@taskforcehq/taskforce 0.3.303 → 0.3.305

package/dist/mcp/taskPlanningRegistrar.js

@@ -0,0 +1,418 @@
+import { bindDomainTool } from './toolCatalog.js';
+function stringProperty(description, enumValues) {
+    return enumValues ? { type: 'string', description, enum: enumValues } : { type: 'string', description };
+}
+function numberProperty(description) {
+    return { type: 'number', description };
+}
+function booleanProperty(description) {
+    return { type: 'boolean', description };
+}
+function arrayProperty(description, items) {
+    return { type: 'array', description, items };
+}
+export function registerTaskPlanningTools(registerTool, executeTool) {
+    const register = (name, buildDescriptor) => {
+        registerTool({
+            name,
+            buildDescriptor: (context) => {
+                const descriptor = buildDescriptor(context);
+                return {
+                    name,
+                    description: descriptor.description,
+                    inputSchema: {
+                        type: 'object',
+                        properties: descriptor.inputSchema.properties,
+                        ...(descriptor.inputSchema.required ? { required: descriptor.inputSchema.required } : {}),
+                    },
+                };
+            },
+            handler: bindDomainTool(executeTool, name),
+        });
+    };
+    register('list_tasks', (context) => ({
+        description: context.describeTool('List active tasks with optional filters. Supports filtering by status, assignee, priority, type, and category. Use openOnly=true to exclude done/cancelled. Use format=json for programmatic use. Default sort is by created date descending. Returns a compact summary of each task — description, comments, and activity are omitted to keep responses concise. Use get_task to retrieve full details for a specific task.'),
+        inputSchema: {
+            properties: {
+                format: stringProperty('Toggle output format (default: markdown).', ['markdown', 'json']),
+                category: stringProperty('Filter by category.'),
+                status: stringProperty('Filter by status.', ['task', 'on-hold', 'in-progress', 'review', 'done', 'cancelled']),
+                openOnly: booleanProperty('When true, only include open tasks (task, on-hold, in-progress, review).'),
+                assignee: stringProperty(`${context.assigneeHint} Call list_assignees to inspect the current eligible IDs.`),
+                priority: numberProperty('Filter by priority level.'),
+                type: stringProperty('Filter by task type.', context.typeEnum),
+                sort: stringProperty('Sort field (default: created).', ['priority', 'created', 'updated']),
+                order: stringProperty('Sort order (default: desc).', ['asc', 'desc']),
+                limit: numberProperty('Max tasks to return.'),
+            },
+        },
+    }));
+    register('search_tasks', (context) => ({
+        description: context.describeTool('Search active and archived tasks by keyword. Matches against title, description, and ID. Use scope=\'active\' or scope=\'archive\' to narrow results. Prefer this over list_tasks when looking for a specific task by name.'),
+        inputSchema: {
+            properties: {
+                query: stringProperty('Search term (matches title, description, internal ID, or task reference such as T-123).'),
+                scope: stringProperty('Search scope (default: all).', ['all', 'active', 'archive']),
+            },
+            required: ['query'],
+        },
+    }));
+    register('get_task', (context) => ({
+        description: context.describeTool('Get a single task by ID or task reference. Checks both active and archived tasks. Use this when you have a specific task ID or T-123 reference from a previous list or search result and need full details including comments and attachment metadata. This tool does not return attachment file contents. For task attachments, call get_task_attachments and then read_task_attachment. Do not fetch attachment path URLs directly when MCP attachment-read tools are available. Do not use this for image references like I-123 or document references like D-123.'),
+        inputSchema: {
+            properties: {
+                id: stringProperty('Task ID or task reference such as T-123.'),
+            },
+            required: ['id'],
+        },
+    }));
+    register('list_initiatives', (context) => ({
+        description: context.describeTool('List initiatives for the active workspace. Returns initiative records with attached workstream summaries and task counts so AI agents can reason about the planning model directly.'),
+        inputSchema: { properties: {} },
+    }));
+    register('get_initiative', (context) => ({
+        description: context.describeTool('Get a single initiative by ID or initiative reference such as IN-123. Returns the initiative plus its workstreams and rolled-up task counts.'),
+        inputSchema: {
+            properties: {
+                id: stringProperty('Initiative ID or initiative reference such as IN-123.'),
+            },
+            required: ['id'],
+        },
+    }));
+    register('create_initiative', (context) => ({
+        description: context.describeTool('Create a new initiative. Use this for the top planning layer when a body of work should coordinate multiple workstreams.'),
+        inputSchema: {
+            properties: {
+                title: stringProperty('Initiative title.'),
+                description: stringProperty('Optional initiative description.'),
+                ownerId: stringProperty(`${context.assigneeHint} Call list_assignees to inspect the current eligible IDs.`),
+                order: numberProperty('Optional sort order among initiatives.'),
+            },
+            required: ['title'],
+        },
+    }));
+    register('update_initiative', (context) => ({
+        description: context.describeTool('Update an existing initiative. Only pass the fields you want to change.'),
+        inputSchema: {
+            properties: {
+                id: stringProperty('Initiative ID or initiative reference such as IN-123.'),
+                title: stringProperty('Updated initiative title.'),
+                description: stringProperty('Updated initiative description.'),
+                ownerId: stringProperty(`${context.assigneeHint} Call list_assignees to inspect the current eligible IDs.`),
+                order: numberProperty('Optional sort order among initiatives.'),
+            },
+            required: ['id'],
+        },
+    }));
+    register('archive_initiative', (context) => ({
+        description: context.describeTool('Archive an initiative without deleting it. This hides it from open planning views while preserving its workstreams and history.'),
+        inputSchema: {
+            properties: {
+                id: stringProperty('Initiative ID or initiative reference such as IN-123.'),
+            },
+            required: ['id'],
+        },
+    }));
+    register('unarchive_initiative', (context) => ({
+        description: context.describeTool('Restore an archived initiative to active planning views.'),
+        inputSchema: {
+            properties: {
+                id: stringProperty('Initiative ID or initiative reference such as IN-123.'),
+            },
+            required: ['id'],
+        },
+    }));
+    register('list_workstreams', (context) => ({
+        description: context.describeTool('List workstreams for the active workspace. Returns workstream records with attached task summaries and linked initiative information when present.'),
+        inputSchema: { properties: {} },
+    }));
+    register('get_workstream', (context) => ({
+        description: context.describeTool('Get a single workstream by ID or workstream reference such as WS-123. Returns the workstream plus its tasks.'),
+        inputSchema: {
+            properties: {
+                id: stringProperty('Workstream ID or workstream reference such as WS-123.'),
+            },
+            required: ['id'],
+        },
+    }));
+    register('create_workstream', (context) => ({
+        description: context.describeTool('Create a new workstream. Use initiativeId to link it to an initiative, or omit initiativeId to create a standalone workstream.'),
+        inputSchema: {
+            properties: {
+                title: stringProperty('Workstream title.'),
+                description: stringProperty('Optional workstream description.'),
+                ownerId: stringProperty(`${context.assigneeHint} Call list_assignees to inspect the current eligible IDs.`),
+                initiativeId: stringProperty('Optional initiative ID or initiative reference such as IN-123.'),
+                order: numberProperty('Optional sort order among workstreams.'),
+            },
+            required: ['title'],
+        },
+    }));
+    register('update_workstream', (context) => ({
+        description: context.describeTool('Update an existing workstream. Only pass the fields you want to change.'),
+        inputSchema: {
+            properties: {
+                id: stringProperty('Workstream ID or workstream reference such as WS-123.'),
+                title: stringProperty('Updated workstream title.'),
+                description: stringProperty('Updated workstream description.'),
+                ownerId: stringProperty(`${context.assigneeHint} Call list_assignees to inspect the current eligible IDs.`),
+                initiativeId: stringProperty('Optional initiative ID or initiative reference such as IN-123. Pass an empty string to unlink.'),
+                order: numberProperty('Optional sort order among workstreams.'),
+            },
+            required: ['id'],
+        },
+    }));
+    register('archive_workstream', (context) => ({
+        description: context.describeTool('Archive a workstream without deleting it. This hides it from open planning views while preserving its linked tasks.'),
+        inputSchema: {
+            properties: {
+                id: stringProperty('Workstream ID or workstream reference such as WS-123.'),
+            },
+            required: ['id'],
+        },
+    }));
+    register('unarchive_workstream', (context) => ({
+        description: context.describeTool('Restore an archived workstream to active planning views.'),
+        inputSchema: {
+            properties: {
+                id: stringProperty('Workstream ID or workstream reference such as WS-123.'),
+            },
+            required: ['id'],
+        },
+    }));
+    register('set_task_workstream', (context) => ({
+        description: context.describeTool('Assign an existing task to a workstream. Reassigning a task removes it from any previous workstream.'),
+        inputSchema: {
+            properties: {
+                taskId: stringProperty('Task ID or task reference such as T-123.'),
+                workstreamId: stringProperty('Workstream ID or workstream reference such as WS-123.'),
+            },
+            required: ['taskId', 'workstreamId'],
+        },
+    }));
+    register('clear_task_workstream', (context) => ({
+        description: context.describeTool('Remove a task from its current workstream, making it standalone.'),
+        inputSchema: {
+            properties: {
+                taskId: stringProperty('Task ID or task reference such as T-123.'),
+            },
+            required: ['taskId'],
+        },
+    }));
+    register('set_workstream_initiative', (context) => ({
+        description: context.describeTool('Assign an existing workstream to an initiative. Reassigning a workstream removes it from any previous initiative.'),
+        inputSchema: {
+            properties: {
+                workstreamId: stringProperty('Workstream ID or workstream reference such as WS-123.'),
+                initiativeId: stringProperty('Initiative ID or initiative reference such as IN-123.'),
+            },
+            required: ['workstreamId', 'initiativeId'],
+        },
+    }));
+    register('clear_workstream_initiative', (context) => ({
+        description: context.describeTool('Remove a workstream from its current initiative, making it standalone.'),
+        inputSchema: {
+            properties: {
+                workstreamId: stringProperty('Workstream ID or workstream reference such as WS-123.'),
+            },
+            required: ['workstreamId'],
+        },
+    }));
+    register('get_task_checklist', (context) => ({
+        description: context.describeTool('Read the structured checklist items for one task. Returns stored checklist items, not markdown parsing.'),
+        inputSchema: {
+            properties: {
+                taskId: stringProperty('Task ID or task reference such as T-123.'),
+            },
+            required: ['taskId'],
+        },
+    }));
+    register('replace_task_checklist', (context) => ({
+        description: context.describeTool('Replace the structured checklist items for one task with a new ordered list.'),
+        inputSchema: {
+            properties: {
+                taskId: stringProperty('Task ID or task reference such as T-123.'),
+                items: arrayProperty('Ordered checklist items to persist.', {
+                    type: 'object',
+                    properties: {
+                        text: { type: 'string' },
+                        done: { type: 'boolean' },
+                    },
+                    required: ['text'],
+                }),
+            },
+            required: ['taskId', 'items'],
+        },
+    }));
+    register('get_schedule_board', (context) => ({
+        description: context.describeTool('Read the current schedule board for the active workspace. Use this before scheduling or reordering tasks when you need the existing day layout and order.'),
+        inputSchema: { properties: {} },
+    }));
+    register('schedule_task', (context) => ({
+        description: context.describeTool('Schedule a task on a specific day. Use get_schedule_board first when you need the current order before inserting the task.'),
+        inputSchema: {
+            properties: {
+                taskId: stringProperty('Task ID or task reference such as T-123.'),
+                date: stringProperty('Target date in YYYY-MM-DD format.'),
+                order: numberProperty('Optional position within that day.'),
+            },
+            required: ['taskId', 'date'],
+        },
+    }));
+    register('unschedule_task', (context) => ({
+        description: context.describeTool('Remove a task from the schedule board and return it to the unscheduled pool.'),
+        inputSchema: {
+            properties: {
+                taskId: stringProperty('Task ID or task reference such as T-123.'),
+            },
+            required: ['taskId'],
+        },
+    }));
+    register('reorder_scheduled_tasks', (context) => ({
+        description: context.describeTool('Replace the ordered task list for one scheduled day. Use get_schedule_board first to inspect the current day contents.'),
+        inputSchema: {
+            properties: {
+                date: stringProperty('Target date in YYYY-MM-DD format.'),
+                taskIds: arrayProperty('Ordered task IDs or task references for that day.', { type: 'string' }),
+            },
+            required: ['date', 'taskIds'],
+        },
+    }));
+    register('bulk_carryover', (context) => ({
+        description: context.describeTool('Carry unfinished scheduled tasks forward from one day to another in bulk.'),
+        inputSchema: {
+            properties: {
+                fromDate: stringProperty('Source date in YYYY-MM-DD format.'),
+                toDate: stringProperty('Destination date in YYYY-MM-DD format.'),
+                preserveCompleted: booleanProperty('When true, leave completed tasks on the source date.'),
+            },
+            required: ['fromDate', 'toDate'],
+        },
+    }));
+    register('set_schedule_preferences', (context) => ({
+        description: context.describeTool('Update schedule board display and planning preferences for the current session.'),
+        inputSchema: {
+            properties: {
+                weekStartsOn: numberProperty('Week start day index, where 0 is Sunday and 1 is Monday.'),
+                showWeekends: booleanProperty('When true, include weekends in schedule views.'),
+            },
+        },
+    }));
+    register('create_task', (context) => ({
+        description: context.describeTool('Create a new task. Use get_config first so category, type, priority, approach, status, and complexity values match the active workspace taxonomy.'),
+        inputSchema: {
+            properties: {
+                title: stringProperty('Task title.'),
+                description: stringProperty('Optional task description.'),
+                assignee: stringProperty(`${context.assigneeHint} Call list_assignees to inspect the current eligible IDs.`),
+                category: stringProperty('Task category value.'),
+                type: stringProperty('Task type value.', context.typeEnum),
+                priority: numberProperty(context.priorityDesc),
+                approach: stringProperty('Task approach value.', context.approachEnum),
+                status: stringProperty('Initial task status.', ['task', 'on-hold', 'in-progress', 'review', 'done', 'cancelled']),
+                complexity: numberProperty(context.complexityDesc),
+                scheduledDate: stringProperty('Optional scheduled date in YYYY-MM-DD format.'),
+                dueDate: stringProperty('Optional due date in YYYY-MM-DD format.'),
+            },
+            required: ['title'],
+        },
+    }));
+    register('start_task', (context) => ({
+        description: context.describeTool('preferred AI start-of-task workflow. Sets a task to in-progress and, when currently unassigned, claims it for the active AI profile. It will not steal a task from a different assignee.'),
+        inputSchema: {
+            properties: {
+                id: stringProperty('Task ID or task reference such as T-123.'),
+            },
+            required: ['id'],
+        },
+    }));
+    register('update_task', (context) => ({
+        description: context.describeTool('Update an existing task. Use get_config first for taxonomy-backed fields. Use start_task when beginning active work on a tracked task, and prefer finish_task for the final completion or review handoff.'),
+        inputSchema: {
+            properties: {
+                id: stringProperty('Task ID or task reference such as T-123.'),
+                title: stringProperty('Updated task title.'),
+                description: stringProperty('Updated task description.'),
+                assignee: stringProperty(`${context.assigneeHint} Call list_assignees to inspect the current eligible IDs.`),
+                category: stringProperty('Updated category value.'),
+                type: stringProperty('Updated task type value.', context.typeEnum),
+                priority: numberProperty(context.priorityDesc),
+                approach: stringProperty('Updated task approach value.', context.approachEnum),
+                status: stringProperty('Updated task status.', ['task', 'on-hold', 'in-progress', 'review', 'done', 'cancelled']),
+                complexity: numberProperty(context.complexityDesc),
+                scheduledDate: stringProperty('Updated scheduled date in YYYY-MM-DD format. Pass an empty string to clear.'),
+                dueDate: stringProperty('Updated due date in YYYY-MM-DD format. Pass an empty string to clear.'),
+            },
+            required: ['id'],
+        },
+    }));
+    register('finish_task', (context) => ({
+        description: context.describeTool('default end-of-task handoff. Use outcome=\'done\' when work is complete and no explicit human action is requested. Use outcome=\'review\' when human validation or approval is needed. If you report completed work on a tracked task, either finish it with this tool or explain why it remains open. This tool never archives automatically.'),
+        inputSchema: {
+            properties: {
+                id: stringProperty('Task ID or task reference such as T-123.'),
+                outcome: stringProperty('Completion outcome.', ['review', 'done']),
+                comment: stringProperty('Optional completion note to add as a task comment.'),
+            },
+            required: ['id'],
+        },
+    }));
+    register('assign_task', (context) => ({
+        description: context.describeTool('Assign a task to one eligible assignee. For assigning 3 or more tasks at once, use bulk_assign_tasks instead.'),
+        inputSchema: {
+            properties: {
+                id: stringProperty('Task ID or task reference such as T-123.'),
+                assignee: stringProperty(`${context.assigneeHint} Call list_assignees to inspect the current eligible IDs.`),
+            },
+            required: ['id', 'assignee'],
+        },
+    }));
+    register('bulk_assign_tasks', (context) => ({
+        description: context.describeTool('Assign multiple tasks to the same eligible assignee in one request. Preferred over repeated assign_task calls when changing 3 or more tasks at once.'),
+        inputSchema: {
+            properties: {
+                ids: arrayProperty('Task IDs or task references such as T-123.', { type: 'string' }),
+                assignee: stringProperty(`${context.assigneeHint} Call list_assignees to inspect the current eligible IDs.`),
+            },
+            required: ['ids', 'assignee'],
+        },
+    }));
+    register('archive_task', (context) => ({
+        description: context.describeTool('Move a task to history by archiving it. Use status=\'done\' for completed work or status=\'cancelled\' for abandoned work. active tasks may still use status=done for final lookover without being archived.'),
+        inputSchema: {
+            properties: {
+                id: stringProperty('Task ID or task reference such as T-123.'),
+                status: stringProperty('Final archive status.', ['done', 'cancelled']),
+                reason: stringProperty('Reason for cancellation when status is cancelled.'),
+            },
+            required: ['id', 'status'],
+        },
+    }));
+    register('list_archive', (context) => ({
+        description: context.describeTool('List archived tasks. Use format=json for programmatic use.'),
+        inputSchema: {
+            properties: {
+                format: stringProperty('Toggle output format (default: markdown).', ['markdown', 'json']),
+            },
+        },
+    }));
+    register('unarchive_task', (context) => ({
+        description: context.describeTool('Restore an archived task to the active task list.'),
+        inputSchema: {
+            properties: {
+                id: stringProperty('Task ID or task reference such as T-123.'),
+            },
+            required: ['id'],
+        },
+    }));
+    register('bulk_archive', (context) => ({
+        description: context.describeTool('Archive multiple tasks in one request. Use status=\'done\' for completed work or status=\'cancelled\' for abandoned work.'),
+        inputSchema: {
+            properties: {
+                ids: arrayProperty('Task IDs or task references such as T-123.', { type: 'string' }),
+                status: stringProperty('Final archive status (default: done).', ['done', 'cancelled']),
+            },
+            required: ['ids'],
+        },
+    }));
+}

package/dist/mcp/toolCatalog.d.ts

@@ -0,0 +1,35 @@
+import type { McpToolName } from './toolRegistry.js';
+export type McpToolInputSchema = {
+    type: 'object';
+    properties?: Record<string, unknown>;
+    required?: string[];
+};
+export type McpToolDescriptor = {
+    name: McpToolName;
+    description: string;
+    inputSchema: McpToolInputSchema;
+};
+export type McpToolDescriptorContext = {
+    describeTool: (text: string) => string;
+    assigneeHint: string;
+    priorityDesc: string;
+    typeEnum: string[];
+    approachEnum: string[];
+    complexityDesc: string;
+};
+export type McpToolHandlerResult = {
+    content?: Array<{
+        type: string;
+        text?: string;
+    }>;
+    isError?: boolean;
+};
+export type McpToolHandler = (args: Record<string, unknown>) => Promise<McpToolHandlerResult> | McpToolHandlerResult;
+export type RegisteredMcpTool = {
+    name: McpToolName;
+    buildDescriptor: (context: McpToolDescriptorContext) => McpToolDescriptor;
+    handler: McpToolHandler;
+};
+export type RegisterMcpTool = (tool: RegisteredMcpTool) => void;
+export type DomainToolExecutor = (name: McpToolName, args: Record<string, unknown>) => Promise<McpToolHandlerResult> | McpToolHandlerResult;
+export declare function bindDomainTool(executeTool: DomainToolExecutor, name: McpToolName): McpToolHandler;

package/dist/mcp/toolCatalog.js

@@ -0,0 +1,3 @@
+export function bindDomainTool(executeTool, name) {
+    return (args) => executeTool(name, args);
+}

package/dist/plugins/vite.js

@@ -190,7 +190,7 @@ export function taskforcePlugin(options) {
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <link rel="icon" type="image/svg+xml" href="/src/assets/favicon/favicon.svg" />
     <link rel="icon" type="image/x-icon" href="/src/assets/favicon/favicon.ico" />
-    <title>Taskforce Dashboard</title>
+    <title>Taskforce</title>
     <style>
         body { margin: 0; background: #0f0f1a; color: white; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif; }
         #root { height: 100vh; overflow: hidden; }

package/dist/runtime/appGateDefinitions.d.ts

@@ -12,7 +12,7 @@ export declare const APP_GATE_DEFINITIONS: {
         readonly removalMilestone: "Document Manager GA";
     };
     readonly 'workflows.workspace_access': {
-        readonly enabled: true;
+        readonly enabled: false;
         readonly description: "Workflow workspace readiness gate.";
         readonly owner: "taskforce";
         readonly removalMilestone: "Workflow workspace GA";

package/dist/runtime/appGateDefinitions.js

@@ -12,7 +12,7 @@ export const APP_GATE_DEFINITIONS = {
         removalMilestone: 'Document Manager GA'
     },
     'workflows.workspace_access': {
-        enabled: true,
+        enabled: false,
         description: 'Workflow workspace readiness gate.',
         owner: 'taskforce',
         removalMilestone: 'Workflow workspace GA'

package/dist/server/index.d.ts

@@ -28,6 +28,7 @@ export declare function shouldRewriteSetCookieForLocalDevHost(hostHeader: string
 export declare function writeJsonErrorIfPossible(res: http.ServerResponse, statusCode: number, payload: Record<string, unknown>): boolean;
 export declare function applyCloudProxyForwardedHeaders(headers: Headers, req: http.IncomingMessage): void;
 export declare function rewriteProxySetCookieForLocalHost(cookie: string): string;
+export declare function shouldRewriteProxySetCookieDomain(cookie: string, hostHeader: string | undefined): boolean;
 export declare function shouldApplyAuthRateLimitForPath(pathname: string): boolean;
 export declare function resolveCloudProxyBaseUrl(env?: NodeJS.ProcessEnv): string;
 export declare function ensureBillingWebhookAuthExclusion(excludedPaths: string[]): string[];

package/dist/server/index.js

@@ -205,6 +205,43 @@ export function rewriteProxySetCookieForLocalHost(cookie) {
     const filteredAttrs = attrs.filter((attr) => !attr.toLowerCase().startsWith('domain='));
     return [nameValue, ...filteredAttrs].join('; ');
 }
+function normalizeHostHeaderHost(hostHeader) {
+    const raw = String(hostHeader || '').trim().toLowerCase();
+    if (!raw)
+        return '';
+    if (raw.startsWith('[')) {
+        const closing = raw.indexOf(']');
+        if (closing >= 0)
+            return raw.slice(1, closing);
+    }
+    const portSeparator = raw.lastIndexOf(':');
+    if (portSeparator <= 0)
+        return raw;
+    const maybePort = raw.slice(portSeparator + 1);
+    if (/^\d+$/.test(maybePort)) {
+        return raw.slice(0, portSeparator);
+    }
+    return raw;
+}
+function parseSetCookieDomain(cookie) {
+    const parts = String(cookie || '').split(';').map((part) => part.trim()).filter(Boolean);
+    for (const part of parts.slice(1)) {
+        const lower = part.toLowerCase();
+        if (!lower.startsWith('domain='))
+            continue;
+        return part.slice('domain='.length).trim().replace(/^\.+/, '').toLowerCase();
+    }
+    return '';
+}
+export function shouldRewriteProxySetCookieDomain(cookie, hostHeader) {
+    const requestHost = normalizeHostHeaderHost(hostHeader);
+    const cookieDomain = parseSetCookieDomain(cookie);
+    if (!requestHost || !cookieDomain)
+        return false;
+    if (requestHost === cookieDomain)
+        return false;
+    return !requestHost.endsWith(`.${cookieDomain}`);
+}
 async function readRequestBody(req, maxBytes) {
     const chunks = [];
     let total = 0;
@@ -550,9 +587,15 @@ export function createStandaloneServer(options) {
                 }
                 const setCookies = upstream.headers.getSetCookie?.();
                 if (Array.isArray(setCookies) && setCookies.length > 0) {
-                    const normalizedSetCookies = shouldRewriteSetCookieForLocalDevHost(String(req.headers.host || '').trim())
-                        ? setCookies.map((cookie) => rewriteProxySetCookieForLocalHost(cookie))
-                        : setCookies;
+                    const requestHost = String(req.headers.host || '').trim();
+                    const normalizedSetCookies = setCookies.map((cookie) => {
+                        if (shouldRewriteSetCookieForLocalDevHost(requestHost)) {
+                            return rewriteProxySetCookieForLocalHost(cookie);
+                        }
+                        return shouldRewriteProxySetCookieDomain(cookie, requestHost)
+                            ? rewriteProxySetCookieForLocalHost(cookie)
+                            : cookie;
+                    });
                     res.setHeader('Set-Cookie', normalizedSetCookies);
                 }
                 res.writeHead(upstream.status, outgoingHeaders);

package/dist/server/index.test.js

@@ -1,5 +1,5 @@
 import { describe, expect, it, vi } from 'vitest';
-import { ensureBillingWebhookAuthExclusion, ensurePublicSiteConfigAuthExclusion, isBillingWebhookPath, resolveEffectiveRequestUserId, resolveAuthorizedWorkspaceAccess, shouldApplyAuthRateLimitForPath, shouldProxyCloudPath, writeJsonErrorIfPossible } from './index.js';
+import { ensureBillingWebhookAuthExclusion, ensurePublicSiteConfigAuthExclusion, isBillingWebhookPath, rewriteProxySetCookieForLocalHost, resolveEffectiveRequestUserId, resolveAuthorizedWorkspaceAccess, shouldRewriteProxySetCookieDomain, shouldApplyAuthRateLimitForPath, shouldProxyCloudPath, writeJsonErrorIfPossible } from './index.js';
 describe('server index helper policies', () => {
     it('adds webhook path to auth exclusions without duplicates', () => {
         const base = ['/api/taskforce/health', '/api/taskforce/auth'];
@@ -92,6 +92,17 @@ describe('shouldProxyCloudPath', () => {
         expect(shouldProxyCloudPath('/api/taskforce/public/site-config-script')).toBe(true);
     });
 });
+describe('proxy cookie helpers', () => {
+    it('rewrites mismatched cookie domains for non-loopback local hosts', () => {
+        const cookie = 'taskforce_session=abc; Path=/; HttpOnly; SameSite=Lax; Domain=taskforcehq.ai';
+        expect(shouldRewriteProxySetCookieDomain(cookie, 'taskforce.localtest.me:3847')).toBe(true);
+        expect(rewriteProxySetCookieForLocalHost(cookie)).not.toContain('Domain=');
+    });
+    it('preserves cookie domains that already match the request host', () => {
+        const cookie = 'taskforce_session=abc; Path=/; HttpOnly; SameSite=Lax; Domain=taskforcehq.ai';
+        expect(shouldRewriteProxySetCookieDomain(cookie, 'app.taskforcehq.ai')).toBe(false);
+    });
+});
 describe('resolveAuthorizedWorkspaceAccess', () => {
     it('prefers an explicitly requested workspace when the user is authorized for it', () => {
         const core = {

package/dist/server/routes/admin.d.ts

@@ -49,7 +49,7 @@
  */
 import type { IncomingMessage, ServerResponse } from 'http';
 import type { TaskforceCore } from '../../core/Taskforce.js';
-import type { RouteHandler, RouteContext } from '../routes.js';
+import { type RouteHandler, type RouteContext } from './primitives.js';
 import type { ResolvedObjectStorageConfig } from '../../storage/objectStorage.js';
 import type { TaskAssetStore } from '../../storage/taskAssetStore.js';
 import { ObjectStorageClient } from '../../storage/objectStorageClient.js';
@@ -99,10 +99,6 @@ export interface AdminRouteDependencies {
     }) => void;
     getCollaborationTelemetry: () => any;
     isCollaborationPolicyEnabled: () => boolean;
-    resolveRuntimeConfigBaseUrl: (req: IncomingMessage) => string;
-    resolvePublicAuthBaseUrl: (req: IncomingMessage) => string;
-    parseFormBody: (req: IncomingMessage, maxBytes?: number) => Promise<Record<string, string>>;
-    escapeHtml: (value: unknown) => string;
     normalizeMcpOauthScopeString: (raw: unknown) => string[];
     MCP_TOKEN_SCOPE_VALUES: Set<string>;
     MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS: Record<string, McpAccessTokenScope>;