@taskforcehq/taskforce 0.3.305 → 0.3.307

package/dist/resources/templates/workflows/review.yaml

@@ -102,7 +102,7 @@ content:
        - `### Next Status`
     3. Ask whether to save as `{artifacts.reviewReport.path}`.
     4. If user confirms, persist task-specific content via `{{MCP_PREFIX}}save_task_attachment` using `filename: "review.md"`.
-       - Use `{{MCP_PREFIX}}link_task_context` only for linking existing files/URLs (for example, shared docs under `docs/`).
+       - Use `{{MCP_PREFIX}}link_task_context` only for external http(s) URLs that should stay as references.
     5. Keep status within allowed statuses (`task`, `on-hold`, `in-progress`, `review`, `done`) unless user explicitly instructs otherwise.
        - If setting status to `task` or `on-hold`, add explicit comment justification using `{{MCP_PREFIX}}add_comment`.
     6. Never set `cancelled`, and never call `{{MCP_PREFIX}}archive_task`, unless explicitly instructed by the user.
@@ -111,5 +111,5 @@ content:
 
     1. Use report files only when user opts in.
     2. Save to `task attachment "review.md"` and attach to task context when approved.
-       - If the document is not task-specific, store it under `docs/` and optionally link it with `{{MCP_PREFIX}}link_task_context`.
+       - If the document should become a shared durable document, save it through the canonical document/document-manager flow instead of a raw `docs/` file.
     3. Stop.

package/dist/server/aiProfileAvatarAssets.d.ts

@@ -0,0 +1,49 @@
+import type { TaskforceCore } from '../core/Taskforce.js';
+import type { ObjectStorageClient } from '../storage/objectStorageClient.js';
+import type { WorkspaceAssetStore } from '../storage/workspaceAssetStore.js';
+type AiAvatarSlot = 'display' | 'source';
+export interface AiProfileAvatarPayload {
+    buffer: Buffer;
+    mimeType: string;
+    originalName?: string | null;
+}
+export interface AiProfileAvatarAssetDeps {
+    core: TaskforceCore;
+    workspaceAssetStore: WorkspaceAssetStore | null;
+    getObjectStorageClient: () => ObjectStorageClient | null;
+    ensureWithinDir: (candidatePath: string, rootDir: string) => string | null;
+    markAssetDeleted: (pathValue: string) => unknown;
+    appendStorageTelemetry: (event: string, payload?: {
+        path?: string;
+        status?: string;
+        provider?: string;
+    }) => void;
+}
+export interface SaveAiProfileAvatarInput {
+    workspaceId: string;
+    profileId: string;
+    display: AiProfileAvatarPayload;
+    source?: AiProfileAvatarPayload | null;
+    actorId?: string | null;
+}
+export declare function buildAiProfileAvatarStorageKey(input: {
+    workspaceId: string;
+    profileId: string;
+    slot: AiAvatarSlot;
+    mimeType: string;
+}): string;
+export declare function storageKeyFromContextUrl(url: unknown): string | null;
+export declare function saveAiProfileAvatarAssets(deps: AiProfileAvatarAssetDeps, input: SaveAiProfileAvatarInput): Promise<{
+    profile: import("../core/Taskforce.js").AiProfileRecord;
+    displayAsset: import("../storage/workspaceAssetStore.js").WorkspaceAssetEntry;
+    sourceAsset: import("../storage/workspaceAssetStore.js").WorkspaceAssetEntry;
+    displayStorageKey: string;
+    sourceStorageKey: string;
+}>;
+export declare function clearAiProfileAvatarAssets(deps: AiProfileAvatarAssetDeps, input: {
+    workspaceId: string;
+    profileId: string;
+}): Promise<{
+    profile: import("../core/Taskforce.js").AiProfileRecord;
+}>;
+export {};

package/dist/server/aiProfileAvatarAssets.js

@@ -0,0 +1,319 @@
+import { createHash } from 'crypto';
+import * as fs from 'fs';
+import * as path from 'path';
+import { normalizeTaskDataRelativePath } from '../storage/objectStorageClient.js';
+const SUPPORTED_IMAGE_MIME_TYPES = new Set([
+    'image/gif',
+    'image/jpeg',
+    'image/png',
+    'image/webp',
+]);
+const AVATAR_MAX_BYTES = 5 * 1024 * 1024;
+function normalizeId(value) {
+    return String(value || '').trim();
+}
+function sanitizeStorageSegment(value, fallback) {
+    const normalized = normalizeId(value)
+        .replace(/[^a-zA-Z0-9._-]/g, '-')
+        .replace(/-+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    return normalized || fallback;
+}
+function normalizeImageMimeType(value) {
+    return normalizeId(value).toLowerCase();
+}
+function extensionForMimeType(mimeType) {
+    if (mimeType === 'image/gif')
+        return 'gif';
+    if (mimeType === 'image/jpeg')
+        return 'jpg';
+    if (mimeType === 'image/png')
+        return 'png';
+    return 'webp';
+}
+function stableAssetId(workspaceId, profileId, slot) {
+    const digest = createHash('sha256')
+        .update(`${workspaceId}:${profileId}:${slot}`)
+        .digest('hex')
+        .slice(0, 32);
+    return `asset-${digest}`;
+}
+export function buildAiProfileAvatarStorageKey(input) {
+    const workspaceId = sanitizeStorageSegment(input.workspaceId, 'default');
+    const profileId = sanitizeStorageSegment(input.profileId, 'ai-profile');
+    const ext = extensionForMimeType(input.mimeType);
+    return `workspaces/${workspaceId}/assets/images/ai-profiles/${profileId}/avatar/${input.slot}.${ext}`;
+}
+function contextUrlForStorageKey(storageKey) {
+    return `/api/taskforce/context/${encodeURIComponent(storageKey)}`;
+}
+export function storageKeyFromContextUrl(url) {
+    const raw = normalizeId(url);
+    if (!raw)
+        return null;
+    const contextPrefix = '/api/taskforce/context/';
+    if (!raw.startsWith(contextPrefix))
+        return null;
+    const encodedPath = raw.slice(contextPrefix.length).split('?')[0] || '';
+    try {
+        return normalizeTaskDataRelativePath(decodeURIComponent(encodedPath));
+    }
+    catch {
+        return null;
+    }
+}
+function validatePayload(payload, label) {
+    const mimeType = normalizeImageMimeType(payload.mimeType);
+    if (!SUPPORTED_IMAGE_MIME_TYPES.has(mimeType)) {
+        throw new Error(`${label} must be a PNG, JPEG, WebP, or GIF image.`);
+    }
+    if (!Buffer.isBuffer(payload.buffer) || payload.buffer.length === 0) {
+        throw new Error(`${label} is empty.`);
+    }
+    if (payload.buffer.length > AVATAR_MAX_BYTES) {
+        throw new Error(`${label} must be 5 MB or smaller.`);
+    }
+    return mimeType;
+}
+function storageKeyBelongsToAiProfileAvatar(workspaceId, profileId, storageKey) {
+    const workspaceIdSafe = sanitizeStorageSegment(workspaceId, 'default');
+    const profileIdSafe = sanitizeStorageSegment(profileId, 'ai-profile');
+    return storageKey.startsWith(`workspaces/${workspaceIdSafe}/assets/images/ai-profiles/${profileIdSafe}/avatar/`);
+}
+async function writeAvatarObject(deps, storageKey, payload, provider) {
+    if (provider === 'r2') {
+        const objectStorageClient = deps.getObjectStorageClient();
+        if (!objectStorageClient)
+            throw new Error('Object storage is not configured.');
+        await objectStorageClient.putObject(storageKey, payload.buffer, payload.mimeType);
+        return;
+    }
+    const { basePath } = deps.core.getPaths();
+    const destination = deps.ensureWithinDir(path.join(basePath, storageKey), basePath);
+    if (!destination)
+        throw new Error('Invalid AI profile avatar storage path.');
+    fs.mkdirSync(path.dirname(destination), { recursive: true });
+    fs.writeFileSync(destination, payload.buffer);
+}
+async function deleteAvatarObject(deps, storageKey, provider) {
+    try {
+        deps.markAssetDeleted(storageKey);
+    }
+    catch {
+        // Best-effort legacy asset index cleanup should not make the canonical
+        // workspace asset/profile update fail after the new slots are written.
+    }
+    if (provider === 'r2') {
+        const objectStorageClient = deps.getObjectStorageClient();
+        if (objectStorageClient) {
+            await objectStorageClient.deleteObject(storageKey).catch(() => false);
+        }
+        return;
+    }
+    const { basePath } = deps.core.getPaths();
+    const destination = deps.ensureWithinDir(path.join(basePath, storageKey), basePath);
+    if (destination && fs.existsSync(destination)) {
+        fs.rmSync(destination, { force: true });
+    }
+}
+function upsertAvatarAsset(input) {
+    if (!input.deps.workspaceAssetStore) {
+        throw new Error('Workspace asset storage is required for AI profile avatars.');
+    }
+    const contentSha256 = createHash('sha256').update(input.payload.buffer).digest('hex');
+    const existing = input.deps.workspaceAssetStore.getByStorageKey(input.storageKey, input.workspaceId);
+    return input.deps.workspaceAssetStore.upsertAsset({
+        assetId: existing?.assetId || stableAssetId(input.workspaceId, input.profileId, input.slot),
+        workspaceId: input.workspaceId,
+        kind: 'image',
+        logicalName: `AI profile avatar ${input.slot}`,
+        originalFilename: normalizeId(input.payload.originalName) || `${input.slot}.${extensionForMimeType(input.payload.mimeType)}`,
+        mimeType: input.payload.mimeType,
+        storageProvider: input.provider,
+        storageKey: input.storageKey,
+        contentSha256,
+        sizeBytes: input.payload.buffer.length,
+        documentId: null,
+        version: null,
+        isLatest: true,
+        scanStatus: 'clean',
+        scanEngine: null,
+        scanDetails: null,
+        createdByUserId: existing?.createdByUserId || normalizeId(input.actorId) || null,
+        createdAt: existing?.createdAt || input.nowIso,
+        updatedAt: input.nowIso,
+        deletedAt: null,
+        purgeAfter: null,
+    });
+}
+async function cleanupAiProfileAvatarAssets(input) {
+    const keep = new Set(Array.from(input.keepStorageKeys || []).filter(Boolean));
+    const candidates = new Map();
+    for (const storageKey of input.explicitStorageKeys || []) {
+        const normalized = normalizeTaskDataRelativePath(normalizeId(storageKey));
+        if (!normalized || keep.has(normalized))
+            continue;
+        if (storageKeyBelongsToAiProfileAvatar(input.workspaceId, input.profileId, normalized)) {
+            candidates.set(normalized, input.providerFallback);
+        }
+    }
+    if (input.deps.workspaceAssetStore) {
+        const assets = input.deps.workspaceAssetStore.listAllByWorkspace(input.workspaceId, {
+            includeDeleted: false,
+            kind: 'image',
+        });
+        for (const asset of assets) {
+            if (!storageKeyBelongsToAiProfileAvatar(input.workspaceId, input.profileId, asset.storageKey))
+                continue;
+            if (keep.has(asset.storageKey))
+                continue;
+            candidates.set(asset.storageKey, asset.storageProvider === 'r2' ? 'r2' : 'local');
+        }
+    }
+    for (const [storageKey, provider] of candidates) {
+        try {
+            const asset = input.deps.workspaceAssetStore?.getByStorageKey(storageKey, input.workspaceId);
+            if (asset && !asset.deletedAt) {
+                input.deps.workspaceAssetStore?.markDeleted(asset.assetId, input.workspaceId);
+            }
+        }
+        catch {
+            input.deps.appendStorageTelemetry('ai_avatar.cleanup', {
+                path: storageKey,
+                provider,
+                status: 'metadata-delete-failed',
+            });
+        }
+        try {
+            await deleteAvatarObject(input.deps, storageKey, provider);
+            input.deps.appendStorageTelemetry('ai_avatar.cleanup', {
+                path: storageKey,
+                provider,
+                status: 'deleted',
+            });
+        }
+        catch {
+            input.deps.appendStorageTelemetry('ai_avatar.cleanup', {
+                path: storageKey,
+                provider,
+                status: 'object-delete-failed',
+            });
+        }
+    }
+}
+export async function saveAiProfileAvatarAssets(deps, input) {
+    const workspaceId = normalizeId(input.workspaceId);
+    const profileId = normalizeId(input.profileId);
+    if (!workspaceId)
+        throw new Error('workspaceId is required.');
+    if (!profileId)
+        throw new Error('profileId is required.');
+    const existingProfile = deps.core.listAiProfiles(workspaceId)
+        .find((profile) => profile.id === profileId);
+    if (!existingProfile)
+        throw new Error(`Profile ${profileId} not found.`);
+    const displayMimeType = validatePayload(input.display, 'Display avatar');
+    const sourcePayload = input.source || input.display;
+    const sourceMimeType = validatePayload(sourcePayload, 'Source avatar');
+    const displayPayload = { ...input.display, mimeType: displayMimeType };
+    const normalizedSourcePayload = { ...sourcePayload, mimeType: sourceMimeType };
+    const displayStorageKey = buildAiProfileAvatarStorageKey({
+        workspaceId,
+        profileId,
+        slot: 'display',
+        mimeType: displayMimeType,
+    });
+    const sourceStorageKey = buildAiProfileAvatarStorageKey({
+        workspaceId,
+        profileId,
+        slot: 'source',
+        mimeType: sourceMimeType,
+    });
+    const objectStorageClient = deps.getObjectStorageClient();
+    const provider = objectStorageClient ? 'r2' : 'local';
+    const nowIso = new Date().toISOString();
+    await writeAvatarObject(deps, displayStorageKey, displayPayload, provider);
+    await writeAvatarObject(deps, sourceStorageKey, normalizedSourcePayload, provider);
+    const displayAsset = upsertAvatarAsset({
+        deps,
+        workspaceId,
+        profileId,
+        slot: 'display',
+        storageKey: displayStorageKey,
+        payload: displayPayload,
+        provider,
+        actorId: input.actorId,
+        nowIso,
+    });
+    const sourceAsset = upsertAvatarAsset({
+        deps,
+        workspaceId,
+        profileId,
+        slot: 'source',
+        storageKey: sourceStorageKey,
+        payload: normalizedSourcePayload,
+        provider,
+        actorId: input.actorId,
+        nowIso,
+    });
+    deps.core.notifyDocumentMetadataMutation(workspaceId, [displayStorageKey, sourceStorageKey], 'upsert');
+    deps.appendStorageTelemetry('ai_avatar.upload', {
+        path: displayStorageKey,
+        provider,
+        status: 'stored',
+    });
+    const profile = deps.core.updateAiProfileAvatar({
+        workspaceId,
+        profileId,
+        avatarUrl: contextUrlForStorageKey(displayStorageKey),
+        avatarSourceUrl: contextUrlForStorageKey(sourceStorageKey),
+    });
+    await cleanupAiProfileAvatarAssets({
+        deps,
+        workspaceId,
+        profileId,
+        keepStorageKeys: [displayStorageKey, sourceStorageKey],
+        explicitStorageKeys: [
+            storageKeyFromContextUrl(existingProfile.avatarUrl),
+            storageKeyFromContextUrl(existingProfile.avatarSourceUrl),
+        ],
+        providerFallback: provider,
+    });
+    return {
+        profile,
+        displayAsset,
+        sourceAsset,
+        displayStorageKey,
+        sourceStorageKey,
+    };
+}
+export async function clearAiProfileAvatarAssets(deps, input) {
+    const workspaceId = normalizeId(input.workspaceId);
+    const profileId = normalizeId(input.profileId);
+    if (!workspaceId)
+        throw new Error('workspaceId is required.');
+    if (!profileId)
+        throw new Error('profileId is required.');
+    const existingProfile = deps.core.listAiProfiles(workspaceId)
+        .find((profile) => profile.id === profileId);
+    const objectStorageClient = deps.getObjectStorageClient();
+    const provider = objectStorageClient ? 'r2' : 'local';
+    const profile = deps.core.updateAiProfileAvatar({
+        workspaceId,
+        profileId,
+        avatarUrl: null,
+        avatarSourceUrl: null,
+    });
+    await cleanupAiProfileAvatarAssets({
+        deps,
+        workspaceId,
+        profileId,
+        keepStorageKeys: [],
+        explicitStorageKeys: [
+            storageKeyFromContextUrl(existingProfile?.avatarUrl),
+            storageKeyFromContextUrl(existingProfile?.avatarSourceUrl),
+        ],
+        providerFallback: provider,
+    });
+    return { profile };
+}

package/dist/server/aiProfileAvatarAssets.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/aiProfileAvatarAssets.test.js

@@ -0,0 +1,213 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { TaskforceCore } from '../core/Taskforce';
+import { WorkspaceAssetStore } from '../storage/workspaceAssetStore';
+import { buildAiProfileAvatarStorageKey, saveAiProfileAvatarAssets, } from './aiProfileAvatarAssets';
+const roots = [];
+function createFixture() {
+    const projectRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'taskforce-ai-avatar-assets-'));
+    roots.push(projectRoot);
+    const core = new TaskforceCore({ projectRoot });
+    const workspaceAssetStore = new WorkspaceAssetStore(core.getDatabaseAdapter(), core.getTenantId());
+    const ensureWithinDir = (candidatePath, rootDir) => {
+        const resolvedRoot = path.resolve(rootDir);
+        const resolvedCandidate = path.resolve(candidatePath);
+        return resolvedCandidate.startsWith(resolvedRoot) ? resolvedCandidate : null;
+    };
+    return {
+        core,
+        workspaceAssetStore,
+        deps: {
+            core,
+            workspaceAssetStore,
+            getObjectStorageClient: () => null,
+            ensureWithinDir,
+            markAssetDeleted: vi.fn(),
+            appendStorageTelemetry: vi.fn(),
+        }
+    };
+}
+afterEach(() => {
+    while (roots.length > 0) {
+        const root = roots.pop();
+        if (root)
+            fs.rmSync(root, { recursive: true, force: true });
+    }
+});
+describe('AI profile avatar stable assets', () => {
+    it('builds deterministic stable slot paths', () => {
+        expect(buildAiProfileAvatarStorageKey({
+            workspaceId: 'workspace-1',
+            profileId: 'ai-profile-1',
+            slot: 'display',
+            mimeType: 'image/webp',
+        })).toBe('workspaces/workspace-1/assets/images/ai-profiles/ai-profile-1/avatar/display.webp');
+        expect(buildAiProfileAvatarStorageKey({
+            workspaceId: 'workspace-1',
+            profileId: 'ai-profile-1',
+            slot: 'source',
+            mimeType: 'image/gif',
+        })).toBe('workspaces/workspace-1/assets/images/ai-profiles/ai-profile-1/avatar/source.gif');
+    });
+    it('overwrites the same display/source assets and advances profile revision', async () => {
+        const { core, workspaceAssetStore, deps } = createFixture();
+        const workspaceId = 'workspace-1';
+        const resolved = core.resolveAiProfile({
+            workspaceId,
+            name: 'Codex',
+            provider: 'OpenAI',
+            model: 'gpt-5',
+        });
+        const profileId = resolved.profile.id;
+        const first = await saveAiProfileAvatarAssets(deps, {
+            workspaceId,
+            profileId,
+            display: {
+                buffer: Buffer.from('display-one'),
+                mimeType: 'image/webp',
+                originalName: 'display.webp',
+            },
+            source: {
+                buffer: Buffer.from('source-one'),
+                mimeType: 'image/jpeg',
+                originalName: 'source.jpg',
+            },
+            actorId: 'user-1',
+        });
+        const second = await saveAiProfileAvatarAssets(deps, {
+            workspaceId,
+            profileId,
+            display: {
+                buffer: Buffer.from('display-two'),
+                mimeType: 'image/webp',
+                originalName: 'display.webp',
+            },
+            source: {
+                buffer: Buffer.from('source-two'),
+                mimeType: 'image/jpeg',
+                originalName: 'source.jpg',
+            },
+            actorId: 'user-1',
+        });
+        expect(second.displayStorageKey).toBe(first.displayStorageKey);
+        expect(second.sourceStorageKey).toBe(first.sourceStorageKey);
+        expect(second.profile.avatarRevision).toBe(2);
+        expect(second.profile.avatarUrl).toBe(`/api/taskforce/context/${encodeURIComponent(second.displayStorageKey)}`);
+        expect(second.profile.avatarSourceUrl).toBe(`/api/taskforce/context/${encodeURIComponent(second.sourceStorageKey)}`);
+        const assets = workspaceAssetStore.listAllByWorkspace(workspaceId, { kind: 'image' });
+        expect(assets.map((asset) => asset.storageKey).sort()).toEqual([
+            second.displayStorageKey,
+            second.sourceStorageKey,
+        ].sort());
+        const displayAsset = workspaceAssetStore.getByStorageKey(second.displayStorageKey, workspaceId);
+        expect(displayAsset?.contentSha256).not.toBe(first.displayAsset.contentSha256);
+        const displayPath = path.join(core.getPaths().basePath, second.displayStorageKey);
+        expect(fs.readFileSync(displayPath, 'utf8')).toBe('display-two');
+        core.close();
+    });
+    it('tombstones old generated avatar assets after a stable replacement succeeds', async () => {
+        const { core, workspaceAssetStore, deps } = createFixture();
+        const workspaceId = 'workspace-1';
+        const resolved = core.resolveAiProfile({
+            workspaceId,
+            name: 'Harry Palmer',
+            provider: 'OpenClaw',
+            model: 'gpt-5.4',
+        });
+        const profileId = resolved.profile.id;
+        const oldStorageKey = `workspaces/${workspaceId}/assets/images/ai-profiles/${profileId}/avatar/asset-old-cropped-harry.webp`;
+        fs.mkdirSync(path.dirname(path.join(core.getPaths().basePath, oldStorageKey)), { recursive: true });
+        fs.writeFileSync(path.join(core.getPaths().basePath, oldStorageKey), 'old-avatar');
+        workspaceAssetStore.upsertAsset({
+            assetId: 'asset-old-harry-avatar-000000000001',
+            workspaceId,
+            kind: 'image',
+            logicalName: 'old avatar',
+            originalFilename: 'cropped-harry.webp',
+            mimeType: 'image/webp',
+            storageProvider: 'local',
+            storageKey: oldStorageKey,
+            contentSha256: 'old-sha',
+            sizeBytes: 10,
+        });
+        core.updateAiProfileAvatar({
+            workspaceId,
+            profileId,
+            avatarUrl: `/api/taskforce/context/${encodeURIComponent(oldStorageKey)}`,
+            avatarSourceUrl: null,
+        });
+        await saveAiProfileAvatarAssets(deps, {
+            workspaceId,
+            profileId,
+            display: {
+                buffer: Buffer.from('display'),
+                mimeType: 'image/webp',
+                originalName: 'display.webp',
+            },
+            source: {
+                buffer: Buffer.from('source'),
+                mimeType: 'image/webp',
+                originalName: 'source.webp',
+            },
+        });
+        expect(workspaceAssetStore.getByStorageKey(oldStorageKey, workspaceId)?.deletedAt).toBeTruthy();
+        expect(fs.existsSync(path.join(core.getPaths().basePath, oldStorageKey))).toBe(false);
+        expect(deps.markAssetDeleted).toHaveBeenCalledWith(oldStorageKey);
+        core.close();
+    });
+    it('does not fail a stable replacement when legacy cleanup markers fail', async () => {
+        const { core, workspaceAssetStore, deps } = createFixture();
+        const workspaceId = 'workspace-1';
+        const resolved = core.resolveAiProfile({
+            workspaceId,
+            name: 'Control',
+            provider: 'OpenAI',
+            model: 'gpt-5',
+        });
+        const profileId = resolved.profile.id;
+        const oldStorageKey = `workspaces/${workspaceId}/assets/images/ai-profiles/${profileId}/avatar/asset-old-control.webp`;
+        fs.mkdirSync(path.dirname(path.join(core.getPaths().basePath, oldStorageKey)), { recursive: true });
+        fs.writeFileSync(path.join(core.getPaths().basePath, oldStorageKey), 'old-avatar');
+        workspaceAssetStore.upsertAsset({
+            assetId: 'asset-old-control-avatar-0000001',
+            workspaceId,
+            kind: 'image',
+            logicalName: 'old avatar',
+            originalFilename: 'control.webp',
+            mimeType: 'image/webp',
+            storageProvider: 'local',
+            storageKey: oldStorageKey,
+            contentSha256: 'old-sha',
+            sizeBytes: 10,
+        });
+        core.updateAiProfileAvatar({
+            workspaceId,
+            profileId,
+            avatarUrl: `/api/taskforce/context/${encodeURIComponent(oldStorageKey)}`,
+            avatarSourceUrl: null,
+        });
+        deps.markAssetDeleted.mockImplementation(() => {
+            throw new Error('legacy marker failed');
+        });
+        const result = await saveAiProfileAvatarAssets(deps, {
+            workspaceId,
+            profileId,
+            display: {
+                buffer: Buffer.from('display'),
+                mimeType: 'image/webp',
+                originalName: 'display.webp',
+            },
+            source: {
+                buffer: Buffer.from('source'),
+                mimeType: 'image/webp',
+                originalName: 'source.webp',
+            },
+        });
+        expect(result.profile.avatarUrl).toBe(`/api/taskforce/context/${encodeURIComponent(result.displayStorageKey)}`);
+        expect(workspaceAssetStore.getByStorageKey(oldStorageKey, workspaceId)?.deletedAt).toBeTruthy();
+        expect(fs.existsSync(path.join(core.getPaths().basePath, oldStorageKey))).toBe(false);
+        core.close();
+    });
+});