@taskforcehq/taskforce 0.3.327 → 0.3.328

package/dist/server/routes/tasks.js

@@ -57,7 +57,7 @@ import { resolveBuildInfo } from '../buildInfo.js';
 import { resolveRealtimeSyncFlag } from '../../sync/realtimeFeature.js';
 import { parseJsonBody } from './primitives.js';
 import { resolveRequestAccess } from '../auth.js';
-import { getRouteTimingNow, logSlowBootstrapRoute, requestBootstrapTraceId, requestHeader, requestRuntimeMode, requestUserId, resolveErrorStatusCode, serializeJsonWithTiming, setServerTimingHeader } from './shared.js';
+import { currentPerformanceTraceDiagnostics, getRouteTimingNow, logSlowBootstrapRoute, performanceTraceServerTimingMetrics, requestBootstrapTraceId, requestHeader, requestHumanActorRef, requestRuntimeMode, respondWithPerformanceTraceJson, resolveErrorStatusCode, runWithPerformanceTrace, serializeJsonWithTiming, setPerformanceTraceHeaders, setServerTimingHeader } from './shared.js';
 import { listBuiltInCustomTaxonomyLibraryPacks } from '../../shared/customTaxonomyLibrary.js';
 import { getBuiltInTaxonomyLibraryPack, listBuiltInTaxonomyLibraryPacks } from '../../shared/taxonomyLibrary.js';
 import { shouldUseProvisionalTaskReferences } from '../../utils/taskReferences.js';
@@ -177,7 +177,7 @@ export function registerTaskRoutes(deps) {
             surface: 'http',
             tenantId: core.getTenantId(),
             workspaceId,
-            actorRef: runtimeMode === 'cloud' ? (String(requestUserId(req) || '').trim() || 'user') : 'user',
+            actorRef: requestHumanActorRef(req),
             cloudClientId: 'http-cloud',
             ...(operationId ? { createOperationId: () => operationId } : {}),
         });
@@ -192,7 +192,7 @@ export function registerTaskRoutes(deps) {
             surface: 'http',
             tenantId: core.getTenantId(),
             workspaceId,
-            actorRef: runtimeMode === 'cloud' ? (String(requestUserId(req) || '').trim() || 'user') : 'user',
+            actorRef: requestHumanActorRef(req),
             cloudClientId: 'http-cloud',
             ...(operationId ? { createOperationId: () => operationId } : {}),
         });
@@ -465,9 +465,13 @@ export function registerTaskRoutes(deps) {
         if (!ensureAppAccess(req, res))
             return;
         const workspaceId = requestWorkspaceId(req);
-        const data = core.listTasks(workspaceId);
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify(data));
+        respondWithPerformanceTraceJson({
+            req,
+            res,
+            route: '/api/taskforce/tasks',
+            workspaceId,
+            load: () => core.listTasks(workspaceId),
+        });
     });
     addRoute('GET', '/api/taskforce/task-relationships', async (req, res) => {
         if (!ensureAppAccess(req, res))
@@ -480,9 +484,13 @@ export function registerTaskRoutes(deps) {
         if (!ensureAppAccess(req, res))
             return;
         const workspaceId = requestWorkspaceId(req);
-        const data = core.listDeletedTasks(workspaceId);
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify(data));
+        respondWithPerformanceTraceJson({
+            req,
+            res,
+            route: '/api/taskforce/deleted',
+            workspaceId,
+            load: () => core.listDeletedTasks(workspaceId),
+        });
     };
     // GET /api/taskforce/deleted - List deleted tasks
     addRoute('GET', '/api/taskforce/deleted', handleListDeletedTasks);
@@ -589,7 +597,7 @@ export function registerTaskRoutes(deps) {
             const durableRouter = createTaskHttpRootRouter(req, workspaceId);
             const task = durableRouter.enabled ? durableRouter.create(taskInput) : core.createTask(taskInput, {
                 workspaceId,
-                actorRef: 'user',
+                actorRef: requestHumanActorRef(req),
                 provisionalLocalReference: shouldUseProvisionalTaskReferences(requestRuntimeMode(req))
             });
             res.writeHead(201, { 'Content-Type': 'application/json' });
@@ -630,13 +638,21 @@ export function registerTaskRoutes(deps) {
             if (hasAttachments && !Array.isArray(updates.attachments)) {
                 throw new TaskforceRuleError('attachments must be an array.', 400, 'TASK_ATTACHMENT_LINKS_INVALID');
             }
+            const hasCardCover = Object.prototype.hasOwnProperty.call(updates || {}, 'cardCoverAssetId');
+            if (hasCardCover && updates.cardCoverAssetId !== null
+                && (typeof updates.cardCoverAssetId !== 'string' || !updates.cardCoverAssetId.trim())) {
+                throw new TaskforceRuleError('cardCoverAssetId must be a non-empty string or null.', 400, 'TASK_CARD_COVER_INVALID');
+            }
             const checklistDurable = hasChecklist && durableRouters.checklist.enabled;
-            const attachmentLinksDurable = hasAttachments && durableRouters.attachmentLinks.enabled;
+            const attachmentLinksDurable = (hasAttachments || hasCardCover) && durableRouters.attachmentLinks.enabled;
             const rawChecklistItems = hasChecklist ? updates.checklistItems : [];
-            const rawAttachments = hasAttachments ? updates.attachments : [];
+            const rawAttachments = hasAttachments
+                ? updates.attachments
+                : (core.getTask(params.id, workspaceId)?.attachments || []);
             const remainingUpdates = checklistDurable || attachmentLinksDurable
                 ? Object.fromEntries(Object.entries(updates).filter(([key]) => (!(checklistDurable && key === 'checklistItems')
-                    && !(attachmentLinksDurable && key === 'attachments'))))
+                    && !(attachmentLinksDurable && key === 'attachments')
+                    && !(attachmentLinksDurable && key === 'cardCoverAssetId'))))
                 : updates;
             let updated;
             const durableTargetCount = Number(checklistDurable)
@@ -657,7 +673,7 @@ export function registerTaskRoutes(deps) {
                     ? (durableRouter.enabled
                         ? durableRouter.update(params.id, remainingUpdates, saveSource)
                         : core.updateTask(params.id, remainingUpdates, workspaceId, {
-                            actorRef: 'user',
+                            actorRef: requestHumanActorRef(req),
                             saveSource,
                         }))
                     : core.getTask(params.id, workspaceId);
@@ -679,7 +695,15 @@ export function registerTaskRoutes(deps) {
                         core,
                         workspaceId,
                     });
-                    updated = attachmentLinksRouter.replace({ taskId: params.id, links }).task;
+                    updated = attachmentLinksRouter.replace({
+                        taskId: params.id,
+                        links,
+                        ...(hasCardCover ? {
+                            cardCoverAssetId: updates.cardCoverAssetId === null
+                                ? null
+                                : String(updates.cardCoverAssetId).trim(),
+                        } : {}),
+                    }).task;
                 }
             }
             if (!updated) {
@@ -766,43 +790,53 @@ export function registerTaskRoutes(deps) {
     addRoute('GET', '/api/taskforce/planning/bootstrap', async (req, res) => {
         if (!ensureAppAccess(req, res))
             return;
-        const startedAt = getRouteTimingNow();
-        const workspaceId = requestWorkspaceId(req);
-        const traceId = requestBootstrapTraceId(req);
-        const diagnostics = {};
-        const data = core.listPlanningBootstrap(workspaceId, diagnostics);
-        const serializeStartedAt = getRouteTimingNow();
-        const serialized = serializeJsonWithTiming(data, serializeStartedAt);
-        const totalDurationMs = Math.max(0, getRouteTimingNow() - startedAt);
-        const details = diagnostics;
-        setServerTimingHeader(res, [
-            { name: 'planning-bootstrap', durationMs: totalDurationMs },
-            { name: 'planning-bootstrap-initiatives', durationMs: details.initiativeLoadMs ?? 0 },
-            { name: 'planning-bootstrap-workstreams', durationMs: details.workstreamLoadMs ?? 0 },
-            { name: 'planning-bootstrap-tasks', durationMs: details.taskSummaryQueryMs ?? 0 },
-            { name: 'planning-bootstrap-build', durationMs: details.taskSummaryBuildMs ?? 0 },
-            { name: 'planning-bootstrap-json', durationMs: serialized.durationMs },
-        ]);
-        logSlowBootstrapRoute({
-            route: '/api/taskforce/planning/bootstrap',
-            workspaceId,
-            traceId,
-            durationMs: totalDurationMs,
-            details: {
-                initiativeCount: details.initiativeCount ?? 0,
-                workstreamCount: details.workstreamCount ?? 0,
-                workstreamLinkedTaskCount: details.workstreamLinkedTaskCount ?? 0,
-                workstreamTaskSummaryCount: details.workstreamTaskSummaryCount ?? 0,
-                responseBytes: serialized.byteLength,
-                initiativeLoadMs: details.initiativeLoadMs ?? 0,
-                workstreamLoadMs: details.workstreamLoadMs ?? 0,
-                taskSummaryQueryMs: details.taskSummaryQueryMs ?? 0,
-                taskSummaryBuildMs: details.taskSummaryBuildMs ?? 0,
-                jsonSerializeMs: serialized.durationMs,
-            },
+        runWithPerformanceTrace(req, () => {
+            const startedAt = getRouteTimingNow();
+            const workspaceId = requestWorkspaceId(req);
+            const traceId = requestBootstrapTraceId(req);
+            const diagnostics = {};
+            const data = core.listPlanningBootstrap(workspaceId, diagnostics);
+            const serializeStartedAt = getRouteTimingNow();
+            const serialized = serializeJsonWithTiming(data, serializeStartedAt);
+            const totalDurationMs = Math.max(0, getRouteTimingNow() - startedAt);
+            const details = diagnostics;
+            const performanceDiagnostics = currentPerformanceTraceDiagnostics();
+            setServerTimingHeader(res, [
+                { name: 'planning-bootstrap', durationMs: totalDurationMs },
+                { name: 'planning-bootstrap-initiatives', durationMs: details.initiativeLoadMs ?? 0 },
+                { name: 'planning-bootstrap-workstreams', durationMs: details.workstreamLoadMs ?? 0 },
+                { name: 'planning-bootstrap-tasks', durationMs: details.taskSummaryQueryMs ?? 0 },
+                { name: 'planning-bootstrap-build', durationMs: details.taskSummaryBuildMs ?? 0 },
+                { name: 'planning-bootstrap-json', durationMs: serialized.durationMs },
+                ...performanceTraceServerTimingMetrics(performanceDiagnostics),
+            ]);
+            setPerformanceTraceHeaders(res, performanceDiagnostics, serialized.byteLength);
+            logSlowBootstrapRoute({
+                route: '/api/taskforce/planning/bootstrap',
+                workspaceId,
+                traceId,
+                durationMs: totalDurationMs,
+                details: {
+                    initiativeCount: details.initiativeCount ?? 0,
+                    workstreamCount: details.workstreamCount ?? 0,
+                    workstreamLinkedTaskCount: details.workstreamLinkedTaskCount ?? 0,
+                    workstreamTaskSummaryCount: details.workstreamTaskSummaryCount ?? 0,
+                    responseBytes: serialized.byteLength,
+                    initiativeLoadMs: details.initiativeLoadMs ?? 0,
+                    workstreamLoadMs: details.workstreamLoadMs ?? 0,
+                    taskSummaryQueryMs: details.taskSummaryQueryMs ?? 0,
+                    taskSummaryBuildMs: details.taskSummaryBuildMs ?? 0,
+                    jsonSerializeMs: serialized.durationMs,
+                    ...(performanceDiagnostics ? {
+                        postgresQueryCount: performanceDiagnostics.postgresQueryCount,
+                        postgresWorkerCallCount: performanceDiagnostics.postgresWorkerCallCount,
+                        postgresWorkerWaitMs: Math.round(performanceDiagnostics.postgresWorkerWaitMs),
+                    } : {}),
+                },
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(serialized.body);
         });
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(serialized.body);
     });
     // POST /api/taskforce/initiative - Create initiative
     addRoute('POST', '/api/taskforce/initiative', async (req, res) => {
@@ -812,7 +846,7 @@ export function registerTaskRoutes(deps) {
         try {
             const workspaceId = requestWorkspaceId(req);
             const router = createInitiativeRouter(req, workspaceId);
-            const allowed = new Set(['id', 'title', 'description', 'ownerId', 'order', 'attachments', 'createdAt']);
+            const allowed = new Set(['id', 'title', 'description', 'ownerId', 'order', 'attachments', 'createdAt', 'icon', 'color']);
             const unsupported = Object.keys(body || {}).filter((key) => !allowed.has(key));
             if (router.enabled && unsupported.length > 0) {
                 const error = new Error(`Unsupported initiative fields: ${unsupported.sort().join(', ')}`);
@@ -826,16 +860,28 @@ export function registerTaskRoutes(deps) {
                 error.statusCode = 400;
                 throw error;
             }
-            const initiative = router.enabled
-                ? initiativeResult(router.create(String(body?.id || '').trim() || `initiative-${randomUUID()}`, {
-                    title: body?.title,
-                    description: body?.description ?? null,
-                    ownerId: body?.ownerId ?? null,
-                    order: body?.order ?? null,
-                    attachments: serializeCanonicalPlanningAttachmentLinks(body?.attachments ?? []),
-                    createdAt: String(body?.createdAt || '').trim() || new Date().toISOString(),
-                }))
-                : core.createInitiative(body || {}, workspaceId, { actorRef: 'user' });
+            const initiative = core.getDatabaseAdapter().transaction(() => {
+                const created = router.enabled
+                    ? initiativeResult(router.create(String(body?.id || '').trim() || `initiative-${randomUUID()}`, {
+                        title: body?.title,
+                        description: body?.description ?? null,
+                        ownerId: body?.ownerId ?? null,
+                        order: body?.order ?? null,
+                        attachments: serializeCanonicalPlanningAttachmentLinks(body?.attachments ?? []),
+                        createdAt: String(body?.createdAt || '').trim() || new Date().toISOString(),
+                    }))
+                    : core.createInitiative(body || {}, workspaceId, { actorRef: requestHumanActorRef(req) });
+                if (!created)
+                    throw new Error('Durable initiative capture did not return a provisional initiative.');
+                const hasIdentity = Object.prototype.hasOwnProperty.call(body || {}, 'icon')
+                    || Object.prototype.hasOwnProperty.call(body || {}, 'color');
+                return hasIdentity
+                    ? core.updatePlanningEntityIdentity('initiative', created.id, {
+                        ...(Object.prototype.hasOwnProperty.call(body || {}, 'icon') ? { icon: body.icon } : {}),
+                        ...(Object.prototype.hasOwnProperty.call(body || {}, 'color') ? { color: body.color } : {}),
+                    }, workspaceId)
+                    : created;
+            })();
             if (!initiative)
                 throw new Error('Durable initiative capture did not return a provisional initiative.');
             res.writeHead(201, { 'Content-Type': 'application/json' });
@@ -883,7 +929,7 @@ export function registerTaskRoutes(deps) {
             };
             const updated = router.enabled
                 ? initiativeResult(router.updateMetadata(params.id, durablePatch))
-                : core.updateInitiative(params.id, body || {}, workspaceId, { actorRef: 'user' });
+                : core.updateInitiative(params.id, body || {}, workspaceId, { actorRef: requestHumanActorRef(req) });
             if (!updated)
                 throw new Error('Durable initiative capture did not return a provisional initiative.');
             res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -893,6 +939,30 @@ export function registerTaskRoutes(deps) {
             writeInitiativeMutationError(res, error, 'Failed to update initiative');
         }
     });
+    addRoute('PATCH', '/api/taskforce/initiative/:id/identity', async (req, res, params) => {
+        if (!ensureAppAccess(req, res))
+            return;
+        const body = await parseJsonBody(req);
+        try {
+            const workspaceId = requestWorkspaceId(req);
+            const source = body && typeof body === 'object' && !Array.isArray(body) ? body : {};
+            const keys = Object.keys(source);
+            if (keys.length === 0 || keys.some((key) => key !== 'icon' && key !== 'color')) {
+                throw new TaskforceRuleError('Planning identity update must contain only icon or color.', 400, 'PLANNING_IDENTITY_INVALID');
+            }
+            const updated = core.updatePlanningEntityIdentity('initiative', params.id, source, workspaceId);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(updated));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                error: error instanceof Error ? error.message : 'Failed to update initiative identity',
+                code: error instanceof TaskforceRuleError ? error.code : undefined,
+            }));
+        }
+    });
     addRoute('POST', '/api/taskforce/initiative/:id/archive', async (req, res, params) => {
         if (!ensureAppAccess(req, res))
             return;
@@ -901,7 +971,7 @@ export function registerTaskRoutes(deps) {
             const router = createInitiativeRouter(req, workspaceId);
             const archived = router.enabled
                 ? initiativeResult(router.archive(params.id))
-                : core.archiveInitiative(params.id, workspaceId, { actorRef: 'user' });
+                : core.archiveInitiative(params.id, workspaceId, { actorRef: requestHumanActorRef(req) });
             if (!archived)
                 throw new Error('Durable initiative capture did not return a provisional initiative.');
             res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -919,7 +989,7 @@ export function registerTaskRoutes(deps) {
             const router = createInitiativeRouter(req, workspaceId);
             const restored = router.enabled
                 ? initiativeResult(router.unarchive(params.id))
-                : core.unarchiveInitiative(params.id, workspaceId, { actorRef: 'user' });
+                : core.unarchiveInitiative(params.id, workspaceId, { actorRef: requestHumanActorRef(req) });
             if (!restored)
                 throw new Error('Durable initiative capture did not return a provisional initiative.');
             res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -946,7 +1016,7 @@ export function registerTaskRoutes(deps) {
         try {
             const workspaceId = requestWorkspaceId(req);
             const router = createWorkstreamRouter(req, workspaceId);
-            const allowed = new Set(['id', 'initiativeId', 'title', 'description', 'ownerId', 'order', 'attachments', 'createdAt']);
+            const allowed = new Set(['id', 'initiativeId', 'title', 'description', 'ownerId', 'order', 'attachments', 'createdAt', 'icon', 'color']);
             const unsupported = Object.keys(body || {}).filter((key) => !allowed.has(key));
             if (router.enabled && unsupported.length > 0) {
                 const error = new Error(`Unsupported workstream fields: ${unsupported.sort().join(', ')}`);
@@ -960,17 +1030,29 @@ export function registerTaskRoutes(deps) {
                 error.statusCode = 400;
                 throw error;
             }
-            const workstream = router.enabled
-                ? workstreamResult(router.create(String(body?.id || '').trim(), {
-                    initiativeId: body?.initiativeId ?? null,
-                    title: body?.title,
-                    description: body?.description ?? null,
-                    ownerId: body?.ownerId ?? null,
-                    order: body?.order ?? null,
-                    attachments: serializeCanonicalPlanningAttachmentLinks(body?.attachments ?? []),
-                    createdAt: String(body?.createdAt || '').trim(),
-                }))
-                : core.createWorkstream(body || {}, workspaceId, { actorRef: 'user' });
+            const workstream = core.getDatabaseAdapter().transaction(() => {
+                const created = router.enabled
+                    ? workstreamResult(router.create(String(body?.id || '').trim(), {
+                        initiativeId: body?.initiativeId ?? null,
+                        title: body?.title,
+                        description: body?.description ?? null,
+                        ownerId: body?.ownerId ?? null,
+                        order: body?.order ?? null,
+                        attachments: serializeCanonicalPlanningAttachmentLinks(body?.attachments ?? []),
+                        createdAt: String(body?.createdAt || '').trim(),
+                    }))
+                    : core.createWorkstream(body || {}, workspaceId, { actorRef: requestHumanActorRef(req) });
+                if (!created)
+                    throw new Error('Durable workstream capture did not return a provisional workstream.');
+                const hasIdentity = Object.prototype.hasOwnProperty.call(body || {}, 'icon')
+                    || Object.prototype.hasOwnProperty.call(body || {}, 'color');
+                return hasIdentity
+                    ? core.updatePlanningEntityIdentity('workstream', created.id, {
+                        ...(Object.prototype.hasOwnProperty.call(body || {}, 'icon') ? { icon: body.icon } : {}),
+                        ...(Object.prototype.hasOwnProperty.call(body || {}, 'color') ? { color: body.color } : {}),
+                    }, workspaceId)
+                    : created;
+            })();
             if (!workstream)
                 throw new Error('Durable workstream capture did not return a provisional workstream.');
             res.writeHead(201, { 'Content-Type': 'application/json' });
@@ -1018,7 +1100,7 @@ export function registerTaskRoutes(deps) {
             };
             const updated = router.enabled
                 ? workstreamResult(router.updateMetadata(params.id, durablePatch))
-                : core.updateWorkstream(params.id, body || {}, workspaceId, { actorRef: 'user' });
+                : core.updateWorkstream(params.id, body || {}, workspaceId, { actorRef: requestHumanActorRef(req) });
             if (!updated)
                 throw new Error('Durable workstream capture did not return a provisional workstream.');
             res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -1028,6 +1110,30 @@ export function registerTaskRoutes(deps) {
             writeWorkstreamMutationError(res, error, 'Failed to update workstream');
         }
     });
+    addRoute('PATCH', '/api/taskforce/workstream/:id/identity', async (req, res, params) => {
+        if (!ensureAppAccess(req, res))
+            return;
+        const body = await parseJsonBody(req);
+        try {
+            const workspaceId = requestWorkspaceId(req);
+            const source = body && typeof body === 'object' && !Array.isArray(body) ? body : {};
+            const keys = Object.keys(source);
+            if (keys.length === 0 || keys.some((key) => key !== 'icon' && key !== 'color')) {
+                throw new TaskforceRuleError('Planning identity update must contain only icon or color.', 400, 'PLANNING_IDENTITY_INVALID');
+            }
+            const updated = core.updatePlanningEntityIdentity('workstream', params.id, source, workspaceId);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(updated));
+        }
+        catch (error) {
+            const statusCode = resolveErrorStatusCode(error, 400);
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                error: error instanceof Error ? error.message : 'Failed to update workstream identity',
+                code: error instanceof TaskforceRuleError ? error.code : undefined,
+            }));
+        }
+    });
     addRoute('POST', '/api/taskforce/workstream/:id/archive', async (req, res, params) => {
         if (!ensureAppAccess(req, res))
             return;
@@ -1036,7 +1142,7 @@ export function registerTaskRoutes(deps) {
             const router = createWorkstreamRouter(req, workspaceId);
             const archived = router.enabled
                 ? workstreamResult(router.archive(params.id))
-                : core.archiveWorkstream(params.id, workspaceId, { actorRef: 'user' });
+                : core.archiveWorkstream(params.id, workspaceId, { actorRef: requestHumanActorRef(req) });
             if (!archived)
                 throw new Error('Durable workstream capture did not return a provisional workstream.');
             res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -1054,7 +1160,7 @@ export function registerTaskRoutes(deps) {
             const router = createWorkstreamRouter(req, workspaceId);
             const restored = router.enabled
                 ? workstreamResult(router.unarchive(params.id))
-                : core.unarchiveWorkstream(params.id, workspaceId, { actorRef: 'user' });
+                : core.unarchiveWorkstream(params.id, workspaceId, { actorRef: requestHumanActorRef(req) });
             if (!restored)
                 throw new Error('Durable workstream capture did not return a provisional workstream.');
             res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -1180,9 +1286,13 @@ export function registerTaskRoutes(deps) {
         if (!ensureAppAccess(req, res))
             return;
         const workspaceId = requestWorkspaceId(req);
-        const data = core.listArchive(workspaceId);
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify(data));
+        respondWithPerformanceTraceJson({
+            req,
+            res,
+            route: '/api/taskforce/archive',
+            workspaceId,
+            load: () => core.listArchive(workspaceId),
+        });
     });
     // POST /api/taskforce/task/:id/complete - Archive as complete
     addRoute('POST', '/api/taskforce/task/:id/complete', async (req, res, params) => {
@@ -1193,7 +1303,7 @@ export function registerTaskRoutes(deps) {
             const durableRouter = createTaskHttpRootRouter(req, workspaceId);
             const archived = durableRouter.enabled
                 ? durableRouter.archive(params.id, false, null)
-                : core.archiveTask(params.id, false, undefined, workspaceId, { actorRef: 'user' });
+                : core.archiveTask(params.id, false, undefined, workspaceId, { actorRef: requestHumanActorRef(req) });
             if (!archived) {
                 res.writeHead(404, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ error: 'Task not found' }));
@@ -1221,7 +1331,7 @@ export function registerTaskRoutes(deps) {
             const durableRouter = createTaskHttpRootRouter(req, workspaceId);
             const archived = durableRouter.enabled
                 ? durableRouter.archive(params.id, true, reason)
-                : core.archiveTask(params.id, true, reason, workspaceId, { actorRef: 'user' });
+                : core.archiveTask(params.id, true, reason, workspaceId, { actorRef: requestHumanActorRef(req) });
             if (!archived) {
                 res.writeHead(404, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ error: 'Task not found' }));
@@ -1247,7 +1357,7 @@ export function registerTaskRoutes(deps) {
             const durableRouter = createTaskHttpRootRouter(req, workspaceId);
             const deleted = durableRouter.enabled
                 ? durableRouter.delete(params.id)
-                : core.softDeleteTask(params.id, workspaceId, { actorRef: 'user', source: 'ui' });
+                : core.softDeleteTask(params.id, workspaceId, { actorRef: requestHumanActorRef(req), source: 'ui' });
             if (!deleted) {
                 res.writeHead(404, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ error: 'Task not found' }));
@@ -1272,7 +1382,7 @@ export function registerTaskRoutes(deps) {
             const durableRouter = createTaskHttpRootRouter(req, workspaceId);
             const restored = durableRouter.enabled
                 ? durableRouter.restore(params.id)
-                : core.restoreDeletedTask(params.id, workspaceId, { actorRef: 'user' });
+                : core.restoreDeletedTask(params.id, workspaceId, { actorRef: requestHumanActorRef(req) });
             if (!restored) {
                 res.writeHead(404, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ error: 'Deleted task not found' }));
@@ -1362,7 +1472,7 @@ export function registerTaskRoutes(deps) {
                                 continue;
                             }
                             const task = core.restoreDeletedTask(deletedRecordId, workspaceId, {
-                                actorRef: 'user',
+                                actorRef: requestHumanActorRef(req),
                                 restoreDestination,
                             });
                             if (!task) {
@@ -1533,7 +1643,7 @@ export function registerTaskRoutes(deps) {
             const durableRouter = createTaskHttpRootRouter(req, workspaceId);
             const restored = durableRouter.enabled
                 ? durableRouter.unarchive(params.id)
-                : core.unarchiveTask(params.id, workspaceId, { actorRef: 'user' });
+                : core.unarchiveTask(params.id, workspaceId, { actorRef: requestHumanActorRef(req) });
             if (!restored) {
                 res.writeHead(404, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ error: 'Archived task not found' }));

package/dist/server/routes.js

@@ -602,7 +602,7 @@ export function createRoutes(core, context = {}) {
             taskId: input.taskId,
             workspaceId: input.workspaceId,
             action: 'task-attachments-changed',
-            actor: 'user',
+            actor: String(input.actorRef || '').trim() || 'user',
             createdAt: input.createdAt || new Date().toISOString(),
             details: {
                 changes: {
@@ -725,6 +725,7 @@ export function createRoutes(core, context = {}) {
                         asset,
                         beforeTask: taskBeforeLink,
                         createdAt: asset.updatedAt,
+                        actorRef: params.actorRef,
                     });
                 }
             }
@@ -788,7 +789,7 @@ export function createRoutes(core, context = {}) {
             return false;
         return /^workspaces\/[^/]+\/assets\/documents\/.+\.(md|markdown)$/.test(normalized);
     };
-    const resolveCanonicalDocumentRead = async (params) => {
+    const resolveCanonicalContentRead = async (params) => {
         const resolvedObjectStorage = resolveEffectiveObjectStorageConfig();
         const objectStorageClient = getObjectStorageClient();
         const { basePath } = core.getPaths();
@@ -800,17 +801,19 @@ export function createRoutes(core, context = {}) {
             : params.asset.storageProvider === 'local'
                 ? 'local'
                 : null;
+        const contentKind = params.asset.kind === 'document' ? 'document' : 'asset';
+        const contentLabel = params.asset.kind === 'document' ? 'Document' : 'Asset';
         const resolvedContent = publishedContentResolver && resolverOwnedProvider
             ? publishedContentResolver.resolve({
                 tenantId: core.getTenantId(),
                 workspaceId: params.asset.workspaceId,
-                kind: 'document',
+                kind: contentKind,
                 logicalPath: logicalStorageKey,
                 legacyProvider: resolverOwnedProvider
             })
             : {
                 source: 'legacy',
-                kind: 'document',
+                kind: contentKind,
                 logicalPath: logicalStorageKey,
                 physicalKey: logicalStorageKey,
                 storageProvider: params.asset.storageProvider
@@ -818,6 +821,31 @@ export function createRoutes(core, context = {}) {
         if (resolvedContent.source === 'deleted') {
             return { statusCode: 404 };
         }
+        if (resolvedContent.source === 'versioned' && (resolvedContent.storageProvider !== params.asset.storageProvider
+            || resolvedContent.contentSha256 !== params.asset.contentSha256
+            || resolvedContent.sizeBytes !== params.asset.sizeBytes)) {
+            return {
+                statusCode: 409,
+                headers: { 'Content-Type': 'application/json' },
+                body: Buffer.from(JSON.stringify({
+                    error: params.asset.kind === 'document'
+                        ? 'The published document head does not match the current canonical document metadata.'
+                        : 'The published asset head does not match the current canonical asset metadata.',
+                    code: params.asset.kind === 'document' ? 'MCP_DOCUMENT_HEAD_STALE' : 'WORKSPACE_ASSET_HEAD_STALE',
+                    details: {
+                        assetId: params.asset.assetId,
+                        currentVersion: params.asset.version,
+                        currentStorageProvider: params.asset.storageProvider,
+                        currentContentSha256: params.asset.contentSha256,
+                        currentSizeBytes: params.asset.sizeBytes,
+                        headVersionId: resolvedContent.versionId,
+                        headStorageProvider: resolvedContent.storageProvider,
+                        headContentSha256: resolvedContent.contentSha256,
+                        headSizeBytes: resolvedContent.sizeBytes,
+                    },
+                })),
+            };
+        }
         const physicalStorageKey = normalizeRelativeStorageKey(resolvedContent.physicalKey);
         if (!physicalStorageKey)
             return { statusCode: 404 };
@@ -852,7 +880,7 @@ export function createRoutes(core, context = {}) {
                         'Content-Disposition': contentDisposition
                     },
                     body: resolvedContent.source === 'versioned'
-                        ? verifyWorkspaceSyncPublishedContentBody(object.body, resolvedContent, `Document ${params.asset.assetId}`)
+                        ? verifyWorkspaceSyncPublishedContentBody(object.body, resolvedContent, `${contentLabel} ${params.asset.assetId}`)
                         : object.body
                 };
             }
@@ -879,7 +907,7 @@ export function createRoutes(core, context = {}) {
                     'Content-Disposition': contentDisposition
                 },
                 body: resolvedContent.source === 'versioned'
-                    ? verifyWorkspaceSyncPublishedContentBody(body, resolvedContent, `Document ${params.asset.assetId}`)
+                    ? verifyWorkspaceSyncPublishedContentBody(body, resolvedContent, `${contentLabel} ${params.asset.assetId}`)
                     : body
             };
         }
@@ -1497,7 +1525,7 @@ export function createRoutes(core, context = {}) {
         sanitizeDownloadFilename,
         contentTypeForExt,
         inferInlineDocumentFromPath,
-        resolveCanonicalDocumentRead,
+        resolveCanonicalContentRead,
         inferWorkspaceIdFromStoragePath,
         inferTaskIdFromStoragePath,
     });