@agentprojectcontext/apx 1.31.2 → 1.32.2

package/src/host/daemon/api/agents.js

@@ -6,44 +6,23 @@
 //   PUT  /projects/:pid/agents/:slug/memory
 import fs from "node:fs";
 import path from "node:path";
-import { readAgents, readVaultAgents, readVaultAgent } from "../../../core/parser.js";
+import { readAgents, readVaultAgents, readVaultAgent } from "#core/apc/parser.js";
 import {
   writeAgentFile,
   writeVaultAgentFile,
   removeVaultAgent,
   restoreVaultAgent,
   ensureAgentDir,
-} from "../../../core/scaffold.js";
+} from "#core/apc/scaffold.js";
 import {
   ensureAgentRuntimeDir,
   readAgentMemory,
   writeAgentMemory,
   agentMemoryPath,
   legacyAgentMemoryPath,
-} from "../../../core/agent-memory.js";
+} from "#core/agent/memory.js";
 import { agentToResponse } from "./shared.js";
-
-// Lowercase the patch keys we accept on the vault and turn skills/tools into
-// arrays. The writer takes either case but normalizes; passing this through
-// it keeps the on-disk format consistent.
-const VAULT_PATCH_FIELDS = ["role", "model", "language", "description", "skills", "tools", "is_master"];
-function normalizeVaultPatch(input = {}) {
-  const out = {};
-  for (const k of VAULT_PATCH_FIELDS) {
-    const lower = k;
-    const title = k.charAt(0).toUpperCase() + k.slice(1);
-    const v = input[lower] ?? input[title];
-    if (v === undefined || v === null) continue;
-    if (k === "skills" || k === "tools") {
-      out[title] = Array.isArray(v)
-        ? v.map(String).map((s) => s.trim()).filter(Boolean)
-        : String(v).split(",").map((s) => s.trim()).filter(Boolean);
-    } else {
-      out[title] = v;
-    }
-  }
-  return out;
-}
+import { normalizeVaultPatch } from "#core/apc/agents-vault.js";
 
 export function register(app, { projects, project }) {
   // Vault = global agent templates. Two-layer: bundled defaults shipped with

package/src/host/daemon/api/artifacts.js

@@ -2,13 +2,92 @@
 //   GET    /projects/:pid/artifacts
 //   POST   /projects/:pid/artifacts
 //   GET    /projects/:pid/artifacts/:name
+//   POST   /projects/:pid/artifacts/:name/run        body: { args?: string[] }
 //   DELETE /projects/:pid/artifacts/:name
+import fs from "node:fs";
+import { spawn } from "node:child_process";
+import path from "node:path";
 import {
+  artifactPath,
   createArtifact,
   listArtifacts,
   readArtifact,
   removeArtifact,
-} from "../../../core/artifacts-store.js";
+} from "#core/stores/artifacts.js";
+
+// Same heuristic as `apx artifact run` (cli/commands/artifact.js): exec bit
+// OR shebang counts as runnable. We auto-chmod when shebang-only so the
+// web Run button "just works" the way it would from the terminal.
+function detectRunnable(absPath) {
+  let stat;
+  try {
+    stat = fs.statSync(absPath);
+  } catch {
+    return { runnable: false, reason: "not_found" };
+  }
+  if (!stat.isFile()) return { runnable: false, reason: "not_a_file" };
+  const execBit = (stat.mode & 0o111) !== 0;
+  let hasShebang = false;
+  try {
+    const fd = fs.openSync(absPath, "r");
+    const buf = Buffer.alloc(2);
+    fs.readSync(fd, buf, 0, 2, 0);
+    fs.closeSync(fd);
+    hasShebang = buf.toString("utf8") === "#!";
+  } catch { /* leave hasShebang = false */ }
+  if (execBit) return { runnable: true, autoChmod: false };
+  if (hasShebang) return { runnable: true, autoChmod: true };
+  return { runnable: false, reason: "no_exec_no_shebang" };
+}
+
+// Cap stdout/stderr captured per run so a runaway script can't blow up the
+// daemon. 256 KiB each — enough for typical script output, small enough to
+// fit in one HTTP response without streaming.
+const MAX_CAPTURE_BYTES = 256 * 1024;
+// Hard timeout for synchronous web execution. Long-running scripts should
+// be invoked from the terminal where the user has direct stdio.
+const RUN_TIMEOUT_MS = 30_000;
+
+function runArtifact({ absPath, cwd, args, timeoutMs = RUN_TIMEOUT_MS }) {
+  return new Promise((resolve) => {
+    const started = Date.now();
+    const child = spawn(absPath, Array.isArray(args) ? args : [], { cwd });
+    let stdout = "";
+    let stderr = "";
+    let truncated = false;
+    let timedOut = false;
+    const cap = (s, chunk) => {
+      if (s.length >= MAX_CAPTURE_BYTES) { truncated = true; return s; }
+      const next = s + chunk.toString("utf8");
+      if (next.length > MAX_CAPTURE_BYTES) { truncated = true; return next.slice(0, MAX_CAPTURE_BYTES); }
+      return next;
+    };
+    child.stdout.on("data", (c) => { stdout = cap(stdout, c); });
+    child.stderr.on("data", (c) => { stderr = cap(stderr, c); });
+    const killer = setTimeout(() => {
+      timedOut = true;
+      try { child.kill("SIGTERM"); } catch { /* ignore */ }
+      setTimeout(() => { try { child.kill("SIGKILL"); } catch { /* ignore */ } }, 1500);
+    }, timeoutMs);
+    child.on("error", (err) => {
+      clearTimeout(killer);
+      resolve({ ok: false, error: err.message, durationMs: Date.now() - started });
+    });
+    child.on("exit", (code, signal) => {
+      clearTimeout(killer);
+      resolve({
+        ok: !timedOut && code === 0,
+        exitCode: code,
+        signal,
+        timedOut,
+        truncated,
+        stdout,
+        stderr,
+        durationMs: Date.now() - started,
+      });
+    });
+  });
+}
 
 export function register(app, { project }) {
   app.get("/projects/:pid/artifacts", (req, res) => {
@@ -49,4 +128,42 @@ export function register(app, { project }) {
     );
     res.status(ok ? 204 : 404).end();
   });
+
+  // Synchronous execute. Web's "Run" button hits this; the terminal CLI uses
+  // its own local spawn (stdio inherited) so it can run interactively. Output
+  // is captured up to MAX_CAPTURE_BYTES and the call is bounded by
+  // RUN_TIMEOUT_MS — anything longer should go through the terminal.
+  app.post("/projects/:pid/artifacts/:name/run", async (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const name = decodeURIComponent(req.params.name);
+    const absPath = artifactPath(p.storagePath, name);
+    if (!fs.existsSync(absPath)) {
+      return res.status(404).json({ error: `artifact "${name}" not found` });
+    }
+    const detection = detectRunnable(absPath);
+    if (!detection.runnable) {
+      return res.status(400).json({
+        error: `artifact "${name}" is not runnable`,
+        reason: detection.reason,
+      });
+    }
+    if (detection.autoChmod) {
+      try {
+        const st = fs.statSync(absPath);
+        fs.chmodSync(absPath, st.mode | 0o111);
+      } catch (e) {
+        return res.status(500).json({ error: `chmod failed: ${e.message}` });
+      }
+    }
+    const args = Array.isArray(req.body?.args)
+      ? req.body.args.filter((a) => typeof a === "string")
+      : [];
+    const result = await runArtifact({
+      absPath,
+      cwd: path.dirname(absPath),
+      args,
+    });
+    res.json(result);
+  });
 }

package/src/host/daemon/api/code.js

@@ -12,9 +12,10 @@
 // stateful: the turn handler rebuilds `previousMessages` from the stored
 // transcript, runs the super-agent on the `code` channel (with plan/build mode
 // + per-mode tool gating), then persists the rich assistant turn.
-import { runSuperAgent } from "../super-agent.js";
+import { runSuperAgent } from "#core/agent/super-agent.js";
 import { appendSuperAgentErrorTrace } from "./shared.js";
-import { createWebConfirmAdapter } from "../../../core/confirmation/adapters/web.js";
+import { createWebConfirmAdapter } from "#core/confirmation/adapters/web.js";
+import { CHANNELS } from "#core/constants/channels.js";
 import {
   listCodeSessions,
   getCodeSession,
@@ -22,9 +23,9 @@ import {
   updateCodeSession,
   removeCodeSession,
   appendTurn,
-} from "../../../core/code-sessions-store.js";
-import { captureBaseline, diffAgainstBaseline, initGitRepo } from "../../../core/git-baseline.js";
-import { loggerFor } from "../../../core/logging.js";
+} from "#core/stores/code-sessions.js";
+import { captureBaseline, diffAgainstBaseline, initGitRepo } from "#core/git-baseline.js";
+import { loggerFor } from "#core/logging.js";
 
 const log = loggerFor("code");
 
@@ -68,20 +69,63 @@ function modeGuidanceFor(mode) {
     "confirmation and do not stop after one step — keep calling tools until the",
     "entire task is done, then briefly summarize what you changed and why.",
     "Prefer surgical edits over rewrites.",
+    "When the user asks for a reusable script, snippet, or 'artifact' (something",
+    "they want to keep and run later), put it under `artifacts/<name>` inside",
+    "the project — it then shows up in the Artifacts tab. Don't drop reusable",
+    "scripts at the project root.",
+    "If a parameter you need is missing (API key, app id, target URL, …), call",
+    "`ask_questions` ONCE with all your questions and stop — control returns",
+    "to the user. Do not call ask_questions again in the same turn; you'll just",
+    "get the same blank state back. Each question can be a string (free-text",
+    "answer) OR an object {question, options:[{label, description}], multiSelect}",
+    "for choices. Prefer 2–4 mutually-exclusive options when a question has a",
+    "natural shortlist (yes/no, which-of-these, …); leave options empty for",
+    "open-ended answers (API keys, names, free-form ideas).",
+    "If the previous assistant turn already asked these same questions and the",
+    "current user message is the compiled answers, DO NOT call ask_questions",
+    "again — process the answers and proceed with the task.",
   ].join(" ");
 }
 
 // Build the [{role, content}] history the super-agent expects from the stored
-// rich transcript: flatten each turn's text parts (tool parts are internal).
+// rich transcript: flatten each turn's text parts. Tool parts are normally
+// internal, but ask_questions is special — without surfacing it the model
+// loses track that it ALREADY asked, sees the user's compiled-answer reply
+// as a fresh request, and asks again forever. We render a one-line synthetic
+// summary of each ask_questions call so the next turn's context shows
+// "I asked X, the user replied Y" naturally.
+function summarizeAskQuestionsPart(part) {
+  const raw = part?.args?.questions;
+  if (!Array.isArray(raw) || raw.length === 0) return null;
+  const lines = raw
+    .map((q) => {
+      if (typeof q === "string") return `- ${q}`;
+      if (!q || typeof q !== "object" || typeof q.question !== "string") return null;
+      const opts = Array.isArray(q.options) ? q.options : [];
+      const optStr = opts
+        .map((o) => (typeof o === "string" ? o : (o && typeof o.label === "string" ? o.label : "")))
+        .filter(Boolean)
+        .join(", ");
+      return optStr ? `- ${q.question} (opciones: ${optStr})` : `- ${q.question}`;
+    })
+    .filter(Boolean);
+  if (lines.length === 0) return null;
+  return `[ask_questions]\n${lines.join("\n")}`;
+}
+
 function historyFrom(session) {
-  return (session.messages || []).map((m) => ({
-    role: m.role,
-    content: (m.parts || [])
-      .filter((p) => p && p.kind === "text" && p.text)
-      .map((p) => p.text)
-      .join("\n\n")
-      .trim(),
-  }));
+  return (session.messages || []).map((m) => {
+    const chunks = [];
+    for (const p of m.parts || []) {
+      if (!p) continue;
+      if (p.kind === "text" && p.text) chunks.push(p.text);
+      else if (p.kind === "tool" && p.tool === "ask_questions") {
+        const summary = summarizeAskQuestionsPart(p);
+        if (summary) chunks.push(summary);
+      }
+    }
+    return { role: m.role, content: chunks.join("\n\n").trim() };
+  });
 }
 
 // Accumulate stream events into the rich ChatPart shape so the persisted
@@ -273,7 +317,7 @@ export function register(app, { projects, project, config, registries, plugins }
         plugins,
         registries,
         prompt,
-        channel: "code",
+        channel: CHANNELS.WEB_CODE,
         channelMeta: {
           projectId: String(p.id),
           projectName: p.name,
@@ -337,7 +381,7 @@ export function register(app, { projects, project, config, registries, plugins }
       });
       appendSuperAgentErrorTrace(req, e, {
         prompt,
-        channel: "code",
+        channel: CHANNELS.WEB_CODE,
         previousMessages,
         model: session.model,
         stream: true,

package/src/host/daemon/api/confirm.js

@@ -8,7 +8,7 @@
 // Promise in the agent loop, unblocking it to continue with confirmed: true
 // or to return a cancelled error.
 
-import { getConfirmationStore } from "../../../core/confirmation/pending-store.js";
+import { getConfirmationStore } from "#core/confirmation/pending-store.js";
 
 export function register(app) {
   app.post("/super-agent/confirm/:correlationId", async (req, res) => {

package/src/host/daemon/api/connections.js

@@ -1,7 +1,7 @@
 // GET /projects/:pid/agents/:slug/connections
 // Builds a per-peer summary of an agent's a2a traffic from the messages store.
-import { readAgents } from "../../../core/parser.js";
-import { readProjectMessages } from "../../../core/messages-store.js";
+import { readAgents } from "#core/apc/parser.js";
+import { readProjectMessages } from "#core/stores/messages.js";
 
 export function register(app, { project }) {
   app.get("/projects/:pid/agents/:slug/connections", (req, res) => {

package/src/host/daemon/api/conversations.js

@@ -6,8 +6,8 @@
 //   POST /projects/:pid/send                                   (agent-to-agent)
 import fs from "node:fs";
 import path from "node:path";
-import { readAgents } from "../../../core/parser.js";
-import { callEngine } from "../../../core/engines/index.js";
+import { readAgents } from "#core/apc/parser.js";
+import { callEngine } from "#core/engines/index.js";
 import { listConversations, readConversation } from "../conversations.js";
 import { compactConversation } from "../compact.js";
 import { nowIso } from "./shared.js";

package/src/host/daemon/api/deck.js

@@ -226,7 +226,7 @@ export function register(app, ctx) {
     // the override we're about to set; we mutate ONLY the override and
     // leave everything else intact.
     try {
-      const { readConfig, writeConfig } = await import("../../../core/config.js");
+      const { readConfig, writeConfig } = await import("#core/config/index.js");
       const fresh = readConfig();
       fresh.deck = fresh.deck && typeof fresh.deck === "object" ? fresh.deck : {};
       fresh.deck.widget_overrides =

package/src/host/daemon/api/desktop.js

@@ -15,7 +15,7 @@ import {
   autostartIsOn,
   autostartInstall,
   autostartUninstall,
-} from "../../../core/desktop/autostart.js";
+} from "#core/desktop/autostart.js";
 
 export function register(app, { plugins }) {
   app.get("/desktop/status", (_req, res) => {

package/src/host/daemon/api/embeddings.js

@@ -8,15 +8,15 @@
 //   POST /embeddings/reindex    → { ok, cleared, indexed }  (rebuild the vector
 //                                   store under the current embedder — needed
 //                                   after switching provider/model)
-import { readConfig } from "../../../core/config.js";
+import { readConfig } from "#core/config/index.js";
 import {
   listAvailableEmbedEngines,
   embeddingsConfig,
   resolveMode,
   resolveChainOrder,
-} from "../../../core/memory/embed-engines/index.js";
-import { embedOne } from "../../../core/memory/embeddings.js";
-import { reindexMemory } from "../../../core/memory/index.js";
+} from "#core/memory/embed-engines/index.js";
+import { embedOne } from "#core/memory/embeddings.js";
+import { reindexMemory } from "#core/memory/index.js";
 
 export function register(app) {
   app.get("/embeddings/providers", async (_req, res) => {

package/src/host/daemon/api/engines.js

@@ -1,8 +1,8 @@
 // GET  /engines            — list engine adapter ids known to core/engines.
 // POST /engines/models      — live model catalog from a provider.
 // GET  /engines/models      — legacy (Ollama only, no auth).
-import { ENGINE_IDS } from "../../../core/engines/index.js";
-import { fetchJsonWithTimeout } from "../../../core/engines/_health.js";
+import { ENGINE_IDS } from "#core/engines/index.js";
+import { fetchJsonWithTimeout } from "#core/engines/_health.js";
 
 const DEFAULT_BASE = {
   openai:     "https://api.openai.com/v1",

package/src/host/daemon/api/exec.js

@@ -4,9 +4,9 @@
 //
 //   POST /projects/:pid/agents/:slug/exec     one-shot, no history
 //   POST /projects/:pid/agents/:slug/chat     append to (or start) a conversation
-import { callEngine } from "../../../core/engines/index.js";
-import { readAgents } from "../../../core/parser.js";
-import { buildAgentSystem } from "../../../core/agent-system.js";
+import { callEngine } from "#core/engines/index.js";
+import { readAgents } from "#core/apc/parser.js";
+import { buildAgentSystem } from "#core/agent/build-agent-system.js";
 import {
   startConversation,
   appendTurn,

package/src/host/daemon/api/identity.js

@@ -1,6 +1,6 @@
 // GET   /identity            full identity.json
 // PATCH /identity            { agent_name?, owner_name?, personality?, owner_context?, language?, timezone? }
-import { readIdentity, writeIdentity } from "../../../core/identity.js";
+import { readIdentity, writeIdentity } from "#core/identity/index.js";
 
 const ALLOWED_KEYS = new Set([
   "agent_name",

package/src/host/daemon/api/mcps.js

@@ -18,7 +18,7 @@ import {
   runtimeMcpsPath,
   globalMcpsPath,
   SOURCES,
-} from "../../../core/mcp/sources.js";
+} from "#core/mcp/sources.js";
 
 // scope alias used by API/CLI -> internal source id used in entry metadata
 const SCOPE_TO_SOURCE = {

package/src/host/daemon/api/messages.js

@@ -9,7 +9,7 @@ import {
   readGlobalMessages,
   readProjectMessages,
   searchProjectMessages,
-} from "../../../core/messages-store.js";
+} from "#core/stores/messages.js";
 
 export function register(app, { project }) {
   app.get("/projects/:pid/messages", (req, res) => {

package/src/host/daemon/api/runtimes.js

@@ -7,18 +7,19 @@
 //   GET  /projects/:pid/sessions/:id/resume?summarize=true
 import fs from "node:fs";
 import path from "node:path";
-import { readAgents } from "../../../core/parser.js";
-import { readSessionFrontmatter } from "../../../core/session-store.js";
-import { buildAgentSystem } from "../../../core/agent-system.js";
+import { readAgents } from "#core/apc/parser.js";
+import { readSessionFrontmatter } from "#core/stores/sessions.js";
+import { buildAgentSystem } from "#core/agent/build-agent-system.js";
+import { CHANNELS } from "#core/constants/channels.js";
 import { getRuntime, RUNTIME_IDS } from "../runtimes/index.js";
 import { detectAll } from "../env-detect.js";
+import { buildRuntimeBridgeHint as buildApfHint } from "#core/agent/runtime-bridge.js";
 import {
-  buildApfHint,
   createRuntimeSession,
   closeRuntimeSession,
-  extractApfResult,
-} from "../apc-runtime-context.js";
-import { runSuperAgent, isSuperAgentEnabled } from "../super-agent.js";
+  extractRuntimeResult as extractApfResult,
+} from "#core/stores/runtime-sessions.js";
+import { runSuperAgent, isSuperAgentEnabled } from "#core/agent/super-agent.js";
 
 export function register(app, { projects, registries, plugins, project, config }) {
   app.get("/runtimes", (_req, res) =>
@@ -205,7 +206,7 @@ export function register(app, { projects, registries, plugins, project, config }
           plugins,
           registries,
           prompt,
-          channel: "api",
+          channel: CHANNELS.API,
           contextNote: `Resume request for session ${id}.`,
         });
         out.summary = sa.text;

package/src/host/daemon/api/sessions-search.js

@@ -4,7 +4,7 @@
 //                                  then delegates to compactConversation.
 import fs from "node:fs";
 import path from "node:path";
-import { readAgents } from "../../../core/parser.js";
+import { readAgents } from "#core/apc/parser.js";
 import { compactConversation } from "../compact.js";
 
 export function register(app, { projects, config }) {

package/src/host/daemon/api/sessions.js

@@ -4,8 +4,8 @@
 //   GET  /projects/:pid/sessions/:sid              by filename (cross-agent lookup)
 import fs from "node:fs";
 import path from "node:path";
-import { parseSessionFrontmatter, readAgents } from "../../../core/parser.js";
-import { collectAllSessions } from "../../../interfaces/cli/commands/sessions.js";
+import { parseSessionFrontmatter, readAgents } from "#core/apc/parser.js";
+import { collectAllSessions } from "#interfaces/cli/commands/sessions.js";
 import { nowIso } from "./shared.js";
 
 export function register(app, { projects, project }) {

package/src/host/daemon/api/shared.js

@@ -5,9 +5,10 @@
 import fs from "node:fs";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
-import { appendErrorTrace, previewText } from "../../../core/logging.js";
-import { readAgents } from "../../../core/parser.js";
-import { agentMemoryPath } from "../../../core/agent-memory.js";
+import { appendErrorTrace, previewText } from "#core/logging.js";
+import { readAgents } from "#core/apc/parser.js";
+import { agentMemoryPath } from "#core/agent/memory.js";
+import { CHANNELS } from "#core/constants/channels.js";
 
 export const nowIso = () =>
   new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
@@ -141,7 +142,7 @@ export function resolveSuperAgentContext(req, project) {
     };
   }
   return {
-    channel: "api",
+    channel: CHANNELS.API,
     channelMeta: {
       projectId: String(project.id),
       projectName: project.name,

package/src/host/daemon/api/skills.js

@@ -0,0 +1,30 @@
+// Lightweight `/skills` listing for UI surfaces (web composer picker,
+// future palettes). Same data backing `list_skills` tool, but here without
+// auth-binding to a project — anyone with a valid daemon token can ask
+// "which skills are around right now?".
+//
+// Returns the catalog already condensed (slug + first-sentence description)
+// so the picker doesn't have to repeat the cleanup work.
+import { listSkills } from "#core/agent/skills/loader.js";
+import { condenseSkillDescription } from "#core/agent/skills/catalog.js";
+
+export function register(app /*, ctx */) {
+  app.get("/skills", (req, res) => {
+    const projectPath = typeof req.query?.project_path === "string"
+      ? req.query.project_path
+      : undefined;
+    try {
+      const skills = listSkills({ projectPath });
+      res.json({
+        count: skills.length,
+        skills: skills.map(({ slug, source, description }) => ({
+          slug,
+          source,
+          description: condenseSkillDescription(description),
+        })),
+      });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+}

package/src/host/daemon/api/super-agent.js

@@ -5,14 +5,17 @@
 //
 //   POST /projects/:pid/super-agent/chat/stream    NDJSON event stream
 //   POST /projects/:pid/super-agent/chat            blocking JSON response
-import { runSuperAgent } from "../super-agent.js";
+import { runSuperAgent } from "#core/agent/super-agent.js";
 import {
   resolveSuperAgentContext,
   appendSuperAgentErrorTrace,
 } from "./shared.js";
-import { loggerFor } from "../../../core/logging.js";
-import { appendGlobalMessage } from "../../../core/messages-store.js";
-import { createWebConfirmAdapter } from "../../../core/confirmation/adapters/web.js";
+import { loggerFor } from "#core/logging.js";
+import { appendGlobalMessage } from "#core/stores/messages.js";
+import { createWebConfirmAdapter } from "#core/confirmation/adapters/web.js";
+import { tryResolveSkillCommand } from "#core/agent/skills/trigger.js";
+import { suggestSkillForPrompt } from "#core/agent/skills/rag.js";
+import { CHANNELS } from "#core/constants/channels.js";
 
 const log = loggerFor("super-agent");
 
@@ -20,7 +23,7 @@ const log = loggerFor("super-agent");
 // RAG index, search_messages, and the "active threads" awareness block. Only
 // the human surfaces (web big chat + sidebar) — not generic "api"/automation
 // callers. Best-effort: a logging failure never breaks the reply.
-const WEB_LOGGED_CHANNELS = new Set(["web", "web_sidebar"]);
+const WEB_LOGGED_CHANNELS = new Set([CHANNELS.WEB, CHANNELS.WEB_SIDEBAR]);
 function logWebTurn(channel, { prompt, replyText }) {
   if (!WEB_LOGGED_CHANNELS.has(channel)) return;
   try {
@@ -66,11 +69,24 @@ export function register(app, { projects, registries, plugins, project, config }
     // Optional coding-surface knobs: the terminal Code TUI (apx code, Build
     // mode) sends these so it runs to completion exactly like the web Code
     // module. Plain chat callers omit them and keep the lightweight defaults.
-    const { prompt, previousMessages, model, maxIters, maxTokens, completionContract } =
+    const { prompt: rawPrompt, previousMessages, model, maxIters, maxTokens, completionContract } =
       req.body || {};
-    if (!prompt) return res.status(400).json({ error: "prompt required" });
+    if (!rawPrompt) return res.status(400).json({ error: "prompt required" });
     const ctx = resolveSuperAgentContext(req, p);
 
+    // `/slug ...` shortcut: load the matching skill body into contextNote and
+    // strip the prefix from the user prompt. Falls through unchanged when the
+    // slug is unknown.
+    const slashed = tryResolveSkillCommand(rawPrompt, { projectPath: p.path });
+    const prompt = slashed.handled ? slashed.prompt : rawPrompt;
+    if (slashed.handled) {
+      ctx.contextNote = [ctx.contextNote, slashed.contextNote].filter(Boolean).join("\n\n");
+    } else {
+      // Semantic skill nudge — only when there was no explicit /slug.
+      const hint = await suggestSkillForPrompt(prompt, { projectPath: p.path });
+      if (hint) ctx.contextNote = [ctx.contextNote, hint].filter(Boolean).join("\n\n");
+    }
+
     res.setHeader("content-type", "application/x-ndjson; charset=utf-8");
     res.setHeader("cache-control", "no-cache, no-transform");
     res.setHeader("x-accel-buffering", "no");
@@ -151,7 +167,7 @@ export function register(app, { projects, registries, plugins, project, config }
         registries,
         prompt,
         contextNote,
-        channel: "api",
+        channel: CHANNELS.API,
         overrideModel: model,
         maxTokens:
           max_tokens && Number.isFinite(Number(max_tokens))
@@ -174,7 +190,8 @@ export function register(app, { projects, registries, plugins, project, config }
   app.post("/projects/:pid/super-agent/chat", async (req, res) => {
     const p = project(req, res);
     if (!p) return;
-    const { prompt, previousMessages, model } = req.body || {};
+    const { prompt, previousMessages, model, maxIters, maxTokens, completionContract } =
+      req.body || {};
     if (!prompt) return res.status(400).json({ error: "prompt required" });
     const ctx = resolveSuperAgentContext(req, p);
     try {
@@ -189,6 +206,9 @@ export function register(app, { projects, registries, plugins, project, config }
         contextNote: ctx.contextNote,
         previousMessages: previousMessages || [],
         overrideModel: model,
+        ...(Number.isFinite(Number(maxIters)) ? { maxIters: Number(maxIters) } : {}),
+        ...(Number.isFinite(Number(maxTokens)) ? { maxTokens: Number(maxTokens) } : {}),
+        ...(completionContract ? { completionContract: true } : {}),
         onEvent: wrapOnEventForLog(null, {
           trace_id: req.apxTraceId,
           channel: ctx.channel,

package/src/host/daemon/api/tasks.js

@@ -1,4 +1,4 @@
-// Per-project tasks (TODOs). Backed by core/tasks-store.js (JSONL event log).
+// Per-project tasks (TODOs). Backed by core/stores/tasks.js (JSONL event log).
 //   GET    /projects/:pid/tasks                  ?state=open|done|dropped|all&tag=X&agent=Y&due_before=ISO&limit=N
 //   POST   /projects/:pid/tasks                  { title, body?, tags?, due?, agent?, source?, meta? }
 //   GET    /projects/:pid/tasks/:id              (id or prefix)
@@ -15,7 +15,7 @@ import {
   dropTask,
   reopenTask,
   countTasks,
-} from "../../../core/tasks-store.js";
+} from "#core/stores/tasks.js";
 
 export function register(app, { project, projects }) {
   // Global tasks across every project.