@taskforcehq/taskforce 0.3.170 → 0.3.301

package/dist/core/Taskforce.mcpAuth.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/Taskforce.mcpAuth.test.js

@@ -0,0 +1,343 @@
+import { describe, expect, it } from 'vitest';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { createHash, randomBytes } from 'crypto';
+import Database from 'better-sqlite3';
+import { TaskforceCore } from './Taskforce';
+function makeCore() {
+    const projectRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-mcp-auth-'));
+    const core = new TaskforceCore({
+        projectRoot,
+        storagePath: path.join(projectRoot, '.taskforce')
+    });
+    return {
+        core,
+        cleanup: () => {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    };
+}
+function setupWorkspace(core, userId = 'owner-1', workspaceId = 'workspace-1') {
+    Object.defineProperty(core, 'getAccountAccessStatus', {
+        configurable: true,
+        value: () => ({
+            gate: 'ok',
+            hasEntitlement: true,
+            canAccessApp: true,
+            canAccessPlans: true,
+            signupMonetizationStrategy: 'none',
+            planSelectionRequired: false,
+            message: null,
+            entitlement: null
+        })
+    });
+    core.createWorkspace({ workspaceId, name: 'Workspace 1' });
+    core.ensureBootstrapUserAccess({
+        userId,
+        workspaceId,
+        role: 'owner',
+        email: `${userId}@example.com`
+    });
+}
+function createOauthGrantToken(core, userId, workspaceId) {
+    const redirectUri = 'https://chat.openai.com/aip/callback';
+    const client = core.registerMcpOAuthClient({
+        provider: 'chatgpt',
+        clientName: 'ChatGPT Connector',
+        redirectUris: [redirectUri]
+    });
+    const verifier = randomBytes(32).toString('base64url');
+    const codeChallenge = createHash('sha256').update(verifier).digest('base64url');
+    const issued = core.issueMcpOAuthAuthorizationCode({
+        provider: 'chatgpt',
+        clientId: client.id,
+        userId,
+        workspaceId,
+        scopes: ['tasks:read'],
+        redirectUri,
+        codeChallenge,
+        codeChallengeMethod: 'S256'
+    });
+    const exchanged = core.exchangeMcpOAuthAuthorizationCode({
+        provider: 'chatgpt',
+        clientId: client.id,
+        code: issued.code,
+        redirectUri,
+        codeVerifier: verifier
+    });
+    return exchanged.accessToken;
+}
+describe('TaskforceCore MCP auth invalidation', () => {
+    it('boots against a legacy mcp_audit_logs table before adding outcome metadata columns', () => {
+        const projectRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-mcp-audit-legacy-boot-'));
+        const storagePath = path.join(projectRoot, '.taskforce');
+        fs.mkdirSync(storagePath, { recursive: true });
+        const dbPath = path.join(storagePath, 'taskforce.db');
+        const legacyDb = new Database(dbPath);
+        try {
+            legacyDb.exec(`
+                CREATE TABLE IF NOT EXISTS mcp_audit_logs (
+                    id TEXT PRIMARY KEY,
+                    tenant_id TEXT NOT NULL DEFAULT 'default',
+                    workspace_id TEXT NOT NULL DEFAULT 'default',
+                    actor_type TEXT NOT NULL,
+                    actor_user_id TEXT NOT NULL,
+                    token_id TEXT,
+                    tool_name TEXT NOT NULL,
+                    details_json TEXT,
+                    created_at TEXT NOT NULL
+                );
+                CREATE INDEX IF NOT EXISTS idx_mcp_audit_logs_workspace_created
+                    ON mcp_audit_logs(tenant_id, workspace_id, created_at);
+                CREATE INDEX IF NOT EXISTS idx_mcp_audit_logs_tool_created
+                    ON mcp_audit_logs(tenant_id, tool_name, created_at);
+            `);
+        }
+        finally {
+            legacyDb.close();
+        }
+        const core = new TaskforceCore({ projectRoot, storagePath });
+        try {
+            const columns = core.db.prepare(`PRAGMA table_info(mcp_audit_logs)`).all();
+            expect(columns.some((column) => column.name === 'outcome')).toBe(true);
+            expect(columns.some((column) => column.name === 'reason_code')).toBe(true);
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('backfills MCP audit metadata columns from legacy details_json on reopen', () => {
+        const projectRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-mcp-audit-backfill-'));
+        const storagePath = path.join(projectRoot, '.taskforce');
+        const core = new TaskforceCore({ projectRoot, storagePath });
+        try {
+            setupWorkspace(core, 'owner-1', 'workspace-1');
+            core.db.prepare(`
+                INSERT INTO mcp_audit_logs (
+                    id, tenant_id, workspace_id, actor_type, actor_user_id, token_id, tool_name, details_json, created_at
+                )
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+            `).run('mcp-audit-legacy', 'default', 'workspace-1', 'token', 'owner-1', 'token-legacy', 'create_task', JSON.stringify({
+                requestId: 'req-legacy',
+                ip: '10.0.0.1',
+                userAgent: 'legacy-client',
+                outcome: 'deny',
+                reasonCode: 'scope_denied',
+                scopes: ['tasks:read']
+            }), new Date().toISOString());
+            core.close();
+            const reopened = new TaskforceCore({ projectRoot, storagePath });
+            try {
+                const row = reopened.db.prepare(`
+                    SELECT request_id, ip, user_agent, outcome, reason_code, details_json
+                    FROM mcp_audit_logs
+                    WHERE tenant_id = ? AND id = ?
+                    LIMIT 1
+                `).get('default', 'mcp-audit-legacy');
+                expect(row?.request_id).toBe('req-legacy');
+                expect(row?.ip).toBe('10.0.0.1');
+                expect(row?.user_agent).toBe('legacy-client');
+                expect(row?.outcome).toBe('deny');
+                expect(row?.reason_code).toBe('scope_denied');
+                expect(JSON.parse(String(row?.details_json || '{}'))).toEqual({
+                    requestId: 'req-legacy',
+                    ip: '10.0.0.1',
+                    userAgent: 'legacy-client',
+                    outcome: 'deny',
+                    reasonCode: 'scope_denied',
+                    scopes: ['tasks:read']
+                });
+            }
+            finally {
+                reopened.close();
+            }
+        }
+        finally {
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('stores MCP audit request metadata in first-class columns', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            setupWorkspace(core, 'owner-1', 'workspace-1');
+            core.addMcpAuditLog({
+                workspaceId: 'workspace-1',
+                actorType: 'token',
+                actorUserId: 'owner-1',
+                tokenId: 'token-1',
+                toolName: 'create_task',
+                details: {
+                    requestId: 'req-123',
+                    ip: '127.0.0.1',
+                    userAgent: 'vitest',
+                    outcome: 'deny',
+                    reasonCode: 'scope_denied',
+                    scopes: ['tasks:read']
+                }
+            });
+            const row = core.db.prepare(`
+                SELECT request_id, ip, user_agent, outcome, reason_code, details_json
+                FROM mcp_audit_logs
+                WHERE tenant_id = ? AND workspace_id = ?
+                ORDER BY created_at DESC
+                LIMIT 1
+            `).get('default', 'workspace-1');
+            expect(row?.request_id).toBe('req-123');
+            expect(row?.ip).toBe('127.0.0.1');
+            expect(row?.user_agent).toBe('vitest');
+            expect(row?.outcome).toBe('deny');
+            expect(row?.reason_code).toBe('scope_denied');
+            expect(JSON.parse(String(row?.details_json || '{}'))).toEqual({
+                scopes: ['tasks:read']
+            });
+        }
+        finally {
+            cleanup();
+        }
+    });
+    it('uses a postgres-safe bucket value for MCP rate limit windows', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            const result = core.checkMcpRateLimit({
+                scope: 'actor',
+                key: 'actor:test',
+                limit: 10,
+                windowMs: 60_000,
+                nowMs: 1_773_703_620_000,
+            });
+            expect(result.allowed).toBe(true);
+            const row = core.db.prepare(`
+                SELECT window_started_at, request_count
+                FROM mcp_rate_limit_windows
+                WHERE tenant_id = ?
+                  AND scope = ?
+                  AND rate_key = ?
+                LIMIT 1
+            `).get('default', 'actor', 'actor:test');
+            expect(row?.request_count).toBe(1);
+            expect(Number(row?.window_started_at)).toBeLessThan(2_147_483_647);
+        }
+        finally {
+            cleanup();
+        }
+    });
+    it('denies PAT authentication after workspace member is disabled', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            setupWorkspace(core, 'owner-1', 'workspace-1');
+            core.ensureBootstrapUserAccess({
+                userId: 'member-1',
+                workspaceId: 'workspace-1',
+                role: 'member',
+                email: 'member@example.com'
+            });
+            const issued = core.createMcpAccessToken({
+                userId: 'member-1',
+                workspaceId: 'workspace-1',
+                name: 'Test Token',
+                scopes: ['tasks:read']
+            });
+            expect(core.authenticateMcpAccessToken(issued.token)?.status).toBe('active');
+            expect(core.setWorkspaceUserDisabled('member-1', 'workspace-1', true)).toBe(true);
+            expect(core.authenticateMcpAccessToken(issued.token)).toBeNull();
+        }
+        finally {
+            cleanup();
+        }
+    });
+    it('denies PAT authentication after workspace membership is removed', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            setupWorkspace(core, 'owner-1', 'workspace-1');
+            core.ensureBootstrapUserAccess({
+                userId: 'member-1',
+                workspaceId: 'workspace-1',
+                role: 'member',
+                email: 'member@example.com'
+            });
+            const issued = core.createMcpAccessToken({
+                userId: 'member-1',
+                workspaceId: 'workspace-1',
+                name: 'Member Token',
+                scopes: ['tasks:read']
+            });
+            expect(core.authenticateMcpAccessToken(issued.token)?.status).toBe('active');
+            expect(core.removeWorkspaceUser('member-1', 'workspace-1')).toBe(true);
+            expect(core.authenticateMcpAccessToken(issued.token)).toBeNull();
+        }
+        finally {
+            cleanup();
+        }
+    });
+    it('denies PAT authentication after the workspace is deleted', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            setupWorkspace(core, 'owner-1', 'workspace-1');
+            const issued = core.createMcpAccessToken({
+                userId: 'owner-1',
+                workspaceId: 'workspace-1',
+                name: 'Workspace Token',
+                scopes: ['tasks:read']
+            });
+            expect(core.authenticateMcpAccessToken(issued.token)?.status).toBe('active');
+            core.deleteWorkspace({ workspaceId: 'workspace-1' });
+            expect(core.authenticateMcpAccessToken(issued.token)).toBeNull();
+        }
+        finally {
+            cleanup();
+        }
+    });
+    it('denies OAuth authentication after the authorized member is disabled', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            setupWorkspace(core, 'owner-1', 'workspace-1');
+            core.ensureBootstrapUserAccess({
+                userId: 'member-1',
+                workspaceId: 'workspace-1',
+                role: 'member',
+                email: 'member@example.com'
+            });
+            const accessToken = createOauthGrantToken(core, 'member-1', 'workspace-1');
+            expect(core.authenticateMcpOAuthAccessToken(accessToken)?.status).toBe('active');
+            expect(core.setWorkspaceUserDisabled('member-1', 'workspace-1', true)).toBe(true);
+            expect(core.authenticateMcpOAuthAccessToken(accessToken)).toBeNull();
+        }
+        finally {
+            cleanup();
+        }
+    });
+    it('denies OAuth authentication after account access is suspended', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            setupWorkspace(core, 'owner-1', 'workspace-1');
+            core.ensureBootstrapUserAccess({
+                userId: 'member-1',
+                workspaceId: 'workspace-1',
+                role: 'member',
+                email: 'member@example.com'
+            });
+            const accessToken = createOauthGrantToken(core, 'member-1', 'workspace-1');
+            expect(core.authenticateMcpOAuthAccessToken(accessToken)?.status).toBe('active');
+            Object.defineProperty(core, 'getAccountAccessStatus', {
+                configurable: true,
+                value: () => ({
+                    gate: 'missing_entitlement',
+                    hasEntitlement: false,
+                    canAccessApp: false,
+                    canAccessPlans: true,
+                    signupMonetizationStrategy: 'none',
+                    planSelectionRequired: false,
+                    message: 'Suspended for test',
+                    entitlement: null
+                })
+            });
+            expect(core.authenticateMcpOAuthAccessToken(accessToken)).toBeNull();
+        }
+        finally {
+            cleanup();
+        }
+    });
+});

package/dist/core/Taskforce.realtimeMutation.test.js

@@ -18,6 +18,17 @@ function makeCore() {
     };
 }
 describe('TaskforceCore realtime mutation stream', () => {
+    it('does not create task-data directories during core startup', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            const paths = core.getPaths();
+            expect(fs.existsSync(path.join(paths.basePath, 'task-data'))).toBe(false);
+            expect(fs.existsSync(path.join(paths.basePath, 'task-data', '_unassigned', 'attachments'))).toBe(false);
+        }
+        finally {
+            cleanup();
+        }
+    });
     it('emits task upsert events for create and update paths (MCP/HTTP shared core)', () => {
         const { core, cleanup } = makeCore();
         try {
@@ -37,16 +48,34 @@ describe('TaskforceCore realtime mutation stream', () => {
             cleanup();
         }
     });
+    it('emits a task upsert event when adding a comment', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            const task = core.createTask({ title: 'Realtime comment task' }, { workspaceId: 'workspace-a' });
+            const events = [];
+            const off = core.onRealtimeMutation((event) => events.push(event));
+            core.addComment(task.id, 'Fresh comment', 'user', 'workspace-a');
+            off();
+            const taskEvent = events.find((event) => event.entityType === 'task');
+            expect(taskEvent).toBeTruthy();
+            expect(taskEvent?.changeType).toBe('upsert');
+            expect(taskEvent?.workspaceId).toBe('workspace-a');
+            expect(taskEvent?.entityIds).toContain(task.id);
+        }
+        finally {
+            cleanup();
+        }
+    });
     it('emits taxonomy events on taxonomy updates', () => {
         const { core, cleanup } = makeCore();
         try {
             const events = [];
             const off = core.onRealtimeMutation((event) => events.push(event));
-            core.updateTaxonomies([{ value: 'streaming', label: 'Streaming' }]);
+            core.updateTaxonomies([{ value: 'streaming', label: 'Streaming' }], 'workspace-a');
             off();
             const taxonomyEvent = events.find((event) => event.entityType === 'taxonomy');
             expect(taxonomyEvent).toBeTruthy();
-            expect(taxonomyEvent?.workspaceId).toBe('*');
+            expect(taxonomyEvent?.workspaceId).toBe('workspace-a');
             expect(taxonomyEvent?.changeType).toBe('upsert');
             expect(taxonomyEvent?.entityIds).toContain('__taxonomy_config__');
         }
@@ -73,4 +102,30 @@ describe('TaskforceCore realtime mutation stream', () => {
             cleanup();
         }
     });
+    it('emits document metadata events for explicit asset/document invalidation notifications', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            const events = [];
+            const off = core.onRealtimeMutation((event) => events.push(event));
+            core.notifyDocumentMetadataMutation('workspace-docs', [
+                'workspaces/workspace-docs/assets/documents/asset-doc.md',
+                'workspaces/workspace-docs/assets/files/asset-file.txt'
+            ], 'upsert');
+            off();
+            expect(events).toEqual([
+                expect.objectContaining({
+                    workspaceId: 'workspace-docs',
+                    entityType: 'document-metadata',
+                    changeType: 'upsert',
+                    entityIds: [
+                        'workspaces/workspace-docs/assets/documents/asset-doc.md',
+                        'workspaces/workspace-docs/assets/files/asset-file.txt'
+                    ]
+                })
+            ]);
+        }
+        finally {
+            cleanup();
+        }
+    });
 });

package/dist/core/TaxonomySettingsService.d.ts

@@ -0,0 +1,18 @@
+import type { DatabaseAdapter } from '../storage/databaseAdapter.js';
+import type { WorkspaceTaxonomyState } from '../shared/taxonomyState.js';
+export declare const WORKSPACE_TAXONOMY_SETTINGS_KEY = "taxonomy_state";
+export interface TaxonomySettingsServiceDeps {
+    db: DatabaseAdapter;
+    tenantId: string;
+    ensureStructuredSettingsTables: (store: DatabaseAdapter) => void;
+    writeSettingsPayloadRow: (store: DatabaseAdapter, tableName: 'workspace_settings', keyValues: unknown[], payload: Record<string, unknown>, updatedAt: string) => void;
+}
+export declare function sanitizeWorkspaceTaxonomyState(input: unknown): WorkspaceTaxonomyState;
+export declare function getWorkspaceTaxonomyStateService(deps: TaxonomySettingsServiceDeps, workspaceId: string): {
+    state: WorkspaceTaxonomyState;
+    updatedAt: string | null;
+};
+export declare function upsertWorkspaceTaxonomyStateService(deps: TaxonomySettingsServiceDeps, workspaceId: string, state: WorkspaceTaxonomyState, updatedAt?: string | null): {
+    state: WorkspaceTaxonomyState;
+    updatedAt: string;
+};

package/dist/core/TaxonomySettingsService.js

@@ -0,0 +1,162 @@
+export const WORKSPACE_TAXONOMY_SETTINGS_KEY = 'taxonomy_state';
+function sanitizeStringArray(input) {
+    if (!Array.isArray(input))
+        return undefined;
+    const values = input
+        .filter((entry) => typeof entry === 'string' && entry.trim().length > 0)
+        .map((entry) => entry.trim());
+    return values.length > 0 ? values : undefined;
+}
+function sanitizeDisplayLabels(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return undefined;
+    const source = input;
+    const next = {};
+    if (typeof source.category === 'string' && source.category.trim().length > 0)
+        next.category = source.category.trim();
+    if (typeof source.type === 'string' && source.type.trim().length > 0)
+        next.type = source.type.trim();
+    if (typeof source.priority === 'string' && source.priority.trim().length > 0)
+        next.priority = source.priority.trim();
+    return Object.keys(next).length > 0 ? next : undefined;
+}
+function sanitizeCategoryRecord(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return null;
+    const source = input;
+    const value = typeof source.value === 'string' ? source.value.trim() : '';
+    const label = typeof source.label === 'string' ? source.label.trim() : '';
+    if (!value || !label)
+        return null;
+    const next = { value, label };
+    const aliases = sanitizeStringArray(source.aliases);
+    if (aliases)
+        next.aliases = aliases;
+    if (typeof source.path === 'string' && source.path.trim())
+        next.path = source.path.trim();
+    if (Array.isArray(source.paths)) {
+        const paths = sanitizeStringArray(source.paths);
+        if (paths)
+            next.paths = paths;
+    }
+    if (typeof source.specialistFile === 'string' && source.specialistFile.trim())
+        next.specialistFile = source.specialistFile.trim();
+    if (typeof source.icon === 'string' && source.icon.trim())
+        next.icon = source.icon.trim();
+    if (typeof source.color === 'string' && source.color.trim())
+        next.color = source.color.trim();
+    if (typeof source.disabled === 'boolean')
+        next.disabled = source.disabled;
+    return next;
+}
+function sanitizeTypeRecord(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return null;
+    const source = input;
+    const value = typeof source.value === 'string' ? source.value.trim() : '';
+    const label = typeof source.label === 'string' ? source.label.trim() : '';
+    if (!value || !label)
+        return null;
+    const next = { value, label };
+    const aliases = sanitizeStringArray(source.aliases);
+    if (aliases)
+        next.aliases = aliases;
+    if (typeof source.icon === 'string' && source.icon.trim())
+        next.icon = source.icon.trim();
+    if (typeof source.color === 'string' && source.color.trim())
+        next.color = source.color.trim();
+    next.status = source.status === 'retired' ? 'retired' : 'active';
+    return next;
+}
+function sanitizePriorityRecord(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return null;
+    const source = input;
+    const rawValue = typeof source.value === 'number' ? source.value : Number(source.value);
+    const label = typeof source.label === 'string' ? source.label.trim() : '';
+    if (!Number.isFinite(rawValue) || !label)
+        return null;
+    const next = {
+        value: Math.trunc(rawValue),
+        label
+    };
+    if (typeof source.color === 'string' && source.color.trim())
+        next.color = source.color.trim();
+    if (typeof source.icon === 'string' && source.icon.trim())
+        next.icon = source.icon.trim();
+    return next;
+}
+export function sanitizeWorkspaceTaxonomyState(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input)) {
+        return {};
+    }
+    const source = input;
+    const next = {};
+    if (Array.isArray(source.categories)) {
+        const categories = source.categories
+            .map((entry) => sanitizeCategoryRecord(entry))
+            .filter((entry) => Boolean(entry));
+        if (categories.length > 0)
+            next.categories = categories;
+    }
+    if (Array.isArray(source.types)) {
+        const types = source.types
+            .map((entry) => sanitizeTypeRecord(entry))
+            .filter((entry) => Boolean(entry));
+        if (types.length > 0)
+            next.types = types;
+    }
+    if (Array.isArray(source.priorities)) {
+        const priorities = source.priorities
+            .map((entry) => sanitizePriorityRecord(entry))
+            .filter((entry) => Boolean(entry));
+        if (priorities.length > 0)
+            next.priorities = priorities;
+    }
+    if (Array.isArray(source.taxonomies)) {
+        next.taxonomies = source.taxonomies.map((entry) => {
+            if (!entry || typeof entry !== 'object')
+                return entry;
+            return JSON.parse(JSON.stringify(entry));
+        });
+    }
+    const displayLabels = sanitizeDisplayLabels(source.displayLabels);
+    if (displayLabels)
+        next.displayLabels = displayLabels;
+    return next;
+}
+export function getWorkspaceTaxonomyStateService(deps, workspaceId) {
+    const normalizedWorkspaceId = String(workspaceId || '').trim() || 'default';
+    deps.ensureStructuredSettingsTables(deps.db);
+    try {
+        const row = deps.db.prepare(`
+            SELECT payload, updated_at
+            FROM workspace_settings
+            WHERE tenant_id = ? AND workspace_id = ? AND settings_key = ?
+            LIMIT 1
+        `).get(deps.tenantId, normalizedWorkspaceId, WORKSPACE_TAXONOMY_SETTINGS_KEY);
+        if (!row?.payload) {
+            return { state: {}, updatedAt: null };
+        }
+        return {
+            state: sanitizeWorkspaceTaxonomyState(JSON.parse(row.payload)),
+            updatedAt: typeof row.updated_at === 'string' ? row.updated_at : null
+        };
+    }
+    catch {
+        return { state: {}, updatedAt: null };
+    }
+}
+export function upsertWorkspaceTaxonomyStateService(deps, workspaceId, state, updatedAt) {
+    const normalizedWorkspaceId = String(workspaceId || '').trim() || 'default';
+    deps.ensureStructuredSettingsTables(deps.db);
+    const sanitized = sanitizeWorkspaceTaxonomyState(state);
+    const nextUpdatedAt = typeof updatedAt === 'string' && updatedAt.trim()
+        ? updatedAt.trim()
+        : new Date().toISOString();
+    deps.writeSettingsPayloadRow(deps.db, 'workspace_settings', [deps.tenantId, normalizedWorkspaceId, WORKSPACE_TAXONOMY_SETTINGS_KEY], sanitized, nextUpdatedAt);
+    return {
+        state: sanitized,
+        updatedAt: nextUpdatedAt
+    };
+}

package/dist/core/WorkspaceDelete.test.js

@@ -9,6 +9,32 @@ function makeCore() {
         projectRoot,
         storagePath: path.join(projectRoot, '.taskforce')
     });
+    const db = core.getDatabaseAdapter();
+    const now = new Date().toISOString();
+    const addFreeMapping = (planVersionId) => {
+        db.prepare(`
+            INSERT OR IGNORE INTO billing_price_mappings (
+                tenant_id, plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run('default', planVersionId, 'month', `free:${planVersionId}:month`, 'free', 1, 0, null, now, now);
+    };
+    core.upsertPlanCatalog({ planId: 'starter', displayName: 'Starter' });
+    addFreeMapping('starter-v1');
+    core.upsertPlanCatalog({ planId: 'starter', displayName: 'Starter', status: 'active' });
+    core.upsertPlanCatalog({ planId: 'collab', displayName: 'Collab' });
+    addFreeMapping('collab-v1');
+    core.upsertPlanCatalog({ planId: 'collab', displayName: 'Collab', status: 'active' });
+    core.updatePlanVersion({
+        planId: 'collab',
+        versionNumber: 1,
+        seatLimit: 5
+    });
+    core.updatePlanVersionFeatures({
+        planVersionId: 'collab-v1',
+        features: [
+            { featureKey: 'collaboration.team_management', access: 'enabled' }
+        ]
+    });
     return {
         core,
         cleanup: () => {
@@ -37,19 +63,12 @@ describe('TaskforceCore deleteWorkspace', () => {
             core.createWorkspace({ workspaceId: wsKeep, name: 'Workspace Keep' });
             core.ensureBootstrapUserAccess({ userId: 'owner-del', workspaceId: wsDelete, role: 'owner', email: 'del@example.com' });
             core.ensureBootstrapUserAccess({ userId: 'owner-keep', workspaceId: wsKeep, role: 'owner', email: 'keep@example.com' });
-            const parent = core.createTask({ title: 'Parent Delete', type: 'feature', category: 'default' }, { workspaceId: wsDelete });
-            const child = core.createTask({ title: 'Child Delete', type: 'feature', category: 'default', parentTaskId: parent.id }, { workspaceId: wsDelete });
-            const sibling = core.createTask({ title: 'Sibling Delete', type: 'feature', category: 'default' }, { workspaceId: wsDelete });
-            const keepTask = core.createTask({ title: 'Keep Task', type: 'feature', category: 'default' }, { workspaceId: wsKeep });
+            const workstream = core.createWorkstream({ title: 'Delete Workstream' }, wsDelete);
+            const parent = core.createTask({ title: 'Parent Delete', workstreamId: workstream.id }, { workspaceId: wsDelete });
+            const child = core.createTask({ title: 'Child Delete', workstreamId: workstream.id }, { workspaceId: wsDelete });
+            const sibling = core.createTask({ title: 'Sibling Delete' }, { workspaceId: wsDelete });
+            const keepTask = core.createTask({ title: 'Keep Task' }, { workspaceId: wsKeep });
             core.addComment(parent.id, 'comment delete', 'owner-del', wsDelete);
-            core.getDatabaseAdapter().prepare(`
-                INSERT INTO screenshots (id, tenant_id, workspace_id, task_id, path, fs_path, caption, timestamp)
-                VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-            `).run('shot-delete', tenantId, wsDelete, parent.id, 'task-data/shot-delete.png', '/tmp/shot-delete.png', 'shot', now);
-            core.getDatabaseAdapter().prepare(`
-                INSERT INTO screenshots (id, tenant_id, workspace_id, task_id, path, fs_path, caption, timestamp)
-                VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-            `).run('shot-keep', tenantId, wsKeep, keepTask.id, 'task-data/shot-keep.png', '/tmp/shot-keep.png', 'shot', now);
             core.getDatabaseAdapter().prepare(`
                 INSERT INTO auth_tokens (id, tenant_id, user_id, workspace_id, purpose, token_hash, expires_at, used_at, revoked_at, created_at)
                 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
@@ -104,7 +123,7 @@ describe('TaskforceCore deleteWorkspace', () => {
             const scopedTables = [
                 'tasks',
                 'comments',
-                'screenshots',
+                'task_events',
                 'workspace_memberships',
                 'auth_tokens',
                 'ui_state',