@humwick/server 0.130.2 → 0.130.4

package/src/routes/commands.ts

@@ -1,15 +1,17 @@
+import { fencePublishForPushAsync, setReviewRefFenceTokenAsync } from "../db/runtime-tail-async";
+import { updateCommandAsync, claimPendingCommandAsync } from "../commands-write";
+import { setOrchestratorUpgradeStateAsync } from "../db/orchestrators-async";
+import { deleteWorkspaceAsync } from "../db/lifecycle-tail-async";
 import { VaultError } from "../secrets-vault/keys";
 import { settleProjectRepoCreation } from "../services/project-repo-create";
 import { settleAgentExitCleanupAsync } from "../agent-exit-cleanup-async";
 // Auto-split from routes.ts (#299). Domain: commands.
 import { randomUUID } from "node:crypto";
 import { VALID_AGENT_ACTIONS, agentControlActionIcon, auditEvent, authorizeRoute, emitCommand, error, json, parseBody, type AgentControlAction, type Handler } from "./_shared";
-import { getReviewRefFenceToken, setReviewRefFenceToken } from "../db";
+import { getReviewRefFenceToken, ValidationError, getOrchestrator, getWorkspace, listOrchestrators, patchWorkspaceMetadataAsync, updateWorkspaceStatus } from "../db";
 import { cleanCommandReport, cleanParams, cleanString, optionalEnum } from "../validation";
-import { ValidationError, deleteWorkspace, getOrchestrator, getWorkspace, listOrchestrators, patchWorkspaceMetadataAsync, setOrchestratorUpgradeState, updateWorkspaceStatus } from "../db";
 import { applyCommandToRecipe } from "../recipe-runner";
-import { fencePublishForPush, getCommand, listAcceptedCommandsByOwner, updateCommand } from "../commands-db";
-import { claimPendingCommandAsync, updateCommandAsync } from "../commands-write";
+import { getCommand, listAcceptedCommandsByOwner } from "../commands-db";
 import {
   acceptLandingProgressAsync,
   acquireKernelPublishFenceAsync,
@@ -103,7 +105,7 @@ async function settleFailedOrchestratorUpgrade(command: Command): Promise<void>
   const up = orch?.upgrade;
   if (!orch || !up || up.status !== "pending" || up.commandId !== command.id) return;
   const errMsg = command.error ?? "orchestrator upgrade failed";
-  setOrchestratorUpgradeState(orch.id, { ...up, status: "failed", settledAt: Date.now(), error: errMsg });
+  (await setOrchestratorUpgradeStateAsync(orch.id, { ...up, status: "failed", settledAt: Date.now(), error: errMsg }));
   await auditEvent({
     clientId: `server-orchestrator-upgrade-command-failed-${orch.id}-${command.id}`,
     kind: "state",
@@ -170,7 +172,7 @@ export const getCommandById: Handler = async (req, params) => {
 // token it minted before claiming; this returns only rows that token accepted and that have not begun
 // running. It is intentionally separate from the normal pending poll, where accepted rows are hidden.
 export const postOwnedAcceptedCommands: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "command:write" });
+  const denied = (await authorizeRoute(req, { scope: "command:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok || !isRecord(parsed.body)) return error("command body must be an object", 400);
@@ -188,7 +190,7 @@ export const postOwnedAcceptedCommands: Handler = async (req) => {
 export const claimCommandById: Handler = async (req, params) => {
   const current = getCommand(params.id!);
   if (!current) return error("command not found", 404);
-  const denied = authorizeRoute(req, { scope: "command:write", resource: dispatchCommandAuthorizationResource(current) });
+  const denied = (await authorizeRoute(req, { scope: "command:write", resource: dispatchCommandAuthorizationResource(current) }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   const expectedType = parsed.ok && isRecord(parsed.body) ? cleanString(parsed.body.type, "type", { max: 100 }) : undefined;
@@ -223,12 +225,12 @@ export const claimCommandById: Handler = async (req, params) => {
   // persist it in the durable ledger. It is the ONLY credential that authorizes this command's terminal
   // settlement (POST /commands/:id/settle-review-publish), so no other command:write holder — including an
   // admin/`*` token — can spoof succeeded/failed/canceled on the claimed publish (generic PATCH + WS bus
-  // are refused at the updateCommand choke point). Returned to the executor only; never serialized to reads.
+  // are refused at the updateCommandAsync choke point). Returned to the executor only; never serialized to reads.
   let reviewFenceToken: string | undefined;
   if (claimed && claimed.type === "workspace.publish-review") {
     const storedFenceToken = getReviewRefFenceToken(claimed.id);
     reviewFenceToken = storedFenceToken ?? randomUUID();
-    if (!storedFenceToken) setReviewRefFenceToken(claimed.id, reviewFenceToken);
+    if (!storedFenceToken) (await setReviewRefFenceTokenAsync(claimed.id, reviewFenceToken));
   }
   // #2663 — a land that lost its CAS because an OLDER land on the same target's lane is still
   // pending is QUEUED, not out-raced, so name the head. Only a genuine CAS loss opens that: every
@@ -253,14 +255,14 @@ export const claimCommandById: Handler = async (req, params) => {
 };
 
 // #1452 round-13 HIGH#2 — token-gated settlement endpoint: the ONLY external path that may terminalize a
-// CLAIMED review publish (generic PATCH + WS bus are refused at the updateCommand choke point). The caller
+// CLAIMED review publish (generic PATCH + WS bus are refused at the updateCommandAsync choke point). The caller
 // must present the exact fence token minted at claim; a missing/mismatched token fails closed (409). Only
-// then does updateCommand run with executor authority. Confines settlement to the actual executor.
+// then does updateCommandAsync run with executor authority. Confines settlement to the actual executor.
 export const settleReviewPublishCommandById: Handler = async (req, params) => {
   const current = getCommand(params.id!);
   if (!current) return error("command not found", 404);
   if (current.type !== "workspace.publish-review") return error("not a review publish command", 400);
-  const denied = authorizeRoute(req, { scope: "command:write", resource: dispatchCommandAuthorizationResource(current) });
+  const denied = (await authorizeRoute(req, { scope: "command:write", resource: dispatchCommandAuthorizationResource(current) }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok || !isRecord(parsed.body)) return error("command body must be an object", 400);
@@ -271,7 +273,7 @@ export const settleReviewPublishCommandById: Handler = async (req, params) => {
   if (!status) return error("status must be succeeded or failed", 400);
   const result = cleanParams(parsed.body.result, "result");
   const err = cleanString(parsed.body.error, "error", { max: 4000 });
-  const command = updateCommand(params.id!, { status: status as CommandStatus, result, error: err }, { executor: true });
+  const command = (await updateCommandAsync(params.id!, { status: status as CommandStatus, result, error: err }, { executor: true }));
   if (!command) return error("command not found", 404);
   emitCommand(command);
   return json(serializeCommandForRead(command, authContextFromRequest(req)));
@@ -285,7 +287,7 @@ export const settleReviewPublishCommandById: Handler = async (req, params) => {
 export const fencePublishCommandById: Handler = async (req, params) => {
   const current = getCommand(params.id!);
   if (!current) return error("command not found", 404);
-  const denied = authorizeRoute(req, { scope: "command:write", resource: dispatchCommandAuthorizationResource(current) });
+  const denied = (await authorizeRoute(req, { scope: "command:write", resource: dispatchCommandAuthorizationResource(current) }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   const body = parsed.ok && isRecord(parsed.body) ? parsed.body : {};
@@ -335,7 +337,7 @@ export const fencePublishCommandById: Handler = async (req, params) => {
       ...(fenced.reason ? { reason: fenced.reason } : {}) });
   }
   if (current.type === "workspace.merge" && current.landingContainmentMode === "legacy-unfenced-v0") {
-    const fenced = fencePublishForPush(params.id!, expectedType);
+    const fenced = (await fencePublishForPushAsync(params.id!, expectedType));
     return json({ fenced: Boolean(fenced),
       ...(fenced ? { command: serializeCommandForRead(fenced, authContextFromRequest(req)) } : {}) });
   }
@@ -386,7 +388,7 @@ export const fencePublishCommandById: Handler = async (req, params) => {
     });
     return json({ fenced: permit.permitted, ...(permit.permitId ? { permitId: permit.permitId } : {}), ...(permit.reason ? { reason: permit.reason } : {}) });
   }
-  const fenced = fencePublishForPush(params.id!, expectedType);
+  const fenced = (await fencePublishForPushAsync(params.id!, expectedType));
   return json({
     fenced: Boolean(fenced),
     ...(fenced ? { command: serializeCommandForRead(fenced, authContextFromRequest(req)) } : {}),
@@ -400,7 +402,7 @@ export const patchCommand: Handler = async (req, params) => {
   try {
     const current = getCommand(params.id!);
     if (!current) return error("command not found", 404);
-    const denied = authorizeRoute(req, { scope: "command:write", resource: dispatchCommandAuthorizationResource(current) });
+    const denied = (await authorizeRoute(req, { scope: "command:write", resource: dispatchCommandAuthorizationResource(current) }));
     if (denied) return denied;
     const status = optionalEnum(parsed.body.status, "status", VALID_COMMAND_STATUSES);
     const fencedLanding = (current.type === "workspace.merge" || isLandingCommandType(current.type))
@@ -462,23 +464,23 @@ export const patchCommand: Handler = async (req, params) => {
     noteCompactionCommandCompleted(command);
     // #2095 — durable "clear committed vs no-op" signal, fired on terminal compact/clear commands.
     noteCompactionResult(command);
-    settleSelfResumeContinuationIngestion(command);
-    enqueueContinuationInjectionAfterSelfResume(command);
-    enqueueLifecycleIdentityInjectionAfterContextCommand(command);
-    notifySelfResumeNoOp(command);
-    settleContextResetCarry(command);
-    settleSelfRestartManagedState(command);
-    settleInterruptRedirectMessage(command);
+    (await settleSelfResumeContinuationIngestion(command));
+    (await enqueueContinuationInjectionAfterSelfResume(command));
+    (await enqueueLifecycleIdentityInjectionAfterContextCommand(command));
+    await notifySelfResumeNoOp(command);
+    (await settleContextResetCarry(command));
+    (await settleSelfRestartManagedState(command));
+    (await settleInterruptRedirectMessage(command));
     // #1565 P4b — memory rides BESIDE the continuation as its own payload (§7), delta-gated on
     // compact; and a memory inject that SUCCEEDS is what advances that gate. Ordered LAST and
     // contained (#1565 F8): composing a block touches the DB, ownership and cwd resolution, and a
     // throw in any of that must not take the rest of the settle chain down with it. The continuation
     // enqueue stays first, so it is unaffected either way.
-    settleMemoryInjectionAfterContextCommand(command);
+    (await settleMemoryInjectionAfterContextCommand(command));
     // #1951 — startup context (validation commands, report-up, profile charter, caller context)
     // recomposed from the DB and re-injected beside the others, delta-gated on compact. Contained
     // the same way (a compose throw must not take the rest of the settle chain down with it).
-    settleStartupContextInjectionAfterContextCommand(command);
+    (await settleStartupContextInjectionAfterContextCommand(command));
     if (command.type === "scheduler.command") {
       await settleScheduledCommandTimer(command);
     }
@@ -548,7 +550,7 @@ export const patchCommand: Handler = async (req, params) => {
     if (command.type === "agent.spawn" && command.status === "failed") {
       const parent = isRecord(command.params) ? cleanString(command.params.spawnedBy, "params.spawnedBy", { max: 240 }) : undefined;
       if (parent) {
-        notifyAgentSpawnFailed({
+        await notifyAgentSpawnFailed({
           parent,
           spawnRequestId: isRecord(command.params) ? cleanString(command.params.spawnRequestId, "params.spawnRequestId", { max: 160 }) : undefined,
           provider: isRecord(command.params) ? cleanString(command.params.provider, "params.provider", { max: 40 }) : undefined,

package/src/routes/context-resets.ts

@@ -24,9 +24,9 @@ export const postAgentContextResetRoute: Handler = async (req, params) => {
       evidence: { instanceId: cleanString(body.instanceId, "instanceId", { max: 200 }) ?? null },
       observedAt,
     };
-    const carry = recordContextReset(fact);
+    const carry = (await recordContextReset(fact));
     // #3698 — a commanded reset is refreshed by its command's settle; an uncommanded one only here.
-    if (!fact.commandId) refreshContextAfterObservedReset(fact);
+    if (!fact.commandId) (await refreshContextAfterObservedReset(fact));
     return json({ ok: true, carryMessageId: carry?.id ?? null });
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);

package/src/routes/coordinator-teams.ts

@@ -4,7 +4,7 @@ import type { CoordinatorTeamSummary } from "../types";
 
 /** Connector discovery: no roster, plan, or per-team runtime queries. */
 export const getCoordinatorTeams: Handler = async req => {
-  const denied = authorizeRoute(req, { scope: "channel:read" });
+  const denied = (await authorizeRoute(req, { scope: "channel:read" }));
   if (denied) return denied;
   const teams: CoordinatorTeamSummary[] = (await listCoordinatorTeamsAsync()).filter(team => team.coordinatorId).map(team => ({
     id: team.id, coordinatorId: team.coordinatorId!, title: team.title ?? null, projectId: team.projectId, projectName: team.projectName,

package/src/routes/decisions.ts

@@ -48,7 +48,7 @@ export const postDecisionAnswerRoute: Handler = async (req, params) => {
   if (!parsed.ok) return error(parsed.error, parsed.status);
   const body = isRecord(parsed.body) ? parsed.body : {};
   try {
-    return json(answerDecision(authContextFromRequest(req), id, { answers: body.answers, note: body.note }));
+    return json((await answerDecision(authContextFromRequest(req), id, { answers: body.answers, note: body.note })));
   } catch (err) {
     return routeError(err);
   }
@@ -59,7 +59,7 @@ export const postDecisionRoute: Handler = async (req) => {
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
     const ctx = authContextFromRequest(req);
-    return json(fileDecision(ctx, isRecord(parsed.body) ? parsed.body : {}, callerProjectId(ctx)), 201);
+    return json((await fileDecision(ctx, isRecord(parsed.body) ? parsed.body : {}, callerProjectId(ctx))), 201);
   } catch (err) {
     return routeError(err);
   }

package/src/routes/host-providers.ts

@@ -8,6 +8,9 @@ import { error, json, parseBody, type Handler } from "./_shared";
 import { getHostProviderSetting } from "../host-provider-store";
 import { isHostSwitchableProvider, isOptInProvider, type HostProviderEnablementSetting } from "../host-provider-enablement";
 import { setHostProviderEnabled, setHostProvidersBulk } from "../services/host-providers";
+import { connectProviderApiKey } from "../services/provider-api-key";
+import { VaultError } from "../secrets-vault/keys";
+import { vaultActorOf } from "../services/auth-context";
 import type { SpawnProvider } from "@humwick/sdk";
 
 function hostProviderView(hostId: string, advertised: SpawnProvider[], setting: HostProviderEnablementSetting | null, catalogProviders: SpawnProvider[]) {
@@ -71,3 +74,18 @@ export const putHostProvidersBulkRoute: Handler = async (req, params) => {
     throw e;
   }
 };
+
+/** T7689 — first-run provider setup: the operator's key, bound on this host, with a credit window. */
+export const postHostProviderApiKeyRoute: Handler = async (req, params) => {
+  const hostId = cleanString(params.id, "host id", { required: true, max: 120 })!;
+  const provider = cleanString(params.provider, "provider", { required: true, max: 80 })!;
+  const parsed = await parseBody<unknown>(req);
+  if (!parsed.ok) return error(parsed.error, parsed.status);
+  try {
+    return json(await connectProviderApiKey(vaultActorOf(req), hostId, provider, parsed.body, req));
+  } catch (e) {
+    if (e instanceof ValidationError) return error(e.message, 400);
+    if (e instanceof VaultError) return error(e.message, 503);
+    throw e;
+  }
+};

package/src/routes/host-secret-files.ts

@@ -10,7 +10,7 @@ import { authorizeRoute, error, parseBody, type Handler } from "./_shared";
 export const postHostSecretFilesResolve: Handler = async (req, params) => {
   const orch = getOrchestrator(params.id!);
   if (!orch) return error("orchestrator not found", 404);
-  const denied = authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } });
+  const denied = (await authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } }));
   if (denied) return denied;
   const component = getComponentAuth(req);
   if (!isFullReachRequest(req) && !(component?.role === "orchestrator" && component.constraints?.orchestrators?.includes(orch.id))) return error("forbidden", 403);

package/src/routes/hosts.ts

@@ -14,7 +14,7 @@ function queryTags(value: string | null, field: string): string[] | undefined {
 }
 
 export const getHostsRoute: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "hosts:read" });
+  const denied = (await authorizeRoute(req, { scope: "hosts:read" }));
   if (denied) return denied;
   const query = new URL(req.url).searchParams;
   try {
@@ -44,7 +44,7 @@ export const getHostsRoute: Handler = async (req) => {
  * relay shows a rebuilding chart, not a stale one).
  */
 export const getHostUtilizationSeries: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "hosts:read" });
+  const denied = (await authorizeRoute(req, { scope: "hosts:read" }));
   if (denied) return denied;
   const samples = readHostUtilizationSeries(params.id!);
   return json({ host: params.id!, window_ms: HOST_UTILIZATION_BUFFER_MS, samples });
@@ -54,7 +54,7 @@ export const getHostUtilizationSeries: Handler = async (req, params) => {
 // gateway write ops the MCP host tools already use (hosts.setLabel / hosts.setTags); this route is
 // just the HTTP door onto them, same shape as patchAgentLabel/patchAgentTags in agents.ts.
 export const patchHostLabel: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "hosts:write" });
+  const denied = (await authorizeRoute(req, { scope: "hosts:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -81,7 +81,7 @@ export const patchHostLabel: Handler = async (req, params) => {
 };
 
 export const patchHostTags: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "hosts:write" });
+  const denied = (await authorizeRoute(req, { scope: "hosts:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -111,7 +111,7 @@ export const patchHostTags: Handler = async (req, params) => {
 // write is idempotent: an already-accepted host remains accepted and a later identity change still
 // traverses the registration tripwire.
 export const postAcceptHostHardware: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "hosts:write" });
+  const denied = (await authorizeRoute(req, { scope: "hosts:write" }));
   if (denied) return denied;
   const host = await acceptHostHardwareAsync(params.id!);
   if (!host) return error("host not found", 404);
@@ -129,7 +129,7 @@ export const postAcceptHostHardware: Handler = async (req, params) => {
 };
 
 export const patchHostLandingPlacement: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "hosts:write" });
+  const denied = (await authorizeRoute(req, { scope: "hosts:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -153,7 +153,7 @@ export const patchHostLandingPlacement: Handler = async (req, params) => {
 };
 
 export const patchHostAgentCap: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "hosts:write" });
+  const denied = (await authorizeRoute(req, { scope: "hosts:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -177,7 +177,7 @@ export const patchHostAgentCap: Handler = async (req, params) => {
 };
 
 export const patchHostLandingCap: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "hosts:write" });
+  const denied = (await authorizeRoute(req, { scope: "hosts:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -201,7 +201,7 @@ export const patchHostLandingCap: Handler = async (req, params) => {
 };
 
 export const patchHostGateBudget: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "hosts:write" });
+  const denied = (await authorizeRoute(req, { scope: "hosts:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -217,7 +217,7 @@ export const patchHostGateBudget: Handler = async (req, params) => {
 };
 
 export const patchHostAdmission: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "hosts:write" });
+  const denied = (await authorizeRoute(req, { scope: "hosts:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -232,7 +232,7 @@ export const patchHostAdmission: Handler = async (req, params) => {
 };
 
 export const getHostAdmission: Handler = async (req, params) => {
-  const denied = getComponentAuth(req) ? null : authorizeRoute(req, { scope: "hosts:read" });
+  const denied = getComponentAuth(req) ? null : (await authorizeRoute(req, { scope: "hosts:read" }));
   if (denied) return denied;
   const host = await getHostAsync(resolveHostId(params.id!) ?? params.id!);
   if (!host) return error("host not found", 404);

package/src/routes/inbox.ts

@@ -78,7 +78,8 @@ function normalizeChatHistoryImportInput(body: unknown): {
 export const getInboxStateRoute: Handler = async (req) => {
   const url = new URL(req.url);
   const operatorId = inboxOperatorId(req, url.searchParams.get("operatorId") ?? undefined);
-  return json(await getInboxStateAsync(operatorId));
+  const raw = url.searchParams.get("excludeOffline");
+  return json(await getInboxStateAsync(operatorId, { excludeOffline: raw === "1" || raw === "true" }));
 };
 
 export const patchInboxThreadState: Handler = async (req) => {
@@ -140,7 +141,7 @@ export const postChatHistoryImportRoute: Handler = async (req) => {
   try {
     const input = normalizeChatHistoryImportInput(parsed.body);
     if (resolveActingUser(req)?.source === "session") input.importedBy = requestUserAddress(req);
-    const denied = authorizeRoute(req, { scope: "agent:write", resource: { agentId: input.targetAgentId, spawnRequestId: input.targetSpawnRequestId } });
+    const denied = (await authorizeRoute(req, { scope: "agent:write", resource: { agentId: input.targetAgentId, spawnRequestId: input.targetSpawnRequestId } }));
     if (denied) return denied;
     const imported = await createChatHistoryImportAsync(input);
     return json(imported, 201);

package/src/routes/index.ts

@@ -44,11 +44,11 @@ import { deleteInboxDraftRoute, getChatHistoryImportsRoute, getInboxStateRoute,
 import { postAgentAreaEntered } from "./memory";
 import { deleteMessageById, getCursorRoute, getMessageById, getMessageDeliveryRoute, getMessageStatusRoute, getMessageThread, getMessages, getQueuedMessagesRoute, patchMessage, postClaimMessage, postMessage, postMessageDeliveryAction, postMessageDeliveryAttempt, postMessageReaction, postRenewMessageClaim, postSystemBroadcast } from "./messages";
 import { deleteOrchestratorById, getOrchestratorById, getOrchestrators, patchOrchestratorAgents, postOrchestrator, postOrchestratorAction, postOrchestratorHeartbeat } from "./orchestrator";
-import { getHostProvidersRoute, putHostProviderRoute, putHostProvidersBulkRoute } from "./host-providers";
+import { getHostProvidersRoute, postHostProviderApiKeyRoute, putHostProviderRoute, putHostProvidersBulkRoute } from "./host-providers";
 import { deleteSpawnPolicyRoute, getSpawnPoliciesHealth, getSpawnPoliciesRoute, getSpawnPolicyDiagnostics, getSpawnPolicyHealth, getSpawnPolicyRoute, getSpawnPolicyStatus, postSpawnPolicyRestart, postSpawnPolicyStart, postSpawnPolicyStop, putSpawnPolicyRoute } from "./spawn-policy";
 import { deleteTokenProfileRoute, getTokenById, getTokenMe, getTokenProfiles, getTokens, patchTokenProfile, postIntegrationRuntimeToken, postInteractiveRunnerRuntimeToken, postMcpRuntimeToken, postOrchestratorRunnerToken, postRuntimeTokenRemint, postRuntimeTokenRenew, postToken, postTokenProfile, postTokenRevoke } from "./tokens";
 import { deleteWorkspaceById, getWorkspaceById, getWorkspaceDiagnostics, getWorkspaceDiff, getWorkspaceGitState, getWorkspaceMergePreview, getWorkspaceOrphans, getWorkspaceRecoveryBranches, getWorkspaceStewards, getWorkspaces, postWorkspaceAction, postWorkspaceCleanupStale, postWorkspaceOrphanReclaim, postWorkspaceRecoveryBranchDiscard } from "./workspaces";
-import { getAuthProvidersRoute, postAcceptInviteRoute, postAuthLoginRoute, postAuthLogoutRoute, postAuthRefreshRoute } from "./auth";
+import { getAuthProvidersRoute, postAcceptInviteRoute, postAuthLoginRoute, postAuthLogoutRoute, postAuthRefreshRoute, postLoginLinkRoute, postRedeemLoginLinkRoute } from "./auth";
 import { getActivityEvents, postActivityEvent } from "./activity";
 import { getAnalyticsRoute, getDeliveryQualityRoute, getHealthRoute, getHubMetricsRoute, getLeadTimeRoute, getMaintenanceJobs, getMaintenancePauses, getMaintenanceRunning, getStatsRoute, postMaintenanceJobCancel, postMaintenanceJobPause, postMaintenanceJobResume, postMaintenanceJobRun, postSystemReap } from "./stats";
 import { getApiDocs, getApiSpec } from "./spec";
@@ -85,7 +85,7 @@ import { getMergeDrain, getMergePauseById, getMergePauses, postMergePause, postM
 import { postMcp } from "../mcp";
 import { postOrchestratorBootstrap, postOrchestratorBootstrapExchange } from "./orchestrator-bootstrap";
 import { getDeploysRoute } from "./deploys";
-import { getGateStatsRoute, getShippingBoardRoute, getShippingStatsRoute, postRedMainAbandonRoute } from "./shipping";
+import { getGateStatsRoute, getKnownFailuresRoute, getShippingBoardRoute, getShippingStatsRoute, postRedMainAbandonRoute } from "./shipping";
 import { getWorkflowCatalogRoute, getWorkflowDefinitionsRoute, getWorkflowRunBudgetRoute, getWorkflowRunRoute, getWorkflowRunsRoute, getWorkflowStatsRoute, patchWorkflowRunBudgetRoute, postWorkflowRunCancelRoute, postWorkflowRunPauseRoute, postWorkflowRunResumeRoute, postWorkflowRunStartRoute, postWorkflowRunUnpauseRoute } from "./workflows";
 import { getRestartEpochRoute, postRestartEpochAbandonRoute } from "./restart-epochs";
 import { getFleetConvergenceRoute } from "./fleet-convergence";
@@ -103,6 +103,8 @@ const routes: Route[] = [
   route("POST", "/api/auth/refresh", postAuthRefreshRoute),
   route("POST", "/api/auth/logout", postAuthLogoutRoute),
   route("POST", "/api/auth/invites/accept", postAcceptInviteRoute),
+  route("POST", "/api/auth/login-links", postLoginLinkRoute),
+  route("POST", "/api/auth/login-links/redeem", postRedeemLoginLinkRoute),
   route("POST", "/api/users/invites", postUserInvite),
   route("PUT", "/api/users/me/password", putMyPassword),
 
@@ -228,6 +230,7 @@ const routes: Route[] = [
   route("GET", "/api/orchestrators/:id/host-providers", getHostProvidersRoute),
   route("PUT", "/api/orchestrators/:id/host-providers", putHostProvidersBulkRoute),
   route("PUT", "/api/orchestrators/:id/host-providers/:provider", putHostProviderRoute),
+  route("POST", "/api/orchestrators/:id/host-providers/:provider/api-key", postHostProviderApiKeyRoute),
   route("GET", "/api/orchestrators/:id/sessions", getOrchestratorSessions),
   route("GET", "/api/orchestrators/:id/version", getOrchestratorVersion),
   route("GET", "/api/orchestrators/:id/logs/:session", getOrchestratorLogs),
@@ -599,6 +602,7 @@ const routes: Route[] = [
   route("POST", "/api/shipping/incidents/:id/abandon", postRedMainAbandonRoute),
   route("GET", "/api/shipping/board", getShippingBoardRoute),
   route("GET", "/api/shipping/stats", getShippingStatsRoute),
+  route("GET", "/api/shipping/known-failures", getKnownFailuresRoute),
   route("GET", "/api/gates/stats", getGateStatsRoute),
   route("GET", "/api/workflows/catalog", getWorkflowCatalogRoute),
   route("POST", "/api/workflows/runs", postWorkflowRunStartRoute),

package/src/routes/integrations.ts

@@ -1,8 +1,10 @@
+import { upsertIntegrationRegistryAsync, ingestIntegrationEventAsync } from "../db/runtime-tail-async";
+import { sendMessageWithResultAsync } from "../db/message-send";
 import type { IntegrationRegistryInput } from "../db/integrations";
 // Auto-split from routes.ts (#299). Domain: integrations.
 import { INTEGRATION_RATE_LIMIT_PER_MINUTE, MAX_BODY_BYTES, getIntegrationTokens, type IntegrationTokenConfig } from "../config";
 import { VALID_ARTIFACT_KINDS, VALID_ARTIFACT_ROLES, VALID_TASK_STATUSES, agentSessionStatus, authorizeRoute, cleanAttachmentRefs, dispatchTaskCallbacksInBackground, error, json, normalizeAgentSessionGuard, parseBody, reactionEmoji, sendReactionNotificationToAuthor, validateChannelAttachmentSourceRef, withPayloadAttachments, type Handler } from "./_shared";
-import { ValidationError, evaluatePoolBindingsAsync, findMessageByTelegramSourceAsync, getAgent, getChannelAsync, getMessage, ingestIntegrationEvent, isIntegrationRegistryEnabled, listChannelBindingsAsync, listChannelsAsync, listIntegrationTaskStatsAsync, reconcileIntegrationRegistryAsync, resolveChannelRoutesAsync, sendMessageWithResult, setMessageReactionAsync, upsertChannelBindingAsync, upsertIntegrationRegistry, validateAgentSession } from "../db";
+import { ValidationError, evaluatePoolBindingsAsync, findMessageByTelegramSourceAsync, getAgent, getChannelAsync, getMessage, isIntegrationRegistryEnabled, listChannelBindingsAsync, listChannelsAsync, listIntegrationTaskStatsAsync, reconcileIntegrationRegistryAsync, resolveChannelRoutesAsync, setMessageReactionAsync, upsertChannelBindingAsync, validateAgentSession } from "../db";
 import { cleanMeta, cleanString, cleanStringArray, optionalEnum } from "../validation";
 import { emitChannelActivity, emitMessageQueued, emitMessageReactionUpdated, emitNewMessage, emitTaskChanged } from "../sse";
 import { getComponentAuth, getIntegrationAuth, hasIntegrationScope, isRequestAuthorizedFor } from "../security";
@@ -425,7 +427,7 @@ export const putIntegrationRegistryRoute: Handler = async (req, params) => {
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
-    return json(upsertIntegrationRegistry(normalizeIntegrationRegistryInput(name, parsed.body)));
+    return json((await upsertIntegrationRegistryAsync(normalizeIntegrationRegistryInput(name, parsed.body))));
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);
     throw e;
@@ -497,7 +499,7 @@ async function applyInboundChannelReaction(payload: Record<string, unknown>): Pr
   const result = await setMessageReactionAsync({ messageId: parent.id, actorId, emoji, action });
   if (result.ok) {
     emitMessageReactionUpdated(result.message);
-    sendReactionNotificationToAuthor(result.message, actorId, emoji, action);
+    (await sendReactionNotificationToAuthor(result.message, actorId, emoji, action));
   }
 }
 
@@ -509,7 +511,7 @@ export const postChannelEvent: Handler = async (req, params) => {
     if (!channel) return error("channel not found", 404);
     const sessionError = requireChannelSession(req, parsed.body, channel);
     if (sessionError) return sessionError;
-    const denied = authorizeRoute(req, { scope: "channel:write", resource: { channel: channel.id } });
+    const denied = (await authorizeRoute(req, { scope: "channel:write", resource: { channel: channel.id } }));
     if (denied) return denied;
     const input = normalizeChannelEventBody(parsed.body);
     validateChannelEnvelope(input.payload, channel);
@@ -521,7 +523,7 @@ export const postChannelEvent: Handler = async (req, params) => {
     await applyInboundChannelReaction(input.payload);
     const bindings = await resolveChannelRoutesAsync(channel.id, input.conversationId);
     if (!bindings.length) return error("channel has no binding", 409);
-    const results = bindings.map((binding) => sendMessageWithResult({
+    const results = await Promise.all(bindings.map(async (binding) => (await sendMessageWithResultAsync({
       from: channel.agentId,
       to: messageTargetForChannelTarget(binding.target, binding),
       kind: "channel.event",
@@ -530,7 +532,7 @@ export const postChannelEvent: Handler = async (req, params) => {
       payload: input.payload,
       idempotencyKey: scopedChannelIdempotencyKey(input.idempotencyKey, binding),
       claimable: false,
-    }));
+    }))));
     for (const result of results) {
       if (!result.created) continue;
       if (result.message.deliveryStatus === "queued") emitMessageQueued(result.message);
@@ -598,7 +600,7 @@ export const postIntegrationEvent: Handler = async (req) => {
       return error("integration token cannot target this task", 403);
     }
     const input = await resolveIntegrationEventTarget({ ...normalized, source: normalized.source ?? integrationName });
-    const result = ingestIntegrationEvent(input, integrationName);
+    const result = (await ingestIntegrationEventAsync(input, integrationName));
     if (result.message) emitNewMessage(result.message);
     emitTaskChanged(result.task, result.created ? "task.created" : "task.updated");
     dispatchTaskCallbacksInBackground(result.task.id, result.created ? "task.created" : "task.updated");

package/src/routes/issue-activity.ts

@@ -31,7 +31,7 @@ export const postIssueActivityRoute: Handler = async (req) => {
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
     if (!isRecord(parsed.body)) throw new ValidationError("issue activity body required");
-    const event = recordAndEmitIssueActivity({
+    const event = (await recordAndEmitIssueActivity({
       agentId: cleanString(parsed.body.agentId, "agentId", { required: true, max: 200 })!,
       action: cleanAction(parsed.body.action),
       issueRefId: cleanString(parsed.body.issueRefId, "issueRefId", { max: 120 }),
@@ -42,7 +42,7 @@ export const postIssueActivityRoute: Handler = async (req) => {
       title: cleanString(parsed.body.title, "title", { max: 200 }),
       body: cleanString(parsed.body.body, "body", { max: 1000 }),
       metadata: cleanMeta(parsed.body.metadata),
-    });
+    }));
     return json({ event }, 201);
   } catch (err) {
     if (err instanceof ValidationError) return error(err.message, 400);

package/src/routes/issue-associations.ts

@@ -37,7 +37,7 @@ export const postIssueAssociationRoute: Handler = async (req) => {
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
-    return json(associateIssueRef(cleanAssociationBody(parsed.body)));
+    return json((await associateIssueRef(cleanAssociationBody(parsed.body))));
   } catch (err) {
     return routeError(err);
   }
@@ -56,9 +56,9 @@ export const getIssueAssociationEntityIssuesRoute: Handler = (_req, params) => {
   }
 };
 
-export const getIssueAssociationIssueEntitiesRoute: Handler = (_req, params) => {
+export const getIssueAssociationIssueEntitiesRoute: Handler = async (_req, params) => {
   try {
-    const issueRef = resolveAssociationIssueRef({ issueRefId: cleanString(params.issueRefId, "issueRefId", { required: true, max: 120 })! });
+    const issueRef = (await resolveAssociationIssueRef({ issueRefId: cleanString(params.issueRefId, "issueRefId", { required: true, max: 120 })! }));
     return json({ issueRef, entities: listIssueEntities(issueRef.id) });
   } catch (err) {
     return routeError(err);
@@ -69,7 +69,7 @@ export const deleteIssueAssociationRoute: Handler = async (req) => {
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
-    return json(removeIssueAssociation(cleanAssociationBody(parsed.body)));
+    return json((await removeIssueAssociation(cleanAssociationBody(parsed.body))));
   } catch (err) {
     return routeError(err);
   }

package/src/routes/issue-refs.ts

@@ -1,4 +1,4 @@
-import { deleteIssueRefMappingAsync, getIssueRef, listIssueRefs, patchIssueRefMappingAsync, resolveIssueRefMappingAsync, upsertIssueRefMappingAsync, type ListIssueRefsOptions } from "../services/issue-refs";
+import { deleteIssueRefMappingAsync, getIssueRef, listIssueRefsAsync, patchIssueRefMappingAsync, resolveIssueRefMappingAsync, upsertIssueRefMappingAsync, type ListIssueRefsOptions } from "../services/issue-refs";
 import { getIssueRefByExternalKey, issueRefClosedCompleted, issueRefForRefString } from "../db/issue-refs";
 import { advanceTerminalPlanRefsAsync } from "../services/plan-terminal-refs";
 import { cleanEnum, cleanString, optionalEnum } from "../validation";
@@ -53,7 +53,7 @@ function cleanResolveBody(body: unknown) {
   return body;
 }
 
-export const listIssueRefsRoute: Handler = (req) => {
+export const listIssueRefsRoute: Handler = async (req) => {
   try {
     const url = new URL(req.url);
     const rawLimit = parseQueryInt(url.searchParams.get("limit"), { min: 1, max: 500, clamp: true });
@@ -64,7 +64,7 @@ export const listIssueRefsRoute: Handler = (req) => {
       status: optionalEnum(url.searchParams.get("status") ?? undefined, "status", ISSUE_REF_STATUSES) as IssueRefStatus | undefined,
       limit: rawLimit ?? undefined,
     };
-    return json({ issueRefs: listIssueRefs(opts) });
+    return json({ issueRefs: await listIssueRefsAsync(opts) });
   } catch (err) {
     return error(err instanceof Error ? err.message : "issue refs route failed");
   }

package/src/routes/kernel-timers-operator.ts

@@ -22,7 +22,7 @@ export const postTimerMessageOperator: Handler = async (req, params) => {
   // Unlike routine routes in allow-unauth development mode, the migration trigger always requires
   // an actual credential. This keeps "authenticated" a property of the action, not deployment mode.
   if (!hasPresentedCredential(req)) return error("authentication required", 401);
-  const denied = authorizeRoute(req, { scope: "system:admin" });
+  const denied = (await authorizeRoute(req, { scope: "system:admin" }));
   if (denied) return denied;
   const actor = resolveActorLabel(req);
   if (!actor) return error("authenticated operator identity required", 403);

package/src/routes/memory.ts

@@ -7,7 +7,7 @@ import { authorizeRoute, error, json, parseBody, type Handler } from "./_shared"
 // that area's memories (src/memory-area-injection.ts).
 export const postAgentAreaEntered: Handler = async (req, params) => {
   const agentId = params.id!;
-  const denied = authorizeRoute(req, { scope: "agent:write", resource: { agentId } });
+  const denied = (await authorizeRoute(req, { scope: "agent:write", resource: { agentId } }));
   if (denied) return denied;
   const ctx = authContextFromRequest(req);
   if (ctx.actor.kind !== "system" && ctx.callerAgentId !== agentId) return error("forbidden: only the agent's own runner may report its area touches", 403);