@taskforcehq/taskforce 0.3.304 → 0.3.305

package/dist/server/routes/admin.js

@@ -50,9 +50,9 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { TaskforceRuleError } from '../../core/Taskforce.js';
-import { parseJsonBody } from '../routes.js';
+import { escapeHtml, parseFormBody, parseJsonBody } from './primitives.js';
 import { resolveRequestAccess } from '../auth.js';
-import { resolveEffectiveEmailConfig, sendEmail } from '../email.js';
+import { sendEmail } from '../email.js';
 import { WorkspaceAssetStore } from '../../storage/workspaceAssetStore.js';
 import { scanDocumentIntegrity } from '../../storage/documentIntegrity.js';
 import { normalizeStorageIntegrityScheduleSettings, resolveStorageIntegrityScheduleSettings, } from '../../storage/integritySchedule.js';
@@ -64,67 +64,18 @@ import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/
 import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
 import { randomUUID } from 'crypto';
 import { resolveDeploymentConfig } from '../../config/deployment.js';
-import { getTaskforceCloudEnvironmentConfig, resolveTaskforceCloudEnvironmentFromBaseUrl } from '../../config/cloudEnvironment.js';
+import { getTaskforceCloudEnvironmentConfig, resolveTaskforceCloudEnvironmentFromBaseUrl, resolveTaskforceMcpBaseUrlFromBaseUrl } from '../../config/cloudEnvironment.js';
 import { buildCloudMcpRuntimeAuth, resolveErrorStatusCode } from './shared.js';
+import { buildAuthBehavior, buildSiteBehavior, getRouteEmailConfig, resolvePublicAuthBaseUrl, resolveRuntimeConfigBaseUrl, } from './authSupport.js';
 import { applyWorkspaceRepair, scanWorkspaceRepair } from '../../sync/workspaceRepair.js';
 // === SECTION: Registration ===
 export function registerAdminRoutes(deps) {
-    const { addRoute, core, context, requestWorkspaceId, requestUserId, requestRole, requestHeader, requestRuntimeMode, ensureAppAccess, ensureAdminRole, ensureCloudPlanData, requireCloudRuntime, resolveAuthenticatedUserId, resolveAdminRequestActor, auditAdminAction, resolveEffectiveObjectStorageConfig, getObjectStorageClient, taskAssetStore, normalizeDocumentPathInput, ensureWithinDir, getAssetMetadata, markAssetDeleted, clearAssetDeleted, removeAssetMetadata, getStorageTelemetry, appendStorageTelemetry, getStorageIntegrityHistory, appendStorageIntegrityHistory, getDocumentPurgeHistory, appendDocumentPurgeHistory, getCollaborationTelemetry, isCollaborationPolicyEnabled, resolveRuntimeConfigBaseUrl, resolvePublicAuthBaseUrl, parseFormBody, escapeHtml, normalizeMcpOauthScopeString, MCP_TOKEN_SCOPE_VALUES, MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS, MCP_WRITE_RATE_LIMIT_ENABLED, MCP_WRITE_RATE_LIMIT_ACTOR_MAX_REQUESTS, MCP_WRITE_RATE_LIMIT_WORKSPACE_MAX_REQUESTS, MCP_WRITE_RATE_LIMIT_WINDOW_MS, } = deps;
+    const { addRoute, core, context, requestWorkspaceId, requestUserId, requestRole, requestHeader, requestRuntimeMode, ensureAppAccess, ensureAdminRole, ensureCloudPlanData, requireCloudRuntime, resolveAuthenticatedUserId, resolveAdminRequestActor, auditAdminAction, resolveEffectiveObjectStorageConfig, getObjectStorageClient, taskAssetStore, normalizeDocumentPathInput, ensureWithinDir, getAssetMetadata, markAssetDeleted, clearAssetDeleted, removeAssetMetadata, getStorageTelemetry, appendStorageTelemetry, getStorageIntegrityHistory, appendStorageIntegrityHistory, getDocumentPurgeHistory, appendDocumentPurgeHistory, getCollaborationTelemetry, isCollaborationPolicyEnabled, normalizeMcpOauthScopeString, MCP_TOKEN_SCOPE_VALUES, MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS, MCP_WRITE_RATE_LIMIT_ENABLED, MCP_WRITE_RATE_LIMIT_ACTOR_MAX_REQUESTS, MCP_WRITE_RATE_LIMIT_WORKSPACE_MAX_REQUESTS, MCP_WRITE_RATE_LIMIT_WINDOW_MS, } = deps;
     const baseVirusScanConfig = resolveVirusScanConfigFromEnv(process.env);
     const workspaceAssetStore = typeof core.getDatabaseAdapter === 'function' && typeof core.getTenantId === 'function'
         ? new WorkspaceAssetStore(core.getDatabaseAdapter(), core.getTenantId())
         : null;
     // === SECTION: Email helpers ===
-    const getEmailConfig = () => {
-        if (context.authConfig?.runtimeMode !== 'cloud') {
-            return resolveEffectiveEmailConfig(process.env, { provider: 'console' });
-        }
-        const globalSettings = core.getGlobalSettings();
-        return resolveEffectiveEmailConfig(process.env, globalSettings.email || null);
-    };
-    const resolveBooleanSetting = (value, fallback) => {
-        if (typeof value === 'boolean')
-            return value;
-        if (typeof value === 'number')
-            return value !== 0;
-        const normalized = String(value || '').trim().toLowerCase();
-        if (!normalized)
-            return fallback;
-        if (['1', 'true', 'yes', 'on'].includes(normalized))
-            return true;
-        if (['0', 'false', 'no', 'off'].includes(normalized))
-            return false;
-        return fallback;
-    };
-    const getAuthBehavior = () => {
-        const globalSettings = core.getGlobalSettings();
-        const authSettings = globalSettings.auth || {};
-        const authRateLimitMaxRequestsRaw = Number(authSettings.authRateLimitMaxRequests);
-        const authRateLimitWindowMsRaw = Number(authSettings.authRateLimitWindowMs);
-        const onboardingPolicy = core.getOnboardingPolicy();
-        return {
-            allowSelfRegistration: resolveBooleanSetting(authSettings.allowSelfRegistration, true),
-            requireVerifiedEmail: resolveBooleanSetting(authSettings.requireVerifiedEmail, true),
-            defaultNewUserBetaAccess: resolveBooleanSetting(authSettings.defaultNewUserBetaAccess, false),
-            authRateLimitEnabled: resolveBooleanSetting(authSettings.authRateLimitEnabled, true),
-            authRateLimitMaxRequests: Number.isFinite(authRateLimitMaxRequestsRaw) && authRateLimitMaxRequestsRaw >= 1
-                ? Math.floor(authRateLimitMaxRequestsRaw)
-                : 10,
-            authRateLimitWindowMs: Number.isFinite(authRateLimitWindowMsRaw) && authRateLimitWindowMsRaw >= 1000
-                ? Math.floor(authRateLimitWindowMsRaw)
-                : 15 * 60_000,
-            onboardingPolicyMode: onboardingPolicy.mode,
-            onboardingPlanVersionId: onboardingPolicy.planVersionId
-        };
-    };
-    const getSiteBehavior = () => {
-        const globalSettings = core.getGlobalSettings();
-        const siteSettings = globalSettings.site || {};
-        return {
-            showRunTaskforceLocally: resolveBooleanSetting(siteSettings.showRunTaskforceLocally, true),
-            pricingPageEnabled: resolveBooleanSetting(siteSettings.pricingPageEnabled, true)
-        };
-    };
     const resolveEffectiveVirusScanSettings = () => {
         const settings = core.getGlobalSettings().objectStorage || {};
         const asyncEnabled = typeof settings.virusScanAsyncEnabled === 'boolean'
@@ -139,6 +90,7 @@ export function registerAdminRoutes(deps) {
         };
     };
     // === SECTION: MCP helpers ===
+    const MCP_CONNECTION_TEST_TIMEOUT_MS = 5000;
     const writeMcpHttpError = (res, statusCode, message) => {
         res.writeHead(statusCode, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({
@@ -171,6 +123,112 @@ export function registerAdminRoutes(deps) {
     const resolveMcpOauthTokenUrl = (req) => `${resolveMcpOauthIssuer(req)}/oauth/mcp/token`;
     const resolveMcpOauthRegisterUrl = (req) => `${resolveMcpOauthIssuer(req)}/oauth/mcp/register`;
     const resolveMcpOauthResourceUrl = (req) => `${resolveMcpOauthIssuer(req)}/mcp`;
+    const resolveCloudMcpEndpoint = (req) => {
+        const requestBaseUrl = resolveRuntimeConfigBaseUrl(req);
+        const deployment = resolveDeploymentConfig(process.env, { requestBaseUrl });
+        const inferredMcpBaseUrl = resolveTaskforceMcpBaseUrlFromBaseUrl(deployment.cloudMcpBaseUrl
+            || deployment.cloudAuthBaseUrl
+            || deployment.cloudBaseUrl
+            || requestBaseUrl
+            || '');
+        const baseUrl = String(inferredMcpBaseUrl || deployment.cloudMcpBaseUrl || resolveMcpOauthIssuer(req)).trim().replace(/\/+$/, '');
+        return `${baseUrl}/mcp`;
+    };
+    const probeCloudMcpEndpoint = async (req, token) => {
+        const endpoint = resolveCloudMcpEndpoint(req);
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), MCP_CONNECTION_TEST_TIMEOUT_MS);
+        try {
+            const response = await fetch(endpoint, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${token}`,
+                    Accept: 'application/json, text/event-stream',
+                    'Content-Type': 'application/json'
+                },
+                body: JSON.stringify({
+                    jsonrpc: '2.0',
+                    id: `mcp-connection-test-${randomUUID()}`,
+                    method: 'initialize',
+                    params: {
+                        protocolVersion: '2025-03-26',
+                        capabilities: {},
+                        clientInfo: {
+                            name: 'taskforce-settings-test',
+                            version: '1.0.0'
+                        }
+                    }
+                }),
+                signal: controller.signal
+            });
+            const responseText = await response.text();
+            let payload = null;
+            try {
+                payload = responseText ? JSON.parse(responseText) : null;
+            }
+            catch {
+                payload = null;
+            }
+            const remoteMessage = typeof payload?.error?.message === 'string'
+                ? payload.error.message.trim()
+                : '';
+            if (!response.ok) {
+                if (response.status >= 500) {
+                    return {
+                        ok: false,
+                        statusCode: 502,
+                        code: 'MCP_ENDPOINT_GATEWAY_ERROR',
+                        error: `Cloud MCP endpoint ${endpoint} returned ${response.status}. The dedicated MCP host may be degraded or unavailable.`,
+                        details: {
+                            endpoint,
+                            upstreamStatus: response.status,
+                            remoteMessage: remoteMessage || null
+                        }
+                    };
+                }
+                return {
+                    ok: false,
+                    statusCode: 502,
+                    code: 'MCP_ENDPOINT_REJECTED_VALIDATED_TOKEN',
+                    error: `Cloud MCP endpoint ${endpoint} rejected a token that validated locally. This usually means the MCP service is stale, routed incorrectly, or out of sync with the auth database.`,
+                    details: {
+                        endpoint,
+                        upstreamStatus: response.status,
+                        remoteMessage: remoteMessage || null
+                    }
+                };
+            }
+            return {
+                ok: true,
+                endpoint,
+                serverName: typeof payload?.result?.serverInfo?.name === 'string'
+                    ? payload.result.serverInfo.name
+                    : null,
+                protocolVersion: typeof payload?.result?.protocolVersion === 'string'
+                    ? payload.result.protocolVersion
+                    : null
+            };
+        }
+        catch (error) {
+            const timedOut = error?.name === 'AbortError';
+            return {
+                ok: false,
+                statusCode: 502,
+                code: timedOut ? 'MCP_ENDPOINT_TIMEOUT' : 'MCP_ENDPOINT_UNREACHABLE',
+                error: timedOut
+                    ? `Cloud MCP endpoint ${endpoint} did not respond within ${MCP_CONNECTION_TEST_TIMEOUT_MS}ms.`
+                    : `Could not reach cloud MCP endpoint ${endpoint}. The dedicated MCP host may be unavailable or misconfigured.`,
+                details: {
+                    endpoint,
+                    timeoutMs: MCP_CONNECTION_TEST_TIMEOUT_MS,
+                    reason: String(error?.message || error || '')
+                }
+            };
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    };
     const renderMcpOauthAuthorizePage = (input) => {
         const options = input.workspaces.map((workspace) => {
             const selected = workspace.id === input.preselectedWorkspaceId ? ' selected' : '';
@@ -1013,7 +1071,7 @@ export function registerAdminRoutes(deps) {
             return;
         }
         if (context.authConfig?.runtimeMode !== 'cloud') {
-            const effective = getEmailConfig();
+            const effective = getRouteEmailConfig(core, context);
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({
                 settings: { provider: 'console', from: effective.from, replyTo: '' },
@@ -1022,7 +1080,7 @@ export function registerAdminRoutes(deps) {
             return;
         }
         const settings = core.getGlobalSettings().email || {};
-        const effective = getEmailConfig();
+        const effective = getRouteEmailConfig(core, context);
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({
             settings: {
@@ -1047,7 +1105,7 @@ export function registerAdminRoutes(deps) {
             return;
         }
         const settings = core.getGlobalSettings().email || {};
-        const effective = getEmailConfig();
+        const effective = getRouteEmailConfig(core, context);
         const keyRequired = effective.provider === 'resend' || effective.provider === 'google-workspace';
         const ready = keyRequired ? Boolean(effective.providerApiKey) : true;
         const reason = ready
@@ -1079,7 +1137,7 @@ export function registerAdminRoutes(deps) {
         const globalSettings = core.getGlobalSettings();
         const authSettings = globalSettings.auth || {};
         const billingSettings = globalSettings.billing || {};
-        const effective = getAuthBehavior();
+        const effective = buildAuthBehavior(core);
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({
             settings: {
@@ -1117,7 +1175,7 @@ export function registerAdminRoutes(deps) {
             return;
         }
         const siteSettings = core.getGlobalSettings().site || {};
-        const siteBehavior = getSiteBehavior();
+        const siteBehavior = buildSiteBehavior(core);
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({
             settings: {
@@ -1842,7 +1900,7 @@ export function registerAdminRoutes(deps) {
             res.end(JSON.stringify({ success: false, error: 'Valid test email address is required.' }));
             return;
         }
-        const config = getEmailConfig();
+        const config = getRouteEmailConfig(core, context);
         const result = await sendEmail({
             to,
             subject: 'Taskforce email settings test',
@@ -2267,9 +2325,28 @@ export function registerAdminRoutes(deps) {
                 res.end(JSON.stringify({ success: false, error: 'Token is missing required scopes.', code: 'MCP_TOKEN_MISSING_SCOPES', details: { requiredScopes, missingScopes, grantedScopes: inspection.scopes } }));
                 return;
             }
+            const probe = await probeCloudMcpEndpoint(req, token);
+            if (!probe.ok) {
+                res.writeHead(probe.statusCode, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ success: false, error: probe.error, code: probe.code, details: probe.details }));
+                return;
+            }
             const workspace = core.getWorkspaceProfile(wid);
             res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ success: true, result: { tokenId: inspection.tokenId, tokenName: inspection.name, workspaceId: wid, workspaceName: String(workspace?.name || wid), scopes: inspection.scopes, requiredScopes, endpoint: '/mcp' } }));
+            res.end(JSON.stringify({
+                success: true,
+                result: {
+                    tokenId: inspection.tokenId,
+                    tokenName: inspection.name,
+                    workspaceId: wid,
+                    workspaceName: String(workspace?.name || wid),
+                    scopes: inspection.scopes,
+                    requiredScopes,
+                    endpoint: probe.endpoint,
+                    serverName: probe.serverName,
+                    protocolVersion: probe.protocolVersion
+                }
+            }));
         }
         catch (error) {
             const statusCode = resolveErrorStatusCode(error);

package/dist/server/routes/annotatedAttachments.d.ts

@@ -13,7 +13,7 @@
  */
 import type { IncomingMessage, ServerResponse } from 'http';
 import type { TaskforceCore } from '../../core/Taskforce.js';
-import type { RouteHandler } from '../routes.js';
+import { type RouteHandler } from './primitives.js';
 export interface AnnotatedAttachmentRouteDependencies {
     addRoute: (method: string, path: string, handler: RouteHandler) => void;
     core: TaskforceCore;

package/dist/server/routes/annotatedAttachments.js

@@ -12,7 +12,7 @@
  *   GET    /api/taskforce/annotated-attachments/sessions/:id/payload
  */
 import { ANNOTATED_ATTACHMENTS_WORKSPACE_FEATURE_KEY, resolveAppGateAccess, } from '../../runtime/appGates.js';
-import { parseJsonBody } from '../routes.js';
+import { parseJsonBody } from './primitives.js';
 import { resolveErrorStatusCode } from './shared.js';
 import { getImageReferenceLabel, parseImageReference } from '../../utils/imageReferences.js';
 function writeJson(res, statusCode, payload) {

package/dist/server/routes/auth.d.ts

@@ -37,7 +37,7 @@
  */
 import type { IncomingMessage, ServerResponse } from 'http';
 import type { TaskforceCore } from '../../core/Taskforce.js';
-import type { RouteHandler, RouteContext } from '../routes.js';
+import { type RouteHandler, type RouteContext } from './primitives.js';
 import type { ResolvedObjectStorageConfig } from '../../storage/objectStorage.js';
 import { ObjectStorageClient } from '../../storage/objectStorageClient.js';
 export interface AuthRouteDependencies {
@@ -58,9 +58,6 @@ export interface AuthRouteDependencies {
         userId: string;
         systemRole: 'system_admin' | 'user';
     };
-    shouldExposeDevAuthTokens: () => boolean;
-    resolveRuntimeConfigBaseUrl: (req: IncomingMessage) => string;
-    resolvePublicAuthBaseUrl: (req: IncomingMessage) => string;
     resolveEffectiveObjectStorageConfig: () => ResolvedObjectStorageConfig;
     getObjectStorageClient: () => ObjectStorageClient | null;
 }

package/dist/server/routes/auth.js

@@ -38,36 +38,23 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { randomUUID } from 'crypto';
-import { parseJsonBody } from '../routes.js';
+import { parseJsonBody } from './primitives.js';
 import { hasValidSession, createClearSessionCookie, createSessionTokenCookie, resolveRequestAccess, resolveSessionCookieAttributesForRequest, } from '../auth.js';
-import { resolveEffectiveEmailConfig, sendEmail } from '../email.js';
+import { sendEmail } from '../email.js';
 import { resolveDeploymentConfig } from '../../config/deployment.js';
 import { resolveRuntimeModeContract } from '../../shared/runtimeContract.js';
 import { requestHeader, resolveErrorStatusCode } from './shared.js';
+import { buildAuthFlowBehavior, buildSiteBehavior, getRouteEmailConfig, resolvePublicAuthBaseUrl, resolveRuntimeConfigBaseUrl, shouldExposeDevAuthTokens } from './authSupport.js';
 import { normalizeTaskDataRelativePath } from '../../storage/objectStorageClient.js';
 // === SECTION: Registration ===
 export function registerAuthRoutes(deps) {
-    const { addRoute, core, context, requestWorkspaceId, requestUserId, ensureAppAccess, ensureAuthenticatedUser, ensureWorkspaceAdminRole, ensureCloudPlanData, requireCloudRuntime, auditAuthAction, resolveAdminRequestActor, shouldExposeDevAuthTokens, resolveRuntimeConfigBaseUrl, resolvePublicAuthBaseUrl, resolveEffectiveObjectStorageConfig, getObjectStorageClient, } = deps;
+    const { addRoute, core, context, requestWorkspaceId, requestUserId, ensureAppAccess, ensureAuthenticatedUser, ensureWorkspaceAdminRole, ensureCloudPlanData, requireCloudRuntime, auditAuthAction, resolveAdminRequestActor, resolveEffectiveObjectStorageConfig, getObjectStorageClient, } = deps;
     const normalizeTeamWorkspaceRole = (value) => {
         const role = String(value || '').trim().toLowerCase();
         if (role === 'owner' || role === 'admin' || role === 'member' || role === 'read-only')
             return role;
         return null;
     };
-    const resolveBooleanSetting = (value, fallback) => {
-        if (typeof value === 'boolean')
-            return value;
-        if (typeof value === 'number')
-            return value !== 0;
-        const normalized = String(value || '').trim().toLowerCase();
-        if (!normalized)
-            return fallback;
-        if (['1', 'true', 'yes', 'on'].includes(normalized))
-            return true;
-        if (['0', 'false', 'no', 'off'].includes(normalized))
-            return false;
-        return fallback;
-    };
     const resolveTeamPlanModeFromEntitlements = (payload) => {
         const state = String(payload?.state || '').trim().toLowerCase();
         const teamAllowed = payload?.features?.['collaboration.team_management']?.allowed === true;
@@ -190,42 +177,6 @@ export function registerAuthRoutes(deps) {
         };
     };
     // === SECTION: Email delivery helpers ===
-    const getEmailConfig = () => {
-        if (context.authConfig?.runtimeMode !== 'cloud') {
-            return resolveEffectiveEmailConfig(process.env, { provider: 'console' });
-        }
-        const globalSettings = core.getGlobalSettings();
-        return resolveEffectiveEmailConfig(process.env, globalSettings.email || null);
-    };
-    const getAuthBehavior = () => {
-        const globalSettings = core.getGlobalSettings();
-        const authSettings = globalSettings.auth || {};
-        const authRateLimitMaxRequestsRaw = Number(authSettings.authRateLimitMaxRequests);
-        const authRateLimitWindowMsRaw = Number(authSettings.authRateLimitWindowMs);
-        const onboardingPolicy = core.getOnboardingPolicy();
-        return {
-            allowSelfRegistration: resolveBooleanSetting(authSettings.allowSelfRegistration, true),
-            requireVerifiedEmail: resolveBooleanSetting(authSettings.requireVerifiedEmail, true),
-            defaultNewUserBetaAccess: resolveBooleanSetting(authSettings.defaultNewUserBetaAccess, false),
-            authRateLimitEnabled: resolveBooleanSetting(authSettings.authRateLimitEnabled, true),
-            authRateLimitMaxRequests: Number.isFinite(authRateLimitMaxRequestsRaw) && authRateLimitMaxRequestsRaw >= 1
-                ? Math.floor(authRateLimitMaxRequestsRaw)
-                : 10,
-            authRateLimitWindowMs: Number.isFinite(authRateLimitWindowMsRaw) && authRateLimitWindowMsRaw >= 1000
-                ? Math.floor(authRateLimitWindowMsRaw)
-                : 15 * 60_000,
-            onboardingPolicyMode: onboardingPolicy.mode,
-            onboardingPlanVersionId: onboardingPolicy.planVersionId
-        };
-    };
-    const getSiteBehavior = () => {
-        const globalSettings = core.getGlobalSettings();
-        const siteSettings = globalSettings.site || {};
-        return {
-            showRunTaskforceLocally: resolveBooleanSetting(siteSettings.showRunTaskforceLocally, true),
-            pricingPageEnabled: resolveBooleanSetting(siteSettings.pricingPageEnabled, true)
-        };
-    };
     const buildPasswordSessionCookieForUser = (req, authConfig, userIdRaw, options) => {
         const userId = String(userIdRaw || '').trim();
         const fallbackRole = String(options?.fallbackRole || authConfig.defaultRole || 'member').trim() || 'member';
@@ -314,7 +265,7 @@ export function registerAuthRoutes(deps) {
             to: email,
             subject,
             text
-        }, getEmailConfig());
+        }, getRouteEmailConfig(core, context));
         if (result.ok) {
             console.info(`[Taskforce Auth Email] kind=${kind} provider=${result.provider} to=${email} messageId=${result.messageId || '-'}`);
         }
@@ -332,7 +283,7 @@ export function registerAuthRoutes(deps) {
             to: email,
             subject,
             text
-        }, getEmailConfig());
+        }, getRouteEmailConfig(core, context));
         if (result.ok) {
             console.info(`[Taskforce Auth Email] kind=invite provider=${result.provider} to=${email} messageId=${result.messageId || '-'}`);
         }
@@ -368,7 +319,7 @@ export function registerAuthRoutes(deps) {
         }));
     });
     addRoute('GET', '/api/taskforce/public/site-config', async (_req, res) => {
-        const siteBehavior = getSiteBehavior();
+        const siteBehavior = buildSiteBehavior(core);
         res.writeHead(200, {
             'Content-Type': 'application/json',
             'Cross-Origin-Resource-Policy': 'cross-origin'
@@ -379,7 +330,7 @@ export function registerAuthRoutes(deps) {
         }));
     });
     addRoute('GET', '/api/taskforce/public/site-config-script', async (_req, res) => {
-        const siteBehavior = getSiteBehavior();
+        const siteBehavior = buildSiteBehavior(core);
         const payload = JSON.stringify(siteBehavior).replace(/</g, '\\u003c');
         res.writeHead(200, {
             'Content-Type': 'application/javascript; charset=utf-8',
@@ -705,7 +656,7 @@ export function registerAuthRoutes(deps) {
         const workspaceId = workspaceIdCandidate || 'default';
         // Password flow (preferred)
         if (email && password) {
-            const authBehavior = getAuthBehavior();
+            const authBehavior = buildAuthFlowBehavior(core);
             let authResult = core.authenticatePasswordUserDetailed({
                 email,
                 password,
@@ -802,7 +753,7 @@ export function registerAuthRoutes(deps) {
         const selectedPlanVersionId = typeof body?.planVersionId === 'string'
             ? body.planVersionId.trim()
             : '';
-        const authBehavior = getAuthBehavior();
+        const authBehavior = buildAuthFlowBehavior(core);
         if (!authBehavior.allowSelfRegistration) {
             res.writeHead(403, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ success: false, error: 'Self-registration is currently disabled.' }));
@@ -875,12 +826,14 @@ export function registerAuthRoutes(deps) {
                 && authBehavior.requireVerifiedEmail
                 && email
                 && !core.isEmailVerified(email)) {
-                let emailSent = true;
+                let emailSent = false;
+                let deliveryAttempted = false;
                 let emailError;
                 let verificationToken;
                 const verification = core.requestEmailVerification({ email });
                 verificationToken = verification.token || null;
                 if (verification.token) {
+                    deliveryAttempted = true;
                     const delivery = await deliverAuthEmail('verify-email', email, verification.token, req);
                     emailSent = delivery.ok;
                     emailError = delivery.error;
@@ -898,6 +851,7 @@ export function registerAuthRoutes(deps) {
                     code: 'EMAIL_ALREADY_EXISTS_UNVERIFIED',
                     verificationRequired: true,
                     emailSent,
+                    deliveryAttempted,
                     emailError,
                     verificationToken: shouldExposeDevAuthTokens()
                         ? (verificationToken || null)
@@ -930,10 +884,12 @@ export function registerAuthRoutes(deps) {
             return;
         }
         try {
-            let emailSent = true;
+            let emailSent = false;
+            let deliveryAttempted = false;
             let emailError;
             const verification = core.requestEmailVerification({ email });
             if (verification.token) {
+                deliveryAttempted = true;
                 const delivery = await deliverAuthEmail('verify-email', email, verification.token, req);
                 emailSent = delivery.ok;
                 emailError = delivery.error;
@@ -946,6 +902,7 @@ export function registerAuthRoutes(deps) {
             res.end(JSON.stringify({
                 success: true,
                 emailSent,
+                deliveryAttempted,
                 emailError,
                 verificationToken: shouldExposeDevAuthTokens() ? (verification.token || null) : undefined
             }));
@@ -1018,10 +975,12 @@ export function registerAuthRoutes(deps) {
             return;
         }
         try {
-            let emailSent = true;
+            let emailSent = false;
+            let deliveryAttempted = false;
             let emailError;
             const reset = core.requestPasswordReset({ email });
             if (reset.token) {
+                deliveryAttempted = true;
                 const delivery = await deliverAuthEmail('password-reset', email, reset.token, req);
                 emailSent = delivery.ok;
                 emailError = delivery.error;
@@ -1034,6 +993,7 @@ export function registerAuthRoutes(deps) {
             res.end(JSON.stringify({
                 success: true,
                 emailSent,
+                deliveryAttempted,
                 emailError,
                 resetToken: shouldExposeDevAuthTokens() ? (reset.token || null) : undefined
             }));
@@ -1389,7 +1349,7 @@ export function registerAuthRoutes(deps) {
                 seatUsage,
                 upgradeHints: canInvite
                     ? []
-                    : ['Team management requires a TEAM plan in active/trialing/grace state.'],
+                    : ['Team management requires an active plan with collaboration access.'],
                 supportLink: 'mailto:support@taskforcehq.ai'
             }));
         }

package/dist/server/routes/authSupport.d.ts

@@ -0,0 +1,30 @@
+import type { IncomingMessage } from 'http';
+import type { TaskforceCore } from '../../core/Taskforce.js';
+import type { RouteContext } from './primitives.js';
+export declare function resolveBooleanSetting(value: unknown, fallback: boolean): boolean;
+export declare function getRouteEmailConfig(core: TaskforceCore, context: RouteContext): import("../email.js").TaskforceEmailConfig;
+export declare function buildAuthFlowBehavior(core: TaskforceCore): {
+    allowSelfRegistration: boolean;
+    requireVerifiedEmail: boolean;
+    defaultNewUserBetaAccess: boolean;
+    authRateLimitEnabled: boolean;
+    authRateLimitMaxRequests: number;
+    authRateLimitWindowMs: number;
+};
+export declare function buildAuthBehavior(core: TaskforceCore): {
+    onboardingPolicyMode: import("../../core/types.js").OnboardingPolicyMode;
+    onboardingPlanVersionId: string | null;
+    allowSelfRegistration: boolean;
+    requireVerifiedEmail: boolean;
+    defaultNewUserBetaAccess: boolean;
+    authRateLimitEnabled: boolean;
+    authRateLimitMaxRequests: number;
+    authRateLimitWindowMs: number;
+};
+export declare function buildSiteBehavior(core: TaskforceCore): {
+    showRunTaskforceLocally: boolean;
+    pricingPageEnabled: boolean;
+};
+export declare function shouldExposeDevAuthTokens(): boolean;
+export declare function resolveRuntimeConfigBaseUrl(req: IncomingMessage): string;
+export declare function resolvePublicAuthBaseUrl(req: IncomingMessage): string;

package/dist/server/routes/authSupport.js

@@ -0,0 +1,81 @@
+import { resolveEffectiveEmailConfig } from '../email.js';
+import { resolveDeploymentConfig } from '../../config/deployment.js';
+export function resolveBooleanSetting(value, fallback) {
+    if (typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number')
+        return value !== 0;
+    const normalized = String(value || '').trim().toLowerCase();
+    if (!normalized)
+        return fallback;
+    if (['1', 'true', 'yes', 'on'].includes(normalized))
+        return true;
+    if (['0', 'false', 'no', 'off'].includes(normalized))
+        return false;
+    return fallback;
+}
+export function getRouteEmailConfig(core, context) {
+    if (context.authConfig?.runtimeMode !== 'cloud') {
+        return resolveEffectiveEmailConfig(process.env, { provider: 'console' });
+    }
+    const globalSettings = core.getGlobalSettings();
+    return resolveEffectiveEmailConfig(process.env, globalSettings.email || null);
+}
+export function buildAuthFlowBehavior(core) {
+    const globalSettings = core.getGlobalSettings();
+    const authSettings = globalSettings.auth || {};
+    const authRateLimitMaxRequestsRaw = Number(authSettings.authRateLimitMaxRequests);
+    const authRateLimitWindowMsRaw = Number(authSettings.authRateLimitWindowMs);
+    return {
+        allowSelfRegistration: resolveBooleanSetting(authSettings.allowSelfRegistration, true),
+        requireVerifiedEmail: resolveBooleanSetting(authSettings.requireVerifiedEmail, true),
+        defaultNewUserBetaAccess: resolveBooleanSetting(authSettings.defaultNewUserBetaAccess, false),
+        authRateLimitEnabled: resolveBooleanSetting(authSettings.authRateLimitEnabled, true),
+        authRateLimitMaxRequests: Number.isFinite(authRateLimitMaxRequestsRaw) && authRateLimitMaxRequestsRaw >= 1
+            ? Math.floor(authRateLimitMaxRequestsRaw)
+            : 10,
+        authRateLimitWindowMs: Number.isFinite(authRateLimitWindowMsRaw) && authRateLimitWindowMsRaw >= 1000
+            ? Math.floor(authRateLimitWindowMsRaw)
+            : 15 * 60_000,
+    };
+}
+export function buildAuthBehavior(core) {
+    const authBehavior = buildAuthFlowBehavior(core);
+    const onboardingPolicy = core.getOnboardingPolicy();
+    return {
+        ...authBehavior,
+        onboardingPolicyMode: onboardingPolicy.mode,
+        onboardingPlanVersionId: onboardingPolicy.planVersionId
+    };
+}
+export function buildSiteBehavior(core) {
+    const globalSettings = core.getGlobalSettings();
+    const siteSettings = globalSettings.site || {};
+    return {
+        showRunTaskforceLocally: resolveBooleanSetting(siteSettings.showRunTaskforceLocally, true),
+        pricingPageEnabled: resolveBooleanSetting(siteSettings.pricingPageEnabled, true)
+    };
+}
+export function shouldExposeDevAuthTokens() {
+    const explicit = String(process.env.TASKFORCE_AUTH_EXPOSE_DEV_TOKENS || '').trim().toLowerCase();
+    return explicit === '1' || explicit === 'true' || explicit === 'yes';
+}
+export function resolveRuntimeConfigBaseUrl(req) {
+    const host = String(req.headers['x-forwarded-host'] || req.headers.host || '').trim();
+    if (!host)
+        return '';
+    const proto = String(req.headers['x-forwarded-proto'] || '').trim().toLowerCase() === 'https'
+        ? 'https'
+        : (req.socket?.encrypted ? 'https' : 'http');
+    return `${proto}://${host}`.replace(/\/+$/, '');
+}
+export function resolvePublicAuthBaseUrl(req) {
+    const configured = String(process.env.TASKFORCE_AUTH_PUBLIC_BASE_URL || '').trim().replace(/\/+$/, '');
+    if (configured)
+        return configured;
+    const host = String(req.headers['x-forwarded-host'] || req.headers.host || '').trim();
+    const proto = String(req.headers['x-forwarded-proto'] || '').trim().toLowerCase() === 'http' ? 'http' : 'https';
+    if (!host)
+        return resolveDeploymentConfig(process.env).cloudBaseUrl || 'https://app.taskforcehq.ai';
+    return `${proto}://${host}`;
+}

package/dist/server/routes/billing.d.ts

@@ -1,6 +1,6 @@
 import type { IncomingMessage } from 'http';
 import type { TaskforceCore } from '../../core/Taskforce.js';
-import type { RouteHandler, RouteContext } from '../routes.js';
+import { type RouteHandler, type RouteContext } from './primitives.js';
 export type BillingInterval = 'month' | 'year';
 export type BillingPricingType = 'stripe' | 'free';
 export interface BillingRouteDependencies {