@taskforcehq/taskforce 0.3.328 → 0.3.330

package/dist/services/ownerScopedModelConnectionGateway.js

@@ -0,0 +1,30 @@
+export class OwnerScopedModelConnectionGateway {
+    connectionService;
+    ownerUserId;
+    connectionId;
+    createGateway;
+    constructor(connectionService, ownerUserId, connectionId, createGateway) {
+        this.connectionService = connectionService;
+        this.ownerUserId = ownerUserId;
+        this.connectionId = connectionId;
+        this.createGateway = createGateway;
+    }
+    generate(input) {
+        return this.connectionService.withConnectionLease({
+            ownerUserId: this.ownerUserId,
+            connectionId: this.connectionId,
+            operation: 'invoke',
+        }, async (context) => {
+            const result = await this.createGateway(context).generate(input);
+            return {
+                ...result,
+                sourceMetadata: {
+                    modelSource: 'subscription_dev',
+                    connectionScope: 'personal',
+                    providerKey: context.connection.providerKey,
+                    billable: false,
+                },
+            };
+        });
+    }
+}

package/dist/services/taskforceAgentConnectionBindingService.d.ts

@@ -0,0 +1,66 @@
+import type { TaskforceAgentStore } from '../storage/taskforceAgentStore.js';
+import type { ModelProviderConnectionRecord, ModelProviderConnectionStore } from '../storage/modelProviderConnectionStore.js';
+import type { TaskforceAgentConnectionBindingRecord, TaskforceAgentConnectionBindingStore } from '../storage/taskforceAgentConnectionBindingStore.js';
+import type { ModelProviderConnectionService } from './modelProviderConnectionService.js';
+export declare class TaskforceAgentConnectionBindingError extends Error {
+    readonly statusCode: number;
+    readonly code: string;
+    constructor(message: string, statusCode: number, code: string);
+}
+type AgentStore = Pick<TaskforceAgentStore, 'get'>;
+type ConnectionStore = Pick<ModelProviderConnectionStore, 'getOwned'>;
+type BindingStore = Pick<TaskforceAgentConnectionBindingStore, 'get' | 'bind' | 'clear'>;
+type ConnectionRuntime = Pick<ModelProviderConnectionService, 'assertReady' | 'withConnectionLease'>;
+export interface ResolvedTaskforceAgentConnectionBinding {
+    binding: TaskforceAgentConnectionBindingRecord;
+    connection: ModelProviderConnectionRecord;
+}
+export interface PublicTaskforceAgentConnectionBinding {
+    bound: boolean;
+    available: boolean;
+    providerKey?: string;
+    modelSource?: string;
+    ownerIsCaller?: boolean;
+    connectionId?: string;
+    reasonCode?: string;
+}
+export declare class TaskforceAgentConnectionBindingService {
+    private readonly bindings;
+    private readonly agents;
+    private readonly connections;
+    private readonly connectionRuntime;
+    private readonly hasGrant;
+    constructor(bindings: BindingStore, agents: AgentStore, connections: ConnectionStore, connectionRuntime: ConnectionRuntime, hasGrant: (userId: string) => boolean);
+    inspect(input: {
+        workspaceId: string;
+        agentId: string;
+        callerUserId: string;
+    }): PublicTaskforceAgentConnectionBinding;
+    bind(input: {
+        workspaceId: string;
+        agentId: string;
+        connectionId: string;
+        actorUserId: string;
+    }): Promise<TaskforceAgentConnectionBindingRecord>;
+    clear(input: {
+        workspaceId: string;
+        agentId: string;
+        actorUserId: string;
+    }): boolean;
+    resolveSaved(input: {
+        workspaceId: string;
+        agentId: string;
+        callerUserId: string;
+    }): ResolvedTaskforceAgentConnectionBinding;
+    resolveDraft(input: {
+        callerUserId: string;
+        connectionId: string;
+        providerKey: string;
+    }): ModelProviderConnectionRecord;
+    private requireBindableAgentSelection;
+    private requireOwnedActiveConnection;
+    private requireOwnedReadyConnection;
+    private assertCompatibleConnection;
+    private assertGranted;
+}
+export {};

package/dist/services/taskforceAgentConnectionBindingService.js

@@ -0,0 +1,185 @@
+export class TaskforceAgentConnectionBindingError extends Error {
+    statusCode;
+    code;
+    constructor(message, statusCode, code) {
+        super(message);
+        this.statusCode = statusCode;
+        this.code = code;
+        this.name = 'TaskforceAgentConnectionBindingError';
+    }
+}
+const SUBSCRIPTION_AUTHENTICATION_TYPES = {
+    openai: 'chatgpt_device_code',
+};
+function requireIdentity(value) {
+    const normalized = String(value || '').trim();
+    if (!normalized) {
+        throw new TaskforceAgentConnectionBindingError('Authentication is required.', 401, 'AUTH_REQUIRED');
+    }
+    return normalized;
+}
+export class TaskforceAgentConnectionBindingService {
+    bindings;
+    agents;
+    connections;
+    connectionRuntime;
+    hasGrant;
+    constructor(bindings, agents, connections, connectionRuntime, hasGrant) {
+        this.bindings = bindings;
+        this.agents = agents;
+        this.connections = connections;
+        this.connectionRuntime = connectionRuntime;
+        this.hasGrant = hasGrant;
+    }
+    inspect(input) {
+        const callerUserId = requireIdentity(input.callerUserId);
+        const agent = this.agents.get(input.workspaceId, input.agentId);
+        if (!agent || agent.deletedAt) {
+            throw new TaskforceAgentConnectionBindingError('Taskforce Agent was not found.', 404, 'TASKFORCE_AGENT_NOT_FOUND');
+        }
+        const binding = this.bindings.get(input.workspaceId, input.agentId);
+        if (!binding)
+            return { bound: false, available: false, reasonCode: 'MODEL_CONNECTION_REQUIRED' };
+        const selection = agent.definition?.model;
+        const ownerIsCaller = binding.ownerUserId === callerUserId;
+        const callerGranted = this.hasGrant(callerUserId);
+        const ownerGranted = this.hasGrant(binding.ownerUserId);
+        let connectionReady = false;
+        if (callerGranted && ownerGranted) {
+            try {
+                const connection = this.requireOwnedReadyConnection(binding.ownerUserId, binding.connectionId, binding.providerKey);
+                connectionReady = Boolean(connection);
+            }
+            catch {
+                connectionReady = false;
+            }
+        }
+        const available = Boolean(connectionReady
+            && selection?.providerKey === binding.providerKey
+            && selection?.modelSource === binding.modelSource);
+        return {
+            bound: true,
+            available,
+            providerKey: binding.providerKey,
+            modelSource: binding.modelSource,
+            ownerIsCaller,
+            ...(ownerIsCaller ? { connectionId: binding.connectionId } : {}),
+            ...(available ? {} : { reasonCode: 'MODEL_CONNECTION_UNAVAILABLE' }),
+        };
+    }
+    async bind(input) {
+        const actorUserId = requireIdentity(input.actorUserId);
+        this.assertGranted(actorUserId);
+        const selection = this.requireBindableAgentSelection(input.workspaceId, input.agentId);
+        const existing = this.bindings.get(input.workspaceId, input.agentId);
+        if (existing && existing.ownerUserId !== actorUserId) {
+            throw new TaskforceAgentConnectionBindingError('Only the current connection owner can replace this Agent binding.', 403, 'AGENT_CONNECTION_OWNER_REQUIRED');
+        }
+        return this.connectionRuntime.withConnectionLease({
+            ownerUserId: actorUserId,
+            connectionId: String(input.connectionId || '').trim(),
+            operation: 'invoke',
+        }, async (context) => {
+            this.assertCompatibleConnection(context.connection, selection.providerKey);
+            const binding = this.bindings.bind({
+                workspaceId: input.workspaceId,
+                agentId: input.agentId,
+                connectionId: context.connection.id,
+                ownerUserId: actorUserId,
+                providerKey: selection.providerKey,
+                modelSource: selection.modelSource,
+                actorUserId,
+            });
+            if (!binding) {
+                throw new TaskforceAgentConnectionBindingError('Only the current connection owner can replace this Agent binding.', 403, 'AGENT_CONNECTION_OWNER_REQUIRED');
+            }
+            return binding;
+        });
+    }
+    clear(input) {
+        const actorUserId = requireIdentity(input.actorUserId);
+        const binding = this.bindings.get(input.workspaceId, input.agentId);
+        if (!binding)
+            return false;
+        if (binding.ownerUserId !== actorUserId) {
+            throw new TaskforceAgentConnectionBindingError('Only the connection owner can clear this Agent binding.', 403, 'AGENT_CONNECTION_OWNER_REQUIRED');
+        }
+        const cleared = this.bindings.clear(input.workspaceId, input.agentId, actorUserId);
+        if (cleared)
+            return true;
+        const current = this.bindings.get(input.workspaceId, input.agentId);
+        if (current && current.ownerUserId !== actorUserId) {
+            throw new TaskforceAgentConnectionBindingError('Only the connection owner can clear this Agent binding.', 403, 'AGENT_CONNECTION_OWNER_REQUIRED');
+        }
+        return false;
+    }
+    resolveSaved(input) {
+        const callerUserId = requireIdentity(input.callerUserId);
+        this.assertGranted(callerUserId);
+        const selection = this.requireBindableAgentSelection(input.workspaceId, input.agentId);
+        const binding = this.bindings.get(input.workspaceId, input.agentId);
+        if (!binding) {
+            throw new TaskforceAgentConnectionBindingError('Connect this Agent to an eligible model account before running it.', 409, 'AGENT_MODEL_CONNECTION_REQUIRED');
+        }
+        this.assertGranted(binding.ownerUserId);
+        if (binding.providerKey !== selection.providerKey || binding.modelSource !== selection.modelSource) {
+            throw new TaskforceAgentConnectionBindingError('The saved Agent model selection no longer matches its local connection.', 409, 'AGENT_MODEL_CONNECTION_MISMATCH');
+        }
+        const connection = this.requireOwnedReadyConnection(binding.ownerUserId, binding.connectionId, binding.providerKey);
+        return { binding, connection };
+    }
+    resolveDraft(input) {
+        const callerUserId = requireIdentity(input.callerUserId);
+        this.assertGranted(callerUserId);
+        return this.requireOwnedReadyConnection(callerUserId, input.connectionId, input.providerKey);
+    }
+    requireBindableAgentSelection(workspaceId, agentId) {
+        const agent = this.agents.get(workspaceId, agentId);
+        if (!agent || agent.deletedAt) {
+            throw new TaskforceAgentConnectionBindingError('Taskforce Agent was not found.', 404, 'TASKFORCE_AGENT_NOT_FOUND');
+        }
+        const model = agent.definition?.model;
+        if (!model
+            || model.modelSource !== 'subscription_dev'
+            || (model.connectionScope !== 'personal' && model.connectionScope !== 'local_dev')) {
+            throw new TaskforceAgentConnectionBindingError('This Agent does not use a personal subscription model connection.', 409, 'AGENT_MODEL_CONNECTION_NOT_APPLICABLE');
+        }
+        return model;
+    }
+    requireOwnedActiveConnection(ownerUserId, connectionIdRaw, providerKey) {
+        const connectionId = String(connectionIdRaw || '').trim();
+        const connection = connectionId
+            ? this.connections.getOwned(ownerUserId, connectionId)
+            : null;
+        if (!connection) {
+            throw new TaskforceAgentConnectionBindingError('Model connection was not found.', 404, 'MODEL_CONNECTION_NOT_FOUND');
+        }
+        if (connection.providerKey !== providerKey) {
+            throw new TaskforceAgentConnectionBindingError('The model connection does not match the selected provider.', 409, 'MODEL_CONNECTION_PROVIDER_MISMATCH');
+        }
+        if (connection.lifecycleStatus !== 'active') {
+            throw new TaskforceAgentConnectionBindingError('The model connection is not active.', 409, 'MODEL_CONNECTION_INACTIVE');
+        }
+        this.assertCompatibleConnection(connection, providerKey);
+        return connection;
+    }
+    requireOwnedReadyConnection(ownerUserId, connectionId, providerKey) {
+        this.requireOwnedActiveConnection(ownerUserId, connectionId, providerKey);
+        const connection = this.connectionRuntime.assertReady(ownerUserId, connectionId);
+        this.assertCompatibleConnection(connection, providerKey);
+        return connection;
+    }
+    assertCompatibleConnection(connection, providerKey) {
+        const expectedAuthenticationType = SUBSCRIPTION_AUTHENTICATION_TYPES[providerKey];
+        if (!expectedAuthenticationType
+            || connection.providerKey !== providerKey
+            || connection.authenticationType !== expectedAuthenticationType) {
+            throw new TaskforceAgentConnectionBindingError('The model connection is not compatible with this subscription model.', 409, 'MODEL_CONNECTION_AUTHENTICATION_MISMATCH');
+        }
+    }
+    assertGranted(userId) {
+        if (this.hasGrant(userId))
+            return;
+        throw new TaskforceAgentConnectionBindingError('Subscription-backed models are not enabled for this account.', 403, 'SUBSCRIPTION_MODEL_ACCESS_REQUIRED');
+    }
+}

package/dist/services/taskforceAgentMcpBridge.d.ts

@@ -1,4 +1,5 @@
 import { type TaskforceCore } from '../core/Taskforce.js';
+import { createTaskforceMcpServer } from '../mcp/runtime.js';
 import { type ManagedAgentMcpToolProfile } from '../mcp/toolProfiles.js';
 import { type McpToolName } from '../mcp/toolRegistry.js';
 import type { AgentToolPolicy } from '../shared/taskforceAgentDefinition.js';
@@ -33,8 +34,12 @@ export type PrepareTaskforceAgentMcpBridgeInput = {
     readOnly?: boolean;
     toolProfile?: ManagedAgentMcpToolProfile;
     toolPolicy?: AgentToolPolicy;
+    executionRequestId: string;
     system: string;
 };
+type PrepareTaskforceAgentMcpBridgeDependencies = {
+    createMcpServer?: typeof createTaskforceMcpServer;
+};
 export declare const MANAGED_AGENT_LIST_TASKS_DEFAULT_LIMIT = 25;
 export declare const MANAGED_AGENT_LIST_TASKS_MAX_LIMIT = 50;
 export declare const MANAGED_AGENT_TOOL_RESULT_MAX_BYTES: number;
@@ -50,8 +55,9 @@ type McpToolDescriptor = {
 export declare function hashTaskforceAgentMcpToolContract(tools: McpToolDescriptor[]): string;
 export declare function isTaskforceAgentMutationToolName(name: string): boolean;
 export declare function taskforceAgentMutationCallKey(name: string, argumentsValue: Record<string, unknown>): string | null;
+export declare function taskforceAgentMcpRequestId(call: TaskforceAgentMcpToolCall): string;
 declare const MANAGED_AGENT_CAPABILITY_TOOLS: Readonly<{
-    readonly tasks: readonly ["add_comment", "add_task_checklist_item", "complete_workflow_step", "get_schedule_board", "get_stats", "get_task", "get_task_attachments", "get_task_checklist", "get_task_workflow", "list_task_relationships", "list_tasks", "replace_task_checklist", "search_tasks"];
+    readonly tasks: readonly ["add_comment", "add_task_checklist_item", "complete_workflow_step", "get_schedule_board", "get_stats", "get_task", "get_task_attachments", "get_task_checklist", "get_task_workflow", "list_task_relationships", "list_tasks", "replace_task_checklist", "search_tasks", "update_task_checklist_item"];
     readonly planning: readonly ["add_initiative_comment", "add_workstream_comment", "get_initiative", "get_workstream", "list_initiatives", "list_workstreams"];
     readonly documents: readonly ["get_document", "get_document_reviews", "search_documents"];
     readonly images: readonly ["get_image", "get_image_annotations", "search_images"];
@@ -72,6 +78,6 @@ type BoundedManagedAgentToolResult = {
     rejected: boolean;
 };
 export declare function boundManagedAgentMcpToolResult(toolName: string, text: string): BoundedManagedAgentToolResult;
-export declare function prepareTaskforceAgentMcpBridge(input: PrepareTaskforceAgentMcpBridgeInput): Promise<PreparedTaskforceAgentMcpBridge | null>;
+export declare function prepareTaskforceAgentMcpBridge(input: PrepareTaskforceAgentMcpBridgeInput, dependencies?: PrepareTaskforceAgentMcpBridgeDependencies): Promise<PreparedTaskforceAgentMcpBridge | null>;
 export declare function serializeTaskforceAgentMcpToolResult(result: TaskforceAgentMcpToolResult): Record<string, unknown>;
 export {};

package/dist/services/taskforceAgentMcpBridge.js

@@ -31,9 +31,19 @@ export function taskforceAgentMutationCallKey(name, argumentsValue) {
         return null;
     return `${normalizedName}:${serializeCanonicalJson(argumentsValue || {})}`;
 }
+export function taskforceAgentMcpRequestId(call) {
+    return `managed-agent-${createHash('sha256')
+        .update(serializeCanonicalJson({
+        name: String(call.name || '').trim(),
+        arguments: call.arguments || {},
+    }))
+        .digest('hex')
+        .slice(0, 32)}`;
+}
 const TASK_SCOPED_MUTATION_TOOL_NAMES = new Set([
     'add_comment',
     'add_task_checklist_item',
+    'update_task_checklist_item',
     'replace_task_checklist',
     'complete_workflow_step',
 ]);
@@ -52,6 +62,7 @@ const MANAGED_AGENT_CAPABILITY_TOOLS = Object.freeze({
         'list_tasks',
         'replace_task_checklist',
         'search_tasks',
+        'update_task_checklist_item',
     ],
     planning: [
         'add_initiative_comment',
@@ -120,21 +131,8 @@ export function resolveManagedAgentMcpToolNames(toolPolicy, profile = MCP_MANAGE
     }
     return Array.from(effective).sort((left, right) => left.localeCompare(right));
 }
-function getRuntimeHandler(runtime, method) {
-    const handler = runtime.server._requestHandlers?.get(method);
-    if (typeof handler !== 'function') {
-        throw new Error(`Taskforce MCP ${method} handler is unavailable.`);
-    }
-    return handler;
-}
 async function listRuntimeTools(runtime) {
-    const handler = getRuntimeHandler(runtime, 'tools/list');
-    const result = await handler({
-        jsonrpc: '2.0',
-        id: 'taskforce-agent-tools-list',
-        method: 'tools/list',
-        params: {},
-    }, {});
+    const result = await runtime.listTools();
     return Array.isArray(result?.tools) ? result.tools : [];
 }
 function compactText(value, maxLength) {
@@ -199,7 +197,7 @@ function buildToolInstructions(baseSystem, tools, allowedMutationTaskId, readOnl
                 ? 'Allowed writes: task comments, checklist changes, and completion of the current owned workflow step. Use complete_workflow_step only after finishing that step.'
                 : 'Allowed writes: task comments and checklist changes.',
         ...(canCompleteWorkflow && !readOnly ? [
-            'For workflow-step work, call get_task_workflow before acting. If requiresCommentEvidence is true, call add_comment and pass its returned comment.id to complete_workflow_step as evidenceCommentId. After all required work succeeds, call complete_workflow_step before answering. A comment or other task mutation does not complete the workflow step.',
+            'For workflow-step work, call get_task_workflow before acting. Reuse its completionCall arguments exactly; never invent or reuse workflow IDs. If requiresCommentEvidence is true, call add_comment and add its returned comment.id as evidenceCommentId. After all required work succeeds, call complete_workflow_step before answering. A comment or other task mutation does not complete the workflow step.',
         ] : []),
         ...(taskScope ? [`This run is task-scoped to ${taskScope}. Mutating Taskforce tools must target only this task.`] : []),
         'To use a Taskforce tool, respond with only one JSON object and no prose:',
@@ -284,6 +282,14 @@ function utf8ByteLength(value) {
     return Buffer.byteLength(value, 'utf8');
 }
 export function normalizeManagedAgentMcpToolCall(call) {
+    if (call.name === 'get_task_workflow' || call.name === 'complete_workflow_step') {
+        const args = { ...call.arguments };
+        if (!String(args.taskId || '').trim() && String(args.id || '').trim()) {
+            args.taskId = args.id;
+        }
+        delete args.id;
+        return { name: call.name, arguments: args };
+    }
     if (call.name !== 'list_tasks')
         return call;
     const args = { ...call.arguments };
@@ -438,7 +444,7 @@ function buildManagedAgentToolResultMessage(result, workflowReminder) {
         'Use a narrower Taskforce read before answering the user.',
     ].join('\n');
 }
-export async function prepareTaskforceAgentMcpBridge(input) {
+export async function prepareTaskforceAgentMcpBridge(input, dependencies = {}) {
     if (!input.core)
         return null;
     if (input.runtimeMode !== 'cloud') {
@@ -454,7 +460,7 @@ export async function prepareTaskforceAgentMcpBridge(input) {
     }
     if (!input.agentProfileId)
         managedToolNames.delete('complete_workflow_step');
-    const runtime = createTaskforceMcpServer({
+    const runtime = (dependencies.createMcpServer || createTaskforceMcpServer)({
         core: input.core,
         workspaceId: input.workspaceId,
         runtimeMode: input.runtimeMode,
@@ -469,6 +475,7 @@ export async function prepareTaskforceAgentMcpBridge(input) {
             aiProfileProvider: input.providerKey || 'taskforce_hq',
             aiProfileModel: input.modelKey || null,
             aiProfileSurfaceType: 'agent',
+            requestId: input.executionRequestId,
         },
     });
     const tools = (await listRuntimeTools(runtime))
@@ -477,7 +484,6 @@ export async function prepareTaskforceAgentMcpBridge(input) {
     if (tools.length === 0)
         return null;
     const availableToolNames = new Set(tools.map((tool) => tool.name));
-    const callTool = getRuntimeHandler(runtime, 'tools/call');
     return {
         system: buildToolInstructions(input.system, tools, input.allowedMutationTaskId, input.readOnly),
         availableToolNames: Array.from(availableToolNames),
@@ -491,15 +497,12 @@ export async function prepareTaskforceAgentMcpBridge(input) {
             if (scopeFailure)
                 return scopeFailure;
             const effectiveCall = normalizeManagedAgentMcpToolCall(call);
-            const result = await callTool({
-                jsonrpc: '2.0',
-                id: `taskforce-agent-tool-${effectiveCall.name}`,
-                method: 'tools/call',
-                params: {
-                    name: effectiveCall.name,
-                    arguments: effectiveCall.arguments,
-                },
-            }, {});
+            const result = await runtime.callTool({
+                name: effectiveCall.name,
+                arguments: effectiveCall.arguments,
+            }, {
+                requestId: taskforceAgentMcpRequestId(effectiveCall),
+            });
             const bounded = boundManagedAgentMcpToolResult(effectiveCall.name, extractToolResultText(result));
             return {
                 name: effectiveCall.name,

package/dist/shared/adminEdgeProxy.d.ts

@@ -0,0 +1,5 @@
+export interface AdminEdgeProxyContext {
+    request: Request;
+    env?: Record<string, unknown>;
+}
+export declare function handleAdminEdgeProxyRequest(context: AdminEdgeProxyContext): Promise<Response>;

package/dist/shared/adminEdgeProxy.js

@@ -0,0 +1,94 @@
+import { TASKFORCE_CLOUD_ENVIRONMENTS, parseTaskforceCloudEnvironment } from '../config/cloudEnvironment.js';
+import { readSetCookieHeaders, stripSetCookieDomainAttribute } from '../utils/httpSetCookie.js';
+import { resolveAllAdminProxyUpstreamSessionCookieNames, resolveAdminProxyUpstreamSessionCookieName, rewriteAdminProxyRequestCookieHeader, rewriteAdminProxyResponseSetCookie, } from './adminProxySessionCookies.js';
+function readEnvValue(env, key) {
+    const value = env[key];
+    return typeof value === 'string' ? value.trim() : '';
+}
+function resolveProxyEnvironment(context) {
+    const processEnvironment = typeof process !== 'undefined' ? process.env : {};
+    return { ...processEnvironment, ...context.env };
+}
+function resolveUpstreamBaseUrl(environment) {
+    return TASKFORCE_CLOUD_ENVIRONMENTS[environment].appBaseUrl.replace(/\/+$/, '');
+}
+function isCloudflareAccessRedirect(response) {
+    if (response.status < 300 || response.status >= 400)
+        return false;
+    const location = String(response.headers.get('location') || '').trim();
+    if (!location)
+        return false;
+    try {
+        const url = new URL(location);
+        return url.hostname.toLowerCase() === 'stratnexus.cloudflareaccess.com'
+            || url.pathname.startsWith('/cdn-cgi/access/login');
+    }
+    catch {
+        return location.includes('/cdn-cgi/access/login');
+    }
+}
+function jsonError(status, error, code) {
+    return new Response(JSON.stringify({ error, code }), {
+        status,
+        headers: {
+            'Content-Type': 'application/json',
+            'Cache-Control': 'no-store',
+        },
+    });
+}
+export async function handleAdminEdgeProxyRequest(context) {
+    const request = context.request;
+    const environment = parseTaskforceCloudEnvironment(request.headers.get('x-taskforce-cloud-environment'));
+    if (!environment) {
+        return jsonError(400, 'A valid admin cloud environment is required.', 'ADMIN_ENVIRONMENT_REQUIRED');
+    }
+    const proxyEnvironment = resolveProxyEnvironment(context);
+    const upstreamSessionCookieName = resolveAdminProxyUpstreamSessionCookieName(environment, proxyEnvironment);
+    const requestUrl = new URL(request.url);
+    const upstreamUrl = `${resolveUpstreamBaseUrl(environment)}${requestUrl.pathname}${requestUrl.search}`;
+    const headers = new Headers(request.headers);
+    headers.delete('host');
+    const rewrittenCookie = rewriteAdminProxyRequestCookieHeader(headers.get('cookie'), environment, upstreamSessionCookieName, resolveAllAdminProxyUpstreamSessionCookieNames(proxyEnvironment));
+    if (rewrittenCookie)
+        headers.set('cookie', rewrittenCookie);
+    else
+        headers.delete('cookie');
+    headers.set('x-taskforce-origin-host', requestUrl.host);
+    headers.set('x-taskforce-origin-proto', requestUrl.protocol.replace(':', ''));
+    headers.set('x-taskforce-origin-base-url', requestUrl.origin);
+    headers.set('x-taskforce-origin-runtime', 'admin-edge-proxy');
+    const cloudProxyClientId = readEnvValue(proxyEnvironment, 'TASKFORCE_CF_ACCESS_CLIENT_ID')
+        || readEnvValue(proxyEnvironment, 'CF_ACCESS_CLIENT_ID');
+    const cloudProxyClientSecret = readEnvValue(proxyEnvironment, 'TASKFORCE_CF_ACCESS_CLIENT_SECRET')
+        || readEnvValue(proxyEnvironment, 'CF_ACCESS_CLIENT_SECRET');
+    if (cloudProxyClientId && cloudProxyClientSecret) {
+        headers.set('CF-Access-Client-Id', cloudProxyClientId);
+        headers.set('CF-Access-Client-Secret', cloudProxyClientSecret);
+    }
+    const method = request.method.toUpperCase();
+    const upstreamResponse = await fetch(upstreamUrl, {
+        method,
+        headers,
+        body: method !== 'GET' && method !== 'HEAD' ? await request.arrayBuffer() : undefined,
+        redirect: 'manual',
+    });
+    if (isCloudflareAccessRedirect(upstreamResponse)) {
+        return jsonError(401, 'Cloudflare Access authentication required for the selected environment.', 'CLOUDFLARE_ACCESS_REQUIRED');
+    }
+    const responseHeaders = new Headers(upstreamResponse.headers);
+    responseHeaders.delete('access-control-allow-origin');
+    responseHeaders.delete('access-control-allow-credentials');
+    responseHeaders.delete('access-control-allow-methods');
+    responseHeaders.delete('access-control-allow-headers');
+    responseHeaders.set('cache-control', 'no-store');
+    const setCookies = readSetCookieHeaders(upstreamResponse.headers);
+    responseHeaders.delete('set-cookie');
+    for (const setCookie of setCookies) {
+        responseHeaders.append('set-cookie', stripSetCookieDomainAttribute(rewriteAdminProxyResponseSetCookie(setCookie, environment, upstreamSessionCookieName)));
+    }
+    return new Response(upstreamResponse.body, {
+        status: upstreamResponse.status,
+        statusText: upstreamResponse.statusText,
+        headers: responseHeaders,
+    });
+}

package/dist/shared/adminProxySessionCookies.d.ts

@@ -0,0 +1,16 @@
+import { type TaskforceCloudEnvironment } from '../config/cloudEnvironment.js';
+export declare const ADMIN_PROXY_UPSTREAM_SESSION_COOKIE_NAME = "taskforce_session";
+export declare const ADMIN_PROXY_UPSTREAM_SESSION_COOKIE_ENV = "TASKFORCE_ADMIN_PROXY_UPSTREAM_SESSION_COOKIE";
+export declare function resolveAdminProxyUpstreamSessionCookieName(environment: TaskforceCloudEnvironment, env?: Record<string, unknown>): string;
+export declare function resolveAllAdminProxyUpstreamSessionCookieNames(env?: Record<string, unknown>): string[];
+export declare function adminProxySessionCookieName(environment: TaskforceCloudEnvironment): string;
+/**
+ * Replace all browser-visible admin session cookies with the one upstream
+ * session cookie expected by the selected cloud environment.
+ */
+export declare function rewriteAdminProxyRequestCookieHeader(cookieHeader: string | null | undefined, environment: TaskforceCloudEnvironment, upstreamSessionCookieName?: string, additionalSessionCookieNames?: readonly string[]): string;
+/**
+ * Namespace an upstream cloud session for the admin proxy host. Removing the
+ * upstream Domain attribute keeps the isolated session scoped to that proxy.
+ */
+export declare function rewriteAdminProxyResponseSetCookie(setCookie: string, environment: TaskforceCloudEnvironment, upstreamSessionCookieName?: string): string;

package/dist/shared/adminProxySessionCookies.js

@@ -0,0 +1,86 @@
+import { TASKFORCE_CLOUD_ENVIRONMENT_ORDER, } from '../config/cloudEnvironment.js';
+export const ADMIN_PROXY_UPSTREAM_SESSION_COOKIE_NAME = 'taskforce_session';
+export const ADMIN_PROXY_UPSTREAM_SESSION_COOKIE_ENV = 'TASKFORCE_ADMIN_PROXY_UPSTREAM_SESSION_COOKIE';
+const ADMIN_PROXY_SESSION_COOKIE_PREFIX = '__Host-taskforce_admin_session_';
+const LEGACY_ADMIN_PROXY_SESSION_COOKIE_PREFIX = 'taskforce_admin_session_';
+const TASKFORCE_SESSION_COOKIE_NAMES = new Set([
+    ADMIN_PROXY_UPSTREAM_SESSION_COOKIE_NAME,
+    'taskforce_session_prod',
+    'taskforce_session_staging',
+    'taskforce_session_performance',
+]);
+export function resolveAdminProxyUpstreamSessionCookieName(environment, env = {}) {
+    const environmentKey = `${ADMIN_PROXY_UPSTREAM_SESSION_COOKIE_ENV}_${environment.toUpperCase()}`;
+    const configured = String(env[environmentKey] || env[ADMIN_PROXY_UPSTREAM_SESSION_COOKIE_ENV] || '').trim();
+    if (!configured)
+        return ADMIN_PROXY_UPSTREAM_SESSION_COOKIE_NAME;
+    if (!/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(configured)) {
+        throw new Error(`Invalid admin proxy upstream session cookie name for ${environment}.`);
+    }
+    return configured;
+}
+export function resolveAllAdminProxyUpstreamSessionCookieNames(env = {}) {
+    return [...new Set(TASKFORCE_CLOUD_ENVIRONMENT_ORDER.map((environment) => resolveAdminProxyUpstreamSessionCookieName(environment, env)))];
+}
+export function adminProxySessionCookieName(environment) {
+    return `${ADMIN_PROXY_SESSION_COOKIE_PREFIX}${environment}`;
+}
+function cookiePairName(pair) {
+    const separator = pair.indexOf('=');
+    return (separator >= 0 ? pair.slice(0, separator) : pair).trim();
+}
+/**
+ * Replace all browser-visible admin session cookies with the one upstream
+ * session cookie expected by the selected cloud environment.
+ */
+export function rewriteAdminProxyRequestCookieHeader(cookieHeader, environment, upstreamSessionCookieName = ADMIN_PROXY_UPSTREAM_SESSION_COOKIE_NAME, additionalSessionCookieNames = []) {
+    const selectedCookieName = adminProxySessionCookieName(environment);
+    const pairs = String(cookieHeader || '')
+        .split(';')
+        .map((part) => part.trim())
+        .filter(Boolean);
+    const selectedPair = pairs.find((pair) => cookiePairName(pair) === selectedCookieName);
+    const forwardedPairs = pairs.filter((pair) => {
+        const name = cookiePairName(pair);
+        return name !== upstreamSessionCookieName
+            && !additionalSessionCookieNames.includes(name)
+            && !TASKFORCE_SESSION_COOKIE_NAMES.has(name)
+            && !name.startsWith(ADMIN_PROXY_SESSION_COOKIE_PREFIX)
+            && !name.startsWith(LEGACY_ADMIN_PROXY_SESSION_COOKIE_PREFIX);
+    });
+    if (selectedPair) {
+        const separator = selectedPair.indexOf('=');
+        forwardedPairs.push(`${upstreamSessionCookieName}=${selectedPair.slice(separator + 1)}`);
+    }
+    return forwardedPairs.join('; ');
+}
+/**
+ * Namespace an upstream cloud session for the admin proxy host. Removing the
+ * upstream Domain attribute keeps the isolated session scoped to that proxy.
+ */
+export function rewriteAdminProxyResponseSetCookie(setCookie, environment, upstreamSessionCookieName = ADMIN_PROXY_UPSTREAM_SESSION_COOKIE_NAME) {
+    const parts = String(setCookie || '')
+        .split(';')
+        .map((part) => part.trim())
+        .filter(Boolean);
+    if (parts.length === 0)
+        return setCookie;
+    const [nameValue, ...attributes] = parts;
+    const separator = nameValue.indexOf('=');
+    if (separator < 0 || nameValue.slice(0, separator).trim() !== upstreamSessionCookieName) {
+        return setCookie;
+    }
+    const value = nameValue.slice(separator + 1);
+    const hostOnlyAttributes = attributes.filter((attribute) => {
+        const lower = attribute.toLowerCase();
+        return !lower.startsWith('domain=')
+            && !lower.startsWith('path=')
+            && lower !== 'secure';
+    });
+    return [
+        `${adminProxySessionCookieName(environment)}=${value}`,
+        'Path=/',
+        'Secure',
+        ...hostOnlyAttributes,
+    ].join('; ');
+}