@taskforcehq/taskforce 0.3.304 → 0.3.306

package/dist/migrations/taskSchemaMigrations.js

@@ -34,58 +34,6 @@ export function ensureTenantSchema(db) {
         CREATE INDEX IF NOT EXISTS idx_comments_tenant_task ON comments(tenant_id, task_id);
     `);
 }
-export function ensureParentTaskSchema(db) {
-    const columns = db.prepare(`PRAGMA table_info(tasks)`).all();
-    const hasParentColumn = columns.some((c) => c.name === 'parent_task_id');
-    const hasChildDisplayOrderColumn = columns.some((c) => c.name === 'child_display_order');
-    if (!hasParentColumn) {
-        db.exec(`ALTER TABLE tasks ADD COLUMN parent_task_id TEXT`);
-    }
-    if (!hasChildDisplayOrderColumn) {
-        db.exec(`ALTER TABLE tasks ADD COLUMN child_display_order INTEGER`);
-    }
-    db.exec(`
-        CREATE INDEX IF NOT EXISTS idx_tasks_parent_task_id ON tasks(parent_task_id);
-        CREATE INDEX IF NOT EXISTS idx_tasks_parent_child_order ON tasks(parent_task_id, child_display_order);
-    `);
-    // SQLite-only runtime guard triggers. Postgres path enforces constraints in core logic.
-    if (db.provider === 'sqlite') {
-        db.exec(`
-            CREATE TRIGGER IF NOT EXISTS trg_tasks_parent_guard_insert
-            BEFORE INSERT ON tasks
-            FOR EACH ROW
-            WHEN NEW.parent_task_id IS NOT NULL AND TRIM(NEW.parent_task_id) <> ''
-            BEGIN
-                SELECT CASE
-                    WHEN NEW.parent_task_id = NEW.id THEN RAISE(ABORT, 'Task cannot parent itself')
-                    WHEN (SELECT id FROM tasks WHERE id = NEW.parent_task_id) IS NULL THEN RAISE(ABORT, 'Parent task not found')
-                END;
-            END;
-        `);
-        db.exec(`
-            CREATE TRIGGER IF NOT EXISTS trg_tasks_parent_guard_update
-            BEFORE UPDATE OF parent_task_id ON tasks
-            FOR EACH ROW
-            WHEN NEW.parent_task_id IS NOT NULL AND TRIM(NEW.parent_task_id) <> ''
-            BEGIN
-                SELECT CASE
-                    WHEN NEW.parent_task_id = NEW.id THEN RAISE(ABORT, 'Task cannot parent itself')
-                    WHEN (SELECT id FROM tasks WHERE id = NEW.parent_task_id) IS NULL THEN RAISE(ABORT, 'Parent task not found')
-                END;
-            END;
-        `);
-        // Block deletion of parent tasks while children still point to them.
-        db.exec(`
-            CREATE TRIGGER IF NOT EXISTS trg_tasks_block_delete_with_children
-            BEFORE DELETE ON tasks
-            FOR EACH ROW
-            WHEN EXISTS (SELECT 1 FROM tasks WHERE parent_task_id = OLD.id)
-            BEGIN
-                SELECT RAISE(ABORT, 'Cannot delete parent task with children');
-            END;
-        `);
-    }
-}
 export function ensureScheduleTaskSchema(db) {
     const columns = db.prepare(`PRAGMA table_info(tasks)`).all();
     const hasScheduledDateColumn = columns.some((c) => c.name === 'scheduled_date');
@@ -226,9 +174,6 @@ export function ensureWorkspaceSchema(db) {
             email TEXT NOT NULL,
             display_name TEXT,
             avatar_url TEXT,
-            auth_provider TEXT,
-            external_auth_id TEXT,
-            password_hash TEXT,
             email_verified_at TEXT,
             beta_access BOOLEAN NOT NULL DEFAULT TRUE,
             is_disabled BOOLEAN NOT NULL DEFAULT FALSE,
@@ -319,9 +264,6 @@ export function ensureWorkspaceSchema(db) {
         const postgresUserRepairs = [
             `ALTER TABLE users ADD COLUMN IF NOT EXISTS display_name TEXT`,
             `ALTER TABLE users ADD COLUMN IF NOT EXISTS avatar_url TEXT`,
-            `ALTER TABLE users ADD COLUMN IF NOT EXISTS auth_provider TEXT`,
-            `ALTER TABLE users ADD COLUMN IF NOT EXISTS external_auth_id TEXT`,
-            `ALTER TABLE users ADD COLUMN IF NOT EXISTS password_hash TEXT`,
             `ALTER TABLE users ADD COLUMN IF NOT EXISTS email_verified_at TEXT`,
             `ALTER TABLE users ADD COLUMN IF NOT EXISTS beta_access BOOLEAN NOT NULL DEFAULT TRUE`,
             `ALTER TABLE users ADD COLUMN IF NOT EXISTS is_disabled BOOLEAN NOT NULL DEFAULT FALSE`,
@@ -357,9 +299,6 @@ export function ensureWorkspaceSchema(db) {
         const sqliteUserRepairs = [
             { name: 'display_name', sql: `ALTER TABLE users ADD COLUMN display_name TEXT` },
             { name: 'avatar_url', sql: `ALTER TABLE users ADD COLUMN avatar_url TEXT` },
-            { name: 'auth_provider', sql: `ALTER TABLE users ADD COLUMN auth_provider TEXT` },
-            { name: 'external_auth_id', sql: `ALTER TABLE users ADD COLUMN external_auth_id TEXT` },
-            { name: 'password_hash', sql: `ALTER TABLE users ADD COLUMN password_hash TEXT` },
             { name: 'email_verified_at', sql: `ALTER TABLE users ADD COLUMN email_verified_at TEXT` },
             { name: 'beta_access', sql: `ALTER TABLE users ADD COLUMN beta_access BOOLEAN NOT NULL DEFAULT TRUE` },
             { name: 'is_disabled', sql: `ALTER TABLE users ADD COLUMN is_disabled BOOLEAN NOT NULL DEFAULT FALSE` },
@@ -697,6 +636,7 @@ export function ensureEntitlementsSchema(db) {
             plan_id TEXT PRIMARY KEY,
             tenant_id TEXT NOT NULL DEFAULT 'default',
             display_name TEXT NOT NULL,
+            description TEXT,
             status TEXT NOT NULL DEFAULT 'active',
             created_at TEXT NOT NULL,
             updated_at TEXT NOT NULL
@@ -727,6 +667,17 @@ export function ensureEntitlementsSchema(db) {
             FOREIGN KEY (plan_version_id) REFERENCES plan_versions(plan_version_id) ON DELETE CASCADE
         );
 
+        CREATE TABLE IF NOT EXISTS plan_feature_catalog_overrides (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            feature_key TEXT NOT NULL,
+            public_label TEXT,
+            public_description TEXT,
+            public_display_order INTEGER,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, feature_key)
+        );
+
         CREATE TABLE IF NOT EXISTS account_entitlements (
             account_id TEXT PRIMARY KEY,
             tenant_id TEXT NOT NULL DEFAULT 'default',
@@ -763,6 +714,8 @@ export function ensureEntitlementsSchema(db) {
         ON plan_versions(tenant_id, plan_id, is_default);
         CREATE INDEX IF NOT EXISTS idx_plan_feature_matrix_plan_version
         ON plan_feature_matrix(tenant_id, plan_version_id);
+        CREATE INDEX IF NOT EXISTS idx_plan_feature_catalog_overrides_tenant
+        ON plan_feature_catalog_overrides(tenant_id, updated_at);
         CREATE INDEX IF NOT EXISTS idx_account_entitlements_state
         ON account_entitlements(tenant_id, entitlement_state);
         CREATE INDEX IF NOT EXISTS idx_account_entitlements_plan_version
@@ -774,6 +727,15 @@ export function ensureEntitlementsSchema(db) {
         CREATE INDEX IF NOT EXISTS idx_entitlement_audit_log_actor
         ON entitlement_audit_log(tenant_id, actor_user_id, created_at);
     `);
+    const planCatalogColumns = db.prepare(`PRAGMA table_info(plan_catalog)`).all();
+    const hasDescriptionColumn = planCatalogColumns.some((c) => c.name === 'description');
+    if (!hasDescriptionColumn) {
+        db.exec(`ALTER TABLE plan_catalog ADD COLUMN description TEXT`);
+    }
+    const planFeatureCatalogOverrideColumns = db.prepare(`PRAGMA table_info(plan_feature_catalog_overrides)`).all();
+    if (!planFeatureCatalogOverrideColumns.some((column) => column.name === 'public_display_order')) {
+        db.exec(`ALTER TABLE plan_feature_catalog_overrides ADD COLUMN public_display_order INTEGER`);
+    }
 }
 export function ensureTaskAssetsSchema(db) {
     db.exec(`
@@ -853,6 +815,7 @@ export function ensureWorkspaceAssetsSchema(db) {
             tenant_id TEXT NOT NULL DEFAULT 'default',
             workspace_id TEXT NOT NULL,
             asset_id TEXT NOT NULL,
+            target_type TEXT NOT NULL DEFAULT 'task',
             task_id TEXT NOT NULL,
             role TEXT NOT NULL,
             display_name TEXT,
@@ -873,6 +836,15 @@ export function ensureWorkspaceAssetsSchema(db) {
     if (!hasDisplayNameColumn) {
         db.exec(`ALTER TABLE workspace_asset_links ADD COLUMN display_name TEXT`);
     }
+    const hasTargetTypeColumn = linkColumns.some((c) => c.name === 'target_type');
+    if (!hasTargetTypeColumn) {
+        db.exec(`ALTER TABLE workspace_asset_links ADD COLUMN target_type TEXT NOT NULL DEFAULT 'task'`);
+        db.exec(`UPDATE workspace_asset_links SET target_type = 'task' WHERE target_type IS NULL OR TRIM(target_type) = ''`);
+    }
+    db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_workspace_asset_links_target
+        ON workspace_asset_links(tenant_id, workspace_id, target_type, task_id, deleted_at, updated_at)
+    `);
 }
 export function ensureDocumentReferenceSchema(db) {
     const columns = db.prepare(`PRAGMA table_info(workspace_assets)`).all();
@@ -1160,3 +1132,141 @@ export function ensureDocumentReviewSessionsSchema(db) {
         }
     }
 }
+export function ensureAuthIdentitySchema(db) {
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS user_auth_identities (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            user_id TEXT NOT NULL,
+            provider TEXT NOT NULL,
+            provider_subject TEXT,
+            provider_email TEXT,
+            provider_email_verified INTEGER,
+            password_hash TEXT,
+            display_name_snapshot TEXT,
+            avatar_url_snapshot TEXT,
+            metadata_json TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            last_login_at TEXT,
+            linked_at TEXT,
+            disabled_at TEXT,
+            FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+        );
+
+        CREATE TABLE IF NOT EXISTS auth_oauth_states (
+            state TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            provider TEXT NOT NULL,
+            flow_mode TEXT NOT NULL,
+            user_id TEXT,
+            invite_token TEXT,
+            return_to TEXT,
+            pkce_verifier TEXT,
+            nonce TEXT,
+            expires_at TEXT NOT NULL,
+            consumed_at TEXT,
+            created_at TEXT NOT NULL,
+            created_ip TEXT
+        );
+    `);
+    if (db.provider === 'postgres') {
+        try {
+            db.exec(`
+                ALTER TABLE user_auth_identities
+                    ADD CONSTRAINT uq_auth_identity_provider_subject
+                    UNIQUE (tenant_id, provider, provider_subject)
+            `);
+        }
+        catch { /* already exists */ }
+        try {
+            db.exec(`
+                ALTER TABLE user_auth_identities
+                    ADD CONSTRAINT uq_auth_identity_user_provider
+                    UNIQUE (tenant_id, user_id, provider)
+            `);
+        }
+        catch { /* already exists */ }
+    }
+    else {
+        // SQLite: create unique indexes if they don't already exist
+        db.exec(`
+            CREATE UNIQUE INDEX IF NOT EXISTS uq_auth_identity_provider_subject
+                ON user_auth_identities(tenant_id, provider, provider_subject)
+                WHERE provider_subject IS NOT NULL;
+            CREATE UNIQUE INDEX IF NOT EXISTS uq_auth_identity_user_provider
+                ON user_auth_identities(tenant_id, user_id, provider);
+        `);
+    }
+    db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_auth_identities_user
+            ON user_auth_identities(tenant_id, user_id);
+        CREATE INDEX IF NOT EXISTS idx_auth_oauth_states_expires
+            ON auth_oauth_states(expires_at);
+    `);
+    // ── Backfill: migrate any remaining users.password_hash rows into user_auth_identities.
+    // Guarded: wrapped in try/catch — if the legacy column was already dropped (T-837),
+    // the SELECT will throw and we skip cleanly. Idempotent via unique index.
+    try {
+        const now = new Date().toISOString();
+        const usersWithPassword = db.prepare(`
+            SELECT id, tenant_id, password_hash
+            FROM users
+            WHERE password_hash IS NOT NULL
+              AND TRIM(COALESCE(password_hash, '')) != ''
+        `).all();
+        const hasIdentity = db.prepare(`
+            SELECT id FROM user_auth_identities
+            WHERE tenant_id = ? AND user_id = ? AND provider = 'password'
+            LIMIT 1
+        `);
+        const insertIdentity = db.prepare(`
+            INSERT INTO user_auth_identities
+                (id, tenant_id, user_id, provider, password_hash, created_at, updated_at, linked_at)
+            VALUES (?, ?, ?, 'password', ?, ?, ?, ?)
+        `);
+        for (const user of usersWithPassword) {
+            const existing = hasIdentity.get(user.tenant_id, user.id);
+            if (existing?.id)
+                continue;
+            const identityId = `identity-${user.id}-pwd`;
+            try {
+                insertIdentity.run(identityId, user.tenant_id, user.id, user.password_hash, now, now, now);
+            }
+            catch {
+                // Concurrent startup or duplicate — safe to skip.
+            }
+        }
+    }
+    catch {
+        // users.password_hash column already absent — backfill not needed.
+    }
+    // ── Drop legacy auth columns from users (T-837).
+    // Safe to run repeatedly: column-existence checks prevent double-drop errors.
+    if (db.provider === 'postgres') {
+        // PostgreSQL: DROP COLUMN IF EXISTS is a single atomic statement.
+        try {
+            db.exec(`
+                ALTER TABLE users
+                    DROP COLUMN IF EXISTS auth_provider,
+                    DROP COLUMN IF EXISTS external_auth_id,
+                    DROP COLUMN IF EXISTS password_hash
+            `);
+        }
+        catch { /* best-effort — ignore if already absent */ }
+    }
+    else {
+        // SQLite: DROP COLUMN requires 3.35.0+ (2021-03-12).
+        // better-sqlite3 ships its own SQLite which satisfies this requirement.
+        // Guard each drop individually to tolerate partial completion.
+        const currentUserCols = new Set(db.prepare(`PRAGMA table_info(users)`).all().map(c => c.name));
+        for (const col of ['auth_provider', 'external_auth_id', 'password_hash']) {
+            if (currentUserCols.has(col)) {
+                try {
+                    db.exec(`ALTER TABLE users DROP COLUMN ${col}`);
+                }
+                catch { /* ignore — concurrent drop or already gone */ }
+            }
+        }
+    }
+}

package/dist/migrations/taskSchemaMigrations.test.js

@@ -1,4 +1,6 @@
 import Database from 'better-sqlite3';
+import fs from 'fs';
+import path from 'path';
 import { afterEach, describe, expect, it } from 'vitest';
 import { ensureAnnotatedAttachmentSessionsSchema, ensureDocumentReviewSessionsSchema, ensureWorkspaceSchema } from './taskSchemaMigrations';
 const openDbs = [];
@@ -208,3 +210,16 @@ describe('ensureDocumentReviewSessionsSchema', () => {
         expect(row?.author_actor_id).toBe('user-1');
     });
 });
+describe('postgres bootstrap parity', () => {
+    it('includes workspace asset tables and target_type indexes', () => {
+        const sqlPath = path.resolve(process.cwd(), 'src/migrations/postgres/001_init.sql');
+        const sql = fs.readFileSync(sqlPath, 'utf8');
+        expect(sql).toContain('CREATE TABLE IF NOT EXISTS workspace_assets');
+        expect(sql).toContain('CREATE TABLE IF NOT EXISTS workspace_asset_links');
+        expect(sql).toContain('target_type TEXT NOT NULL DEFAULT \'task\'');
+        expect(sql).toContain('display_name TEXT');
+        expect(sql).toContain('reference_number INTEGER');
+        expect(sql).toContain('CREATE INDEX IF NOT EXISTS idx_workspace_asset_links_target');
+        expect(sql).toContain('CREATE UNIQUE INDEX IF NOT EXISTS idx_workspace_assets_workspace_kind_reference');
+    });
+});

package/dist/resources/templates/workflow-sources/workflowDocs.mjs

@@ -284,7 +284,7 @@ export const workflowDocs = [
                 '   - `### Next Action`',
                 '6. Ask whether to save as `{artifacts.implementationPlan.path}`.',
                 '7. If user confirms, persist task-specific content via `{{MCP_PREFIX}}save_task_attachment` using `filename: "implementation-plan.md"`.',
-                '   - Use `{{MCP_PREFIX}}link_task_context` only for linking existing files/URLs (for example, shared docs under `docs/`).',
+                '   - Use `{{MCP_PREFIX}}link_task_context` only for external http(s) URLs that should stay as references.',
                 '8. If setting status to `task` or `on-hold`, add explicit comment justification using `{{MCP_PREFIX}}add_comment`.',
                 '9. Never set `cancelled`, and never call `{{MCP_PREFIX}}archive_task`, unless explicitly instructed by the user.',
                 '10. Print `prompts.handoffPrompt` and stop.'
@@ -358,7 +358,7 @@ export const workflowDocs = [
                 '   - `### Next Step`',
                 '4. Ask whether to save as `{artifacts.collaborationBlueprint.path}`.',
                 '5. If user confirms, persist task-specific content via `{{MCP_PREFIX}}save_task_attachment` using `filename: "collaboration-blueprint.md"`.',
-                '   - Use `{{MCP_PREFIX}}link_task_context` only for linking existing files/URLs (for example, shared docs under `docs/`).',
+                '   - Use `{{MCP_PREFIX}}link_task_context` only for external http(s) URLs that should stay as references.',
                 '6. Ask concise clarification questions only if required fields above are missing.',
                 '7. If setting status to `task` or `on-hold`, add explicit comment justification using `{{MCP_PREFIX}}add_comment`.',
                 '8. Never set `cancelled`, and never call `{{MCP_PREFIX}}archive_task`, unless explicitly instructed by the user.',
@@ -435,14 +435,14 @@ export const workflowDocs = [
                 '   - `### Next Step`',
                 '4. Ask whether to save as `{artifacts.evaluationReport.path}`.',
                 '5. If user confirms, persist task-specific content via `{{MCP_PREFIX}}save_task_attachment` using `filename: "evaluation.md"`.',
-                '   - Use `{{MCP_PREFIX}}link_task_context` only for linking existing files/URLs (for example, shared docs under `docs/`).',
+                '   - Use `{{MCP_PREFIX}}link_task_context` only for external http(s) URLs that should stay as references.',
                 '6. Never set `cancelled`, and never call `{{MCP_PREFIX}}archive_task`, unless explicitly instructed by the user.',
                 '',
                 '## 3. Optional Report Artifact',
                 '',
                 '1. Use report files only when user opts in.',
                 '2. Save to `task attachment "evaluation.md"` and attach to task context when approved.',
-                '   - If the document is not task-specific, store it under `docs/` and optionally link it with `{{MCP_PREFIX}}link_task_context`.',
+                '   - If the document should become a shared durable document, save it through the canonical document/document-manager flow instead of a raw `docs/` file.',
                 '3. Stop.'
             ].join('\n')
         }
@@ -513,7 +513,7 @@ export const workflowDocs = [
                 '   - `### Next Status`',
                 '3. Ask whether to save as `{artifacts.reviewReport.path}`.',
                 '4. If user confirms, persist task-specific content via `{{MCP_PREFIX}}save_task_attachment` using `filename: "review.md"`.',
-                '   - Use `{{MCP_PREFIX}}link_task_context` only for linking existing files/URLs (for example, shared docs under `docs/`).',
+                '   - Use `{{MCP_PREFIX}}link_task_context` only for external http(s) URLs that should stay as references.',
                 '5. Keep status within allowed statuses (`task`, `on-hold`, `in-progress`, `review`, `done`) unless user explicitly instructs otherwise.',
                 '   - If setting status to `task` or `on-hold`, add explicit comment justification using `{{MCP_PREFIX}}add_comment`.',
                 '6. Never set `cancelled`, and never call `{{MCP_PREFIX}}archive_task`, unless explicitly instructed by the user.',
@@ -522,7 +522,7 @@ export const workflowDocs = [
                 '',
                 '1. Use report files only when user opts in.',
                 '2. Save to `task attachment "review.md"` and attach to task context when approved.',
-                '   - If the document is not task-specific, store it under `docs/` and optionally link it with `{{MCP_PREFIX}}link_task_context`.',
+                '   - If the document should become a shared durable document, save it through the canonical document/document-manager flow instead of a raw `docs/` file.',
                 '3. Stop.'
             ].join('\n')
         }

package/dist/resources/templates/workflows/collaborate.yaml

@@ -102,7 +102,7 @@ content:
        - `### Next Step`
     4. Ask whether to save as `{artifacts.collaborationBlueprint.path}`.
     5. If user confirms, persist task-specific content via `{{MCP_PREFIX}}save_task_attachment` using `filename: "collaboration-blueprint.md"`.
-       - Use `{{MCP_PREFIX}}link_task_context` only for linking existing files/URLs (for example, shared docs under `docs/`).
+       - Use `{{MCP_PREFIX}}link_task_context` only for external http(s) URLs that should stay as references.
     6. Ask concise clarification questions only if required fields above are missing.
     7. If setting status to `task` or `on-hold`, add explicit comment justification using `{{MCP_PREFIX}}add_comment`.
     8. Never set `cancelled`, and never call `{{MCP_PREFIX}}archive_task`, unless explicitly instructed by the user.

package/dist/resources/templates/workflows/evaluate.yaml

@@ -106,12 +106,12 @@ content:
        - `### Next Step`
     4. Ask whether to save as `{artifacts.evaluationReport.path}`.
     5. If user confirms, persist task-specific content via `{{MCP_PREFIX}}save_task_attachment` using `filename: "evaluation.md"`.
-       - Use `{{MCP_PREFIX}}link_task_context` only for linking existing files/URLs (for example, shared docs under `docs/`).
+       - Use `{{MCP_PREFIX}}link_task_context` only for external http(s) URLs that should stay as references.
     6. Never set `cancelled`, and never call `{{MCP_PREFIX}}archive_task`, unless explicitly instructed by the user.
 
     ## 3. Optional Report Artifact
 
     1. Use report files only when user opts in.
     2. Save to `task attachment "evaluation.md"` and attach to task context when approved.
-       - If the document is not task-specific, store it under `docs/` and optionally link it with `{{MCP_PREFIX}}link_task_context`.
+       - If the document should become a shared durable document, save it through the canonical document/document-manager flow instead of a raw `docs/` file.
     3. Stop.

package/dist/resources/templates/workflows/plan.yaml

@@ -113,7 +113,7 @@ content:
        - `### Next Action`
     6. Ask whether to save as `{artifacts.implementationPlan.path}`.
     7. If user confirms, persist task-specific content via `{{MCP_PREFIX}}save_task_attachment` using `filename: "implementation-plan.md"`.
-       - Use `{{MCP_PREFIX}}link_task_context` only for linking existing files/URLs (for example, shared docs under `docs/`).
+       - Use `{{MCP_PREFIX}}link_task_context` only for external http(s) URLs that should stay as references.
     8. If setting status to `task` or `on-hold`, add explicit comment justification using `{{MCP_PREFIX}}add_comment`.
     9. Never set `cancelled`, and never call `{{MCP_PREFIX}}archive_task`, unless explicitly instructed by the user.
     10. Print `prompts.handoffPrompt` and stop.

package/dist/resources/templates/workflows/review.yaml

@@ -102,7 +102,7 @@ content:
        - `### Next Status`
     3. Ask whether to save as `{artifacts.reviewReport.path}`.
     4. If user confirms, persist task-specific content via `{{MCP_PREFIX}}save_task_attachment` using `filename: "review.md"`.
-       - Use `{{MCP_PREFIX}}link_task_context` only for linking existing files/URLs (for example, shared docs under `docs/`).
+       - Use `{{MCP_PREFIX}}link_task_context` only for external http(s) URLs that should stay as references.
     5. Keep status within allowed statuses (`task`, `on-hold`, `in-progress`, `review`, `done`) unless user explicitly instructs otherwise.
        - If setting status to `task` or `on-hold`, add explicit comment justification using `{{MCP_PREFIX}}add_comment`.
     6. Never set `cancelled`, and never call `{{MCP_PREFIX}}archive_task`, unless explicitly instructed by the user.
@@ -111,5 +111,5 @@ content:
 
     1. Use report files only when user opts in.
     2. Save to `task attachment "review.md"` and attach to task context when approved.
-       - If the document is not task-specific, store it under `docs/` and optionally link it with `{{MCP_PREFIX}}link_task_context`.
+       - If the document should become a shared durable document, save it through the canonical document/document-manager flow instead of a raw `docs/` file.
     3. Stop.

package/dist/server/annotatedAttachmentsRoutes.test.js

@@ -209,9 +209,9 @@ describe('annotated attachment routes', () => {
             core.createWorkspace({ workspaceId: 'workspace-1', name: 'Workspace 1' });
             const now = new Date().toISOString();
             core.db.prepare(`
-                INSERT INTO users (id, tenant_id, email, display_name, auth_provider, external_auth_id, beta_access, is_disabled, created_at, updated_at)
-                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-            `).run('user-local-1', core.getTenantId(), 'local@example.com', 'Local User', 'local', 'user-local-1', 1, 0, now, now);
+                INSERT INTO users (id, tenant_id, email, display_name, beta_access, is_disabled, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+            `).run('user-local-1', core.getTenantId(), 'local@example.com', 'Local User', 1, 0, now, now);
             core.db.prepare(`
                 INSERT INTO workspace_memberships (id, tenant_id, workspace_id, user_id, role, status, created_at, updated_at)
                 VALUES (?, ?, ?, ?, ?, ?, ?, ?)

package/dist/server/auth/providers/apple.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Apple Sign In adapter.
+ *
+ * Flow:
+ *   1. Redirect user to buildAppleAuthUrl() with response_mode=form_post.
+ *   2. Apple POSTs `code`, `state`, `id_token` and optional `user` JSON to the callback.
+ *   3. Call exchangeAppleCode() which mints the client-secret JWT, exchanges the code,
+ *      and decodes the id_token payload for the canonical profile.
+ *
+ * Notes:
+ *   - Apple never re-sends the user's name after the very first authorisation.
+ *     If the user JSON arrives on first login it is captured; subsequent logins
+ *     use the snapshot stored in user_auth_identities.
+ *   - Private-relay email addresses contain `.privaterelay.appleid.com`; the
+ *     `is_private_email` claim is set to `true` in that case.
+ */
+import type { NormalizedOAuthProfile } from './types.js';
+export declare function buildAppleAuthUrl(input: {
+    servicesId: string;
+    redirectUri: string;
+    state: string;
+    nonce: string;
+}): string;
+export declare function exchangeAppleCode(input: {
+    code: string;
+    redirectUri: string;
+    servicesId: string;
+    teamId: string;
+    keyId: string;
+    privateKeyPem: string;
+    /** Optional: JSON string Apple sends on first authorisation containing { name }. */
+    userJson?: string | null;
+}): Promise<NormalizedOAuthProfile>;

package/dist/server/auth/providers/apple.js

@@ -0,0 +1,82 @@
+import { getAppleClientSecret } from './appleClientSecret.js';
+export function buildAppleAuthUrl(input) {
+    const params = new URLSearchParams({
+        client_id: input.servicesId,
+        redirect_uri: input.redirectUri,
+        response_type: 'code id_token',
+        scope: 'name email',
+        state: input.state,
+        nonce: input.nonce,
+        response_mode: 'form_post',
+    });
+    return `https://appleid.apple.com/auth/authorize?${params.toString()}`;
+}
+export async function exchangeAppleCode(input) {
+    const clientSecret = getAppleClientSecret({
+        servicesId: input.servicesId,
+        teamId: input.teamId,
+        keyId: input.keyId,
+        privateKeyPem: input.privateKeyPem,
+    });
+    // Step 1: exchange authorisation code for tokens
+    const tokenRes = await fetch('https://appleid.apple.com/auth/token', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'authorization_code',
+            code: input.code,
+            redirect_uri: input.redirectUri,
+            client_id: input.servicesId,
+            client_secret: clientSecret,
+        }).toString(),
+    });
+    if (!tokenRes.ok) {
+        const body = await tokenRes.text().catch(() => '');
+        throw new Error(`Apple token exchange failed (${tokenRes.status}): ${body}`);
+    }
+    const tokens = await tokenRes.json();
+    const idToken = String(tokens.id_token || '').trim();
+    if (!idToken)
+        throw new Error('Apple token exchange: missing id_token');
+    // Step 2: decode id_token payload (trust Apple — skip signature verification here)
+    const parts = idToken.split('.');
+    if (parts.length !== 3)
+        throw new Error('Apple id_token: not a valid JWT');
+    let payload;
+    try {
+        payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+    }
+    catch {
+        throw new Error('Apple id_token: could not decode payload');
+    }
+    const sub = String(payload.sub || '').trim();
+    if (!sub)
+        throw new Error('Apple id_token: missing sub');
+    const email = String(payload.email || '').trim().toLowerCase() || null;
+    const emailVerified = payload.email_verified === true || payload.email_verified === 'true';
+    const isPrivateEmail = payload.is_private_email === true || payload.is_private_email === 'true';
+    // Step 3: extract display name from one-time `user` JSON (first-login only)
+    let displayName = null;
+    if (input.userJson) {
+        try {
+            const userObj = JSON.parse(input.userJson);
+            const firstName = String(userObj?.name?.firstName || '').trim();
+            const lastName = String(userObj?.name?.lastName || '').trim();
+            const full = [firstName, lastName].filter(Boolean).join(' ');
+            if (full)
+                displayName = full;
+        }
+        catch {
+            // malformed — ignore
+        }
+    }
+    return {
+        provider: 'apple',
+        providerSubject: sub,
+        email,
+        emailVerified,
+        displayName,
+        avatarUrl: null, // Apple never provides an avatar
+        isPrivateEmail,
+    };
+}

package/dist/server/auth/providers/appleClientSecret.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Apple OAuth client-secret JWT minter.
+ *
+ * Apple Sign In requires a short-lived JWT as the OAuth `client_secret` rather
+ * than a static secret. The JWT must be:
+ *   - Signed with ES256 (ECDSA P-256) using the private key registered in App Store Connect
+ *   - Valid for at most 6 months (Apple enforces this; we use 10 min for freshness)
+ *   - Cached so callers don't re-sign on every request
+ *
+ * Reference: https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens
+ */
+export interface AppleClientSecretConfig {
+    /** 10-character Apple Team ID */
+    teamId: string;
+    /** Services ID (bundle ID) registered in App Store Connect */
+    servicesId: string;
+    /** Key ID of the registered Sign In with Apple key */
+    keyId: string;
+    /** PEM-encoded EC P-256 private key downloaded from App Store Connect */
+    privateKeyPem: string;
+}
+/**
+ * Returns a cached client-secret JWT for the given Apple config, minting a
+ * fresh one if the cache entry is absent or within 60 s of expiry.
+ */
+export declare function getAppleClientSecret(cfg: AppleClientSecretConfig): string;
+/**
+ * Force-mints a fresh JWT (bypasses cache) for health-check purposes.
+ * Returns success/error without updating the cache.
+ */
+export declare function testMintAppleClientSecret(cfg: AppleClientSecretConfig): {
+    ok: true;
+    token: string;
+} | {
+    ok: false;
+    error: string;
+};