@taskforcehq/taskforce 0.3.305 → 0.3.307

package/dist/TaskforceCore.test.js

@@ -7,6 +7,28 @@ import { TaskforceCore } from './TaskforceCore';
 import fs from 'fs';
 import path from 'path';
 import modalStyles from './components/ui/Modal.module.css';
+vi.mock('react-avatar-editor', async () => {
+    const React = await import('react');
+    return {
+        default: React.forwardRef((_props, ref) => {
+            React.useImperativeHandle(ref, () => ({
+                getImageScaledToCanvas: () => ({
+                    width: 1024,
+                    height: 1024,
+                    getContext: () => ({
+                        drawImage: () => undefined
+                    }),
+                    toBlob: (callback, type) => {
+                        callback(new Blob([new Uint8Array([1, 2, 3, 4])], { type: type || 'image/webp' }));
+                    }
+                }),
+                getImage: () => document.createElement('canvas'),
+                getCroppingRect: () => ({ x: 0, y: 0, width: 1, height: 1 })
+            }));
+            return _jsx("div", { "data-testid": "avatar-editor" });
+        })
+    };
+});
 const mockTasks = [
     {
         id: 'task-20260130-abc123',
@@ -888,6 +910,48 @@ describe('TaskforceCore Integration', () => {
         });
         expect(container.querySelector('[aria-pressed]')).not.toBeInTheDocument();
     });
+    it('renders the cloud login route even while protected startup config is pending', async () => {
+        const hangingConfig = new Promise(() => { });
+        const fetchMock = vi.fn((url) => {
+            if (url.includes('/api/taskforce/auth/runtime-config')) {
+                return Promise.resolve({
+                    ok: true,
+                    json: () => Promise.resolve({
+                        config: {
+                            runtimeMode: 'cloud',
+                            workspaceMode: 'multi-cloud',
+                            authSource: 'cloud',
+                            workspaceSwitchingEnabled: true
+                        }
+                    })
+                });
+            }
+            if (url.includes('/api/taskforce/auth/session')) {
+                return Promise.resolve({
+                    ok: true,
+                    json: () => Promise.resolve({
+                        authenticated: false,
+                        runtimeMode: 'cloud'
+                    })
+                });
+            }
+            if (url.includes('/api/taskforce/config')) {
+                return hangingConfig;
+            }
+            if (url.includes('/api/taskforce/auth/providers')) {
+                return Promise.resolve({ ok: true, json: () => Promise.resolve({ providers: [] }) });
+            }
+            return Promise.resolve({ ok: true, json: () => Promise.resolve({}) });
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        render(_jsx(MemoryRouter, { initialEntries: ['/login?mode=login&next=%2Ftaskforce%2F'], children: _jsx(TaskforceCore, {}) }));
+        await waitFor(() => {
+            expect(screen.getByPlaceholderText('Email')).toBeInTheDocument();
+            expect(screen.getByPlaceholderText('Password')).toBeInTheDocument();
+            expect(screen.getByRole('button', { name: 'Sign In' })).toBeInTheDocument();
+        });
+        expect(screen.queryByText('Loading Taskforce')).not.toBeInTheDocument();
+    });
     it('allows public access to /pricing in cloud mode without login redirect', async () => {
         const fetchMock = vi.fn((url) => {
             if (url.includes('/api/taskforce/auth/session')) {
@@ -1085,7 +1149,6 @@ describe('TaskforceCore Integration', () => {
         render(_jsx(MemoryRouter, { initialEntries: ['/'], children: _jsx(TaskforceCore, {}) }));
         await waitFor(() => {
             expect(screen.getByRole('heading', { name: 'Subscription Plans' })).toBeInTheDocument();
-            expect(screen.getByText('Choose a plan to continue.')).toBeInTheDocument();
         });
     });
     it('redirects authenticated users with a blocking account access gate to the plans page', async () => {
@@ -1789,11 +1852,12 @@ describe('TaskforceCore Integration', () => {
             if (url.includes('/api/taskforce/workspace/assignee-options')) {
                 return jsonResponse({ assignees: [] });
             }
-            if (url.includes('/api/taskforce/initiatives')) {
-                return jsonResponse([]);
-            }
-            if (url.includes('/api/taskforce/workstreams')) {
-                return jsonResponse([]);
+            if (url.includes('/api/taskforce/planning/bootstrap')) {
+                return jsonResponse({
+                    initiatives: [],
+                    workstreams: [],
+                    workstreamTaskSummaries: [],
+                });
             }
             return jsonResponse({});
         });
@@ -1820,7 +1884,8 @@ describe('TaskforceCore Integration', () => {
         await user.click(screen.getByRole('button', { name: 'Register' }));
         await user.type(await screen.findByPlaceholderText('Email'), accounts.newcomer.email);
         await user.type(screen.getByPlaceholderText('Display name'), accounts.newcomer.displayName);
-        await user.type(screen.getByPlaceholderText('Password'), 'Password123!');
+        await user.type(screen.getByPlaceholderText('Password'), 'GoodPassphrase123!');
+        await user.type(screen.getByPlaceholderText('Confirm password'), 'GoodPassphrase123!');
         await user.click(screen.getByRole('button', { name: 'Create Account' }));
         await waitFor(() => {
             expect(screen.getByTitle(/Account/i)).toBeInTheDocument();
@@ -1902,6 +1967,7 @@ describe('TaskforceCore Integration', () => {
             expect(screen.getByText('Create your Taskforce account.')).toBeInTheDocument();
             expect(screen.getByLabelText('Email')).toBeInTheDocument();
             expect(screen.getByLabelText('Display name')).toBeInTheDocument();
+            expect(screen.getByLabelText('Confirm password')).toBeInTheDocument();
             expect(screen.getByPlaceholderText('Email')).toBeInTheDocument();
             expect(screen.getByPlaceholderText('Display name')).toBeInTheDocument();
             expect(screen.getByRole('button', { name: 'Create Account' })).toBeInTheDocument();
@@ -1913,6 +1979,56 @@ describe('TaskforceCore Integration', () => {
         });
         expect(container.querySelector('[aria-pressed]')).not.toBeInTheDocument();
     });
+    it('blocks registration when the confirmation does not match', async () => {
+        const user = userEvent.setup();
+        const fetchMock = vi.fn((url) => {
+            if (url.includes('/api/taskforce/auth/session')) {
+                return Promise.resolve({
+                    ok: true,
+                    json: () => Promise.resolve({
+                        authenticated: false,
+                        runtimeMode: 'cloud',
+                        authRequiredForApi: false
+                    })
+                });
+            }
+            if (url.includes('/api/taskforce/config')) {
+                return Promise.resolve({
+                    ok: true,
+                    json: () => Promise.resolve({
+                        ...mockConfig,
+                        runtimeMode: 'cloud',
+                        authRequiredForApi: false,
+                        setupState: {
+                            globalSetupState: 'present',
+                            workspaceSetupState: 'present',
+                            runtimeMode: 'cloud',
+                            workspaceId: 'workspace-local-active',
+                            mode: 'core',
+                            forceSetup: false,
+                            forceGlobalSetup: false,
+                            forceWorkspaceSetup: false
+                        }
+                    })
+                });
+            }
+            if (url.includes('/api/taskforce/workflow-templates')) {
+                return Promise.resolve({ ok: true, json: () => Promise.resolve({ templates: [] }) });
+            }
+            return Promise.resolve({ ok: true, json: () => Promise.resolve({}) });
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        render(_jsx(MemoryRouter, { initialEntries: ['/login?mode=register&next=%2F'], children: _jsx(TaskforceCore, {}) }));
+        await user.type(await screen.findByPlaceholderText('Email'), 'mismatch@example.com');
+        await user.type(screen.getByPlaceholderText('Display name'), 'Mismatch User');
+        await user.type(screen.getByPlaceholderText('Password'), 'GoodPassphrase123!');
+        await user.type(screen.getByPlaceholderText('Confirm password'), 'DifferentPassphrase123!');
+        await user.click(screen.getByRole('button', { name: 'Create Account' }));
+        await waitFor(() => {
+            expect(screen.getByText('Passwords do not match.')).toBeInTheDocument();
+        });
+        expect(fetchMock.mock.calls.some((call) => String(call[0]).includes('/api/taskforce/auth/register'))).toBe(false);
+    });
     it('keeps the verification screen focused on verification and lets the user request a fresh email token', async () => {
         const fetchMock = vi.fn((url) => {
             if (url.includes('/api/taskforce/auth/session')) {
@@ -2204,7 +2320,8 @@ describe('TaskforceCore Integration', () => {
         render(_jsx(MemoryRouter, { initialEntries: ['/login?mode=register&next=%2Fplans'], children: _jsx(TaskforceCore, {}) }));
         await user.type(await screen.findByPlaceholderText('Email'), 'local@example.com');
         await user.type(screen.getByPlaceholderText('Display name'), 'Local User');
-        await user.type(screen.getByPlaceholderText('Password'), 'Password123!');
+        await user.type(screen.getByPlaceholderText('Password'), 'GoodPassphrase123!');
+        await user.type(screen.getByPlaceholderText('Confirm password'), 'GoodPassphrase123!');
         await user.click(screen.getByRole('button', { name: 'Create Account' }));
         await waitFor(() => {
             expect(screen.getByText('Configure your new workspace.')).toBeInTheDocument();
@@ -2362,11 +2479,11 @@ describe('TaskforceCore Integration', () => {
         render(_jsx(MemoryRouter, { initialEntries: ['/login?mode=register&next=%2F'], children: _jsx(TaskforceCore, {}) }));
         await user.type(await screen.findByPlaceholderText('Email'), 'pending@example.com');
         await user.type(screen.getByPlaceholderText('Display name'), 'Pending User');
-        await user.type(screen.getByPlaceholderText('Password'), 'Password123!');
+        await user.type(screen.getByPlaceholderText('Password'), 'GoodPassphrase123!');
+        await user.type(screen.getByPlaceholderText('Confirm password'), 'GoodPassphrase123!');
         await user.click(screen.getByRole('button', { name: 'Create Account' }));
         await waitFor(() => {
             expect(screen.getByRole('heading', { name: 'Subscription Plans' })).toBeInTheDocument();
-            expect(screen.getByText('Choose a plan to continue.')).toBeInTheDocument();
         });
         expect(fetchMock.mock.calls.some(([url]) => String(url).includes('/api/taskforce/billing/checkout-session'))).toBe(false);
     });
@@ -2478,11 +2595,148 @@ describe('TaskforceCore Integration', () => {
         render(_jsx(MemoryRouter, { initialEntries: ['/login?mode=register&next=%2F'], children: _jsx(TaskforceCore, {}) }));
         await user.type(await screen.findByPlaceholderText('Email'), 'brandnew@example.com');
         await user.type(screen.getByPlaceholderText('Display name'), 'Brand New');
-        await user.type(screen.getByPlaceholderText('Password'), 'Password123!');
+        await user.type(screen.getByPlaceholderText('Password'), 'GoodPassphrase123!');
+        await user.type(screen.getByPlaceholderText('Confirm password'), 'GoodPassphrase123!');
         await user.click(screen.getByRole('button', { name: 'Create Account' }));
         await waitFor(() => {
             expect(screen.getByRole('heading', { name: 'Subscription Plans' })).toBeInTheDocument();
-            expect(screen.getByText('Choose a plan to continue.')).toBeInTheDocument();
+        });
+        expect(screen.queryByText('Configure your new workspace.')).not.toBeInTheDocument();
+    });
+    it('keeps registration on plan selection while the post-auth cloud session is still resolving for a commercially gated user with no workspace', async () => {
+        const user = userEvent.setup();
+        let authenticated = false;
+        let authSessionCallCount = 0;
+        let releaseInitialSession = null;
+        const initialSessionGate = new Promise((resolve) => {
+            releaseInitialSession = resolve;
+        });
+        const fetchMock = vi.fn((input) => {
+            const url = String(input);
+            if (url.includes('/api/taskforce/auth/runtime-config')) {
+                return jsonResponse({
+                    config: {
+                        baseUrl: 'https://app.taskforce.example',
+                        apiBaseUrl: 'https://app.taskforce.example/api',
+                        cloudAuthBaseUrl: 'https://app.taskforce.example',
+                        runtimeMode: 'cloud',
+                        authSource: 'cloud',
+                        workspaceMode: 'multi-cloud',
+                        workspaceSwitchingEnabled: true,
+                        authRequiredForApi: true
+                    }
+                });
+            }
+            if (url.includes('/api/taskforce/auth/session')) {
+                authSessionCallCount += 1;
+                const payload = () => ({
+                    authenticated,
+                    runtimeMode: 'cloud',
+                    authRequiredForApi: true,
+                    userId: authenticated ? 'user-gated-pending' : null,
+                    workspaceId: null,
+                    betaAccess: true
+                });
+                if (authSessionCallCount === 1) {
+                    return initialSessionGate.then(() => jsonResponse(payload()));
+                }
+                return jsonResponse(payload());
+            }
+            if (url.includes('/api/taskforce/config')) {
+                return jsonResponse({
+                    ...mockConfig,
+                    runtimeMode: 'cloud',
+                    authRequiredForApi: true,
+                    workspaceSwitchingEnabled: true,
+                    setupState: {
+                        globalSetupState: 'present',
+                        workspaceSetupState: 'missing',
+                        runtimeMode: 'cloud',
+                        workspaceId: 'default',
+                        mode: 'core',
+                        forceSetup: true,
+                        forceGlobalSetup: false,
+                        forceWorkspaceSetup: true
+                    }
+                });
+            }
+            if (url.includes('/api/taskforce/workspaces')) {
+                return jsonResponse({
+                    success: true,
+                    workspaces: [],
+                    currentWorkspaceId: 'default'
+                });
+            }
+            if (url.includes('/api/taskforce/account/access-status')) {
+                return jsonResponse({
+                    gate: 'plan_selection_required',
+                    hasEntitlement: true,
+                    canAccessApp: false,
+                    canAccessPlans: true,
+                    message: 'Choose a plan to continue.'
+                });
+            }
+            if (url.includes('/api/taskforce/account/profile-summary')) {
+                return jsonResponse({
+                    entitlementState: 'pending_plan_selection',
+                    gate: 'plan_selection_required',
+                    message: 'Choose a plan to continue.',
+                    workspaceId: null
+                });
+            }
+            if (url.includes('/api/taskforce/public/pricing')) {
+                return jsonResponse({ plans: [] });
+            }
+            if (url.includes('/api/taskforce/auth/register')) {
+                authenticated = true;
+                return jsonResponse({
+                    success: true,
+                    workspaceSetupRequired: true,
+                    verificationRequired: false,
+                    planSelectionRequired: true,
+                    commercialState: 'pending_plan_selection'
+                });
+            }
+            if (url.includes('/api/taskforce/categories'))
+                return jsonResponse(mockCategories);
+            if (url.includes('/api/taskforce/tasks'))
+                return jsonResponse({ tasks: mockTasks });
+            if (url.includes('/api/taskforce/archive'))
+                return jsonResponse({ archived: [] });
+            if (url.includes('/api/taskforce/data-version'))
+                return jsonResponse({ dataVersion: 1 });
+            if (url.includes('/api/taskforce/types'))
+                return jsonResponse({ types: [] });
+            if (url.includes('/api/taskforce/priorities'))
+                return jsonResponse({ priorities: [] });
+            if (url.includes('/api/taskforce/approaches'))
+                return jsonResponse({ approaches: [] });
+            if (url.includes('/api/taskforce/specialists'))
+                return jsonResponse({ specialists: [] });
+            if (url.includes('/api/taskforce/workflow-templates'))
+                return jsonResponse({ templates: [] });
+            return jsonResponse({});
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        render(_jsx(MemoryRouter, { initialEntries: ['/login?mode=register&next=%2F'], children: _jsx(TaskforceCore, {}) }));
+        await user.type(await screen.findByPlaceholderText('Email'), 'gated-pending@example.com');
+        await user.type(screen.getByPlaceholderText('Display name'), 'Gated Pending');
+        await user.type(screen.getByPlaceholderText('Password'), 'GoodPassphrase123!');
+        await user.type(screen.getByPlaceholderText('Confirm password'), 'GoodPassphrase123!');
+        await user.click(screen.getByRole('button', { name: 'Create Account' }));
+        await act(async () => {
+            await Promise.resolve();
+        });
+        await waitFor(() => {
+            expect(screen.getByRole('heading', { name: 'Subscription Plans' })).toBeInTheDocument();
+        });
+        expect(screen.queryByText('Configure your new workspace.')).not.toBeInTheDocument();
+        await act(async () => {
+            releaseInitialSession?.();
+            await Promise.resolve();
+        });
+        await waitFor(() => {
+            expect(screen.getByRole('heading', { name: 'Subscription Plans' })).toBeInTheDocument();
         });
         expect(screen.queryByText('Configure your new workspace.')).not.toBeInTheDocument();
     });
@@ -2653,7 +2907,8 @@ describe('TaskforceCore Integration', () => {
         render(_jsx(MemoryRouter, { initialEntries: ['/login?mode=register&planId=basic&planVersionId=basic-v1&interval=year&next=%2F'], children: _jsx(TaskforceCore, {}) }));
         await user.type(await screen.findByPlaceholderText('Email'), 'checkout@example.com');
         await user.type(screen.getByPlaceholderText('Display name'), 'Checkout User');
-        await user.type(screen.getByPlaceholderText('Password'), 'Password123!');
+        await user.type(screen.getByPlaceholderText('Password'), 'GoodPassphrase123!');
+        await user.type(screen.getByPlaceholderText('Confirm password'), 'GoodPassphrase123!');
         await user.click(screen.getByRole('button', { name: 'Create Account' }));
         await waitFor(() => {
             expect(screen.getByRole('heading', { name: 'Subscription Plans' })).toBeInTheDocument();
@@ -2786,7 +3041,8 @@ describe('TaskforceCore Integration', () => {
         render(_jsx(MemoryRouter, { initialEntries: ['/login?mode=register&next=%2F'], children: _jsx(TaskforceCore, {}) }));
         await user.type(await screen.findByPlaceholderText('Email'), 'free-user@example.com');
         await user.type(screen.getByPlaceholderText('Display name'), 'Free User');
-        await user.type(screen.getByPlaceholderText('Password'), 'Password123!');
+        await user.type(screen.getByPlaceholderText('Password'), 'GoodPassphrase123!');
+        await user.type(screen.getByPlaceholderText('Confirm password'), 'GoodPassphrase123!');
         await user.click(screen.getByRole('button', { name: 'Create Account' }));
         await act(async () => {
             await Promise.resolve();
@@ -2912,7 +3168,8 @@ describe('TaskforceCore Integration', () => {
         render(_jsx(MemoryRouter, { initialEntries: ['/login?mode=register&next=%2F'], children: _jsx(TaskforceCore, {}) }));
         await user.type(await screen.findByPlaceholderText('Email'), 'existing-workspace@example.com');
         await user.type(screen.getByPlaceholderText('Display name'), 'Existing Workspace User');
-        await user.type(screen.getByPlaceholderText('Password'), 'Password123!');
+        await user.type(screen.getByPlaceholderText('Password'), 'GoodPassphrase123!');
+        await user.type(screen.getByPlaceholderText('Confirm password'), 'GoodPassphrase123!');
         await user.click(screen.getByRole('button', { name: 'Create Account' }));
         await act(async () => {
             await Promise.resolve();
@@ -2982,7 +3239,8 @@ describe('TaskforceCore Integration', () => {
         render(_jsx(MemoryRouter, { initialEntries: ['/login?mode=register&next=%2Fplans'], children: _jsx(TaskforceCore, {}) }));
         await user.type(await screen.findByPlaceholderText('Email'), 'local@example.com');
         await user.type(screen.getByPlaceholderText('Display name'), 'Local User');
-        await user.type(screen.getByPlaceholderText('Password'), 'Password123!');
+        await user.type(screen.getByPlaceholderText('Password'), 'GoodPassphrase123!');
+        await user.type(screen.getByPlaceholderText('Confirm password'), 'GoodPassphrase123!');
         await user.click(screen.getByRole('button', { name: 'Create Account' }));
         await waitFor(() => {
             expect(screen.getByPlaceholderText('Verification token')).toBeInTheDocument();
@@ -2990,6 +3248,156 @@ describe('TaskforceCore Integration', () => {
         expect(screen.queryByRole('button', { name: 'Create Account' })).not.toBeInTheDocument();
         expect(screen.queryByText('Subscription Plans')).not.toBeInTheDocument();
     });
+    it('keeps verified registration on plan selection when commercial onboarding is still blocked', async () => {
+        const user = userEvent.setup();
+        let authenticated = false;
+        const fetchMock = vi.fn((input) => {
+            const url = String(input);
+            if (url.includes('/api/taskforce/auth/runtime-config')) {
+                return jsonResponse({
+                    config: {
+                        baseUrl: 'https://app.taskforce.example',
+                        apiBaseUrl: 'https://app.taskforce.example/api',
+                        cloudAuthBaseUrl: 'https://app.taskforce.example',
+                        runtimeMode: 'cloud',
+                        authSource: 'cloud',
+                        workspaceMode: 'multi-cloud',
+                        workspaceSwitchingEnabled: true,
+                        authRequiredForApi: true
+                    }
+                });
+            }
+            if (url.includes('/api/taskforce/auth/session')) {
+                return jsonResponse({
+                    authenticated,
+                    runtimeMode: 'cloud',
+                    authRequiredForApi: true,
+                    userId: authenticated ? 'user-verify' : null,
+                    workspaceId: authenticated ? 'default' : null,
+                    betaAccess: true
+                });
+            }
+            if (url.includes('/api/taskforce/config')) {
+                return jsonResponse({
+                    ...mockConfig,
+                    runtimeMode: 'cloud',
+                    authRequiredForApi: true,
+                    workspaceSwitchingEnabled: true,
+                    setupState: {
+                        globalSetupState: 'present',
+                        workspaceSetupState: authenticated ? 'missing' : 'present',
+                        runtimeMode: 'cloud',
+                        workspaceId: 'default',
+                        mode: 'core',
+                        forceSetup: false,
+                        forceGlobalSetup: false,
+                        forceWorkspaceSetup: false
+                    }
+                });
+            }
+            if (url.includes('/api/taskforce/workspaces')) {
+                return jsonResponse({
+                    success: true,
+                    workspaces: [],
+                    currentWorkspaceId: null
+                });
+            }
+            if (url.includes('/api/taskforce/account/access-status')) {
+                return jsonResponse({
+                    gate: 'plan_selection_required',
+                    hasEntitlement: true,
+                    canAccessApp: false,
+                    canAccessPlans: true,
+                    message: 'Choose a plan to continue.'
+                });
+            }
+            if (url.includes('/api/taskforce/account/profile-summary')) {
+                return jsonResponse({
+                    entitlementState: 'pending_plan_selection',
+                    gate: 'plan_selection_required',
+                    message: 'Choose a plan to continue.',
+                    workspaceId: null
+                });
+            }
+            if (url.includes('/api/taskforce/public/pricing')) {
+                return jsonResponse({
+                    plans: [{
+                            planId: 'free',
+                            displayName: 'Free',
+                            status: 'active',
+                            defaultVersion: {
+                                planVersionId: 'free-v1',
+                                versionNumber: 1,
+                                seatLimit: null,
+                                metadata: {}
+                            },
+                            features: [],
+                            pricing: {
+                                month: {
+                                    planVersionId: 'free-v1',
+                                    interval: 'month',
+                                    pricingType: 'free',
+                                    stripePriceId: 'free:free-v1:month',
+                                    displayAmount: '$0.00',
+                                    unitAmount: 0,
+                                    currency: 'usd'
+                                },
+                                year: null
+                            }
+                        }]
+                });
+            }
+            if (url.includes('/api/taskforce/auth/register')) {
+                return jsonResponse({
+                    success: true,
+                    workspaceSetupRequired: true,
+                    verificationRequired: true,
+                    verificationToken: 'verify-token',
+                    emailSent: true,
+                    planSelectionRequired: true,
+                    commercialState: 'pending_plan_selection'
+                });
+            }
+            if (url.includes('/api/taskforce/auth/verify-email/confirm')) {
+                authenticated = true;
+                return jsonResponse({ success: true });
+            }
+            if (url.includes('/api/taskforce/categories'))
+                return jsonResponse(mockCategories);
+            if (url.includes('/api/taskforce/tasks'))
+                return jsonResponse({ tasks: mockTasks });
+            if (url.includes('/api/taskforce/archive'))
+                return jsonResponse({ archived: [] });
+            if (url.includes('/api/taskforce/data-version'))
+                return jsonResponse({ dataVersion: 1 });
+            if (url.includes('/api/taskforce/types'))
+                return jsonResponse({ types: [] });
+            if (url.includes('/api/taskforce/priorities'))
+                return jsonResponse({ priorities: [] });
+            if (url.includes('/api/taskforce/approaches'))
+                return jsonResponse({ approaches: [] });
+            if (url.includes('/api/taskforce/specialists'))
+                return jsonResponse({ specialists: [] });
+            if (url.includes('/api/taskforce/workflow-templates'))
+                return jsonResponse({ templates: [] });
+            return jsonResponse({});
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        render(_jsx(MemoryRouter, { initialEntries: ['/login?mode=register&next=%2F'], children: _jsx(TaskforceCore, {}) }));
+        await user.type(await screen.findByPlaceholderText('Email'), 'verify-gated@example.com');
+        await user.type(screen.getByPlaceholderText('Display name'), 'Verify Gated User');
+        await user.type(screen.getByPlaceholderText('Password'), 'GoodPassphrase123!');
+        await user.type(screen.getByPlaceholderText('Confirm password'), 'GoodPassphrase123!');
+        await user.click(screen.getByRole('button', { name: 'Create Account' }));
+        await waitFor(() => {
+            expect(screen.getByPlaceholderText('Verification token')).toHaveValue('verify-token');
+        });
+        await user.click(screen.getByRole('button', { name: 'Verify Email' }));
+        await waitFor(() => {
+            expect(screen.getByRole('heading', { name: 'Subscription Plans' })).toBeInTheDocument();
+        });
+        expect(screen.queryByText('Configure your new workspace.')).not.toBeInTheDocument();
+    });
     it('allows returning to sign-in/register from forgot mode in local runtime', async () => {
         const user = userEvent.setup();
         const fetchMock = vi.fn((url) => {
@@ -3291,7 +3699,8 @@ describe('TaskforceCore Integration', () => {
         render(_jsx(MemoryRouter, { initialEntries: ['/login?mode=register&next=%2F'], children: _jsx(TaskforceCore, {}) }));
         await user.type(await screen.findByPlaceholderText('Email'), 'local@example.com');
         await user.type(screen.getByPlaceholderText('Display name'), 'Local User');
-        await user.type(screen.getByPlaceholderText('Password'), 'Password123!');
+        await user.type(screen.getByPlaceholderText('Password'), 'GoodPassphrase123!');
+        await user.type(screen.getByPlaceholderText('Confirm password'), 'GoodPassphrase123!');
         await user.click(screen.getByRole('button', { name: 'Create Account' }));
         await waitFor(() => {
             expect(screen.getByText('Choose a plan to continue.')).toBeInTheDocument();
@@ -3677,6 +4086,7 @@ describe('TaskforceCore Integration', () => {
         await waitFor(() => {
             expect(screen.getByText('Create your account to join this workspace.')).toBeInTheDocument();
             expect(screen.getByPlaceholderText('Create password')).toBeInTheDocument();
+            expect(screen.getByPlaceholderText('Confirm password')).toBeInTheDocument();
             expect(screen.getByRole('button', { name: 'Create Account and Join' })).toBeInTheDocument();
         });
     });
@@ -5417,6 +5827,15 @@ describe('TaskforceCore Integration', () => {
         expect(useTaskforceSource).toContain("|| path.startsWith('/api/taskforce/account/')");
         expect(useTaskforceSource).toContain("|| path.startsWith('/api/taskforce/billing/')");
     });
+    it('keeps plans on a dedicated surface while preserving the faster exit flow', () => {
+        const standaloneLayoutPath = path.join(process.cwd(), 'src/components/views/StandaloneLayout.tsx');
+        const standaloneLayoutSource = fs.readFileSync(standaloneLayoutPath, 'utf8');
+        expect(standaloneLayoutSource).toContain('{!isPlansScreen && <WorkspaceHeaderActions actions={universalFilterActions} />}');
+        expect(standaloneLayoutSource).toContain('{!isPlansScreen && showFilters && workspaceFilterBar}');
+        expect(standaloneLayoutSource).not.toMatch(/\{isPlansScreen \? \([\s\S]*\{workspaceToolRail\}[\s\S]*<PlansPage/);
+        expect(standaloneLayoutSource).toContain('closePlansScreen();');
+        expect(standaloneLayoutSource).toContain('void (async () => {');
+    });
     it('uses shared /login flow for local sign in instead of a duplicate modal', async () => {
         const standaloneLayoutPath = path.join(process.cwd(), 'src/components/views/StandaloneLayout.tsx');
         const standaloneLayoutSource = fs.readFileSync(standaloneLayoutPath, 'utf8');
@@ -5601,11 +6020,12 @@ describe('TaskforceCore Integration', () => {
             if (url.includes('/api/taskforce/workflow-templates')) {
                 return jsonResponse({ templates: [] });
             }
-            if (url.includes('/api/taskforce/initiatives')) {
-                return jsonResponse([]);
-            }
-            if (url.includes('/api/taskforce/workstreams')) {
-                return jsonResponse([]);
+            if (url.includes('/api/taskforce/planning/bootstrap')) {
+                return jsonResponse({
+                    initiatives: [],
+                    workstreams: [],
+                    workstreamTaskSummaries: [],
+                });
             }
             return jsonResponse({});
         });
@@ -5624,6 +6044,142 @@ describe('TaskforceCore Integration', () => {
         await user.click(screen.getByTitle(/Account/i));
         expect(await screen.findByText('Sign In / Register')).toBeInTheDocument();
     });
+    it('returns to the login screen after signing out from the cloud plans screen', async () => {
+        const user = userEvent.setup();
+        let signedIn = true;
+        const fetchMock = vi.fn((url) => {
+            if (url.includes('/api/taskforce/auth/runtime-config')) {
+                return jsonResponse({ config: { runtimeMode: 'cloud', workspaceMode: 'team', authSource: 'cloud' } });
+            }
+            if (url.includes('/api/taskforce/auth/session')) {
+                return jsonResponse({
+                    authenticated: signedIn,
+                    runtimeMode: 'cloud',
+                    authRequiredForApi: true,
+                    email: signedIn ? 'member@example.com' : '',
+                    userId: signedIn ? 'user-member' : 'anonymous',
+                    workspaceId: signedIn ? 'workspace-cloud-active' : '',
+                    betaAccess: true
+                });
+            }
+            if (url.includes('/api/taskforce/auth/logout')) {
+                signedIn = false;
+                return jsonResponse({ success: true });
+            }
+            if (url.includes('/api/taskforce/config')) {
+                return jsonResponse({
+                    ...mockConfig,
+                    runtimeMode: 'cloud',
+                    authRequiredForApi: true,
+                    workspaceId: 'workspace-cloud-active',
+                    workspaceSwitchingEnabled: true,
+                    setupState: {
+                        globalSetupState: 'present',
+                        workspaceSetupState: 'present',
+                        runtimeMode: 'cloud',
+                        workspaceId: 'workspace-cloud-active',
+                        mode: 'core',
+                        forceSetup: false,
+                        forceGlobalSetup: false,
+                        forceWorkspaceSetup: false
+                    }
+                });
+            }
+            if (url.includes('/api/taskforce/account/access-status')) {
+                return jsonResponse({
+                    gate: 'plan_selection_required',
+                    hasEntitlement: false,
+                    canAccessApp: false,
+                    canAccessPlans: true
+                });
+            }
+            if (url.includes('/api/taskforce/public/pricing')) {
+                return jsonResponse({
+                    plans: [
+                        {
+                            planId: 'free',
+                            displayName: 'Free',
+                            status: 'active',
+                            features: [],
+                            pricing: {
+                                month: { pricingType: 'free', stripePriceId: null, unitAmount: 0, currency: null, interval: 'month' },
+                                year: null
+                            },
+                            defaultVersion: {
+                                planVersionId: 'free-v1',
+                                versionNumber: 1,
+                                seatLimit: null,
+                                metadata: {}
+                            }
+                        }
+                    ]
+                });
+            }
+            if (url.includes('/api/taskforce/account/profile-summary')) {
+                return jsonResponse({
+                    planId: 'free',
+                    planName: 'Free',
+                    planVersionId: 'free-v1',
+                    entitlementState: 'pending_plan_selection',
+                    gate: 'plan_selection_required',
+                    planSelectionRequired: true
+                });
+            }
+            if (url.includes('/api/taskforce/workspaces')) {
+                return jsonResponse({ workspaces: [] });
+            }
+            if (url.includes('/api/taskforce/ui-state?key=app')) {
+                return jsonResponse({ success: true, state: {} });
+            }
+            if (url.includes('/api/taskforce/ui-state?key=workspace-sync')) {
+                return jsonResponse({ success: true, state: {} });
+            }
+            if (url.includes('/api/taskforce/categories')) {
+                return jsonResponse(mockCategories);
+            }
+            if (url.includes('/api/taskforce/tasks')) {
+                return jsonResponse({ tasks: mockTasks });
+            }
+            if (url.includes('/api/taskforce/archive')) {
+                return jsonResponse({ archived: [] });
+            }
+            if (url.includes('/api/taskforce/types')) {
+                return jsonResponse({ types: [] });
+            }
+            if (url.includes('/api/taskforce/priorities')) {
+                return jsonResponse({ priorities: [] });
+            }
+            if (url.includes('/api/taskforce/approaches')) {
+                return jsonResponse({ approaches: [] });
+            }
+            if (url.includes('/api/taskforce/specialists')) {
+                return jsonResponse({ specialists: [] });
+            }
+            if (url.includes('/api/taskforce/workflow-templates')) {
+                return jsonResponse({ templates: [] });
+            }
+            if (url.includes('/api/taskforce/workspace/assignee-options')) {
+                return jsonResponse({ assignees: [] });
+            }
+            if (url.includes('/api/taskforce/planning/bootstrap')) {
+                return jsonResponse({
+                    initiatives: [],
+                    workstreams: [],
+                    workstreamTaskSummaries: [],
+                });
+            }
+            return jsonResponse({});
+        });
+        vi.stubGlobal('fetch', fetchMock);
+        render(_jsx(MemoryRouter, { initialEntries: ['/?screen=plans&gate=plan_selection_required'], children: _jsx(TaskforceCore, { config: { cloudAuthBaseUrl: 'https://cloud.example.com' } }) }));
+        expect(await screen.findByRole('heading', { name: 'Subscription Plans' })).toBeInTheDocument();
+        await user.click(screen.getByTitle(/Account/i));
+        await user.click(await screen.findByRole('menuitem', { name: 'Sign Out' }));
+        await waitFor(() => {
+            expect(fetchMock.mock.calls.some((call) => String(call[0]).includes('/api/taskforce/auth/logout'))).toBe(true);
+            expect(screen.getByText('Sign in with your account credentials.')).toBeInTheDocument();
+        });
+    });
     it('uses an explicit cloud sign-out redirect and broader cloud logout reset path', () => {
         const standaloneLayoutSource = fs.readFileSync(path.join(__dirname, 'components/views/StandaloneLayout.tsx'), 'utf8');
         const useTaskforceSource = fs.readFileSync(path.join(__dirname, 'hooks/useTaskforce.ts'), 'utf8');
@@ -5947,9 +6503,9 @@ describe('TaskforceCore Integration', () => {
                                 occurredAt: '2026-03-15T14:28:17.000Z',
                                 eventType: 'apply',
                                 status: 'error',
-                                errorMessage: 'Detected asset reference number mismatch during normal sync.',
+                                errorMessage: 'Detected task reference number mismatch during normal sync.',
                                 details: {
-                                    path: 'workspaces/workspace-local-active/assets/images/hero.png',
+                                    taskId: 'task-1',
                                     existingReferenceNumber: 12,
                                     incomingReferenceNumber: 18
                                 }
@@ -7183,6 +7739,7 @@ describe('TaskforceCore Integration', () => {
         const user = userEvent.setup();
         let savedDisplayName = 'Original Name';
         let savedAvatarUrl = '';
+        const cloudAuthBaseUrl = 'https://performance-app.taskforcehq.ai';
         const fetchMock = vi.fn((input, init) => {
             const url = String(input);
             if (url.includes('/api/taskforce/auth/runtime-config')) {
@@ -7222,6 +7779,9 @@ describe('TaskforceCore Integration', () => {
                     ...mockConfig,
                     runtimeMode: 'local',
                     authRequiredForApi: false,
+                    apiBaseUrl: cloudAuthBaseUrl,
+                    cloudAuthBaseUrl,
+                    cloudAuthViaLocalProxy: true,
                     workspaceId: 'workspace-local-active',
                     setupState: {
                         globalSetupState: 'present',
@@ -7257,13 +7817,12 @@ describe('TaskforceCore Integration', () => {
                 return jsonResponse({
                     success: true,
                     draftId: 'avatar-draft-1',
-                    uploadUrl: 'https://upload.example.com/avatar-draft-1',
                     relativePath: 'users/user-1/profile/avatar/avatar-draft-1-avatar.png',
                     path: '/api/taskforce/context/users%2Fuser-1%2Fprofile%2Favatar%2Favatar-draft-1-avatar.png'
                 });
             }
-            if (url.includes('https://upload.example.com/avatar-draft-1')) {
-                return Promise.resolve({ ok: true, status: 200, json: async () => ({}) });
+            if (url.includes('/api/taskforce/auth/profile/avatar/upload')) {
+                return jsonResponse({ success: true, draftId: 'avatar-draft-1' });
             }
             if (url.includes('/api/taskforce/auth/profile/avatar/finalize')) {
                 return jsonResponse({
@@ -7304,8 +7863,21 @@ describe('TaskforceCore Integration', () => {
         const displayNameInput = within(modal).getByPlaceholderText('Display name');
         await user.clear(displayNameInput);
         await user.type(displayNameInput, 'Updated Name');
-        const avatarInput = within(modal).getByLabelText('Upload profile photo');
+        const getContextSpy = vi.spyOn(HTMLCanvasElement.prototype, 'getContext').mockReturnValue({
+            drawImage: () => undefined
+        });
+        const toBlobSpy = vi.spyOn(HTMLCanvasElement.prototype, 'toBlob').mockImplementation(function toBlob(callback, type) {
+            callback(new Blob([new Uint8Array([1, 2, 3, 4])], { type: type || 'image/webp' }));
+        });
+        await user.click(within(modal).getByLabelText('Edit profile photo'));
+        const avatarManager = await screen.findByText('Edit Profile Photo');
+        const avatarManagerModal = avatarManager.closest(`.${modalStyles.modal}`);
+        const avatarInput = within(avatarManagerModal).getByLabelText('Choose profile photo');
         await user.upload(avatarInput, new File(['avatar'], 'avatar.png', { type: 'image/png' }));
+        await user.click(within(avatarManagerModal).getByRole('button', { name: 'Apply Photo' }));
+        await waitFor(() => {
+            expect(screen.queryByText('Edit Profile Photo')).not.toBeInTheDocument();
+        });
         await user.click(within(modal).getByRole('button', { name: 'Save Profile' }));
         await waitFor(() => {
             const profileCall = fetchMock.mock.calls.find((call) => {
@@ -7317,6 +7889,17 @@ describe('TaskforceCore Integration', () => {
             expect(payload.displayName).toBe('Updated Name');
             expect(payload.avatarDraftId).toBe('avatar-draft-1');
         });
+        expect(fetchMock).toHaveBeenCalledWith('/api/taskforce/auth/profile/avatar/init', expect.objectContaining({ method: 'POST' }));
+        const avatarUploadCall = fetchMock.mock.calls.find((call) => String(call[0]) === '/api/taskforce/auth/profile/avatar/upload');
+        expect(avatarUploadCall).toBeTruthy();
+        expect(avatarUploadCall?.[1]).toEqual(expect.objectContaining({ method: 'POST' }));
+        const avatarUploadHeaders = new Headers(avatarUploadCall?.[1]?.headers);
+        expect(avatarUploadHeaders.get('Content-Type')).toBe('image/webp');
+        expect(avatarUploadHeaders.get('x-taskforce-avatar-draft-id')).toBe('avatar-draft-1');
+        expect(fetchMock).toHaveBeenCalledWith('/api/taskforce/auth/profile/avatar/finalize', expect.objectContaining({ method: 'POST' }));
+        expect(fetchMock.mock.calls.some((call) => String(call[0]).startsWith(`${cloudAuthBaseUrl}/api/taskforce/auth/profile/avatar/`))).toBe(false);
+        getContextSpy.mockRestore();
+        toBlobSpy.mockRestore();
         await waitFor(() => {
             expect(screen.queryByText('Edit Profile')).not.toBeInTheDocument();
         });