@humwick/server 0.130.2 → 0.130.4

package/src/routes/prompt-templates.ts

@@ -21,21 +21,21 @@ function routeError(err: unknown): Response {
   return error(err instanceof Error ? err.message : "prompt template route failed");
 }
 
-function authorizePromptRead(req: Request): Response | null {
+async function authorizePromptRead(req: Request): Promise<Response | null> {
   const auth = getComponentAuth(req);
   if (auth && (hasComponentScope(auth, "system:admin") || hasComponentScope(auth, "agent:read"))) return null;
-  return authorizeRoute(req, { scope: "system:admin" });
+  return (await authorizeRoute(req, { scope: "system:admin" }));
 }
 
 export const getPromptTemplatesRoute: Handler = async (req) => {
-  const denied = authorizePromptRead(req);
+  const denied = (await authorizePromptRead(req));
   if (denied) return denied;
   const category = cleanString(new URL(req.url).searchParams.get("category"), "category", { max: 120 }) ?? undefined;
   return json({ templates: (await readPromptTemplates(category)).filter(entry => !memoryRetirementMessage(entry.slug)) });
 };
 
 export const getPromptTemplateRoute: Handler = async (req, params) => {
-  const denied = authorizePromptRead(req);
+  const denied = (await authorizePromptRead(req));
   if (denied) return denied;
   const slug = slugParam(params);
   const retirement = memoryRetirementMessage(slug);
@@ -45,7 +45,7 @@ export const getPromptTemplateRoute: Handler = async (req, params) => {
 };
 
 export const putPromptTemplateRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: versionedPromptsEnabled() ? "agent:write" : "system:admin" });
+  const denied = (await authorizeRoute(req, { scope: versionedPromptsEnabled() ? "agent:write" : "system:admin" }));
   if (denied) return denied;
   const parsed = await parseBody<Record<string, unknown>>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -55,31 +55,31 @@ export const putPromptTemplateRoute: Handler = async (req, params) => {
       await mutatePrompt(authContextFromRequest(req), slug, parsed.body);
       return json(await readPromptTemplate(slug));
     }
-    const legacyDenied = authorizeRoute(req, { scope: "system:admin" });
+    const legacyDenied = (await authorizeRoute(req, { scope: "system:admin" }));
     if (legacyDenied) return legacyDenied;
     const template = cleanString(parsed.body?.template, "template", { required: true, max: 200_000 })!;
-    return json(updatePromptTemplate(slug, template));
+    return json((await updatePromptTemplate(slug, template)));
   } catch (err) {
     return routeError(err);
   }
 };
 
 export const postPromptTemplateResetRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: versionedPromptsEnabled() ? "agent:write" : "system:admin" });
+  const denied = (await authorizeRoute(req, { scope: versionedPromptsEnabled() ? "agent:write" : "system:admin" }));
   if (denied) return denied;
   try {
     const slug = slugParam(params);
     if (versionedPromptsEnabled() && (await readPromptTemplate(slug))?.version !== undefined) return mutateRevision(req, slug, "adopt");
-    const legacyDenied = authorizeRoute(req, { scope: "system:admin" });
+    const legacyDenied = (await authorizeRoute(req, { scope: "system:admin" }));
     if (legacyDenied) return legacyDenied;
-    return json(resetPromptTemplate(slug));
+    return json((await resetPromptTemplate(slug)));
   } catch (err) {
     return routeError(err);
   }
 };
 
 export const getPromptHistoryRoute: Handler = async (req, params) => {
-  const denied = authorizePromptRead(req);
+  const denied = (await authorizePromptRead(req));
   if (denied) return denied;
   const slug = slugParam(params);
   if (!versionedPromptsEnabled() || (await readPromptTemplate(slug))?.version === undefined) return error("versioned prompt not found", 404);
@@ -100,7 +100,7 @@ async function mutateRevision(req: Request, slug: string, action: "adopt" | "res
 }
 
 export const postPromptRevisionRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "agent:write" });
+  const denied = (await authorizeRoute(req, { scope: "agent:write" }));
   if (denied) return denied;
   return mutateRevision(req, slugParam(params), new URL(req.url).pathname.endsWith("/restore") ? "restore" : "adopt");
 };

package/src/routes/provider-quotas.ts

@@ -45,7 +45,7 @@ function cleanUnavailableWindows(value: unknown): ProviderQuotaWindowIdentity[]
   return windows;
 }
 
-function cleanProviderQuotaUpdate(body: unknown): ProviderQuotaUpdateInput | string {
+export function cleanProviderQuotaUpdate(body: unknown): ProviderQuotaUpdateInput | string {
   if (!isRecord(body)) return "JSON object body required";
   const provider = cleanString(body.provider, "provider", { required: true, max: 80 })!;
   const accountKey = cleanString(body.accountKey, "accountKey", { required: true, max: 240 })!;
@@ -122,7 +122,7 @@ export const postProviderQuotaRoute: Handler = async (req) => {
   if (!parsed.ok) return error(parsed.error, parsed.status);
   const input = cleanProviderQuotaUpdate(parsed.body);
   if (typeof input === "string") return error(input);
-  const providerWriteGate = authorizeProviderQuotaWrite(req, input);
+  const providerWriteGate = (await authorizeProviderQuotaWrite(req, input));
   if (providerWriteGate) return providerWriteGate;
   if ((VALID_QUOTA_CONFIG_PROVIDERS as readonly string[]).includes(input.provider) && getProviderQuotaConfig(input.provider).enabled === false) return json({ skipped: true, reason: "provider quota collection disabled" }, 202);
   const providerContext = authContextFromRequest(req);
@@ -218,19 +218,19 @@ function cleanPublisherLeaseBody(body: unknown): {
 
 const runnerLeaseHolderId = (sourceAgentId: string) => `runner:${sourceAgentId}`;
 
-function authorizeProviderQuotaSourceAgent(req: Request, sourceAgentId: string): Response | null {
+async function authorizeProviderQuotaSourceAgent(req: Request, sourceAgentId: string): Promise<Response | null> {
   const ctx = authContextFromRequest(req);
   if (ctx.component?.role !== "provider") return null;
-  const denied = authorizeRoute(req, { scope: "quota:write" });
+  const denied = (await authorizeRoute(req, { scope: "quota:write" }));
   if (denied) return denied;
   return ctx.callerAgentId === sourceAgentId ? null : error("forbidden", 403);
 }
 
-function authorizeProviderQuotaWrite(req: Request, input: ProviderQuotaUpdateInput): Response | null {
+export async function authorizeProviderQuotaWrite(req: Request, input: ProviderQuotaUpdateInput): Promise<Response | null> {
   const ctx = authContextFromRequest(req);
   if (ctx.component?.role !== "provider") return null;
   if (!input.sourceAgentId) return error("sourceAgentId required for provider quota writer", 403);
-  const denied = authorizeProviderQuotaSourceAgent(req, input.sourceAgentId);
+  const denied = (await authorizeProviderQuotaSourceAgent(req, input.sourceAgentId));
   if (denied) return denied;
   // The authority fence is deliberately folded into providerQuotas.upsert. A pre-read here would
   // race lease transfer while the async writer is queued.
@@ -242,7 +242,7 @@ export const postProviderQuotaPublisherLeaseAcquireRoute: Handler = async (req)
   if (!parsed.ok) return error(parsed.error, parsed.status);
   const input = cleanPublisherLeaseBody(parsed.body);
   if (typeof input === "string") return error(input);
-  const denied = authorizeProviderQuotaSourceAgent(req, input.sourceAgentId);
+  const denied = (await authorizeProviderQuotaSourceAgent(req, input.sourceAgentId));
   if (denied) return denied;
   return json(await acquireProviderQuotaLeaseAsync({
     provider: input.provider,
@@ -260,7 +260,7 @@ export const postProviderQuotaPublisherLeaseReleaseRoute: Handler = async (req)
   const input = cleanPublisherLeaseBody(parsed.body);
   if (typeof input === "string") return error(input);
   if (!input.leaseToken) return error("leaseToken required");
-  const denied = authorizeProviderQuotaSourceAgent(req, input.sourceAgentId);
+  const denied = (await authorizeProviderQuotaSourceAgent(req, input.sourceAgentId));
   if (denied) return denied;
   return json({
     released: await releaseProviderQuotaLeaseAsync({
@@ -275,7 +275,7 @@ export const postProviderQuotaPublisherLeaseReleaseRoute: Handler = async (req)
 export const postProviderQuotaLeaseAcquireRoute: Handler = async (req, params) => {
   const orch = getOrchestrator(params.id!);
   if (!orch) return error("orchestrator not found", 404);
-  const denied = authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } });
+  const denied = (await authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -294,7 +294,7 @@ export const postProviderQuotaLeaseAcquireRoute: Handler = async (req, params) =
 export const postProviderQuotaLeaseReleaseRoute: Handler = async (req, params) => {
   const orch = getOrchestrator(params.id!);
   if (!orch) return error("orchestrator not found", 404);
-  const denied = authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } });
+  const denied = (await authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);

package/src/routes/run-command.ts

@@ -10,7 +10,7 @@ import { authorizeRoute, error, json, parseBody, type Handler } from "./_shared"
 export const postRunCommand: Handler = async (req) => {
   // Require authentication even when the server permits credential-less development requests.
   if (!hasPresentedCredential(req) || !isAuthorized(req)) return error("authentication required", 401);
-  const denied = authorizeRoute(req, { scope: "command:write" });
+  const denied = (await authorizeRoute(req, { scope: "command:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);

package/src/routes/secrets-backup.ts

@@ -2,7 +2,7 @@ import { isRecord } from "@humwick/sdk";
 import { ValidationError } from "../db/connection";
 import { readBodyBytes } from "../http-body";
 import { getComponentAuth } from "../security";
-import { authContextFromRequest } from "../services/auth-context";
+import { vaultActorOf } from "../services/auth-context";
 import { exportVaultBackup, vaultBackupStatus, writeVaultBackup } from "../secrets-vault/backup";
 import { VaultError } from "../secrets-vault/keys";
 import { restoreVaultBackup } from "../secrets-vault/restore";
@@ -20,7 +20,7 @@ function backupError(cause: unknown): Response {
 /** Backup and restore move every secret at once: the operator only, never a secrets-scoped agent. */
 function operatorRoute(handle: (body: Record<string, unknown>, actor: string) => Promise<Response>): Handler {
   return async req => {
-    const denied = authorizeRoute(req, { scope: "secrets:write" });
+    const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
     if (denied) return denied;
     if (!isRootCredentialRequest(req) && getComponentAuth(req)?.role !== "dashboard") return error("operator token required for vault backup and restore", 403);
     let body: unknown = {};
@@ -30,14 +30,13 @@ function operatorRoute(handle: (body: Record<string, unknown>, actor: string) =>
       try { body = read.bytes.byteLength ? JSON.parse(new TextDecoder().decode(read.bytes)) : {}; } catch { return error("invalid JSON body", 400); }
     }
     if (!isRecord(body)) return error("body must be an object", 400);
-    const ctx = authContextFromRequest(req);
-    try { return await handle(body, ctx.actor.kind === "system" ? "operator" : ctx.actor.id); }
+    try { return await handle(body, vaultActorOf(req)); }
     catch (cause) { return backupError(cause); }
   };
 }
 
 export const getVaultBackupRoute: Handler = async req => {
-  const denied = authorizeRoute(req, { scope: "secrets:write" });
+  const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
   if (denied) return denied;
   try { return json(await vaultBackupStatus()); } catch (cause) { return backupError(cause); }
 };

package/src/routes/secrets-import.ts

@@ -1,7 +1,7 @@
 import { ValidationError } from "../db/connection";
 import { isRecord } from "@humwick/sdk";
 import { getComponentAuth } from "../security";
-import { authContextFromRequest } from "../services/auth-context";
+import { vaultActorOf } from "../services/auth-context";
 import { importVaultSecrets, previewVaultImport } from "../secrets-vault/import";
 import { VaultError } from "../secrets-vault/keys";
 import { SecretsBrokerError } from "../secrets-broker/error";
@@ -9,16 +9,15 @@ import { authorizeRoute, error, isRootCredentialRequest, json, parseBody, type H
 
 function importRoute(preview: boolean): Handler {
   return async req => {
-    const denied = authorizeRoute(req, { scope: "secrets:write" });
+    const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
     if (denied) return denied;
     // Import is the operator's batch approval; a secrets-scoped agent may not approve its own migration.
     if (!isRootCredentialRequest(req) && getComponentAuth(req)?.role !== "dashboard") return error("operator token required to import secrets", 403);
     const parsed = await parseBody<unknown>(req);
     if (!parsed.ok) return error(parsed.error, parsed.status);
     if (!isRecord(parsed.body)) return error("import must be an object", 400);
-    const ctx = authContextFromRequest(req);
     try {
-      return json(preview ? await previewVaultImport(parsed.body.source) : await importVaultSecrets(ctx.actor.kind === "system" ? "operator" : ctx.actor.id, parsed.body), preview ? 200 : 201);
+      return json(preview ? await previewVaultImport(parsed.body.source) : await importVaultSecrets(vaultActorOf(req), parsed.body), preview ? 200 : 201);
     } catch (cause) {
       if (cause instanceof ValidationError) return error(cause.message, 400);
       if (cause instanceof VaultError) return error(cause.message, cause.code === "exists" ? 409 : cause.code === "not_found" ? 404 : 503);

package/src/routes/secrets-vault.ts

@@ -2,7 +2,7 @@ import { listSecretAuditAsync } from "../db/secrets-broker-async";
 import { parseSecretName, scopedSecretName, secretEnvironment } from "../secrets-vault/scope";
 import { builtinVault, backendCall, readVaultLastResolved } from "../secrets-vault/backend";
 import { editSecretMetadata, getSecretMetadata, createOperatorSecret, deleteOperatorSecret, requireVault, rotateOperatorSecret } from "../secrets-vault/service";
-import { authContextFromRequest } from "../services/auth-context";
+import { vaultActorOf } from "../services/auth-context";
 import { ValidationError } from "../db/connection";
 import { resolveProjectAsync } from "../db/projects-async";
 import { isRecord } from "@humwick/sdk";
@@ -13,7 +13,7 @@ import { resolveHostProviderEnv } from "../secrets-vault/provider-env";
 import { isOrchestratorSelfReportAuthorized } from "../orchestrator-self-report-authz";
 
 export const getVaultMetadataRoute: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "secrets:write" });
+  const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
   if (denied) return denied;
   // health() opens a row, so a missing or wrong key answers 503 here instead of listing names that nothing can resolve.
   try {
@@ -39,8 +39,6 @@ export const getVaultMetadataRoute: Handler = async (req) => {
   } catch (cause) { return error(cause instanceof Error ? cause.message : "vault unavailable", cause instanceof ValidationError ? 400 : 503); }
 };
 
-const operatorActor = (req: Request) => { const ctx = authContextFromRequest(req); return ctx.actor.kind === "system" ? "operator" : ctx.actor.id; };
-
 function vaultWriteError(cause: unknown): Response {
   if (cause instanceof ValidationError) return error(cause.message, 400);
   if (cause instanceof VaultError) return error(cause.message, cause.code === "exists" ? 409 : cause.code === "not_found" ? 404 : 503);
@@ -49,32 +47,32 @@ function vaultWriteError(cause: unknown): Response {
 
 /** The operator creates a new secret straight from the dashboard; the value is never echoed or logged. */
 export const postVaultSecretRoute: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "secrets:write" });
+  const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   if (!isRecord(parsed.body)) return error("secret must be an object", 400);
-  try { return json(await createOperatorSecret(operatorActor(req), parsed.body), 201); }
+  try { return json(await createOperatorSecret(vaultActorOf(req), parsed.body), 201); }
   catch (cause) { return vaultWriteError(cause); }
 };
 
 /** #3558 — the operator sets a new version of an existing secret (`:name` is `NAME` or `project:<id>:NAME`). */
 export const putVaultSecretRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "secrets:write" });
+  const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   if (!isRecord(parsed.body)) return error("secret must be an object", 400);
   const environment = parsed.body.environment === undefined ? new URL(req.url).searchParams.get("environment") ?? undefined : parsed.body.environment;
-  try { return json(await rotateOperatorSecret(operatorActor(req), params.name!, { ...parsed.body, environment })); }
+  try { return json(await rotateOperatorSecret(vaultActorOf(req), params.name!, { ...parsed.body, environment })); }
   catch (cause) { return vaultWriteError(cause); }
 };
 
 /** #3554 — the operator deletes every version of one secret. */
 export const deleteVaultSecretRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "secrets:write" });
+  const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
   if (denied) return denied;
-  try { return json(await deleteOperatorSecret(operatorActor(req), params.name!, new URL(req.url).searchParams.get("environment") ?? undefined)); }
+  try { return json(await deleteOperatorSecret(vaultActorOf(req), params.name!, new URL(req.url).searchParams.get("environment") ?? undefined)); }
   catch (cause) { return vaultWriteError(cause); }
 };
 
@@ -91,7 +89,7 @@ export const getVaultAuditRoute: Handler = async (req, params) => {
 export const getOrchestratorProviderEnvRoute: Handler = async (req, params) => {
   const orch = getOrchestrator(params.id!);
   if (!orch) return error("orchestrator not found", 404);
-  const denied = authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } });
+  const denied = (await authorizeRoute(req, { scope: "command:write", resource: { orchestratorId: orch.id } }));
   if (denied) return denied;
   // Plaintext keys: only this orchestrator's own host credential (or admin), never a runner token with command:write.
   if (!isOrchestratorSelfReportAuthorized(req, orch.id)) return error("forbidden", 403);
@@ -105,17 +103,17 @@ export const getOrchestratorProviderEnvRoute: Handler = async (req, params) => {
 };
 
 export const getVaultSecretRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "secrets:write" });
+  const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
   if (denied) return denied;
   try { return json(await getSecretMetadata(params.name!, new URL(req.url).searchParams.get("environment") ?? undefined)); }
   catch (cause) { return vaultWriteError(cause); }
 };
 
 export const patchVaultMetadataRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "secrets:write" });
+  const denied = (await authorizeRoute(req, { scope: "secrets:write" }));
   if (denied) return denied;
   const parsed = await parseBody<unknown>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
-  try { return json(await editSecretMetadata(operatorActor(req), params.name!, parsed.body, new URL(req.url).searchParams.get("environment") ?? undefined)); }
+  try { return json(await editSecretMetadata(vaultActorOf(req), params.name!, parsed.body, new URL(req.url).searchParams.get("environment") ?? undefined)); }
   catch (cause) { return vaultWriteError(cause); }
 };

package/src/routes/settings.ts

@@ -70,7 +70,7 @@ export async function setRegisteredSettingValue(namespace: string, key: string,
   const validation = validateSettingValue(namespace, key, merged);
   if (!validation.valid) throw new ValidationError(validation.errors.join("; "));
   if (descriptor.tier === "user") return setUserSettingAsync(DEFAULT_USER_ID, namespace, key, merged, updatedBy);
-  return setConfigAsync(namespace, key, merged, updatedBy);
+  return (await setConfigAsync(namespace, key, merged, updatedBy));
 }
 
 async function putSetting(req: Request, namespaceRaw: string | undefined, keyRaw: string | undefined): Promise<Response> {

package/src/routes/shipping.ts

@@ -5,12 +5,13 @@ import { readGateStatsAsync, resolveProjectAsync } from "../db";
 import { getShippingBoard } from "../services/shipping-board";
 import { getShippingStats } from "../services/shipping-stats";
 import { abandonRedMainIncident } from "../services/red-main-incident";
+import { baseKnownFailures } from "../db/land-boundaries";
 import { OpError } from "@humwick/kernel/contract";
 import { cleanString } from "../validation";
 import { authorizeRoute, error, json, parseBody, resolveActorLabel, type Handler } from "./_shared";
 
 export const postRedMainAbandonRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "command:write" });
+  const denied = (await authorizeRoute(req, { scope: "command:write" }));
   if (denied) return denied;
   const parsed = await parseBody<{ reason?: unknown }>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -23,6 +24,13 @@ export const postRedMainAbandonRoute: Handler = async (req, params) => {
   }
 };
 
+// #3362 §11: what a builder's delivery gate holds out of unrelated runs. agent:read, so every agent token reads it.
+export const getKnownFailuresRoute: Handler = async (req) => {
+  const remote = new URL(req.url).searchParams.get("remote")?.trim();
+  if (!remote || !/^[\w.-]+\/[\w.-]+$/.test(remote)) return error("remote must be owner/repo", 400);
+  return json({ failures: baseKnownFailures(remote) });
+};
+
 /** A `projectId` query names a project by id or slug; absent means all projects. */
 async function projectFilter(req: Request): Promise<{ projectId?: string } | Response> {
   const ref = new URL(req.url).searchParams.get("projectId")?.trim();

package/src/routes/spawn-policy.ts

@@ -1,3 +1,4 @@
+import { upsertManagedAgentStateAsync } from "../db/lifecycle-tail-async";
 // Auto-split from routes.ts (#299). Domain: spawn-policy.
 import { ValidationError, getCrashReport, getManagedPolicyTimelineAsync, getOrchestrator } from "../db";
 import { auditEvent, authAuditMetadata, dashboardAttribution, emitCommand, error, json, parseBody, parseQueryInt, spawnRequestId, type Handler } from "./_shared";
@@ -6,7 +7,7 @@ import { SYSTEM_LAUNCH } from "../runtime-tokens";
 import { cleanString } from "../validation";
 import { hostSpawnsDrained } from "../db/spawn-host-cap";
 import { createCommandAsync } from "../commands-write";
-import { getManagedAgentState, getSpawnPolicy, listSpawnPolicies, upsertManagedAgentState } from "../config-store";
+import { getManagedAgentState, getSpawnPolicy, listSpawnPolicies } from "../config-store";
 import { deleteConfigAsync, setConfigAsync } from "../config-store-write";
 import { managedSpawnReservationCurrent, restoreDrainedSpawnReservation } from "../managed-spawn-reservation";
 import { emitConfigChanged, emitManagedAgentStateChanged } from "../sse";
@@ -72,7 +73,7 @@ async function enqueuePolicyStart(policy: SpawnPolicy, reason: string): Promise<
   if (stewardDeny) return error(`steward spawn refused: ${stewardDeny}`, 409);
   const requestId = spawnRequestId();
   const existing = getManagedAgentState(policy.name);
-  const state = upsertManagedAgentState({
+  const state = (await upsertManagedAgentStateAsync({
     policyName: policy.name,
     status: "starting",
     orchestratorId: policy.orchestratorId,
@@ -82,7 +83,7 @@ async function enqueuePolicyStart(policy: SpawnPolicy, reason: string): Promise<
     // An operator start deliberately retries a failed policy after correcting its launch.
     restartCount: existing?.restartCount ?? 0,
     consecutiveFailures: 0,
-  });
+  }));
   emitManagedAgentStateChanged(policy.name, state as unknown as Record<string, unknown>);
   const policySnapshot = JSON.stringify(policy);
   const spawnParams = await buildManagedSpawnParamsAsync(policy, requestId, { createdBy: "managed-agent", authority: SYSTEM_LAUNCH });
@@ -93,7 +94,7 @@ async function enqueuePolicyStart(policy: SpawnPolicy, reason: string): Promise<
     return error("managed policy start was superseded", 409);
   }
   if (hostSpawnsDrained(orch.agentId)) {
-    restoreDrainedSpawnReservation(policy, requestId, existing);
+    (await restoreDrainedSpawnReservation(policy, requestId, existing));
     return error(`host ${orch.hostname} is draining: new spawns disabled`, 409);
   }
   const command = await createCommandAsync({
@@ -131,7 +132,7 @@ async function enqueuePolicyStop(policy: SpawnPolicy, action: "shutdown" | "rest
     })
     : undefined;
   if (action === "restart" && hostSpawnsDrained(orch.agentId)) return error(`host ${orch.hostname} is draining: new spawns disabled`, 409);
-  const nextState = upsertManagedAgentState({
+  const nextState = (await upsertManagedAgentStateAsync({
     policyName: policy.name,
     status: "stopping",
     agentId: state?.agentId,
@@ -143,7 +144,7 @@ async function enqueuePolicyStop(policy: SpawnPolicy, action: "shutdown" | "rest
     lastStopAt: Date.now(),
     restartCount: state?.restartCount ?? 0,
     consecutiveFailures: state?.consecutiveFailures ?? 0,
-  });
+  }));
   emitManagedAgentStateChanged(policy.name, nextState as unknown as Record<string, unknown>);
   const command = await createCommandAsync({
     type: action === "restart" ? "agent.restart" : "agent.shutdown",
@@ -209,7 +210,7 @@ export const putSpawnPolicyRoute: Handler = async (req, params) => {
     const updatedBy = isRecord(parsed.body) ? cleanString(parsed.body.updatedBy, "updatedBy", { max: 200 }) : undefined;
     const entry = await setConfigAsync("spawn-policy", params.name!, value, updatedBy);
     emitConfigChanged(entry.namespace, entry.key, entry.version);
-    getLifecycleManager().onConfigChanged("spawn-policy", entry.key);
+    (await getLifecycleManager().onConfigChanged("spawn-policy", entry.key));
     return json(entry, entry.version === 1 ? 201 : 200);
   } catch (e) {
     if (e instanceof ValidationError) return error(e.message, 400);

package/src/routes/sse.ts

@@ -5,13 +5,13 @@ import { isOtherHumanSink } from "../message-visibility";
 import { canViewAgentRoute, error, type Handler } from "./_shared";
 import { messageViewerForRequest } from "./message-viewer";
 
-export const getEvents: Handler = (req) => {
+export const getEvents: Handler = async (req) => {
   const url = new URL(req.url);
   const agentId = url.searchParams.get("for") || null;
   const lastEventId = Number(req.headers.get("last-event-id") ?? "");
   // #3567 D6 — a signed-in human streams their own messages and notifications only.
   const viewer = messageViewerForRequest(req) ?? undefined;
-  if (agentId && isOtherHumanSink(viewer, agentId)) return authorityDenied(req, "you can only read your own messages", 403, agentId, "read sink stream");
+  if (agentId && isOtherHumanSink(viewer, agentId)) return (await authorityDenied(req, "you can only read your own messages", 403, agentId, "read sink stream"));
   if (agentId && !canViewAgentRoute(req, agentId)) return error("agent not found", 404);
   return createSSEStream(agentId, Number.isSafeInteger(lastEventId) && lastEventId > 0 ? lastEventId : 0,
     url.searchParams.get("agentStatus") === "delta", viewer);

package/src/routes/team-templates.ts

@@ -16,14 +16,14 @@ function slugParam(params: Record<string, string | undefined>): string {
   return cleanString(params.slug, "slug", { required: true, max: 120 })!;
 }
 
-export const getTeamTemplatesRoute: Handler = (req) => {
-  const denied = authorizeRoute(req, { scope: "system:admin" });
+export const getTeamTemplatesRoute: Handler = async (req) => {
+  const denied = (await authorizeRoute(req, { scope: "system:admin" }));
   if (denied) return denied;
   return json({ templates: listTeamTemplates() });
 };
 
-export const getTeamTemplateRoute: Handler = (req, params) => {
-  const denied = authorizeRoute(req, { scope: "system:admin" });
+export const getTeamTemplateRoute: Handler = async (req, params) => {
+  const denied = (await authorizeRoute(req, { scope: "system:admin" }));
   if (denied) return denied;
   try {
     const template = getTeamTemplate(slugParam(params));
@@ -34,7 +34,7 @@ export const getTeamTemplateRoute: Handler = (req, params) => {
 };
 
 export const postTeamTemplateRoute: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "system:admin" });
+  const denied = (await authorizeRoute(req, { scope: "system:admin" }));
   if (denied) return denied;
   const parsed = await parseBody<Record<string, unknown>>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -46,7 +46,7 @@ export const postTeamTemplateRoute: Handler = async (req) => {
 };
 
 export const putTeamTemplateRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "system:admin" });
+  const denied = (await authorizeRoute(req, { scope: "system:admin" }));
   if (denied) return denied;
   const parsed = await parseBody<Record<string, unknown>>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -58,7 +58,7 @@ export const putTeamTemplateRoute: Handler = async (req, params) => {
 };
 
 export const deleteTeamTemplateRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "system:admin" });
+  const denied = (await authorizeRoute(req, { scope: "system:admin" }));
   if (denied) return denied;
   const slug = slugParam(params);
   return json({ slug, deleted: await deleteTeamTemplateAsync(slug, updatedBy(req)) });

package/src/routes/teams.ts

@@ -43,9 +43,9 @@ export const getMyTeamRoute: Handler = (req) => {
 };
 
 // #3725 — a signed-in member lists the teams their agent scope can see; machine callers stay admin-only.
-export const getTeamsRoute: Handler = (req) => {
+export const getTeamsRoute: Handler = async (req) => {
   const viewer = viewerScopeForRequest(req);
-  const denied = authorizeRoute(req, { scope: viewer ? "teams:read" : "system:admin" });
+  const denied = (await authorizeRoute(req, { scope: viewer ? "teams:read" : "system:admin" }));
   if (denied) return denied;
   try {
     const status = optionalEnum(new URL(req.url).searchParams.get("status") ?? undefined, "status", TEAM_STATUSES) as Team["status"] | undefined;
@@ -67,7 +67,7 @@ export const getTeamsRoute: Handler = (req) => {
 };
 
 export const getTeamOutcomesRoute: Handler = async (req) => {
-  const denied = authorizeRoute(req, { scope: "system:admin" });
+  const denied = (await authorizeRoute(req, { scope: "system:admin" }));
   if (denied) return denied;
   try {
     const recentLimit = parseQueryInt(new URL(req.url).searchParams.get("recentLimit"), { min: 1, max: 50, clamp: true }) ?? undefined;
@@ -83,11 +83,11 @@ export const putMyTeamBriefRoute: Handler = async (req) => {
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
     const body = parsed.body ?? {};
-    return json(setCallerTeamBrief(authContextFromRequest(req), {
+    return json((await setCallerTeamBrief(authContextFromRequest(req), {
       title: cleanString(body.title, "title", { max: 240 }),
       brief: cleanString(body.brief, "brief", { max: 16_000 }),
       definitionOfDone: cleanString(body.definitionOfDone, "definitionOfDone", { max: 4000 }),
-    }));
+    })));
   } catch (err) {
     return routeError(err);
   }
@@ -98,28 +98,28 @@ export const postMyTeamDissolveRoute: Handler = async (req) => {
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
     const body = parsed.body ?? {};
-    return json(dissolveCallerTeam(authContextFromRequest(req), cleanDissolveInput(body)));
+    return json(await dissolveCallerTeam(authContextFromRequest(req), cleanDissolveInput(body)));
   } catch (err) {
     return routeError(err);
   }
 };
 
 export const postTeamDissolveByIdRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "system:admin" });
+  const denied = (await authorizeRoute(req, { scope: "system:admin" }));
   if (denied) return denied;
   const parsed = await parseBody<Record<string, unknown>>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
   try {
     const id = params.id!;
     if (!getTeam(id)) return error("team not found", 404);
-    return json(dissolveTeamById(id, cleanDissolveInput(parsed.body ?? {})));
+    return json(await dissolveTeamById(id, cleanDissolveInput(parsed.body ?? {})));
   } catch (err) {
     return routeError(err);
   }
 };
 
 export const patchTeamSpawnDelegationRoute: Handler = async (req, params) => {
-  const denied = authorizeRoute(req, { scope: "teams:write" });
+  const denied = (await authorizeRoute(req, { scope: "teams:write" }));
   if (denied) return denied;
   const parsed = await parseBody<Record<string, unknown>>(req);
   if (!parsed.ok) return error(parsed.error, parsed.status);
@@ -132,7 +132,7 @@ export const patchTeamSpawnDelegationRoute: Handler = async (req, params) => {
 export const getTeamSpawnDelegationRoute: Handler = async (req, params) => {
   // #3725 — the grant names projects and launches across the tree; a member's session may not read it.
   const viewer = viewerScopeForRequest(req);
-  const denied = authorizeRoute(req, { scope: viewer && !viewer.seesAll ? "system:admin" : "teams:read" });
+  const denied = (await authorizeRoute(req, { scope: viewer && !viewer.seesAll ? "system:admin" : "teams:read" }));
   if (denied) return denied;
   try {
     const state = await getTeamSpawnDelegation(authContextFromRequest(req), params.id!);