@taskforcehq/taskforce 0.3.303 → 0.3.305

package/dist/server/routes/admin.js

@@ -50,9 +50,9 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { TaskforceRuleError } from '../../core/Taskforce.js';
-import { parseJsonBody } from '../routes.js';
+import { escapeHtml, parseFormBody, parseJsonBody } from './primitives.js';
 import { resolveRequestAccess } from '../auth.js';
-import { resolveEffectiveEmailConfig, sendEmail } from '../email.js';
+import { sendEmail } from '../email.js';
 import { WorkspaceAssetStore } from '../../storage/workspaceAssetStore.js';
 import { scanDocumentIntegrity } from '../../storage/documentIntegrity.js';
 import { normalizeStorageIntegrityScheduleSettings, resolveStorageIntegrityScheduleSettings, } from '../../storage/integritySchedule.js';
@@ -64,67 +64,18 @@ import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/
 import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
 import { randomUUID } from 'crypto';
 import { resolveDeploymentConfig } from '../../config/deployment.js';
-import { getTaskforceCloudEnvironmentConfig, resolveTaskforceCloudEnvironmentFromBaseUrl } from '../../config/cloudEnvironment.js';
-import { resolveErrorStatusCode } from './shared.js';
+import { getTaskforceCloudEnvironmentConfig, resolveTaskforceCloudEnvironmentFromBaseUrl, resolveTaskforceMcpBaseUrlFromBaseUrl } from '../../config/cloudEnvironment.js';
+import { buildCloudMcpRuntimeAuth, resolveErrorStatusCode } from './shared.js';
+import { buildAuthBehavior, buildSiteBehavior, getRouteEmailConfig, resolvePublicAuthBaseUrl, resolveRuntimeConfigBaseUrl, } from './authSupport.js';
 import { applyWorkspaceRepair, scanWorkspaceRepair } from '../../sync/workspaceRepair.js';
 // === SECTION: Registration ===
 export function registerAdminRoutes(deps) {
-    const { addRoute, core, context, requestWorkspaceId, requestUserId, requestRole, requestHeader, requestRuntimeMode, ensureAppAccess, ensureAdminRole, ensureCloudPlanData, requireCloudRuntime, resolveAuthenticatedUserId, resolveAdminRequestActor, auditAdminAction, resolveEffectiveObjectStorageConfig, getObjectStorageClient, taskAssetStore, normalizeDocumentPathInput, ensureWithinDir, getAssetMetadata, markAssetDeleted, clearAssetDeleted, removeAssetMetadata, getStorageTelemetry, appendStorageTelemetry, getStorageIntegrityHistory, appendStorageIntegrityHistory, getDocumentPurgeHistory, appendDocumentPurgeHistory, getCollaborationTelemetry, isCollaborationPolicyEnabled, resolveRuntimeConfigBaseUrl, resolvePublicAuthBaseUrl, parseFormBody, escapeHtml, normalizeMcpOauthScopeString, MCP_TOKEN_SCOPE_VALUES, MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS, MCP_WRITE_RATE_LIMIT_ENABLED, MCP_WRITE_RATE_LIMIT_ACTOR_MAX_REQUESTS, MCP_WRITE_RATE_LIMIT_WORKSPACE_MAX_REQUESTS, MCP_WRITE_RATE_LIMIT_WINDOW_MS, } = deps;
+    const { addRoute, core, context, requestWorkspaceId, requestUserId, requestRole, requestHeader, requestRuntimeMode, ensureAppAccess, ensureAdminRole, ensureCloudPlanData, requireCloudRuntime, resolveAuthenticatedUserId, resolveAdminRequestActor, auditAdminAction, resolveEffectiveObjectStorageConfig, getObjectStorageClient, taskAssetStore, normalizeDocumentPathInput, ensureWithinDir, getAssetMetadata, markAssetDeleted, clearAssetDeleted, removeAssetMetadata, getStorageTelemetry, appendStorageTelemetry, getStorageIntegrityHistory, appendStorageIntegrityHistory, getDocumentPurgeHistory, appendDocumentPurgeHistory, getCollaborationTelemetry, isCollaborationPolicyEnabled, normalizeMcpOauthScopeString, MCP_TOKEN_SCOPE_VALUES, MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS, MCP_WRITE_RATE_LIMIT_ENABLED, MCP_WRITE_RATE_LIMIT_ACTOR_MAX_REQUESTS, MCP_WRITE_RATE_LIMIT_WORKSPACE_MAX_REQUESTS, MCP_WRITE_RATE_LIMIT_WINDOW_MS, } = deps;
     const baseVirusScanConfig = resolveVirusScanConfigFromEnv(process.env);
     const workspaceAssetStore = typeof core.getDatabaseAdapter === 'function' && typeof core.getTenantId === 'function'
         ? new WorkspaceAssetStore(core.getDatabaseAdapter(), core.getTenantId())
         : null;
     // === SECTION: Email helpers ===
-    const getEmailConfig = () => {
-        if (context.authConfig?.runtimeMode !== 'cloud') {
-            return resolveEffectiveEmailConfig(process.env, { provider: 'console' });
-        }
-        const globalSettings = core.getGlobalSettings();
-        return resolveEffectiveEmailConfig(process.env, globalSettings.email || null);
-    };
-    const resolveBooleanSetting = (value, fallback) => {
-        if (typeof value === 'boolean')
-            return value;
-        if (typeof value === 'number')
-            return value !== 0;
-        const normalized = String(value || '').trim().toLowerCase();
-        if (!normalized)
-            return fallback;
-        if (['1', 'true', 'yes', 'on'].includes(normalized))
-            return true;
-        if (['0', 'false', 'no', 'off'].includes(normalized))
-            return false;
-        return fallback;
-    };
-    const getAuthBehavior = () => {
-        const globalSettings = core.getGlobalSettings();
-        const authSettings = globalSettings.auth || {};
-        const authRateLimitMaxRequestsRaw = Number(authSettings.authRateLimitMaxRequests);
-        const authRateLimitWindowMsRaw = Number(authSettings.authRateLimitWindowMs);
-        const onboardingPolicy = core.getOnboardingPolicy();
-        return {
-            allowSelfRegistration: resolveBooleanSetting(authSettings.allowSelfRegistration, true),
-            requireVerifiedEmail: resolveBooleanSetting(authSettings.requireVerifiedEmail, true),
-            defaultNewUserBetaAccess: resolveBooleanSetting(authSettings.defaultNewUserBetaAccess, false),
-            authRateLimitEnabled: resolveBooleanSetting(authSettings.authRateLimitEnabled, true),
-            authRateLimitMaxRequests: Number.isFinite(authRateLimitMaxRequestsRaw) && authRateLimitMaxRequestsRaw >= 1
-                ? Math.floor(authRateLimitMaxRequestsRaw)
-                : 10,
-            authRateLimitWindowMs: Number.isFinite(authRateLimitWindowMsRaw) && authRateLimitWindowMsRaw >= 1000
-                ? Math.floor(authRateLimitWindowMsRaw)
-                : 15 * 60_000,
-            onboardingPolicyMode: onboardingPolicy.mode,
-            onboardingPlanVersionId: onboardingPolicy.planVersionId
-        };
-    };
-    const getSiteBehavior = () => {
-        const globalSettings = core.getGlobalSettings();
-        const siteSettings = globalSettings.site || {};
-        return {
-            showRunTaskforceLocally: resolveBooleanSetting(siteSettings.showRunTaskforceLocally, true),
-            pricingPageEnabled: resolveBooleanSetting(siteSettings.pricingPageEnabled, true)
-        };
-    };
     const resolveEffectiveVirusScanSettings = () => {
         const settings = core.getGlobalSettings().objectStorage || {};
         const asyncEnabled = typeof settings.virusScanAsyncEnabled === 'boolean'
@@ -139,6 +90,7 @@ export function registerAdminRoutes(deps) {
         };
     };
     // === SECTION: MCP helpers ===
+    const MCP_CONNECTION_TEST_TIMEOUT_MS = 5000;
     const writeMcpHttpError = (res, statusCode, message) => {
         res.writeHead(statusCode, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({
@@ -171,6 +123,112 @@ export function registerAdminRoutes(deps) {
     const resolveMcpOauthTokenUrl = (req) => `${resolveMcpOauthIssuer(req)}/oauth/mcp/token`;
     const resolveMcpOauthRegisterUrl = (req) => `${resolveMcpOauthIssuer(req)}/oauth/mcp/register`;
     const resolveMcpOauthResourceUrl = (req) => `${resolveMcpOauthIssuer(req)}/mcp`;
+    const resolveCloudMcpEndpoint = (req) => {
+        const requestBaseUrl = resolveRuntimeConfigBaseUrl(req);
+        const deployment = resolveDeploymentConfig(process.env, { requestBaseUrl });
+        const inferredMcpBaseUrl = resolveTaskforceMcpBaseUrlFromBaseUrl(deployment.cloudMcpBaseUrl
+            || deployment.cloudAuthBaseUrl
+            || deployment.cloudBaseUrl
+            || requestBaseUrl
+            || '');
+        const baseUrl = String(inferredMcpBaseUrl || deployment.cloudMcpBaseUrl || resolveMcpOauthIssuer(req)).trim().replace(/\/+$/, '');
+        return `${baseUrl}/mcp`;
+    };
+    const probeCloudMcpEndpoint = async (req, token) => {
+        const endpoint = resolveCloudMcpEndpoint(req);
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), MCP_CONNECTION_TEST_TIMEOUT_MS);
+        try {
+            const response = await fetch(endpoint, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${token}`,
+                    Accept: 'application/json, text/event-stream',
+                    'Content-Type': 'application/json'
+                },
+                body: JSON.stringify({
+                    jsonrpc: '2.0',
+                    id: `mcp-connection-test-${randomUUID()}`,
+                    method: 'initialize',
+                    params: {
+                        protocolVersion: '2025-03-26',
+                        capabilities: {},
+                        clientInfo: {
+                            name: 'taskforce-settings-test',
+                            version: '1.0.0'
+                        }
+                    }
+                }),
+                signal: controller.signal
+            });
+            const responseText = await response.text();
+            let payload = null;
+            try {
+                payload = responseText ? JSON.parse(responseText) : null;
+            }
+            catch {
+                payload = null;
+            }
+            const remoteMessage = typeof payload?.error?.message === 'string'
+                ? payload.error.message.trim()
+                : '';
+            if (!response.ok) {
+                if (response.status >= 500) {
+                    return {
+                        ok: false,
+                        statusCode: 502,
+                        code: 'MCP_ENDPOINT_GATEWAY_ERROR',
+                        error: `Cloud MCP endpoint ${endpoint} returned ${response.status}. The dedicated MCP host may be degraded or unavailable.`,
+                        details: {
+                            endpoint,
+                            upstreamStatus: response.status,
+                            remoteMessage: remoteMessage || null
+                        }
+                    };
+                }
+                return {
+                    ok: false,
+                    statusCode: 502,
+                    code: 'MCP_ENDPOINT_REJECTED_VALIDATED_TOKEN',
+                    error: `Cloud MCP endpoint ${endpoint} rejected a token that validated locally. This usually means the MCP service is stale, routed incorrectly, or out of sync with the auth database.`,
+                    details: {
+                        endpoint,
+                        upstreamStatus: response.status,
+                        remoteMessage: remoteMessage || null
+                    }
+                };
+            }
+            return {
+                ok: true,
+                endpoint,
+                serverName: typeof payload?.result?.serverInfo?.name === 'string'
+                    ? payload.result.serverInfo.name
+                    : null,
+                protocolVersion: typeof payload?.result?.protocolVersion === 'string'
+                    ? payload.result.protocolVersion
+                    : null
+            };
+        }
+        catch (error) {
+            const timedOut = error?.name === 'AbortError';
+            return {
+                ok: false,
+                statusCode: 502,
+                code: timedOut ? 'MCP_ENDPOINT_TIMEOUT' : 'MCP_ENDPOINT_UNREACHABLE',
+                error: timedOut
+                    ? `Cloud MCP endpoint ${endpoint} did not respond within ${MCP_CONNECTION_TEST_TIMEOUT_MS}ms.`
+                    : `Could not reach cloud MCP endpoint ${endpoint}. The dedicated MCP host may be unavailable or misconfigured.`,
+                details: {
+                    endpoint,
+                    timeoutMs: MCP_CONNECTION_TEST_TIMEOUT_MS,
+                    reason: String(error?.message || error || '')
+                }
+            };
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    };
     const renderMcpOauthAuthorizePage = (input) => {
         const options = input.workspaces.map((workspace) => {
             const selected = workspace.id === input.preselectedWorkspaceId ? ' selected' : '';
@@ -474,22 +532,13 @@ export function registerAdminRoutes(deps) {
                 serverName: 'taskforce-cloud',
                 logStartup: false,
                 runtimeMode: 'cloud',
-                auth: {
-                    scopes: authScopes,
-                    userId: auth.authenticatedViaToken?.userId || auth.authenticatedViaOAuth?.userId || auth.userId || null,
-                    tokenId: auth.authenticatedViaToken?.tokenId || auth.authenticatedViaOAuth?.grantId || null,
-                    aiProfileToken: auth.aiProfileToken,
-                    aiProfileName: auth.aiProfileName,
-                    aiProfileDescription: auth.aiProfileDescription,
-                    aiProfileRole: auth.aiProfileRole,
-                    aiProfileProvider: auth.aiProfileProvider,
-                    aiProfileModel: auth.aiProfileModel,
-                    aiProfileSurfaceType: auth.aiProfileSurfaceType,
-                    actorType: auth.authenticatedViaToken ? 'token' : auth.authenticatedViaOAuth ? 'oauth' : 'user',
+                auth: buildCloudMcpRuntimeAuth({
+                    req,
+                    auth,
+                    requestHeader,
                     requestId: String(req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || randomUUID(),
-                    ip: req.socket?.remoteAddress || null,
-                    userAgent: requestHeader(req, 'user-agent', '') || null,
-                },
+                    authScopes,
+                }),
             });
             const transport = new StreamableHTTPServerTransport({
                 sessionIdGenerator: undefined,
@@ -1022,7 +1071,7 @@ export function registerAdminRoutes(deps) {
             return;
         }
         if (context.authConfig?.runtimeMode !== 'cloud') {
-            const effective = getEmailConfig();
+            const effective = getRouteEmailConfig(core, context);
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({
                 settings: { provider: 'console', from: effective.from, replyTo: '' },
@@ -1031,7 +1080,7 @@ export function registerAdminRoutes(deps) {
             return;
         }
         const settings = core.getGlobalSettings().email || {};
-        const effective = getEmailConfig();
+        const effective = getRouteEmailConfig(core, context);
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({
             settings: {
@@ -1056,7 +1105,7 @@ export function registerAdminRoutes(deps) {
             return;
         }
         const settings = core.getGlobalSettings().email || {};
-        const effective = getEmailConfig();
+        const effective = getRouteEmailConfig(core, context);
         const keyRequired = effective.provider === 'resend' || effective.provider === 'google-workspace';
         const ready = keyRequired ? Boolean(effective.providerApiKey) : true;
         const reason = ready
@@ -1088,7 +1137,7 @@ export function registerAdminRoutes(deps) {
         const globalSettings = core.getGlobalSettings();
         const authSettings = globalSettings.auth || {};
         const billingSettings = globalSettings.billing || {};
-        const effective = getAuthBehavior();
+        const effective = buildAuthBehavior(core);
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({
             settings: {
@@ -1126,7 +1175,7 @@ export function registerAdminRoutes(deps) {
             return;
         }
         const siteSettings = core.getGlobalSettings().site || {};
-        const siteBehavior = getSiteBehavior();
+        const siteBehavior = buildSiteBehavior(core);
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({
             settings: {
@@ -1741,17 +1790,20 @@ export function registerAdminRoutes(deps) {
             return;
         }
         const body = await parseJsonBody(req);
+        const currentOnboardingPolicy = core.getOnboardingPolicy();
         const onboardingPolicyMode = body?.onboardingPolicyMode === 'auto_grant_free' || body?.onboardingPolicyMode === 'auto_start_trial'
             ? body.onboardingPolicyMode
-            : 'require_plan_selection';
+            : body?.onboardingPolicyMode === 'require_plan_selection'
+                ? 'require_plan_selection'
+                : currentOnboardingPolicy.mode;
         const onboardingPlanVersionId = typeof body?.onboardingPlanVersionId === 'string'
             ? body.onboardingPlanVersionId.trim() || null
             : body?.onboardingPlanVersionId === null
                 ? null
-                : undefined;
+                : currentOnboardingPolicy.planVersionId;
         const validation = core.validateOnboardingPolicy({
             mode: onboardingPolicyMode,
-            ...(onboardingPlanVersionId !== undefined ? { planVersionId: onboardingPlanVersionId } : {})
+            planVersionId: onboardingPlanVersionId
         });
         if (!validation.valid) {
             res.writeHead(400, { 'Content-Type': 'application/json' });
@@ -1848,7 +1900,7 @@ export function registerAdminRoutes(deps) {
             res.end(JSON.stringify({ success: false, error: 'Valid test email address is required.' }));
             return;
         }
-        const config = getEmailConfig();
+        const config = getRouteEmailConfig(core, context);
         const result = await sendEmail({
             to,
             subject: 'Taskforce email settings test',
@@ -2273,9 +2325,28 @@ export function registerAdminRoutes(deps) {
                 res.end(JSON.stringify({ success: false, error: 'Token is missing required scopes.', code: 'MCP_TOKEN_MISSING_SCOPES', details: { requiredScopes, missingScopes, grantedScopes: inspection.scopes } }));
                 return;
             }
+            const probe = await probeCloudMcpEndpoint(req, token);
+            if (!probe.ok) {
+                res.writeHead(probe.statusCode, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ success: false, error: probe.error, code: probe.code, details: probe.details }));
+                return;
+            }
             const workspace = core.getWorkspaceProfile(wid);
             res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ success: true, result: { tokenId: inspection.tokenId, tokenName: inspection.name, workspaceId: wid, workspaceName: String(workspace?.name || wid), scopes: inspection.scopes, requiredScopes, endpoint: '/mcp' } }));
+            res.end(JSON.stringify({
+                success: true,
+                result: {
+                    tokenId: inspection.tokenId,
+                    tokenName: inspection.name,
+                    workspaceId: wid,
+                    workspaceName: String(workspace?.name || wid),
+                    scopes: inspection.scopes,
+                    requiredScopes,
+                    endpoint: probe.endpoint,
+                    serverName: probe.serverName,
+                    protocolVersion: probe.protocolVersion
+                }
+            }));
         }
         catch (error) {
             const statusCode = resolveErrorStatusCode(error);

package/dist/server/routes/annotatedAttachments.d.ts

@@ -13,7 +13,7 @@
  */
 import type { IncomingMessage, ServerResponse } from 'http';
 import type { TaskforceCore } from '../../core/Taskforce.js';
-import type { RouteHandler } from '../routes.js';
+import { type RouteHandler } from './primitives.js';
 export interface AnnotatedAttachmentRouteDependencies {
     addRoute: (method: string, path: string, handler: RouteHandler) => void;
     core: TaskforceCore;

package/dist/server/routes/annotatedAttachments.js

@@ -12,7 +12,7 @@
  *   GET    /api/taskforce/annotated-attachments/sessions/:id/payload
  */
 import { ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY, resolveAppGateAccess, } from '../../runtime/appGates.js';
-import { parseJsonBody } from '../routes.js';
+import { parseJsonBody } from './primitives.js';
 import { resolveErrorStatusCode } from './shared.js';
 import { getImageReferenceLabel, parseImageReference } from '../../utils/imageReferences.js';
 function writeJson(res, statusCode, payload) {

package/dist/server/routes/auth.d.ts

@@ -37,7 +37,7 @@
  */
 import type { IncomingMessage, ServerResponse } from 'http';
 import type { TaskforceCore } from '../../core/Taskforce.js';
-import type { RouteHandler, RouteContext } from '../routes.js';
+import { type RouteHandler, type RouteContext } from './primitives.js';
 import type { ResolvedObjectStorageConfig } from '../../storage/objectStorage.js';
 import { ObjectStorageClient } from '../../storage/objectStorageClient.js';
 export interface AuthRouteDependencies {
@@ -58,9 +58,6 @@ export interface AuthRouteDependencies {
         userId: string;
         systemRole: 'system_admin' | 'user';
     };
-    shouldExposeDevAuthTokens: () => boolean;
-    resolveRuntimeConfigBaseUrl: (req: IncomingMessage) => string;
-    resolvePublicAuthBaseUrl: (req: IncomingMessage) => string;
     resolveEffectiveObjectStorageConfig: () => ResolvedObjectStorageConfig;
     getObjectStorageClient: () => ObjectStorageClient | null;
 }

package/dist/server/routes/auth.js

@@ -38,36 +38,23 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { randomUUID } from 'crypto';
-import { parseJsonBody } from '../routes.js';
+import { parseJsonBody } from './primitives.js';
 import { hasValidSession, createClearSessionCookie, createSessionTokenCookie, resolveRequestAccess, resolveSessionCookieAttributesForRequest, } from '../auth.js';
-import { resolveEffectiveEmailConfig, sendEmail } from '../email.js';
+import { sendEmail } from '../email.js';
 import { resolveDeploymentConfig } from '../../config/deployment.js';
 import { resolveRuntimeModeContract } from '../../shared/runtimeContract.js';
 import { requestHeader, resolveErrorStatusCode } from './shared.js';
+import { buildAuthFlowBehavior, buildSiteBehavior, getRouteEmailConfig, resolvePublicAuthBaseUrl, resolveRuntimeConfigBaseUrl, shouldExposeDevAuthTokens } from './authSupport.js';
 import { normalizeTaskDataRelativePath } from '../../storage/objectStorageClient.js';
 // === SECTION: Registration ===
 export function registerAuthRoutes(deps) {
-    const { addRoute, core, context, requestWorkspaceId, requestUserId, ensureAppAccess, ensureAuthenticatedUser, ensureWorkspaceAdminRole, ensureCloudPlanData, requireCloudRuntime, auditAuthAction, resolveAdminRequestActor, shouldExposeDevAuthTokens, resolveRuntimeConfigBaseUrl, resolvePublicAuthBaseUrl, resolveEffectiveObjectStorageConfig, getObjectStorageClient, } = deps;
+    const { addRoute, core, context, requestWorkspaceId, requestUserId, ensureAppAccess, ensureAuthenticatedUser, ensureWorkspaceAdminRole, ensureCloudPlanData, requireCloudRuntime, auditAuthAction, resolveAdminRequestActor, resolveEffectiveObjectStorageConfig, getObjectStorageClient, } = deps;
     const normalizeTeamWorkspaceRole = (value) => {
         const role = String(value || '').trim().toLowerCase();
         if (role === 'owner' || role === 'admin' || role === 'member' || role === 'read-only')
             return role;
         return null;
     };
-    const resolveBooleanSetting = (value, fallback) => {
-        if (typeof value === 'boolean')
-            return value;
-        if (typeof value === 'number')
-            return value !== 0;
-        const normalized = String(value || '').trim().toLowerCase();
-        if (!normalized)
-            return fallback;
-        if (['1', 'true', 'yes', 'on'].includes(normalized))
-            return true;
-        if (['0', 'false', 'no', 'off'].includes(normalized))
-            return false;
-        return fallback;
-    };
     const resolveTeamPlanModeFromEntitlements = (payload) => {
         const state = String(payload?.state || '').trim().toLowerCase();
         const teamAllowed = payload?.features?.['collaboration.team_management']?.allowed === true;
@@ -190,42 +177,6 @@ export function registerAuthRoutes(deps) {
         };
     };
     // === SECTION: Email delivery helpers ===
-    const getEmailConfig = () => {
-        if (context.authConfig?.runtimeMode !== 'cloud') {
-            return resolveEffectiveEmailConfig(process.env, { provider: 'console' });
-        }
-        const globalSettings = core.getGlobalSettings();
-        return resolveEffectiveEmailConfig(process.env, globalSettings.email || null);
-    };
-    const getAuthBehavior = () => {
-        const globalSettings = core.getGlobalSettings();
-        const authSettings = globalSettings.auth || {};
-        const authRateLimitMaxRequestsRaw = Number(authSettings.authRateLimitMaxRequests);
-        const authRateLimitWindowMsRaw = Number(authSettings.authRateLimitWindowMs);
-        const onboardingPolicy = core.getOnboardingPolicy();
-        return {
-            allowSelfRegistration: resolveBooleanSetting(authSettings.allowSelfRegistration, true),
-            requireVerifiedEmail: resolveBooleanSetting(authSettings.requireVerifiedEmail, true),
-            defaultNewUserBetaAccess: resolveBooleanSetting(authSettings.defaultNewUserBetaAccess, false),
-            authRateLimitEnabled: resolveBooleanSetting(authSettings.authRateLimitEnabled, true),
-            authRateLimitMaxRequests: Number.isFinite(authRateLimitMaxRequestsRaw) && authRateLimitMaxRequestsRaw >= 1
-                ? Math.floor(authRateLimitMaxRequestsRaw)
-                : 10,
-            authRateLimitWindowMs: Number.isFinite(authRateLimitWindowMsRaw) && authRateLimitWindowMsRaw >= 1000
-                ? Math.floor(authRateLimitWindowMsRaw)
-                : 15 * 60_000,
-            onboardingPolicyMode: onboardingPolicy.mode,
-            onboardingPlanVersionId: onboardingPolicy.planVersionId
-        };
-    };
-    const getSiteBehavior = () => {
-        const globalSettings = core.getGlobalSettings();
-        const siteSettings = globalSettings.site || {};
-        return {
-            showRunTaskforceLocally: resolveBooleanSetting(siteSettings.showRunTaskforceLocally, true),
-            pricingPageEnabled: resolveBooleanSetting(siteSettings.pricingPageEnabled, true)
-        };
-    };
     const buildPasswordSessionCookieForUser = (req, authConfig, userIdRaw, options) => {
         const userId = String(userIdRaw || '').trim();
         const fallbackRole = String(options?.fallbackRole || authConfig.defaultRole || 'member').trim() || 'member';
@@ -308,13 +259,13 @@ export function registerAuthRoutes(deps) {
             ? 'Verify your Taskforce account'
             : 'Reset your Taskforce password';
         const text = kind === 'verify-email'
-            ? `Welcome to Taskforce.\n\nVerify your email by opening this link:\n${link}\n\nIf you did not create an account, you can ignore this message.`
+            ? `Welcome to Taskforce.\n\nYou're almost in. Enter this verification token on the verification screen to activate your account:\n\n${token}\n\nPrefer the faster route? Open the link below to verify your email automatically:\n${link}\n\nIf you didn't create a Taskforce account, you can safely ignore this email.`
             : `Reset your Taskforce password using this link:\n${link}\n\nIf you did not request this reset, you can ignore this message.`;
         const result = await sendEmail({
             to: email,
             subject,
             text
-        }, getEmailConfig());
+        }, getRouteEmailConfig(core, context));
         if (result.ok) {
             console.info(`[Taskforce Auth Email] kind=${kind} provider=${result.provider} to=${email} messageId=${result.messageId || '-'}`);
         }
@@ -332,7 +283,7 @@ export function registerAuthRoutes(deps) {
             to: email,
             subject,
             text
-        }, getEmailConfig());
+        }, getRouteEmailConfig(core, context));
         if (result.ok) {
             console.info(`[Taskforce Auth Email] kind=invite provider=${result.provider} to=${email} messageId=${result.messageId || '-'}`);
         }
@@ -368,7 +319,7 @@ export function registerAuthRoutes(deps) {
         }));
     });
     addRoute('GET', '/api/taskforce/public/site-config', async (_req, res) => {
-        const siteBehavior = getSiteBehavior();
+        const siteBehavior = buildSiteBehavior(core);
         res.writeHead(200, {
             'Content-Type': 'application/json',
             'Cross-Origin-Resource-Policy': 'cross-origin'
@@ -379,7 +330,7 @@ export function registerAuthRoutes(deps) {
         }));
     });
     addRoute('GET', '/api/taskforce/public/site-config-script', async (_req, res) => {
-        const siteBehavior = getSiteBehavior();
+        const siteBehavior = buildSiteBehavior(core);
         const payload = JSON.stringify(siteBehavior).replace(/</g, '\\u003c');
         res.writeHead(200, {
             'Content-Type': 'application/javascript; charset=utf-8',
@@ -401,7 +352,8 @@ export function registerAuthRoutes(deps) {
         let avatarUrl = null;
         let betaAccess = true;
         if (authenticated && access?.userId) {
-            await cleanupStaleAvatarDrafts(access.userId);
+            // Keep the session endpoint fast on reload; avatar draft cleanup is best-effort housekeeping.
+            void cleanupStaleAvatarDrafts(access.userId).catch(() => { });
             betaAccess = core.getUserBetaAccess(access.userId);
             const resolved = core.resolveUserAccess(access.userId, workspaceId, role);
             if (resolved) {
@@ -704,7 +656,7 @@ export function registerAuthRoutes(deps) {
         const workspaceId = workspaceIdCandidate || 'default';
         // Password flow (preferred)
         if (email && password) {
-            const authBehavior = getAuthBehavior();
+            const authBehavior = buildAuthFlowBehavior(core);
             let authResult = core.authenticatePasswordUserDetailed({
                 email,
                 password,
@@ -801,7 +753,7 @@ export function registerAuthRoutes(deps) {
         const selectedPlanVersionId = typeof body?.planVersionId === 'string'
             ? body.planVersionId.trim()
             : '';
-        const authBehavior = getAuthBehavior();
+        const authBehavior = buildAuthFlowBehavior(core);
         if (!authBehavior.allowSelfRegistration) {
             res.writeHead(403, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ success: false, error: 'Self-registration is currently disabled.' }));
@@ -870,6 +822,43 @@ export function registerAuthRoutes(deps) {
             }));
         }
         catch (error) {
+            if (error?.code === 'EMAIL_ALREADY_EXISTS'
+                && authBehavior.requireVerifiedEmail
+                && email
+                && !core.isEmailVerified(email)) {
+                let emailSent = false;
+                let deliveryAttempted = false;
+                let emailError;
+                let verificationToken;
+                const verification = core.requestEmailVerification({ email });
+                verificationToken = verification.token || null;
+                if (verification.token) {
+                    deliveryAttempted = true;
+                    const delivery = await deliverAuthEmail('verify-email', email, verification.token, req);
+                    emailSent = delivery.ok;
+                    emailError = delivery.error;
+                }
+                auditAuthAction(req, 'auth-register-existing-unverified', {
+                    email,
+                    workspaceId: workspaceIdInput || null,
+                    code: 'EMAIL_ALREADY_EXISTS_UNVERIFIED',
+                    emailSent
+                });
+                res.writeHead(409, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({
+                    success: false,
+                    error: 'This email already has an unverified account. Continue with email verification instead.',
+                    code: 'EMAIL_ALREADY_EXISTS_UNVERIFIED',
+                    verificationRequired: true,
+                    emailSent,
+                    deliveryAttempted,
+                    emailError,
+                    verificationToken: shouldExposeDevAuthTokens()
+                        ? (verificationToken || null)
+                        : undefined
+                }));
+                return;
+            }
             const statusCode = Number(error?.statusCode || 400);
             const message = String(error?.message || 'Unable to register');
             auditAuthAction(req, 'auth-register-failed', {
@@ -895,10 +884,12 @@ export function registerAuthRoutes(deps) {
             return;
         }
         try {
-            let emailSent = true;
+            let emailSent = false;
+            let deliveryAttempted = false;
             let emailError;
             const verification = core.requestEmailVerification({ email });
             if (verification.token) {
+                deliveryAttempted = true;
                 const delivery = await deliverAuthEmail('verify-email', email, verification.token, req);
                 emailSent = delivery.ok;
                 emailError = delivery.error;
@@ -911,6 +902,7 @@ export function registerAuthRoutes(deps) {
             res.end(JSON.stringify({
                 success: true,
                 emailSent,
+                deliveryAttempted,
                 emailError,
                 verificationToken: shouldExposeDevAuthTokens() ? (verification.token || null) : undefined
             }));
@@ -983,10 +975,12 @@ export function registerAuthRoutes(deps) {
             return;
         }
         try {
-            let emailSent = true;
+            let emailSent = false;
+            let deliveryAttempted = false;
             let emailError;
             const reset = core.requestPasswordReset({ email });
             if (reset.token) {
+                deliveryAttempted = true;
                 const delivery = await deliverAuthEmail('password-reset', email, reset.token, req);
                 emailSent = delivery.ok;
                 emailError = delivery.error;
@@ -999,6 +993,7 @@ export function registerAuthRoutes(deps) {
             res.end(JSON.stringify({
                 success: true,
                 emailSent,
+                deliveryAttempted,
                 emailError,
                 resetToken: shouldExposeDevAuthTokens() ? (reset.token || null) : undefined
             }));
@@ -1354,7 +1349,7 @@ export function registerAuthRoutes(deps) {
                 seatUsage,
                 upgradeHints: canInvite
                     ? []
-                    : ['Team management requires a TEAM plan in active/trialing/grace state.'],
+                    : ['Team management requires an active plan with collaboration access.'],
                 supportLink: 'mailto:support@taskforcehq.ai'
             }));
         }

package/dist/server/routes/authSupport.d.ts

@@ -0,0 +1,30 @@
+import type { IncomingMessage } from 'http';
+import type { TaskforceCore } from '../../core/Taskforce.js';
+import type { RouteContext } from './primitives.js';
+export declare function resolveBooleanSetting(value: unknown, fallback: boolean): boolean;
+export declare function getRouteEmailConfig(core: TaskforceCore, context: RouteContext): import("../email.js").TaskforceEmailConfig;
+export declare function buildAuthFlowBehavior(core: TaskforceCore): {
+    allowSelfRegistration: boolean;
+    requireVerifiedEmail: boolean;
+    defaultNewUserBetaAccess: boolean;
+    authRateLimitEnabled: boolean;
+    authRateLimitMaxRequests: number;
+    authRateLimitWindowMs: number;
+};
+export declare function buildAuthBehavior(core: TaskforceCore): {
+    onboardingPolicyMode: import("../../core/types.js").OnboardingPolicyMode;
+    onboardingPlanVersionId: string | null;
+    allowSelfRegistration: boolean;
+    requireVerifiedEmail: boolean;
+    defaultNewUserBetaAccess: boolean;
+    authRateLimitEnabled: boolean;
+    authRateLimitMaxRequests: number;
+    authRateLimitWindowMs: number;
+};
+export declare function buildSiteBehavior(core: TaskforceCore): {
+    showRunTaskforceLocally: boolean;
+    pricingPageEnabled: boolean;
+};
+export declare function shouldExposeDevAuthTokens(): boolean;
+export declare function resolveRuntimeConfigBaseUrl(req: IncomingMessage): string;
+export declare function resolvePublicAuthBaseUrl(req: IncomingMessage): string;