, actor_type, source, details_json, task_snapshot_json
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        ON CONFLICT (tenant_id, workspace_id, task_id) DO UPDATE SET
+            deleted_at = excluded.deleted_at,
+            actor = excluded.actor,
+            actor_type = excluded.actor_type,
+            source = excluded.source,
+            details_json = excluded.details_json,
+            task_snapshot_json = excluded.task_snapshot_json
+    `).run(recordId, deps.tenantId, workspaceId, task.id, deletedAt, actor, actorType, input.source || 'system', JSON.stringify(details), JSON.stringify(task));
+    const stored = deps.db.prepare(`
+        SELECT *
+        FROM deleted_tasks
+        WHERE tenant_id = ? AND workspace_id = ? AND task_id = ?
+        LIMIT 1
+    `).get(deps.tenantId, workspaceId, task.id);
+    const mapped = stored ? mapDeletedTaskRowService(deps, stored) : null;
+    if (!mapped) {
+        throw deps.createRuleError('Failed to persist deleted task history', 500, 'DELETED_TASK_PERSIST_FAILED');
+    }
+    return mapped;
+}
+export function listDeletedTasksService(deps, workspaceId) {
+    const normalizedWorkspaceId = deps.normalizeWorkspaceId(workspaceId);
+    purgeExpiredDeletedTasksService(deps, normalizedWorkspaceId);
+    const rows = deps.db.prepare(`
+        SELECT *
+        FROM deleted_tasks
+        WHERE tenant_id = ?
+          AND workspace_id = ?
+        ORDER BY deleted_at DESC, id DESC
+    `).all(deps.tenantId, normalizedWorkspaceId);
+    return {
+        deleted: rows
+            .map((row) => mapDeletedTaskRowService(deps, row))
+            .filter((row) => Boolean(row))
+    };
+}
+export function getDeletedTaskService(deps, id, workspaceId) {
+    const normalizedWorkspaceId = deps.normalizeWorkspaceId(workspaceId);
+    const normalizedId = String(id || '').trim();
+    if (!normalizedId)
+        return null;
+    purgeExpiredDeletedTasksService(deps, normalizedWorkspaceId);
+    const row = deps.db.prepare(`
+        SELECT *
+        FROM deleted_tasks
+        WHERE tenant_id = ?
+          AND workspace_id = ?
+          AND (id = ? OR task_id = ?)
+        ORDER BY deleted_at DESC, id DESC
+        LIMIT 1
+    `).get(deps.tenantId, normalizedWorkspaceId, normalizedId, normalizedId);
+    return row ? mapDeletedTaskRowService(deps, row) : null;
+}

package/dist/core/DeletedTaskTrash.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/DeletedTaskTrash.test.js

@@ -0,0 +1,104 @@
+import { describe, expect, it } from 'vitest';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { TaskforceCore } from './Taskforce';
+function makeCore() {
+    const projectRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-deleted-'));
+    const core = new TaskforceCore({
+        projectRoot,
+        storagePath: path.join(projectRoot, '.taskforce')
+    });
+    return {
+        core,
+        cleanup: () => {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    };
+}
+describe('TaskforceCore deleted task lifecycle', () => {
+    it('moves deleted tasks into deleted-task history with actor, source, and snapshot data', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            const task = core.createTask({
+                title: 'Trash me',
+                description: 'Forensics matter',
+                createdBy: 'user'
+            }, { workspaceId: 'workspace-a', actorRef: 'user' });
+            const deleted = core.softDeleteTask(task.id, 'workspace-a', { actorRef: 'user', source: 'ui' });
+            expect(deleted).toEqual(expect.objectContaining({
+                taskId: task.id,
+                source: 'ui',
+                actor: 'user',
+                actorType: 'human',
+                taskSnapshot: expect.objectContaining({
+                    id: task.id,
+                    title: 'Trash me',
+                    description: 'Forensics matter'
+                })
+            }));
+            expect(core.getTask(task.id, 'workspace-a')).toBeNull();
+            expect(core.listDeletedTasks('workspace-a').deleted).toHaveLength(1);
+        }
+        finally {
+            cleanup();
+        }
+    });
+    it('restores a deleted task back into active tasks and removes it from deleted-task history', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            const task = core.createTask({
+                title: 'Bring me back',
+                comments: [{ id: 'comment-1', author: 'user', text: 'Keep this note', timestamp: '2026-03-22T10:00:00.000Z' }],
+                createdBy: 'user'
+            }, { workspaceId: 'workspace-a', actorRef: 'user' });
+            const deleted = core.softDeleteTask(task.id, 'workspace-a', { actorRef: 'user', source: 'ui' });
+            const restored = core.restoreDeletedTask(deleted.id, 'workspace-a', { actorRef: 'user' });
+            expect(restored).toEqual(expect.objectContaining({
+                id: task.id,
+                title: 'Bring me back',
+                comments: expect.arrayContaining([
+                    expect.objectContaining({ text: 'Keep this note' })
+                ])
+            }));
+            expect(core.listDeletedTasks('workspace-a').deleted).toHaveLength(0);
+            expect(core.getTask(task.id, 'workspace-a')).not.toBeNull();
+            expect(core.listTaskEvents(task.id, 'workspace-a').map((event) => event.action)).toContain('task-restored');
+        }
+        finally {
+            cleanup();
+        }
+    });
+    it('purges deleted task records older than the retention window', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            const staleTask = core.createTask({
+                title: 'Old deleted task',
+                createdBy: 'user'
+            }, { workspaceId: 'workspace-a', actorRef: 'user' });
+            const freshTask = core.createTask({
+                title: 'Fresh deleted task',
+                createdBy: 'user'
+            }, { workspaceId: 'workspace-a', actorRef: 'user' });
+            const staleDeleted = core.softDeleteTask(staleTask.id, 'workspace-a', { actorRef: 'user', source: 'ui' });
+            const freshDeleted = core.softDeleteTask(freshTask.id, 'workspace-a', { actorRef: 'user', source: 'ui' });
+            const staleDeletedAt = new Date(Date.now() - (91 * 24 * 60 * 60 * 1000)).toISOString();
+            core.db.prepare(`
+                UPDATE deleted_tasks
+                SET deleted_at = ?
+                WHERE tenant_id = ? AND workspace_id = ? AND task_id = ?
+            `).run(staleDeletedAt, core.getTenantId(), 'workspace-a', staleTask.id);
+            const listed = core.listDeletedTasks('workspace-a').deleted;
+            expect(listed).toHaveLength(1);
+            expect(listed[0]?.taskId).toBe(freshTask.id);
+            expect(core.getDeletedTask(staleDeleted.id, 'workspace-a')).toBeNull();
+            expect(core.getDeletedTask(freshDeleted.id, 'workspace-a')).toEqual(expect.objectContaining({
+                taskId: freshTask.id
+            }));
+        }
+        finally {
+            cleanup();
+        }
+    });
+});