@agentprojectcontext/apx 1.25.0 → 1.27.2

package/src/host/daemon/api/sessions-search.js

@@ -0,0 +1,177 @@
+// Cross-agent, cross-conversation session search + global compact-by-id.
+//   GET  /sessions/search?q=…&project=…&limit=20
+//   POST /sessions/:id/compact     resolves which project/agent owns the file
+//                                  then delegates to compactConversation.
+import fs from "node:fs";
+import path from "node:path";
+import { readAgents } from "../../../core/parser.js";
+import { compactConversation } from "../compact.js";
+
+export function register(app, { projects, config }) {
+  app.get("/sessions/search", (req, res) => {
+    const { q, project: projectRef, limit = "20" } = req.query;
+    if (!q) return res.status(400).json({ error: "q required" });
+    const lim = Math.min(parseInt(limit, 10) || 20, 200);
+    const needle = q.toLowerCase();
+
+    const allProjects = projects.list();
+    const targetProjects = (() => {
+      if (projectRef != null) {
+        const ref = String(projectRef);
+        const found = allProjects.find(
+          (p) => String(p.id) === ref || p.path === path.resolve(ref)
+        );
+        return found ? [projects.get(found.id)] : [];
+      }
+      return allProjects.map((p) => projects.get(p.id)).filter(Boolean);
+    })();
+
+    const matches = [];
+
+    for (const p of targetProjects) {
+      if (!p) continue;
+
+      // 1) Session files in the repo (.apc/agents/<slug>/sessions/)
+      const sessionAgentsDir = path.join(p.path, ".apc", "agents");
+      if (fs.existsSync(sessionAgentsDir)) {
+        for (const slug of fs.readdirSync(sessionAgentsDir)) {
+          const sessionsDir = path.join(sessionAgentsDir, slug, "sessions");
+          if (!fs.existsSync(sessionsDir)) continue;
+          for (const f of fs
+            .readdirSync(sessionsDir)
+            .filter((x) => x.endsWith(".md"))) {
+            const filePath = path.join(sessionsDir, f);
+            try {
+              const text = fs.readFileSync(filePath, "utf8");
+              if (text.toLowerCase().includes(needle)) {
+                const lines = text.split("\n");
+                const matchLine = lines.findIndex((l) =>
+                  l.toLowerCase().includes(needle)
+                );
+                const excerpt = lines
+                  .slice(Math.max(0, matchLine - 1), matchLine + 3)
+                  .join("\n");
+                matches.push({
+                  type: "session",
+                  project: p.id,
+                  agent: slug,
+                  filename: f,
+                  path: filePath,
+                  excerpt: excerpt.slice(0, 300),
+                });
+                if (matches.length >= lim) break;
+              }
+            } catch {}
+          }
+          if (matches.length >= lim) break;
+        }
+      }
+
+      if (matches.length >= lim) break;
+
+      // 2) Conversation files in daemon storage (~/.apx/…/conversations/)
+      const convAgentsDir = path.join(p.storagePath, "agents");
+      if (fs.existsSync(convAgentsDir)) {
+        for (const slug of fs.readdirSync(convAgentsDir)) {
+          const convDir = path.join(convAgentsDir, slug, "conversations");
+          if (!fs.existsSync(convDir)) continue;
+          for (const f of fs
+            .readdirSync(convDir)
+            .filter((x) => x.endsWith(".md"))) {
+            const filePath = path.join(convDir, f);
+            try {
+              const text = fs.readFileSync(filePath, "utf8");
+              if (text.toLowerCase().includes(needle)) {
+                const lines = text.split("\n");
+                const matchLine = lines.findIndex((l) =>
+                  l.toLowerCase().includes(needle)
+                );
+                const excerpt = lines
+                  .slice(Math.max(0, matchLine - 1), matchLine + 3)
+                  .join("\n");
+                matches.push({
+                  type: "conversation",
+                  project: p.id,
+                  agent: slug,
+                  filename: f,
+                  path: filePath,
+                  excerpt: excerpt.slice(0, 300),
+                });
+                if (matches.length >= lim) break;
+              }
+            } catch {}
+          }
+          if (matches.length >= lim) break;
+        }
+      }
+
+      if (matches.length >= lim) break;
+    }
+
+    res.json({ q, count: matches.length, results: matches });
+  });
+
+  app.post("/sessions/:id/compact", async (req, res) => {
+    const { id } = req.params;
+    const { model: modelOverride, project: projectRef } = req.body || {};
+
+    const candidates =
+      projectRef != null
+        ? (() => {
+            const ref = String(projectRef);
+            const found = projects
+              .list()
+              .find(
+                (p) => String(p.id) === ref || p.path === path.resolve(ref)
+              );
+            return found ? [projects.get(found.id)] : [];
+          })()
+        : projects.list().map((p) => projects.get(p.id)).filter(Boolean);
+
+    let found = null;
+    const filename = id.endsWith(".md") ? id : `${id}.md`;
+
+    for (const p of candidates) {
+      if (!p) continue;
+      const agentsDir = path.join(p.storagePath, "agents");
+      if (fs.existsSync(agentsDir)) {
+        for (const slug of fs.readdirSync(agentsDir)) {
+          const f = path.join(agentsDir, slug, "conversations", filename);
+          if (fs.existsSync(f)) {
+            found = { p, slug };
+            break;
+          }
+        }
+      }
+      if (found) break;
+    }
+
+    if (!found) {
+      return res
+        .status(404)
+        .json({ error: `session/conversation "${id}" not found` });
+    }
+
+    const { p, slug } = found;
+    const agents = readAgents(p.path);
+    const agent = agents.find((a) => a.slug === slug);
+    const modelId = modelOverride || agent?.fields?.Model;
+    if (!modelId)
+      return res
+        .status(400)
+        .json({ error: "agent has no model; pass model in body" });
+
+    try {
+      const result = await compactConversation({
+        storagePath: p.storagePath,
+        agentSlug: slug,
+        filename,
+        modelId,
+        config: p.config || config,
+      });
+      res.json(result);
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+}

package/src/host/daemon/api/sessions.js

@@ -0,0 +1,115 @@
+// Per-agent session files (.apc-style markdown, lives under storagePath).
+//   GET  /projects/:pid/agents/:slug/sessions
+//   POST /projects/:pid/agents/:slug/sessions      { title, body? }
+//   GET  /projects/:pid/sessions/:sid              by filename (cross-agent lookup)
+import fs from "node:fs";
+import path from "node:path";
+import { parseSessionFrontmatter, readAgents } from "../../../core/parser.js";
+import { collectAllSessions } from "../../../interfaces/cli/commands/sessions.js";
+import { nowIso } from "./shared.js";
+
+export function register(app, { projects, project }) {
+  // Cross-engine sessions (apx · claude · codex), newest first.
+  app.get("/sessions", (req, res) => {
+    const engineId = req.query.engine ? String(req.query.engine) : null;
+    const limit = Math.min(parseInt(req.query.limit, 10) || 200, 1000);
+    let rows = [];
+    try {
+      rows = collectAllSessions({}, { engineId });
+    } catch (e) {
+      return res.status(500).json({ error: e.message, sessions: [] });
+    }
+    rows.sort((a, b) => (b.mtime || 0) - (a.mtime || 0));
+    res.json({ sessions: rows.slice(0, limit) });
+  });
+
+  app.get("/projects/:pid/agents/:slug/sessions", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const agents = readAgents(p.path);
+    if (!agents.find((a) => a.slug === req.params.slug))
+      return res.status(404).json({ error: "agent not found" });
+    const sessionsDir = path.join(
+      p.storagePath,
+      "agents",
+      req.params.slug,
+      "sessions"
+    );
+    if (!fs.existsSync(sessionsDir)) return res.json([]);
+    const sessions = fs
+      .readdirSync(sessionsDir)
+      .filter((f) => f.endsWith(".md"))
+      .sort()
+      .reverse()
+      .map((f) => {
+        const text = fs.readFileSync(path.join(sessionsDir, f), "utf8");
+        const fm = parseSessionFrontmatter(text);
+        const titleFromFile = f
+          .replace(/^\d{4}-\d{2}-\d{2}-/, "")
+          .replace(/\.md$/, "");
+        return {
+          filename: f,
+          title: fm.title || titleFromFile,
+          started_at: fm.started || null,
+          ended_at: fm.ended || null,
+        };
+      });
+    res.json(sessions);
+  });
+
+  app.post("/projects/:pid/agents/:slug/sessions", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const { title, body = "" } = req.body || {};
+    if (!title) return res.status(400).json({ error: "title required" });
+    const sessionsDir = path.join(
+      p.storagePath,
+      "agents",
+      req.params.slug,
+      "sessions"
+    );
+    fs.mkdirSync(sessionsDir, { recursive: true });
+    const titleSlug =
+      title
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-|-$/g, "") || "session";
+    const today = new Date().toISOString().slice(0, 10);
+    let candidate = path.join(sessionsDir, `${today}-${titleSlug}.md`);
+    let n = 2;
+    while (fs.existsSync(candidate)) {
+      candidate = path.join(sessionsDir, `${today}-${titleSlug}-${n}.md`);
+      n++;
+    }
+    const started = nowIso();
+    const content = `---\ntitle: ${title}\nstarted: ${started}\n---\n\n# ${title}\n\n${body}\n`;
+    fs.writeFileSync(candidate, content);
+    projects.rebuild(p.id);
+    res
+      .status(201)
+      .json({ filename: path.basename(candidate), path: candidate });
+  });
+
+  // GET session by filename (sid may include or omit the .md extension)
+  app.get("/projects/:pid/sessions/:sid", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const sid = req.params.sid;
+    const filename = sid.endsWith(".md") ? sid : `${sid}.md`;
+    const agentsDir = path.join(p.storagePath, "agents");
+    let found = null;
+    if (fs.existsSync(agentsDir)) {
+      for (const slug of fs.readdirSync(agentsDir)) {
+        const f = path.join(agentsDir, slug, "sessions", filename);
+        if (fs.existsSync(f)) {
+          const text = fs.readFileSync(f, "utf8");
+          const fm = parseSessionFrontmatter(text);
+          found = { filename, agent: slug, ...fm, body_md: text };
+          break;
+        }
+      }
+    }
+    if (!found) return res.status(404).json({ error: "session not found" });
+    res.json(found);
+  });
+}

package/src/host/daemon/api/shared.js

@@ -0,0 +1,217 @@
+// Shared helpers used by every API route module.
+//
+// These were inlined in api.js (monolith). They are kept dependency-free so
+// any route module can `import` them without pulling in the world.
+import fs from "node:fs";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+import { appendErrorTrace, previewText } from "../../../core/logging.js";
+
+export const nowIso = () =>
+  new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
+
+// Trace id middleware — populates req.apxTraceId and echoes it on the response.
+export function traceIdMiddleware(req, res, next) {
+  req.apxTraceId = req.get("x-apx-trace-id") || randomUUID();
+  res.setHeader("x-apx-trace-id", req.apxTraceId);
+  next();
+}
+
+// Paths that bypass auth: /health for liveness probes, /pair/* so a fresh
+// client can bootstrap a token without already having one, and
+// /admin/web-token so the local same-origin admin panel can self-bootstrap.
+// /pair/init and /admin/web-token both enforce localhost-only checks of
+// their own — the auth middleware just gets out of their way.
+const UNAUTHENTICATED_PREFIXES = ["/health", "/pair/", "/admin/web-token"];
+// API prefixes that MUST stay authenticated. Anything not in this list,
+// requested with GET, is treated as a static SPA asset (HTML/CSS/JS/font)
+// or a client-router path and served without auth — the bundle itself
+// fetches /admin/web-token to obtain a bearer for the subsequent API
+// calls. This is safe because all data-bearing routes start with one of
+// the API prefixes below.
+const API_PREFIXES = [
+  "/health", "/admin", "/projects", "/telegram", "/engines", "/runtimes",
+  "/messages", "/sessions", "/tools", "/mcp", "/voice", "/tts", "/desktop", "/overlay",
+  "/transcribe", "/run", "/files", "/memory", "/env", "/pair", "/deck",
+  "/super-agent", "/identity", "/agents", "/tasks",
+];
+function isApiPath(p) {
+  for (const prefix of API_PREFIXES) {
+    if (p === prefix || p.startsWith(prefix + "/")) return true;
+  }
+  return false;
+}
+function isUnauthenticatedPath(p, method = "GET") {
+  if (p === "/health") return true;
+  if (p === "/admin/web-token") return true;
+  for (const prefix of UNAUTHENTICATED_PREFIXES) {
+    if (p === prefix.replace(/\/$/, "") || p.startsWith(prefix)) return true;
+  }
+  // GET requests that don't hit an API prefix are SPA assets / client-router
+  // paths; let them through so the admin bundle can load before it has a
+  // bearer.
+  if (method === "GET" && !isApiPath(p)) return true;
+  return false;
+}
+
+// Bearer-token auth.
+//
+// Accepts either:
+//   - a string (legacy: single master token), or
+//   - a tokenStore { has(token), touch?(token) } from token-store.js
+//
+// The tokenStore form lets multiple paired clients each carry their own
+// token. The middleware does an O(1) Set check and best-effort updates
+// last_seen.
+export function buildAuthMiddleware(tokenOrStore) {
+  const isStore = tokenOrStore && typeof tokenOrStore === "object" && typeof tokenOrStore.has === "function";
+  return (req, res, next) => {
+    if (isUnauthenticatedPath(req.path, req.method)) return next();
+    const auth = req.get("authorization") || "";
+    const provided = auth.startsWith("Bearer ") ? auth.slice(7) : "";
+    const ok = isStore ? tokenOrStore.has(provided) : provided === tokenOrStore;
+    if (!ok) return res.status(401).json({ error: "unauthorized" });
+    if (isStore && typeof tokenOrStore.touch === "function") {
+      try { tokenOrStore.touch(provided); } catch {}
+    }
+    next();
+  };
+}
+
+// Resolve a project by `:pid` and 404 if missing.
+export function makeProjectResolver(projects) {
+  return function project(req, res) {
+    const p = projects.get(req.params.pid);
+    if (!p) {
+      res.status(404).json({ error: "project not found" });
+      return null;
+    }
+    return p;
+  };
+}
+
+// Resolve a "top-level" project for routes that don't carry :pid:
+// /memory, /files, /mcp, /mcp/run.
+// Strategy: explicit ?project= wins; otherwise pick the first non-default
+// project; if none, fall back to id=0 (super-agent default workspace).
+export function makeTopProjectResolver(projects) {
+  return function resolveTopProject(query) {
+    const ref = query?.project;
+    if (ref !== undefined && ref !== null) {
+      const all = projects.list();
+      const r = String(ref);
+      return projects.get(
+        all.find((p) => String(p.id) === r || p.path === path.resolve(r))?.id
+      );
+    }
+    const all = projects.list().filter((p) => p.id !== 0);
+    return all.length ? projects.get(all[0].id) : projects.get(0);
+  };
+}
+
+// Pick the memory.md to use when /memory is called without an agent ref.
+// Prefer the first .apc/agents/<slug>/memory.md; else .apc/memory.md.
+export function resolveMemoryPath(p) {
+  const agentsDir = path.join(p.path, ".apc", "agents");
+  if (fs.existsSync(agentsDir)) {
+    const slugs = fs.readdirSync(agentsDir).filter((s) =>
+      fs.statSync(path.join(agentsDir, s)).isDirectory()
+    );
+    if (slugs.length) return path.join(agentsDir, slugs[0], "memory.md");
+  }
+  return path.join(p.path, ".apc", "memory.md");
+}
+
+// Channel context passed to the super-agent loop. `api` is the default when
+// the caller didn't explicitly set channel/channelMeta.
+export function resolveSuperAgentContext(req, project) {
+  const { channel, channelMeta, contextNote } = req.body || {};
+  if (channel) {
+    const meta =
+      channelMeta && typeof channelMeta === "object" ? channelMeta : {};
+    // Always anchor the meta to the resolved project so the super-agent prompt
+    // can load this project's AGENTS.md (buildProjectAgentsBlock). Caller-set
+    // values win.
+    return {
+      channel,
+      channelMeta: {
+        projectId: String(project.id),
+        projectName: project.name,
+        projectPath: project.path,
+        ...meta,
+      },
+      contextNote: contextNote || "",
+    };
+  }
+  return {
+    channel: "api",
+    channelMeta: {
+      projectId: String(project.id),
+      projectName: project.name,
+      projectPath: project.path,
+    },
+    contextNote: contextNote || "",
+  };
+}
+
+// Persist an error trace from a super-agent endpoint into ~/.apx/logs.
+export function appendSuperAgentErrorTrace(req, error, details = {}) {
+  appendErrorTrace({
+    trace_id: req.apxTraceId,
+    surface: "daemon_api",
+    route: `${req.method} ${req.route?.path || req.path}`,
+    project_id: req.params?.pid || null,
+    channel: details.channel || null,
+    model: details.model || null,
+    stream: !!details.stream,
+    prompt_preview: previewText(details.prompt),
+    previous_messages: Array.isArray(details.previousMessages)
+      ? details.previousMessages.length
+      : 0,
+    error: {
+      message: error?.message || String(error),
+      stack: error?.stack || null,
+    },
+  });
+}
+
+// Shape an agent's parsed fields into the API response shape.
+export function agentToResponse(a) {
+  if (!a) return null;
+  const f = a.fields || {};
+  const reserved = new Set([
+    "Role",
+    "Model",
+    "Language",
+    "Description",
+    "Skills",
+    "Tools",
+    "Master",
+    "Primary",
+    "Parent",
+    "Type",
+    "Area",
+  ]);
+  const extra = {};
+  for (const [k, v] of Object.entries(f)) {
+    if (!reserved.has(k)) extra[k] = v;
+  }
+  return {
+    slug: a.slug,
+    role: f.Role || null,
+    model: f.Model || null,
+    language: f.Language || null,
+    description: f.Description || null,
+    is_master: String(f.Master || f.Primary || "").toLowerCase() === "true",
+    // Orchestrator → subagent link. Lives in APC (AGENT.md frontmatter), so it
+    // travels with the project and is diffable. Runtime state stays in ~/.apx.
+    parent: f.Parent || null,
+    // Typology (specialist/assistant/orchestrator/worker/monitor) + area. Both
+    // definitional, kept in APC frontmatter.
+    type: f.Type || null,
+    area: f.Area || null,
+    skills: Array.isArray(f.Skills) ? f.Skills : [],
+    tools: Array.isArray(f.Tools) ? f.Tools : [],
+    extra,
+  };
+}