@agentprojectcontext/apx 1.75.0 → 1.77.0

package/src/interfaces/cli/commands/panel.js

@@ -0,0 +1,131 @@
+// apx panel — reach the admin panel from another device on the same network.
+//
+//   apx panel status
+//   apx panel share   [--host 192.168.1.40]
+//   apx panel unshare
+//
+// This binds a second, specific LAN address. It is NOT a tunnel: nothing leaves
+// the local network. Loopback stays the default, sharing is always explicit,
+// and the daemon's auth is untouched — the URL carries the token because
+// /admin/web-token is loopback-only by design, so a phone cannot fetch it.
+import fs from "node:fs";
+import { readConfig, writeConfig, effectivePort, effectiveHost } from "#core/config/index.js";
+import { TOKEN_PATH } from "#core/config/paths.js";
+import { detectLanAddresses, validateBindHost, isLoopback, isWildcard } from "#core/net/lan.js";
+
+export const PANEL_USAGE = {
+  status: "apx panel status",
+  share: "apx panel share [--host <ip>]",
+  unshare: "apx panel unshare",
+};
+
+function readToken() {
+  try {
+    return fs.readFileSync(TOKEN_PATH, "utf8").trim();
+  } catch {
+    return "";
+  }
+}
+
+function panelUrl(host, port, token) {
+  // /admin/web-token refuses anything that is not loopback, so the panel on a
+  // phone can only authenticate from the fragment. The fragment never reaches
+  // the server or a proxy log — that is why it is a fragment and not a query.
+  return `http://${host}:${port}/` + (token ? `#token=${token}` : "");
+}
+
+export async function cmdPanelStatus() {
+  const cfg = readConfig();
+  const host = effectiveHost(cfg);
+  const port = effectivePort(cfg);
+
+  if (isLoopback(host)) {
+    console.log(`panel: local only — http://${host}:${port}`);
+    console.log("  Nothing on your network can reach it.");
+    console.log("  To reach it from your phone: apx panel share");
+    return;
+  }
+
+  // 0.0.0.0 is a bigger promise than "reachable on my network": it also covers
+  // every interface that appears LATER — a VPN, a hotspot, a bridged container.
+  // Worth calling out separately rather than reporting it as ordinary sharing.
+  if (isWildcard(host)) {
+    console.log(`panel: bound to EVERY interface — ${host}:${port}`);
+    const addrs = detectLanAddresses();
+    if (addrs.length) {
+      console.log(`  Currently reachable at: ${addrs.map((a) => `http://${a.address}:${port}`).join(", ")}`);
+    }
+    console.log("  This also covers interfaces that appear later — a VPN, a hotspot, a");
+    console.log("  container bridge. Auth still applies, but the surface is wider than");
+    console.log("  it needs to be.");
+    console.log("");
+    console.log("  Narrow it to one address: apx panel share");
+    console.log("  Turn it off entirely:    apx panel unshare");
+    return;
+  }
+
+  console.log(`panel: SHARED on your network — http://${host}:${port}`);
+  console.log(`  Anyone on this network who has the URL and the token can open it.`);
+  console.log(`  To stop: apx panel unshare`);
+}
+
+export async function cmdPanelShare(args) {
+  const cfg = readConfig();
+  const port = effectivePort(cfg);
+
+  const requested = args?.flags?.host;
+  const candidates = detectLanAddresses();
+
+  if (!requested && candidates.length === 0) {
+    console.error("apx panel share: no network address found on this machine.");
+    console.error("  Are you connected to a network? Pass one explicitly with --host <ip>.");
+    process.exit(1);
+  }
+
+  const host = requested || candidates[0].address;
+  const check = validateBindHost(host);
+  if (!check.ok) {
+    console.error(`apx panel share: ${check.reason}`);
+    process.exit(1);
+  }
+
+  cfg.host = host;
+  writeConfig(cfg);
+
+  const token = readToken();
+  const iface = candidates.find((c) => c.address === host)?.iface;
+
+  console.log(`panel shared on ${host}:${port}${iface ? ` (${iface})` : ""}`);
+  console.log("");
+  console.log("  Open this on your phone — the token is in the URL:");
+  console.log(`  ${panelUrl(host, port, token)}`);
+  console.log("");
+  // Say plainly what changed. A LAN can be a café or a coworking space.
+  console.log("  What this means: anyone on this network can now REACH the panel.");
+  console.log("  They still need the token above, which is not guessable — treat that");
+  console.log("  URL like a password, and run `apx panel unshare` when you are done.");
+  if (candidates.length > 1) {
+    const others = candidates.filter((c) => c.address !== host).map((c) => `${c.address} (${c.iface})`);
+    console.log(`  Other addresses on this machine: ${others.join(", ")}`);
+  }
+  console.log("");
+  console.log("  Restart the daemon for the new binding to take effect: apx restart");
+}
+
+export async function cmdPanelUnshare() {
+  const cfg = readConfig();
+  const port = effectivePort(cfg);
+  const was = effectiveHost(cfg);
+
+  if (isLoopback(was)) {
+    console.log("panel is already local only — nothing to do");
+    return;
+  }
+
+  cfg.host = "127.0.0.1";
+  writeConfig(cfg);
+
+  console.log(`panel is local only again — http://127.0.0.1:${port}`);
+  console.log(`  Was ${was}. Nothing on your network can reach it now.`);
+  console.log("  Restart the daemon to apply: apx restart");
+}

package/src/interfaces/cli/commands/task.js

@@ -1,7 +1,8 @@
 // apx task — per-project TODO list. Backed by /projects/:pid/tasks.
 //
 //   apx task add "<title>" [--project X] [--body Y] [--tag t] [--due 2026-05-30] [--agent A]
-//   apx task list          [--project X] [--state open|done|dropped|all] [--tag X] [--agent Y] [--due-before ISO] [--limit N]
+//   apx task list          [--all | --project X] [--state ...] [--status ...] [--tag X] [--agent Y]
+//                          [--due-before ISO] [--due-after ISO] [--updated-since ISO] [--limit N]
 //   apx task show <id>     [--project X]
 //   apx task done <id>     [--project X] [--by name]
 //   apx task drop <id>     [--project X] [--by name]
@@ -18,7 +19,7 @@ import { resolveProjectId } from "./project.js";
 // ── Usage strings (also used by index.js help topics) ────────────────────────
 export const TASK_USAGE = {
   add:    'apx task add "<title>" [--project X] [--body Y] [--tag t]... [--due 2026-05-30] [--agent A]',
-  list:   "apx task list [--project X] [--state open|done|dropped|all] [--tag X] [--agent Y] [--due-before ISO] [--limit N]",
+  list:   "apx task list [--all | --project X] [--state open|done|dropped|all] [--status pending|running|in_review|blocked] [--tag X] [--agent Y] [--due-before ISO] [--due-after ISO] [--updated-since ISO] [--limit N]",
   show:   "apx task show <id> [--project X]",
   done:   "apx task done <id> [--project X] [--by name]",
   drop:   "apx task drop <id> [--project X] [--by name]",
@@ -44,14 +45,20 @@ function shortTs(iso) {
   return String(iso).replace(/T/, " ").replace(/Z$/, "").slice(0, 16);
 }
 
-function renderTable(rows) {
+function renderTable(rows, { showProject = false } = {}) {
   if (!rows.length) {
     console.log("(no tasks)");
     return;
   }
-  const idW = Math.max(...rows.map((r) => r.id.length), 4);
+  const idW = Math.max(...rows.map((r) => String(r.id).length), 4);
+  const projW = showProject
+    ? Math.min(Math.max(...rows.map((r) => String(r.project_name || "").length), 7), 20)
+    : 0;
+  const proj = (t) => (showProject ? String(t.project_name || "").slice(0, projW).padEnd(projW) + "  " : "");
+
   console.log(
     "ID".padEnd(idW) + "  " +
+    (showProject ? "PROJECT".padEnd(projW) + "  " : "") +
     "STATE".padEnd(7) + "  " +
     "DUE".padEnd(10) + "  " +
     "TAGS".padEnd(18) + "  " +
@@ -61,7 +68,8 @@ function renderTable(rows) {
     const tags = (t.tags || []).join(",").slice(0, 18).padEnd(18);
     const title = (t.title || "").slice(0, 60);
     console.log(
-      t.id.padEnd(idW) + "  " +
+      String(t.id).padEnd(idW) + "  " +
+      proj(t) +
       (t.state || "open").padEnd(7) + "  " +
       (t.due || "—").padEnd(10) + "  " +
       tags + "  " +
@@ -105,17 +113,40 @@ export async function cmdTaskAdd(args) {
 }
 
 // ── list ──────────────────────────────────────────────────────────────────────
+// The list endpoints answer with a { meta, data } envelope. Older callers here
+// treated the response as a bare array, which made `apx task list` print
+// "(no tasks)" no matter what — the rows were sitting in `.data`.
+function unwrap(res) {
+  if (Array.isArray(res)) return { rows: res, meta: null };
+  return { rows: Array.isArray(res?.data) ? res.data : [], meta: res?.meta || null };
+}
+
 export async function cmdTaskList(args) {
-  const pid = await resolveProjectId(args?.flags?.project);
   const params = new URLSearchParams();
-  if (args.flags?.state)          params.set("state", args.flags.state);
-  if (args.flags?.tag)            params.set("tag", args.flags.tag);
-  if (args.flags?.agent)          params.set("agent", args.flags.agent);
-  if (args.flags?.["due-before"]) params.set("due_before", args.flags["due-before"]);
-  if (args.flags?.limit)          params.set("limit", String(args.flags.limit));
+  if (args.flags?.state)             params.set("state", args.flags.state);
+  if (args.flags?.tag)               params.set("tag", args.flags.tag);
+  if (args.flags?.agent)             params.set("agent", args.flags.agent);
+  if (args.flags?.status)            params.set("status", args.flags.status);
+  if (args.flags?.["due-before"])    params.set("due_before", args.flags["due-before"]);
+  if (args.flags?.["due-after"])     params.set("due_after", args.flags["due-after"]);
+  if (args.flags?.["updated-since"]) params.set("updated_since", args.flags["updated-since"]);
+  if (args.flags?.limit)             params.set("limit", String(args.flags.limit));
   const qs = params.toString();
-  const rows = await http.get(`/projects/${pid}/tasks${qs ? "?" + qs : ""}`);
-  renderTable(rows);
+
+  // --all folds every registered project into one list, each row carrying the
+  // project it came from. Without it, behaviour is exactly as before.
+  const all = !!args.flags?.all;
+  const path = all
+    ? `/tasks${qs ? "?" + qs : ""}`
+    : `/projects/${await resolveProjectId(args?.flags?.project)}/tasks${qs ? "?" + qs : ""}`;
+
+  const { rows, meta } = unwrap(await http.get(path));
+  renderTable(rows, { showProject: all });
+
+  // A project whose task log could not be read is reported, never swallowed.
+  for (const s of meta?.skipped || []) {
+    console.error(`warning: project #${s.id} skipped — ${s.error}`);
+  }
 }
 
 // ── show ──────────────────────────────────────────────────────────────────────

package/src/interfaces/cli/index.js

@@ -161,6 +161,11 @@ import {
   cmdProfileDoctor,
   cmdProfileUninstall,
 } from "./commands/profile.js";
+import {
+  cmdPanelStatus,
+  cmdPanelShare,
+  cmdPanelUnshare,
+} from "./commands/panel.js";
 import {
   cmdOrgShow,
   cmdOrgAreaAdd,
@@ -1617,6 +1622,19 @@ const HELP_TOPICS = new Map(Object.entries({
     examples: ["apx plugins status telegram"],
   }),
 
+  panel: topic({
+    title: "apx panel",
+    summary:
+      "Reach the admin panel from another device on the same network. Not a tunnel — nothing leaves your LAN, and loopback stays the default.",
+    usage: ["apx panel <status|share|unshare>"],
+    commands: [
+      ["status", "Whether the panel is local only or shared, and on what address."],
+      ["share", "Bind a LAN address and print the URL to open on your phone."],
+      ["unshare", "Go back to local only."],
+    ],
+    options: [["--host <ip>", "share: bind this address instead of the detected one."]],
+    examples: ["apx panel status", "apx panel share", "apx panel unshare"],
+  }),
   profile: topic({
     title: "apx profile",
     summary:
@@ -1666,10 +1684,16 @@ const HELP_TOPICS = new Map(Object.entries({
       ["reopen <id>", "Reopen a done or dropped task."],
       ["patch | edit <id>", "Edit fields on an existing task."],
     ],
-    options: [["--project <name|id|path>", "Pin command to a specific project."]],
+    options: [
+      ["--project <name|id|path>", "Pin command to a specific project."],
+      ["--all", "list: fold every registered project into one list, each row labelled."],
+      ["--status <s>", "list: workflow sub-status — pending | running | in_review | blocked."],
+      ["--updated-since <ISO>", "list: only what moved since that moment."],
+    ],
     examples: [
       "apx task add \"Ship release notes\" --tag release --due 2026-06-01",
       "apx task list --state open --tag release",
+      "apx task list --all --status blocked",
       "apx task done t_abc123",
     ],
   }),
@@ -2799,6 +2823,16 @@ async function dispatch(cmd, rest) {
         break;
       }
 
+      case "panel": {
+        const sub = rest[0];
+        const a = parseArgs(rest.slice(1));
+        if (!sub || sub === "status") await cmdPanelStatus(a);
+        else if (sub === "share") await cmdPanelShare(a);
+        else if (sub === "unshare") await cmdPanelUnshare(a);
+        else die(`unknown panel subcommand: ${sub}\nUsage: apx panel <status|share|unshare>`);
+        break;
+      }
+
       case "profile":
       case "profiles": {
         const sub = rest[0];