@vellumai/assistant 0.8.6 → 0.8.7-dev.202606052118.34cd356

package/src/runtime/routes/skills-routes.ts

@@ -26,10 +26,11 @@ import {
   uninstallSkill,
   updateSkill,
 } from "../../daemon/handlers/skills.js";
+import { getCategories } from "../../skills/categories-cache.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, InternalError, NotFoundError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
-
 const partnerAuditSchema = z.object({
   risk: z.enum(["safe", "low", "medium", "high", "critical", "unknown"]),
   alerts: z.number().optional(),
@@ -41,9 +42,11 @@ const slimSkillBase = {
   id: z.string(),
   name: z.string(),
   description: z.string(),
+  icon: z.string().optional(),
   emoji: z.string().optional(),
   kind: z.enum(["bundled", "installed", "catalog"]),
   status: z.enum(["enabled", "disabled", "available"]),
+  category: z.string(),
 };
 
 const slimSkillSchema = z.discriminatedUnion("origin", [
@@ -129,8 +132,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "listSkills",
     endpoint: "skills",
     method: "GET",
-    policyKey: "skills",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List all skills",
     description:
       "Return all installed skills. Pass ?include=catalog to also include available catalog skills. Supports optional filter params: origin, kind, q, category.",
@@ -190,15 +195,13 @@ export const ROUTES: RouteDefinition[] = [
       const hasFilter = !!(origin || kind || q || category);
 
       if (hasFilter || include === "catalog") {
-        const result = await listSkillsFiltered(
-          {
-            ...(origin ? { origin } : {}),
-            ...(kind ? { kind } : {}),
-            ...(q ? { q } : {}),
-            ...(category ? { category } : {}),
-            includeCatalog: include === "catalog",
-          },
-        );
+        const result = await listSkillsFiltered({
+          ...(origin ? { origin } : {}),
+          ...(kind ? { kind } : {}),
+          ...(q ? { q } : {}),
+          ...(category ? { category } : {}),
+          includeCatalog: include === "catalog",
+        });
         return {
           skills: result.skills,
           categoryCounts: result.categoryCounts,
@@ -210,12 +213,41 @@ export const ROUTES: RouteDefinition[] = [
       return { skills };
     },
   },
+  {
+    operationId: "listSkillCategories",
+    endpoint: "skills/categories",
+    method: "GET",
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    summary: "List skill categories",
+    description:
+      "Return all skill category definitions with labels, icons, and descriptions.",
+    tags: ["skills"],
+    responseBody: z.object({
+      categories: z.array(
+        z.object({
+          slug: z.string(),
+          label: z.string(),
+          description: z.string(),
+          icon: z.string(),
+        }),
+      ),
+    }),
+    handler: async () => {
+      const categories = await getCategories();
+      return { categories };
+    },
+  },
   {
     operationId: "getSkillFileContent",
     endpoint: "skills/:id/files/content",
     method: "GET",
-    policyKey: "skills",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get skill file content",
     description:
       "Return the content of a single file belonging to an installed or catalog skill.",
@@ -254,11 +286,28 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "getSkillFiles",
     endpoint: "skills/:id/files",
     method: "GET",
-    policyKey: "skills",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get skill files",
     description: "Return skill metadata and directory contents.",
     tags: ["skills"],
+    responseBody: z.object({
+      skill: slimSkillSchema.describe("Skill metadata"),
+      files: z
+        .array(
+          z.object({
+            path: z.string(),
+            name: z.string(),
+            size: z.number().int(),
+            mimeType: z.string(),
+            isBinary: z.boolean(),
+            content: z.string().nullable(),
+          }),
+        )
+        .describe("Directory contents"),
+    }),
     handler: async ({ pathParams }: RouteHandlerArgs) => {
       const result = await getSkillFiles(pathParams!.id);
       if ("error" in result) {
@@ -272,8 +321,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "enableSkill",
     endpoint: "skills/:id/enable",
     method: "POST",
-    policyKey: "skills",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Enable skill",
     description: "Enable an installed skill.",
     tags: ["skills"],
@@ -288,8 +339,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "disableSkill",
     endpoint: "skills/:id/disable",
     method: "POST",
-    policyKey: "skills",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Disable skill",
     description: "Disable an installed skill.",
     tags: ["skills"],
@@ -304,8 +357,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "configureSkill",
     endpoint: "skills/:id/config",
     method: "PATCH",
-    policyKey: "skills",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Configure skill",
     description: "Update skill configuration (env, apiKey, config).",
     tags: ["skills"],
@@ -316,14 +371,11 @@ export const ROUTES: RouteDefinition[] = [
     }),
     responseBody: z.object({ ok: z.boolean() }),
     handler: ({ pathParams, body = {} }: RouteHandlerArgs) => {
-      const result = configureSkill(
-        pathParams!.id,
-        {
-          env: body.env as Record<string, string> | undefined,
-          apiKey: body.apiKey as string | undefined,
-          config: body.config as Record<string, unknown> | undefined,
-        },
-      );
+      const result = configureSkill(pathParams!.id, {
+        env: body.env as Record<string, string> | undefined,
+        apiKey: body.apiKey as string | undefined,
+        config: body.config as Record<string, unknown> | undefined,
+      });
       if (!result.success) throw new InternalError(result.error);
       return { ok: true };
     },
@@ -332,8 +384,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "checkSkillUpdates",
     endpoint: "skills/check-updates",
     method: "POST",
-    policyKey: "skills",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Check skill updates",
     description: "Check for available updates to installed skills.",
     tags: ["skills"],
@@ -350,8 +404,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "searchSkills",
     endpoint: "skills/search",
     method: "GET",
-    policyKey: "skills",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Search skill catalog",
     description: "Search the skill catalog by query string.",
     tags: ["skills"],
@@ -376,7 +432,9 @@ export const ROUTES: RouteDefinition[] = [
       const query = queryParams.q ?? "";
       if (!query) throw new BadRequestError("q query parameter is required");
       const limitRaw = queryParams.limit;
-      const limit = limitRaw ? Math.max(1, Number.parseInt(limitRaw, 10) || 25) : 25;
+      const limit = limitRaw
+        ? Math.max(1, Number.parseInt(limitRaw, 10) || 25)
+        : 25;
       const result = await searchSkills(query, limit);
       if (!result.success) throw new InternalError(result.error);
       return { skills: result.skills };
@@ -386,8 +444,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "draftSkill",
     endpoint: "skills/draft",
     method: "POST",
-    policyKey: "skills",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Draft a skill",
     description: "Generate a skill draft from source text.",
     tags: ["skills"],
@@ -410,8 +470,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "updateSkill",
     endpoint: "skills/:id/update",
     method: "POST",
-    policyKey: "skills",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Update skill",
     description: "Update an installed skill to the latest version.",
     tags: ["skills"],
@@ -426,8 +488,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "inspectSkill",
     endpoint: "skills/:id/inspect",
     method: "GET",
-    policyKey: "skills",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Inspect skill",
     description: "Return detailed skill information.",
     tags: ["skills"],
@@ -453,8 +517,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "getSkill",
     endpoint: "skills/:id",
     method: "GET",
-    policyKey: "skills",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get skill",
     description: "Return a single skill by ID with enriched detail fields.",
     tags: ["skills"],
@@ -474,8 +540,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "deleteSkill",
     endpoint: "skills/:id",
     method: "DELETE",
-    policyKey: "skills",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Uninstall skill",
     description: "Remove an installed skill.",
     tags: ["skills"],
@@ -490,24 +558,45 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "installSkill",
     endpoint: "skills/install",
     method: "POST",
-    policyKey: "skills",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Install skill",
     description: "Install a skill by slug, URL, or spec.",
     tags: ["skills"],
     requestBody: z.object({
-      slug: z.string().describe("Skill slug"),
-      url: z.string().describe("Skill URL"),
-      spec: z.string().describe("Skill spec"),
-      version: z.string(),
+      slug: z
+        .string()
+        .optional()
+        .describe("Skill slug. One of slug, url, or spec is required."),
+      url: z
+        .string()
+        .optional()
+        .describe("Skill URL. One of slug, url, or spec is required."),
+      spec: z
+        .string()
+        .optional()
+        .describe("Skill spec. One of slug, url, or spec is required."),
+      version: z.string().optional().describe("Specific version to install"),
       origin: z
         .enum(["clawhub", "skillssh"])
         .optional()
         .describe(
           "Which registry to install from. When omitted, the install flow auto-detects based on slug format.",
         ),
-      overwrite: z.boolean().optional().describe("Replace an existing install. Defaults to true for back-compat with the legacy in-process API."),
-      catalogOnly: z.boolean().optional().describe("When true, restrict to bundled and Vellum catalog skills only — do not fall through to community registries."),
+      overwrite: z
+        .boolean()
+        .optional()
+        .describe(
+          "Replace an existing install. Defaults to true for back-compat with the legacy in-process API.",
+        ),
+      catalogOnly: z
+        .boolean()
+        .optional()
+        .describe(
+          "When true, restrict to bundled and Vellum catalog skills only — do not fall through to community registries.",
+        ),
     }),
     responseBody: z.object({
       ok: z.boolean(),
@@ -515,21 +604,17 @@ export const ROUTES: RouteDefinition[] = [
     }),
     handler: async ({ body = {} }: RouteHandlerArgs) => {
       const slug =
-        (body.slug as string) ??
-        (body.url as string) ??
-        (body.spec as string);
+        (body.slug as string) ?? (body.url as string) ?? (body.spec as string);
       if (!slug || typeof slug !== "string") {
         throw new BadRequestError("slug, url, or spec is required");
       }
-      const result = await installSkill(
-        {
-          slug,
-          version: body.version as string | undefined,
-          origin: body.origin as "clawhub" | "skillssh" | undefined,
-          catalogOnly: body.catalogOnly as boolean | undefined,
-          overwrite: body.overwrite as boolean | undefined,
-        },
-      );
+      const result = await installSkill({
+        slug,
+        version: body.version as string | undefined,
+        origin: body.origin as "clawhub" | "skillssh" | undefined,
+        catalogOnly: body.catalogOnly as boolean | undefined,
+        overwrite: body.overwrite as boolean | undefined,
+      });
       if (!result.success) throw new InternalError(result.error);
       return { ok: true, skillId: result.skillId };
     },
@@ -538,8 +623,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "createSkill",
     endpoint: "skills",
     method: "POST",
-    policyKey: "skills",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Create skill",
     description: "Create a new skill.",
     tags: ["skills"],
@@ -561,9 +648,12 @@ export const ROUTES: RouteDefinition[] = [
           "skillId, name, description, and bodyMarkdown are required",
         );
       }
-      const result = await createSkill(
-        { skillId, name, description, bodyMarkdown },
-      );
+      const result = await createSkill({
+        skillId,
+        name,
+        description,
+        bodyMarkdown,
+      });
       if (!result.success) throw new InternalError(result.error);
       return { ok: true };
     },
@@ -572,10 +662,13 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "skillsLocalInspect",
     endpoint: "skills/:id/local-inspect",
     method: "GET",
-    policyKey: "skills",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Local skill inspect",
-    description: "Return full local detail for an installed or bundled skill, including featureFlag, toolManifest, installMeta, configEntry, and directoryPath.",
+    description:
+      "Return full local detail for an installed or bundled skill, including featureFlag, toolManifest, installMeta, configEntry, and directoryPath.",
     tags: ["skills"],
     handler: ({ pathParams }: RouteHandlerArgs) => {
       const result = getSkillLocalDetail(pathParams!.id);

package/src/runtime/routes/slack-channel-routes.ts

@@ -12,6 +12,7 @@ import {
   getSlackConversationInfo,
   SlackApiError,
 } from "../../messaging/providers/slack/api.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { publishSyncInvalidation } from "../sync/sync-publisher.js";
 import { NotFoundError } from "./errors.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
@@ -171,6 +172,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "slack_channel_name_resolve",
     endpoint: "conversations/:conversationId/slack-channel/resolve",
     method: "POST",
+    policy: {
+      requiredScopes: ["chat.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleSlackChannelNameResolve,
     summary: "Resolve Slack channel name",
     description:

package/src/runtime/routes/stt-routes.ts

@@ -23,6 +23,7 @@ import {
   FFPROBE_TIMEOUT_MS,
   spawnWithTimeout,
 } from "../../util/spawn.js";
+import { ACTOR_PRINCIPALS, LOCAL_PRINCIPALS } from "../auth/route-policy.js";
 import {
   BadGatewayError,
   BadRequestError,
@@ -382,8 +383,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "stt_providers",
     endpoint: "stt/providers",
     method: "GET",
-    policyKey: "stt/providers",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["settings.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "List STT providers",
     description:
       "Return the catalog of available STT providers with client-facing metadata.",
@@ -408,8 +411,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "stt_transcribe",
     endpoint: "stt/transcribe",
     method: "POST",
-    policyKey: "stt/transcribe",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Transcribe audio to text",
     description:
       "Transcribe base64-encoded audio to text using the configured STT provider.",
@@ -441,8 +446,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "stt_transcribe_file",
     endpoint: "stt/transcribe-file",
     method: "POST",
-    policyKey: "stt/transcribe-file",
-    requirePolicyEnforcement: true,
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: LOCAL_PRINCIPALS,
+    },
     summary: "Transcribe audio/video file to text",
     description:
       "Transcribe an audio or video file to text using the configured STT provider. Handles ffmpeg conversion, large-file chunking, and sequential chunk transcription.",

package/src/runtime/routes/subagents-routes.ts

@@ -7,6 +7,7 @@
  */
 import { z } from "zod";
 
+import { SubagentDetailResponseSchema } from "../../api/responses/subagent-detail.js";
 import {
   getMessages,
   type MessageRow,
@@ -14,6 +15,7 @@ import {
 import { getConversationUsageTotals } from "../../memory/llm-usage-store.js";
 import { getSubagentManager } from "../../subagent/index.js";
 import { getLogger } from "../../util/logger.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { BadRequestError, NotFoundError } from "./errors.js";
 import type { RouteDefinition } from "./types.js";
 
@@ -192,7 +194,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "reconcileSubagents",
     endpoint: "subagents/reconcile",
     method: "GET",
-    policyKey: "subagents",
+    policy: {
+      requiredScopes: ["chat.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Reconcile subagent live status",
     description:
       "Returns the live in-memory status of all subagents known to the daemon for a given parent conversation. Subagents not in the response are orphaned.",
@@ -233,7 +238,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "getSubagentDetail",
     endpoint: "subagents/:id",
     method: "GET",
-    policyKey: "subagents",
+    policy: {
+      requiredScopes: ["chat.read"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Get subagent detail",
     description: "Return subagent objective and event history.",
     tags: ["subagents"],
@@ -244,18 +252,7 @@ export const ROUTES: RouteDefinition[] = [
         description: "Parent conversation ID (required)",
       },
     ],
-    responseBody: z.object({
-      subagentId: z.string(),
-      objective: z.string(),
-      usage: z
-        .object({
-          inputTokens: z.number(),
-          outputTokens: z.number(),
-          estimatedCost: z.number(),
-        })
-        .optional(),
-      events: z.array(z.unknown()).describe("Subagent event objects"),
-    }),
+    responseBody: SubagentDetailResponseSchema,
     handler: ({ pathParams, queryParams }) => {
       const conversationId = queryParams?.conversationId;
       if (!conversationId) {
@@ -263,9 +260,12 @@ export const ROUTES: RouteDefinition[] = [
       }
 
       const manager = getSubagentManager();
-      manager.getState(pathParams!.id);
+      const state = manager.getState(pathParams!.id);
 
-      return getSubagentDetail(pathParams!.id, conversationId);
+      return {
+        ...getSubagentDetail(pathParams!.id, conversationId),
+        status: state?.status,
+      };
     },
   },
 
@@ -273,7 +273,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "abortSubagent",
     endpoint: "subagents/:id/abort",
     method: "POST",
-    policyKey: "subagents/abort",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Abort subagent",
     description: "Abort a running subagent.",
     tags: ["subagents"],
@@ -313,7 +316,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "sendSubagentMessage",
     endpoint: "subagents/:id/message",
     method: "POST",
-    policyKey: "subagents/message",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Send message to subagent",
     description: "Send a text message to a running subagent.",
     tags: ["subagents"],

package/src/runtime/routes/suggest-trust-rule-routes.ts

@@ -14,6 +14,7 @@ import {
   getConfiguredProvider,
   userMessage,
 } from "../../providers/provider-send-message.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import type { RouteDefinition, RouteHandlerArgs } from "./types.js";
 
 // ── Request / response shapes ─────────────────────────────────────────
@@ -183,9 +184,9 @@ async function handleSuggestTrustRule({
   try {
     const response = await provider.sendMessage(
       [userMessage(buildUserMessage(req))],
-      [SUGGEST_RULE_TOOL],
-      SYSTEM_PROMPT,
       {
+        tools: [SUGGEST_RULE_TOOL],
+        systemPrompt: SYSTEM_PROMPT,
         config: {
           callSite: "trustRuleSuggestion",
           max_tokens: 512,
@@ -264,6 +265,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "suggest_trust_rule",
     endpoint: "trust-rules/suggest",
     method: "POST",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     handler: handleSuggestTrustRule,
     summary: "Suggest a trust rule",
     description:

package/src/runtime/routes/surface-action-routes.ts

@@ -13,6 +13,7 @@ import type { ChannelId } from "../../channels/types.js";
 import { isHttpAuthDisabled } from "../../config/env.js";
 import { getLogger } from "../../util/logger.js";
 import { DAEMON_INTERNAL_ASSISTANT_ID } from "../assistant-scope.js";
+import { ACTOR_PRINCIPALS } from "../auth/route-policy.js";
 import { healGuardianBindingDrift } from "../guardian-vellum-migration.js";
 import { resolveLocalTrustContext } from "../local-actor-identity.js";
 import {
@@ -225,6 +226,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "triggerSurfaceAction",
     endpoint: "surface-actions",
     method: "POST",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Trigger a surface action",
     description:
       "Execute an interactive action on a surface (e.g. button click, form submit).",
@@ -257,6 +262,10 @@ export const ROUTES: RouteDefinition[] = [
     operationId: "undoSurfaceAction",
     endpoint: "surfaces/:id/undo",
     method: "POST",
+    policy: {
+      requiredScopes: ["chat.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
     summary: "Undo last surface action",
     description: "Revert the most recent action on a surface.",
     tags: ["surfaces"],