@taskforcehq/taskforce 0.3.304 → 0.3.305

package/dist/config/envSchema.js

@@ -26,7 +26,7 @@ const SPECS = [
     { key: 'TASKFORCE_BOOTSTRAP_ADMIN_EMAIL', description: 'Bootstrap admin email used by login fallback.', category: 'Auth', targets: ['server', 'all'] },
     { key: 'TASKFORCE_BOOTSTRAP_ADMIN_PASSWORD', description: 'Bootstrap admin password used by login fallback.', category: 'Auth', secret: true, targets: ['server', 'all'] },
     { key: 'TASKFORCE_AUTH_PUBLIC_BASE_URL', description: 'Public auth URL used in email links.', category: 'Auth', example: 'https://performance-app.taskforcehq.ai', targets: ['server', 'all'] },
-    { key: 'TASKFORCE_AUTH_EXPOSE_DEV_TOKENS', description: 'Expose dev auth tokens in responses.', category: 'Auth', defaultValue: 'false', targets: ['server', 'all'] },
+    { key: 'TASKFORCE_AUTH_EXPOSE_DEV_TOKENS', description: 'Explicitly expose auth tokens in non-production responses for test automation.', category: 'Auth', defaultValue: 'false', targets: ['server', 'all'] },
     { key: 'TASKFORCE_CLOUD_PROXY_BASE_URL', description: 'Optional upstream cloud base URL for local proxying of auth/sync API calls.', category: 'Auth', example: 'https://performance-app.taskforcehq.ai', targets: ['server', 'all'] },
     { key: 'TASKFORCE_CF_ACCESS_CLIENT_ID', description: 'Optional Cloudflare Access service token client id for local cloud proxy.', category: 'Cloudflare', secret: true, targets: ['server', 'all'] },
     { key: 'TASKFORCE_CF_ACCESS_CLIENT_SECRET', description: 'Optional Cloudflare Access service token client secret for local cloud proxy.', category: 'Cloudflare', secret: true, targets: ['server', 'all'] },

package/dist/core/AiProfileService.d.ts

@@ -50,7 +50,12 @@ export interface AiProfileServiceDeps {
     aiProfileRowToRecord: (row: Record<string, unknown>) => AiProfileRecordLike;
     generateEntityId: (prefix: string) => string;
     issueProfileToken: () => string;
-    createRuleError: (message: string, statusCode?: number, code?: string) => Error;
+    countAiProfileUsage: (workspaceId: string) => {
+        used: number;
+        limit: number | null;
+        remaining: number | null;
+    };
+    createRuleError: (message: string, statusCode?: number, code?: string, details?: unknown) => Error;
 }
 export declare function listAiProfilesService(deps: AiProfileServiceDeps, workspaceId: string): AiProfileRecordLike[];
 export declare function getAiProfileByTokenService(deps: AiProfileServiceDeps, input: {

package/dist/core/AiProfileService.js

@@ -23,6 +23,112 @@ function normalizeAiProfileSurfaceTypeInput(deps, value) {
     }
     return normalized;
 }
+function inferAiProfileProviderModelDefaults(name) {
+    const normalized = String(name || '').trim().toLowerCase();
+    if (!normalized)
+        return {};
+    if (normalized.includes('claude code'))
+        return { provider: 'Anthropic', model: 'Claude Code' };
+    if (normalized.includes('claude'))
+        return { provider: 'Anthropic', model: 'Claude' };
+    if (normalized.includes('chatgpt'))
+        return { provider: 'OpenAI', model: 'ChatGPT' };
+    if (normalized.includes('codex'))
+        return { provider: 'OpenAI', model: 'Codex' };
+    if (normalized.includes('gemini'))
+        return { provider: 'Google', model: 'Gemini' };
+    return {};
+}
+function inferAiProfileMetadataDefaults(name, surfaceType) {
+    const inferredProviderModel = inferAiProfileProviderModelDefaults(name);
+    switch (surfaceType) {
+        case 'agent':
+            return {
+                description: `${name} AI collaborator registered in Taskforce.`,
+                role: 'AI Collaborator',
+                ...inferredProviderModel
+            };
+        case 'coding_tool':
+            return {
+                description: `${name} coding agent connected through MCP.`,
+                role: 'Coding Agent',
+                ...inferredProviderModel
+            };
+        case 'chat_app':
+            return {
+                description: `${name} conversational AI connected through Taskforce.`,
+                role: 'AI Assistant',
+                ...inferredProviderModel
+            };
+        case 'ide':
+            return {
+                description: `${name} IDE-connected AI assistant.`,
+                role: 'Coding Assistant',
+                ...inferredProviderModel
+            };
+        case 'other':
+            return {
+                description: `${name} AI profile connected through Taskforce.`,
+                role: 'AI Assistant',
+                ...inferredProviderModel
+            };
+        default:
+            return {};
+    }
+}
+function resolveOptionalProfileField(inputValue, existingValue, fallbackValue) {
+    const explicitValue = normalizeOptionalProfileField(inputValue);
+    if (explicitValue !== undefined)
+        return explicitValue;
+    const preservedValue = normalizeOptionalProfileField(existingValue);
+    if (preservedValue !== undefined)
+        return preservedValue;
+    return normalizeOptionalProfileField(fallbackValue);
+}
+function resolveAiProfileMetadataFields(deps, input, existing) {
+    const surfaceTypeInput = normalizeAiProfileSurfaceTypeInput(deps, input.surfaceType);
+    const effectiveSurfaceType = surfaceTypeInput === undefined
+        ? existing?.surfaceType ?? null
+        : surfaceTypeInput;
+    const inferredDefaults = inferAiProfileMetadataDefaults(input.name, effectiveSurfaceType);
+    return {
+        description: resolveOptionalProfileField(input.description, existing?.description, inferredDefaults.description) ?? null,
+        role: resolveOptionalProfileField(input.role, existing?.role, inferredDefaults.role) ?? null,
+        provider: resolveOptionalProfileField(input.provider, existing?.provider, inferredDefaults.provider) ?? null,
+        model: resolveOptionalProfileField(input.model, existing?.model, inferredDefaults.model) ?? null,
+        surfaceType: effectiveSurfaceType,
+        surfaceTypeProvided: surfaceTypeInput !== undefined,
+    };
+}
+function applyAiProfileMetadataDefaults(record) {
+    const inferredDefaults = inferAiProfileMetadataDefaults(record.name, record.surfaceType);
+    return {
+        ...record,
+        description: resolveOptionalProfileField(undefined, record.description, inferredDefaults.description) ?? null,
+        role: resolveOptionalProfileField(undefined, record.role, inferredDefaults.role) ?? null,
+        provider: resolveOptionalProfileField(undefined, record.provider, inferredDefaults.provider) ?? null,
+        model: resolveOptionalProfileField(undefined, record.model, inferredDefaults.model) ?? null,
+    };
+}
+function hydrateAiProfileRecord(deps, row) {
+    const record = deps.aiProfileRowToRecord(row);
+    const hydrated = applyAiProfileMetadataDefaults(record);
+    const metadataChanged = record.description !== hydrated.description
+        || record.role !== hydrated.role
+        || record.provider !== hydrated.provider
+        || record.model !== hydrated.model;
+    if (metadataChanged) {
+        deps.db.prepare(`
+            UPDATE ai_profiles
+            SET description = ?,
+                role = ?,
+                provider = ?,
+                model = ?
+            WHERE tenant_id = ? AND id = ?
+        `).run(hydrated.description ?? null, hydrated.role ?? null, hydrated.provider ?? null, hydrated.model ?? null, deps.tenantId, record.id);
+    }
+    return hydrated;
+}
 export function listAiProfilesService(deps, workspaceId) {
     const normalizedWorkspaceId = deps.normalizeWorkspaceId(workspaceId);
     const rows = deps.db.prepare(`
@@ -48,7 +154,7 @@ export function listAiProfilesService(deps, workspaceId) {
           AND workspace_id = ?
         ORDER BY COALESCE(updated_at, created_at) DESC, LOWER(name) ASC
     `).all(deps.tenantId, normalizedWorkspaceId);
-    return rows.map((row) => deps.aiProfileRowToRecord(row));
+    return rows.map((row) => hydrateAiProfileRecord(deps, row));
 }
 export function getAiProfileByTokenService(deps, input) {
     const normalizedWorkspaceId = deps.normalizeWorkspaceId(input.workspaceId);
@@ -63,7 +169,7 @@ export function getAiProfileByTokenService(deps, input) {
           AND profile_token = ?
         LIMIT 1
     `).get(deps.tenantId, normalizedWorkspaceId, profileToken);
-    return row ? deps.aiProfileRowToRecord(row) : null;
+    return row ? hydrateAiProfileRecord(deps, row) : null;
 }
 export function upsertAiProfileForSyncService(deps, profile) {
     const normalizedWorkspaceId = deps.normalizeWorkspaceId(profile.workspaceId);
@@ -77,7 +183,6 @@ export function upsertAiProfileForSyncService(deps, profile) {
     const normalizedLastActiveAt = typeof profile.lastActiveAt === 'string' && profile.lastActiveAt.trim().length > 0
         ? profile.lastActiveAt.trim()
         : null;
-    const normalizedSurfaceType = normalizeAiProfileSurfaceTypeInput(deps, profile.surfaceType);
     const existingRow = deps.db.prepare(`
         SELECT *
         FROM ai_profiles
@@ -87,9 +192,18 @@ export function upsertAiProfileForSyncService(deps, profile) {
     if (existingRow) {
         const existingUpdatedAt = String(existingRow.updated_at || existingRow.created_at || '').trim();
         if (existingUpdatedAt && existingUpdatedAt > normalizedUpdatedAt) {
-            return deps.aiProfileRowToRecord(existingRow);
+            return hydrateAiProfileRecord(deps, existingRow);
         }
     }
+    const existingProfile = existingRow ? deps.aiProfileRowToRecord(existingRow) : null;
+    const resolvedMetadata = resolveAiProfileMetadataFields(deps, {
+        name: profile.name,
+        description: profile.description,
+        role: profile.role,
+        provider: profile.provider,
+        model: profile.model,
+        surfaceType: profile.surfaceType,
+    }, existingProfile);
     deps.db.prepare(`
         INSERT INTO ai_profiles (
             id, tenant_id, workspace_id, profile_token, name, username, icon, color,
@@ -111,7 +225,7 @@ export function upsertAiProfileForSyncService(deps, profile) {
             created_at = excluded.created_at,
             updated_at = excluded.updated_at,
             last_active_at = excluded.last_active_at
-    `).run(profileId, deps.tenantId, normalizedWorkspaceId, String(profile.profileToken || '').trim(), deps.normalizeAiProfileName(profile.name), deps.normalizeAiProfileUsername(profile.username, profile.name), deps.normalizeAiProfileIcon(profile.icon), deps.normalizeAiProfileColor(profile.color), normalizeOptionalProfileField(profile.description) ?? null, normalizeOptionalProfileField(profile.role) ?? null, normalizeOptionalProfileField(profile.provider) ?? null, normalizeOptionalProfileField(profile.model) ?? null, normalizedSurfaceType, profile.providerMetadata && typeof profile.providerMetadata === 'object' && !Array.isArray(profile.providerMetadata)
+    `).run(profileId, deps.tenantId, normalizedWorkspaceId, String(profile.profileToken || '').trim(), deps.normalizeAiProfileName(profile.name), deps.normalizeAiProfileUsername(profile.username, profile.name), deps.normalizeAiProfileIcon(profile.icon), deps.normalizeAiProfileColor(profile.color), resolvedMetadata.description, resolvedMetadata.role, resolvedMetadata.provider, resolvedMetadata.model, resolvedMetadata.surfaceType, profile.providerMetadata && typeof profile.providerMetadata === 'object' && !Array.isArray(profile.providerMetadata)
         ? JSON.stringify(profile.providerMetadata)
         : null, normalizedCreatedAt, normalizedUpdatedAt, normalizedLastActiveAt);
     const refreshed = deps.db.prepare(`
@@ -123,7 +237,7 @@ export function upsertAiProfileForSyncService(deps, profile) {
     if (!refreshed) {
         throw deps.createRuleError('Failed to upsert AI profile during sync', 500, 'AI_PROFILE_SYNC_UPSERT_FAILED');
     }
-    return deps.aiProfileRowToRecord(refreshed);
+    return hydrateAiProfileRecord(deps, refreshed);
 }
 export function mergeAiProfilesService(deps, input) {
     const normalizedWorkspaceId = deps.normalizeWorkspaceId(input.workspaceId);
@@ -165,7 +279,7 @@ export function mergeAiProfilesService(deps, input) {
     const refreshed = deps.db.prepare(`
         SELECT * FROM ai_profiles WHERE tenant_id = ? AND id = ? LIMIT 1
     `).get(deps.tenantId, keepId);
-    return deps.aiProfileRowToRecord(refreshed);
+    return hydrateAiProfileRecord(deps, refreshed);
 }
 export function resolveAiProfileService(deps, input) {
     const normalizedWorkspaceId = deps.normalizeWorkspaceId(input.workspaceId);
@@ -197,7 +311,14 @@ export function resolveAiProfileService(deps, input) {
         const nextRole = normalizeOptionalProfileField(input.role);
         const nextProvider = normalizeOptionalProfileField(input.provider);
         const nextModel = normalizeOptionalProfileField(input.model);
-        const nextSurfaceType = normalizeAiProfileSurfaceTypeInput(deps, input.surfaceType);
+        const resolvedMetadata = resolveAiProfileMetadataFields(deps, {
+            name: nextName,
+            description: nextDescription,
+            role: nextRole,
+            provider: nextProvider,
+            model: nextModel,
+            surfaceType: input.surfaceType,
+        }, existingProfile);
         deps.db.prepare(`
             UPDATE ai_profiles
             SET name = ?,
@@ -215,7 +336,7 @@ export function resolveAiProfileService(deps, input) {
                 last_active_at = ?,
                 updated_at = ?
             WHERE tenant_id = ? AND id = ?
-        `).run(nextName, nextUsername, nextIcon, nextColor, nextDescription ?? null, nextRole ?? null, nextProvider ?? null, nextModel ?? null, nextSurfaceType !== undefined ? 1 : 0, nextSurfaceType, now, now, deps.tenantId, String(existingRow.id || '').trim());
+        `).run(nextName, nextUsername, nextIcon, nextColor, resolvedMetadata.description, resolvedMetadata.role, resolvedMetadata.provider, resolvedMetadata.model, resolvedMetadata.surfaceTypeProvided ? 1 : 0, resolvedMetadata.surfaceType, now, now, deps.tenantId, String(existingRow.id || '').trim());
         const refreshed = deps.db.prepare(`
             SELECT *
             FROM ai_profiles
@@ -227,7 +348,7 @@ export function resolveAiProfileService(deps, input) {
         }
         return {
             created: false,
-            profile: deps.aiProfileRowToRecord(refreshed)
+            profile: hydrateAiProfileRecord(deps, refreshed)
         };
     }
     const exactMatches = deps.db.prepare(`
@@ -251,7 +372,15 @@ export function resolveAiProfileService(deps, input) {
         const nextRole = normalizeOptionalProfileField(input.role);
         const nextProvider = normalizeOptionalProfileField(input.provider);
         const nextModel = normalizeOptionalProfileField(input.model);
-        const nextSurfaceType = normalizeAiProfileSurfaceTypeInput(deps, input.surfaceType);
+        const existingProfile = deps.aiProfileRowToRecord(exactMatches[0]);
+        const resolvedMetadata = resolveAiProfileMetadataFields(deps, {
+            name: nextName,
+            description: nextDescription,
+            role: nextRole,
+            provider: nextProvider,
+            model: nextModel,
+            surfaceType: input.surfaceType,
+        }, existingProfile);
         deps.db.prepare(`
             UPDATE ai_profiles
             SET name = ?,
@@ -269,7 +398,7 @@ export function resolveAiProfileService(deps, input) {
                     ELSE surface_type
                 END
             WHERE tenant_id = ? AND id = ?
-        `).run(nextName, nextUsername, nextIcon, nextColor, nextDescription ?? null, nextRole ?? null, nextProvider ?? null, nextModel ?? null, now, now, nextSurfaceType !== undefined ? 1 : 0, nextSurfaceType, deps.tenantId, canonicalId);
+        `).run(nextName, nextUsername, nextIcon, nextColor, resolvedMetadata.description, resolvedMetadata.role, resolvedMetadata.provider, resolvedMetadata.model, now, now, resolvedMetadata.surfaceTypeProvided ? 1 : 0, resolvedMetadata.surfaceType, deps.tenantId, canonicalId);
         const reused = deps.db.prepare(`
             SELECT *
             FROM ai_profiles
@@ -281,7 +410,7 @@ export function resolveAiProfileService(deps, input) {
         }
         return {
             created: false,
-            profile: deps.aiProfileRowToRecord(reused),
+            profile: hydrateAiProfileRecord(deps, reused),
             ...(exactMatches.length > 1 ? {
                 duplicateWarning: {
                     existingProfileId: canonicalId,
@@ -290,6 +419,15 @@ export function resolveAiProfileService(deps, input) {
             } : {})
         };
     }
+    const aiProfileUsage = deps.countAiProfileUsage(normalizedWorkspaceId);
+    if (aiProfileUsage.limit !== null && aiProfileUsage.used >= aiProfileUsage.limit) {
+        throw deps.createRuleError('No AI seats are available for this workspace. Remove an existing AI profile or upgrade your plan.', 403, 'AI_PROFILE_LIMIT_REACHED', {
+            workspaceId: normalizedWorkspaceId,
+            limit: aiProfileUsage.limit,
+            used: aiProfileUsage.used,
+            remaining: aiProfileUsage.remaining
+        });
+    }
     const id = deps.generateEntityId('ai-profile');
     const issuedProfileToken = deps.issueProfileToken();
     const username = deps.normalizeAiProfileUsername(undefined, name);
@@ -299,7 +437,14 @@ export function resolveAiProfileService(deps, input) {
     const role = normalizeOptionalProfileField(input.role);
     const provider = normalizeOptionalProfileField(input.provider);
     const model = normalizeOptionalProfileField(input.model);
-    const surfaceType = normalizeAiProfileSurfaceTypeInput(deps, input.surfaceType);
+    const resolvedMetadata = resolveAiProfileMetadataFields(deps, {
+        name,
+        description,
+        role,
+        provider,
+        model,
+        surfaceType: input.surfaceType,
+    }, null);
     const providerMetadata = input.providerMetadata && typeof input.providerMetadata === 'object'
         ? input.providerMetadata
         : null;
@@ -308,7 +453,7 @@ export function resolveAiProfileService(deps, input) {
             id, tenant_id, workspace_id, profile_token, name, username, icon, color,
             description, role, provider, model, surface_type, provider_metadata_json, created_at, updated_at, last_active_at
         ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `).run(id, deps.tenantId, normalizedWorkspaceId, issuedProfileToken, name, username, icon, color, description ?? null, role ?? null, provider ?? null, model ?? null, surfaceType, providerMetadata ? JSON.stringify(providerMetadata) : null, now, now, now);
+    `).run(id, deps.tenantId, normalizedWorkspaceId, issuedProfileToken, name, username, icon, color, resolvedMetadata.description, resolvedMetadata.role, resolvedMetadata.provider, resolvedMetadata.model, resolvedMetadata.surfaceType, providerMetadata ? JSON.stringify(providerMetadata) : null, now, now, now);
     const created = deps.db.prepare(`
         SELECT *
         FROM ai_profiles
@@ -320,6 +465,6 @@ export function resolveAiProfileService(deps, input) {
     }
     return {
         created: true,
-        profile: deps.aiProfileRowToRecord(created),
+        profile: hydrateAiProfileRecord(deps, created),
     };
 }

package/dist/core/AiProfileService.test.js

@@ -56,10 +56,12 @@ function createDeps(overrides) {
         }),
         generateEntityId: (prefix) => `${prefix}-1`,
         issueProfileToken: () => 'tfp_test',
-        createRuleError: (message, statusCode = 400, code = 'TASK_RULE_VIOLATION') => {
+        countAiProfileUsage: () => ({ used: 0, limit: null, remaining: null }),
+        createRuleError: (message, statusCode = 400, code = 'TASK_RULE_VIOLATION', details) => {
             const error = new Error(message);
             error.statusCode = statusCode;
             error.code = code;
+            error.details = details;
             return error;
         },
         ...overrides

package/dist/core/AiProfiles.test.js

@@ -10,6 +10,28 @@ function createProjectRoot(prefix = 'taskforce-ai-profiles-') {
     return root;
 }
 const createdRoots = [];
+function enableAiProfileSeatLimit(core, workspaceId, userId, limit) {
+    core.upsertPlanCatalog({ planId: 'free', displayName: 'Free', status: 'active' });
+    core.ensureBootstrapUserAccess({
+        userId,
+        workspaceId,
+        role: 'owner',
+        email: `${userId}@example.com`
+    });
+    core.updatePlanVersionFeatures({
+        planVersionId: 'free-v1',
+        features: [
+            { featureKey: 'collaboration.ai_profiles', access: 'limited', config: { maxAiProfiles: limit } }
+        ]
+    });
+    core.updateAccountEntitlement({
+        accountId: userId,
+        planVersionId: 'free-v1',
+        entitlementState: 'active',
+        actorUserId: 'system-admin',
+        actorRole: 'system_admin'
+    });
+}
 afterEach(() => {
     while (createdRoots.length > 0) {
         const root = createdRoots.pop();
@@ -103,6 +125,125 @@ describe('TaskforceCore ai profiles', () => {
         expect(second.profile.surfaceType).toBe('coding_tool');
         expect(second.profile.color).toBe('#0ea5e9');
     });
+    it('applies default metadata for named agent profiles when optional fields are omitted', () => {
+        const projectRoot = createProjectRoot();
+        createdRoots.push(projectRoot);
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+        const resolved = core.resolveAiProfile({
+            workspaceId: 'workspace-1',
+            name: 'John Drake',
+            surfaceType: 'agent'
+        });
+        expect(resolved.profile.description).toBe('John Drake AI collaborator registered in Taskforce.');
+        expect(resolved.profile.role).toBe('AI Collaborator');
+        expect(resolved.profile.provider).toBeNull();
+        expect(resolved.profile.model).toBeNull();
+        expect(resolved.profile.surfaceType).toBe('agent');
+    });
+    it('self-heals sparse named agent profiles on re-resolve', () => {
+        const projectRoot = createProjectRoot();
+        createdRoots.push(projectRoot);
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+        const first = core.resolveAiProfile({
+            workspaceId: 'workspace-1',
+            name: 'John Drake'
+        });
+        expect(first.profile.description).toBeNull();
+        expect(first.profile.role).toBeNull();
+        const second = core.resolveAiProfile({
+            workspaceId: 'workspace-1',
+            name: 'John Drake',
+            surfaceType: 'agent',
+            profileToken: first.profile.profileToken
+        });
+        expect(second.profile.id).toBe(first.profile.id);
+        expect(second.profile.description).toBe('John Drake AI collaborator registered in Taskforce.');
+        expect(second.profile.role).toBe('AI Collaborator');
+        expect(second.profile.provider).toBeNull();
+        expect(second.profile.model).toBeNull();
+        expect(second.profile.surfaceType).toBe('agent');
+    });
+    it('durably repairs sparse named agent profiles when listing profiles', () => {
+        const projectRoot = createProjectRoot();
+        createdRoots.push(projectRoot);
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+        const first = core.resolveAiProfile({
+            workspaceId: 'workspace-1',
+            name: 'John Drake'
+        });
+        expect(first.profile.description).toBeNull();
+        expect(first.profile.role).toBeNull();
+        core.resolveAiProfile({
+            workspaceId: 'workspace-1',
+            name: 'John Drake',
+            surfaceType: 'agent',
+            profileToken: first.profile.profileToken
+        });
+        core.db.prepare(`
+            UPDATE ai_profiles
+            SET description = NULL, role = NULL, provider = NULL, model = NULL
+            WHERE tenant_id = ? AND workspace_id = ? AND id = ?
+        `).run('default', 'workspace-1', first.profile.id);
+        const listed = core.listAiProfiles('workspace-1')[0];
+        expect(listed.description).toBe('John Drake AI collaborator registered in Taskforce.');
+        expect(listed.role).toBe('AI Collaborator');
+        expect(listed.provider).toBeNull();
+        expect(listed.model).toBeNull();
+        const repaired = core.db.prepare(`
+            SELECT description, role, provider, model
+            FROM ai_profiles
+            WHERE tenant_id = ? AND workspace_id = ? AND id = ?
+            LIMIT 1
+        `).get('default', 'workspace-1', first.profile.id);
+        expect(repaired).toEqual({
+            description: 'John Drake AI collaborator registered in Taskforce.',
+            role: 'AI Collaborator',
+            provider: null,
+            model: null
+        });
+    });
+    it('durably repairs sparse coding-tool profiles when resolving by token lookup', () => {
+        const projectRoot = createProjectRoot();
+        createdRoots.push(projectRoot);
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+        const resolved = core.resolveAiProfile({
+            workspaceId: 'workspace-1',
+            name: 'Codex',
+            surfaceType: 'coding_tool'
+        });
+        core.db.prepare(`
+            UPDATE ai_profiles
+            SET description = NULL, role = NULL, provider = NULL, model = NULL
+            WHERE tenant_id = ? AND workspace_id = ? AND id = ?
+        `).run('default', 'workspace-1', resolved.profile.id);
+        const fetched = core.getAiProfileByToken({
+            workspaceId: 'workspace-1',
+            profileToken: resolved.profile.profileToken
+        });
+        expect(fetched).toEqual(expect.objectContaining({
+            description: 'Codex coding agent connected through MCP.',
+            role: 'Coding Agent',
+            provider: 'OpenAI',
+            model: 'Codex',
+            surfaceType: 'coding_tool'
+        }));
+        const repaired = core.db.prepare(`
+            SELECT description, role, provider, model
+            FROM ai_profiles
+            WHERE tenant_id = ? AND workspace_id = ? AND id = ?
+            LIMIT 1
+        `).get('default', 'workspace-1', resolved.profile.id);
+        expect(repaired).toEqual({
+            description: 'Codex coding agent connected through MCP.',
+            role: 'Coding Agent',
+            provider: 'OpenAI',
+            model: 'Codex'
+        });
+    });
     it('ignores empty-string optional ai profile updates instead of clearing stored values', () => {
         const projectRoot = createProjectRoot();
         createdRoots.push(projectRoot);
@@ -368,6 +509,65 @@ describe('TaskforceCore ai profiles', () => {
         expect(core.listAiProfiles('workspace-1')).toHaveLength(1);
         expect(core.listAiProfiles('workspace-2')).toHaveLength(1);
     });
+    it('allows token-based re-resolve even when the ai profile limit is full', () => {
+        const projectRoot = createProjectRoot();
+        createdRoots.push(projectRoot);
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+        enableAiProfileSeatLimit(core, 'workspace-1', 'owner-u1', 1);
+        const first = core.resolveAiProfile({ workspaceId: 'workspace-1', name: 'Codex' });
+        const second = core.resolveAiProfile({
+            workspaceId: 'workspace-1',
+            name: 'Codex Prime',
+            icon: 'Sparkles',
+            profileToken: first.profile.profileToken
+        });
+        expect(second.created).toBe(false);
+        expect(second.profile.id).toBe(first.profile.id);
+        expect(second.profile.name).toBe('Codex Prime');
+        expect(core.listAiProfiles('workspace-1')).toHaveLength(1);
+    });
+    it('reuses an exact-match ai profile even when the ai profile limit is full', () => {
+        const projectRoot = createProjectRoot();
+        createdRoots.push(projectRoot);
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+        enableAiProfileSeatLimit(core, 'workspace-1', 'owner-u1', 1);
+        const first = core.resolveAiProfile({ workspaceId: 'workspace-1', name: 'Automation Codex' });
+        const second = core.resolveAiProfile({
+            workspaceId: 'workspace-1',
+            name: 'Automation Codex',
+            role: 'Assistant'
+        });
+        expect(second.created).toBe(false);
+        expect(second.profile.id).toBe(first.profile.id);
+        expect(second.profile.role).toBe('Assistant');
+        expect(core.listAiProfiles('workspace-1')).toHaveLength(1);
+    });
+    it('blocks net-new ai profile creation when the ai profile limit is full', () => {
+        const projectRoot = createProjectRoot();
+        createdRoots.push(projectRoot);
+        const core = new TaskforceCore({ projectRoot, storagePath: '.taskforce' });
+        core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
+        enableAiProfileSeatLimit(core, 'workspace-1', 'owner-u1', 1);
+        const first = core.resolveAiProfile({ workspaceId: 'workspace-1', name: 'Codex' });
+        expect(first.created).toBe(true);
+        try {
+            core.resolveAiProfile({ workspaceId: 'workspace-1', name: 'Claude' });
+            throw new Error('Expected AI profile creation to be blocked');
+        }
+        catch (error) {
+            expect(error.message).toContain('No AI seats are available for this workspace');
+            expect(error.code).toBe('AI_PROFILE_LIMIT_REACHED');
+            expect(error.statusCode).toBe(403);
+            expect(error.details).toEqual({
+                workspaceId: 'workspace-1',
+                limit: 1,
+                used: 1,
+                remaining: 0
+            });
+        }
+    });
     it('merges two duplicate profiles, reassigning task assignees and comment authors', () => {
         const projectRoot = createProjectRoot();
         createdRoots.push(projectRoot);

package/dist/core/AuthTokenService.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/AuthTokenService.test.js

@@ -0,0 +1,78 @@
+import { describe, expect, it } from 'vitest';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { TaskforceCore } from './Taskforce';
+function makeCore() {
+    const projectRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-auth-token-test-'));
+    const core = new TaskforceCore({
+        projectRoot,
+        storagePath: path.join(projectRoot, '.taskforce')
+    });
+    core.updateGlobalSettings({
+        billing: {
+            onboardingPolicy: {
+                mode: 'require_plan_selection',
+                planVersionId: null
+            }
+        }
+    });
+    core.upsertPlanCatalog({ planId: 'starter', displayName: 'Starter', status: 'active' });
+    return {
+        core,
+        cleanup: () => {
+            core.close();
+            fs.rmSync(projectRoot, { recursive: true, force: true });
+        }
+    };
+}
+describe('Auth token lifecycle', () => {
+    it('keeps previously issued verification tokens valid until they are used or expire', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            core.registerPasswordUser({
+                email: 'verify@example.com',
+                password: 'password123',
+                displayName: 'Verify User',
+                betaAccess: true
+            });
+            const first = String(core.requestEmailVerification({ email: 'verify@example.com' }).token || '');
+            const second = String(core.requestEmailVerification({ email: 'verify@example.com' }).token || '');
+            expect(first).toMatch(/^[a-f0-9]{48}$/);
+            expect(second).toMatch(/^[a-f0-9]{48}$/);
+            expect(first).not.toBe(second);
+            expect(core.inspectOneTimeAuthToken(first, 'email_verification').state).toBe('valid');
+            expect(core.inspectOneTimeAuthToken(second, 'email_verification').state).toBe('valid');
+            expect(core.verifyEmailWithToken(first)).toBe(true);
+            expect(core.inspectOneTimeAuthToken(first, 'email_verification').state).toBe('used');
+            expect(core.inspectOneTimeAuthToken(second, 'email_verification').state).toBe('valid');
+        }
+        finally {
+            cleanup();
+        }
+    });
+    it('keeps previously issued password reset tokens valid until they are used or expire', () => {
+        const { core, cleanup } = makeCore();
+        try {
+            core.registerPasswordUser({
+                email: 'reset@example.com',
+                password: 'password123',
+                displayName: 'Reset User',
+                betaAccess: true
+            });
+            const first = String(core.requestPasswordReset({ email: 'reset@example.com' }).token || '');
+            const second = String(core.requestPasswordReset({ email: 'reset@example.com' }).token || '');
+            expect(first).toMatch(/^[a-f0-9]{48}$/);
+            expect(second).toMatch(/^[a-f0-9]{48}$/);
+            expect(first).not.toBe(second);
+            expect(core.inspectOneTimeAuthToken(first, 'password_reset').state).toBe('valid');
+            expect(core.inspectOneTimeAuthToken(second, 'password_reset').state).toBe('valid');
+            expect(core.resetPasswordWithToken({ token: first, password: 'UpdatedPass456!' })).toBe(true);
+            expect(core.inspectOneTimeAuthToken(first, 'password_reset').state).toBe('used');
+            expect(core.inspectOneTimeAuthToken(second, 'password_reset').state).toBe('valid');
+        }
+        finally {
+            cleanup();
+        }
+    });
+});