@taskforcehq/taskforce 0.3.305 → 0.3.307

package/dist/mcp/taskAttachmentTypes.d.ts

@@ -6,7 +6,7 @@ export type TaskAttachmentRecord = {
     displayName?: string;
     originalFilename?: string;
     timestamp?: string;
-    assetId?: string;
+    assetId?: string | null;
     referenceNumber?: number | null;
     referenceLabel?: string | null;
     taskId?: string | null;

package/dist/mcp/taskPlanningRegistrar.js

@@ -87,6 +87,18 @@ export function registerTaskPlanningTools(registerTool, executeTool) {
                 description: stringProperty('Optional initiative description.'),
                 ownerId: stringProperty(`${context.assigneeHint} Call list_assignees to inspect the current eligible IDs.`),
                 order: numberProperty('Optional sort order among initiatives.'),
+                attachments: arrayProperty('Optional attachment descriptors to store on the initiative. Prefer save_initiative_attachment for generated content or files.', {
+                    type: 'object',
+                    properties: {
+                        path: { type: 'string' },
+                        fsPath: { type: 'string' },
+                        caption: { type: 'string' },
+                        displayName: { type: 'string' },
+                        originalFilename: { type: 'string' },
+                        assetId: { type: 'string' },
+                    },
+                    required: ['path'],
+                }),
             },
             required: ['title'],
         },
@@ -100,6 +112,18 @@ export function registerTaskPlanningTools(registerTool, executeTool) {
                 description: stringProperty('Updated initiative description.'),
                 ownerId: stringProperty(`${context.assigneeHint} Call list_assignees to inspect the current eligible IDs.`),
                 order: numberProperty('Optional sort order among initiatives.'),
+                attachments: arrayProperty('Replacement attachment descriptors for the initiative. Prefer save_initiative_attachment and delete_initiative_attachment for generated content or files.', {
+                    type: 'object',
+                    properties: {
+                        path: { type: 'string' },
+                        fsPath: { type: 'string' },
+                        caption: { type: 'string' },
+                        displayName: { type: 'string' },
+                        originalFilename: { type: 'string' },
+                        assetId: { type: 'string' },
+                    },
+                    required: ['path'],
+                }),
             },
             required: ['id'],
         },
@@ -144,6 +168,18 @@ export function registerTaskPlanningTools(registerTool, executeTool) {
                 ownerId: stringProperty(`${context.assigneeHint} Call list_assignees to inspect the current eligible IDs.`),
                 initiativeId: stringProperty('Optional initiative ID or initiative reference such as IN-123.'),
                 order: numberProperty('Optional sort order among workstreams.'),
+                attachments: arrayProperty('Optional attachment descriptors to store on the workstream. Prefer save_workstream_attachment for generated content or files.', {
+                    type: 'object',
+                    properties: {
+                        path: { type: 'string' },
+                        fsPath: { type: 'string' },
+                        caption: { type: 'string' },
+                        displayName: { type: 'string' },
+                        originalFilename: { type: 'string' },
+                        assetId: { type: 'string' },
+                    },
+                    required: ['path'],
+                }),
             },
             required: ['title'],
         },
@@ -158,6 +194,18 @@ export function registerTaskPlanningTools(registerTool, executeTool) {
                 ownerId: stringProperty(`${context.assigneeHint} Call list_assignees to inspect the current eligible IDs.`),
                 initiativeId: stringProperty('Optional initiative ID or initiative reference such as IN-123. Pass an empty string to unlink.'),
                 order: numberProperty('Optional sort order among workstreams.'),
+                attachments: arrayProperty('Replacement attachment descriptors for the workstream. Prefer save_workstream_attachment and delete_workstream_attachment for generated content or files.', {
+                    type: 'object',
+                    properties: {
+                        path: { type: 'string' },
+                        fsPath: { type: 'string' },
+                        caption: { type: 'string' },
+                        displayName: { type: 'string' },
+                        originalFilename: { type: 'string' },
+                        assetId: { type: 'string' },
+                    },
+                    required: ['path'],
+                }),
             },
             required: ['id'],
         },

package/dist/mcp/toolRegistry.d.ts

@@ -185,6 +185,62 @@ export declare const MCP_TOOL_REGISTRY: Readonly<{
         };
         readonly mutating: false;
     };
+    readonly get_workstream_attachments: {
+        readonly permission: {
+            readonly kind: "scope";
+            readonly scope: "tasks:read";
+        };
+        readonly mutating: false;
+    };
+    readonly read_workstream_attachment: {
+        readonly permission: {
+            readonly kind: "scope";
+            readonly scope: "tasks:read";
+        };
+        readonly mutating: false;
+    };
+    readonly save_workstream_attachment: {
+        readonly permission: {
+            readonly kind: "scope";
+            readonly scope: "tasks:write";
+        };
+        readonly mutating: true;
+    };
+    readonly delete_workstream_attachment: {
+        readonly permission: {
+            readonly kind: "scope";
+            readonly scope: "tasks:write";
+        };
+        readonly mutating: true;
+    };
+    readonly get_initiative_attachments: {
+        readonly permission: {
+            readonly kind: "scope";
+            readonly scope: "tasks:read";
+        };
+        readonly mutating: false;
+    };
+    readonly read_initiative_attachment: {
+        readonly permission: {
+            readonly kind: "scope";
+            readonly scope: "tasks:read";
+        };
+        readonly mutating: false;
+    };
+    readonly save_initiative_attachment: {
+        readonly permission: {
+            readonly kind: "scope";
+            readonly scope: "tasks:write";
+        };
+        readonly mutating: true;
+    };
+    readonly delete_initiative_attachment: {
+        readonly permission: {
+            readonly kind: "scope";
+            readonly scope: "tasks:write";
+        };
+        readonly mutating: true;
+    };
     readonly search_images: {
         readonly permission: {
             readonly kind: "scope";

package/dist/mcp/toolRegistry.js

@@ -26,6 +26,14 @@ export const MCP_TOOL_REGISTRY = Object.freeze({
     replace_task_checklist: { permission: { kind: 'scope', scope: 'tasks:write' }, mutating: true },
     get_task_attachments: { permission: { kind: 'scope', scope: 'tasks:read' }, mutating: false },
     read_task_attachment: { permission: { kind: 'scope', scope: 'tasks:read' }, mutating: false },
+    get_workstream_attachments: { permission: { kind: 'scope', scope: 'tasks:read' }, mutating: false },
+    read_workstream_attachment: { permission: { kind: 'scope', scope: 'tasks:read' }, mutating: false },
+    save_workstream_attachment: { permission: { kind: 'scope', scope: 'tasks:write' }, mutating: true },
+    delete_workstream_attachment: { permission: { kind: 'scope', scope: 'tasks:write' }, mutating: true },
+    get_initiative_attachments: { permission: { kind: 'scope', scope: 'tasks:read' }, mutating: false },
+    read_initiative_attachment: { permission: { kind: 'scope', scope: 'tasks:read' }, mutating: false },
+    save_initiative_attachment: { permission: { kind: 'scope', scope: 'tasks:write' }, mutating: true },
+    delete_initiative_attachment: { permission: { kind: 'scope', scope: 'tasks:write' }, mutating: true },
     search_images: { permission: { kind: 'scope', scope: 'tasks:read' }, mutating: false },
     get_image: { permission: { kind: 'scope', scope: 'tasks:read' }, mutating: false },
     search_documents: { permission: { kind: 'scope', scope: 'tasks:read' }, mutating: false },

package/dist/mcp/toolRegistry.test.js

@@ -11,6 +11,8 @@ describe('MCP tool registry', () => {
         expect(MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS.search_documents).toBe('tasks:read');
         expect(MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS.read_task_attachment).toBe('tasks:read');
         expect(MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS.get_task_attachments).toBe('tasks:read');
+        expect(MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS.read_workstream_attachment).toBe('tasks:read');
+        expect(MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS.get_initiative_attachments).toBe('tasks:read');
         expect(MCP_CLOUD_TOOL_SCOPE_REQUIREMENTS.export_resources).toBeUndefined();
     });
     it('derives mutating tool names from the shared registry', () => {
@@ -20,6 +22,8 @@ describe('MCP tool registry', () => {
         expect(MCP_WRITE_TOOL_NAMES).toEqual(expected);
         expect(MCP_WRITE_TOOL_NAMES.has('read_task_attachment')).toBe(false);
         expect(MCP_WRITE_TOOL_NAMES.has('save_task_attachment')).toBe(true);
+        expect(MCP_WRITE_TOOL_NAMES.has('save_workstream_attachment')).toBe(true);
+        expect(MCP_WRITE_TOOL_NAMES.has('delete_initiative_attachment')).toBe(true);
         expect(MCP_WRITE_TOOL_NAMES.has('finish_task')).toBe(true);
         expect(MCP_WRITE_TOOL_NAMES.has('review_document')).toBe(true);
     });

package/dist/migrations/taskSchemaMigrations.d.ts

@@ -1,6 +1,5 @@
 import type { DatabaseAdapter } from '../storage/databaseAdapter.js';
 export declare function ensureTenantSchema(db: DatabaseAdapter): void;
-export declare function ensureParentTaskSchema(db: DatabaseAdapter): void;
 export declare function ensureScheduleTaskSchema(db: DatabaseAdapter): void;
 export declare function ensureAssigneeTaskSchema(db: DatabaseAdapter): void;
 export declare function ensureTaskReferenceSchema(db: DatabaseAdapter): void;
@@ -14,3 +13,4 @@ export declare function ensureSyncEventsSchema(db: DatabaseAdapter): void;
 export declare function ensureWorkspaceDocumentsSchema(db: DatabaseAdapter): void;
 export declare function ensureAnnotatedAttachmentSessionsSchema(db: DatabaseAdapter): void;
 export declare function ensureDocumentReviewSessionsSchema(db: DatabaseAdapter): void;
+export declare function ensureAuthIdentitySchema(db: DatabaseAdapter): void;

package/dist/migrations/taskSchemaMigrations.js

@@ -34,58 +34,6 @@ export function ensureTenantSchema(db) {
         CREATE INDEX IF NOT EXISTS idx_comments_tenant_task ON comments(tenant_id, task_id);
     `);
 }
-export function ensureParentTaskSchema(db) {
-    const columns = db.prepare(`PRAGMA table_info(tasks)`).all();
-    const hasParentColumn = columns.some((c) => c.name === 'parent_task_id');
-    const hasChildDisplayOrderColumn = columns.some((c) => c.name === 'child_display_order');
-    if (!hasParentColumn) {
-        db.exec(`ALTER TABLE tasks ADD COLUMN parent_task_id TEXT`);
-    }
-    if (!hasChildDisplayOrderColumn) {
-        db.exec(`ALTER TABLE tasks ADD COLUMN child_display_order INTEGER`);
-    }
-    db.exec(`
-        CREATE INDEX IF NOT EXISTS idx_tasks_parent_task_id ON tasks(parent_task_id);
-        CREATE INDEX IF NOT EXISTS idx_tasks_parent_child_order ON tasks(parent_task_id, child_display_order);
-    `);
-    // SQLite-only runtime guard triggers. Postgres path enforces constraints in core logic.
-    if (db.provider === 'sqlite') {
-        db.exec(`
-            CREATE TRIGGER IF NOT EXISTS trg_tasks_parent_guard_insert
-            BEFORE INSERT ON tasks
-            FOR EACH ROW
-            WHEN NEW.parent_task_id IS NOT NULL AND TRIM(NEW.parent_task_id) <> ''
-            BEGIN
-                SELECT CASE
-                    WHEN NEW.parent_task_id = NEW.id THEN RAISE(ABORT, 'Task cannot parent itself')
-                    WHEN (SELECT id FROM tasks WHERE id = NEW.parent_task_id) IS NULL THEN RAISE(ABORT, 'Parent task not found')
-                END;
-            END;
-        `);
-        db.exec(`
-            CREATE TRIGGER IF NOT EXISTS trg_tasks_parent_guard_update
-            BEFORE UPDATE OF parent_task_id ON tasks
-            FOR EACH ROW
-            WHEN NEW.parent_task_id IS NOT NULL AND TRIM(NEW.parent_task_id) <> ''
-            BEGIN
-                SELECT CASE
-                    WHEN NEW.parent_task_id = NEW.id THEN RAISE(ABORT, 'Task cannot parent itself')
-                    WHEN (SELECT id FROM tasks WHERE id = NEW.parent_task_id) IS NULL THEN RAISE(ABORT, 'Parent task not found')
-                END;
-            END;
-        `);
-        // Block deletion of parent tasks while children still point to them.
-        db.exec(`
-            CREATE TRIGGER IF NOT EXISTS trg_tasks_block_delete_with_children
-            BEFORE DELETE ON tasks
-            FOR EACH ROW
-            WHEN EXISTS (SELECT 1 FROM tasks WHERE parent_task_id = OLD.id)
-            BEGIN
-                SELECT RAISE(ABORT, 'Cannot delete parent task with children');
-            END;
-        `);
-    }
-}
 export function ensureScheduleTaskSchema(db) {
     const columns = db.prepare(`PRAGMA table_info(tasks)`).all();
     const hasScheduledDateColumn = columns.some((c) => c.name === 'scheduled_date');
@@ -226,9 +174,6 @@ export function ensureWorkspaceSchema(db) {
             email TEXT NOT NULL,
             display_name TEXT,
             avatar_url TEXT,
-            auth_provider TEXT,
-            external_auth_id TEXT,
-            password_hash TEXT,
             email_verified_at TEXT,
             beta_access BOOLEAN NOT NULL DEFAULT TRUE,
             is_disabled BOOLEAN NOT NULL DEFAULT FALSE,
@@ -253,6 +198,25 @@ export function ensureWorkspaceSchema(db) {
             FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
         );
 
+        CREATE TABLE IF NOT EXISTS task_attachment_upload_drafts (
+            draft_id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL,
+            task_id TEXT NOT NULL,
+            actor_ref TEXT NOT NULL,
+            storage_key TEXT NOT NULL,
+            mime_type TEXT NOT NULL,
+            original_filename TEXT NOT NULL,
+            size_bytes INTEGER NOT NULL DEFAULT 0,
+            storage_provider TEXT NOT NULL DEFAULT 'local',
+            consumed_at TEXT,
+            discarded_at TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            FOREIGN KEY (task_id) REFERENCES tasks(id) ON DELETE CASCADE,
+            FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE
+        );
+
         CREATE TABLE IF NOT EXISTS auth_tokens (
             id TEXT PRIMARY KEY,
             tenant_id TEXT NOT NULL DEFAULT 'default',
@@ -319,9 +283,6 @@ export function ensureWorkspaceSchema(db) {
         const postgresUserRepairs = [
             `ALTER TABLE users ADD COLUMN IF NOT EXISTS display_name TEXT`,
             `ALTER TABLE users ADD COLUMN IF NOT EXISTS avatar_url TEXT`,
-            `ALTER TABLE users ADD COLUMN IF NOT EXISTS auth_provider TEXT`,
-            `ALTER TABLE users ADD COLUMN IF NOT EXISTS external_auth_id TEXT`,
-            `ALTER TABLE users ADD COLUMN IF NOT EXISTS password_hash TEXT`,
             `ALTER TABLE users ADD COLUMN IF NOT EXISTS email_verified_at TEXT`,
             `ALTER TABLE users ADD COLUMN IF NOT EXISTS beta_access BOOLEAN NOT NULL DEFAULT TRUE`,
             `ALTER TABLE users ADD COLUMN IF NOT EXISTS is_disabled BOOLEAN NOT NULL DEFAULT FALSE`,
@@ -357,9 +318,6 @@ export function ensureWorkspaceSchema(db) {
         const sqliteUserRepairs = [
             { name: 'display_name', sql: `ALTER TABLE users ADD COLUMN display_name TEXT` },
             { name: 'avatar_url', sql: `ALTER TABLE users ADD COLUMN avatar_url TEXT` },
-            { name: 'auth_provider', sql: `ALTER TABLE users ADD COLUMN auth_provider TEXT` },
-            { name: 'external_auth_id', sql: `ALTER TABLE users ADD COLUMN external_auth_id TEXT` },
-            { name: 'password_hash', sql: `ALTER TABLE users ADD COLUMN password_hash TEXT` },
             { name: 'email_verified_at', sql: `ALTER TABLE users ADD COLUMN email_verified_at TEXT` },
             { name: 'beta_access', sql: `ALTER TABLE users ADD COLUMN beta_access BOOLEAN NOT NULL DEFAULT TRUE` },
             { name: 'is_disabled', sql: `ALTER TABLE users ADD COLUMN is_disabled BOOLEAN NOT NULL DEFAULT FALSE` },
@@ -449,6 +407,8 @@ export function ensureWorkspaceSchema(db) {
         CREATE INDEX IF NOT EXISTS idx_auth_tokens_user_purpose ON auth_tokens(user_id, purpose);
         CREATE INDEX IF NOT EXISTS idx_auth_tokens_workspace_purpose ON auth_tokens(workspace_id, purpose);
         CREATE INDEX IF NOT EXISTS idx_auth_tokens_expires ON auth_tokens(expires_at);
+        CREATE INDEX IF NOT EXISTS idx_task_attachment_upload_drafts_workspace_task ON task_attachment_upload_drafts(workspace_id, task_id);
+        CREATE INDEX IF NOT EXISTS idx_task_attachment_upload_drafts_actor_created ON task_attachment_upload_drafts(actor_ref, created_at);
         CREATE UNIQUE INDEX IF NOT EXISTS idx_mcp_access_tokens_prefix ON mcp_access_tokens(token_prefix);
         CREATE INDEX IF NOT EXISTS idx_mcp_access_tokens_workspace_user ON mcp_access_tokens(workspace_id, user_id);
         CREATE INDEX IF NOT EXISTS idx_mcp_access_tokens_status ON mcp_access_tokens(status);
@@ -697,6 +657,7 @@ export function ensureEntitlementsSchema(db) {
             plan_id TEXT PRIMARY KEY,
             tenant_id TEXT NOT NULL DEFAULT 'default',
             display_name TEXT NOT NULL,
+            description TEXT,
             status TEXT NOT NULL DEFAULT 'active',
             created_at TEXT NOT NULL,
             updated_at TEXT NOT NULL
@@ -727,6 +688,17 @@ export function ensureEntitlementsSchema(db) {
             FOREIGN KEY (plan_version_id) REFERENCES plan_versions(plan_version_id) ON DELETE CASCADE
         );
 
+        CREATE TABLE IF NOT EXISTS plan_feature_catalog_overrides (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            feature_key TEXT NOT NULL,
+            public_label TEXT,
+            public_description TEXT,
+            public_display_order INTEGER,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            PRIMARY KEY (tenant_id, feature_key)
+        );
+
         CREATE TABLE IF NOT EXISTS account_entitlements (
             account_id TEXT PRIMARY KEY,
             tenant_id TEXT NOT NULL DEFAULT 'default',
@@ -763,6 +735,8 @@ export function ensureEntitlementsSchema(db) {
         ON plan_versions(tenant_id, plan_id, is_default);
         CREATE INDEX IF NOT EXISTS idx_plan_feature_matrix_plan_version
         ON plan_feature_matrix(tenant_id, plan_version_id);
+        CREATE INDEX IF NOT EXISTS idx_plan_feature_catalog_overrides_tenant
+        ON plan_feature_catalog_overrides(tenant_id, updated_at);
         CREATE INDEX IF NOT EXISTS idx_account_entitlements_state
         ON account_entitlements(tenant_id, entitlement_state);
         CREATE INDEX IF NOT EXISTS idx_account_entitlements_plan_version
@@ -774,6 +748,15 @@ export function ensureEntitlementsSchema(db) {
         CREATE INDEX IF NOT EXISTS idx_entitlement_audit_log_actor
         ON entitlement_audit_log(tenant_id, actor_user_id, created_at);
     `);
+    const planCatalogColumns = db.prepare(`PRAGMA table_info(plan_catalog)`).all();
+    const hasDescriptionColumn = planCatalogColumns.some((c) => c.name === 'description');
+    if (!hasDescriptionColumn) {
+        db.exec(`ALTER TABLE plan_catalog ADD COLUMN description TEXT`);
+    }
+    const planFeatureCatalogOverrideColumns = db.prepare(`PRAGMA table_info(plan_feature_catalog_overrides)`).all();
+    if (!planFeatureCatalogOverrideColumns.some((column) => column.name === 'public_display_order')) {
+        db.exec(`ALTER TABLE plan_feature_catalog_overrides ADD COLUMN public_display_order INTEGER`);
+    }
 }
 export function ensureTaskAssetsSchema(db) {
     db.exec(`
@@ -853,6 +836,7 @@ export function ensureWorkspaceAssetsSchema(db) {
             tenant_id TEXT NOT NULL DEFAULT 'default',
             workspace_id TEXT NOT NULL,
             asset_id TEXT NOT NULL,
+            target_type TEXT NOT NULL DEFAULT 'task',
             task_id TEXT NOT NULL,
             role TEXT NOT NULL,
             display_name TEXT,
@@ -873,6 +857,15 @@ export function ensureWorkspaceAssetsSchema(db) {
     if (!hasDisplayNameColumn) {
         db.exec(`ALTER TABLE workspace_asset_links ADD COLUMN display_name TEXT`);
     }
+    const hasTargetTypeColumn = linkColumns.some((c) => c.name === 'target_type');
+    if (!hasTargetTypeColumn) {
+        db.exec(`ALTER TABLE workspace_asset_links ADD COLUMN target_type TEXT NOT NULL DEFAULT 'task'`);
+        db.exec(`UPDATE workspace_asset_links SET target_type = 'task' WHERE target_type IS NULL OR TRIM(target_type) = ''`);
+    }
+    db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_workspace_asset_links_target
+        ON workspace_asset_links(tenant_id, workspace_id, target_type, task_id, deleted_at, updated_at)
+    `);
 }
 export function ensureDocumentReferenceSchema(db) {
     const columns = db.prepare(`PRAGMA table_info(workspace_assets)`).all();
@@ -1160,3 +1153,141 @@ export function ensureDocumentReviewSessionsSchema(db) {
         }
     }
 }
+export function ensureAuthIdentitySchema(db) {
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS user_auth_identities (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            user_id TEXT NOT NULL,
+            provider TEXT NOT NULL,
+            provider_subject TEXT,
+            provider_email TEXT,
+            provider_email_verified INTEGER,
+            password_hash TEXT,
+            display_name_snapshot TEXT,
+            avatar_url_snapshot TEXT,
+            metadata_json TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            last_login_at TEXT,
+            linked_at TEXT,
+            disabled_at TEXT,
+            FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+        );
+
+        CREATE TABLE IF NOT EXISTS auth_oauth_states (
+            state TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            provider TEXT NOT NULL,
+            flow_mode TEXT NOT NULL,
+            user_id TEXT,
+            invite_token TEXT,
+            return_to TEXT,
+            pkce_verifier TEXT,
+            nonce TEXT,
+            expires_at TEXT NOT NULL,
+            consumed_at TEXT,
+            created_at TEXT NOT NULL,
+            created_ip TEXT
+        );
+    `);
+    if (db.provider === 'postgres') {
+        try {
+            db.exec(`
+                ALTER TABLE user_auth_identities
+                    ADD CONSTRAINT uq_auth_identity_provider_subject
+                    UNIQUE (tenant_id, provider, provider_subject)
+            `);
+        }
+        catch { /* already exists */ }
+        try {
+            db.exec(`
+                ALTER TABLE user_auth_identities
+                    ADD CONSTRAINT uq_auth_identity_user_provider
+                    UNIQUE (tenant_id, user_id, provider)
+            `);
+        }
+        catch { /* already exists */ }
+    }
+    else {
+        // SQLite: create unique indexes if they don't already exist
+        db.exec(`
+            CREATE UNIQUE INDEX IF NOT EXISTS uq_auth_identity_provider_subject
+                ON user_auth_identities(tenant_id, provider, provider_subject)
+                WHERE provider_subject IS NOT NULL;
+            CREATE UNIQUE INDEX IF NOT EXISTS uq_auth_identity_user_provider
+                ON user_auth_identities(tenant_id, user_id, provider);
+        `);
+    }
+    db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_auth_identities_user
+            ON user_auth_identities(tenant_id, user_id);
+        CREATE INDEX IF NOT EXISTS idx_auth_oauth_states_expires
+            ON auth_oauth_states(expires_at);
+    `);
+    // ── Backfill: migrate any remaining users.password_hash rows into user_auth_identities.
+    // Guarded: wrapped in try/catch — if the legacy column was already dropped (T-837),
+    // the SELECT will throw and we skip cleanly. Idempotent via unique index.
+    try {
+        const now = new Date().toISOString();
+        const usersWithPassword = db.prepare(`
+            SELECT id, tenant_id, password_hash
+            FROM users
+            WHERE password_hash IS NOT NULL
+              AND TRIM(COALESCE(password_hash, '')) != ''
+        `).all();
+        const hasIdentity = db.prepare(`
+            SELECT id FROM user_auth_identities
+            WHERE tenant_id = ? AND user_id = ? AND provider = 'password'
+            LIMIT 1
+        `);
+        const insertIdentity = db.prepare(`
+            INSERT INTO user_auth_identities
+                (id, tenant_id, user_id, provider, password_hash, created_at, updated_at, linked_at)
+            VALUES (?, ?, ?, 'password', ?, ?, ?, ?)
+        `);
+        for (const user of usersWithPassword) {
+            const existing = hasIdentity.get(user.tenant_id, user.id);
+            if (existing?.id)
+                continue;
+            const identityId = `identity-${user.id}-pwd`;
+            try {
+                insertIdentity.run(identityId, user.tenant_id, user.id, user.password_hash, now, now, now);
+            }
+            catch {
+                // Concurrent startup or duplicate — safe to skip.
+            }
+        }
+    }
+    catch {
+        // users.password_hash column already absent — backfill not needed.
+    }
+    // ── Drop legacy auth columns from users (T-837).
+    // Safe to run repeatedly: column-existence checks prevent double-drop errors.
+    if (db.provider === 'postgres') {
+        // PostgreSQL: DROP COLUMN IF EXISTS is a single atomic statement.
+        try {
+            db.exec(`
+                ALTER TABLE users
+                    DROP COLUMN IF EXISTS auth_provider,
+                    DROP COLUMN IF EXISTS external_auth_id,
+                    DROP COLUMN IF EXISTS password_hash
+            `);
+        }
+        catch { /* best-effort — ignore if already absent */ }
+    }
+    else {
+        // SQLite: DROP COLUMN requires 3.35.0+ (2021-03-12).
+        // better-sqlite3 ships its own SQLite which satisfies this requirement.
+        // Guard each drop individually to tolerate partial completion.
+        const currentUserCols = new Set(db.prepare(`PRAGMA table_info(users)`).all().map(c => c.name));
+        for (const col of ['auth_provider', 'external_auth_id', 'password_hash']) {
+            if (currentUserCols.has(col)) {
+                try {
+                    db.exec(`ALTER TABLE users DROP COLUMN ${col}`);
+                }
+                catch { /* ignore — concurrent drop or already gone */ }
+            }
+        }
+    }
+}

package/dist/migrations/taskSchemaMigrations.test.js

@@ -1,4 +1,6 @@
 import Database from 'better-sqlite3';
+import fs from 'fs';
+import path from 'path';
 import { afterEach, describe, expect, it } from 'vitest';
 import { ensureAnnotatedAttachmentSessionsSchema, ensureDocumentReviewSessionsSchema, ensureWorkspaceSchema } from './taskSchemaMigrations';
 const openDbs = [];
@@ -208,3 +210,16 @@ describe('ensureDocumentReviewSessionsSchema', () => {
         expect(row?.author_actor_id).toBe('user-1');
     });
 });
+describe('postgres bootstrap parity', () => {
+    it('includes workspace asset tables and target_type indexes', () => {
+        const sqlPath = path.resolve(process.cwd(), 'src/migrations/postgres/001_init.sql');
+        const sql = fs.readFileSync(sqlPath, 'utf8');
+        expect(sql).toContain('CREATE TABLE IF NOT EXISTS workspace_assets');
+        expect(sql).toContain('CREATE TABLE IF NOT EXISTS workspace_asset_links');
+        expect(sql).toContain('target_type TEXT NOT NULL DEFAULT \'task\'');
+        expect(sql).toContain('display_name TEXT');
+        expect(sql).toContain('reference_number INTEGER');
+        expect(sql).toContain('CREATE INDEX IF NOT EXISTS idx_workspace_asset_links_target');
+        expect(sql).toContain('CREATE UNIQUE INDEX IF NOT EXISTS idx_workspace_assets_workspace_kind_reference');
+    });
+});

package/dist/resources/templates/workflow-sources/workflowDocs.mjs

@@ -284,7 +284,7 @@ export const workflowDocs = [
                 '   - `### Next Action`',
                 '6. Ask whether to save as `{artifacts.implementationPlan.path}`.',
                 '7. If user confirms, persist task-specific content via `{{MCP_PREFIX}}save_task_attachment` using `filename: "implementation-plan.md"`.',
-                '   - Use `{{MCP_PREFIX}}link_task_context` only for linking existing files/URLs (for example, shared docs under `docs/`).',
+                '   - Use `{{MCP_PREFIX}}link_task_context` only for external http(s) URLs that should stay as references.',
                 '8. If setting status to `task` or `on-hold`, add explicit comment justification using `{{MCP_PREFIX}}add_comment`.',
                 '9. Never set `cancelled`, and never call `{{MCP_PREFIX}}archive_task`, unless explicitly instructed by the user.',
                 '10. Print `prompts.handoffPrompt` and stop.'
@@ -358,7 +358,7 @@ export const workflowDocs = [
                 '   - `### Next Step`',
                 '4. Ask whether to save as `{artifacts.collaborationBlueprint.path}`.',
                 '5. If user confirms, persist task-specific content via `{{MCP_PREFIX}}save_task_attachment` using `filename: "collaboration-blueprint.md"`.',
-                '   - Use `{{MCP_PREFIX}}link_task_context` only for linking existing files/URLs (for example, shared docs under `docs/`).',
+                '   - Use `{{MCP_PREFIX}}link_task_context` only for external http(s) URLs that should stay as references.',
                 '6. Ask concise clarification questions only if required fields above are missing.',
                 '7. If setting status to `task` or `on-hold`, add explicit comment justification using `{{MCP_PREFIX}}add_comment`.',
                 '8. Never set `cancelled`, and never call `{{MCP_PREFIX}}archive_task`, unless explicitly instructed by the user.',
@@ -435,14 +435,14 @@ export const workflowDocs = [
                 '   - `### Next Step`',
                 '4. Ask whether to save as `{artifacts.evaluationReport.path}`.',
                 '5. If user confirms, persist task-specific content via `{{MCP_PREFIX}}save_task_attachment` using `filename: "evaluation.md"`.',
-                '   - Use `{{MCP_PREFIX}}link_task_context` only for linking existing files/URLs (for example, shared docs under `docs/`).',
+                '   - Use `{{MCP_PREFIX}}link_task_context` only for external http(s) URLs that should stay as references.',
                 '6. Never set `cancelled`, and never call `{{MCP_PREFIX}}archive_task`, unless explicitly instructed by the user.',
                 '',
                 '## 3. Optional Report Artifact',
                 '',
                 '1. Use report files only when user opts in.',
                 '2. Save to `task attachment "evaluation.md"` and attach to task context when approved.',
-                '   - If the document is not task-specific, store it under `docs/` and optionally link it with `{{MCP_PREFIX}}link_task_context`.',
+                '   - If the document should become a shared durable document, save it through the canonical document/document-manager flow instead of a raw `docs/` file.',
                 '3. Stop.'
             ].join('\n')
         }
@@ -513,7 +513,7 @@ export const workflowDocs = [
                 '   - `### Next Status`',
                 '3. Ask whether to save as `{artifacts.reviewReport.path}`.',
                 '4. If user confirms, persist task-specific content via `{{MCP_PREFIX}}save_task_attachment` using `filename: "review.md"`.',
-                '   - Use `{{MCP_PREFIX}}link_task_context` only for linking existing files/URLs (for example, shared docs under `docs/`).',
+                '   - Use `{{MCP_PREFIX}}link_task_context` only for external http(s) URLs that should stay as references.',
                 '5. Keep status within allowed statuses (`task`, `on-hold`, `in-progress`, `review`, `done`) unless user explicitly instructs otherwise.',
                 '   - If setting status to `task` or `on-hold`, add explicit comment justification using `{{MCP_PREFIX}}add_comment`.',
                 '6. Never set `cancelled`, and never call `{{MCP_PREFIX}}archive_task`, unless explicitly instructed by the user.',
@@ -522,7 +522,7 @@ export const workflowDocs = [
                 '',
                 '1. Use report files only when user opts in.',
                 '2. Save to `task attachment "review.md"` and attach to task context when approved.',
-                '   - If the document is not task-specific, store it under `docs/` and optionally link it with `{{MCP_PREFIX}}link_task_context`.',
+                '   - If the document should become a shared durable document, save it through the canonical document/document-manager flow instead of a raw `docs/` file.',
                 '3. Stop.'
             ].join('\n')
         }

package/dist/resources/templates/workflows/collaborate.yaml

@@ -102,7 +102,7 @@ content:
        - `### Next Step`
     4. Ask whether to save as `{artifacts.collaborationBlueprint.path}`.
     5. If user confirms, persist task-specific content via `{{MCP_PREFIX}}save_task_attachment` using `filename: "collaboration-blueprint.md"`.
-       - Use `{{MCP_PREFIX}}link_task_context` only for linking existing files/URLs (for example, shared docs under `docs/`).
+       - Use `{{MCP_PREFIX}}link_task_context` only for external http(s) URLs that should stay as references.
     6. Ask concise clarification questions only if required fields above are missing.
     7. If setting status to `task` or `on-hold`, add explicit comment justification using `{{MCP_PREFIX}}add_comment`.
     8. Never set `cancelled`, and never call `{{MCP_PREFIX}}archive_task`, unless explicitly instructed by the user.

package/dist/resources/templates/workflows/evaluate.yaml

@@ -106,12 +106,12 @@ content:
        - `### Next Step`
     4. Ask whether to save as `{artifacts.evaluationReport.path}`.
     5. If user confirms, persist task-specific content via `{{MCP_PREFIX}}save_task_attachment` using `filename: "evaluation.md"`.
-       - Use `{{MCP_PREFIX}}link_task_context` only for linking existing files/URLs (for example, shared docs under `docs/`).
+       - Use `{{MCP_PREFIX}}link_task_context` only for external http(s) URLs that should stay as references.
     6. Never set `cancelled`, and never call `{{MCP_PREFIX}}archive_task`, unless explicitly instructed by the user.
 
     ## 3. Optional Report Artifact
 
     1. Use report files only when user opts in.
     2. Save to `task attachment "evaluation.md"` and attach to task context when approved.
-       - If the document is not task-specific, store it under `docs/` and optionally link it with `{{MCP_PREFIX}}link_task_context`.
+       - If the document should become a shared durable document, save it through the canonical document/document-manager flow instead of a raw `docs/` file.
     3. Stop.

package/dist/resources/templates/workflows/plan.yaml

@@ -113,7 +113,7 @@ content:
        - `### Next Action`
     6. Ask whether to save as `{artifacts.implementationPlan.path}`.
     7. If user confirms, persist task-specific content via `{{MCP_PREFIX}}save_task_attachment` using `filename: "implementation-plan.md"`.
-       - Use `{{MCP_PREFIX}}link_task_context` only for linking existing files/URLs (for example, shared docs under `docs/`).
+       - Use `{{MCP_PREFIX}}link_task_context` only for external http(s) URLs that should stay as references.
     8. If setting status to `task` or `on-hold`, add explicit comment justification using `{{MCP_PREFIX}}add_comment`.
     9. Never set `cancelled`, and never call `{{MCP_PREFIX}}archive_task`, unless explicitly instructed by the user.
     10. Print `prompts.handoffPrompt` and stop.