@taskforcehq/taskforce 0.3.301 → 0.3.303

package/dist/qaOpen.test.js

@@ -0,0 +1,56 @@
+import os from 'node:os';
+import path from 'node:path';
+import { describe, expect, it } from 'vitest';
+// @ts-ignore - JS helper module without generated .d.ts; covered by focused tests.
+import { assertQaProjectRootSafe, matchExpectedWorkspace, parseEnvFileContents, parseQaArgs, resolveExpectedWorkspace, resolveQaPaths } from '../scripts/qa-open-lib.mjs';
+describe('qa open helper library', () => {
+    it('derives a stable QA root layout for an agent', () => {
+        const homeDir = path.join(os.tmpdir(), 'qa-open-test-home');
+        const paths = resolveQaPaths({ agentId: 'Codex Main', homeDir });
+        expect(paths.agentId).toBe('codex-main');
+        expect(paths.root).toContain(path.join('.taskforce', 'qa', 'codex-main'));
+        expect(paths.projectRoot).toContain(path.join('.taskforce', 'qa', 'codex-main', 'project'));
+        expect(paths.playwrightStorageState).toContain(path.join('.taskforce', 'qa', 'codex-main', 'playwright-auth.json'));
+    });
+    it('parses env files with comments, export statements, and quoted values', () => {
+        const env = parseEnvFileContents(`
+            # comment
+            export TASKFORCE_E2E_EMAIL="codex@example.com"
+            TASKFORCE_E2E_PASSWORD='secret'
+            TASKFORCE_QA_EXPECTED_WORKSPACE_SLUG=codex-qa
+        `);
+        expect(env.TASKFORCE_E2E_EMAIL).toBe('codex@example.com');
+        expect(env.TASKFORCE_E2E_PASSWORD).toBe('secret');
+        expect(env.TASKFORCE_QA_EXPECTED_WORKSPACE_SLUG).toBe('codex-qa');
+    });
+    it('rejects QA roots inside the repository', () => {
+        const repoRoot = '/repo/taskforce';
+        expect(() => assertQaProjectRootSafe('/repo/taskforce', repoRoot)).toThrow(/inside the repository/i);
+        expect(() => assertQaProjectRootSafe('/repo/taskforce/tmp/qa', repoRoot)).toThrow(/inside the repository/i);
+        expect(() => assertQaProjectRootSafe('/tmp/taskforce-qa', repoRoot)).not.toThrow();
+    });
+    it('matches expected workspace by slug against the current workspace id', () => {
+        const match = matchExpectedWorkspace({
+            currentWorkspaceId: 'workspace-2',
+            workspaces: [
+                { id: 'workspace-1', slug: 'alpha' },
+                { id: 'workspace-2', slug: 'beta' }
+            ]
+        }, { workspaceId: null, workspaceSlug: 'beta' });
+        expect(match.ok).toBe(true);
+    });
+    it('builds args and expected workspace from env', () => {
+        const parsed = parseQaArgs([], {
+            TASKFORCE_QA_AGENT: 'Claude QA',
+            TASKFORCE_QA_MODE: 'staging',
+            TASKFORCE_QA_PORT: '5199'
+        });
+        expect(parsed.agentId).toBe('claude-qa');
+        expect(parsed.mode).toBe('staging');
+        expect(parsed.preferredPort).toBe(5199);
+        const expected = resolveExpectedWorkspace({
+            TASKFORCE_QA_EXPECTED_WORKSPACE_ID: 'workspace-123'
+        });
+        expect(expected).toEqual({ workspaceId: 'workspace-123', workspaceSlug: null });
+    });
+});

package/dist/server/index.cookieProxy.test.js

@@ -22,6 +22,8 @@ describe('proxy cookie rewrite helpers', () => {
         expect(shouldProxyCloudPath('/api/taskforce/public/site-config-script')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/version')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/account/entitlements')).toBe(true);
+        expect(shouldProxyCloudPath('/api/taskforce/account/profile-summary')).toBe(true);
+        expect(shouldProxyCloudPath('/api/taskforce/account/team-management-access')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/admin/mcp-audit-logs')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/billing/status')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/billing/checkout-session')).toBe(true);

package/dist/server/index.d.ts

@@ -22,6 +22,7 @@ interface AuthorizedRequestAccess extends RequestAccessContext {
 export declare function shouldProxyCloudPath(pathname: string): boolean;
 export declare function resolveCloudProxyUpstreamBaseUrl(req: http.IncomingMessage, fallbackBaseUrl: string): string;
 export declare function resolveAuthorizedWorkspaceAccess(core: Pick<TaskforceCore, 'resolveUserAccess' | 'getSystemRole'>, access: AuthorizedRequestAccess, requestedWorkspaceId: string): AuthorizedRequestAccess;
+export declare function resolveEffectiveRequestUserId(accessUserId: string, explicitUserId: string): string;
 export declare function resolveMaxPayloadBytesForPath(pathname: string, defaultMaxBytes: number): number;
 export declare function shouldRewriteSetCookieForLocalDevHost(hostHeader: string | undefined): boolean;
 export declare function writeJsonErrorIfPossible(res: http.ServerResponse, statusCode: number, payload: Record<string, unknown>): boolean;

package/dist/server/index.js

@@ -109,6 +109,8 @@ export function shouldProxyCloudPath(pathname) {
         || pathname === PUBLIC_SITE_CONFIG_SCRIPT_PATH
         || pathname === '/api/taskforce/version'
         || pathname === '/api/taskforce/account/entitlements'
+        || pathname === '/api/taskforce/account/profile-summary'
+        || pathname === '/api/taskforce/account/team-management-access'
         || pathname.startsWith('/api/taskforce/admin/')
         || pathname.startsWith('/api/taskforce/billing/')
         || pathname.startsWith('/api/taskforce/auth/')
@@ -145,6 +147,17 @@ export function resolveAuthorizedWorkspaceAccess(core, access, requestedWorkspac
     }
     return access;
 }
+export function resolveEffectiveRequestUserId(accessUserId, explicitUserId) {
+    const normalizedAccessUserId = String(accessUserId || '').trim();
+    if (normalizedAccessUserId && normalizedAccessUserId !== 'anonymous') {
+        return normalizedAccessUserId;
+    }
+    const normalizedExplicitUserId = String(explicitUserId || '').trim();
+    if (normalizedExplicitUserId && normalizedExplicitUserId !== 'anonymous') {
+        return normalizedExplicitUserId;
+    }
+    return 'anonymous';
+}
 export function resolveMaxPayloadBytesForPath(pathname, defaultMaxBytes) {
     if (pathname.startsWith('/api/taskforce/sync/')) {
         // Sync routes (especially applying local changes) often include large binary attachments
@@ -677,7 +690,10 @@ export function createStandaloneServer(options) {
                 req.headers['x-taskforce-role'] = access.role;
                 req.headers['x-taskforce-system-role'] = access.systemRole;
                 req.headers['x-taskforce-workspace-id'] = access.workspaceId;
-                req.headers['x-taskforce-user-id'] = access.userId;
+                const explicitRequestUserId = Array.isArray(req.headers['x-taskforce-user-id'])
+                    ? String(req.headers['x-taskforce-user-id'][0] || '')
+                    : String(req.headers['x-taskforce-user-id'] || '');
+                req.headers['x-taskforce-user-id'] = resolveEffectiveRequestUserId(access.userId, explicitRequestUserId);
                 if (isCollaborationPolicyEnabled() && isMutation && access.role === 'read-only') {
                     res.writeHead(403, { 'Content-Type': 'application/json' });
                     res.end(JSON.stringify({ error: 'Forbidden: read-only role cannot mutate data.' }));

package/dist/server/index.test.js

@@ -1,5 +1,5 @@
 import { describe, expect, it, vi } from 'vitest';
-import { ensureBillingWebhookAuthExclusion, ensurePublicSiteConfigAuthExclusion, isBillingWebhookPath, resolveAuthorizedWorkspaceAccess, shouldApplyAuthRateLimitForPath, shouldProxyCloudPath, writeJsonErrorIfPossible } from './index.js';
+import { ensureBillingWebhookAuthExclusion, ensurePublicSiteConfigAuthExclusion, isBillingWebhookPath, resolveEffectiveRequestUserId, resolveAuthorizedWorkspaceAccess, shouldApplyAuthRateLimitForPath, shouldProxyCloudPath, writeJsonErrorIfPossible } from './index.js';
 describe('server index helper policies', () => {
     it('adds webhook path to auth exclusions without duplicates', () => {
         const base = ['/api/taskforce/health', '/api/taskforce/auth'];
@@ -86,6 +86,8 @@ describe('shouldProxyCloudPath', () => {
         expect(shouldProxyCloudPath('/api/taskforce/admin/users')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/billing/plans')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/auth/login')).toBe(true);
+        expect(shouldProxyCloudPath('/api/taskforce/account/profile-summary')).toBe(true);
+        expect(shouldProxyCloudPath('/api/taskforce/account/team-management-access')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/public/site-config')).toBe(true);
         expect(shouldProxyCloudPath('/api/taskforce/public/site-config-script')).toBe(true);
     });
@@ -148,3 +150,15 @@ describe('resolveAuthorizedWorkspaceAccess', () => {
         expect(next.workspaceId).toBe('workspace-personal');
     });
 });
+describe('resolveEffectiveRequestUserId', () => {
+    it('prefers the authenticated access user when present', () => {
+        expect(resolveEffectiveRequestUserId('user-authenticated', 'user-explicit')).toBe('user-authenticated');
+    });
+    it('preserves an explicit local actor header when auth access is anonymous', () => {
+        expect(resolveEffectiveRequestUserId('anonymous', 'user-local-actor')).toBe('user-local-actor');
+        expect(resolveEffectiveRequestUserId('', 'user-local-actor')).toBe('user-local-actor');
+    });
+    it('falls back to anonymous when neither source has a user id', () => {
+        expect(resolveEffectiveRequestUserId('anonymous', '')).toBe('anonymous');
+    });
+});

package/dist/server/mockStripe.d.ts

@@ -11,6 +11,7 @@ type MockStripeCheckoutSessionRecord = {
     successUrl: string;
     cancelUrl: string;
     subscriptionId: string | null;
+    expiresAt: number;
     paymentStatus: 'unpaid' | 'paid';
     status: 'open' | 'complete' | 'expired';
 };

package/dist/server/mockStripe.js

@@ -122,6 +122,7 @@ function formatMockCheckoutSession(record, expandSubscription = false) {
         metadata: { ...record.metadata },
         payment_status: record.paymentStatus,
         status: record.status,
+        expires_at: record.expiresAt,
         subscription: record.subscriptionId
             ? (expandSubscription ? formatMockSubscription(getMockStripeSubscription(record.subscriptionId)) : record.subscriptionId)
             : null
@@ -243,6 +244,7 @@ export function createMockStripeClient() {
                         successUrl: String(params.success_url || '').trim(),
                         cancelUrl: String(params.cancel_url || '').trim(),
                         subscriptionId: null,
+                        expiresAt: Math.floor(Date.now() / 1000) + (24 * 60 * 60),
                         paymentStatus: 'unpaid',
                         status: 'open'
                     };

package/dist/server/routes/admin.js

@@ -59,6 +59,7 @@ import { normalizeStorageIntegrityScheduleSettings, resolveStorageIntegritySched
 import { resolveVirusScanConfigFromEnv } from '../../security/virusScan.js';
 import { applyPrefixedRateLimitHeaders } from '../rateLimit.js';
 import { createTaskforceMcpServer, isMcpWriteToolName } from '../../mcp/runtime.js';
+import { parseAiProfileBootstrapHeaders } from '../../mcp/aiProfileBootstrap.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
 import { randomUUID } from 'crypto';
@@ -81,33 +82,47 @@ export function registerAdminRoutes(deps) {
         const globalSettings = core.getGlobalSettings();
         return resolveEffectiveEmailConfig(process.env, globalSettings.email || null);
     };
+    const resolveBooleanSetting = (value, fallback) => {
+        if (typeof value === 'boolean')
+            return value;
+        if (typeof value === 'number')
+            return value !== 0;
+        const normalized = String(value || '').trim().toLowerCase();
+        if (!normalized)
+            return fallback;
+        if (['1', 'true', 'yes', 'on'].includes(normalized))
+            return true;
+        if (['0', 'false', 'no', 'off'].includes(normalized))
+            return false;
+        return fallback;
+    };
     const getAuthBehavior = () => {
         const globalSettings = core.getGlobalSettings();
         const authSettings = globalSettings.auth || {};
         const authRateLimitMaxRequestsRaw = Number(authSettings.authRateLimitMaxRequests);
         const authRateLimitWindowMsRaw = Number(authSettings.authRateLimitWindowMs);
-        const signupSettings = core.getSignupMonetizationSettings();
+        const onboardingPolicy = core.getOnboardingPolicy();
         return {
-            allowSelfRegistration: authSettings.allowSelfRegistration !== false,
-            requireVerifiedEmail: authSettings.requireVerifiedEmail !== false,
-            defaultNewUserBetaAccess: authSettings.defaultNewUserBetaAccess === true,
-            authRateLimitEnabled: authSettings.authRateLimitEnabled !== false,
+            allowSelfRegistration: resolveBooleanSetting(authSettings.allowSelfRegistration, true),
+            requireVerifiedEmail: resolveBooleanSetting(authSettings.requireVerifiedEmail, true),
+            defaultNewUserBetaAccess: resolveBooleanSetting(authSettings.defaultNewUserBetaAccess, false),
+            authRateLimitEnabled: resolveBooleanSetting(authSettings.authRateLimitEnabled, true),
             authRateLimitMaxRequests: Number.isFinite(authRateLimitMaxRequestsRaw) && authRateLimitMaxRequestsRaw >= 1
                 ? Math.floor(authRateLimitMaxRequestsRaw)
                 : 10,
             authRateLimitWindowMs: Number.isFinite(authRateLimitWindowMsRaw) && authRateLimitWindowMsRaw >= 1000
                 ? Math.floor(authRateLimitWindowMsRaw)
                 : 15 * 60_000,
-            signupMonetizationStrategy: signupSettings.strategy,
-            defaultSignupPlanVersionId: signupSettings.defaultSignupPlanVersionId
+            onboardingPolicyMode: onboardingPolicy.mode,
+            onboardingPlanVersionId: onboardingPolicy.planVersionId
         };
     };
     const getSiteBehavior = () => {
         const globalSettings = core.getGlobalSettings();
         const siteSettings = globalSettings.site || {};
         return {
-            showRunTaskforceLocally: siteSettings.showRunTaskforceLocally !== false,
-            pricingPageEnabled: siteSettings.pricingPageEnabled !== false
+            showRunTaskforceLocally: resolveBooleanSetting(siteSettings.showRunTaskforceLocally, true),
+            pricingPageEnabled: resolveBooleanSetting(siteSettings.pricingPageEnabled, true)
         };
     };
     const resolveEffectiveVirusScanSettings = () => {
@@ -148,6 +163,10 @@ export function registerAdminRoutes(deps) {
         }
         return String(configured || resolvePublicAuthBaseUrl(req)).replace(/\/+$/, '');
     };
+    const resolveAdminCloudEnvironment = (req) => {
+        return resolveTaskforceCloudEnvironmentFromBaseUrl(resolveRuntimeConfigBaseUrl(req))
+            || resolveTaskforceCloudEnvironmentFromBaseUrl(resolveCloudLoginBaseUrl(req));
+    };
     const resolveMcpOauthAuthorizeUrl = (req) => `${resolveMcpOauthIssuer(req)}/oauth/mcp/authorize`;
     const resolveMcpOauthTokenUrl = (req) => `${resolveMcpOauthIssuer(req)}/oauth/mcp/token`;
     const resolveMcpOauthRegisterUrl = (req) => `${resolveMcpOauthIssuer(req)}/oauth/mcp/register`;
@@ -264,13 +283,7 @@ export function registerAdminRoutes(deps) {
             ? authorization.slice(7).trim()
             : '';
         const requestedWorkspaceId = requestHeader(req, 'x-taskforce-workspace-id', '').trim();
-        const aiProfileToken = requestHeader(req, 'x-taskforce-ai-profile-token', '').trim() || null;
-        const aiProfileName = requestHeader(req, 'x-taskforce-ai-name', '').trim() || null;
-        const aiProfileDescription = requestHeader(req, 'x-taskforce-ai-description', '').trim() || null;
-        const aiProfileRole = requestHeader(req, 'x-taskforce-ai-role', '').trim() || null;
-        const aiProfileProvider = requestHeader(req, 'x-taskforce-ai-provider', '').trim() || null;
-        const aiProfileModel = requestHeader(req, 'x-taskforce-ai-model', '').trim() || null;
-        const aiProfileSurfaceType = requestHeader(req, 'x-taskforce-ai-surface-type', '').trim() || null;
+        const bootstrap = parseAiProfileBootstrapHeaders(req.headers);
         if (bearerToken) {
             const tokenAuth = core.authenticateMcpAccessToken(bearerToken);
             const oauthAuth = tokenAuth ? null : core.authenticateMcpOAuthAccessToken(bearerToken);
@@ -318,13 +331,7 @@ export function registerAdminRoutes(deps) {
                 authenticatedViaToken: tokenAuth || null,
                 authenticatedViaOAuth: oauthAuth || null,
                 userId: null,
-                aiProfileToken,
-                aiProfileName,
-                aiProfileDescription,
-                aiProfileRole,
-                aiProfileProvider,
-                aiProfileModel,
-                aiProfileSurfaceType,
+                ...bootstrap,
             };
         }
         core.addMcpAuditLog({
@@ -961,6 +968,51 @@ export function registerAdminRoutes(deps) {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ success: true }));
     });
+    // DELETE /api/taskforce/admin/system-users/:id - Purge a test user in non-production cloud environments
+    addRoute('DELETE', '/api/taskforce/admin/system-users/:id', async (req, res, params) => {
+        if (!requireCloudRuntime(res, 'System user purge'))
+            return;
+        if (!ensureAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: system admin role required.' }));
+            return;
+        }
+        const environment = resolveAdminCloudEnvironment(req);
+        if (environment !== 'staging' && environment !== 'performance') {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                error: 'System user purge is only available in staging and performance.',
+                code: 'SYSTEM_USER_PURGE_ENVIRONMENT_FORBIDDEN'
+            }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        const actor = resolveAdminRequestActor(req);
+        try {
+            const summary = core.purgeSystemUser({
+                targetUserId: params.id,
+                actorUserId: actor.userId,
+                emailConfirmation: String(body?.emailConfirmation || '')
+            });
+            auditAdminAction(req, 'purge-system-user', {
+                targetUserId: params.id,
+                targetEmail: summary.email,
+                environment,
+                summary
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true, environment, summary }));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                error: String(error?.message || 'Unable to purge system user'),
+                code: error?.code,
+                details: error?.details || null
+            }));
+        }
+    });
     // === SECTION: Admin email settings ===
     // GET /api/taskforce/admin/email-settings - Read email provider settings
     addRoute('GET', '/api/taskforce/admin/email-settings', async (req, res) => {
@@ -1033,7 +1085,9 @@ export function registerAdminRoutes(deps) {
             res.end(JSON.stringify({ error: 'Forbidden: admin role required.' }));
             return;
         }
-        const authSettings = core.getGlobalSettings().auth || {};
+        const globalSettings = core.getGlobalSettings();
+        const authSettings = globalSettings.auth || {};
+        const billingSettings = globalSettings.billing || {};
         const effective = getAuthBehavior();
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({
@@ -1044,11 +1098,13 @@ export function registerAdminRoutes(deps) {
                 ...(typeof authSettings.authRateLimitEnabled === 'boolean' ? { authRateLimitEnabled: authSettings.authRateLimitEnabled } : {}),
                 ...(typeof authSettings.authRateLimitMaxRequests === 'number' ? { authRateLimitMaxRequests: authSettings.authRateLimitMaxRequests } : {}),
                 ...(typeof authSettings.authRateLimitWindowMs === 'number' ? { authRateLimitWindowMs: authSettings.authRateLimitWindowMs } : {}),
-                ...((authSettings.signupMonetizationStrategy === 'auto_assign_default' || authSettings.signupMonetizationStrategy === 'plan_selection_required')
-                    ? { signupMonetizationStrategy: authSettings.signupMonetizationStrategy }
+                ...((billingSettings.onboardingPolicy?.mode === 'require_plan_selection'
+                    || billingSettings.onboardingPolicy?.mode === 'auto_grant_free'
+                    || billingSettings.onboardingPolicy?.mode === 'auto_start_trial')
+                    ? { onboardingPolicyMode: billingSettings.onboardingPolicy.mode }
                     : {}),
-                ...(typeof authSettings.defaultSignupPlanVersionId === 'string' || authSettings.defaultSignupPlanVersionId === null
-                    ? { defaultSignupPlanVersionId: authSettings.defaultSignupPlanVersionId ?? null }
+                ...(typeof billingSettings.onboardingPolicy?.planVersionId === 'string' || billingSettings.onboardingPolicy?.planVersionId === null
+                    ? { onboardingPlanVersionId: billingSettings.onboardingPolicy?.planVersionId ?? null }
                     : {})
             },
             status: {
@@ -1058,8 +1114,8 @@ export function registerAdminRoutes(deps) {
                 authRateLimitEnabled: effective.authRateLimitEnabled,
                 authRateLimitMaxRequests: effective.authRateLimitMaxRequests,
                 authRateLimitWindowMs: effective.authRateLimitWindowMs,
-                signupMonetizationStrategy: effective.signupMonetizationStrategy,
-                defaultSignupPlanVersionId: effective.defaultSignupPlanVersionId
+                onboardingPolicyMode: effective.onboardingPolicyMode,
+                onboardingPlanVersionId: effective.onboardingPlanVersionId
             }
         }));
     });
@@ -1685,21 +1741,21 @@ export function registerAdminRoutes(deps) {
             return;
         }
         const body = await parseJsonBody(req);
-        const signupMonetizationStrategy = body?.signupMonetizationStrategy === 'plan_selection_required'
-            ? 'plan_selection_required'
-            : 'auto_assign_default';
-        const defaultSignupPlanVersionId = typeof body?.defaultSignupPlanVersionId === 'string'
-            ? body.defaultSignupPlanVersionId.trim() || null
-            : body?.defaultSignupPlanVersionId === null
+        const onboardingPolicyMode = body?.onboardingPolicyMode === 'auto_grant_free' || body?.onboardingPolicyMode === 'auto_start_trial'
+            ? body.onboardingPolicyMode
+            : 'require_plan_selection';
+        const onboardingPlanVersionId = typeof body?.onboardingPlanVersionId === 'string'
+            ? body.onboardingPlanVersionId.trim() || null
+            : body?.onboardingPlanVersionId === null
                 ? null
                 : undefined;
-        const validation = core.validateSignupMonetizationSettings({
-            strategy: signupMonetizationStrategy,
-            ...(defaultSignupPlanVersionId !== undefined ? { defaultSignupPlanVersionId } : {})
+        const validation = core.validateOnboardingPolicy({
+            mode: onboardingPolicyMode,
+            ...(onboardingPlanVersionId !== undefined ? { planVersionId: onboardingPlanVersionId } : {})
         });
         if (!validation.valid) {
             res.writeHead(400, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: validation.message || 'Invalid signup monetization settings.', code: validation.code, details: validation.details }));
+            res.end(JSON.stringify({ error: validation.message || 'Invalid onboarding policy.', code: validation.code, details: validation.details }));
             return;
         }
         core.updateGlobalSettings({
@@ -1711,9 +1767,13 @@ export function registerAdminRoutes(deps) {
                 ...(typeof body?.authRateLimitMaxRequests === 'number' && Number.isFinite(body.authRateLimitMaxRequests)
                     ? { authRateLimitMaxRequests: Math.max(1, Math.floor(body.authRateLimitMaxRequests)) } : {}),
                 ...(typeof body?.authRateLimitWindowMs === 'number' && Number.isFinite(body.authRateLimitWindowMs)
-                    ? { authRateLimitWindowMs: Math.max(1000, Math.floor(body.authRateLimitWindowMs)) } : {}),
-                signupMonetizationStrategy,
-                ...(defaultSignupPlanVersionId !== undefined ? { defaultSignupPlanVersionId } : {})
+                    ? { authRateLimitWindowMs: Math.max(1000, Math.floor(body.authRateLimitWindowMs)) } : {})
+            },
+            billing: {
+                onboardingPolicy: {
+                    mode: onboardingPolicyMode,
+                    planVersionId: onboardingPlanVersionId ?? null
+                }
             }
         });
         res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -1812,7 +1872,7 @@ export function registerAdminRoutes(deps) {
     addRoute('OPTIONS', '/mcp', async (_req, res) => {
         res.writeHead(204, {
             'Access-Control-Allow-Origin': '*',
-            'Access-Control-Allow-Headers': 'authorization, content-type, accept, last-event-id, mcp-protocol-version, mcp-session-id, x-taskforce-workspace-id, x-taskforce-ai-profile-token, x-taskforce-ai-name, x-taskforce-ai-description, x-taskforce-ai-role, x-taskforce-ai-provider, x-taskforce-ai-model, x-taskforce-ai-surface-type',
+            'Access-Control-Allow-Headers': 'authorization, content-type, accept, last-event-id, mcp-protocol-version, mcp-session-id, x-taskforce-workspace-id, x-taskforce-ai-profile-token, x-taskforce-ai-name, x-taskforce-ai-icon, x-taskforce-ai-color, x-taskforce-ai-description, x-taskforce-ai-role, x-taskforce-ai-provider, x-taskforce-ai-model, x-taskforce-ai-surface-type',
             'Access-Control-Allow-Methods': 'GET, POST, DELETE, OPTIONS'
         });
         res.end();
@@ -1820,7 +1880,7 @@ export function registerAdminRoutes(deps) {
     addRoute('OPTIONS', '/mcp/', async (_req, res) => {
         res.writeHead(204, {
             'Access-Control-Allow-Origin': '*',
-            'Access-Control-Allow-Headers': 'authorization, content-type, accept, last-event-id, mcp-protocol-version, mcp-session-id, x-taskforce-workspace-id, x-taskforce-ai-profile-token, x-taskforce-ai-name, x-taskforce-ai-description, x-taskforce-ai-role, x-taskforce-ai-provider, x-taskforce-ai-model, x-taskforce-ai-surface-type',
+            'Access-Control-Allow-Headers': 'authorization, content-type, accept, last-event-id, mcp-protocol-version, mcp-session-id, x-taskforce-workspace-id, x-taskforce-ai-profile-token, x-taskforce-ai-name, x-taskforce-ai-icon, x-taskforce-ai-color, x-taskforce-ai-description, x-taskforce-ai-role, x-taskforce-ai-provider, x-taskforce-ai-model, x-taskforce-ai-surface-type',
             'Access-Control-Allow-Methods': 'GET, POST, DELETE, OPTIONS'
         });
         res.end();

package/dist/server/routes/auth.d.ts

@@ -20,7 +20,9 @@
  *   POST /api/taskforce/auth/invite/join
  *   POST /api/taskforce/auth/logout
  *   GET  /api/taskforce/account/access-status
+ *   GET  /api/taskforce/account/profile-summary
  *   GET  /api/taskforce/account/entitlements
+ *   GET  /api/taskforce/account/team-management-access
  *   GET  /api/taskforce/account/plan-preview
  *   GET  /api/taskforce/auth/workspace-members
  *   GET  /api/taskforce/workspace/assignee-options
@@ -36,6 +38,8 @@
 import type { IncomingMessage, ServerResponse } from 'http';
 import type { TaskforceCore } from '../../core/Taskforce.js';
 import type { RouteHandler, RouteContext } from '../routes.js';
+import type { ResolvedObjectStorageConfig } from '../../storage/objectStorage.js';
+import { ObjectStorageClient } from '../../storage/objectStorageClient.js';
 export interface AuthRouteDependencies {
     addRoute: (method: string, path: string, handler: RouteHandler) => void;
     core: TaskforceCore;
@@ -57,5 +61,7 @@ export interface AuthRouteDependencies {
     shouldExposeDevAuthTokens: () => boolean;
     resolveRuntimeConfigBaseUrl: (req: IncomingMessage) => string;
     resolvePublicAuthBaseUrl: (req: IncomingMessage) => string;
+    resolveEffectiveObjectStorageConfig: () => ResolvedObjectStorageConfig;
+    getObjectStorageClient: () => ObjectStorageClient | null;
 }
 export declare function registerAuthRoutes(deps: AuthRouteDependencies): void;