@agentprojectcontext/apx 1.32.0 → 1.33.0

package/src/core/memory/active-threads.js

@@ -1,4 +1,4 @@
-// "Hilos activos en otros canales" — a tiny, recency-based awareness block.
+// "Active threads on other channels" — a tiny, recency-based awareness block.
 //
 // Unlike the Memory Broker (semantic RAG + remembered notes), this reads the
 // raw cross-channel message log and surfaces the most recent turn from every
@@ -11,8 +11,8 @@
 
 import fs from "node:fs";
 import path from "node:path";
-import { GLOBAL_MESSAGES_DIR } from "../config.js";
-import { parseDayJsonl } from "../messages-store.js";
+import { GLOBAL_MESSAGES_DIR } from "../config/index.js";
+import { parseDayJsonl } from "../stores/messages.js";
 
 const BODY_CAP = 70;
 
@@ -20,9 +20,9 @@ function ago(ts) {
   const then = Date.parse(ts);
   if (!Number.isFinite(then)) return "";
   const mins = Math.max(0, Math.round((Date.now() - then) / 60000));
-  if (mins < 60) return `hace ${mins} min`;
+  if (mins < 60) return `${mins} min ago`;
   const hrs = Math.round(mins / 60);
-  return `hace ${hrs} h`;
+  return `${hrs} h ago`;
 }
 
 // Prefer the last USER turn (most recognizable for "lo de antes"); fall back to
@@ -69,7 +69,7 @@ function readChannelRecentTurn(baseDir, channel, sinceMs) {
   return turn;
 }
 
-// Build the "# Hilos activos en otros canales" block. Returns "" when there's
+// Build the "# Active threads on other channels" block. Returns "" when there's
 // nothing recent on another channel (or the feature is disabled).
 export function buildActiveThreadsBlock(currentChannel, { config, messagesDir } = {}) {
   try {
@@ -111,10 +111,10 @@ export function buildActiveThreadsBlock(currentChannel, { config, messagesDir }
     });
 
     return [
-      "# Hilos activos en otros canales",
-      'Charlas recientes en otras superficies (NO es este chat). Si el usuario dice',
-      '"seguimos" / "lo de antes" / "lo de telegram", probablemente sea uno de estos —',
-      "retomalo naturalmente; usá search_messages para el detalle exacto.",
+      "# Active threads on other channels",
+      "Recent chatter on other surfaces (NOT this chat). If the user says",
+      '"let\'s continue" / "the thing from before" / "the telegram one" it\'s probably',
+      "one of these — pick it up naturally; use search_messages for exact detail.",
       "",
       ...lines,
     ].join("\n");

package/src/core/memory/broker.js

@@ -1,10 +1,10 @@
 // Memory Broker (Pieza 4) — runs before each super-agent turn and assembles the
-// [MEMORIA RELEVANTE] block injected into the system prompt.
+// [RELEVANT MEMORY] block injected into the system prompt.
 //
 //   incoming message
 //     → embed it + RAG retriever (Pieza 2) → top-K relevant chunks
 //     → read the last N entries of memory.md
-//     → merge, dedupe, format as a [MEMORIA RELEVANTE] block
+//     → merge, dedupe, format as a [RELEVANT MEMORY] block
 //
 // Silent and bounded: the whole thing races an 800 ms budget. If RAG is slow
 // (Ollama lagging), the block still returns with whatever memory.md gave us —
@@ -79,7 +79,7 @@ function bulletFor({ date, channel, text }) {
   return `• ${d}${c} ${trunc(text)}`.replace(/\s+/g, " ").trim();
 }
 
-// Build the [MEMORIA RELEVANTE] block. Returns "" when there's nothing useful.
+// Build the [RELEVANT MEMORY] block. Returns "" when there's nothing useful.
 //
 // opts: { store, config, memoryPath, budgetMs, topK, channel, embed }
 export async function buildMemoryBlock(message, opts = {}) {
@@ -132,13 +132,13 @@ export async function buildMemoryBlock(message, opts = {}) {
   if (bullets.length === 0) return "";
 
   return [
-    "# Memoria relevante (cross-channel)",
-    "Contexto recuperado de tu memoria y del historial de todos los canales. Tratá",
-    "como hechos conocidos; si arrancás una sesión nueva y algo de acá sigue abierto,",
-    "mencionalo naturalmente (\"ayer estuvimos con X, ¿seguimos?\") sin que te pregunten.",
+    "# Relevant memory (cross-channel)",
+    "Context recovered from your notebook and from the message log across channels.",
+    "Treat these as known facts. If a fresh session opens and something here is still",
+    "open, bring it up naturally in the user's language (e.g. \"yesterday we were on X — shall we continue?\") without being asked.",
     "",
-    "[MEMORIA RELEVANTE]",
+    "[RELEVANT MEMORY]",
     ...bullets,
-    "[/MEMORIA RELEVANTE]",
+    "[/RELEVANT MEMORY]",
   ].join("\n");
 }

package/src/core/memory/compactor.js

@@ -15,8 +15,8 @@
 
 import fs from "node:fs";
 import path from "node:path";
-import { GLOBAL_MESSAGES_DIR } from "../config.js";
-import { parseDayJsonl, appendGlobalMessage } from "../messages-store.js";
+import { GLOBAL_MESSAGES_DIR } from "../config/index.js";
+import { parseDayJsonl, appendGlobalMessage } from "../stores/messages.js";
 import { callEngine } from "../engines/index.js";
 
 const DEFAULT_MAX_TURNS = 60;

package/src/core/memory/index.js

@@ -12,7 +12,7 @@
 // affected piece simply contributes nothing.
 
 import path from "node:path";
-import { APX_HOME } from "../config.js";
+import { APX_HOME } from "../config/index.js";
 import { ensureSelfMemoryFile } from "../agent/self-memory.js";
 import fs from "node:fs";
 import { openMemoryStore } from "./store.js";
@@ -141,7 +141,7 @@ export function stopMemory() {
   _ready = null;
 }
 
-// Build the [MEMORIA RELEVANTE] block for a turn (Pieza 4). Never throws —
+// Build the [RELEVANT MEMORY] block for a turn (Pieza 4). Never throws —
 // returns "" on any failure so the prompt builder can drop the block.
 export async function memoryBlockFor(message, { config, channel, budgetMs } = {}) {
   try {

package/src/core/memory/indexer.js

@@ -19,7 +19,7 @@
 
 import fs from "node:fs";
 import path from "node:path";
-import { GLOBAL_MESSAGES_DIR, APX_HOME } from "../config.js";
+import { GLOBAL_MESSAGES_DIR, APX_HOME } from "../config/index.js";
 import { SELF_MEMORY_PATH, parseSelfMemoryEntries } from "../agent/self-memory.js";
 import { embedBatch, embedOne } from "./embeddings.js";
 

package/src/core/{code-sessions-store.js → stores/code-sessions.js}

@@ -11,7 +11,8 @@
 // translation.
 import fs from "node:fs";
 import path from "node:path";
-import { randomUUID } from "node:crypto";
+import { nowIso } from "../util/time.js";
+import { shortId as makeShortId } from "../util/ids.js";
 
 function sessionsDir(storagePath) {
   return path.join(storagePath, "code-sessions");
@@ -21,13 +22,8 @@ function sessionFile(storagePath, id) {
   return path.join(sessionsDir(storagePath), `${id}.json`);
 }
 
-function nowIso() {
-  return new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
-}
-
 function shortId() {
-  const hex = randomUUID().replace(/-/g, "").slice(0, 8);
-  return "cs_" + parseInt(hex, 16).toString(36).padStart(6, "0").slice(-6);
+  return makeShortId("cs");
 }
 
 // Atomic write: tmp file + rename so a crash mid-write can't corrupt a session.
@@ -53,6 +49,7 @@ function toRow(s) {
     title: s.title,
     mode: s.mode,
     model: s.model || null,
+    agentSlug: s.agentSlug || null,
     createdAt: s.createdAt,
     updatedAt: s.updatedAt,
     messageCount: Array.isArray(s.messages) ? s.messages.length : 0,
@@ -82,7 +79,7 @@ export function getCodeSession(storagePath, id) {
 
 /**
  * Create a new session.
- * fields: { projectId, title?, model?, mode?, git? }
+ * fields: { projectId, title?, model?, mode?, git?, agentSlug? }
  */
 export function createCodeSession(storagePath, fields = {}) {
   const id = shortId();
@@ -95,6 +92,7 @@ export function createCodeSession(storagePath, fields = {}) {
     updatedAt: ts,
     model: fields.model || null,
     mode: fields.mode === "plan" ? "plan" : "build",
+    agentSlug: fields.agentSlug || null,
     git: fields.git && typeof fields.git === "object" ? fields.git : null,
     messages: [],
   };
@@ -112,6 +110,7 @@ export function updateCodeSession(storagePath, id, patch = {}) {
   if (patch.title != null) session.title = String(patch.title).trim() || session.title;
   if (patch.model !== undefined) session.model = patch.model || null;
   if (patch.mode === "plan" || patch.mode === "build") session.mode = patch.mode;
+  if (patch.agentSlug !== undefined) session.agentSlug = patch.agentSlug || null;
   if (patch.git !== undefined) session.git = patch.git;
   session.updatedAt = nowIso();
   writeJson(sessionFile(storagePath, id), session);

package/src/core/{messages-store.js → stores/messages.js}

@@ -18,9 +18,11 @@
 
 import fs from "node:fs";
 import path from "node:path";
-import { GLOBAL_MESSAGES_DIR } from "./config.js";
+import { GLOBAL_MESSAGES_DIR } from "../config/index.js";
+import { CHANNELS } from "../constants/channels.js";
+import { SUPERAGENT_ACTOR_ID } from "../constants/actors.js";
 
-const nowIso = () => new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
+import { nowIso } from "../util/time.js";
 
 function dayPathJsonl(projectRoot, ts) {
   const day = (ts || nowIso()).slice(0, 10);
@@ -63,7 +65,7 @@ function inferActorKind({ actor_kind, type, actor_id, meta = {} } = {}) {
   if (explicit) return explicit;
   if (type === "compact") return "compact";
   if (type === "user" || type === "tool" || type === "system") return type;
-  if (type === "agent") return actor_id === "super_agent" ? "superagent" : "agent";
+  if (type === "agent") return actor_id === SUPERAGENT_ACTOR_ID ? "superagent" : "agent";
   return null;
 }
 
@@ -531,7 +533,7 @@ export function getRecentChannelTurnsFromFs({
 
 // Telegram-specific wrapper kept for back-compat with existing call sites.
 export function getRecentTelegramTurnsFromFs(opts = {}) {
-  return getRecentChannelTurnsFromFs({ ...opts, channel: "telegram" });
+  return getRecentChannelTurnsFromFs({ ...opts, channel: CHANNELS.TELEGRAM });
 }
 
 // ---------------------------------------------------------------------------

package/src/core/stores/routine-memory.js

@@ -0,0 +1,71 @@
+// Per-routine memory.md — durable notes scoped to a single routine.
+//
+// Path: <projectStoragePath>/routines/<routineId>/memory.md
+//
+// The routine handler (host/daemon/routines.js) creates the file on first read
+// and injects a bounded slice into the super-agent prompt via
+// channelMeta.routineMemory. The routine can write back with future tooling;
+// today we only read.
+//
+// Distinct from:
+//   - Agent memory (~/.apx/projects/<id>/agents/<slug>/memory.md) — per-agent.
+//   - Super-agent self-memory (~/.apx/memory.md) — global to the super-agent.
+import fs from "node:fs";
+import path from "node:path";
+
+const PROMPT_LIMIT = 1500;
+
+export function routineMemoryDir(storagePath, routineId) {
+  return path.join(storagePath, "routines", String(routineId || "_unknown"));
+}
+
+export function routineMemoryPath(storagePath, routineId) {
+  return path.join(routineMemoryDir(storagePath, routineId), "memory.md");
+}
+
+/** Read the memory body. Returns "" when the file doesn't exist. Never throws. */
+export function readRoutineMemory(storagePath, routineId) {
+  try {
+    return fs.readFileSync(routineMemoryPath(storagePath, routineId), "utf8");
+  } catch {
+    return "";
+  }
+}
+
+/** Bounded slice for the system prompt. Returns "" when empty. */
+export function readRoutineMemoryForPrompt(storagePath, routineId, limit = PROMPT_LIMIT) {
+  const body = readRoutineMemory(storagePath, routineId).trim();
+  if (!body) return "";
+  if (body.length <= limit) return body;
+  return body.slice(0, limit).trimEnd() + "\n… (truncated)";
+}
+
+/** Ensure the routine memory file exists. Returns true if it was created. */
+export function ensureRoutineMemory(storagePath, routineId, routineName = "") {
+  const file = routineMemoryPath(storagePath, routineId);
+  if (fs.existsSync(file)) return false;
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const header = routineName
+    ? `# Routine memory — ${routineName}\n`
+    : "# Routine memory\n";
+  fs.writeFileSync(file, header);
+  return true;
+}
+
+/** Append a dated note to the routine memory. Creates the file on first write. */
+export function appendRoutineMemory(storagePath, routineId, note, { routineName = "" } = {}) {
+  const text = String(note || "").trim();
+  if (!text) throw new Error("nothing to remember (empty note)");
+  ensureRoutineMemory(storagePath, routineId, routineName);
+  const file = routineMemoryPath(storagePath, routineId);
+  const today = new Date().toISOString().slice(0, 10);
+  const heading = `## ${today}`;
+  const oneLine = text.replace(/\n+/g, " ").trim();
+  const bullet = `- ${oneLine}`;
+  const existing = fs.readFileSync(file, "utf8");
+  const next = existing.includes(heading)
+    ? existing.trimEnd() + `\n${bullet}\n`
+    : existing.trimEnd() + `\n\n${heading}\n${bullet}\n`;
+  fs.writeFileSync(file, next);
+  return { path: file, note: text };
+}

package/src/core/{routines-store.js → stores/routines.js}

@@ -3,9 +3,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import cronParser from "cron-parser";
-
-const nowIso = () => new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
-const isoToMs = (iso) => (iso ? Date.parse(iso) : 0);
+import { nowIso, isoToMs } from "../util/time.js";
 
 function routinesPath(storagePath) {
   // storagePath is always ~/.apx/projects/{apxId}/ — flat, no .apc subdir needed.

package/src/core/stores/runtime-sessions.js

@@ -0,0 +1,99 @@
+// On-disk session state for external runtimes (Claude Code, Codex, OpenCode,
+// Aider, Cursor Agent, Gemini CLI, Qwen Code). One markdown file per session
+// under <storageRoot>/agents/<slug>/sessions/<id>.md with YAML frontmatter
+// (id, agent, title, task_ref, status, started, completed, result, runtime,
+// external_session_path).
+//
+// The "bridge" prompt-text builder that explains this layout to the external
+// runtime lives in core/agent/runtime-bridge.js. Both used to live together
+// in host/daemon/apc-runtime-context.js; they were split because they have
+// different homes (text → core/agent, state → core/stores).
+import fs from "node:fs";
+import path from "node:path";
+import { generateSessionId } from "./sessions.js";
+import { nowIso } from "#core/util/time.js";
+
+/** Create the APX runtime session file. Returns { id, filename, path }. */
+export function createRuntimeSession({
+  projectRoot,
+  storageRoot = projectRoot,
+  agentSlug,
+  runtime,
+  taskRef = "",
+  title,
+}) {
+  const dir = path.join(storageRoot, "agents", agentSlug, "sessions");
+  fs.mkdirSync(dir, { recursive: true });
+  const id = generateSessionId(storageRoot, agentSlug);
+  const file = path.join(dir, `${id}.md`);
+  const started = nowIso();
+  const sessionTitle = title || `Runtime: ${runtime}`;
+  const body =
+    `---\n` +
+    `id: ${id}\n` +
+    `agent: ${agentSlug}\n` +
+    `title: ${sessionTitle}\n` +
+    `task_ref: ${taskRef}\n` +
+    `status: 🔄 In progress\n` +
+    `started: ${started}\n` +
+    `completed: \n` +
+    `result: \n` +
+    `runtime: ${runtime}\n` +
+    `external_session_path: \n` +
+    `---\n\n` +
+    `# ${sessionTitle}\n\n`;
+  fs.writeFileSync(file, body);
+  return { id, filename: `${id}.md`, path: file };
+}
+
+/** Update session frontmatter with the external transcript path + final state. */
+export function closeRuntimeSession({ filePath, externalSessionPath, exitCode, result }) {
+  let text = fs.readFileSync(filePath, "utf8");
+  text = setField(text, "completed", nowIso());
+  if (externalSessionPath) {
+    text = setField(text, "external_session_path", externalSessionPath);
+  }
+  if (typeof exitCode === "number") {
+    text = setField(
+      text,
+      "result",
+      `${exitCode === 0 ? "✅" : "⚠️"} exit ${exitCode}: ${(result || "").slice(0, 200)}`
+    );
+  } else if (result) {
+    text = setField(text, "result", result.slice(0, 300));
+  }
+  text = setField(text, "status", exitCode === 0 ? "✅ Completed" : "⚠️ Closed with error");
+  fs.writeFileSync(filePath, text);
+}
+
+function setField(text, field, value) {
+  if (!text.startsWith("---\n")) return text;
+  const end = text.indexOf("\n---", 4);
+  if (end === -1) return text;
+  const fmText = text.slice(4, end);
+  const lines = fmText.split("\n");
+  let found = false;
+  const out = lines.map((line) => {
+    if (line.startsWith(`${field}:`)) {
+      found = true;
+      return `${field}: ${value}`;
+    }
+    return line;
+  });
+  if (!found) out.push(`${field}: ${value}`);
+  return `---\n${out.join("\n")}\n---${text.slice(end + 4)}`;
+}
+
+/**
+ * Extract a self-reported "APC_RESULT: ..." line from the runtime's stdout
+ * (the convention printed in the bridge hint). Returns the captured string
+ * or null. Fallback for runtimes that can't shell out to `apx session close`.
+ */
+export function extractRuntimeResult(stdout) {
+  if (!stdout || typeof stdout !== "string") return null;
+  const m = stdout.match(/^APC_RESULT:\s*(.+?)\s*$/m);
+  return m ? m[1].trim() : null;
+}
+
+// Back-compat alias.
+export const extractApfResult = extractRuntimeResult;

package/src/core/{tasks-store.js → stores/tasks.js}

@@ -16,7 +16,8 @@
 // caller explicitly re-opens with op="reopen".
 import fs from "node:fs";
 import path from "node:path";
-import { randomUUID } from "node:crypto";
+import { nowIso } from "../util/time.js";
+import { shortId as makeShortId } from "../util/ids.js";
 
 function tasksDir(storagePath) {
   return path.join(storagePath, "tasks");
@@ -27,14 +28,8 @@ function monthlyFile(storagePath, date = new Date()) {
   return path.join(tasksDir(storagePath), `${ym}.jsonl`);
 }
 
-function nowIso() {
-  return new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
-}
-
 function shortId() {
-  // 6 base36 chars from randomUUID's first 8 hex chars → 32 bits → ~4B keyspace.
-  const hex = randomUUID().replace(/-/g, "").slice(0, 8);
-  return "t_" + parseInt(hex, 16).toString(36).padStart(6, "0").slice(-6);
+  return makeShortId("t");
 }
 
 function appendEvent(storagePath, event) {

package/src/core/update-check.js

@@ -6,7 +6,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import https from "node:https";
-import { APX_HOME } from "./config.js";
+import { APX_HOME } from "./config/index.js";
 
 const PACKAGE_NAME = "@agentprojectcontext/apx";
 const CACHE_PATH = path.join(APX_HOME, "update-check.json");

package/src/core/util/ids.js

@@ -0,0 +1,14 @@
+// Short, prefix-able ids derived from a UUID. Stores use these for primary
+// keys when an autoincrement isn't a fit (no SQL row counter, JSON files).
+import { randomUUID } from "node:crypto";
+
+/**
+ * Six-character base36 id derived from a UUID. Random enough for in-process
+ * uniqueness inside a single file/store; combine with a prefix when collisions
+ * across stores would be ambiguous.
+ */
+export function shortId(prefix = "") {
+  const hex = randomUUID().replace(/-/g, "").slice(0, 8);
+  const id = parseInt(hex, 16).toString(36).padStart(6, "0").slice(-6);
+  return prefix ? `${prefix}_${id}` : id;
+}

package/src/core/util/index.js

@@ -0,0 +1,2 @@
+export * from "./time.js";
+export * from "./ids.js";

package/src/core/util/time.js

@@ -0,0 +1,9 @@
+// Time helpers. Single source for ISO timestamps so every store agrees on
+// resolution (seconds) and shape ("YYYY-MM-DDTHH:MM:SSZ").
+export function nowIso() {
+  return new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+
+export function isoToMs(iso) {
+  return iso ? Date.parse(iso) : 0;
+}

package/src/core/voice/tts.js

@@ -10,7 +10,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
-import { readConfig } from "../config.js";
+import { readConfig } from "../config/index.js";
 import {
   selectTtsEngine,
   listAvailableTtsEngines,

package/src/host/daemon/api/admin-config.js

@@ -5,9 +5,10 @@
 // The PATCH variant is intentional: PUT would force the caller to send the
 // whole credentials block, and a UI that forgot one field would wipe secrets.
 // Dotted keys make every edit narrowly-scoped.
-import { readConfig, writeConfig } from "../../../core/config.js";
-import { resolveAgentName } from "../../../core/identity.js";
+import { readConfig, writeConfig } from "#core/config/index.js";
+import { resolveAgentName } from "#core/identity/index.js";
 import { setDottedKey, unsetDottedKey } from "../project-config.js";
+import { PERMISSION_MODES, DEFAULT_PERMISSION_MODE } from "#core/constants/permissions.js";
 
 const SECRET_PATHS = [
   "engines.anthropic.api_key",
@@ -148,7 +149,7 @@ export function register(app, { config, scheduler, plugins }) {
         name: resolveAgentName(fresh),
         model: sa.model || "",
         system: sa.system || "",
-        permission_mode: sa.permission_mode || "permiso",
+        permission_mode: sa.permission_mode || PERMISSION_MODES.PERMISO,
         allowed_tools: sa.allowed_tools || [],
         model_fallback: sa.model_fallback || { enabled: false, models: [], order: [] },
       });

package/src/host/daemon/api/admin.js

@@ -3,7 +3,7 @@
 // POST /admin/shutdown    — clean exit (50 ms grace so the response flushes).
 //
 // Both are auth-gated (the global middleware applies).
-import { readConfig } from "../../../core/config.js";
+import { readConfig } from "#core/config/index.js";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";

package/src/host/daemon/api/agents.js

@@ -6,44 +6,23 @@
 //   PUT  /projects/:pid/agents/:slug/memory
 import fs from "node:fs";
 import path from "node:path";
-import { readAgents, readVaultAgents, readVaultAgent } from "../../../core/parser.js";
+import { readAgents, readVaultAgents, readVaultAgent } from "#core/apc/parser.js";
 import {
   writeAgentFile,
   writeVaultAgentFile,
   removeVaultAgent,
   restoreVaultAgent,
   ensureAgentDir,
-} from "../../../core/scaffold.js";
+} from "#core/apc/scaffold.js";
 import {
   ensureAgentRuntimeDir,
   readAgentMemory,
   writeAgentMemory,
   agentMemoryPath,
   legacyAgentMemoryPath,
-} from "../../../core/agent-memory.js";
+} from "#core/agent/memory.js";
 import { agentToResponse } from "./shared.js";
-
-// Lowercase the patch keys we accept on the vault and turn skills/tools into
-// arrays. The writer takes either case but normalizes; passing this through
-// it keeps the on-disk format consistent.
-const VAULT_PATCH_FIELDS = ["role", "model", "language", "description", "skills", "tools", "is_master"];
-function normalizeVaultPatch(input = {}) {
-  const out = {};
-  for (const k of VAULT_PATCH_FIELDS) {
-    const lower = k;
-    const title = k.charAt(0).toUpperCase() + k.slice(1);
-    const v = input[lower] ?? input[title];
-    if (v === undefined || v === null) continue;
-    if (k === "skills" || k === "tools") {
-      out[title] = Array.isArray(v)
-        ? v.map(String).map((s) => s.trim()).filter(Boolean)
-        : String(v).split(",").map((s) => s.trim()).filter(Boolean);
-    } else {
-      out[title] = v;
-    }
-  }
-  return out;
-}
+import { normalizeVaultPatch } from "#core/apc/agents-vault.js";
 
 export function register(app, { projects, project }) {
   // Vault = global agent templates. Two-layer: bundled defaults shipped with

package/src/host/daemon/api/artifacts.js

@@ -13,7 +13,7 @@ import {
   listArtifacts,
   readArtifact,
   removeArtifact,
-} from "../../../core/artifacts-store.js";
+} from "#core/stores/artifacts.js";
 
 // Same heuristic as `apx artifact run` (cli/commands/artifact.js): exec bit
 // OR shebang counts as runnable. We auto-chmod when shebang-only so the
@@ -119,6 +119,31 @@ export function register(app, { project }) {
     }
   });
 
+  app.patch("/projects/:pid/artifacts/:name", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const name = decodeURIComponent(req.params.name);
+    const { content, newName } = req.body || {};
+    try {
+      const absPath = artifactPath(p.storagePath, name);
+      if (!fs.existsSync(absPath)) {
+        return res.status(404).json({ error: `artifact "${name}" not found` });
+      }
+      if (typeof content === "string") {
+        fs.writeFileSync(absPath, content, "utf8");
+      }
+      let finalName = name;
+      if (newName && newName !== name) {
+        const newAbsPath = artifactPath(p.storagePath, newName);
+        fs.renameSync(absPath, newAbsPath);
+        finalName = newName;
+      }
+      res.json({ ok: true, name: finalName });
+    } catch (e) {
+      res.status(400).json({ error: e.message });
+    }
+  });
+
   app.delete("/projects/:pid/artifacts/:name", (req, res) => {
     const p = project(req, res);
     if (!p) return;