@agentprojectcontext/apx 1.77.3 → 1.78.0

package/src/host/daemon/api/integrations.js

@@ -25,8 +25,12 @@ import {
   getPluginService,
   reconcilePluginMcp,
 } from "#core/integrations/index.js";
+import { asyncRoute } from "./shared.js";
 
-function normalizeScope(raw) {
+// Integration scope vocabulary: project | global, accepting "default" for
+// global and both "shared" and "runtime" for project. See the note in
+// api/mcps.js — do not merge these three helpers.
+function normalizeIntegrationScope(raw) {
   if (!raw) return "project";
   const s = String(raw).toLowerCase();
   if (s === "global" || s === "default") return "global";
@@ -44,7 +48,7 @@ function storagePathForScope(scope, p, projects) {
   return p.storagePath || null;
 }
 
-export function register(app, { projects, project, registries }) {
+export function register(api, { projects, project, registries }) {
   // Keep a plugin's optional auto-registered MCP server (svc.mcpServer hook) in
   // lockstep with its stored state. Best-effort: a failure here must not break
   // the configure/validate/deactivate/delete response. `storagePath` is the one
@@ -62,10 +66,10 @@ export function register(app, { projects, project, registries }) {
   }
 
   // List stored integrations in the chosen scope (secrets redacted).
-  app.get("/projects/:pid/integrations", (req, res) => {
+  api.get("/projects/:pid/integrations", (req, res) => {
     const p = project(req, res);
     if (!p) return;
-    const scope = normalizeScope(req.query?.scope);
+    const scope = normalizeIntegrationScope(req.query?.scope);
     if (scope === null) return res.status(400).json({ error: `unknown scope "${req.query?.scope}"` });
     const storagePath = storagePathForScope(scope, p, projects);
     if (!storagePath) return res.status(400).json({ error: "project has no storage path" });
@@ -75,7 +79,7 @@ export function register(app, { projects, project, registries }) {
 
   // The full plugin roster with each plugin's resolved status for this project
   // (project record wins over the default/global one).
-  app.get("/projects/:pid/integrations/catalog", (req, res) => {
+  api.get("/projects/:pid/integrations/catalog", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const catalog = listCatalog().map((entry) => {
@@ -97,12 +101,12 @@ export function register(app, { projects, project, registries }) {
   });
 
   // Status for a single plugin in the chosen scope.
-  app.get("/projects/:pid/integrations/:slug", (req, res) => {
+  api.get("/projects/:pid/integrations/:slug", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const svc = getPluginService(req.params.slug);
     if (!svc) return res.status(404).json({ error: `unknown plugin "${req.params.slug}"` });
-    const scope = normalizeScope(req.query?.scope);
+    const scope = normalizeIntegrationScope(req.query?.scope);
     if (scope === null) return res.status(400).json({ error: `unknown scope "${req.query?.scope}"` });
     const storagePath = storagePathForScope(scope, p, projects);
     if (!storagePath) return res.status(400).json({ error: "project has no storage path" });
@@ -111,12 +115,12 @@ export function register(app, { projects, project, registries }) {
   });
 
   // Save credentials / config. Creates the record if missing.
-  app.post("/projects/:pid/integrations/:slug/configure", (req, res) => {
+  api.post("/projects/:pid/integrations/:slug/configure", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const svc = getPluginService(req.params.slug);
     if (!svc) return res.status(404).json({ error: `unknown plugin "${req.params.slug}"` });
-    const scope = normalizeScope(req.query?.scope);
+    const scope = normalizeIntegrationScope(req.query?.scope);
     if (scope === null) return res.status(400).json({ error: `unknown scope "${req.query?.scope}"` });
     const storagePath = storagePathForScope(scope, p, projects);
     if (!storagePath) return res.status(400).json({ error: "project has no storage path" });
@@ -132,12 +136,12 @@ export function register(app, { projects, project, registries }) {
   });
 
   // Verify the stored credentials against the provider, then persist the result.
-  app.post("/projects/:pid/integrations/:slug/validate", async (req, res) => {
+  api.post("/projects/:pid/integrations/:slug/validate", asyncRoute(async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const svc = getPluginService(req.params.slug);
     if (!svc) return res.status(404).json({ error: `unknown plugin "${req.params.slug}"` });
-    const scope = normalizeScope(req.query?.scope);
+    const scope = normalizeIntegrationScope(req.query?.scope);
     if (scope === null) return res.status(400).json({ error: `unknown scope "${req.query?.scope}"` });
     const storagePath = storagePathForScope(scope, p, projects);
     if (!storagePath) return res.status(400).json({ error: "project has no storage path" });
@@ -153,15 +157,15 @@ export function register(app, { projects, project, registries }) {
     } catch (e) {
       res.status(400).json({ error: e.message });
     }
-  });
+  }));
 
   // Disable a plugin without deleting its stored credentials.
-  app.post("/projects/:pid/integrations/:slug/deactivate", (req, res) => {
+  api.post("/projects/:pid/integrations/:slug/deactivate", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const svc = getPluginService(req.params.slug);
     if (!svc) return res.status(404).json({ error: `unknown plugin "${req.params.slug}"` });
-    const scope = normalizeScope(req.query?.scope);
+    const scope = normalizeIntegrationScope(req.query?.scope);
     if (scope === null) return res.status(400).json({ error: `unknown scope "${req.query?.scope}"` });
     const storagePath = storagePathForScope(scope, p, projects);
     if (!storagePath) return res.status(400).json({ error: "project has no storage path" });
@@ -174,7 +178,7 @@ export function register(app, { projects, project, registries }) {
   });
 
   // Plugin-specific read action (e.g. Asana → list workspaces for the token).
-  app.post("/projects/:pid/integrations/:slug/action/:action", async (req, res) => {
+  api.post("/projects/:pid/integrations/:slug/action/:action", asyncRoute(async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const svc = getPluginService(req.params.slug);
@@ -183,7 +187,7 @@ export function register(app, { projects, project, registries }) {
     if (typeof fn !== "function") {
       return res.status(404).json({ error: `unknown action "${req.params.action}"` });
     }
-    const scope = normalizeScope(req.query?.scope);
+    const scope = normalizeIntegrationScope(req.query?.scope);
     if (scope === null) return res.status(400).json({ error: `unknown scope "${req.query?.scope}"` });
     const storagePath = storagePathForScope(scope, p, projects);
     if (!storagePath) return res.status(400).json({ error: "project has no storage path" });
@@ -197,13 +201,13 @@ export function register(app, { projects, project, registries }) {
     } catch (e) {
       res.status(400).json({ error: e.message });
     }
-  });
+  }));
 
   // Remove a stored integration entirely.
-  app.delete("/projects/:pid/integrations/:slug", (req, res) => {
+  api.delete("/projects/:pid/integrations/:slug", (req, res) => {
     const p = project(req, res);
     if (!p) return;
-    const scope = normalizeScope(req.query?.scope);
+    const scope = normalizeIntegrationScope(req.query?.scope);
     if (scope === null) return res.status(400).json({ error: `unknown scope "${req.query?.scope}"` });
     const storagePath = storagePathForScope(scope, p, projects);
     if (!storagePath) return res.status(400).json({ error: "project has no storage path" });

package/src/host/daemon/api/mcps.js

@@ -45,7 +45,11 @@ function writeScope(scope, projectEntry, json) {
   return writeApfMcps(projectEntry.path, json);
 }
 
-function normalizeScope(raw) {
+// MCP scope vocabulary: shared | runtime | global (with "apc" as a friendly
+// alias for shared). NOT interchangeable with the var or integration scopes —
+// each subsystem has its own set and its own default, and collapsing them into
+// one helper would silently reroute writes to the wrong store.
+function normalizeMcpScope(raw) {
   if (!raw) return "shared";
   const s = String(raw).toLowerCase();
   if (s === "apc") return "shared"; // friendly alias
@@ -55,17 +59,17 @@ function normalizeScope(raw) {
   return s;
 }
 
-export function register(app, { projects, registries, project }) {
-  app.get("/projects/:pid/mcps", (req, res) => {
+export function register(api, { projects, registries, project }) {
+  api.get("/projects/:pid/mcps", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     res.json(registries.for(p).list());
   });
 
-  app.post("/projects/:pid/mcps", (req, res) => {
+  api.post("/projects/:pid/mcps", (req, res) => {
     const p = project(req, res);
     if (!p) return;
-    const scope = normalizeScope(req.query?.scope);
+    const scope = normalizeMcpScope(req.query?.scope);
     if (scope === null) {
       return res.status(400).json({ error: `unknown scope "${req.query?.scope}" (use shared|runtime|global)` });
     }
@@ -102,10 +106,10 @@ export function register(app, { projects, registries, project }) {
     res.status(201).json(entry);
   });
 
-  app.delete("/projects/:pid/mcps/:name", (req, res) => {
+  api.delete("/projects/:pid/mcps/:name", (req, res) => {
     const p = project(req, res);
     if (!p) return;
-    const scope = normalizeScope(req.query?.scope);
+    const scope = normalizeMcpScope(req.query?.scope);
     if (scope === null) {
       return res.status(400).json({ error: `unknown scope "${req.query?.scope}" (use shared|runtime|global)` });
     }
@@ -155,7 +159,7 @@ export function register(app, { projects, registries, project }) {
     res.status(204).end();
   });
 
-  app.get("/projects/:pid/mcps/check", (req, res) => {
+  api.get("/projects/:pid/mcps/check", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const reg = registries.for(p);
@@ -194,7 +198,7 @@ export function register(app, { projects, registries, project }) {
   // Full tool catalog — tools/list with input schemas, all pages merged.
   // This is what `apx mcp tools` renders; /test below stays as the
   // lightweight smoke check for the web UI card.
-  app.get("/projects/:pid/mcps/:name/tools", async (req, res) => {
+  api.get("/projects/:pid/mcps/:name/tools", async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     try {
@@ -205,7 +209,7 @@ export function register(app, { projects, registries, project }) {
     }
   });
 
-  app.post("/projects/:pid/mcps/:name/call", async (req, res) => {
+  api.post("/projects/:pid/mcps/:name/call", async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { tool, params } = req.body || {};
@@ -221,7 +225,7 @@ export function register(app, { projects, registries, project }) {
   // Smoke test — calls tools/list and reports either the tool catalog or a
   // clean error message. Used by the "Test" button in the MCP card so the
   // user can sanity-check a freshly-saved MCP without firing a real tool.
-  app.post("/projects/:pid/mcps/:name/test", async (req, res) => {
+  api.post("/projects/:pid/mcps/:name/test", async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     try {
@@ -242,7 +246,7 @@ export function register(app, { projects, registries, project }) {
 
   // In-memory log buffer for one MCP — stderr tail (stdio) or fetch summary
   // (http) plus a ring of recent events.
-  app.get("/projects/:pid/mcps/:name/logs", (req, res) => {
+  api.get("/projects/:pid/mcps/:name/logs", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const logs = registries.for(p).getLogs(req.params.name);

package/src/host/daemon/api/messages.js

@@ -11,8 +11,8 @@ import {
   searchProjectMessages,
 } from "#core/stores/messages.js";
 
-export function register(app, { project }) {
-  app.get("/projects/:pid/messages", (req, res) => {
+export function register(api, { project }) {
+  api.get("/projects/:pid/messages", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { agent, channel, since, limit = "100" } = req.query;
@@ -25,7 +25,7 @@ export function register(app, { project }) {
     res.json(rows);
   });
 
-  app.post("/projects/:pid/messages", (req, res) => {
+  api.post("/projects/:pid/messages", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const {
@@ -55,7 +55,7 @@ export function register(app, { project }) {
     res.status(201).json({ ok: true, ts: r.ts });
   });
 
-  app.get("/projects/:pid/messages/search", (req, res) => {
+  api.get("/projects/:pid/messages/search", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { q, limit = "50" } = req.query;
@@ -70,7 +70,7 @@ export function register(app, { project }) {
   });
 
   // Cross-project channels (telegram, direct, …)
-  app.get("/messages/global", (req, res) => {
+  api.get("/messages/global", (req, res) => {
     const { channel, limit = "100", since } = req.query;
     const lim = Math.min(parseInt(limit, 10) || 100, 1000);
     const rows = readGlobalMessages({

package/src/host/daemon/api/organization.js

@@ -19,14 +19,14 @@ import {
   removeRole,
 } from "#core/stores/organization.js";
 
-export function register(app, { project }) {
-  app.get("/projects/:pid/organization", (req, res) => {
+export function register(api, { project }) {
+  api.get("/projects/:pid/organization", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     res.json(readOrganization(p.path));
   });
 
-  app.post("/projects/:pid/organization/areas", (req, res) => {
+  api.post("/projects/:pid/organization/areas", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     try {
@@ -36,7 +36,7 @@ export function register(app, { project }) {
     }
   });
 
-  app.patch("/projects/:pid/organization/areas/:slug", (req, res) => {
+  api.patch("/projects/:pid/organization/areas/:slug", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     try {
@@ -48,7 +48,7 @@ export function register(app, { project }) {
     }
   });
 
-  app.delete("/projects/:pid/organization/areas/:slug", (req, res) => {
+  api.delete("/projects/:pid/organization/areas/:slug", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     if (!removeArea(p.path, req.params.slug))
@@ -56,7 +56,7 @@ export function register(app, { project }) {
     res.json({ ok: true });
   });
 
-  app.post("/projects/:pid/organization/roles", (req, res) => {
+  api.post("/projects/:pid/organization/roles", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     try {
@@ -66,7 +66,7 @@ export function register(app, { project }) {
     }
   });
 
-  app.patch("/projects/:pid/organization/roles/:slug", (req, res) => {
+  api.patch("/projects/:pid/organization/roles/:slug", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     try {
@@ -78,7 +78,7 @@ export function register(app, { project }) {
     }
   });
 
-  app.delete("/projects/:pid/organization/roles/:slug", (req, res) => {
+  api.delete("/projects/:pid/organization/roles/:slug", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     if (!removeRole(p.path, req.params.slug))

package/src/host/daemon/api/pairing.js

@@ -64,7 +64,7 @@ function purgeExpired(now = Date.now()) {
   }
 }
 
-export function register(app, ctx) {
+export function register(api, ctx) {
   const { tokenStore, config } = ctx;
   if (!tokenStore) {
     // Pairing requires the multi-token store; if running with legacy
@@ -75,7 +75,7 @@ export function register(app, ctx) {
 
   // ── POST /pair/init ───────────────────────────────────────────────
   // Localhost-only. Returns { pairing_id, expires_at }. No body needed.
-  app.post("/pair/init", (req, res) => {
+  api.post("/pair/init", (req, res) => {
     if (!isLocalhost(req)) {
       return res.status(403).json({ error: "pair/init: localhost only" });
     }
@@ -107,7 +107,7 @@ export function register(app, ctx) {
   // ── POST /pair/confirm ────────────────────────────────────────────
   // App side. Body: { pairing_id, label?, fingerprint? }. Returns the
   // new client token. Nonce is one-shot.
-  app.post("/pair/confirm", (req, res) => {
+  api.post("/pair/confirm", (req, res) => {
     purgeExpired();
     const { pairing_id, label, fingerprint, kind } = req.body || {};
     if (!pairing_id || typeof pairing_id !== "string") {
@@ -149,7 +149,7 @@ export function register(app, ctx) {
   // ── GET /pair/status/:pairing_id ──────────────────────────────────
   // For the CLI to poll while showing the QR. Returns pending|confirmed
   // |expired. Never leaks the token.
-  app.get("/pair/status/:pairing_id", (req, res) => {
+  api.get("/pair/status/:pairing_id", (req, res) => {
     purgeExpired();
     const s = sessions.get(req.params.pairing_id);
     if (!s) return res.json({ status: "unknown" });
@@ -171,13 +171,13 @@ export function register(app, ctx) {
   // ── GET /pair/list ────────────────────────────────────────────────
   // Authenticated (auth middleware exempts /pair/*, so we re-check by
   // hand here — only the master or an existing client can list peers).
-  app.get("/pair/list", (req, res) => {
+  api.get("/pair/list", (req, res) => {
     if (!checkBearer(req, tokenStore)) return res.status(401).json({ error: "unauthorized" });
     res.json({ clients: tokenStore.list() });
   });
 
   // ── DELETE /pair/revoke/:id ───────────────────────────────────────
-  app.delete("/pair/revoke/:id", (req, res) => {
+  api.delete("/pair/revoke/:id", (req, res) => {
     if (!checkBearer(req, tokenStore)) return res.status(401).json({ error: "unauthorized" });
     const ok = tokenStore.revoke(req.params.id);
     if (!ok) return res.status(404).json({ error: "no such client" });

package/src/host/daemon/api/plugins.js

@@ -1,13 +1,13 @@
 // Daemon plugin status surface.
 //   GET /plugins              status of every loaded plugin
 //   GET /plugins/:id/status   single plugin
-export function register(app, { plugins }) {
-  app.get("/plugins", (_req, res) => {
+export function register(api, { plugins }) {
+  api.get("/plugins", (_req, res) => {
     if (!plugins) return res.json({});
     res.json(plugins.status());
   });
 
-  app.get("/plugins/:id/status", (req, res) => {
+  api.get("/plugins/:id/status", (req, res) => {
     if (!plugins) return res.status(404).end();
     const inst = plugins.get(req.params.id);
     if (!inst)

package/src/host/daemon/api/prefix.js

@@ -0,0 +1,20 @@
+// The single mount point for every daemon data route.
+//
+// Before this existed, routes lived at the root and three separate hand-written
+// prefix lists had to agree on which of them were "API" (the SPA fallback in
+// web.js, the auth allowlist in shared.js, and the vite dev proxy). They drifted.
+// Now the answer is structural: a path is an API path iff it starts with /api.
+//
+// Kept in its own module so both the daemon and the route modules can import it
+// without pulling in express or any route registration.
+export const API_PREFIX = "/api";
+
+/** True for /api and anything below it. */
+export function isApiPath(p) {
+  return p === API_PREFIX || p.startsWith(API_PREFIX + "/");
+}
+
+/** Prefix a root-relative route path with the API mount point. */
+export function apiPath(p) {
+  return `${API_PREFIX}${p.startsWith("/") ? p : `/${p}`}`;
+}

package/src/host/daemon/api/profiles.js

@@ -82,8 +82,8 @@ function detail(id, { preview = true } = {}) {
   };
 }
 
-export function register(app) {
-  app.get("/profiles", (_req, res) => {
+export function register(api) {
+  api.get("/profiles", (_req, res) => {
     try {
       const cfg = readConfig();
       res.json({
@@ -96,7 +96,7 @@ export function register(app) {
   });
 
   // Registered before /profiles/:id so "doctor" isn't swallowed as an id.
-  app.get("/profiles/doctor", (req, res) => {
+  api.get("/profiles/doctor", (req, res) => {
     try {
       res.json(profileDoctor(req.query?.id || null));
     } catch (e) {
@@ -104,7 +104,7 @@ export function register(app) {
     }
   });
 
-  app.get("/profiles/:id", (req, res) => {
+  api.get("/profiles/:id", (req, res) => {
     try {
       const out = detail(req.params.id, { preview: req.query?.preview !== "0" });
       if (!out) return res.status(404).json({ error: `profile "${req.params.id}" not found` });
@@ -114,7 +114,7 @@ export function register(app) {
     }
   });
 
-  app.post("/profiles/install", (req, res) => {
+  api.post("/profiles/install", (req, res) => {
     try {
       const { source, force } = req.body || {};
       if (!source) return res.status(400).json({ error: "body needs { source }" });
@@ -131,7 +131,7 @@ export function register(app) {
     }
   });
 
-  app.post("/profiles/use", (req, res) => {
+  api.post("/profiles/use", (req, res) => {
     try {
       const { id, force } = req.body || {};
       if (!id) return res.status(400).json({ error: "body needs { id }" });
@@ -148,7 +148,7 @@ export function register(app) {
     }
   });
 
-  app.post("/profiles/off", (_req, res) => {
+  api.post("/profiles/off", (_req, res) => {
     try {
       res.json({ ok: true, ...offProfile() });
     } catch (e) {
@@ -156,7 +156,7 @@ export function register(app) {
     }
   });
 
-  app.patch("/profiles/config", (req, res) => {
+  api.patch("/profiles/config", (req, res) => {
     try {
       const { values, id } = req.body || {};
       if (!values || typeof values !== "object") {
@@ -169,7 +169,7 @@ export function register(app) {
     }
   });
 
-  app.delete("/profiles/:id", (req, res) => {
+  api.delete("/profiles/:id", (req, res) => {
     try {
       res.json({ ok: true, ...uninstallProfile(req.params.id) });
     } catch (e) {

package/src/host/daemon/api/projects.js

@@ -3,10 +3,10 @@
 //   POST   /projects               register a project by path
 //   DELETE /projects/:id           unregister
 //   POST   /projects/:id/rebuild   force a context rebuild from disk
-export function register(app, { projects, registries, addProjectGlobally }) {
-  app.get("/projects", (_req, res) => res.json(projects.list()));
+export function register(api, { projects, registries, addProjectGlobally }) {
+  api.get("/projects", (_req, res) => res.json(projects.list()));
 
-  app.post("/projects", (req, res) => {
+  api.post("/projects", (req, res) => {
     const { path: p } = req.body || {};
     if (!p) return res.status(400).json({ error: "path required" });
     try {
@@ -19,12 +19,12 @@ export function register(app, { projects, registries, addProjectGlobally }) {
     }
   });
 
-  app.delete("/projects/:id", (req, res) => {
+  api.delete("/projects/:id", (req, res) => {
     const ok = projects.unregister(req.params.id);
     res.status(ok ? 204 : 404).end();
   });
 
-  app.post("/projects/:id/rebuild", (req, res) => {
+  api.post("/projects/:id/rebuild", (req, res) => {
     try {
       const result = projects.rebuild(req.params.id);
       res.json({ ok: true, ...result });

package/src/host/daemon/api/routines.js

@@ -17,14 +17,14 @@ import {
   runRoutineNow,
 } from "#core/routines/index.js";
 
-export function register(app, { projects, registries, plugins, project, config }) {
-  app.get("/projects/:pid/routines", (req, res) => {
+export function register(api, { projects, registries, plugins, project, config }) {
+  api.get("/projects/:pid/routines", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     res.json(listRoutines(p.storagePath));
   });
 
-  app.get("/projects/:pid/routines/:name", (req, res) => {
+  api.get("/projects/:pid/routines/:name", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const r = getRoutine(p.storagePath, req.params.name);
@@ -32,7 +32,7 @@ export function register(app, { projects, registries, plugins, project, config }
     res.json(r);
   });
 
-  app.post("/projects/:pid/routines", (req, res) => {
+  api.post("/projects/:pid/routines", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     try {
@@ -45,28 +45,28 @@ export function register(app, { projects, registries, plugins, project, config }
     }
   });
 
-  app.delete("/projects/:pid/routines/:name", (req, res) => {
+  api.delete("/projects/:pid/routines/:name", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const ok = deleteRoutine(p.storagePath, req.params.name);
     res.status(ok ? 204 : 404).end();
   });
 
-  app.post("/projects/:pid/routines/:name/enable", (req, res) => {
+  api.post("/projects/:pid/routines/:name/enable", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     setRoutineEnabled(p.storagePath, req.params.name, true);
     res.json({ ok: true });
   });
 
-  app.post("/projects/:pid/routines/:name/disable", (req, res) => {
+  api.post("/projects/:pid/routines/:name/disable", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     setRoutineEnabled(p.storagePath, req.params.name, false);
     res.json({ ok: true });
   });
 
-  app.post("/projects/:pid/routines/:name/run", async (req, res) => {
+  api.post("/projects/:pid/routines/:name/run", async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const r = getRoutine(p.storagePath, req.params.name);

package/src/host/daemon/api/run.js

@@ -4,8 +4,8 @@
 import path from "node:path";
 import { execFile } from "node:child_process";
 
-export function register(app, { projects }) {
-  app.post("/run", (req, res) => {
+export function register(api, { projects }) {
+  api.post("/run", (req, res) => {
     const {
       cmd,
       cwd: cwdOverride,

package/src/host/daemon/api/runtimes.js

@@ -12,7 +12,7 @@ import { apcProjectFile, apcAgentsDir } from "#core/apc/paths.js";
 import { readSessionFrontmatter } from "#core/stores/sessions.js";
 import { buildAgentSystem } from "#core/agent/build-agent-system.js";
 import { CHANNELS } from "#core/constants/channels.js";
-import { getRuntime, RUNTIME_IDS } from "../runtimes/index.js";
+import { getRuntime, RUNTIME_IDS } from "#core/runtimes/index.js";
 import { detectAll } from "#core/runtimes/detect.js";
 import { buildRuntimeBridgeHint as buildApfHint } from "#core/agent/runtime-bridge.js";
 import {
@@ -22,17 +22,17 @@ import {
 } from "#core/stores/runtime-sessions.js";
 import { runSuperAgent, isSuperAgentEnabled } from "#core/agent/super-agent.js";
 
-export function register(app, { projects, registries, plugins, project, config }) {
-  app.get("/runtimes", (_req, res) =>
+export function register(api, { projects, registries, plugins, project, config }) {
+  api.get("/runtimes", (_req, res) =>
     res.json({ runtimes: RUNTIME_IDS })
   );
 
-  app.get("/env/detect", async (_req, res) => {
+  api.get("/env/detect", async (_req, res) => {
     const detected = await detectAll();
     res.json(detected);
   });
 
-  app.post("/projects/:pid/agents/:slug/runtime", async (req, res) => {
+  api.post("/projects/:pid/agents/:slug/runtime", async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { runtime, prompt, timeoutMs } = req.body || {};
@@ -146,7 +146,7 @@ export function register(app, { projects, registries, plugins, project, config }
   });
 
   // ---- Session resume — reads APC session file + (optionally) external transcript ----
-  app.get("/projects/:pid/sessions/:id/resume", async (req, res) => {
+  api.get("/projects/:pid/sessions/:id/resume", async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { id } = req.params;