@taskforcehq/taskforce 0.3.169 → 0.3.300

package/dist/server/documentReviewRoutes.test.js

@@ -0,0 +1,157 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import { Readable, Writable } from 'stream';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { TaskforceCore } from '../core/Taskforce.js';
+import { createRoutes, matchRoute } from './routes.js';
+function createProjectRoot() {
+    return fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-document-review-routes-'));
+}
+function createMockReq(method, url, body, headers) {
+    const req = new Readable();
+    req._read = () => { };
+    if (body === undefined) {
+        req.push(null);
+    }
+    else {
+        req.push(JSON.stringify(body));
+        req.push(null);
+    }
+    req.method = method;
+    req.url = url;
+    req.headers = headers || {};
+    return req;
+}
+function createMockRes() {
+    const bodyChunks = [];
+    const headers = new Map();
+    const res = new Writable({
+        write(chunk, _encoding, callback) {
+            bodyChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+            callback();
+        }
+    });
+    res.statusCode = 200;
+    res.writeHead = ((statusCode, nextHeaders) => {
+        res.statusCode = statusCode;
+        if (nextHeaders) {
+            for (const [key, value] of Object.entries(nextHeaders)) {
+                headers.set(key.toLowerCase(), value);
+            }
+        }
+        return res;
+    });
+    res.setHeader = ((name, value) => {
+        headers.set(name.toLowerCase(), value);
+    });
+    res.getHeader = ((name) => headers.get(name.toLowerCase()));
+    const originalEnd = res.end.bind(res);
+    res.end = ((chunk) => {
+        if (chunk !== undefined) {
+            bodyChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+        }
+        return originalEnd();
+    });
+    res.__getBody = () => Buffer.concat(bodyChunks).toString('utf8');
+    return res;
+}
+describe('document review routes', () => {
+    afterEach(() => {
+        // no-op
+    });
+    it('creates, lists, updates, and comments on document review sessions', async () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({
+            projectRoot,
+            storagePath: path.join(projectRoot, '.taskforce'),
+        });
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+            const now = new Date().toISOString();
+            core.db.prepare(`
+                INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, beta_access, is_disabled, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            `).run('user-local-1', core.getTenantId(), 'local@example.com', 'Local User', 'local', 'user-local-1', 1, 0, now, now);
+            core.db.prepare(`
+                INSERT INTO workspace_memberships (id, tenant_id, workspace_id, user_id, role, status, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+            `).run('membership-local-1', core.getTenantId(), 'workspace-1', 'user-local-1', 'owner', 'active', now, now);
+            const assetStore = core.getWorkspaceAssetStore();
+            assetStore.upsertAsset({
+                assetId: 'asset-doc-1',
+                workspaceId: 'workspace-1',
+                kind: 'document',
+                originalFilename: 'implementation-plan.md',
+                logicalName: 'Implementation Plan',
+                mimeType: 'text/markdown',
+                storageProvider: 'local',
+                storageKey: 'workspaces/workspace-1/assets/documents/asset-doc-1-implementation-plan.md',
+                contentSha256: 'sha-doc-1',
+                sizeBytes: 512,
+                documentId: 'doc-1',
+                version: 3,
+            });
+            const routes = createRoutes(core);
+            const createReq = createMockReq('POST', '/api/taskforce/document-reviews/sessions?workspaceId=workspace-1', {
+                assetId: 'asset-doc-1',
+                title: 'Review round 1',
+            }, { 'x-taskforce-user-id': 'user-local-1' });
+            const createRes = createMockRes();
+            await matchRoute('POST', '/api/taskforce/document-reviews/sessions', routes)?.handler(createReq, createRes, {});
+            expect(createRes.statusCode).toBe(200);
+            const created = JSON.parse(createRes.__getBody());
+            expect(created.session).toMatchObject({
+                assetId: 'asset-doc-1',
+                documentId: 'doc-1',
+                documentVersion: 3,
+                title: 'Review round 1',
+                status: 'open',
+            });
+            const sessionId = String(created.session.id);
+            const commentReq = createMockReq('POST', `/api/taskforce/document-reviews/sessions/${sessionId}/comments?workspaceId=workspace-1`, {
+                body: 'Please tighten the rollout section.',
+                anchor: { kind: 'line-range', startLine: 18, endLine: 24 },
+            }, { 'x-taskforce-user-id': 'user-local-1' });
+            const commentRes = createMockRes();
+            await matchRoute('POST', `/api/taskforce/document-reviews/sessions/${sessionId}/comments`, routes)?.handler(commentReq, commentRes, { id: sessionId });
+            expect(commentRes.statusCode).toBe(200);
+            const commented = JSON.parse(commentRes.__getBody());
+            expect(commented.session.comments).toHaveLength(1);
+            expect(commented.session.comments[0]).toMatchObject({
+                body: 'Please tighten the rollout section.',
+                anchor: { kind: 'line-range', startLine: 18, endLine: 24 },
+                authorActorId: 'user-local-1',
+                authorActor: expect.objectContaining({
+                    id: 'user-local-1',
+                }),
+            });
+            const commentId = String(commented.session.comments[0].id);
+            const patchReq = createMockReq('PATCH', `/api/taskforce/document-reviews/sessions/${sessionId}/comments/${commentId}?workspaceId=workspace-1`, {
+                body: 'Please tighten the rollout and ownership sections.',
+            }, { 'x-taskforce-user-id': 'user-local-1' });
+            const patchRes = createMockRes();
+            await matchRoute('PATCH', `/api/taskforce/document-reviews/sessions/${sessionId}/comments/${commentId}`, routes)?.handler(patchReq, patchRes, { id: sessionId, commentId });
+            expect(patchRes.statusCode).toBe(200);
+            const patched = JSON.parse(patchRes.__getBody());
+            expect(patched.session.comments[0].body).toBe('Please tighten the rollout and ownership sections.');
+            const listReq = createMockReq('GET', '/api/taskforce/document-reviews/sessions?workspaceId=workspace-1&assetId=asset-doc-1');
+            const listRes = createMockRes();
+            await matchRoute('GET', '/api/taskforce/document-reviews/sessions', routes)?.handler(listReq, listRes, {});
+            expect(listRes.statusCode).toBe(200);
+            const listed = JSON.parse(listRes.__getBody());
+            expect(listed.sessions).toHaveLength(1);
+            expect(listed.sessions[0].id).toBe(sessionId);
+            const deleteCommentReq = createMockReq('DELETE', `/api/taskforce/document-reviews/sessions/${sessionId}/comments/${commentId}?workspaceId=workspace-1`, undefined, { 'x-taskforce-user-id': 'user-local-1' });
+            const deleteCommentRes = createMockRes();
+            await matchRoute('DELETE', `/api/taskforce/document-reviews/sessions/${sessionId}/comments/${commentId}`, routes)?.handler(deleteCommentReq, deleteCommentRes, { id: sessionId, commentId });
+            expect(deleteCommentRes.statusCode).toBe(200);
+            const afterDelete = JSON.parse(deleteCommentRes.__getBody());
+            expect(afterDelete.session.comments).toHaveLength(0);
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+});

package/dist/server/index.cookieProxy.test.js

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest';
-import { rewriteProxySetCookieForLocalHost, shouldRewriteSetCookieForLocalDevHost } from './index';
+import { applyCloudProxyForwardedHeaders, resolveCloudProxyBaseUrl, resolveCloudProxyUpstreamBaseUrl, rewriteProxySetCookieForLocalHost, shouldProxyCloudPath, shouldRewriteSetCookieForLocalDevHost, TASKFORCE_PROXY_CLOUD_ENVIRONMENT_HEADER, TASKFORCE_PROXY_ORIGIN_BASE_URL_HEADER, TASKFORCE_PROXY_ORIGIN_HOST_HEADER, TASKFORCE_PROXY_ORIGIN_PROTO_HEADER, TASKFORCE_PROXY_ORIGIN_RUNTIME_HEADER } from './index';
 describe('proxy cookie rewrite helpers', () => {
     it('detects local dev hosts', () => {
         expect(shouldRewriteSetCookieForLocalDevHost('localhost:5174')).toBe(true);
@@ -16,4 +16,49 @@ describe('proxy cookie rewrite helpers', () => {
         expect(rewritten).toContain('SameSite=None');
         expect(rewritten.toLowerCase()).not.toContain('domain=');
     });
+    it('includes public pricing in the local cloud proxy path set', () => {
+        expect(shouldProxyCloudPath('/api/taskforce/public/pricing')).toBe(true);
+        expect(shouldProxyCloudPath('/api/taskforce/public/site-config')).toBe(true);
+        expect(shouldProxyCloudPath('/api/taskforce/public/site-config-script')).toBe(true);
+        expect(shouldProxyCloudPath('/api/taskforce/version')).toBe(true);
+        expect(shouldProxyCloudPath('/api/taskforce/account/entitlements')).toBe(true);
+        expect(shouldProxyCloudPath('/api/taskforce/admin/mcp-audit-logs')).toBe(true);
+        expect(shouldProxyCloudPath('/api/taskforce/billing/status')).toBe(true);
+        expect(shouldProxyCloudPath('/api/taskforce/billing/checkout-session')).toBe(true);
+        expect(shouldProxyCloudPath('/api/taskforce/auth/session')).toBe(true);
+        expect(shouldProxyCloudPath('/api/taskforce/workspace/assignee-options')).toBe(false);
+        expect(shouldProxyCloudPath('/api/taskforce/settings/mcp/tokens')).toBe(true);
+        expect(shouldProxyCloudPath('/api/taskforce/settings/mcp/test-connection')).toBe(true);
+        expect(shouldProxyCloudPath('/api/platform/plans')).toBe(true);
+        expect(shouldProxyCloudPath('/api/taskforce/sync/workspace/apply-local')).toBe(false);
+        expect(shouldProxyCloudPath('/api/taskforce/sync/workspace/documents')).toBe(false);
+        expect(shouldProxyCloudPath('/api/taskforce/sync/workspace/assets')).toBe(false);
+        expect(shouldProxyCloudPath('/api/taskforce/sync/events')).toBe(false);
+        expect(shouldProxyCloudPath('/api/taskforce/auth/runtime-config')).toBe(false);
+    });
+    it('defaults local cloud proxy base url to production when no env is configured', () => {
+        expect(resolveCloudProxyBaseUrl({})).toBe('https://app.taskforcehq.ai');
+    });
+    it('allows proxied requests to override the upstream environment per request', () => {
+        const req = {
+            headers: {
+                [TASKFORCE_PROXY_CLOUD_ENVIRONMENT_HEADER]: 'performance'
+            }
+        };
+        expect(resolveCloudProxyUpstreamBaseUrl(req, 'https://app.taskforcehq.ai')).toBe('https://performance-app.taskforcehq.ai');
+        expect(resolveCloudProxyUpstreamBaseUrl({ headers: {} }, 'https://app.taskforcehq.ai')).toBe('https://app.taskforcehq.ai');
+    });
+    it('preserves the original local host and protocol for proxied cloud requests', () => {
+        const headers = new Headers();
+        applyCloudProxyForwardedHeaders(headers, {
+            headers: { host: 'localhost:5174' },
+            socket: { encrypted: false }
+        });
+        expect(headers.get('x-forwarded-host')).toBe('localhost:5174');
+        expect(headers.get('x-forwarded-proto')).toBe('http');
+        expect(headers.get(TASKFORCE_PROXY_ORIGIN_HOST_HEADER)).toBe('localhost:5174');
+        expect(headers.get(TASKFORCE_PROXY_ORIGIN_PROTO_HEADER)).toBe('http');
+        expect(headers.get(TASKFORCE_PROXY_ORIGIN_BASE_URL_HEADER)).toBe('http://localhost:5174');
+        expect(headers.get(TASKFORCE_PROXY_ORIGIN_RUNTIME_HEADER)).toBe('local-proxy');
+    });
 });

package/dist/server/index.d.ts

@@ -5,13 +5,33 @@
  * Serves pre-built static UI and provides API endpoints.
  */
 import * as http from 'http';
+import { TaskforceCore } from '../core/Taskforce.js';
+import type { RequestAccessContext } from './auth.js';
 export interface StandaloneServerOptions {
     projectRoot: string;
     port: number;
 }
+export declare const TASKFORCE_PROXY_ORIGIN_HOST_HEADER = "x-taskforce-origin-host";
+export declare const TASKFORCE_PROXY_ORIGIN_PROTO_HEADER = "x-taskforce-origin-proto";
+export declare const TASKFORCE_PROXY_ORIGIN_BASE_URL_HEADER = "x-taskforce-origin-base-url";
+export declare const TASKFORCE_PROXY_ORIGIN_RUNTIME_HEADER = "x-taskforce-origin-runtime";
+export declare const TASKFORCE_PROXY_CLOUD_ENVIRONMENT_HEADER = "x-taskforce-cloud-environment";
+interface AuthorizedRequestAccess extends RequestAccessContext {
+    disabled?: boolean;
+}
+export declare function shouldProxyCloudPath(pathname: string): boolean;
+export declare function resolveCloudProxyUpstreamBaseUrl(req: http.IncomingMessage, fallbackBaseUrl: string): string;
+export declare function resolveAuthorizedWorkspaceAccess(core: Pick<TaskforceCore, 'resolveUserAccess' | 'getSystemRole'>, access: AuthorizedRequestAccess, requestedWorkspaceId: string): AuthorizedRequestAccess;
+export declare function resolveMaxPayloadBytesForPath(pathname: string, defaultMaxBytes: number): number;
 export declare function shouldRewriteSetCookieForLocalDevHost(hostHeader: string | undefined): boolean;
+export declare function writeJsonErrorIfPossible(res: http.ServerResponse, statusCode: number, payload: Record<string, unknown>): boolean;
+export declare function applyCloudProxyForwardedHeaders(headers: Headers, req: http.IncomingMessage): void;
 export declare function rewriteProxySetCookieForLocalHost(cookie: string): string;
 export declare function shouldApplyAuthRateLimitForPath(pathname: string): boolean;
+export declare function resolveCloudProxyBaseUrl(env?: NodeJS.ProcessEnv): string;
 export declare function ensureBillingWebhookAuthExclusion(excludedPaths: string[]): string[];
+export declare function ensurePublicPricingAuthExclusion(excludedPaths: string[]): string[];
+export declare function ensurePublicSiteConfigAuthExclusion(excludedPaths: string[]): string[];
 export declare function isBillingWebhookPath(pathname: string): boolean;
 export declare function createStandaloneServer(options: StandaloneServerOptions): http.Server<typeof http.IncomingMessage, typeof http.ServerResponse>;
+export {};

package/dist/server/index.js

@@ -23,9 +23,11 @@ import { purgeExpiredDocuments } from '../storage/documentPurge.js';
 import { scanDocumentIntegrity } from '../storage/documentIntegrity.js';
 import { resolveStorageIntegrityScheduleSettings, shouldRunStorageIntegritySchedule } from '../storage/integritySchedule.js';
 import { TaskAssetStore } from '../storage/taskAssetStore.js';
-import { DocumentRegistry } from '../storage/documentRegistry.js';
-import { assertEnvironment } from '../config/envSchema.js';
+import { WorkspaceAssetStore } from '../storage/workspaceAssetStore.js';
+import { validateEnvironment } from '../config/envSchema.js';
 import { createRealtimeSyncWsManager } from './realtimeSyncWs.js';
+import { resolveDeploymentConfig } from '../config/deployment.js';
+import { TASKFORCE_CLOUD_ENVIRONMENTS, parseTaskforceCloudEnvironment } from '../config/cloudEnvironment.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const MIME_TYPES = {
@@ -82,12 +84,73 @@ const CORS_RESPONSE_HEADERS = new Set([
     'access-control-max-age',
     'vary'
 ]);
-function shouldProxyCloudPath(pathname) {
+export const TASKFORCE_PROXY_ORIGIN_HOST_HEADER = 'x-taskforce-origin-host';
+export const TASKFORCE_PROXY_ORIGIN_PROTO_HEADER = 'x-taskforce-origin-proto';
+export const TASKFORCE_PROXY_ORIGIN_BASE_URL_HEADER = 'x-taskforce-origin-base-url';
+export const TASKFORCE_PROXY_ORIGIN_RUNTIME_HEADER = 'x-taskforce-origin-runtime';
+export const TASKFORCE_PROXY_CLOUD_ENVIRONMENT_HEADER = 'x-taskforce-cloud-environment';
+export function shouldProxyCloudPath(pathname) {
     if (!pathname)
         return false;
     if (pathname === '/api/taskforce/auth/runtime-config')
         return false;
-    return pathname.startsWith('/api/taskforce/auth/') || pathname.startsWith('/api/taskforce/sync/');
+    if (pathname === '/api/taskforce/sync/workspace/apply-local')
+        return false;
+    if (pathname === '/api/taskforce/sync/workspace/documents')
+        return false;
+    if (pathname === '/api/taskforce/sync/workspace/assets')
+        return false;
+    if (pathname === '/api/taskforce/sync/workspace/ai-profiles')
+        return false;
+    if (pathname === '/api/taskforce/sync/events')
+        return false;
+    return pathname === PUBLIC_PRICING_PATH
+        || pathname === PUBLIC_SITE_CONFIG_PATH
+        || pathname === PUBLIC_SITE_CONFIG_SCRIPT_PATH
+        || pathname === '/api/taskforce/version'
+        || pathname === '/api/taskforce/account/entitlements'
+        || pathname.startsWith('/api/taskforce/admin/')
+        || pathname.startsWith('/api/taskforce/billing/')
+        || pathname.startsWith('/api/taskforce/auth/')
+        || pathname.startsWith('/api/taskforce/settings/mcp/')
+        || pathname.startsWith('/api/platform/')
+        || pathname.startsWith('/api/taskforce/sync/');
+}
+export function resolveCloudProxyUpstreamBaseUrl(req, fallbackBaseUrl) {
+    const requestedEnvironment = parseTaskforceCloudEnvironment(req.headers[TASKFORCE_PROXY_CLOUD_ENVIRONMENT_HEADER]);
+    if (!requestedEnvironment)
+        return fallbackBaseUrl;
+    return TASKFORCE_CLOUD_ENVIRONMENTS[requestedEnvironment].appBaseUrl;
+}
+export function resolveAuthorizedWorkspaceAccess(core, access, requestedWorkspaceId) {
+    if (!access.authenticated || !access.userId || access.userId === 'anonymous')
+        return access;
+    const trimmedRequestedWorkspaceId = String(requestedWorkspaceId || '').trim();
+    const candidateWorkspaceIds = [
+        trimmedRequestedWorkspaceId,
+        String(access.workspaceId || '').trim()
+    ].filter((workspaceId, index, values) => Boolean(workspaceId) && values.indexOf(workspaceId) === index);
+    for (const workspaceId of candidateWorkspaceIds) {
+        const resolved = core.resolveUserAccess(access.userId, workspaceId, access.role);
+        if (!resolved)
+            continue;
+        return {
+            ...access,
+            role: resolved.role,
+            workspaceId: resolved.workspaceId,
+            userId: resolved.userId,
+            systemRole: core.getSystemRole(resolved.userId),
+            disabled: resolved.disabled
+        };
+    }
+    return access;
+}
+export function resolveMaxPayloadBytesForPath(pathname, defaultMaxBytes) {
+    if (pathname.startsWith('/api/taskforce/sync/')) {
+        // Sync routes (especially applying local changes) often include large binary attachments
+        return Math.max(defaultMaxBytes, 50 * 1024 * 1024);
+    }
+    return defaultMaxBytes;
 }
 export function shouldRewriteSetCookieForLocalDevHost(hostHeader) {
     const host = String(hostHeader || '').trim().toLowerCase();
@@ -96,6 +159,31 @@ export function shouldRewriteSetCookieForLocalDevHost(hostHeader) {
     const hostname = host.replace(/:\d+$/, '');
     return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1' || hostname === '[::1]';
 }
+export function writeJsonErrorIfPossible(res, statusCode, payload) {
+    if (res.headersSent || res.writableEnded)
+        return false;
+    res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(payload));
+    return true;
+}
+export function applyCloudProxyForwardedHeaders(headers, req) {
+    const originalHost = String(req.headers.host || '').trim();
+    const proto = String(req.headers['x-forwarded-proto'] || '').trim().toLowerCase() === 'https'
+        ? 'https'
+        : (req.socket?.encrypted ? 'https' : 'http');
+    if (originalHost && !headers.has('x-forwarded-host')) {
+        headers.set('x-forwarded-host', originalHost);
+    }
+    if (!headers.has('x-forwarded-proto')) {
+        headers.set('x-forwarded-proto', proto);
+    }
+    if (originalHost) {
+        headers.set(TASKFORCE_PROXY_ORIGIN_HOST_HEADER, originalHost);
+        headers.set(TASKFORCE_PROXY_ORIGIN_PROTO_HEADER, proto);
+        headers.set(TASKFORCE_PROXY_ORIGIN_BASE_URL_HEADER, `${proto}://${originalHost.replace(/\/+$/, '')}`);
+        headers.set(TASKFORCE_PROXY_ORIGIN_RUNTIME_HEADER, 'local-proxy');
+    }
+}
 export function rewriteProxySetCookieForLocalHost(cookie) {
     const parts = String(cookie || '').split(';').map((part) => part.trim()).filter(Boolean);
     if (parts.length === 0)
@@ -120,34 +208,66 @@ async function readRequestBody(req, maxBytes) {
 export function shouldApplyAuthRateLimitForPath(pathname) {
     const normalizedPath = String(pathname || '').trim();
     return normalizedPath.startsWith('/api/taskforce/auth/')
-        && normalizedPath !== '/api/taskforce/auth/session';
+        && normalizedPath !== '/api/taskforce/auth/session'
+        && normalizedPath !== '/api/taskforce/auth/runtime-config'
+        && normalizedPath !== '/api/taskforce/auth/admin-session';
 }
 const BILLING_WEBHOOK_PATH = '/api/taskforce/billing/webhook';
+const PUBLIC_PRICING_PATH = '/api/taskforce/public/pricing';
+const PUBLIC_SITE_CONFIG_PATH = '/api/taskforce/public/site-config';
+const PUBLIC_SITE_CONFIG_SCRIPT_PATH = '/api/taskforce/public/site-config-script';
+export function resolveCloudProxyBaseUrl(env = process.env) {
+    return resolveDeploymentConfig(env).cloudBaseUrl || TASKFORCE_CLOUD_ENVIRONMENTS.production.appBaseUrl;
+}
 export function ensureBillingWebhookAuthExclusion(excludedPaths) {
     if (excludedPaths.includes(BILLING_WEBHOOK_PATH))
         return excludedPaths;
     return [...excludedPaths, BILLING_WEBHOOK_PATH];
 }
+export function ensurePublicPricingAuthExclusion(excludedPaths) {
+    if (excludedPaths.includes(PUBLIC_PRICING_PATH))
+        return excludedPaths;
+    return [...excludedPaths, PUBLIC_PRICING_PATH];
+}
+export function ensurePublicSiteConfigAuthExclusion(excludedPaths) {
+    const next = excludedPaths.includes(PUBLIC_SITE_CONFIG_PATH)
+        ? excludedPaths
+        : [...excludedPaths, PUBLIC_SITE_CONFIG_PATH];
+    if (next.includes(PUBLIC_SITE_CONFIG_SCRIPT_PATH))
+        return next;
+    return [...next, PUBLIC_SITE_CONFIG_SCRIPT_PATH];
+}
 export function isBillingWebhookPath(pathname) {
     return String(pathname || '').trim() === BILLING_WEBHOOK_PATH;
 }
 export function createStandaloneServer(options) {
-    assertEnvironment(process.env, { target: 'server', strictUnknown: true });
+    const envValidation = validateEnvironment(process.env, { target: 'server', strictUnknown: true });
+    if (!envValidation.ok) {
+        const details = envValidation.errors.map((entry) => `- ${entry}`).join('\n');
+        throw new Error(`Environment validation failed:\n${details}`);
+    }
+    for (const warning of envValidation.warnings) {
+        console.warn(`[Taskforce env] ${warning}`);
+    }
     const db = resolveDatabaseConfigFromEnv();
     const runtimeMode = resolveRuntimeModeFromEnv(process.env, db.provider);
     assertCloudDatabaseProvider(runtimeMode, db.provider, process.env);
     const core = new TaskforceCore({
         projectRoot: options.projectRoot,
         tenantId: process.env.TASKFORCE_TENANT_ID || 'default',
+        runtimeMode,
         database: {
             provider: db.provider,
             connectionString: db.connectionString
         }
     });
     const { basePath } = core.getPaths();
-    const taskAssetStore = new TaskAssetStore(core.getDatabaseAdapter(), core.getTenantId(), basePath, new DocumentRegistry(basePath));
+    const taskAssetStore = new TaskAssetStore(core.getDatabaseAdapter(), core.getTenantId());
+    const workspaceAssetStore = new WorkspaceAssetStore(core.getDatabaseAdapter(), core.getTenantId());
     const authConfig = resolveAuthConfigFromEnv(runtimeMode, process.env);
     authConfig.excludedPaths = ensureBillingWebhookAuthExclusion(authConfig.excludedPaths);
+    authConfig.excludedPaths = ensurePublicPricingAuthExclusion(authConfig.excludedPaths);
+    authConfig.excludedPaths = ensurePublicSiteConfigAuthExclusion(authConfig.excludedPaths);
     const objectStorage = resolveObjectStorageConfigFromEnv(process.env);
     const resolveEffectiveObjectStorage = () => {
         if (objectStorage.provider !== 'r2' || !objectStorage.r2)
@@ -159,13 +279,14 @@ export function createStandaloneServer(options) {
         const keyPrefixRaw = typeof storageSettings.keyPrefix === 'string'
             ? storageSettings.keyPrefix.trim().replace(/^\/+|\/+$/g, '')
             : '';
+        const hasKeyPrefixOverride = typeof storageSettings.keyPrefix === 'string';
         const uploadTtlRaw = Number(storageSettings.signedUploadTtlSeconds);
         const downloadTtlRaw = Number(storageSettings.signedDownloadTtlSeconds);
         return {
             provider: 'r2',
             r2: {
                 ...objectStorage.r2,
-                keyPrefix: keyPrefixRaw || objectStorage.r2.keyPrefix,
+                keyPrefix: hasKeyPrefixOverride ? keyPrefixRaw : objectStorage.r2.keyPrefix,
                 signedUploadTtlSeconds: Number.isFinite(uploadTtlRaw) && uploadTtlRaw > 0
                     ? Math.floor(uploadTtlRaw)
                     : objectStorage.r2.signedUploadTtlSeconds,
@@ -180,7 +301,7 @@ export function createStandaloneServer(options) {
         objectStorage: resolveEffectiveObjectStorage()
     });
     const allowedOrigins = getAllowedOriginsFromEnv(process.env.TASKFORCE_ALLOWED_ORIGINS);
-    const cloudProxyBaseUrl = String(process.env.TASKFORCE_CLOUD_PROXY_BASE_URL || '').trim().replace(/\/+$/, '');
+    const cloudProxyBaseUrl = resolveCloudProxyBaseUrl(process.env);
     const cloudProxyEnabled = runtimeMode === 'local' && Boolean(cloudProxyBaseUrl);
     const cloudProxyClientId = String(process.env.TASKFORCE_CF_ACCESS_CLIENT_ID || process.env.CF_ACCESS_CLIENT_ID || '').trim();
     const cloudProxyClientSecret = String(process.env.TASKFORCE_CF_ACCESS_CLIENT_SECRET || process.env.CF_ACCESS_CLIENT_SECRET || '').trim();
@@ -291,8 +412,8 @@ export function createStandaloneServer(options) {
     // Standalone UI source now lives in apps/app and builds to dist/ui.
     // When built: dist/server/index.js -> dist/ui/
     // When source: src/server/index.ts -> dist/ui/
-    const uiResolution = resolveStaticUiPath();
-    const distUiPath = uiResolution.uiPath;
+    let uiResolution = resolveStaticUiPath();
+    let distUiPath = uiResolution.uiPath;
     if (distUiPath) {
         console.log(`[Taskforce] Serving static files from: ${distUiPath}`);
     }
@@ -343,8 +464,13 @@ export function createStandaloneServer(options) {
     const integritySchedulePollMinutes = readPositiveInteger(process.env.TASKFORCE_STORAGE_INTEGRITY_SCHEDULE_POLL_MINUTES, 1);
     console.log(`[Taskforce] Storage integrity scheduler poll: every ${integritySchedulePollMinutes} minute(s)`);
     const server = http.createServer(async (req, res) => {
+        if (!distUiPath) {
+            uiResolution = resolveStaticUiPath();
+            distUiPath = uiResolution.uiPath;
+        }
         const url = new URL(req.url || '/', `http://localhost`);
-        applySecurityHeaders(res, runtimeMode);
+        const isMcpPath = url.pathname === '/mcp' || url.pathname === '/mcp/' || url.pathname.startsWith('/mcp/');
+        applySecurityHeaders(res, runtimeMode, process.env);
         // Handle CORS preflight
         if (req.method === 'OPTIONS') {
             const cors = applyCorsHeaders(req, res, allowedOrigins);
@@ -367,25 +493,31 @@ export function createStandaloneServer(options) {
             }
             try {
                 const method = String(req.method || 'GET').toUpperCase();
-                const upstreamUrl = `${cloudProxyBaseUrl}${url.pathname}${url.search || ''}`;
+                const upstreamBaseUrl = resolveCloudProxyUpstreamBaseUrl(req, cloudProxyBaseUrl);
+                const upstreamUrl = `${upstreamBaseUrl}${url.pathname}${url.search || ''}`;
                 const headers = new Headers();
                 for (const [key, value] of Object.entries(req.headers)) {
                     const name = key.toLowerCase();
                     if (!value)
                         continue;
-                    if (name === 'host' || name === 'content-length' || HOP_BY_HOP_HEADERS.has(name))
+                    if (name === 'host'
+                        || name === 'content-length'
+                        || name === TASKFORCE_PROXY_CLOUD_ENVIRONMENT_HEADER
+                        || HOP_BY_HOP_HEADERS.has(name))
                         continue;
                     const serialized = Array.isArray(value) ? value.join(', ') : String(value);
                     if (!serialized.trim())
                         continue;
                     headers.set(key, serialized);
                 }
+                applyCloudProxyForwardedHeaders(headers, req);
                 if (cloudProxyClientId && cloudProxyClientSecret) {
                     headers.set('CF-Access-Client-Id', cloudProxyClientId);
                     headers.set('CF-Access-Client-Secret', cloudProxyClientSecret);
                 }
                 const hasBody = method !== 'GET' && method !== 'HEAD';
-                const body = hasBody ? await readRequestBody(req, maxPayloadBytes) : undefined;
+                const requestMaxPayload = resolveMaxPayloadBytesForPath(url.pathname, maxPayloadBytes);
+                const body = hasBody ? await readRequestBody(req, requestMaxPayload) : undefined;
                 const upstream = await fetch(upstreamUrl, {
                     method,
                     headers,
@@ -417,13 +549,12 @@ export function createStandaloneServer(options) {
             catch (error) {
                 const message = String(error?.message || '');
                 if (message.startsWith('PAYLOAD_TOO_LARGE:')) {
-                    const max = Number(message.split(':')[1] || maxPayloadBytes);
-                    res.writeHead(413, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: `Payload too large (max ${max} bytes)` }));
+                    const requestMaxPayload = resolveMaxPayloadBytesForPath(url.pathname, maxPayloadBytes);
+                    const max = Number(message.split(':')[1] || requestMaxPayload);
+                    writeJsonErrorIfPossible(res, 413, { error: `Payload too large (max ${max} bytes)` });
                     return;
                 }
-                res.writeHead(502, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Cloud proxy request failed.' }));
+                writeJsonErrorIfPossible(res, 502, { error: 'Cloud proxy request failed.' });
             }
             return;
         }
@@ -451,11 +582,12 @@ export function createStandaloneServer(options) {
                 // Enforce request payload guard before route handlers parse bodies.
                 const contentLength = req.headers['content-length'];
                 if (typeof contentLength === 'string') {
+                    const requestMaxPayload = resolveMaxPayloadBytesForPath(url.pathname, maxPayloadBytes);
                     const contentLengthNumber = Number.parseInt(contentLength, 10);
-                    if (Number.isFinite(contentLengthNumber) && contentLengthNumber > maxPayloadBytes) {
+                    if (Number.isFinite(contentLengthNumber) && contentLengthNumber > requestMaxPayload) {
                         req.resume();
                         res.writeHead(413, { 'Content-Type': 'application/json' });
-                        res.end(JSON.stringify({ error: `Payload too large (max ${maxPayloadBytes} bytes)` }));
+                        res.end(JSON.stringify({ error: `Payload too large (max ${requestMaxPayload} bytes)` }));
                         return;
                     }
                 }
@@ -463,7 +595,7 @@ export function createStandaloneServer(options) {
                 const shouldApplyAuthRateLimit = shouldApplyAuthRateLimitForPath(url.pathname);
                 const accessForRateLimit = resolveRequestAccess(req, authConfig);
                 const isBillingWebhook = isBillingWebhookPath(url.pathname);
-                if (rateLimitEnabled && !isAuthApiPath) {
+                if (rateLimitEnabled && !isAuthApiPath && !isMcpPath) {
                     const key = resolveRateLimitKey({
                         req,
                         pathname: url.pathname,
@@ -533,21 +665,13 @@ export function createStandaloneServer(options) {
                 let access = accessForRateLimit;
                 const isAuthRoute = pathname.startsWith('/api/taskforce/auth/');
                 if (access.authenticated) {
-                    const resolved = core.resolveUserAccess(access.userId, access.workspaceId, access.role);
-                    if (resolved) {
-                        const systemRole = core.getSystemRole(resolved.userId);
-                        access = {
-                            ...access,
-                            role: resolved.role,
-                            workspaceId: resolved.workspaceId,
-                            userId: resolved.userId,
-                            systemRole
-                        };
-                        if (resolved.disabled && !isAuthRoute) {
-                            res.writeHead(403, { 'Content-Type': 'application/json' });
-                            res.end(JSON.stringify({ error: 'Forbidden: user account is disabled.' }));
-                            return;
-                        }
+                    access = resolveAuthorizedWorkspaceAccess(core, access, Array.isArray(req.headers['x-taskforce-workspace-id'])
+                        ? String(req.headers['x-taskforce-workspace-id'][0] || '')
+                        : String(req.headers['x-taskforce-workspace-id'] || ''));
+                    if (access.disabled && !isAuthRoute) {
+                        res.writeHead(403, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ error: 'Forbidden: user account is disabled.' }));
+                        return;
                     }
                 }
                 req.headers['x-taskforce-role'] = access.role;
@@ -590,6 +714,9 @@ export function createStandaloneServer(options) {
         // 3. SPA fallback: serve index.html for client-side routing
         const indexPath = distUiPath ? path.join(distUiPath, 'index.html') : '';
         if (!url.pathname.startsWith('/api/') && distUiPath && fs.existsSync(indexPath)) {
+            if (isMcpPath) {
+                console.warn(`[Taskforce MCP] unmatched path fell through to SPA method=${req.method || 'GET'} path=${url.pathname} contentType="${String(req.headers['content-type'] || '')}" accept="${String(req.headers.accept || '')}" userAgent="${String(req.headers['user-agent'] || '')}"`);
+            }
             res.writeHead(200, { 'Content-Type': 'text/html' });
             fs.createReadStream(indexPath).pipe(res);
             return;
@@ -638,10 +765,9 @@ export function createStandaloneServer(options) {
         };
         const runDocumentPurge = async () => {
             try {
-                const { basePath, taskDataDir } = core.getPaths();
+                const { basePath } = core.getPaths();
                 const summary = await purgeExpiredDocuments({
                     basePath,
-                    taskDataDir,
                     objectStorage: resolveEffectiveObjectStorage(),
                     assetStore: taskAssetStore
                 });
@@ -685,7 +811,8 @@ export function createStandaloneServer(options) {
                     includeDeleted: schedule.includeDeleted,
                     requireMirror: schedule.requireMirror,
                     limit: schedule.limit,
-                    assetStore: taskAssetStore
+                    assetStore: taskAssetStore,
+                    workspaceAssetStore
                 });
                 core.updateGlobalSettings({
                     storageIntegritySchedule: {

package/dist/server/index.rateLimit.test.js

@@ -7,6 +7,12 @@ describe('shouldApplyAuthRateLimitForPath', () => {
     it('excludes auth session endpoint', () => {
         expect(shouldApplyAuthRateLimitForPath('/api/taskforce/auth/session')).toBe(false);
     });
+    it('excludes runtime config bootstrap endpoint', () => {
+        expect(shouldApplyAuthRateLimitForPath('/api/taskforce/auth/runtime-config')).toBe(false);
+    });
+    it('excludes admin session endpoint', () => {
+        expect(shouldApplyAuthRateLimitForPath('/api/taskforce/auth/admin-session')).toBe(false);
+    });
     it('does not apply to non-auth routes', () => {
         expect(shouldApplyAuthRateLimitForPath('/api/taskforce/tasks')).toBe(false);
     });