@taskforcehq/taskforce 0.3.305 → 0.3.307

package/dist/server/routes/documents.d.ts

@@ -15,6 +15,7 @@
  *   GET    /api/taskforce/context-metadata
  *   POST   /api/taskforce/context/purge-expired
  *   GET    /api/taskforce/documents
+ *   POST   /api/taskforce/documents/:assetId/attach
  *   DELETE /api/taskforce/documents/:assetId
  *   PATCH  /api/taskforce/documents/:assetId
  *   POST   /api/taskforce/documents/save

package/dist/server/routes/documents.js

@@ -15,6 +15,7 @@
  *   GET    /api/taskforce/context-metadata
  *   POST   /api/taskforce/context/purge-expired
  *   GET    /api/taskforce/documents
+ *   POST   /api/taskforce/documents/:assetId/attach
  *   DELETE /api/taskforce/documents/:assetId
  *   PATCH  /api/taskforce/documents/:assetId
  *   POST   /api/taskforce/documents/save
@@ -30,6 +31,75 @@ import { parsePlan } from '../../utils/planParser.js';
 import { getCanonicalDocumentName, getReadableDocumentName, isGeneratedDocumentName } from '../../utils/documentNames.js';
 import { requestRuntimeMode } from './shared.js';
 import { parseJsonBody } from './primitives.js';
+import { resolveDeploymentConfig } from '../../config/deployment.js';
+function isUserProfileAvatarPath(relativePath) {
+    return /^users\/[^/]+\/profile\/avatar\/[^/]+$/i.test(String(relativePath || '').replace(/\\/g, '/'));
+}
+function isAiProfileAvatarPath(relativePath) {
+    return /^workspaces\/[^/]+\/assets\/images\/ai-profiles\/[^/]+\/avatar\/[^/]+$/i.test(String(relativePath || '').replace(/\\/g, '/'));
+}
+function resolveRequestOrigin(req) {
+    const host = String(req.headers.host || '').trim();
+    if (!host)
+        return '';
+    const proto = String(req.headers['x-forwarded-proto'] || '').trim().toLowerCase() === 'https'
+        ? 'https'
+        : (req.socket?.encrypted ? 'https' : 'http');
+    return `${proto}://${host.replace(/\/+$/, '')}`;
+}
+async function proxyCloudUserProfileAvatar(req, res, relativePath, contentTypeForExt) {
+    if (!isUserProfileAvatarPath(relativePath))
+        return false;
+    const deployment = resolveDeploymentConfig(process.env);
+    const cloudBaseUrl = String(deployment.cloudBaseUrl || deployment.cloudAuthBaseUrl || '').trim().replace(/\/+$/, '');
+    if (!cloudBaseUrl)
+        return false;
+    if (cloudBaseUrl === resolveRequestOrigin(req))
+        return false;
+    const requestUrl = new URL(req.url || '', 'http://localhost');
+    const upstreamUrl = `${cloudBaseUrl}/api/taskforce/context/${encodeURIComponent(relativePath)}${requestUrl.search || ''}`;
+    const headers = new Headers();
+    const cookie = String(req.headers.cookie || '').trim();
+    const accept = String(req.headers.accept || '').trim();
+    const userAgent = String(req.headers['user-agent'] || '').trim();
+    if (cookie)
+        headers.set('cookie', cookie);
+    if (accept)
+        headers.set('accept', accept);
+    if (userAgent)
+        headers.set('user-agent', userAgent);
+    headers.set('x-taskforce-origin-runtime', 'local-proxy');
+    const cfClientId = String(process.env.TASKFORCE_CF_ACCESS_CLIENT_ID || process.env.CF_ACCESS_CLIENT_ID || '').trim();
+    const cfClientSecret = String(process.env.TASKFORCE_CF_ACCESS_CLIENT_SECRET || process.env.CF_ACCESS_CLIENT_SECRET || '').trim();
+    if (cfClientId && cfClientSecret) {
+        headers.set('CF-Access-Client-Id', cfClientId);
+        headers.set('CF-Access-Client-Secret', cfClientSecret);
+    }
+    try {
+        const upstream = await fetch(upstreamUrl, {
+            method: 'GET',
+            headers
+        });
+        if (upstream.status === 404)
+            return false;
+        const outgoingHeaders = {};
+        for (const [key, value] of upstream.headers.entries()) {
+            const name = key.toLowerCase();
+            if (name === 'set-cookie' || name === 'content-length' || name === 'transfer-encoding')
+                continue;
+            outgoingHeaders[key] = value;
+        }
+        if (!outgoingHeaders['content-type']) {
+            outgoingHeaders['Content-Type'] = contentTypeForExt(path.extname(relativePath).toLowerCase());
+        }
+        res.writeHead(upstream.status, outgoingHeaders);
+        res.end(Buffer.from(await upstream.arrayBuffer()));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 export function registerDocumentRoutes(deps) {
     const { addRoute, core, context, requestWorkspaceId, ensureAdminRole, resolveEffectiveObjectStorageConfig, getObjectStorageClient, resolveStorageWorkspaceId, ensureContextUploadAllowed, parseStorageFolderSegments, buildCanonicalWorkspaceAssetRelativePath, inferAssetKindFromPath, appendStorageTelemetry, scanAndRecordDocument, buildTaskAttachmentPayload, workspaceAssetStore, taskAssetStore, normalizeDocumentPathInput, getAssetMetadata, getCanonicalAssetMetadata, documentRetentionDays, appendDocumentPurgeHistory, markAssetDeleted, isAssetDeleted, clearAssetDeleted, ensureWithinDir, sanitizeDownloadFilename, contentTypeForExt, inferInlineDocumentFromPath, resolveCanonicalDocumentRead, inferWorkspaceIdFromStoragePath, inferTaskIdFromStoragePath, } = deps;
     const removeDocumentAttachmentFromTaskAttachments = (attachmentsRaw, asset) => {
@@ -396,9 +466,22 @@ export function registerDocumentRoutes(deps) {
             return;
         }
         if (objectStorageClient && normalizedRelative && resolvedObjectStorage.provider === 'r2' && resolvedObjectStorage.r2) {
-            if (shouldProxyInlineDocument) {
+            const shouldProxyInlineUserAvatar = isUserProfileAvatarPath(normalizedRelative);
+            const shouldProxyInlineAiAvatar = isAiProfileAvatarPath(normalizedRelative);
+            if (shouldProxyInlineDocument || shouldProxyInlineUserAvatar || shouldProxyInlineAiAvatar) {
                 const object = await objectStorageClient.getObject(normalizedRelative);
                 if (!object) {
+                    if (shouldProxyInlineUserAvatar && await proxyCloudUserProfileAvatar(req, res, normalizedRelative, contentTypeForExt)) {
+                        return;
+                    }
+                    if (shouldProxyInlineAiAvatar && filePath && fs.existsSync(filePath)) {
+                        res.writeHead(200, {
+                            'Content-Type': contentTypeForExt(ext),
+                            'Content-Disposition': contentDisposition
+                        });
+                        res.end(fs.readFileSync(filePath));
+                        return;
+                    }
                     res.writeHead(404, { 'Content-Type': 'text/plain' });
                     res.end('Context file not found');
                     return;
@@ -423,6 +506,9 @@ export function registerDocumentRoutes(deps) {
             res.end(fs.readFileSync(filePath));
             return;
         }
+        if (normalizedRelative && await proxyCloudUserProfileAvatar(req, res, normalizedRelative, contentTypeForExt)) {
+            return;
+        }
         res.writeHead(404, { 'Content-Type': 'text/plain' });
         res.end('Context file not found');
     });
@@ -590,9 +676,6 @@ export function registerDocumentRoutes(deps) {
     });
     addRoute('GET', '/api/taskforce/documents', async (req, res) => {
         const workspaceId = requestWorkspaceId(req);
-        const { basePath, projectRoot } = core.getPaths();
-        const planningDocsDir = path.join(basePath, 'docs');
-        const runtimeMode = context.authConfig?.runtimeMode === 'cloud' ? 'cloud' : 'local';
         function inferDocType(filename) {
             const base = path.basename(filename, path.extname(filename)).toLowerCase();
             if (base.includes('implementation-plan') || base.includes('implementation_plan'))
@@ -630,12 +713,9 @@ export function registerDocumentRoutes(deps) {
                 : (taskId ? 1 : 0);
             const attachmentState = input.attachmentState === 'attached'
                 || input.attachmentState === 'unattached'
-                || input.attachmentState === 'standalone'
                 ? (attachmentCount > 0 || taskId
                     ? 'attached'
-                    : input.attachmentState === 'standalone'
-                        ? 'standalone'
-                        : 'unattached')
+                    : 'unattached')
                 : (attachmentCount > 0 || taskId ? 'attached' : 'unattached');
             return {
                 id: input.id,
@@ -658,12 +738,6 @@ export function registerDocumentRoutes(deps) {
                 attachmentState
             };
         }
-        function safeRelative(fullPath) {
-            const rel = path.relative(projectRoot, fullPath);
-            if (rel.startsWith('..'))
-                return null;
-            return rel;
-        }
         const documents = [];
         const seenDocumentPaths = new Set();
         const pushDocument = (doc) => {
@@ -674,6 +748,9 @@ export function registerDocumentRoutes(deps) {
             seenDocumentPaths.add(key);
             documents.push(normalizedDoc);
         };
+        // Shared document listing is canonical-document-only. Raw files under
+        // .taskforce/docs are intentionally excluded because they are not
+        // workspace-scoped managed documents.
         const canonicalDocuments = workspaceAssetStore?.listAllByWorkspace(workspaceId, {
             includeDeleted: false,
             kind: 'document'
@@ -689,8 +766,11 @@ export function registerDocumentRoutes(deps) {
             });
             const activeLinks = (workspaceAssetStore?.listLinksForAsset(asset.assetId, workspaceId) || [])
                 .filter((link) => !link.deletedAt)
+                .filter((link) => link.targetType !== 'task' || (!!link.taskId && !!core.getTask(link.taskId, workspaceId)));
+            const activeTaskLinks = activeLinks
+                .filter((link) => link.targetType === 'task' && !!link.taskId)
                 .filter((link) => !!core.getTask(link.taskId, workspaceId));
-            const firstLink = activeLinks[0] || null;
+            const firstLink = activeTaskLinks[0] || null;
             const repairedLogicalName = isGeneratedDocumentName(asset.logicalName || null, asset.assetId || null)
                 ? (String(firstLink?.displayName || '').trim()
                     || repairedReadableName)
@@ -742,58 +822,6 @@ export function registerDocumentRoutes(deps) {
                 attachmentState: activeLinks.length > 0 ? 'attached' : 'unattached',
             });
         }
-        if (runtimeMode !== 'cloud') {
-            const walkMarkdownFiles = (dir, visitor) => {
-                let entries = [];
-                try {
-                    entries = fs.readdirSync(dir, { withFileTypes: true });
-                }
-                catch {
-                    return;
-                }
-                for (const entry of entries) {
-                    const fullPath = path.join(dir, entry.name);
-                    if (entry.isDirectory()) {
-                        walkMarkdownFiles(fullPath, visitor);
-                        continue;
-                    }
-                    if (!entry.isFile() || path.extname(entry.name).toLowerCase() !== '.md') {
-                        continue;
-                    }
-                    let stat;
-                    try {
-                        stat = fs.statSync(fullPath);
-                    }
-                    catch {
-                        continue;
-                    }
-                    const relativePath = safeRelative(fullPath);
-                    if (!relativePath)
-                        continue;
-                    visitor({ relativePath, entryName: entry.name, stat });
-                }
-            };
-            walkMarkdownFiles(planningDocsDir, ({ relativePath, entryName, stat }) => {
-                pushDocument({
-                    id: relativePath,
-                    assetId: null,
-                    referenceNumber: null,
-                    referenceLabel: null,
-                    fsPath: relativePath,
-                    apiUrl: `/api/taskforce/context-link?path=${encodeURIComponent(relativePath)}`,
-                    taskId: null,
-                    displayName: inferTitle(entryName),
-                    originalFilename: entryName,
-                    title: inferTitle(entryName),
-                    docType: 'planning',
-                    sizeBytes: stat.size,
-                    updatedAt: stat.mtime.toISOString(),
-                    editable: true,
-                    attachmentCount: 0,
-                    attachmentState: 'standalone',
-                });
-            });
-        }
         documents.sort((a, b) => {
             if (!a.updatedAt && !b.updatedAt)
                 return 0;
@@ -806,6 +834,87 @@ export function registerDocumentRoutes(deps) {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ documents }));
     });
+    addRoute('POST', '/api/taskforce/documents/:assetId/attach', async (req, res, params) => {
+        const workspaceId = requestWorkspaceId(req);
+        const assetId = String(params.assetId || '').trim();
+        const body = await parseJsonBody(req);
+        const targetType = String(body?.targetType || 'task').trim();
+        const targetId = String(body?.targetId || '').trim();
+        if (!workspaceAssetStore || !assetId) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Document not found.' }));
+            return;
+        }
+        if (!targetId) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Missing required targetId.' }));
+            return;
+        }
+        if (targetType !== 'task') {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Only task attachments are supported from the document manager right now.' }));
+            return;
+        }
+        const asset = workspaceAssetStore.get(assetId, workspaceId);
+        if (!asset || asset.kind !== 'document' || asset.deletedAt) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Document not found.' }));
+            return;
+        }
+        const task = core.getTask(targetId, workspaceId);
+        if (!task) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Task not found.' }));
+            return;
+        }
+        const existingLinks = workspaceAssetStore.listLinksForTarget('task', targetId, workspaceId)
+            .filter((link) => !link.deletedAt);
+        const alreadyAttached = existingLinks.some((link) => link.assetId === asset.assetId && link.role === 'attachment');
+        if (alreadyAttached) {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                success: true,
+                alreadyAttached: true,
+                targetType: 'task',
+                targetId,
+                attachmentCount: existingLinks.length,
+            }));
+            return;
+        }
+        const attachedAt = new Date().toISOString();
+        const payload = buildTaskAttachmentPayload(asset.storageKey, {
+            caption: getCanonicalDocumentName({
+                assetId: asset.assetId,
+                fsPath: asset.storageKey,
+                logicalName: asset.logicalName || null,
+                title: asset.logicalName || asset.originalFilename,
+                originalFilename: asset.originalFilename,
+            }),
+            assetId: asset.assetId,
+            taskId: targetId,
+            timestamp: attachedAt,
+        });
+        if (!payload) {
+            res.writeHead(500, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Failed to build attachment payload for this document.' }));
+            return;
+        }
+        core.updateTask(targetId, {
+            attachments: [...(Array.isArray(task.attachments) ? task.attachments : []), payload],
+        }, workspaceId, {
+            actorRef: 'user',
+            saveSource: 'manual',
+        });
+        core.notifyDocumentMetadataMutation(workspaceId, [asset.storageKey], 'upsert');
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            success: true,
+            attached: true,
+            alreadyAttached: false,
+            targetType: 'task',
+            targetId,
+        }));
+    });
     addRoute('DELETE', '/api/taskforce/documents/:assetId', async (req, res, params) => {
         const workspaceId = requestWorkspaceId(req);
         const assetId = String(params.assetId || '').trim();
@@ -824,6 +933,7 @@ export function registerDocumentRoutes(deps) {
         }
         const activeLinks = workspaceAssetStore.listLinksForAsset(asset.assetId, workspaceId)
             .filter((link) => !link.deletedAt)
+            .filter((link) => link.targetType === 'task' && !!link.taskId)
             .filter((link) => !!core.getTask(link.taskId, workspaceId));
         if (activeLinks.length > 0) {
             if (!forceDetach) {
@@ -836,11 +946,12 @@ export function registerDocumentRoutes(deps) {
                 return;
             }
             for (const link of activeLinks) {
-                const task = core.getTask(link.taskId, workspaceId);
+                const taskId = link.taskId;
+                const task = core.getTask(taskId, workspaceId);
                 if (!task)
                     continue;
                 const updatedAttachments = removeDocumentAttachmentFromTaskAttachments(task.attachments, asset);
-                core.updateTask(link.taskId, { attachments: updatedAttachments }, workspaceId, {
+                core.updateTask(taskId, { attachments: updatedAttachments }, workspaceId, {
                     actorRef: 'user',
                     saveSource: 'manual'
                 });
@@ -855,7 +966,8 @@ export function registerDocumentRoutes(deps) {
             workspaceAssetStore.deleteLink({
                 workspaceId,
                 assetId: asset.assetId,
-                taskId: link.taskId,
+                targetType: link.targetType,
+                targetId: link.targetId,
                 role: link.role
             });
         }

package/dist/server/routes/shared.d.ts

@@ -10,7 +10,32 @@ import { TaskforceCore } from '../../core/Taskforce.js';
 import type { McpAccessTokenAuthResult, McpOAuthAccessTokenAuthResult, McpAccessTokenScope } from '../../core/Taskforce.js';
 import type { RouteContext } from './primitives.js';
 import type { AiProfileBootstrapConfig } from '../../mcp/aiProfileBootstrap.js';
+import type { AiProfileSeatScope } from '../../shared/aiProfileSeatScope.js';
 export declare function resolveErrorStatusCode(error: unknown, fallback?: number): number;
+export declare const BOOTSTRAP_ROUTE_SLOW_THRESHOLD_MS = 1500;
+export declare const BOOTSTRAP_ROUTE_SEVERE_THRESHOLD_MS = 5000;
+export type ServerTimingMetric = {
+    name: string;
+    durationMs: number;
+};
+export declare function getRouteTimingNow(): number;
+export declare function buildServerTimingMetric(name: string, durationMs: number): string;
+export declare function setServerTimingHeader(res: ServerResponse, metrics: ServerTimingMetric[]): void;
+export declare function serializeJsonWithTiming(payload: unknown, startedAt?: number): {
+    body: string;
+    byteLength: number;
+    durationMs: number;
+};
+export declare function requestBootstrapTraceId(req: IncomingMessage): string;
+export declare function logSlowBootstrapRoute(input: {
+    route: string;
+    workspaceId: string;
+    durationMs: number;
+    traceId?: string | null;
+    thresholdMs?: number;
+    severeThresholdMs?: number;
+    details?: Record<string, unknown>;
+}): void;
 export declare function buildCloudMcpRuntimeAuth(input: {
     req: IncomingMessage;
     auth: {
@@ -34,6 +59,7 @@ export declare function buildCloudMcpRuntimeAuth(input: {
     aiProfileProvider?: AiProfileBootstrapConfig['aiProfileProvider'];
     aiProfileModel?: AiProfileBootstrapConfig['aiProfileModel'];
     aiProfileSurfaceType?: AiProfileBootstrapConfig['aiProfileSurfaceType'];
+    aiProfileSeatScope?: AiProfileSeatScope | null;
     actorType?: 'local' | 'user' | 'token' | 'oauth';
     requestId?: string | null;
     ip?: string | null;
@@ -51,7 +77,7 @@ export declare function makeResolveAuthenticatedUserId(core: TaskforceCore, cont
 export declare function makeResolveAuthenticatedMutationUserId(core: TaskforceCore, context: RouteContext, requestWorkspaceId: (req: IncomingMessage) => string): (req: IncomingMessage) => string;
 export declare function makeEnsureAppAccess(core: TaskforceCore, context: RouteContext): (req: IncomingMessage, res: ServerResponse) => boolean;
 export declare function makeEnsureAdminRole(core: TaskforceCore, context: RouteContext): (req: IncomingMessage) => boolean;
-export declare function makeEnsureAuthenticatedUser(): (req: IncomingMessage) => boolean;
+export declare function makeEnsureAuthenticatedUser(authConfig?: RouteContext['authConfig']): (req: IncomingMessage) => boolean;
 export declare function ensureOwnerRole(req: IncomingMessage): boolean;
 export declare function ensureWorkspaceAdminRole(req: IncomingMessage): boolean;
 export declare function makeResolveAdminRequestActor(core: TaskforceCore, context: RouteContext): (req: IncomingMessage) => {
@@ -60,6 +86,6 @@ export declare function makeResolveAdminRequestActor(core: TaskforceCore, contex
     systemRole: "system_admin" | "user";
 };
 export declare function makeAuditAdminAction(core: TaskforceCore, context: RouteContext): (req: IncomingMessage, action: string, details: Record<string, unknown>) => void;
-export declare function makeAuditAuthAction(core: TaskforceCore, requestWorkspaceId: (req: IncomingMessage) => string, context: RouteContext): (req: IncomingMessage, action: string, details: Record<string, unknown>) => void;
+export declare function makeAuditAuthAction(core: TaskforceCore, requestWorkspaceId: (req: IncomingMessage) => string, context: RouteContext): (req: IncomingMessage, action: string, details: Record<string, unknown>, workspaceIdOverride?: string | null) => void;
 export declare function makeRequireCloudRuntime(context: RouteContext): (res: ServerResponse, feature: string) => boolean;
 export declare function makeEnsureCloudPlanData(context: RouteContext): (req: IncomingMessage, res: ServerResponse) => boolean;

package/dist/server/routes/shared.js

@@ -17,6 +17,57 @@ export function resolveErrorStatusCode(error, fallback = 400) {
     }
     return fallback;
 }
+// === SECTION: Route timing helpers ===
+export const BOOTSTRAP_ROUTE_SLOW_THRESHOLD_MS = 1500;
+export const BOOTSTRAP_ROUTE_SEVERE_THRESHOLD_MS = 5000;
+function sanitizeServerTimingMetricName(name) {
+    return String(name || 'taskforce-route')
+        .trim()
+        .replace(/[^A-Za-z0-9_-]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        || 'taskforce-route';
+}
+export function getRouteTimingNow() {
+    return Date.now();
+}
+export function buildServerTimingMetric(name, durationMs) {
+    return `${sanitizeServerTimingMetricName(name)};dur=${Math.max(0, Math.round(durationMs))}`;
+}
+export function setServerTimingHeader(res, metrics) {
+    const value = metrics
+        .filter((metric) => String(metric.name || '').trim().length > 0)
+        .map((metric) => buildServerTimingMetric(metric.name, metric.durationMs))
+        .join(', ');
+    if (value)
+        res.setHeader('Server-Timing', value);
+}
+export function serializeJsonWithTiming(payload, startedAt = getRouteTimingNow()) {
+    const body = JSON.stringify(payload);
+    return {
+        body,
+        byteLength: Buffer.byteLength(body, 'utf8'),
+        durationMs: Math.max(0, getRouteTimingNow() - startedAt),
+    };
+}
+export function requestBootstrapTraceId(req) {
+    return requestHeader(req, 'x-taskforce-bootstrap-trace-id', '').trim();
+}
+export function logSlowBootstrapRoute(input) {
+    const thresholdMs = Number(input.thresholdMs) > 0 ? Number(input.thresholdMs) : BOOTSTRAP_ROUTE_SLOW_THRESHOLD_MS;
+    const severeThresholdMs = Number(input.severeThresholdMs) > 0 ? Number(input.severeThresholdMs) : BOOTSTRAP_ROUTE_SEVERE_THRESHOLD_MS;
+    const durationMs = Math.max(0, Math.round(input.durationMs));
+    if (durationMs < thresholdMs)
+        return;
+    const payload = {
+        route: input.route,
+        workspaceId: String(input.workspaceId || '').trim() || 'default',
+        traceId: String(input.traceId || '').trim() || null,
+        durationMs,
+        severity: durationMs >= severeThresholdMs ? 'high' : 'warning',
+        ...(input.details || {}),
+    };
+    console.warn('[Taskforce Bootstrap Timing]', payload);
+}
 export function buildCloudMcpRuntimeAuth(input) {
     const { req, auth, requestHeader, requestId, authScopes } = input;
     const actorType = auth.authenticatedViaToken
@@ -37,6 +88,7 @@ export function buildCloudMcpRuntimeAuth(input) {
         aiProfileProvider: auth.aiProfileProvider,
         aiProfileModel: auth.aiProfileModel,
         aiProfileSurfaceType: auth.aiProfileSurfaceType,
+        aiProfileSeatScope: 'cloud_metered',
         actorType,
         requestId: String(requestId || req.headers['x-request-id'] || req.headers['x-railway-request-id'] || '').trim() || undefined,
         ip: req.socket?.remoteAddress || null,
@@ -164,16 +216,6 @@ export function makeResolveAuthenticatedMutationUserId(core, context, requestWor
         const explicitUserId = String(requestUserId(req) || '').trim();
         if (explicitUserId && explicitUserId !== 'anonymous')
             return explicitUserId;
-        if (requestRuntimeMode(req) === 'local') {
-            const workspaceId = String(requestWorkspaceId(req) || '').trim() || 'default';
-            const fallbackUser = core.listWorkspaceUsers(workspaceId).find((user) => {
-                const status = String(user.status || '').trim().toLowerCase();
-                return status === 'active' && user.disabled !== true;
-            });
-            const fallbackUserId = String(fallbackUser?.userId || '').trim();
-            if (fallbackUserId)
-                return fallbackUserId;
-        }
         throw new TaskforceRuleError('Authenticated user required for mutation attribution.', 401, 'MUTATION_AUTH_REQUIRED');
     };
 }
@@ -216,8 +258,14 @@ export function makeEnsureAdminRole(core, context) {
         return actor.authenticated && actor.systemRole === 'system_admin';
     };
 }
-export function makeEnsureAuthenticatedUser() {
+export function makeEnsureAuthenticatedUser(authConfig) {
     return function ensureAuthenticatedUser(req) {
+        if (authConfig?.enabled) {
+            const access = resolveRequestAccess(req, authConfig);
+            if (access.authenticated && access.userId && access.userId !== 'anonymous') {
+                return true;
+            }
+        }
         const userId = String(requestUserId(req) || '').trim();
         return userId.length > 0 && userId !== 'anonymous';
     };
@@ -286,21 +334,28 @@ export function makeAuditAdminAction(core, context) {
     };
 }
 export function makeAuditAuthAction(core, requestWorkspaceId, context) {
-    return function auditAuthAction(req, action, details) {
+    return function auditAuthAction(req, action, details, workspaceIdOverride) {
         const authConfig = context.authConfig;
         const resolvedAccess = authConfig?.enabled ? resolveRequestAccess(req, authConfig) : null;
         const actorUserId = resolvedAccess?.authenticated && resolvedAccess.userId && resolvedAccess.userId !== 'anonymous'
             ? resolvedAccess.userId
             : requestUserId(req);
-        const actorRole = resolvedAccess?.authenticated
+        let actorRole = resolvedAccess?.authenticated
             ? String(resolvedAccess.role || '').trim().toLowerCase() || requestRole(req)
             : requestRole(req);
+        const workspaceId = String(workspaceIdOverride || requestWorkspaceId(req) || '').trim() || 'default';
+        if (workspaceIdOverride && actorUserId && actorUserId !== 'anonymous') {
+            const membership = core.listWorkspaceUsers(workspaceId).find((user) => String(user.userId || '').trim() === actorUserId);
+            const role = String(membership?.role || '').trim().toLowerCase();
+            if (role)
+                actorRole = role;
+        }
         const payload = {
             ts: new Date().toISOString(),
             action,
             actorUserId,
             actorRole,
-            workspaceId: requestWorkspaceId(req),
+            workspaceId,
             details
         };
         try {