@taskforcehq/taskforce 0.3.305 → 0.3.306

package/dist/TaskforceCore.js

@@ -15,6 +15,7 @@ import logoDark from './assets/branding/logos/logo_dark.svg';
 import taskforceBg from './assets/images/taskforce.png';
 import { isLightThemeFamily } from './utils/theme';
 import { Cloud, LaptopMinimal } from 'lucide-react';
+import { getPasswordPolicyGuidance, validatePasswordPolicy } from './shared/passwordPolicy';
 function isDebugModeEnabled() {
     const runtimeOverride = globalThis.__DEBUG_MODE__;
     if (typeof runtimeOverride === 'boolean')
@@ -58,18 +59,21 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
     const [loginEmail, setLoginEmail] = useState('');
     const [loginDisplayName, setLoginDisplayName] = useState('');
     const [loginPassword, setLoginPassword] = useState('');
+    const [loginPasswordConfirm, setLoginPasswordConfirm] = useState('');
     const [authMode, setAuthMode] = useState('login');
     const [verificationToken, setVerificationToken] = useState('');
     const [pendingVerificationWorkspaceSetupRequired, setPendingVerificationWorkspaceSetupRequired] = useState(false);
     const [pendingVerificationCommercialState, setPendingVerificationCommercialState] = useState(null);
     const [pendingVerificationRedirectPath, setPendingVerificationRedirectPath] = useState(null);
     const [pendingPostAuthRedirect, setPendingPostAuthRedirect] = useState(null);
+    const [commercialOnboardingRedirectActive, setCommercialOnboardingRedirectActive] = useState(false);
     const [resetToken, setResetToken] = useState('');
     const [inviteToken, setInviteToken] = useState('');
     const [inviteEmail, setInviteEmail] = useState(null);
     const [inviteWorkspaceId, setInviteWorkspaceId] = useState(null);
     const [inviteResolution, setInviteResolution] = useState('unknown');
     const [invitePasswordRequired, setInvitePasswordRequired] = useState(false);
+    const [inviteOAuthProviders, setInviteOAuthProviders] = useState([]);
     const [loginNotice, setLoginNotice] = useState(null);
     const [loginError, setLoginError] = useState(null);
     const [loginErrorCode, setLoginErrorCode] = useState(null);
@@ -109,7 +113,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         onTaskCountChange,
         onClose
     });
-    const { runtimeMode, workspaceSwitchingEnabled, currentWorkspaceId, configLoaded, cloudAuthConfigured, authRequiredForApi, authBlocked, isAuthenticated, hasBetaAccess, authSessionResolved, workspaceBootstrapPending, bootstrapPhase, bootstrapError, setupState, runtimeCapabilities, refreshSetupContext, retryBootstrapChecks, createWorkspace, saveWorkspaceProfile, fetchWorkspaces, applyWorkspaceSyncStateSnapshot, workspaceCloudSyncEnabled, workspaceSyncPhase, workspaceSyncSetupIntent, workspaceSyncSummary, workspaceSyncRecommendedAction, workspaceSyncBusy, workspaceLastErrorMessage, retryWorkspaceCloudSync, settingsModel, fetchTasks, loginWithCredentials, registerWithCredentials, requestEmailVerification, confirmEmailVerification, requestPasswordReset, confirmPasswordReset, inspectInviteAcceptance, acceptInviteWithToken, joinInviteWithToken, authUserEmail, currentTheme, logout } = taskforceState;
+    const { runtimeMode, workspaceSwitchingEnabled, currentWorkspaceId, cloudAuthConfigured, authRequiredForApi, authBlocked, isAuthenticated, hasBetaAccess, authSessionResolved, setupState, runtimeCapabilities, refreshSetupContext, retryBootstrapChecks, createWorkspace, saveWorkspaceProfile, fetchWorkspaces, applyWorkspaceSyncStateSnapshot, workspaceCloudSyncEnabled, workspaceSyncPhase, workspaceSyncSetupIntent, workspaceSyncSummary, workspaceSyncRecommendedAction, workspaceSyncBusy, workspaceLastErrorMessage, retryWorkspaceCloudSync, settingsModel, fetchTasks, bootstrapState, loginWithCredentials, beginOAuthLogin, availableAuthProviders, registerWithCredentials, requestEmailVerification, confirmEmailVerification, requestPasswordReset, confirmPasswordReset, inspectInviteAcceptance, acceptInviteWithToken, joinInviteWithToken, authUserEmail, currentTheme, logout } = taskforceState;
     const persistWorkspaceSyncStatePatch = useCallback(async (workspaceId, patch) => {
         const response = await fetch('/api/taskforce/ui-state', {
             method: 'POST',
@@ -216,6 +220,9 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         && !isPricingRoute
         && !isPlansRoute
         && !isPlansScreen;
+    const cloudAccountAccessPending = runtimeMode === 'cloud'
+        && isAuthenticated
+        && (!authSessionResolved || !accountAccessGateResolved);
     const directRegistrationEnabled = cloudAuthConfigured;
     const authPageTitle = useMemo(() => {
         switch (authMode) {
@@ -238,7 +245,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
     const setupIntent = useMemo(() => String(new URLSearchParams(location.search).get('intent') || '').trim().toLowerCase(), [location.search]);
     const isCreateWorkspaceIntent = isSetupRoute && setupStep === 'workspace' && setupIntent === 'create-workspace';
     const shouldHoldForAuthBootstrap = mode !== 'widget'
-        && !authSessionResolved
+        && bootstrapState.authPending
         && !isLoginRoute
         && !isSetupRoute
         && !isPricingRoute
@@ -266,23 +273,47 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
     const needsWorkspaceSetup = workspaceLifecycle.needsWorkspaceSetup;
     const hasSetupReadError = workspaceLifecycle.hasSetupReadError;
     const shouldHoldForSetupBootstrap = mode !== 'widget'
-        && authSessionResolved
+        && bootstrapState.auth.resolved
         && !shouldForceLogin
         && !shouldForceComingSoon
         && !isPricingRoute
         && !isPlansRoute
         && !isPlansScreen
-        && (!configLoaded || workspaceBootstrapPending || bootstrapPhase === 'stalled')
+        && bootstrapState.appPending
         && (isSetupRoute || runtimeMode === 'cloud' || isLikelyCloudAppHost);
-    const bootstrapSubtitle = useMemo(() => {
-        if (bootstrapPhase === 'auth')
-            return 'Verifying session...';
-        if (bootstrapPhase === 'workspace')
-            return 'Resolving workspace access...';
-        if (bootstrapPhase === 'config')
-            return 'Loading configuration...';
-        return 'Checking account, workspace access, and setup status...';
-    }, [bootstrapPhase]);
+    const shouldHoldForCommercialOnboardingRedirect = runtimeMode === 'cloud'
+        && commercialOnboardingRedirectActive
+        && !isPlansScreen;
+    const bootstrapSubtitle = bootstrapState.subtitle;
+    const showGuidedWorkspaceSetup = isCreateWorkspaceIntent
+        || (isSetupRoute && Boolean(activeCloudWorkspaceImport))
+        || (isSetupRoute && setupGateActive && (hasSetupReadError || needsGlobalSetup || needsWorkspaceSetup));
+    const shellRenderState = useMemo(() => {
+        if (shouldHoldForAuthBootstrap)
+            return 'auth-bootstrap';
+        if (shouldHoldForCommercialOnboardingRedirect)
+            return 'app-bootstrap';
+        if (shouldHoldForSetupBootstrap)
+            return 'app-bootstrap';
+        if (isLoginRoute)
+            return 'login';
+        if (shouldForceLogin && !isLoginRoute)
+            return 'login-redirect';
+        if (isComingSoonRoute && shouldForceComingSoon)
+            return 'coming-soon';
+        if (showGuidedWorkspaceSetup)
+            return 'guided-setup';
+        return 'app';
+    }, [
+        isComingSoonRoute,
+        isLoginRoute,
+        shouldForceComingSoon,
+        shouldForceLogin,
+        shouldHoldForCommercialOnboardingRedirect,
+        shouldHoldForAuthBootstrap,
+        shouldHoldForSetupBootstrap,
+        showGuidedWorkspaceSetup
+    ]);
     const isPlaceholderWorkspaceName = useCallback((name, workspaceId, _description) => {
         const normalizedName = String(name || '').trim().toLowerCase();
         const normalizedWorkspaceId = String(workspaceId || '').trim().toLowerCase();
@@ -299,7 +330,12 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         setSetupModeChoice(modeValue);
     }, [setupState?.mode]);
     useEffect(() => {
-        if (runtimeMode !== 'cloud' || !isAuthenticated || !authSessionResolved) {
+        if (runtimeMode !== 'cloud' || !isAuthenticated) {
+            setAccountAccessGate(null);
+            setAccountAccessGateResolved(false);
+            return;
+        }
+        if (!authSessionResolved) {
             setAccountAccessGate(null);
             setAccountAccessGateResolved(false);
             return;
@@ -637,27 +673,95 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         setPendingVerificationRedirectPath(null);
     }, [authMode, isLoginRoute, loginRouteMode]);
     useEffect(() => {
-        if (!isLoginRoute || !pendingPostAuthRedirect || !authSessionResolved || !isAuthenticated)
+        if (authMode === 'register')
             return;
-        if (runtimeMode === 'cloud' && !pendingPostAuthRedirect.commercialOnboardingGate && !accountAccessGateResolved) {
+        setLoginPasswordConfirm('');
+    }, [authMode]);
+    useEffect(() => {
+        if (!pendingPostAuthRedirect || !isAuthenticated)
+            return;
+        if (!pendingPostAuthRedirect.commercialOnboardingGate && (!authSessionResolved || cloudAccountAccessPending)) {
             return;
         }
-        if (!pendingPostAuthRedirect.commercialOnboardingGate && pendingPostAuthRedirect.workspaceSetupRequired) {
-            navigate(resolveWorkspaceSetupPath(), { replace: true });
+        const destination = !pendingPostAuthRedirect.commercialOnboardingGate && pendingPostAuthRedirect.workspaceSetupRequired
+            ? resolveWorkspaceSetupPath()
+            : pendingPostAuthRedirect.path;
+        const currentRoute = `${location.pathname}${location.search}${location.hash || ''}`;
+        if (currentRoute !== destination) {
+            navigate(destination, { replace: true });
         }
-        else {
-            navigate(pendingPostAuthRedirect.path, { replace: true });
+    }, [
+        authSessionResolved,
+        cloudAccountAccessPending,
+        isAuthenticated,
+        location.hash,
+        location.pathname,
+        location.search,
+        navigate,
+        pendingPostAuthRedirect,
+        resolveWorkspaceSetupPath
+    ]);
+    useEffect(() => {
+        if (!commercialOnboardingRedirectActive)
+            return;
+        if (!authSessionResolved) {
+            return;
         }
+        if (!isAuthenticated) {
+            setCommercialOnboardingRedirectActive(false);
+            setPendingPostAuthRedirect(null);
+            return;
+        }
+        if (accountAccessGateResolved && accountAccessGate?.canAccessApp === true) {
+            setLoginEmail('');
+            setLoginDisplayName('');
+            setLoginPassword('');
+            setLoginPasswordConfirm('');
+            setPendingPostAuthRedirect(null);
+            setCommercialOnboardingRedirectActive(false);
+            return;
+        }
+        const destination = pendingPostAuthRedirect?.commercialOnboardingGate
+            ? pendingPostAuthRedirect.path
+            : planSelectionPath;
+        const currentRoute = `${location.pathname}${location.search}${location.hash || ''}`;
+        if (currentRoute !== destination) {
+            navigate(destination, { replace: true });
+        }
+    }, [
+        accountAccessGate?.canAccessApp,
+        accountAccessGateResolved,
+        authSessionResolved,
+        commercialOnboardingRedirectActive,
+        isAuthenticated,
+        location.hash,
+        location.pathname,
+        location.search,
+        navigate,
+        pendingPostAuthRedirect,
+        planSelectionPath
+    ]);
+    useEffect(() => {
+        if (!pendingPostAuthRedirect || !isAuthenticated)
+            return;
+        const destination = !pendingPostAuthRedirect.commercialOnboardingGate && pendingPostAuthRedirect.workspaceSetupRequired
+            ? resolveWorkspaceSetupPath()
+            : pendingPostAuthRedirect.path;
+        const currentRoute = `${location.pathname}${location.search}${location.hash || ''}`;
+        if (currentRoute !== destination)
+            return;
+        if (pendingPostAuthRedirect.commercialOnboardingGate)
+            return;
         setLoginEmail('');
         setLoginDisplayName('');
         setLoginPassword('');
+        setLoginPasswordConfirm('');
         setPendingPostAuthRedirect(null);
     }, [
-        accountAccessGateResolved,
-        authSessionResolved,
+        location.hash,
+        location.pathname,
+        location.search,
         isAuthenticated,
-        isLoginRoute,
-        navigate,
         pendingPostAuthRedirect,
         resolveWorkspaceSetupPath,
         runtimeMode
@@ -679,6 +783,9 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                 setInviteEmail(inspected.email || null);
                 setInviteWorkspaceId(inspected.workspaceId || null);
                 setInvitePasswordRequired(inspected.passwordRequired === true);
+                // Capture OAuth providers available for invite-claim (pending_setup only)
+                const oauthMethods = (inspected.availableMethods || []).filter(m => m === 'google' || m === 'github' || m === 'apple');
+                setInviteOAuthProviders(inspected.inviteeState === 'pending_setup' ? oauthMethods : []);
                 const inviteMatchesAuthenticatedUser = Boolean(isAuthenticated
                     && authUserEmail
                     && inspected.email
@@ -704,6 +811,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                 setInviteWorkspaceId(null);
                 setInviteResolution('invalid');
                 setInvitePasswordRequired(false);
+                setInviteOAuthProviders([]);
                 setLoginError(formatAuthError(inspected));
                 setLoginErrorCode(inspected.code || inspected.state || null);
             }
@@ -730,6 +838,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
     const resetCooldownSeconds = Math.max(0, Math.ceil((resetCooldownUntil - cooldownNow) / 1000));
     const verifyCooldownActive = verifyCooldownSeconds > 0;
     const resetCooldownActive = resetCooldownSeconds > 0;
+    const registerPasswordGuidance = useMemo(() => getPasswordPolicyGuidance(), []);
     const formatAuthError = (result) => {
         const message = result.error || 'Request failed.';
         const code = result.code || result.state;
@@ -756,7 +865,15 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
     useEffect(() => {
         if (mode === 'widget')
             return;
-        if (workspaceBootstrapPending)
+        if (isLoginRoute && loginBusy) {
+            return;
+        }
+        const shouldBypassWorkspacePendingForAccessGate = runtimeMode === 'cloud'
+            && isAuthenticated
+            && accountAccessGateResolved
+            && accountAccessGate?.canAccessApp === false
+            && accountAccessGate?.canAccessPlans !== false;
+        if (bootstrapState.workspace.pending && !shouldBypassWorkspacePendingForAccessGate)
             return;
         if (shouldForceComingSoon) {
             if (!isComingSoonRoute)
@@ -775,10 +892,11 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                 && isAuthenticated
                 && !shouldStayOnInviteRoute
                 && (Boolean(pendingPostAuthRedirect)
-                    || workspaceBootstrapPending
+                    || bootstrapState.workspace.pending
                     || authMode === 'register'
                     || authMode === 'verify'
-                    || (runtimeMode === 'cloud' && (!configLoaded || !accountAccessGateResolved)));
+                    || !bootstrapState.config.loaded
+                    || cloudAccountAccessPending);
             if (shouldDelayAuthenticatedLoginRedirect) {
                 return;
             }
@@ -796,6 +914,23 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         if (isLoginRoute && !isAuthenticated) {
             return;
         }
+        if (pendingPostAuthRedirect && isAuthenticated) {
+            return;
+        }
+        const shouldHoldAuthenticatedAuthRoute = isLoginRoute
+            && isAuthenticated
+            && (authMode === 'register'
+                || authMode === 'verify'
+                || (authMode === 'invite' && inviteToken.trim().length > 0));
+        if (shouldHoldAuthenticatedAuthRoute) {
+            return;
+        }
+        if (commercialOnboardingRedirectActive) {
+            return;
+        }
+        if (isPlansScreen) {
+            return;
+        }
         if (shouldForceAccountAccessGate) {
             if (!isPlansScreen) {
                 const gate = encodeURIComponent(String(accountAccessGate?.gate || 'plan_selection_required'));
@@ -812,6 +947,16 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
             }
             return;
         }
+        if (isPlansScreen && cloudAccountAccessPending) {
+            return;
+        }
+        if (isPlansScreen
+            && runtimeMode === 'cloud'
+            && accountAccessGateResolved
+            && accountAccessGate?.canAccessApp === false
+            && accountAccessGate?.canAccessPlans !== false) {
+            return;
+        }
         if (setupGateActive) {
             if (hasSetupReadError) {
                 if (!isSetupRoute || setupStep !== 'error') {
@@ -849,9 +994,12 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         isComingSoonRoute,
         isPlansRoute,
         isPlansScreen,
+        accountAccessGate,
         accountAccessGate?.gate,
         accountAccessGateResolved,
         authMode,
+        commercialOnboardingRedirectActive,
+        cloudAccountAccessPending,
         setupGateActive,
         setupState,
         hasSetupReadError,
@@ -860,9 +1008,11 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         needsGlobalSetup,
         needsWorkspaceSetup,
         setupStep,
-        workspaceBootstrapPending,
-        configLoaded,
+        bootstrapState,
         runtimeMode,
+        loginBusy,
+        isAuthenticated,
+        accountAccessGateResolved,
         inviteToken,
         location.pathname,
         location.search,
@@ -877,7 +1027,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
             return;
         if (runtimeMode !== 'local')
             return;
-        if (!configLoaded)
+        if (!bootstrapState.config.loaded)
             return;
         if (isLoginRoute || isSetupRoute)
             return;
@@ -885,7 +1035,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         if (!workspaceId || workspaceId === 'default') {
             navigate('/setup?step=workspace', { replace: true });
         }
-    }, [mode, runtimeMode, configLoaded, isLoginRoute, isSetupRoute, currentWorkspaceId, navigate]);
+    }, [mode, runtimeMode, bootstrapState.config.loaded, isLoginRoute, isSetupRoute, currentWorkspaceId, navigate]);
     const handleRetryBootstrap = useCallback(async () => {
         setBootstrapRetryBusy(true);
         try {
@@ -913,13 +1063,13 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         params.set('screen', 'plans');
         return _jsx(Navigate, { to: `/?${params.toString()}${location.hash || ''}`, replace: true });
     }
-    if (shouldHoldForAuthBootstrap) {
+    if (shellRenderState === 'auth-bootstrap') {
         return (_jsx("div", { className: shellStyles.standaloneWrapper, "data-theme": currentTheme, children: _jsx("div", { className: authStyles.loginView, children: _jsxs("div", { className: authStyles.loginCard, children: [_jsxs("div", { className: authStyles.authBrandRow, children: [_jsx("img", { src: authBrandLogo, alt: "Taskforce", className: authStyles.loginLogo }), _jsx("h1", { className: authStyles.loginTitle, children: "Loading Taskforce" })] }), _jsx("p", { className: authStyles.loginSubtitle, children: "Checking your session..." })] }) }) }));
     }
-    if (shouldHoldForSetupBootstrap) {
-        return (_jsx("div", { className: shellStyles.standaloneWrapper, "data-theme": currentTheme, children: _jsx("div", { className: authStyles.loginView, children: _jsxs("div", { className: authStyles.loginCard, children: [_jsxs("div", { className: authStyles.authBrandRow, children: [_jsx("img", { src: authBrandLogo, alt: "Taskforce", className: authStyles.loginLogo }), _jsx("h1", { className: authStyles.loginTitle, children: "Loading Taskforce" })] }), _jsx("p", { className: authStyles.loginSubtitle, children: bootstrapSubtitle }), bootstrapPhase === 'stalled' && (_jsxs(_Fragment, { children: [_jsx("p", { className: authStyles.loginError, children: bootstrapError || 'Startup checks timed out.' }), _jsx("button", { className: styles.submitBtn, disabled: bootstrapRetryBusy, onClick: handleRetryBootstrap, children: bootstrapRetryBusy ? 'Retrying...' : 'Retry checks' }), isCloudRuntime && (_jsx("button", { className: styles.cancelBtn, disabled: bootstrapRetryBusy, onClick: handleGoToSignIn, children: "Go to sign-in" }))] }))] }) }) }));
+    if (shellRenderState === 'app-bootstrap') {
+        return (_jsx("div", { className: shellStyles.standaloneWrapper, "data-theme": currentTheme, children: _jsx("div", { className: authStyles.loginView, children: _jsxs("div", { className: authStyles.loginCard, children: [_jsxs("div", { className: authStyles.authBrandRow, children: [_jsx("img", { src: authBrandLogo, alt: "Taskforce", className: authStyles.loginLogo }), _jsx("h1", { className: authStyles.loginTitle, children: "Loading Taskforce" })] }), _jsx("p", { className: authStyles.loginSubtitle, children: bootstrapSubtitle }), bootstrapState.stalled && (_jsxs(_Fragment, { children: [_jsx("p", { className: authStyles.loginError, children: bootstrapState.error || 'Startup checks timed out.' }), _jsx("button", { className: styles.submitBtn, disabled: bootstrapRetryBusy, onClick: handleRetryBootstrap, children: bootstrapRetryBusy ? 'Retrying...' : 'Retry checks' }), isCloudRuntime && (_jsx("button", { className: styles.cancelBtn, disabled: bootstrapRetryBusy, onClick: handleGoToSignIn, children: "Go to sign-in" }))] }))] }) }) }));
     }
-    if (isLoginRoute) {
+    if (shellRenderState === 'login') {
         return (_jsx("div", { className: shellStyles.standaloneWrapper, "data-theme": currentTheme, children: _jsx("div", { className: authStyles.loginView, style: {
                     backgroundImage: `linear-gradient(rgba(15, 15, 26, 0.88), rgba(15, 15, 26, 0.9)), url(${taskforceBg})`
                 }, children: _jsxs("div", { className: authStyles.loginCard, children: [!isCloudRuntime && !shouldForceLogin && (_jsx("button", { className: authStyles.loginCloseBtn, "aria-label": "Close sign in", "data-testid": "auth-close-button", onClick: () => navigate(nextPath, { replace: true }), children: "\u00D7" })), _jsxs("div", { className: authStyles.authBrandRow, children: [_jsx("img", { src: authBrandLogo, alt: "Taskforce", className: authStyles.loginLogo }), _jsxs("h1", { className: authStyles.loginTitle, children: ["TASKFORCE ", _jsx("span", { className: authStyles.loginTitleAccent, children: "HQ" })] })] }), _jsxs("p", { className: authStyles.loginSubtitle, children: [authMode === 'login' && 'Sign in with your account credentials.', authMode === 'register' && 'Create your Taskforce account.', authMode === 'verify' && 'Enter your verification token.', authMode === 'forgot' && 'Request a password reset link.', authMode === 'reset' && 'Set a new password using your reset token.', authMode === 'invite' && (inviteResolution === 'existing_user_ready'
@@ -941,7 +1091,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                             ? (invitePasswordRequired ? 'Create password' : 'Password')
                                             : 'Password'), autoComplete: authMode === 'register' || authMode === 'reset' || (authMode === 'invite' && invitePasswordRequired)
                                         ? 'new-password'
-                                        : 'current-password', "data-testid": "auth-password-input", onChange: (event) => setLoginPassword(event.target.value) })] })), authMode === 'verify' && (_jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: "Verification token" }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "text", value: verificationToken, placeholder: "Verification token", autoComplete: "one-time-code", "data-testid": "auth-verification-token-input", onChange: (event) => setVerificationToken(event.target.value) })] })), authMode === 'reset' && (_jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: "Reset token" }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "text", value: resetToken, placeholder: "Reset token", autoComplete: "one-time-code", "data-testid": "auth-reset-token-input", onChange: (event) => setResetToken(event.target.value) })] })), authMode === 'invite' && (_jsxs(_Fragment, { children: [_jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: "Invite token" }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "text", value: inviteToken, placeholder: "Invite token", "data-testid": "auth-invite-token-input", onChange: (event) => setInviteToken(event.target.value) })] }), inviteEmail && (_jsxs("p", { className: authStyles.loginSubtitle, children: ["Invite for: ", _jsx("strong", { children: inviteEmail }), inviteWorkspaceId ? ` · Workspace: ${inviteWorkspaceId}` : ''] }))] })), loginNotice && _jsx("p", { className: authStyles.loginSubtitle, children: loginNotice }), loginError && _jsx("p", { className: authStyles.loginError, children: loginError }), authMode === 'login' && loginErrorCode === 'EMAIL_NOT_VERIFIED' && loginEmail.trim() && (_jsx("button", { className: authStyles.authModeLink, disabled: loginBusy || verifyCooldownActive, onClick: async () => {
+                                        : 'current-password', "data-testid": "auth-password-input", onChange: (event) => setLoginPassword(event.target.value) })] })), (authMode === 'register' || (authMode === 'invite' && invitePasswordRequired)) && (_jsx(_Fragment, { children: _jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: "Confirm password" }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "password", value: loginPasswordConfirm, placeholder: "Confirm password", autoComplete: "new-password", "data-testid": "auth-confirm-password-input", onChange: (event) => setLoginPasswordConfirm(event.target.value) })] }) })), (authMode === 'register' || (authMode === 'invite' && invitePasswordRequired)) && (_jsx("p", { className: authStyles.loginSubtitle, children: registerPasswordGuidance.join(' ') })), authMode === 'verify' && (_jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: "Verification token" }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "text", value: verificationToken, placeholder: "Verification token", autoComplete: "one-time-code", "data-testid": "auth-verification-token-input", onChange: (event) => setVerificationToken(event.target.value) })] })), authMode === 'reset' && (_jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: "Reset token" }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "text", value: resetToken, placeholder: "Reset token", autoComplete: "one-time-code", "data-testid": "auth-reset-token-input", onChange: (event) => setResetToken(event.target.value) })] })), authMode === 'invite' && (_jsxs(_Fragment, { children: [_jsxs("label", { className: authStyles.loginField, children: [_jsx("span", { className: authStyles.loginFieldLabel, children: "Invite token" }), _jsx("input", { className: `${styles.input} ${authStyles.loginInput}`, type: "text", value: inviteToken, placeholder: "Invite token", "data-testid": "auth-invite-token-input", onChange: (event) => setInviteToken(event.target.value) })] }), inviteEmail && (_jsxs("p", { className: authStyles.loginSubtitle, children: ["Invite for: ", _jsx("strong", { children: inviteEmail }), inviteWorkspaceId ? ` · Workspace: ${inviteWorkspaceId}` : ''] }))] })), loginNotice && _jsx("p", { className: authStyles.loginSubtitle, children: loginNotice }), loginError && _jsx("p", { className: authStyles.loginError, children: loginError }), authMode === 'login' && loginErrorCode === 'EMAIL_NOT_VERIFIED' && loginEmail.trim() && (_jsx("button", { className: authStyles.authModeLink, disabled: loginBusy || verifyCooldownActive, onClick: async () => {
                                 setLoginBusy(true);
                                 setLoginNotice(null);
                                 const sent = await requestEmailVerification(loginEmail);
@@ -968,6 +1118,24 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                         setLoginBusy(false);
                                         return;
                                     }
+                                    if (authMode === 'register') {
+                                        const validation = validatePasswordPolicy(loginPassword, {
+                                            email: loginEmail,
+                                            displayName: loginDisplayName
+                                        });
+                                        if (!validation.ok) {
+                                            setLoginError(validation.message || 'Password does not meet the password policy.');
+                                            setLoginErrorCode(validation.code || null);
+                                            setLoginBusy(false);
+                                            return;
+                                        }
+                                        if (loginPassword !== loginPasswordConfirm) {
+                                            setLoginError('Passwords do not match.');
+                                            setLoginErrorCode('PASSWORD_CONFIRMATION_MISMATCH');
+                                            setLoginBusy(false);
+                                            return;
+                                        }
+                                    }
                                     let result = { success: false };
                                     if (authMode === 'login') {
                                         result = await loginWithCredentials(loginEmail, loginPassword);
@@ -1060,6 +1228,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                                 : 'Account created. Check your email for verification instructions.');
                                         }
                                         else {
+                                            setCommercialOnboardingRedirectActive(commercialOnboardingGate);
                                             setPendingPostAuthRedirect({
                                                 path: postRegistrationPath,
                                                 workspaceSetupRequired: Boolean(result.workspaceSetupRequired),
@@ -1071,6 +1240,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                         await retryBootstrapChecks();
                                         const commercialOnboardingGate = pendingVerificationCommercialState === 'pending_plan_selection'
                                             || pendingVerificationCommercialState === 'checkout_pending';
+                                        setCommercialOnboardingRedirectActive(commercialOnboardingGate);
                                         setPendingPostAuthRedirect({
                                             path: pendingVerificationRedirectPath || nextPath,
                                             workspaceSetupRequired: pendingVerificationWorkspaceSetupRequired,
@@ -1102,6 +1272,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                                 setAuthMode('invite');
                                                 setInviteResolution('existing_user_ready');
                                                 setLoginPassword('');
+                                                setLoginPasswordConfirm('');
                                                 setLoginNotice('Signed in. Review the invite details to continue.');
                                                 setLoginError(null);
                                                 setLoginErrorCode(null);
@@ -1113,6 +1284,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                             }
                                             setInviteResolution('existing_user_signed_out');
                                             setLoginPassword('');
+                                            setLoginPasswordConfirm('');
                                             setLoginNotice(normalizedInviteEmail
                                                 ? `Signed in, but this invite is for ${inviteEmail}. Sign in with that account to continue.`
                                                 : 'Signed in, but this invite requires the invited account. Sign in with that account to continue.');
@@ -1132,6 +1304,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                         if (inviteToken.trim()) {
                                             setAuthMode('invite');
                                             setLoginPassword('');
+                                            setLoginPasswordConfirm('');
                                             setLoginNotice('Signed in. Review the invite details to continue.');
                                             setLoginBusy(false);
                                             return;
@@ -1144,12 +1317,14 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                         setLoginEmail('');
                                         setLoginDisplayName('');
                                         setLoginPassword('');
+                                        setLoginPasswordConfirm('');
                                         navigate(nextPath, { replace: true });
                                     }
                                     else {
                                         setLoginEmail('');
                                         setLoginDisplayName('');
                                         setLoginPassword('');
+                                        setLoginPasswordConfirm('');
                                         navigate(nextPath, { replace: true });
                                     }
                                     setLoginBusy(false);
@@ -1162,7 +1337,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                                     ? 'Reset Password'
                                                     : (inviteResolution === 'existing_user_signed_out'
                                                         ? 'Sign In to Continue'
-                                                        : (invitePasswordRequired ? 'Create Account and Join' : 'Join Workspace'))) }) }), authMode === 'register' && (_jsxs("p", { className: authStyles.registerConsent, children: ["By creating an account, you agree to the", ' ', _jsx("a", { className: authStyles.registerConsentLink, href: "https://taskforcehq.com/legal/terms", target: "_blank", rel: "noopener noreferrer", children: "Terms of Service" }), ' ', "and acknowledge the", ' ', _jsx("a", { className: authStyles.registerConsentLink, href: "https://taskforcehq.com/legal/privacy", target: "_blank", rel: "noopener noreferrer", children: "Privacy Policy" }), "."] })), _jsxs("div", { className: authStyles.authSecondaryActions, role: "group", "aria-label": "Authentication navigation", children: [directRegistrationEnabled && (authMode === 'login' || authMode === 'register') && (_jsxs("p", { className: authStyles.authModeSwitch, children: [authMode === 'login' ? 'Need an account?' : 'Already have an account?', ' ', _jsx("button", { className: authStyles.authModeSwitchLink, disabled: loginBusy, "data-testid": "auth-switch-mode-button", onClick: () => {
+                                                        : (invitePasswordRequired ? 'Create Account and Join' : 'Join Workspace'))) }) }), (authMode === 'login' || authMode === 'register') && availableAuthProviders.length > 0 && (_jsxs("div", { className: authStyles.oauthProviders, children: [_jsx("div", { className: authStyles.oauthDivider, children: _jsx("span", { children: "or continue with" }) }), _jsxs("div", { className: authStyles.oauthButtons, children: [availableAuthProviders.includes('google') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('google', location.pathname !== '/login' ? location.pathname : '/'), "aria-label": "Continue with Google", children: "Google" })), availableAuthProviders.includes('github') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('github', location.pathname !== '/login' ? location.pathname : '/'), "aria-label": "Continue with GitHub", children: "GitHub" })), availableAuthProviders.includes('apple') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('apple', location.pathname !== '/login' ? location.pathname : '/'), "aria-label": "Continue with Apple", children: "Apple" }))] })] })), authMode === 'invite' && inviteResolution === 'new_user' && inviteOAuthProviders.length > 0 && (_jsxs("div", { className: authStyles.oauthProviders, children: [_jsx("div", { className: authStyles.oauthDivider, children: _jsx("span", { children: "or join with" }) }), _jsxs("div", { className: authStyles.oauthButtons, children: [inviteOAuthProviders.includes('google') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('google', '/', inviteToken), "aria-label": "Join with Google", children: "Google" })), inviteOAuthProviders.includes('github') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('github', '/', inviteToken), "aria-label": "Join with GitHub", children: "GitHub" })), inviteOAuthProviders.includes('apple') && (_jsx("button", { type: "button", className: authStyles.oauthButton, disabled: loginBusy, onClick: () => beginOAuthLogin('apple', '/', inviteToken), "aria-label": "Join with Apple", children: "Apple" }))] })] })), authMode === 'register' && (_jsxs("p", { className: authStyles.registerConsent, children: ["By creating an account, you agree to the", ' ', _jsx("a", { className: authStyles.registerConsentLink, href: "https://taskforcehq.com/legal/terms", target: "_blank", rel: "noopener noreferrer", children: "Terms of Service" }), ' ', "and acknowledge the", ' ', _jsx("a", { className: authStyles.registerConsentLink, href: "https://taskforcehq.com/legal/privacy", target: "_blank", rel: "noopener noreferrer", children: "Privacy Policy" }), "."] })), _jsxs("div", { className: authStyles.authSecondaryActions, role: "group", "aria-label": "Authentication navigation", children: [directRegistrationEnabled && (authMode === 'login' || authMode === 'register') && (_jsxs("p", { className: authStyles.authModeSwitch, children: [authMode === 'login' ? 'Need an account?' : 'Already have an account?', ' ', _jsx("button", { className: authStyles.authModeSwitchLink, disabled: loginBusy, "data-testid": "auth-switch-mode-button", onClick: () => {
                                                 setLoginError(null);
                                                 setLoginErrorCode(null);
                                                 setLoginNotice(null);
@@ -1185,18 +1360,15 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                                         setLoginBusy(false);
                                                     }, children: verifyCooldownActive ? `Resend Verification (${verifyCooldownSeconds}s)` : 'Resend Verification' })), _jsx("button", { className: authStyles.authModeLink, disabled: loginBusy, "data-testid": "auth-return-sign-in-button", onClick: () => { setLoginError(null); setLoginErrorCode(null); setLoginNotice(null); setLoginMode('login'); }, children: authMode === 'verify' ? 'Back to Sign In' : 'Sign In' }), directRegistrationEnabled && authMode !== 'verify' && (_jsx("button", { className: authStyles.authModeLink, disabled: loginBusy, "data-testid": "auth-return-register-button", onClick: () => { setLoginError(null); setLoginErrorCode(null); setLoginNotice(null); setLoginMode('register'); }, children: "Register" })), authMode === 'reset' && (_jsx("button", { className: authStyles.authModeLink, disabled: loginBusy || resetCooldownActive, "data-testid": "auth-return-forgot-password-button", onClick: () => { setLoginError(null); setLoginErrorCode(null); setLoginNotice(null); setLoginMode('forgot'); }, children: resetCooldownActive ? `Forgot Password (${resetCooldownSeconds}s)` : 'Forgot Password' }))] }))] })] })] }) }) }));
     }
-    if (shouldForceLogin && !isLoginRoute) {
+    if (shellRenderState === 'login-redirect') {
         return (_jsx("div", { className: shellStyles.standaloneWrapper, "data-theme": currentTheme, children: _jsx("div", { className: authStyles.loginView, children: _jsxs("div", { className: authStyles.loginCard, children: [_jsxs("div", { className: authStyles.authBrandRow, children: [_jsx("img", { src: authBrandLogo, alt: "Taskforce", className: authStyles.loginLogo }), _jsx("h1", { className: authStyles.loginTitle, children: "Loading Taskforce" })] }), _jsx("p", { className: authStyles.loginSubtitle, children: "Redirecting to sign in..." })] }) }) }));
     }
-    if (isComingSoonRoute && shouldForceComingSoon) {
+    if (shellRenderState === 'coming-soon') {
         return (_jsx("div", { className: shellStyles.standaloneWrapper, "data-theme": currentTheme, children: _jsx("div", { className: authStyles.loginView, style: {
                     backgroundImage: `linear-gradient(rgba(15, 15, 26, 0.88), rgba(15, 15, 26, 0.9)), url(${taskforceBg})`
                 }, children: _jsxs("div", { className: authStyles.loginCard, children: [_jsxs("div", { className: authStyles.authBrandRow, children: [_jsx("img", { src: authBrandLogo, alt: "Taskforce", className: authStyles.loginLogo }), _jsx("h1", { className: authStyles.loginTitle, children: "Private Beta" })] }), _jsx("p", { className: authStyles.loginSubtitle, children: "You are signed in, but your account is not in the beta allowlist yet." }), _jsx("p", { className: authStyles.loginSubtitle, children: "You will see the full app as soon as beta access is enabled." }), _jsx("button", { className: styles.cancelBtn, onClick: async () => { await taskforceState.logout(); navigate('/login', { replace: true }); }, children: "Sign Out" })] }) }) }));
     }
-    const showGuidedWorkspaceSetup = isCreateWorkspaceIntent
-        || (isSetupRoute && Boolean(activeCloudWorkspaceImport))
-        || (isSetupRoute && setupGateActive && (hasSetupReadError || needsGlobalSetup || needsWorkspaceSetup));
-    if (showGuidedWorkspaceSetup) {
+    if (shellRenderState === 'guided-setup') {
         const isError = !isCreateWorkspaceIntent && (hasSetupReadError || setupStep === 'error');
         const isGlobal = !isCreateWorkspaceIntent && !isError && (needsGlobalSetup || setupStep === 'global');
         const heading = isError