@vellumai/assistant 0.8.6 → 0.8.7-dev.202606052118.34cd356

package/src/runtime/routes/acp-routes.ts

@@ -4,18 +4,21 @@
  * Exposes spawn, steer, cancel, close, sessions, and permission operations
  * over HTTP and IPC.
  */
-import { desc, eq, inArray } from "drizzle-orm";
+import { and, desc, eq, inArray, notInArray } from "drizzle-orm";
 import { z } from "zod";
 
+import { resolveAgentWithAutoInstall } from "../../acp/auto-install.js";
 import { getAcpSessionManager } from "../../acp/index.js";
 import { prepareAgentEnv } from "../../acp/prepare-agent-env.js";
-import { resolveAcpAgent } from "../../acp/resolve-agent.js";
+import { formatResolveFailure } from "../../acp/resolve-agent.js";
+import { AcpResumeError } from "../../acp/session-manager.js";
 import type { AcpSessionState } from "../../acp/types.js";
 import { getDb } from "../../memory/db-connection.js";
 import { rawChanges } from "../../memory/raw-query.js";
 import { acpSessionHistory } from "../../memory/schema.js";
 import { broadcastMessage } from "../../runtime/assistant-event-hub.js";
 import { getLogger } from "../../util/logger.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import {
   BadRequestError,
   ConflictError,
@@ -60,26 +63,19 @@ async function spawnSession({ body }: RouteHandlerArgs) {
     throw new BadRequestError("agent, task, and conversationId are required");
   }
 
-  const resolved = resolveAcpAgent(agent);
+  // Resolve the agent, silently auto-installing a missing allowlisted
+  // adapter binary (see acp/auto-install.ts). Shared with the skill-tool
+  // path in tools/acp/spawn.ts; only the transport mapping differs.
+  const { resolved, failureMessage } = await resolveAgentWithAutoInstall(agent);
+  if (failureMessage) {
+    throw new FailedDependencyError(failureMessage);
+  }
   if (!resolved.ok) {
-    switch (resolved.reason) {
-      case "acp_disabled":
-        throw new BadRequestError(resolved.hint);
-      case "unknown_agent":
-        throw new BadRequestError(
-          `Unknown agent "${agent}". Available: ${resolved.available.join(", ")}.`,
-        );
-      case "binary_not_found":
-        throw new FailedDependencyError(
-          `${resolved.command} is not on PATH. ${resolved.hint}`,
-        );
-      default: {
-        const _exhaustive: never = resolved;
-        throw new Error(
-          `Unexpected acp resolver reason: ${(_exhaustive as { reason: string }).reason}`,
-        );
-      }
+    const message = formatResolveFailure(agent, resolved);
+    if (resolved.reason === "binary_not_found") {
+      throw new FailedDependencyError(message);
     }
+    throw new BadRequestError(message);
   }
 
   // Inject required env vars and preflight via the shared helper. See
@@ -115,13 +111,31 @@ async function steerSession({ pathParams, body }: RouteHandlerArgs) {
     throw new BadRequestError("instruction is required");
   }
 
+  // Sessions no longer in memory (completed, or lost to a daemon restart)
+  // are transparently resumed from persisted history with the instruction
+  // fired in the same call, mirroring the acp_steer skill tool.
+  // broadcastMessage plays the sender role spawnSession gives it, so
+  // connected clients render the session.
   const manager = getAcpSessionManager();
   try {
-    await manager.steer(id, instruction);
-  } catch {
+    const { resumed } = await manager.steerOrResume(
+      id,
+      instruction,
+      broadcastMessage,
+    );
+    return resumed
+      ? { acpSessionId: id, steered: true, resumed: true }
+      : { acpSessionId: id, steered: true };
+  } catch (err) {
+    // Resume errors carry the actionable hint (legacy row without cwd,
+    // agent capability missing, resolver failures, ...).
+    if (err instanceof AcpResumeError) {
+      throw new FailedDependencyError(err.message);
+    }
+    // Unknown ids (no in-memory session, no history row) and plain steer
+    // failures both map to 404, as before.
     throw new NotFoundError("ACP session not found");
   }
-  return { acpSessionId: id, steered: true };
 }
 
 async function cancelSession({ pathParams }: RouteHandlerArgs) {
@@ -160,9 +174,25 @@ function bulkDeleteSessions({ queryParams }: RouteHandlerArgs) {
       "status query param is required and must be 'completed'",
     );
   }
+  // Exclude sessions currently active in memory AND ids with a resume in
+  // flight (reserved but not yet registered): a resumed session reuses its
+  // original id, and its history row keeps the old terminal status until
+  // the next terminal upsert - a status-only delete would remove the row
+  // out from under the live (or resuming) session, and the later terminal
+  // upsert would resurrect it. Mirrors the 409 guard on the single-id
+  // delete route.
+  const activeIds = getAcpSessionManager().getActiveAndPendingIds();
+  const terminalFilter = inArray(
+    acpSessionHistory.status,
+    TERMINAL_SESSION_STATUSES,
+  );
   getDb()
     .delete(acpSessionHistory)
-    .where(inArray(acpSessionHistory.status, TERMINAL_SESSION_STATUSES))
+    .where(
+      activeIds.length > 0
+        ? and(terminalFilter, notInArray(acpSessionHistory.id, activeIds))
+        : terminalFilter,
+    )
     .run();
   const deleted = rawChanges();
   log.info({ deleted }, "Bulk-cleared terminal ACP session history");
@@ -171,9 +201,10 @@ function bulkDeleteSessions({ queryParams }: RouteHandlerArgs) {
 
 function deleteSession({ pathParams }: RouteHandlerArgs) {
   const id = pathParams?.id as string;
+  const manager = getAcpSessionManager();
 
   try {
-    const state = getAcpSessionManager().getStatus(id);
+    const state = manager.getStatus(id);
     if (
       !Array.isArray(state) &&
       (state.status === "running" || state.status === "initializing")
@@ -184,7 +215,16 @@ function deleteSession({ pathParams }: RouteHandlerArgs) {
     }
   } catch (err) {
     if (err instanceof ConflictError) throw err;
-    // Not in memory — fall through to the (idempotent) DB delete.
+    // Not registered in memory, but a resume may be in flight (id reserved
+    // while awaiting env preparation). Its history row must survive until
+    // the resume lands - the later terminal upsert would resurrect a
+    // deleted row.
+    if (manager.getActiveAndPendingIds().includes(id)) {
+      throw new ConflictError(
+        `ACP session "${id}" has a resume in flight. Wait for it to finish before deleting.`,
+      );
+    }
+    // Otherwise fall through to the (idempotent) DB delete.
   }
 
   getDb().delete(acpSessionHistory).where(eq(acpSessionHistory.id, id)).run();
@@ -202,7 +242,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "acp_spawn",
     endpoint: "acp/spawn",
     method: "POST",
-    policyKey: "acp/spawn",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: spawnSession,
     summary: "Spawn ACP session",
     description: "Start a new Agent Communication Protocol session.",
@@ -223,10 +266,17 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "acp_steer",
     endpoint: "acp/:id/steer",
     method: "POST",
-    policyKey: "acp/steer",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: steerSession,
     summary: "Steer ACP session",
-    description: "Send a steering instruction to an active ACP session.",
+    description:
+      "Send a steering instruction to an ACP session. Sessions no longer " +
+      "in memory (completed, or lost to a daemon restart) are " +
+      "transparently resumed from persisted history first, when the agent " +
+      "supports ACP session loading.",
     tags: ["acp"],
     requestBody: z.object({
       instruction: z.string(),
@@ -234,13 +284,22 @@ export const ROUTES: RouteDefinition[] = [
     responseBody: z.object({
       acpSessionId: z.string(),
       steered: z.boolean(),
+      resumed: z
+        .boolean()
+        .optional()
+        .describe(
+          "True when the session was resumed from persisted history before steering.",
+        ),
     }),
   },
   {
     operationId: "acp_cancel",
     endpoint: "acp/:id/cancel",
     method: "POST",
-    policyKey: "acp/cancel",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: cancelSession,
     summary: "Cancel ACP session",
     description: "Cancel an active ACP session.",
@@ -254,7 +313,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "acp_close",
     endpoint: "acp/:id/close",
     method: "POST",
-    policyKey: "acp/close",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: closeSession,
     summary: "Close ACP session",
     description: "Close a completed ACP session.",
@@ -268,7 +330,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "acp_list_sessions",
     endpoint: "acp/sessions",
     method: "GET",
-    policyKey: "acp",
+    policy: {
+      requiredScopes: ["chat.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: listSessions,
     summary: "List ACP sessions",
     description:
@@ -300,11 +365,17 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "acp_bulk_delete_sessions",
     endpoint: "acp/sessions",
     method: "DELETE",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: bulkDeleteSessions,
     summary: "Bulk-clear terminal ACP sessions",
     description:
       "Remove every terminal-state row (completed/failed/cancelled) from " +
-      "the persisted acp_session_history table.",
+      "the persisted acp_session_history table. Rows whose session is " +
+      "currently active in memory (e.g. resumed) or has a resume in " +
+      "flight are excluded.",
     tags: ["acp"],
     queryParams: [
       {
@@ -322,12 +393,16 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "acp_delete_session",
     endpoint: "acp/sessions/:id",
     method: "DELETE",
-    policyKey: "acp/sessions/delete",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: deleteSession,
     summary: "Delete ACP session from history",
     description:
       "Remove a persisted ACP session row. Rejects with 409 when the " +
-      "session is still active in memory; idempotent for unknown ids.",
+      "session is still active in memory or has a resume in flight; " +
+      "idempotent for unknown ids.",
     tags: ["acp"],
     responseBody: z.object({
       deleted: z.boolean(),

package/src/runtime/routes/app-management-routes.ts

@@ -1,6 +1,6 @@
 /**
  * Route handlers for app CRUD, bundling, sharing, versioning,
- * gallery, and signing operations.
+ * and signing operations.
  */
 import { randomBytes } from "node:crypto";
 import {
@@ -12,7 +12,7 @@ import {
 } from "node:fs";
 import { stat, unlink } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
-import { dirname, join } from "node:path";
+import { join } from "node:path";
 
 import { z } from "zod";
 
@@ -22,7 +22,6 @@ import { scanBundle } from "../../bundler/bundle-scanner.js";
 import type { SignatureJson } from "../../bundler/bundle-signer.js";
 import { verifyBundleSignature } from "../../bundler/signature-verifier.js";
 import { compareSemver } from "../../daemon/handlers/shared.js";
-import { defaultGallery } from "../../gallery/default-gallery.js";
 import {
   getAppDiff,
   getAppHistory,
@@ -49,6 +48,8 @@ import {
 import { createSharedAppLink } from "../../memory/shared-app-links-store.js";
 import { computeContentId } from "../../util/content-id.js";
 import { getLogger } from "../../util/logger.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
+import { publishAppsChanged } from "../sync/resource-sync-events.js";
 import {
   BadRequestError,
   NotFoundError,
@@ -62,6 +63,12 @@ const log = getLogger("app-management-routes");
 // Helpers
 // ---------------------------------------------------------------------------
 
+function getOriginClientId(
+  headers: RouteHandlerArgs["headers"],
+): string | undefined {
+  return headers?.["x-vellum-client-id"]?.trim() || undefined;
+}
+
 function getSharedAppsDir(): string {
   return join(
     homedir(),
@@ -264,47 +271,6 @@ function forkSharedApp(
   return { success: true, appId: newApp.id, name: newApp.name };
 }
 
-async function installGalleryApp(
-  galleryAppId: string,
-): Promise<
-  | { success: true; appId: string; name: string }
-  | { success: false; error: string }
-> {
-  const galleryApp = defaultGallery.apps.find((a) => a.id === galleryAppId);
-  if (!galleryApp) {
-    return {
-      success: false,
-      error: `Gallery app not found: ${galleryAppId}`,
-    };
-  }
-
-  const app = createApp({
-    name: galleryApp.name,
-    description: galleryApp.description,
-    schemaJson: galleryApp.schemaJson,
-    htmlDefinition: galleryApp.htmlDefinition,
-    formatVersion: galleryApp.formatVersion,
-  });
-
-  if (galleryApp.formatVersion === 2 && galleryApp.sourceFiles) {
-    const appDir = getAppDirPath(app.id);
-    for (const [relPath, content] of Object.entries(galleryApp.sourceFiles)) {
-      const fullPath = join(appDir, relPath);
-      mkdirSync(dirname(fullPath), { recursive: true });
-      writeFileSync(fullPath, content, "utf-8");
-    }
-    const result = await compileApp(appDir);
-    if (!result.ok) {
-      log.warn(
-        { appId: app.id, errors: result.errors },
-        "Gallery app compilation had errors; falling back to htmlDefinition",
-      );
-    }
-  }
-
-  return { success: true, appId: app.id, name: app.name };
-}
-
 async function openBundle(filePath: string): Promise<Record<string, unknown>> {
   const fileStat = await stat(filePath);
   const bundleSizeBytes = fileStat.size;
@@ -565,14 +531,16 @@ async function handleImportBundle({ rawBody, headers }: RouteHandlerArgs) {
       "Request body is required — upload a .vbundle file",
     );
   }
-  return importBundle(rawBody, headers ?? {});
+  const result = await importBundle(rawBody, headers ?? {});
+  publishAppsChanged(getOriginClientId(headers));
+  return result;
 }
 
 function handleListSharedApps() {
   return { apps: listSharedApps() };
 }
 
-function handleForkSharedApp({ body }: RouteHandlerArgs) {
+function handleForkSharedApp({ body, headers }: RouteHandlerArgs) {
   if (!body?.uuid) {
     throw new BadRequestError("uuid is required");
   }
@@ -580,24 +548,10 @@ function handleForkSharedApp({ body }: RouteHandlerArgs) {
   if (!result.success) {
     throw new BadRequestError(result.error);
   }
+  publishAppsChanged(getOriginClientId(headers));
   return result;
 }
 
-async function handleInstallGalleryApp({ body }: RouteHandlerArgs) {
-  if (!body?.galleryAppId) {
-    throw new BadRequestError("galleryAppId is required");
-  }
-  const result = await installGalleryApp(body.galleryAppId as string);
-  if (!result.success) {
-    throw new BadRequestError(result.error);
-  }
-  return result;
-}
-
-function handleListGallery() {
-  return { gallery: defaultGallery };
-}
-
 function handleSignBundle({ body }: RouteHandlerArgs) {
   if (!body?.payload) {
     throw new BadRequestError("payload is required");
@@ -694,8 +648,9 @@ async function handleOpenApp({ pathParams }: RouteHandlerArgs) {
   return { appId: app.id, dirName, name: app.name, html };
 }
 
-function handleDeleteApp({ pathParams }: RouteHandlerArgs) {
+function handleDeleteApp({ pathParams, headers }: RouteHandlerArgs) {
   deleteApp(pathParams?.id as string);
+  publishAppsChanged(getOriginClientId(headers));
   return { success: true };
 }
 
@@ -773,7 +728,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_list",
     endpoint: "apps",
     method: "GET",
-    policyKey: "apps",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleListApps,
     summary: "List apps",
     description: "Return all locally installed apps.",
@@ -803,7 +761,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_open_bundle",
     endpoint: "apps/open-bundle",
     method: "POST",
-    policyKey: "apps/open-bundle",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleOpenBundle,
     summary: "Open a .vbundle file",
     description:
@@ -832,7 +793,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_shared_list",
     endpoint: "apps/shared",
     method: "GET",
-    policyKey: "apps/shared-list",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleListSharedApps,
     summary: "List shared apps",
     description: "Return all apps available via cloud share links.",
@@ -861,7 +825,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_fork",
     endpoint: "apps/fork",
     method: "POST",
-    policyKey: "apps/fork",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleForkSharedApp,
     summary: "Fork a shared app",
     description: "Create a local copy of a shared app by its UUID.",
@@ -875,67 +842,23 @@ export const ROUTES: RouteDefinition[] = [
       name: z.string(),
     }),
   },
-  {
-    operationId: "apps_gallery_install",
-    endpoint: "apps/gallery/install",
-    method: "POST",
-    policyKey: "apps/gallery/install",
-    handler: handleInstallGalleryApp,
-    summary: "Install a gallery app",
-    description: "Install an app from the built-in gallery by its ID.",
-    tags: ["apps"],
-    requestBody: z.object({ galleryAppId: z.string() }),
-    responseBody: z.object({
-      success: z.literal(true),
-      appId: z.string(),
-      name: z.string(),
-    }),
-  },
-  {
-    operationId: "apps_gallery_list",
-    endpoint: "apps/gallery",
-    method: "GET",
-    policyKey: "apps/gallery",
-    handler: handleListGallery,
-    summary: "List gallery apps",
-    description: "Return the built-in app gallery catalog.",
-    tags: ["apps"],
-    responseBody: z.object({
-      gallery: z.object({
-        version: z.number(),
-        updatedAt: z.string(),
-        categories: z.array(
-          z.object({
-            id: z.string(),
-            name: z.string(),
-            icon: z.string(),
-          }),
-        ),
-        apps: z.array(
-          z.object({
-            id: z.string(),
-            name: z.string(),
-            description: z.string(),
-            icon: z.string(),
-            category: z.string(),
-            version: z.string(),
-            featured: z.boolean().optional(),
-          }),
-        ),
-      }),
-    }),
-  },
   {
     operationId: "apps_import_bundle",
     endpoint: "apps/import-bundle",
     method: "POST",
-    policyKey: "apps/import-bundle",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleImportBundle,
     summary: "Import a .vbundle file",
     description:
       "Upload, validate, and install a .vbundle archive as a new local app.",
     tags: ["apps"],
-    rawBody: true,
+    requestBody: {
+      contentType: "application/octet-stream",
+      schema: { type: "string", format: "binary" },
+    },
     responseBody: z.object({
       success: z.boolean(),
       appId: z.string(),
@@ -957,7 +880,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_sign_bundle",
     endpoint: "apps/sign-bundle",
     method: "POST",
-    policyKey: "apps/sign-bundle",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleSignBundle,
     summary: "Sign an app bundle",
     description:
@@ -980,7 +906,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_signing_identity",
     endpoint: "apps/signing-identity",
     method: "GET",
-    policyKey: "apps/signing-identity",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleSigningIdentity,
     summary: "Get signing identity",
     description:
@@ -995,7 +924,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_data_query",
     endpoint: "apps/:id/data",
     method: "GET",
-    policyKey: "apps/data",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleQueryAppData,
     summary: "Query app data",
     description: "Read records from an app's local data store.",
@@ -1015,7 +947,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_data_mutate",
     endpoint: "apps/:id/data",
     method: "POST",
-    policyKey: "apps/data",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleMutateAppData,
     summary: "Mutate app data",
     description:
@@ -1035,7 +970,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_open",
     endpoint: "apps/:id/open",
     method: "POST",
-    policyKey: "apps/open",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleOpenApp,
     summary: "Open an app",
     description: "Compile (if needed) and return the app's HTML for rendering.",
@@ -1051,7 +989,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_delete",
     endpoint: "apps/:id/delete",
     method: "POST",
-    policyKey: "apps/delete",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleDeleteApp,
     summary: "Delete an app",
     description: "Permanently remove an app and its data.",
@@ -1062,7 +1003,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_preview_get",
     endpoint: "apps/:id/preview",
     method: "GET",
-    policyKey: "apps/preview",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleGetPreview,
     summary: "Get app preview",
     description: "Return the preview image or HTML for an app.",
@@ -1076,7 +1020,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_preview_update",
     endpoint: "apps/:id/preview",
     method: "PUT",
-    policyKey: "apps/preview",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleUpdatePreview,
     summary: "Update app preview",
     description: "Set a new preview image or HTML for an app.",
@@ -1093,7 +1040,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_history",
     endpoint: "apps/:id/history",
     method: "GET",
-    policyKey: "apps/history",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleGetHistory,
     summary: "Get app version history",
     description: "Return the git commit history of an app.",
@@ -1114,7 +1064,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_diff",
     endpoint: "apps/:id/diff",
     method: "GET",
-    policyKey: "apps/diff",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleGetDiff,
     summary: "Get app diff",
     description: "Return a git diff between two commits for an app.",
@@ -1132,7 +1085,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_restore",
     endpoint: "apps/:id/restore",
     method: "POST",
-    policyKey: "apps/restore",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleRestore,
     summary: "Restore app version",
     description: "Restore an app to a previous git commit.",
@@ -1144,7 +1100,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_bundle",
     endpoint: "apps/:id/bundle",
     method: "POST",
-    policyKey: "apps/bundle",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleBundle,
     summary: "Bundle an app",
     description: "Package an app into a distributable .vbundle archive.",
@@ -1160,7 +1119,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "apps_share_cloud",
     endpoint: "apps/:id/share-cloud",
     method: "POST",
-    policyKey: "apps/share-cloud",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleShareCloud,
     summary: "Share app to cloud",
     description: "Package and upload an app to the cloud share service.",