@taskforcehq/taskforce 0.3.318 → 0.3.320

package/dist/TaskforceCore.js

@@ -579,14 +579,44 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         persistWorkspaceSyncStatePatch,
         refreshSetupContext
     ]);
-    const nextPath = useMemo(() => {
+    const nextTarget = useMemo(() => {
         const raw = new URLSearchParams(location.search).get('next') || '/';
-        if (!raw.startsWith('/'))
-            return '/';
-        if (raw === '/login')
+        if (raw.startsWith('/')) {
+            if (raw === '/login')
+                return '/';
+            return raw;
+        }
+        try {
+            const parsed = new URL(raw);
+            const host = parsed.hostname.toLowerCase();
+            const isLocal = host === 'localhost' || host === '127.0.0.1' || host === '::1';
+            const isTaskforceHost = host === 'taskforcehq.ai' || host.endsWith('.taskforcehq.ai');
+            if ((parsed.protocol === 'http:' || parsed.protocol === 'https:') && (isLocal || isTaskforceHost)) {
+                return parsed.toString();
+            }
+        }
+        catch {
             return '/';
-        return raw;
+        }
+        return '/';
     }, [location.search]);
+    const nextPath = useMemo(() => nextTarget.startsWith('/') ? nextTarget : '/', [nextTarget]);
+    const navigateToPostAuthTarget = useCallback((target, options) => {
+        if (!target)
+            return;
+        if (target.startsWith('/')) {
+            navigate(target, { replace: options?.replace === true });
+            return;
+        }
+        if (typeof window !== 'undefined') {
+            if (options?.replace === true) {
+                window.location.replace(target);
+            }
+            else {
+                window.location.assign(target);
+            }
+        }
+    }, [navigate]);
     const shouldReturnToCloudWorkspaceSelection = useMemo(() => {
         try {
             const parsed = new URL(nextPath, 'https://taskforce.local');
@@ -622,9 +652,9 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                 interval: selectedSignupPlanVersionId ? resolvedSignupInterval : null
             });
         }
-        return nextPath;
+        return nextTarget;
     }, [
-        nextPath,
+        nextTarget,
         planSelectionPath,
         resolvedSignupInterval,
         selectedSignupPlanId,
@@ -688,9 +718,13 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
             ? resolveWorkspaceSetupPath()
             : pendingPostAuthRedirect.path;
         const currentRoute = `${location.pathname}${location.search}${location.hash || ''}`;
-        if (currentRoute !== destination) {
-            navigate(destination, { replace: true });
+        if (destination.startsWith('/')) {
+            if (currentRoute !== destination) {
+                navigate(destination, { replace: true });
+            }
+            return;
         }
+        navigateToPostAuthTarget(destination, { replace: true });
     }, [
         authSessionResolved,
         cloudAccountAccessPending,
@@ -699,6 +733,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         location.pathname,
         location.search,
         navigate,
+        navigateToPostAuthTarget,
         pendingPostAuthRedirect,
         resolveWorkspaceSetupPath
     ]);
@@ -726,9 +761,13 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
             ? pendingPostAuthRedirect.path
             : planSelectionPath;
         const currentRoute = `${location.pathname}${location.search}${location.hash || ''}`;
-        if (currentRoute !== destination) {
-            navigate(destination, { replace: true });
+        if (destination.startsWith('/')) {
+            if (currentRoute !== destination) {
+                navigate(destination, { replace: true });
+            }
+            return;
         }
+        navigateToPostAuthTarget(destination, { replace: true });
     }, [
         accountAccessGate?.canAccessApp,
         accountAccessGateResolved,
@@ -739,6 +778,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
         location.pathname,
         location.search,
         navigate,
+        navigateToPostAuthTarget,
         pendingPostAuthRedirect,
         planSelectionPath
     ]);
@@ -901,8 +941,9 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
             if (shouldDelayAuthenticatedLoginRedirect) {
                 return;
             }
-            if (isLoginRoute && isAuthenticated && !shouldStayOnInviteRoute)
-                navigate(nextPath, { replace: true });
+            if (isLoginRoute && isAuthenticated && !shouldStayOnInviteRoute) {
+                navigateToPostAuthTarget(nextTarget, { replace: true });
+            }
         }
         else {
             if (!isLoginRoute) {
@@ -1299,7 +1340,7 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                             setLoginBusy(false);
                                             return;
                                         }
-                                        navigate(nextPath, { replace: true });
+                                        navigateToPostAuthTarget(nextTarget, { replace: true });
                                     }
                                     else if (authMode === 'login') {
                                         if (inviteToken.trim()) {
@@ -1319,14 +1360,14 @@ function TaskforceCoreWithRouter({ config = {}, initialTaskId, onTaskCountChange
                                         setLoginDisplayName('');
                                         setLoginPassword('');
                                         setLoginPasswordConfirm('');
-                                        navigate(nextPath, { replace: true });
+                                        navigateToPostAuthTarget(nextTarget, { replace: true });
                                     }
                                     else {
                                         setLoginEmail('');
                                         setLoginDisplayName('');
                                         setLoginPassword('');
                                         setLoginPasswordConfirm('');
-                                        navigate(nextPath, { replace: true });
+                                        navigateToPostAuthTarget(nextTarget, { replace: true });
                                     }
                                     setLoginBusy(false);
                                 }, children: loginBusy ? 'Working...' : (authMode === 'login' ? 'Sign In'

package/dist/server/routes/admin.js

@@ -259,11 +259,19 @@ export function registerAdminRoutes(deps) {
         }
     };
     const renderMcpOauthAuthorizePage = (input) => {
+        const scopeLabels = {
+            'tasks:read': 'Read tasks',
+            'tasks:write': 'Update tasks',
+            'workspace:read': 'Read workspace'
+        };
         const options = input.workspaces.map((workspace) => {
             const selected = workspace.id === input.preselectedWorkspaceId ? ' selected' : '';
             return `<option value="${escapeHtml(workspace.id)}"${selected}>${escapeHtml(workspace.name)} (${escapeHtml(workspace.role)})</option>`;
         }).join('');
-        const scopeBadges = input.scopes.map((scope) => `<span style="display:inline-flex;padding:6px 10px;border-radius:999px;background:#272742;border:1px solid rgba(255,255,255,0.09);font-size:12px;">${escapeHtml(scope)}</span>`).join('');
+        const scopeBadges = input.scopes.map((scope) => {
+            const label = scopeLabels[scope] || scope;
+            return `<span class="scope-chip">${escapeHtml(label)}</span>`;
+        }).join('');
         const termsUrl = 'https://taskforcehq.ai/legal/terms/';
         const privacyUrl = 'https://taskforcehq.ai/legal/privacy/';
         return `<!doctype html>
@@ -272,47 +280,62 @@ export function registerAdminRoutes(deps) {
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <title>Authorize Taskforce MCP Connector</title>
+  <link rel="stylesheet" href="/styles/fonts.css" />
   <style>
     :root { color-scheme: dark; }
-    body { margin: 0; font-family: Inter, system-ui, sans-serif; background: #111126; color: #f8f7ff; }
-    .wrap { min-height: 100vh; display: flex; align-items: center; justify-content: center; padding: 24px; }
-    .card { width: min(560px, 100%); background: rgba(22,22,44,0.95); border: 1px solid rgba(255,255,255,0.08); border-radius: 20px; box-shadow: 0 20px 80px rgba(0,0,0,0.35); padding: 28px; }
-    h1 { margin: 0 0 8px; font-size: 24px; }
-    p { margin: 0 0 16px; color: rgba(255,255,255,0.72); line-height: 1.45; }
-    label { display: block; font-size: 13px; font-weight: 600; margin: 18px 0 8px; color: rgba(255,255,255,0.9); }
-    select { width: 100%; border-radius: 14px; border: 1px solid rgba(255,255,255,0.1); background: #1a1a34; color: #fff; padding: 12px 14px; font-size: 14px; }
-    .scopes { display:flex; flex-wrap:wrap; gap:8px; margin-top:8px; }
-    .meta { margin-top: 18px; padding: 14px 16px; border-radius: 14px; background: rgba(255,255,255,0.04); border: 1px solid rgba(255,255,255,0.08); }
-    .meta p { margin: 10px 0 0; font-size: 13px; color: rgba(255,255,255,0.68); }
-    .error { margin-bottom: 16px; padding: 12px 14px; border-radius: 12px; background: rgba(255,99,132,0.12); color: #ffb6c6; border: 1px solid rgba(255,99,132,0.25); }
-    .actions { display:flex; justify-content:flex-end; gap:12px; margin-top: 24px; }
-    button { border-radius: 12px; padding: 11px 16px; font-size: 14px; font-weight: 600; cursor: pointer; border: 1px solid rgba(255,255,255,0.08); }
-    button[name="decision"][value="deny"] { background: transparent; color: rgba(255,255,255,0.85); }
-    button[name="decision"][value="approve"] { background: #8d6bff; color: white; border-color: rgba(141,107,255,0.6); }
-    a { color: #b9d6ff; }
+    body { margin: 0; font-family: "Outfit", -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; background: radial-gradient(circle at top, rgba(255,138,0,0.08), transparent 30%), #111126; color: #f8f7ff; }
+    .wrap { min-height: 100vh; display: flex; align-items: center; justify-content: center; padding: 32px 24px; }
+    .card { width: min(720px, 100%); background: rgba(22,22,44,0.95); border: 1px solid rgba(255,255,255,0.08); border-radius: 32px; box-shadow: 0 24px 80px rgba(0,0,0,0.35); padding: 40px 48px; }
+    h1 { margin: 0; font-size: clamp(1.95rem, 4.2vw, 2.6rem); line-height: 1.02; letter-spacing: -0.035em; color: #f8f7ff; }
+    .lede { margin: 16px 0 8px; font-size: 1.1rem; line-height: 1.45; color: rgba(255,255,255,0.78); max-width: 48ch; text-wrap: pretty; }
+    .lede strong { color: #fff; }
+    .session-row { display: flex; align-items: center; gap: 14px; flex-wrap: wrap; margin: 0 0 28px; }
+    .user-meta { margin: 0; color: rgba(255,255,255,0.5); font-size: 0.9rem; }
+    .account-switch { padding: 0; border: 0; min-width: 0; background: transparent; color: #cbd8ff; font-size: 0.9rem; font-weight: 600; box-shadow: none; }
+    .account-switch:hover { transform: none; color: #ffffff; text-decoration: underline; }
+    label { display: block; font-size: 13px; font-weight: 700; margin: 24px 0 10px; color: rgba(255,255,255,0.92); letter-spacing: 0.01em; }
+    select { width: 100%; border-radius: 18px; border: 1px solid rgba(255,255,255,0.1); background: #1f2039; color: #fff; padding: 16px 18px; font-size: 15px; font-weight: 600; box-shadow: inset 0 1px 0 rgba(255,255,255,0.02); }
+    .scopes { display:flex; flex-wrap:wrap; gap:10px; margin-top:8px; }
+    .scope-chip { display:inline-flex; padding:8px 14px; border-radius:999px; background:#2a2947; border:1px solid rgba(255,255,255,0.09); font-size:13px; font-weight:600; color:rgba(255,255,255,0.92); }
+    .legal { margin: 28px 2px 0; color: rgba(255,255,255,0.58); font-size: 0.9rem; line-height: 1.55; max-width: 58ch; }
+    .error { margin-bottom: 18px; padding: 12px 14px; border-radius: 14px; background: rgba(255,99,132,0.12); color: #ffb6c6; border: 1px solid rgba(255,99,132,0.25); }
+    .actions { display:flex; justify-content:flex-end; gap:14px; margin-top: 36px; }
+    button { border-radius: 18px; padding: 15px 22px; font-size: 15px; font-weight: 700; cursor: pointer; border: 1px solid rgba(255,255,255,0.08); min-width: 156px; transition: transform 160ms ease, box-shadow 160ms ease, border-color 160ms ease, background-color 160ms ease; }
+    button:hover { transform: translateY(-1px); }
+    button[name="decision"][value="deny"] { background: transparent; color: rgba(255,255,255,0.88); border-color: rgba(255,255,255,0.12); }
+    button[name="decision"][value="approve"] { background: linear-gradient(135deg, #8d6bff 0%, #7c59f1 100%); color: white; border-color: rgba(141,107,255,0.6); box-shadow: 0 14px 28px rgba(141,107,255,0.26); }
+    a { color: #cbd8ff; }
+    @media (max-width: 720px) {
+      .card { padding: 30px 22px; border-radius: 28px; }
+      h1 { font-size: 1.85rem; }
+      .lede { max-width: none; }
+      .actions { flex-direction: column-reverse; }
+      button { width: 100%; }
+    }
   </style>
 </head>
 <body>
   <div class="wrap">
     <form class="card" method="post" action="/oauth/mcp/authorize">
       <h1>Authorize Taskforce Connector</h1>
-      <p>${escapeHtml(input.clientName)} wants access to Taskforce MCP for ${escapeHtml(input.userName)}.</p>
+      <p class="lede"><strong>${escapeHtml(input.clientName)}</strong> wants to connect to Taskforce for <strong>${escapeHtml(input.userName)}</strong>.</p>
+      <div class="session-row">
+        ${input.userMeta ? `<p class="user-meta">Signed in as ${escapeHtml(input.userMeta)}</p>` : ''}
+        <button class="account-switch" type="submit" formaction="/api/taskforce/auth/logout" formmethod="post" formnovalidate>Use different account</button>
+      </div>
       ${input.error ? `<div class="error">${escapeHtml(input.error)}</div>` : ''}
-      <label for="workspaceId">Workspace</label>
+      <label for="workspaceId">Select Workspace</label>
       <select id="workspaceId" name="workspaceId" required>${options}</select>
-      <label>Requested Scopes</label>
+      <label>Requested Permissions</label>
       <div class="scopes">${scopeBadges}</div>
-      <div class="meta">
-        <div><strong>Client:</strong> ${escapeHtml(input.clientName)}</div>
-        <div><strong>Redirect URI:</strong> ${escapeHtml(input.redirectUri)}</div>
-        <p>By authorizing this connector, you agree to Taskforce&apos;s <a href="${termsUrl}" target="_blank" rel="noopener noreferrer">Terms of Service</a> and acknowledge the <a href="${privacyUrl}" target="_blank" rel="noopener noreferrer">Privacy Policy</a>.</p>
-      </div>
+      <p class="legal">By authorizing this connector, you agree to Taskforce&apos;s <a href="${termsUrl}" target="_blank" rel="noopener noreferrer">Terms of Service</a> and acknowledge the <a href="${privacyUrl}" target="_blank" rel="noopener noreferrer">Privacy Policy</a>.</p>
       <input type="hidden" name="client_id" value="${escapeHtml(input.clientId)}" />
       <input type="hidden" name="redirect_uri" value="${escapeHtml(input.redirectUri)}" />
       <input type="hidden" name="scope" value="${escapeHtml(input.scopes.join(' '))}" />
       <input type="hidden" name="state" value="${escapeHtml(input.state)}" />
       <input type="hidden" name="code_challenge" value="${escapeHtml(input.codeChallenge)}" />
       <input type="hidden" name="code_challenge_method" value="${escapeHtml(input.codeChallengeMethod)}" />
+      <input type="hidden" name="next" value="${escapeHtml(input.authorizeUrl)}" />
       <div class="actions">
         <button type="submit" name="decision" value="deny">Cancel</button>
         <button type="submit" name="decision" value="approve">Authorize</button>
@@ -2481,13 +2504,15 @@ export function registerAdminRoutes(deps) {
     addRoute('POST', '/mcp/', async (req, res) => { await handleCloudMcpRequest(req, res); });
     addRoute('GET', '/mcp', async (req, res) => { await handleCloudMcpRequest(req, res); });
     addRoute('GET', '/mcp/', async (req, res) => { await handleCloudMcpRequest(req, res); });
+    addRoute('HEAD', '/mcp', async (req, res) => { await handleCloudMcpRequest(req, res); });
+    addRoute('HEAD', '/mcp/', async (req, res) => { await handleCloudMcpRequest(req, res); });
     addRoute('DELETE', '/mcp', async (req, res) => { await handleCloudMcpRequest(req, res); });
     addRoute('DELETE', '/mcp/', async (req, res) => { await handleCloudMcpRequest(req, res); });
     addRoute('OPTIONS', '/mcp', async (_req, res) => {
         res.writeHead(204, {
             'Access-Control-Allow-Origin': '*',
             'Access-Control-Allow-Headers': 'authorization, content-type, accept, last-event-id, mcp-protocol-version, mcp-session-id, x-taskforce-workspace-id, x-taskforce-ai-profile-token, x-taskforce-ai-name, x-taskforce-ai-icon, x-taskforce-ai-color, x-taskforce-ai-description, x-taskforce-ai-role, x-taskforce-ai-provider, x-taskforce-ai-model, x-taskforce-ai-surface-type',
-            'Access-Control-Allow-Methods': 'GET, POST, DELETE, OPTIONS'
+            'Access-Control-Allow-Methods': 'GET, HEAD, POST, DELETE, OPTIONS'
         });
         res.end();
     });
@@ -2495,7 +2520,7 @@ export function registerAdminRoutes(deps) {
         res.writeHead(204, {
             'Access-Control-Allow-Origin': '*',
             'Access-Control-Allow-Headers': 'authorization, content-type, accept, last-event-id, mcp-protocol-version, mcp-session-id, x-taskforce-workspace-id, x-taskforce-ai-profile-token, x-taskforce-ai-name, x-taskforce-ai-icon, x-taskforce-ai-color, x-taskforce-ai-description, x-taskforce-ai-role, x-taskforce-ai-provider, x-taskforce-ai-model, x-taskforce-ai-surface-type',
-            'Access-Control-Allow-Methods': 'GET, POST, DELETE, OPTIONS'
+            'Access-Control-Allow-Methods': 'GET, HEAD, POST, DELETE, OPTIONS'
         });
         res.end();
     });
@@ -2515,6 +2540,21 @@ export function registerAdminRoutes(deps) {
             scopes_supported: ['tasks:read', 'tasks:write', 'workspace:read'],
         }));
     });
+    addRoute('HEAD', '/.well-known/oauth-authorization-server', async (req, res) => {
+        const issuer = resolveMcpOauthIssuer(req);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            issuer,
+            authorization_endpoint: resolveMcpOauthAuthorizeUrl(req),
+            token_endpoint: resolveMcpOauthTokenUrl(req),
+            registration_endpoint: resolveMcpOauthRegisterUrl(req),
+            response_types_supported: ['code'],
+            grant_types_supported: ['authorization_code'],
+            token_endpoint_auth_methods_supported: ['none'],
+            code_challenge_methods_supported: ['S256'],
+            scopes_supported: ['tasks:read', 'tasks:write', 'workspace:read'],
+        }));
+    });
     addRoute('GET', '/.well-known/oauth-protected-resource', async (req, res) => {
         const issuer = resolveMcpOauthIssuer(req);
         res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -2524,6 +2564,15 @@ export function registerAdminRoutes(deps) {
             bearer_methods_supported: ['header'],
         }));
     });
+    addRoute('HEAD', '/.well-known/oauth-protected-resource', async (req, res) => {
+        const issuer = resolveMcpOauthIssuer(req);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            resource: resolveMcpOauthResourceUrl(req),
+            authorization_servers: [issuer],
+            bearer_methods_supported: ['header'],
+        }));
+    });
     addRoute('POST', '/oauth/mcp/register', async (req, res) => {
         if (!ensureAppAccess(req, res))
             return;
@@ -2606,8 +2655,77 @@ export function registerAdminRoutes(deps) {
             if (workspaces.length === 0)
                 throw new TaskforceRuleError('No accessible workspaces found for this user', 403, 'MCP_OAUTH_WORKSPACE_REQUIRED');
             const preferredWorkspaceId = workspaces.find((workspace) => workspace.id === String(access.workspaceId || '').trim())?.id || workspaces[0].id;
+            const userIdentity = core.resolveUserIdentity(access.userId);
+            const userName = String(userIdentity?.displayName || userIdentity?.email || access.userId).trim() || String(access.userId);
+            const userMeta = userIdentity?.email && userIdentity.email !== userName ? String(userIdentity.email).trim() : null;
+            const authorizeUrl = new URL('/oauth/mcp/authorize', resolveMcpOauthIssuer(req));
+            authorizeUrl.searchParams.set('client_id', clientId);
+            authorizeUrl.searchParams.set('redirect_uri', redirectUri);
+            authorizeUrl.searchParams.set('response_type', responseType);
+            authorizeUrl.searchParams.set('code_challenge', codeChallenge);
+            authorizeUrl.searchParams.set('code_challenge_method', codeChallengeMethod);
+            if (state)
+                authorizeUrl.searchParams.set('state', state);
+            if (scopes.length > 0)
+                authorizeUrl.searchParams.set('scope', scopes.join(' '));
+            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+            res.end(renderMcpOauthAuthorizePage({ userName, userMeta, authorizeUrl: authorizeUrl.toString(), workspaces, preselectedWorkspaceId: preferredWorkspaceId, clientName: clientRecord.clientName, clientId: clientRecord.id, redirectUri, scopes, state, codeChallenge, codeChallengeMethod }));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'invalid_request', error_description: error.message, code: error?.code || 'MCP_OAUTH_AUTHORIZE_FAILED' }));
+        }
+    });
+    addRoute('HEAD', '/oauth/mcp/authorize', async (req, res) => {
+        if (!ensureAppAccess(req, res))
+            return;
+        const reqUrl = new URL(req.url || '/oauth/mcp/authorize', resolveMcpOauthIssuer(req));
+        const clientId = String(reqUrl.searchParams.get('client_id') || '').trim();
+        const redirectUri = String(reqUrl.searchParams.get('redirect_uri') || '').trim();
+        const responseType = String(reqUrl.searchParams.get('response_type') || '').trim();
+        const state = String(reqUrl.searchParams.get('state') || '').trim();
+        const codeChallenge = String(reqUrl.searchParams.get('code_challenge') || '').trim();
+        const codeChallengeMethod = String(reqUrl.searchParams.get('code_challenge_method') || 'S256').trim() || 'S256';
+        const scopes = normalizeMcpOauthScopeString(reqUrl.searchParams.get('scope'));
+        if (responseType !== 'code' || !clientId || !redirectUri || !codeChallenge) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'invalid_request', error_description: 'client_id, redirect_uri, response_type=code, and code_challenge are required.' }));
+            return;
+        }
+        const access = context.authConfig ? resolveRequestAccess(req, context.authConfig) : null;
+        if (!access?.authenticated || !access.userId || access.userId === 'anonymous') {
+            res.writeHead(302, { Location: `${resolveCloudLoginBaseUrl(req)}/login?next=${encodeURIComponent(reqUrl.toString())}` });
+            res.end();
+            return;
+        }
+        try {
+            const clientRecord = core.getMcpOAuthClient(clientId);
+            if (!clientRecord)
+                throw new TaskforceRuleError('OAuth client not found', 404, 'MCP_OAUTH_CLIENT_NOT_FOUND');
+            if (!clientRecord.redirectUris.includes(redirectUri))
+                throw new TaskforceRuleError('Redirect URI is not registered for this OAuth client', 400, 'MCP_OAUTH_REDIRECT_URI_INVALID');
+            const workspaces = core.listUserWorkspaces(access.userId)
+                .map((workspace) => ({ id: String(workspace.id || '').trim(), name: String(workspace.name || workspace.slug || workspace.id || 'Workspace'), role: String(workspace.role || 'member') }))
+                .filter((workspace) => Boolean(workspace.id));
+            if (workspaces.length === 0)
+                throw new TaskforceRuleError('No accessible workspaces found for this user', 403, 'MCP_OAUTH_WORKSPACE_REQUIRED');
+            const preferredWorkspaceId = workspaces.find((workspace) => workspace.id === String(access.workspaceId || '').trim())?.id || workspaces[0].id;
+            const userIdentity = core.resolveUserIdentity(access.userId);
+            const userName = String(userIdentity?.displayName || userIdentity?.email || access.userId).trim() || String(access.userId);
+            const userMeta = userIdentity?.email && userIdentity.email !== userName ? String(userIdentity.email).trim() : null;
+            const authorizeUrl = new URL('/oauth/mcp/authorize', resolveMcpOauthIssuer(req));
+            authorizeUrl.searchParams.set('client_id', clientId);
+            authorizeUrl.searchParams.set('redirect_uri', redirectUri);
+            authorizeUrl.searchParams.set('response_type', responseType);
+            authorizeUrl.searchParams.set('code_challenge', codeChallenge);
+            authorizeUrl.searchParams.set('code_challenge_method', codeChallengeMethod);
+            if (state)
+                authorizeUrl.searchParams.set('state', state);
+            if (scopes.length > 0)
+                authorizeUrl.searchParams.set('scope', scopes.join(' '));
             res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-            res.end(renderMcpOauthAuthorizePage({ userName: String(access.userId), workspaces, preselectedWorkspaceId: preferredWorkspaceId, clientName: clientRecord.clientName, clientId: clientRecord.id, redirectUri, scopes, state, codeChallenge, codeChallengeMethod }));
+            res.end(renderMcpOauthAuthorizePage({ userName, userMeta, authorizeUrl: authorizeUrl.toString(), workspaces, preselectedWorkspaceId: preferredWorkspaceId, clientName: clientRecord.clientName, clientId: clientRecord.id, redirectUri, scopes, state, codeChallenge, codeChallengeMethod }));
         }
         catch (error) {
             const statusCode = resolveErrorStatusCode(error);

package/dist/server/routes/auth.js

@@ -2068,7 +2068,31 @@ export function registerAuthRoutes(deps) {
         for (const domain of domains) {
             clearCookies.push(`${clearBase}; Domain=${domain}`);
         }
+        const body = await parseFormBody(req);
+        const requestedNext = String(body.next || '').trim();
+        const next = (() => {
+            if (!requestedNext)
+                return '';
+            try {
+                const parsed = new URL(requestedNext);
+                const host = parsed.hostname.toLowerCase();
+                const isLocal = host === 'localhost' || host === '127.0.0.1' || host === '::1';
+                const isTaskforceHost = host === 'taskforcehq.ai' || host.endsWith('.taskforcehq.ai');
+                if ((parsed.protocol === 'http:' || parsed.protocol === 'https:') && (isLocal || isTaskforceHost)) {
+                    return parsed.toString();
+                }
+            }
+            catch {
+                return '';
+            }
+            return '';
+        })();
         res.setHeader('Set-Cookie', [...new Set(clearCookies)]);
+        if (next) {
+            res.writeHead(303, { Location: next });
+            res.end();
+            return;
+        }
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ success: true }));
     });

package/dist/server/routes.js

@@ -1262,11 +1262,19 @@ export function createRoutes(core, context = {}) {
     const resolveMcpOauthRegisterUrl = (req) => `${resolveMcpOauthIssuer(req)}/oauth/mcp/register`;
     const resolveMcpOauthResourceUrl = (req) => `${resolveMcpOauthIssuer(req)}/mcp`;
     const renderMcpOauthAuthorizePage = (input) => {
+        const scopeLabels = {
+            'tasks:read': 'Read tasks',
+            'tasks:write': 'Update tasks',
+            'workspace:read': 'Read workspace'
+        };
         const options = input.workspaces.map((workspace) => {
             const selected = workspace.id === input.preselectedWorkspaceId ? ' selected' : '';
             return `<option value="${escapeHtml(workspace.id)}"${selected}>${escapeHtml(workspace.name)} (${escapeHtml(workspace.role)})</option>`;
         }).join('');
-        const scopeBadges = input.scopes.map((scope) => `<span style="display:inline-flex;padding:6px 10px;border-radius:999px;background:#272742;border:1px solid rgba(255,255,255,0.09);font-size:12px;">${escapeHtml(scope)}</span>`).join('');
+        const scopeBadges = input.scopes.map((scope) => {
+            const label = scopeLabels[scope] || scope;
+            return `<span class="scope-chip">${escapeHtml(label)}</span>`;
+        }).join('');
         const termsUrl = 'https://taskforcehq.ai/legal/terms/';
         const privacyUrl = 'https://taskforcehq.ai/legal/privacy/';
         return `<!doctype html>
@@ -1275,47 +1283,62 @@ export function createRoutes(core, context = {}) {
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <title>Authorize Taskforce MCP Connector</title>
+  <link rel="stylesheet" href="/styles/fonts.css" />
   <style>
     :root { color-scheme: dark; }
-    body { margin: 0; font-family: Inter, system-ui, sans-serif; background: #111126; color: #f8f7ff; }
-    .wrap { min-height: 100vh; display: flex; align-items: center; justify-content: center; padding: 24px; }
-    .card { width: min(560px, 100%); background: rgba(22,22,44,0.95); border: 1px solid rgba(255,255,255,0.08); border-radius: 20px; box-shadow: 0 20px 80px rgba(0,0,0,0.35); padding: 28px; }
-    h1 { margin: 0 0 8px; font-size: 24px; }
-    p { margin: 0 0 16px; color: rgba(255,255,255,0.72); line-height: 1.45; }
-    label { display: block; font-size: 13px; font-weight: 600; margin: 18px 0 8px; color: rgba(255,255,255,0.9); }
-    select { width: 100%; border-radius: 14px; border: 1px solid rgba(255,255,255,0.1); background: #1a1a34; color: #fff; padding: 12px 14px; font-size: 14px; }
-    .scopes { display:flex; flex-wrap:wrap; gap:8px; margin-top:8px; }
-    .meta { margin-top: 18px; padding: 14px 16px; border-radius: 14px; background: rgba(255,255,255,0.04); border: 1px solid rgba(255,255,255,0.08); }
-    .meta p { margin: 10px 0 0; font-size: 13px; color: rgba(255,255,255,0.68); }
-    .error { margin-bottom: 16px; padding: 12px 14px; border-radius: 12px; background: rgba(255,99,132,0.12); color: #ffb6c6; border: 1px solid rgba(255,99,132,0.25); }
-    .actions { display:flex; justify-content:flex-end; gap:12px; margin-top: 24px; }
-    button { border-radius: 12px; padding: 11px 16px; font-size: 14px; font-weight: 600; cursor: pointer; border: 1px solid rgba(255,255,255,0.08); }
-    button[name="decision"][value="deny"] { background: transparent; color: rgba(255,255,255,0.85); }
-    button[name="decision"][value="approve"] { background: #8d6bff; color: white; border-color: rgba(141,107,255,0.6); }
-    a { color: #b9d6ff; }
+    body { margin: 0; font-family: "Outfit", -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; background: radial-gradient(circle at top, rgba(255,138,0,0.08), transparent 30%), #111126; color: #f8f7ff; }
+    .wrap { min-height: 100vh; display: flex; align-items: center; justify-content: center; padding: 32px 24px; }
+    .card { width: min(720px, 100%); background: rgba(22,22,44,0.95); border: 1px solid rgba(255,255,255,0.08); border-radius: 32px; box-shadow: 0 24px 80px rgba(0,0,0,0.35); padding: 40px 48px; }
+    h1 { margin: 0; font-size: clamp(1.95rem, 4.2vw, 2.6rem); line-height: 1.02; letter-spacing: -0.035em; color: #f8f7ff; }
+    .lede { margin: 16px 0 8px; font-size: 1.1rem; line-height: 1.45; color: rgba(255,255,255,0.78); max-width: 48ch; text-wrap: pretty; }
+    .lede strong { color: #fff; }
+    .session-row { display: flex; align-items: center; gap: 14px; flex-wrap: wrap; margin: 0 0 28px; }
+    .user-meta { margin: 0; color: rgba(255,255,255,0.5); font-size: 0.9rem; }
+    .account-switch { padding: 0; border: 0; min-width: 0; background: transparent; color: #cbd8ff; font-size: 0.9rem; font-weight: 600; box-shadow: none; }
+    .account-switch:hover { transform: none; color: #ffffff; text-decoration: underline; }
+    label { display: block; font-size: 13px; font-weight: 700; margin: 24px 0 10px; color: rgba(255,255,255,0.92); letter-spacing: 0.01em; }
+    select { width: 100%; border-radius: 18px; border: 1px solid rgba(255,255,255,0.1); background: #1f2039; color: #fff; padding: 16px 18px; font-size: 15px; font-weight: 600; box-shadow: inset 0 1px 0 rgba(255,255,255,0.02); }
+    .scopes { display:flex; flex-wrap:wrap; gap:10px; margin-top:8px; }
+    .scope-chip { display:inline-flex; padding:8px 14px; border-radius:999px; background:#2a2947; border:1px solid rgba(255,255,255,0.09); font-size:13px; font-weight:600; color:rgba(255,255,255,0.92); }
+    .legal { margin: 28px 2px 0; color: rgba(255,255,255,0.58); font-size: 0.9rem; line-height: 1.55; max-width: 58ch; }
+    .error { margin-bottom: 18px; padding: 12px 14px; border-radius: 14px; background: rgba(255,99,132,0.12); color: #ffb6c6; border: 1px solid rgba(255,99,132,0.25); }
+    .actions { display:flex; justify-content:flex-end; gap:14px; margin-top: 36px; }
+    button { border-radius: 18px; padding: 15px 22px; font-size: 15px; font-weight: 700; cursor: pointer; border: 1px solid rgba(255,255,255,0.08); min-width: 156px; transition: transform 160ms ease, box-shadow 160ms ease, border-color 160ms ease, background-color 160ms ease; }
+    button:hover { transform: translateY(-1px); }
+    button[name="decision"][value="deny"] { background: transparent; color: rgba(255,255,255,0.88); border-color: rgba(255,255,255,0.12); }
+    button[name="decision"][value="approve"] { background: linear-gradient(135deg, #8d6bff 0%, #7c59f1 100%); color: white; border-color: rgba(141,107,255,0.6); box-shadow: 0 14px 28px rgba(141,107,255,0.26); }
+    a { color: #cbd8ff; }
+    @media (max-width: 720px) {
+      .card { padding: 30px 22px; border-radius: 28px; }
+      h1 { font-size: 1.85rem; }
+      .lede { max-width: none; }
+      .actions { flex-direction: column-reverse; }
+      button { width: 100%; }
+    }
   </style>
 </head>
 <body>
   <div class="wrap">
     <form class="card" method="post" action="/oauth/mcp/authorize">
       <h1>Authorize Taskforce Connector</h1>
-      <p>${escapeHtml(input.clientName)} wants access to Taskforce MCP for ${escapeHtml(input.userName)}.</p>
+      <p class="lede"><strong>${escapeHtml(input.clientName)}</strong> wants to connect to Taskforce for <strong>${escapeHtml(input.userName)}</strong>.</p>
+      <div class="session-row">
+        ${input.userMeta ? `<p class="user-meta">Signed in as ${escapeHtml(input.userMeta)}</p>` : ''}
+        <button class="account-switch" type="submit" formaction="/api/taskforce/auth/logout" formmethod="post" formnovalidate>Use different account</button>
+      </div>
       ${input.error ? `<div class="error">${escapeHtml(input.error)}</div>` : ''}
-      <label for="workspaceId">Workspace</label>
+      <label for="workspaceId">Select Workspace</label>
       <select id="workspaceId" name="workspaceId" required>${options}</select>
-      <label>Requested Scopes</label>
+      <label>Requested Permissions</label>
       <div class="scopes">${scopeBadges}</div>
-      <div class="meta">
-        <div><strong>Client:</strong> ${escapeHtml(input.clientName)}</div>
-        <div><strong>Redirect URI:</strong> ${escapeHtml(input.redirectUri)}</div>
-        <p>By authorizing this connector, you agree to Taskforce&apos;s <a href="${termsUrl}" target="_blank" rel="noopener noreferrer">Terms of Service</a> and acknowledge the <a href="${privacyUrl}" target="_blank" rel="noopener noreferrer">Privacy Policy</a>.</p>
-      </div>
+      <p class="legal">By authorizing this connector, you agree to Taskforce&apos;s <a href="${termsUrl}" target="_blank" rel="noopener noreferrer">Terms of Service</a> and acknowledge the <a href="${privacyUrl}" target="_blank" rel="noopener noreferrer">Privacy Policy</a>.</p>
       <input type="hidden" name="client_id" value="${escapeHtml(input.clientId)}" />
       <input type="hidden" name="redirect_uri" value="${escapeHtml(input.redirectUri)}" />
       <input type="hidden" name="scope" value="${escapeHtml(input.scopes.join(' '))}" />
       <input type="hidden" name="state" value="${escapeHtml(input.state)}" />
       <input type="hidden" name="code_challenge" value="${escapeHtml(input.codeChallenge)}" />
       <input type="hidden" name="code_challenge_method" value="${escapeHtml(input.codeChallengeMethod)}" />
+      <input type="hidden" name="next" value="${escapeHtml(input.authorizeUrl)}" />
       <div class="actions">
         <button type="submit" name="decision" value="deny">Cancel</button>
         <button type="submit" name="decision" value="approve">Authorize</button>