@agentprojectcontext/apx 1.33.1 → 1.35.0

package/src/core/config/redact.js

@@ -0,0 +1,95 @@
+// Secret redaction for the global config. Wraps any string secret with a
+// `*** set *** (...<suffix>)` marker so the web admin can show "value is set"
+// without leaking it, AND so PATCH callers can echo back the marker to mean
+// "don't touch this one" — see isSecretMarker / mergeRedactedChannels below.
+//
+// The dotted paths in SECRET_PATHS are the single source of truth for "which
+// keys are secrets". Anything new (a new engine api_key, a new TTS provider
+// key, etc.) goes here and every redaction path picks it up.
+
+const SECRET_MARKER_PREFIX = "*** set ***";
+
+export const SECRET_PATHS = [
+  "engines.anthropic.api_key",
+  "engines.openai.api_key",
+  "engines.groq.api_key",
+  "engines.openrouter.api_key",
+  "engines.gemini.api_key",
+  "voice.tts.elevenlabs.api_key",
+  "voice.tts.openai.api_key",
+  "voice.tts.gemini.api_key",
+  "memory.embeddings.openai.api_key",
+  "memory.embeddings.gemini.api_key",
+  // Telegram bot tokens live inside an array — handled separately in redact()
+  // because dotted paths can't address array entries.
+  "telegram.channels.*.bot_token",
+];
+
+/** Replace a secret string with the visible marker, preserving the last 5 chars. */
+export function secretMarker(value) {
+  if (typeof value !== "string" || !value.length) return value;
+  const suffix = value.slice(-5);
+  return `${SECRET_MARKER_PREFIX} (...${suffix})`;
+}
+
+/** True when a value is the placeholder a redacted view sends back unchanged. */
+export function isSecretMarker(value) {
+  return typeof value === "string" && value.startsWith(SECRET_MARKER_PREFIX);
+}
+
+/** Deep-copy of `cfg` with every secret string replaced by its marker. */
+export function redactConfig(cfg) {
+  const out = JSON.parse(JSON.stringify(cfg || {}));
+  const mark = (val) => (typeof val === "string" && val.length ? secretMarker(val) : val);
+
+  for (const dotted of SECRET_PATHS) {
+    if (dotted.includes("*")) continue;
+    const parts = dotted.split(".");
+    let cur = out;
+    for (let i = 0; i < parts.length - 1; i++) {
+      if (!cur[parts[i]] || typeof cur[parts[i]] !== "object") { cur = null; break; }
+      cur = cur[parts[i]];
+    }
+    if (cur && cur[parts[parts.length - 1]]) {
+      cur[parts[parts.length - 1]] = mark(cur[parts[parts.length - 1]]);
+    }
+  }
+  const channels = out?.telegram?.channels;
+  if (Array.isArray(channels)) {
+    for (const ch of channels) {
+      if (ch && typeof ch.bot_token === "string" && ch.bot_token.length) {
+        ch.bot_token = mark(ch.bot_token);
+      }
+    }
+  }
+  return out;
+}
+
+/** Redact a single Telegram channel record. */
+export function redactChannel(channel) {
+  if (!channel?.bot_token) return channel;
+  return { ...channel, bot_token: secretMarker(channel.bot_token) };
+}
+
+/**
+ * Merge a PATCH-shape `nextChannels` against the prior on-disk list. Any
+ * incoming channel whose bot_token is missing or a marker takes the prior
+ * token verbatim — so a UI that echoes the redacted view back doesn't wipe
+ * the real secret.
+ */
+export function mergeRedactedChannels(nextChannels, priorChannels) {
+  if (!Array.isArray(nextChannels)) return nextChannels;
+  const priorByName = new Map(
+    (Array.isArray(priorChannels) ? priorChannels : [])
+      .filter((c) => c && typeof c.name === "string")
+      .map((c) => [c.name, c])
+  );
+  return nextChannels.map((channel) => {
+    if (!channel || typeof channel !== "object") return channel;
+    const prior = priorByName.get(channel.name);
+    if (prior?.bot_token && (channel.bot_token === undefined || isSecretMarker(channel.bot_token))) {
+      return { ...channel, bot_token: prior.bot_token };
+    }
+    return channel;
+  });
+}

package/src/core/constants/channels.js

@@ -16,4 +16,6 @@ export const CHANNELS = Object.freeze({
   DECK: "deck",               // Mobile cockpit dashboard
   DESKTOP: "desktop",         // Electron capsule (always voice mode)
   CODE: "code",               // `apx code` — terminal coding session
+  DIRECT: "direct",           // Planned: 1:1 channel that isn't a chat platform
+  WHATSAPP: "whatsapp",       // Planned: WhatsApp bot integration
 });

package/src/core/constants/code-modes.js

@@ -0,0 +1,10 @@
+// Code session modes. PLAN = read-only exploration (the agent proposes
+// changes but never mutates); BUILD = unrestricted execution. The value
+// lives in code-sessions.json (session.mode) and is what api/code.js,
+// stores/code-sessions.js, and agent/prompts/modes/ all branch on.
+export const CODE_MODES = Object.freeze({
+  PLAN: "plan",
+  BUILD: "build",
+});
+
+export const DEFAULT_CODE_MODE = CODE_MODES.BUILD;

package/src/core/constants/index.js

@@ -3,3 +3,4 @@ export * from "./permissions.js";
 export * from "./channels.js";
 export * from "./roles.js";
 export * from "./actors.js";
+export * from "./code-modes.js";

package/src/core/deck/manifest.js

@@ -0,0 +1,186 @@
+// APX Deck manifest — the data model the companion clients (deck, desktop
+// capsule) read on boot. Pure data + decoration; no HTTP or filesystem.
+// host/daemon/api/deck.js wraps this for the /deck/manifest endpoint.
+
+export const CORE_WIDGETS = [
+  {
+    id: "apx-current-project",
+    title: "Proyecto actual",
+    source: "apx",
+    desktop: "project",
+    kind: "context",
+    status: "available",
+  },
+  {
+    id: "apx-voice",
+    title: "Voz APX",
+    source: "apx",
+    desktop: "general",
+    kind: "voice",
+    status: "available",
+  },
+  {
+    id: "apx-agents",
+    title: "Agentes APX",
+    source: "apx",
+    desktop: "ai",
+    kind: "agents",
+    status: "available",
+  },
+  {
+    id: "apx-notes",
+    title: "Notas APX",
+    source: "apx",
+    desktop: "project",
+    kind: "capture",
+    status: "available",
+  },
+];
+
+export const EXTERNAL_WIDGETS = [
+  ["docker", "Docker", "infra"],
+  ["dokploy", "Dokploy", "infra"],
+  ["factorial", "Factorial", "work"],
+  ["telegram", "Telegram", "comms"],
+  ["gmail", "Gmail", "comms"],
+  ["outlook", "Outlook", "comms"],
+  ["teams", "Teams", "comms"],
+  ["whatsapp", "WhatsApp", "comms"],
+  ["zen", "Zen Browser", "ai"],
+  ["claude", "Claude", "ai"],
+  ["chatgpt", "ChatGPT", "ai"],
+  ["cursor", "Cursor", "ai"],
+  ["codex", "Codex", "ai"],
+].map(([id, title, desktop]) => ({
+  id,
+  title,
+  source: "external",
+  desktop,
+  kind: "plugin",
+  status: "not_configured",
+}));
+
+export const DESKTOPS = [
+  { id: "general", title: "Hoy" },
+  { id: "project", title: "Proyecto" },
+  { id: "ai", title: "IA" },
+  { id: "comms", title: "Comunicaciones" },
+  { id: "infra", title: "Infra" },
+  { id: "work", title: "Tiempo laboral" },
+  { id: "plugins", title: "Plugins" },
+];
+
+export const SAFE_ACTIONS = [
+  {
+    id: "apx.copy_context",
+    title: "Copiar contexto APX",
+    risk: "safe",
+    endpoint: "/projects/:pid/agents",
+  },
+  {
+    id: "apx.voice_turn",
+    title: "Hablar con APX",
+    risk: "safe",
+    endpoint: "/voice/turn",
+  },
+  {
+    id: "apx.super_agent",
+    title: "Pedir acción a APX",
+    risk: "confirm",
+    endpoint: "/projects/:pid/super-agent/chat",
+  },
+];
+
+// Widget ids the user is allowed to override. Keeps a rogue client from
+// writing arbitrary keys into the global config under deck.widget_overrides.
+// CORE_WIDGETS are intentionally NOT in here — they're built-in APX surfaces
+// and don't make sense to disable.
+export const TOGGLEABLE_WIDGETS = new Set(EXTERNAL_WIDGETS.map((w) => w.id));
+
+function pickActiveProject(projectList) {
+  return projectList.find((project) => Number(project.id) !== 0) || projectList[0] || null;
+}
+
+/**
+ * Apply runtime status + user overrides to the static EXTERNAL_WIDGETS list.
+ *
+ *   1. user explicitly disabled it → "disabled" (sticky, regardless of plugin
+ *      auto-detect)
+ *   2. daemon has a running plugin → "available"
+ *   3. user toggled it on but no plugin backing → "configured"
+ *   4. nothing → leave the static "not_configured" default
+ */
+export function decorateExternalWidgets(pluginStatus = {}, overrides = {}) {
+  return EXTERNAL_WIDGETS.map((widget) => {
+    const override = overrides[widget.id];
+    const status = pluginStatus[widget.id];
+    const decorated = { ...widget };
+    if (status) decorated.daemon_status = status;
+    if (override?.enabled === false) {
+      decorated.status = "disabled";
+    } else if (status) {
+      decorated.status = status.enabled === false ? "disabled" : "available";
+    } else if (override?.enabled === true) {
+      decorated.status = "configured";
+    }
+    // Always echo the user-toggle so the app can render the switch
+    // independently of the running/available bit.
+    decorated.user_enabled = override?.enabled ?? null;
+    return decorated;
+  });
+}
+
+/**
+ * Build the full /deck/manifest response body.
+ *
+ * Inputs are *resolved* runtime values, not the live managers — caller is
+ * responsible for catching errors in projects.list()/plugins.status() and
+ * passing the resulting arrays/maps in (or empty defaults).
+ */
+export function buildDeckManifest({
+  projectList = [],
+  pluginStatus = {},
+  overrides = {},
+  version,
+  startedAt,
+  config,
+}) {
+  const activeProject = pickActiveProject(projectList);
+  return {
+    status: "ok",
+    daemon: {
+      name: "apx",
+      version,
+      host: config?.host || "127.0.0.1",
+      port: config?.port || 7430,
+      uptime_s: Math.round((Date.now() - startedAt) / 1000),
+      started_at: new Date(startedAt).toISOString(),
+    },
+    deck: {
+      name: "apx-deck",
+      desktops: DESKTOPS,
+      widgets: [...CORE_WIDGETS, ...decorateExternalWidgets(pluginStatus, overrides)],
+      suggested_actions: SAFE_ACTIONS,
+    },
+    apx: {
+      active_project: activeProject,
+      projects: projectList,
+      plugins: pluginStatus,
+      endpoints: {
+        health: "/health",
+        projects: "/projects",
+        plugins: "/plugins",
+        voice_turn: "/voice/turn",
+        transcribe_chunk: "/transcribe/chunk",
+        super_agent_chat: "/projects/:pid/super-agent/chat",
+        super_agent_stream: "/projects/:pid/super-agent/chat/stream",
+      },
+    },
+    safety: {
+      direct_shell: false,
+      arbitrary_commands: false,
+      dangerous_actions_require_confirmation: true,
+      allowed_actions_only: true,
+    },
+  };
+}

package/src/core/engines/catalog.js

@@ -0,0 +1,83 @@
+// Live model catalogs per engine. Wraps each provider's "list models" endpoint
+// behind one signature: listModels(engine, baseUrl?, apiKey?) → { models } or
+// { error }. Pure transport — no daemon dependencies. Both the daemon HTTP
+// adapter and CLI commands can reuse this.
+import { fetchJsonWithTimeout } from "./_health.js";
+
+export const DEFAULT_BASE = {
+  openai:     "https://api.openai.com/v1",
+  groq:       "https://api.groq.com/openai/v1",
+  openrouter: "https://openrouter.ai/api/v1",
+  gemini:     "https://generativelanguage.googleapis.com/v1beta/openai",
+  anthropic:  "https://api.anthropic.com/v1",
+  ollama:     "http://localhost:11434",
+};
+
+// Gemini's native models endpoint returns a much richer catalog than the
+// OpenAI-compat shim (which only echoes back a handful). We always query the
+// native URL regardless of the user's configured base_url.
+const GEMINI_NATIVE_BASE = "https://generativelanguage.googleapis.com/v1beta";
+
+export async function listModels(engine, baseUrl, apiKey) {
+  const base = String(baseUrl || DEFAULT_BASE[engine] || "").replace(/\/$/, "");
+
+  if (engine === "ollama") {
+    const b = base || process.env.OLLAMA_HOST || "http://localhost:11434";
+    const r = await fetchJsonWithTimeout(`${b}/api/tags`, { timeoutMs: 2500 });
+    if (!r.ok) return { error: r.reason || "no se pudo contactar Ollama" };
+    const list = Array.isArray(r.json?.models) ? r.json.models : [];
+    return { models: list.map((m) => m?.name).filter((n) => typeof n === "string" && n) };
+  }
+
+  if (engine === "anthropic") {
+    if (!apiKey) return { error: "falta api_key" };
+    const b = base || DEFAULT_BASE.anthropic;
+    const r = await fetchJsonWithTimeout(`${b}/models?limit=100`, {
+      timeoutMs: 5000,
+      headers: { "x-api-key": apiKey, "anthropic-version": "2023-06-01" },
+    });
+    if (!r.ok) return { error: r.reason || `HTTP ${r.status}` };
+    const data = Array.isArray(r.json?.data) ? r.json.data : [];
+    return { models: data.map((m) => m?.id).filter(Boolean) };
+  }
+
+  if (engine === "gemini") {
+    if (!apiKey) return { error: "falta api_key" };
+    // Native Gemini API returns rich metadata, including supportedGenerationMethods
+    // so we can drop embeddings/vision-only entries. Names come back as
+    // "models/<id>"; strip the prefix.
+    const r = await fetchJsonWithTimeout(
+      `${GEMINI_NATIVE_BASE}/models?key=${encodeURIComponent(apiKey)}&pageSize=200`,
+      { timeoutMs: 5000 },
+    );
+    if (!r.ok) return { error: r.reason || `HTTP ${r.status}` };
+    const data = Array.isArray(r.json?.models) ? r.json.models : [];
+    const models = data
+      .filter((m) => {
+        const methods = m?.supportedGenerationMethods;
+        if (!Array.isArray(methods)) return true;
+        return methods.includes("generateContent");
+      })
+      .map((m) => {
+        const name = typeof m?.name === "string" ? m.name : "";
+        return name.startsWith("models/") ? name.slice("models/".length) : name;
+      })
+      .filter(Boolean);
+    return { models };
+  }
+
+  // openai-compatible family: openai, groq, openrouter, azure, custom
+  if (!apiKey) return { error: "falta api_key" };
+  if (!base) return { error: "falta base_url" };
+  const r = await fetchJsonWithTimeout(`${base}/models`, {
+    timeoutMs: 5000,
+    headers: { authorization: `Bearer ${apiKey}` },
+  });
+  if (!r.ok) return { error: r.reason || `HTTP ${r.status}` };
+  const data = Array.isArray(r.json?.data)
+    ? r.json.data
+    : Array.isArray(r.json?.models)
+      ? r.json.models
+      : [];
+  return { models: data.map((m) => m?.id || m?.name).filter(Boolean) };
+}

package/src/core/{tools → http-tools}/browser.js

@@ -1,4 +1,3 @@
-// daemon/tools/browser.js
 // Puppeteer-backed browser automation tools for APX.
 //
 // Logic adapted from the puppeteer-server MCP server

package/src/core/{tools → http-tools}/fetch.js

@@ -1,4 +1,3 @@
-// daemon/tools/fetch.js
 // Lightweight HTTP fetch tools — no Puppeteer, no Chromium. Starts in
 // milliseconds. Use this when you only need to hit an HTTP endpoint
 // (REST API, raw page HTML, JSON). For JS-rendered pages, real clicks,

package/src/core/{tools → http-tools}/glob.js

@@ -1,4 +1,3 @@
-// daemon/tools/glob.js
 // Glob tool for APX — lists files matching a glob pattern.
 // Backends, in order of preference:
 //   1. fast-glob (npm)  — full glob spec, brace expansion, negation patterns

package/src/core/{tools → http-tools}/grep.js

@@ -1,4 +1,3 @@
-// daemon/tools/grep.js
 // Native Grep tool for APX — searches file contents by regex pattern.
 // Tries ripgrep (rg) first for speed, falls back to pure Node.js walk.
 //

package/src/core/{tools → http-tools}/registry.js

@@ -1,4 +1,3 @@
-// daemon/tools/registry.js
 // Tool Registry on-demand for APX.
 //
 // Endpoints registered by api.js:

package/src/core/{tools → http-tools}/search.js

@@ -1,4 +1,3 @@
-// daemon/tools/search.js
 // WebSearch tool for APX — 3 modes:
 //   1. DuckDuckGo HTML scraping (no API key, uses node-fetch)
 //   2. Brave Search API (requires BRAVE_API_KEY env)

package/src/core/i18n/en.js

@@ -0,0 +1,9 @@
+// Backend strings — English (en).
+export default {
+  "telegram.heads_up": "On it — working on that… 🛠️",
+  "telegram.reset_ack": "Done, context cleared. Starting fresh. What do you need?",
+  "telegram.error_generic": "Something broke on my side — already logged.",
+  "telegram.fallback_listo": "Done.",
+
+  "common.unknown_error": "Something went wrong.",
+};

package/src/core/i18n/es.js

@@ -0,0 +1,12 @@
+// Backend strings — Spanish (es). Keep this file flat dot-paths only; the
+// web admin has its own i18n tree.
+export default {
+  // Telegram channel
+  "telegram.heads_up": "Dale, estoy con eso… 🛠️",
+  "telegram.reset_ack": "Listo, contexto borrado. Arranco un hilo nuevo, ¿qué necesitás?",
+  "telegram.error_generic": "Algo se rompió de mi lado — ya lo registré.",
+  "telegram.fallback_listo": "Listo.",
+
+  // Generic helpers reused from several surfaces
+  "common.unknown_error": "Algo salió mal.",
+};

package/src/core/i18n/index.js

@@ -0,0 +1,54 @@
+// Backend i18n for daemon-side messages (Telegram heads-up, system replies,
+// any other user-facing string emitted from the host/core layer). The web
+// admin has its own dict tree under src/interfaces/web/src/i18n/ — that one
+// stays separate, this is for what the daemon sends back.
+//
+// Usage:
+//   import { t, resolveLang } from "#core/i18n/index.js";
+//   const lang = resolveLang(globalConfig);
+//   await sendTelegram(t("telegram.heads_up", { lang }));
+//
+// Adding a key: pick a clear dotted path, add it to every locale dict, and
+// the unit test in tests/i18n.test.js will assert parity (no missing
+// translations). Values can include {var} placeholders that t() will fill.
+import en from "./en.js";
+import es from "./es.js";
+import pt from "./pt.js";
+
+const DICTS = Object.freeze({ en, es, pt });
+const DEFAULT_LANG = "es";
+
+/**
+ * Pull the user's preferred language code from a globalConfig snapshot.
+ * Falls back to DEFAULT_LANG when nothing is set. The 2-char slice keeps
+ * "es-AR" / "en-US" / "pt-BR" working without per-region dicts.
+ */
+export function resolveLang(globalConfig) {
+  const raw = globalConfig?.user?.language;
+  return String(raw || DEFAULT_LANG).slice(0, 2).toLowerCase();
+}
+
+function format(s, vars) {
+  if (!vars) return s;
+  return s.replace(/\{(\w+)\}/g, (_m, k) => (k in vars ? String(vars[k]) : `{${k}}`));
+}
+
+/**
+ * Translate a key into the active locale. Missing keys fall back through:
+ *   requested lang → DEFAULT_LANG → the key itself (as a last-resort
+ *   placeholder so the caller can spot the gap).
+ */
+export function t(key, { lang = DEFAULT_LANG, vars } = {}) {
+  const code = String(lang || DEFAULT_LANG).slice(0, 2).toLowerCase();
+  const dict = DICTS[code] || DICTS[DEFAULT_LANG];
+  const value = dict?.[key] ?? DICTS[DEFAULT_LANG]?.[key] ?? key;
+  return format(value, vars);
+}
+
+/** Lower-level: get the active dict, e.g. for bulk lookups in a loop. */
+export function getDict(lang) {
+  const code = String(lang || DEFAULT_LANG).slice(0, 2).toLowerCase();
+  return DICTS[code] || DICTS[DEFAULT_LANG];
+}
+
+export { DICTS, DEFAULT_LANG };

package/src/core/i18n/pt.js

@@ -0,0 +1,9 @@
+// Backend strings — Portuguese (pt).
+export default {
+  "telegram.heads_up": "Já estou nisso… 🛠️",
+  "telegram.reset_ack": "Pronto, contexto limpo. Começando do zero — do que você precisa?",
+  "telegram.error_generic": "Algo quebrou do meu lado — já registrei.",
+  "telegram.fallback_listo": "Pronto.",
+
+  "common.unknown_error": "Algo deu errado.",
+};

package/src/core/identity/telegram.js

@@ -17,6 +17,7 @@ import {
   upsertContact,
   upsertTelegramChannel,
 } from "../config/index.js";
+import { SENDER_ROLES } from "../constants/roles.js";
 
 function telegramDisplayName(from) {
   const full = [from?.first_name, from?.last_name].filter(Boolean).join(" ").trim();
@@ -62,7 +63,7 @@ export function resolveAllowedTools(cfg, sender) {
   if (sender?.isOwner) return "*";
   const def = cfg?.telegram?.roles?.[sender?.role];
   if (def && def.tools !== undefined) return def.tools;
-  if (sender?.role === "guest") return [];
+  if (sender?.role === SENDER_ROLES.GUEST) return [];
   return "*";
 }