@taskforcehq/taskforce 0.3.305 → 0.3.306

package/dist/server/routes/syncPushRoutes.js

@@ -0,0 +1,212 @@
+import { decryptDocument, ENCRYPTION_PREFIX } from '../../sync/encryptionService.js';
+import { serializeTaskForSync } from '../../sync/taskSyncPayload.js';
+import { parseJsonBody } from './primitives.js';
+import { requireAuthenticatedSyncRequest, requireEnabledSyncAuth, resolveAuthorizedSyncWorkspace, } from './syncRouteGuards.js';
+export function registerWorkspacePushSyncRoutes({ addRoute, core, context, auditAuthAction, resolveErrorStatusCode, resolveRequestAccess, readPushIdempotency, writePushIdempotency, dispatchWorkspaceSyncChanges }) {
+    // POST /api/taskforce/sync/workspace/push - Incremental workspace deltas from local to cloud
+    addRoute('POST', '/api/taskforce/sync/workspace/push', async (req, res) => {
+        const auditPushSideEffect = (action, details) => {
+            try {
+                auditAuthAction(req, action, details);
+            }
+            catch {
+                // success-path diagnostics must never flip a committed push into failure
+            }
+        };
+        const startedAtMs = Date.now();
+        const authConfig = context.authConfig;
+        if (!requireEnabledSyncAuth(res, authConfig)) {
+            return;
+        }
+        const access = requireAuthenticatedSyncRequest({
+            req,
+            res,
+            authConfig,
+            resolveRequestAccess,
+            auditAuthAction,
+            unauthorizedAuditAction: 'sync-workspace-push-unauthorized'
+        });
+        if (!access) {
+            return;
+        }
+        const body = await parseJsonBody(req, 50 * 1024 * 1024);
+        const targetWorkspaceId = resolveAuthorizedSyncWorkspace({
+            req,
+            res,
+            core,
+            access,
+            requestedWorkspaceId: String(body?.workspaceId || '').trim(),
+            auditAuthAction,
+            missingWorkspaceAuditAction: 'sync-workspace-push-missing-workspace',
+            forbiddenWorkspaceAuditAction: 'sync-workspace-push-forbidden',
+            missingWorkspaceResponseExtras: {
+                durationMs: Date.now() - startedAtMs
+            }
+        });
+        if (!targetWorkspaceId) {
+            return;
+        }
+        const idempotencyKey = String(body?.idempotencyKey || '').trim();
+        if (idempotencyKey) {
+            const replay = readPushIdempotency(targetWorkspaceId, idempotencyKey);
+            if (replay) {
+                auditAuthAction(req, 'sync-workspace-push-idempotent-replay', {
+                    workspaceId: targetWorkspaceId,
+                    idempotencyKey
+                });
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(replay);
+                return;
+            }
+        }
+        let incomingChanges = Array.isArray(body?.changes) ? body.changes : [];
+        const incomingTaskUpsertIds = incomingChanges
+            .filter((change) => change?.op === 'upsert')
+            .map((change) => String(change.task?.id || '').trim())
+            .filter((taskId) => taskId.length > 0);
+        const allowReferenceNumberReassignment = body?.repair === true;
+        if (typeof process !== 'undefined' && process.env?.TASKFORCE_SYNC_KEY) {
+            const syncKey = process.env.TASKFORCE_SYNC_KEY;
+            const decryptedChanges = [];
+            for (const change of incomingChanges) {
+                if (change.op === 'asset-upsert' && typeof change.contentBase64 === 'string' && change.contentBase64.startsWith(ENCRYPTION_PREFIX)) {
+                    try {
+                        decryptedChanges.push({ ...change, contentBase64: await decryptDocument(change.contentBase64, syncKey) });
+                    }
+                    catch {
+                        decryptedChanges.push(change);
+                    }
+                }
+                else if (change.op === 'document-upsert' && typeof change.content === 'string' && change.content.startsWith(ENCRYPTION_PREFIX)) {
+                    try {
+                        decryptedChanges.push({ ...change, content: await decryptDocument(change.content, syncKey) });
+                    }
+                    catch {
+                        decryptedChanges.push(change);
+                    }
+                }
+                else {
+                    decryptedChanges.push(change);
+                }
+            }
+            incomingChanges = decryptedChanges;
+        }
+        const receivedAtBaseMs = Date.now();
+        incomingChanges = incomingChanges.map((change, index) => {
+            if (change.op !== 'upsert')
+                return change;
+            const task = change.task;
+            const rawReferenceNumber = task.referenceNumber;
+            const incomingReferenceNumber = rawReferenceNumber === undefined || rawReferenceNumber === null
+                ? null
+                : (Number.isFinite(Number(rawReferenceNumber))
+                    ? Math.max(1, Math.floor(Number(rawReferenceNumber)))
+                    : null);
+            if (incomingReferenceNumber)
+                return change;
+            return {
+                ...change,
+                task: {
+                    ...task,
+                    updatedAt: new Date(receivedAtBaseMs + index).toISOString()
+                }
+            };
+        });
+        try {
+            const { result, deleteCount, emittedEventIds } = await dispatchWorkspaceSyncChanges(targetWorkspaceId, incomingChanges, {
+                allowReferenceNumberReassignment
+            });
+            let appliedTaskUpserts = [];
+            try {
+                appliedTaskUpserts = incomingTaskUpsertIds
+                    .map((taskId) => core.getTask(taskId, targetWorkspaceId))
+                    .filter((task) => Boolean(task))
+                    .map((task) => ({
+                    archived: Boolean(task.isArchived),
+                    task: serializeTaskForSync(task)
+                }));
+            }
+            catch (error) {
+                auditPushSideEffect('sync-workspace-push-upsert-echo-failed', {
+                    workspaceId: targetWorkspaceId,
+                    taskCount: incomingTaskUpsertIds.length,
+                    error: String(error?.message || 'Failed to read back applied task upserts')
+                });
+            }
+            const durationMs = Date.now() - startedAtMs;
+            const payload = JSON.stringify({
+                success: true,
+                workspaceId: targetWorkspaceId,
+                idempotencyKey: idempotencyKey || null,
+                emittedEventIds,
+                appliedTaskUpserts,
+                result,
+                durationMs
+            });
+            if (idempotencyKey) {
+                try {
+                    writePushIdempotency(targetWorkspaceId, idempotencyKey, payload);
+                }
+                catch (error) {
+                    auditPushSideEffect('sync-workspace-push-idempotency-write-failed', {
+                        workspaceId: targetWorkspaceId,
+                        idempotencyKey,
+                        error: String(error?.message || 'Failed to persist push idempotency replay payload')
+                    });
+                }
+            }
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(payload);
+            try {
+                core.recordSyncEvent(targetWorkspaceId, {
+                    eventType: 'push',
+                    status: 'success',
+                    changeCount: incomingChanges.length,
+                    requestMs: durationMs
+                });
+            }
+            catch {
+                // success-path diagnostics must never flip a committed push into failure
+            }
+            auditPushSideEffect('sync-workspace-push-success', {
+                workspaceId: targetWorkspaceId,
+                idempotencyKey: idempotencyKey || null,
+                changeCount: incomingChanges.length,
+                deleteCount,
+                durationMs
+            });
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            const durationMs = Date.now() - startedAtMs;
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                success: false,
+                error: String(error?.message || 'Failed to apply workspace deltas'),
+                code: error?.code,
+                details: error?.details || undefined,
+                durationMs
+            }));
+            try {
+                core.recordSyncEvent(targetWorkspaceId, {
+                    eventType: 'push',
+                    status: 'error',
+                    statusCode,
+                    errorMessage: String(error?.message || 'Failed to apply workspace deltas'),
+                    changeCount: incomingChanges.length,
+                    requestMs: durationMs
+                });
+            }
+            catch {
+                // error-path diagnostics must never suppress a committed error response
+            }
+            auditPushSideEffect('sync-workspace-push-failed', {
+                workspaceId: targetWorkspaceId,
+                code: error?.code || null,
+                statusCode,
+                details: error?.details || null,
+                durationMs
+            });
+        }
+    });
+}

package/dist/server/routes/syncRouteGuards.d.ts

@@ -0,0 +1,36 @@
+import type { IncomingMessage, ServerResponse } from 'http';
+import type { SyncResolveRequestAccess, SyncResolvedAccess, SyncRouteAuthConfig } from './syncRouteTypes.js';
+interface SyncWorkspaceAccessCoreLike {
+    listUserWorkspaces(userId: string): Array<{
+        id: string;
+    }>;
+}
+interface RequireAuthenticatedSyncRequestArgs<TAuthConfig extends NonNullable<SyncRouteAuthConfig>> {
+    req: IncomingMessage;
+    res: ServerResponse;
+    authConfig: TAuthConfig | null | undefined;
+    resolveRequestAccess: SyncResolveRequestAccess;
+    auditAuthAction?: (req: IncomingMessage, action: string, details: Record<string, unknown>) => void;
+    unauthorizedAuditAction?: string;
+}
+interface ResolveAuthorizedSyncWorkspaceArgs {
+    req: IncomingMessage;
+    res: ServerResponse;
+    core: SyncWorkspaceAccessCoreLike;
+    access: SyncResolvedAccess;
+    requestedWorkspaceId: string;
+    auditAuthAction?: (req: IncomingMessage, action: string, details: Record<string, unknown>) => void;
+    missingWorkspaceAuditAction?: string;
+    forbiddenWorkspaceAuditAction?: string;
+    missingWorkspaceResponseExtras?: Record<string, unknown>;
+    forbiddenWorkspaceResponseExtras?: Record<string, unknown>;
+}
+export declare function requireEnabledSyncAuth(res: ServerResponse, authConfig: SyncRouteAuthConfig | null | undefined): boolean;
+export declare function requireAuthenticatedSyncRequest<TAuthConfig extends NonNullable<SyncRouteAuthConfig>>({ req, res, authConfig, resolveRequestAccess, auditAuthAction, unauthorizedAuditAction }: Omit<RequireAuthenticatedSyncRequestArgs<TAuthConfig>, 'authConfig'> & {
+    authConfig: TAuthConfig | null | undefined;
+}): SyncResolvedAccess | null;
+export declare function requireCloudRuntimeSnapshotAccess<TAuthConfig extends NonNullable<SyncRouteAuthConfig>>(args: Omit<RequireAuthenticatedSyncRequestArgs<TAuthConfig>, 'authConfig'> & {
+    authConfig: TAuthConfig | null | undefined;
+}): SyncResolvedAccess | null;
+export declare function resolveAuthorizedSyncWorkspace({ req, res, core, access, requestedWorkspaceId, auditAuthAction, missingWorkspaceAuditAction, forbiddenWorkspaceAuditAction, missingWorkspaceResponseExtras, forbiddenWorkspaceResponseExtras }: ResolveAuthorizedSyncWorkspaceArgs): string | null;
+export {};

package/dist/server/routes/syncRouteGuards.js

@@ -0,0 +1,67 @@
+function writeJson(res, statusCode, payload) {
+    res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(payload));
+}
+export function requireEnabledSyncAuth(res, authConfig) {
+    if (authConfig?.enabled)
+        return true;
+    writeJson(res, 400, {
+        success: false,
+        error: 'Sync is unavailable when auth is disabled.'
+    });
+    return false;
+}
+export function requireAuthenticatedSyncRequest({ req, res, authConfig, resolveRequestAccess, auditAuthAction, unauthorizedAuditAction }) {
+    if (!authConfig?.enabled)
+        return null;
+    const access = resolveRequestAccess(req, authConfig);
+    if (access.authenticated && access.userId && access.userId !== 'anonymous') {
+        return access;
+    }
+    if (auditAuthAction && unauthorizedAuditAction) {
+        auditAuthAction(req, unauthorizedAuditAction, {});
+    }
+    writeJson(res, 401, {
+        success: false,
+        error: 'Authentication required.'
+    });
+    return null;
+}
+export function requireCloudRuntimeSnapshotAccess(args) {
+    if (args.authConfig?.runtimeMode !== 'cloud') {
+        return { authenticated: true, userId: null, workspaceId: null };
+    }
+    return requireAuthenticatedSyncRequest(args);
+}
+export function resolveAuthorizedSyncWorkspace({ req, res, core, access, requestedWorkspaceId, auditAuthAction, missingWorkspaceAuditAction, forbiddenWorkspaceAuditAction, missingWorkspaceResponseExtras, forbiddenWorkspaceResponseExtras }) {
+    const normalizedWorkspaceId = String(requestedWorkspaceId || '').trim();
+    if (!normalizedWorkspaceId) {
+        if (auditAuthAction && missingWorkspaceAuditAction) {
+            auditAuthAction(req, missingWorkspaceAuditAction, { code: 'WORKSPACE_ID_REQUIRED' });
+        }
+        writeJson(res, 400, {
+            success: false,
+            error: 'workspaceId is required.',
+            code: 'WORKSPACE_ID_REQUIRED',
+            workspaceId: null,
+            ...missingWorkspaceResponseExtras
+        });
+        return null;
+    }
+    const allowed = core.listUserWorkspaces(String(access.userId || '')).find((workspace) => workspace.id === normalizedWorkspaceId);
+    if (allowed)
+        return normalizedWorkspaceId;
+    if (auditAuthAction && forbiddenWorkspaceAuditAction) {
+        auditAuthAction(req, forbiddenWorkspaceAuditAction, {
+            requestedWorkspaceId: normalizedWorkspaceId
+        });
+    }
+    writeJson(res, 403, {
+        success: false,
+        error: 'You do not have access to this workspace.',
+        code: 'WORKSPACE_ACCESS_DENIED',
+        workspaceId: normalizedWorkspaceId,
+        ...forbiddenWorkspaceResponseExtras
+    });
+    return null;
+}

package/dist/server/routes/syncRouteGuards.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/routes/syncRouteGuards.test.js

@@ -0,0 +1,94 @@
+import { describe, expect, it, vi } from 'vitest';
+import { requireAuthenticatedSyncRequest, requireCloudRuntimeSnapshotAccess, requireEnabledSyncAuth, resolveAuthorizedSyncWorkspace, } from './syncRouteGuards';
+function createMockRes() {
+    return {
+        writeHead: vi.fn(),
+        end: vi.fn()
+    };
+}
+describe('syncRouteGuards', () => {
+    it('rejects sync routes when auth is disabled', () => {
+        const res = createMockRes();
+        expect(requireEnabledSyncAuth(res, { enabled: false })).toBe(false);
+        expect(res.writeHead).toHaveBeenCalledWith(400, { 'Content-Type': 'application/json' });
+        expect(res.end).toHaveBeenCalledWith(expect.stringContaining('Sync is unavailable when auth is disabled.'));
+    });
+    it('requires authentication for enabled sync routes', () => {
+        const req = {};
+        const res = createMockRes();
+        const auditAuthAction = vi.fn();
+        expect(requireAuthenticatedSyncRequest({
+            req,
+            res,
+            authConfig: { enabled: true },
+            resolveRequestAccess: () => ({ authenticated: false, userId: null }),
+            auditAuthAction,
+            unauthorizedAuditAction: 'sync-workspace-pull-unauthorized'
+        })).toBeNull();
+        expect(auditAuthAction).toHaveBeenCalledWith(req, 'sync-workspace-pull-unauthorized', {});
+        expect(res.writeHead).toHaveBeenCalledWith(401, { 'Content-Type': 'application/json' });
+    });
+    it('skips snapshot auth in local runtime but enforces it in cloud runtime', () => {
+        const req = {};
+        const localRes = createMockRes();
+        expect(requireCloudRuntimeSnapshotAccess({
+            req,
+            res: localRes,
+            authConfig: { enabled: true, runtimeMode: 'local' },
+            resolveRequestAccess: () => ({ authenticated: false, userId: null })
+        })).toEqual({ authenticated: true, userId: null, workspaceId: null });
+        expect(localRes.writeHead).not.toHaveBeenCalled();
+        const cloudRes = createMockRes();
+        expect(requireCloudRuntimeSnapshotAccess({
+            req,
+            res: cloudRes,
+            authConfig: { enabled: true, runtimeMode: 'cloud' },
+            resolveRequestAccess: () => ({ authenticated: false, userId: null })
+        })).toBeNull();
+        expect(cloudRes.writeHead).toHaveBeenCalledWith(401, { 'Content-Type': 'application/json' });
+    });
+    it('rejects missing and unauthorized workspace access consistently', () => {
+        const req = {};
+        const res = createMockRes();
+        const auditAuthAction = vi.fn();
+        const access = { authenticated: true, userId: 'user-1' };
+        const core = {
+            listUserWorkspaces: vi.fn(() => [{ id: 'workspace-2' }])
+        };
+        expect(resolveAuthorizedSyncWorkspace({
+            req,
+            res,
+            core,
+            access,
+            requestedWorkspaceId: '',
+            auditAuthAction,
+            missingWorkspaceAuditAction: 'sync-workspace-pull-missing-workspace',
+            forbiddenWorkspaceAuditAction: 'sync-workspace-pull-forbidden'
+        })).toBeNull();
+        expect(auditAuthAction).toHaveBeenCalledWith(req, 'sync-workspace-pull-missing-workspace', { code: 'WORKSPACE_ID_REQUIRED' });
+        vi.clearAllMocks();
+        expect(resolveAuthorizedSyncWorkspace({
+            req,
+            res,
+            core,
+            access,
+            requestedWorkspaceId: 'workspace-1',
+            auditAuthAction,
+            missingWorkspaceAuditAction: 'sync-workspace-pull-missing-workspace',
+            forbiddenWorkspaceAuditAction: 'sync-workspace-pull-forbidden'
+        })).toBeNull();
+        expect(auditAuthAction).toHaveBeenCalledWith(req, 'sync-workspace-pull-forbidden', { requestedWorkspaceId: 'workspace-1' });
+        expect(res.end).toHaveBeenCalledWith(expect.stringContaining('WORKSPACE_ACCESS_DENIED'));
+    });
+    it('returns an authorized workspace id for allowed users', () => {
+        expect(resolveAuthorizedSyncWorkspace({
+            req: {},
+            res: createMockRes(),
+            core: {
+                listUserWorkspaces: () => [{ id: 'workspace-1' }]
+            },
+            access: { authenticated: true, userId: 'user-1' },
+            requestedWorkspaceId: 'workspace-1'
+        })).toBe('workspace-1');
+    });
+});

package/dist/server/routes/syncRouteTypes.d.ts

@@ -0,0 +1,13 @@
+import type { IncomingMessage, ServerResponse } from 'http';
+import type { TaskforceCore, TaskforceSyncCapable } from '../../core/Taskforce.js';
+import type { RouteContext } from './primitives.js';
+export interface SyncResolvedAccess {
+    authenticated: boolean;
+    userId?: string | null;
+    workspaceId?: string | null;
+}
+export type SyncRouteAuthConfig = RouteContext['authConfig'];
+export type SyncRouteCore = TaskforceCore & TaskforceSyncCapable;
+export type SyncRouteHandler = (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+export type SyncAddRoute = (method: string, path: string, handler: SyncRouteHandler) => void;
+export type SyncResolveRequestAccess = (req: IncomingMessage, config: NonNullable<SyncRouteAuthConfig>) => SyncResolvedAccess;

package/dist/server/routes/syncRouteTypes.js

@@ -0,0 +1 @@
+export {};

package/dist/server/routes/syncSnapshotRoutes.d.ts

@@ -0,0 +1,66 @@
+import type { IncomingMessage } from 'http';
+import type { SyncAddRoute, SyncResolveRequestAccess, SyncRouteAuthConfig, SyncRouteCore } from './syncRouteTypes.js';
+interface WorkspaceSyncDocumentSnapshotState {
+    listWorkspaceSyncDocumentIndex(basePath: string, workspaceId: string): Promise<Array<{
+        path: string;
+    }>>;
+    listWorkspaceSyncDocumentsSnapshot(basePath: string, workspaceId: string): Promise<Array<{
+        path: string;
+        updatedAt: string;
+        content: string;
+        assetId?: string | null;
+        documentId?: string | null;
+        version?: number | null;
+        taskId?: string | null;
+        linkRole?: string | null;
+    }>>;
+    listWorkspaceSyncBinaryAssetIndex(workspaceId: string): Promise<Array<{
+        path: string;
+    }>>;
+    listWorkspaceSyncBinaryAssetsSnapshot(basePath: string, workspaceId: string): Promise<Array<{
+        path: string;
+        updatedAt: string;
+        contentBase64: string;
+        assetId?: string | null;
+        kind: string;
+        mimeType: string;
+        taskId?: string | null;
+        originalFilename?: string | null;
+        linkRole?: string | null;
+    }>>;
+}
+interface WorkspaceSyncCollaborationSnapshotState {
+    listWorkspaceSyncDocumentReviewSessionsSnapshot(workspaceId: string): Array<{
+        id: string;
+        updatedAt: string;
+        status: string;
+        comments: unknown[];
+    }>;
+    listWorkspaceSyncDocumentReviewCommentsSnapshot(workspaceId: string): Array<{
+        id: string;
+        sessionId: string;
+        updatedAt: string;
+        deletedAt?: string | null;
+    }>;
+    listWorkspaceSyncAnnotatedAttachmentSessionsSnapshot(workspaceId: string): Array<{
+        id: string;
+        updatedAt: string;
+        taskId: string;
+        baseImageAssetId: string;
+        annotations: unknown[];
+        deletedAt?: string | null;
+    }>;
+}
+interface RegisterWorkspaceSnapshotSyncRoutesArgs {
+    addRoute: SyncAddRoute;
+    core: SyncRouteCore;
+    context: {
+        authConfig?: SyncRouteAuthConfig | null;
+    };
+    resolveRequestAccess: SyncResolveRequestAccess;
+    requestWorkspaceId: (req: IncomingMessage) => string | null | undefined;
+    contentSyncState: WorkspaceSyncDocumentSnapshotState;
+    collaborationSyncState: WorkspaceSyncCollaborationSnapshotState;
+}
+export declare function registerWorkspaceSnapshotSyncRoutes({ addRoute, core, context, resolveRequestAccess, requestWorkspaceId, contentSyncState, collaborationSyncState }: RegisterWorkspaceSnapshotSyncRoutesArgs): void;
+export {};

package/dist/server/routes/syncSnapshotRoutes.js

@@ -0,0 +1,180 @@
+import { requireCloudRuntimeSnapshotAccess } from './syncRouteGuards.js';
+export function registerWorkspaceSnapshotSyncRoutes({ addRoute, core, context, resolveRequestAccess, requestWorkspaceId, contentSyncState, collaborationSyncState }) {
+    // GET /api/taskforce/sync/workspace/documents - Snapshot markdown documents only.
+    // Binary image/file assets travel through the sibling /assets snapshot and asset-* sync ops.
+    addRoute('GET', '/api/taskforce/sync/workspace/documents', async (req, res) => {
+        const snapshotAccess = requireCloudRuntimeSnapshotAccess({
+            req,
+            res,
+            authConfig: context.authConfig,
+            resolveRequestAccess
+        });
+        if (!snapshotAccess)
+            return;
+        const workspaceId = requestWorkspaceId(req) || 'default';
+        const basePath = core.getPaths().basePath;
+        const documentIndex = await contentSyncState.listWorkspaceSyncDocumentIndex(basePath, workspaceId);
+        const documents = await contentSyncState.listWorkspaceSyncDocumentsSnapshot(basePath, workspaceId);
+        const knownPaths = documentIndex
+            .map((doc) => String(doc?.path || '').trim())
+            .filter((docPath) => docPath.length > 0);
+        const fingerprint = JSON.stringify([
+            ...knownPaths.map((docPath) => `known:${docPath}`),
+            ...documents.map((doc) => [
+                doc.path,
+                doc.updatedAt,
+                doc.content.length,
+                doc.assetId || '',
+                doc.documentId || '',
+                String(doc.version ?? ''),
+                doc.taskId || '',
+                doc.linkRole || ''
+            ].join(':'))
+        ]);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            success: true,
+            documents,
+            knownPaths,
+            fingerprint
+        }));
+    });
+    // GET /api/taskforce/sync/workspace/ai-profiles - Snapshot workspace AI profiles for local->cloud sync.
+    addRoute('GET', '/api/taskforce/sync/workspace/ai-profiles', async (req, res) => {
+        const snapshotAccess = requireCloudRuntimeSnapshotAccess({
+            req,
+            res,
+            authConfig: context.authConfig,
+            resolveRequestAccess
+        });
+        if (!snapshotAccess)
+            return;
+        const workspaceId = requestWorkspaceId(req) || 'default';
+        const aiProfiles = core.listAiProfiles(workspaceId, { includeArchived: true });
+        const fingerprint = JSON.stringify(aiProfiles.map((profile) => [
+            profile.id,
+            profile.updatedAt,
+            profile.name,
+            profile.username,
+            profile.profileToken,
+            profile.avatarUrl ?? '',
+            profile.avatarSourceUrl ?? '',
+            profile.surfaceType ?? '',
+            profile.seatScope ?? '',
+            profile.archivedAt ?? '',
+            profile.archivedReason ?? '',
+            profile.mergedIntoProfileId ?? '',
+            profile.rosterStateUpdatedAt ?? ''
+        ].join(':')));
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            success: true,
+            aiProfiles,
+            fingerprint
+        }));
+    });
+    // GET /api/taskforce/sync/workspace/document-reviews - Snapshot document review sessions for local->cloud sync.
+    addRoute('GET', '/api/taskforce/sync/workspace/document-reviews', async (req, res) => {
+        const snapshotAccess = requireCloudRuntimeSnapshotAccess({
+            req,
+            res,
+            authConfig: context.authConfig,
+            resolveRequestAccess
+        });
+        if (!snapshotAccess)
+            return;
+        const workspaceId = requestWorkspaceId(req) || 'default';
+        const sessions = collaborationSyncState.listWorkspaceSyncDocumentReviewSessionsSnapshot(workspaceId);
+        const comments = collaborationSyncState.listWorkspaceSyncDocumentReviewCommentsSnapshot(workspaceId);
+        const fingerprint = JSON.stringify([
+            ...sessions.map((session) => [
+                'session',
+                session.id,
+                session.updatedAt,
+                session.status,
+                session.comments.length
+            ].join(':')),
+            ...comments.map((comment) => [
+                'comment',
+                comment.id,
+                comment.sessionId,
+                comment.updatedAt,
+                comment.deletedAt || ''
+            ].join(':'))
+        ]);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            success: true,
+            sessions,
+            comments,
+            fingerprint
+        }));
+    });
+    // GET /api/taskforce/sync/workspace/annotated-attachments - Snapshot Image Notes sessions for local->cloud sync.
+    addRoute('GET', '/api/taskforce/sync/workspace/annotated-attachments', async (req, res) => {
+        const snapshotAccess = requireCloudRuntimeSnapshotAccess({
+            req,
+            res,
+            authConfig: context.authConfig,
+            resolveRequestAccess
+        });
+        if (!snapshotAccess)
+            return;
+        const workspaceId = requestWorkspaceId(req) || 'default';
+        const sessions = collaborationSyncState.listWorkspaceSyncAnnotatedAttachmentSessionsSnapshot(workspaceId);
+        const fingerprint = JSON.stringify(sessions.map((session) => [
+            session.id,
+            session.updatedAt,
+            session.taskId,
+            session.baseImageAssetId,
+            session.annotations.length,
+            session.deletedAt || ''
+        ].join(':')));
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            success: true,
+            sessions,
+            fingerprint
+        }));
+    });
+    // GET /api/taskforce/sync/workspace/assets - Snapshot non-markdown local assets.
+    // Markdown remains on the /documents snapshot so document encryption/version semantics stay isolated.
+    addRoute('GET', '/api/taskforce/sync/workspace/assets', async (req, res) => {
+        const snapshotAccess = requireCloudRuntimeSnapshotAccess({
+            req,
+            res,
+            authConfig: context.authConfig,
+            resolveRequestAccess
+        });
+        if (!snapshotAccess)
+            return;
+        const workspaceId = requestWorkspaceId(req) || 'default';
+        const basePath = core.getPaths().basePath;
+        const assetIndex = await contentSyncState.listWorkspaceSyncBinaryAssetIndex(workspaceId);
+        const assets = await contentSyncState.listWorkspaceSyncBinaryAssetsSnapshot(basePath, workspaceId);
+        const knownPaths = assetIndex
+            .map((asset) => String(asset?.path || '').trim())
+            .filter((assetPath) => assetPath.length > 0);
+        const fingerprint = JSON.stringify([
+            ...knownPaths.map((assetPath) => `known:${assetPath}`),
+            ...assets.map((asset) => [
+                asset.path,
+                asset.updatedAt,
+                asset.contentBase64.length,
+                asset.assetId || '',
+                asset.kind,
+                asset.mimeType,
+                asset.taskId || '',
+                asset.originalFilename || '',
+                asset.linkRole || ''
+            ].join(':'))
+        ]);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            success: true,
+            assets,
+            knownPaths,
+            fingerprint
+        }));
+    });
+}