@taskforcehq/taskforce 0.3.303 → 0.3.305

package/dist/server/routes/sync.js

@@ -1,19 +1,18 @@
 import * as path from 'path';
-import { parseJsonBody } from '../routes.js';
+import { parseJsonBody } from './primitives.js';
 import { normalizeTaskDataRelativePath, ObjectStorageClient } from '../../storage/objectStorageClient.js';
 import { WorkspaceAssetStore, } from '../../storage/workspaceAssetStore.js';
 import { resolveSessionCookieAttributesForRequest } from '../auth.js';
 import { decryptDocument, ENCRYPTION_PREFIX } from '../../sync/encryptionService.js';
 import { isAiProfileSurfaceType } from '../../shared/aiProfileSurfaceType.js';
-import { getTaskMutationTieBreak, getTaskMutationWatermark } from '../../sync/workspaceSyncSurface.js';
-import { normalizeTaskSyncPayload, taskSyncPayloadToCoreTask } from '../../sync/taskSyncPayload.js';
-import { normalizeBinaryAssetDeleteSyncPayload, normalizeBinaryAssetSyncPayload, normalizeDocumentDeleteSyncPayload, normalizeDocumentSyncPayload, serializeBinaryAssetSyncPayload, serializeDocumentSyncPayload } from '../../sync/contentSyncPayload.js';
+import { serializeTaskForSync, } from '../../sync/taskSyncPayload.js';
+import { serializeBinaryAssetSyncPayload, serializeDocumentSyncPayload, } from '../../sync/contentSyncPayload.js';
 import { createContentSyncState } from '../../sync/contentSyncState.js';
-import { normalizeAiProfileSyncPayload, normalizeAnnotatedAttachmentSessionSyncPayload, normalizeDeleteSyncPayload, normalizeDocumentReviewCommentSyncPayload, normalizeDocumentReviewSessionSyncPayload, } from '../../sync/collaborationSyncPayload.js';
+import { normalizeAiProfileSyncPayload, normalizeAnnotatedAttachmentSessionSyncPayload, normalizeDocumentReviewCommentSyncPayload, normalizeDocumentReviewSessionSyncPayload, } from '../../sync/collaborationSyncPayload.js';
 import { createCollaborationSyncState } from '../../sync/collaborationSyncState.js';
 import { buildWorkspacePullFeed } from '../../sync/workspacePullFeed.js';
 import { normalizeInitiativeSyncPayload, normalizeTaxonomySyncPayload, normalizeWorkstreamSyncPayload, } from '../../sync/planningSyncPayload.js';
-import { applyAiProfileAndMemberSyncChanges, applyCollaborationSyncChanges, applyContentSyncChanges, applyPlanningSyncChanges, resolveSyncConflictOrdering, } from '../../sync/syncApplyHandlers.js';
+import { applyAiProfileAndMemberSyncChanges, applyCollaborationSyncChanges, applyContentSyncChanges, applyPlanningSyncChanges, applyPreparedTaskSyncSnapshot, applyTaskActivitySyncChanges, applyTaskSyncDeletes, classifyWorkspaceSyncChanges, prepareTaskSyncSnapshotApply, } from '../../sync/syncApplyHandlers.js';
 import { applyWorkspaceRepair } from '../../sync/workspaceRepair.js';
 function decodeWorkspaceSyncCursor(raw) {
     const value = String(raw || '').trim();
@@ -60,6 +59,40 @@ function normalizeIncomingAiProfileSurfaceType(value, context) {
     }
     return normalized;
 }
+function normalizeTaskEventSyncPayload(raw, workspaceId, sourceWatermark) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return null;
+    const source = raw;
+    const id = String(source.id || '').trim();
+    const taskId = String(source.taskId || source.task_id || '').trim();
+    const action = String(source.action || '').trim();
+    const actor = String(source.actor || 'system').trim() || 'system';
+    const createdAt = String(source.createdAt || source.created_at || sourceWatermark || '').trim();
+    if (!id || !taskId || !action || !Number.isFinite(Date.parse(createdAt)))
+        return null;
+    const actorType = source.actorType === 'ai' || source.actorType === 'human' || source.actorType === 'system'
+        ? source.actorType
+        : source.actor_type === 'ai' || source.actor_type === 'human' || source.actor_type === 'system'
+            ? source.actor_type
+            : actor.startsWith('ai-profile-')
+                ? 'ai'
+                : actor === 'system'
+                    ? 'system'
+                    : 'human';
+    const details = source.details && typeof source.details === 'object' && !Array.isArray(source.details)
+        ? source.details
+        : {};
+    return {
+        id,
+        taskId,
+        workspaceId,
+        action,
+        actor,
+        actorType,
+        details,
+        createdAt
+    };
+}
 export function registerSyncRoutes(deps) {
     const { addRoute, core, context, auditAuthAction, resolveErrorStatusCode, requestWorkspaceId, resolveRequestAccess, isReservedWorkspaceId, createSessionTokenCookie } = deps;
     const readPushIdempotency = (workspaceId, key) => {
@@ -190,32 +223,7 @@ export function registerSyncRoutes(deps) {
         workspaceDocumentSnapshotCache,
     });
     const collaborationSyncState = createCollaborationSyncState({ core });
-    const hasTaskReferenceNumberDrift = (workspaceId, task) => {
-        const taskId = String(task?.id || '').trim();
-        const incomingReferenceNumber = Number.isFinite(Number(task?.referenceNumber))
-            ? Math.max(1, Math.floor(Number(task?.referenceNumber)))
-            : null;
-        if (!incomingReferenceNumber)
-            return false;
-        const existingTask = core.resolveTaskIdentifier(`T-${incomingReferenceNumber}`, workspaceId);
-        if (!existingTask || existingTask.id === taskId)
-            return false;
-        recordSyncDiagnostic(workspaceId, 'apply', 'Detected task reference number mismatch during normal sync.', {
-            source: 'tasks.referenceNumber.mismatch',
-            taskId: taskId || null,
-            taskTitle: typeof task?.title === 'string' ? task.title.trim() || null : null,
-            existingTaskId: existingTask.id,
-            existingTaskTitle: existingTask.title || null,
-            referenceLabel: `T-${incomingReferenceNumber}`,
-            existingReferenceNumber: existingTask.referenceNumber ?? incomingReferenceNumber,
-            incomingReferenceNumber
-        });
-        return true;
-    };
     const dispatchWorkspaceSyncChanges = async (workspaceId, incomingChanges, options) => {
-        const tasks = [];
-        const archived = [];
-        const incomingTaskDeletes = new Map();
         const emittedEventIds = new Set();
         const unsubscribeRealtime = core.onRealtimeMutation((event) => {
             const eventWorkspaceId = String(event?.workspaceId || '').trim();
@@ -225,224 +233,63 @@ export function registerSyncRoutes(deps) {
             if (eventId)
                 emittedEventIds.add(eventId);
         });
-        let incomingTaxonomies = null;
-        let incomingTaxonomyState = null;
-        let incomingTaxonomiesUpdatedAt = '';
-        const incomingInitiatives = new Map();
-        const incomingWorkstreams = new Map();
-        const incomingAiProfiles = new Map();
-        const incomingDocuments = [];
-        const incomingDocumentDeletes = new Map();
-        const incomingDocumentReviewSessions = new Map();
-        const incomingDocumentReviewSessionDeletes = new Map();
-        const incomingDocumentReviewComments = new Map();
-        const incomingDocumentReviewCommentDeletes = new Map();
-        const incomingAnnotatedAttachmentSessions = new Map();
-        const incomingAnnotatedAttachmentSessionDeletes = new Map();
-        const incomingAssets = [];
-        const incomingAssetDeletes = new Map();
         try {
-            for (const change of incomingChanges) {
-                const raw = change;
-                const op = String(raw.op || '').trim().toLowerCase();
-                if (op === 'taxonomy-upsert') {
-                    const taxonomy = normalizeTaxonomySyncPayload(raw);
-                    if (taxonomy?.taxonomyState)
-                        incomingTaxonomyState = taxonomy.taxonomyState;
-                    if (Array.isArray(taxonomy?.taxonomies))
-                        incomingTaxonomies = taxonomy.taxonomies;
-                    if (taxonomy?.updatedAt)
-                        incomingTaxonomiesUpdatedAt = taxonomy.updatedAt;
-                    continue;
-                }
-                if (op === 'initiative-upsert') {
-                    const initiative = normalizeInitiativeSyncPayload(raw.initiative, String(raw.updatedAt || raw.watermark || '').trim());
-                    if (initiative)
-                        incomingInitiatives.set(initiative.id, initiative);
-                    continue;
-                }
-                if (op === 'workstream-upsert') {
-                    const workstream = normalizeWorkstreamSyncPayload(raw.workstream, String(raw.updatedAt || raw.watermark || '').trim());
-                    if (workstream)
-                        incomingWorkstreams.set(workstream.id, workstream);
-                    continue;
-                }
-                if (op === 'ai-profile-upsert') {
-                    const profile = normalizeAiProfileSyncPayload(raw.profile, workspaceId, normalizeIncomingAiProfileSurfaceType, 'apply.aiProfileUpsert');
-                    const profileId = String(profile?.id || '').trim();
-                    if (profileId && profile) {
-                        const profileWorkspaceId = String(profile.workspaceId || '').trim();
-                        if (profileWorkspaceId && profileWorkspaceId !== workspaceId) {
-                            recordSyncDiagnostic(workspaceId, 'apply', `Rejected ai-profile-upsert for profile ${profileId}: workspace mismatch (expected ${workspaceId}, got ${profileWorkspaceId}).`, {
-                                source: 'apply.aiProfileWorkspaceMismatch',
-                                workspaceId,
-                                profileId,
-                                expectedWorkspaceId: workspaceId,
-                                receivedWorkspaceId: profileWorkspaceId
-                            });
-                            continue;
-                        }
-                        incomingAiProfiles.set(profileId, {
-                            ...profile,
-                            workspaceId,
-                            createdAt: profile.createdAt || String(raw.updatedAt || raw.watermark || '').trim(),
-                            updatedAt: profile.updatedAt || String(raw.updatedAt || raw.watermark || '').trim(),
-                        });
-                    }
-                    continue;
-                }
-                if (op === 'document-upsert') {
-                    const document = normalizeDocumentSyncPayload(raw, normalizeWorkspaceSyncDocumentPath);
-                    if (document)
-                        incomingDocuments.push(document);
-                    continue;
-                }
-                if (op === 'document-delete') {
-                    const deletedDocument = normalizeDocumentDeleteSyncPayload(raw, normalizeWorkspaceSyncDocumentPath);
-                    if (deletedDocument)
-                        incomingDocumentDeletes.set(deletedDocument.path, deletedDocument.deletedAt);
-                    continue;
-                }
-                if (op === 'asset-upsert') {
-                    const asset = normalizeBinaryAssetSyncPayload(raw, (rawPath) => normalizeTaskDataRelativePath(String(rawPath || '').trim()));
-                    if (asset)
-                        incomingAssets.push(asset);
-                    continue;
-                }
-                if (op === 'asset-delete') {
-                    const deletedAsset = normalizeBinaryAssetDeleteSyncPayload(raw, (rawPath) => normalizeTaskDataRelativePath(String(rawPath || '').trim()));
-                    if (deletedAsset)
-                        incomingAssetDeletes.set(deletedAsset.path, deletedAsset.deletedAt);
-                    continue;
-                }
-                if (op === 'document-review-session-upsert') {
-                    const session = normalizeDocumentReviewSessionSyncPayload(raw.session, String(raw.updatedAt || raw.watermark || '').trim());
-                    if (session)
-                        incomingDocumentReviewSessions.set(session.id, session);
-                    continue;
-                }
-                if (op === 'document-review-session-delete') {
-                    const deletedSession = normalizeDeleteSyncPayload(raw, 'sessionId');
-                    if (deletedSession)
-                        incomingDocumentReviewSessionDeletes.set(deletedSession.id, deletedSession.deletedAt);
-                    continue;
-                }
-                if (op === 'document-review-comment-upsert') {
-                    const comment = normalizeDocumentReviewCommentSyncPayload(raw.comment, { sourceWatermark: String(raw.updatedAt || raw.watermark || '').trim() });
-                    if (comment)
-                        incomingDocumentReviewComments.set(comment.id, comment);
-                    continue;
-                }
-                if (op === 'document-review-comment-delete') {
-                    const deletedComment = normalizeDeleteSyncPayload(raw, 'commentId');
-                    if (deletedComment)
-                        incomingDocumentReviewCommentDeletes.set(deletedComment.id, deletedComment.deletedAt);
-                    continue;
-                }
-                if (op === 'annotated-attachment-session-upsert') {
-                    const session = normalizeAnnotatedAttachmentSessionSyncPayload(raw.session, workspaceId, String(raw.updatedAt || raw.watermark || '').trim());
-                    if (session)
-                        incomingAnnotatedAttachmentSessions.set(session.id, session);
-                    continue;
-                }
-                if (op === 'annotated-attachment-session-delete') {
-                    const deletedSession = normalizeDeleteSyncPayload(raw, 'sessionId');
-                    if (deletedSession)
-                        incomingAnnotatedAttachmentSessionDeletes.set(deletedSession.id, deletedSession.deletedAt);
-                    continue;
-                }
-                if (op !== 'delete')
-                    continue;
-                const task = normalizeTaskSyncPayload(raw.task);
-                const deleteTaskId = String(raw.taskId || raw.id || task?.id || '').trim();
-                if (deleteTaskId) {
-                    incomingTaskDeletes.set(deleteTaskId, String(raw.deletedAt || raw.watermark || new Date().toISOString()).trim());
-                }
-            }
-            for (const change of incomingChanges) {
-                const raw = change;
-                const op = String(raw.op || '').trim().toLowerCase();
-                if (op === 'delete'
-                    || op === 'initiative-upsert'
-                    || op === 'workstream-upsert'
-                    || op === 'document-upsert'
-                    || op === 'document-delete'
-                    || op === 'asset-upsert'
-                    || op === 'asset-delete'
-                    || op === 'document-review-session-upsert'
-                    || op === 'document-review-session-delete'
-                    || op === 'document-review-comment-upsert'
-                    || op === 'document-review-comment-delete'
-                    || op === 'annotated-attachment-session-upsert'
-                    || op === 'annotated-attachment-session-delete')
-                    continue;
-                const task = normalizeTaskSyncPayload(raw.task);
-                if (!task)
-                    continue;
-                const taskId = String(task.id || '').trim();
-                hasTaskReferenceNumberDrift(workspaceId, task);
-                const deleteWatermark = taskId ? String(incomingTaskDeletes.get(taskId) || '').trim() : '';
-                if (taskId && deleteWatermark) {
-                    const compareAgainstDelete = resolveSyncConflictOrdering(deleteWatermark, String(task.updatedAt || task.createdAt || '').trim(), `delete:${taskId}`, getTaskMutationTieBreak(task, raw.archived === true || task?.isArchived === true));
-                    if (compareAgainstDelete >= 0)
-                        continue;
-                }
-                const markedArchived = raw.archived === true || task?.isArchived === true;
-                if (markedArchived)
-                    archived.push(task);
-                else
-                    tasks.push(task);
-            }
-            for (const [taskId, deleteWatermark] of incomingTaskDeletes.entries()) {
-                try {
-                    const existingTask = core.getTask(taskId, workspaceId);
-                    if (existingTask) {
-                        const compareAgainstExisting = resolveSyncConflictOrdering(deleteWatermark, getTaskMutationWatermark(existingTask), `delete:${taskId}`, getTaskMutationTieBreak(existingTask, Boolean(existingTask.isArchived)));
-                        if (compareAgainstExisting < 0)
-                            continue;
-                    }
-                    core.deleteTaskForSync(taskId, workspaceId, { persistBackup: false });
-                }
-                catch (error) {
-                    recordSyncDiagnostic(workspaceId, 'apply', 'Failed to delete task during sync apply.', {
-                        source: 'apply.deleteTask',
-                        taskId,
-                        error: String(error?.message || error || '')
-                    });
-                }
-            }
+            const applyModel = classifyWorkspaceSyncChanges({
+                workspaceId,
+                incomingChanges,
+                normalizeWorkspaceSyncDocumentPath,
+                normalizeTaskAssetPath: (rawPath) => normalizeTaskDataRelativePath(String(rawPath || '').trim()),
+                normalizeIncomingAiProfileSurfaceType,
+                normalizeTaskEventSyncPayload,
+                recordSyncDiagnostic,
+            });
             applyPlanningSyncChanges({
                 core,
                 workspaceId,
-                incomingInitiatives,
-                incomingWorkstreams,
-                incomingTaxonomies,
-                incomingTaxonomyState,
-                incomingTaxonomiesUpdatedAt,
+                incomingInitiatives: applyModel.planning.incomingInitiatives,
+                incomingWorkstreams: applyModel.planning.incomingWorkstreams,
+                incomingTaxonomies: applyModel.planning.incomingTaxonomies,
+                incomingTaxonomyState: applyModel.planning.incomingTaxonomyState,
+                incomingTaxonomiesUpdatedAt: applyModel.planning.incomingTaxonomiesUpdatedAt,
                 workspaceTaxonomySyncMeta,
                 recordSyncDiagnostic,
             });
             applyAiProfileAndMemberSyncChanges({
                 core,
                 workspaceId,
-                incomingAiProfiles,
+                incomingAiProfiles: applyModel.profiles.incomingAiProfiles,
                 workspaceMembers: options?.workspaceMembers,
                 recordSyncDiagnostic,
                 assertSyncedAiProfilesPersisted,
                 createSyncRouteError,
             });
-            validateTaskActorAssignments(workspaceId, tasks, archived);
+            const preparedTaskSnapshot = prepareTaskSyncSnapshotApply({
+                core,
+                workspaceId,
+                taskMutations: applyModel.taskMutations,
+                recordSyncDiagnostic,
+            });
+            validateTaskActorAssignments(workspaceId, preparedTaskSnapshot.tasks, preparedTaskSnapshot.archived);
             await applyContentSyncChanges({
                 core,
                 workspaceId,
-                incomingDocuments,
-                incomingDocumentDeletes,
-                incomingAssets,
-                incomingAssetDeletes,
+                incomingDocuments: applyModel.content.incomingDocuments,
+                incomingDocumentDeletes: applyModel.content.incomingDocumentDeletes,
+                incomingAssets: applyModel.content.incomingAssets,
+                incomingAssetDeletes: applyModel.content.incomingAssetDeletes,
                 basePath: core.getPaths().basePath,
                 hasObjectStorageClient: () => Boolean(getObjectStorageClient()),
                 hasDocumentSyncMetadataDrift: contentSyncState.hasDocumentSyncMetadataDrift,
                 hasBinaryAssetSyncMetadataDrift: contentSyncState.hasBinaryAssetSyncMetadataDrift,
+                getExistingDocument: (docPath, targetWorkspaceId) => {
+                    const asset = workspaceAssetStore?.getByStorageKey(docPath, targetWorkspaceId) || null;
+                    return asset
+                        ? {
+                            updatedAt: asset.updatedAt,
+                            contentHash: asset.contentSha256
+                        }
+                        : null;
+                },
                 writeWorkspaceSyncDocument: contentSyncState.writeWorkspaceSyncDocument,
                 deleteWorkspaceSyncDocument: contentSyncState.deleteWorkspaceSyncDocument,
                 writeWorkspaceSyncBinaryAsset: contentSyncState.writeWorkspaceSyncBinaryAsset,
@@ -454,20 +301,34 @@ export function registerSyncRoutes(deps) {
             applyCollaborationSyncChanges({
                 core,
                 workspaceId,
-                incomingDocumentReviewSessions,
-                incomingDocumentReviewSessionDeletes,
-                incomingDocumentReviewComments,
-                incomingDocumentReviewCommentDeletes,
-                incomingAnnotatedAttachmentSessions,
-                incomingAnnotatedAttachmentSessionDeletes,
+                incomingDocumentReviewSessions: applyModel.collaboration.incomingDocumentReviewSessions,
+                incomingDocumentReviewSessionDeletes: applyModel.collaboration.incomingDocumentReviewSessionDeletes,
+                incomingDocumentReviewComments: applyModel.collaboration.incomingDocumentReviewComments,
+                incomingDocumentReviewCommentDeletes: applyModel.collaboration.incomingDocumentReviewCommentDeletes,
+                incomingAnnotatedAttachmentSessions: applyModel.collaboration.incomingAnnotatedAttachmentSessions,
+                incomingAnnotatedAttachmentSessionDeletes: applyModel.collaboration.incomingAnnotatedAttachmentSessionDeletes,
+                recordSyncDiagnostic,
+                createSyncRouteError,
+            });
+            const deleteCount = applyTaskSyncDeletes({
+                core,
+                workspaceId,
+                taskMutations: applyModel.taskMutations,
+                recordSyncDiagnostic,
+            });
+            const result = applyPreparedTaskSyncSnapshot({
+                core,
+                workspaceId,
+                prepared: preparedTaskSnapshot,
+            });
+            applyTaskActivitySyncChanges({
+                core,
+                workspaceId,
+                incomingTaskEvents: applyModel.taskActivity.incomingTaskEvents,
                 recordSyncDiagnostic,
                 createSyncRouteError,
             });
-            const result = core.applyWorkspaceSyncSnapshot({
-                tasks: tasks.map(taskSyncPayloadToCoreTask),
-                archived: archived.map(taskSyncPayloadToCoreTask)
-            }, workspaceId);
-            return { result, deleteCount: incomingTaskDeletes.size, emittedEventIds: Array.from(emittedEventIds) };
+            return { result, deleteCount, emittedEventIds: Array.from(emittedEventIds) };
         }
         finally {
             unsubscribeRealtime();
@@ -1257,6 +1118,10 @@ export function registerSyncRoutes(deps) {
             }
         }
         let incomingChanges = Array.isArray(body?.changes) ? body.changes : [];
+        const incomingTaskUpsertIds = incomingChanges
+            .filter((change) => change?.op === 'upsert')
+            .map((change) => String(change.task?.id || '').trim())
+            .filter((taskId) => taskId.length > 0);
         const allowReferenceNumberReassignment = body?.repair === true;
         // Decrypt asset and document content if TASKFORCE_SYNC_KEY is configured on this server.
         // The local runtime encrypts content before pushing; the cloud must decrypt before writing to storage.
@@ -1311,12 +1176,20 @@ export function registerSyncRoutes(deps) {
             const { result, deleteCount, emittedEventIds } = await dispatchWorkspaceSyncChanges(targetWorkspaceId, incomingChanges, {
                 allowReferenceNumberReassignment
             });
+            const appliedTaskUpserts = incomingTaskUpsertIds
+                .map((taskId) => core.getTask(taskId, targetWorkspaceId))
+                .filter((task) => Boolean(task))
+                .map((task) => ({
+                archived: Boolean(task.isArchived),
+                task: serializeTaskForSync(task)
+            }));
             const durationMs = Date.now() - startedAtMs;
             const payload = JSON.stringify({
                 success: true,
                 workspaceId: targetWorkspaceId,
                 idempotencyKey: idempotencyKey || null,
                 emittedEventIds,
+                appliedTaskUpserts,
                 result,
                 durationMs
             });

package/dist/server/routes/tasks.d.ts

@@ -52,7 +52,7 @@
 import { IncomingMessage, ServerResponse } from 'http';
 import { TaskforceCore } from '../../core/Taskforce.js';
 import { type ResolvedObjectStorageConfig } from '../../storage/objectStorage.js';
-import { type RouteHandler, type RouteContext } from '../routes.js';
+import { type RouteHandler, type RouteContext } from './primitives.js';
 export interface TaskRouteDependencies {
     addRoute: (method: string, path: string, handler: RouteHandler) => void;
     core: TaskforceCore;

package/dist/server/routes/tasks.js

@@ -54,11 +54,19 @@ import { toPublicObjectStorageConfig } from '../../storage/objectStorage.js';
 import { getRuntimeCapabilities } from '../../runtime/capabilities.js';
 import { resolveBuildInfo } from '../buildInfo.js';
 import { resolveRealtimeSyncFlag } from '../../sync/realtimeFeature.js';
-import { parseJsonBody } from '../routes.js';
+import { parseJsonBody } from './primitives.js';
+import { resolveRequestAccess } from '../auth.js';
 import { resolveErrorStatusCode, requestHeader, requestRuntimeMode } from './shared.js';
 import { listBuiltInCustomTaxonomyLibraryPacks } from '../../shared/customTaxonomyLibrary.js';
 import { listBuiltInTaxonomyLibraryPacks } from '../../shared/taxonomyLibrary.js';
 import { shouldUseProvisionalTaskReferences } from '../../utils/taskReferences.js';
+function createUiStateRequestId() {
+    return `ui-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+}
+function attachUiStateDebugHeaders(res, requestId) {
+    res.setHeader('x-taskforce-ui-state-route', 'tasks');
+    res.setHeader('x-taskforce-ui-state-request-id', requestId);
+}
 // === SECTION: Registration ===
 export function registerTaskRoutes(deps) {
     const { addRoute, core, context, requestWorkspaceId, ensureAppAccess, resolveEffectiveObjectStorageConfig, buildBatchSummary, CLOUD_SAFE_CONFIG_PATHS, } = deps;
@@ -155,16 +163,31 @@ export function registerTaskRoutes(deps) {
             || ((isLocalRuntime && allowCreate && !explicitWorkspaceId) ? '' : headerWorkspaceId)).trim() || 'default';
         try {
             const workspaceExists = Boolean(core.getWorkspaceProfile(incomingWorkspaceId));
+            const authConfig = context.authConfig;
+            const requestAccess = authConfig?.enabled
+                ? resolveRequestAccess(req, authConfig)
+                : null;
             const shouldCreateWorkspace = Boolean(name
                 && (incomingWorkspaceId === 'default' || !workspaceExists)
                 && (isLocalRuntime || allowCreate));
             const workspace = shouldCreateWorkspace
-                ? core.createWorkspace({
-                    workspaceId: incomingWorkspaceId === 'default' ? undefined : incomingWorkspaceId,
-                    name,
-                    description,
-                    slug
-                })
+                ? (!isLocalRuntime
+                    && requestAccess?.authenticated
+                    && requestAccess.userId
+                    && requestAccess.userId !== 'anonymous'
+                    ? core.createWorkspaceForUser({
+                        userId: requestAccess.userId,
+                        preferredWorkspaceId: incomingWorkspaceId === 'default' ? undefined : incomingWorkspaceId,
+                        name,
+                        description,
+                        role: 'owner'
+                    })
+                    : core.createWorkspace({
+                        workspaceId: incomingWorkspaceId === 'default' ? undefined : incomingWorkspaceId,
+                        name,
+                        description,
+                        slug
+                    }))
                 : core.updateWorkspaceProfile(incomingWorkspaceId, { name, description, slug });
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ success: true, workspace }));
@@ -179,6 +202,9 @@ export function registerTaskRoutes(deps) {
     addRoute('GET', '/api/taskforce/ui-state', async (req, res) => {
         if (!ensureAppAccess(req, res))
             return;
+        const requestId = createUiStateRequestId();
+        const startedAt = Date.now();
+        attachUiStateDebugHeaders(res, requestId);
         try {
             const url = new URL(req.url || '/', 'http://localhost');
             const requestedWorkspaceId = String(url.searchParams.get('workspaceId') || '').trim();
@@ -194,6 +220,12 @@ export function registerTaskRoutes(deps) {
         }
         catch (error) {
             const statusCode = resolveErrorStatusCode(error, 400);
+            console.warn('[Taskforce][ui-state] GET failed', {
+                requestId,
+                durationMs: Date.now() - startedAt,
+                error: String(error?.message || 'Failed to read UI state'),
+                path: req.url || '/api/taskforce/ui-state'
+            });
             res.writeHead(statusCode, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ success: false, error: String(error?.message || 'Failed to read UI state') }));
         }
@@ -202,6 +234,9 @@ export function registerTaskRoutes(deps) {
     addRoute('POST', '/api/taskforce/ui-state', async (req, res) => {
         if (!ensureAppAccess(req, res))
             return;
+        const requestId = createUiStateRequestId();
+        const startedAt = Date.now();
+        attachUiStateDebugHeaders(res, requestId);
         const body = await parseJsonBody(req);
         try {
             const requestedWorkspaceId = String(body?.workspaceId || '').trim();
@@ -222,6 +257,13 @@ export function registerTaskRoutes(deps) {
         }
         catch (error) {
             const statusCode = resolveErrorStatusCode(error, 400);
+            console.warn('[Taskforce][ui-state] POST failed', {
+                requestId,
+                durationMs: Date.now() - startedAt,
+                error: String(error?.message || 'Failed to merge UI state'),
+                path: req.url || '/api/taskforce/ui-state',
+                stateKey: String(body?.stateKey || body?.key || '').trim() || 'default'
+            });
             res.writeHead(statusCode, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ success: false, error: String(error?.message || 'Failed to merge UI state') }));
         }
@@ -398,7 +440,7 @@ export function registerTaskRoutes(deps) {
                 : body;
             const updated = core.updateTask(params.id, updates, workspaceId, {
                 actorRef: 'user',
-                skipTaskEvents: saveSource === 'autosave'
+                saveSource
             });
             if (!updated) {
                 res.writeHead(404, { 'Content-Type': 'application/json' });

package/dist/server/routes/workspaces.d.ts

@@ -13,7 +13,7 @@
  */
 import type { IncomingMessage, ServerResponse } from 'http';
 import type { TaskforceCore } from '../../core/Taskforce.js';
-import type { RouteHandler, RouteContext } from '../routes.js';
+import { type RouteHandler, type RouteContext } from './primitives.js';
 import { ObjectStorageClient } from '../../storage/objectStorageClient.js';
 export interface WorkspaceRouteDependencies {
     addRoute: (method: string, path: string, handler: RouteHandler) => void;

package/dist/server/routes/workspaces.js

@@ -13,7 +13,7 @@
  */
 import * as fs from 'fs';
 import * as path from 'path';
-import { parseJsonBody } from '../routes.js';
+import { parseJsonBody } from './primitives.js';
 import { resolveRequestAccess, createSessionTokenCookie, resolveSessionCookieAttributesForRequest, } from '../auth.js';
 import { isWorkspaceSwitchingEnabledForRuntime } from '../../shared/runtimeContract.js';
 import { resolveErrorStatusCode } from './shared.js';

package/dist/server/routes.d.ts

@@ -4,17 +4,14 @@
  * Extracted from vite.ts plugin to be reusable in both Vite plugin and standalone server.
  * This is a minimal implementation with core routes - additional routes can be added incrementally.
  */
-import { IncomingMessage, ServerResponse } from 'http';
 import { TaskforceCore } from '../core/Taskforce.js';
-import { type TaskforceAuthConfig } from './auth.js';
-import { type ResolvedObjectStorageConfig } from '../storage/objectStorage.js';
-export type RouteHandler = (req: IncomingMessage, res: ServerResponse, params: Record<string, string>) => Promise<void>;
+import { type RouteContext, type RouteHandler } from './routes/primitives.js';
+export { parseJsonBody } from './routes/primitives.js';
 export interface Route {
     pattern: RegExp;
     keys: string[];
     handler: RouteHandler;
 }
-export declare function parseJsonBody(req: IncomingMessage, maxBytes?: number): Promise<any>;
 /**
  * Create API routes for Taskforce
  *
@@ -60,10 +57,6 @@ export declare function parseJsonBody(req: IncomingMessage, maxBytes?: number):
  * - POST /api/taskforce/export-resources
  * - GET /api/taskforce/health
  */
-export interface RouteContext {
-    authConfig?: TaskforceAuthConfig;
-    objectStorage?: ResolvedObjectStorageConfig;
-}
 export declare function createRoutes(core: TaskforceCore, context?: RouteContext): Route[];
 export declare function matchRoute(method: string, pathname: string, routes: Route[]): {
     handler: RouteHandler;