@humwick/server 0.130.2 → 0.130.3

package/src/routes/users.ts

@@ -60,14 +60,14 @@ export const getMe: Handler = (req) => {
   return user ? json({ ...user, hasPassword: hasPasswordLogin(user.id) } satisfies CurrentUser) : error("user not found", 404);
 };
 
-export const patchMe: Handler = (req) => patchUserProfile(req, { id: requestUserId(req) });
+export const patchMe: Handler = async (req) => (await patchUserProfile(req, { id: requestUserId(req) }));
 
-export const patchUserById: Handler = (req, params) => patchUserProfile(req, params);
+export const patchUserById: Handler = async (req, params) => (await patchUserProfile(req, params));
 
 async function patchUserProfile(req: Request, params: Record<string, string>): Promise<Response> {
   try {
     const userId = userIdParam(req, params);
-    if (!canManageUser(req, userId)) return authorityDenied(req, "forbidden");
+    if (!canManageUser(req, userId)) return (await authorityDenied(req, "forbidden"));
     const parsed = await parseBody<unknown>(req);
     if (!parsed.ok) return error(parsed.error, parsed.status);
     if (!isRecord(parsed.body)) return error("body must be an object");
@@ -76,14 +76,14 @@ async function patchUserProfile(req: Request, params: Record<string, string>): P
     const role = optionalEnum(body.role, "role", INVITE_ROLES);
     const status = optionalEnum(body.status, "status", ACCOUNT_STATUSES);
     if (role || status) {
-      if (!isAdminRequest(req)) return authorityDenied(req, "only an admin can change a user's role or status");
+      if (!isAdminRequest(req)) return (await authorityDenied(req, "only an admin can change a user's role or status"));
       const before = getUser(userId);
       const after = await changeUserAccess({ actorUserId: requestUserId(req), userId, role, status });
-      if (before && after.role !== before.role) recordUserManagement(req, userId, "change role", { from: before.role, to: after.role });
-      if (before && after.status !== before.status) recordUserManagement(req, userId, after.status === "suspended" ? "suspend" : "reactivate");
+      if (before && after.role !== before.role) (await recordUserManagement(req, userId, "change role", { from: before.role, to: after.role }));
+      if (before && after.status !== before.status) (await recordUserManagement(req, userId, after.status === "suspended" ? "suspend" : "reactivate"));
     }
     const displayName = cleanString(body.displayName, "displayName", { required: !role && !status, max: 120 });
-    if (displayName) return json(updateUserDisplayName({ userId, displayName }));
+    if (displayName) return json((await updateUserDisplayName({ userId, displayName })));
     const user = userOr404(userId);
     return user instanceof Response ? user : json(user);
   } catch (e) {
@@ -91,9 +91,9 @@ async function patchUserProfile(req: Request, params: Record<string, string>): P
   }
 }
 
-export const postMyAvatar: Handler = (req) => postUserAvatar(req, { id: requestUserId(req) });
+export const postMyAvatar: Handler = async (req) => (await postUserAvatar(req, { id: requestUserId(req) }));
 
-export const postUserAvatarById: Handler = (req, params) => postUserAvatar(req, params);
+export const postUserAvatarById: Handler = async (req, params) => (await postUserAvatar(req, params));
 
 async function avatarUploadInput(req: Request): Promise<{ bytes: Uint8Array; filename?: string; mediaType: string; digest?: string }> {
   const contentType = req.headers.get("content-type") ?? "";
@@ -123,7 +123,7 @@ async function postUserAvatar(req: Request, params: Record<string, string>): Pro
     const userId = userIdParam(req, params);
     const user = userOr404(userId);
     if (user instanceof Response) return user;
-    if (!canManageUser(req, userId)) return authorityDenied(req, "forbidden");
+    if (!canManageUser(req, userId)) return (await authorityDenied(req, "forbidden"));
     const input = await avatarUploadInput(req);
     const result = await storeUserAvatar({ userId, actor: requestUserAddress(req), ...input });
     return json(result, 201);
@@ -132,25 +132,25 @@ async function postUserAvatar(req: Request, params: Record<string, string>): Pro
   }
 }
 
-export const deleteMyAvatar: Handler = (req) => deleteUserAvatar(req, { id: requestUserId(req) });
+export const deleteMyAvatar: Handler = async (req) => (await deleteUserAvatar(req, { id: requestUserId(req) }));
 
-export const deleteUserAvatarById: Handler = (req, params) => deleteUserAvatar(req, params);
+export const deleteUserAvatarById: Handler = async (req, params) => (await deleteUserAvatar(req, params));
 
 async function deleteUserAvatar(req: Request, params: Record<string, string>): Promise<Response> {
   try {
     const userId = userIdParam(req, params);
     const user = userOr404(userId);
     if (user instanceof Response) return user;
-    if (!canManageUser(req, userId)) return authorityDenied(req, "forbidden");
+    if (!canManageUser(req, userId)) return (await authorityDenied(req, "forbidden"));
     return json(await removeUserAvatar({ userId }));
   } catch (e) {
     return profileError(e);
   }
 }
 
-export const getUserAvatar: Handler = (req, params) => serveUserAvatar(req, params, false);
+export const getUserAvatar: Handler = async (req, params) => (await serveUserAvatar(req, params, false));
 
-export const headUserAvatar: Handler = (req, params) => serveUserAvatar(req, params, true);
+export const headUserAvatar: Handler = async (req, params) => (await serveUserAvatar(req, params, true));
 
 async function serveUserAvatar(req: Request, params: Record<string, string>, head: boolean): Promise<Response> {
   const userId = userIdParam(req, params);
@@ -158,7 +158,7 @@ async function serveUserAvatar(req: Request, params: Record<string, string>, hea
   if (!user?.avatarArtifactId) return error("avatar not found", 404);
   const artifact = await getArtifactAsync(user.avatarArtifactId);
   if (!artifact) return error("avatar artifact not found", 404);
-  if (!canReadAvatar(req, userId, artifact)) return authorityDenied(req, "forbidden");
+  if (!canReadAvatar(req, userId, artifact)) return (await authorityDenied(req, "forbidden"));
   const blob = await getArtifactBlobAsync(artifact.blobDigest);
   if (!blob) return error("avatar blob not found", 404);
   const headers = {
@@ -183,15 +183,15 @@ export const invitesDisabled = () => error("user invites are disabled", 404);
 /** POST /api/users/invites — admin only. The code is shown once; share `/invite/<code>` by hand. */
 export const postUserInvite: Handler = async (req) => {
   if (!userInvitesEnabled()) return invitesDisabled();
-  if (!isAdminRequest(req)) return authorityDenied(req, "only an admin can invite users");
+  if (!isAdminRequest(req)) return (await authorityDenied(req, "only an admin can invite users"));
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   const body = isRecord(parsed.body) ? parsed.body : {};
   try {
     const role = optionalEnum(body.role, "role", INVITE_ROLES) ?? "operator";
     const displayName = cleanString(body.displayName, "displayName", { max: 120 });
-    const { invite, code } = createInvite({ role, displayName, createdBy: requestUserId(req) });
-    recordUserManagement(req, `invite:${invite.id}`, "create invite", { role, ...(displayName ? { displayName } : {}) });
+    const { invite, code } = (await createInvite({ role, displayName, createdBy: requestUserId(req) }));
+    (await recordUserManagement(req, `invite:${invite.id}`, "create invite", { role, ...(displayName ? { displayName } : {}) }));
     return json({ invite, code, path: `/invite/${code}` }, 201);
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);
@@ -202,7 +202,7 @@ export const postUserInvite: Handler = async (req) => {
 /** PUT /api/users/me/password — a signed-in user, or the admin token for the default admin. */
 export const putMyPassword: Handler = async (req) => {
   const acting = resolveActingUser(req);
-  if (!acting) return authorityDenied(req, "sign in to set a password");
+  if (!acting) return (await authorityDenied(req, "sign in to set a password"));
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   if (!isRecord(parsed.body)) return error("password required");
@@ -219,11 +219,11 @@ export const putMyPassword: Handler = async (req) => {
 
 /** DELETE /api/users/:id/sessions — sign the user out everywhere; their next call gets 401. */
 export const deleteUserSessions: Handler = async (req, params) => {
-  if (!isAdminRequest(req)) return authorityDenied(req, "only an admin can sign a user out");
+  if (!isAdminRequest(req)) return (await authorityDenied(req, "only an admin can sign a user out"));
   try {
     const userId = decodeURIComponent(params.id!);
     const revoked = await revokeUserSessions(userId);
-    recordUserManagement(req, userId, "revoke sessions", { revoked });
+    (await recordUserManagement(req, userId, "revoke sessions", { revoked }));
     return json({ revoked });
   } catch (e) {
     return profileError(e);
@@ -232,7 +232,7 @@ export const deleteUserSessions: Handler = async (req, params) => {
 
 /** POST /api/users/:id/handover — every agent of the user gets `toUserId` as its principal. */
 export const postUserHandover: Handler = async (req, params) => {
-  if (!isAdminRequest(req)) return authorityDenied(req, "only an admin can hand over agents");
+  if (!isAdminRequest(req)) return (await authorityDenied(req, "only an admin can hand over agents"));
   try {
     const parsed = await parseBody<unknown>(req);
     if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -240,7 +240,7 @@ export const postUserHandover: Handler = async (req, params) => {
     const toUserId = cleanString(body.toUserId, "toUserId", { required: true, max: 64 })!;
     const fromUserId = decodeURIComponent(params.id!);
     const agentIds = await handOverAgents({ fromUserId, toUserId });
-    recordUserManagement(req, fromUserId, "hand over agents", { toUserId, agentIds });
+    (await recordUserManagement(req, fromUserId, "hand over agents", { toUserId, agentIds }));
     return json({ toUserId, agentIds });
   } catch (e) {
     return profileError(e);

package/src/routes/viewer-read.ts

@@ -12,15 +12,15 @@ export function scopeResourceReads(method: string, path: string, handler: Handle
     const viewer = viewerScopeForRequest(req);
     if (!viewer || viewer.seesAll) return handler(req, params);
     const id = params.id!;
-    if (resource === "agents" && !agentVisibleTo(viewer, id)) return authorityDenied(req, "agent not found", 404, id, "read agent");
+    if (resource === "agents" && !agentVisibleTo(viewer, id)) return (await authorityDenied(req, "agent not found", 404, id, "read agent"));
     if (resource === "tasks") {
       const taskId = parseId(id);
-      if (taskId !== null && !taskVisibleTo(viewer, { id: taskId })) return authorityDenied(req, "task not found", 404, id, "read task");
+      if (taskId !== null && !taskVisibleTo(viewer, { id: taskId })) return (await authorityDenied(req, "task not found", 404, id, "read task"));
     }
     if (resource === "messages") {
       const messageId = parseId(id);
       const message = messageId === null ? null : await getMessageAsync(messageId);
-      if (message && !messageVisibleTo(viewer, message)) return authorityDenied(req, "you can only read your own messages", 403, id, path.endsWith("/thread") ? "read thread" : "read message");
+      if (message && !messageVisibleTo(viewer, message)) return (await authorityDenied(req, "you can only read your own messages", 403, id, path.endsWith("/thread") ? "read thread" : "read message"));
     }
     return handler(req, params);
   };

package/src/routes/web-tool-calls.ts

@@ -5,27 +5,27 @@ import { ingestWebToolCall, queryWebSearchBudget, queryWebToolCalls, queryWebToo
 import { authorizeRoute, error, json, parseBody, type Handler } from "./_shared";
 
 export const getWebToolCalls: Handler = async req => {
-  const denied = authorizeRoute(req, { scope: "agent:read" });
+  const denied = (await authorizeRoute(req, { scope: "agent:read" }));
   if (denied) return denied;
   try { return json(await queryWebToolCalls(Object.fromEntries(new URL(req.url).searchParams))); }
   catch (e) { if (e instanceof ValidationError) return error(e.message, 400); throw e; }
 };
 
 export const getWebToolCallSummary: Handler = async req => {
-  const denied = authorizeRoute(req, { scope: "agent:read" });
+  const denied = (await authorizeRoute(req, { scope: "agent:read" }));
   if (denied) return denied;
   try { return json(await queryWebToolCallSummary(Object.fromEntries(new URL(req.url).searchParams))); }
   catch (e) { if (e instanceof ValidationError) return error(e.message, 400); throw e; }
 };
 
 export const getWebSearchBudget: Handler = async req => {
-  const denied = authorizeRoute(req, { scope: "agent:read" });
+  const denied = (await authorizeRoute(req, { scope: "agent:read" }));
   if (denied) return denied;
   return json(await queryWebSearchBudget());
 };
 
 export const postWebToolCall: Handler = async req => {
-  const denied = authorizeRoute(req, { scope: "agent:write" });
+  const denied = (await authorizeRoute(req, { scope: "agent:write" }));
   if (denied) return denied;
   const body = await parseBody<unknown>(req);
   if (!body.ok) return error(body.error, body.status);

package/src/routes/workflows.ts

@@ -9,6 +9,7 @@ import { McpNotFoundError } from "../mcp-errors";
 import { authContextFromRequest } from "../services/auth-context";
 import { ServiceAuthError } from "../services/errors";
 import { readWorkflowCatalog } from "../services/workflow-catalog";
+import { parseWorkflowPins } from "../services/workflow-pins";
 import { requireSpawnBudget } from "../spawn-budget";
 import { amendWorkflowRunBudget, cancelWorkflowRun, getWorkflowRun, pauseWorkflowRun, readWorkflowRunBudget, listWorkflowRuns, resumeWorkflowRun, startWorkflowRun } from "../services/workflow-runs";
 import { workflowDefinitions, workflowStats } from "../services/workflow-stats";
@@ -123,7 +124,7 @@ export const postWorkflowRunResumeRoute: Handler = async (req, params) => {
   if (!parsed.ok) return error(parsed.error, parsed.status);
   if (!isRecord(parsed.body)) return error("body must be a JSON object", 400);
   try {
-    return json(await resumeWorkflowRun({ runId: params.runId!, decision: parseWorkflowDecisionResponse(parsed.body.decision), activationId: cleanString(parsed.body.activationId, "activationId", { max: 2000 }), note: cleanString(parsed.body.note, "note", { max: 8000 }) }, authContextFromRequest(req)));
+    return json(await resumeWorkflowRun({ runId: params.runId!, pins: parseWorkflowPins(parsed.body.pins), step: cleanString(parsed.body.step, "step", { max: 64 }), decision: parseWorkflowDecisionResponse(parsed.body.decision), activationId: cleanString(parsed.body.activationId, "activationId", { max: 2000 }), note: cleanString(parsed.body.note, "note", { max: 8000 }) }, authContextFromRequest(req)));
   } catch (e) {
     if (e instanceof McpNotFoundError) return error(e.message, 404);
     if (e instanceof ServiceAuthError) return error(e.message, 403);
@@ -146,7 +147,6 @@ export const postWorkflowRunStartRoute: Handler = async (req) => {
   try {
     const workflow = cleanString(parsed.body.workflow, "workflow", { max: 64 });
     if (!workflow) throw new ValidationError("workflow is required");
-    const { parseWorkflowPins } = await import("../services/workflow-pins");
     return json(await startWorkflowRun({ workflow, taskId: taskIdField(parsed.body.taskId), pins: parseWorkflowPins(parsed.body.pins), inputs: parsed.body.inputs as Record<string, unknown> | undefined, requestKey: cleanString(parsed.body.requestKey, "requestKey", { max: 200 }), budget: parsed.body.budget }, authContextFromRequest(req)), 202);
   } catch (e) {
     if (e instanceof ServiceAuthError) return error(e.message, 403);

package/src/routes/workspaces.ts

@@ -1,19 +1,20 @@
+import { createCommandAsync } from "../commands-write";
+import { deleteWorkspaceAsync } from "../db/lifecycle-tail-async";
 // Auto-split from routes.ts (#299). Domain: workspaces.
 import { RELAY_TOKEN_HEADER, isRecord } from "@humwick/sdk";
 import { TERMINAL_WORKSPACE_STATUSES, describeWorkspacePhase, landReceipt } from "../workspace-phase";
 import { VALID_WORKSPACE_STATUSES, cleanMeta, cleanString, optionalEnum } from "../validation";
-import { ValidationError, deleteWorkspace, getAgent, getWorkspace, listMergeLeases, listOrchestrators, listRepoStewards, listWorkspaces, updateWorkspaceStatus, withResolvedWorkspaceProjectsAsync } from "../db";
+import { ValidationError, getAgent, getWorkspace, listMergeLeases, listOrchestrators, listRepoStewards, listWorkspaces, updateWorkspaceStatus, withResolvedWorkspaceProjectsAsync } from "../db";
 import { recoverIsolatedWorkspace } from "../services/workspace-recovery";
 import { WORKSPACE_ACTIONS, applyWorkspaceAction, waitForWorkspaceStatus } from "../workspace-actions";
 import { buildWorkspaceCleanupCommand, cleanupStaleWorkspaces } from "../workspace-cleanup-stale";
 import { auditEvent, authAuditMetadata, authorizeRoute, emitCommand, error, isRootCredentialRequest, json, parseBody, type Handler } from "./_shared";
 import { collectWorkspaceOrphans } from "../workspace-orphans";
-import { createCommand, getCommand } from "../commands-db";
-import { LAND_STRATEGIES, isOwnerAlive, isOwnerProcessConfirmedGone, withOwnerOnline } from "../workspace-merge";
+import { getCommand } from "../commands-db";
+import { LAND_STRATEGIES, isOwnerAlive, isOwnerProcessConfirmedGone, withOwnerOnline, AUTO_MERGE_POLICIES } from "../workspace-merge";
 import { isPathWithinBase } from "../utils";
 import { resolve } from "node:path";
 import { type WorkspaceAutoMergePolicy, type WorkspaceDiagnostics, type WorkspaceGitState, type WorkspaceLandGateLevel, type WorkspaceLandingPolicy, type WorkspaceMergeStrategy, type WorkspaceRecoveryBranch, type WorkspaceRecord, type WorkspaceStatus } from "../types";
-import { AUTO_MERGE_POLICIES } from "../workspace-merge";
 import { workspaceActiveClaim } from "../workspace-claim";
 import { resolveCoordinatorAgentId } from "../steward-identity";
 import { relayToken } from "../config";
@@ -231,7 +232,7 @@ export const getWorkspaceRecoveryBranches: Handler = async (req) => {
 };
 
 export const postWorkspaceRecoveryBranchDiscard: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "command:write" });
+  const denied = (await authorizeRoute(req, { scope: "command:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -256,13 +257,13 @@ export const postWorkspaceRecoveryBranchDiscard: Handler = async (req) => {
     if (target.safeToDelete !== true && !force) {
       return error(`branch holds work or cannot be proven safe (${target.preserveReason ?? `${target.unmergedAhead ?? target.ahead ?? "?"} unlanded commit(s)`}); land it first or pass force:true with reason to discard`, 409);
     }
-    const command = createCommand({
+    const command = (await createCommandAsync({
       type: "workspace.recovery-branch-discard",
       source: "system",
       target: orch.agentId,
       correlationId: branch,
       params: { action: "recovery-branch-discard", repoRoot, branch, baseRef: baseRef ?? target.baseRef, baseSha: baseSha ?? target.baseSha, force, reason, requestedBy: "steward", requestedAt: Date.now() },
-    });
+    }));
     emitCommand(command);
     await auditEvent({
       clientId: `workspace-recovery-branch-discard-${Date.now()}`,
@@ -282,7 +283,7 @@ export const postWorkspaceRecoveryBranchDiscard: Handler = async (req) => {
 };
 
 export const postWorkspaceOrphanReclaim: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "command:write" });
+  const denied = (await authorizeRoute(req, { scope: "command:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -306,12 +307,12 @@ export const postWorkspaceOrphanReclaim: Handler = async (req) => {
       ? listOrchestrators().find((candidate) => candidate.id === target.orchestratorId && candidate.status === "online")
       : listOrchestrators().find((candidate) => candidate.status === "online" && isPathWithinBase(repoRoot, candidate.baseDir));
     if (!orch) return error("no online orchestrator owns this path", 409);
-    const command = createCommand({
+    const command = (await createCommandAsync({
       type: "workspace.cleanup",
       source: "system",
       target: orch.agentId,
       params: { action: "cleanup", worktreePath, repoRoot, branch, baseRef, baseSha, deleteBranch: true, reclaim: true, requestedBy: "dashboard", requestedAt: Date.now() },
-    });
+    }));
     emitCommand(command);
     await auditEvent({
       clientId: `workspace-orphan-reclaim-${Date.now()}`,
@@ -443,7 +444,7 @@ export const getWorkspaceDiagnostics: Handler = async (_req, params) => {
 };
 
 export const postWorkspaceCleanupStale: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "command:write" });
+  const denied = (await authorizeRoute(req, { scope: "command:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -475,7 +476,7 @@ export const postWorkspaceAction: Handler = async (req, params) => {
     // owner-merge cwd-authz short-circuit below, so a recovered row still runs the standard cwd check.
     let freshlyRecovered = false;
     if (!workspace) {
-      const recovery = recoverIsolatedWorkspace(authContextFromRequest(req), isRecord(parsed.body.workspace) ? parsed.body.workspace : undefined, params.id!);
+      const recovery = (await recoverIsolatedWorkspace(authContextFromRequest(req), isRecord(parsed.body.workspace) ? parsed.body.workspace : undefined, params.id!));
       if (!recovery.ok) return error("workspace not found", 404);
       workspace = recovery.workspace;
       freshlyRecovered = recovery.created;
@@ -509,7 +510,7 @@ export const postWorkspaceAction: Handler = async (req, params) => {
       // fuzzy label match (the 545ca290 impersonation hole); steward authz resolves the actual
       // elected steward, not the null-prone `workspace.stewardAgentId` mirror.
       const authorized = isWorkspaceRecoveryAuthorized(authCtx, workspace);
-      const denied = authorizeRoute(req, { scope: requiresCommand ? "command:write" : "agent:write" });
+      const denied = (await authorizeRoute(req, { scope: requiresCommand ? "command:write" : "agent:write" }));
       if (denied) return denied;
       if (!authorized) return error("forbidden", 403);
       // A raw root credential or a VERIFIED component recovery principal (one of the four #1747
@@ -534,7 +535,7 @@ export const postWorkspaceAction: Handler = async (req, params) => {
       hasComponentScope(component, "command:write");
     if (!ownsMergeRequest && !isRecoveryAction) {
       const authzCwd = freshlyRecovered ? workspace.sourceCwd : workspace.worktreePath;
-      const denied = authorizeRoute(req, { scope: requiresCommand ? "command:write" : "agent:write", resource: { agentId, cwd: authzCwd } });
+      const denied = (await authorizeRoute(req, { scope: requiresCommand ? "command:write" : "agent:write", resource: { agentId, cwd: authzCwd } }));
       if (denied) return denied;
     }
 
@@ -617,7 +618,7 @@ export const postWorkspaceAction: Handler = async (req, params) => {
 };
 
 export const deleteWorkspaceById: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "command:write" });
+  const denied = (await authorizeRoute(req, { scope: "command:write" }));
   if (denied) return denied;
   const workspace = getWorkspace(params.id!);
   if (!workspace) return error("workspace not found", 404);
@@ -626,7 +627,7 @@ export const deleteWorkspaceById: Handler = async (req, params) => {
   // outlives this row: once the workspace is gone the reconciler sees the ledger entry, treats the
   // round as closed, and deletes each leaked ref by its OWN stored value with backoff until origin
   // confirms. So a purge just drops the workspace row; the ledger owns cleanup.
-  const removed = deleteWorkspace(workspace.id);
+  const removed = (await deleteWorkspaceAsync(workspace.id));
   if (!removed) return error("workspace not found", 404);
   await auditEvent({
     clientId: `workspace-delete-${workspace.id}-${Date.now()}`,

package/src/routing-policy-push.ts

@@ -5,7 +5,7 @@ import { emitRelayEvent } from "./events";
 import { routeNotification } from "./notification-router";
 import { renderTemplate } from "./prompt-resolver";
 import { parseJson } from "./utils";
-import { isRecord } from "@humwick/sdk";
+import { fireAndForget, isRecord } from "@humwick/sdk";
 import type { RoutingPolicy } from "@humwick/sdk";
 
 const PUSH_TTL_MS = 15 * 60 * 1000;
@@ -33,16 +33,16 @@ export function notifyRoutingPolicyChanged(policy: RoutingPolicy, previous: Rout
   if (pending) clearTimeout(pending.timer);
   pending = {
     db, previous: baseline, policy: structuredClone(policy), updatedBy: opts.updatedBy,
-    timer: setTimeout(() => {
+    timer: setTimeout(() => void fireAndForget("[routing-policy] FYI", async () => {
       const settled = pending;
       pending = undefined;
       try {
         if (!settled || settled.db !== getDb()) return;
-        pushSettledPolicy(settled.previous, settled.policy, settled.updatedBy);
+        await pushSettledPolicy(settled.previous, settled.policy, settled.updatedBy);
       } catch (error) {
         console.warn("Routing policy FYI failed:", error);
       }
-    }, QUIET_WINDOW_MS),
+    }), QUIET_WINDOW_MS),
   };
   pending.timer.unref();
 }
@@ -98,13 +98,13 @@ function ruleDelta(previous: unknown[], current: unknown[], path: string): strin
   return delta;
 }
 
-function pushSettledPolicy(previous: RoutingPolicy, policy: RoutingPolicy, updatedBy?: string): void {
+async function pushSettledPolicy(previous: RoutingPolicy, policy: RoutingPolicy, updatedBy?: string): Promise<void> {
   const delta = policyDelta(previous, policy);
   if (delta.length === 0) return;
   const recipients = getSpawnCapableAgentIds();
   if (recipients.length === 0) return;
 
-  routeNotification({
+  await routeNotification({
     type: "routing.policy.changed",
     scope: {},
     recipients,

package/src/runtime-grant.ts

@@ -5,11 +5,11 @@ import { getLaunchFact } from "./db/launch-facts";
 import { getTokenProfile } from "./token-db";
 import { getAgentProfile, spawnGrantForProfile, toolGroupsForProfile } from "./config-store";
 import { FLEET_SCOPE } from "./security";
-import { stringValue } from "@humwick/sdk";
+import { registryToolName, stringValue } from "@humwick/sdk";
 import { canonicalAgentProfileName, hasScope } from "@humwick/sdk/types";
 import { COORDINATOR_PROFILE_NAMES } from "./agent-system-tags";
 import { SECRETS_DEFAULT_PROFILES, SECRETS_TOOL_GROUP, SECRETS_WRITE_SCOPE } from "./secrets-broker/config";
-import { resolveRelayTools, SELF_CARE_TOOL_GROUP } from "./mcp/tool-groups";
+import { RELAY_TOOL_GROUPS, resolveRelayTools, SELF_CARE_TOOL_GROUP } from "./mcp/tool-groups";
 
 // Scopes that turn an agent's runtime token into a spawn-capable one (#221). Appended to the
 // provider-agent base scope only when the resolved profile permits (maxSpawnedAgents > 0).
@@ -27,6 +27,8 @@ const FLEET_OPS_PROFILES = new Set(["coordinator", "ops-assistant"]);
 const HOST_WRITE_PROFILES = new Set(["coordinator"]);
 // #3772 — the reboot runbook reads resource_control held/waiter counts from /api/hosts; ops profiles read, never write.
 const HOST_READ_PROFILES = new Set([...HOST_WRITE_PROFILES, "ops-assistant", "sec-ops"]);
+// #3780 — operations and QA need hub diagnostics; coordinators can delegate the read scope.
+const STATS_READ_PROFILES = new Set(["coordinator", "ops-assistant", "qa"]);
 // #3073 — coordinator-only groups (not in WORKER_TOOL_GROUPS) a coordinator always gets, even when its stored override predates them.
 const COORDINATOR_ONLY_TOOL_GROUPS = ["decisions", "workflows", "project", "routing"] as const;
 // #3327 — the coordinator edits routing preferences, like Edin in the dashboard.
@@ -45,11 +47,10 @@ function callerMayMintHostsScope(callerScopes: string[] | undefined, scope: "hos
   return callerScopes === undefined || hasScope(callerScopes, scope);
 }
 
-// #3110 — the secrets broker scope follows the `secrets` tool group: an explicit group list must name
-// it; a full-surface profile (no list) gets it only by default (coordinator, ops-assistant). A caller
-// cannot confer it onto a child it spawns without holding it.
-function grantsSecretsScope(profile: string | undefined, toolGroups: string[] | undefined, callerScopes: string[] | undefined): boolean {
-  const inGroup = toolGroups ? toolGroups.includes(SECRETS_TOOL_GROUP) : Boolean(profile && SECRETS_DEFAULT_PROFILES.has(profile));
+// #3110/#3817 — broker groups and exact includes request the same scope, capped by the caller.
+function grantsSecretsScope(profile: string | undefined, toolGroups: string[] | undefined, explicitlySelected: boolean, callerScopes: string[] | undefined): boolean {
+  const inGroup = (toolGroups ? toolGroups.includes(SECRETS_TOOL_GROUP) : Boolean(profile && SECRETS_DEFAULT_PROFILES.has(profile)))
+    || explicitlySelected;
   return inGroup && (callerScopes === undefined || hasScope(callerScopes, SECRETS_WRITE_SCOPE));
 }
 
@@ -74,6 +75,8 @@ function nonTrustedBaseline(agentInitiated: boolean): string[] {
 interface RunnerGrant {
   scope: string[];
   canSpawn: boolean;
+  /** A sub-coordinator under its root coordinator's project delegation: it places spawns on any host its parent can (#3804). */
+  delegated: boolean;
   maxSpawnedAgents: number;
   toolGroups: string[] | undefined;
   toolInclude?: string[];
@@ -95,7 +98,7 @@ export function deriveRunnerGrant(profile: string | undefined, authority: Deriva
   const selection = profile ? getAgentProfile(profile)?.value.relay.tools : undefined;
   let toolGroups = toolGroupsForProfile(profile);
   // #2897/#3073/#3110 — stored overrides predate newer trusted-profile groups: coordinators always get the coordinator-only
-  // groups, and the secrets profiles (coordinator, ops-assistant) always get `secrets`. Keep explicit NONE and full-surface semantics.
+  // groups, and the coordinator gets `secrets`. Keep explicit NONE and full-surface semantics.
   if (toolGroups?.length) {
     const extra: string[] = [];
     if ((COORDINATOR_PROFILE_NAMES as readonly string[]).includes(profile ?? "")) extra.push(...COORDINATOR_ONLY_TOOL_GROUPS);
@@ -106,19 +109,21 @@ export function deriveRunnerGrant(profile: string | undefined, authority: Deriva
   }
   const fleetOps = !agentInitiated && Boolean(profile && FLEET_OPS_PROFILES.has(profile)) && callerMayMintFleetScope(callerScopes);
   const hostsRead = !agentInitiated && Boolean(profile && HOST_READ_PROFILES.has(profile)) && callerMayMintHostsScope(callerScopes, "hosts:read");
-  resolveRelayTools({ ...selection, groups: toolGroups });
+  const selected = resolveRelayTools({ ...selection, groups: toolGroups });
+  const explicitSecrets = selection?.include?.map(registryToolName).some(name => selected.has(name) && RELAY_TOOL_GROUPS[SECRETS_TOOL_GROUP]!.includes(name)) ?? false;
   let scope = [
     ...nonTrustedBaseline(agentInitiated),
     ...(fleetOps ? [FLEET_SCOPE] : []),
     ...(hostsRead ? ["hosts:read"] : []),
+    ...(profile && STATS_READ_PROFILES.has(profile.toLowerCase()) && (callerScopes === undefined || hasScope(callerScopes, "stats:read")) ? ["stats:read"] : []),
     ...(!agentInitiated && Boolean(profile && HOST_WRITE_PROFILES.has(profile)) && callerMayMintHostsScope(callerScopes, "hosts:write") ? ["hosts:write"] : []),
-    ...(grantsSecretsScope(profile, toolGroups, callerScopes) ? [SECRETS_WRITE_SCOPE] : []),
+    ...(grantsSecretsScope(profile, toolGroups, explicitSecrets, callerScopes) ? [SECRETS_WRITE_SCOPE] : []),
     ...(!agentInitiated && (COORDINATOR_PROFILE_NAMES as readonly string[]).includes(profile ?? "") && (callerScopes === undefined || hasScope(callerScopes, ROUTING_WRITE_SCOPE)) ? [ROUTING_WRITE_SCOPE] : []),
     ...(grant.canSpawn ? SPAWN_SCOPES.filter(scope => !agentInitiated || callerScopes === undefined || hasScope(callerScopes, scope)) : []),
     ...(delegated && callerScopes && hasScope(callerScopes, "teams:write") ? ["teams:write"] : []),
   ];
   if (lineage?.participating && callerScopes) scope = scope.filter(scope => hasScope(callerScopes, scope));
-  return { scope, canSpawn: grant.canSpawn, maxSpawnedAgents: grant.maxSpawnedAgents, toolGroups,
+  return { scope, canSpawn: grant.canSpawn, delegated, maxSpawnedAgents: grant.maxSpawnedAgents, toolGroups,
     ...(selection?.include === undefined ? {} : { toolInclude: selection.include }),
     ...(selection?.exclude === undefined ? {} : { toolExclude: selection.exclude }),
   };
@@ -151,6 +156,7 @@ export function successorGrant(agentId: string, profile: string | undefined, dep
   return {
     scope: derived.scope.filter((scope) => ceiling.scope.includes(scope)),
     canSpawn: derived.canSpawn && ceiling.canSpawn,
+    delegated: derived.delegated && ceiling.delegated,
     maxSpawnedAgents: Math.min(derived.maxSpawnedAgents, ceiling.maxSpawnedAgents),
     toolGroups: derived.toolGroups,
     toolInclude: derived.toolInclude,

package/src/runtime-tokens.ts

@@ -1,4 +1,4 @@
-import { registryToolName } from "@humwick/sdk";
+import { stringValue } from "@humwick/sdk";
 import { writeChildEnv } from "@humwick/sdk/env";
 import { deriveRunnerGrant, successorGrant } from "./runtime-grant";
 export { runnerSpawnGrantForAgent } from "./runtime-grant";
@@ -13,11 +13,9 @@ import { getLaunchFact, recordLaunchFact, type LaunchFact } from "./db/launch-fa
 import type { ComponentToken, SpawnApprovalMode, TokenConstraints, TokenRecord } from "./types";
 import { listManagedOrchestratorsForAgent } from "./orchestrator-lookup";
 import { sameHostIdentity } from "./utils";
-import { stringValue } from "@humwick/sdk";
-import { canonicalAgentProfileName, hasScope } from "@humwick/sdk/types";
+import { canonicalAgentProfileName } from "@humwick/sdk/types";
 import { COORDINATOR_PROFILE_NAMES } from "./agent-system-tags";
 import { SECRETS_DEFAULT_PROFILES, SECRETS_TOOL_GROUP, SECRETS_WRITE_SCOPE } from "./secrets-broker/config";
-import { INCLUDED_TOOL_SCOPE_NEEDS, RELAY_TOOL_GROUPS, resolveRelayTools, SELF_CARE_TOOL_GROUP } from "./mcp/tool-groups";
 
 /**
  * Who vouches for a runner launch's authority (#3110 review). A launch without a positively identified
@@ -194,8 +192,8 @@ export function issueOrchestratorRuntimeToken(input: {
 }
 
 /** #1870 S6c — the mint on the writer thread, for the async routes. */
-export function issueOrchestratorRuntimeTokenAsync(input: Parameters<typeof issueOrchestratorRuntimeToken>[0]): Promise<RuntimeTokenResult> {
-  return createTokenAsync(orchestratorTokenSpec(input));
+export async function issueOrchestratorRuntimeTokenAsync(input: Parameters<typeof issueOrchestratorRuntimeToken>[0]): Promise<RuntimeTokenResult> {
+  return (await createTokenAsync(orchestratorTokenSpec(input)));
 }
 
 function orchestratorTokenSpec(input: Parameters<typeof issueOrchestratorRuntimeToken>[0]): CreateTokenInput {
@@ -269,21 +267,15 @@ function runnerTokenSpec(input: RunnerRuntimeTokenInput): { token: CreateTokenIn
   const grant = authority.kind === "successor" ? successorGrant(input.agentId, profile)
     : { ...deriveRunnerGrant(profile, authority.kind === "delegated" ? { agentInitiated, callerScopes: authority.callerScopes, parentAgentId: input.spawnedBy, projectId: input.projectId, maxSpawnedAgents: input.maxSpawnedAgents } : { agentInitiated }), agentInitiated };
   const { canSpawn, maxSpawnedAgents, toolGroups, toolInclude, toolExclude } = grant;
-  const selected = resolveRelayTools({ groups: toolGroups, include: toolInclude, exclude: toolExclude });
-  for (const authoredName of toolInclude ?? []) {
-    const name = registryToolName(authoredName);
-    if (!selected.has(name)) continue;
-    const needs = INCLUDED_TOOL_SCOPE_NEEDS[name];
-    if (RELAY_TOOL_GROUPS.kernel!.includes(name) || (needs && !needs.some((need) => hasScope(grant.scope, need)))) {
-      throw new Error(`relay.tools.include: ${name} requires ${needs?.join(" or ") ?? "kernel control scopes"}; profile ${profile} cannot grant that scope under this launch authority`);
-    }
-  }
+  // Includes choose the surface, not launch authority. MCP scope filtering hides unavailable tools (#3817).
   // #1570 — provider-split: a Codex worker eager-loads every listed tool schema every turn (no
   // client-native deferral), so trim its always-loaded MCP surface to the lean worker set. Classified
   // by explicit worker profile (not tool-group shape — reviewers share the groups but aren't workers).
   const toolAllowlist = toolInclude !== undefined || toolExclude !== undefined
     ? undefined : toolAllowlistForRunner(input.provider, profile);
-  const hostPinned = grant.agentInitiated ? true : (input.hostPinned ?? hostPinForProfile(input.profile));
+  // #3804 — an agent-spawned child stays on its launch host, except a delegated sub-coordinator: its home host is
+  // often full, so it places spawns wherever its parent can unless the launch pinned it.
+  const hostPinned = grant.agentInitiated && !grant.delegated ? true : (input.hostPinned ?? hostPinForProfile(input.profile));
   const subject = input.policyName
     ? `runner:policy:${input.policyName}`
     : input.spawnRequestId
@@ -339,7 +331,7 @@ export function issueRunnerRuntimeTokenAsync(input: RunnerRuntimeTokenInput): Pr
   return createRunnerTokenAsync(spec.token, spec.launchFact ? { agentId: input.agentId, fact: spec.launchFact } : undefined);
 }
 
-export function issueInteractiveRunnerRuntimeToken(input: {
+export async function issueInteractiveRunnerRuntimeToken(input: {
   provider: string;
   cwd: string;
   runnerId: string;
@@ -351,9 +343,9 @@ export function issueInteractiveRunnerRuntimeToken(input: {
    * authorization, so it must ride the signature rather than the caller-writable agent card. */
   approvalMode?: SpawnApprovalMode;
   createdBy?: string;
-}): RuntimeTokenResult {
+}): Promise<RuntimeTokenResult> {
   const agentId = input.agentId ?? input.runnerId;
-  return createToken({
+  return (await createTokenAsync({
     profileId: "provider-interactive",
     sub: `runner:interactive:${input.host ?? "local"}:${input.runnerId}`,
     role: "provider",
@@ -368,22 +360,22 @@ export function issueInteractiveRunnerRuntimeToken(input: {
       canDelegate: false,
     },
     createdBy: input.createdBy ?? "interactive-runner",
-  });
+  }));
 }
 
-export function issueMcpRuntimeToken(input: {
+export async function issueMcpRuntimeToken(input: {
   sessionId: string;
   agentId?: string;
   targets?: string[];
   channels?: string[];
   createdBy?: string;
-}): RuntimeTokenResult {
+}): Promise<RuntimeTokenResult> {
   const targets = input.targets?.length
     ? input.targets
     : input.agentId
       ? ["user", input.agentId]
       : undefined;
-  return createToken({
+  return (await createTokenAsync({
     profileId: "mcp-client",
     sub: input.agentId ? `mcp:${input.agentId}:${input.sessionId}` : `mcp:session:${input.sessionId}`,
     role: "mcp",
@@ -394,16 +386,16 @@ export function issueMcpRuntimeToken(input: {
       canDelegate: false,
     },
     createdBy: input.createdBy ?? "runtime",
-  });
+  }));
 }
 
-export function issueIntegrationRuntimeToken(input: {
+export async function issueIntegrationRuntimeToken(input: {
   name: string;
   targets?: string[];
   channels?: string[];
   createdBy?: string;
-}): RuntimeTokenResult {
-  return createToken({
+}): Promise<RuntimeTokenResult> {
+  return (await createTokenAsync({
     profileId: "integration-client",
     sub: input.name,
     role: "integration",
@@ -414,7 +406,7 @@ export function issueIntegrationRuntimeToken(input: {
       canDelegate: false,
     },
     createdBy: input.createdBy ?? "runtime",
-  });
+  }));
 }
 
 export function runnerRuntimeTokenEnv(input: RunnerRuntimeTokenInput): Record<string, string> {