@agentprojectcontext/apx 1.33.1 → 1.35.0

package/src/host/daemon/api/conversations.js

@@ -4,12 +4,10 @@
 //   POST /projects/:pid/agents/:slug/compact
 //   POST /projects/:pid/agents/:slug/conversations/:id/compact
 //   POST /projects/:pid/send                                   (agent-to-agent)
-import fs from "node:fs";
-import path from "node:path";
 import { readAgents } from "#core/apc/parser.js";
-import { callEngine } from "#core/engines/index.js";
-import { listConversations, readConversation } from "../conversations.js";
-import { compactConversation } from "../compact.js";
+import { listConversations, readConversation } from "#core/stores/conversations.js";
+import { compactConversation } from "#core/stores/conversations-compactor.js";
+import { replyAsAgent } from "#core/agent/a2a/reply.js";
 import { nowIso } from "./shared.js";
 
 export function register(app, { project, config }) {
@@ -102,30 +100,11 @@ export function register(app, { project, config }) {
     let reply = null;
     if (deliver && toAgent.fields.Model) {
       try {
-        const tf = toAgent.fields;
-        const parts = [];
-        if (tf.Description) parts.push(tf.Description);
-        if (tf.Role) parts.push(`Role: ${tf.Role}`);
-        if (tf.Language) parts.push(`Default language: ${tf.Language}`);
-        parts.push(
-          `You are ${toAgent.slug}. You just received a message from ${fromAgent.slug}. Reply concisely.`
-        );
-        const memPath = path.join(
-          p.path,
-          ".apc",
-          "agents",
-          toAgent.slug,
-          "memory.md"
-        );
-        if (fs.existsSync(memPath))
-          parts.push("## Memory\n" + fs.readFileSync(memPath, "utf8"));
-
-        const result = await callEngine({
-          modelId: toAgent.fields.Model,
-          system: parts.join("\n\n"),
-          messages: [
-            { role: "user", content: `From ${fromAgent.slug}:\n\n${body}` },
-          ],
+        const result = await replyAsAgent({
+          projectPath: p.path,
+          toAgent,
+          fromAgent,
+          body,
           config: p.config || config,
         });
 

package/src/host/daemon/api/deck.js

@@ -1,95 +1,16 @@
 // APX Deck bootstrap surface.
-// It exposes read-only context for companion clients without making external
-// services first-class APX daemon dependencies.
-
-const CORE_WIDGETS = [
-  {
-    id: "apx-current-project",
-    title: "Proyecto actual",
-    source: "apx",
-    desktop: "project",
-    kind: "context",
-    status: "available",
-  },
-  {
-    id: "apx-voice",
-    title: "Voz APX",
-    source: "apx",
-    desktop: "general",
-    kind: "voice",
-    status: "available",
-  },
-  {
-    id: "apx-agents",
-    title: "Agentes APX",
-    source: "apx",
-    desktop: "ai",
-    kind: "agents",
-    status: "available",
-  },
-  {
-    id: "apx-notes",
-    title: "Notas APX",
-    source: "apx",
-    desktop: "project",
-    kind: "capture",
-    status: "available",
-  },
-];
-
-const EXTERNAL_WIDGETS = [
-  ["docker", "Docker", "infra"],
-  ["dokploy", "Dokploy", "infra"],
-  ["factorial", "Factorial", "work"],
-  ["telegram", "Telegram", "comms"],
-  ["gmail", "Gmail", "comms"],
-  ["outlook", "Outlook", "comms"],
-  ["teams", "Teams", "comms"],
-  ["whatsapp", "WhatsApp", "comms"],
-  ["zen", "Zen Browser", "ai"],
-  ["claude", "Claude", "ai"],
-  ["chatgpt", "ChatGPT", "ai"],
-  ["cursor", "Cursor", "ai"],
-  ["codex", "Codex", "ai"],
-].map(([id, title, desktop]) => ({
-  id,
-  title,
-  source: "external",
-  desktop,
-  kind: "plugin",
-  status: "not_configured",
-}));
-
-const DESKTOPS = [
-  { id: "general", title: "Hoy" },
-  { id: "project", title: "Proyecto" },
-  { id: "ai", title: "IA" },
-  { id: "comms", title: "Comunicaciones" },
-  { id: "infra", title: "Infra" },
-  { id: "work", title: "Tiempo laboral" },
-  { id: "plugins", title: "Plugins" },
-];
-
-const SAFE_ACTIONS = [
-  {
-    id: "apx.copy_context",
-    title: "Copiar contexto APX",
-    risk: "safe",
-    endpoint: "/projects/:pid/agents",
-  },
-  {
-    id: "apx.voice_turn",
-    title: "Hablar con APX",
-    risk: "safe",
-    endpoint: "/voice/turn",
-  },
-  {
-    id: "apx.super_agent",
-    title: "Pedir acción a APX",
-    risk: "confirm",
-    endpoint: "/projects/:pid/super-agent/chat",
-  },
-];
+// Read-only context for companion clients (deck, desktop capsule) plus a
+// safe-action runner. Domain (manifest model, project-context reader, notes
+// appender) lives in core/; process orchestration (spawn child processes,
+// clipboard) lives next door in host/daemon/deck-exec.js. This file is the
+// HTTP adapter.
+import {
+  buildDeckManifest,
+  TOGGLEABLE_WIDGETS,
+} from "#core/deck/manifest.js";
+import { readProjectContext } from "#core/apc/context-copy.js";
+import { appendProjectNote } from "#core/apc/notes.js";
+import { runDeckExec, copyToClipboard } from "../deck-exec.js";
 
 function safePluginStatus(plugins) {
   if (!plugins || typeof plugins.status !== "function") return {};
@@ -109,104 +30,27 @@ function safeProjects(projects) {
   }
 }
 
-function pickActiveProject(projectList) {
-  return projectList.find((project) => Number(project.id) !== 0) || projectList[0] || null;
-}
-
-function decorateExternalWidgets(pluginStatus, overrides) {
-  return EXTERNAL_WIDGETS.map((widget) => {
-    // Three-way status:
-    //   1. user explicitly disabled it → "disabled" (sticky, regardless
-    //      of plugin auto-detect),
-    //   2. daemon has a running plugin → "available",
-    //   3. user toggled it on but no plugin backing → "configured"
-    //      (Deck UI can show "no daemon support yet" hint),
-    //   4. nothing → leave the static "not_configured" default.
-    const override = overrides[widget.id];
-    const status = pluginStatus[widget.id];
-    const decorated = { ...widget };
-    if (status) {
-      decorated.daemon_status = status;
-    }
-    if (override?.enabled === false) {
-      decorated.status = "disabled";
-    } else if (status) {
-      decorated.status = status.enabled === false ? "disabled" : "available";
-    } else if (override?.enabled === true) {
-      decorated.status = "configured";
-    }
-    // Always echo the user-toggle so the app can render the switch
-    // independently of the running/available bit.
-    decorated.user_enabled = override?.enabled ?? null;
-    return decorated;
-  });
-}
-
-export function buildDeckManifest({ projects, plugins, version, startedAt, config }) {
-  const projectList = safeProjects(projects);
-  const pluginStatus = safePluginStatus(plugins);
-  const activeProject = pickActiveProject(projectList);
-  const overrides =
-    (config?.deck && typeof config.deck === "object" && config.deck.widget_overrides) || {};
-
-  return {
-    status: "ok",
-    daemon: {
-      name: "apx",
-      version,
-      host: config?.host || "127.0.0.1",
-      port: config?.port || 7430,
-      uptime_s: Math.round((Date.now() - startedAt) / 1000),
-      started_at: new Date(startedAt).toISOString(),
-    },
-    deck: {
-      name: "apx-deck",
-      desktops: DESKTOPS,
-      widgets: [...CORE_WIDGETS, ...decorateExternalWidgets(pluginStatus, overrides)],
-      suggested_actions: SAFE_ACTIONS,
-    },
-    apx: {
-      active_project: activeProject,
-      projects: projectList,
-      plugins: pluginStatus,
-      endpoints: {
-        health: "/health",
-        projects: "/projects",
-        plugins: "/plugins",
-        voice_turn: "/voice/turn",
-        transcribe_chunk: "/transcribe/chunk",
-        super_agent_chat: "/projects/:pid/super-agent/chat",
-        super_agent_stream: "/projects/:pid/super-agent/chat/stream",
-      },
-    },
-    safety: {
-      direct_shell: false,
-      arbitrary_commands: false,
-      dangerous_actions_require_confirmation: true,
-      allowed_actions_only: true,
-    },
-  };
-}
-
-// Whitelist of widget ids the user is allowed to override. Keeps a
-// rogue client from writing arbitrary keys into the global config.
-const TOGGLEABLE_WIDGETS = new Set([
-  ...EXTERNAL_WIDGETS.map((w) => w.id),
-  // CORE_WIDGETS are intentionally NOT in here — they're built-in APX
-  // surfaces and don't make sense to disable.
-]);
-
 export function register(app, ctx) {
   app.get("/deck/manifest", (_req, res) => {
-    res.json(buildDeckManifest(ctx));
+    const overrides =
+      (ctx.config?.deck && typeof ctx.config.deck === "object" && ctx.config.deck.widget_overrides) || {};
+    res.json(
+      buildDeckManifest({
+        projectList: safeProjects(ctx.projects),
+        pluginStatus: safePluginStatus(ctx.plugins),
+        overrides,
+        version: ctx.version,
+        startedAt: ctx.startedAt,
+        config: ctx.config,
+      })
+    );
   });
 
   // PATCH /deck/widgets/:id  body: { enabled: boolean }
   //
-  // Persists the user's enable/disable choice for an external widget
-  // into the global config under `deck.widget_overrides[id]`. The next
-  // /deck/manifest call reflects it. No-op for unknown widget ids so
-  // the deck UI can stay forward-compatible with future widgets.
+  // Persists the user's enable/disable choice for an external widget into the
+  // global config under `deck.widget_overrides[id]`. No-op for unknown widget
+  // ids so the deck UI can stay forward-compatible.
   app.patch("/deck/widgets/:id", async (req, res) => {
     const id = req.params.id;
     if (!TOGGLEABLE_WIDGETS.has(id)) {
@@ -217,14 +61,9 @@ export function register(app, ctx) {
       return res.status(400).json({ error: "body.enabled must be boolean" });
     }
     // CRITICAL: we MUST read config fresh from disk before mutating.
-    // The captured `ctx.config` is a snapshot from daemon startup —
-    // any `apx project add` that happened since then is NOT in there.
-    // Persisting that stale snapshot wipes out user-added projects
-    // (which is exactly the bug we hit when we first shipped this).
-    //
-    // The on-disk file is the source of truth for everything except
-    // the override we're about to set; we mutate ONLY the override and
-    // leave everything else intact.
+    // The captured `ctx.config` is a snapshot from daemon startup — any
+    // `apx project add` that happened since then is NOT in there. Persisting
+    // that stale snapshot wipes out user-added projects.
     try {
       const { readConfig, writeConfig } = await import("#core/config/index.js");
       const fresh = readConfig();
@@ -236,9 +75,8 @@ export function register(app, ctx) {
       fresh.deck.widget_overrides[id] = { enabled };
       writeConfig(fresh);
 
-      // Also mirror the override into the live ctx.config so the next
-      // /deck/manifest in this same process picks it up without a
-      // re-read (mergeDefaults runs once at startup).
+      // Mirror into the live ctx.config so the next /deck/manifest in this
+      // same process picks it up without a re-read.
       if (ctx.config) {
         ctx.config.deck = ctx.config.deck || {};
         ctx.config.deck.widget_overrides = ctx.config.deck.widget_overrides || {};
@@ -252,10 +90,8 @@ export function register(app, ctx) {
 
   // POST /projects/:pid/context/copy
   //
-  // Reads the project's AGENTS.md + .apc/memory.md, concatenates them
-  // with a small header per file, and ships the result to the
-  // daemon-host clipboard via pbcopy/xclip/clip. Returns byte count so
-  // the deck can toast "X bytes copiados".
+  // Reads the project's AGENTS.md + .apc/memory.md, concatenates them with a
+  // small header per file, and ships the result to the daemon-host clipboard.
   app.post("/projects/:pid/context/copy", async (req, res) => {
     const project = ctx.project ? ctx.project(req, res) : null;
     if (!project) return; // project() already 404'd
@@ -270,11 +106,6 @@ export function register(app, ctx) {
   });
 
   // POST /projects/:pid/notes  body: { body: "...", title?: "..." }
-  //
-  // Appends to .apc/notes/YYYY-MM-DD.md. Each note is a markdown block
-  // with timestamp + title + body. No editing — the file is append-only
-  // by design so the daemon doesn't have to manage UIDs. The deck UI
-  // can later read this back via GET if we add it.
   app.post("/projects/:pid/notes", async (req, res) => {
     const project = ctx.project ? ctx.project(req, res) : null;
     if (!project) return;
@@ -295,20 +126,9 @@ export function register(app, ctx) {
 
   // POST /deck/exec
   //
-  // Light-touch action runner for the deck buttons. We don't want the
-  // companion clients to shell out arbitrary commands — that's the
-  // safety promise in /deck/manifest — so the body picks from a small
-  // whitelist of "intent" verbs and the server picks the OS command.
-  //
-  // Body shape:
-  //   { kind: "open_app", target: "claude" | "cursor" | "vscode" | "terminal" }
-  //   { kind: "open_path", target: "/abs/path" | "<projectId>" }   // opens in Finder/default
-  //   { kind: "open_path_in", target: "<projectId>", app: "vscode" | "cursor" | "terminal" }
-  //   { kind: "open_url", target: "https://..." }
-  //   { kind: "copy_clipboard", text: "..." }
-  //
-  // Everything routes through `open` on macOS, `xdg-open` on Linux, or
-  // `start` on Windows — no shell metacharacters, all args as array.
+  // Light-touch action runner for the deck buttons. Companion clients can't
+  // shell out arbitrary commands — body picks from a whitelist of "intent"
+  // verbs and the server picks the OS command. See deck-exec.js for the kinds.
   app.post("/deck/exec", async (req, res) => {
     const { kind, target, app: appHint, text } = req.body || {};
     if (!kind || typeof kind !== "string") {
@@ -322,190 +142,3 @@ export function register(app, ctx) {
     }
   });
 }
-
-// ── /deck/exec implementation ───────────────────────────────────────
-//
-// All shell spawning sits behind this helper so it can be unit-tested
-// in isolation. The OS abstraction is intentionally tiny: pick the
-// "opener" command for the platform and pass `target` as a single arg
-// (no shell). For app-launching on macOS we use `open -a <App>`.
-
-const MAC_APPS = {
-  // Whitelisted mac app names. Adding here is the only way the deck
-  // can launch something — we never honour a free-form `app` string.
-  claude: "Claude",
-  chatgpt: "ChatGPT",
-  cursor: "Cursor",
-  vscode: "Visual Studio Code",
-  zen: "Zen Browser",
-  terminal: "Terminal",
-  iterm: "iTerm",
-  finder: "Finder",
-};
-
-async function runDeckExec({ kind, target, appHint, text, ctx }) {
-  const { spawn } = await import("node:child_process");
-  const platform = process.platform;
-
-  const spawnDetached = (cmd, args) =>
-    new Promise((resolve, reject) => {
-      const child = spawn(cmd, args, { stdio: "ignore", detached: true });
-      let settled = false;
-      const done = (err) => {
-        if (settled) return;
-        settled = true;
-        err ? reject(err) : resolve();
-      };
-      child.on("error", done);
-      // Give the process a tick to fail-fast (bad binary); otherwise
-      // detach and assume success.
-      setTimeout(() => {
-        try { child.unref(); } catch {}
-        done(null);
-      }, 250);
-    });
-
-  const opener = () => {
-    if (platform === "darwin") return "open";
-    if (platform === "win32") return "start";
-    return "xdg-open";
-  };
-
-  // Resolve a project id (number or "<n>") into an absolute path via
-  // the daemon's project manager. Returns null when the id is bogus.
-  const projectPath = (idOrPath) => {
-    if (!idOrPath) return null;
-    const str = String(idOrPath);
-    if (str.startsWith("/")) return str;
-    if (!/^\d+$/.test(str)) return null;
-    const p = ctx.projects?.get?.(parseInt(str, 10));
-    return p?.path || null;
-  };
-
-  if (kind === "open_app") {
-    if (platform !== "darwin") throw new Error("open_app only implemented on macOS for now");
-    const appName = MAC_APPS[String(target || "").toLowerCase()];
-    if (!appName) throw new Error(`unknown app: ${target}`);
-    // Two-step launch:
-    //   1. `open -a` ensures the app is running (no-op if already up).
-    //   2. AppleScript `activate` brings it to the foreground across
-    //      Spaces / Stage Manager, which `open` alone often skips when
-    //      the app was already running in the background.
-    // Both are best-effort; we surface success as long as the launch
-    // command exited cleanly.
-    await spawnDetached("open", ["-a", appName]);
-    try {
-      await new Promise((resolve) => {
-        const child = spawn("osascript", [
-          "-e",
-          `tell application "${appName}" to activate`,
-        ], { stdio: "ignore" });
-        child.on("close", () => resolve());
-        child.on("error", () => resolve());
-        setTimeout(() => { try { child.kill(); } catch {} ; resolve(); }, 600);
-      });
-    } catch {
-      // osascript missing or refused — `open -a` already ran.
-    }
-    return { app: appName };
-  }
-
-  if (kind === "open_path") {
-    const resolved = projectPath(target);
-    if (!resolved) throw new Error(`open_path: invalid target ${target}`);
-    await spawnDetached(opener(), [resolved]);
-    return { path: resolved };
-  }
-
-  if (kind === "open_path_in") {
-    if (platform !== "darwin") throw new Error("open_path_in only implemented on macOS for now");
-    const resolved = projectPath(target);
-    if (!resolved) throw new Error(`open_path_in: invalid target ${target}`);
-    const appName = MAC_APPS[String(appHint || "").toLowerCase()];
-    if (!appName) throw new Error(`open_path_in: unknown app ${appHint}`);
-    await spawnDetached("open", ["-a", appName, resolved]);
-    return { app: appName, path: resolved };
-  }
-
-  if (kind === "open_url") {
-    if (!target || !/^https?:\/\//i.test(String(target))) {
-      throw new Error("open_url: target must be http(s) URL");
-    }
-    await spawnDetached(opener(), [String(target)]);
-    return { url: target };
-  }
-
-  if (kind === "copy_clipboard") {
-    if (typeof text !== "string") throw new Error("copy_clipboard: text required");
-    // pbcopy on mac; xclip on linux; clip on windows.
-    const cmd =
-      platform === "darwin" ? "pbcopy" :
-      platform === "win32" ? "clip" :
-      "xclip";
-    const args = platform === "linux" ? ["-selection", "clipboard"] : [];
-    await new Promise((resolve, reject) => {
-      const child = spawn(cmd, args, { stdio: ["pipe", "ignore", "ignore"] });
-      child.on("error", reject);
-      child.on("close", (code) => (code === 0 ? resolve() : reject(new Error(`${cmd} exited ${code}`))));
-      child.stdin.end(text);
-    });
-    return { bytes: text.length };
-  }
-
-  throw new Error(`unknown kind: ${kind}`);
-}
-
-// ── Context + Notes helpers ────────────────────────────────────────
-
-async function readProjectContext(projectPath) {
-  const fs = await import("node:fs/promises");
-  const path = await import("node:path");
-  const candidates = [
-    { rel: "AGENTS.md", label: "AGENTS.md" },
-    { rel: ".apc/memory.md", label: ".apc/memory.md" },
-  ];
-  const chunks = [];
-  for (const { rel, label } of candidates) {
-    try {
-      const abs = path.join(projectPath, rel);
-      const content = await fs.readFile(abs, "utf8");
-      if (content.trim()) {
-        chunks.push(`# ${label}\n\n${content.trim()}\n`);
-      }
-    } catch {
-      // missing file is fine; we just skip it.
-    }
-  }
-  return chunks.join("\n---\n\n");
-}
-
-async function copyToClipboard(text) {
-  const { spawn } = await import("node:child_process");
-  const platform = process.platform;
-  const cmd =
-    platform === "darwin" ? "pbcopy" :
-    platform === "win32" ? "clip" :
-    "xclip";
-  const args = platform === "linux" ? ["-selection", "clipboard"] : [];
-  await new Promise((resolve, reject) => {
-    const child = spawn(cmd, args, { stdio: ["pipe", "ignore", "ignore"] });
-    child.on("error", reject);
-    child.on("close", (code) => (code === 0 ? resolve() : reject(new Error(`${cmd} exited ${code}`))));
-    child.stdin.end(text);
-  });
-}
-
-async function appendProjectNote(projectPath, { title, body }) {
-  const fs = await import("node:fs/promises");
-  const path = await import("node:path");
-  const notesDir = path.join(projectPath, ".apc", "notes");
-  await fs.mkdir(notesDir, { recursive: true });
-  const today = new Date().toISOString().slice(0, 10);
-  const file = path.join(notesDir, `${today}.md`);
-  const ts = new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
-  const block = title
-    ? `\n## ${title}\n_${ts}_\n\n${body}\n`
-    : `\n### ${ts}\n\n${body}\n`;
-  await fs.appendFile(file, block, "utf8");
-  return file;
-}

package/src/host/daemon/api/engines.js

@@ -2,86 +2,7 @@
 // POST /engines/models      — live model catalog from a provider.
 // GET  /engines/models      — legacy (Ollama only, no auth).
 import { ENGINE_IDS } from "#core/engines/index.js";
-import { fetchJsonWithTimeout } from "#core/engines/_health.js";
-
-const DEFAULT_BASE = {
-  openai:     "https://api.openai.com/v1",
-  groq:       "https://api.groq.com/openai/v1",
-  openrouter: "https://openrouter.ai/api/v1",
-  gemini:     "https://generativelanguage.googleapis.com/v1beta/openai",
-  anthropic:  "https://api.anthropic.com/v1",
-  ollama:     "http://localhost:11434",
-};
-
-// Gemini's native models endpoint returns a much richer catalog than the
-// OpenAI-compat shim (which only echoes back a handful). We always query the
-// native URL regardless of the user's configured base_url.
-const GEMINI_NATIVE_BASE = "https://generativelanguage.googleapis.com/v1beta";
-
-// Returns { models } or { error }. Reads the right /models endpoint per engine.
-async function listModels(engine, baseUrl, apiKey) {
-  const base = String(baseUrl || DEFAULT_BASE[engine] || "").replace(/\/$/, "");
-
-  if (engine === "ollama") {
-    const b = base || process.env.OLLAMA_HOST || "http://localhost:11434";
-    const r = await fetchJsonWithTimeout(`${b}/api/tags`, { timeoutMs: 2500 });
-    if (!r.ok) return { error: r.reason || "no se pudo contactar Ollama" };
-    const list = Array.isArray(r.json?.models) ? r.json.models : [];
-    return { models: list.map((m) => m?.name).filter((n) => typeof n === "string" && n) };
-  }
-
-  if (engine === "anthropic") {
-    if (!apiKey) return { error: "falta api_key" };
-    const b = base || DEFAULT_BASE.anthropic;
-    const r = await fetchJsonWithTimeout(`${b}/models?limit=100`, {
-      timeoutMs: 5000,
-      headers: { "x-api-key": apiKey, "anthropic-version": "2023-06-01" },
-    });
-    if (!r.ok) return { error: r.reason || `HTTP ${r.status}` };
-    const data = Array.isArray(r.json?.data) ? r.json.data : [];
-    return { models: data.map((m) => m?.id).filter(Boolean) };
-  }
-
-  if (engine === "gemini") {
-    if (!apiKey) return { error: "falta api_key" };
-    // Native Gemini API: returns a `models` array with rich metadata, including
-    // `supportedGenerationMethods` so we can drop embeddings/vision-only entries.
-    // Names come back as "models/<id>"; strip the prefix for display.
-    const r = await fetchJsonWithTimeout(
-      `${GEMINI_NATIVE_BASE}/models?key=${encodeURIComponent(apiKey)}&pageSize=200`,
-      { timeoutMs: 5000 },
-    );
-    if (!r.ok) return { error: r.reason || `HTTP ${r.status}` };
-    const data = Array.isArray(r.json?.models) ? r.json.models : [];
-    const models = data
-      .filter((m) => {
-        const methods = m?.supportedGenerationMethods;
-        if (!Array.isArray(methods)) return true;
-        return methods.includes("generateContent");
-      })
-      .map((m) => {
-        const name = typeof m?.name === "string" ? m.name : "";
-        return name.startsWith("models/") ? name.slice("models/".length) : name;
-      })
-      .filter(Boolean);
-    return { models };
-  }
-
-  // openai-compatible family: openai, groq, openrouter, azure, custom
-  if (!apiKey) return { error: "falta api_key" };
-  if (!base) return { error: "falta base_url" };
-  const r = await fetchJsonWithTimeout(`${base}/models`, {
-    timeoutMs: 5000,
-    headers: { authorization: `Bearer ${apiKey}` },
-  });
-  if (!r.ok) return { error: r.reason || `HTTP ${r.status}` };
-  const data = Array.isArray(r.json?.data)
-    ? r.json.data
-    : Array.isArray(r.json?.models)
-      ? r.json.models
-      : [];
-  return { models: data.map((m) => m?.id || m?.name).filter(Boolean) };
-}
+import { listModels } from "#core/engines/catalog.js";
 
 export function register(app, { config }) {
   app.get("/engines", (_req, res) => res.json({ engines: ENGINE_IDS }));

package/src/host/daemon/api/exec.js

@@ -13,7 +13,7 @@ import {
   appendTurn,
   readConversation,
   setStatus,
-} from "../conversations.js";
+} from "#core/stores/conversations.js";
 
 // Pick a model for a direct agent chat: explicit override → agent's own model →
 // super-agent default (resolved via the same router the super-agent uses, so

package/src/host/daemon/api/mcps.js

@@ -202,4 +202,36 @@ export function register(app, { projects, registries, project }) {
       res.status(500).json({ error: e.message });
     }
   });
+
+  // Smoke test — calls tools/list and reports either the tool catalog or a
+  // clean error message. Used by the "Test" button in the MCP card so the
+  // user can sanity-check a freshly-saved MCP without firing a real tool.
+  app.post("/projects/:pid/mcps/:name/test", async (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    try {
+      const result = await registries.for(p).listTools(req.params.name);
+      const tools = Array.isArray(result?.tools) ? result.tools : [];
+      res.json({
+        ok: true,
+        tool_count: tools.length,
+        tools: tools.map((t) => ({
+          name: t.name,
+          description: t.description || "",
+        })),
+      });
+    } catch (e) {
+      res.status(200).json({ ok: false, error: e.message });
+    }
+  });
+
+  // In-memory log buffer for one MCP — stderr tail (stdio) or fetch summary
+  // (http) plus a ring of recent events.
+  app.get("/projects/:pid/mcps/:name/logs", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const logs = registries.for(p).getLogs(req.params.name);
+    if (!logs) return res.status(404).json({ error: "MCP not found" });
+    res.json(logs);
+  });
 }