@taskforcehq/taskforce 0.3.301 → 0.3.302

package/dist/server/routes/tasks.js

@@ -58,6 +58,7 @@ import { parseJsonBody } from '../routes.js';
 import { resolveErrorStatusCode, requestHeader, requestRuntimeMode } from './shared.js';
 import { listBuiltInCustomTaxonomyLibraryPacks } from '../../shared/customTaxonomyLibrary.js';
 import { listBuiltInTaxonomyLibraryPacks } from '../../shared/taxonomyLibrary.js';
+import { shouldUseProvisionalTaskReferences } from '../../utils/taskReferences.js';
 // === SECTION: Registration ===
 export function registerTaskRoutes(deps) {
     const { addRoute, core, context, requestWorkspaceId, ensureAppAccess, resolveEffectiveObjectStorageConfig, buildBatchSummary, CLOUD_SAFE_CONFIG_PATHS, } = deps;
@@ -343,7 +344,8 @@ export function registerTaskRoutes(deps) {
             const result = core.bulkCreateTasks([taskInput], {
                 atomic: true,
                 validateOnly: true,
-                workspaceId
+                workspaceId,
+                provisionalLocalReference: shouldUseProvisionalTaskReferences(requestRuntimeMode(req))
             });
             const hasErrors = result.errors.length > 0;
             const failureStatus = hasErrors
@@ -361,7 +363,11 @@ export function registerTaskRoutes(deps) {
         }
         try {
             const workspaceId = requestWorkspaceId(req);
-            const task = core.createTask(taskInput, { workspaceId, actorRef: 'user' });
+            const task = core.createTask(taskInput, {
+                workspaceId,
+                actorRef: 'user',
+                provisionalLocalReference: shouldUseProvisionalTaskReferences(requestRuntimeMode(req))
+            });
             res.writeHead(201, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify(task));
         }
@@ -386,7 +392,14 @@ export function registerTaskRoutes(deps) {
         const body = await parseJsonBody(req);
         try {
             const workspaceId = requestWorkspaceId(req);
-            const updated = core.updateTask(params.id, body, workspaceId, { actorRef: 'user' });
+            const saveSource = body?.saveSource === 'autosave' ? 'autosave' : 'manual';
+            const updates = body && typeof body === 'object'
+                ? Object.fromEntries(Object.entries(body).filter(([key]) => key !== 'saveSource'))
+                : body;
+            const updated = core.updateTask(params.id, updates, workspaceId, {
+                actorRef: 'user',
+                skipTaskEvents: saveSource === 'autosave'
+            });
             if (!updated) {
                 res.writeHead(404, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ error: 'Task not found' }));
@@ -869,7 +882,8 @@ export function registerTaskRoutes(deps) {
         const result = core.bulkCreateTasks(tasks, {
             atomic: atomic !== false,
             validateOnly: validate_only === true,
-            workspaceId
+            workspaceId,
+            provisionalLocalReference: shouldUseProvisionalTaskReferences(requestRuntimeMode(req))
         });
         const hasErrors = result.errors.length > 0;
         const succeeded = validate_only ? (hasErrors ? 0 : result.total) : result.created.length;

package/dist/server/routes.js

@@ -10,6 +10,7 @@ import { createHash, randomUUID } from 'crypto';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
 import { TaskforceRuleError } from '../core/Taskforce.js';
+import { parseAiProfileBootstrapHeaders } from '../mcp/aiProfileBootstrap.js';
 import { createTaskforceMcpServer, isMcpWriteToolName } from '../mcp/runtime.js';
 import { applyPrefixedRateLimitHeaders } from './rateLimit.js';
 import { createSessionTokenCookie, resolveRequestAccess } from './auth.js';
@@ -69,6 +70,20 @@ function readPositiveInteger(value, fallback) {
         return fallback;
     return parsed;
 }
+function resolveBooleanSetting(value, fallback) {
+    if (typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number')
+        return value !== 0;
+    const normalized = String(value || '').trim().toLowerCase();
+    if (!normalized)
+        return fallback;
+    if (['1', 'true', 'yes', 'on'].includes(normalized))
+        return true;
+    if (['0', 'false', 'no', 'off'].includes(normalized))
+        return false;
+    return fallback;
+}
 // Convert route pattern like '/api/taskforce/tasks/:id' to regex
 function createRoutePattern(path) {
     const keys = [];
@@ -332,10 +347,10 @@ export function createRoutes(core, context = {}) {
         const authRateLimitWindowMsRaw = Number(authSettings.authRateLimitWindowMs);
         const signupSettings = core.getSignupMonetizationSettings();
         return {
-            allowSelfRegistration: authSettings.allowSelfRegistration !== false,
-            requireVerifiedEmail: authSettings.requireVerifiedEmail !== false,
-            defaultNewUserBetaAccess: authSettings.defaultNewUserBetaAccess === true,
-            authRateLimitEnabled: authSettings.authRateLimitEnabled !== false,
+            allowSelfRegistration: resolveBooleanSetting(authSettings.allowSelfRegistration, true),
+            requireVerifiedEmail: resolveBooleanSetting(authSettings.requireVerifiedEmail, true),
+            defaultNewUserBetaAccess: resolveBooleanSetting(authSettings.defaultNewUserBetaAccess, false),
+            authRateLimitEnabled: resolveBooleanSetting(authSettings.authRateLimitEnabled, true),
             authRateLimitMaxRequests: Number.isFinite(authRateLimitMaxRequestsRaw) && authRateLimitMaxRequestsRaw >= 1
                 ? Math.floor(authRateLimitMaxRequestsRaw)
                 : 10,
@@ -1124,13 +1139,7 @@ export function createRoutes(core, context = {}) {
             ? authorization.slice(7).trim()
             : '';
         const requestedWorkspaceId = requestHeader(req, 'x-taskforce-workspace-id', '').trim();
-        const aiProfileToken = requestHeader(req, 'x-taskforce-ai-profile-token', '').trim() || null;
-        const aiProfileName = requestHeader(req, 'x-taskforce-ai-name', '').trim() || null;
-        const aiProfileDescription = requestHeader(req, 'x-taskforce-ai-description', '').trim() || null;
-        const aiProfileRole = requestHeader(req, 'x-taskforce-ai-role', '').trim() || null;
-        const aiProfileProvider = requestHeader(req, 'x-taskforce-ai-provider', '').trim() || null;
-        const aiProfileModel = requestHeader(req, 'x-taskforce-ai-model', '').trim() || null;
-        const aiProfileSurfaceType = requestHeader(req, 'x-taskforce-ai-surface-type', '').trim() || null;
+        const bootstrap = parseAiProfileBootstrapHeaders(req.headers);
         if (bearerToken) {
             const tokenAuth = core.authenticateMcpAccessToken(bearerToken);
             const oauthAuth = tokenAuth ? null : core.authenticateMcpOAuthAccessToken(bearerToken);
@@ -1178,13 +1187,7 @@ export function createRoutes(core, context = {}) {
                 authenticatedViaToken: tokenAuth || null,
                 authenticatedViaOAuth: oauthAuth || null,
                 userId: null,
-                aiProfileToken,
-                aiProfileName,
-                aiProfileDescription,
-                aiProfileRole,
-                aiProfileProvider,
-                aiProfileModel,
-                aiProfileSurfaceType,
+                ...bootstrap,
             };
         }
         core.addMcpAuditLog({
@@ -1461,6 +1464,8 @@ export function createRoutes(core, context = {}) {
                     tokenId: auth.authenticatedViaToken?.tokenId || auth.authenticatedViaOAuth?.grantId || null,
                     aiProfileToken: auth.aiProfileToken,
                     aiProfileName: auth.aiProfileName,
+                    aiProfileIcon: auth.aiProfileIcon,
+                    aiProfileColor: auth.aiProfileColor,
                     aiProfileDescription: auth.aiProfileDescription,
                     aiProfileRole: auth.aiProfileRole,
                     aiProfileProvider: auth.aiProfileProvider,
@@ -1495,7 +1500,7 @@ export function createRoutes(core, context = {}) {
     };
     const resolveAdminRequestActor = makeResolveAdminRequestActor(core, context);
     const auditAdminAction = makeAuditAdminAction(core, context);
-    const auditAuthAction = makeAuditAuthAction(core, requestWorkspaceId);
+    const auditAuthAction = makeAuditAuthAction(core, requestWorkspaceId, context);
     const ensureAdminRole = makeEnsureAdminRole(core, context);
     const ensureAuthenticatedUser = makeEnsureAuthenticatedUser();
     const isCollaborationPolicyEnabled = () => {
@@ -1560,6 +1565,8 @@ export function createRoutes(core, context = {}) {
         shouldExposeDevAuthTokens,
         resolveRuntimeConfigBaseUrl,
         resolvePublicAuthBaseUrl,
+        resolveEffectiveObjectStorageConfig,
+        getObjectStorageClient,
     });
     registerWorkspaceRoutes({
         addRoute,

package/dist/server/routes.test.js

@@ -462,10 +462,22 @@ vi.mock('../core/Taskforce', () => {
             }));
             resolveUserIdentity = vi.fn().mockImplementation((userId) => {
                 if (userId === 'admin-user') {
-                    return { userId, email: 'admin@example.com' };
+                    return { userId, email: 'admin@example.com', avatarUrl: null };
                 }
                 return null;
             });
+            updateUserProfile = vi.fn().mockImplementation((userId, input) => ({
+                userId,
+                email: `${userId}@example.com`,
+                displayName: input.displayName,
+                avatarUrl: input.avatarUrl === undefined ? null : input.avatarUrl
+            }));
+            createUserAvatarUploadDraft = vi.fn();
+            getUserAvatarUploadDraft = vi.fn().mockReturnValue(null);
+            markUserAvatarUploadDraftFinalized = vi.fn().mockReturnValue(null);
+            markUserAvatarUploadDraftConsumed = vi.fn().mockReturnValue(null);
+            discardUserAvatarUploadDraft = vi.fn().mockReturnValue(null);
+            cleanupStaleUserAvatarUploadDrafts = vi.fn().mockReturnValue([]);
             resolvePreferredWorkspaceId = vi.fn().mockImplementation((options) => (options?.allowDefault ? 'default' : null));
             resolvePreferredUserWorkspaceId = vi.fn().mockImplementation((_userId, options) => {
                 const preferred = String(options?.preferredWorkspaceId || '').trim();
@@ -863,6 +875,8 @@ describe('Server Routes', () => {
                 authorization: 'Bearer tfmcp_ai_header_token',
                 'x-taskforce-ai-name': 'Automation Codex',
                 'x-taskforce-ai-profile-token': 'tfp_automation_codex',
+                'x-taskforce-ai-icon': 'Code2',
+                'x-taskforce-ai-color': '#10a37f',
                 'x-taskforce-ai-description': 'OpenAI Codex coding agent connected through MCP.',
                 'x-taskforce-ai-role': 'Coding Agent',
                 'x-taskforce-ai-provider': 'OpenAI',
@@ -3511,7 +3525,11 @@ describe('Server Routes', () => {
             const req = createMockReq('POST', '/api/taskforce/task', newTask);
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.createTask).toHaveBeenCalledWith(newTask, { workspaceId: 'default', actorRef: 'user' });
+            expect(core.createTask).toHaveBeenCalledWith(newTask, {
+                workspaceId: 'default',
+                actorRef: 'user',
+                provisionalLocalReference: true
+            });
             expect(res.writeHead).toHaveBeenCalledWith(201, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(JSON.stringify(createdTask));
         });
@@ -3591,7 +3609,7 @@ describe('Server Routes', () => {
                 const payload = JSON.parse(res.end.mock.calls[0][0]);
                 expect(payload?.config?.baseUrl).toBe('http://127.0.0.1:4271');
                 expect(payload?.config?.apiBaseUrl).toBe('http://127.0.0.1:4271');
-                expect(payload?.config?.cloudAuthBaseUrl).toBe('http://127.0.0.1:4271');
+                expect(payload?.config?.cloudAuthBaseUrl).toBe('https://app.taskforcehq.ai');
                 expect(payload?.config?.wsBaseUrl).toBe('http://127.0.0.1:4271');
                 expect(payload?.config?.cloudMcpBaseUrl).toBe('https://mcp.taskforcehq.ai');
             }
@@ -4172,6 +4190,44 @@ describe('Server Routes', () => {
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"success":true'));
         });
+        it('POST /api/taskforce/auth/login should treat string false as disabled verified-email enforcement', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            core.getGlobalSettings.mockReturnValue({
+                auth: {
+                    allowSelfRegistration: true,
+                    requireVerifiedEmail: 'false'
+                }
+            });
+            routes = createRoutes(core, { authConfig });
+            core.resolvePreferredUserWorkspaceId.mockReturnValueOnce(null);
+            core.authenticatePasswordUserDetailed.mockReturnValueOnce({
+                ok: true,
+                access: { userId: 'u2', workspaceId: 'default', role: 'member' }
+            });
+            const match = matchRoute('POST', '/api/taskforce/auth/login', routes);
+            const req = createMockReq('POST', '/api/taskforce/auth/login', {
+                email: 'user@example.com',
+                password: 'password123'
+            });
+            const res = createMockRes();
+            res.setHeader = vi.fn();
+            await match?.handler(req, res, {});
+            expect(core.authenticatePasswordUserDetailed).toHaveBeenCalledWith(expect.objectContaining({
+                email: 'user@example.com',
+                requireVerifiedEmail: false
+            }));
+            expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
+        });
         it('POST /api/taskforce/auth/login should re-scope default session workspace to accessible membership', async () => {
             const authConfig = {
                 runtimeMode: 'cloud',
@@ -8673,6 +8729,215 @@ describe('Server Routes', () => {
             expect(payload.betaAccess).toBe(false);
             expect(core.getUserBetaAccess).toHaveBeenCalledWith('u-no-workspace');
         });
+        it('GET /api/taskforce/auth/session should expose avatarUrl from the resolved profile', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            routes = createRoutes(core, { authConfig });
+            core.resolveUserIdentity.mockReturnValueOnce({
+                userId: 'u-avatar',
+                email: 'avatar@example.com',
+                displayName: 'Avatar User',
+                avatarUrl: '/api/taskforce/context/users%2Fu-avatar%2Fprofile%2Favatar%2Fdraft.png'
+            });
+            const cookie = createSessionTokenCookie('session-avatar-auth', authConfig, {
+                userId: 'u-avatar',
+                role: 'member',
+                workspaceId: 'workspace-1'
+            });
+            const match = matchRoute('GET', '/api/taskforce/auth/session', routes);
+            const req = createMockReq('GET', '/api/taskforce/auth/session', undefined, { cookie });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload.authenticated).toBe(true);
+            expect(payload.avatarUrl).toBe('/api/taskforce/context/users%2Fu-avatar%2Fprofile%2Favatar%2Fdraft.png');
+        });
+        it('POST /api/taskforce/auth/profile should save avatar by validated draft id', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            routes = createRoutes(core, { authConfig });
+            core.getUserAvatarUploadDraft.mockReturnValueOnce({
+                draftId: 'avatar-draft-1',
+                userId: 'u1',
+                storageKey: 'users/u1/profile/avatar/avatar-draft-1-headshot.png',
+                finalizedAt: '2026-04-09T00:00:00.000Z',
+                discardedAt: null
+            });
+            core.resolveUserIdentity.mockReturnValueOnce({
+                userId: 'u1',
+                email: 'u1@example.com',
+                displayName: 'Before',
+                avatarUrl: null
+            });
+            core.updateUserProfile.mockReturnValueOnce({
+                userId: 'u1',
+                email: 'u1@example.com',
+                displayName: 'Updated Name',
+                avatarUrl: '/api/taskforce/context/users%2Fu1%2Fprofile%2Favatar%2Favatar-draft-1-headshot.png'
+            });
+            const cookie = createSessionTokenCookie('session-profile-auth', authConfig, {
+                userId: 'u1',
+                role: 'member',
+                workspaceId: 'workspace-1'
+            });
+            const match = matchRoute('POST', '/api/taskforce/auth/profile', routes);
+            const req = createMockReq('POST', '/api/taskforce/auth/profile', {
+                displayName: 'Updated Name',
+                avatarDraftId: 'avatar-draft-1'
+            }, { cookie });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(core.updateUserProfile).toHaveBeenCalledWith('u1', {
+                displayName: 'Updated Name',
+                avatarUrl: '/api/taskforce/context/users%2Fu1%2Fprofile%2Favatar%2Favatar-draft-1-headshot.png'
+            });
+            expect(core.addAdminAuditLog).toHaveBeenCalledWith(expect.objectContaining({
+                action: 'auth-profile-updated',
+                actorUserId: 'u1',
+                actorRole: 'member'
+            }));
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload.profile.avatarUrl).toBe('/api/taskforce/context/users%2Fu1%2Fprofile%2Favatar%2Favatar-draft-1-headshot.png');
+        });
+        it('POST /api/taskforce/auth/profile/avatar/init should create a signed avatar upload draft', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            const routesWithStorage = createRoutes(core, {
+                authConfig,
+                objectStorage: {
+                    provider: 'r2',
+                    r2: {
+                        accountId: 'acct-1',
+                        bucket: 'taskforce-docs',
+                        endpoint: 'https://example.r2.cloudflarestorage.com',
+                        accessKeyId: 'access-key-1',
+                        secretAccessKey: 'secret-key-1',
+                        keyPrefix: 'taskforce',
+                        signedUploadTtlSeconds: 600,
+                        signedDownloadTtlSeconds: 300
+                    }
+                }
+            });
+            const cookie = createSessionTokenCookie('session-avatar-init', authConfig, {
+                userId: 'u1',
+                role: 'member',
+                workspaceId: 'workspace-1'
+            });
+            const match = matchRoute('POST', '/api/taskforce/auth/profile/avatar/init', routesWithStorage);
+            const req = createMockReq('POST', '/api/taskforce/auth/profile/avatar/init', {
+                originalName: 'headshot.png',
+                mimeType: 'image/png',
+                size: 1024
+            }, { cookie });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload.success).toBe(true);
+            expect(payload.draftId).toMatch(/^avatar-draft-/);
+            expect(payload.relativePath).toMatch(/^users\/u1\/profile\/avatar\/avatar-draft-[a-f0-9]{32}-headshot\.png$/);
+            expect(payload.uploadUrl).toContain('X-Amz-Signature=');
+            expect(core.createUserAvatarUploadDraft).toHaveBeenCalledWith(expect.objectContaining({
+                userId: 'u1',
+                draftId: payload.draftId,
+                storageKey: payload.relativePath,
+                mimeType: 'image/png'
+            }));
+        });
+        it('POST /api/taskforce/auth/profile/avatar/finalize should validate and finalize the uploaded draft', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            const fetchMock = vi.fn().mockResolvedValue({
+                ok: true,
+                status: 200,
+                statusText: 'OK',
+                headers: { get: () => 'image/png' },
+                arrayBuffer: async () => new Uint8Array([1, 2, 3]).buffer
+            });
+            vi.stubGlobal('fetch', fetchMock);
+            const routesWithStorage = createRoutes(core, {
+                authConfig,
+                objectStorage: {
+                    provider: 'r2',
+                    r2: {
+                        accountId: 'acct-1',
+                        bucket: 'taskforce-docs',
+                        endpoint: 'https://example.r2.cloudflarestorage.com',
+                        accessKeyId: 'access-key-1',
+                        secretAccessKey: 'secret-key-1',
+                        keyPrefix: 'taskforce',
+                        signedUploadTtlSeconds: 600,
+                        signedDownloadTtlSeconds: 300
+                    }
+                }
+            });
+            core.getUserAvatarUploadDraft.mockReturnValueOnce({
+                draftId: 'avatar-draft-1',
+                userId: 'u1',
+                storageKey: 'users/u1/profile/avatar/avatar-draft-1-headshot.png',
+                finalizedAt: null,
+                discardedAt: null
+            });
+            core.markUserAvatarUploadDraftFinalized.mockReturnValueOnce({
+                draftId: 'avatar-draft-1',
+                userId: 'u1',
+                storageKey: 'users/u1/profile/avatar/avatar-draft-1-headshot.png',
+                finalizedAt: '2026-04-09T00:00:00.000Z',
+                discardedAt: null
+            });
+            const cookie = createSessionTokenCookie('session-avatar-finalize', authConfig, {
+                userId: 'u1',
+                role: 'member',
+                workspaceId: 'workspace-1'
+            });
+            const match = matchRoute('POST', '/api/taskforce/auth/profile/avatar/finalize', routesWithStorage);
+            const req = createMockReq('POST', '/api/taskforce/auth/profile/avatar/finalize', {
+                draftId: 'avatar-draft-1',
+                relativePath: 'users/u1/profile/avatar/avatar-draft-1-headshot.png'
+            }, { cookie });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload.success).toBe(true);
+            expect(payload.avatarUrl).toBe('/api/taskforce/context/users%2Fu1%2Fprofile%2Favatar%2Favatar-draft-1-headshot.png');
+            expect(core.markUserAvatarUploadDraftFinalized).toHaveBeenCalledWith('u1', 'avatar-draft-1');
+            vi.unstubAllGlobals();
+        });
         it('GET /api/taskforce/admin/system-users should require system admin role', async () => {
             const match = matchRoute('GET', '/api/taskforce/admin/system-users', routes);
             const req = createMockReq('GET', '/api/taskforce/admin/system-users', undefined, { 'x-taskforce-system-role': 'user' });
@@ -8701,6 +8966,54 @@ describe('Server Routes', () => {
             expect(payload.planId).toBe('collab');
             expect(payload.features['collaboration.invites'].allowed).toBe(true);
         });
+        it('GET /api/taskforce/account/team-management-access should return unified role and team plan access', async () => {
+            core.resolveUserAccess.mockReturnValueOnce({
+                userId: 'u1',
+                workspaceId: 'default',
+                role: 'owner',
+                disabled: false,
+                betaAccess: true
+            });
+            const match = matchRoute('GET', '/api/taskforce/account/team-management-access', routes);
+            const req = createMockReq('GET', '/api/taskforce/account/team-management-access', undefined, {
+                'x-taskforce-user-id': 'u1',
+                'x-taskforce-workspace-id': 'workspace-1',
+                'x-taskforce-role': 'owner'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(core.resolveUserAccess).toHaveBeenCalledWith('u1', 'default', 'member');
+            expect(core.getAccountEntitlementsPayload).toHaveBeenCalledWith({ userId: 'u1', workspaceId: 'default' });
+            expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload).toMatchObject({
+                workspaceId: 'default',
+                role: 'owner',
+                canManageWorkspace: true,
+                teamPlanMode: 'team',
+                allowed: true
+            });
+        });
+        it('GET /api/taskforce/account/team-management-access should fall back to the hinted workspace role when local access cannot resolve the cloud user id', async () => {
+            core.resolveUserAccess.mockReturnValueOnce(null);
+            const match = matchRoute('GET', '/api/taskforce/account/team-management-access', routes);
+            const req = createMockReq('GET', '/api/taskforce/account/team-management-access?workspaceId=workspace-1', undefined, {
+                'x-taskforce-user-id': 'u-cloud',
+                'x-taskforce-workspace-role': 'owner'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(core.resolveUserAccess).toHaveBeenCalledWith('u-cloud', 'workspace-1', 'member');
+            expect(core.getAccountEntitlementsPayload).toHaveBeenCalledWith({ userId: 'u-cloud', workspaceId: 'workspace-1' });
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload).toMatchObject({
+                workspaceId: 'workspace-1',
+                role: 'owner',
+                canManageWorkspace: true,
+                teamPlanMode: 'team',
+                allowed: true
+            });
+        });
         it('GET /api/taskforce/account/access-status should return pending plan-selection gate', async () => {
             core.getAccountAccessStatus.mockReturnValueOnce({
                 gate: 'plan_selection_required',
@@ -10894,7 +11207,8 @@ describe('Server Routes', () => {
             expect(core.bulkCreateTasks).toHaveBeenCalledWith([newTask], {
                 atomic: true,
                 validateOnly: true,
-                workspaceId: 'default'
+                workspaceId: 'default',
+                provisionalLocalReference: true
             });
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(JSON.stringify({
@@ -10949,7 +11263,8 @@ describe('Server Routes', () => {
             expect(core.bulkCreateTasks).toHaveBeenCalledWith(inputs, {
                 atomic: true,
                 validateOnly: false,
-                workspaceId: 'default'
+                workspaceId: 'default',
+                provisionalLocalReference: true
             });
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(JSON.stringify({
@@ -11023,7 +11338,8 @@ describe('Server Routes', () => {
             expect(core.bulkCreateTasks).toHaveBeenCalledWith(inputs, {
                 atomic: true,
                 validateOnly: true,
-                workspaceId: 'default'
+                workspaceId: 'default',
+                provisionalLocalReference: true
             });
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(JSON.stringify({
@@ -11044,6 +11360,36 @@ describe('Server Routes', () => {
                 errors: []
             }));
         });
+        it('PATCH /api/taskforce/task/:id should pass autosave updates through as non-audited route metadata', async () => {
+            const updatedTask = { id: '123', description: 'Draft body' };
+            core.updateTask.mockReturnValue(updatedTask);
+            const url = '/api/taskforce/task/123';
+            const match = matchRoute('PATCH', url, routes);
+            const req = createMockReq('PATCH', url, { description: 'Draft body', saveSource: 'autosave' });
+            const res = createMockRes();
+            await match?.handler(req, res, { id: '123' });
+            expect(core.updateTask).toHaveBeenCalledWith('123', { description: 'Draft body' }, 'default', {
+                actorRef: 'user',
+                skipTaskEvents: true
+            });
+            expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
+            expect(res.end).toHaveBeenCalledWith(JSON.stringify(updatedTask));
+        });
+        it('PATCH /api/taskforce/task/:id should keep manual updates on the audited path', async () => {
+            const updatedTask = { id: '123', description: 'Manual body' };
+            core.updateTask.mockReturnValue(updatedTask);
+            const url = '/api/taskforce/task/123';
+            const match = matchRoute('PATCH', url, routes);
+            const req = createMockReq('PATCH', url, { description: 'Manual body', saveSource: 'manual' });
+            const res = createMockRes();
+            await match?.handler(req, res, { id: '123' });
+            expect(core.updateTask).toHaveBeenCalledWith('123', { description: 'Manual body' }, 'default', {
+                actorRef: 'user',
+                skipTaskEvents: false
+            });
+            expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
+            expect(res.end).toHaveBeenCalledWith(JSON.stringify(updatedTask));
+        });
         it('PATCH /api/taskforce/task/:id should return rule-error status/message', async () => {
             core.updateTask.mockImplementation(() => {
                 const err = new Error('Task update blocked by rule check');

package/dist/shared/runtimeContract.d.ts

@@ -1,5 +1,5 @@
 export type RuntimeMode = 'local' | 'cloud';
-export type AuthSource = 'cloud' | 'local';
+export type AuthSource = 'cloud';
 export type WorkspaceMode = 'single-local' | 'multi-cloud';
 export interface RuntimeModeContract {
     runtimeMode: RuntimeMode;

package/dist/sync/collaborationSyncPayload.d.ts

@@ -0,0 +1,17 @@
+import type { WorkspaceSyncAiProfileSnapshot, WorkspaceSyncAnnotatedAttachmentSessionSnapshot, WorkspaceSyncDocumentReviewCommentSnapshot, WorkspaceSyncDocumentReviewSessionSnapshot } from './workspaceSyncModel.js';
+import type { AiProfileSurfaceType } from '../shared/aiProfileSurfaceType.js';
+export declare function normalizeAiProfileSyncPayload(raw: unknown, workspaceId: string, normalizeSurfaceType: (value: unknown, context: {
+    source: string;
+    profileId?: string;
+    workspaceId?: string;
+}) => AiProfileSurfaceType | null, source: string): WorkspaceSyncAiProfileSnapshot | null;
+export declare function normalizeDocumentReviewSessionSyncPayload(raw: unknown, sourceWatermark?: string): WorkspaceSyncDocumentReviewSessionSnapshot | null;
+export declare function normalizeDocumentReviewCommentSyncPayload(raw: unknown, options?: {
+    sessionId?: string;
+    sourceWatermark?: string;
+}): WorkspaceSyncDocumentReviewCommentSnapshot | null;
+export declare function normalizeAnnotatedAttachmentSessionSyncPayload(raw: unknown, expectedWorkspaceId?: string, sourceWatermark?: string): WorkspaceSyncAnnotatedAttachmentSessionSnapshot | null;
+export declare function normalizeDeleteSyncPayload(raw: unknown, idKey: 'sessionId' | 'commentId'): {
+    id: string;
+    deletedAt: string;
+} | null;