@taskforcehq/taskforce 0.3.305 → 0.3.307

package/dist/services/workflowExportSnapshots.test.js

@@ -17,6 +17,8 @@ describe('Workflow export snapshots', () => {
         for (const workflowName of workflowNames) {
             it(`${envId}/${workflowName} export snapshot`, () => {
                 const result = engine.processTemplate(workflowName, envId);
+                expect(result.content).not.toContain('shared docs under `docs/`');
+                expect(result.content).not.toContain('store it under `docs/`');
                 expect({
                     filename: result.filename,
                     strategy: result.strategy,

package/dist/shared/aiProfileSeatScope.d.ts

@@ -0,0 +1,5 @@
+export declare const AI_PROFILE_SEAT_SCOPES: readonly ["cloud_metered", "local_unmetered"];
+export type AiProfileSeatScope = typeof AI_PROFILE_SEAT_SCOPES[number];
+export declare function isAiProfileSeatScope(value: unknown): value is AiProfileSeatScope;
+export declare function parseAiProfileSeatScope(value: unknown): AiProfileSeatScope | null;
+export declare function formatAiProfileSeatScopeLabel(value: AiProfileSeatScope): string;

package/dist/shared/aiProfileSeatScope.js

@@ -0,0 +1,21 @@
+export const AI_PROFILE_SEAT_SCOPES = [
+    'cloud_metered',
+    'local_unmetered',
+];
+const AI_PROFILE_SEAT_SCOPE_LABELS = {
+    cloud_metered: 'Cloud MCP',
+    local_unmetered: 'Local MCP',
+};
+export function isAiProfileSeatScope(value) {
+    return typeof value === 'string'
+        && AI_PROFILE_SEAT_SCOPES.includes(value);
+}
+export function parseAiProfileSeatScope(value) {
+    if (typeof value !== 'string')
+        return null;
+    const normalized = value.trim();
+    return isAiProfileSeatScope(normalized) ? normalized : null;
+}
+export function formatAiProfileSeatScopeLabel(value) {
+    return AI_PROFILE_SEAT_SCOPE_LABELS[value];
+}

package/dist/shared/aiProfileSurfaceType.d.ts

@@ -1,4 +1,4 @@
-export declare const AI_PROFILE_SURFACE_TYPES: readonly ["chat_app", "ide", "coding_tool", "agent", "other"];
+export declare const AI_PROFILE_SURFACE_TYPES: readonly ["chat_app", "ide", "cli", "coding_tool", "agent"];
 export type AiProfileSurfaceType = typeof AI_PROFILE_SURFACE_TYPES[number];
 export type AiProfileSurfaceTypeSection = AiProfileSurfaceType | 'unclassified';
 export declare const AI_PROFILE_SURFACE_TYPE_SECTION_ORDER: AiProfileSurfaceTypeSection[];

package/dist/shared/aiProfileSurfaceType.js

@@ -1,31 +1,31 @@
 export const AI_PROFILE_SURFACE_TYPES = [
     'chat_app',
     'ide',
+    'cli',
     'coding_tool',
-    'agent',
-    'other'
+    'agent'
 ];
 export const AI_PROFILE_SURFACE_TYPE_SECTION_ORDER = [
     'chat_app',
     'ide',
+    'cli',
     'coding_tool',
     'agent',
-    'other',
     'unclassified'
 ];
 const AI_PROFILE_SURFACE_TYPE_LABELS = {
-    chat_app: 'Chat app',
+    chat_app: 'Chat App',
     ide: 'IDE',
-    coding_tool: 'Coding tool',
-    agent: 'Agent',
-    other: 'Other'
+    cli: 'CLI',
+    coding_tool: 'Coding Tool',
+    agent: 'Agent'
 };
 const AI_PROFILE_SURFACE_TYPE_SECTION_LABELS = {
     chat_app: 'Chat Apps',
     ide: 'IDEs',
+    cli: 'CLI',
     coding_tool: 'Coding Tools',
     agent: 'Agents',
-    other: 'Other',
     unclassified: 'Unclassified'
 };
 export function isAiProfileSurfaceType(value) {
@@ -36,6 +36,8 @@ export function parseAiProfileSurfaceType(value) {
     if (typeof value !== 'string')
         return null;
     const normalized = value.trim();
+    if (normalized === 'other')
+        return 'agent';
     return isAiProfileSurfaceType(normalized) ? normalized : null;
 }
 export function formatAiProfileSurfaceTypeLabel(surfaceType) {

package/dist/shared/passwordPolicy.d.ts

@@ -0,0 +1,13 @@
+export declare const MIN_PASSWORD_LENGTH = 12;
+export type PasswordPolicyCode = 'PASSWORD_REQUIRED' | 'PASSWORD_TOO_SHORT' | 'PASSWORD_TOO_COMMON' | 'PASSWORD_CONTAINS_PERSONAL_INFO';
+export interface PasswordPolicyResult {
+    ok: boolean;
+    code?: PasswordPolicyCode;
+    message?: string;
+}
+export interface PasswordPolicyContext {
+    email?: string | null;
+    displayName?: string | null;
+}
+export declare function getPasswordPolicyGuidance(): string[];
+export declare function validatePasswordPolicy(password: string, context?: PasswordPolicyContext): PasswordPolicyResult;

package/dist/shared/passwordPolicy.js

@@ -0,0 +1,84 @@
+export const MIN_PASSWORD_LENGTH = 12;
+const COMMON_PASSWORDS = new Set([
+    '12345678',
+    '123456789',
+    '1234567890',
+    'admin123',
+    'changeme',
+    'letmein',
+    'letmein123',
+    'password',
+    'password1',
+    'password12',
+    'password123',
+    'password1234',
+    'qwerty',
+    'qwerty123',
+    'welcome',
+    'welcome123'
+]);
+const normalizeForComparison = (value) => (String(value || '')
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9]/g, ''));
+function extractPersonalInfoTokens(context) {
+    const tokens = new Set();
+    const email = String(context?.email || '').trim().toLowerCase();
+    const displayName = String(context?.displayName || '').trim().toLowerCase();
+    if (email.includes('@')) {
+        const localPart = email.split('@')[0] || '';
+        const compactLocalPart = localPart.replace(/[^a-z0-9]/g, '');
+        if (compactLocalPart.length >= 4)
+            tokens.add(compactLocalPart);
+        for (const part of localPart.split(/[^a-z0-9]+/)) {
+            if (part.length >= 4)
+                tokens.add(part);
+        }
+    }
+    for (const part of displayName.split(/[^a-z0-9]+/)) {
+        if (part.length >= 4)
+            tokens.add(part);
+    }
+    return [...tokens];
+}
+export function getPasswordPolicyGuidance() {
+    return [
+        `Use at least ${MIN_PASSWORD_LENGTH} characters.`,
+        'Avoid common passwords or obvious patterns.',
+        'Do not include your email or display name.'
+    ];
+}
+export function validatePasswordPolicy(password, context) {
+    const rawPassword = String(password || '');
+    if (!rawPassword) {
+        return {
+            ok: false,
+            code: 'PASSWORD_REQUIRED',
+            message: 'Password is required.'
+        };
+    }
+    if (rawPassword.length < MIN_PASSWORD_LENGTH) {
+        return {
+            ok: false,
+            code: 'PASSWORD_TOO_SHORT',
+            message: `Password must be at least ${MIN_PASSWORD_LENGTH} characters.`
+        };
+    }
+    const normalizedPassword = normalizeForComparison(rawPassword);
+    if (COMMON_PASSWORDS.has(normalizedPassword)) {
+        return {
+            ok: false,
+            code: 'PASSWORD_TOO_COMMON',
+            message: 'Choose a less common password.'
+        };
+    }
+    const personalTokens = extractPersonalInfoTokens(context);
+    if (personalTokens.some((token) => normalizedPassword.includes(token))) {
+        return {
+            ok: false,
+            code: 'PASSWORD_CONTAINS_PERSONAL_INFO',
+            message: 'Password cannot contain your email or display name.'
+        };
+    }
+    return { ok: true };
+}

package/dist/shared/passwordPolicy.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/shared/passwordPolicy.test.js

@@ -0,0 +1,34 @@
+import { describe, expect, it } from 'vitest';
+import { getPasswordPolicyGuidance, MIN_PASSWORD_LENGTH, validatePasswordPolicy } from './passwordPolicy';
+describe('passwordPolicy', () => {
+    it('describes the active password policy guidance', () => {
+        expect(getPasswordPolicyGuidance()).toEqual([
+            `Use at least ${MIN_PASSWORD_LENGTH} characters.`,
+            'Avoid common passwords or obvious patterns.',
+            'Do not include your email or display name.'
+        ]);
+    });
+    it('rejects common passwords even when padded with punctuation', () => {
+        expect(validatePasswordPolicy('Password123!')).toEqual({
+            ok: false,
+            code: 'PASSWORD_TOO_COMMON',
+            message: 'Choose a less common password.'
+        });
+    });
+    it('rejects passwords containing personal information', () => {
+        expect(validatePasswordPolicy('RossBurkeSecure!2026', {
+            email: 'ross@example.com',
+            displayName: 'Ross Burke'
+        })).toEqual({
+            ok: false,
+            code: 'PASSWORD_CONTAINS_PERSONAL_INFO',
+            message: 'Password cannot contain your email or display name.'
+        });
+    });
+    it('accepts long passwords without common or personal tokens', () => {
+        expect(validatePasswordPolicy('MapleHarborOrbit!2026', {
+            email: 'ross@example.com',
+            displayName: 'Ross Burke'
+        })).toEqual({ ok: true });
+    });
+});

package/dist/storage/objectStorage.d.ts

@@ -8,6 +8,7 @@ export interface R2ObjectStorageConfig {
     keyPrefix: string;
     signedUploadTtlSeconds: number;
     signedDownloadTtlSeconds: number;
+    requestTimeoutMs?: number;
 }
 export interface ResolvedObjectStorageConfig {
     provider: ObjectStorageProvider;

package/dist/storage/objectStorage.js

@@ -9,7 +9,8 @@ export function toPublicObjectStorageConfig(config) {
             endpoint: config.r2.endpoint,
             keyPrefix: config.r2.keyPrefix,
             signedUploadTtlSeconds: config.r2.signedUploadTtlSeconds,
-            signedDownloadTtlSeconds: config.r2.signedDownloadTtlSeconds
+            signedDownloadTtlSeconds: config.r2.signedDownloadTtlSeconds,
+            ...(typeof config.r2.requestTimeoutMs === 'number' ? { requestTimeoutMs: config.r2.requestTimeoutMs } : {})
         }
     };
 }

package/dist/storage/objectStorageClient.d.ts

@@ -8,6 +8,7 @@ export declare class ObjectStorageClient {
     constructor(config: ResolvedObjectStorageConfig);
     provider(): ObjectStorageProvider;
     keyForRelativePath(relativePath: string): string;
+    private requestTimeoutMs;
     putObject(relativePath: string, body: Buffer, contentType: string): Promise<void>;
     getObject(relativePath: string): Promise<StoredObject | null>;
     objectExists(relativePath: string): Promise<boolean>;

package/dist/storage/objectStorageClient.js

@@ -4,6 +4,7 @@ const AWS_SERVICE = 's3';
 const AWS_REGION = 'auto';
 const TRANSIENT_GET_OBJECT_STATUS_CODES = new Set([408, 425, 429, 500, 502, 503, 504]);
 const MAX_GET_OBJECT_ATTEMPTS = 3;
+const DEFAULT_REQUEST_TIMEOUT_MS = 15000;
 function sha256Hex(value) {
     return createHash('sha256').update(value).digest('hex');
 }
@@ -77,6 +78,33 @@ function shouldRetryGetObjectError(error) {
         || message.includes('ecanceled')
         || message.includes('und_err');
 }
+async function fetchWithTimeout(url, init, timeoutMsRaw) {
+    const timeoutMs = Number.isFinite(timeoutMsRaw) && timeoutMsRaw > 0
+        ? Math.floor(timeoutMsRaw)
+        : DEFAULT_REQUEST_TIMEOUT_MS;
+    const controller = new AbortController();
+    const timeout = setTimeout(() => {
+        controller.abort(new Error(`R2 request timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+    try {
+        return await fetch(url, {
+            ...init,
+            signal: controller.signal
+        });
+    }
+    catch (error) {
+        if (controller.signal.aborted) {
+            const reason = controller.signal.reason;
+            if (reason instanceof Error)
+                throw reason;
+            throw new Error(`R2 request timed out after ${timeoutMs}ms`);
+        }
+        throw error;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
 function signRequest(params) {
     const amzDate = createAmzDate(params.now);
     const dateStamp = toDateStamp(amzDate);
@@ -117,6 +145,11 @@ export class ObjectStorageClient {
     keyForRelativePath(relativePath) {
         return buildObjectKey(this.config, relativePath);
     }
+    requestTimeoutMs() {
+        return this.config.provider === 'r2'
+            ? Number(this.config.r2?.requestTimeoutMs || DEFAULT_REQUEST_TIMEOUT_MS)
+            : DEFAULT_REQUEST_TIMEOUT_MS;
+    }
     async putObject(relativePath, body, contentType) {
         if (this.config.provider !== 'r2' || !this.config.r2) {
             throw new Error('R2 object storage is not configured.');
@@ -131,7 +164,7 @@ export class ObjectStorageClient {
             secretAccessKey: this.config.r2.secretAccessKey,
             payloadHash
         });
-        const response = await fetch(url, {
+        const response = await fetchWithTimeout(url, {
             method: 'PUT',
             headers: {
                 'authorization': signed.authorization,
@@ -140,7 +173,7 @@ export class ObjectStorageClient {
                 'content-type': contentType
             },
             body: new Uint8Array(body)
-        });
+        }, this.requestTimeoutMs());
         if (!response.ok) {
             const text = await response.text().catch(() => '');
             throw new Error(`Failed to upload object (${response.status}): ${text || response.statusText}`);
@@ -163,14 +196,14 @@ export class ObjectStorageClient {
                 payloadHash
             });
             try {
-                const response = await fetch(url, {
+                const response = await fetchWithTimeout(url, {
                     method: 'GET',
                     headers: {
                         'authorization': signed.authorization,
                         'x-amz-date': signed.amzDate,
                         'x-amz-content-sha256': payloadHash
                     }
-                });
+                }, this.requestTimeoutMs());
                 if (response.status === 404)
                     return null;
                 if (!response.ok) {
@@ -211,14 +244,14 @@ export class ObjectStorageClient {
             secretAccessKey: this.config.r2.secretAccessKey,
             payloadHash
         });
-        const response = await fetch(url, {
+        const response = await fetchWithTimeout(url, {
             method: 'HEAD',
             headers: {
                 'authorization': signed.authorization,
                 'x-amz-date': signed.amzDate,
                 'x-amz-content-sha256': payloadHash
             }
-        });
+        }, this.requestTimeoutMs());
         if (response.status === 404)
             return false;
         if (!response.ok) {
@@ -241,14 +274,14 @@ export class ObjectStorageClient {
             secretAccessKey: this.config.r2.secretAccessKey,
             payloadHash
         });
-        const response = await fetch(url, {
+        const response = await fetchWithTimeout(url, {
             method: 'DELETE',
             headers: {
                 'authorization': signed.authorization,
                 'x-amz-date': signed.amzDate,
                 'x-amz-content-sha256': payloadHash
             }
-        });
+        }, this.requestTimeoutMs());
         if (response.status === 404)
             return false;
         if (!response.ok) {

package/dist/storage/objectStorageClient.test.js

@@ -10,9 +10,34 @@ const TEST_CONFIG = {
         secretAccessKey: 'secret-key-1',
         keyPrefix: '',
         signedUploadTtlSeconds: 600,
-        signedDownloadTtlSeconds: 300
+        signedDownloadTtlSeconds: 300,
+        requestTimeoutMs: 15000
     }
 };
+describe('ObjectStorageClient.putObject', () => {
+    afterEach(() => {
+        vi.unstubAllGlobals();
+        vi.restoreAllMocks();
+    });
+    it('aborts stalled uploads before MCP tool calls can time out', async () => {
+        const fetchMock = vi.fn((_input, init) => (new Promise((_resolve, reject) => {
+            const signal = init?.signal;
+            signal?.addEventListener('abort', () => {
+                reject(signal.reason);
+            }, { once: true });
+        })));
+        vi.stubGlobal('fetch', fetchMock);
+        const client = new ObjectStorageClient({
+            ...TEST_CONFIG,
+            r2: {
+                ...TEST_CONFIG.r2,
+                requestTimeoutMs: 1
+            }
+        });
+        await expect(client.putObject('workspaces/workspace-1/assets/documents/doc-1.md', Buffer.from('# plan', 'utf8'), 'text/markdown')).rejects.toThrow('R2 request timed out after 1ms');
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+    });
+});
 describe('ObjectStorageClient.getObject', () => {
     afterEach(() => {
         vi.unstubAllGlobals();

package/dist/storage/objectStorageConfig.js

@@ -31,6 +31,7 @@ export function resolveObjectStorageConfigFromEnv(env = process.env) {
         : '';
     const signedUploadTtlSeconds = readPositiveInteger(env.R2_SIGNED_UPLOAD_TTL_SECONDS, 600);
     const signedDownloadTtlSeconds = readPositiveInteger(env.R2_SIGNED_DOWNLOAD_TTL_SECONDS, 300);
+    const requestTimeoutMs = readPositiveInteger(env.R2_REQUEST_TIMEOUT_MS, 15000);
     return {
         provider: 'r2',
         r2: {
@@ -41,7 +42,8 @@ export function resolveObjectStorageConfigFromEnv(env = process.env) {
             secretAccessKey,
             keyPrefix,
             signedUploadTtlSeconds,
-            signedDownloadTtlSeconds
+            signedDownloadTtlSeconds,
+            requestTimeoutMs
         }
     };
 }

package/dist/storage/objectStorageConfig.test.js

@@ -20,7 +20,8 @@ describe('resolveObjectStorageConfigFromEnv', () => {
                 secretAccessKey: 'secret-key-1',
                 keyPrefix: '',
                 signedUploadTtlSeconds: 600,
-                signedDownloadTtlSeconds: 300
+                signedDownloadTtlSeconds: 300,
+                requestTimeoutMs: 15000
             }
         });
     });
@@ -35,4 +36,15 @@ describe('resolveObjectStorageConfigFromEnv', () => {
         });
         expect(config.r2?.keyPrefix).toBe('taskforce-assets');
     });
+    it('reads a bounded R2 request timeout', () => {
+        const config = resolveObjectStorageConfigFromEnv({
+            TASKFORCE_OBJECT_STORAGE_PROVIDER: 'r2',
+            R2_ACCOUNT_ID: 'acct-1',
+            R2_BUCKET: 'taskforce-dev-assets',
+            R2_ACCESS_KEY_ID: 'access-key-1',
+            R2_SECRET_ACCESS_KEY: 'secret-key-1',
+            R2_REQUEST_TIMEOUT_MS: '2500'
+        });
+        expect(config.r2?.requestTimeoutMs).toBe(2500);
+    });
 });

package/dist/storage/workspaceAssetStore.d.ts

@@ -3,6 +3,7 @@ import type { ObjectStorageProvider } from './objectStorage.js';
 export type WorkspaceAssetKind = 'document' | 'image' | 'file';
 export type WorkspaceAssetScanStatus = 'pending' | 'clean' | 'infected' | 'failed';
 export type WorkspaceAssetLinkRole = 'attachment' | 'image' | 'reference';
+export type WorkspaceAssetLinkTargetType = 'task' | 'initiative' | 'workstream';
 export interface WorkspaceAssetEntry {
     assetId: string;
     tenantId: string;
@@ -32,7 +33,9 @@ export interface WorkspaceAssetLinkEntry {
     tenantId: string;
     workspaceId: string;
     assetId: string;
-    taskId: string;
+    targetType: WorkspaceAssetLinkTargetType;
+    targetId: string;
+    taskId: string | null;
     role: WorkspaceAssetLinkRole;
     displayName: string | null;
     sortOrder: number | null;
@@ -43,7 +46,9 @@ export interface WorkspaceAssetLinkEntry {
 export declare class WorkspaceAssetStore {
     private readonly db;
     private readonly tenantId;
+    private supportsTargetTypeCache;
     constructor(db: DatabaseAdapter, tenantId: string);
+    private supportsTargetType;
     private normalizePersistedAsset;
     get(assetIdRaw: string, workspaceIdRaw?: string): WorkspaceAssetEntry | null;
     getByStorageKey(storageKeyRaw: string, workspaceIdRaw: string): WorkspaceAssetEntry | null;
@@ -98,7 +103,9 @@ export declare class WorkspaceAssetStore {
     upsertLink(input: {
         workspaceId: string;
         assetId: string;
-        taskId: string;
+        taskId?: string;
+        targetType?: WorkspaceAssetLinkTargetType;
+        targetId?: string;
         role: WorkspaceAssetLinkRole;
         displayName?: string | null;
         sortOrder?: number | null;
@@ -109,13 +116,18 @@ export declare class WorkspaceAssetStore {
     listLinksForTask(taskIdRaw: string, workspaceIdRaw: string, options?: {
         includeDeleted?: boolean;
     }): WorkspaceAssetLinkEntry[];
+    listLinksForTarget(targetTypeRaw: WorkspaceAssetLinkTargetType, targetIdRaw: string, workspaceIdRaw: string, options?: {
+        includeDeleted?: boolean;
+    }): WorkspaceAssetLinkEntry[];
     listLinksForAsset(assetIdRaw: string, workspaceIdRaw: string, options?: {
         includeDeleted?: boolean;
     }): WorkspaceAssetLinkEntry[];
     deleteLink(input: {
         workspaceId: string;
         assetId: string;
-        taskId: string;
+        taskId?: string;
+        targetType?: WorkspaceAssetLinkTargetType;
+        targetId?: string;
         role: WorkspaceAssetLinkRole;
         hardDelete?: boolean;
     }): boolean;