@taskforcehq/taskforce 0.3.303 → 0.3.304

package/dist/mcp/runtime.test.js

@@ -436,11 +436,11 @@ describe('Taskforce MCP tool descriptions', () => {
             expect(linkTaskContext.description).toContain('external http(s) URL');
             expect(saveTaskAttachment.description).toContain('generated content');
             expect(saveTaskAttachment.description).toContain('overwrite=true');
-            expect(saveTaskAttachment.description).toContain('AI-authored markdown/text should usually be passed inline via content');
+            expect(saveTaskAttachment.description).toContain('use inline content for AI-authored markdown/text');
             expect(saveTaskAttachment.inputSchema).toBeDefined();
             const saveTaskAttachmentSchema = saveTaskAttachment.inputSchema;
             expect(saveTaskAttachmentSchema.properties.content.description).toContain('use this for AI-authored markdown/text attachments');
-            expect(saveTaskAttachmentSchema.properties.sourcePath.description).toContain('local runtime only today');
+            expect(saveTaskAttachmentSchema.properties.sourcePath.description).toContain('approved agent workspace root');
             expect(resolveProfile.description).toContain('AI collaborator profile');
             expect(resolveProfile.description).toContain('Update semantics');
             expect(resolveProfile.description).toContain('empty strings are ignored rather than clearing');
@@ -1667,6 +1667,40 @@ describe('Taskforce MCP tool descriptions', () => {
             fs.rmSync(projectRoot, { recursive: true, force: true });
         }
     });
+    it('returns summary-only rows from list_tasks json output', async () => {
+        const projectRoot = createProjectRoot();
+        try {
+            const created = parseToolJson(await callTool(projectRoot, 'local', 'create_task', {
+                title: 'List summary task',
+                description: 'Verbose description that should not appear in list rows'
+            }));
+            await callTool(projectRoot, 'local', 'replace_task_checklist', {
+                taskId: created.referenceLabel,
+                items: [
+                    { title: 'Checklist item one', isCompleted: false }
+                ]
+            });
+            await callTool(projectRoot, 'local', 'add_comment', {
+                id: created.referenceLabel,
+                text: 'Verbose comment that should not appear in list rows',
+                author: 'ai-profile-019d15c5-6ad3-7bf0-9b9e-fa9c366c3ff4'
+            });
+            const listed = parseToolJson(await callTool(projectRoot, 'local', 'list_tasks', {
+                format: 'json'
+            }));
+            const row = listed.find((task) => task.referenceLabel === created.referenceLabel);
+            expect(row).toBeTruthy();
+            expect(row.description).toBeUndefined();
+            expect(row.comments).toBeUndefined();
+            expect(row.taskEvents).toBeUndefined();
+            expect(row.activity).toBeUndefined();
+            expect(row.attachments).toBeUndefined();
+            expect(row.checklistItems).toBeUndefined();
+        }
+        finally {
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    });
     it('reads task resources by T-XXX reference and exposes version/scope in config resource', async () => {
         const projectRoot = createProjectRoot();
         try {
@@ -1961,8 +1995,45 @@ describe('Taskforce MCP tool descriptions', () => {
             fs.rmSync(projectRoot, { recursive: true, force: true });
         }
     });
-    it('rejects sourcePath for save_task_attachment in cloud runtime', async () => {
+    it('allows save_task_attachment sourcePath in cloud runtime for approved agent workspace roots', async () => {
+        const projectRoot = createProjectRoot();
+        const agentWorkspaceRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-mcp-agent-workspace-'));
+        const previousRoots = process.env.TASKFORCE_ALLOWED_ATTACHMENT_SOURCE_ROOTS;
+        try {
+            const core = new TaskforceCore({
+                projectRoot,
+                storagePath: path.join(projectRoot, '.taskforce')
+            });
+            const task = core.createTask({ title: 'Cloud sourcePath allow test' }, { workspaceId: 'workspace-1' });
+            core.close();
+            const sourcePath = path.join(agentWorkspaceRoot, 'implementation-plan.md');
+            fs.writeFileSync(sourcePath, '# Recovered implementation plan', 'utf8');
+            process.env.TASKFORCE_ALLOWED_ATTACHMENT_SOURCE_ROOTS = agentWorkspaceRoot;
+            await callTool(projectRoot, 'cloud', 'save_task_attachment', {
+                id: task.id,
+                filename: 'implementation-plan.md',
+                sourcePath
+            });
+            const readBack = parseToolJson(await callTool(projectRoot, 'cloud', 'read_task_attachment', {
+                taskId: task.id,
+                attachmentId: parseToolJson(await callTool(projectRoot, 'cloud', 'get_task_attachments', { id: task.id })).attachments[0]?.attachmentId
+            }));
+            expect(readBack.content).toContain('# Recovered implementation plan');
+        }
+        finally {
+            if (previousRoots === undefined) {
+                delete process.env.TASKFORCE_ALLOWED_ATTACHMENT_SOURCE_ROOTS;
+            }
+            else {
+                process.env.TASKFORCE_ALLOWED_ATTACHMENT_SOURCE_ROOTS = previousRoots;
+            }
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+            fs.rmSync(agentWorkspaceRoot, { recursive: true, force: true });
+        }
+    });
+    it('rejects save_task_attachment sourcePath in cloud runtime for unapproved roots', async () => {
         const projectRoot = createProjectRoot();
+        const externalRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-mcp-cloud-unapproved-'));
         try {
             const core = new TaskforceCore({
                 projectRoot,
@@ -1970,16 +2041,18 @@ describe('Taskforce MCP tool descriptions', () => {
             });
             const task = core.createTask({ title: 'Cloud sourcePath reject test' }, { workspaceId: 'workspace-1' });
             core.close();
+            const sourcePath = path.join(externalRoot, 'outside.md');
+            fs.writeFileSync(sourcePath, '# Outside approved roots', 'utf8');
             const result = await callTool(projectRoot, 'cloud', 'save_task_attachment', {
                 id: task.id,
-                filename: 'copy.txt',
-                sourcePath: 'docs/source.txt'
+                filename: 'outside.md',
+                sourcePath
             });
-            expect(result.content?.[0]?.text).toContain('does not support sourcePath for save_task_attachment yet');
-            expect(result.content?.[0]?.text).toContain('resend the attachment using inline content instead');
+            expect(result.content?.[0]?.text).toContain('sourcePath must be within project root, a Taskforce-managed attachment source, or an approved agent workspace root');
         }
         finally {
             fs.rmSync(projectRoot, { recursive: true, force: true });
+            fs.rmSync(externalRoot, { recursive: true, force: true });
         }
     });
     it('accepts task references for save_task_attachment', async () => {
@@ -2331,7 +2404,7 @@ describe('Taskforce MCP tool descriptions', () => {
                 filename: 'outside.md',
                 sourcePath: externalSourcePath
             });
-            expect(result.content?.[0]?.text).toContain('sourcePath must be within project root or a Taskforce-managed attachment source');
+            expect(result.content?.[0]?.text).toContain('sourcePath must be within project root, a Taskforce-managed attachment source, or an approved agent workspace root');
         }
         finally {
             fs.rmSync(projectRoot, { recursive: true, force: true });

package/dist/mcp/taskAttachmentHelpers.d.ts

@@ -0,0 +1,41 @@
+import type { WorkspaceAssetEntry, WorkspaceAssetKind, WorkspaceAssetStore } from '../storage/workspaceAssetStore.js';
+import type { McpTaskAttachmentDescriptor, TaskAttachmentRecord } from './taskAttachmentTypes.js';
+export interface TaskAttachmentHelpersDeps {
+    activeWorkspaceId: string;
+    workspaceAssetStore: WorkspaceAssetStore | null;
+    getImageReferenceLabel: (asset: WorkspaceAssetEntry | null | undefined) => string | null;
+    getDocumentReferenceLabel: (asset: WorkspaceAssetEntry | null | undefined) => string | null;
+    inferMimeTypeFromPath: (filePath: string) => string;
+    inferAssetKind: (filePath: string, mimeType: string) => WorkspaceAssetKind;
+    isTextReadableMimeType: (mimeTypeRaw: string) => boolean;
+    isValidCanonicalDocumentAsset: (params: Pick<WorkspaceAssetEntry, 'kind' | 'storageKey' | 'originalFilename' | 'mimeType'>) => boolean;
+    canonicalAssetHelpers: {
+        getAttachmentAssetRecord: (attachment: TaskAttachmentRecord) => WorkspaceAssetEntry | null;
+        normalizeAttachmentStorageKey: (pathValue: unknown, fsPathValue: unknown) => string | null;
+        buildSyntheticAttachmentId: (taskId: string, attachment: TaskAttachmentRecord) => string;
+        toTaskAttachmentRecord: (attachment: string | TaskAttachmentRecord) => TaskAttachmentRecord;
+    };
+    documentHelpers: {
+        buildCanonicalDocumentAttachmentHint: (asset: {
+            assetId: string;
+            documentId: string | null;
+            referenceNumber?: number | null;
+            mimeType?: string | null;
+        }) => {
+            documentId: string | null;
+            preferredNextTool: string;
+            preferredWorkflow: string;
+            suggestedArgs: {
+                documentId: string;
+            };
+            guidance: string;
+        } | null;
+    };
+}
+export declare function createTaskAttachmentHelpers(deps: TaskAttachmentHelpersDeps): {
+    describeTaskAttachment: (taskId: string, attachmentInput: string | TaskAttachmentRecord) => McpTaskAttachmentDescriptor;
+    listTaskAttachmentDescriptors: (task: {
+        id: string;
+        attachments?: Array<string | TaskAttachmentRecord> | null;
+    }) => McpTaskAttachmentDescriptor[];
+};

package/dist/mcp/taskAttachmentHelpers.js

@@ -0,0 +1,60 @@
+export function createTaskAttachmentHelpers(deps) {
+    const isCanonicalDocumentAssetRecord = (asset) => deps.isValidCanonicalDocumentAsset(asset);
+    const describeTaskAttachment = (taskId, attachmentInput) => {
+        const attachment = deps.canonicalAssetHelpers.toTaskAttachmentRecord(attachmentInput);
+        const asset = deps.canonicalAssetHelpers.getAttachmentAssetRecord(attachment);
+        const storageKey = deps.canonicalAssetHelpers.normalizeAttachmentStorageKey(attachment.path, attachment.fsPath);
+        const assetId = String(attachment.assetId || asset?.assetId || '').trim() || undefined;
+        const source = (asset?.storageProvider === 'external' || /^https?:\/\//i.test(String(attachment.path || '').trim()))
+            ? 'external'
+            : 'canonical';
+        const mimeType = String(asset?.mimeType
+            || (storageKey && !/^https?:\/\//i.test(storageKey) ? deps.inferMimeTypeFromPath(storageKey) : '')
+            || deps.inferMimeTypeFromPath(String(attachment.originalFilename || attachment.displayName || attachment.caption || attachment.path || ''))).trim() || 'application/octet-stream';
+        const kind = asset?.kind || deps.inferAssetKind(storageKey || String(attachment.path || ''), mimeType);
+        const isCanonicalDocument = Boolean(asset && isCanonicalDocumentAssetRecord(asset)) || (!asset && kind === 'document');
+        const referenceNumber = typeof attachment.referenceNumber === 'number'
+            ? attachment.referenceNumber
+            : (typeof asset?.referenceNumber === 'number' ? asset.referenceNumber : null);
+        const referenceLabel = String(attachment.referenceLabel
+            || (kind === 'image' ? deps.getImageReferenceLabel(asset) : '')
+            || (isCanonicalDocument ? deps.getDocumentReferenceLabel(asset) : '')).trim() || null;
+        const readableAsText = source === 'canonical' && deps.isTextReadableMimeType(mimeType);
+        const canonicalDocumentHint = isCanonicalDocument && source === 'canonical' && asset
+            ? deps.documentHelpers.buildCanonicalDocumentAttachmentHint(asset)
+            : null;
+        return {
+            attachmentId: assetId || deps.canonicalAssetHelpers.buildSyntheticAttachmentId(taskId, attachment),
+            ...(assetId ? { assetId } : {}),
+            ...(referenceNumber ? { referenceNumber } : {}),
+            ...(referenceLabel ? { referenceLabel } : {}),
+            ...(canonicalDocumentHint?.documentId ? { documentId: canonicalDocumentHint.documentId } : {}),
+            path: String(attachment.path || '').trim(),
+            ...(storageKey && !/^https?:\/\//i.test(storageKey) ? { fsPath: storageKey } : (attachment.fsPath ? { fsPath: String(attachment.fsPath).trim() } : {})),
+            ...(attachment.caption ? { caption: String(attachment.caption).trim() } : {}),
+            ...(attachment.displayName ? { displayName: String(attachment.displayName).trim() } : {}),
+            ...(attachment.originalFilename ? { originalFilename: String(attachment.originalFilename).trim() } : {}),
+            kind: isCanonicalDocument ? 'document' : kind,
+            mimeType,
+            sizeBytes: asset ? Number(asset.sizeBytes || 0) : null,
+            ...(attachment.timestamp ? { timestamp: String(attachment.timestamp).trim() } : {}),
+            source,
+            readableAsText,
+            ...(canonicalDocumentHint ? {
+                preferredNextTool: canonicalDocumentHint.preferredNextTool,
+                preferredWorkflow: canonicalDocumentHint.preferredWorkflow,
+                suggestedArgs: canonicalDocumentHint.suggestedArgs,
+                guidance: canonicalDocumentHint.guidance,
+            } : {}),
+        };
+    };
+    const listTaskAttachmentDescriptors = (task) => {
+        if (!task || !Array.isArray(task.attachments))
+            return [];
+        return task.attachments.map((attachment) => describeTaskAttachment(task.id, attachment));
+    };
+    return {
+        describeTaskAttachment,
+        listTaskAttachmentDescriptors,
+    };
+}

package/dist/mcp/taskAttachmentTypes.d.ts

@@ -0,0 +1,37 @@
+import type { WorkspaceAssetKind } from '../storage/workspaceAssetStore.js';
+export type TaskAttachmentRecord = {
+    path: string;
+    fsPath?: string;
+    caption?: string;
+    displayName?: string;
+    originalFilename?: string;
+    timestamp?: string;
+    assetId?: string;
+    referenceNumber?: number | null;
+    referenceLabel?: string | null;
+    taskId?: string | null;
+};
+export type McpTaskAttachmentDescriptor = {
+    attachmentId: string;
+    assetId?: string;
+    referenceNumber?: number | null;
+    referenceLabel?: string | null;
+    documentId?: string | null;
+    path: string;
+    fsPath?: string;
+    caption?: string;
+    displayName?: string;
+    originalFilename?: string;
+    kind: WorkspaceAssetKind;
+    mimeType: string;
+    sizeBytes: number | null;
+    timestamp?: string;
+    source: 'canonical' | 'external';
+    readableAsText: boolean;
+    preferredNextTool?: string;
+    preferredWorkflow?: string;
+    suggestedArgs?: {
+        documentId: string;
+    };
+    guidance?: string;
+};

package/dist/mcp/taskAttachmentTypes.js

@@ -0,0 +1 @@
+export {};

package/dist/plugins/vite.js

@@ -190,7 +190,7 @@ export function taskforcePlugin(options) {
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <link rel="icon" type="image/svg+xml" href="/src/assets/favicon/favicon.svg" />
     <link rel="icon" type="image/x-icon" href="/src/assets/favicon/favicon.ico" />
-    <title>Taskforce Dashboard</title>
+    <title>Taskforce</title>
     <style>
         body { margin: 0; background: #0f0f1a; color: white; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif; }
         #root { height: 100vh; overflow: hidden; }

package/dist/runtime/appGateDefinitions.d.ts

@@ -12,7 +12,7 @@ export declare const APP_GATE_DEFINITIONS: {
         readonly removalMilestone: "Document Manager GA";
     };
     readonly 'workflows.workspace_access': {
-        readonly enabled: true;
+        readonly enabled: false;
         readonly description: "Workflow workspace readiness gate.";
         readonly owner: "taskforce";
         readonly removalMilestone: "Workflow workspace GA";

package/dist/runtime/appGateDefinitions.js

@@ -12,7 +12,7 @@ export const APP_GATE_DEFINITIONS = {
         removalMilestone: 'Document Manager GA'
     },
     'workflows.workspace_access': {
-        enabled: true,
+        enabled: false,
         description: 'Workflow workspace readiness gate.',
         owner: 'taskforce',
         removalMilestone: 'Workflow workspace GA'

package/dist/server/index.d.ts

@@ -28,6 +28,7 @@ export declare function shouldRewriteSetCookieForLocalDevHost(hostHeader: string
 export declare function writeJsonErrorIfPossible(res: http.ServerResponse, statusCode: number, payload: Record<string, unknown>): boolean;
 export declare function applyCloudProxyForwardedHeaders(headers: Headers, req: http.IncomingMessage): void;
 export declare function rewriteProxySetCookieForLocalHost(cookie: string): string;
+export declare function shouldRewriteProxySetCookieDomain(cookie: string, hostHeader: string | undefined): boolean;
 export declare function shouldApplyAuthRateLimitForPath(pathname: string): boolean;
 export declare function resolveCloudProxyBaseUrl(env?: NodeJS.ProcessEnv): string;
 export declare function ensureBillingWebhookAuthExclusion(excludedPaths: string[]): string[];

package/dist/server/index.js

@@ -205,6 +205,43 @@ export function rewriteProxySetCookieForLocalHost(cookie) {
     const filteredAttrs = attrs.filter((attr) => !attr.toLowerCase().startsWith('domain='));
     return [nameValue, ...filteredAttrs].join('; ');
 }
+function normalizeHostHeaderHost(hostHeader) {
+    const raw = String(hostHeader || '').trim().toLowerCase();
+    if (!raw)
+        return '';
+    if (raw.startsWith('[')) {
+        const closing = raw.indexOf(']');
+        if (closing >= 0)
+            return raw.slice(1, closing);
+    }
+    const portSeparator = raw.lastIndexOf(':');
+    if (portSeparator <= 0)
+        return raw;
+    const maybePort = raw.slice(portSeparator + 1);
+    if (/^\d+$/.test(maybePort)) {
+        return raw.slice(0, portSeparator);
+    }
+    return raw;
+}
+function parseSetCookieDomain(cookie) {
+    const parts = String(cookie || '').split(';').map((part) => part.trim()).filter(Boolean);
+    for (const part of parts.slice(1)) {
+        const lower = part.toLowerCase();
+        if (!lower.startsWith('domain='))
+            continue;
+        return part.slice('domain='.length).trim().replace(/^\.+/, '').toLowerCase();
+    }
+    return '';
+}
+export function shouldRewriteProxySetCookieDomain(cookie, hostHeader) {
+    const requestHost = normalizeHostHeaderHost(hostHeader);
+    const cookieDomain = parseSetCookieDomain(cookie);
+    if (!requestHost || !cookieDomain)
+        return false;
+    if (requestHost === cookieDomain)
+        return false;
+    return !requestHost.endsWith(`.${cookieDomain}`);
+}
 async function readRequestBody(req, maxBytes) {
     const chunks = [];
     let total = 0;
@@ -550,9 +587,15 @@ export function createStandaloneServer(options) {
                 }
                 const setCookies = upstream.headers.getSetCookie?.();
                 if (Array.isArray(setCookies) && setCookies.length > 0) {
-                    const normalizedSetCookies = shouldRewriteSetCookieForLocalDevHost(String(req.headers.host || '').trim())
-                        ? setCookies.map((cookie) => rewriteProxySetCookieForLocalHost(cookie))
-                        : setCookies;
+                    const requestHost = String(req.headers.host || '').trim();
+                    const normalizedSetCookies = setCookies.map((cookie) => {
+                        if (shouldRewriteSetCookieForLocalDevHost(requestHost)) {
+                            return rewriteProxySetCookieForLocalHost(cookie);
+                        }
+                        return shouldRewriteProxySetCookieDomain(cookie, requestHost)
+                            ? rewriteProxySetCookieForLocalHost(cookie)
+                            : cookie;
+                    });
                     res.setHeader('Set-Cookie', normalizedSetCookies);
                 }
                 res.writeHead(upstream.status, outgoingHeaders);

package/dist/server/index.test.js

@@ -1,5 +1,5 @@
 import { describe, expect, it, vi } from 'vitest';
-import { ensureBillingWebhookAuthExclusion, ensurePublicSiteConfigAuthExclusion, isBillingWebhookPath, resolveEffectiveRequestUserId, resolveAuthorizedWorkspaceAccess, shouldApplyAuthRateLimitForPath, shouldProxyCloudPath, writeJsonErrorIfPossible } from './index.js';
+import { ensureBillingWebhookAuthExclusion, ensurePublicSiteConfigAuthExclusion, isBillingWebhookPath, rewriteProxySetCookieForLocalHost, resolveEffectiveRequestUserId, resolveAuthorizedWorkspaceAccess, shouldRewriteProxySetCookieDomain, shouldApplyAuthRateLimitForPath, shouldProxyCloudPath, writeJsonErrorIfPossible } from './index.js';
 describe('server index helper policies', () => {
     it('adds webhook path to auth exclusions without duplicates', () => {
         const base = ['/api/taskforce/health', '/api/taskforce/auth'];
@@ -92,6 +92,17 @@ describe('shouldProxyCloudPath', () => {
         expect(shouldProxyCloudPath('/api/taskforce/public/site-config-script')).toBe(true);
     });
 });
+describe('proxy cookie helpers', () => {
+    it('rewrites mismatched cookie domains for non-loopback local hosts', () => {
+        const cookie = 'taskforce_session=abc; Path=/; HttpOnly; SameSite=Lax; Domain=taskforcehq.ai';
+        expect(shouldRewriteProxySetCookieDomain(cookie, 'taskforce.localtest.me:3847')).toBe(true);
+        expect(rewriteProxySetCookieForLocalHost(cookie)).not.toContain('Domain=');
+    });
+    it('preserves cookie domains that already match the request host', () => {
+        const cookie = 'taskforce_session=abc; Path=/; HttpOnly; SameSite=Lax; Domain=taskforcehq.ai';
+        expect(shouldRewriteProxySetCookieDomain(cookie, 'app.taskforcehq.ai')).toBe(false);
+    });
+});
 describe('resolveAuthorizedWorkspaceAccess', () => {
     it('prefers an explicitly requested workspace when the user is authorized for it', () => {
         const core = {

package/dist/server/routes/admin.js

@@ -65,7 +65,7 @@ import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
 import { randomUUID } from 'crypto';
 import { resolveDeploymentConfig } from '../../config/deployment.js';
 import { getTaskforceCloudEnvironmentConfig, resolveTaskforceCloudEnvironmentFromBaseUrl } from '../../config/cloudEnvironment.js';
-import { resolveErrorStatusCode } from './shared.js';
+import { buildCloudMcpRuntimeAuth, resolveErrorStatusCode } from './shared.js';
 import { applyWorkspaceRepair, scanWorkspaceRepair } from '../../sync/workspaceRepair.js';
 // === SECTION: Registration ===
 export function registerAdminRoutes(deps) {
@@ -474,22 +474,13 @@ export function registerAdminRoutes(deps) {
                 serverName: 'taskforce-cloud',
                 logStartup: false,
                 runtimeMode: 'cloud',
-                auth: {
-                    scopes: authScopes,
-                    userId: auth.authenticatedViaToken?.userId || auth.authenticatedViaOAuth?.userId || auth.userId || null,
-                    tokenId: auth.authenticatedViaToken?.tokenId || auth.authenticatedViaOAuth?.grantId || null,
-                    aiProfileToken: auth.aiProfileToken,
-                    aiProfileName: auth.aiProfileName,
-                    aiProfileDescription: auth.aiProfileDescription,
-                    aiProfileRole: auth.aiProfileRole,
-                    aiProfileProvider: auth.aiProfileProvider,
-                    aiProfileModel: auth.aiProfileModel,
-                    aiProfileSurfaceType: auth.aiProfileSurfaceType,
-                    actorType: auth.authenticatedViaToken ? 'token' : auth.authenticatedViaOAuth ? 'oauth' : 'user',
+                auth: buildCloudMcpRuntimeAuth({
+                    req,
+                    auth,
+                    requestHeader,
                     requestId: String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || randomUUID(),
-                    ip: req.socket?.remoteAddress || null,
-                    userAgent: requestHeader(req, 'user-agent', '') || null,
-                },
+                    authScopes,
+                }),
             });
             const transport = new StreamableHTTPServerTransport({
                 sessionIdGenerator: undefined,
@@ -1741,17 +1732,20 @@ export function registerAdminRoutes(deps) {
             return;
         }
         const body = await parseJsonBody(req);
+        const currentOnboardingPolicy = core.getOnboardingPolicy();
         const onboardingPolicyMode = body?.onboardingPolicyMode === 'auto_grant_free' || body?.onboardingPolicyMode === 'auto_start_trial'
             ? body.onboardingPolicyMode
-            : 'require_plan_selection';
+            : body?.onboardingPolicyMode === 'require_plan_selection'
+                ? 'require_plan_selection'
+                : currentOnboardingPolicy.mode;
         const onboardingPlanVersionId = typeof body?.onboardingPlanVersionId === 'string'
             ? body.onboardingPlanVersionId.trim() || null
             : body?.onboardingPlanVersionId === null
                 ? null
-                : undefined;
+                : currentOnboardingPolicy.planVersionId;
         const validation = core.validateOnboardingPolicy({
             mode: onboardingPolicyMode,
-            ...(onboardingPlanVersionId !== undefined ? { planVersionId: onboardingPlanVersionId } : {})
+            planVersionId: onboardingPlanVersionId
         });
         if (!validation.valid) {
             res.writeHead(400, { 'Content-Type': 'application/json' });

package/dist/server/routes/auth.js

@@ -308,7 +308,7 @@ export function registerAuthRoutes(deps) {
             ? 'Verify your Taskforce account'
             : 'Reset your Taskforce password';
         const text = kind === 'verify-email'
-            ? `Welcome to Taskforce.\n\nVerify your email by opening this link:\n${link}\n\nIf you did not create an account, you can ignore this message.`
+            ? `Welcome to Taskforce.\n\nYou're almost in. Enter this verification token on the verification screen to activate your account:\n\n${token}\n\nPrefer the faster route? Open the link below to verify your email automatically:\n${link}\n\nIf you didn't create a Taskforce account, you can safely ignore this email.`
             : `Reset your Taskforce password using this link:\n${link}\n\nIf you did not request this reset, you can ignore this message.`;
         const result = await sendEmail({
             to: email,
@@ -401,7 +401,8 @@ export function registerAuthRoutes(deps) {
         let avatarUrl = null;
         let betaAccess = true;
         if (authenticated && access?.userId) {
-            await cleanupStaleAvatarDrafts(access.userId);
+            // Keep the session endpoint fast on reload; avatar draft cleanup is best-effort housekeeping.
+            void cleanupStaleAvatarDrafts(access.userId).catch(() => { });
             betaAccess = core.getUserBetaAccess(access.userId);
             const resolved = core.resolveUserAccess(access.userId, workspaceId, role);
             if (resolved) {
@@ -870,6 +871,40 @@ export function registerAuthRoutes(deps) {
             }));
         }
         catch (error) {
+            if (error?.code === 'EMAIL_ALREADY_EXISTS'
+                && authBehavior.requireVerifiedEmail
+                && email
+                && !core.isEmailVerified(email)) {
+                let emailSent = true;
+                let emailError;
+                let verificationToken;
+                const verification = core.requestEmailVerification({ email });
+                verificationToken = verification.token || null;
+                if (verification.token) {
+                    const delivery = await deliverAuthEmail('verify-email', email, verification.token, req);
+                    emailSent = delivery.ok;
+                    emailError = delivery.error;
+                }
+                auditAuthAction(req, 'auth-register-existing-unverified', {
+                    email,
+                    workspaceId: workspaceIdInput || null,
+                    code: 'EMAIL_ALREADY_EXISTS_UNVERIFIED',
+                    emailSent
+                });
+                res.writeHead(409, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({
+                    success: false,
+                    error: 'This email already has an unverified account. Continue with email verification instead.',
+                    code: 'EMAIL_ALREADY_EXISTS_UNVERIFIED',
+                    verificationRequired: true,
+                    emailSent,
+                    emailError,
+                    verificationToken: shouldExposeDevAuthTokens()
+                        ? (verificationToken || null)
+                        : undefined
+                }));
+                return;
+            }
             const statusCode = Number(error?.statusCode || 400);
             const message = String(error?.message || 'Unable to register');
             auditAuthAction(req, 'auth-register-failed', {

package/dist/server/routes/billing.js

@@ -733,72 +733,18 @@ function shouldRecordCheckoutPendingState(entitlement) {
         || currentState === 'canceled';
 }
 function beginCheckoutPending(core, input) {
-    const planId = resolvePlanIdForVersion(core, input.planVersionId);
     const updatedBy = input.updatedBy || 'checkout-start';
     const source = input.source || 'checkout-start';
-    if (typeof core.transitionCanonicalCommercialState === 'function') {
-        core.transitionCanonicalCommercialState({
-            accountId: input.userId,
-            planVersionId: input.planVersionId,
-            state: 'checkout_pending',
-            effectiveUntil: input.effectiveUntil || null,
-            billingMirrorPlanId: planId,
-            source,
-            updatedBy
-        });
-        return;
-    }
-    const db = core.getDatabaseAdapter();
-    const tenantId = core.getTenantId();
-    const now = new Date().toISOString();
-    db.prepare(`
-        INSERT INTO account_entitlements (account_id, tenant_id, plan_version_id, entitlement_state, effective_at, effective_until, updated_by, created_at, updated_at)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-        ON CONFLICT (account_id) DO UPDATE SET
-            plan_version_id = excluded.plan_version_id,
-            entitlement_state = excluded.entitlement_state,
-            effective_at = excluded.effective_at,
-            effective_until = excluded.effective_until,
-            updated_by = excluded.updated_by,
-            updated_at = excluded.updated_at
-    `).run(input.userId, tenantId, input.planVersionId, 'checkout_pending', now, input.effectiveUntil || null, updatedBy, now, now);
-    upsertBillingMirror(core, {
-        userId: input.userId,
-        planId,
-        canonicalState: 'checkout_pending',
-        effectiveUntil: input.effectiveUntil || null
+    core.transitionCanonicalCommercialState({
+        accountId: input.userId,
+        planVersionId: input.planVersionId,
+        state: 'checkout_pending',
+        effectiveUntil: input.effectiveUntil || null,
+        billingMirrorPlanId: resolvePlanIdForVersion(core, input.planVersionId),
+        source,
+        updatedBy
     });
 }
-function upsertCanonicalEntitlement(core, input) {
-    const updatedBy = input.updatedBy || 'stripe-webhook';
-    if (typeof core.transitionCanonicalCommercialState === 'function') {
-        core.transitionCanonicalCommercialState({
-            accountId: input.userId,
-            planVersionId: input.planVersionId,
-            state: input.state,
-            effectiveAt: input.effectiveAt,
-            effectiveUntil: input.effectiveUntil,
-            billingMirrorPlanId: resolvePlanIdForVersion(core, input.planVersionId),
-            source: updatedBy === 'checkout-confirm' ? 'checkout-confirm' : 'stripe-webhook',
-            updatedBy
-        });
-        return;
-    }
-    const db = core.getDatabaseAdapter();
-    const tenantId = core.getTenantId();
-    const now = new Date().toISOString();
-    db.prepare(`
-        INSERT INTO account_entitlements (account_id, tenant_id, plan_version_id, entitlement_state, effective_at, effective_until, updated_by, created_at, updated_at)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-        ON CONFLICT (account_id) DO UPDATE SET
-            plan_version_id = excluded.plan_version_id,
-            entitlement_state = excluded.entitlement_state,
-            effective_at = excluded.effective_at,
-            effective_until = excluded.effective_until,
-            updated_by = excluded.updated_by,
-            updated_at = excluded.updated_at
-    `).run(input.userId, tenantId, input.planVersionId, input.state, input.effectiveAt || now, input.effectiveUntil || null, updatedBy, now, now);
-}
 function upsertBillingMirror(core, input) {
     const db = core.getDatabaseAdapter();
     const tenantId = core.getTenantId();
@@ -881,12 +827,14 @@ function applySubscriptionSnapshot(core, input) {
         }
     }
     else if (planVersionId) {
-        upsertCanonicalEntitlement(core, {
-            userId,
+        core.transitionCanonicalCommercialState({
+            accountId: userId,
             planVersionId: planVersionId || existingEntitlement?.plan_version_id || core.getDefaultPlanVersionIdByMode('personal', { allowFallback: true }),
             state: canonicalState,
             effectiveAt: trialEnd || nowIso,
             effectiveUntil,
+            billingMirrorPlanId: resolvePlanIdForVersion(core, planVersionId),
+            source,
             updatedBy: source
         });
     }
@@ -2385,12 +2333,15 @@ export function registerBillingRoutes(deps) {
                         });
                         return;
                     }
-                    upsertCanonicalEntitlement(core, {
-                        userId,
+                    core.transitionCanonicalCommercialState({
+                        accountId: userId,
                         planVersionId: planVersionId || existingEntitlement?.plan_version_id || core.getDefaultPlanVersionIdByMode('personal', { allowFallback: true }),
                         state: canonicalState,
                         effectiveAt: new Date().toISOString(),
-                        effectiveUntil: currentPeriodEnd
+                        effectiveUntil: currentPeriodEnd,
+                        billingMirrorPlanId: resolvePlanIdForVersion(core, planVersionId),
+                        source: 'stripe-webhook',
+                        updatedBy: 'stripe-webhook'
                     });
                     markLatestOpenCheckoutAttemptConfirmed(core, {
                         userId,