@humwick/server 0.130.1 → 0.130.2

package/src/routes/orchestrator-proxy.ts

@@ -1,6 +1,6 @@
 // Auto-split from routes.ts (#299). Domain: orchestrator-proxy.
 import { RELAY_TOKEN_HEADER, SPAWN_PROVIDERS, isRecord } from "@humwick/sdk";
-import { ValidationError, getOrchestrator, orchestratorHeartbeat } from "../db";
+import { ValidationError, getOrchestrator, orchestratorHeartbeatAsync } from "../db";
 import { authorizeRoute, cleanJsonArray, error, json, type Handler } from "./_shared";
 import { cleanStringArray } from "../validation";
 import { emitOrchestratorStatus } from "../sse";
@@ -136,7 +136,7 @@ export const getOrchestratorProviders: Handler = async (req, params) => {
         }
       }
     }
-    const updated = orchestratorHeartbeat(params.id!, {
+    const updated = await orchestratorHeartbeatAsync(params.id!, {
       providers,
       providerStatus: cleanJsonArray(payload.providerStatus, "providerStatus") as OrchestratorRuntimeInput["providerStatus"],
       providerCatalog: cleanJsonArray(payload.providerCatalog, "providerCatalog") as OrchestratorRuntimeInput["providerCatalog"],

package/src/routes/orchestrator.ts

@@ -6,7 +6,7 @@ import { CONTRACT_VERSIONS, parseRuntimeCapabilities, parseRuntimeContracts, par
 import { notifyAgentOffline, notifyAgentSpawnQueued } from "../agent-lifecycle-events";
 import { diagnoseReportedExit } from "../services/reported-exit-death";
 import { VERSION } from "../config";
-import { ValidationError, deleteOrchestrator, effectiveProviderCatalogListAsync, getAgent, getOrchestrator, getOrchestratorAsync, listOrchestrators, listOrchestratorsAsync, orchestratorHeartbeat, orchestratorHeartbeatAsync, recordAgentExitDiagnosticsAsync, reportOrchestratorRosterAsync, setOrchestratorUpgradeState, upsertOrchestratorAsync } from "../db";
+import { ValidationError, deleteOrchestrator, effectiveProviderCatalogListAsync, getAgent, getOrchestrator, getOrchestratorAsync, listOrchestrators, listOrchestratorsAsync, orchestratorHeartbeatAsync, recordAgentExitDiagnosticsAsync, reportOrchestratorRosterAsync, setOrchestratorUpgradeStateAsync, upsertOrchestratorAsync } from "../db";
 import { reconcileOrchestratorSchedulerCommands } from "../services/scheduler-recovery.ts";
 import { recoverRegisteredOrchestrator } from "../services/orchestrator-registration-recovery";
 import { recoverOrchestratorLegacyLandings } from "../services/orchestrator-landing-recovery";
@@ -624,7 +624,7 @@ export const postOrchestratorAction: Handler = async (req, params) => {
           ...(mode === "git-checkout" ? { mode, commitSha, repoUrl } : (npmReuseRepoUrl ? { repoUrl: npmReuseRepoUrl } : {})),
         },
       });
-      setOrchestratorUpgradeState(orch.id, {
+      await setOrchestratorUpgradeStateAsync(orch.id, {
         desiredVersion: targetVersion, ...(mode === "git-checkout" && commitSha ? { targetGitSha: commitSha } : {}),
         status: "pending",
         commandId: command.id,

package/src/routes/project-profile-instructions.ts

@@ -0,0 +1,27 @@
+import { cleanString } from "../validation";
+import { ValidationError } from "../db/connection";
+import { authorizeRoute, error, json, parseBody, type Handler } from "./_shared";
+import { authContextFromRequest } from "../services/auth-context";
+import { PromptVersionConflictError } from "../prompt-version-errors";
+import { listProjectProfileInstructions, mutateProjectProfileInstructions, projectProfileInstructionHistory, readProjectProfileInstructions } from "../services/project-profile-instructions";
+
+export const projectProfileInstructionsRoute: Handler = async (req, params) => {
+  const denied = authorizeRoute(req, { scope: req.method === "GET" ? "agent:read" : "agent:write" });
+  if (denied) return denied;
+  try {
+    const projectId = cleanString(params.id, "projectId", { max: 200 });
+    const profile = cleanString(params.profile ?? params.name, "profile", { max: 200 });
+    if (!projectId || !profile) return json(await listProjectProfileInstructions({ projectId, profile }));
+    const path = new URL(req.url).pathname;
+    if (req.method === "GET") return json(path.endsWith("/history")
+      ? await projectProfileInstructionHistory(projectId, profile)
+      : await readProjectProfileInstructions(projectId, profile));
+    const body = await parseBody<unknown>(req);
+    if (!body.ok) return error(body.error, body.status);
+    return json(await mutateProjectProfileInstructions(authContextFromRequest(req), projectId, profile, body.body, path.endsWith("/restore")));
+  } catch (err) {
+    if (err instanceof PromptVersionConflictError) return json({ error: err.message, current: err.current }, 409);
+    if (err instanceof ValidationError) return error(err.message, /not found/.test(err.message) ? 404 : 400);
+    throw err;
+  }
+};

package/src/routes/project-trust.ts

@@ -5,7 +5,7 @@
 // code runs, and built-in profiles are admin-edited anyway.
 import { isRecord } from "@humwick/sdk";
 import { ValidationError } from "../db";
-import { approveProfileProjectTrust, PROJECT_REVIEW_MODES, PROJECT_TRUST_CAPABILITIES, updateProfileProjectTrust } from "../services/profile-trust";
+import { approveProfileProjectTrust, PROJECT_REVIEW_MODES, PROJECT_TRUST_CAPABILITIES, updateProfileProjectTrustAsync } from "../services/profile-trust";
 import { cleanString, optionalEnum } from "../validation";
 import { auditEvent, error, isAdminRequest, json, normalizeConfigPathParam, parseBody, requestUserAddress, type Handler } from "./_shared";
 import { getAgentProfile } from "../config-store";
@@ -57,7 +57,7 @@ export const patchProjectTrustRoute: Handler = async (req, params) => {
     if (body.ack !== undefined && !Array.isArray(body.ack)) return error("ack must be an array of hooks|mcp", 400);
     const ack = (body.ack as unknown[] | undefined)?.map((capability) => optionalEnum(capability, "ack", PROJECT_TRUST_CAPABILITIES)!);
     const by = requestUserAddress(req);
-    const saved = updateProfileProjectTrust(name, { ...(review ? { review } : {}), ...(ack ? { ack } : {}) }, by);
+    const saved = await updateProfileProjectTrustAsync(name, { ...(review ? { review } : {}), ...(ack ? { ack } : {}) }, by);
     await auditEvent({
       kind: "state",
       title: `Project trust updated: ${saved.value.name}`,

package/src/routes/provider-config.ts

@@ -6,7 +6,7 @@ import { cleanString, cleanStringArray, optionalEnum } from "../validation";
 import { getCommand } from "../commands-db";
 import { deleteCommandAsync } from "../commands-write";
 import { emitCommand, error, json, parseBody, type Handler } from "./_shared";
-import { getProviderConfigEntry, listProviderConfigEntries, migrateLocalProviderConfigs, providerConfigPublic, setProviderConfig, VALID_PROVIDER_CONFIGS } from "../provider-config-store";
+import { getProviderConfigEntry, listProviderConfigEntries, migrateLocalProviderConfigsAsync, providerConfigPublic, setProviderConfigAsync, VALID_PROVIDER_CONFIGS } from "../provider-config-store";
 import { cleanProviderModelLimits } from "../provider-catalog-store";
 import { emitConfigChanged } from "../sse";
 import { setConfigAsync } from "../config-store-write";
@@ -28,9 +28,9 @@ export const getProvidersRoute: Handler = async () => {
   });
 };
 
-export const getProviderConfigsRoute: Handler = (req) => {
+export const getProviderConfigsRoute: Handler = async (req) => {
   const host = new URL(req.url).searchParams.get("host") ?? undefined;
-  migrateLocalProviderConfigs();
+  await migrateLocalProviderConfigsAsync();
   const entries = listProviderConfigEntries(host);
   return json(Object.fromEntries(VALID_PROVIDER_CONFIGS.map((provider) => {
     return [provider, providerConfigPublic(entries[provider] ?? getProviderConfigEntry(provider, host))];
@@ -127,12 +127,12 @@ export const deleteProviderModelRoute: Handler = async (_req, params) => {
   }
 };
 
-export const getProviderConfigRoute: Handler = (_req, params) => {
+export const getProviderConfigRoute: Handler = async (_req, params) => {
   const provider = optionalEnum(params.provider, "provider", VALID_PROVIDER_CONFIGS);
   if (!provider) return error("provider required");
   const host = new URL(_req.url).searchParams.get("host") ?? undefined;
   const includeSecrets = new URL(_req.url).searchParams.get("includeSecrets") === "1";
-  migrateLocalProviderConfigs();
+  await migrateLocalProviderConfigsAsync();
   return json(providerConfigPublic(getProviderConfigEntry(provider, host), { maskEnv: !includeSecrets }));
 };
 
@@ -145,7 +145,7 @@ export const putProviderConfigRoute: Handler = async (req, params) => {
     if (!isRecord(parsed.body)) return error("provider config body must be an object");
     const host = new URL(req.url).searchParams.get("host") ?? undefined;
     const updatedBy = cleanString(parsed.body.updatedBy, "updatedBy", { max: 200 });
-    const entry = setProviderConfig(provider, parsed.body, { host, updatedBy });
+    const entry = await setProviderConfigAsync(provider, parsed.body, { host, updatedBy });
     emitConfigChanged(entry.namespace, entry.key, entry.version);
     return json(providerConfigPublic(entry), entry.version === 1 ? 201 : 200);
   } catch (e) {

package/src/routes/provider-quota-config.ts

@@ -8,7 +8,7 @@ import { error, json, parseBody, type Handler } from "./_shared";
 import {
   getProviderQuotaConfig,
   listProviderQuotaConfigs,
-  setProviderQuotaConfig,
+  setProviderQuotaConfigAsync,
   VALID_QUOTA_CONFIG_PROVIDERS,
 } from "../provider-quota-config-store";
 import { cleanString, optionalEnum } from "../validation";
@@ -40,7 +40,7 @@ export const putProviderQuotaConfigRoute: Handler = async (req, params) => {
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
     const updatedBy = isRecord(parsed.body) ? cleanString(parsed.body.updatedBy, "updatedBy", { max: 200 }) : undefined;
-    return json(setProviderQuotaConfig(provider, parsed.body, { updatedBy }));
+    return json(await setProviderQuotaConfigAsync(provider, parsed.body, { updatedBy }));
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);
     throw e;

package/src/routes/settings.ts

@@ -4,7 +4,7 @@ import { ValidationError } from "../db";
 import { getConfig } from "../config-store";
 import { setConfigAsync } from "../config-store-write";
 import { getUserSettingAsync, setUserSettingAsync } from "../user-settings-async";
-import { ensureProviderConfigDescriptors, migrateLocalProviderConfigs } from "../provider-config-store";
+import { ensureProviderConfigDescriptors, migrateLocalProviderConfigsAsync } from "../provider-config-store";
 import { ensureNotificationSettingDescriptors } from "../notification-settings-store";
 import { NOTIFICATIONS_NAMESPACE } from "../notification-settings";
 import { getSettingDescriptor, listSettingDescriptors, validateSettingValue, PROVIDER_CONFIG_NAMESPACE } from "../settings/registry";
@@ -23,7 +23,7 @@ type SettingEnvelope = SettingEntry;
 // as before the migration (back-compat). Server-runtime/bootstrap/browser tiers ignore this.
 
 export const getSettingsRoute: Handler = async (req) => {
-  migrateLocalProviderConfigs();
+  await migrateLocalProviderConfigsAsync();
   ensureProviderConfigDescriptors();
   ensureNotificationSettingDescriptors();
   return json({ settings: await listVisibleSettings(req) });
@@ -31,7 +31,7 @@ export const getSettingsRoute: Handler = async (req) => {
 
 export const getSettingsNamespaceRoute: Handler = async (req, params) => {
   const namespace = normalizeConfigPathParam(params.namespace, "namespace");
-  migrateLocalProviderConfigs();
+  await migrateLocalProviderConfigsAsync();
   ensureProviderConfigDescriptors();
   if (namespace === NOTIFICATIONS_NAMESPACE) ensureNotificationSettingDescriptors();
   const settings = await listVisibleSettings(req);
@@ -41,7 +41,7 @@ export const getSettingsNamespaceRoute: Handler = async (req, params) => {
 export const getSettingRoute: Handler = async (req, params) => {
   const namespace = normalizeConfigPathParam(params.namespace, "namespace");
   const key = normalizeConfigPathParam(params.key, "key");
-  migrateLocalProviderConfigs();
+  await migrateLocalProviderConfigsAsync();
   ensureProviderConfigDescriptors(namespace === PROVIDER_CONFIG_NAMESPACE ? [key] : []);
   if (namespace === NOTIFICATIONS_NAMESPACE) ensureNotificationSettingDescriptors([key]);
   const descriptor = getSettingDescriptor(namespace, key);
@@ -82,7 +82,7 @@ async function putSetting(req: Request, namespaceRaw: string | undefined, keyRaw
   if (!Object.prototype.hasOwnProperty.call(parsed.body, "value")) return error("value required", 400);
 
   try {
-    migrateLocalProviderConfigs();
+    await migrateLocalProviderConfigsAsync();
     ensureProviderConfigDescriptors(namespace === PROVIDER_CONFIG_NAMESPACE ? [key] : []);
     if (namespace === NOTIFICATIONS_NAMESPACE) ensureNotificationSettingDescriptors([key]);
     const descriptor = getSettingDescriptor(namespace, key);

package/src/routes/stats.ts

@@ -7,7 +7,7 @@ import { listPauses, pauseJob, resumeJobAsync } from "../maintenance/pauses";
 import { defaultIssueRepo } from "../config";
 import { listSpawnPolicies } from "../config-store";
 import { disabledBackingPolicyNames } from "../channel-policy-health";
-import { cancelMaintenanceRun, listMaintenanceJobs, listRecentMaintenanceRuns, listRunningMaintenanceRuns, runLegacyMaintenanceReaper, runMaintenanceJobNow } from "../maintenance";
+import { cancelMaintenanceRun, listMaintenanceJobsAsync, listRecentMaintenanceRuns, listRunningMaintenanceRuns, runLegacyMaintenanceReaper, runMaintenanceJobNow } from "../maintenance";
 import { claudeAppOAuthHealth } from "../claude-app/oauth-http";
 import { getConnector } from "../connectors";
 import { channelsHostEnsureHealthCheck } from "../connector-boot-health";
@@ -66,7 +66,7 @@ export const getHealthRoute: Handler = async () => {
 // #3606 — rolling 60 s load breakdown: callers by rate and CPU, emits, reader-pool ops.
 export const getHubMetricsRoute: Handler = () => json(hubMetricsReport());
 
-export const getMaintenanceJobs: Handler = () => json(listMaintenanceJobs());
+export const getMaintenanceJobs: Handler = async () => json(await listMaintenanceJobsAsync());
 
 // #1728 stage 0 — a POST-HOC diagnostic surface, not a live incident one: it reads the in-memory
 // run registry the scheduler maintains (see src/maintenance/scheduler.ts). That registry can only
@@ -87,7 +87,7 @@ export const postMaintenanceJobRun: Handler = async (req, params) => {
     const parsed = await parseBody<{ overridePause?: unknown }>(req);
     const overridePause = parsed.ok && parsed.body?.overridePause === true;
     const run = await runMaintenanceJobNow(params.id!, { overridePause });
-    return json({ run, jobs: listMaintenanceJobs() }, run.status === "failed" ? 500 : 202);
+    return json({ run, jobs: await listMaintenanceJobsAsync() }, run.status === "failed" ? 500 : 202);
   } catch (e) {
     if (e instanceof Error && e.message.includes("not found")) return error(e.message, 404);
     throw e;
@@ -110,7 +110,7 @@ export const postMaintenanceJobCancel: Handler = async (req, params) => {
   if (cancelledRunIds.length === 0) {
     return json({ ok: false, error: "maintenance job is not running", cancelledRunIds: [] }, 404);
   }
-  return json({ ok: true, cancelledRunIds, requester, jobs: listMaintenanceJobs() });
+  return json({ ok: true, cancelledRunIds, requester, jobs: await listMaintenanceJobsAsync() });
 };
 
 export const getMaintenancePauses: Handler = () => {
@@ -136,7 +136,7 @@ export const postMaintenanceJobPause: Handler = async (req, params) => {
     if (!result.ok) {
       return json({ ok: false, error: "maintenance job already paused", pause: result.pause }, 409);
     }
-    return json({ ok: true, pause: result.pause, jobs: listMaintenanceJobs() });
+    return json({ ok: true, pause: result.pause, jobs: await listMaintenanceJobsAsync() });
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);
     throw e;
@@ -147,7 +147,7 @@ export const postMaintenanceJobResume: Handler = async (_req, params) => {
   try {
     const result = await resumeJobAsync({ jobId: params.id! });
     if (!result.resumed) return error("maintenance job is not paused", 404);
-    return json({ ok: true, ...result, jobs: listMaintenanceJobs() });
+    return json({ ok: true, ...result, jobs: await listMaintenanceJobsAsync() });
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);
     throw e;

package/src/routes/task-http.ts

@@ -1,4 +1,5 @@
-import { resolveActingUser, requestUserAddress, resolveActorLabel, error } from "./_shared";
+import { isRecord } from "@humwick/sdk";
+import { resolveActingUser, requestUserAddress, resolveActorLabel, error, parseBody, parseId } from "./_shared";
 import { ValidationError } from "../db/connection";
 import { authContextFromRequest } from "../services/auth-context";
 import { isRequestAuthorizedFor } from "../security";
@@ -25,3 +26,16 @@ export function taskEntityError(e: unknown): Response {
   }
   throw e;
 }
+
+export async function parseTaskMutation(req: Request, rawId: string | undefined): Promise<
+  { ok: true; id: number; body: Record<string, unknown> } | { ok: false; response: Response }
+> {
+  const id = parseId(rawId);
+  if (id === null) return { ok: false, response: error("invalid task id") };
+  const forbidden = await requireTaskMutationAuth(req, id);
+  if (forbidden) return { ok: false, response: forbidden };
+  const parsed = await parseBody<Record<string, unknown>>(req);
+  if (!parsed.ok) return { ok: false, response: error(parsed.error, parsed.status) };
+  if (!isRecord(parsed.body)) return { ok: false, response: error("JSON object body required") };
+  return { ok: true, id, body: parsed.body };
+}

package/src/routes/task-issues.ts

@@ -6,18 +6,13 @@ import { cleanIssueRefRelation } from "../db/task-issue-relation";
 import { issueRefsFromArgs } from "../services/issue-refs";
 import { cleanString } from "../validation";
 import { isRecord } from "@humwick/sdk";
-import { error, json, parseBody, parseId, type Handler } from "./_shared";
-import { taskHttpActor as actorOf, requireTaskMutationAuth, taskEntityError as entityError } from "./task-http";
+import { error, json, type Handler } from "./_shared";
+import { taskHttpActor as actorOf, parseTaskMutation, taskEntityError as entityError } from "./task-http";
 
 export const postTaskRef: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     // Same alias tolerance + attach-nothing rejection as relay_task_add_ref (#2214), one body.
     return json(await attachTaskRefs(id, {
@@ -33,14 +28,9 @@ export const postTaskRef: Handler = async (req, params) => {
   }
 };
 export const deleteTaskRef: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     const detail = await removeTaskEntityRefAsync(id, {
       issueRefId: cleanString(body.issueRefId, "issueRefId", { max: 120 }),
@@ -57,14 +47,9 @@ export const deleteTaskRef: Handler = async (req, params) => {
 // #833 — comment-on-Task writes THROUGH to the linked GitHub issue (discussion lives in
 // GitHub, never a relay table). Execution telemetry never reaches this path.
 export const postTaskComment: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     const result = await commentOnTaskThrough({
       taskId: id,

package/src/routes/tasks.ts

@@ -2,9 +2,9 @@
 export { postTaskRef, deleteTaskRef, postTaskComment } from "./task-issues";
 import { createPlanTaskAsync, isPlanTaskCreate } from "../services/plan-task-create";
 import { prepareIssueTaskCreate, refreshTaskIssueUpdateAsync } from "../services/task-from-issue";
-import { taskHttpActor as actorOf, requireTaskMutationAuth, taskEntityError as entityError } from "./task-http";
+import { taskHttpActor as actorOf, requireTaskMutationAuth, parseTaskMutation, taskEntityError as entityError } from "./task-http";
 import { MAX_BODY_BYTES } from "../config";
-import { VALID_TASK_STATUSES, agentSessionStatus, auditEvent, dispatchTaskCallbacksInBackground, emitCommand, error, json, normalizeAgentSessionGuard, parseBody, parseId, type Handler } from "./_shared";
+import { VALID_TASK_STATUSES, agentSessionStatus, auditEvent, dispatchTaskCallbacksInBackground, error, json, normalizeAgentSessionGuard, parseBody, parseId, type Handler } from "./_shared";
 import { isRequestAuthorizedFor } from "../security";
 import { authContextFromRequest } from "../services/auth-context";
 import { hasTaskReadAdminScope } from "../task-authz";
@@ -25,7 +25,7 @@ import { cleanIssueRefRelation } from "../db/task-issue-relation";
 import { issueRefsFromArgs } from "../services/issue-refs";
 import { cleanEpoch, cleanMeta, cleanString, dependencyRefField, optionalEnum, taskIdField } from "../validation";
 import { emitMessageClaimed, emitTaskChanged } from "../sse";
-import { errMessage, isRecord, TASK_TERMINAL_STAGES, TASK_DELIVERABLE_STAGES, TASK_DISPATCH_COMPLEXITIES, type TaskBlocker, type TaskDispatch, type TaskGateStatus, type TaskPriority } from "@humwick/sdk";
+import { isRecord, TASK_TERMINAL_STAGES, TASK_DELIVERABLE_STAGES, TASK_DISPATCH_COMPLEXITIES, type TaskBlocker, type TaskDispatch, type TaskGateStatus, type TaskPriority } from "@humwick/sdk";
 import { type AgentSessionGuard, type TaskStatus, type TaskStatusInput } from "../types";
 
 async function taskDetailOr404(id: number) {
@@ -100,6 +100,7 @@ export const postTaskCreate: Handler = async (req) => {
       complexity: optionalEnum(body.complexity, "complexity", TASK_DISPATCH_COMPLEXITIES),
       context: cleanString(body.context, "context", { max: MAX_BODY_BYTES }),
       terminalStage: optionalEnum(body.terminalStage, "terminalStage", TASK_TERMINAL_STAGES),
+      onDeploy: cleanString(body.onDeploy, "onDeploy", { max: 500 }),
       doneWhen: cleanString(body.doneWhen, "doneWhen", { max: MAX_BODY_BYTES }),
       teamId: cleanString(body.teamId, "teamId", { max: 200 }),
       projectId: cleanString(body.projectId, "projectId", { max: 120 }),
@@ -109,6 +110,7 @@ export const postTaskCreate: Handler = async (req) => {
       // Raw passthrough (same convention as `dispatch` above) — validated inside
       // createDeliverableTask (cleanTags / cleanTaskPriority), not at the route layer.
       tags: body.tags as string[] | undefined,
+      paths: body.paths as string[] | undefined,
       priority: body.priority as TaskPriority | undefined,
       // Same alias-tolerant normalization the MCP surface uses (#2214) — one home, both transports.
       issueRefs: issueRefsFromArgs(body),
@@ -148,21 +150,10 @@ export const postTaskCreate: Handler = async (req) => {
   }
 };
 
-
-
-
-
-
-
 export const patchTaskEntity: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     if (body.refreshIssue !== undefined) return json(await refreshTaskIssueUpdateAsync(id, body, actorOf(req)));
     const detail = await updateTaskEntityAsync(id, {
@@ -171,6 +162,7 @@ export const patchTaskEntity: Handler = async (req, params) => {
       ...(body.complexity !== undefined ? { complexity: optionalEnum(body.complexity, "complexity", TASK_DISPATCH_COMPLEXITIES) } : {}),
       ...(body.context !== undefined ? { context: cleanString(body.context, "context", { max: MAX_BODY_BYTES }) ?? "" } : {}),
       ...(body.latestSteer !== undefined ? { latestSteer: cleanString(body.latestSteer, "latestSteer", { max: MAX_BODY_BYTES }) ?? "" } : {}),
+      ...(body.onDeploy !== undefined ? { onDeploy: cleanString(body.onDeploy, "onDeploy", { max: 500 }) ?? "" } : {}),
       ...(body.doneWhen !== undefined ? { doneWhen: cleanString(body.doneWhen, "doneWhen", { max: MAX_BODY_BYTES }) ?? "" } : {}),
       ...(body.dispatch !== undefined ? { dispatch: body.dispatch as TaskDispatch } : {}),
       ...(body.teamId !== undefined ? { teamId: cleanString(body.teamId, "teamId", { max: 200 }) ?? "" } : {}),
@@ -180,6 +172,7 @@ export const patchTaskEntity: Handler = async (req, params) => {
       // survive into updateDeliverableTask, which cleanString's `?? ""` collapse would erase.
       ...(body.terminalStage !== undefined ? { terminalStage: body.terminalStage === null ? null : optionalEnum(body.terminalStage, "terminalStage", TASK_TERMINAL_STAGES) } : {}),
       ...(body.tags !== undefined ? { tags: body.tags as string[] | null } : {}),
+      ...(body.paths !== undefined ? { paths: body.paths as string[] | null } : {}),
       ...(body.priority !== undefined ? { priority: body.priority as TaskPriority | null } : {}),
       actor: actorOf(req),
     });
@@ -190,14 +183,9 @@ export const patchTaskEntity: Handler = async (req, params) => {
 };
 
 export const postTaskEntityStatus: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     const detail = await setTaskStatusControl(id, {
       status: body.status as TaskStatus,
@@ -213,14 +201,9 @@ export const postTaskEntityStatus: Handler = async (req, params) => {
 };
 
 export const postTaskEntityStage: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     const detail = await setTaskEntityStageAsync(id, {
       deliverableStage: optionalEnum(body.deliverableStage, "deliverableStage", TASK_DELIVERABLE_STAGES) as any,
@@ -235,14 +218,9 @@ export const postTaskEntityStage: Handler = async (req, params) => {
 };
 
 export const postTaskEntityGate: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     return json(await recordTaskEntityGateAsync(id, {
       gate: cleanString(body.gate, "gate", { required: true, max: 120 })!,
@@ -345,14 +323,9 @@ export const deleteTaskRelated: Handler = async (req, params) => {
 };
 
 export const postTaskAssign: Handler = async (req, params) => {
-  const id = parseId(params.id);
-  if (id === null) return error("invalid task id");
-  const forbidden = await requireTaskMutationAuth(req, id);
-  if (forbidden) return forbidden;
-  const parsed = await parseBody<Record<string, unknown>>(req);
-  if (!parsed.ok) return error(parsed.error, parsed.status);
-  const body = parsed.body;
-  if (!isRecord(body)) return error("JSON object body required");
+  const parsed = await parseTaskMutation(req, params.id);
+  if (!parsed.ok) return parsed.response;
+  const { id, body } = parsed;
   try {
     const detail = await assignTaskEntityAgentAsync(id, cleanString(body.agentId, "agentId", { required: true, max: 200 })!, cleanString(body.role, "role", { max: 120 }), actorOf(req));
     return json(detail);
@@ -444,10 +417,6 @@ export const postWorkspaceWithdrawLand: Handler = async (req) => {
   }
 };
 
-
-
-
-
 export const postClaimTask: Handler = async (req, params) => {
   const id = parseId(params.id);
   if (id === null) return error("invalid task id");

package/src/routes/team-templates.ts

@@ -1,5 +1,5 @@
 import { authContextFromRequest } from "../services/auth-context";
-import { deleteTeamTemplate, getTeamTemplate, listTeamTemplates, saveTeamTemplate } from "../services/team-templates";
+import { deleteTeamTemplateAsync, getTeamTemplate, listTeamTemplates, saveTeamTemplateAsync } from "../services/team-templates";
 import { cleanString } from "../validation";
 import { authorizeRoute, error, json, parseBody, type Handler } from "./_shared";
 
@@ -39,7 +39,7 @@ export const postTeamTemplateRoute: Handler = async (req) => {
   const parsed = await parseBody<Record<string, unknown>>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
-    return json(saveTeamTemplate(parsed.body ?? {}, updatedBy(req)), 201);
+    return json(await saveTeamTemplateAsync(parsed.body ?? {}, updatedBy(req)), 201);
   } catch (err) {
     return routeError(err);
   }
@@ -51,15 +51,15 @@ export const putTeamTemplateRoute: Handler = async (req, params) => {
   const parsed = await parseBody<Record<string, unknown>>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
-    return json(saveTeamTemplate({ ...(parsed.body ?? {}), slug: slugParam(params) }, updatedBy(req)));
+    return json(await saveTeamTemplateAsync({ ...(parsed.body ?? {}), slug: slugParam(params) }, updatedBy(req)));
   } catch (err) {
     return routeError(err);
   }
 };
 
-export const deleteTeamTemplateRoute: Handler = (req, params) => {
+export const deleteTeamTemplateRoute: Handler = async (req, params) => {
   const denied = authorizeRoute(req, { scope: "system:admin" });
   if (denied) return denied;
   const slug = slugParam(params);
-  return json({ slug, deleted: deleteTeamTemplate(slug, updatedBy(req)) });
+  return json({ slug, deleted: await deleteTeamTemplateAsync(slug, updatedBy(req)) });
 };

package/src/routes/teams-config.ts

@@ -1,4 +1,4 @@
-import { getTeamsConfig, setTeamsConfig } from "../teams-config-store";
+import { getTeamsConfig, setTeamsConfigAsync } from "../teams-config-store";
 import { cleanString } from "../validation";
 import { error, json, parseBody, type Handler } from "./_shared";
 import { isRecord } from "@humwick/sdk";
@@ -11,5 +11,5 @@ export const putTeamsConfigRoute: Handler = async (req) => {
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   const updatedBy = isRecord(parsed.body) ? cleanString(parsed.body.updatedBy, "updatedBy", { max: 200 }) : undefined;
-  return json(setTeamsConfig(parsed.body, { updatedBy }));
+  return json(await setTeamsConfigAsync(parsed.body, { updatedBy }));
 };

package/src/routes/tokens.ts

@@ -6,13 +6,19 @@ import { ValidationError, getOrchestrator, upsertIntegrationRegistry } from "../
 import { auditEvent, authAuditMetadata, authorizeRoute, error, isRootCredentialRequest, json, parseBody, resolveActingUser, type Handler } from "./_shared";
 import { cleanString, cleanStringArray, cleanTokenConstraints, optionalEnum } from "../validation";
 import { deleteTokenProfile, getToken, getTokenProfile, listTokenProfiles, listTokens, updateTokenProfile, upsertTokenProfile } from "../token-db";
-import { createTokenAsync, handoffTokenAsync, revokeTokenAsync } from "../token-db-write";
+import { createTokenAsync, revokeTokenAsync } from "../token-db-write";
 import { getComponentAuth, getIntegrationAuth, isAuthorized } from "../security";
-import { issueIntegrationRuntimeToken, issueInteractiveRunnerRuntimeToken, issueMcpRuntimeToken, reissueRunnerRuntimeToken, remintRunnerRuntimeToken } from "../runtime-tokens";
+import { handoffRunnerTokenAsync, issueIntegrationRuntimeToken, issueInteractiveRunnerRuntimeToken, issueMcpRuntimeToken, reissueRunnerRuntimeToken, remintRunnerRuntimeToken, type RunnerTokenMintRefusal } from "../runtime-tokens";
 import { type SpawnProvider } from "../types";
 
 export const getTokens: Handler = () => json(listTokens());
 
+// #3775 — a rate-limited runner token mint is a 429 with Retry-After; any other refusal stays 403.
+function mintRefused(refusal: RunnerTokenMintRefusal): Response {
+  if (refusal.retryAfterSeconds === undefined) return error(refusal.error, 403);
+  return Response.json({ error: refusal.error, retryAfterSeconds: refusal.retryAfterSeconds }, { status: 429, headers: { "Retry-After": String(refusal.retryAfterSeconds) } });
+}
+
 export const getTokenMe: Handler = (req) => {
   const component = getComponentAuth(req);
   if (component) {
@@ -103,11 +109,12 @@ export const postRuntimeTokenRenew: Handler = async (req) => {
   const auth = getComponentAuth(req);
   if (!auth?.jti) return error("scoped runtime token required", 403);
   if (auth.role !== "provider") return error("provider runtime token required", 403);
-  const renewed = await handoffTokenAsync({
+  const renewed = await handoffRunnerTokenAsync(auth.sub, {
     jti: auth.jti,
     allowedProfileIds: ["provider-agent", "provider-interactive"],
     createdBy: `renew:${auth.jti}`,
   });
+  if (renewed && "retryAfterSeconds" in renewed) return mintRefused({ error: "runtime token mint rate limited", ...renewed });
   if (!renewed) return error("runtime token cannot be renewed", 403);
   await auditEvent({
     // Keyed by the successor, so a replayed handoff (#1245) records one renewal.
@@ -151,7 +158,7 @@ export const postRuntimeTokenRemint: Handler = async (req) => {
     throw e;
   }
   const result = await remintRunnerRuntimeToken(auth, `remint:${auth.jti}`);
-  if ("error" in result) return error(result.error, 403);
+  if ("error" in result) return mintRefused(result);
   if ("unchanged" in result) return json(result);
   await auditEvent({
     clientId: "server-runtime-token-remint-" + result.record.jti,
@@ -180,7 +187,7 @@ export const postOrchestratorRunnerToken: Handler = async (req, params) => {
     orchestratorId: orch.id,
     createdBy: `orchestrator-remint:${orch.id}`,
   });
-  if ("error" in result) return error(result.error, 403);
+  if ("error" in result) return mintRefused(result);
   await auditEvent({
     clientId: "server-runner-token-remint-" + result.record.jti,
     kind: "state",