@taskforcehq/taskforce 0.3.303 → 0.3.304

package/dist/server/routes/tasks.js

@@ -55,10 +55,18 @@ import { getRuntimeCapabilities } from '../../runtime/capabilities.js';
 import { resolveBuildInfo } from '../buildInfo.js';
 import { resolveRealtimeSyncFlag } from '../../sync/realtimeFeature.js';
 import { parseJsonBody } from '../routes.js';
+import { resolveRequestAccess } from '../auth.js';
 import { resolveErrorStatusCode, requestHeader, requestRuntimeMode } from './shared.js';
 import { listBuiltInCustomTaxonomyLibraryPacks } from '../../shared/customTaxonomyLibrary.js';
 import { listBuiltInTaxonomyLibraryPacks } from '../../shared/taxonomyLibrary.js';
 import { shouldUseProvisionalTaskReferences } from '../../utils/taskReferences.js';
+function createUiStateRequestId() {
+    return `ui-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+}
+function attachUiStateDebugHeaders(res, requestId) {
+    res.setHeader('x-taskforce-ui-state-route', 'tasks');
+    res.setHeader('x-taskforce-ui-state-request-id', requestId);
+}
 // === SECTION: Registration ===
 export function registerTaskRoutes(deps) {
     const { addRoute, core, context, requestWorkspaceId, ensureAppAccess, resolveEffectiveObjectStorageConfig, buildBatchSummary, CLOUD_SAFE_CONFIG_PATHS, } = deps;
@@ -155,16 +163,31 @@ export function registerTaskRoutes(deps) {
             || ((isLocalRuntime && allowCreate && !explicitWorkspaceId) ? '' : headerWorkspaceId)).trim() || 'default';
         try {
             const workspaceExists = Boolean(core.getWorkspaceProfile(incomingWorkspaceId));
+            const authConfig = context.authConfig;
+            const requestAccess = authConfig?.enabled
+                ? resolveRequestAccess(req, authConfig)
+                : null;
             const shouldCreateWorkspace = Boolean(name
                 && (incomingWorkspaceId === 'default' || !workspaceExists)
                 && (isLocalRuntime || allowCreate));
             const workspace = shouldCreateWorkspace
-                ? core.createWorkspace({
-                    workspaceId: incomingWorkspaceId === 'default' ? undefined : incomingWorkspaceId,
-                    name,
-                    description,
-                    slug
-                })
+                ? (!isLocalRuntime
+                    && requestAccess?.authenticated
+                    && requestAccess.userId
+                    && requestAccess.userId !== 'anonymous'
+                    ? core.createWorkspaceForUser({
+                        userId: requestAccess.userId,
+                        preferredWorkspaceId: incomingWorkspaceId === 'default' ? undefined : incomingWorkspaceId,
+                        name,
+                        description,
+                        role: 'owner'
+                    })
+                    : core.createWorkspace({
+                        workspaceId: incomingWorkspaceId === 'default' ? undefined : incomingWorkspaceId,
+                        name,
+                        description,
+                        slug
+                    }))
                 : core.updateWorkspaceProfile(incomingWorkspaceId, { name, description, slug });
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ success: true, workspace }));
@@ -179,6 +202,9 @@ export function registerTaskRoutes(deps) {
     addRoute('GET', '/api/taskforce/ui-state', async (req, res) => {
         if (!ensureAppAccess(req, res))
             return;
+        const requestId = createUiStateRequestId();
+        const startedAt = Date.now();
+        attachUiStateDebugHeaders(res, requestId);
         try {
             const url = new URL(req.url || '/', 'http://localhost');
             const requestedWorkspaceId = String(url.searchParams.get('workspaceId') || '').trim();
@@ -194,6 +220,12 @@ export function registerTaskRoutes(deps) {
         }
         catch (error) {
             const statusCode = resolveErrorStatusCode(error, 400);
+            console.warn('[Taskforce][ui-state] GET failed', {
+                requestId,
+                durationMs: Date.now() - startedAt,
+                error: String(error?.message || 'Failed to read UI state'),
+                path: req.url || '/api/taskforce/ui-state'
+            });
             res.writeHead(statusCode, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ success: false, error: String(error?.message || 'Failed to read UI state') }));
         }
@@ -202,6 +234,9 @@ export function registerTaskRoutes(deps) {
     addRoute('POST', '/api/taskforce/ui-state', async (req, res) => {
         if (!ensureAppAccess(req, res))
             return;
+        const requestId = createUiStateRequestId();
+        const startedAt = Date.now();
+        attachUiStateDebugHeaders(res, requestId);
         const body = await parseJsonBody(req);
         try {
             const requestedWorkspaceId = String(body?.workspaceId || '').trim();
@@ -222,6 +257,13 @@ export function registerTaskRoutes(deps) {
         }
         catch (error) {
             const statusCode = resolveErrorStatusCode(error, 400);
+            console.warn('[Taskforce][ui-state] POST failed', {
+                requestId,
+                durationMs: Date.now() - startedAt,
+                error: String(error?.message || 'Failed to merge UI state'),
+                path: req.url || '/api/taskforce/ui-state',
+                stateKey: String(body?.stateKey || body?.key || '').trim() || 'default'
+            });
             res.writeHead(statusCode, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ success: false, error: String(error?.message || 'Failed to merge UI state') }));
         }
@@ -398,7 +440,7 @@ export function registerTaskRoutes(deps) {
                 : body;
             const updated = core.updateTask(params.id, updates, workspaceId, {
                 actorRef: 'user',
-                skipTaskEvents: saveSource === 'autosave'
+                saveSource
             });
             if (!updated) {
                 res.writeHead(404, { 'Content-Type': 'application/json' });

package/dist/server/routes.js

@@ -34,7 +34,7 @@ import { registerResourceRoutes } from './routes/resources.js';
 import { registerDocumentRoutes } from './routes/documents.js';
 import { registerDocumentReviewRoutes } from './routes/documentReviews.js';
 import { registerAnnotatedAttachmentRoutes } from './routes/annotatedAttachments.js';
-import { requestHeader, requestRole, requestRuntimeMode, requestUserId, makeAuditAdminAction, makeAuditAuthAction, makeEnsureAdminRole, makeEnsureAppAccess, makeEnsureAuthenticatedUser, makeEnsureCloudPlanData, makeRequestWorkspaceId, makeRequireCloudRuntime, makeResolveAdminRequestActor, makeResolveAuthenticatedUserId, makeResolveAuthenticatedMutationUserId, ensureWorkspaceAdminRole, } from './routes/shared.js';
+import { buildCloudMcpRuntimeAuth, requestHeader, requestRole, requestRuntimeMode, requestUserId, makeAuditAdminAction, makeAuditAuthAction, makeEnsureAdminRole, makeEnsureAppAccess, makeEnsureAuthenticatedUser, makeEnsureCloudPlanData, makeRequestWorkspaceId, makeRequireCloudRuntime, makeResolveAdminRequestActor, makeResolveAuthenticatedUserId, makeResolveAuthenticatedMutationUserId, ensureWorkspaceAdminRole, } from './routes/shared.js';
 import { resolveDeploymentConfig } from '../config/deployment.js';
 import { getTaskforceCloudEnvironmentConfig, resolveTaskforceCloudEnvironmentFromBaseUrl } from '../config/cloudEnvironment.js';
 import { getCanonicalDocumentName } from '../utils/documentNames.js';
@@ -372,7 +372,7 @@ export function createRoutes(core, context = {}) {
             ? 'Verify your Taskforce account'
             : 'Reset your Taskforce password';
         const text = kind === 'verify-email'
-            ? `Welcome to Taskforce.\n\nVerify your email by opening this link:\n${link}\n\nIf you did not create an account, you can ignore this message.`
+            ? `Welcome to Taskforce.\n\nYou're almost in. Enter this verification token on the verification screen to activate your account:\n\n${token}\n\nPrefer the faster route? Open the link below to verify your email automatically:\n${link}\n\nIf you didn't create a Taskforce account, you can safely ignore this email.`
             : `Reset your Taskforce password using this link:\n${link}\n\nIf you did not request this reset, you can ignore this message.`;
         const result = await sendEmail({
             to: email,
@@ -1458,24 +1458,13 @@ export function createRoutes(core, context = {}) {
                 serverName: 'taskforce-cloud',
                 logStartup: false,
                 runtimeMode: 'cloud',
-                auth: {
-                    scopes: authScopes,
-                    userId: auth.authenticatedViaToken?.userId || auth.authenticatedViaOAuth?.userId || auth.userId || null,
-                    tokenId: auth.authenticatedViaToken?.tokenId || auth.authenticatedViaOAuth?.grantId || null,
-                    aiProfileToken: auth.aiProfileToken,
-                    aiProfileName: auth.aiProfileName,
-                    aiProfileIcon: auth.aiProfileIcon,
-                    aiProfileColor: auth.aiProfileColor,
-                    aiProfileDescription: auth.aiProfileDescription,
-                    aiProfileRole: auth.aiProfileRole,
-                    aiProfileProvider: auth.aiProfileProvider,
-                    aiProfileModel: auth.aiProfileModel,
-                    aiProfileSurfaceType: auth.aiProfileSurfaceType,
-                    actorType: auth.authenticatedViaToken ? 'token' : auth.authenticatedViaOAuth ? 'oauth' : 'user',
+                auth: buildCloudMcpRuntimeAuth({
+                    req,
+                    auth,
+                    requestHeader,
                     requestId: String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || randomUUID(),
-                    ip: req.socket?.remoteAddress || null,
-                    userAgent: requestHeader(req, 'user-agent', '') || null,
-                },
+                    authScopes,
+                }),
             });
             const transport = new StreamableHTTPServerTransport({
                 sessionIdGenerator: undefined,

package/dist/server/routes.test.js

@@ -10,6 +10,7 @@ import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/
 import * as mcpRuntime from '../mcp/runtime';
 import { createDatabaseAdapter } from '../storage/createDatabaseAdapter.js';
 import { ensureDocumentReferenceSchema, ensureTaskAssetsSchema, ensureWorkspaceAssetsSchema } from '../migrations/taskSchemaMigrations.js';
+import { ObjectStorageClient } from '../storage/objectStorageClient.js';
 import { WorkspaceAssetStore } from '../storage/workspaceAssetStore.js';
 // Mock TaskforceCore
 vi.mock('../core/Taskforce', () => {
@@ -159,10 +160,13 @@ vi.mock('../core/Taskforce', () => {
             listDocumentReviewSessionsForSync = vi.fn().mockReturnValue([]);
             listDocumentReviewCommentsForSync = vi.fn().mockReturnValue([]);
             listAnnotatedAttachmentSessionsForSync = vi.fn().mockReturnValue([]);
+            listTaskEventsForSync = vi.fn().mockReturnValue([]);
+            listTaskEvents = vi.fn().mockReturnValue([]);
             getDocumentReviewSession = vi.fn().mockReturnValue(null);
             upsertAiProfileForSync = vi.fn();
             upsertDocumentReviewSessionForSync = vi.fn();
             upsertDocumentReviewCommentForSync = vi.fn();
+            upsertTaskEventForSync = vi.fn();
             deleteDocumentReviewSessionForSync = vi.fn().mockReturnValue(true);
             deleteDocumentReviewCommentForSync = vi.fn().mockReturnValue(true);
             deleteAnnotatedAttachmentSessionForSync = vi.fn().mockReturnValue(true);
@@ -434,6 +438,7 @@ vi.mock('../core/Taskforce', () => {
             ]);
             hasWorkspaceAdmin = vi.fn().mockReturnValue(true);
             registerPasswordUser = vi.fn();
+            isEmailVerified = vi.fn().mockReturnValue(false);
             requestEmailVerification = vi.fn().mockReturnValue({});
             verifyEmailWithToken = vi.fn().mockReturnValue(false);
             markEmailVerified = vi.fn().mockReturnValue(true);
@@ -892,6 +897,8 @@ describe('Server Routes', () => {
                 auth: expect.objectContaining({
                     aiProfileName: 'Automation Codex',
                     aiProfileToken: 'tfp_automation_codex',
+                    aiProfileIcon: 'Code2',
+                    aiProfileColor: '#10a37f',
                     aiProfileDescription: 'OpenAI Codex coding agent connected through MCP.',
                     aiProfileRole: 'Coding Agent',
                     aiProfileProvider: 'OpenAI',
@@ -1600,6 +1607,17 @@ describe('Server Routes', () => {
             });
             expect(core.updateUiState).not.toHaveBeenCalledWith('workspace-denied', expect.anything(), expect.anything());
         });
+        it('POST /api/taskforce/ui-state should stamp debug response headers', async () => {
+            const match = matchRoute('POST', '/api/taskforce/ui-state', routes);
+            const req = createMockReq('POST', '/api/taskforce/ui-state', {
+                stateKey: 'app',
+                patch: { activeWorkspaceModule: 'tasks' }
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(res.setHeader).toHaveBeenCalledWith('x-taskforce-ui-state-route', 'tasks');
+            expect(res.setHeader).toHaveBeenCalledWith('x-taskforce-ui-state-request-id', expect.stringMatching(/^ui-/));
+        });
         it('POST /api/taskforce/workspace-profile should persist workspace name and description', async () => {
             const match = matchRoute('POST', '/api/taskforce/workspace-profile', routes);
             const req = createMockReq('POST', '/api/taskforce/workspace-profile', { workspaceId: 'default', name: 'Acme Project', description: 'Customer onboarding' }, { 'x-taskforce-workspace-id': 'default' });
@@ -3821,7 +3839,7 @@ describe('Server Routes', () => {
             }));
             expect(res.writeHead).toHaveBeenCalledWith(201, expect.any(Object));
         });
-        it('POST /api/taskforce/auth/register should return conflict when email exists', async () => {
+        it('POST /api/taskforce/auth/register should route duplicate unverified email into verification recovery', async () => {
             const authConfig = {
                 runtimeMode: 'cloud',
                 enabled: true,
@@ -3835,6 +3853,8 @@ describe('Server Routes', () => {
             };
             routes = createRoutes(core, { authConfig });
             core.hasWorkspaceAdmin.mockReturnValueOnce(true);
+            core.isEmailVerified.mockReturnValueOnce(false);
+            core.requestEmailVerification.mockReturnValueOnce({ token: 'verify-token-existing' });
             const error = new Error('Email is already registered');
             error.statusCode = 409;
             error.code = 'EMAIL_ALREADY_EXISTS';
@@ -3849,6 +3869,49 @@ describe('Server Routes', () => {
             });
             const res = createMockRes();
             await match?.handler(req, res, {});
+            expect(core.isEmailVerified).toHaveBeenCalledWith('owner@example.com');
+            expect(core.requestEmailVerification).toHaveBeenCalledWith({ email: 'owner@example.com' });
+            expect(res.writeHead).toHaveBeenCalledWith(409, expect.any(Object));
+            const responsePayload = JSON.parse(String(res.end.mock.calls.at(-1)?.[0] || '{}'));
+            expect(responsePayload).toEqual(expect.objectContaining({
+                success: false,
+                code: 'EMAIL_ALREADY_EXISTS_UNVERIFIED',
+                verificationRequired: true,
+                emailSent: true,
+                verificationToken: 'verify-token-existing'
+            }));
+        });
+        it('POST /api/taskforce/auth/register should return conflict when verified email exists', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            routes = createRoutes(core, { authConfig });
+            core.hasWorkspaceAdmin.mockReturnValueOnce(true);
+            core.isEmailVerified.mockReturnValueOnce(true);
+            const error = new Error('Email is already registered');
+            error.statusCode = 409;
+            error.code = 'EMAIL_ALREADY_EXISTS';
+            core.registerPasswordUser.mockImplementationOnce(() => {
+                throw error;
+            });
+            const match = matchRoute('POST', '/api/taskforce/auth/register', routes);
+            const req = createMockReq('POST', '/api/taskforce/auth/register', {
+                email: 'owner@example.com',
+                password: 'password123',
+                workspaceId: 'workspace-1'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(core.isEmailVerified).toHaveBeenCalledWith('owner@example.com');
+            expect(core.requestEmailVerification).not.toHaveBeenCalled();
             expect(res.writeHead).toHaveBeenCalledWith(409, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(JSON.stringify({
                 success: false,
@@ -6531,6 +6594,77 @@ describe('Server Routes', () => {
             });
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
+        it('POST /api/taskforce/sync/workspace/apply-local should apply task event upserts after task snapshots', async () => {
+            core.resolvePreferredWorkspaceId.mockReturnValue('workspace-local');
+            core.getTask.mockImplementation((taskId) => (taskId === 'task-sync-activity-1'
+                ? {
+                    id: 'task-sync-activity-1',
+                    title: 'Synced task',
+                    status: 'done',
+                    category: 'general',
+                    type: 'task',
+                    createdAt: '2026-03-24T10:00:00.000Z',
+                    updatedAt: '2026-03-24T10:05:00.000Z',
+                    taskEvents: []
+                }
+                : null));
+            routes = createRoutes(core, { authConfig: { runtimeMode: 'local', enabled: false } });
+            const match = matchRoute('POST', '/api/taskforce/sync/workspace/apply-local', routes);
+            const req = createMockReq('POST', '/api/taskforce/sync/workspace/apply-local', {
+                changes: [
+                    {
+                        op: 'upsert',
+                        archived: false,
+                        task: {
+                            id: 'task-sync-activity-1',
+                            title: 'Synced task',
+                            status: 'done',
+                            category: 'general',
+                            type: 'task',
+                            updatedAt: '2026-03-24T10:05:00.000Z'
+                        }
+                    },
+                    {
+                        op: 'task-event-upsert',
+                        event: {
+                            id: 'task-event-sync-1',
+                            taskId: 'task-sync-activity-1',
+                            workspaceId: 'workspace-local',
+                            action: 'task-status-changed',
+                            actor: 'ai-profile-1',
+                            actorType: 'ai',
+                            createdAt: '2026-03-24T10:05:00.000Z',
+                            details: {
+                                changes: {
+                                    status: {
+                                        from: 'in-progress',
+                                        to: 'done'
+                                    }
+                                }
+                            }
+                        }
+                    }
+                ]
+            }, {
+                'x-taskforce-workspace-id': 'workspace-local'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({ id: 'task-sync-activity-1' })],
+                archived: []
+            }), 'workspace-local');
+            expect(core.upsertTaskEventForSync).toHaveBeenCalledWith(expect.objectContaining({
+                id: 'task-event-sync-1',
+                taskId: 'task-sync-activity-1',
+                workspaceId: 'workspace-local',
+                action: 'task-status-changed',
+                actor: 'ai-profile-1',
+                actorType: 'ai',
+                createdAt: '2026-03-24T10:05:00.000Z'
+            }));
+            expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
+        });
         it('POST /api/taskforce/sync/workspace/apply-local should fail when document review session persistence fails', async () => {
             core.resolvePreferredWorkspaceId.mockReturnValue('workspace-local');
             const error = new Error('document review session write failed');
@@ -8771,6 +8905,73 @@ describe('Server Routes', () => {
             expect(payload.authenticated).toBe(true);
             expect(payload.avatarUrl).toBe('/api/taskforce/context/users%2Fu-avatar%2Fprofile%2Favatar%2Fdraft.png');
         });
+        it('GET /api/taskforce/auth/session should not wait for avatar cleanup before responding', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            const deleteObjectCompletion = { resolve: null };
+            const deleteObjectSpy = vi.spyOn(ObjectStorageClient.prototype, 'deleteObject').mockImplementation(() => new Promise((resolve) => {
+                deleteObjectCompletion.resolve = resolve;
+            }));
+            routes = createRoutes(core, {
+                authConfig,
+                objectStorage: {
+                    provider: 'r2',
+                    r2: {
+                        accountId: 'test-account',
+                        bucket: 'taskforce-test',
+                        endpoint: 'https://example.com',
+                        accessKeyId: 'test-key',
+                        secretAccessKey: 'test-secret',
+                        keyPrefix: '',
+                        signedUploadTtlSeconds: 60,
+                        signedDownloadTtlSeconds: 60
+                    }
+                }
+            });
+            core.cleanupStaleUserAvatarUploadDrafts.mockReturnValueOnce([{
+                    draftId: 'avatar-draft-stale',
+                    userId: 'u-avatar',
+                    storageKey: 'users/u-avatar/profile/avatar/avatar-draft-stale.png',
+                    discardedAt: null,
+                    consumedAt: null,
+                    finalizedAt: null,
+                    createdAt: '2026-04-14T00:00:00.000Z',
+                    updatedAt: '2026-04-14T00:00:00.000Z'
+                }]);
+            const cookie = createSessionTokenCookie('session-avatar-cleanup', authConfig, {
+                userId: 'u-avatar',
+                role: 'member',
+                workspaceId: 'workspace-1'
+            });
+            const match = matchRoute('GET', '/api/taskforce/auth/session', routes);
+            const req = createMockReq('GET', '/api/taskforce/auth/session', undefined, { cookie });
+            const res = createMockRes();
+            try {
+                const outcome = await Promise.race([
+                    match?.handler(req, res, {}).then(() => 'completed'),
+                    new Promise((resolve) => setTimeout(() => resolve('timeout'), 25))
+                ]);
+                expect(outcome).toBe('completed');
+                const payload = JSON.parse(res.end.mock.calls[0][0]);
+                expect(payload.authenticated).toBe(true);
+                expect(deleteObjectSpy).toHaveBeenCalledWith('users/u-avatar/profile/avatar/avatar-draft-stale.png');
+            }
+            finally {
+                if (deleteObjectCompletion.resolve) {
+                    deleteObjectCompletion.resolve(true);
+                }
+                deleteObjectSpy.mockRestore();
+            }
+        });
         it('POST /api/taskforce/auth/profile should save avatar by validated draft id', async () => {
             const authConfig = {
                 runtimeMode: 'cloud',
@@ -10300,6 +10501,43 @@ describe('Server Routes', () => {
                 }
             });
         });
+        it('POST /api/taskforce/admin/system-settings should preserve onboarding policy when onboarding fields are omitted', async () => {
+            core.getOnboardingPolicy.mockReturnValue({
+                mode: 'auto_grant_free',
+                planVersionId: 'starter-v1'
+            });
+            const match = matchRoute('POST', '/api/taskforce/admin/system-settings', routes);
+            const req = createMockReq('POST', '/api/taskforce/admin/system-settings', {
+                allowSelfRegistration: false,
+                requireVerifiedEmail: true,
+                defaultNewUserBetaAccess: false,
+                authRateLimitEnabled: true,
+                authRateLimitMaxRequests: 10,
+                authRateLimitWindowMs: 900000
+            }, { 'x-taskforce-role': 'admin' });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(core.validateOnboardingPolicy).toHaveBeenCalledWith({
+                mode: 'auto_grant_free',
+                planVersionId: 'starter-v1'
+            });
+            expect(core.updateGlobalSettings).toHaveBeenCalledWith({
+                auth: {
+                    allowSelfRegistration: false,
+                    requireVerifiedEmail: true,
+                    defaultNewUserBetaAccess: false,
+                    authRateLimitEnabled: true,
+                    authRateLimitMaxRequests: 10,
+                    authRateLimitWindowMs: 900000
+                },
+                billing: {
+                    onboardingPolicy: {
+                        mode: 'auto_grant_free',
+                        planVersionId: 'starter-v1'
+                    }
+                }
+            });
+        });
         it('GET /api/taskforce/admin/site-settings should expose effective website settings', async () => {
             core.getGlobalSettings.mockReturnValue({
                 site: {
@@ -11571,7 +11809,7 @@ describe('Server Routes', () => {
                 errors: []
             }));
         });
-        it('PATCH /api/taskforce/task/:id should pass autosave updates through as non-audited route metadata', async () => {
+        it('PATCH /api/taskforce/task/:id should pass autosave metadata through to core.updateTask', async () => {
             const updatedTask = { id: '123', description: 'Draft body' };
             core.updateTask.mockReturnValue(updatedTask);
             const url = '/api/taskforce/task/123';
@@ -11581,12 +11819,12 @@ describe('Server Routes', () => {
             await match?.handler(req, res, { id: '123' });
             expect(core.updateTask).toHaveBeenCalledWith('123', { description: 'Draft body' }, 'default', {
                 actorRef: 'user',
-                skipTaskEvents: true
+                saveSource: 'autosave'
             });
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(JSON.stringify(updatedTask));
         });
-        it('PATCH /api/taskforce/task/:id should keep manual updates on the audited path', async () => {
+        it('PATCH /api/taskforce/task/:id should pass manual save metadata through to core.updateTask', async () => {
             const updatedTask = { id: '123', description: 'Manual body' };
             core.updateTask.mockReturnValue(updatedTask);
             const url = '/api/taskforce/task/123';
@@ -11596,7 +11834,7 @@ describe('Server Routes', () => {
             await match?.handler(req, res, { id: '123' });
             expect(core.updateTask).toHaveBeenCalledWith('123', { description: 'Manual body' }, 'default', {
                 actorRef: 'user',
-                skipTaskEvents: false
+                saveSource: 'manual'
             });
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(JSON.stringify(updatedTask));

package/dist/shared/taskActor.d.ts

@@ -0,0 +1,10 @@
+export interface TaskActor {
+    id: string;
+    kind: 'human' | 'ai';
+    label: string;
+    username: string;
+    icon: string;
+    color: string;
+    isNamed: boolean;
+    meta?: Record<string, unknown>;
+}

package/dist/shared/taskActor.js

@@ -0,0 +1 @@
+export {};

package/dist/sync/collaborationSyncPayload.js

@@ -39,6 +39,10 @@ export function normalizeAiProfileSyncPayload(raw, workspaceId, normalizeSurface
         username: String(profile.username || '').trim(),
         icon: String(profile.icon || 'Bot').trim() || 'Bot',
         color: String(profile.color || '#8b5cf6').trim() || '#8b5cf6',
+        description: toNullableTrimmedString(profile.description),
+        role: toNullableTrimmedString(profile.role),
+        provider: toNullableTrimmedString(profile.provider),
+        model: toNullableTrimmedString(profile.model),
         surfaceType: normalizeSurfaceType(profile.surfaceType, { source, profileId, workspaceId: profileWorkspaceId }),
         providerMetadata: profile.providerMetadata && typeof profile.providerMetadata === 'object' && !Array.isArray(profile.providerMetadata)
             ? profile.providerMetadata

package/dist/sync/collaborationSyncPayload.test.js

@@ -15,6 +15,10 @@ describe('collaborationSyncPayload', () => {
             username: ' agent ',
             icon: ' Bot ',
             color: ' #111111 ',
+            description: ' Product coding agent ',
+            role: ' Implementer ',
+            provider: ' OpenAI ',
+            model: ' gpt-5.4 ',
             surfaceType: 'agent',
             providerMetadata: { foo: 'bar' },
             createdAt: '2026-04-10T10:00:00.000Z',
@@ -29,6 +33,10 @@ describe('collaborationSyncPayload', () => {
             username: 'agent',
             icon: 'Bot',
             color: '#111111',
+            description: 'Product coding agent',
+            role: 'Implementer',
+            provider: 'OpenAI',
+            model: 'gpt-5.4',
             surfaceType: 'agent',
             providerMetadata: { foo: 'bar' },
             createdAt: '2026-04-10T10:00:00.000Z',

package/dist/sync/collaborationSyncState.d.ts

@@ -1,5 +1,5 @@
 import type { TaskforceCore, TaskforceSyncCapable } from '../core/Taskforce.js';
-import type { WorkspaceSyncAnnotatedAttachmentSessionSnapshot, WorkspaceSyncDocumentReviewCommentSnapshot, WorkspaceSyncDocumentReviewSessionSnapshot } from './workspaceSyncModel.js';
+import type { WorkspaceSyncAnnotatedAttachmentSessionSnapshot, WorkspaceSyncDocumentReviewCommentSnapshot, WorkspaceSyncDocumentReviewSessionSnapshot, WorkspaceSyncTaskEventSnapshot } from './workspaceSyncModel.js';
 type SyncCore = TaskforceCore & TaskforceSyncCapable;
 interface CollaborationSyncStateDeps {
     core: SyncCore;
@@ -7,9 +7,11 @@ interface CollaborationSyncStateDeps {
 export declare function listWorkspaceSyncDocumentReviewSessionsSnapshot(deps: CollaborationSyncStateDeps, workspaceId?: string): WorkspaceSyncDocumentReviewSessionSnapshot[];
 export declare function listWorkspaceSyncDocumentReviewCommentsSnapshot(deps: CollaborationSyncStateDeps, workspaceId?: string): WorkspaceSyncDocumentReviewCommentSnapshot[];
 export declare function listWorkspaceSyncAnnotatedAttachmentSessionsSnapshot(deps: CollaborationSyncStateDeps, workspaceId?: string): WorkspaceSyncAnnotatedAttachmentSessionSnapshot[];
+export declare function listWorkspaceSyncTaskEventsSnapshot(deps: CollaborationSyncStateDeps, workspaceId?: string): WorkspaceSyncTaskEventSnapshot[];
 export declare function createCollaborationSyncState(deps: CollaborationSyncStateDeps): {
     listWorkspaceSyncDocumentReviewSessionsSnapshot: (workspaceId?: string) => WorkspaceSyncDocumentReviewSessionSnapshot[];
     listWorkspaceSyncDocumentReviewCommentsSnapshot: (workspaceId?: string) => WorkspaceSyncDocumentReviewCommentSnapshot[];
     listWorkspaceSyncAnnotatedAttachmentSessionsSnapshot: (workspaceId?: string) => WorkspaceSyncAnnotatedAttachmentSessionSnapshot[];
+    listWorkspaceSyncTaskEventsSnapshot: (workspaceId?: string) => WorkspaceSyncTaskEventSnapshot[];
 };
 export {};

package/dist/sync/collaborationSyncState.js

@@ -51,10 +51,29 @@ export function listWorkspaceSyncAnnotatedAttachmentSessionsSnapshot(deps, works
         && session.workspaceId.length > 0
         && session.baseImageAssetId.length > 0));
 }
+export function listWorkspaceSyncTaskEventsSnapshot(deps, workspaceId = 'default') {
+    return deps.core.listTaskEventsForSync({ workspaceId })
+        .map((event) => ({
+        id: event.id,
+        taskId: event.taskId,
+        workspaceId: event.workspaceId,
+        action: event.action,
+        actor: event.actor,
+        actorType: event.actorType,
+        details: event.details,
+        createdAt: event.createdAt,
+    }))
+        .filter((event) => (event.id.length > 0
+        && event.taskId.length > 0
+        && event.workspaceId.length > 0
+        && event.action.length > 0
+        && event.createdAt.length > 0));
+}
 export function createCollaborationSyncState(deps) {
     return {
         listWorkspaceSyncDocumentReviewSessionsSnapshot: (workspaceId = 'default') => listWorkspaceSyncDocumentReviewSessionsSnapshot(deps, workspaceId),
         listWorkspaceSyncDocumentReviewCommentsSnapshot: (workspaceId = 'default') => listWorkspaceSyncDocumentReviewCommentsSnapshot(deps, workspaceId),
         listWorkspaceSyncAnnotatedAttachmentSessionsSnapshot: (workspaceId = 'default') => listWorkspaceSyncAnnotatedAttachmentSessionsSnapshot(deps, workspaceId),
+        listWorkspaceSyncTaskEventsSnapshot: (workspaceId = 'default') => listWorkspaceSyncTaskEventsSnapshot(deps, workspaceId),
     };
 }