@taskforcehq/taskforce 0.3.306 → 0.3.307

package/dist/server/routes/auth.js

@@ -38,6 +38,8 @@
  *   GET  /api/taskforce/auth/workspace-members
  *   GET  /api/taskforce/workspace/assignee-options
  *   POST /api/taskforce/workspace/ai-profiles/avatar
+ *   POST /api/taskforce/workspace/ai-profiles/avatar/upload
+ *   POST /api/taskforce/workspace/ai-profiles/surface-type
  *   GET  /api/taskforce/admin/users
  *   POST /api/taskforce/admin/users/invite
  *   PATCH /api/taskforce/admin/users/:id/role
@@ -61,9 +63,11 @@ import { resolveRuntimeModeContract } from '../../shared/runtimeContract.js';
 import { getRouteTimingNow, logSlowBootstrapRoute, requestBootstrapTraceId, requestHeader, resolveErrorStatusCode, serializeJsonWithTiming, setServerTimingHeader } from './shared.js';
 import { buildAuthFlowBehavior, buildSiteBehavior, getRouteEmailConfig, resolvePublicAuthBaseUrl, resolveRuntimeConfigBaseUrl, shouldExposeDevAuthTokens } from './authSupport.js';
 import { normalizeTaskDataRelativePath } from '../../storage/objectStorageClient.js';
+import { clearAiProfileAvatarAssets, saveAiProfileAvatarAssets } from '../aiProfileAvatarAssets.js';
+const AI_PROFILE_AVATAR_UPLOAD_MAX_JSON_BYTES = 16 * 1024 * 1024;
 // === SECTION: Registration ===
 export function registerAuthRoutes(deps) {
-    const { addRoute, core, context, requestWorkspaceId, requestUserId, resolveAuthenticatedUserId, ensureAppAccess, ensureAuthenticatedUser, ensureWorkspaceAdminRole, ensureCloudPlanData, requireCloudRuntime, auditAuthAction, resolveAdminRequestActor, resolveEffectiveObjectStorageConfig, getObjectStorageClient, } = deps;
+    const { addRoute, core, context, requestWorkspaceId, requestUserId, resolveAuthenticatedUserId, ensureAppAccess, ensureAuthenticatedUser, ensureWorkspaceAdminRole, ensureCloudPlanData, requireCloudRuntime, auditAuthAction, resolveAdminRequestActor, resolveEffectiveObjectStorageConfig, getObjectStorageClient, workspaceAssetStore, ensureWithinDir, markAssetDeleted, appendStorageTelemetry, } = deps;
     const normalizeTeamWorkspaceRole = (value) => {
         const role = String(value || '').trim().toLowerCase();
         if (role === 'owner' || role === 'admin' || role === 'member' || role === 'read-only')
@@ -76,6 +80,56 @@ export function registerAuthRoutes(deps) {
         const stateAllows = state === 'active' || state === 'trialing' || state === 'grace';
         return teamAllowed && stateAllows ? 'team' : 'personal';
     };
+    const serializeAiProfilePublicRecord = (profile) => ({
+        id: profile.id,
+        workspaceId: profile.workspaceId,
+        name: profile.name,
+        username: profile.username,
+        icon: profile.icon,
+        color: profile.color,
+        avatarUrl: profile.avatarUrl ?? null,
+        avatarSourceUrl: profile.avatarSourceUrl ?? null,
+        avatarRevision: profile.avatarRevision ?? 0,
+        avatarUpdatedAt: profile.avatarUpdatedAt ?? null,
+        description: profile.description ?? null,
+        role: profile.role ?? null,
+        provider: profile.provider ?? null,
+        model: profile.model ?? null,
+        surfaceType: profile.surfaceType ?? null,
+        seatScope: profile.seatScope ?? null,
+        archivedAt: profile.archivedAt ?? null,
+        archivedBy: profile.archivedBy ?? null,
+        archivedReason: profile.archivedReason ?? null,
+        mergedIntoProfileId: profile.mergedIntoProfileId ?? null,
+        rosterStateUpdatedAt: profile.rosterStateUpdatedAt ?? null,
+        createdAt: profile.createdAt,
+        updatedAt: profile.updatedAt,
+        lastActiveAt: profile.lastActiveAt ?? null
+    });
+    const parseAiAvatarDataUrlPayload = (value, fallbackOriginalName) => {
+        if (!value || typeof value !== 'object')
+            return null;
+        const record = value;
+        const dataUrl = String(record.dataUrl || record.file || '').trim();
+        const dataMatch = dataUrl.match(/^data:([^;]+);base64,(.+)$/);
+        if (!dataMatch)
+            return null;
+        return {
+            mimeType: String(record.mimeType || dataMatch[1] || 'application/octet-stream').trim().toLowerCase(),
+            originalName: typeof record.originalName === 'string' && record.originalName.trim().length > 0
+                ? record.originalName.trim()
+                : fallbackOriginalName,
+            buffer: Buffer.from(dataMatch[2], 'base64')
+        };
+    };
+    const aiProfileAvatarAssetDeps = {
+        core,
+        workspaceAssetStore,
+        getObjectStorageClient,
+        ensureWithinDir,
+        markAssetDeleted,
+        appendStorageTelemetry,
+    };
     const resolveBillingConflictCodeForUser = (userIdRaw, gateRaw) => {
         const userId = String(userIdRaw || '').trim();
         const gate = String(gateRaw || '').trim().toLowerCase();
@@ -1062,6 +1116,8 @@ export function registerAuthRoutes(deps) {
         }
         const payload = {
             authenticated,
+            authRequiredForApi: Boolean(authConfig?.enabled && authConfig.requiredForApi),
+            runtimeMode: authConfig?.runtimeMode || 'local',
             userId,
             workspaceId,
             role,
@@ -2189,6 +2245,7 @@ export function registerAuthRoutes(deps) {
         res.end(JSON.stringify({ users }));
     });
     // GET /api/taskforce/workspace/assignee-options - Read active workspace humans and registered AI collaborators for task assignee selection.
+    // Use ?kind=agent for Agent Manager roster loads that do not need human workspace members.
     addRoute('GET', '/api/taskforce/workspace/assignee-options', async (req, res) => {
         if (!ensureAppAccess(req, res))
             return;
@@ -2200,26 +2257,30 @@ export function registerAuthRoutes(deps) {
         const startedAt = getRouteTimingNow();
         const wid = requestWorkspaceId(req);
         const traceId = requestBootstrapTraceId(req);
-        const adminRoleStartedAt = getRouteTimingNow();
-        const includeProfileToken = context.authConfig?.enabled !== true || ensureWorkspaceAdminRole(req);
-        const adminRoleResolvedAt = getRouteTimingNow();
+        const reqUrl = new URL(req.url || '/api/taskforce/workspace/assignee-options', 'http://localhost');
+        const kindFilter = String(reqUrl.searchParams.get('kind') || '').trim().toLowerCase();
+        const agentsOnly = kindFilter === 'agent' || kindFilter === 'agents' || kindFilter === 'ai-profile' || kindFilter === 'ai-profiles';
         const usersStartedAt = getRouteTimingNow();
-        const activeWorkspaceUsers = core.listWorkspaceUsers(wid)
-            .filter((user) => String(user.status || '').trim().toLowerCase() === 'active' && user.disabled !== true);
+        const activeWorkspaceUsers = agentsOnly
+            ? []
+            : core.listWorkspaceUsers(wid)
+                .filter((user) => String(user.status || '').trim().toLowerCase() === 'active' && user.disabled !== true);
         const usersLoadedAt = getRouteTimingNow();
-        const workspaceUsers = activeWorkspaceUsers.map((user) => ({
-            value: user.userId,
-            label: String(user.displayName || user.email || user.userId).trim() || user.userId,
-            icon: 'User',
-            color: '#22c55e',
-            kind: 'member',
-            userId: user.userId,
-            email: user.email,
-            displayName: user.displayName ?? null,
-            avatarUrl: user.avatarUrl ?? null,
-            status: user.status,
-            disabled: user.disabled === true
-        }));
+        const workspaceUsers = agentsOnly
+            ? []
+            : activeWorkspaceUsers.map((user) => ({
+                value: user.userId,
+                label: String(user.displayName || user.email || user.userId).trim() || user.userId,
+                icon: 'User',
+                color: '#22c55e',
+                kind: 'member',
+                userId: user.userId,
+                email: user.email,
+                displayName: user.displayName ?? null,
+                avatarUrl: user.avatarUrl ?? null,
+                status: user.status,
+                disabled: user.disabled === true
+            }));
         const usersMappedAt = getRouteTimingNow();
         const aiProfileDiagnostics = { metadataBackfillCount: 0 };
         const aiProfilesStartedAt = getRouteTimingNow();
@@ -2228,12 +2289,13 @@ export function registerAuthRoutes(deps) {
             .map((profile) => ({
             value: profile.id,
             label: profile.name,
-            ...(includeProfileToken ? { profileToken: profile.profileToken } : {}),
             username: profile.username,
             icon: profile.icon,
             color: profile.color,
             avatarUrl: profile.avatarUrl ?? null,
             avatarSourceUrl: profile.avatarSourceUrl ?? null,
+            avatarRevision: profile.avatarRevision ?? 0,
+            avatarUpdatedAt: profile.avatarUpdatedAt ?? null,
             kind: 'agent',
             description: profile.description ?? null,
             role: profile.role ?? null,
@@ -2256,7 +2318,6 @@ export function registerAuthRoutes(deps) {
         const totalDurationMs = Math.max(0, getRouteTimingNow() - startedAt);
         setServerTimingHeader(res, [
             { name: 'assignee-options', durationMs: totalDurationMs },
-            { name: 'assignee-options-admin-role', durationMs: adminRoleResolvedAt - adminRoleStartedAt },
             { name: 'assignee-options-users', durationMs: usersLoadedAt - usersStartedAt },
             { name: 'assignee-options-users-map', durationMs: usersMappedAt - usersLoadedAt },
             { name: 'assignee-options-ai-profiles', durationMs: aiProfilesLoadedAt - aiProfilesStartedAt },
@@ -2272,9 +2333,9 @@ export function registerAuthRoutes(deps) {
                 humanAssigneeCount: workspaceUsers.length,
                 workspaceUserCount: activeWorkspaceUsers.length,
                 aiProfileCount: aiProfiles.length,
+                agentsOnly,
                 metadataBackfillCount: aiProfileDiagnostics.metadataBackfillCount,
                 responseBytes: serialized.byteLength,
-                adminRoleMs: Math.max(0, adminRoleResolvedAt - adminRoleStartedAt),
                 listWorkspaceUsersMs: Math.max(0, usersLoadedAt - usersStartedAt),
                 workspaceUsersMapMs: Math.max(0, usersMappedAt - usersLoadedAt),
                 listAiProfilesMs: Math.max(0, aiProfilesLoadedAt - aiProfilesStartedAt),
@@ -2285,7 +2346,7 @@ export function registerAuthRoutes(deps) {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(serialized.body);
     });
-    // POST /api/taskforce/workspace/ai-profiles/avatar - Assign or clear an AI profile avatar image.
+    // POST /api/taskforce/workspace/ai-profiles/avatar - Clear an AI profile avatar image.
     addRoute('POST', '/api/taskforce/workspace/ai-profiles/avatar', async (req, res) => {
         if (!ensureWorkspaceAdminRole(req)) {
             res.writeHead(403, { 'Content-Type': 'application/json' });
@@ -2307,9 +2368,19 @@ export function registerAuthRoutes(deps) {
             return;
         }
         try {
-            const profile = core.updateAiProfileAvatar({ workspaceId: wid, profileId, avatarUrl, avatarSourceUrl });
+            const shouldClearAvatar = avatarUrl === null && (avatarSourceUrl === null || avatarSourceUrl === undefined);
+            if (!shouldClearAvatar) {
+                res.writeHead(400, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({
+                    error: 'AI profile avatar updates must use the stable avatar upload endpoint.',
+                    code: 'AI_PROFILE_AVATAR_STABLE_UPLOAD_REQUIRED'
+                }));
+                return;
+            }
+            const result = await clearAiProfileAvatarAssets(aiProfileAvatarAssetDeps, { workspaceId: wid, profileId });
+            const profile = result.profile;
             res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ success: true, profile }));
+            res.end(JSON.stringify({ success: true, profile: serializeAiProfilePublicRecord(profile) }));
         }
         catch (err) {
             const status = err?.statusCode ?? 500;
@@ -2317,6 +2388,58 @@ export function registerAuthRoutes(deps) {
             res.end(JSON.stringify({ error: err?.message ?? 'Failed to update AI profile avatar.' }));
         }
     });
+    // POST /api/taskforce/workspace/ai-profiles/avatar/upload - Upload stable AI profile avatar slots.
+    addRoute('POST', '/api/taskforce/workspace/ai-profiles/avatar/upload', async (req, res) => {
+        if (!ensureWorkspaceAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: owner or admin role required.' }));
+            return;
+        }
+        const body = await parseJsonBody(req, AI_PROFILE_AVATAR_UPLOAD_MAX_JSON_BYTES);
+        const wid = requestWorkspaceId(req);
+        const profileId = String(body?.profileId || '').trim();
+        if (!profileId) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'profileId is required.' }));
+            return;
+        }
+        const display = parseAiAvatarDataUrlPayload(body?.displayImage || body?.display, 'display-avatar');
+        if (!display) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'displayImage data URL is required.' }));
+            return;
+        }
+        const source = parseAiAvatarDataUrlPayload(body?.sourceImage || body?.source, 'source-avatar');
+        try {
+            const result = await saveAiProfileAvatarAssets(aiProfileAvatarAssetDeps, {
+                workspaceId: wid,
+                profileId,
+                display,
+                source,
+                actorId: resolveAuthenticatedUserId(req)
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                success: true,
+                profile: serializeAiProfilePublicRecord(result.profile),
+                assets: {
+                    display: {
+                        assetId: result.displayAsset.assetId,
+                        storageKey: result.displayStorageKey,
+                    },
+                    source: {
+                        assetId: result.sourceAsset.assetId,
+                        storageKey: result.sourceStorageKey,
+                    }
+                }
+            }));
+        }
+        catch (err) {
+            const status = err?.statusCode ?? 500;
+            res.writeHead(status, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: err?.message ?? 'Failed to upload AI profile avatar.' }));
+        }
+    });
     // POST /api/taskforce/workspace/ai-profiles/merge - Merge a duplicate AI profile into another, reassigning all references.
     addRoute('POST', '/api/taskforce/workspace/ai-profiles/merge', async (req, res) => {
         if (!ensureWorkspaceAdminRole(req)) {
@@ -2336,7 +2459,7 @@ export function registerAuthRoutes(deps) {
         try {
             const profile = core.mergeAiProfiles({ workspaceId: wid, keepId, mergeId });
             res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ profile }));
+            res.end(JSON.stringify({ profile: serializeAiProfilePublicRecord(profile) }));
         }
         catch (err) {
             const status = err?.statusCode ?? 500;
@@ -2344,6 +2467,45 @@ export function registerAuthRoutes(deps) {
             res.end(JSON.stringify({ error: err?.message ?? 'Merge failed.' }));
         }
     });
+    // POST /api/taskforce/workspace/ai-profiles/surface-type - Manually re-categorize an active AI profile.
+    addRoute('POST', '/api/taskforce/workspace/ai-profiles/surface-type', async (req, res) => {
+        if (!ensureWorkspaceAdminRole(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Forbidden: owner or admin role required.' }));
+            return;
+        }
+        const body = await parseJsonBody(req);
+        const wid = requestWorkspaceId(req);
+        const profileId = String(body.profileId || '').trim();
+        const hasSurfaceType = Boolean(body && Object.prototype.hasOwnProperty.call(body, 'surfaceType'));
+        if (!profileId) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'profileId is required.' }));
+            return;
+        }
+        if (!hasSurfaceType) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'surfaceType is required.' }));
+            return;
+        }
+        try {
+            const profile = core.updateAiProfileSurfaceType({
+                workspaceId: wid,
+                profileId,
+                surfaceType: body.surfaceType
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ success: true, profile: serializeAiProfilePublicRecord(profile) }));
+        }
+        catch (err) {
+            const status = err?.statusCode ?? 500;
+            res.writeHead(status, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                error: err?.message ?? 'Failed to update AI profile category.',
+                code: err?.code
+            }));
+        }
+    });
     // POST /api/taskforce/workspace/ai-profiles/archive - Remove an AI profile from the active roster without deleting its history.
     addRoute('POST', '/api/taskforce/workspace/ai-profiles/archive', async (req, res) => {
         if (!ensureWorkspaceAdminRole(req)) {
@@ -2368,7 +2530,7 @@ export function registerAuthRoutes(deps) {
                 reason
             });
             res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ profile }));
+            res.end(JSON.stringify({ profile: serializeAiProfilePublicRecord(profile) }));
         }
         catch (err) {
             const status = err?.statusCode ?? 500;

package/dist/server/routes/authSupport.d.ts

@@ -24,6 +24,10 @@ export declare function buildAuthBehavior(core: TaskforceCore): {
 export declare function buildSiteBehavior(core: TaskforceCore): {
     showRunTaskforceLocally: boolean;
     pricingPageEnabled: boolean;
+    animatedBackgroundEnabled: boolean;
+    siteTheme: string;
+    pricingPageTitle: string;
+    pricingPageDescription: string;
 };
 export declare function shouldExposeDevAuthTokens(): boolean;
 export declare function resolveRuntimeConfigBaseUrl(req: IncomingMessage): string;

package/dist/server/routes/authSupport.js

@@ -51,9 +51,20 @@ export function buildAuthBehavior(core) {
 export function buildSiteBehavior(core) {
     const globalSettings = core.getGlobalSettings();
     const siteSettings = globalSettings.site || {};
+    const pricingPageTitle = typeof siteSettings.pricingPageTitle === 'string'
+        ? (siteSettings.pricingPageTitle.trim() || 'Subscription Plans')
+        : 'Subscription Plans';
+    const pricingPageDescription = typeof siteSettings.pricingPageDescription === 'string'
+        ? (siteSettings.pricingPageDescription.trim() || 'Manage your subscription and explore available features. Your current plan is highlighted below.')
+        : 'Manage your subscription and explore available features. Your current plan is highlighted below.';
+    const siteTheme = siteSettings.siteTheme === 'light' ? 'light' : 'dark';
     return {
         showRunTaskforceLocally: resolveBooleanSetting(siteSettings.showRunTaskforceLocally, true),
-        pricingPageEnabled: resolveBooleanSetting(siteSettings.pricingPageEnabled, true)
+        pricingPageEnabled: resolveBooleanSetting(siteSettings.pricingPageEnabled, true),
+        animatedBackgroundEnabled: resolveBooleanSetting(siteSettings.animatedBackgroundEnabled, false),
+        siteTheme,
+        pricingPageTitle,
+        pricingPageDescription
     };
 }
 export function shouldExposeDevAuthTokens() {

package/dist/server/routes/billing.js

@@ -2553,6 +2553,15 @@ export function registerBillingRoutes(deps) {
             const db = core.getDatabaseAdapter();
             const tenantId = core.getTenantId();
             const environment = requestPricingEnvironment(req);
+            const siteSettings = typeof core.getGlobalSettings === 'function'
+                ? (core.getGlobalSettings().site || {})
+                : {};
+            const pageTitle = typeof siteSettings.pricingPageTitle === 'string'
+                ? (siteSettings.pricingPageTitle.trim() || 'Subscription Plans')
+                : 'Subscription Plans';
+            const pageDescription = typeof siteSettings.pricingPageDescription === 'string'
+                ? (siteSettings.pricingPageDescription.trim() || 'Manage your subscription and explore available features. Your current plan is highlighted below.')
+                : 'Manage your subscription and explore available features. Your current plan is highlighted below.';
             const cacheKey = `${tenantId}:${environment}`;
             const cacheVersion = buildPublicPricingCacheVersion(core);
             const cached = publicPricingCache.get(cacheKey);
@@ -2664,6 +2673,8 @@ export function registerBillingRoutes(deps) {
             }).filter(Boolean);
             const payload = {
                 asOf: new Date().toISOString(),
+                pageTitle,
+                pageDescription,
                 pricingSource: {
                     environment,
                     runtimeMode: 'cloud'

package/dist/server/routes/billing.test.js

@@ -2733,6 +2733,8 @@ describe('Billing Webhook Routes', () => {
         expect(res.statusCode).toBe(200);
         const body = JSON.parse(res.body);
         expect(body.plans).toBeInstanceOf(Array);
+        expect(body.pageTitle).toBe('Subscription Plans');
+        expect(body.pageDescription).toBe('Manage your subscription and explore available features. Your current plan is highlighted below.');
         expect(body.pricingSource).toEqual({
             environment: 'production',
             runtimeMode: 'cloud'
@@ -2949,6 +2951,7 @@ describe('Billing Webhook Routes', () => {
         await pricingRoute(req, res, {});
         expect(res.statusCode).toBe(200);
         const body = JSON.parse(res.body);
+        expect(body.pageTitle).toBe('Subscription Plans');
         expect(body.pricingSource).toEqual({
             environment: 'performance',
             runtimeMode: 'cloud'

package/dist/server/routes/documents.js

@@ -474,6 +474,14 @@ export function registerDocumentRoutes(deps) {
                     if (shouldProxyInlineUserAvatar && await proxyCloudUserProfileAvatar(req, res, normalizedRelative, contentTypeForExt)) {
                         return;
                     }
+                    if (shouldProxyInlineAiAvatar && filePath && fs.existsSync(filePath)) {
+                        res.writeHead(200, {
+                            'Content-Type': contentTypeForExt(ext),
+                            'Content-Disposition': contentDisposition
+                        });
+                        res.end(fs.readFileSync(filePath));
+                        return;
+                    }
                     res.writeHead(404, { 'Content-Type': 'text/plain' });
                     res.end('Context file not found');
                     return;
@@ -873,6 +881,7 @@ export function registerDocumentRoutes(deps) {
             }));
             return;
         }
+        const attachedAt = new Date().toISOString();
         const payload = buildTaskAttachmentPayload(asset.storageKey, {
             caption: getCanonicalDocumentName({
                 assetId: asset.assetId,
@@ -883,6 +892,7 @@ export function registerDocumentRoutes(deps) {
             }),
             assetId: asset.assetId,
             taskId: targetId,
+            timestamp: attachedAt,
         });
         if (!payload) {
             res.writeHead(500, { 'Content-Type': 'application/json' });

package/dist/server/routes/shared.js

@@ -216,16 +216,6 @@ export function makeResolveAuthenticatedMutationUserId(core, context, requestWor
         const explicitUserId = String(requestUserId(req) || '').trim();
         if (explicitUserId && explicitUserId !== 'anonymous')
             return explicitUserId;
-        if (requestRuntimeMode(req) === 'local') {
-            const workspaceId = String(requestWorkspaceId(req) || '').trim() || 'default';
-            const fallbackUser = core.listWorkspaceUsers(workspaceId).find((user) => {
-                const status = String(user.status || '').trim().toLowerCase();
-                return status === 'active' && user.disabled !== true;
-            });
-            const fallbackUserId = String(fallbackUser?.userId || '').trim();
-            if (fallbackUserId)
-                return fallbackUserId;
-        }
         throw new TaskforceRuleError('Authenticated user required for mutation attribution.', 401, 'MUTATION_AUTH_REQUIRED');
     };
 }