@taskforcehq/taskforce 0.3.170 → 0.3.301

package/dist/core/WorkspaceSyncSettings.test.js

@@ -0,0 +1,65 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, describe, expect, it } from 'vitest';
+import { TaskforceCore } from './Taskforce';
+const createdRoots = [];
+const originalHome = process.env.HOME;
+function createProjectRoot(prefix = 'taskforce-workspace-sync-settings-') {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+    process.env.HOME = root;
+    createdRoots.push(root);
+    return root;
+}
+afterEach(() => {
+    process.env.HOME = originalHome;
+    while (createdRoots.length > 0) {
+        const root = createdRoots.pop();
+        if (root && fs.existsSync(root)) {
+            fs.rmSync(root, { recursive: true, force: true });
+        }
+    }
+});
+describe('TaskforceCore workspace shareable sync settings', () => {
+    it('returns an empty snapshot when no workspace-shareable settings are allowlisted', () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        expect(core.getWorkspaceShareableSyncSettings('workspace-1')).toEqual({
+            settings: {},
+            updatedAt: null
+        });
+    });
+    it('drops disallowed workspace_settings rows from the sync snapshot', () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const db = core.getDatabaseAdapter();
+        const now = new Date().toISOString();
+        db.prepare(`
+            INSERT INTO workspace_settings (tenant_id, workspace_id, settings_key, payload, updated_at)
+            VALUES (?, ?, ?, ?, ?)
+        `).run('default', 'workspace-1', 'dangerous-admin-setting', JSON.stringify({ enabled: true }), now);
+        expect(core.getWorkspaceShareableSyncSettings('workspace-1')).toEqual({
+            settings: {},
+            updatedAt: null
+        });
+    });
+    it('ignores attempted writes for disallowed workspace-shareable sync settings', () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const result = core.upsertWorkspaceShareableSyncSettings('workspace-1', {
+            dangerousAdminSetting: { enabled: true }
+        }, '2026-03-17T12:00:00.000Z');
+        expect(result).toEqual({
+            settings: {},
+            updatedAt: null,
+            applied: false
+        });
+        const db = core.getDatabaseAdapter();
+        const rows = db.prepare(`
+            SELECT settings_key
+            FROM workspace_settings
+            WHERE tenant_id = ? AND workspace_id = ?
+        `).all('default', 'workspace-1');
+        expect(rows).toEqual([]);
+    });
+});

package/dist/core/__tests__/TaskAttachmentsCanonical.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/TaskAttachmentsCanonical.test.js

@@ -0,0 +1,212 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, describe, expect, it } from 'vitest';
+import { TaskforceCore } from '../Taskforce';
+const createdRoots = [];
+const originalHome = process.env.HOME;
+function createProjectRoot(prefix = 'taskforce-canonical-attachments-') {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+    process.env.HOME = root;
+    createdRoots.push(root);
+    return root;
+}
+afterEach(() => {
+    process.env.HOME = originalHome;
+    while (createdRoots.length > 0) {
+        const root = createdRoots.pop();
+        if (root && fs.existsSync(root)) {
+            fs.rmSync(root, { recursive: true, force: true });
+        }
+    }
+});
+describe('TaskforceCore canonical task attachments', () => {
+    it('renders canonical asset links as task attachments', () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const created = core.createTask({
+            title: 'Attachment task'
+        }, { workspaceId: 'default' });
+        const db = core.getDatabaseAdapter();
+        const now = new Date().toISOString();
+        const storageKey = 'workspaces/default/assets/documents/asset-doc-1-implementation-plan.md';
+        db.prepare(`
+            INSERT INTO workspace_assets (
+                asset_id, tenant_id, workspace_id, kind, logical_name, original_filename, mime_type,
+                storage_provider, storage_key, content_sha256, size_bytes, document_id, version,
+                is_latest, scan_status, created_at, updated_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run('asset-doc-1', 'default', 'default', 'document', 'Implementation Plan', 'implementation-plan.md', 'text/markdown', 'r2', storageKey, 'sha-doc-1', 120, 'doc-1', 1, 1, 'clean', now, now);
+        db.prepare(`
+            INSERT INTO workspace_asset_links (
+                tenant_id, workspace_id, asset_id, task_id, role, created_at, updated_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?)
+        `).run('default', 'default', 'asset-doc-1', created.id, 'attachment', now, now);
+        const tasks = core.listTasks('default').tasks;
+        const task = tasks.find((entry) => entry.id === created.id);
+        expect(task?.attachments).toEqual([
+            expect.objectContaining({
+                path: `/api/taskforce/context/${encodeURIComponent(storageKey)}`,
+                fsPath: storageKey,
+                caption: 'Implementation Plan'
+            })
+        ]);
+    });
+    it('writes canonical task attachment links when attachments are updated from payload data', () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const created = core.createTask({
+            title: 'Attachment write task'
+        }, { workspaceId: 'default' });
+        const db = core.getDatabaseAdapter();
+        const now = new Date().toISOString();
+        const storageKey = 'workspaces/default/assets/files/asset-file-1-brief.pdf';
+        db.prepare(`
+            INSERT INTO workspace_assets (
+                asset_id, tenant_id, workspace_id, kind, original_filename, mime_type,
+                storage_provider, storage_key, content_sha256, size_bytes, is_latest,
+                scan_status, created_at, updated_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run('asset-file-1', 'default', 'default', 'file', 'brief.pdf', 'application/pdf', 'r2', storageKey, 'sha-file-1', 88, 1, 'clean', now, now);
+        core.updateTask(created.id, {
+            attachments: [{
+                    path: `/api/taskforce/context/${encodeURIComponent(storageKey)}`,
+                    fsPath: storageKey,
+                    caption: 'Brief',
+                    timestamp: now
+                }]
+        }, 'default');
+        const rows = db.prepare(`
+            SELECT asset_id, task_id, role, deleted_at
+            FROM workspace_asset_links
+            WHERE tenant_id = ? AND workspace_id = ? AND task_id = ?
+        `).all('default', 'default', created.id);
+        expect(rows).toEqual([
+            expect.objectContaining({
+                asset_id: 'asset-file-1',
+                task_id: created.id,
+                role: 'attachment',
+                deleted_at: null
+            })
+        ]);
+    });
+    it('renders canonical image attachments through the unified context route', () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const created = core.createTask({
+            title: 'Image attachment task'
+        }, { workspaceId: 'default' });
+        const db = core.getDatabaseAdapter();
+        const now = new Date().toISOString();
+        const storageKey = 'workspaces/default/assets/images/asset-image-1-proof.png';
+        db.prepare(`
+            INSERT INTO workspace_assets (
+                asset_id, tenant_id, workspace_id, kind, logical_name, original_filename, mime_type,
+                storage_provider, storage_key, content_sha256, size_bytes, is_latest, scan_status, created_at, updated_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run('asset-image-1', 'default', 'default', 'image', 'Proof', 'proof.png', 'image/png', 'local', storageKey, 'sha-image-1', 42, 1, 'clean', now, now);
+        db.prepare(`
+            INSERT INTO workspace_asset_links (
+                tenant_id, workspace_id, asset_id, task_id, role, created_at, updated_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?)
+        `).run('default', 'default', 'asset-image-1', created.id, 'image', now, now);
+        const imagePath = path.join(projectRoot, '.taskforce', storageKey);
+        fs.mkdirSync(path.dirname(imagePath), { recursive: true });
+        fs.writeFileSync(imagePath, 'png');
+        const task = core.getTask(created.id, 'default');
+        expect(task?.attachments).toEqual([
+            expect.objectContaining({
+                path: `/api/taskforce/context/${encodeURIComponent(storageKey)}`,
+                fsPath: storageKey,
+                caption: 'Proof'
+            })
+        ]);
+    });
+    it('does not render broken local canonical attachments when the file is missing', () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const created = core.createTask({
+            title: 'Broken attachment task'
+        }, { workspaceId: 'default' });
+        const db = core.getDatabaseAdapter();
+        const now = new Date().toISOString();
+        const storageKey = 'workspaces/default/assets/images/asset-image-2-broken.png';
+        db.prepare(`
+            INSERT INTO workspace_assets (
+                asset_id, tenant_id, workspace_id, kind, logical_name, original_filename, mime_type,
+                storage_provider, storage_key, content_sha256, size_bytes, is_latest, scan_status, created_at, updated_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run('asset-image-2', 'default', 'default', 'image', 'Broken Proof', 'broken.png', 'image/png', 'local', storageKey, 'sha-image-2', 42, 1, 'clean', now, now);
+        db.prepare(`
+            INSERT INTO workspace_asset_links (
+                tenant_id, workspace_id, asset_id, task_id, role, created_at, updated_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?)
+        `).run('default', 'default', 'asset-image-2', created.id, 'image', now, now);
+        const task = core.getTask(created.id, 'default');
+        expect(task?.attachments).toEqual([]);
+    });
+    it('persists linked local files with a stable display name and context-link path', () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const created = core.createTask({
+            title: 'Linked file task'
+        }, { workspaceId: 'default' });
+        const linkedPath = 'docs/architecture/decision-record.md';
+        const now = new Date().toISOString();
+        core.updateTask(created.id, {
+            attachments: [{
+                    path: `/api/taskforce/context-link?path=${encodeURIComponent(linkedPath)}`,
+                    fsPath: linkedPath,
+                    caption: 'Architecture Decision Record',
+                    timestamp: now
+                }]
+        }, 'default');
+        const db = core.getDatabaseAdapter();
+        const assetRow = db.prepare(`
+            SELECT asset_id, storage_provider, storage_key, logical_name, original_filename
+            FROM workspace_assets
+            WHERE tenant_id = ? AND workspace_id = ? AND storage_key = ?
+            LIMIT 1
+        `).get('default', 'default', linkedPath);
+        expect(assetRow).toEqual(expect.objectContaining({
+            storage_provider: 'external',
+            storage_key: linkedPath,
+            logical_name: 'Architecture Decision Record',
+            original_filename: 'Architecture Decision Record'
+        }));
+        const linkRow = db.prepare(`
+            SELECT display_name, role, deleted_at
+            FROM workspace_asset_links
+            WHERE tenant_id = ? AND workspace_id = ? AND task_id = ?
+            LIMIT 1
+        `).get('default', 'default', created.id);
+        expect(linkRow).toEqual(expect.objectContaining({
+            display_name: 'Architecture Decision Record',
+            role: 'attachment',
+            deleted_at: null
+        }));
+        const task = core.getTask(created.id, 'default');
+        expect(task?.attachments).toEqual([
+            expect.objectContaining({
+                path: `/api/taskforce/context-link?path=${encodeURIComponent(linkedPath)}`,
+                fsPath: linkedPath,
+                caption: 'Architecture Decision Record',
+                displayName: 'Architecture Decision Record',
+                originalFilename: 'Architecture Decision Record'
+            })
+        ]);
+    });
+    it('does not read legacy task-folder attachments when canonical metadata is absent', () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        const created = core.createTask({
+            title: 'Filesystem attachment fallback'
+        }, { workspaceId: 'default' });
+        const taskDir = path.join(projectRoot, '.taskforce', 'task-data', created.id, 'attachments');
+        fs.mkdirSync(taskDir, { recursive: true });
+        const filePath = path.join(taskDir, 'notes.txt');
+        fs.writeFileSync(filePath, 'hello');
+        const task = core.getTask(created.id, 'default');
+        expect(task?.attachments).toEqual([]);
+    });
+});

package/dist/core/shared.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Taskforce Core Shared Utilities
+ *
+ * Standalone (non-class) helper functions and module-level constants used
+ * across the Taskforce domain. These have no dependency on database state
+ * or class instance fields.
+ *
+ * Key exports:
+ *   - hashPassword / verifyPassword — PBKDF2-SHA256 password hashing
+ *   - hashAuthToken — SHA-256 one-time auth token hashing
+ *   - hashMcpAccessTokenSecret / verifyMcpAccessTokenSecret — MCP token hashing
+ *   - hashMcpOAuthSecret / verifyMcpOAuthSecret — OAuth secret hashing
+ *   - generateUuidV7 — time-ordered UUID v7 generation
+ *   - Feature key constants and DEFAULT_PLAN_FEATURE_CATALOG
+ *   - PLAN_FEATURE_DEPENDENCIES map
+ */
+import type { McpAccessTokenScope, PlanFeatureCatalogItem } from './types.js';
+export declare const DOCUMENT_CLOUD_STORAGE_FEATURE_KEY = "context.uploads";
+export declare const WORKSPACES_FEATURE_KEY = "workspace.switching";
+export declare const DOCUMENT_CLOUD_STORAGE_LIMIT_CONFIG_KEY = "storageLimitMb";
+export declare const WORKSPACES_LIMIT_CONFIG_KEY = "maxWorkspaces";
+export declare const MCP_ACCESS_TOKEN_MAX_ACTIVE_PER_USER_WORKSPACE = 10;
+export declare const MCP_ACCESS_TOKEN_DEFAULT_PAGE_SIZE = 20;
+export declare const MCP_ACCESS_TOKEN_MAX_PAGE_SIZE = 100;
+export declare const MCP_OAUTH_AUTH_CODE_TTL_MS: number;
+export declare const MCP_ACCESS_TOKEN_ALLOWED_SCOPES: McpAccessTokenScope[];
+export declare const DEFAULT_PLAN_FEATURE_CATALOG: PlanFeatureCatalogItem[];
+export declare const PLAN_FEATURE_DEPENDENCIES: Record<string, string[]>;
+export declare function hashPassword(password: string): string;
+export declare function verifyPassword(password: string, encoded: string): boolean;
+export declare function hashAuthToken(token: string): string;
+export declare function hashMcpAccessTokenSecret(secret: string): string;
+export declare function verifyMcpAccessTokenSecret(secret: string, encoded: string): boolean;
+export declare function hashMcpOAuthSecret(secret: string): string;
+export declare function verifyMcpOAuthSecret(secret: string, encoded: string): boolean;
+export declare function generateUuidV7(): string;

package/dist/core/shared.js

@@ -0,0 +1,128 @@
+/**
+ * Taskforce Core Shared Utilities
+ *
+ * Standalone (non-class) helper functions and module-level constants used
+ * across the Taskforce domain. These have no dependency on database state
+ * or class instance fields.
+ *
+ * Key exports:
+ *   - hashPassword / verifyPassword — PBKDF2-SHA256 password hashing
+ *   - hashAuthToken — SHA-256 one-time auth token hashing
+ *   - hashMcpAccessTokenSecret / verifyMcpAccessTokenSecret — MCP token hashing
+ *   - hashMcpOAuthSecret / verifyMcpOAuthSecret — OAuth secret hashing
+ *   - generateUuidV7 — time-ordered UUID v7 generation
+ *   - Feature key constants and DEFAULT_PLAN_FEATURE_CATALOG
+ *   - PLAN_FEATURE_DEPENDENCIES map
+ */
+import { createHash, pbkdf2Sync, randomBytes, timingSafeEqual } from 'crypto';
+// === SECTION: Constants ===
+export const DOCUMENT_CLOUD_STORAGE_FEATURE_KEY = 'context.uploads';
+export const WORKSPACES_FEATURE_KEY = 'workspace.switching';
+export const DOCUMENT_CLOUD_STORAGE_LIMIT_CONFIG_KEY = 'storageLimitMb';
+export const WORKSPACES_LIMIT_CONFIG_KEY = 'maxWorkspaces';
+export const MCP_ACCESS_TOKEN_MAX_ACTIVE_PER_USER_WORKSPACE = 10;
+export const MCP_ACCESS_TOKEN_DEFAULT_PAGE_SIZE = 20;
+export const MCP_ACCESS_TOKEN_MAX_PAGE_SIZE = 100;
+export const MCP_OAUTH_AUTH_CODE_TTL_MS = 10 * 60 * 1000;
+export const MCP_ACCESS_TOKEN_ALLOWED_SCOPES = ['tasks:read', 'tasks:write', 'workspace:read'];
+export const DEFAULT_PLAN_FEATURE_CATALOG = [
+    {
+        featureKey: 'collaboration.team_management',
+        label: 'Team Management',
+        description: 'Allow managing members, invites, roles, and collaboration settings.',
+        allowedAccessModes: ['enabled', 'disabled'],
+        configTemplate: {}
+    },
+    {
+        featureKey: DOCUMENT_CLOUD_STORAGE_FEATURE_KEY,
+        label: 'Document Cloud Storage',
+        description: 'Allow cloud document storage with an optional storage allowance in MB.',
+        allowedAccessModes: ['enabled', 'disabled'],
+        configTemplate: {
+            [DOCUMENT_CLOUD_STORAGE_LIMIT_CONFIG_KEY]: 1024
+        }
+    },
+    {
+        featureKey: WORKSPACES_FEATURE_KEY,
+        label: 'Workspaces',
+        description: 'Allow multiple workspaces with a configurable workspace limit.',
+        allowedAccessModes: ['enabled', 'disabled'],
+        configTemplate: {
+            [WORKSPACES_LIMIT_CONFIG_KEY]: 1
+        }
+    }
+];
+export const PLAN_FEATURE_DEPENDENCIES = Object.freeze(DEFAULT_PLAN_FEATURE_CATALOG.reduce((acc, feature) => {
+    if (Array.isArray(feature.dependsOn) && feature.dependsOn.length > 0) {
+        acc[feature.featureKey] = [...feature.dependsOn];
+    }
+    return acc;
+}, {}));
+// === SECTION: Password hashing ===
+export function hashPassword(password) {
+    const iterations = 120000;
+    const salt = randomBytes(16).toString('hex');
+    const hash = pbkdf2Sync(password, salt, iterations, 32, 'sha256').toString('hex');
+    return `pbkdf2-sha256$${iterations}$${salt}$${hash}`;
+}
+export function verifyPassword(password, encoded) {
+    const parts = String(encoded || '').split('$');
+    if (parts.length !== 4 || parts[0] !== 'pbkdf2-sha256')
+        return false;
+    const iterations = Number.parseInt(parts[1], 10);
+    const salt = parts[2];
+    const expectedHex = parts[3];
+    if (!Number.isFinite(iterations) || iterations <= 0 || !salt || !expectedHex)
+        return false;
+    const actual = pbkdf2Sync(password, salt, iterations, 32, 'sha256');
+    const expected = Buffer.from(expectedHex, 'hex');
+    if (expected.length !== actual.length)
+        return false;
+    return timingSafeEqual(actual, expected);
+}
+// === SECTION: Auth token hashing ===
+export function hashAuthToken(token) {
+    return createHash('sha256').update(token).digest('hex');
+}
+// === SECTION: MCP token hashing ===
+export function hashMcpAccessTokenSecret(secret) {
+    const iterations = 120000;
+    const salt = randomBytes(16).toString('hex');
+    const hash = pbkdf2Sync(secret, salt, iterations, 32, 'sha256').toString('hex');
+    return `pbkdf2-sha256$${iterations}$${salt}$${hash}`;
+}
+export function verifyMcpAccessTokenSecret(secret, encoded) {
+    return verifyPassword(secret, encoded);
+}
+export function hashMcpOAuthSecret(secret) {
+    return hashMcpAccessTokenSecret(secret);
+}
+export function verifyMcpOAuthSecret(secret, encoded) {
+    return verifyMcpAccessTokenSecret(secret, encoded);
+}
+// === SECTION: UUID generation ===
+export function generateUuidV7() {
+    const timestamp = BigInt(Date.now());
+    const bytes = new Uint8Array(16);
+    // 48-bit unix timestamp in milliseconds (big-endian)
+    bytes[0] = Number((timestamp >> 40n) & 0xffn);
+    bytes[1] = Number((timestamp >> 32n) & 0xffn);
+    bytes[2] = Number((timestamp >> 24n) & 0xffn);
+    bytes[3] = Number((timestamp >> 16n) & 0xffn);
+    bytes[4] = Number((timestamp >> 8n) & 0xffn);
+    bytes[5] = Number(timestamp & 0xffn);
+    // 80 bits random source -> UUIDv7 layout fields.
+    const random = randomBytes(10);
+    bytes[6] = 0x70 | (random[0] & 0x0f); // version 7 + rand_a high nibble
+    bytes[7] = random[1]; // rand_a low byte
+    bytes[8] = 0x80 | (random[2] & 0x3f); // variant 10xx + rand_b high bits
+    bytes[9] = random[3];
+    bytes[10] = random[4];
+    bytes[11] = random[5];
+    bytes[12] = random[6];
+    bytes[13] = random[7];
+    bytes[14] = random[8];
+    bytes[15] = random[9];
+    const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('');
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}