@taskforcehq/taskforce 0.3.170 → 0.3.301

package/dist/server/annotatedAttachmentsRoutes.test.js

@@ -0,0 +1,473 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { Readable, Writable } from 'stream';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { TaskforceCore } from '../core/Taskforce.js';
+import { createRoutes, matchRoute } from './routes.js';
+import { registerAnnotatedAttachmentRoutes } from './routes/annotatedAttachments.js';
+import { ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY, APP_GATE_DEFINITIONS, } from '../runtime/appGates.js';
+import { TaskforceRuleError } from '../core/Taskforce.js';
+function createProjectRoot() {
+    return fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-annotated-attachment-routes-'));
+}
+function createMockReq(method, url, body, headers) {
+    const req = new Readable();
+    req._read = () => { };
+    if (body === undefined) {
+        req.push(null);
+    }
+    else if (typeof body === 'string') {
+        req.push(body);
+        req.push(null);
+    }
+    else {
+        req.push(JSON.stringify(body));
+        req.push(null);
+    }
+    req.method = method;
+    req.url = url;
+    req.headers = headers || {};
+    return req;
+}
+function createMockRes() {
+    const bodyChunks = [];
+    let writableEnded = false;
+    const headers = new Map();
+    const res = new Writable({
+        write(chunk, _encoding, callback) {
+            bodyChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+            callback();
+        }
+    });
+    res.statusCode = 200;
+    Object.defineProperty(res, 'writableEnded', {
+        configurable: true,
+        get: () => writableEnded,
+    });
+    res.writeHead = ((statusCode, nextHeaders) => {
+        res.statusCode = statusCode;
+        if (nextHeaders) {
+            for (const [key, value] of Object.entries(nextHeaders)) {
+                headers.set(key.toLowerCase(), value);
+            }
+        }
+        return res;
+    });
+    res.setHeader = ((name, value) => {
+        headers.set(name.toLowerCase(), value);
+    });
+    res.getHeader = ((name) => headers.get(name.toLowerCase()));
+    const originalEnd = res.end.bind(res);
+    res.end = ((chunk) => {
+        if (chunk !== undefined) {
+            bodyChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+        }
+        writableEnded = true;
+        return originalEnd();
+    });
+    res.__getBody = () => Buffer.concat(bodyChunks).toString('utf8');
+    return res;
+}
+describe('annotated attachment routes', () => {
+    let previousGateEnabled = false;
+    beforeEach(() => {
+        previousGateEnabled = APP_GATE_DEFINITIONS[ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY].enabled;
+        APP_GATE_DEFINITIONS[ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY].enabled = true;
+    });
+    afterEach(() => {
+        APP_GATE_DEFINITIONS[ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY].enabled = previousGateEnabled;
+    });
+    it('creates, lists, updates, and reads annotated attachment session payloads', async () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({
+            projectRoot,
+            storagePath: path.join(projectRoot, '.taskforce'),
+        });
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+            const category = core.getCategories()[0]?.value;
+            const type = core.getTypes()[0]?.value;
+            const task = core.createTask({ title: 'Review image', category, type }, { workspaceId: 'workspace-1', actorRef: 'owner-1' });
+            const assetStore = core.getWorkspaceAssetStore();
+            assetStore.upsertAsset({
+                assetId: 'asset-image-1',
+                workspaceId: 'workspace-1',
+                kind: 'image',
+                originalFilename: 'ui-review.png',
+                logicalName: 'UI Review',
+                mimeType: 'image/png',
+                storageProvider: 'local',
+                storageKey: 'workspaces/workspace-1/assets/images/asset-image-1-ui-review.png',
+                contentSha256: 'sha-image-1',
+                sizeBytes: 256,
+            });
+            assetStore.upsertLink({
+                workspaceId: 'workspace-1',
+                assetId: 'asset-image-1',
+                taskId: task.id,
+                role: 'attachment',
+            });
+            const routes = createRoutes(core);
+            const createMatch = matchRoute('POST', '/api/taskforce/annotated-attachments/sessions', routes);
+            const createReq = createMockReq('POST', '/api/taskforce/annotated-attachments/sessions?workspaceId=workspace-1', {
+                taskId: task.id,
+                baseImageAssetId: 'asset-image-1',
+                title: 'Homepage review',
+                globalInstruction: 'Answer each marker in order.',
+                annotations: [
+                    {
+                        id: 'marker-1',
+                        kind: 'pin',
+                        order: 0,
+                        markerType: 'question',
+                        instruction: 'What should change here?',
+                        x: 0.2,
+                        y: 0.3,
+                    }
+                ],
+            }, { 'x-taskforce-user-id': 'owner-1' });
+            const createRes = createMockRes();
+            await createMatch?.handler(createReq, createRes, {});
+            expect(createRes.statusCode).toBe(200);
+            const created = JSON.parse(createRes.__getBody());
+            expect(created.success).toBe(true);
+            expect(created.session).toMatchObject({
+                taskId: task.id,
+                baseImageAssetId: 'asset-image-1',
+                title: 'Homepage review',
+                globalInstruction: 'Answer each marker in order.',
+            });
+            const sessionId = String(created.session.id);
+            const listMatch = matchRoute('GET', '/api/taskforce/annotated-attachments/sessions', routes);
+            const listReq = createMockReq('GET', `/api/taskforce/annotated-attachments/sessions?workspaceId=workspace-1&taskId=${encodeURIComponent(task.id)}&imageAssetId=asset-image-1`);
+            const listRes = createMockRes();
+            await listMatch?.handler(listReq, listRes, {});
+            const listed = JSON.parse(listRes.__getBody());
+            expect(listRes.statusCode).toBe(200);
+            expect(listed.sessions).toHaveLength(1);
+            expect(listed.sessions[0].id).toBe(sessionId);
+            const patchMatch = matchRoute('PATCH', `/api/taskforce/annotated-attachments/sessions/${sessionId}`, routes);
+            const patchReq = createMockReq('PATCH', `/api/taskforce/annotated-attachments/sessions/${sessionId}?workspaceId=workspace-1`, {
+                title: 'Homepage review revised',
+                annotations: [
+                    {
+                        id: 'marker-1',
+                        kind: 'box',
+                        order: 0,
+                        markerType: 'issue',
+                        instruction: 'Review this whole panel.',
+                        x: 0.1,
+                        y: 0.15,
+                        width: 0.3,
+                        height: 0.2,
+                    }
+                ],
+            }, { 'x-taskforce-user-id': 'owner-1' });
+            const patchRes = createMockRes();
+            await patchMatch?.handler(patchReq, patchRes, { id: sessionId });
+            const patched = JSON.parse(patchRes.__getBody());
+            expect(patchRes.statusCode).toBe(200);
+            expect(patched.session.title).toBe('Homepage review revised');
+            expect(patched.session.annotations[0]).toMatchObject({
+                kind: 'box',
+                instruction: 'Review this whole panel.',
+            });
+            const payloadMatch = matchRoute('GET', `/api/taskforce/annotated-attachments/sessions/${sessionId}/payload`, routes);
+            const payloadReq = createMockReq('GET', `/api/taskforce/annotated-attachments/sessions/${sessionId}/payload?workspaceId=workspace-1`);
+            const payloadRes = createMockRes();
+            await payloadMatch?.handler(payloadReq, payloadRes, { id: sessionId });
+            const payload = JSON.parse(payloadRes.__getBody());
+            expect(payloadRes.statusCode).toBe(200);
+            expect(payload.payload).toMatchObject({
+                taskId: task.id,
+                sessionId,
+                title: 'Homepage review revised',
+                image: {
+                    assetId: 'asset-image-1',
+                    referenceLabel: 'I-1',
+                    apiUrl: '/api/taskforce/context/workspaces%2Fworkspace-1%2Fassets%2Fimages%2Fasset-image-1-ui-review.png',
+                },
+            });
+            expect(payload.payload.annotations[0].cropHint.x).toBeCloseTo(0.06, 10);
+            expect(payload.payload.annotations[0].cropHint.y).toBeCloseTo(0.11, 10);
+            expect(payload.payload.annotations[0].cropHint.width).toBeCloseTo(0.38, 10);
+            expect(payload.payload.annotations[0].cropHint.height).toBeCloseTo(0.28, 10);
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('allows local mutation attribution fallback when local runtime has an active user even if auth is enabled', async () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({
+            projectRoot,
+            storagePath: path.join(projectRoot, '.taskforce'),
+        });
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+            const now = new Date().toISOString();
+            core.db.prepare(`
+                INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, beta_access, is_disabled, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            `).run('user-local-1', core.getTenantId(), 'local@example.com', 'Local User', 'local', 'user-local-1', 1, 0, now, now);
+            core.db.prepare(`
+                INSERT INTO workspace_memberships (id, tenant_id, workspace_id, user_id, role, status, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+            `).run('membership-local-1', core.getTenantId(), 'workspace-1', 'user-local-1', 'owner', 'active', now, now);
+            core.getWorkspaceAssetStore().upsertAsset({
+                assetId: 'asset-image-1',
+                workspaceId: 'workspace-1',
+                kind: 'image',
+                originalFilename: 'ui-review.png',
+                logicalName: 'UI Review',
+                mimeType: 'image/png',
+                storageProvider: 'local',
+                storageKey: 'workspaces/workspace-1/assets/images/asset-image-1-ui-review.png',
+                contentSha256: 'sha-image-1',
+                sizeBytes: 256,
+            });
+            const routes = createRoutes(core, {
+                authConfig: {
+                    runtimeMode: 'local',
+                    enabled: true,
+                    requiredForApi: false,
+                    excludedPaths: [],
+                    defaultRole: 'member',
+                    defaultWorkspaceId: 'default',
+                    sessionCookieName: 'taskforce_session',
+                    sessionSecret: 'test-secret',
+                    sessionTtlSeconds: 3600,
+                    sessionCookieSameSite: 'Lax',
+                    sessionCookieSecure: false,
+                },
+            });
+            const createMatch = matchRoute('POST', '/api/taskforce/annotated-attachments/sessions', routes);
+            const createReq = createMockReq('POST', '/api/taskforce/annotated-attachments/sessions?workspaceId=workspace-1', {
+                taskId: '',
+                baseImageAssetId: 'asset-image-1',
+                title: 'Fallback session',
+                annotations: [],
+            });
+            const createRes = createMockRes();
+            await createMatch?.handler(createReq, createRes, {});
+            expect(createRes.statusCode).toBe(200);
+            expect(JSON.parse(createRes.__getBody())).toMatchObject({
+                success: true,
+                session: expect.objectContaining({
+                    createdByActorId: 'user-local-1',
+                    updatedByActorId: 'user-local-1',
+                }),
+            });
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('rejects session creation when mutation identity is unresolved', async () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({
+            projectRoot,
+            storagePath: path.join(projectRoot, '.taskforce'),
+        });
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+            const routes = [];
+            registerAnnotatedAttachmentRoutes({
+                addRoute: (method, path, handler) => {
+                    const keys = [];
+                    const pattern = new RegExp(`^${`${method}:${path}`.replace(/:([^/]+)/g, (_match, key) => {
+                        keys.push(key);
+                        return '([^/]+)';
+                    })}$`);
+                    routes.push({ pattern, keys, handler });
+                },
+                core,
+                requestWorkspaceId: () => 'workspace-1',
+                resolveAuthenticatedUserId: () => {
+                    throw new TaskforceRuleError('Authenticated user required for mutation attribution.', 401, 'MUTATION_AUTH_REQUIRED');
+                },
+                ensureAppAccess: () => true,
+            });
+            const createMatch = matchRoute('POST', '/api/taskforce/annotated-attachments/sessions', routes);
+            const createReq = createMockReq('POST', '/api/taskforce/annotated-attachments/sessions?workspaceId=workspace-1', {
+                taskId: '',
+                baseImageAssetId: 'asset-image-1',
+                title: 'Should fail',
+                annotations: [],
+            });
+            const createRes = createMockRes();
+            await createMatch?.handler(createReq, createRes, {});
+            expect(createRes.statusCode).toBe(401);
+            expect(JSON.parse(createRes.__getBody())).toMatchObject({
+                success: false,
+                code: 'MUTATION_AUTH_REQUIRED',
+            });
+        }
+        finally {
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('resolves an image target by image reference label', async () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({
+            projectRoot,
+            storagePath: path.join(projectRoot, '.taskforce'),
+        });
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+            const category = core.getCategories()[0]?.value;
+            const type = core.getTypes()[0]?.value;
+            const task = core.createTask({ title: 'Reference image task', category, type }, { workspaceId: 'workspace-1', actorRef: 'owner-1' });
+            const assetStore = core.getWorkspaceAssetStore();
+            assetStore.upsertAsset({
+                assetId: 'asset-image-24',
+                workspaceId: 'workspace-1',
+                kind: 'image',
+                originalFilename: 'reference-image.png',
+                logicalName: 'Reference image',
+                mimeType: 'image/png',
+                storageProvider: 'local',
+                storageKey: 'workspaces/workspace-1/assets/images/asset-image-24-reference-image.png',
+                contentSha256: 'sha-image-24',
+                sizeBytes: 256,
+                referenceNumber: 24,
+            });
+            assetStore.upsertLink({
+                workspaceId: 'workspace-1',
+                assetId: 'asset-image-24',
+                taskId: task.id,
+                role: 'image',
+            });
+            const routes = createRoutes(core);
+            const match = matchRoute('GET', '/api/taskforce/annotated-attachments/images/I-24', routes);
+            const req = createMockReq('GET', '/api/taskforce/annotated-attachments/images/I-24?workspaceId=workspace-1');
+            const res = createMockRes();
+            await match?.handler(req, res, { reference: 'I-24' });
+            expect(res.statusCode).toBe(200);
+            expect(JSON.parse(res.__getBody())).toEqual({
+                target: expect.objectContaining({
+                    assetId: 'asset-image-24',
+                    taskId: task.id,
+                    taskReferenceLabel: task.referenceLabel,
+                    imageReferenceLabel: 'I-24',
+                    path: '/api/taskforce/context/workspaces%2Fworkspace-1%2Fassets%2Fimages%2Fasset-image-24-reference-image.png',
+                    displayName: 'Reference image',
+                }),
+            });
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('resolves an image target by canonical asset id without requiring a task link', async () => {
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({
+            projectRoot,
+            storagePath: path.join(projectRoot, '.taskforce'),
+        });
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+            core.getWorkspaceAssetStore().upsertAsset({
+                assetId: 'asset-image-42',
+                workspaceId: 'workspace-1',
+                kind: 'image',
+                originalFilename: 'standalone-image.png',
+                logicalName: 'Standalone image',
+                mimeType: 'image/png',
+                storageProvider: 'local',
+                storageKey: 'workspaces/workspace-1/assets/images/asset-image-42-standalone-image.png',
+                contentSha256: 'sha-image-42',
+                sizeBytes: 256,
+                referenceNumber: 42,
+            });
+            const routes = createRoutes(core);
+            const match = matchRoute('GET', '/api/taskforce/annotated-attachments/images/asset-image-42', routes);
+            const req = createMockReq('GET', '/api/taskforce/annotated-attachments/images/asset-image-42?workspaceId=workspace-1');
+            const res = createMockRes();
+            await match?.handler(req, res, { reference: 'asset-image-42' });
+            expect(res.statusCode).toBe(200);
+            expect(JSON.parse(res.__getBody())).toEqual({
+                target: expect.objectContaining({
+                    assetId: 'asset-image-42',
+                    taskId: null,
+                    taskReferenceLabel: null,
+                    imageReferenceLabel: 'I-42',
+                    path: '/api/taskforce/context/workspaces%2Fworkspace-1%2Fassets%2Fimages%2Fasset-image-42-standalone-image.png',
+                    displayName: 'Standalone image',
+                }),
+            });
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('rejects access when the annotated attachments gate is disabled', async () => {
+        APP_GATE_DEFINITIONS[ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY].enabled = false;
+        const projectRoot = createProjectRoot();
+        const core = new TaskforceCore({
+            projectRoot,
+            storagePath: path.join(projectRoot, '.taskforce'),
+        });
+        try {
+            core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+            const routes = createRoutes(core);
+            const match = matchRoute('GET', '/api/taskforce/annotated-attachments/sessions', routes);
+            const req = createMockReq('GET', '/api/taskforce/annotated-attachments/sessions?workspaceId=workspace-1&taskId=task-1');
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(res.statusCode).toBe(403);
+            const body = JSON.parse(res.__getBody());
+            expect(body.error).toBe('Annotated attachments are unavailable for this workspace.');
+            expect(typeof body.code).toBe('string');
+        }
+        finally {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
+    it('uses the authenticated user resolver for created session actors', async () => {
+        const handlers = new Map();
+        const core = {
+            createAnnotatedAttachmentSession: (input) => ({
+                id: 'session-1',
+                workspaceId: input.workspaceId,
+                taskId: input.taskId,
+                baseImageAssetId: input.baseImageAssetId,
+                title: input.title,
+                globalInstruction: input.globalInstruction,
+                annotations: input.annotations,
+                createdByActorId: input.actorId,
+                updatedByActorId: input.actorId,
+            }),
+        };
+        registerAnnotatedAttachmentRoutes({
+            addRoute: (method, routePath, handler) => {
+                handlers.set(`${method} ${routePath}`, handler);
+            },
+            core,
+            requestWorkspaceId: () => 'workspace-1',
+            resolveAuthenticatedUserId: () => 'ross.burke',
+            ensureAppAccess: () => true,
+        });
+        const handler = handlers.get('POST /api/taskforce/annotated-attachments/sessions');
+        expect(handler).toBeDefined();
+        const req = createMockReq('POST', '/api/taskforce/annotated-attachments/sessions?workspaceId=workspace-1', {
+            taskId: 'task-1',
+            baseImageAssetId: 'asset-image-1',
+            title: 'Homepage review',
+            globalInstruction: '',
+            annotations: [],
+        });
+        const res = createMockRes();
+        await handler?.(req, res, {});
+        expect(res.statusCode).toBe(200);
+        const payload = JSON.parse(res.__getBody());
+        expect(payload.session.createdByActorId).toBe('ross.burke');
+        expect(payload.session.updatedByActorId).toBe('ross.burke');
+    });
+});

package/dist/server/auth.js

@@ -1,4 +1,5 @@
 import { createHmac, timingSafeEqual } from 'crypto';
+import { getTaskforceCloudEnvironmentConfig, parseTaskforceCloudEnvironment } from '../config/cloudEnvironment.js';
 function parseBoolean(raw, fallback) {
     if (raw === undefined)
         return fallback;
@@ -23,6 +24,15 @@ function parsePositiveInt(raw, fallback) {
         return fallback;
     return value;
 }
+function inferCloudSessionCookieDomain(env) {
+    const cloudEnvironment = parseTaskforceCloudEnvironment(env.TASKFORCE_CLOUD_ENVIRONMENT);
+    if (!cloudEnvironment)
+        return undefined;
+    const appHost = new URL(getTaskforceCloudEnvironmentConfig(cloudEnvironment).appBaseUrl).hostname.toLowerCase();
+    if (appHost.endsWith('.taskforcehq.ai'))
+        return 'taskforcehq.ai';
+    return undefined;
+}
 function normalizeSameSite(raw, fallback) {
     const value = String(raw || '').trim().toLowerCase();
     if (value === 'lax')
@@ -72,7 +82,8 @@ export function resolveAuthConfigFromEnv(runtimeMode, env = process.env) {
         ? parseBoolean(explicitEnabled, false)
         : (runtimeMode === 'cloud');
     const requiredForApi = parseBoolean(env.TASKFORCE_AUTH_REQUIRED_FOR_API, runtimeMode === 'cloud');
-    const excludedPathsRaw = env.TASKFORCE_AUTH_EXCLUDED_PATHS || '/api/taskforce/health,/api/taskforce/version,/api/taskforce/auth';
+    const excludedPathsRaw = env.TASKFORCE_AUTH_EXCLUDED_PATHS
+        || '/api/taskforce/health,/api/taskforce/version,/api/taskforce/auth,/api/taskforce/public/pricing,/api/taskforce/public/site-config,/api/taskforce/public/site-config-script';
     const excludedPaths = excludedPathsRaw
         .split(',')
         .map(v => v.trim())
@@ -82,7 +93,8 @@ export function resolveAuthConfigFromEnv(runtimeMode, env = process.env) {
     const sessionTtlSeconds = parsePositiveInt(env.TASKFORCE_AUTH_SESSION_TTL_SECONDS, 60 * 60 * 24 * 30);
     const sessionCookieSameSite = normalizeSameSite(env.TASKFORCE_AUTH_SESSION_SAMESITE, runtimeMode === 'cloud' ? 'None' : 'Lax');
     const sessionCookieSecure = parseBoolean(env.TASKFORCE_AUTH_SESSION_SECURE, runtimeMode === 'cloud');
-    const sessionCookieDomain = String(env.TASKFORCE_AUTH_SESSION_DOMAIN || '').trim() || undefined;
+    const explicitSessionCookieDomain = String(env.TASKFORCE_AUTH_SESSION_DOMAIN || '').trim();
+    const sessionCookieDomain = explicitSessionCookieDomain || inferCloudSessionCookieDomain(env);
     const defaultRole = normalizeRole(env.TASKFORCE_AUTH_DEFAULT_ROLE, 'member');
     // No env-configured default workspace. Workspace selection must come from
     // explicit header/session resolution and user setup flows.

package/dist/server/auth.test.js

@@ -13,7 +13,14 @@ describe('server/auth', () => {
         expect(config.enabled).toBe(false);
         expect(config.requiredForApi).toBe(false);
         expect(config.sessionCookieSecure).toBe(false);
-        expect(config.excludedPaths).toEqual(['/api/taskforce/health', '/api/taskforce/version', '/api/taskforce/auth']);
+        expect(config.excludedPaths).toEqual([
+            '/api/taskforce/health',
+            '/api/taskforce/version',
+            '/api/taskforce/auth',
+            '/api/taskforce/public/pricing',
+            '/api/taskforce/public/site-config',
+            '/api/taskforce/public/site-config-script'
+        ]);
     });
     it('defaults to auth-required in cloud mode', () => {
         const config = resolveAuthConfigFromEnv('cloud', {});
@@ -21,6 +28,19 @@ describe('server/auth', () => {
         expect(config.requiredForApi).toBe(true);
         expect(config.sessionCookieSecure).toBe(true);
     });
+    it('infers a shared cookie domain for official cloud environments', () => {
+        const config = resolveAuthConfigFromEnv('cloud', {
+            TASKFORCE_CLOUD_ENVIRONMENT: 'performance'
+        });
+        expect(config.sessionCookieDomain).toBe('taskforcehq.ai');
+    });
+    it('prefers an explicitly configured session cookie domain', () => {
+        const config = resolveAuthConfigFromEnv('cloud', {
+            TASKFORCE_CLOUD_ENVIRONMENT: 'performance',
+            TASKFORCE_AUTH_SESSION_DOMAIN: 'performance-app.taskforcehq.ai'
+        });
+        expect(config.sessionCookieDomain).toBe('performance-app.taskforcehq.ai');
+    });
     it('allows excluded health path without session', () => {
         const config = resolveAuthConfigFromEnv('cloud', {
             TASKFORCE_AUTH_ENABLED: 'true',

package/dist/server/cors.js

@@ -2,7 +2,12 @@ const DEFAULT_ALLOWED_ORIGINS = [
     'https://taskforcehq.ai',
     'https://www.taskforcehq.ai',
     'https://app.taskforcehq.ai',
+    'https://mcp.taskforcehq.ai',
     'https://admin.taskforcehq.ai',
+    'https://staging-app.taskforcehq.ai',
+    'https://staging-mcp.taskforcehq.ai',
+    'https://performance-app.taskforcehq.ai',
+    'https://performance-mcp.taskforcehq.ai',
     // Allow local development and packaged desktop webviews out of the box.
     '__loopback__',
     '__null__',
@@ -15,12 +20,13 @@ const CORS_ALLOW_METHODS = 'GET, POST, PUT, PATCH, DELETE, OPTIONS';
 const CORS_ALLOW_HEADERS = 'Content-Type';
 export function getAllowedOriginsFromEnv(envValue) {
     const raw = typeof envValue === 'string' ? envValue.trim() : '';
+    const allowed = new Set(DEFAULT_ALLOWED_ORIGINS);
     if (!raw)
-        return new Set(DEFAULT_ALLOWED_ORIGINS);
-    return new Set(raw
-        .split(',')
-        .map(v => v.trim())
-        .filter(Boolean));
+        return allowed;
+    for (const value of raw.split(',').map(v => v.trim()).filter(Boolean)) {
+        allowed.add(value);
+    }
+    return allowed;
 }
 export function resolveAllowedOrigin(originHeader, allowedOrigins) {
     const origin = typeof originHeader === 'string' ? originHeader.trim() : '';

package/dist/server/cors.test.js

@@ -20,6 +20,7 @@ describe('server cors helpers', () => {
         const set = getAllowedOriginsFromEnv('https://a.test, https://b.test');
         expect(set.has('https://a.test')).toBe(true);
         expect(set.has('https://b.test')).toBe(true);
+        expect(set.has('https://app.taskforcehq.ai')).toBe(true);
     });
     it('resolves allowed origin only when listed', () => {
         const allowed = new Set(['https://taskforcehq.ai']);
@@ -60,6 +61,11 @@ describe('server cors helpers', () => {
         expect(res.getHeader('Access-Control-Allow-Origin')).toBe('https://taskforcehq.ai');
         expect(res.getHeader('Access-Control-Allow-Credentials')).toBe('true');
     });
+    it('includes official staging and performance app origins by default', () => {
+        const allowed = getAllowedOriginsFromEnv();
+        expect(resolveAllowedOrigin('https://staging-app.taskforcehq.ai', allowed)).toBe('https://staging-app.taskforcehq.ai');
+        expect(resolveAllowedOrigin('https://performance-app.taskforcehq.ai', allowed)).toBe('https://performance-app.taskforcehq.ai');
+    });
     it('rejects disallowed origin', () => {
         const allowed = new Set(['https://taskforcehq.ai']);
         const req = mockReq('https://evil.test');

package/dist/server/documentReviewRoutes.test.d.ts

@@ -0,0 +1 @@
+export {};