@sema-agent/server 7.150.0 → 7.152.0

package/dist/http/routes/fleet.js

@@ -3,7 +3,7 @@ import { FLEET_SNAPSHOT_TERMINAL_MAX_ROWS, isTerminalWorkflowRowStatus, recentTe
 import { taskNotificationFoldKey } from "../../orchestration/workflow-completion-inbox.js";
 import { sendJson, sendError, sseHeaders } from "../send.js";
 import { gatedSubject, sendPrincipalRefusal } from "../principal-gate.js";
-import { routeListFilter } from "../owner-access.js";
+import { routeListFilter, workflowScopeOf } from "../owner-access.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 export async function handleFleet(req, res, match, ctx) {
@@ -24,22 +24,24 @@ export async function handleFleet(req, res, match, ctx) {
             const fleetParams = new URLSearchParams(match.search);
             const callerSession = fleetParams.get("session");
             const observeOnly = fleetParams.get("observe") === "1";
-            await streamFleet(req, res, fleet.fleetBus, fleetWide ? null : (principal ?? "default"), callerSession || null, observeOnly ? undefined : deps.workflowCompletionInbox, { store: deps.workflowRunStore, scope: fleetWide ? null : (principal ?? "default"), pullScope: principal ?? "default", ready: deps.fleetRecoveryDone });
+            const workflowScope = workflowScopeOf(principal);
+            const viewer = fleetWide ? null : { rows: principal ?? "default", workflows: workflowScope };
+            await streamFleet(req, res, fleet.fleetBus, viewer, callerSession || null, observeOnly ? undefined : deps.workflowCompletionInbox, { store: deps.workflowRunStore, scope: viewer?.workflows ?? null, pullScope: workflowScope, ready: deps.fleetRecoveryDone });
             return;
         }
         default:
             return assertNever(match.decl.id);
     }
 }
-function streamFleet(req, res, bus, callerScope, callerSession = null, completionInbox, terminal) {
+function streamFleet(req, res, bus, viewer, callerSession = null, completionInbox, terminal) {
     return new Promise((resolve) => {
         sseHeaders(res);
-        res.write(`event: meta\ndata: ${JSON.stringify({ type: "meta", version: 1, scoped: callerScope !== null, sessionScoped: callerSession !== null, ...(callerSession !== null ? { session: callerSession } : {}), bgNotifyFailClosed: true })}\n\n`);
+        res.write(`event: meta\ndata: ${JSON.stringify({ type: "meta", version: 1, scoped: viewer !== null, sessionScoped: callerSession !== null, ...(callerSession !== null ? { session: callerSession } : {}), bgNotifyFailClosed: true })}\n\n`);
         const seenTasks = new Set();
         const seenWf = new Set();
         const sessionOk = (rowSession) => callerSession === null || rowSession === undefined || rowSession === callerSession;
-        const visT = (r) => (callerScope === null || r.scope === callerScope) && sessionOk(r.sessionId);
-        const visW = (r) => (callerScope === null || r.scope === callerScope) && sessionOk(r.sessionId);
+        const visT = (r) => (viewer === null || r.scope === viewer.rows) && sessionOk(r.sessionId);
+        const visW = (r) => (viewer === null || r.scope === viewer.workflows) && sessionOk(r.sessionId);
         const SCOPED_TASK_KEY_DISPOSITION = {
             id: "keep", parentId: "keep", parentToolCallId: "keep", workflowRunId: "keep", status: "keep",
             startedAt: "keep", elapsedMs: "keep", tokens: "keep",
@@ -144,7 +146,7 @@ function streamFleet(req, res, bus, callerScope, callerSession = null, completio
                     break;
                 case "hook_notice": {
                     const hn = frame.notice;
-                    const hScopeOk = callerScope === null || hn.ownerScope === callerScope;
+                    const hScopeOk = viewer === null || hn.ownerScope === viewer.rows;
                     const hSessionOk = callerSession === null || hn.ownerSessionId === callerSession;
                     if (hScopeOk && hSessionOk) {
                         send("hook_notice", { type: "hook_notice", ...hookNoticeWire(hn), ts: frame.ts });
@@ -153,7 +155,7 @@ function streamFleet(req, res, bus, callerScope, callerSession = null, completio
                 }
                 case "bg_notification": {
                     const n = frame.notification;
-                    const scopeOk = callerScope === null || n.ownerScope === callerScope;
+                    const scopeOk = viewer === null || n.ownerScope === viewer.rows;
                     const sessionInjectOk = callerSession === null || n.ownerSessionId === callerSession;
                     if (scopeOk && sessionInjectOk) {
                         const { ownerScope: _os, ownerSessionId: _osid, ...wire } = n;

package/dist/http/routes/images.js

@@ -49,13 +49,13 @@ export async function handleImages(req, res, match, ctx) {
         const bakes = deps.imageBakes;
         const idx = deps.imageIndex;
         const principal = gatedPerson(req, deps.config);
-        const isExplicitOperator = explicitOperatorOk(principal, deps.config);
-        const operatorLane = facts.operatorLane(deps);
+        const isExplicitOperator = explicitOperatorOk(principal, deps.config, "operate");
+        const operatorLane = facts.operatorLane(deps, "operate");
         const cfg = deps.config.imageBakes;
         const isRunner = source !== undefined && source !== null && source === cfg.runnerPrincipal;
         if (match.decl.id === "image-bake-submit") {
             if (!operatorLane.available) {
-                sendOperatorPrincipalsRequired(res);
+                sendOperatorPrincipalsRequired(res, "operate");
                 return;
             }
             if (!isExplicitOperator) {
@@ -130,7 +130,7 @@ export async function handleImages(req, res, match, ctx) {
         }
         if (match.decl.id === "image-bake-events") {
             if (!operatorLane.available) {
-                sendOperatorPrincipalsRequired(res);
+                sendOperatorPrincipalsRequired(res, "operate");
                 return;
             }
             if (!isExplicitOperator) {
@@ -152,7 +152,7 @@ export async function handleImages(req, res, match, ctx) {
         }
         if (match.decl.id === "image-bake-cancel") {
             if (!operatorLane.available) {
-                sendOperatorPrincipalsRequired(res);
+                sendOperatorPrincipalsRequired(res, "operate");
                 return;
             }
             if (!isExplicitOperator) {
@@ -264,7 +264,7 @@ export async function handleImages(req, res, match, ctx) {
         }
         if (match.decl.id === "image-bake-detail") {
             if (!operatorLane.available) {
-                sendOperatorPrincipalsRequired(res);
+                sendOperatorPrincipalsRequired(res, "operate");
                 return;
             }
             if (!isExplicitOperator) {
@@ -290,7 +290,7 @@ export async function handleImages(req, res, match, ctx) {
     if (pool.available && isIndexRouteId(match.decl.id)) {
         const idx = pool.imageIndex;
         const principal = gatedPerson(req, deps.config);
-        const operator = explicitOperatorOk(principal, deps.config);
+        const operator = explicitOperatorOk(principal, deps.config, "operate");
         const viewer = { operator, tenantId: principal ?? null };
         const q = new URLSearchParams(match.search);
         if (match.decl.id === "images-index") {
@@ -340,11 +340,11 @@ export async function handleImages(req, res, match, ctx) {
             return;
         }
         if (match.decl.id === "image-register") {
-            if (!facts.operatorLane(deps).available) {
-                sendOperatorPrincipalsRequired(res);
+            if (!facts.operatorLane(deps, "operate").available) {
+                sendOperatorPrincipalsRequired(res, "operate");
                 return;
             }
-            if (!explicitOperatorOk(principal, deps.config)) {
+            if (!explicitOperatorOk(principal, deps.config, "operate")) {
                 sendError(res, 403, "auth.operator_only", "operator only");
                 return;
             }

package/dist/http/routes/memory-bundle.js

@@ -73,10 +73,10 @@ export async function handleMemoryBundle(req, res, match, ctx) {
     }
     const fact = facts.memoryBundle(deps);
     if (!fact.available && fact.why === "operator_principals_empty") {
-        sendOperatorPrincipalsRequired(res);
+        sendOperatorPrincipalsRequired(res, "operate");
         return;
     }
-    if (!explicitOperatorOk(principal, deps.config)) {
+    if (!explicitOperatorOk(principal, deps.config, "operate")) {
         sendError(res, 403, "auth.operator_only", "memory governance bundles are an operator-only deployment action");
         return;
     }
@@ -86,7 +86,7 @@ export async function handleMemoryBundle(req, res, match, ctx) {
                 sendError(res, 501, "capability.memory_engine_required", "memory governance bundles are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend implements the v2-c bundle composite (exportSnapshotOf / importBundleCommit); the file memory backend does, the pg/mysql memory backends do not");
                 return;
             case "operator_principals_empty":
-                sendOperatorPrincipalsRequired(res);
+                sendOperatorPrincipalsRequired(res, "operate");
                 return;
             default:
                 return assertNever(fact.why);

package/dist/http/routes/memory-compliance.js

@@ -29,10 +29,10 @@ export async function handleMemoryCompliance(req, res, match, ctx) {
     }
     const fact = facts.memoryCompliance(deps);
     if (!fact.available && fact.why === "operator_principals_empty") {
-        sendOperatorPrincipalsRequired(res);
+        sendOperatorPrincipalsRequired(res, "operate");
         return;
     }
-    if (!explicitOperatorOk(principal, deps.config)) {
+    if (!explicitOperatorOk(principal, deps.config, "operate")) {
         sendError(res, 403, "auth.operator_only", "memory provenance and erasure are operator-only deployment actions");
         return;
     }
@@ -42,7 +42,7 @@ export async function handleMemoryCompliance(req, res, match, ctx) {
                 sendError(res, 501, "capability.memory_engine_required", "memory provenance and erasure are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the file memory backend does, the pg/mysql memory backends do not (their control plane would land on a replica's local disk)");
                 return;
             case "operator_principals_empty":
-                sendOperatorPrincipalsRequired(res);
+                sendOperatorPrincipalsRequired(res, "operate");
                 return;
             default:
                 return assertNever(fact.why);

package/dist/http/routes/memory-consolidation.js

@@ -85,14 +85,14 @@ export async function handleMemoryConsolidation(req, res, match, ctx) {
                 sendError(res, 501, "feature.memory_consolidation_disabled", "memory consolidation is switched off on this deployment (MEMORY_CONSOLIDATION_DRIVER is off, or its default derived off because no cheap model is configured); turn it on to use these endpoints");
                 return;
             case "operator_principals_empty":
-                sendOperatorPrincipalsRequired(res);
+                sendOperatorPrincipalsRequired(res, "operate");
                 return;
             default:
                 return assertNever(fact.why);
         }
     }
     const faces = fact.valve;
-    if (!explicitOperatorOk(principal, deps.config)) {
+    if (!explicitOperatorOk(principal, deps.config, "operate")) {
         sendError(res, 403, "auth.operator_only", "memory consolidation is operator-only: the caller principal is not in OPERATOR_PRINCIPALS");
         return;
     }

package/dist/http/routes/memory-origin.js

@@ -118,10 +118,10 @@ export async function handleMemoryOrigin(req, res, match, ctx) {
     }
     const fact = facts.memoryOrigin(deps);
     if (!fact.available && fact.why === "operator_principals_empty") {
-        sendOperatorPrincipalsRequired(res);
+        sendOperatorPrincipalsRequired(res, "operate");
         return;
     }
-    if (!explicitOperatorOk(principal, deps.config)) {
+    if (!explicitOperatorOk(principal, deps.config, "operate")) {
         sendError(res, 403, "auth.operator_only", "memory origin marking and clearance are operator-only deployment actions");
         return;
     }
@@ -131,7 +131,7 @@ export async function handleMemoryOrigin(req, res, match, ctx) {
                 sendError(res, 501, "capability.memory_engine_required", "memory origin marking and clearance are not available on this deployment — they require a wired memory engine (MEMORY_ENGINE=on) whose backend owns the engine control plane (controlPlaneRoot); the clearance ledger and its write-ahead custody rows live in that plane, and on a backend without it they would land on one replica's local disk");
                 return;
             case "operator_principals_empty":
-                sendOperatorPrincipalsRequired(res);
+                sendOperatorPrincipalsRequired(res, "operate");
                 return;
             default:
                 return assertNever(fact.why);

package/dist/http/routes/memory-policy.js

@@ -9,7 +9,7 @@ import { gatedPerson, explicitOperatorOk, sendPrincipalRefusal, sendUnauthorized
 import { assertNever } from "../route-ctx.js";
 import { sentMemoryFaceFault } from "../memory-face-fault-reply.js";
 function layerFaceAudience(deps, principal, face, scope) {
-    if (explicitOperatorOk(principal, deps.config))
+    if (explicitOperatorOk(principal, deps.config, "operate"))
         return { kind: "operator" };
     return { kind: "layer_owner", face, withheld: (coreMessage) => deps.logger?.warn?.(face === "export" ? "memory_export_refused" : "memory_sync_refused", { scope, err: coreMessage }) };
 }
@@ -44,7 +44,7 @@ function directoryDecidesThisFace(mode) {
 async function gateMemoryScope(deps, person, scope, need) {
     if (scope === formatUserScope(person) || parseProjectLayerKey(scope)?.owner === person)
         return { kind: "allow" };
-    if (explicitOperatorOk(person, deps.config))
+    if (explicitOperatorOk(person, deps.config, "operate"))
         return { kind: "allow" };
     const directory = deps.orgMemoryDirectory;
     if (!scope.startsWith(ORG_PREFIX) || directory === undefined || !directoryDecidesThisFace(deps.config.memoryOrgAdmissionMode)) {

package/dist/http/routes/observability.js

@@ -9,10 +9,10 @@ export async function handleObservability(req, res, match, ctx) {
         case "outcomes": {
             const fact = facts.outcomeLedger(deps);
             if (!fact.available && fact.why === "operator_principals_empty") {
-                sendOperatorPrincipalsRequired(res);
+                sendOperatorPrincipalsRequired(res, "operate");
                 return;
             }
-            if (!explicitOperatorOk(gatedPerson(req, deps.config), deps.config)) {
+            if (!explicitOperatorOk(gatedPerson(req, deps.config), deps.config, "operate")) {
                 sendError(res, 403, "auth.operator_only", "the outcomes view is operator-only");
                 return;
             }
@@ -22,7 +22,7 @@ export async function handleObservability(req, res, match, ctx) {
                         sendError(res, 501, "capability.outcome_ledger_required", "no queryable outcome ledger on this worker (File sink — read the JSONL dataset directly)");
                         return;
                     case "operator_principals_empty":
-                        sendOperatorPrincipalsRequired(res);
+                        sendOperatorPrincipalsRequired(res, "operate");
                         return;
                     default:
                         return assertNever(fact.why);

package/dist/http/routes/projects.d.ts

@@ -9,8 +9,9 @@
  *  · **登记簿只由配置中心下发**:settings-schema 的本地读取集不收 `projects` 域 ⇒ 没有中心腿在应用配置的部署上没有登记簿 —— 两口 501
  *    `capability.unavailable`,能力位 `capabilities.projects`(布尔)读同一只事实(`capability-facts.ts` 的 `projectRegistry`)答 `false`;
  *    有登记簿时答 `true`。本面不开写动词(写到哪里由另一张设计定;写面到货时另立一位,本位不改义)。
- *  · **可见性 fail-closed**:身份判在登记簿在场判**之前**(否则「这台有没有登记簿」先于 401 泄出去);fleet 调用方(列表面 `list.read` 读档(`listFilterOf`))看全部;
- *    带验过主体的调用方只看 `registeredBy` 恰是自己的登记;看不见的与不存在的同码同句(404 `not_found.project`,不给存在性预言机)。
+ *  · **可见性 fail-closed**:身份判在登记簿在场判**之前**(否则「这台有没有登记簿」先于 401 泄出去);判与按 id 取只有一只(`project-registry.ts`:
+ *    fleet 调用方(列表面 `list.read` 读档(`listFilterOf`))看全部,带验过主体的调用方只看 `registeredBy` 恰是自己的登记 —— 项目上下文继承与登记簿默认读层种子同读它);
+ *    看不见的与不存在的同码同句(404 `not_found.project`,不给存在性预言机)。
  *
  * 归档:`archivedAt` 在场 = 已归档。列表缺省不列,`?archived=true` 只列已归档的,`?archived=false` 与缺省同;单项读不论归档与否都答(会话行引用它)。
  */

package/dist/http/routes/projects.js

@@ -4,7 +4,7 @@ import { sendUnauthorized } from "../principal-gate.js";
 import { routeListFilter } from "../owner-access.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
-import { projectVisible } from "../../project-context.js";
+import { projectVisibleTo, visibleProjectOf } from "../../project-registry.js";
 import { projectByTable } from "../../trace/projection-table.js";
 export const PROJECT_NOT_FOUND_MESSAGE = "no such project";
 export const PROJECT_ROW_DISPOSITIONS = {
@@ -49,7 +49,6 @@ export async function handleProjects(req, res, match, ctx) {
         sendError(res, 501, "capability.unavailable", "the project registry is not available on this deployment: projects are published only by the configuration center, and no center configuration is applied here");
         return;
     }
-    const visible = (registration) => projectVisible(registration, viewer);
     switch (match.decl.id) {
         case "projects-list": {
             const archived = readArchivedQuery(new URLSearchParams(match.search).get("archived"));
@@ -58,7 +57,7 @@ export async function handleProjects(req, res, match, ctx) {
                 return;
             }
             const projects = Object.entries(registry.registry)
-                .filter(([, registration]) => visible(registration) && (registration.archivedAt !== undefined) === archived)
+                .filter(([, registration]) => projectVisibleTo(viewer, registration) && (registration.archivedAt !== undefined) === archived)
                 .map(([id, registration]) => projectRowOf(id, registration));
             sendJson(res, 200, { projects });
             return;
@@ -70,8 +69,8 @@ export async function handleProjects(req, res, match, ctx) {
                 return;
             }
             const id = raw.toLowerCase();
-            const registration = Object.hasOwn(registry.registry, id) ? registry.registry[id] : undefined;
-            if (registration === undefined || !visible(registration)) {
+            const registration = visibleProjectOf(registry.registry, id, viewer);
+            if (registration === undefined) {
                 sendError(res, 404, "not_found.project", PROJECT_NOT_FOUND_MESSAGE);
                 return;
             }

package/dist/http/routes/retention-ops.js

@@ -33,11 +33,11 @@ export async function handleRetention(req, res, match, ctx) {
         sendPrincipalRefusal(res, req, deps.config);
         return;
     }
-    if (!facts.operatorLane(deps).available) {
-        sendOperatorPrincipalsRequired(res);
+    if (!facts.operatorLane(deps, "operate").available) {
+        sendOperatorPrincipalsRequired(res, "operate");
         return;
     }
-    if (!explicitOperatorOk(principal, deps.config)) {
+    if (!explicitOperatorOk(principal, deps.config, "operate")) {
         sendError(res, 403, "auth.operator_only", OPERATOR_ONLY_MESSAGE);
         return;
     }

package/dist/http/routes/rules.js

@@ -242,9 +242,9 @@ function sendImportReceipt(res, outcome) {
 function resolveTargetPrincipal(requested, caller, config) {
     if (requested === undefined || requested === caller)
         return { ok: true, principal: caller };
-    if (!facts.operatorLane({ config }).available)
+    if (!facts.operatorLane({ config }, "operate").available)
         return { ok: false, why: "operator_principals_empty" };
-    if (!explicitOperatorOk(caller, config))
+    if (!explicitOperatorOk(caller, config, "operate"))
         return { ok: false, why: "not_operator" };
     if (principalShapeProblem(requested) !== undefined)
         return { ok: false, why: "not_a_principal" };
@@ -259,7 +259,7 @@ async function handleRuleList(res, search, caller, lane, config) {
     if (!target.ok) {
         switch (target.why) {
             case "operator_principals_empty":
-                sendOperatorPrincipalsRequired(res);
+                sendOperatorPrincipalsRequired(res, "operate");
                 return;
             case "not_operator":
                 sendError(res, 403, "auth.operator_only", "reading another principal's rules is an operator-only action");
@@ -382,7 +382,7 @@ async function handleRuleWrite(res, rawBody, caller, lane, config) {
     if (!target.ok) {
         switch (target.why) {
             case "operator_principals_empty":
-                sendOperatorPrincipalsRequired(res);
+                sendOperatorPrincipalsRequired(res, "operate");
                 return;
             case "not_operator":
                 sendError(res, 403, "auth.operator_only", "writing another principal's rules is an operator-only action");
@@ -434,7 +434,7 @@ async function handleRuleRevoke(res, rawBody, caller, lane, config) {
     if (!target.ok) {
         switch (target.why) {
             case "operator_principals_empty":
-                sendOperatorPrincipalsRequired(res);
+                sendOperatorPrincipalsRequired(res, "operate");
                 return;
             case "not_operator":
                 sendError(res, 403, "auth.operator_only", "revoking another principal's rules is an operator-only action");

package/dist/http/routes/run-permission-mode.d.ts

@@ -15,7 +15,8 @@
  * 拒 ⇒ 422 `request.host_posture_refused`(与提交口同码同句)。
  *
  * ── 回写:准入的词写回存储体(run 模式词的唯一来源)────────────────────────────────────────────────────────
- * 续跑腿(停驻后续跑 / 重启后续跑)按存储体顶层 `permissionMode` 重建 spec;不写回 = 下一腿回到切档前的词。写回走**认领栅栏**
+ * 续跑腿(停驻后续跑 / 重启后续跑)按存储体顶层 `permissionMode` 重建 spec;不写回 = 下一腿回到切档前的词。词与写据经改写口一笔换(写据 `switch`:
+ * 切档写下的词不是任何地板的出口,运维事后改严时续跑口照钳 —— `permission-mode-admission.ts` 顶注「写据」)。写回走**认领栅栏**
  * (checkpoint 店的 `rewriteCtxWhileClaimed`:只在**接下切档的那条腿**此刻仍持有这条 run 时写,只改既有行)—— 这条 run 终局放掉认领、同会话新 run
  * 已写下它自己的存储体之后,或这条 run 停驻、续跑的新腿(同一个 taskId 回到 running、认领仍在)已写下它续跑用的体之后,迟到的回写零写,
  * 不会拿旧腿的体盖掉新腿的。腿身份 = {@link switchLegHolds}(栅栏里问)。同一条腿上的切档在本进程按活流对象串行(引擎受理序 = 落盘序;活流只在本副本)。

package/dist/http/routes/run-permission-mode.js

@@ -5,7 +5,7 @@ import { admitRunById, enter } from "../owner-access.js";
 import { assertNever } from "../route-ctx.js";
 import * as facts from "../../capability-facts.js";
 import { PERMISSION_MODE_WORDS, coercePermissionModeStrict, parseTaskSettings } from "../../task-settings.js";
-import { admitPermissionModeWord } from "../../permission-mode-admission.js";
+import { admitPermissionModeWord, withStoredPermissionMode } from "../../permission-mode-admission.js";
 import { readResumeCtx, resumeCtxCorruptAnswer, resumeCtxUnreadableAnswer, resumeCtxUnsealableAnswer } from "../resume-ctx-read.js";
 import { sealCheckpointCtx } from "../checkpoint-ctx.js";
 import { serviceVersion } from "../../service-version.js";
@@ -114,7 +114,7 @@ export async function handlePermissionMode(req, res, match, ctx) {
                 }
                 let persistMiss;
                 try {
-                    const next = sealCheckpointCtx({ ...stored, body: { ...stored.body, permissionMode: admitted }, writerVersion: serviceVersion() }, deps.checkpointCtxSealing, sessionId);
+                    const next = sealCheckpointCtx({ ...withStoredPermissionMode(stored, admitted, "switch"), writerVersion: serviceVersion() }, deps.checkpointCtxSealing, sessionId);
                     const rewrite = await checkpointStore.rewriteCtxWhileClaimed(sessionId, next, { fence: runStore, taskId, legHolds: (fenced) => switchLegHolds(fenced, deps.instanceId, ctx.registry.steerableRuns.get(taskId), live) });
                     persistMiss = rewrite === "written" ? undefined : rewrite;
                 }

package/dist/http/routes/runs.d.ts

@@ -129,20 +129,15 @@ export declare const RUN_VERBS_ROUTES: readonly [{
     readonly label: "/v1/questions/:id/respond";
     readonly methods: readonly ["POST"];
 }, {
-    readonly id: "tool-approval-respond";
+    readonly id: "task-ask-decision";
     readonly pattern: RegExp;
-    readonly label: "/v1/tool-approvals/:id/respond";
+    readonly label: "/v1/tasks/:id/asks/:askId/decision";
     readonly methods: readonly ["POST"];
 }, {
-    readonly id: "tool-approval-read";
+    readonly id: "task-ask-read";
     readonly pattern: RegExp;
-    readonly label: "/v1/tool-approvals/:id";
+    readonly label: "/v1/tasks/:id/asks/:askId";
     readonly methods: readonly ["GET"];
-}, {
-    readonly id: "task-ask-decision";
-    readonly pattern: RegExp;
-    readonly label: "/v1/tasks/:id/asks/:askId/decision";
-    readonly methods: readonly ["POST"];
 }];
 export type RunVerbsRouteId = RouteIdsOf<typeof RUN_VERBS_ROUTES>;
 //# sourceMappingURL=runs.d.ts.map