@taskforcehq/taskforce 0.3.303 → 0.3.305

package/dist/server/routes/primitives.d.ts

@@ -0,0 +1,11 @@
+import { IncomingMessage, ServerResponse } from 'http';
+import type { TaskforceAuthConfig } from '../auth.js';
+import type { ResolvedObjectStorageConfig } from '../../storage/objectStorage.js';
+export type RouteHandler = (req: IncomingMessage, res: ServerResponse, params: Record<string, string>) => Promise<void>;
+export interface RouteContext {
+    authConfig?: TaskforceAuthConfig;
+    objectStorage?: ResolvedObjectStorageConfig;
+}
+export declare function parseJsonBody(req: IncomingMessage, maxBytes?: number): Promise<any>;
+export declare function parseFormBody(req: IncomingMessage, maxBytes?: number): Promise<Record<string, string>>;
+export declare function escapeHtml(value: unknown): string;

package/dist/server/routes/primitives.js

@@ -0,0 +1,73 @@
+const DEFAULT_MAX_JSON_BODY_BYTES = 1024 * 1024; // 1MB
+function createHttpError(message, statusCode) {
+    const error = new Error(message);
+    error.statusCode = statusCode;
+    return error;
+}
+export async function parseJsonBody(req, maxBytes = DEFAULT_MAX_JSON_BODY_BYTES) {
+    const safeMaxBytes = Number.isFinite(maxBytes) && maxBytes > 0
+        ? Math.floor(maxBytes)
+        : DEFAULT_MAX_JSON_BODY_BYTES;
+    return new Promise((resolve, reject) => {
+        let body = '';
+        let receivedBytes = 0;
+        req.on('data', chunk => {
+            receivedBytes += chunk.length;
+            if (receivedBytes > safeMaxBytes) {
+                req.pause();
+                reject(createHttpError(`Payload too large (max ${safeMaxBytes} bytes)`, 413));
+                return;
+            }
+            body += chunk;
+        });
+        req.on('end', () => {
+            try {
+                resolve(body ? JSON.parse(body) : {});
+            }
+            catch {
+                reject(createHttpError('Invalid JSON', 400));
+            }
+        });
+        req.on('error', reject);
+    });
+}
+export async function parseFormBody(req, maxBytes = DEFAULT_MAX_JSON_BODY_BYTES) {
+    const safeMaxBytes = Number.isFinite(maxBytes) && maxBytes > 0
+        ? Math.floor(maxBytes)
+        : DEFAULT_MAX_JSON_BODY_BYTES;
+    return new Promise((resolve, reject) => {
+        let body = '';
+        let receivedBytes = 0;
+        req.on('data', chunk => {
+            receivedBytes += chunk.length;
+            if (receivedBytes > safeMaxBytes) {
+                req.pause();
+                reject(createHttpError(`Payload too large (max ${safeMaxBytes} bytes)`, 413));
+                return;
+            }
+            body += chunk;
+        });
+        req.on('end', () => {
+            try {
+                const params = new URLSearchParams(body);
+                const parsed = {};
+                params.forEach((value, key) => {
+                    parsed[String(key)] = String(value);
+                });
+                resolve(parsed);
+            }
+            catch {
+                reject(createHttpError('Invalid form body', 400));
+            }
+        });
+        req.on('error', reject);
+    });
+}
+export function escapeHtml(value) {
+    return String(value || '')
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}

package/dist/server/routes/resources.d.ts

@@ -17,7 +17,7 @@
  *   GET  /api/taskforce/environments
  */
 import type { TaskforceCore } from '../../core/Taskforce.js';
-import { type RouteHandler } from '../routes.js';
+import { type RouteHandler } from './primitives.js';
 export interface ResourceRouteDependencies {
     addRoute: (method: string, path: string, handler: RouteHandler) => void;
     core: TaskforceCore;

package/dist/server/routes/resources.js

@@ -19,7 +19,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { execFileSync } from 'child_process';
-import { parseJsonBody } from '../routes.js';
+import { parseJsonBody } from './primitives.js';
 const WORKFLOW_EDITOR_LOCKED_FIELDS = {
     do: ['aliasesText', 'dispatchDefault', 'criticalToolsText', 'contentDefault'],
     execute: ['aliasesText', 'dispatchDefault', 'criticalToolsText', 'contentDefault']

package/dist/server/routes/shared.d.ts

@@ -7,8 +7,38 @@
  */
 import { IncomingMessage, ServerResponse } from 'http';
 import { TaskforceCore } from '../../core/Taskforce.js';
-import type { RouteContext } from '../routes.js';
+import type { McpAccessTokenAuthResult, McpOAuthAccessTokenAuthResult, McpAccessTokenScope } from '../../core/Taskforce.js';
+import type { RouteContext } from './primitives.js';
+import type { AiProfileBootstrapConfig } from '../../mcp/aiProfileBootstrap.js';
 export declare function resolveErrorStatusCode(error: unknown, fallback?: number): number;
+export declare function buildCloudMcpRuntimeAuth(input: {
+    req: IncomingMessage;
+    auth: {
+        authenticatedViaToken: McpAccessTokenAuthResult | null;
+        authenticatedViaOAuth: McpOAuthAccessTokenAuthResult | null;
+        userId: string | null;
+    } & Required<AiProfileBootstrapConfig>;
+    requestHeader: (req: IncomingMessage, name: string, fallback?: string) => string;
+    requestId?: string | null;
+    authScopes?: McpAccessTokenScope[] | null;
+}): {
+    scopes?: McpAccessTokenScope[] | null;
+    userId?: string | null;
+    tokenId?: string | null;
+    aiProfileToken?: AiProfileBootstrapConfig['aiProfileToken'];
+    aiProfileName?: AiProfileBootstrapConfig['aiProfileName'];
+    aiProfileIcon?: AiProfileBootstrapConfig['aiProfileIcon'];
+    aiProfileColor?: AiProfileBootstrapConfig['aiProfileColor'];
+    aiProfileDescription?: AiProfileBootstrapConfig['aiProfileDescription'];
+    aiProfileRole?: AiProfileBootstrapConfig['aiProfileRole'];
+    aiProfileProvider?: AiProfileBootstrapConfig['aiProfileProvider'];
+    aiProfileModel?: AiProfileBootstrapConfig['aiProfileModel'];
+    aiProfileSurfaceType?: AiProfileBootstrapConfig['aiProfileSurfaceType'];
+    actorType?: 'local' | 'user' | 'token' | 'oauth';
+    requestId?: string | null;
+    ip?: string | null;
+    userAgent?: string | null;
+};
 export declare function requestHeader(req: IncomingMessage, name: string, fallback?: string): string;
 export declare function requestWorkspaceHeader(req: IncomingMessage): string;
 export declare function requestAuthoritativeWorkspaceId(req: IncomingMessage): string;

package/dist/server/routes/shared.js

@@ -17,6 +17,32 @@ export function resolveErrorStatusCode(error, fallback = 400) {
     }
     return fallback;
 }
+export function buildCloudMcpRuntimeAuth(input) {
+    const { req, auth, requestHeader, requestId, authScopes } = input;
+    const actorType = auth.authenticatedViaToken
+        ? 'token'
+        : auth.authenticatedViaOAuth
+            ? 'oauth'
+            : 'user';
+    return {
+        scopes: authScopes || auth.authenticatedViaToken?.scopes || auth.authenticatedViaOAuth?.scopes || [],
+        userId: auth.authenticatedViaToken?.userId || auth.authenticatedViaOAuth?.userId || auth.userId || null,
+        tokenId: auth.authenticatedViaToken?.tokenId || auth.authenticatedViaOAuth?.grantId || null,
+        aiProfileToken: auth.aiProfileToken,
+        aiProfileName: auth.aiProfileName,
+        aiProfileIcon: auth.aiProfileIcon,
+        aiProfileColor: auth.aiProfileColor,
+        aiProfileDescription: auth.aiProfileDescription,
+        aiProfileRole: auth.aiProfileRole,
+        aiProfileProvider: auth.aiProfileProvider,
+        aiProfileModel: auth.aiProfileModel,
+        aiProfileSurfaceType: auth.aiProfileSurfaceType,
+        actorType,
+        requestId: String(requestId || req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || undefined,
+        ip: req.socket?.remoteAddress || null,
+        userAgent: requestHeader(req, 'user-agent', '') || null,
+    };
+}
 // === SECTION: Request header helpers ===
 export function requestHeader(req, name, fallback = '') {
     const value = req.headers?.[name.toLowerCase()];

package/dist/server/routes/sync.d.ts

@@ -1,6 +1,6 @@
 import { IncomingMessage } from 'http';
 import { TaskforceCore, TaskforceSyncCapable } from '../../core/Taskforce.js';
-import { RouteHandler, RouteContext } from '../routes.js';
+import { type RouteContext, type RouteHandler } from './primitives.js';
 import { resolveRequestAccess, createSessionTokenCookie } from '../auth.js';
 import { isReservedWorkspaceId } from '../../utils/workspaceIdentity.js';
 export interface SyncRouteDependencies {

package/dist/server/routes/sync.integration.test.js

@@ -344,6 +344,10 @@ describe('Server Routes Workspace Sync Integration', () => {
                         username: 'codex',
                         icon: 'Bot',
                         color: '#0ea5e9',
+                        description: 'Terminal-first coding agent',
+                        role: 'Implementer',
+                        provider: 'OpenAI',
+                        model: 'gpt-5.4',
                         surfaceType: 'coding_tool',
                         createdAt: '2026-03-22T10:00:00.000Z',
                         updatedAt: '2026-03-22T10:05:00.000Z',
@@ -361,6 +365,10 @@ describe('Server Routes Workspace Sync Integration', () => {
                 id: 'ai-profile-codex',
                 name: 'Codex',
                 username: 'codex',
+                description: 'Terminal-first coding agent',
+                role: 'Implementer',
+                provider: 'OpenAI',
+                model: 'gpt-5.4',
                 surfaceType: 'coding_tool'
             })
         ]);
@@ -1757,6 +1765,18 @@ describe('Server Routes Workspace Sync Integration', () => {
         const pushRes = createMockRes();
         await pushMatch?.handler(pushReq, pushRes, {});
         expect(pushRes.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
+        const pushBody = readJsonBody(pushRes);
+        expect(Array.isArray(pushBody?.appliedTaskUpserts)).toBe(true);
+        expect(pushBody?.appliedTaskUpserts).toEqual(expect.arrayContaining([
+            expect.objectContaining({
+                archived: false,
+                task: expect.objectContaining({
+                    id: taskId,
+                    title: 'Offline provisional task',
+                    referenceNumber: 1
+                })
+            })
+        ]));
         const persisted = core.getTask(taskId, workspaceId);
         expect(persisted?.referenceNumber).toBe(1);
         expect(Date.parse(String(persisted?.updatedAt || ''))).toBeGreaterThan(Date.parse(staleUpdatedAt));