@agentprojectcontext/apx 1.77.0 → 1.77.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentprojectcontext/apx",
-  "version": "1.77.0",
+  "version": "1.77.2",
   "description": "APX — unified CLI + daemon for the Agent Project Context (APC) standard.",
   "publishConfig": {
     "access": "public"
@@ -40,7 +40,8 @@
     "upgrade": "pnpm install && pnpm add -g .",
     "prepare": "node scripts/install-githooks.js",
     "prepack": "node scripts/sync-apc-skill.js && node scripts/build-web.js",
-    "postinstall": "node src/interfaces/cli/postinstall.js"
+    "postinstall": "node src/interfaces/cli/postinstall.js",
+    "smoke:seam": "node --test --test-reporter=spec tests/smoke/*.smoke.js"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",

package/src/host/daemon/api/web.js

@@ -25,6 +25,7 @@ const API_PREFIXES = [
   "/messages", "/sessions", "/tools", "/mcp", "/voice", "/tts", "/desktop", "/overlay",
   "/transcribe", "/run", "/files", "/memory", "/env", "/pair", "/deck",
   "/super-agent", "/identity", "/skills", "/profiles", "/inbox",
+  "/tasks", "/agents", "/plugins", "/previews", "/embeddings",
 ];
 
 export function isApiPath(p) {

package/src/host/daemon/db.js

@@ -126,6 +126,12 @@ export class ProjectManager {
         name,
         kind,
         agents: readAgents(e.path).length,
+        // Where this project's runtime state lives. The CLI needs it to reach
+        // per-routine memory and anything else stored outside the repo — it has
+        // no other way to resolve it, and `apx routine memory` was silently
+        // broken for want of these two fields.
+        apx_id: e.apxId || null,
+        storage_path: e.storagePath || null,
       };
     });
   }

package/src/host/daemon/index.js

@@ -3,9 +3,13 @@
 // Must run before any outbound fetch — see the module header for why.
 import "#core/net/ipv4-first.js";
 import fs from "node:fs";
+import http from "node:http";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { randomBytes } from "node:crypto";
+
+// Loopback is always bound, no matter what `host` is configured to.
+const LOOPBACK_HOST = "127.0.0.1";
 import {
   readConfig,
   writeConfig,
@@ -233,9 +237,29 @@ async function main() {
   plugins.installRoutes(app);
 
   let callbackReconciler = null;
-  const server = app.listen(port, host, () => {
+
+  // Loopback is ALWAYS bound, whatever `host` says.
+  //
+  // Binding a single specific LAN address (what `apx panel share` configures)
+  // excludes 127.0.0.1 — and the CLI, the desktop app and /admin/web-token all
+  // reach the daemon over loopback. Sharing the panel with the phone must not
+  // take the local toolchain down with it, so a non-loopback host means TWO
+  // listeners on one app, not a move.
+  const extraHosts =
+    host && host !== LOOPBACK_HOST && host !== "0.0.0.0" && host !== "::" ? [host] : [];
+  const secondary = [];
+
+  const server = app.listen(port, extraHosts.length ? LOOPBACK_HOST : host, () => {
     writePid();
-    log(`apx-daemon ${PKG.version} listening on http://${host}:${port}`);
+    for (const h of extraHosts) {
+      // A secondary bind failing must never take the daemon down — the local
+      // one is already up and is the one everything depends on.
+      const s2 = http.createServer(app);
+      s2.on("error", (e) => log(`bind ${h}:${port} failed (${e.code || e.message}) — local access unaffected`));
+      s2.listen(port, h, () => log(`apx-daemon also listening on http://${h}:${port}`));
+      secondary.push(s2);
+    }
+    log(`apx-daemon ${PKG.version} listening on http://${extraHosts.length ? LOOPBACK_HOST : host}:${port}`);
     log(`projects: ${projects.list().length} | plugins: ${Object.keys(plugins.status()).join(", ") || "(none)"}`);
     plugins.startAll();
     scheduler.start();
@@ -317,6 +341,11 @@ async function main() {
     import("./whisper-server.js").then(({ shutdownWhisperServer }) => {
       shutdownWhisperServer().catch(() => {});
     }).catch(() => {});
+    // Close the LAN listener(s) too, or the port stays held after SIGTERM and
+    // the next `apx restart` fails with "already running".
+    for (const s2 of secondary) {
+      try { s2.close(); } catch { /* already down */ }
+    }
     server.close(() => {
       clearPid();
       process.exit(0);

package/src/interfaces/cli/commands/panel.js

@@ -8,9 +8,7 @@
 // the local network. Loopback stays the default, sharing is always explicit,
 // and the daemon's auth is untouched — the URL carries the token because
 // /admin/web-token is loopback-only by design, so a phone cannot fetch it.
-import fs from "node:fs";
 import { readConfig, writeConfig, effectivePort, effectiveHost } from "#core/config/index.js";
-import { TOKEN_PATH } from "#core/config/paths.js";
 import { detectLanAddresses, validateBindHost, isLoopback, isWildcard } from "#core/net/lan.js";
 
 export const PANEL_USAGE = {
@@ -19,21 +17,6 @@ export const PANEL_USAGE = {
   unshare: "apx panel unshare",
 };
 
-function readToken() {
-  try {
-    return fs.readFileSync(TOKEN_PATH, "utf8").trim();
-  } catch {
-    return "";
-  }
-}
-
-function panelUrl(host, port, token) {
-  // /admin/web-token refuses anything that is not loopback, so the panel on a
-  // phone can only authenticate from the fragment. The fragment never reaches
-  // the server or a proxy log — that is why it is a fragment and not a query.
-  return `http://${host}:${port}/` + (token ? `#token=${token}` : "");
-}
-
 export async function cmdPanelStatus() {
   const cfg = readConfig();
   const host = effectiveHost(cfg);
@@ -92,18 +75,27 @@ export async function cmdPanelShare(args) {
   cfg.host = host;
   writeConfig(cfg);
 
-  const token = readToken();
   const iface = candidates.find((c) => c.address === host)?.iface;
 
   console.log(`panel shared on ${host}:${port}${iface ? ` (${iface})` : ""}`);
   console.log("");
-  console.log("  Open this on your phone — the token is in the URL:");
-  console.log(`  ${panelUrl(host, port, token)}`);
+  console.log(`  URL for the other device:  http://${host}:${port}/`);
+  console.log("");
+  // Deliberately NOT the daemon's master token. Handing that to a phone gives
+  // it the same power as the CLI, cannot be revoked without rotating the token
+  // every local tool depends on, and leaves no record the device exists —
+  // which is the exact thing pairing was built to avoid (see token-store.js).
+  // It would not even last: the master token is regenerated on every restart.
+  console.log("  Authorise the device by PAIRING it, not by copying a token:");
+  console.log("    the panel → Settings → Devices → Pair device, then scan the QR.");
+  console.log("");
+  console.log("  Pairing gives that device its OWN token, which survives restarts,");
+  console.log("  shows up under Paired devices, and can be revoked on its own without");
+  console.log("  disturbing anything else.");
   console.log("");
   // Say plainly what changed. A LAN can be a café or a coworking space.
   console.log("  What this means: anyone on this network can now REACH the panel.");
-  console.log("  They still need the token above, which is not guessable — treat that");
-  console.log("  URL like a password, and run `apx panel unshare` when you are done.");
+  console.log("  They cannot use it without pairing. Run `apx panel unshare` when done.");
   if (candidates.length > 1) {
     const others = candidates.filter((c) => c.address !== host).map((c) => `${c.address} (${c.iface})`);
     console.log(`  Other addresses on this machine: ${others.join(", ")}`);