@agentprojectcontext/apx 1.25.0 → 1.27.1

package/src/host/daemon/api/super-agent.js

@@ -0,0 +1,208 @@
+// "super-agent" here is the *default APX agent* — the tool-using loop that
+// runs when no project agent is named (Telegram, overlay, TUI without
+// --agent). It is NOT a persona with that name; it is the system-level
+// dispatcher described in core/agent/run-agent.js.
+//
+//   POST /projects/:pid/super-agent/chat/stream    NDJSON event stream
+//   POST /projects/:pid/super-agent/chat            blocking JSON response
+import { runSuperAgent } from "../super-agent.js";
+import {
+  resolveSuperAgentContext,
+  appendSuperAgentErrorTrace,
+} from "./shared.js";
+import { loggerFor } from "../../../core/logging.js";
+import { appendGlobalMessage } from "../../../core/messages-store.js";
+
+const log = loggerFor("super-agent");
+
+// Persist human web turns to the cross-channel message store so they feed the
+// RAG index, search_messages, and the "active threads" awareness block. Only
+// the human surfaces (web big chat + sidebar) — not generic "api"/automation
+// callers. Best-effort: a logging failure never breaks the reply.
+const WEB_LOGGED_CHANNELS = new Set(["web", "web_sidebar"]);
+function logWebTurn(channel, { prompt, replyText }) {
+  if (!WEB_LOGGED_CHANNELS.has(channel)) return;
+  try {
+    appendGlobalMessage({ channel, direction: "in", type: "user", author: "user", body: prompt });
+    if (replyText) {
+      appendGlobalMessage({ channel, direction: "out", type: "agent", body: replyText });
+    }
+  } catch {
+    /* best-effort */
+  }
+}
+
+// Wrap an onEvent emitter so that operationally interesting events also land
+// in the unified daemon log. We don't log every "model_start" — too noisy —
+// just the ones a user would want to see in `apx log -f` after a turn fails
+// or rotates models.
+function wrapOnEventForLog(send, { trace_id, channel }) {
+  return (event) => {
+    if (event?.type === "engine_failed") {
+      log.warn(
+        `engine ${event.model || "?"} failed → retrying with ${event.retry_with || "?"}`,
+        { trace_id, channel, reason: event.reason }
+      );
+    } else if (event?.type === "tools_suppressed") {
+      log.info(
+        `tools suppressed: ${(event.tools || []).join(", ")} (${event.reason || "?"})`,
+        { trace_id, channel }
+      );
+    } else if (event?.type === "model_routed" && event.from_fallback) {
+      log.info(
+        `model routing fell back: ${event.model} (provider=${event.provider})`,
+        { trace_id, channel }
+      );
+    }
+    if (send) send(event);
+  };
+}
+
+export function register(app, { projects, registries, plugins, project, config }) {
+  app.post("/projects/:pid/super-agent/chat/stream", async (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    // Optional coding-surface knobs: the terminal Code TUI (apx code, Build
+    // mode) sends these so it runs to completion exactly like the web Code
+    // module. Plain chat callers omit them and keep the lightweight defaults.
+    const { prompt, previousMessages, model, maxIters, maxTokens, completionContract } =
+      req.body || {};
+    if (!prompt) return res.status(400).json({ error: "prompt required" });
+    const ctx = resolveSuperAgentContext(req, p);
+
+    res.setHeader("content-type", "application/x-ndjson; charset=utf-8");
+    res.setHeader("cache-control", "no-cache, no-transform");
+    res.setHeader("x-accel-buffering", "no");
+    res.flushHeaders?.();
+
+    const send = (event) => {
+      res.write(JSON.stringify(event) + "\n");
+    };
+
+    try {
+      const saResult = await runSuperAgent({
+        globalConfig: config,
+        projects,
+        plugins,
+        registries,
+        prompt,
+        channel: ctx.channel,
+        channelMeta: ctx.channelMeta,
+        contextNote: ctx.contextNote,
+        previousMessages: previousMessages || [],
+        overrideModel: model,
+        ...(Number.isFinite(Number(maxIters)) ? { maxIters: Number(maxIters) } : {}),
+        ...(Number.isFinite(Number(maxTokens)) ? { maxTokens: Number(maxTokens) } : {}),
+        ...(completionContract ? { completionContract: true } : {}),
+        onEvent: wrapOnEventForLog(send, {
+          trace_id: req.apxTraceId,
+          channel: ctx.channel,
+        }),
+      });
+      projects.rebuild(p.id);
+      logWebTurn(ctx.channel, { prompt, replyText: saResult.text });
+      send({
+        type: "final",
+        result: {
+          text: saResult.text,
+          usage: saResult.usage,
+          name: saResult.name,
+          trace: saResult.trace,
+        },
+      });
+      res.end();
+    } catch (e) {
+      appendSuperAgentErrorTrace(req, e, {
+        prompt,
+        channel: ctx.channel,
+        previousMessages,
+        model,
+        stream: true,
+      });
+      send({
+        type: "error",
+        trace_id: req.apxTraceId,
+        error: `${e.message} (trace: ${req.apxTraceId})`,
+      });
+      res.end();
+    }
+  });
+
+  // Project-agnostic one-shot summarize endpoint. Used by `apx session resume
+  // <id>` when the session lives outside any registered APX project (e.g. a
+  // raw Claude/Codex session). Returns { text } so callers can format the
+  // summary however they want.
+  app.post("/super-agent/summarize", async (req, res) => {
+    const { prompt, context_note: contextNote = "", model, max_tokens } = req.body || {};
+    if (!prompt) return res.status(400).json({ error: "prompt required" });
+    try {
+      const saResult = await runSuperAgent({
+        globalConfig: config,
+        projects,
+        plugins,
+        registries,
+        prompt,
+        contextNote,
+        channel: "api",
+        overrideModel: model,
+        maxTokens:
+          max_tokens && Number.isFinite(Number(max_tokens))
+            ? Number(max_tokens)
+            : undefined,
+        // Summaries are pure text — no tool registry, so a transcript that
+        // mentions a tool (telegram, etc.) can't trigger a real side effect.
+        noTools: true,
+      });
+      res.json({
+        text: saResult.text,
+        usage: saResult.usage,
+        name: saResult.name,
+      });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  app.post("/projects/:pid/super-agent/chat", async (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const { prompt, previousMessages, model } = req.body || {};
+    if (!prompt) return res.status(400).json({ error: "prompt required" });
+    const ctx = resolveSuperAgentContext(req, p);
+    try {
+      const saResult = await runSuperAgent({
+        globalConfig: config,
+        projects,
+        plugins,
+        registries,
+        prompt,
+        channel: ctx.channel,
+        channelMeta: ctx.channelMeta,
+        contextNote: ctx.contextNote,
+        previousMessages: previousMessages || [],
+        overrideModel: model,
+        onEvent: wrapOnEventForLog(null, {
+          trace_id: req.apxTraceId,
+          channel: ctx.channel,
+        }),
+      });
+      projects.rebuild(p.id);
+      logWebTurn(ctx.channel, { prompt, replyText: saResult.text });
+      res.json({
+        text: saResult.text,
+        usage: saResult.usage,
+        name: saResult.name,
+        trace: saResult.trace,
+      });
+    } catch (e) {
+      appendSuperAgentErrorTrace(req, e, {
+        prompt,
+        channel: ctx.channel,
+        previousMessages,
+        model,
+        stream: false,
+      });
+      res.status(500).json({ error: e.message, trace_id: req.apxTraceId });
+    }
+  });
+}

package/src/host/daemon/api/tasks.js

@@ -0,0 +1,118 @@
+// Per-project tasks (TODOs). Backed by core/tasks-store.js (JSONL event log).
+//   GET    /projects/:pid/tasks                  ?state=open|done|dropped|all&tag=X&agent=Y&due_before=ISO&limit=N
+//   POST   /projects/:pid/tasks                  { title, body?, tags?, due?, agent?, source?, meta? }
+//   GET    /projects/:pid/tasks/:id              (id or prefix)
+//   PATCH  /projects/:pid/tasks/:id              { patch: {...} }
+//   POST   /projects/:pid/tasks/:id/done         { by? }
+//   POST   /projects/:pid/tasks/:id/drop         { by? }
+//   POST   /projects/:pid/tasks/:id/reopen
+import {
+  createTask,
+  listTasks,
+  getTask,
+  patchTask,
+  doneTask,
+  dropTask,
+  reopenTask,
+  countTasks,
+} from "../../../core/tasks-store.js";
+
+export function register(app, { project, projects }) {
+  // Global tasks across every project.
+  app.get("/tasks", (req, res) => {
+    const state = req.query.state || "open";
+    const out = [];
+    for (const entry of projects.list()) {
+      const p = projects.get(entry.id);
+      if (!p) continue;
+      let tasks = [];
+      try {
+        tasks = listTasks(p.storagePath, {
+          state: state === "all" ? undefined : state,
+          limit: 500,
+        });
+      } catch { /* skip project */ }
+      for (const t of tasks) out.push({ ...t, project_id: entry.id, project_name: entry.name || entry.path });
+    }
+    res.json(out);
+  });
+
+  app.get("/projects/:pid/tasks", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const { state, tag, agent, due_before, due_after, limit } = req.query;
+    const out = listTasks(p.storagePath, {
+      state: state || undefined,
+      tag: tag || undefined,
+      agent: agent || undefined,
+      due_before: due_before || undefined,
+      due_after: due_after || undefined,
+      limit: limit ? Math.min(parseInt(limit, 10) || 0, 1000) : undefined,
+    });
+    res.json(out);
+  });
+
+  app.post("/projects/:pid/tasks", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    try {
+      const task = createTask(p.storagePath, req.body || {});
+      res.status(201).json(task);
+    } catch (e) {
+      res.status(400).json({ error: e.message });
+    }
+  });
+
+  app.get("/projects/:pid/tasks/:id", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const task = getTask(p.storagePath, req.params.id);
+    if (!task) return res.status(404).json({ error: "task not found" });
+    res.json(task);
+  });
+
+  app.patch("/projects/:pid/tasks/:id", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const { patch } = req.body || {};
+    if (!patch || typeof patch !== "object") {
+      return res.status(400).json({ error: "patch object required" });
+    }
+    const updated = patchTask(p.storagePath, req.params.id, patch);
+    if (!updated) return res.status(404).json({ error: "task not found" });
+    res.json(updated);
+  });
+
+  app.post("/projects/:pid/tasks/:id/done", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const { by = null } = req.body || {};
+    const updated = doneTask(p.storagePath, req.params.id, by);
+    if (!updated) return res.status(404).json({ error: "task not found" });
+    res.json(updated);
+  });
+
+  app.post("/projects/:pid/tasks/:id/drop", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const { by = null } = req.body || {};
+    const updated = dropTask(p.storagePath, req.params.id, by);
+    if (!updated) return res.status(404).json({ error: "task not found" });
+    res.json(updated);
+  });
+
+  app.post("/projects/:pid/tasks/:id/reopen", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const updated = reopenTask(p.storagePath, req.params.id);
+    if (!updated) return res.status(404).json({ error: "task not found" });
+    res.json(updated);
+  });
+
+  // Lightweight summary endpoint for status displays.
+  app.get("/projects/:pid/tasks-summary", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    res.json(countTasks(p.storagePath));
+  });
+}

package/src/host/daemon/api/telegram.js

@@ -0,0 +1,325 @@
+// Telegram plugin endpoints. Every route 503s if the plugin isn't loaded.
+//   GET    /telegram/status
+//   POST   /telegram/start
+//   POST   /telegram/stop
+//   POST   /telegram/send         { chat_id?, text, channel? }
+//   POST   /telegram/send_photo   { chat_id?, photo, caption?, parse_mode?, channel? }
+//   POST   /telegram/send_voice   { chat_id?, audio, caption?, duration?, channel? }
+//   POST   /telegram/send_audio   { chat_id?, audio, caption?, title?, performer?, channel? }
+//   POST   /telegram/notify       (alias of /telegram/send; daemon-initiated pushes)
+//
+//   GET    /telegram/channels                         — list configured channels
+//   POST   /telegram/channels    { name, ... }        — create or replace one channel
+//   PATCH  /telegram/channels/:name { ...fields }     — patch (set/unset via null)
+//   DELETE /telegram/channels/:name                   — remove channel
+//
+//   GET    /telegram/contacts                          — roster + roles + channel owners
+//   PATCH  /telegram/contacts/:user_id { role, ... }   — set role/name/note
+//   DELETE /telegram/contacts/:user_id                 — remove a contact
+//   GET    /telegram/roles                             — role → {tools} map
+//   PUT    /telegram/roles/:name { tools }             — define/replace a role
+//   DELETE /telegram/roles/:name                       — remove a custom role
+//   (channel owner is set via PATCH /telegram/channels/:name { owner_user_id })
+//
+// The CRUD endpoints edit ~/.apx/config.json directly and DO NOT auto-reload
+// the running plugin. Callers should POST /admin/reload afterwards.
+import {
+  readConfig,
+  listTelegramChannels,
+  findTelegramChannel,
+  upsertTelegramChannel,
+  removeTelegramChannel,
+  unsetTelegramChannelFields,
+  listContacts,
+  findContact,
+  upsertContact,
+  removeContact,
+  listRoles,
+  setRole,
+  removeRole,
+} from "../../../core/config.js";
+
+function redactChannel(channel) {
+  if (!channel?.bot_token) return channel;
+  return {
+    ...channel,
+    bot_token: `*** set *** (...${String(channel.bot_token).slice(-5)})`,
+  };
+}
+
+function isSecretMarker(value) {
+  return typeof value === "string" && value.startsWith("*** set ***");
+}
+
+export function register(app, { telegram }) {
+  app.get("/telegram/status", (_req, res) => {
+    if (!telegram) return res.json({ enabled: false, channels: [] });
+    res.json(telegram.status());
+  });
+
+  app.post("/telegram/start", (_req, res) => {
+    if (!telegram)
+      return res.status(503).json({ error: "telegram plugin not loaded" });
+    try {
+      telegram.start();
+      res.json({ ok: true, status: telegram.status() });
+    } catch (e) {
+      res.status(502).json({ error: e.message });
+    }
+  });
+
+  app.post("/telegram/stop", (_req, res) => {
+    if (!telegram)
+      return res.status(503).json({ error: "telegram plugin not loaded" });
+    try {
+      telegram.stop();
+      res.json({ ok: true, status: telegram.status() });
+    } catch (e) {
+      res.status(502).json({ error: e.message });
+    }
+  });
+
+  app.post("/telegram/send", async (req, res) => {
+    const { chat_id, text, channel } = req.body || {};
+    if (!text) return res.status(400).json({ error: "text required" });
+    if (!telegram)
+      return res.status(503).json({ error: "telegram plugin not loaded" });
+    try {
+      const r = await telegram.send({ chat_id, text, channel });
+      res.status(202).json({ ok: true, message_id: r.message_id });
+    } catch (e) {
+      res.status(502).json({ error: e.message });
+    }
+  });
+
+  app.post("/telegram/send_photo", async (req, res) => {
+    const { chat_id, photo, caption, parse_mode, channel } = req.body || {};
+    if (!photo)
+      return res.status(400).json({ error: "photo required (path or url)" });
+    if (!telegram)
+      return res.status(503).json({ error: "telegram plugin not loaded" });
+    try {
+      const r = await telegram.sendPhoto({
+        chat_id,
+        photo,
+        caption,
+        parse_mode,
+        channel,
+      });
+      res.status(202).json({ ok: true, message_id: r?.message_id });
+    } catch (e) {
+      res.status(502).json({ error: e.message });
+    }
+  });
+
+  app.post("/telegram/send_voice", async (req, res) => {
+    const { chat_id, audio, caption, duration, channel } = req.body || {};
+    if (!audio) return res.status(400).json({ error: "audio required (path)" });
+    if (!telegram)
+      return res.status(503).json({ error: "telegram plugin not loaded" });
+    try {
+      const r = await telegram.sendVoice({
+        chat_id,
+        audio,
+        caption,
+        duration,
+        channel,
+      });
+      res.status(202).json({ ok: true, message_id: r?.message_id });
+    } catch (e) {
+      res.status(502).json({ error: e.message });
+    }
+  });
+
+  app.post("/telegram/send_audio", async (req, res) => {
+    const { chat_id, audio, caption, title, performer, channel } =
+      req.body || {};
+    if (!audio) return res.status(400).json({ error: "audio required (path)" });
+    if (!telegram)
+      return res.status(503).json({ error: "telegram plugin not loaded" });
+    try {
+      const r = await telegram.sendAudio({
+        chat_id,
+        audio,
+        caption,
+        title,
+        performer,
+        channel,
+      });
+      res.status(202).json({ ok: true, message_id: r?.message_id });
+    } catch (e) {
+      res.status(502).json({ error: e.message });
+    }
+  });
+
+  // ── Channel CRUD (config-only; caller must POST /admin/reload to apply) ──
+  // We read fresh config from disk on each call so concurrent writes from the
+  // CLI and the daemon don't clobber one another via stale closures.
+  app.get("/telegram/channels", (_req, res) => {
+    try {
+      const cfg = readConfig();
+      res.json({ channels: listTelegramChannels(cfg).map(redactChannel) });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  app.post("/telegram/channels", (req, res) => {
+    const body = req.body || {};
+    if (!body.name || typeof body.name !== "string") {
+      return res.status(400).json({ error: "name required" });
+    }
+    try {
+      const cfg = readConfig();
+      const existing = findTelegramChannel(cfg, body.name);
+      const patch = { ...body };
+      if (existing?.bot_token && (patch.bot_token === undefined || isSecretMarker(patch.bot_token))) {
+        patch.bot_token = existing.bot_token;
+      }
+      const result = upsertTelegramChannel(cfg, body.name, patch);
+      res.status(result.created ? 201 : 200).json({ ...result, channel: redactChannel(result.channel) });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  app.patch("/telegram/channels/:name", (req, res) => {
+    const { name } = req.params;
+    const body = req.body || {};
+    try {
+      const cfg = readConfig();
+      const existing = findTelegramChannel(cfg, name);
+      if (!existing) return res.status(404).json({ error: `no channel: ${name}` });
+      // null in the patch means "unset that field".
+      const unset = Object.entries(body)
+        .filter(([, v]) => v === null)
+        .map(([k]) => k);
+      const setPatch = Object.fromEntries(
+        Object.entries(body).filter(([, v]) => v !== null)
+      );
+      if (existing?.bot_token && (setPatch.bot_token === undefined || isSecretMarker(setPatch.bot_token))) {
+        delete setPatch.bot_token;
+      }
+      if (Object.keys(setPatch).length > 0) {
+        upsertTelegramChannel(cfg, name, setPatch);
+      }
+      if (unset.length > 0) {
+        unsetTelegramChannelFields(cfg, name, unset);
+      }
+      res.json({ ok: true, channel: redactChannel(findTelegramChannel(cfg, name)) });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  app.delete("/telegram/channels/:name", (req, res) => {
+    const { name } = req.params;
+    try {
+      const cfg = readConfig();
+      const { removed } = removeTelegramChannel(cfg, name);
+      if (!removed) return res.status(404).json({ error: `no channel: ${name}` });
+      res.json({ ok: true, removed });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  // ── Contacts roster (global; keyed by Telegram user_id) ─────────────────
+  // Identity of a person is global; per-channel owner_user_id marks who owns a
+  // channel. These edit ~/.apx/config.json directly; the running poller picks
+  // changes up on its next inbound message (it re-reads config per message), so
+  // no /admin/reload is required for contact/role edits.
+  app.get("/telegram/contacts", (_req, res) => {
+    try {
+      const cfg = readConfig();
+      res.json({
+        contacts: listContacts(cfg),
+        roles: listRoles(cfg),
+        channel_owners: listTelegramChannels(cfg).map((c) => ({
+          name: c.name,
+          owner_user_id: c.owner_user_id ?? null,
+        })),
+      });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  app.patch("/telegram/contacts/:user_id", (req, res) => {
+    const { user_id } = req.params;
+    const body = req.body || {};
+    try {
+      const cfg = readConfig();
+      const patch = {};
+      for (const k of ["name", "username", "role", "note"]) {
+        if (body[k] !== undefined) patch[k] = body[k];
+      }
+      if (Object.keys(patch).length === 0) {
+        return res.status(400).json({ error: "nothing to update (name/username/role/note)" });
+      }
+      const { created, contact } = upsertContact(cfg, user_id, patch);
+      res.status(created ? 201 : 200).json({ ok: true, created, contact });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  app.delete("/telegram/contacts/:user_id", (req, res) => {
+    const { user_id } = req.params;
+    try {
+      const cfg = readConfig();
+      const { removed } = removeContact(cfg, user_id);
+      if (!removed) return res.status(404).json({ error: `no contact: ${user_id}` });
+      res.json({ ok: true, removed });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  // ── Roles (role → { tools }) ────────────────────────────────────────────
+  app.get("/telegram/roles", (_req, res) => {
+    try {
+      res.json({ roles: listRoles(readConfig()) });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  app.put("/telegram/roles/:name", (req, res) => {
+    const { name } = req.params;
+    const body = req.body || {};
+    try {
+      const tools = body.tools === "*" || Array.isArray(body.tools) ? body.tools : [];
+      const cfg = readConfig();
+      const role = setRole(cfg, name, { tools });
+      res.json({ ok: true, name, role });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  app.delete("/telegram/roles/:name", (req, res) => {
+    const { name } = req.params;
+    try {
+      const { removed } = removeRole(readConfig(), name);
+      if (!removed) return res.status(404).json({ error: `no role: ${name}` });
+      res.json({ ok: true, removed });
+    } catch (e) {
+      res.status(400).json({ error: e.message });
+    }
+  });
+
+  // Alias for proactive daemon-initiated pushes (routines, error handlers, …).
+  app.post("/telegram/notify", async (req, res) => {
+    const { chat_id, text, channel } = req.body || {};
+    if (!text) return res.status(400).json({ error: "text required" });
+    if (!telegram)
+      return res.status(503).json({ error: "telegram plugin not loaded" });
+    try {
+      const r = await telegram.send({ chat_id, text, channel });
+      res.status(202).json({ ok: true, message_id: r.message_id, via: "notify" });
+    } catch (e) {
+      res.status(502).json({ error: e.message });
+    }
+  });
+}

package/src/host/daemon/api/tools.js

@@ -0,0 +1,21 @@
+// Tool routers — every adapter lives in core/tools/. Mount order matters:
+//   fetch  = native HTTP, no Chromium       → cheap default for REST/HTML
+//   browser = Puppeteer-backed              → heavy, lazy-launched, JS-rendered
+//   search / glob / grep                    → filesystem-bounded
+//   registry                                → /:name wildcard, MOUNT LAST so it
+//                                             doesn't shadow the specific paths
+import { buildBrowserRouter } from "../../../core/tools/browser.js";
+import { buildFetchRouter } from "../../../core/tools/fetch.js";
+import { buildSearchRouter } from "../../../core/tools/search.js";
+import { buildRegistryRouter } from "../../../core/tools/registry.js";
+import { buildGlobRouter } from "../../../core/tools/glob.js";
+import { buildGrepRouter } from "../../../core/tools/grep.js";
+
+export function register(app, { express, projects, registries }) {
+  app.use("/tools/fetch", buildFetchRouter(express));
+  app.use("/tools/browser", buildBrowserRouter(express));
+  app.use("/tools/search", buildSearchRouter(express));
+  app.use("/tools/glob", buildGlobRouter(express));
+  app.use("/tools/grep", buildGrepRouter(express));
+  app.use("/tools", buildRegistryRouter(express, { projects, registries }));
+}