@taskforcehq/taskforce 0.3.304 → 0.3.306

package/dist/server/routes/documentReviews.d.ts

@@ -1,6 +1,6 @@
 import type { IncomingMessage, ServerResponse } from 'http';
 import type { TaskforceCore } from '../../core/Taskforce.js';
-import type { RouteHandler } from '../routes.js';
+import { type RouteHandler } from './primitives.js';
 export interface DocumentReviewRouteDependencies {
     addRoute: (method: string, path: string, handler: RouteHandler) => void;
     core: TaskforceCore;

package/dist/server/routes/documentReviews.js

@@ -1,4 +1,4 @@
-import { parseJsonBody } from '../routes.js';
+import { parseJsonBody } from './primitives.js';
 import { resolveErrorStatusCode } from './shared.js';
 function writeJson(res, statusCode, payload) {
     res.writeHead(statusCode, { 'Content-Type': 'application/json' });

package/dist/server/routes/documents.d.ts

@@ -15,6 +15,7 @@
  *   GET    /api/taskforce/context-metadata
  *   POST   /api/taskforce/context/purge-expired
  *   GET    /api/taskforce/documents
+ *   POST   /api/taskforce/documents/:assetId/attach
  *   DELETE /api/taskforce/documents/:assetId
  *   PATCH  /api/taskforce/documents/:assetId
  *   POST   /api/taskforce/documents/save
@@ -28,7 +29,7 @@ import { ObjectStorageClient } from '../../storage/objectStorageClient.js';
 import type { DocumentRegistryEntry } from '../../storage/documentRegistry.js';
 import { TaskAssetStore } from '../../storage/taskAssetStore.js';
 import { WorkspaceAssetStore, type WorkspaceAssetEntry, type WorkspaceAssetKind } from '../../storage/workspaceAssetStore.js';
-import type { RouteContext, RouteHandler } from '../routes.js';
+import { type RouteContext, type RouteHandler } from './primitives.js';
 type AssetMetadata = DocumentRegistryEntry & {
     quarantineStatus?: 'none' | 'quarantined' | 'released';
     workspaceId?: string;
@@ -51,7 +52,9 @@ export interface DocumentRouteDependencies {
     resolveEffectiveObjectStorageConfig: () => ResolvedObjectStorageConfig;
     getObjectStorageClient: () => ObjectStorageClient | null;
     resolveStorageWorkspaceId: (req: IncomingMessage, body?: any) => string | null;
-    ensureContextUploadAllowed: (req: IncomingMessage, res: ServerResponse, workspaceId: string) => boolean;
+    ensureContextUploadAllowed: (req: IncomingMessage, res: ServerResponse, workspaceId: string, options?: {
+        requestedBytes?: number | null;
+    }) => boolean;
     parseStorageFolderSegments: (folderPathRaw: unknown) => string[] | null;
     buildCanonicalWorkspaceAssetRelativePath: (params: {
         workspaceIdRaw: unknown;

package/dist/server/routes/documents.js

@@ -15,6 +15,7 @@
  *   GET    /api/taskforce/context-metadata
  *   POST   /api/taskforce/context/purge-expired
  *   GET    /api/taskforce/documents
+ *   POST   /api/taskforce/documents/:assetId/attach
  *   DELETE /api/taskforce/documents/:assetId
  *   PATCH  /api/taskforce/documents/:assetId
  *   POST   /api/taskforce/documents/save
@@ -29,21 +30,122 @@ import { purgeExpiredDocuments } from '../../storage/documentPurge.js';
 import { parsePlan } from '../../utils/planParser.js';
 import { getCanonicalDocumentName, getReadableDocumentName, isGeneratedDocumentName } from '../../utils/documentNames.js';
 import { requestRuntimeMode } from './shared.js';
-import { parseJsonBody } from '../routes.js';
+import { parseJsonBody } from './primitives.js';
+import { resolveDeploymentConfig } from '../../config/deployment.js';
+function isUserProfileAvatarPath(relativePath) {
+    return /^users\/[^/]+\/profile\/avatar\/[^/]+$/i.test(String(relativePath || '').replace(/\\/g, '/'));
+}
+function isAiProfileAvatarPath(relativePath) {
+    return /^workspaces\/[^/]+\/assets\/images\/ai-profiles\/[^/]+\/avatar\/[^/]+$/i.test(String(relativePath || '').replace(/\\/g, '/'));
+}
+function resolveRequestOrigin(req) {
+    const host = String(req.headers.host || '').trim();
+    if (!host)
+        return '';
+    const proto = String(req.headers['x-forwarded-proto'] || '').trim().toLowerCase() === 'https'
+        ? 'https'
+        : (req.socket?.encrypted ? 'https' : 'http');
+    return `${proto}://${host.replace(/\/+$/, '')}`;
+}
+async function proxyCloudUserProfileAvatar(req, res, relativePath, contentTypeForExt) {
+    if (!isUserProfileAvatarPath(relativePath))
+        return false;
+    const deployment = resolveDeploymentConfig(process.env);
+    const cloudBaseUrl = String(deployment.cloudBaseUrl || deployment.cloudAuthBaseUrl || '').trim().replace(/\/+$/, '');
+    if (!cloudBaseUrl)
+        return false;
+    if (cloudBaseUrl === resolveRequestOrigin(req))
+        return false;
+    const requestUrl = new URL(req.url || '', 'http://localhost');
+    const upstreamUrl = `${cloudBaseUrl}/api/taskforce/context/${encodeURIComponent(relativePath)}${requestUrl.search || ''}`;
+    const headers = new Headers();
+    const cookie = String(req.headers.cookie || '').trim();
+    const accept = String(req.headers.accept || '').trim();
+    const userAgent = String(req.headers['user-agent'] || '').trim();
+    if (cookie)
+        headers.set('cookie', cookie);
+    if (accept)
+        headers.set('accept', accept);
+    if (userAgent)
+        headers.set('user-agent', userAgent);
+    headers.set('x-taskforce-origin-runtime', 'local-proxy');
+    const cfClientId = String(process.env.TASKFORCE_CF_ACCESS_CLIENT_ID || process.env.CF_ACCESS_CLIENT_ID || '').trim();
+    const cfClientSecret = String(process.env.TASKFORCE_CF_ACCESS_CLIENT_SECRET || process.env.CF_ACCESS_CLIENT_SECRET || '').trim();
+    if (cfClientId && cfClientSecret) {
+        headers.set('CF-Access-Client-Id', cfClientId);
+        headers.set('CF-Access-Client-Secret', cfClientSecret);
+    }
+    try {
+        const upstream = await fetch(upstreamUrl, {
+            method: 'GET',
+            headers
+        });
+        if (upstream.status === 404)
+            return false;
+        const outgoingHeaders = {};
+        for (const [key, value] of upstream.headers.entries()) {
+            const name = key.toLowerCase();
+            if (name === 'set-cookie' || name === 'content-length' || name === 'transfer-encoding')
+                continue;
+            outgoingHeaders[key] = value;
+        }
+        if (!outgoingHeaders['content-type']) {
+            outgoingHeaders['Content-Type'] = contentTypeForExt(path.extname(relativePath).toLowerCase());
+        }
+        res.writeHead(upstream.status, outgoingHeaders);
+        res.end(Buffer.from(await upstream.arrayBuffer()));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 export function registerDocumentRoutes(deps) {
     const { addRoute, core, context, requestWorkspaceId, ensureAdminRole, resolveEffectiveObjectStorageConfig, getObjectStorageClient, resolveStorageWorkspaceId, ensureContextUploadAllowed, parseStorageFolderSegments, buildCanonicalWorkspaceAssetRelativePath, inferAssetKindFromPath, appendStorageTelemetry, scanAndRecordDocument, buildTaskAttachmentPayload, workspaceAssetStore, taskAssetStore, normalizeDocumentPathInput, getAssetMetadata, getCanonicalAssetMetadata, documentRetentionDays, appendDocumentPurgeHistory, markAssetDeleted, isAssetDeleted, clearAssetDeleted, ensureWithinDir, sanitizeDownloadFilename, contentTypeForExt, inferInlineDocumentFromPath, resolveCanonicalDocumentRead, inferWorkspaceIdFromStoragePath, inferTaskIdFromStoragePath, } = deps;
+    const removeDocumentAttachmentFromTaskAttachments = (attachmentsRaw, asset) => {
+        const canonicalDocumentPath = `/api/taskforce/documents/${encodeURIComponent(asset.assetId)}/content`;
+        const legacyContextPath = `/api/taskforce/context/${encodeURIComponent(asset.storageKey)}`;
+        if (!Array.isArray(attachmentsRaw))
+            return [];
+        return attachmentsRaw.filter((attachment) => {
+            if (typeof attachment === 'string') {
+                const normalized = attachment.trim();
+                if (!normalized)
+                    return false;
+                return normalized !== canonicalDocumentPath
+                    && normalized !== legacyContextPath
+                    && normalized !== asset.storageKey;
+            }
+            if (!attachment || typeof attachment !== 'object')
+                return false;
+            const candidate = attachment;
+            const candidatePath = String(candidate.path || '').trim();
+            const candidateFsPath = String(candidate.fsPath || '').trim();
+            const candidateAssetId = String(candidate.assetId || '').trim();
+            if (candidateAssetId && candidateAssetId === asset.assetId)
+                return false;
+            if (candidatePath === canonicalDocumentPath || candidatePath === legacyContextPath)
+                return false;
+            if (candidateFsPath && candidateFsPath === asset.storageKey)
+                return false;
+            return !!candidatePath;
+        });
+    };
     addRoute('POST', '/api/taskforce/context-upload/init', async (req, res) => {
         const resolvedObjectStorage = resolveEffectiveObjectStorageConfig();
         const objectStorageClient = getObjectStorageClient();
         const body = await parseJsonBody(req);
         const { originalName, mimeType, taskId, folderPath } = body || {};
         const workspaceId = resolveStorageWorkspaceId(req, body);
+        const requestedBytes = Number(body?.size);
         if (!workspaceId) {
             res.writeHead(400, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'workspaceId is required and cannot be default for uploads.' }));
             return;
         }
-        if (!ensureContextUploadAllowed(req, res, workspaceId))
+        if (!ensureContextUploadAllowed(req, res, workspaceId, {
+            requestedBytes: Number.isFinite(requestedBytes) ? requestedBytes : null
+        }))
             return;
         const folderSegments = parseStorageFolderSegments(folderPath);
         if (folderSegments === null) {
@@ -144,6 +246,10 @@ export function registerDocumentRoutes(deps) {
             res.end(JSON.stringify({ error: 'Uploaded file not found.' }));
             return;
         }
+        if (!ensureContextUploadAllowed(req, res, workspaceId, {
+            requestedBytes: object.body.length
+        }))
+            return;
         try {
             const taskId = typeof body?.taskId === 'string' && body.taskId.trim().length > 0
                 ? body.taskId.trim()
@@ -191,8 +297,6 @@ export function registerDocumentRoutes(deps) {
             res.end(JSON.stringify({ error: 'workspaceId is required and cannot be default for uploads.' }));
             return;
         }
-        if (!ensureContextUploadAllowed(req, res, workspaceId))
-            return;
         const folderSegments = parseStorageFolderSegments(folderPath);
         if (folderSegments === null) {
             res.writeHead(400, { 'Content-Type': 'application/json' });
@@ -233,6 +337,10 @@ export function registerDocumentRoutes(deps) {
         const actualFilename = `${safeBase}-${Date.now()}${extension}`;
         const { basePath, projectRoot } = core.getPaths();
         const buffer = Buffer.from(base64Data, 'base64');
+        if (!ensureContextUploadAllowed(req, res, workspaceId, {
+            requestedBytes: buffer.length
+        }))
+            return;
         const relativeToStorage = buildCanonicalWorkspaceAssetRelativePath({
             workspaceIdRaw: workspaceId,
             kind: mimeType.startsWith('image/') ? 'image' : inferAssetKindFromPath(actualFilename),
@@ -358,9 +466,14 @@ export function registerDocumentRoutes(deps) {
             return;
         }
         if (objectStorageClient && normalizedRelative && resolvedObjectStorage.provider === 'r2' && resolvedObjectStorage.r2) {
-            if (shouldProxyInlineDocument) {
+            const shouldProxyInlineUserAvatar = isUserProfileAvatarPath(normalizedRelative);
+            const shouldProxyInlineAiAvatar = isAiProfileAvatarPath(normalizedRelative);
+            if (shouldProxyInlineDocument || shouldProxyInlineUserAvatar || shouldProxyInlineAiAvatar) {
                 const object = await objectStorageClient.getObject(normalizedRelative);
                 if (!object) {
+                    if (shouldProxyInlineUserAvatar && await proxyCloudUserProfileAvatar(req, res, normalizedRelative, contentTypeForExt)) {
+                        return;
+                    }
                     res.writeHead(404, { 'Content-Type': 'text/plain' });
                     res.end('Context file not found');
                     return;
@@ -385,6 +498,9 @@ export function registerDocumentRoutes(deps) {
             res.end(fs.readFileSync(filePath));
             return;
         }
+        if (normalizedRelative && await proxyCloudUserProfileAvatar(req, res, normalizedRelative, contentTypeForExt)) {
+            return;
+        }
         res.writeHead(404, { 'Content-Type': 'text/plain' });
         res.end('Context file not found');
     });
@@ -552,9 +668,6 @@ export function registerDocumentRoutes(deps) {
     });
     addRoute('GET', '/api/taskforce/documents', async (req, res) => {
         const workspaceId = requestWorkspaceId(req);
-        const { basePath, projectRoot } = core.getPaths();
-        const planningDocsDir = path.join(basePath, 'docs');
-        const runtimeMode = context.authConfig?.runtimeMode === 'cloud' ? 'cloud' : 'local';
         function inferDocType(filename) {
             const base = path.basename(filename, path.extname(filename)).toLowerCase();
             if (base.includes('implementation-plan') || base.includes('implementation_plan'))
@@ -592,12 +705,9 @@ export function registerDocumentRoutes(deps) {
                 : (taskId ? 1 : 0);
             const attachmentState = input.attachmentState === 'attached'
                 || input.attachmentState === 'unattached'
-                || input.attachmentState === 'standalone'
                 ? (attachmentCount > 0 || taskId
                     ? 'attached'
-                    : input.attachmentState === 'standalone'
-                        ? 'standalone'
-                        : 'unattached')
+                    : 'unattached')
                 : (attachmentCount > 0 || taskId ? 'attached' : 'unattached');
             return {
                 id: input.id,
@@ -620,12 +730,6 @@ export function registerDocumentRoutes(deps) {
                 attachmentState
             };
         }
-        function safeRelative(fullPath) {
-            const rel = path.relative(projectRoot, fullPath);
-            if (rel.startsWith('..'))
-                return null;
-            return rel;
-        }
         const documents = [];
         const seenDocumentPaths = new Set();
         const pushDocument = (doc) => {
@@ -636,6 +740,9 @@ export function registerDocumentRoutes(deps) {
             seenDocumentPaths.add(key);
             documents.push(normalizedDoc);
         };
+        // Shared document listing is canonical-document-only. Raw files under
+        // .taskforce/docs are intentionally excluded because they are not
+        // workspace-scoped managed documents.
         const canonicalDocuments = workspaceAssetStore?.listAllByWorkspace(workspaceId, {
             includeDeleted: false,
             kind: 'document'
@@ -651,8 +758,11 @@ export function registerDocumentRoutes(deps) {
             });
             const activeLinks = (workspaceAssetStore?.listLinksForAsset(asset.assetId, workspaceId) || [])
                 .filter((link) => !link.deletedAt)
+                .filter((link) => link.targetType !== 'task' || (!!link.taskId && !!core.getTask(link.taskId, workspaceId)));
+            const activeTaskLinks = activeLinks
+                .filter((link) => link.targetType === 'task' && !!link.taskId)
                 .filter((link) => !!core.getTask(link.taskId, workspaceId));
-            const firstLink = activeLinks[0] || null;
+            const firstLink = activeTaskLinks[0] || null;
             const repairedLogicalName = isGeneratedDocumentName(asset.logicalName || null, asset.assetId || null)
                 ? (String(firstLink?.displayName || '').trim()
                     || repairedReadableName)
@@ -704,58 +814,6 @@ export function registerDocumentRoutes(deps) {
                 attachmentState: activeLinks.length > 0 ? 'attached' : 'unattached',
             });
         }
-        if (runtimeMode !== 'cloud') {
-            const walkMarkdownFiles = (dir, visitor) => {
-                let entries = [];
-                try {
-                    entries = fs.readdirSync(dir, { withFileTypes: true });
-                }
-                catch {
-                    return;
-                }
-                for (const entry of entries) {
-                    const fullPath = path.join(dir, entry.name);
-                    if (entry.isDirectory()) {
-                        walkMarkdownFiles(fullPath, visitor);
-                        continue;
-                    }
-                    if (!entry.isFile() || path.extname(entry.name).toLowerCase() !== '.md') {
-                        continue;
-                    }
-                    let stat;
-                    try {
-                        stat = fs.statSync(fullPath);
-                    }
-                    catch {
-                        continue;
-                    }
-                    const relativePath = safeRelative(fullPath);
-                    if (!relativePath)
-                        continue;
-                    visitor({ relativePath, entryName: entry.name, stat });
-                }
-            };
-            walkMarkdownFiles(planningDocsDir, ({ relativePath, entryName, stat }) => {
-                pushDocument({
-                    id: relativePath,
-                    assetId: null,
-                    referenceNumber: null,
-                    referenceLabel: null,
-                    fsPath: relativePath,
-                    apiUrl: `/api/taskforce/context-link?path=${encodeURIComponent(relativePath)}`,
-                    taskId: null,
-                    displayName: inferTitle(entryName),
-                    originalFilename: entryName,
-                    title: inferTitle(entryName),
-                    docType: 'planning',
-                    sizeBytes: stat.size,
-                    updatedAt: stat.mtime.toISOString(),
-                    editable: true,
-                    attachmentCount: 0,
-                    attachmentState: 'standalone',
-                });
-            });
-        }
         documents.sort((a, b) => {
             if (!a.updatedAt && !b.updatedAt)
                 return 0;
@@ -768,9 +826,90 @@ export function registerDocumentRoutes(deps) {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ documents }));
     });
+    addRoute('POST', '/api/taskforce/documents/:assetId/attach', async (req, res, params) => {
+        const workspaceId = requestWorkspaceId(req);
+        const assetId = String(params.assetId || '').trim();
+        const body = await parseJsonBody(req);
+        const targetType = String(body?.targetType || 'task').trim();
+        const targetId = String(body?.targetId || '').trim();
+        if (!workspaceAssetStore || !assetId) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Document not found.' }));
+            return;
+        }
+        if (!targetId) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Missing required targetId.' }));
+            return;
+        }
+        if (targetType !== 'task') {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Only task attachments are supported from the document manager right now.' }));
+            return;
+        }
+        const asset = workspaceAssetStore.get(assetId, workspaceId);
+        if (!asset || asset.kind !== 'document' || asset.deletedAt) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Document not found.' }));
+            return;
+        }
+        const task = core.getTask(targetId, workspaceId);
+        if (!task) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Task not found.' }));
+            return;
+        }
+        const existingLinks = workspaceAssetStore.listLinksForTarget('task', targetId, workspaceId)
+            .filter((link) => !link.deletedAt);
+        const alreadyAttached = existingLinks.some((link) => link.assetId === asset.assetId && link.role === 'attachment');
+        if (alreadyAttached) {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                success: true,
+                alreadyAttached: true,
+                targetType: 'task',
+                targetId,
+                attachmentCount: existingLinks.length,
+            }));
+            return;
+        }
+        const payload = buildTaskAttachmentPayload(asset.storageKey, {
+            caption: getCanonicalDocumentName({
+                assetId: asset.assetId,
+                fsPath: asset.storageKey,
+                logicalName: asset.logicalName || null,
+                title: asset.logicalName || asset.originalFilename,
+                originalFilename: asset.originalFilename,
+            }),
+            assetId: asset.assetId,
+            taskId: targetId,
+        });
+        if (!payload) {
+            res.writeHead(500, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Failed to build attachment payload for this document.' }));
+            return;
+        }
+        core.updateTask(targetId, {
+            attachments: [...(Array.isArray(task.attachments) ? task.attachments : []), payload],
+        }, workspaceId, {
+            actorRef: 'user',
+            saveSource: 'manual',
+        });
+        core.notifyDocumentMetadataMutation(workspaceId, [asset.storageKey], 'upsert');
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            success: true,
+            attached: true,
+            alreadyAttached: false,
+            targetType: 'task',
+            targetId,
+        }));
+    });
     addRoute('DELETE', '/api/taskforce/documents/:assetId', async (req, res, params) => {
         const workspaceId = requestWorkspaceId(req);
         const assetId = String(params.assetId || '').trim();
+        const body = await parseJsonBody(req);
+        const forceDetach = body?.forceDetach === true;
         if (!workspaceAssetStore || !assetId) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Document not found' }));
@@ -784,16 +923,44 @@ export function registerDocumentRoutes(deps) {
         }
         const activeLinks = workspaceAssetStore.listLinksForAsset(asset.assetId, workspaceId)
             .filter((link) => !link.deletedAt)
+            .filter((link) => link.targetType === 'task' && !!link.taskId)
             .filter((link) => !!core.getTask(link.taskId, workspaceId));
         if (activeLinks.length > 0) {
-            res.writeHead(409, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'Document is still attached to one or more tasks.' }));
-            return;
+            if (!forceDetach) {
+                res.writeHead(409, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({
+                    error: 'Document is still attached to one or more tasks.',
+                    activeAttachmentCount: activeLinks.length,
+                    requiresForceDetach: true
+                }));
+                return;
+            }
+            for (const link of activeLinks) {
+                const taskId = link.taskId;
+                const task = core.getTask(taskId, workspaceId);
+                if (!task)
+                    continue;
+                const updatedAttachments = removeDocumentAttachmentFromTaskAttachments(task.attachments, asset);
+                core.updateTask(taskId, { attachments: updatedAttachments }, workspaceId, {
+                    actorRef: 'user',
+                    saveSource: 'manual'
+                });
+            }
         }
         const nowIso = new Date().toISOString();
         const purgeAfter = new Date(Date.now() + documentRetentionDays * 24 * 60 * 60 * 1000).toISOString();
         const metadata = markAssetDeleted(asset.storageKey);
         workspaceAssetStore.markDeleted(asset.assetId, workspaceId, nowIso, purgeAfter);
+        const links = workspaceAssetStore.listLinksForAsset(asset.assetId, workspaceId, { includeDeleted: true });
+        for (const link of links) {
+            workspaceAssetStore.deleteLink({
+                workspaceId,
+                assetId: asset.assetId,
+                targetType: link.targetType,
+                targetId: link.targetId,
+                role: link.role
+            });
+        }
         appendStorageTelemetry('delete.soft', {
             path: asset.storageKey,
             status: 'soft-deleted',
@@ -803,6 +970,7 @@ export function registerDocumentRoutes(deps) {
         res.end(JSON.stringify({
             success: true,
             softDeleted: true,
+            detachedTaskCount: activeLinks.length,
             retentionDays: documentRetentionDays,
             purgeAfter: metadata?.purgeAfter || purgeAfter
         }));

package/dist/server/routes/primitives.d.ts

@@ -0,0 +1,11 @@
+import { IncomingMessage, ServerResponse } from 'http';
+import type { TaskforceAuthConfig } from '../auth.js';
+import type { ResolvedObjectStorageConfig } from '../../storage/objectStorage.js';
+export type RouteHandler = (req: IncomingMessage, res: ServerResponse, params: Record<string, string>) => Promise<void>;
+export interface RouteContext {
+    authConfig?: TaskforceAuthConfig;
+    objectStorage?: ResolvedObjectStorageConfig;
+}
+export declare function parseJsonBody(req: IncomingMessage, maxBytes?: number): Promise<any>;
+export declare function parseFormBody(req: IncomingMessage, maxBytes?: number): Promise<Record<string, string>>;
+export declare function escapeHtml(value: unknown): string;

package/dist/server/routes/primitives.js

@@ -0,0 +1,73 @@
+const DEFAULT_MAX_JSON_BODY_BYTES = 1024 * 1024; // 1MB
+function createHttpError(message, statusCode) {
+    const error = new Error(message);
+    error.statusCode = statusCode;
+    return error;
+}
+export async function parseJsonBody(req, maxBytes = DEFAULT_MAX_JSON_BODY_BYTES) {
+    const safeMaxBytes = Number.isFinite(maxBytes) && maxBytes > 0
+        ? Math.floor(maxBytes)
+        : DEFAULT_MAX_JSON_BODY_BYTES;
+    return new Promise((resolve, reject) => {
+        let body = '';
+        let receivedBytes = 0;
+        req.on('data', chunk => {
+            receivedBytes += chunk.length;
+            if (receivedBytes > safeMaxBytes) {
+                req.pause();
+                reject(createHttpError(`Payload too large (max ${safeMaxBytes} bytes)`, 413));
+                return;
+            }
+            body += chunk;
+        });
+        req.on('end', () => {
+            try {
+                resolve(body ? JSON.parse(body) : {});
+            }
+            catch {
+                reject(createHttpError('Invalid JSON', 400));
+            }
+        });
+        req.on('error', reject);
+    });
+}
+export async function parseFormBody(req, maxBytes = DEFAULT_MAX_JSON_BODY_BYTES) {
+    const safeMaxBytes = Number.isFinite(maxBytes) && maxBytes > 0
+        ? Math.floor(maxBytes)
+        : DEFAULT_MAX_JSON_BODY_BYTES;
+    return new Promise((resolve, reject) => {
+        let body = '';
+        let receivedBytes = 0;
+        req.on('data', chunk => {
+            receivedBytes += chunk.length;
+            if (receivedBytes > safeMaxBytes) {
+                req.pause();
+                reject(createHttpError(`Payload too large (max ${safeMaxBytes} bytes)`, 413));
+                return;
+            }
+            body += chunk;
+        });
+        req.on('end', () => {
+            try {
+                const params = new URLSearchParams(body);
+                const parsed = {};
+                params.forEach((value, key) => {
+                    parsed[String(key)] = String(value);
+                });
+                resolve(parsed);
+            }
+            catch {
+                reject(createHttpError('Invalid form body', 400));
+            }
+        });
+        req.on('error', reject);
+    });
+}
+export function escapeHtml(value) {
+    return String(value || '')
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}

package/dist/server/routes/resources.d.ts

@@ -17,7 +17,7 @@
  *   GET  /api/taskforce/environments
  */
 import type { TaskforceCore } from '../../core/Taskforce.js';
-import { type RouteHandler } from '../routes.js';
+import { type RouteHandler } from './primitives.js';
 export interface ResourceRouteDependencies {
     addRoute: (method: string, path: string, handler: RouteHandler) => void;
     core: TaskforceCore;

package/dist/server/routes/resources.js

@@ -19,7 +19,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { execFileSync } from 'child_process';
-import { parseJsonBody } from '../routes.js';
+import { parseJsonBody } from './primitives.js';
 const WORKFLOW_EDITOR_LOCKED_FIELDS = {
     do: ['aliasesText', 'dispatchDefault', 'criticalToolsText', 'contentDefault'],
     execute: ['aliasesText', 'dispatchDefault', 'criticalToolsText', 'contentDefault']

package/dist/server/routes/shared.d.ts

@@ -8,9 +8,34 @@
 import { IncomingMessage, ServerResponse } from 'http';
 import { TaskforceCore } from '../../core/Taskforce.js';
 import type { McpAccessTokenAuthResult, McpOAuthAccessTokenAuthResult, McpAccessTokenScope } from '../../core/Taskforce.js';
-import type { RouteContext } from '../routes.js';
+import type { RouteContext } from './primitives.js';
 import type { AiProfileBootstrapConfig } from '../../mcp/aiProfileBootstrap.js';
+import type { AiProfileSeatScope } from '../../shared/aiProfileSeatScope.js';
 export declare function resolveErrorStatusCode(error: unknown, fallback?: number): number;
+export declare const BOOTSTRAP_ROUTE_SLOW_THRESHOLD_MS = 1500;
+export declare const BOOTSTRAP_ROUTE_SEVERE_THRESHOLD_MS = 5000;
+export type ServerTimingMetric = {
+    name: string;
+    durationMs: number;
+};
+export declare function getRouteTimingNow(): number;
+export declare function buildServerTimingMetric(name: string, durationMs: number): string;
+export declare function setServerTimingHeader(res: ServerResponse, metrics: ServerTimingMetric[]): void;
+export declare function serializeJsonWithTiming(payload: unknown, startedAt?: number): {
+    body: string;
+    byteLength: number;
+    durationMs: number;
+};
+export declare function requestBootstrapTraceId(req: IncomingMessage): string;
+export declare function logSlowBootstrapRoute(input: {
+    route: string;
+    workspaceId: string;
+    durationMs: number;
+    traceId?: string | null;
+    thresholdMs?: number;
+    severeThresholdMs?: number;
+    details?: Record<string, unknown>;
+}): void;
 export declare function buildCloudMcpRuntimeAuth(input: {
     req: IncomingMessage;
     auth: {
@@ -34,6 +59,7 @@ export declare function buildCloudMcpRuntimeAuth(input: {
     aiProfileProvider?: AiProfileBootstrapConfig['aiProfileProvider'];
     aiProfileModel?: AiProfileBootstrapConfig['aiProfileModel'];
     aiProfileSurfaceType?: AiProfileBootstrapConfig['aiProfileSurfaceType'];
+    aiProfileSeatScope?: AiProfileSeatScope | null;
     actorType?: 'local' | 'user' | 'token' | 'oauth';
     requestId?: string | null;
     ip?: string | null;
@@ -51,7 +77,7 @@ export declare function makeResolveAuthenticatedUserId(core: TaskforceCore, cont
 export declare function makeResolveAuthenticatedMutationUserId(core: TaskforceCore, context: RouteContext, requestWorkspaceId: (req: IncomingMessage) => string): (req: IncomingMessage) => string;
 export declare function makeEnsureAppAccess(core: TaskforceCore, context: RouteContext): (req: IncomingMessage, res: ServerResponse) => boolean;
 export declare function makeEnsureAdminRole(core: TaskforceCore, context: RouteContext): (req: IncomingMessage) => boolean;
-export declare function makeEnsureAuthenticatedUser(): (req: IncomingMessage) => boolean;
+export declare function makeEnsureAuthenticatedUser(authConfig?: RouteContext['authConfig']): (req: IncomingMessage) => boolean;
 export declare function ensureOwnerRole(req: IncomingMessage): boolean;
 export declare function ensureWorkspaceAdminRole(req: IncomingMessage): boolean;
 export declare function makeResolveAdminRequestActor(core: TaskforceCore, context: RouteContext): (req: IncomingMessage) => {
@@ -60,6 +86,6 @@ export declare function makeResolveAdminRequestActor(core: TaskforceCore, contex
     systemRole: "system_admin" | "user";
 };
 export declare function makeAuditAdminAction(core: TaskforceCore, context: RouteContext): (req: IncomingMessage, action: string, details: Record<string, unknown>) => void;
-export declare function makeAuditAuthAction(core: TaskforceCore, requestWorkspaceId: (req: IncomingMessage) => string, context: RouteContext): (req: IncomingMessage, action: string, details: Record<string, unknown>) => void;
+export declare function makeAuditAuthAction(core: TaskforceCore, requestWorkspaceId: (req: IncomingMessage) => string, context: RouteContext): (req: IncomingMessage, action: string, details: Record<string, unknown>, workspaceIdOverride?: string | null) => void;
 export declare function makeRequireCloudRuntime(context: RouteContext): (res: ServerResponse, feature: string) => boolean;
 export declare function makeEnsureCloudPlanData(context: RouteContext): (req: IncomingMessage, res: ServerResponse) => boolean;