chore(api): move blocked-urls under /v1/admin/blocklist (#597)

Closes #524. Routes now live at /v1/admin/blocklist; updates the
adminRoutes allowlist, agent block tool, and eval-task cleanup to
match. CLI client + whoami probe move in a follow-up release.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: zachdunn

docs/architecture/remote-mode.md

@@ -4,7 +4,7 @@ The API worker at `workers/api/` is the authoritative data plane — every read
 
 ## Auth model
 
-GET endpoints are public (no auth required). Write operations (POST/PATCH/DELETE) require a Bearer token. The `publicReadAuthMiddleware` in `workers/api/src/middleware/auth.ts` handles this split. Admin-only routes (sessions, `admin/*`, `workflows/*`, blocked-urls) require auth for all methods. The `GET /v1/orgs/:slug/playbook` endpoint is also admin-only (inline `authMiddleware` on the handler) since playbook content is internal.
+GET endpoints are public (no auth required). Write operations (POST/PATCH/DELETE) require a Bearer token. The `publicReadAuthMiddleware` in `workers/api/src/middleware/auth.ts` handles this split. Admin-only routes (sessions, `admin/*`, `workflows/*`) require auth for all methods. The `GET /v1/orgs/:slug/playbook` endpoint is also admin-only (inline `authMiddleware` on the handler) since playbook content is internal.
 
 ## On-demand AI admin endpoints
 

scripts/run-eval-task.ts

@@ -236,7 +236,7 @@ async function runCleanup(t: (typeof TASKS)[number], phase: "pre" | "post"): Pro
         return cleanupFetch("DELETE", `/orgs/${encodeURIComponent(args.slug)}`);
       }
       if (kind === "unblock_url") {
-        return cleanupFetch("DELETE", `/blocked-urls/${encodeURIComponent(args.pattern)}`);
+        return cleanupFetch("DELETE", `/admin/blocklist/${encodeURIComponent(args.pattern)}`);
       }
       if (kind === "unignore_url") {
         return cleanupFetch(

src/shared/agent-tools.ts

@@ -606,7 +606,7 @@ export function createTypedExecutor(opts: APIClientOptions) {
           const body: Record<string, unknown> = { pattern: url };
           if (input.block_type) body.type = input.block_type;
           if (input.reason) body.reason = input.reason;
-          return api("POST", "/blocked-urls", body);
+          return api("POST", "/admin/blocklist", body);
         }
 
         return `Error: unknown action "${action}"`;

workers/api/src/index.ts

@@ -207,11 +207,11 @@ for (const r of publicReadRoutes) {
 // Admin-only routes: all methods require auth.
 const adminRoutes = [
   "sessions",
-  "blocked-urls",
   "evaluate",
   "status/fetch-log",
   "status/usage",
   "status/event",
+  "admin/blocklist",
   "admin/embed/status",
   "admin/cron-runs",
   "admin/logs",

workers/api/src/routes/ignore.ts

@@ -66,9 +66,9 @@ ignoreRoutes.delete("/orgs/:slug/ignored-urls/:url", async (c) => {
   return c.json({ deleted: true });
 });
 
-// ── Global blocked URLs: /blocked-urls ──
+// ── Global blocked URLs: /admin/blocklist ──
 
-ignoreRoutes.get("/blocked-urls", async (c) => {
+ignoreRoutes.get("/admin/blocklist", async (c) => {
   const db = createDb(c.env.DB);
 
   const singleUrl = c.req.query("url");
@@ -98,7 +98,7 @@ ignoreRoutes.get("/blocked-urls", async (c) => {
   return c.json(rows);
 });
 
-ignoreRoutes.post("/blocked-urls", async (c) => {
+ignoreRoutes.post("/admin/blocklist", async (c) => {
   const db = createDb(c.env.DB);
   const body = await c.req.json<{ pattern: string; type?: "exact" | "domain"; reason?: string }>();
 
@@ -118,7 +118,7 @@ ignoreRoutes.post("/blocked-urls", async (c) => {
   return c.json({ blocked: true }, 201);
 });
 
-ignoreRoutes.delete("/blocked-urls/:pattern", async (c) => {
+ignoreRoutes.delete("/admin/blocklist/:pattern", async (c) => {
   const db = createDb(c.env.DB);
   const pattern = decodeURIComponent(c.req.param("pattern"));