@humwick/server 0.130.1 → 0.130.3

package/src/routes/users.ts

@@ -60,14 +60,14 @@ export const getMe: Handler = (req) => {
   return user ? json({ ...user, hasPassword: hasPasswordLogin(user.id) } satisfies CurrentUser) : error("user not found", 404);
 };
 
-export const patchMe: Handler = (req) => patchUserProfile(req, { id: requestUserId(req) });
+export const patchMe: Handler = async (req) => (await patchUserProfile(req, { id: requestUserId(req) }));
 
-export const patchUserById: Handler = (req, params) => patchUserProfile(req, params);
+export const patchUserById: Handler = async (req, params) => (await patchUserProfile(req, params));
 
 async function patchUserProfile(req: Request, params: Record<string, string>): Promise<Response> {
   try {
     const userId = userIdParam(req, params);
-    if (!canManageUser(req, userId)) return authorityDenied(req, "forbidden");
+    if (!canManageUser(req, userId)) return (await authorityDenied(req, "forbidden"));
     const parsed = await parseBody<unknown>(req);
     if (!parsed.ok) return error(parsed.error, parsed.status);
     if (!isRecord(parsed.body)) return error("body must be an object");
@@ -76,14 +76,14 @@ async function patchUserProfile(req: Request, params: Record<string, string>): P
     const role = optionalEnum(body.role, "role", INVITE_ROLES);
     const status = optionalEnum(body.status, "status", ACCOUNT_STATUSES);
     if (role || status) {
-      if (!isAdminRequest(req)) return authorityDenied(req, "only an admin can change a user's role or status");
+      if (!isAdminRequest(req)) return (await authorityDenied(req, "only an admin can change a user's role or status"));
       const before = getUser(userId);
       const after = await changeUserAccess({ actorUserId: requestUserId(req), userId, role, status });
-      if (before && after.role !== before.role) recordUserManagement(req, userId, "change role", { from: before.role, to: after.role });
-      if (before && after.status !== before.status) recordUserManagement(req, userId, after.status === "suspended" ? "suspend" : "reactivate");
+      if (before && after.role !== before.role) (await recordUserManagement(req, userId, "change role", { from: before.role, to: after.role }));
+      if (before && after.status !== before.status) (await recordUserManagement(req, userId, after.status === "suspended" ? "suspend" : "reactivate"));
     }
     const displayName = cleanString(body.displayName, "displayName", { required: !role && !status, max: 120 });
-    if (displayName) return json(updateUserDisplayName({ userId, displayName }));
+    if (displayName) return json((await updateUserDisplayName({ userId, displayName })));
     const user = userOr404(userId);
     return user instanceof Response ? user : json(user);
   } catch (e) {
@@ -91,9 +91,9 @@ async function patchUserProfile(req: Request, params: Record<string, string>): P
   }
 }
 
-export const postMyAvatar: Handler = (req) => postUserAvatar(req, { id: requestUserId(req) });
+export const postMyAvatar: Handler = async (req) => (await postUserAvatar(req, { id: requestUserId(req) }));
 
-export const postUserAvatarById: Handler = (req, params) => postUserAvatar(req, params);
+export const postUserAvatarById: Handler = async (req, params) => (await postUserAvatar(req, params));
 
 async function avatarUploadInput(req: Request): Promise<{ bytes: Uint8Array; filename?: string; mediaType: string; digest?: string }> {
   const contentType = req.headers.get("content-type") ?? "";
@@ -123,7 +123,7 @@ async function postUserAvatar(req: Request, params: Record<string, string>): Pro
     const userId = userIdParam(req, params);
     const user = userOr404(userId);
     if (user instanceof Response) return user;
-    if (!canManageUser(req, userId)) return authorityDenied(req, "forbidden");
+    if (!canManageUser(req, userId)) return (await authorityDenied(req, "forbidden"));
     const input = await avatarUploadInput(req);
     const result = await storeUserAvatar({ userId, actor: requestUserAddress(req), ...input });
     return json(result, 201);
@@ -132,25 +132,25 @@ async function postUserAvatar(req: Request, params: Record<string, string>): Pro
   }
 }
 
-export const deleteMyAvatar: Handler = (req) => deleteUserAvatar(req, { id: requestUserId(req) });
+export const deleteMyAvatar: Handler = async (req) => (await deleteUserAvatar(req, { id: requestUserId(req) }));
 
-export const deleteUserAvatarById: Handler = (req, params) => deleteUserAvatar(req, params);
+export const deleteUserAvatarById: Handler = async (req, params) => (await deleteUserAvatar(req, params));
 
 async function deleteUserAvatar(req: Request, params: Record<string, string>): Promise<Response> {
   try {
     const userId = userIdParam(req, params);
     const user = userOr404(userId);
     if (user instanceof Response) return user;
-    if (!canManageUser(req, userId)) return authorityDenied(req, "forbidden");
+    if (!canManageUser(req, userId)) return (await authorityDenied(req, "forbidden"));
     return json(await removeUserAvatar({ userId }));
   } catch (e) {
     return profileError(e);
   }
 }
 
-export const getUserAvatar: Handler = (req, params) => serveUserAvatar(req, params, false);
+export const getUserAvatar: Handler = async (req, params) => (await serveUserAvatar(req, params, false));
 
-export const headUserAvatar: Handler = (req, params) => serveUserAvatar(req, params, true);
+export const headUserAvatar: Handler = async (req, params) => (await serveUserAvatar(req, params, true));
 
 async function serveUserAvatar(req: Request, params: Record<string, string>, head: boolean): Promise<Response> {
   const userId = userIdParam(req, params);
@@ -158,7 +158,7 @@ async function serveUserAvatar(req: Request, params: Record<string, string>, hea
   if (!user?.avatarArtifactId) return error("avatar not found", 404);
   const artifact = await getArtifactAsync(user.avatarArtifactId);
   if (!artifact) return error("avatar artifact not found", 404);
-  if (!canReadAvatar(req, userId, artifact)) return authorityDenied(req, "forbidden");
+  if (!canReadAvatar(req, userId, artifact)) return (await authorityDenied(req, "forbidden"));
   const blob = await getArtifactBlobAsync(artifact.blobDigest);
   if (!blob) return error("avatar blob not found", 404);
   const headers = {
@@ -183,15 +183,15 @@ export const invitesDisabled = () => error("user invites are disabled", 404);
 /** POST /api/users/invites — admin only. The code is shown once; share `/invite/<code>` by hand. */
 export const postUserInvite: Handler = async (req) => {
   if (!userInvitesEnabled()) return invitesDisabled();
-  if (!isAdminRequest(req)) return authorityDenied(req, "only an admin can invite users");
+  if (!isAdminRequest(req)) return (await authorityDenied(req, "only an admin can invite users"));
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   const body = isRecord(parsed.body) ? parsed.body : {};
   try {
     const role = optionalEnum(body.role, "role", INVITE_ROLES) ?? "operator";
     const displayName = cleanString(body.displayName, "displayName", { max: 120 });
-    const { invite, code } = createInvite({ role, displayName, createdBy: requestUserId(req) });
-    recordUserManagement(req, `invite:${invite.id}`, "create invite", { role, ...(displayName ? { displayName } : {}) });
+    const { invite, code } = (await createInvite({ role, displayName, createdBy: requestUserId(req) }));
+    (await recordUserManagement(req, `invite:${invite.id}`, "create invite", { role, ...(displayName ? { displayName } : {}) }));
     return json({ invite, code, path: `/invite/${code}` }, 201);
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);
@@ -202,7 +202,7 @@ export const postUserInvite: Handler = async (req) => {
 /** PUT /api/users/me/password — a signed-in user, or the admin token for the default admin. */
 export const putMyPassword: Handler = async (req) => {
   const acting = resolveActingUser(req);
-  if (!acting) return authorityDenied(req, "sign in to set a password");
+  if (!acting) return (await authorityDenied(req, "sign in to set a password"));
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   if (!isRecord(parsed.body)) return error("password required");
@@ -219,11 +219,11 @@ export const putMyPassword: Handler = async (req) => {
 
 /** DELETE /api/users/:id/sessions — sign the user out everywhere; their next call gets 401. */
 export const deleteUserSessions: Handler = async (req, params) => {
-  if (!isAdminRequest(req)) return authorityDenied(req, "only an admin can sign a user out");
+  if (!isAdminRequest(req)) return (await authorityDenied(req, "only an admin can sign a user out"));
   try {
     const userId = decodeURIComponent(params.id!);
     const revoked = await revokeUserSessions(userId);
-    recordUserManagement(req, userId, "revoke sessions", { revoked });
+    (await recordUserManagement(req, userId, "revoke sessions", { revoked }));
     return json({ revoked });
   } catch (e) {
     return profileError(e);
@@ -232,7 +232,7 @@ export const deleteUserSessions: Handler = async (req, params) => {
 
 /** POST /api/users/:id/handover — every agent of the user gets `toUserId` as its principal. */
 export const postUserHandover: Handler = async (req, params) => {
-  if (!isAdminRequest(req)) return authorityDenied(req, "only an admin can hand over agents");
+  if (!isAdminRequest(req)) return (await authorityDenied(req, "only an admin can hand over agents"));
   try {
     const parsed = await parseBody<unknown>(req);
     if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -240,7 +240,7 @@ export const postUserHandover: Handler = async (req, params) => {
     const toUserId = cleanString(body.toUserId, "toUserId", { required: true, max: 64 })!;
     const fromUserId = decodeURIComponent(params.id!);
     const agentIds = await handOverAgents({ fromUserId, toUserId });
-    recordUserManagement(req, fromUserId, "hand over agents", { toUserId, agentIds });
+    (await recordUserManagement(req, fromUserId, "hand over agents", { toUserId, agentIds }));
     return json({ toUserId, agentIds });
   } catch (e) {
     return profileError(e);

package/src/routes/viewer-read.ts

@@ -12,15 +12,15 @@ export function scopeResourceReads(method: string, path: string, handler: Handle
     const viewer = viewerScopeForRequest(req);
     if (!viewer || viewer.seesAll) return handler(req, params);
     const id = params.id!;
-    if (resource === "agents" && !agentVisibleTo(viewer, id)) return authorityDenied(req, "agent not found", 404, id, "read agent");
+    if (resource === "agents" && !agentVisibleTo(viewer, id)) return (await authorityDenied(req, "agent not found", 404, id, "read agent"));
     if (resource === "tasks") {
       const taskId = parseId(id);
-      if (taskId !== null && !taskVisibleTo(viewer, { id: taskId })) return authorityDenied(req, "task not found", 404, id, "read task");
+      if (taskId !== null && !taskVisibleTo(viewer, { id: taskId })) return (await authorityDenied(req, "task not found", 404, id, "read task"));
     }
     if (resource === "messages") {
       const messageId = parseId(id);
       const message = messageId === null ? null : await getMessageAsync(messageId);
-      if (message && !messageVisibleTo(viewer, message)) return authorityDenied(req, "you can only read your own messages", 403, id, path.endsWith("/thread") ? "read thread" : "read message");
+      if (message && !messageVisibleTo(viewer, message)) return (await authorityDenied(req, "you can only read your own messages", 403, id, path.endsWith("/thread") ? "read thread" : "read message"));
     }
     return handler(req, params);
   };

package/src/routes/web-tool-calls.ts

@@ -5,27 +5,27 @@ import { ingestWebToolCall, queryWebSearchBudget, queryWebToolCalls, queryWebToo
 import { authorizeRoute, error, json, parseBody, type Handler } from "./_shared";
 
 export const getWebToolCalls: Handler = async req => {
-  const denied = authorizeRoute(req, { scope: "agent:read" });
+  const denied = (await authorizeRoute(req, { scope: "agent:read" }));
   if (denied) return denied;
   try { return json(await queryWebToolCalls(Object.fromEntries(new URL(req.url).searchParams))); }
   catch (e) { if (e instanceof ValidationError) return error(e.message, 400); throw e; }
 };
 
 export const getWebToolCallSummary: Handler = async req => {
-  const denied = authorizeRoute(req, { scope: "agent:read" });
+  const denied = (await authorizeRoute(req, { scope: "agent:read" }));
   if (denied) return denied;
   try { return json(await queryWebToolCallSummary(Object.fromEntries(new URL(req.url).searchParams))); }
   catch (e) { if (e instanceof ValidationError) return error(e.message, 400); throw e; }
 };
 
 export const getWebSearchBudget: Handler = async req => {
-  const denied = authorizeRoute(req, { scope: "agent:read" });
+  const denied = (await authorizeRoute(req, { scope: "agent:read" }));
   if (denied) return denied;
   return json(await queryWebSearchBudget());
 };
 
 export const postWebToolCall: Handler = async req => {
-  const denied = authorizeRoute(req, { scope: "agent:write" });
+  const denied = (await authorizeRoute(req, { scope: "agent:write" }));
   if (denied) return denied;
   const body = await parseBody<unknown>(req);
   if (!body.ok) return error(body.error, body.status);

package/src/routes/workflows.ts

@@ -1,7 +1,7 @@
 import { parseWorkflowDecisionResponse } from "../services/workflow-decisions";
 // #3076 — the dashboard's workflow run reads: the run list (by status and project), one run, the stats
 // window and the workflows that ran, all from the workflow run records relay_workflow_get reads, with its visibility rule.
-// #3120 — the catalog. #3166 — cancel a run, as relay_workflow_cancel does.
+// #3120 — the catalog. #3166 — cancel a run, as relay_workflow_cancel does. #3757 — pause and unpause one.
 import { OpError } from "@humwick/kernel";
 import { isRecord, WORKFLOW_STATS_WINDOWS, type WorkflowStatsWindow } from "@humwick/sdk";
 import { resolveProjectAsync, ValidationError } from "../db";
@@ -9,8 +9,9 @@ import { McpNotFoundError } from "../mcp-errors";
 import { authContextFromRequest } from "../services/auth-context";
 import { ServiceAuthError } from "../services/errors";
 import { readWorkflowCatalog } from "../services/workflow-catalog";
+import { parseWorkflowPins } from "../services/workflow-pins";
 import { requireSpawnBudget } from "../spawn-budget";
-import { amendWorkflowRunBudget, cancelWorkflowRun, getWorkflowRun, readWorkflowRunBudget, listWorkflowRuns, resumeWorkflowRun, startWorkflowRun } from "../services/workflow-runs";
+import { amendWorkflowRunBudget, cancelWorkflowRun, getWorkflowRun, pauseWorkflowRun, readWorkflowRunBudget, listWorkflowRuns, resumeWorkflowRun, startWorkflowRun } from "../services/workflow-runs";
 import { workflowDefinitions, workflowStats } from "../services/workflow-stats";
 import { cleanString, taskIdField } from "../validation";
 import { error, json, parseBody, type Handler } from "./_shared";
@@ -83,7 +84,22 @@ export const postWorkflowRunCancelRoute: Handler = async (req, params) => {
   }
 };
 
-function budgetRouteError(e: unknown): Response {
+/** #3757 — pause (a `reason` is required) or unpause a run, as relay_workflow_resume's `pause` does; the dashboard's buttons use these. */
+function workflowRunPauseRoute(pause: boolean): Handler {
+  return async (req, params) => {
+    const parsed = await parseBody<unknown>(req);
+    if (!parsed.ok) return error(parsed.error, parsed.status);
+    if (parsed.body !== null && !isRecord(parsed.body)) return error("body must be a JSON object", 400);
+    try {
+      const reason = cleanString(parsed.body?.reason, "reason", { max: 2000 });
+      return json(await pauseWorkflowRun({ runId: params.runId!, pause, ...(reason ? { reason } : {}) }, authContextFromRequest(req)));
+    } catch (e) { return runRouteError(e); }
+  };
+}
+export const postWorkflowRunPauseRoute = workflowRunPauseRoute(true);
+export const postWorkflowRunUnpauseRoute = workflowRunPauseRoute(false);
+
+function runRouteError(e: unknown): Response {
   if (e instanceof McpNotFoundError) return error(e.message, 404);
   if (e instanceof ServiceAuthError) return error(e.message, 403);
   if (e instanceof ValidationError) return error(e.message, 400);
@@ -91,7 +107,7 @@ function budgetRouteError(e: unknown): Response {
 }
 
 export const getWorkflowRunBudgetRoute: Handler = async (req, params) => {
-  try { return json(await readWorkflowRunBudget(params.runId!, authContextFromRequest(req))); } catch (e) { return budgetRouteError(e); }
+  try { return json(await readWorkflowRunBudget(params.runId!, authContextFromRequest(req))); } catch (e) { return runRouteError(e); }
 };
 
 export const patchWorkflowRunBudgetRoute: Handler = async (req, params) => {
@@ -100,7 +116,7 @@ export const patchWorkflowRunBudgetRoute: Handler = async (req, params) => {
   try {
     const { tokenCap } = requireSpawnBudget(parsed.body);
     return json(await amendWorkflowRunBudget({ runId: params.runId!, tokenCap }, authContextFromRequest(req)));
-  } catch (e) { return budgetRouteError(e); }
+  } catch (e) { return runRouteError(e); }
 };
 
 export const postWorkflowRunResumeRoute: Handler = async (req, params) => {
@@ -108,7 +124,7 @@ export const postWorkflowRunResumeRoute: Handler = async (req, params) => {
   if (!parsed.ok) return error(parsed.error, parsed.status);
   if (!isRecord(parsed.body)) return error("body must be a JSON object", 400);
   try {
-    return json(await resumeWorkflowRun({ runId: params.runId!, decision: parseWorkflowDecisionResponse(parsed.body.decision), activationId: cleanString(parsed.body.activationId, "activationId", { max: 2000 }), note: cleanString(parsed.body.note, "note", { max: 8000 }) }, authContextFromRequest(req)));
+    return json(await resumeWorkflowRun({ runId: params.runId!, pins: parseWorkflowPins(parsed.body.pins), step: cleanString(parsed.body.step, "step", { max: 64 }), decision: parseWorkflowDecisionResponse(parsed.body.decision), activationId: cleanString(parsed.body.activationId, "activationId", { max: 2000 }), note: cleanString(parsed.body.note, "note", { max: 8000 }) }, authContextFromRequest(req)));
   } catch (e) {
     if (e instanceof McpNotFoundError) return error(e.message, 404);
     if (e instanceof ServiceAuthError) return error(e.message, 403);
@@ -131,7 +147,6 @@ export const postWorkflowRunStartRoute: Handler = async (req) => {
   try {
     const workflow = cleanString(parsed.body.workflow, "workflow", { max: 64 });
     if (!workflow) throw new ValidationError("workflow is required");
-    const { parseWorkflowPins } = await import("../services/workflow-pins");
     return json(await startWorkflowRun({ workflow, taskId: taskIdField(parsed.body.taskId), pins: parseWorkflowPins(parsed.body.pins), inputs: parsed.body.inputs as Record<string, unknown> | undefined, requestKey: cleanString(parsed.body.requestKey, "requestKey", { max: 200 }), budget: parsed.body.budget }, authContextFromRequest(req)), 202);
   } catch (e) {
     if (e instanceof ServiceAuthError) return error(e.message, 403);

package/src/routes/workspaces.ts

@@ -1,19 +1,20 @@
+import { createCommandAsync } from "../commands-write";
+import { deleteWorkspaceAsync } from "../db/lifecycle-tail-async";
 // Auto-split from routes.ts (#299). Domain: workspaces.
 import { RELAY_TOKEN_HEADER, isRecord } from "@humwick/sdk";
 import { TERMINAL_WORKSPACE_STATUSES, describeWorkspacePhase, landReceipt } from "../workspace-phase";
 import { VALID_WORKSPACE_STATUSES, cleanMeta, cleanString, optionalEnum } from "../validation";
-import { ValidationError, deleteWorkspace, getAgent, getWorkspace, listMergeLeases, listOrchestrators, listRepoStewards, listWorkspaces, updateWorkspaceStatus, withResolvedWorkspaceProjectsAsync } from "../db";
+import { ValidationError, getAgent, getWorkspace, listMergeLeases, listOrchestrators, listRepoStewards, listWorkspaces, updateWorkspaceStatus, withResolvedWorkspaceProjectsAsync } from "../db";
 import { recoverIsolatedWorkspace } from "../services/workspace-recovery";
 import { WORKSPACE_ACTIONS, applyWorkspaceAction, waitForWorkspaceStatus } from "../workspace-actions";
 import { buildWorkspaceCleanupCommand, cleanupStaleWorkspaces } from "../workspace-cleanup-stale";
 import { auditEvent, authAuditMetadata, authorizeRoute, emitCommand, error, isRootCredentialRequest, json, parseBody, type Handler } from "./_shared";
 import { collectWorkspaceOrphans } from "../workspace-orphans";
-import { createCommand, getCommand } from "../commands-db";
-import { LAND_STRATEGIES, isOwnerAlive, isOwnerProcessConfirmedGone, withOwnerOnline } from "../workspace-merge";
+import { getCommand } from "../commands-db";
+import { LAND_STRATEGIES, isOwnerAlive, isOwnerProcessConfirmedGone, withOwnerOnline, AUTO_MERGE_POLICIES } from "../workspace-merge";
 import { isPathWithinBase } from "../utils";
 import { resolve } from "node:path";
 import { type WorkspaceAutoMergePolicy, type WorkspaceDiagnostics, type WorkspaceGitState, type WorkspaceLandGateLevel, type WorkspaceLandingPolicy, type WorkspaceMergeStrategy, type WorkspaceRecoveryBranch, type WorkspaceRecord, type WorkspaceStatus } from "../types";
-import { AUTO_MERGE_POLICIES } from "../workspace-merge";
 import { workspaceActiveClaim } from "../workspace-claim";
 import { resolveCoordinatorAgentId } from "../steward-identity";
 import { relayToken } from "../config";
@@ -231,7 +232,7 @@ export const getWorkspaceRecoveryBranches: Handler = async (req) => {
 };
 
 export const postWorkspaceRecoveryBranchDiscard: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "command:write" });
+  const denied = (await authorizeRoute(req, { scope: "command:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -256,13 +257,13 @@ export const postWorkspaceRecoveryBranchDiscard: Handler = async (req) => {
     if (target.safeToDelete !== true && !force) {
       return error(`branch holds work or cannot be proven safe (${target.preserveReason ?? `${target.unmergedAhead ?? target.ahead ?? "?"} unlanded commit(s)`}); land it first or pass force:true with reason to discard`, 409);
     }
-    const command = createCommand({
+    const command = (await createCommandAsync({
       type: "workspace.recovery-branch-discard",
       source: "system",
       target: orch.agentId,
       correlationId: branch,
       params: { action: "recovery-branch-discard", repoRoot, branch, baseRef: baseRef ?? target.baseRef, baseSha: baseSha ?? target.baseSha, force, reason, requestedBy: "steward", requestedAt: Date.now() },
-    });
+    }));
     emitCommand(command);
     await auditEvent({
       clientId: `workspace-recovery-branch-discard-${Date.now()}`,
@@ -282,7 +283,7 @@ export const postWorkspaceRecoveryBranchDiscard: Handler = async (req) => {
 };
 
 export const postWorkspaceOrphanReclaim: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "command:write" });
+  const denied = (await authorizeRoute(req, { scope: "command:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -306,12 +307,12 @@ export const postWorkspaceOrphanReclaim: Handler = async (req) => {
       ? listOrchestrators().find((candidate) => candidate.id === target.orchestratorId && candidate.status === "online")
       : listOrchestrators().find((candidate) => candidate.status === "online" && isPathWithinBase(repoRoot, candidate.baseDir));
     if (!orch) return error("no online orchestrator owns this path", 409);
-    const command = createCommand({
+    const command = (await createCommandAsync({
       type: "workspace.cleanup",
       source: "system",
       target: orch.agentId,
       params: { action: "cleanup", worktreePath, repoRoot, branch, baseRef, baseSha, deleteBranch: true, reclaim: true, requestedBy: "dashboard", requestedAt: Date.now() },
-    });
+    }));
     emitCommand(command);
     await auditEvent({
       clientId: `workspace-orphan-reclaim-${Date.now()}`,
@@ -443,7 +444,7 @@ export const getWorkspaceDiagnostics: Handler = async (_req, params) => {
 };
 
 export const postWorkspaceCleanupStale: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "command:write" });
+  const denied = (await authorizeRoute(req, { scope: "command:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -475,7 +476,7 @@ export const postWorkspaceAction: Handler = async (req, params) => {
     // owner-merge cwd-authz short-circuit below, so a recovered row still runs the standard cwd check.
     let freshlyRecovered = false;
     if (!workspace) {
-      const recovery = recoverIsolatedWorkspace(authContextFromRequest(req), isRecord(parsed.body.workspace) ? parsed.body.workspace : undefined, params.id!);
+      const recovery = (await recoverIsolatedWorkspace(authContextFromRequest(req), isRecord(parsed.body.workspace) ? parsed.body.workspace : undefined, params.id!));
       if (!recovery.ok) return error("workspace not found", 404);
       workspace = recovery.workspace;
       freshlyRecovered = recovery.created;
@@ -509,7 +510,7 @@ export const postWorkspaceAction: Handler = async (req, params) => {
       // fuzzy label match (the 545ca290 impersonation hole); steward authz resolves the actual
       // elected steward, not the null-prone `workspace.stewardAgentId` mirror.
       const authorized = isWorkspaceRecoveryAuthorized(authCtx, workspace);
-      const denied = authorizeRoute(req, { scope: requiresCommand ? "command:write" : "agent:write" });
+      const denied = (await authorizeRoute(req, { scope: requiresCommand ? "command:write" : "agent:write" }));
       if (denied) return denied;
       if (!authorized) return error("forbidden", 403);
       // A raw root credential or a VERIFIED component recovery principal (one of the four #1747
@@ -534,7 +535,7 @@ export const postWorkspaceAction: Handler = async (req, params) => {
       hasComponentScope(component, "command:write");
     if (!ownsMergeRequest && !isRecoveryAction) {
       const authzCwd = freshlyRecovered ? workspace.sourceCwd : workspace.worktreePath;
-      const denied = authorizeRoute(req, { scope: requiresCommand ? "command:write" : "agent:write", resource: { agentId, cwd: authzCwd } });
+      const denied = (await authorizeRoute(req, { scope: requiresCommand ? "command:write" : "agent:write", resource: { agentId, cwd: authzCwd } }));
       if (denied) return denied;
     }
 
@@ -617,7 +618,7 @@ export const postWorkspaceAction: Handler = async (req, params) => {
 };
 
 export const deleteWorkspaceById: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "command:write" });
+  const denied = (await authorizeRoute(req, { scope: "command:write" }));
   if (denied) return denied;
   const workspace = getWorkspace(params.id!);
   if (!workspace) return error("workspace not found", 404);
@@ -626,7 +627,7 @@ export const deleteWorkspaceById: Handler = async (req, params) => {
   // outlives this row: once the workspace is gone the reconciler sees the ledger entry, treats the
   // round as closed, and deletes each leaked ref by its OWN stored value with backoff until origin
   // confirms. So a purge just drops the workspace row; the ledger owns cleanup.
-  const removed = deleteWorkspace(workspace.id);
+  const removed = (await deleteWorkspaceAsync(workspace.id));
   if (!removed) return error("workspace not found", 404);
   await auditEvent({
     clientId: `workspace-delete-${workspace.id}-${Date.now()}`,

package/src/routing-policy-normalize.ts

@@ -1,5 +1,4 @@
 import { ValidationError } from "@humwick/sdk";
-import { currentDispatchModels } from "./routing-model-aliases";
 import { normalizeStepRoutingDefaults } from "./routing-step-defaults";
 import {
   isRecord,
@@ -199,7 +198,7 @@ export function normalizeDispatchPolicy(raw: unknown): DispatchPolicy {
  */
 /** Pure projection used by reader-gateway callers that already captured the policy snapshot. */
 export function dispatchPolicyFor(policy: RoutingPolicy): DispatchPolicy {
-  return policy.dispatch ? currentDispatchModels(policy.dispatch) : DEFAULT_DISPATCH_POLICY;
+  return policy.dispatch ?? DEFAULT_DISPATCH_POLICY;
 }
 
 const MAX_RULES = 100;

package/src/routing-policy-push.ts

@@ -5,7 +5,7 @@ import { emitRelayEvent } from "./events";
 import { routeNotification } from "./notification-router";
 import { renderTemplate } from "./prompt-resolver";
 import { parseJson } from "./utils";
-import { isRecord } from "@humwick/sdk";
+import { fireAndForget, isRecord } from "@humwick/sdk";
 import type { RoutingPolicy } from "@humwick/sdk";
 
 const PUSH_TTL_MS = 15 * 60 * 1000;
@@ -33,16 +33,16 @@ export function notifyRoutingPolicyChanged(policy: RoutingPolicy, previous: Rout
   if (pending) clearTimeout(pending.timer);
   pending = {
     db, previous: baseline, policy: structuredClone(policy), updatedBy: opts.updatedBy,
-    timer: setTimeout(() => {
+    timer: setTimeout(() => void fireAndForget("[routing-policy] FYI", async () => {
       const settled = pending;
       pending = undefined;
       try {
         if (!settled || settled.db !== getDb()) return;
-        pushSettledPolicy(settled.previous, settled.policy, settled.updatedBy);
+        await pushSettledPolicy(settled.previous, settled.policy, settled.updatedBy);
       } catch (error) {
         console.warn("Routing policy FYI failed:", error);
       }
-    }, QUIET_WINDOW_MS),
+    }), QUIET_WINDOW_MS),
   };
   pending.timer.unref();
 }
@@ -98,13 +98,13 @@ function ruleDelta(previous: unknown[], current: unknown[], path: string): strin
   return delta;
 }
 
-function pushSettledPolicy(previous: RoutingPolicy, policy: RoutingPolicy, updatedBy?: string): void {
+async function pushSettledPolicy(previous: RoutingPolicy, policy: RoutingPolicy, updatedBy?: string): Promise<void> {
   const delta = policyDelta(previous, policy);
   if (delta.length === 0) return;
   const recipients = getSpawnCapableAgentIds();
   if (recipients.length === 0) return;
 
-  routeNotification({
+  await routeNotification({
     type: "routing.policy.changed",
     scope: {},
     recipients,

package/src/routing-step-defaults.ts

@@ -1,5 +1,4 @@
 import { cleanString, isRecord, isSpawnProvider, ValidationError, type StepRoutingDefaults, type StepRoutingTarget } from "@humwick/sdk";
-import { VALID_EFFORTS } from "@humwick/sdk/provider-catalog";
 import { WORKFLOW_PIN_FIELDS } from "@humwick/kernel/workflow-definition";
 
 export function normalizeStepRoutingDefaults(raw: unknown): StepRoutingDefaults {
@@ -25,7 +24,6 @@ function normalizeRoles(raw: unknown, where: string): Record<string, StepRouting
     for (const key of Object.keys(target)) if (!(WORKFLOW_PIN_FIELDS as readonly string[]).includes(key)) throw new ValidationError(`${where}.${role}.${key} is not a routing field`);
     const fields = Object.fromEntries(Object.entries(target).map(([key, value]) => [key, cleanString(value, `${where}.${role}.${key}`, { required: true, max: 200 })]));
     if (fields.provider !== undefined && !isSpawnProvider(fields.provider)) throw new ValidationError(`${where}.${role}.provider is not a provider`);
-    if (fields.effort !== undefined && !(VALID_EFFORTS as readonly string[]).includes(fields.effort)) throw new ValidationError(`${where}.${role}.effort must be ${VALID_EFFORTS.join(", ")}`);
     return [role, fields as StepRoutingTarget];
   }));
 }

package/src/runner-token-mint-limit.ts

@@ -0,0 +1,63 @@
+// #3775 — per-subject cap on runner token successor mints (renew, orchestrator re-mint, boundary
+// re-derive). A runner stuck re-minting after 401 minted 700-1,400 tokens/min and overloaded the
+// hub writer; this refuses the excess before any token row is written. A spawn subject
+// (`runner:spawn:<id>`) keeps one subject across its whole token lineage, so it is the key. Only a
+// real mint is charged: a replayed handoff (retry or concurrent caller) writes nothing.
+
+/** At most this many new tokens per subject in any rolling window. */
+export const RUNNER_TOKEN_MINTS_PER_WINDOW = 3;
+export const RUNNER_TOKEN_MINT_WINDOW_MS = 60_000;
+const MAX_TRACKED_SUBJECTS = 10_000;
+
+export class RunnerTokenMintLimit {
+  /** Recent mint times per subject, oldest first, at most RUNNER_TOKEN_MINTS_PER_WINDOW long. */
+  private readonly mints = new Map<string, number[]>();
+  /** Subjects currently refused, so a trip logs once rather than once per refused mint. */
+  private readonly tripped = new Set<string>();
+  private readonly now: () => number;
+  private readonly log: (message: string) => void;
+
+  constructor(options: { now?: () => number; log?: (message: string) => void } = {}) {
+    this.now = options.now ?? Date.now;
+    this.log = options.log ?? console.warn;
+  }
+
+  /** Seconds `sub` must wait before its next mint, or undefined when it may mint now. Charges nothing. */
+  refusal(sub: string): number | undefined {
+    const recent = this.recent(sub);
+    if (recent.length < RUNNER_TOKEN_MINTS_PER_WINDOW) {
+      this.tripped.delete(sub);
+      return undefined;
+    }
+    if (!this.tripped.has(sub)) {
+      if (this.tripped.size >= MAX_TRACKED_SUBJECTS) this.tripped.clear();
+      this.tripped.add(sub);
+      this.log(`[token-mint] rate limit tripped for ${sub}: ${RUNNER_TOKEN_MINTS_PER_WINDOW} tokens minted in the last ${RUNNER_TOKEN_MINT_WINDOW_MS / 1000}s; refusing until the window frees`);
+    }
+    return Math.max(1, Math.ceil((recent[0]! + RUNNER_TOKEN_MINT_WINDOW_MS - this.now()) / 1000));
+  }
+
+  /** Record one new token minted for `sub`. */
+  charge(sub: string): void {
+    const recent = this.recent(sub);
+    if (!this.mints.has(sub) && this.mints.size >= MAX_TRACKED_SUBJECTS) this.mints.delete(this.mints.keys().next().value!);
+    recent.push(this.now());
+    if (recent.length > RUNNER_TOKEN_MINTS_PER_WINDOW) recent.shift();
+    this.mints.set(sub, recent);
+  }
+
+  reset(): void {
+    this.mints.clear();
+    this.tripped.clear();
+  }
+
+  private recent(sub: string): number[] {
+    const since = this.now() - RUNNER_TOKEN_MINT_WINDOW_MS;
+    const recent = (this.mints.get(sub) ?? []).filter((at) => at > since);
+    if (recent.length) this.mints.set(sub, recent);
+    else this.mints.delete(sub);
+    return recent;
+  }
+}
+
+export const runnerTokenMintLimit = new RunnerTokenMintLimit();