@taskforcehq/taskforce 0.3.304 → 0.3.306

package/dist/hooks/useTaskforce.js

@@ -27,7 +27,7 @@
  *   === SECTION: Navigation ===             Line ~3410 — setActiveTab, handleNavigation
  *   === SECTION: Form ===                   Line ~3489 — resetForm, handleEdit, handleSubmit, saveTask
  *   === SECTION: Task CRUD ===              Line ~3691 — handleDelete, handleUpdateTask, handleToggle*
- *   === SECTION: Task Relationships ===     Line ~4129 — parent/child link handlers
+ *   === SECTION: Planning Links ===         Line ~4129 — workstream and initiative link handlers
  *   === SECTION: Category/Type Mgmt ===     Line ~4462 — handleSaveCategory, handleRemoveCategory
  *   === SECTION: Settings Model ===         Line ~4625 — settingsModel object
  *   === SECTION: Return Value ===           Line ~4817 — final return object (public API shape)
@@ -43,6 +43,7 @@ import { DEFAULT_TYPE_VALUE } from '../shared/taxonomyDefaults.js';
 import { cloneDefaultWorkflowDefinitions } from '../shared/workflowDefaults.js';
 import { resolveClientDeploymentConfig } from '../config/clientDeployment';
 import { resolveTaskforceMcpBaseUrlFromBaseUrl } from '../config/cloudEnvironment';
+import { buildBootstrapTraceId, withBootstrapTraceHeader } from '../utils/bootstrapTrace';
 import { createDefaultAssigneeOptions } from '../utils/assignees';
 import { persistLocalMutationActorUserId, readLocalMutationActorUserId } from '../utils/taskforceApiClient';
 import { useSyncOrchestrator } from './useSyncOrchestrator';
@@ -67,6 +68,13 @@ import { useTaskforceAuthBootstrap } from './auth/useTaskforceAuthBootstrap';
 import { deriveAuthGuardPolicy } from './auth/useAuthGuardPolicy';
 import { useTaskforceWorkspaceBootstrap } from './workspace/useTaskforceWorkspaceBootstrap';
 import { useDataVersionRefresh } from './sync/useDataVersionRefresh';
+function upsertEntityById(items, nextItem) {
+    const existingIndex = items.findIndex((item) => item.id === nextItem.id);
+    if (existingIndex === -1) {
+        return [...items, nextItem];
+    }
+    return items.map((item, index) => (index === existingIndex ? nextItem : item));
+}
 const ENV_DEPLOYMENT = resolveClientDeploymentConfig(import.meta.env);
 const DEFAULT_CLOUD_APP_ORIGIN = (() => {
     const configuredBase = ENV_DEPLOYMENT.baseUrl;
@@ -82,6 +90,75 @@ const DEFAULT_CLOUD_APP_ORIGIN = (() => {
     return 'https://app.taskforcehq.ai';
 })();
 const BOOTSTRAP_REQUEST_TIMEOUT_MS = 12_000;
+const PLANNING_BOOTSTRAP_REQUEST_TIMEOUT_MS = 20_000;
+const EXPECTED_WORKSPACE_ABORT_REASONS = new Set([
+    'external-abort',
+    'superseded',
+    'workspace-reset',
+    'workspace-transition',
+]);
+function hasAbortErrorName(error) {
+    if (typeof DOMException !== 'undefined' && error instanceof DOMException) {
+        return error.name === 'AbortError';
+    }
+    return String(error?.name || '').toLowerCase() === 'aborterror';
+}
+function isExpectedWorkspaceAbortReason(reason) {
+    return typeof reason === 'string' && EXPECTED_WORKSPACE_ABORT_REASONS.has(reason);
+}
+function isExpectedWorkspaceAbortFailure(error, signal) {
+    if (!signal.aborted)
+        return false;
+    if (error === signal.reason)
+        return true;
+    if (isExpectedWorkspaceAbortReason(error) || isExpectedWorkspaceAbortReason(signal.reason))
+        return true;
+    return hasAbortErrorName(error);
+}
+function createBootstrapTimeoutError(timeoutMs) {
+    const timeoutError = new Error(`Startup checks timed out after ${timeoutMs}ms.`);
+    timeoutError.name = 'BootstrapTimeoutError';
+    return timeoutError;
+}
+function sanitizePlanningBootstrapPayload(input) {
+    const payload = input && typeof input === 'object' ? input : {};
+    const initiatives = Array.isArray(payload.initiatives)
+        ? payload.initiatives.filter((item) => Boolean(item && typeof item === 'object' && typeof item.id === 'string'))
+        : [];
+    const workstreams = Array.isArray(payload.workstreams)
+        ? payload.workstreams.filter((item) => Boolean(item && typeof item === 'object' && typeof item.id === 'string'))
+        : [];
+    const workstreamTaskSummaries = Array.isArray(payload.workstreamTaskSummaries)
+        ? payload.workstreamTaskSummaries.flatMap((entry) => {
+            if (!entry || typeof entry !== 'object')
+                return [];
+            const normalizedWorkstreamId = String(entry.workstreamId || '').trim();
+            if (!normalizedWorkstreamId)
+                return [];
+            const rawTasks = Array.isArray(entry.tasks) ? entry.tasks : [];
+            const taskCount = Math.max(0, Number(entry.taskCount) || 0);
+            const completedTaskCount = Math.max(0, Number(entry.completedTaskCount) || 0);
+            return [{
+                    workstreamId: normalizedWorkstreamId,
+                    taskCount,
+                    completedTaskCount,
+                    tasks: rawTasks
+                        .filter((task) => Boolean(task && typeof task === 'object' && typeof task.id === 'string'))
+                        .map((task) => ({
+                        id: String(task.id || '').trim(),
+                        referenceNumber: typeof task.referenceNumber === 'number' ? task.referenceNumber : null,
+                        title: String(task.title || '').trim() || 'Untitled Task',
+                        status: typeof task.status === 'string' ? task.status : null,
+                    })),
+                }];
+        })
+        : [];
+    return {
+        initiatives,
+        workstreams,
+        workstreamTaskSummaries,
+    };
+}
 export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, onClose }) {
     const mergedConfig = { ...DEFAULT_CONFIG, ...config };
     const { categories, types, apiEndpoint, apiBaseUrl, cloudAuthBaseUrl, cloudMcpBaseUrl, wsBaseUrl, shortcut: configShortcut } = mergedConfig;
@@ -131,6 +208,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
                 const workspaceMode = workspaceModeRaw === 'single-local' || workspaceModeRaw === 'multi-cloud'
                     ? workspaceModeRaw
                     : (runtimeModeHint === 'cloud' ? 'multi-cloud' : 'single-local');
+                setRuntimeMode(runtimeModeHint);
                 setRuntimeConfigOverride({
                     cloudEnvironment: typeof cfg.cloudEnvironment === 'string'
                         ? String(cfg.cloudEnvironment).trim().toLowerCase()
@@ -175,10 +253,11 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
     const propApiBaseUrl = normalizeBaseUrl(apiBaseUrl);
     const propCloudAuthBaseUrl = normalizeBaseUrl(cloudAuthBaseUrl);
     const propCloudMcpBaseUrl = normalizeBaseUrl(cloudMcpBaseUrl);
-    const explicitConfiguredApiBaseUrl = propApiBaseUrl || envApiBaseUrl || envBaseUrl;
     const runtimeResolvedApiBaseUrl = runtimeConfigOverride.apiBaseUrl || runtimeConfigOverride.baseUrl;
-    const normalizedApiBaseUrl = explicitConfiguredApiBaseUrl
+    const envConfiguredApiBaseUrl = isLoopbackHost ? '' : (envApiBaseUrl || envBaseUrl);
+    const normalizedApiBaseUrl = propApiBaseUrl
         || runtimeResolvedApiBaseUrl
+        || envConfiguredApiBaseUrl
         || '';
     const explicitConfiguredCloudAuthBaseUrl = propCloudAuthBaseUrl || envCloudAuthBaseUrl || envBaseUrl;
     const runtimeResolvedCloudAuthBaseUrl = runtimeConfigOverride.cloudAuthBaseUrl || runtimeConfigOverride.baseUrl;
@@ -206,10 +285,14 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
         || normalizedCloudAuthBaseUrl
         || defaultCloudAuthBaseUrl).trim().replace(/\/+$/, '');
     const authOnlyCloudMode = !isCloudHost && Boolean(normalizedCloudAuthBaseUrl) && !normalizedApiBaseUrl;
-    const shouldProbeCloudAuth = runtimeConfigReady && (Boolean(normalizedCloudAuthBaseUrl || normalizedApiBaseUrl) || isCloudHost);
+    // Real cloud hosts must defer protected bootstrap calls immediately, even before
+    // runtime-config finishes, or the one-shot initial bootstrap can consume itself
+    // on unauthenticated /config, /taxonomy-state, and /planning/bootstrap reads.
+    const shouldProbeCloudAuth = isCloudHost || (runtimeConfigReady && Boolean(normalizedCloudAuthBaseUrl || normalizedApiBaseUrl));
     const shouldGateProtectedApiCalls = shouldProbeCloudAuth && !authOnlyCloudMode;
     const cloudAuthConfigured = Boolean(normalizedCloudAuthBaseUrl || normalizedApiBaseUrl || isCloudHost);
     const initialRuntimeMode = isCloudHost ? 'cloud' : 'local';
+    const [runtimeMode, setRuntimeMode] = useState(() => initialRuntimeMode);
     const optimisticLocalAuthUserId = initialRuntimeMode === 'local' && isLoopbackHost && cloudAuthConfigured
         ? readLocalMutationActorUserId()
         : '';
@@ -235,8 +318,16 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
             || path.startsWith('/api/taskforce/billing/')
             || path.startsWith('/api/taskforce/sync/')
             || path.startsWith('/api/taskforce/settings/mcp/');
-        if (!isCloudHost && isCloudScopedPath && (!runtimeConfigReady || runtimeConfigOverride.cloudAuthViaLocalProxy)) {
-            return path;
+        if (!isCloudHost && isCloudScopedPath) {
+            if (runtimeMode === 'cloud') {
+                return path;
+            }
+            if (!runtimeConfigReady || runtimeConfigOverride.cloudAuthViaLocalProxy) {
+                return path;
+            }
+            if (runtimeConfigOverride.workspaceMode === 'multi-cloud') {
+                return path;
+            }
         }
         const base = normalizedCloudAuthBaseUrl || normalizedApiBaseUrl;
         if (base) {
@@ -258,7 +349,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
         if (!isCloudHost && isCloudScopedPath)
             return path;
         return path;
-    }, [runtimeConfigReady, runtimeConfigOverride.cloudAuthViaLocalProxy, normalizedCloudAuthBaseUrl, normalizedApiBaseUrl, isCloudHost]);
+    }, [runtimeConfigReady, runtimeConfigOverride.cloudAuthViaLocalProxy, runtimeConfigOverride.workspaceMode, normalizedCloudAuthBaseUrl, normalizedApiBaseUrl, isCloudHost, runtimeMode]);
     const resolveWebSocketUrl = useCallback((path) => {
         const wsPath = String(path || '').trim() || '/taskforce-ws';
         const normalizedPath = wsPath.startsWith('/') ? wsPath : `/${wsPath}`;
@@ -308,7 +399,6 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
     }), [projectRoot, initialRuntimeMode]);
     const [mcpScriptPath, setMcpScriptPath] = useState('');
     const [tenantId, setTenantId] = useState('');
-    const [runtimeMode, setRuntimeMode] = useState(() => initialRuntimeMode);
     const runtimeContractFallback = resolveRuntimeModeContract(runtimeMode);
     const workspaceMode = runtimeConfigOverride.workspaceMode === 'single-local' || runtimeConfigOverride.workspaceMode === 'multi-cloud'
         ? runtimeConfigOverride.workspaceMode
@@ -323,6 +413,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
     const [authWorkspaceId, setAuthWorkspaceId] = useState('');
     const [authUserEmail, setAuthUserEmail] = useState('');
     const [authUserDisplayName, setAuthUserDisplayName] = useState('');
+    const [availableAuthProviders, setAvailableAuthProviders] = useState([]);
     const [authUserAvatarUrl, setAuthUserAvatarUrl] = useState('');
     const [hasBetaAccess, setHasBetaAccess] = useState(true);
     const [hydratedWorkspaceRole, setHydratedWorkspaceRole] = useState(null);
@@ -353,6 +444,12 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
     const currentWorkspaceIdRef = useRef(currentWorkspaceId);
     const explicitWorkspaceSelectionRef = useRef(null);
     const workspaceTransitionEpochRef = useRef(0);
+    const bootstrapTraceSeedRef = useRef((() => {
+        const randomPart = typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function'
+            ? crypto.randomUUID()
+            : `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+        return randomPart.replace(/[^A-Za-z0-9_-]+/g, '').slice(0, 12) || 'session';
+    })());
     const [workspaceTransitionEpoch, setWorkspaceTransitionEpoch] = useState(0);
     const bootstrapConfigAbortRef = useRef(null);
     const referenceDataAbortRef = useRef(null);
@@ -360,6 +457,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
     const assigneeOptionsAbortRef = useRef(null);
     const deletedTasksAbortRef = useRef(null);
     const planningEntitiesAbortRef = useRef(null);
+    const planningEntitiesRetryTimerRef = useRef(null);
     const commitCurrentWorkspaceId = useCallback((nextWorkspaceIdRaw, options) => {
         const nextWorkspaceId = String(nextWorkspaceIdRaw || '').trim();
         if (!nextWorkspaceId)
@@ -404,9 +502,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
         return workspaceTransitionEpochRef.current !== requestState.epoch;
     }, []);
     const isAbortError = useCallback((error) => {
-        return error instanceof DOMException
-            ? error.name === 'AbortError'
-            : String(error?.name || '').toLowerCase() === 'aborterror';
+        return hasAbortErrorName(error) || isExpectedWorkspaceAbortReason(error);
     }, []);
     const abortWorkspaceScopedRequests = useCallback(() => {
         [
@@ -420,6 +516,10 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
             ref.current?.abort('workspace-transition');
             ref.current = null;
         });
+        if (planningEntitiesRetryTimerRef.current !== null && typeof window !== 'undefined') {
+            window.clearTimeout(planningEntitiesRetryTimerRef.current);
+            planningEntitiesRetryTimerRef.current = null;
+        }
         referenceDataRequestRef.current = null;
     }, []);
     // Local runtime APIs must stay available immediately on app start, even when cloud
@@ -499,6 +599,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
     const [archivedTasks, setArchivedTasks] = useState([]);
     const [initiatives, setInitiatives] = useState([]);
     const [workstreams, setWorkstreams] = useState([]);
+    const [planningBootstrapTaskSummaries, setPlanningBootstrapTaskSummaries] = useState([]);
     const [deletedTasks, setDeletedTasks] = useState([]);
     const [loadingTasks, setLoadingTasks] = useState(false);
     const [editingTaskId, setEditingTaskId] = useState(null);
@@ -540,6 +641,14 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
         const abortController = new AbortController();
         const externalSignal = options?.signal;
         const timeoutLabel = Number(timeoutMs) > 0 ? Number(timeoutMs) : BOOTSTRAP_REQUEST_TIMEOUT_MS;
+        const requestState = getWorkspaceRequestState();
+        const tracedInit = url.startsWith('/api/taskforce/')
+            ? withBootstrapTraceHeader(init, buildBootstrapTraceId({
+                workspaceId: requestState.workspaceId,
+                epoch: requestState.epoch,
+                seed: bootstrapTraceSeedRef.current,
+            }))
+            : init;
         const timerId = typeof window !== 'undefined'
             ? window.setTimeout(() => abortController.abort('bootstrap-timeout'), timeoutLabel)
             : null;
@@ -556,18 +665,16 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
         }
         try {
             return await fetch(url, {
-                ...(init || {}),
+                ...(tracedInit || {}),
                 signal: abortController.signal
             });
         }
         catch (error) {
-            const isAbortError = error instanceof DOMException
-                ? error.name === 'AbortError'
-                : String(error?.name || '').toLowerCase() === 'aborterror';
-            if (isAbortError) {
-                const timeoutError = new Error(`Startup checks timed out after ${timeoutLabel}ms.`);
-                timeoutError.name = 'BootstrapTimeoutError';
-                throw timeoutError;
+            if (externalSignal?.aborted && isExpectedWorkspaceAbortFailure(error, externalSignal)) {
+                throw externalSignal.reason || error;
+            }
+            if (hasAbortErrorName(error) || error === 'bootstrap-timeout') {
+                throw createBootstrapTimeoutError(timeoutLabel);
             }
             throw error;
         }
@@ -579,7 +686,50 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
                 window.clearTimeout(timerId);
             }
         }
-    }, []);
+    }, [getWorkspaceRequestState]);
+    const bootstrapState = useMemo(() => {
+        const authPending = !authSessionResolved;
+        const stalled = bootstrapPhase === 'stalled';
+        const appPending = authSessionResolved && (!configLoaded || workspaceBootstrapPending || stalled);
+        let subtitle = 'Checking account, workspace access, and setup status...';
+        if (bootstrapPhase === 'auth') {
+            subtitle = 'Verifying session...';
+        }
+        else if (bootstrapPhase === 'workspace') {
+            subtitle = 'Resolving workspace access...';
+        }
+        else if (bootstrapPhase === 'config') {
+            subtitle = 'Loading configuration...';
+        }
+        return {
+            phase: bootstrapPhase,
+            auth: {
+                resolved: authSessionResolved,
+                pending: authPending
+            },
+            config: {
+                loaded: configLoaded
+            },
+            workspace: {
+                pending: workspaceBootstrapPending
+            },
+            pending: authPending || appPending,
+            authPending,
+            appPending,
+            ready: authSessionResolved && configLoaded && !workspaceBootstrapPending && bootstrapPhase === 'ready',
+            stalled,
+            subtitle,
+            error: bootstrapError,
+            startedAt: bootstrapStartedAt
+        };
+    }, [
+        authSessionResolved,
+        bootstrapError,
+        bootstrapPhase,
+        bootstrapStartedAt,
+        configLoaded,
+        workspaceBootstrapPending
+    ]);
     const isBootstrapTimeoutError = useCallback((error) => {
         return String(error?.name || '') === 'BootstrapTimeoutError';
     }, []);
@@ -648,7 +798,6 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
     useEffect(() => {
         if (workspaceTransitionEpoch === 0)
             return;
-        abortWorkspaceScopedRequests();
         referenceDataRequestRef.current = null;
         lastLoadedUiStateKeyRef.current = '';
         lastAssigneeOptionsLoadKeyRef.current = '';
@@ -663,8 +812,6 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
         setDeletedTasks([]);
         setTasks([]);
         setArchivedTasks([]);
-        setInitiatives([]);
-        setWorkstreams([]);
         setLoadingTasks(false);
         if (cloudRealtimeFollowUpRefreshTimerRef.current !== null && typeof window !== 'undefined') {
             window.clearTimeout(cloudRealtimeFollowUpRefreshTimerRef.current);
@@ -674,7 +821,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
             window.clearTimeout(archiveBootstrapTimerRef.current);
             archiveBootstrapTimerRef.current = null;
         }
-    }, [abortWorkspaceScopedRequests, setArchivedTasks, setLoadingTasks, setTasks, workspaceTransitionEpoch]);
+    }, [setArchivedTasks, setLoadingTasks, setTasks, workspaceTransitionEpoch]);
     const fetchDeletedTasks = useCallback(async (isSilent = false, options) => {
         const ignoreAuthGuard = options?.ignoreAuthGuard === true;
         if (!ignoreAuthGuard && (shouldDeferProtectedApiCalls || shouldBlockProtectedApiCalls))
@@ -722,7 +869,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
             }
         }
         catch (err) {
-            if (isAbortError(err))
+            if (isExpectedWorkspaceAbortFailure(err, abortController.signal) || isAbortError(err))
                 return;
             console.error('[Taskforce] Failed to fetch deleted tasks:', err);
         }
@@ -746,37 +893,105 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
         if (!ignoreAuthGuard && (shouldDeferProtectedApiCalls || shouldBlockProtectedApiCalls))
             return;
         const requestState = getWorkspaceRequestState();
+        planningEntitiesAbortRef.current?.abort('superseded');
+        if (planningEntitiesRetryTimerRef.current !== null && typeof window !== 'undefined') {
+            window.clearTimeout(planningEntitiesRetryTimerRef.current);
+            planningEntitiesRetryTimerRef.current = null;
+        }
         const abortController = new AbortController();
         planningEntitiesAbortRef.current = abortController;
         try {
-            const [initiativesRes, workstreamsRes] = await Promise.all([
-                fetch('/api/taskforce/initiatives', { signal: abortController.signal }),
-                fetch('/api/taskforce/workstreams', { signal: abortController.signal }),
-            ]);
-            if (initiativesRes.status === 401 || workstreamsRes.status === 401) {
+            const planningTraceId = buildBootstrapTraceId({
+                workspaceId: requestState.workspaceId,
+                epoch: requestState.epoch,
+                seed: bootstrapTraceSeedRef.current,
+            });
+            const fetchPlanningRoute = async (url) => {
+                if (typeof window === 'undefined') {
+                    return fetch(url, withBootstrapTraceHeader({ signal: abortController.signal }, planningTraceId));
+                }
+                const timeoutController = new AbortController();
+                const timerId = window.setTimeout(() => timeoutController.abort('planning-timeout'), PLANNING_BOOTSTRAP_REQUEST_TIMEOUT_MS);
+                const onAbort = () => timeoutController.abort(abortController.signal.reason || 'external-abort');
+                if (abortController.signal.aborted) {
+                    onAbort();
+                }
+                else {
+                    abortController.signal.addEventListener('abort', onAbort, { once: true });
+                }
+                try {
+                    return await fetch(url, withBootstrapTraceHeader({ signal: timeoutController.signal }, planningTraceId));
+                }
+                catch (error) {
+                    if (abortController.signal.aborted)
+                        throw abortController.signal.reason || error;
+                    if (hasAbortErrorName(error) || error === 'planning-timeout') {
+                        return null;
+                    }
+                    throw error;
+                }
+                finally {
+                    window.clearTimeout(timerId);
+                    abortController.signal.removeEventListener('abort', onAbort);
+                }
+            };
+            let bootstrapPayload = null;
+            const bootstrapRes = await fetchPlanningRoute('/api/taskforce/planning/bootstrap');
+            if (bootstrapRes?.status === 401) {
                 handleUnauthorized();
                 setInitiatives([]);
                 setWorkstreams([]);
+                setPlanningBootstrapTaskSummaries([]);
                 return;
             }
-            const [initiativesData, workstreamsData] = await Promise.all([
-                initiativesRes.ok ? initiativesRes.json().catch(() => []) : [],
-                workstreamsRes.ok ? workstreamsRes.json().catch(() => []) : [],
-            ]);
+            if (bootstrapRes?.ok) {
+                bootstrapPayload = sanitizePlanningBootstrapPayload(await bootstrapRes.json().catch(() => ({})));
+            }
+            else {
+                const [initiativesRes, workstreamsRes] = await Promise.all([
+                    fetchPlanningRoute('/api/taskforce/initiatives'),
+                    fetchPlanningRoute('/api/taskforce/workstreams'),
+                ]);
+                if (!initiativesRes || !workstreamsRes) {
+                    throw new Error('Planning endpoints timed out during startup.');
+                }
+                if (initiativesRes.status === 401 || workstreamsRes.status === 401) {
+                    handleUnauthorized();
+                    setInitiatives([]);
+                    setWorkstreams([]);
+                    setPlanningBootstrapTaskSummaries([]);
+                    return;
+                }
+                const [initiativesData, workstreamsData] = await Promise.all([
+                    initiativesRes.ok ? initiativesRes.json().catch(() => []) : [],
+                    workstreamsRes.ok ? workstreamsRes.json().catch(() => []) : [],
+                ]);
+                bootstrapPayload = sanitizePlanningBootstrapPayload({
+                    initiatives: initiativesData,
+                    workstreams: workstreamsData,
+                    workstreamTaskSummaries: [],
+                });
+            }
             if (isWorkspaceRequestStale(requestState)) {
                 return;
             }
-            setInitiatives(Array.isArray(initiativesData)
-                ? initiativesData.filter((item) => Boolean(item && typeof item === 'object' && typeof item.id === 'string'))
-                : []);
-            setWorkstreams(Array.isArray(workstreamsData)
-                ? workstreamsData.filter((item) => Boolean(item && typeof item === 'object' && typeof item.id === 'string'))
-                : []);
+            setInitiatives(bootstrapPayload.initiatives);
+            setWorkstreams(bootstrapPayload.workstreams);
+            setPlanningBootstrapTaskSummaries(bootstrapPayload.workstreamTaskSummaries);
         }
         catch (err) {
-            if (isAbortError(err))
+            if (isExpectedWorkspaceAbortFailure(err, abortController.signal) || isAbortError(err))
                 return;
             console.error('[Taskforce] Failed to fetch planning entities:', err);
+            if (typeof window !== 'undefined'
+                && !isWorkspaceRequestStale(requestState)
+                && initiatives.length === 0
+                && workstreams.length === 0) {
+                planningEntitiesRetryTimerRef.current = window.setTimeout(() => {
+                    planningEntitiesRetryTimerRef.current = null;
+                    void fetchPlanningEntities(options);
+                }, 3000);
+            }
         }
         finally {
             if (planningEntitiesAbortRef.current === abortController) {
@@ -784,12 +999,16 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
             }
         }
     }, [
+        BOOTSTRAP_REQUEST_TIMEOUT_MS,
+        PLANNING_BOOTSTRAP_REQUEST_TIMEOUT_MS,
+        initiatives.length,
         getWorkspaceRequestState,
         handleUnauthorized,
         isAbortError,
         isWorkspaceRequestStale,
         shouldDeferProtectedApiCalls,
         shouldBlockProtectedApiCalls,
+        workstreams.length,
     ]);
     const fetchTasks = useCallback(async (isSilent = false, options) => {
         await fetchTasksBase(isSilent, options);
@@ -815,7 +1034,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
     const setUserGlobalSyncErrorRef = useRef(() => undefined);
     const checkAuthSessionImplRef = useRef(async () => false);
     const checkAuthSession = useCallback((options) => checkAuthSessionImplRef.current(options), []);
-    const { userGlobalSyncStatus, setUserGlobalSyncStatus, userGlobalSyncError, setUserGlobalSyncError, workspaceLastPullAt, workspaceLastPushAt, workspaceLastErrorAt, workspaceLastErrorMessage, workspaceLastSuccessfulSyncAt, workspaceCloudSyncEnabled, workspaceSyncPhase, workspaceSyncStatus, workspaceSyncSummary, workspaceSyncRecommendedAction, workspaceSyncBusy, workspaceSyncPendingChanges, workspacePushInFlightRef, workspacePullInFlightRef, workspaceLastPushedSignatureRef, workspacePendingSignatureRef, workspaceLastPushedTaskIdsRef, workspaceDeletedTaskIdsRef, workspacePullCursorRef, clearWorkspaceRetry, persistWorkspaceSyncPatch, loadWorkspaceSyncState, applyWorkspaceSyncStateSnapshot, syncUserGlobalSettings, buildWorkspaceSyncSignature, pushWorkspaceChangesToCloud, saveWorkspaceCloudSyncSettings, retryUserGlobalSettingsSync, retryWorkspaceCloudSync, resetWorkspaceSyncCursorAndPull, getWorkspaceSyncDiagnostics } = useSyncOrchestrator({
+    const { userGlobalSyncStatus, setUserGlobalSyncStatus, userGlobalSyncError, setUserGlobalSyncError, workspaceLastPullAt, workspaceLastPushAt, workspaceLastErrorAt, workspaceLastErrorMessage, workspaceLastSuccessfulSyncAt, workspaceCloudSyncEnabled, workspaceSyncPhase, workspaceSyncSetupIntent, workspaceSyncStatus, workspaceSyncSummary, workspaceSyncRecommendedAction, workspaceSyncBusy, workspaceSyncPendingChanges, workspacePushInFlightRef, workspacePullInFlightRef, workspaceLastPushedSignatureRef, workspacePendingSignatureRef, workspaceLastPushedTaskIdsRef, workspaceDeletedTaskIdsRef, workspaceDeletedTaskWatermarksRef, workspacePullCursorRef, clearWorkspaceRetry, persistWorkspaceSyncPatch, loadWorkspaceSyncState, applyWorkspaceSyncStateSnapshot, syncUserGlobalSettings, buildWorkspaceSyncSignature, pushWorkspaceChangesToCloud, saveWorkspaceCloudSyncSettings, retryUserGlobalSettingsSync, retryWorkspaceCloudSync, resetWorkspaceSyncCursorAndPull, getWorkspaceSyncDiagnostics } = useSyncOrchestrator({
         currentWorkspaceId,
         cloudAuthConfigured,
         runtimeMode,
@@ -828,6 +1047,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
         realtimeSyncEnabled,
         tasks,
         archivedTasks,
+        deletedTasks,
         initiatives,
         workstreams,
         taxonomies,
@@ -1317,7 +1537,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
             }
         }
     }, [fetchWithTimeout, isBootstrapTimeoutError, markBootstrapStalled]);
-    const { fetchReferenceData, fetchBootstrapConfig, fetchConfig, fetchWorkspaces, fetchAssigneeOptions, switchWorkspace, resolveWorkspaceAfterAuth, retryBootstrapChecks } = useTaskforceWorkspaceBootstrap({
+    const { fetchReferenceData, fetchBootstrapConfig, fetchConfig, fetchWorkspaces, fetchAssigneeOptions, switchWorkspace, resolveWorkspaceAfterAuth, retryBootstrapChecks, runCloudBootstrap } = useTaskforceWorkspaceBootstrap({
         shouldDeferProtectedApiCalls,
         shouldBlockProtectedApiCalls,
         getWorkspaceRequestState,
@@ -1357,6 +1577,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
         authSessionResolved,
         isAuthenticated,
         authUserId,
+        authUserAvatarUrl,
         setHydratedWorkspaceRole,
         setAssigneeOptions,
         setAssigneeOptionsLoaded,
@@ -1382,6 +1603,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
         showArchive,
         taskScope,
         settingsSection,
+        workspaceBootstrapPending,
         fetchTasks,
         fetchArchive,
         fetchPlanningEntities,
@@ -1397,12 +1619,35 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
     useEffect(() => {
         if (!configLoaded || workspaceBootstrapPending)
             return;
-        const loadKey = `${runtimeMode}:${isAuthenticated ? 'auth' : 'guest'}:${currentWorkspaceId}`;
+        const loadKey = `${runtimeMode}:${isAuthenticated ? 'auth' : 'guest'}:${currentWorkspaceId}:${authUserAvatarUrl || 'no-avatar'}`;
         if (assigneeOptionsLoaded && lastAssigneeOptionsLoadKeyRef.current === loadKey)
             return;
         lastAssigneeOptionsLoadKeyRef.current = loadKey;
         void fetchAssigneeOptions();
-    }, [assigneeOptionsLoaded, configLoaded, currentWorkspaceId, fetchAssigneeOptions, isAuthenticated, runtimeMode, workspaceBootstrapPending]);
+    }, [assigneeOptionsLoaded, authUserAvatarUrl, configLoaded, currentWorkspaceId, fetchAssigneeOptions, isAuthenticated, runtimeMode, workspaceBootstrapPending]);
+    useEffect(() => {
+        if (!authSessionResolved || !isAuthenticated)
+            return;
+        const normalizedAuthUserId = String(authUserId || '').trim();
+        if (!normalizedAuthUserId || normalizedAuthUserId === 'anonymous')
+            return;
+        const nextAvatarUrl = String(authUserAvatarUrl || '').trim() || null;
+        setAssigneeOptions((previous) => {
+            let changed = false;
+            const next = previous.map((option) => {
+                if (option.kind !== 'member' || String(option.value || '').trim() !== normalizedAuthUserId)
+                    return option;
+                const currentAvatarUrl = typeof option.avatarUrl === 'string' && option.avatarUrl.trim().length > 0
+                    ? option.avatarUrl.trim()
+                    : null;
+                if (currentAvatarUrl === nextAvatarUrl)
+                    return option;
+                changed = true;
+                return { ...option, avatarUrl: nextAvatarUrl };
+            });
+            return changed ? next : previous;
+        });
+    }, [authSessionResolved, authUserAvatarUrl, authUserId, isAuthenticated]);
     const currentWorkspaceRole = useMemo(() => {
         if (workspaceSwitchingEnabled) {
             const current = availableWorkspaces.find((workspace) => workspace.id === currentWorkspaceId);
@@ -1417,44 +1662,86 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
     }, [isAuthenticated]);
     const continueAfterCommercialOnboarding = useCallback(async () => {
         setBootstrapError(null);
-        markBootstrapPhase('auth');
-        const authenticated = await checkAuthSession({ force: true });
-        if (!authenticated) {
-            await fetchConfig({ ignoreAuthGuard: true });
-            return { success: false, destination: 'login', error: 'Sign in required.', code: 'AUTH_REQUIRED' };
+        const result = await runCloudBootstrap({
+            reason: 'post-plans',
+            ignoreAuthGuard: true,
+            tasksSilent: true,
+            includeDeferredArchive: false
+        });
+        if (!result.authenticated) {
+            return { success: false, destination: 'login', error: result.error || 'Sign in required.', code: result.code || 'AUTH_REQUIRED' };
         }
-        if (workspaceSwitchingEnabled) {
-            const workspaceResolution = await resolveWorkspaceAfterAuth();
+        if (!result.success) {
+            return {
+                success: false,
+                destination: 'app',
+                error: result.error || 'Unable to resolve workspace after plan selection.',
+                code: result.code
+            };
+        }
+        if (result.workspaceSetupRequired) {
+            return { success: true, destination: 'setup' };
+        }
+        return { success: true, destination: 'app' };
+    }, [
+        runCloudBootstrap
+    ]);
+    const resolvePostAuthCloudEntry = useCallback(async (options) => {
+        const reason = options?.reason || 'retry';
+        const preferredWorkspaceId = typeof options?.preferredWorkspaceId === 'string' ? options.preferredWorkspaceId.trim() : '';
+        const allowCommercialGate = options?.allowCommercialGate === true;
+        if (preferredWorkspaceId && workspaceSwitchingEnabled) {
+            const authenticated = await checkAuthSession({ force: true });
+            if (!authenticated) {
+                await fetchConfig({ ignoreAuthGuard: true });
+                return { success: false, error: 'Sign in required.', code: 'AUTH_REQUIRED' };
+            }
+            const workspaceResolution = await resolveWorkspaceAfterAuth({ preferredWorkspaceId });
             if (!workspaceResolution.success) {
                 await fetchConfig({ ignoreAuthGuard: true });
                 return {
                     success: false,
-                    destination: 'app',
-                    error: workspaceResolution.error || 'Unable to resolve workspace after plan selection.',
+                    error: workspaceResolution.error || 'Unable to resolve workspace access.',
                     code: workspaceResolution.code
                 };
             }
             if (workspaceResolution.workspaceSetupRequired) {
                 await fetchConfig({ ignoreAuthGuard: true });
-                return { success: true, destination: 'setup' };
+                return { success: true, workspaceSetupRequired: true };
             }
         }
-        await fetchBootstrapConfig();
-        await Promise.all([
-            fetchTasks(true, { ignoreAuthGuard: true }),
-            fetchReferenceData(),
-            fetchPlanningEntities()
-        ]);
-        return { success: true, destination: 'app' };
+        const result = await runCloudBootstrap({
+            reason,
+            ignoreAuthGuard: true,
+            tasksSilent: true,
+            includeDeferredArchive: false
+        });
+        if (!result.authenticated) {
+            return { success: false, error: result.error || 'Sign in required.', code: result.code || 'AUTH_REQUIRED' };
+        }
+        if (!result.success) {
+            return {
+                success: false,
+                error: result.error || 'Unable to resolve workspace access.',
+                code: result.code
+            };
+        }
+        if (result.workspaceSetupRequired) {
+            if (allowCommercialGate) {
+                return { success: true, workspaceSetupRequired: false };
+            }
+            return { success: true, workspaceSetupRequired: true };
+        }
+        if (!allowCommercialGate) {
+            void syncUserGlobalSettings({ preferCloudOnFirstSync: true });
+        }
+        return { success: true, workspaceSetupRequired: false };
     }, [
         checkAuthSession,
-        fetchBootstrapConfig,
         fetchConfig,
-        fetchPlanningEntities,
-        fetchReferenceData,
-        fetchTasks,
-        markBootstrapPhase,
         resolveWorkspaceAfterAuth,
+        runCloudBootstrap,
+        syncUserGlobalSettings,
         workspaceSwitchingEnabled
     ]);
     const createWorkspace = useCallback(async (name, description) => {
@@ -1615,30 +1902,34 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
                 return { success: false, error: data?.error || 'Sign in failed.', code: data?.code };
             }
             setError('');
-            await checkAuthSession({ force: true });
-            const workspaceResolution = await resolveWorkspaceAfterAuth();
-            if (!workspaceResolution.success) {
-                return {
-                    success: false,
-                    error: workspaceResolution.error || 'Unable to resolve workspace after sign in.',
-                    code: workspaceResolution.code
-                };
-            }
-            if (workspaceResolution.workspaceSetupRequired) {
-                await fetchConfig({ ignoreAuthGuard: true });
-                return { success: true, workspaceSetupRequired: true };
+            const entry = await resolvePostAuthCloudEntry();
+            if (!entry.success) {
+                return { success: false, error: entry.error || 'Unable to resolve workspace after sign in.', code: entry.code };
             }
-            await Promise.all([
-                fetchConfig({ ignoreAuthGuard: true }),
-                fetchTasks(true, { ignoreAuthGuard: true })
-            ]);
-            void syncUserGlobalSettings({ preferCloudOnFirstSync: true });
-            return { success: true };
+            return { success: true, workspaceSetupRequired: entry.workspaceSetupRequired === true };
         }
         catch {
             return { success: false, error: 'Sign in failed.' };
         }
-    }, [checkAuthSession, fetchConfig, fetchTasks, resolveWorkspaceAfterAuth, syncUserGlobalSettings, resolveCloudAuthUrl, cloudAuthConfigured]);
+    }, [resolveCloudAuthUrl, cloudAuthConfigured, resolvePostAuthCloudEntry]);
+    /**
+     * Initiates an OAuth login (or invite-claim) flow by redirecting the browser
+     * to the provider's authorisation URL via the server-side start route.
+     *
+     * @param provider   - 'google' | 'github' | 'apple'
+     * @param returnTo   - Optional relative path to redirect back to after auth (defaults to '/').
+     * @param inviteToken - Optional invite token; when provided the flow uses `invite_claim` mode.
+     */
+    const beginOAuthLogin = useCallback((provider, returnTo, inviteToken) => {
+        const sanitizedReturnTo = returnTo && /^\/[A-Za-z0-9_\-./?=&%]*$/.test(returnTo)
+            ? returnTo
+            : '/';
+        let path = `/api/taskforce/auth/oauth/${encodeURIComponent(provider)}/start?return_to=${encodeURIComponent(sanitizedReturnTo)}`;
+        if (inviteToken) {
+            path += `&invite_token=${encodeURIComponent(inviteToken)}`;
+        }
+        window.location.href = resolveCloudAuthUrl(path);
+    }, [resolveCloudAuthUrl]);
     const registerWithCredentials = useCallback(async (email, password, options) => {
         if (!cloudAuthConfigured) {
             return { success: false, error: 'Cloud auth endpoint is not configured.' };
@@ -1688,32 +1979,42 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
             const verificationRequired = Boolean(data?.verificationRequired);
             if (!verificationRequired) {
                 setError('');
-                await checkAuthSession({ force: true });
-                const workspaceResolution = await resolveWorkspaceAfterAuth();
-                if (!workspaceResolution.success) {
-                    return {
-                        success: false,
-                        error: workspaceResolution.error || 'Unable to resolve workspace after registration.',
-                        code: workspaceResolution.code
-                    };
-                }
                 const hasCommercialOnboardingGate = Boolean(planSelectionRequired
                     || checkoutPending
                     || commercialState === 'pending_plan_selection'
                     || commercialState === 'checkout_pending');
-                if (workspaceResolution.workspaceSetupRequired || hasCommercialOnboardingGate) {
-                    await fetchConfig({ ignoreAuthGuard: true });
+                if (hasCommercialOnboardingGate) {
+                    const authenticated = await checkAuthSession({ force: true });
+                    if (!authenticated) {
+                        return {
+                            success: false,
+                            error: 'Unable to resolve workspace after registration.',
+                            code: 'AUTH_REQUIRED'
+                        };
+                    }
+                    return {
+                        success: true,
+                        workspaceSetupRequired: false,
+                        planSelectionRequired,
+                        checkoutPending,
+                        commercialState,
+                        verificationRequired,
+                        verificationToken: typeof data?.verificationToken === 'string' ? data.verificationToken : undefined,
+                        emailSent: data?.emailSent !== false,
+                        emailError: typeof data?.emailError === 'string' ? data.emailError : undefined
+                    };
                 }
-                else {
-                    await Promise.all([
-                        fetchConfig({ ignoreAuthGuard: true }),
-                        fetchTasks(true, { ignoreAuthGuard: true })
-                    ]);
-                    void syncUserGlobalSettings({ preferCloudOnFirstSync: true });
+                const entry = await resolvePostAuthCloudEntry({ allowCommercialGate: false });
+                if (!entry.success) {
+                    return {
+                        success: false,
+                        error: entry.error || 'Unable to resolve workspace after registration.',
+                        code: entry.code
+                    };
                 }
                 return {
                     success: true,
-                    workspaceSetupRequired: workspaceResolution.workspaceSetupRequired,
+                    workspaceSetupRequired: entry.workspaceSetupRequired === true,
                     planSelectionRequired,
                     checkoutPending,
                     commercialState,
@@ -1738,7 +2039,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
         catch {
             return { success: false, error: 'Create account failed.' };
         }
-    }, [checkAuthSession, fetchConfig, fetchTasks, resolveWorkspaceAfterAuth, syncUserGlobalSettings, resolveCloudAuthUrl, cloudAuthConfigured]);
+    }, [checkAuthSession, resolveCloudAuthUrl, cloudAuthConfigured, resolvePostAuthCloudEntry]);
     const updateCurrentUserProfile = useCallback(async (input) => {
         if (!cloudAuthConfigured) {
             return { success: false, error: 'Cloud auth endpoint is not configured.' };
@@ -1800,6 +2101,8 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
                 success: true,
                 verificationToken: data?.verificationToken ?? null,
                 emailSent: data?.emailSent !== false,
+                deliveryAttempted: data?.deliveryAttempted === true
+                    || (typeof data?.verificationToken === 'string' && data.verificationToken.trim().length > 0),
                 emailError: typeof data?.emailError === 'string' ? data.emailError : undefined
             };
         }
@@ -1853,6 +2156,8 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
                 success: true,
                 resetToken: data?.resetToken ?? null,
                 emailSent: data?.emailSent !== false,
+                deliveryAttempted: data?.deliveryAttempted === true
+                    || (typeof data?.resetToken === 'string' && data.resetToken.trim().length > 0),
                 emailError: typeof data?.emailError === 'string' ? data.emailError : undefined
             };
         }
@@ -1915,7 +2220,9 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
                 email: typeof data?.email === 'string' ? data.email : undefined,
                 workspaceId: typeof data?.workspaceId === 'string' ? data.workspaceId : undefined,
                 inviteeKind: data?.inviteeKind === 'existing_user' ? 'existing_user' : 'new_user',
-                passwordRequired: data?.passwordRequired === true
+                passwordRequired: data?.passwordRequired === true,
+                inviteeState: data?.inviteeState === 'existing_account' ? 'existing_account' : 'pending_setup',
+                availableMethods: Array.isArray(data?.availableMethods) ? data.availableMethods : []
             };
         }
         catch {
@@ -1943,30 +2250,30 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
                 return { success: false, error: data?.error || 'Invite acceptance failed.', code: data?.code };
             }
             setError('');
-            await checkAuthSession({ force: true });
             const preferredWorkspaceId = typeof data?.workspaceId === 'string' ? data.workspaceId : null;
-            const workspaceResolution = await resolveWorkspaceAfterAuth({ preferredWorkspaceId });
-            if (!workspaceResolution.success) {
-                return {
-                    success: false,
-                    error: workspaceResolution.error || 'Unable to resolve workspace after invite acceptance.',
-                    code: workspaceResolution.code
-                };
+            if (preferredWorkspaceId && workspaceSwitchingEnabled) {
+                const switched = await switchWorkspace(preferredWorkspaceId, { hydrate: false });
+                if (!switched.success) {
+                    return {
+                        success: false,
+                        error: switched.error || 'Unable to resolve workspace after invite acceptance.',
+                        code: switched.code
+                    };
+                }
             }
-            if (workspaceResolution.workspaceSetupRequired) {
-                return { success: true, workspaceSetupRequired: true };
+            const entry = await resolvePostAuthCloudEntry();
+            if (!entry.success) {
+                return { success: false, error: entry.error || 'Unable to resolve workspace after invite acceptance.', code: entry.code };
             }
-            await Promise.all([
-                fetchConfig({ ignoreAuthGuard: true }),
-                fetchTasks(true, { ignoreAuthGuard: true })
-            ]);
-            void syncUserGlobalSettings({ preferCloudOnFirstSync: true });
-            return { success: true };
+            if (preferredWorkspaceId && currentWorkspaceIdRef.current !== preferredWorkspaceId) {
+                commitCurrentWorkspaceId(preferredWorkspaceId, { clearExplicitSelection: false });
+            }
+            return { success: true, workspaceSetupRequired: entry.workspaceSetupRequired === true };
         }
         catch {
             return { success: false, error: 'Invite acceptance failed.' };
         }
-    }, [checkAuthSession, fetchConfig, fetchTasks, resolveWorkspaceAfterAuth, syncUserGlobalSettings, resolveCloudAuthUrl, cloudAuthConfigured]);
+    }, [commitCurrentWorkspaceId, resolveCloudAuthUrl, cloudAuthConfigured, currentWorkspaceIdRef, resolvePostAuthCloudEntry, switchWorkspace, workspaceSwitchingEnabled]);
     const joinInviteWithToken = useCallback(async (token) => {
         if (!cloudAuthConfigured) {
             return { success: false, error: 'Cloud auth endpoint is not configured.' };
@@ -1987,30 +2294,93 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
                 return { success: false, error: data?.error || 'Invite join failed.', code: data?.code };
             }
             setError('');
-            await checkAuthSession();
             const preferredWorkspaceId = typeof data?.workspaceId === 'string' ? data.workspaceId : null;
-            const workspaceResolution = await resolveWorkspaceAfterAuth({ preferredWorkspaceId });
-            if (!workspaceResolution.success) {
-                return {
-                    success: false,
-                    error: workspaceResolution.error || 'Unable to resolve workspace after invite join.',
-                    code: workspaceResolution.code
-                };
+            if (preferredWorkspaceId && workspaceSwitchingEnabled) {
+                const switched = await switchWorkspace(preferredWorkspaceId, { hydrate: false });
+                if (!switched.success) {
+                    return {
+                        success: false,
+                        error: switched.error || 'Unable to resolve workspace after invite join.',
+                        code: switched.code
+                    };
+                }
             }
-            if (workspaceResolution.workspaceSetupRequired) {
-                return { success: true, workspaceSetupRequired: true };
+            const entry = await resolvePostAuthCloudEntry();
+            if (!entry.success) {
+                return { success: false, error: entry.error || 'Unable to resolve workspace after invite join.', code: entry.code };
             }
-            await Promise.all([
-                fetchConfig({ ignoreAuthGuard: true }),
-                fetchTasks(true, { ignoreAuthGuard: true })
-            ]);
-            void syncUserGlobalSettings({ preferCloudOnFirstSync: true });
-            return { success: true };
+            if (preferredWorkspaceId && currentWorkspaceIdRef.current !== preferredWorkspaceId) {
+                commitCurrentWorkspaceId(preferredWorkspaceId, { clearExplicitSelection: false });
+            }
+            return { success: true, workspaceSetupRequired: entry.workspaceSetupRequired === true };
         }
         catch {
             return { success: false, error: 'Invite join failed.' };
         }
-    }, [checkAuthSession, fetchConfig, fetchTasks, resolveWorkspaceAfterAuth, syncUserGlobalSettings, resolveCloudAuthUrl, cloudAuthConfigured]);
+    }, [commitCurrentWorkspaceId, resolveCloudAuthUrl, cloudAuthConfigured, currentWorkspaceIdRef, resolvePostAuthCloudEntry, switchWorkspace, workspaceSwitchingEnabled]);
+    // ─── Login method management ────────────────────────────────────────────────
+    const fetchLoginMethods = useCallback(async () => {
+        if (!cloudAuthConfigured)
+            return { success: false, error: 'Cloud auth not configured.' };
+        try {
+            const res = await fetch(resolveCloudAuthUrl('/api/taskforce/account/login-methods'), {
+                credentials: 'include'
+            });
+            const data = await res.json().catch(() => ({}));
+            if (!res.ok || !data?.success) {
+                return { success: false, error: data?.error || 'Failed to fetch login methods.' };
+            }
+            return { success: true, methods: Array.isArray(data?.methods) ? data.methods : [] };
+        }
+        catch {
+            return { success: false, error: 'Failed to fetch login methods.' };
+        }
+    }, [resolveCloudAuthUrl, cloudAuthConfigured]);
+    const unlinkLoginMethod = useCallback(async (provider) => {
+        if (!cloudAuthConfigured)
+            return { success: false, error: 'Cloud auth not configured.' };
+        try {
+            const res = await fetch(resolveCloudAuthUrl(`/api/taskforce/account/login-methods/${encodeURIComponent(provider)}`), {
+                method: 'DELETE',
+                credentials: 'include'
+            });
+            const data = await res.json().catch(() => ({}));
+            if (!res.ok || !data?.success) {
+                return { success: false, error: data?.error || 'Unlink failed.', code: data?.code };
+            }
+            return { success: true };
+        }
+        catch {
+            return { success: false, error: 'Unlink failed.' };
+        }
+    }, [resolveCloudAuthUrl, cloudAuthConfigured]);
+    const addPasswordToAccount = useCallback(async (password) => {
+        if (!cloudAuthConfigured)
+            return { success: false, error: 'Cloud auth not configured.' };
+        try {
+            const res = await fetch(resolveCloudAuthUrl('/api/taskforce/account/login-methods/password'), {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                credentials: 'include',
+                body: JSON.stringify({ password })
+            });
+            const data = await res.json().catch(() => ({}));
+            if (!res.ok || !data?.success) {
+                return { success: false, error: data?.error || 'Failed to add password.', code: data?.code };
+            }
+            return { success: true };
+        }
+        catch {
+            return { success: false, error: 'Failed to add password.' };
+        }
+    }, [resolveCloudAuthUrl, cloudAuthConfigured]);
+    const beginOAuthLink = useCallback((provider, returnTo) => {
+        const sanitizedReturnTo = returnTo && /^\/[A-Za-z0-9_\-./?=&%]*$/.test(returnTo)
+            ? returnTo
+            : '/';
+        const path = `/api/taskforce/auth/oauth/${encodeURIComponent(provider)}/start?flow=link&return_to=${encodeURIComponent(sanitizedReturnTo)}`;
+        window.location.href = resolveCloudAuthUrl(path);
+    }, [resolveCloudAuthUrl]);
     const resetCloudLogoutClientState = useCallback(() => {
         abortWorkspaceScopedRequests();
         referenceDataRequestRef.current = null;
@@ -2029,6 +2399,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
         setArchivedTasks([]);
         setInitiatives([]);
         setWorkstreams([]);
+        setPlanningBootstrapTaskSummaries([]);
         setLoadingTasks(false);
         if (cloudRealtimeFollowUpRefreshTimerRef.current !== null && typeof window !== 'undefined') {
             window.clearTimeout(cloudRealtimeFollowUpRefreshTimerRef.current);
@@ -2139,6 +2510,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
             throw new Error(data?.error || `Failed to create initiative (${res.status})`);
         }
         await fetchPlanningEntities();
+        setInitiatives((current) => upsertEntityById(current, data));
         return data;
     }, [fetchPlanningEntities]);
     const updateInitiative = useCallback(async (id, payload) => {
@@ -2152,6 +2524,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
             throw new Error(data?.error || `Failed to update initiative (${res.status})`);
         }
         await fetchPlanningEntities();
+        setInitiatives((current) => upsertEntityById(current, data));
         return data;
     }, [fetchPlanningEntities]);
     const archiveInitiative = useCallback(async (id) => {
@@ -2163,6 +2536,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
             throw new Error(data?.error || `Failed to archive initiative (${res.status})`);
         }
         await fetchPlanningEntities();
+        setInitiatives((current) => upsertEntityById(current, data));
         return data;
     }, [fetchPlanningEntities]);
     const unarchiveInitiative = useCallback(async (id) => {
@@ -2174,6 +2548,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
             throw new Error(data?.error || `Failed to unarchive initiative (${res.status})`);
         }
         await fetchPlanningEntities();
+        setInitiatives((current) => upsertEntityById(current, data));
         return data;
     }, [fetchPlanningEntities]);
     const createWorkstream = useCallback(async (payload) => {
@@ -2187,6 +2562,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
             throw new Error(data?.error || `Failed to create workstream (${res.status})`);
         }
         await fetchPlanningEntities();
+        setWorkstreams((current) => upsertEntityById(current, data));
         return data;
     }, [fetchPlanningEntities]);
     const updateWorkstream = useCallback(async (id, payload) => {
@@ -2200,6 +2576,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
             throw new Error(data?.error || `Failed to update workstream (${res.status})`);
         }
         await fetchPlanningEntities();
+        setWorkstreams((current) => upsertEntityById(current, data));
         return data;
     }, [fetchPlanningEntities]);
     const archiveWorkstream = useCallback(async (id) => {
@@ -2211,6 +2588,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
             throw new Error(data?.error || `Failed to archive workstream (${res.status})`);
         }
         await fetchPlanningEntities();
+        setWorkstreams((current) => upsertEntityById(current, data));
         return data;
     }, [fetchPlanningEntities]);
     const unarchiveWorkstream = useCallback(async (id) => {
@@ -2222,6 +2600,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
             throw new Error(data?.error || `Failed to unarchive workstream (${res.status})`);
         }
         await fetchPlanningEntities();
+        setWorkstreams((current) => upsertEntityById(current, data));
         return data;
     }, [fetchPlanningEntities]);
     // Initialize auth once, then bootstrap protected data once auth gates are settled.
@@ -2238,6 +2617,38 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
             return;
         void checkAuthSession();
     }, [runtimeConfigReady, checkAuthSession]);
+    // Fetch available OAuth providers once we know the auth endpoint.
+    // Uses a short timeout so an unreachable auth server doesn't hold open
+    // browser connections and slow down subsequent requests on the same origin.
+    useEffect(() => {
+        if (!cloudAuthConfigured)
+            return;
+        let cancelled = false;
+        const controller = new AbortController();
+        const timerId = typeof window !== 'undefined'
+            ? window.setTimeout(() => controller.abort(), 5000)
+            : null;
+        fetch(resolveCloudAuthUrl('/api/taskforce/auth/providers'), {
+            credentials: 'include',
+            signal: controller.signal
+        })
+            .then(r => r.ok ? r.json() : null)
+            .then(data => {
+            if (!cancelled && Array.isArray(data?.providers)) {
+                setAvailableAuthProviders(data.providers);
+            }
+        })
+            .catch(() => { })
+            .finally(() => {
+            if (timerId !== null && typeof window !== 'undefined') {
+                window.clearTimeout(timerId);
+            }
+        });
+        return () => {
+            cancelled = true;
+            controller.abort();
+        };
+    }, [cloudAuthConfigured, resolveCloudAuthUrl]);
     // Keep local runtime auth state aligned with cloud session changes
     // (e.g. user signs in/out in another tab or cloud-hosted app).
     useEffect(() => {
@@ -2261,109 +2672,6 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
             window.clearInterval(intervalId);
         };
     }, [runtimeMode, shouldProbeCloudAuth, checkAuthSession]);
-    useEffect(() => {
-        if (shouldDeferProtectedApiCalls || shouldBlockProtectedApiCalls)
-            return;
-        if (hasBootstrappedDataRef.current)
-            return;
-        hasBootstrappedDataRef.current = true;
-        void (async () => {
-            if (runtimeMode === 'cloud' && authSessionResolved && isAuthenticated) {
-                const workspaceResolution = await resolveWorkspaceAfterAuth();
-                if (!workspaceResolution.success || workspaceResolution.workspaceSetupRequired) {
-                    await fetchBootstrapConfig();
-                    void fetchReferenceData();
-                    return;
-                }
-            }
-            await fetchBootstrapConfig();
-            await Promise.all([
-                (async () => {
-                    const startedAt = typeof performance !== 'undefined' ? performance.now() : Date.now();
-                    await fetchTasks(false);
-                    logBootstrapDebug('bootstrap_tasks_loaded', {
-                        durationMs: Math.round((typeof performance !== 'undefined' ? performance.now() : Date.now()) - startedAt)
-                    });
-                })(),
-                fetchReferenceData(),
-                fetchPlanningEntities()
-            ]);
-            if (typeof window !== 'undefined') {
-                if (archiveBootstrapTimerRef.current !== null) {
-                    window.clearTimeout(archiveBootstrapTimerRef.current);
-                }
-                archiveBootstrapTimerRef.current = window.setTimeout(() => {
-                    archiveBootstrapTimerRef.current = null;
-                    const startedAt = typeof performance !== 'undefined' ? performance.now() : Date.now();
-                    void fetchArchive(true).then(() => {
-                        logBootstrapDebug('bootstrap_archive_loaded_deferred', {
-                            durationMs: Math.round((typeof performance !== 'undefined' ? performance.now() : Date.now()) - startedAt)
-                        });
-                    });
-                }, 1500);
-            }
-        })();
-    }, [
-        shouldDeferProtectedApiCalls,
-        shouldBlockProtectedApiCalls,
-        runtimeMode,
-        authSessionResolved,
-        isAuthenticated,
-        resolveWorkspaceAfterAuth,
-        fetchBootstrapConfig,
-        fetchTasks,
-        fetchArchive,
-        fetchReferenceData,
-        fetchPlanningEntities
-    ]);
-    useEffect(() => {
-        if (shouldDeferProtectedApiCalls || shouldBlockProtectedApiCalls)
-            return;
-        if (workspaceBootstrapPending)
-            return;
-        if (workspaceSelectionScope === WORKSPACE_BOOTSTRAP_SCOPE)
-            return;
-        if (!hasBootstrappedDataRef.current)
-            return;
-        const loadKey = `${runtimeMode}:${currentWorkspaceId}:${workspaceSelectionScope}`;
-        if (lastConfigRefreshKeyRef.current === loadKey)
-            return;
-        lastConfigRefreshKeyRef.current = loadKey;
-        void fetchConfig();
-    }, [
-        currentWorkspaceId,
-        shouldDeferProtectedApiCalls,
-        shouldBlockProtectedApiCalls,
-        workspaceBootstrapPending,
-        runtimeMode,
-        workspaceSelectionScope,
-        fetchConfig
-    ]);
-    useEffect(() => {
-        if (shouldDeferProtectedApiCalls || shouldBlockProtectedApiCalls)
-            return;
-        if (workspaceBootstrapPending)
-            return;
-        const loadKey = currentWorkspaceId;
-        if (lastWorkspaceSyncStateLoadKeyRef.current === loadKey)
-            return;
-        lastWorkspaceSyncStateLoadKeyRef.current = loadKey;
-        void loadWorkspaceSyncState();
-    }, [shouldDeferProtectedApiCalls, shouldBlockProtectedApiCalls, currentWorkspaceId, loadWorkspaceSyncState, workspaceBootstrapPending]);
-    useEffect(() => {
-        if (runtimeMode !== 'cloud' || !authSessionResolved || !isAuthenticated) {
-            if (runtimeMode !== 'cloud') {
-                setAvailableWorkspaces([]);
-            }
-            workspaceListHydratedRef.current = false;
-            return;
-        }
-        if (workspaceBootstrapPending)
-            return;
-        if (!hasBootstrappedDataRef.current || workspaceListHydratedRef.current)
-            return;
-        fetchWorkspaces();
-    }, [runtimeMode, authSessionResolved, isAuthenticated, fetchWorkspaces, workspaceBootstrapPending]);
     // Report task count to parent
     useEffect(() => {
         if (onTaskCountChange) {
@@ -2529,6 +2837,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
                 return;
             lastTaskSurfaceLoadKeyRef.current = loadKey;
             fetchTasks();
+            fetchPlanningEntities();
             if (showArchive || taskScope === 'archived') {
                 fetchArchive(true);
             }
@@ -2555,6 +2864,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
         showArchive,
         taskScope,
         fetchTasks,
+        fetchPlanningEntities,
         fetchArchive,
         fetchDeletedTasks,
         fetchConfig,
@@ -2723,6 +3033,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
         pushWorkspaceChangesToCloud,
         workspacePendingSignatureRef,
         workspaceDeletedTaskIdsRef,
+        workspaceDeletedTaskWatermarksRef,
     });
     const { autoSaveState, flushAutoSave, scheduleWarningPrompt, handleSubmit, confirmScheduleWarning, cancelScheduleWarning, handleAddComment } = useTaskFormActions({
         activeCategories,
@@ -2992,6 +3303,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
         workspaceLastErrorMessage,
         workspaceLastSuccessfulSyncAt,
         workspaceSyncPhase,
+        workspaceSyncSetupIntent,
         workspaceSyncStatus,
         workspaceSyncSummary,
         workspaceSyncRecommendedAction,
@@ -3011,6 +3323,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
         workspaceCloudSyncEnabled,
         saveWorkspaceCloudSyncSettings,
         applyWorkspaceSyncStateSnapshot,
+        bootstrapState,
         authSessionResolved,
         workspaceBootstrapPending,
         bootstrapPhase,
@@ -3027,6 +3340,12 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
         deleteWorkspace,
         switchWorkspace,
         loginWithCredentials,
+        beginOAuthLogin,
+        availableAuthProviders,
+        fetchLoginMethods,
+        unlinkLoginMethod,
+        addPasswordToAccount,
+        beginOAuthLink,
         registerWithCredentials,
         updateCurrentUserProfile,
         requestEmailVerification,
@@ -3059,6 +3378,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
         archivedTasks,
         initiatives,
         workstreams,
+        planningBootstrapTaskSummaries,
         deletedTasks,
         activeCategories,
         activeTypes,
@@ -3081,6 +3401,7 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
         setFilterAssignees,
         filterTaxonomies,
         setFilterTaxonomies,
+        hasInitedFilters,
         sortBy,
         setSortBy,
         sortOrder,