@taskforcehq/taskforce 0.3.314 → 0.3.315

package/dist/components/features/AnnotatedAttachmentWorkspace.js

@@ -118,6 +118,14 @@ function isEditableKeyboardTarget(target) {
         return true;
     return tagName === 'input' || tagName === 'textarea' || tagName === 'select';
 }
+function isInteractiveKeyboardTarget(target) {
+    if (!(target instanceof HTMLElement))
+        return false;
+    if (isEditableKeyboardTarget(target))
+        return true;
+    const tagName = target.tagName.toLowerCase();
+    return tagName === 'button' || tagName === 'a' || target.getAttribute('role') === 'button';
+}
 function normalizeOrder(annotations) {
     return annotations.map((annotation, index) => ({
         ...annotation,
@@ -438,6 +446,7 @@ export function AnnotatedAttachmentWorkspaceShell({ runtimeMode = 'local', apiBa
     const [imageLoadError, setImageLoadError] = useState(false);
     const [zoomLevel, setZoomLevel] = useState(1);
     const [panMode, setPanMode] = useState(false);
+    const [spacePanActive, setSpacePanActive] = useState(false);
     const [pastingImage, setPastingImage] = useState(false);
     const [naturalImageSize, setNaturalImageSize] = useState({ width: 0, height: 0 });
     const overlayRef = useRef(null);
@@ -542,6 +551,7 @@ export function AnnotatedAttachmentWorkspaceShell({ runtimeMode = 'local', apiBa
                 || canvasMediaSize.height > (scroller.clientHeight + 1)));
     }, [canvasMediaSize.height, canvasMediaSize.width, zoomLevel]);
     const zoomLabel = `${Math.round(zoomLevel * 100)}%`;
+    const isPanActive = canPan && (panMode || spacePanActive);
     const annotationOrderNumbers = useMemo(() => {
         const orderMap = new Map();
         draftAnnotations.forEach((annotation, index) => {
@@ -1232,6 +1242,7 @@ export function AnnotatedAttachmentWorkspaceShell({ runtimeMode = 'local', apiBa
         setNaturalImageSize({ width: 0, height: 0 });
         setZoomLevel(1);
         setPanMode(false);
+        setSpacePanActive(false);
     }, [activeTarget?.path]);
     useEffect(() => {
         if (!imageLoading)
@@ -1250,6 +1261,7 @@ export function AnnotatedAttachmentWorkspaceShell({ runtimeMode = 'local', apiBa
         if (canPan)
             return;
         setPanMode(false);
+        setSpacePanActive(false);
     }, [canPan]);
     useEffect(() => {
         setPayloadPreview(null);
@@ -1657,6 +1669,34 @@ export function AnnotatedAttachmentWorkspaceShell({ runtimeMode = 'local', apiBa
         window.addEventListener('keydown', handleKeyDown);
         return () => window.removeEventListener('keydown', handleKeyDown);
     }, [deleteSelectedAnnotation, selectedAnnotationId]);
+    useEffect(() => {
+        const handleKeyDown = (event) => {
+            if (event.code !== 'Space')
+                return;
+            if (!canPan)
+                return;
+            if (isInteractiveKeyboardTarget(event.target))
+                return;
+            event.preventDefault();
+            setSpacePanActive(true);
+        };
+        const handleKeyUp = (event) => {
+            if (event.code !== 'Space')
+                return;
+            setSpacePanActive(false);
+        };
+        const handleWindowBlur = () => {
+            setSpacePanActive(false);
+        };
+        window.addEventListener('keydown', handleKeyDown);
+        window.addEventListener('keyup', handleKeyUp);
+        window.addEventListener('blur', handleWindowBlur);
+        return () => {
+            window.removeEventListener('keydown', handleKeyDown);
+            window.removeEventListener('keyup', handleKeyUp);
+            window.removeEventListener('blur', handleWindowBlur);
+        };
+    }, [canPan]);
     const readPoint = useCallback((event) => {
         const rect = overlayRef.current?.getBoundingClientRect();
         if (!rect || rect.width <= 0 || rect.height <= 0)
@@ -1667,7 +1707,7 @@ export function AnnotatedAttachmentWorkspaceShell({ runtimeMode = 'local', apiBa
         };
     }, []);
     const handleCanvasPointerDown = useCallback((event) => {
-        if (panMode && canPan) {
+        if (isPanActive) {
             const scroller = canvasScrollerRef.current;
             if (!scroller)
                 return;
@@ -1709,7 +1749,7 @@ export function AnnotatedAttachmentWorkspaceShell({ runtimeMode = 'local', apiBa
         setDraftAnnotations((current) => normalizeOrder([...current, annotation]));
         setSelectedAnnotationId(annotation.id);
         markDraftChanged(300);
-    }, [canPan, defaultMarkerColor, markDraftChanged, panMode, readPoint, selectedSessionId, toolMode]);
+    }, [defaultMarkerColor, isPanActive, markDraftChanged, readPoint, selectedSessionId, toolMode]);
     const handleCanvasPointerUp = useCallback((event) => {
         if (panRef.current?.pointerId === event.pointerId) {
             event.currentTarget.releasePointerCapture?.(event.pointerId);
@@ -1726,7 +1766,7 @@ export function AnnotatedAttachmentWorkspaceShell({ runtimeMode = 'local', apiBa
         setToolMode('select');
     }, [readPoint, toolMode]);
     const startDragAnnotation = useCallback((event, annotation) => {
-        if (toolMode !== 'select' || panMode)
+        if (toolMode !== 'select' || isPanActive)
             return;
         const point = readPoint(event);
         if (!point)
@@ -1738,7 +1778,7 @@ export function AnnotatedAttachmentWorkspaceShell({ runtimeMode = 'local', apiBa
         };
         setSelectedAnnotationId(annotation.id);
         event.stopPropagation();
-    }, [panMode, readPoint, toolMode]);
+    }, [isPanActive, readPoint, toolMode]);
     const handleCanvasPointerMove = useCallback((event) => {
         if (panRef.current?.pointerId === event.pointerId) {
             const scroller = canvasScrollerRef.current;
@@ -1872,7 +1912,7 @@ export function AnnotatedAttachmentWorkspaceShell({ runtimeMode = 'local', apiBa
         panRef.current = null;
     }, []);
     const startResizeBox = useCallback((event, annotation) => {
-        if (toolMode !== 'select' || panMode)
+        if (toolMode !== 'select' || isPanActive)
             return;
         const point = readPoint(event);
         if (!point)
@@ -1884,9 +1924,9 @@ export function AnnotatedAttachmentWorkspaceShell({ runtimeMode = 'local', apiBa
         };
         setSelectedAnnotationId(annotation.id);
         event.stopPropagation();
-    }, [panMode, readPoint, toolMode]);
+    }, [isPanActive, readPoint, toolMode]);
     const startArrowHandleDrag = useCallback((event, annotation, endpoint) => {
-        if (toolMode !== 'select' || panMode)
+        if (toolMode !== 'select' || isPanActive)
             return;
         const point = readPoint(event);
         if (!point)
@@ -1899,7 +1939,7 @@ export function AnnotatedAttachmentWorkspaceShell({ runtimeMode = 'local', apiBa
         };
         setSelectedAnnotationId(annotation.id);
         event.stopPropagation();
-    }, [panMode, readPoint, toolMode]);
+    }, [isPanActive, readPoint, toolMode]);
     const activeSessionTimestamp = selectedSession?.updatedAt ? formatTimestamp(selectedSession.updatedAt) : 'Not saved yet';
     return (_jsxs("div", { className: `${styles.shell} ${showImageTray ? styles.shellWithImageTray : ''} ${showImageTray && imageTrayOpen ? styles.shellImageTrayOpen : ''}`.trim(), children: [showImageTray ? (_jsxs("aside", { className: `${styles.imageTrayPanel} ${imageTrayOpen ? styles.imageTrayPanelOpen : ''}`.trim(), "aria-label": "Image tray", "aria-hidden": !imageTrayOpen, children: [_jsxs("div", { className: styles.imageTrayHeader, children: [_jsxs("span", { className: styles.imageTrayTitle, children: [_jsx(FolderOpen, { size: 14 }), "Images"] }), _jsx("button", { type: "button", className: "tf-control-icon", onClick: onCloseImageTray, title: "Collapse image tray", "aria-label": "Collapse image tray", children: _jsx(ChevronLeft, { size: 16 }) })] }), _jsxs("div", { className: styles.imageTraySearch, children: [_jsx(Search, { size: 12, className: styles.imageTraySearchIcon }), _jsx("input", { type: "text", placeholder: "Search images...", value: imageTraySearchQuery, onChange: (event) => setImageTraySearchQuery(event.target.value), className: styles.imageTraySearchInput })] }), _jsx("div", { className: `tf-scrollbar ${styles.imageTrayList}`, children: imageTrayLoading ? (_jsx("div", { className: styles.imageTrayState, children: "Loading images..." })) : imageTrayError ? (_jsx("div", { className: styles.imageTrayStateError, children: imageTrayError })) : filteredImageTrayItems.length === 0 ? (_jsx("div", { className: styles.imageTrayState, children: imageTraySearchQuery.trim() ? 'No images match your search.' : 'No images found.' })) : filteredImageTrayItems.map((item) => {
                             const isSelected = activeTarget?.assetId === item.assetId;
@@ -1957,7 +1997,7 @@ export function AnnotatedAttachmentWorkspaceShell({ runtimeMode = 'local', apiBa
                                             if (!selectedSession)
                                                 return;
                                             restoreLastSavedDraft();
-                                        }, disabled: !selectedSession || !hasUnsavedChanges, "aria-label": "Reset unsaved changes", title: "Reset unsaved changes", children: _jsx(RotateCcw, { size: 18 }) }), _jsx("button", { type: "button", className: `tf-button-ghost ${styles.toolRailButton} ${styles.iconButton}`, onClick: zoomOut, disabled: !activeTarget || imageLoading || zoomLevel <= 0.25, "aria-label": "Zoom out", children: _jsx(ZoomOut, { size: 18 }) }), _jsx("button", { type: "button", className: `tf-button-ghost tf-button-compact ${styles.ghostBtn} ${styles.toolbarButton}`, onClick: resetZoom, disabled: !activeTarget || imageLoading || zoomLevel === 1, "aria-label": `Reset zoom to 100 percent (currently ${zoomLabel})`, title: `Reset zoom to 100% (currently ${zoomLabel})`, children: _jsx("span", { children: zoomLabel }) }), _jsx("button", { type: "button", className: `tf-button-ghost ${styles.toolRailButton} ${styles.iconButton}`, onClick: zoomIn, disabled: !activeTarget || imageLoading || zoomLevel >= 4, "aria-label": "Zoom in", children: _jsx(ZoomIn, { size: 18 }) }), _jsx("button", { type: "button", className: `tf-button-ghost tf-button-compact ${styles.toolBtn} ${styles.toolbarButton} ${panMode ? styles.toolBtnActive : ''}`, onClick: () => setPanMode((current) => !current), disabled: !activeTarget || imageLoading || !canPan, "aria-label": "Pan canvas", title: "Pan canvas", children: _jsx(Hand, { size: 18 }) })] }), _jsx("span", { className: styles.toolbarSeparator, "aria-hidden": "true" }), _jsxs("div", { className: styles.toolbarActions, children: [_jsx("div", { className: styles.toolbarSelectionActions, children: selectedAnnotation ? (_jsxs(_Fragment, { children: [_jsxs("div", { ref: colorPickerRef, className: styles.toolbarColorPicker, children: [_jsx("button", { type: "button", className: `tf-button-ghost tf-button-compact ${styles.ghostBtn} ${styles.toolbarButton} ${styles.colorPickerButton}`, onClick: () => setColorPickerOpen((current) => !current), "aria-label": "Marker color", "aria-expanded": colorPickerOpen, title: "Marker color", children: _jsx("span", { className: styles.colorPickerSwatch, style: { backgroundColor: selectedMarkerColor }, "aria-hidden": "true" }) }), colorPickerOpen ? (_jsx("div", { className: styles.colorPickerPopover, role: "menu", "aria-label": "Marker color options", children: MARKER_COLOR_SWATCHES.map((color) => (_jsx("button", { type: "button", className: `${styles.colorOption} ${selectedMarkerColor === color ? styles.colorOptionActive : ''}`, style: { backgroundColor: color }, onClick: () => applyMarkerColor(color), "aria-label": `Use marker color ${color}`, "aria-pressed": selectedMarkerColor === color }, color))) })) : null] }), _jsx("button", { type: "button", className: `tf-button-ghost tf-button-compact ${styles.ghostBtn} ${styles.toolbarButton}`, onClick: deleteSelectedAnnotation, "aria-label": "Delete marker", title: "Delete selected marker", children: _jsx(Trash2, { size: 18 }) }), _jsx("div", { className: styles.toolbarGeometryFields, "aria-label": "Marker geometry percent controls", children: getGeometryFields(selectedAnnotation).map((field) => (_jsxs("label", { className: styles.toolbarGeometryField, children: [_jsx("span", { className: `tf-text-meta ${styles.toolbarGeometryLabel}`, children: field.label }), _jsx("input", { className: `tf-field-shell ${styles.toolbarGeometryInput}`, type: "number", min: 0, max: 100, step: 0.1, value: field.value, onChange: (event) => {
+                                        }, disabled: !selectedSession || !hasUnsavedChanges, "aria-label": "Reset unsaved changes", title: "Reset unsaved changes", children: _jsx(RotateCcw, { size: 18 }) }), _jsx("button", { type: "button", className: `tf-button-ghost ${styles.toolRailButton} ${styles.iconButton}`, onClick: zoomOut, disabled: !activeTarget || imageLoading || zoomLevel <= 0.25, "aria-label": "Zoom out", children: _jsx(ZoomOut, { size: 18 }) }), _jsx("button", { type: "button", className: `tf-button-ghost tf-button-compact ${styles.ghostBtn} ${styles.toolbarButton}`, onClick: resetZoom, disabled: !activeTarget || imageLoading || zoomLevel === 1, "aria-label": `Reset zoom to 100 percent (currently ${zoomLabel})`, title: `Reset zoom to 100% (currently ${zoomLabel})`, children: _jsx("span", { children: zoomLabel }) }), _jsx("button", { type: "button", className: `tf-button-ghost ${styles.toolRailButton} ${styles.iconButton}`, onClick: zoomIn, disabled: !activeTarget || imageLoading || zoomLevel >= 4, "aria-label": "Zoom in", children: _jsx(ZoomIn, { size: 18 }) }), _jsx("button", { type: "button", className: `tf-button-ghost tf-button-compact ${styles.toolBtn} ${styles.toolbarButton} ${isPanActive ? styles.toolBtnActive : ''}`, onClick: () => setPanMode((current) => !current), disabled: !activeTarget || imageLoading || !canPan, "aria-label": "Pan canvas", title: "Pan canvas", children: _jsx(Hand, { size: 18 }) })] }), _jsx("span", { className: styles.toolbarSeparator, "aria-hidden": "true" }), _jsxs("div", { className: styles.toolbarActions, children: [_jsx("div", { className: styles.toolbarSelectionActions, children: selectedAnnotation ? (_jsxs(_Fragment, { children: [_jsxs("div", { ref: colorPickerRef, className: styles.toolbarColorPicker, children: [_jsx("button", { type: "button", className: `tf-button-ghost tf-button-compact ${styles.ghostBtn} ${styles.toolbarButton} ${styles.colorPickerButton}`, onClick: () => setColorPickerOpen((current) => !current), "aria-label": "Marker color", "aria-expanded": colorPickerOpen, title: "Marker color", children: _jsx("span", { className: styles.colorPickerSwatch, style: { backgroundColor: selectedMarkerColor }, "aria-hidden": "true" }) }), colorPickerOpen ? (_jsx("div", { className: styles.colorPickerPopover, role: "menu", "aria-label": "Marker color options", children: MARKER_COLOR_SWATCHES.map((color) => (_jsx("button", { type: "button", className: `${styles.colorOption} ${selectedMarkerColor === color ? styles.colorOptionActive : ''}`, style: { backgroundColor: color }, onClick: () => applyMarkerColor(color), "aria-label": `Use marker color ${color}`, "aria-pressed": selectedMarkerColor === color }, color))) })) : null] }), _jsx("button", { type: "button", className: `tf-button-ghost tf-button-compact ${styles.ghostBtn} ${styles.toolbarButton}`, onClick: deleteSelectedAnnotation, "aria-label": "Delete marker", title: "Delete selected marker", children: _jsx(Trash2, { size: 18 }) }), _jsx("div", { className: styles.toolbarGeometryFields, "aria-label": "Marker geometry percent controls", children: getGeometryFields(selectedAnnotation).map((field) => (_jsxs("label", { className: styles.toolbarGeometryField, children: [_jsx("span", { className: `tf-text-meta ${styles.toolbarGeometryLabel}`, children: field.label }), _jsx("input", { className: `tf-field-shell ${styles.toolbarGeometryInput}`, type: "number", min: 0, max: 100, step: 0.1, value: field.value, onChange: (event) => {
                                                                     const nextValue = parsePercentField(event.target.value);
                                                                     if (nextValue === null)
                                                                         return;
@@ -1980,7 +2020,7 @@ export function AnnotatedAttachmentWorkspaceShell({ runtimeMode = 'local', apiBa
                                                                 setNaturalImageSize({ width: 0, height: 0 });
                                                                 setImageLoading(false);
                                                                 setImageLoadError(true);
-                                                            } }), !imageLoading && !imageLoadError && selectedSession ? (_jsxs("div", { ref: overlayRef, className: `${styles.overlay} ${toolMode === 'select' ? styles.overlaySelect : ''} ${panMode && canPan ? styles.overlayPan : ''}`, onPointerDown: handleCanvasPointerDown, onPointerMove: handleCanvasPointerMove, onPointerUp: (event) => {
+                                                            } }), !imageLoading && !imageLoadError && selectedSession ? (_jsxs("div", { ref: overlayRef, className: `${styles.overlay} ${toolMode === 'select' ? styles.overlaySelect : ''} ${isPanActive ? styles.overlayPan : ''}`, onPointerDown: handleCanvasPointerDown, onPointerMove: handleCanvasPointerMove, onPointerUp: (event) => {
                                                                 handleCanvasPointerUp(event);
                                                                 handleCanvasPointerEnd();
                                                             }, "data-testid": "annotated-attachment-overlay", onPointerLeave: handleCanvasPointerLeave, onPointerCancel: handleCanvasPointerCancel, children: [_jsx("svg", { className: styles.overlaySvg, viewBox: arrowOverlayViewBox, preserveAspectRatio: "none", "aria-hidden": "true", children: draftAnnotations.filter((annotation) => annotation.kind === 'arrow').map((annotation) => {
@@ -2022,7 +2062,7 @@ export function AnnotatedAttachmentWorkspaceShell({ runtimeMode = 'local', apiBa
                                     ? 'Save failed. Retry now.'
                                     : saveState === 'saving' || saveState === 'pending'
                                         ? 'Saving…'
-                                        : 'Saved' }), error ? _jsx("span", { children: error }) : _jsx("span", { children: !selectedSession ? 'Create a session to begin placing markers on this image.' : panMode && canPan ? 'Drag on the image to pan.' : toolMode === 'select' ? 'Select a marker to edit it.' : `Click on the image to place a ${toolMode}.` }), activeTarget && !selectedSession && showCreateSessionPrompt ? (_jsx("button", { type: "button", className: `tf-button-ghost tf-button-compact ${styles.ghostBtn} ${styles.toolbarButton}`, onClick: () => void createSession(), disabled: saving || loading, children: saving ? 'Creating…' : 'Create one now' })) : null] })] }), _jsx("section", { className: `tf-surface-panel ${styles.panel} ${styles.detailPanel}`, children: selectedSession ? (_jsxs(_Fragment, { children: [_jsxs("div", { className: styles.panelHeader, children: [_jsxs("div", { className: styles.panelHeaderText, children: [_jsx("div", { className: `tf-heading-card ${styles.panelTitle}`, children: "Markers" }), _jsxs("div", { className: "tf-text-secondary", children: [draftAnnotations.length, " in this session"] })] }), _jsxs("div", { className: styles.sessionActions, children: [_jsx("button", { type: "button", className: `tf-control-icon ${styles.iconButton}`, onClick: () => moveSelectedAnnotation('up'), disabled: !selectedAnnotation || selectedAnnotationIndex <= 0, "aria-label": "Move marker up", children: _jsx(ArrowUp, { size: 16 }) }), _jsx("button", { type: "button", className: `tf-control-icon ${styles.iconButton}`, onClick: () => moveSelectedAnnotation('down'), disabled: !selectedAnnotation || selectedAnnotationIndex === -1 || selectedAnnotationIndex >= draftAnnotations.length - 1, "aria-label": "Move marker down", children: _jsx(ArrowDown, { size: 16 }) })] })] }), _jsx("div", { className: `tf-scrollbar ${styles.annotationList}`, children: draftAnnotations.length === 0 ? (_jsx("div", { className: styles.detailEmpty, children: _jsx("p", { className: "tf-empty-copy", children: "Add a marker on the image to begin." }) })) : draftAnnotations.map((annotation, index) => {
+                                        : 'Saved' }), error ? _jsx("span", { children: error }) : _jsx("span", { children: !selectedSession ? 'Create a session to begin placing markers on this image.' : isPanActive ? 'Drag on the image to pan.' : toolMode === 'select' ? 'Select a marker to edit it.' : `Click on the image to place a ${toolMode}.` }), activeTarget && !selectedSession && showCreateSessionPrompt ? (_jsx("button", { type: "button", className: `tf-button-ghost tf-button-compact ${styles.ghostBtn} ${styles.toolbarButton}`, onClick: () => void createSession(), disabled: saving || loading, children: saving ? 'Creating…' : 'Create one now' })) : null] })] }), _jsx("section", { className: `tf-surface-panel ${styles.panel} ${styles.detailPanel}`, children: selectedSession ? (_jsxs(_Fragment, { children: [_jsxs("div", { className: styles.panelHeader, children: [_jsxs("div", { className: styles.panelHeaderText, children: [_jsx("div", { className: `tf-heading-card ${styles.panelTitle}`, children: "Markers" }), _jsxs("div", { className: "tf-text-secondary", children: [draftAnnotations.length, " in this session"] })] }), _jsxs("div", { className: styles.sessionActions, children: [_jsx("button", { type: "button", className: `tf-control-icon ${styles.iconButton}`, onClick: () => moveSelectedAnnotation('up'), disabled: !selectedAnnotation || selectedAnnotationIndex <= 0, "aria-label": "Move marker up", children: _jsx(ArrowUp, { size: 16 }) }), _jsx("button", { type: "button", className: `tf-control-icon ${styles.iconButton}`, onClick: () => moveSelectedAnnotation('down'), disabled: !selectedAnnotation || selectedAnnotationIndex === -1 || selectedAnnotationIndex >= draftAnnotations.length - 1, "aria-label": "Move marker down", children: _jsx(ArrowDown, { size: 16 }) })] })] }), _jsx("div", { className: `tf-scrollbar ${styles.annotationList}`, children: draftAnnotations.length === 0 ? (_jsx("div", { className: styles.detailEmpty, children: _jsx("p", { className: "tf-empty-copy", children: "Add a marker on the image to begin." }) })) : draftAnnotations.map((annotation, index) => {
                                 const AnnotationKindIcon = ANNOTATION_KIND_ICON[annotation.kind];
                                 const annotationKindLabel = ANNOTATION_KIND_LABELS[annotation.kind];
                                 const annotationSequenceLabel = `${annotationKindLabel} ${index + 1}`;

package/dist/core/PlanEntitlementService.js

@@ -258,12 +258,17 @@ export class PlanEntitlementService {
             };
         }
         if (normalizedFeatureKey === AI_PROFILES_FEATURE_KEY) {
+            const limit = this.readPositiveIntegerConfig(config[AI_PROFILES_LIMIT_CONFIG_KEY], 1);
             if (access === 'limited') {
-                const limit = this.readPositiveIntegerConfig(config[AI_PROFILES_LIMIT_CONFIG_KEY], 1);
                 return {
                     [AI_PROFILES_LIMIT_CONFIG_KEY]: limit ?? 1
                 };
             }
+            if (limit !== null) {
+                return {
+                    [AI_PROFILES_LIMIT_CONFIG_KEY]: limit
+                };
+            }
             return {};
         }
         return config && typeof config === 'object' ? { ...config } : {};

package/dist/core/Taskforce.d.ts

@@ -911,6 +911,8 @@ export declare class TaskforceCore implements TaskforceSyncCapable {
     private tenantId;
     private db;
     private globalSettingsDb;
+    private readonly globalSettingsSchemaEnsuredStores;
+    private readonly structuredSettingsSchemaEnsuredStores;
     private authTokenService;
     private identityService;
     private mcpTokenService;

package/dist/core/Taskforce.js

@@ -40,6 +40,7 @@ import { formatInitiativeReference, formatWorkstreamReference, } from '../utils/
 import { getDocumentReferenceLabel } from '../utils/documentReferences.js';
 import { getImageReferenceLabel } from '../utils/imageReferences.js';
 import { getCanonicalDocumentName } from '../utils/documentNames.js';
+import { isPathInsideRoot, resolveStorageKeyPathInsideRoot } from '../utils/pathSafety.js';
 import { DEFAULT_TASKFORCE_THEME } from '../utils/theme.js';
 import { ensureAssigneeTaskSchema, ensureAnnotatedAttachmentSessionsSchema, ensureAuthIdentitySchema, ensureBillingSchema, ensureDocumentReviewSessionsSchema, ensureDocumentReferenceSchema, ensureEntitlementsSchema, ensureScheduleTaskSchema, ensureTaskAssetsSchema, ensureTaskReferenceSchema, ensureTenantSchema, ensureWorkspaceAssetsSchema, ensureWorkspaceSchema } from '../migrations/taskSchemaMigrations.js';
 export class TaskforceRuleError extends Error {
@@ -142,6 +143,8 @@ export class TaskforceCore {
     tenantId;
     db;
     globalSettingsDb = null;
+    globalSettingsSchemaEnsuredStores = new WeakSet();
+    structuredSettingsSchemaEnsuredStores = new WeakSet();
     authTokenService;
     identityService;
     mcpTokenService;
@@ -2961,6 +2964,8 @@ export class TaskforceCore {
         return this.globalSettingsDb || this.db;
     }
     ensureGlobalSettingsTable(store) {
+        if (this.globalSettingsSchemaEnsuredStores.has(store))
+            return;
         store.exec(`
             CREATE TABLE IF NOT EXISTS global_settings (
                 tenant_id TEXT PRIMARY KEY,
@@ -2968,8 +2973,11 @@ export class TaskforceCore {
                 updated_at TEXT NOT NULL
             );
         `);
+        this.globalSettingsSchemaEnsuredStores.add(store);
     }
     ensureStructuredSettingsTables(store) {
+        if (this.structuredSettingsSchemaEnsuredStores.has(store))
+            return;
         store.exec(`
             CREATE TABLE IF NOT EXISTS system_settings (
                 tenant_id TEXT NOT NULL DEFAULT 'default',
@@ -3002,6 +3010,7 @@ export class TaskforceCore {
             CREATE INDEX IF NOT EXISTS idx_user_preferences_user_key
             ON user_preferences(user_id, prefs_key);
         `);
+        this.structuredSettingsSchemaEnsuredStores.add(store);
     }
     readSettingsPayloadRow(store, tableName, whereValues) {
         try {
@@ -3260,8 +3269,13 @@ export class TaskforceCore {
                     };
                 }
                 if (storageProvider !== 'r2') {
-                    const candidatePath = path.join(this.basePath, storageKey);
-                    if (!fs.existsSync(candidatePath) || !fs.statSync(candidatePath).isFile()) {
+                    const candidatePath = resolveStorageKeyPathInsideRoot(this.basePath, storageKey);
+                    if (!candidatePath || !fs.existsSync(candidatePath) || !fs.statSync(candidatePath).isFile()) {
+                        return null;
+                    }
+                    const storageRoot = fs.existsSync(this.basePath) ? fs.realpathSync(this.basePath) : path.resolve(this.basePath);
+                    const realCandidatePath = fs.realpathSync(candidatePath);
+                    if (!isPathInsideRoot(realCandidatePath, storageRoot)) {
                         return null;
                     }
                 }

package/dist/hooks/useTaskforce.js

@@ -2708,14 +2708,21 @@ export function useTaskforce({ config = {}, initialTaskId, onTaskCountChange, on
             onTaskCountChange(tasks.length);
         }
     }, [tasks.length, onTaskCountChange]);
+    const handledInitialTaskIdRef = useRef(null);
     // Deep linking handler
     useEffect(() => {
-        if (initialTaskId && tasks.length > 0) {
-            const task = tasks.find(t => t.id.endsWith(initialTaskId) || t.id === initialTaskId);
-            if (task) {
-                handleEdit(task);
-                setActiveTab('add');
-            }
+        if (!initialTaskId) {
+            handledInitialTaskIdRef.current = null;
+            return;
+        }
+        if (handledInitialTaskIdRef.current === initialTaskId || tasks.length === 0) {
+            return;
+        }
+        const task = tasks.find(t => t.id.endsWith(initialTaskId) || t.id === initialTaskId);
+        if (task) {
+            handledInitialTaskIdRef.current = initialTaskId;
+            handleEdit(task);
+            setActiveTab('add');
         }
     }, [initialTaskId, tasks]);
     // Update active category logic

package/dist/mcp/canonicalAssetHelpers.js

@@ -1,11 +1,12 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { createHash, randomUUID } from 'node:crypto';
+import { normalizeRelativeStorageKey, resolveExistingStorageKeyFilePathInsideRoot, resolveStorageKeyWritePathInsideRoot } from '../utils/pathSafety.js';
 export function createCanonicalAssetHelpers(deps) {
     const normalizeAttachmentStorageKey = (pathValue, fsPathValue) => {
         const fsPathRaw = String(fsPathValue || '').trim().replace(/\\/g, '/');
         if (fsPathRaw) {
-            return fsPathRaw.replace(/^\.taskforce\//, '').trim() || null;
+            return normalizeRelativeStorageKey(fsPathRaw.replace(/^\.taskforce\//, '').trim());
         }
         const pathRaw = String(pathValue || '').trim();
         if (!pathRaw)
@@ -13,10 +14,18 @@ export function createCanonicalAssetHelpers(deps) {
         if (/^https?:\/\//i.test(pathRaw))
             return pathRaw;
         if (pathRaw.startsWith('/api/taskforce/context/')) {
-            return decodeURIComponent(pathRaw.slice('/api/taskforce/context/'.length)).trim() || null;
+            return normalizeRelativeStorageKey(decodeURIComponent(pathRaw.slice('/api/taskforce/context/'.length)).trim());
         }
         return null;
     };
+    const isSafeCanonicalAssetStorage = (asset) => {
+        if (asset.storageProvider === 'external')
+            return true;
+        return Boolean(normalizeRelativeStorageKey(asset.storageKey));
+    };
+    const resolveCanonicalLocalFilePath = (storageKey) => {
+        return resolveExistingStorageKeyFilePathInsideRoot(deps.basePath, storageKey);
+    };
     const buildSyntheticAttachmentId = (taskId, attachment) => {
         const stableSource = [
             taskId,
@@ -32,14 +41,14 @@ export function createCanonicalAssetHelpers(deps) {
         const assetId = String(attachment.assetId || '').trim();
         if (assetId) {
             const byId = deps.workspaceAssetStore.get(assetId, deps.activeWorkspaceId);
-            if (byId && !byId.deletedAt)
+            if (byId && !byId.deletedAt && isSafeCanonicalAssetStorage(byId))
                 return byId;
         }
         const storageKey = normalizeAttachmentStorageKey(attachment.path, attachment.fsPath);
         if (!storageKey || /^https?:\/\//i.test(storageKey))
             return null;
         const byStorageKey = deps.workspaceAssetStore.getByStorageKey(storageKey, deps.activeWorkspaceId);
-        if (byStorageKey && !byStorageKey.deletedAt)
+        if (byStorageKey && !byStorageKey.deletedAt && isSafeCanonicalAssetStorage(byStorageKey))
             return byStorageKey;
         return null;
     };
@@ -80,6 +89,9 @@ export function createCanonicalAssetHelpers(deps) {
             throw new Error('Attachment scan pending');
         }
         if (asset.storageProvider === 'r2') {
+            if (!normalizeRelativeStorageKey(asset.storageKey)) {
+                throw new Error(`Attachment ${attachment.attachmentId} not found on ${targetLabel} ${taskId}`);
+            }
             const attachmentContext = describeAttachmentStorageContext(attachment, asset.storageKey);
             if (!deps.objectStorageClient) {
                 throw new Error(`Attachment read failed from R2 because object storage is not configured in this MCP runtime (${attachmentContext})`);
@@ -97,11 +109,8 @@ export function createCanonicalAssetHelpers(deps) {
             }
             return object.body;
         }
-        const resolvedPath = path.resolve(deps.basePath, asset.storageKey);
-        if (!resolvedPath.startsWith(path.resolve(deps.basePath))) {
-            throw new Error(`Attachment ${attachment.attachmentId} not found on ${targetLabel} ${taskId}`);
-        }
-        if (!fs.existsSync(resolvedPath) || !fs.statSync(resolvedPath).isFile()) {
+        const resolvedPath = resolveCanonicalLocalFilePath(asset.storageKey);
+        if (!resolvedPath) {
             throw new Error(`Attachment ${attachment.attachmentId} not found on ${targetLabel} ${taskId}`);
         }
         return fs.readFileSync(resolvedPath);
@@ -117,6 +126,9 @@ export function createCanonicalAssetHelpers(deps) {
             throw new Error('Document scan pending');
         }
         if (asset.storageProvider === 'r2') {
+            if (!normalizeRelativeStorageKey(asset.storageKey)) {
+                throw new Error(`Document ${asset.assetId} not found in workspace ${deps.activeWorkspaceId}.`);
+            }
             if (!deps.objectStorageClient) {
                 throw new Error(`Document read failed from R2 because object storage is not configured in this MCP runtime (assetId=${asset.assetId}, storageKey=${asset.storageKey || 'unknown'})`);
             }
@@ -133,11 +145,8 @@ export function createCanonicalAssetHelpers(deps) {
             }
             return object.body;
         }
-        const resolvedPath = path.resolve(deps.basePath, asset.storageKey);
-        if (!resolvedPath.startsWith(path.resolve(deps.basePath))) {
-            throw new Error(`Document ${asset.assetId} not found in workspace ${deps.activeWorkspaceId}.`);
-        }
-        if (!fs.existsSync(resolvedPath) || !fs.statSync(resolvedPath).isFile()) {
+        const resolvedPath = resolveCanonicalLocalFilePath(asset.storageKey);
+        if (!resolvedPath) {
             throw new Error(`Document ${asset.assetId} not found in workspace ${deps.activeWorkspaceId}.`);
         }
         return fs.readFileSync(resolvedPath);
@@ -176,14 +185,17 @@ export function createCanonicalAssetHelpers(deps) {
             const logicalFilename = resolveAttachmentLogicalFilename(attachment, asset);
             if (logicalFilename !== requestedFilename)
                 continue;
-            const relativePath = deps.toPosixPath(path.relative(deps.projectRoot, path.resolve(deps.basePath, asset.storageKey)));
+            const absolutePath = resolveStorageKeyWritePathInsideRoot(deps.basePath, asset.storageKey);
+            if (!absolutePath)
+                continue;
+            const relativePath = deps.toPosixPath(path.relative(deps.projectRoot, absolutePath));
             return {
                 index,
                 attachment,
                 asset,
                 descriptor,
                 relativePath,
-                absolutePath: path.resolve(deps.basePath, asset.storageKey),
+                absolutePath,
                 logicalFilename,
             };
         }
@@ -197,10 +209,12 @@ export function createCanonicalAssetHelpers(deps) {
         const targetId = String(targetIdRaw || '').trim();
         if (!relativePath || !targetId)
             return null;
-        const absolutePath = path.resolve(deps.projectRoot, relativePath);
-        if (!fs.existsSync(absolutePath) || !fs.statSync(absolutePath).isFile())
+        const storageKey = normalizeRelativeStorageKey(relativePath.replace(/^\.taskforce\//, '').trim() || relativePath);
+        if (!storageKey)
+            return null;
+        const absolutePath = resolveExistingStorageKeyFilePathInsideRoot(deps.basePath, storageKey);
+        if (!absolutePath)
             return null;
-        const storageKey = relativePath.replace(/^\.taskforce\//, '').trim() || relativePath;
         const buffer = fs.readFileSync(absolutePath);
         const stats = fs.statSync(absolutePath);
         const mimeType = deps.inferMimeTypeFromPath(relativePath);

package/dist/mcp/runtime.js

@@ -11,6 +11,7 @@ import { buildResolveAiProfileInputFromBootstrap } from './aiProfileBootstrap.js
 import { createCanonicalAssetHelpers } from './canonicalAssetHelpers.js';
 import { createDocumentHelpers } from './documentHelpers.js';
 import { createTaskAttachmentHelpers } from './taskAttachmentHelpers.js';
+import { isPathWithinRoot } from '../utils/pathContainment.js';
 import { validateStructuredDocForAttach } from './structuredDocValidation.js';
 import { validateStructuredCommentForAdd } from './structuredCommentValidation.js';
 import { resolveDatabaseConfigFromEnv } from '../storage/providerConfig.js';
@@ -23,6 +24,7 @@ import { getDocumentReferenceLabel, parseDocumentReference } from '../utils/docu
 import { getImageReferenceLabel, parseImageReference } from '../utils/imageReferences.js';
 import { inferCanonicalAssetKind, isValidCanonicalDocumentAsset } from '../utils/canonicalAssetKind.js';
 import { getTaskReferenceLabel, shouldUseProvisionalTaskReferences } from '../utils/taskReferences.js';
+import { resolveStorageKeyPathInsideRoot } from '../utils/pathSafety.js';
 import { parseAiProfileSurfaceType } from '../shared/aiProfileSurfaceType.js';
 import { parseAiProfileSeatScope } from '../shared/aiProfileSeatScope.js';
 import { formatInitiativeReference, formatWorkstreamReference, resolveInitiativeReference, parseWorkstreamReference, } from '../utils/planningReferences.js';
@@ -1426,12 +1428,8 @@ export function createTaskforceMcpServer(options = {}) {
     function isHttpUrl(value) {
         return /^https?:\/\//i.test(value);
     }
-    function isWithinRoot(filePath, root) {
-        const relative = path.relative(root, filePath);
-        return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
-    }
     function isApprovedAttachmentSourcePath(filePath, projectRootReal) {
-        return getApprovedAttachmentSourceRoots(projectRootReal).some((root) => isWithinRoot(filePath, root));
+        return getApprovedAttachmentSourceRoots(projectRootReal).some((root) => isPathWithinRoot(filePath, root));
     }
     function toPosixPath(filePath) {
         return filePath.split(path.sep).join('/');
@@ -2976,9 +2974,24 @@ export function createTaskforceMcpServer(options = {}) {
             case "replace_task_checklist": {
                 const { taskId, items } = args;
                 const { id: resolvedTaskId } = resolveTaskByIdentifierOrThrow(taskId);
+                const now = new Date().toISOString();
+                const checklistItems = Array.isArray(items)
+                    ? items.map((item, index) => ({
+                        id: item?.id,
+                        taskId: resolvedTaskId,
+                        title: String(item?.title ?? item?.text ?? '').trim() || `Checklist item ${index + 1}`,
+                        isCompleted: Boolean(item?.isCompleted ?? item?.done),
+                        order: Number.isFinite(Number(item?.order)) ? Number(item.order) : index,
+                        createdAt: String(item?.createdAt || now),
+                        updatedAt: item?.updatedAt ? String(item.updatedAt) : now,
+                    }))
+                    : [];
                 const updatedTask = core.updateTask(resolvedTaskId, {
-                    checklistItems: Array.isArray(items) ? items : [],
+                    checklistItems,
                 }, ACTIVE_WORKSPACE_ID, { actorRef: getActiveMcpActorRef() });
+                if (!updatedTask) {
+                    throw new Error(`Task ${resolvedTaskId} not found`);
+                }
                 const replaced = core.listChecklistItems(resolvedTaskId, ACTIVE_WORKSPACE_ID);
                 recordMcpWriteAudit('replace_task_checklist', {
                     taskId: resolvedTaskId,
@@ -2994,7 +3007,6 @@ export function createTaskforceMcpServer(options = {}) {
                             text: JSON.stringify({
                                 taskId: resolvedTaskId,
                                 items: replaced,
-                                ...(updatedTask ? { task: updatedTask } : {}),
                             }, null, 2),
                         }],
                 };
@@ -4880,8 +4892,8 @@ export function createTaskforceMcpServer(options = {}) {
                             await objectStorageClient.deleteObject(replacedStorageKey).catch(() => { });
                         }
                         else if (overwriteTarget.asset.storageProvider === 'local') {
-                            const replacedAbsolutePath = path.resolve(basePath, replacedStorageKey);
-                            if (replacedAbsolutePath.startsWith(path.resolve(basePath)) && fs.existsSync(replacedAbsolutePath)) {
+                            const replacedAbsolutePath = resolveStorageKeyPathInsideRoot(basePath, replacedStorageKey);
+                            if (replacedAbsolutePath && fs.existsSync(replacedAbsolutePath)) {
                                 fs.rmSync(replacedAbsolutePath, { force: true });
                             }
                         }

package/dist/mcp/taskAttachmentHelpers.js

@@ -1,18 +1,40 @@
 export function createTaskAttachmentHelpers(deps) {
     const isCanonicalDocumentAssetRecord = (asset) => deps.isValidCanonicalDocumentAsset(asset);
+    const inferSpecificMimeType = (...candidates) => {
+        for (const candidate of candidates) {
+            const value = String(candidate || '').trim();
+            if (!value)
+                continue;
+            const inferred = deps.inferMimeTypeFromPath(value);
+            if (inferred && inferred !== 'application/octet-stream')
+                return inferred;
+        }
+        return '';
+    };
     const describeTaskAttachment = (taskId, attachmentInput) => {
         const attachment = deps.canonicalAssetHelpers.toTaskAttachmentRecord(attachmentInput);
         const asset = deps.canonicalAssetHelpers.getAttachmentAssetRecord(attachment);
         const storageKey = deps.canonicalAssetHelpers.normalizeAttachmentStorageKey(attachment.path, attachment.fsPath);
-        const assetId = String(attachment.assetId || asset?.assetId || '').trim() || undefined;
-        const source = (asset?.storageProvider === 'external' || /^https?:\/\//i.test(String(attachment.path || '').trim()))
+        const assetId = String(asset?.assetId || '').trim() || undefined;
+        const source = (asset?.storageProvider === 'external'
+            || /^https?:\/\//i.test(String(attachment.path || '').trim())
+            || (!asset && !storageKey))
             ? 'external'
             : 'canonical';
-        const mimeType = String(asset?.mimeType
-            || (storageKey && !/^https?:\/\//i.test(storageKey) ? deps.inferMimeTypeFromPath(storageKey) : '')
-            || deps.inferMimeTypeFromPath(String(attachment.originalFilename || attachment.displayName || attachment.caption || attachment.path || ''))).trim() || 'application/octet-stream';
-        const kind = asset?.kind || deps.inferAssetKind(storageKey || String(attachment.path || ''), mimeType);
-        const isCanonicalDocument = Boolean(asset && isCanonicalDocumentAssetRecord(asset)) || (!asset && kind === 'document');
+        const storedMimeType = String(asset?.mimeType || '').trim();
+        const inferredMimeType = inferSpecificMimeType(asset?.originalFilename, asset?.storageKey, storageKey && !/^https?:\/\//i.test(storageKey) ? storageKey : '', attachment.originalFilename, attachment.displayName, attachment.path);
+        const mimeType = (storedMimeType && storedMimeType !== 'application/octet-stream'
+            ? storedMimeType
+            : inferredMimeType) || storedMimeType || 'application/octet-stream';
+        const inferredKind = deps.inferAssetKind(asset?.originalFilename || asset?.storageKey || storageKey || String(attachment.originalFilename || attachment.path || ''), mimeType);
+        const kind = asset?.kind && asset.kind !== 'file' ? asset.kind : inferredKind;
+        const isCanonicalDocument = kind === 'document' && (!asset
+            || isCanonicalDocumentAssetRecord({
+                kind,
+                storageKey: String(asset.storageKey || storageKey || '').trim(),
+                originalFilename: String(asset.originalFilename || attachment.originalFilename || '').trim(),
+                mimeType,
+            }));
         const referenceNumber = typeof attachment.referenceNumber === 'number'
             ? attachment.referenceNumber
             : (typeof asset?.referenceNumber === 'number' ? asset.referenceNumber : null);

package/dist/server/index.js

@@ -784,7 +784,7 @@ export function createStandaloneServer(options) {
                         return;
                     }
                 }
-                if (isAuthApiPath) {
+                if (shouldApplyAuthRateLimit) {
                     const latestAuthRateSettings = resolveAuthRateLimitSettings();
                     if (latestAuthRateSettings.enabled !== authRateLimitSettings.enabled
                         || latestAuthRateSettings.maxRequests !== authRateLimitSettings.maxRequests

package/dist/server/routes/documents.js

@@ -25,6 +25,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { normalizeTaskDataRelativePath } from '../../storage/objectStorageClient.js';
+import { resolveExistingStorageKeyFilePathInsideRoot } from '../../utils/pathSafety.js';
 import { shouldUseProvisionalTaskReferences } from '../../utils/taskReferences.js';
 import { purgeExpiredDocuments } from '../../storage/documentPurge.js';
 import { parsePlan } from '../../utils/planParser.js';
@@ -427,7 +428,7 @@ export function registerDocumentRoutes(deps) {
             return;
         }
         const filePath = normalizedRelative
-            ? ensureWithinDir(path.join(basePath, normalizedRelative), basePath)
+            ? resolveExistingStorageKeyFilePathInsideRoot(basePath, normalizedRelative)
             : null;
         const ext = normalizedRelative ? path.extname(normalizedRelative).toLowerCase() : '';
         const resolvedDownloadNameBase = sanitizeDownloadFilename(requestedFilename