@taskforcehq/taskforce 0.3.329 → 0.3.332

package/dist/services/taskforceAgentConnectionBindingService.d.ts

@@ -0,0 +1,66 @@
+import type { TaskforceAgentStore } from '../storage/taskforceAgentStore.js';
+import type { ModelProviderConnectionRecord, ModelProviderConnectionStore } from '../storage/modelProviderConnectionStore.js';
+import type { TaskforceAgentConnectionBindingRecord, TaskforceAgentConnectionBindingStore } from '../storage/taskforceAgentConnectionBindingStore.js';
+import type { ModelProviderConnectionService } from './modelProviderConnectionService.js';
+export declare class TaskforceAgentConnectionBindingError extends Error {
+    readonly statusCode: number;
+    readonly code: string;
+    constructor(message: string, statusCode: number, code: string);
+}
+type AgentStore = Pick<TaskforceAgentStore, 'get'>;
+type ConnectionStore = Pick<ModelProviderConnectionStore, 'getOwned'>;
+type BindingStore = Pick<TaskforceAgentConnectionBindingStore, 'get' | 'bind' | 'clear'>;
+type ConnectionRuntime = Pick<ModelProviderConnectionService, 'assertReady' | 'withConnectionLease'>;
+export interface ResolvedTaskforceAgentConnectionBinding {
+    binding: TaskforceAgentConnectionBindingRecord;
+    connection: ModelProviderConnectionRecord;
+}
+export interface PublicTaskforceAgentConnectionBinding {
+    bound: boolean;
+    available: boolean;
+    providerKey?: string;
+    modelSource?: string;
+    ownerIsCaller?: boolean;
+    connectionId?: string;
+    reasonCode?: string;
+}
+export declare class TaskforceAgentConnectionBindingService {
+    private readonly bindings;
+    private readonly agents;
+    private readonly connections;
+    private readonly connectionRuntime;
+    private readonly hasGrant;
+    constructor(bindings: BindingStore, agents: AgentStore, connections: ConnectionStore, connectionRuntime: ConnectionRuntime, hasGrant: (userId: string) => boolean);
+    inspect(input: {
+        workspaceId: string;
+        agentId: string;
+        callerUserId: string;
+    }): PublicTaskforceAgentConnectionBinding;
+    bind(input: {
+        workspaceId: string;
+        agentId: string;
+        connectionId: string;
+        actorUserId: string;
+    }): Promise<TaskforceAgentConnectionBindingRecord>;
+    clear(input: {
+        workspaceId: string;
+        agentId: string;
+        actorUserId: string;
+    }): boolean;
+    resolveSaved(input: {
+        workspaceId: string;
+        agentId: string;
+        callerUserId: string;
+    }): ResolvedTaskforceAgentConnectionBinding;
+    resolveDraft(input: {
+        callerUserId: string;
+        connectionId: string;
+        providerKey: string;
+    }): ModelProviderConnectionRecord;
+    private requireBindableAgentSelection;
+    private requireOwnedActiveConnection;
+    private requireOwnedReadyConnection;
+    private assertCompatibleConnection;
+    private assertGranted;
+}
+export {};

package/dist/services/taskforceAgentConnectionBindingService.js

@@ -0,0 +1,185 @@
+export class TaskforceAgentConnectionBindingError extends Error {
+    statusCode;
+    code;
+    constructor(message, statusCode, code) {
+        super(message);
+        this.statusCode = statusCode;
+        this.code = code;
+        this.name = 'TaskforceAgentConnectionBindingError';
+    }
+}
+const SUBSCRIPTION_AUTHENTICATION_TYPES = {
+    openai: 'chatgpt_device_code',
+};
+function requireIdentity(value) {
+    const normalized = String(value || '').trim();
+    if (!normalized) {
+        throw new TaskforceAgentConnectionBindingError('Authentication is required.', 401, 'AUTH_REQUIRED');
+    }
+    return normalized;
+}
+export class TaskforceAgentConnectionBindingService {
+    bindings;
+    agents;
+    connections;
+    connectionRuntime;
+    hasGrant;
+    constructor(bindings, agents, connections, connectionRuntime, hasGrant) {
+        this.bindings = bindings;
+        this.agents = agents;
+        this.connections = connections;
+        this.connectionRuntime = connectionRuntime;
+        this.hasGrant = hasGrant;
+    }
+    inspect(input) {
+        const callerUserId = requireIdentity(input.callerUserId);
+        const agent = this.agents.get(input.workspaceId, input.agentId);
+        if (!agent || agent.deletedAt) {
+            throw new TaskforceAgentConnectionBindingError('Taskforce Agent was not found.', 404, 'TASKFORCE_AGENT_NOT_FOUND');
+        }
+        const binding = this.bindings.get(input.workspaceId, input.agentId);
+        if (!binding)
+            return { bound: false, available: false, reasonCode: 'MODEL_CONNECTION_REQUIRED' };
+        const selection = agent.definition?.model;
+        const ownerIsCaller = binding.ownerUserId === callerUserId;
+        const callerGranted = this.hasGrant(callerUserId);
+        const ownerGranted = this.hasGrant(binding.ownerUserId);
+        let connectionReady = false;
+        if (callerGranted && ownerGranted) {
+            try {
+                const connection = this.requireOwnedReadyConnection(binding.ownerUserId, binding.connectionId, binding.providerKey);
+                connectionReady = Boolean(connection);
+            }
+            catch {
+                connectionReady = false;
+            }
+        }
+        const available = Boolean(connectionReady
+            && selection?.providerKey === binding.providerKey
+            && selection?.modelSource === binding.modelSource);
+        return {
+            bound: true,
+            available,
+            providerKey: binding.providerKey,
+            modelSource: binding.modelSource,
+            ownerIsCaller,
+            ...(ownerIsCaller ? { connectionId: binding.connectionId } : {}),
+            ...(available ? {} : { reasonCode: 'MODEL_CONNECTION_UNAVAILABLE' }),
+        };
+    }
+    async bind(input) {
+        const actorUserId = requireIdentity(input.actorUserId);
+        this.assertGranted(actorUserId);
+        const selection = this.requireBindableAgentSelection(input.workspaceId, input.agentId);
+        const existing = this.bindings.get(input.workspaceId, input.agentId);
+        if (existing && existing.ownerUserId !== actorUserId) {
+            throw new TaskforceAgentConnectionBindingError('Only the current connection owner can replace this Agent binding.', 403, 'AGENT_CONNECTION_OWNER_REQUIRED');
+        }
+        return this.connectionRuntime.withConnectionLease({
+            ownerUserId: actorUserId,
+            connectionId: String(input.connectionId || '').trim(),
+            operation: 'invoke',
+        }, async (context) => {
+            this.assertCompatibleConnection(context.connection, selection.providerKey);
+            const binding = this.bindings.bind({
+                workspaceId: input.workspaceId,
+                agentId: input.agentId,
+                connectionId: context.connection.id,
+                ownerUserId: actorUserId,
+                providerKey: selection.providerKey,
+                modelSource: selection.modelSource,
+                actorUserId,
+            });
+            if (!binding) {
+                throw new TaskforceAgentConnectionBindingError('Only the current connection owner can replace this Agent binding.', 403, 'AGENT_CONNECTION_OWNER_REQUIRED');
+            }
+            return binding;
+        });
+    }
+    clear(input) {
+        const actorUserId = requireIdentity(input.actorUserId);
+        const binding = this.bindings.get(input.workspaceId, input.agentId);
+        if (!binding)
+            return false;
+        if (binding.ownerUserId !== actorUserId) {
+            throw new TaskforceAgentConnectionBindingError('Only the connection owner can clear this Agent binding.', 403, 'AGENT_CONNECTION_OWNER_REQUIRED');
+        }
+        const cleared = this.bindings.clear(input.workspaceId, input.agentId, actorUserId);
+        if (cleared)
+            return true;
+        const current = this.bindings.get(input.workspaceId, input.agentId);
+        if (current && current.ownerUserId !== actorUserId) {
+            throw new TaskforceAgentConnectionBindingError('Only the connection owner can clear this Agent binding.', 403, 'AGENT_CONNECTION_OWNER_REQUIRED');
+        }
+        return false;
+    }
+    resolveSaved(input) {
+        const callerUserId = requireIdentity(input.callerUserId);
+        this.assertGranted(callerUserId);
+        const selection = this.requireBindableAgentSelection(input.workspaceId, input.agentId);
+        const binding = this.bindings.get(input.workspaceId, input.agentId);
+        if (!binding) {
+            throw new TaskforceAgentConnectionBindingError('Connect this Agent to an eligible model account before running it.', 409, 'AGENT_MODEL_CONNECTION_REQUIRED');
+        }
+        this.assertGranted(binding.ownerUserId);
+        if (binding.providerKey !== selection.providerKey || binding.modelSource !== selection.modelSource) {
+            throw new TaskforceAgentConnectionBindingError('The saved Agent model selection no longer matches its local connection.', 409, 'AGENT_MODEL_CONNECTION_MISMATCH');
+        }
+        const connection = this.requireOwnedReadyConnection(binding.ownerUserId, binding.connectionId, binding.providerKey);
+        return { binding, connection };
+    }
+    resolveDraft(input) {
+        const callerUserId = requireIdentity(input.callerUserId);
+        this.assertGranted(callerUserId);
+        return this.requireOwnedReadyConnection(callerUserId, input.connectionId, input.providerKey);
+    }
+    requireBindableAgentSelection(workspaceId, agentId) {
+        const agent = this.agents.get(workspaceId, agentId);
+        if (!agent || agent.deletedAt) {
+            throw new TaskforceAgentConnectionBindingError('Taskforce Agent was not found.', 404, 'TASKFORCE_AGENT_NOT_FOUND');
+        }
+        const model = agent.definition?.model;
+        if (!model
+            || model.modelSource !== 'subscription_dev'
+            || (model.connectionScope !== 'personal' && model.connectionScope !== 'local_dev')) {
+            throw new TaskforceAgentConnectionBindingError('This Agent does not use a personal subscription model connection.', 409, 'AGENT_MODEL_CONNECTION_NOT_APPLICABLE');
+        }
+        return model;
+    }
+    requireOwnedActiveConnection(ownerUserId, connectionIdRaw, providerKey) {
+        const connectionId = String(connectionIdRaw || '').trim();
+        const connection = connectionId
+            ? this.connections.getOwned(ownerUserId, connectionId)
+            : null;
+        if (!connection) {
+            throw new TaskforceAgentConnectionBindingError('Model connection was not found.', 404, 'MODEL_CONNECTION_NOT_FOUND');
+        }
+        if (connection.providerKey !== providerKey) {
+            throw new TaskforceAgentConnectionBindingError('The model connection does not match the selected provider.', 409, 'MODEL_CONNECTION_PROVIDER_MISMATCH');
+        }
+        if (connection.lifecycleStatus !== 'active') {
+            throw new TaskforceAgentConnectionBindingError('The model connection is not active.', 409, 'MODEL_CONNECTION_INACTIVE');
+        }
+        this.assertCompatibleConnection(connection, providerKey);
+        return connection;
+    }
+    requireOwnedReadyConnection(ownerUserId, connectionId, providerKey) {
+        this.requireOwnedActiveConnection(ownerUserId, connectionId, providerKey);
+        const connection = this.connectionRuntime.assertReady(ownerUserId, connectionId);
+        this.assertCompatibleConnection(connection, providerKey);
+        return connection;
+    }
+    assertCompatibleConnection(connection, providerKey) {
+        const expectedAuthenticationType = SUBSCRIPTION_AUTHENTICATION_TYPES[providerKey];
+        if (!expectedAuthenticationType
+            || connection.providerKey !== providerKey
+            || connection.authenticationType !== expectedAuthenticationType) {
+            throw new TaskforceAgentConnectionBindingError('The model connection is not compatible with this subscription model.', 409, 'MODEL_CONNECTION_AUTHENTICATION_MISMATCH');
+        }
+    }
+    assertGranted(userId) {
+        if (this.hasGrant(userId))
+            return;
+        throw new TaskforceAgentConnectionBindingError('Subscription-backed models are not enabled for this account.', 403, 'SUBSCRIPTION_MODEL_ACCESS_REQUIRED');
+    }
+}

package/dist/services/taskforceAgentMcpBridge.d.ts

@@ -57,9 +57,9 @@ export declare function isTaskforceAgentMutationToolName(name: string): boolean;
 export declare function taskforceAgentMutationCallKey(name: string, argumentsValue: Record<string, unknown>): string | null;
 export declare function taskforceAgentMcpRequestId(call: TaskforceAgentMcpToolCall): string;
 declare const MANAGED_AGENT_CAPABILITY_TOOLS: Readonly<{
-    readonly tasks: readonly ["add_comment", "add_task_checklist_item", "complete_workflow_step", "get_schedule_board", "get_stats", "get_task", "get_task_attachments", "get_task_checklist", "get_task_workflow", "list_task_relationships", "list_tasks", "replace_task_checklist", "search_tasks"];
+    readonly tasks: readonly ["add_comment", "add_task_checklist_item", "complete_workflow_step", "get_schedule_board", "get_stats", "get_task", "get_task_attachments", "get_task_checklist", "get_task_workflow", "list_task_relationships", "list_tasks", "replace_task_checklist", "search_tasks", "update_task_checklist_item"];
     readonly planning: readonly ["add_initiative_comment", "add_workstream_comment", "get_initiative", "get_workstream", "list_initiatives", "list_workstreams"];
-    readonly documents: readonly ["get_document", "get_document_reviews", "search_documents"];
+    readonly documents: readonly ["get_document", "get_document_reviews", "review_document", "search_documents"];
     readonly images: readonly ["get_image", "get_image_annotations", "search_images"];
     readonly workspace: readonly ["get_config", "get_current_profile", "list_assignees"];
 }>;

package/dist/services/taskforceAgentMcpBridge.js

@@ -43,6 +43,7 @@ export function taskforceAgentMcpRequestId(call) {
 const TASK_SCOPED_MUTATION_TOOL_NAMES = new Set([
     'add_comment',
     'add_task_checklist_item',
+    'update_task_checklist_item',
     'replace_task_checklist',
     'complete_workflow_step',
 ]);
@@ -61,6 +62,7 @@ const MANAGED_AGENT_CAPABILITY_TOOLS = Object.freeze({
         'list_tasks',
         'replace_task_checklist',
         'search_tasks',
+        'update_task_checklist_item',
     ],
     planning: [
         'add_initiative_comment',
@@ -73,6 +75,7 @@ const MANAGED_AGENT_CAPABILITY_TOOLS = Object.freeze({
     documents: [
         'get_document',
         'get_document_reviews',
+        'review_document',
         'search_documents',
     ],
     images: [
@@ -129,21 +132,8 @@ export function resolveManagedAgentMcpToolNames(toolPolicy, profile = MCP_MANAGE
     }
     return Array.from(effective).sort((left, right) => left.localeCompare(right));
 }
-function getRuntimeHandler(runtime, method) {
-    const handler = runtime.server._requestHandlers?.get(method);
-    if (typeof handler !== 'function') {
-        throw new Error(`Taskforce MCP ${method} handler is unavailable.`);
-    }
-    return handler;
-}
 async function listRuntimeTools(runtime) {
-    const handler = getRuntimeHandler(runtime, 'tools/list');
-    const result = await handler({
-        jsonrpc: '2.0',
-        id: 'taskforce-agent-tools-list',
-        method: 'tools/list',
-        params: {},
-    }, {});
+    const result = await runtime.listTools();
     return Array.isArray(result?.tools) ? result.tools : [];
 }
 function compactText(value, maxLength) {
@@ -198,21 +188,50 @@ function buildToolInstructions(baseSystem, tools, allowedMutationTaskId, readOnl
     const toolLines = tools.map((tool) => (`- ${tool.name}: ${compactText(tool.description, 180)} Args: ${describeToolSchema(tool.inputSchema)}`));
     const taskScope = String(allowedMutationTaskId || '').trim();
     const canCompleteWorkflow = tools.some((tool) => tool.name === 'complete_workflow_step');
+    const canReviewDocuments = tools.some((tool) => tool.name === 'review_document');
+    const canAddComments = tools.some((tool) => [
+        'add_comment',
+        'add_initiative_comment',
+        'add_workstream_comment',
+    ].includes(tool.name));
+    const canChangeChecklists = tools.some((tool) => [
+        'add_task_checklist_item',
+        'replace_task_checklist',
+        'update_task_checklist_item',
+    ].includes(tool.name));
+    const allowedWrites = [
+        ...(canAddComments ? ['comments'] : []),
+        ...(canChangeChecklists ? ['checklist changes'] : []),
+        ...(canReviewDocuments ? ['document review feedback'] : []),
+        ...(canCompleteWorkflow ? ['completion of the current owned workflow step'] : []),
+    ];
+    const allowedWritesSentence = allowedWrites.length > 0
+        ? `Allowed writes: ${allowedWrites.join(', ')}.${canCompleteWorkflow ? ' Use complete_workflow_step only after finishing that step.' : ''}`
+        : 'No Taskforce writes are enabled for this run.';
+    const availableToolNames = new Set(tools.map((tool) => tool.name));
+    const selectedToolCallExample = [
+        { name: 'get_task', arguments: { id: 'T-123' } },
+        { name: 'get_document', arguments: { documentId: 'D-123' } },
+        { name: 'get_initiative', arguments: { id: 'IN-123' } },
+        { name: 'get_workstream', arguments: { id: 'WS-123' } },
+        { name: 'get_config', arguments: {} },
+    ].find((example) => availableToolNames.has(example.name));
+    const toolCallExample = selectedToolCallExample
+        ? { tool: selectedToolCallExample.name, arguments: selectedToolCallExample.arguments }
+        : { tool: tools[0]?.name, arguments: {} };
     return [
         baseSystem,
         '',
         'Taskforce project tools are attached invisibly by the server. Use them when the user asks about current Taskforce tasks, initiatives, workstreams, documents, images, annotations, config, stats, or specific reference labels such as T-123, IN-123, WS-123, D-123, or I-123.',
         readOnly
             ? 'This run is read-only. Use Taskforce tools only to inspect data; no Taskforce writes are available.'
-            : canCompleteWorkflow
-                ? 'Allowed writes: task comments, checklist changes, and completion of the current owned workflow step. Use complete_workflow_step only after finishing that step.'
-                : 'Allowed writes: task comments and checklist changes.',
+            : allowedWritesSentence,
         ...(canCompleteWorkflow && !readOnly ? [
-            'For workflow-step work, call get_task_workflow before acting. If requiresCommentEvidence is true, call add_comment and pass its returned comment.id to complete_workflow_step as evidenceCommentId. After all required work succeeds, call complete_workflow_step before answering. A comment or other task mutation does not complete the workflow step.',
+            'For workflow-step work, call get_task_workflow before acting. Reuse its completionCall arguments exactly; never invent or reuse workflow IDs. If requiresCommentEvidence is true, call add_comment and add its returned comment.id as evidenceCommentId. After all required work succeeds, call complete_workflow_step before answering. A comment or other task mutation does not complete the workflow step.',
         ] : []),
-        ...(taskScope ? [`This run is task-scoped to ${taskScope}. Mutating Taskforce tools must target only this task.`] : []),
+        ...(taskScope ? [`This run is task-scoped to ${taskScope}. Task-targeted mutations must target only this task.`] : []),
         'To use a Taskforce tool, respond with only one JSON object and no prose:',
-        '{"tool":"get_task","arguments":{"id":"T-123"}}',
+        JSON.stringify(toolCallExample),
         'After the server returns a tool result, answer the user normally unless another Taskforce tool is required; if another tool is required, respond with only one more tool-call JSON object.',
         'Do not mention MCP setup or credentials.',
         'Available Taskforce tools:',
@@ -495,7 +514,6 @@ export async function prepareTaskforceAgentMcpBridge(input, dependencies = {}) {
     if (tools.length === 0)
         return null;
     const availableToolNames = new Set(tools.map((tool) => tool.name));
-    const callTool = getRuntimeHandler(runtime, 'tools/call');
     return {
         system: buildToolInstructions(input.system, tools, input.allowedMutationTaskId, input.readOnly),
         availableToolNames: Array.from(availableToolNames),
@@ -509,14 +527,9 @@ export async function prepareTaskforceAgentMcpBridge(input, dependencies = {}) {
             if (scopeFailure)
                 return scopeFailure;
             const effectiveCall = normalizeManagedAgentMcpToolCall(call);
-            const result = await callTool({
-                jsonrpc: '2.0',
-                id: `taskforce-agent-tool-${effectiveCall.name}`,
-                method: 'tools/call',
-                params: {
-                    name: effectiveCall.name,
-                    arguments: effectiveCall.arguments,
-                },
+            const result = await runtime.callTool({
+                name: effectiveCall.name,
+                arguments: effectiveCall.arguments,
             }, {
                 requestId: taskforceAgentMcpRequestId(effectiveCall),
             });

package/dist/shared/adminEdgeProxy.d.ts

@@ -0,0 +1,5 @@
+export interface AdminEdgeProxyContext {
+    request: Request;
+    env?: Record<string, unknown>;
+}
+export declare function handleAdminEdgeProxyRequest(context: AdminEdgeProxyContext): Promise<Response>;

package/dist/shared/adminEdgeProxy.js

@@ -0,0 +1,94 @@
+import { TASKFORCE_CLOUD_ENVIRONMENTS, parseTaskforceCloudEnvironment } from '../config/cloudEnvironment.js';
+import { readSetCookieHeaders, stripSetCookieDomainAttribute } from '../utils/httpSetCookie.js';
+import { resolveAllAdminProxyUpstreamSessionCookieNames, resolveAdminProxyUpstreamSessionCookieName, rewriteAdminProxyRequestCookieHeader, rewriteAdminProxyResponseSetCookie, } from './adminProxySessionCookies.js';
+function readEnvValue(env, key) {
+    const value = env[key];
+    return typeof value === 'string' ? value.trim() : '';
+}
+function resolveProxyEnvironment(context) {
+    const processEnvironment = typeof process !== 'undefined' ? process.env : {};
+    return { ...processEnvironment, ...context.env };
+}
+function resolveUpstreamBaseUrl(environment) {
+    return TASKFORCE_CLOUD_ENVIRONMENTS[environment].appBaseUrl.replace(/\/+$/, '');
+}
+function isCloudflareAccessRedirect(response) {
+    if (response.status < 300 || response.status >= 400)
+        return false;
+    const location = String(response.headers.get('location') || '').trim();
+    if (!location)
+        return false;
+    try {
+        const url = new URL(location);
+        return url.hostname.toLowerCase() === 'stratnexus.cloudflareaccess.com'
+            || url.pathname.startsWith('/cdn-cgi/access/login');
+    }
+    catch {
+        return location.includes('/cdn-cgi/access/login');
+    }
+}
+function jsonError(status, error, code) {
+    return new Response(JSON.stringify({ error, code }), {
+        status,
+        headers: {
+            'Content-Type': 'application/json',
+            'Cache-Control': 'no-store',
+        },
+    });
+}
+export async function handleAdminEdgeProxyRequest(context) {
+    const request = context.request;
+    const environment = parseTaskforceCloudEnvironment(request.headers.get('x-taskforce-cloud-environment'));
+    if (!environment) {
+        return jsonError(400, 'A valid admin cloud environment is required.', 'ADMIN_ENVIRONMENT_REQUIRED');
+    }
+    const proxyEnvironment = resolveProxyEnvironment(context);
+    const upstreamSessionCookieName = resolveAdminProxyUpstreamSessionCookieName(environment, proxyEnvironment);
+    const requestUrl = new URL(request.url);
+    const upstreamUrl = `${resolveUpstreamBaseUrl(environment)}${requestUrl.pathname}${requestUrl.search}`;
+    const headers = new Headers(request.headers);
+    headers.delete('host');
+    const rewrittenCookie = rewriteAdminProxyRequestCookieHeader(headers.get('cookie'), environment, upstreamSessionCookieName, resolveAllAdminProxyUpstreamSessionCookieNames(proxyEnvironment));
+    if (rewrittenCookie)
+        headers.set('cookie', rewrittenCookie);
+    else
+        headers.delete('cookie');
+    headers.set('x-taskforce-origin-host', requestUrl.host);
+    headers.set('x-taskforce-origin-proto', requestUrl.protocol.replace(':', ''));
+    headers.set('x-taskforce-origin-base-url', requestUrl.origin);
+    headers.set('x-taskforce-origin-runtime', 'admin-edge-proxy');
+    const cloudProxyClientId = readEnvValue(proxyEnvironment, 'TASKFORCE_CF_ACCESS_CLIENT_ID')
+        || readEnvValue(proxyEnvironment, 'CF_ACCESS_CLIENT_ID');
+    const cloudProxyClientSecret = readEnvValue(proxyEnvironment, 'TASKFORCE_CF_ACCESS_CLIENT_SECRET')
+        || readEnvValue(proxyEnvironment, 'CF_ACCESS_CLIENT_SECRET');
+    if (cloudProxyClientId && cloudProxyClientSecret) {
+        headers.set('CF-Access-Client-Id', cloudProxyClientId);
+        headers.set('CF-Access-Client-Secret', cloudProxyClientSecret);
+    }
+    const method = request.method.toUpperCase();
+    const upstreamResponse = await fetch(upstreamUrl, {
+        method,
+        headers,
+        body: method !== 'GET' && method !== 'HEAD' ? await request.arrayBuffer() : undefined,
+        redirect: 'manual',
+    });
+    if (isCloudflareAccessRedirect(upstreamResponse)) {
+        return jsonError(401, 'Cloudflare Access authentication required for the selected environment.', 'CLOUDFLARE_ACCESS_REQUIRED');
+    }
+    const responseHeaders = new Headers(upstreamResponse.headers);
+    responseHeaders.delete('access-control-allow-origin');
+    responseHeaders.delete('access-control-allow-credentials');
+    responseHeaders.delete('access-control-allow-methods');
+    responseHeaders.delete('access-control-allow-headers');
+    responseHeaders.set('cache-control', 'no-store');
+    const setCookies = readSetCookieHeaders(upstreamResponse.headers);
+    responseHeaders.delete('set-cookie');
+    for (const setCookie of setCookies) {
+        responseHeaders.append('set-cookie', stripSetCookieDomainAttribute(rewriteAdminProxyResponseSetCookie(setCookie, environment, upstreamSessionCookieName)));
+    }
+    return new Response(upstreamResponse.body, {
+        status: upstreamResponse.status,
+        statusText: upstreamResponse.statusText,
+        headers: responseHeaders,
+    });
+}

package/dist/shared/adminProxySessionCookies.d.ts

@@ -0,0 +1,16 @@
+import { type TaskforceCloudEnvironment } from '../config/cloudEnvironment.js';
+export declare const ADMIN_PROXY_UPSTREAM_SESSION_COOKIE_NAME = "taskforce_session";
+export declare const ADMIN_PROXY_UPSTREAM_SESSION_COOKIE_ENV = "TASKFORCE_ADMIN_PROXY_UPSTREAM_SESSION_COOKIE";
+export declare function resolveAdminProxyUpstreamSessionCookieName(environment: TaskforceCloudEnvironment, env?: Record<string, unknown>): string;
+export declare function resolveAllAdminProxyUpstreamSessionCookieNames(env?: Record<string, unknown>): string[];
+export declare function adminProxySessionCookieName(environment: TaskforceCloudEnvironment): string;
+/**
+ * Replace all browser-visible admin session cookies with the one upstream
+ * session cookie expected by the selected cloud environment.
+ */
+export declare function rewriteAdminProxyRequestCookieHeader(cookieHeader: string | null | undefined, environment: TaskforceCloudEnvironment, upstreamSessionCookieName?: string, additionalSessionCookieNames?: readonly string[]): string;
+/**
+ * Namespace an upstream cloud session for the admin proxy host. Removing the
+ * upstream Domain attribute keeps the isolated session scoped to that proxy.
+ */
+export declare function rewriteAdminProxyResponseSetCookie(setCookie: string, environment: TaskforceCloudEnvironment, upstreamSessionCookieName?: string): string;

package/dist/shared/adminProxySessionCookies.js

@@ -0,0 +1,86 @@
+import { TASKFORCE_CLOUD_ENVIRONMENT_ORDER, } from '../config/cloudEnvironment.js';
+export const ADMIN_PROXY_UPSTREAM_SESSION_COOKIE_NAME = 'taskforce_session';
+export const ADMIN_PROXY_UPSTREAM_SESSION_COOKIE_ENV = 'TASKFORCE_ADMIN_PROXY_UPSTREAM_SESSION_COOKIE';
+const ADMIN_PROXY_SESSION_COOKIE_PREFIX = '__Host-taskforce_admin_session_';
+const LEGACY_ADMIN_PROXY_SESSION_COOKIE_PREFIX = 'taskforce_admin_session_';
+const TASKFORCE_SESSION_COOKIE_NAMES = new Set([
+    ADMIN_PROXY_UPSTREAM_SESSION_COOKIE_NAME,
+    'taskforce_session_prod',
+    'taskforce_session_staging',
+    'taskforce_session_performance',
+]);
+export function resolveAdminProxyUpstreamSessionCookieName(environment, env = {}) {
+    const environmentKey = `${ADMIN_PROXY_UPSTREAM_SESSION_COOKIE_ENV}_${environment.toUpperCase()}`;
+    const configured = String(env[environmentKey] || env[ADMIN_PROXY_UPSTREAM_SESSION_COOKIE_ENV] || '').trim();
+    if (!configured)
+        return ADMIN_PROXY_UPSTREAM_SESSION_COOKIE_NAME;
+    if (!/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(configured)) {
+        throw new Error(`Invalid admin proxy upstream session cookie name for ${environment}.`);
+    }
+    return configured;
+}
+export function resolveAllAdminProxyUpstreamSessionCookieNames(env = {}) {
+    return [...new Set(TASKFORCE_CLOUD_ENVIRONMENT_ORDER.map((environment) => resolveAdminProxyUpstreamSessionCookieName(environment, env)))];
+}
+export function adminProxySessionCookieName(environment) {
+    return `${ADMIN_PROXY_SESSION_COOKIE_PREFIX}${environment}`;
+}
+function cookiePairName(pair) {
+    const separator = pair.indexOf('=');
+    return (separator >= 0 ? pair.slice(0, separator) : pair).trim();
+}
+/**
+ * Replace all browser-visible admin session cookies with the one upstream
+ * session cookie expected by the selected cloud environment.
+ */
+export function rewriteAdminProxyRequestCookieHeader(cookieHeader, environment, upstreamSessionCookieName = ADMIN_PROXY_UPSTREAM_SESSION_COOKIE_NAME, additionalSessionCookieNames = []) {
+    const selectedCookieName = adminProxySessionCookieName(environment);
+    const pairs = String(cookieHeader || '')
+        .split(';')
+        .map((part) => part.trim())
+        .filter(Boolean);
+    const selectedPair = pairs.find((pair) => cookiePairName(pair) === selectedCookieName);
+    const forwardedPairs = pairs.filter((pair) => {
+        const name = cookiePairName(pair);
+        return name !== upstreamSessionCookieName
+            && !additionalSessionCookieNames.includes(name)
+            && !TASKFORCE_SESSION_COOKIE_NAMES.has(name)
+            && !name.startsWith(ADMIN_PROXY_SESSION_COOKIE_PREFIX)
+            && !name.startsWith(LEGACY_ADMIN_PROXY_SESSION_COOKIE_PREFIX);
+    });
+    if (selectedPair) {
+        const separator = selectedPair.indexOf('=');
+        forwardedPairs.push(`${upstreamSessionCookieName}=${selectedPair.slice(separator + 1)}`);
+    }
+    return forwardedPairs.join('; ');
+}
+/**
+ * Namespace an upstream cloud session for the admin proxy host. Removing the
+ * upstream Domain attribute keeps the isolated session scoped to that proxy.
+ */
+export function rewriteAdminProxyResponseSetCookie(setCookie, environment, upstreamSessionCookieName = ADMIN_PROXY_UPSTREAM_SESSION_COOKIE_NAME) {
+    const parts = String(setCookie || '')
+        .split(';')
+        .map((part) => part.trim())
+        .filter(Boolean);
+    if (parts.length === 0)
+        return setCookie;
+    const [nameValue, ...attributes] = parts;
+    const separator = nameValue.indexOf('=');
+    if (separator < 0 || nameValue.slice(0, separator).trim() !== upstreamSessionCookieName) {
+        return setCookie;
+    }
+    const value = nameValue.slice(separator + 1);
+    const hostOnlyAttributes = attributes.filter((attribute) => {
+        const lower = attribute.toLowerCase();
+        return !lower.startsWith('domain=')
+            && !lower.startsWith('path=')
+            && lower !== 'secure';
+    });
+    return [
+        `${adminProxySessionCookieName(environment)}=${value}`,
+        'Path=/',
+        'Secure',
+        ...hostOnlyAttributes,
+    ].join('; ');
+}

package/dist/shared/aiProfileColors.d.ts

@@ -1,5 +1,35 @@
 export declare const AI_PROFILE_GENERIC_GRAY = "#6b7280";
-export declare const AI_PROFILE_COLOR_TOKENS: readonly ["red-500", "orange-500", "amber-500", "green-700", "teal-700", "sky-500", "sky-700", "blue-500", "indigo-700", "violet-500"];
+export declare const AI_PROFILE_SIGNATURE_COLOR_OPTIONS: readonly [{
+    readonly name: "Blue";
+    readonly value: "#4269d0";
+}, {
+    readonly name: "Orange";
+    readonly value: "#efb118";
+}, {
+    readonly name: "Red";
+    readonly value: "#ff725c";
+}, {
+    readonly name: "Cyan";
+    readonly value: "#6cc5b0";
+}, {
+    readonly name: "Green";
+    readonly value: "#3ca951";
+}, {
+    readonly name: "Pink";
+    readonly value: "#ff8ab7";
+}, {
+    readonly name: "Purple";
+    readonly value: "#a463f2";
+}, {
+    readonly name: "Light blue";
+    readonly value: "#97bbf5";
+}, {
+    readonly name: "Brown";
+    readonly value: "#9c6b4e";
+}, {
+    readonly name: "Gray";
+    readonly value: "#9498a0";
+}];
 export declare const AI_PROFILE_COLOR_SOURCES: readonly ["user_override", "agent_explicit", "product_default", "assigned_default", "legacy"];
 export type AiProfileColorSource = typeof AI_PROFILE_COLOR_SOURCES[number];
 export declare function normalizeAiProfileColor(value: unknown): string | null;