# Continuity ledger (per-branch)

## Human intent (must not be overwritten)

- Make `@giselles-ai/sdk` `client.app.runAndWait()` work with the **Team secret key** format (`gsk-...`) by aligning the Tasks API auth with the Run API auth. App-scoped keys are deprecated.

## Goal (incl. success criteria)

- Fix `401 Unauthorized` on `GET /api/apps/{appId}/tasks/{taskId}` when using a Team secret key (while `POST /api/apps/{appId}/run` already succeeds).
- Success criteria:
  - `client.app.runAndWait()` no longer fails with `Tasks API request failed: 401 Unauthorized` when using `gsk-...`
  - Tasks endpoint does not leak app existence (keeps 401 behavior when app is missing / auth fails)

## Constraints/Assumptions

- Prefer simplest change (less is more) and keep behavior consistent with the existing Run endpoint.
- Treat App API keys (`gsk_...`) as deprecated for this flow.

## Key decisions

- Authenticate Tasks endpoint with Team API keys (DB-backed) via `verifyApiSecretForTeam`, matching the Run endpoint.
- Keep cross-app task access guard (`task.starter.appId === appId`) and non-leaking behavior.

## State

- Tasks endpoint now uses Team key verification; unit tests added for the route handler (with mocks).
- Note: `pnpm -C apps/studio.giselles.ai check-types` reports missing static asset imports in `internal-packages/workflow-designer-ui/.../workspace-tour.tsx` (appears unrelated to this change).

## Done

- Updated Tasks API route auth to use `verifyApiSecretForTeam` after looking up `teamDbId` from `apps` table.
- Added Vitest tests for the Tasks route (mocked db + verifier) to cover 401 and success response paths.

## Now

- Awaiting real-world confirmation by running the SDK script against Studio with a Team secret key (should now succeed).

## Next

- (Optional) Add a small `curl` snippet to docs/README for debugging Runs/Tasks auth with Team keys.
- (Optional follow-up) Investigate/resolve the `workspace-tour` missing asset typecheck errors if they affect CI in this branch.

## Open questions (UNCONFIRMED if needed)

- Does CI enforce Studio `check-types` for this branch, or is the missing asset import issue already tracked elsewhere?

## Working set (files/ids/commands)

- `apps/studio.giselles.ai/app/api/apps/[appId]/tasks/[taskId]/route.ts`
- `apps/studio.giselles.ai/app/api/apps/[appId]/tasks/[taskId]/route.test.ts`
- `pnpm -C apps/studio.giselles.ai test`
- `pnpm -C apps/studio.giselles.ai check-types`

