@taskforcehq/taskforce 0.3.304 → 0.3.305

package/dist/server/routes.test.js

@@ -684,6 +684,22 @@ describe('Server Routes', () => {
             res.__getBody = () => Buffer.concat(bodyChunks).toString('utf8');
             return res;
         };
+        const withDevAuthTokenExposure = async (value, run) => {
+            const previous = process.env.TASKFORCE_AUTH_EXPOSE_DEV_TOKENS;
+            if (value === undefined)
+                delete process.env.TASKFORCE_AUTH_EXPOSE_DEV_TOKENS;
+            else
+                process.env.TASKFORCE_AUTH_EXPOSE_DEV_TOKENS = value;
+            try {
+                await run();
+            }
+            finally {
+                if (previous === undefined)
+                    delete process.env.TASKFORCE_AUTH_EXPOSE_DEV_TOKENS;
+                else
+                    process.env.TASKFORCE_AUTH_EXPOSE_DEV_TOKENS = previous;
+            }
+        };
         it('GET /api/taskforce/tasks should return tasks', async () => {
             const mockTasks = { tasks: [], config: {} };
             core.listTasks.mockReturnValue(mockTasks);
@@ -1914,6 +1930,20 @@ describe('Server Routes', () => {
             });
         });
         it('POST /api/taskforce/settings/mcp/test-connection should validate the token against workspace and scopes', async () => {
+            const previousCloudEnvironment = process.env.TASKFORCE_CLOUD_ENVIRONMENT;
+            process.env.TASKFORCE_CLOUD_ENVIRONMENT = 'performance';
+            const fetchMock = vi.fn(async () => new Response(JSON.stringify({
+                jsonrpc: '2.0',
+                id: 'mcp-connection-test',
+                result: {
+                    protocolVersion: '2025-03-26',
+                    serverInfo: { name: 'taskforce-cloud' }
+                }
+            }), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' }
+            }));
+            vi.stubGlobal('fetch', fetchMock);
             core.inspectMcpAccessToken.mockReturnValue({
                 tokenId: 'mcp-token-1',
                 tokenPrefix: 'tfmcp_abc123',
@@ -1940,12 +1970,136 @@ describe('Server Routes', () => {
             });
             const res = createMockRes();
             res.req = req;
-            await match?.handler(req, res, {});
+            try {
+                await match?.handler(req, res, {});
+            }
+            finally {
+                vi.unstubAllGlobals();
+                if (previousCloudEnvironment === undefined)
+                    delete process.env.TASKFORCE_CLOUD_ENVIRONMENT;
+                else
+                    process.env.TASKFORCE_CLOUD_ENVIRONMENT = previousCloudEnvironment;
+            }
             expect(core.inspectMcpAccessToken).toHaveBeenCalledWith('tfmcp_abc123_secret');
+            expect(fetchMock).toHaveBeenCalledWith('https://performance-mcp.taskforcehq.ai/mcp', expect.objectContaining({
+                method: 'POST',
+                headers: expect.objectContaining({
+                    Authorization: 'Bearer tfmcp_abc123_secret'
+                })
+            }));
             const payload = JSON.parse(res.end.mock.calls[0][0]);
             expect(payload.success).toBe(true);
             expect(payload.result.workspaceName).toBe('Workspace One');
             expect(payload.result.scopes).toEqual(['tasks:read', 'tasks:write']);
+            expect(payload.result.endpoint).toBe('https://performance-mcp.taskforcehq.ai/mcp');
+            expect(payload.result.serverName).toBe('taskforce-cloud');
+            expect(payload.result.protocolVersion).toBe('2025-03-26');
+        });
+        it('POST /api/taskforce/settings/mcp/test-connection should return a clear error when the dedicated MCP host returns a gateway failure', async () => {
+            const previousCloudEnvironment = process.env.TASKFORCE_CLOUD_ENVIRONMENT;
+            process.env.TASKFORCE_CLOUD_ENVIRONMENT = 'performance';
+            const fetchMock = vi.fn(async () => new Response('Bad gateway', {
+                status: 502,
+                headers: { 'Content-Type': 'text/plain' }
+            }));
+            vi.stubGlobal('fetch', fetchMock);
+            core.inspectMcpAccessToken.mockReturnValue({
+                tokenId: 'mcp-token-1',
+                tokenPrefix: 'tfmcp_abc123',
+                workspaceId: 'workspace-1',
+                userId: 'user-1',
+                name: 'Workspace MCP',
+                scopes: ['tasks:read', 'tasks:write'],
+                status: 'active'
+            });
+            const match = matchRoute('POST', '/api/taskforce/settings/mcp/test-connection', routes);
+            const req = createMockReq('POST', '/api/taskforce/settings/mcp/test-connection', {
+                token: 'tfmcp_abc123_secret',
+                requiredScopes: ['tasks:read', 'tasks:write']
+            }, {
+                'x-taskforce-runtime-mode': 'cloud',
+                'x-taskforce-user-id': 'user-1',
+                'x-taskforce-workspace-id': 'workspace-1'
+            });
+            const res = createMockRes();
+            res.req = req;
+            try {
+                await match?.handler(req, res, {});
+            }
+            finally {
+                vi.unstubAllGlobals();
+                if (previousCloudEnvironment === undefined)
+                    delete process.env.TASKFORCE_CLOUD_ENVIRONMENT;
+                else
+                    process.env.TASKFORCE_CLOUD_ENVIRONMENT = previousCloudEnvironment;
+            }
+            expect(res.writeHead).toHaveBeenCalledWith(502, { 'Content-Type': 'application/json' });
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload.success).toBe(false);
+            expect(payload.code).toBe('MCP_ENDPOINT_GATEWAY_ERROR');
+            expect(payload.error).toContain('https://performance-mcp.taskforcehq.ai/mcp');
+            expect(payload.details).toEqual(expect.objectContaining({
+                endpoint: 'https://performance-mcp.taskforcehq.ai/mcp',
+                upstreamStatus: 502
+            }));
+        });
+        it('POST /api/taskforce/settings/mcp/test-connection should prefer the dedicated MCP hostname when cloudMcpBaseUrl points at the app host', async () => {
+            const previousCloudEnvironment = process.env.TASKFORCE_CLOUD_ENVIRONMENT;
+            const previousCloudMcpBaseUrl = process.env.VITE_TASKFORCE_CLOUD_MCP_BASE_URL;
+            process.env.TASKFORCE_CLOUD_ENVIRONMENT = 'performance';
+            process.env.VITE_TASKFORCE_CLOUD_MCP_BASE_URL = 'https://performance-app.taskforcehq.ai';
+            const fetchMock = vi.fn(async () => new Response(JSON.stringify({
+                jsonrpc: '2.0',
+                id: 'mcp-connection-test',
+                result: {
+                    serverInfo: { name: 'taskforce-cloud' }
+                }
+            }), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' }
+            }));
+            vi.stubGlobal('fetch', fetchMock);
+            core.inspectMcpAccessToken.mockReturnValue({
+                tokenId: 'mcp-token-1',
+                tokenPrefix: 'tfmcp_abc123',
+                workspaceId: 'workspace-1',
+                userId: 'user-1',
+                name: 'Workspace MCP',
+                scopes: ['tasks:read', 'tasks:write'],
+                status: 'active'
+            });
+            core.getWorkspaceProfile.mockReturnValue({
+                id: 'workspace-1',
+                slug: 'workspace-1',
+                name: 'Workspace One',
+                description: null
+            });
+            const match = matchRoute('POST', '/api/taskforce/settings/mcp/test-connection', routes);
+            const req = createMockReq('POST', '/api/taskforce/settings/mcp/test-connection', {
+                token: 'tfmcp_abc123_secret',
+                requiredScopes: ['tasks:read']
+            }, {
+                'x-taskforce-runtime-mode': 'cloud',
+                'x-taskforce-user-id': 'user-1',
+                'x-taskforce-workspace-id': 'workspace-1'
+            });
+            const res = createMockRes();
+            res.req = req;
+            try {
+                await match?.handler(req, res, {});
+            }
+            finally {
+                vi.unstubAllGlobals();
+                if (previousCloudEnvironment === undefined)
+                    delete process.env.TASKFORCE_CLOUD_ENVIRONMENT;
+                else
+                    process.env.TASKFORCE_CLOUD_ENVIRONMENT = previousCloudEnvironment;
+                if (previousCloudMcpBaseUrl === undefined)
+                    delete process.env.VITE_TASKFORCE_CLOUD_MCP_BASE_URL;
+                else
+                    process.env.VITE_TASKFORCE_CLOUD_MCP_BASE_URL = previousCloudMcpBaseUrl;
+            }
+            expect(fetchMock).toHaveBeenCalledWith('https://performance-mcp.taskforcehq.ai/mcp', expect.any(Object));
         });
         it('POST /api/taskforce/settings/mcp/test-connection should report missing scopes', async () => {
             core.inspectMcpAccessToken.mockReturnValue({
@@ -2230,6 +2384,63 @@ describe('Server Routes', () => {
             expect(fetchMock).not.toHaveBeenCalled();
             vi.unstubAllGlobals();
         });
+        it('GET /api/taskforce/documents/:assetId/content should fall back to object storage when local canonical metadata points at a missing file', async () => {
+            const fetchMock = vi.fn().mockResolvedValue({
+                status: 200,
+                ok: true,
+                headers: new Headers({ 'content-type': 'text/markdown' }),
+                arrayBuffer: async () => Buffer.from('# Recovered canonical doc\n').buffer,
+            });
+            vi.stubGlobal('fetch', fetchMock);
+            const routesWithStorage = createRoutes(core, {
+                objectStorage: {
+                    provider: 'r2',
+                    r2: {
+                        accountId: 'acct-1',
+                        bucket: 'taskforce-docs',
+                        endpoint: 'https://example.r2.cloudflarestorage.com',
+                        accessKeyId: 'access-key-1',
+                        secretAccessKey: 'secret-key-1',
+                        keyPrefix: 'taskforce',
+                        signedUploadTtlSeconds: 600,
+                        signedDownloadTtlSeconds: 300
+                    }
+                }
+            });
+            const store = new WorkspaceAssetStore(core.getDatabaseAdapter(), core.getTenantId());
+            store.upsertAsset({
+                assetId: 'asset-doc-content-fallback-1',
+                workspaceId: 'default',
+                kind: 'document',
+                logicalName: 'Recovered canonical doc',
+                originalFilename: 'recovered-canonical-doc.md',
+                mimeType: 'text/markdown',
+                storageProvider: 'local',
+                storageKey: 'workspaces/default/assets/documents/asset-doc-content-fallback-1-recovered-canonical-doc.md',
+                contentSha256: 'sha-canonical-doc-fallback-1',
+                sizeBytes: 25,
+                documentId: 'doc-content-fallback-1',
+                version: 1,
+                isLatest: true,
+                scanStatus: 'clean',
+                scanEngine: null,
+                scanDetails: null,
+                deletedAt: null,
+                purgeAfter: null
+            });
+            const req = createMockReq('GET', '/api/taskforce/documents/asset-doc-content-fallback-1/content');
+            const res = createMockRes();
+            await matchRoute('GET', '/api/taskforce/documents/asset-doc-content-fallback-1/content', routesWithStorage)?.handler(req, res, {
+                assetId: 'asset-doc-content-fallback-1'
+            });
+            expect(res.writeHead).toHaveBeenCalledWith(200, expect.objectContaining({
+                'Content-Type': 'text/markdown',
+                'Content-Disposition': 'inline'
+            }));
+            expect(res.end).toHaveBeenCalledWith(expect.any(Buffer));
+            expect(fetchMock).toHaveBeenCalled();
+            vi.unstubAllGlobals();
+        });
         it('GET /api/taskforce/documents/:assetId/content should reject non-document assets', async () => {
             const routesWithStorage = createRoutes(core, {
                 objectStorage: {
@@ -3485,10 +3696,106 @@ describe('Server Routes', () => {
             const res = createMockRes();
             await match?.handler(req, res, { assetId: 'asset-doc-attached-1' });
             expect(res.writeHead).toHaveBeenCalledWith(409, { 'Content-Type': 'application/json' });
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload).toEqual(expect.objectContaining({
+                error: 'Document is still attached to one or more tasks.',
+                activeAttachmentCount: 1,
+                requiresForceDetach: true
+            }));
             expect(store.get('asset-doc-attached-1', 'default')?.deletedAt).toBeNull();
             fs.rmSync(dbRoot, { recursive: true, force: true });
             fs.rmSync(tmpRoot, { recursive: true, force: true });
         });
+        it('DELETE /api/taskforce/documents/:assetId should unlink attached canonical documents when forceDetach is true', async () => {
+            const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-documents-delete-force-attached-'));
+            const basePath = path.join(tmpRoot, '.taskforce');
+            const documentPath = path.join(basePath, 'workspaces', 'default', 'assets', 'documents', 'asset-doc-force-delete-1-notes.md');
+            fs.mkdirSync(path.dirname(documentPath), { recursive: true });
+            fs.writeFileSync(documentPath, '# attached\n', 'utf8');
+            core.getPaths.mockReturnValue({
+                projectRoot: tmpRoot,
+                basePath,
+            });
+            const { tmpRoot: dbRoot, db, store } = createWorkspaceAssetTestStore();
+            core.getDatabaseAdapter = vi.fn().mockReturnValue(db);
+            core.getTenantId = vi.fn().mockReturnValue('default');
+            store.upsertAsset({
+                assetId: 'asset-doc-force-delete-1',
+                workspaceId: 'default',
+                kind: 'document',
+                originalFilename: 'notes.md',
+                mimeType: 'text/markdown',
+                storageProvider: 'local',
+                storageKey: 'workspaces/default/assets/documents/asset-doc-force-delete-1-notes.md',
+                contentSha256: 'sha-doc-force-delete-1',
+                sizeBytes: 16,
+                documentId: 'doc-force-delete-1',
+                version: 1,
+                updatedAt: '2026-03-18T14:00:00.000Z'
+            });
+            store.upsertLink({
+                workspaceId: 'default',
+                assetId: 'asset-doc-force-delete-1',
+                taskId: 'task-keep',
+                role: 'attachment'
+            });
+            core.getTask.mockImplementation((id) => id === 'task-keep'
+                ? {
+                    id: 'task-keep',
+                    title: 'Task Keep',
+                    attachments: [{
+                            path: '/api/taskforce/documents/asset-doc-force-delete-1/content',
+                            fsPath: 'workspaces/default/assets/documents/asset-doc-force-delete-1-notes.md',
+                            caption: 'notes.md',
+                            assetId: 'asset-doc-force-delete-1'
+                        }, {
+                            path: '/api/taskforce/context/other-file.md',
+                            fsPath: 'workspaces/default/assets/files/other-file.md',
+                            caption: 'other-file.md'
+                        }]
+                }
+                : null);
+            core.updateTask.mockImplementation((_id, patch) => ({
+                id: 'task-keep',
+                attachments: patch.attachments
+            }));
+            const routesWithDb = createRoutes(core);
+            const match = matchRoute('DELETE', '/api/taskforce/documents/asset-doc-force-delete-1', routesWithDb);
+            const req = createMockReq('DELETE', '/api/taskforce/documents/asset-doc-force-delete-1', {
+                forceDetach: true
+            }, {
+                'x-taskforce-workspace-id': 'default'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, { assetId: 'asset-doc-force-delete-1' });
+            expect(core.updateTask).toHaveBeenCalledWith('task-keep', {
+                attachments: [{
+                        path: '/api/taskforce/context/other-file.md',
+                        fsPath: 'workspaces/default/assets/files/other-file.md',
+                        caption: 'other-file.md'
+                    }]
+            }, 'default', expect.objectContaining({ actorRef: 'user', saveSource: 'manual' }));
+            expect(res.writeHead).toHaveBeenCalledWith(200, { 'Content-Type': 'application/json' });
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload).toEqual(expect.objectContaining({
+                success: true,
+                softDeleted: true,
+                detachedTaskCount: 1
+            }));
+            expect(store.get('asset-doc-force-delete-1', 'default')).toEqual(expect.objectContaining({
+                deletedAt: expect.any(String),
+                purgeAfter: expect.any(String)
+            }));
+            expect(store.listLinksForAsset('asset-doc-force-delete-1', 'default', { includeDeleted: true })).toEqual([
+                expect.objectContaining({
+                    taskId: 'task-keep',
+                    role: 'attachment',
+                    deletedAt: expect.any(String)
+                })
+            ]);
+            fs.rmSync(dbRoot, { recursive: true, force: true });
+            fs.rmSync(tmpRoot, { recursive: true, force: true });
+        });
         it('PATCH /api/taskforce/documents/:assetId should update the shared display name without changing storage identity', async () => {
             const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-documents-rename-'));
             core.getPaths.mockReturnValue({
@@ -3726,7 +4033,85 @@ describe('Server Routes', () => {
             }));
             expect(res.setHeader).not.toHaveBeenCalledWith('Set-Cookie', expect.any(String));
             expect(res.writeHead).toHaveBeenCalledWith(201, expect.any(Object));
-            expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"verificationRequired":true'));
+            const payload = JSON.parse(String(res.end.mock.calls.at(-1)?.[0] || '{}'));
+            expect(payload).toEqual(expect.objectContaining({
+                success: true,
+                verificationRequired: true
+            }));
+            expect(payload.verificationToken).toBeUndefined();
+        });
+        it('POST /api/taskforce/auth/register should not depend on onboarding policy lookups', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            core.getOnboardingPolicy.mockImplementationOnce(() => {
+                throw new Error('for SELECT DISTINCT, ORDER BY expressions must appear in select list');
+            });
+            core.getGlobalSettings.mockReturnValue({
+                auth: {
+                    allowSelfRegistration: true,
+                    requireVerifiedEmail: false
+                }
+            });
+            routes = createRoutes(core, { authConfig });
+            core.registerPasswordUser.mockReturnValueOnce({
+                userId: 'u-new',
+                workspaceId: 'default',
+                role: 'member',
+                planSelectionRequired: false
+            });
+            const match = matchRoute('POST', '/api/taskforce/auth/register', routes);
+            const req = createMockReq('POST', '/api/taskforce/auth/register', {
+                email: 'newuser@example.com',
+                password: 'password123'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(core.registerPasswordUser).toHaveBeenCalledWith(expect.objectContaining({
+                email: 'newuser@example.com'
+            }));
+            expect(res.writeHead).toHaveBeenCalledWith(201, expect.any(Object));
+            expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"success":true'));
+        });
+        it('POST /api/taskforce/auth/register should only expose verificationToken when explicitly enabled', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            await withDevAuthTokenExposure('true', async () => {
+                routes = createRoutes(core, { authConfig });
+                core.registerPasswordUser.mockReturnValueOnce({
+                    userId: 'user-opt-in',
+                    workspaceId: null,
+                    role: 'member',
+                    planSelectionRequired: false
+                });
+                core.requestEmailVerification.mockReturnValueOnce({ token: 'verify-token-opt-in' });
+                const match = matchRoute('POST', '/api/taskforce/auth/register', routes);
+                const req = createMockReq('POST', '/api/taskforce/auth/register', {
+                    email: 'opt-in@example.com',
+                    password: 'password123'
+                });
+                const res = createMockRes();
+                await match?.handler(req, res, {});
+                const payload = JSON.parse(String(res.end.mock.calls.at(-1)?.[0] || '{}'));
+                expect(payload.verificationToken).toBe('verify-token-opt-in');
+            });
         });
         it('POST /api/taskforce/auth/register should allow first-time registration without workspaceId', async () => {
             const authConfig = {
@@ -3851,35 +4236,37 @@ describe('Server Routes', () => {
                 sessionSecret: 'test-secret',
                 sessionTtlSeconds: 3600
             };
-            routes = createRoutes(core, { authConfig });
-            core.hasWorkspaceAdmin.mockReturnValueOnce(true);
-            core.isEmailVerified.mockReturnValueOnce(false);
-            core.requestEmailVerification.mockReturnValueOnce({ token: 'verify-token-existing' });
-            const error = new Error('Email is already registered');
-            error.statusCode = 409;
-            error.code = 'EMAIL_ALREADY_EXISTS';
-            core.registerPasswordUser.mockImplementationOnce(() => {
-                throw error;
-            });
-            const match = matchRoute('POST', '/api/taskforce/auth/register', routes);
-            const req = createMockReq('POST', '/api/taskforce/auth/register', {
-                email: 'owner@example.com',
-                password: 'password123',
-                workspaceId: 'workspace-1'
+            await withDevAuthTokenExposure('true', async () => {
+                routes = createRoutes(core, { authConfig });
+                core.hasWorkspaceAdmin.mockReturnValueOnce(true);
+                core.isEmailVerified.mockReturnValueOnce(false);
+                core.requestEmailVerification.mockReturnValueOnce({ token: 'verify-token-existing' });
+                const error = new Error('Email is already registered');
+                error.statusCode = 409;
+                error.code = 'EMAIL_ALREADY_EXISTS';
+                core.registerPasswordUser.mockImplementationOnce(() => {
+                    throw error;
+                });
+                const match = matchRoute('POST', '/api/taskforce/auth/register', routes);
+                const req = createMockReq('POST', '/api/taskforce/auth/register', {
+                    email: 'owner@example.com',
+                    password: 'password123',
+                    workspaceId: 'workspace-1'
+                });
+                const res = createMockRes();
+                await match?.handler(req, res, {});
+                expect(core.isEmailVerified).toHaveBeenCalledWith('owner@example.com');
+                expect(core.requestEmailVerification).toHaveBeenCalledWith({ email: 'owner@example.com' });
+                expect(res.writeHead).toHaveBeenCalledWith(409, expect.any(Object));
+                const responsePayload = JSON.parse(String(res.end.mock.calls.at(-1)?.[0] || '{}'));
+                expect(responsePayload).toEqual(expect.objectContaining({
+                    success: false,
+                    code: 'EMAIL_ALREADY_EXISTS_UNVERIFIED',
+                    verificationRequired: true,
+                    emailSent: true,
+                    verificationToken: 'verify-token-existing'
+                }));
             });
-            const res = createMockRes();
-            await match?.handler(req, res, {});
-            expect(core.isEmailVerified).toHaveBeenCalledWith('owner@example.com');
-            expect(core.requestEmailVerification).toHaveBeenCalledWith({ email: 'owner@example.com' });
-            expect(res.writeHead).toHaveBeenCalledWith(409, expect.any(Object));
-            const responsePayload = JSON.parse(String(res.end.mock.calls.at(-1)?.[0] || '{}'));
-            expect(responsePayload).toEqual(expect.objectContaining({
-                success: false,
-                code: 'EMAIL_ALREADY_EXISTS_UNVERIFIED',
-                verificationRequired: true,
-                emailSent: true,
-                verificationToken: 'verify-token-existing'
-            }));
         });
         it('POST /api/taskforce/auth/register should return conflict when verified email exists', async () => {
             const authConfig = {
@@ -3952,6 +4339,124 @@ describe('Server Routes', () => {
                 code: 'SIGNUP_PLAN_VERSION_NOT_FOUND'
             }));
         });
+        it('POST /api/taskforce/auth/verify-email/request should report no-send cases without claiming delivery', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            routes = createRoutes(core, { authConfig });
+            core.requestEmailVerification.mockReturnValueOnce({});
+            const match = matchRoute('POST', '/api/taskforce/auth/verify-email/request', routes);
+            const req = createMockReq('POST', '/api/taskforce/auth/verify-email/request', { email: 'nobody@example.com' });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            const payload = JSON.parse(String(res.end.mock.calls.at(-1)?.[0] || '{}'));
+            expect(payload).toMatchObject({
+                success: true,
+                emailSent: false,
+                deliveryAttempted: false
+            });
+            expect(payload.emailError).toBeUndefined();
+        });
+        it('POST /api/taskforce/auth/verify-email/request should only expose verificationToken when explicitly enabled', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            await withDevAuthTokenExposure(undefined, async () => {
+                routes = createRoutes(core, { authConfig });
+                core.requestEmailVerification.mockReturnValueOnce({ token: 'verify-token-hidden' });
+                const match = matchRoute('POST', '/api/taskforce/auth/verify-email/request', routes);
+                const req = createMockReq('POST', '/api/taskforce/auth/verify-email/request', { email: 'owner@example.com' });
+                const res = createMockRes();
+                await match?.handler(req, res, {});
+                const payload = JSON.parse(String(res.end.mock.calls.at(-1)?.[0] || '{}'));
+                expect(payload.verificationToken).toBeUndefined();
+            });
+            await withDevAuthTokenExposure('true', async () => {
+                routes = createRoutes(core, { authConfig });
+                core.requestEmailVerification.mockReturnValueOnce({ token: 'verify-token-visible' });
+                const match = matchRoute('POST', '/api/taskforce/auth/verify-email/request', routes);
+                const req = createMockReq('POST', '/api/taskforce/auth/verify-email/request', { email: 'owner@example.com' });
+                const res = createMockRes();
+                await match?.handler(req, res, {});
+                const payload = JSON.parse(String(res.end.mock.calls.at(-1)?.[0] || '{}'));
+                expect(payload.verificationToken).toBe('verify-token-visible');
+            });
+        });
+        it('POST /api/taskforce/auth/password-reset/request should report no-send cases without claiming delivery', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            routes = createRoutes(core, { authConfig });
+            core.requestPasswordReset.mockReturnValueOnce({});
+            const match = matchRoute('POST', '/api/taskforce/auth/password-reset/request', routes);
+            const req = createMockReq('POST', '/api/taskforce/auth/password-reset/request', { email: 'nobody@example.com' });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            const payload = JSON.parse(String(res.end.mock.calls.at(-1)?.[0] || '{}'));
+            expect(payload).toMatchObject({
+                success: true,
+                emailSent: false,
+                deliveryAttempted: false
+            });
+            expect(payload.emailError).toBeUndefined();
+        });
+        it('POST /api/taskforce/auth/password-reset/request should only expose resetToken when explicitly enabled', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            await withDevAuthTokenExposure(undefined, async () => {
+                routes = createRoutes(core, { authConfig });
+                core.requestPasswordReset.mockReturnValueOnce({ token: 'reset-token-hidden' });
+                const match = matchRoute('POST', '/api/taskforce/auth/password-reset/request', routes);
+                const req = createMockReq('POST', '/api/taskforce/auth/password-reset/request', { email: 'owner@example.com' });
+                const res = createMockRes();
+                await match?.handler(req, res, {});
+                const payload = JSON.parse(String(res.end.mock.calls.at(-1)?.[0] || '{}'));
+                expect(payload.resetToken).toBeUndefined();
+            });
+            await withDevAuthTokenExposure('true', async () => {
+                routes = createRoutes(core, { authConfig });
+                core.requestPasswordReset.mockReturnValueOnce({ token: 'reset-token-visible' });
+                const match = matchRoute('POST', '/api/taskforce/auth/password-reset/request', routes);
+                const req = createMockReq('POST', '/api/taskforce/auth/password-reset/request', { email: 'owner@example.com' });
+                const res = createMockRes();
+                await match?.handler(req, res, {});
+                const payload = JSON.parse(String(res.end.mock.calls.at(-1)?.[0] || '{}'));
+                expect(payload.resetToken).toBe('reset-token-visible');
+            });
+        });
         it('POST /api/taskforce/auth/verify-email/confirm should verify token', async () => {
             const authConfig = {
                 runtimeMode: 'cloud',
@@ -4407,6 +4912,40 @@ describe('Server Routes', () => {
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"success":true'));
         });
+        it('POST /api/taskforce/auth/login should not depend on onboarding policy lookups', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            core.getOnboardingPolicy.mockImplementationOnce(() => {
+                throw new Error('for SELECT DISTINCT, ORDER BY expressions must appear in select list');
+            });
+            routes = createRoutes(core, { authConfig });
+            core.authenticatePasswordUserDetailed.mockReturnValueOnce({
+                ok: false,
+                code: 'INVALID_CREDENTIALS'
+            });
+            const match = matchRoute('POST', '/api/taskforce/auth/login', routes);
+            const req = createMockReq('POST', '/api/taskforce/auth/login', {
+                email: 'user@example.com',
+                password: 'wrongpass'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(res.writeHead).toHaveBeenCalledWith(401, expect.any(Object));
+            expect(res.end).toHaveBeenCalledWith(expect.stringContaining('Invalid email/password.'));
+            expect(core.authenticatePasswordUserDetailed).toHaveBeenCalledWith(expect.objectContaining({
+                email: 'user@example.com',
+                requireVerifiedEmail: true
+            }));
+        });
         it('GET /api/taskforce/workspaces should list authenticated user workspaces', async () => {
             const authConfig = {
                 runtimeMode: 'cloud',
@@ -5726,6 +6265,109 @@ describe('Server Routes', () => {
             ]));
             fs.rmSync(dbRoot, { recursive: true, force: true });
         });
+        it('GET /api/taskforce/sync/workspace/pull should hydrate canonical markdown documents from object storage', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            const fetchMock = vi.fn().mockResolvedValue({
+                status: 200,
+                ok: true,
+                headers: new Headers({ 'content-type': 'text/markdown' }),
+                arrayBuffer: async () => Uint8Array.from(Buffer.from('# Canonical R2 doc\n')).buffer,
+            });
+            vi.stubGlobal('fetch', fetchMock);
+            const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-sync-pull-doc-r2-'));
+            const basePath = path.join(tmpRoot, '.taskforce');
+            fs.mkdirSync(basePath, { recursive: true });
+            const { tmpRoot: dbRoot, db, store } = createWorkspaceAssetTestStore();
+            store.upsertAsset({
+                assetId: 'asset-doc-r2-1',
+                workspaceId: 'workspace-1',
+                kind: 'document',
+                originalFilename: 'canonical-r2-doc.md',
+                mimeType: 'text/markdown',
+                storageProvider: 'r2',
+                storageKey: 'workspaces/workspace-1/assets/documents/asset-doc-r2-1-canonical-r2-doc.md',
+                contentSha256: 'sha-doc-r2-1',
+                sizeBytes: 19,
+                documentId: 'doc-r2-1',
+                referenceNumber: 201,
+                version: 2,
+                isLatest: true,
+                createdAt: '2026-03-17T09:00:00.000Z',
+                updatedAt: '2026-03-17T10:00:00.000Z'
+            });
+            store.upsertLink({
+                workspaceId: 'workspace-1',
+                assetId: 'asset-doc-r2-1',
+                taskId: 'task-1',
+                role: 'attachment',
+                createdAt: '2026-03-17T10:00:00.000Z',
+                updatedAt: '2026-03-17T10:00:00.000Z'
+            });
+            core.getPaths.mockReturnValue({
+                projectRoot: tmpRoot,
+                basePath,
+            });
+            core.getDatabaseAdapter = vi.fn().mockReturnValue(db);
+            core.getTenantId = vi.fn().mockReturnValue('default');
+            routes = createRoutes(core, {
+                authConfig,
+                objectStorage: {
+                    provider: 'r2',
+                    r2: {
+                        accountId: 'acct-1',
+                        bucket: 'taskforce-docs',
+                        endpoint: 'https://example.r2.cloudflarestorage.com',
+                        accessKeyId: 'access-key-1',
+                        secretAccessKey: 'secret-key-1',
+                        keyPrefix: 'taskforce',
+                        signedUploadTtlSeconds: 600,
+                        signedDownloadTtlSeconds: 300
+                    }
+                }
+            });
+            core.listUserWorkspaces.mockReturnValueOnce([{ id: 'workspace-1', slug: 'workspace-1', name: 'Workspace 1', description: null, role: 'owner', status: 'active', betaAccess: true }]);
+            const cookie = createSessionTokenCookie('session-sync-pull-doc-r2', authConfig, {
+                role: 'owner',
+                workspaceId: 'workspace-1',
+                userId: 'user-1'
+            });
+            core.listTasks.mockReturnValueOnce({ tasks: [] });
+            core.listArchive.mockReturnValueOnce({ archived: [] });
+            const match = matchRoute('GET', '/api/taskforce/sync/workspace/pull', routes);
+            const req = createMockReq('GET', '/api/taskforce/sync/workspace/pull?workspaceId=workspace-1&limit=20', undefined, { cookie });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            const payloadRaw = res.end.mock.calls[0]?.[0];
+            const payload = JSON.parse(String(payloadRaw || '{}'));
+            expect(payload.changes).toEqual(expect.arrayContaining([
+                expect.objectContaining({
+                    op: 'document-upsert',
+                    path: 'workspaces/workspace-1/assets/documents/asset-doc-r2-1-canonical-r2-doc.md',
+                    content: '# Canonical R2 doc\n',
+                    assetId: 'asset-doc-r2-1',
+                    documentId: 'doc-r2-1',
+                    referenceNumber: 201,
+                    version: 2,
+                    taskId: 'task-1',
+                    originalFilename: 'canonical-r2-doc.md',
+                    linkRole: 'attachment'
+                })
+            ]));
+            expect(fetchMock).toHaveBeenCalled();
+            vi.unstubAllGlobals();
+            fs.rmSync(dbRoot, { recursive: true, force: true });
+            fs.rmSync(tmpRoot, { recursive: true, force: true });
+        });
         it('GET /api/taskforce/sync/workspace/pull should include document review session upserts and deletes', async () => {
             const authConfig = {
                 runtimeMode: 'cloud',