@agentprojectcontext/apx 1.77.3 → 1.78.0

package/src/host/daemon/api/sessions-search.js

@@ -2,23 +2,30 @@
 //   GET  /sessions/search?q=…&project=…&limit=20
 //   POST /sessions/:id/compact     resolves which project/agent owns the file
 //                                  then delegates to compactConversation.
-import path from "node:path";
 import { readAgents } from "#core/apc/parser.js";
 import { compactConversation } from "#core/stores/conversations-compactor.js";
 import { searchSessions, findSessionFile } from "#core/stores/sessions-search.js";
+import { asyncRoute } from "./shared.js";
+import { resolveProject } from "#core/apc/projects-helpers.js";
 
+// Plural on purpose: no ref means "search every project". This is a different
+// operation from core's resolveProject (which resolves exactly one and throws),
+// but the *matching* must agree with it — this used to accept only an id or an
+// exact path, so `?project=savia` matched nothing here while working on every
+// other route.
 function resolveProjects(projects, projectRef) {
-  const all = projects.list();
-  if (projectRef != null) {
-    const ref = String(projectRef);
-    const found = all.find((p) => String(p.id) === ref || p.path === path.resolve(ref));
-    return found ? [projects.get(found.id)] : [];
+  if (projectRef == null || projectRef === "") {
+    return projects.list().map((p) => projects.get(p.id)).filter(Boolean);
+  }
+  try {
+    return [resolveProject(projects, projectRef)];
+  } catch {
+    return []; // unknown or ambiguous ref → no results, not a 500
   }
-  return all.map((p) => projects.get(p.id)).filter(Boolean);
 }
 
-export function register(app, { projects, config }) {
-  app.get("/sessions/search", (req, res) => {
+export function register(api, { projects, config }) {
+  api.get("/sessions/search", (req, res) => {
     const { q, project: projectRef, limit = "20" } = req.query;
     if (!q) return res.status(400).json({ error: "q required" });
     const lim = Math.min(parseInt(limit, 10) || 20, 200);
@@ -27,7 +34,7 @@ export function register(app, { projects, config }) {
     res.json({ q, count: results.length, results });
   });
 
-  app.post("/sessions/:id/compact", async (req, res) => {
+  api.post("/sessions/:id/compact", asyncRoute(async (req, res) => {
     const { id } = req.params;
     const { model: modelOverride, project: projectRef } = req.body || {};
     const candidates = resolveProjects(projects, projectRef);
@@ -57,5 +64,5 @@ export function register(app, { projects, config }) {
     } catch (e) {
       res.status(500).json({ error: e.message });
     }
-  });
+  }));
 }

package/src/host/daemon/api/sessions.js

@@ -12,16 +12,16 @@ import {
   agentSessionsDir,
   createAgentSessionFile,
 } from "#core/stores/sessions.js";
-import { collectAllSessions, filterSessionsByQuery } from "#interfaces/cli/commands/sessions.js";
+import { collectAllSessions, filterSessionsByQuery } from "#core/sessions/index.js";
 import { pageEnvelope } from "./shared.js";
 
-export function register(app, { projects, project }) {
+export function register(api, { projects, project }) {
   // Cross-engine sessions (apx · claude · codex), newest first. Returns a
   // { meta, data } envelope (meta = pagination info, data = rows). Paginated
   // via ?limit & ?offset; with no limit, data is the full set as one page.
   // Optional ?q= filters via the same core as `apx session find` (title match,
   // + transcript content when ?deep=1) so terminal and web search are identical.
-  app.get("/sessions", (req, res) => {
+  api.get("/sessions", (req, res) => {
     const engineId = req.query.engine ? String(req.query.engine) : null;
     const q = req.query.q ? String(req.query.q) : "";
     const deep = req.query.deep === "1" || req.query.deep === "true";
@@ -49,7 +49,7 @@ export function register(app, { projects, project }) {
     res.json(pageEnvelope(rows, req.query));
   });
 
-  app.get("/projects/:pid/agents/:slug/sessions", (req, res) => {
+  api.get("/projects/:pid/agents/:slug/sessions", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const agents = readAgents(p.path);
@@ -78,7 +78,7 @@ export function register(app, { projects, project }) {
     res.json(sessions);
   });
 
-  app.post("/projects/:pid/agents/:slug/sessions", (req, res) => {
+  api.post("/projects/:pid/agents/:slug/sessions", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { title, body = "" } = req.body || {};
@@ -93,7 +93,7 @@ export function register(app, { projects, project }) {
   });
 
   // GET session by filename (sid may include or omit the .md extension)
-  app.get("/projects/:pid/sessions/:sid", (req, res) => {
+  api.get("/projects/:pid/sessions/:sid", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const sid = req.params.sid;

package/src/host/daemon/api/shared.js

@@ -2,7 +2,6 @@
 //
 // These were inlined in api.js (monolith). They are kept dependency-free so
 // any route module can `import` them without pulling in the world.
-import fs from "node:fs";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
 import { appendErrorTrace, previewText } from "#core/logging.js";
@@ -11,6 +10,7 @@ import { agentMemoryPath } from "#core/agent/memory.js";
 import { apcMemoryFile } from "#core/apc/paths.js";
 import { CHANNELS } from "#core/constants/channels.js";
 import { isKnownSpaRoute } from "./web.js";
+import { apiPath, isApiPath } from "./prefix.js";
 
 export const nowIso = () =>
   new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
@@ -20,6 +20,44 @@ export const nowIso = () =>
 // full set as a single page (data = 100% of rows) so non-paginated callers get
 // the same shape — meta just reports one page covering everything.
 //   meta: { total, offset, limit, pageSize, page, pageCount }
+/**
+ * Wrap an async route handler so a rejected promise becomes a 500 instead of
+ * an unhandled rejection.
+ *
+ * Express 4 does not await handlers: if one throws asynchronously, the error
+ * never reaches the error middleware, the request hangs, and on Node >= 15 the
+ * unhandled rejection takes the whole daemon down. Several routes awaited work
+ * with no try/catch, so a single failing preview or engine probe could kill a
+ * process serving the SPA, Telegram polling and voice at the same time.
+ *
+ *   api.get("/things", asyncRoute(async (req, res) => { ... }))
+ */
+export function asyncRoute(handler) {
+  return (req, res, next) => Promise.resolve(handler(req, res, next)).catch(next);
+}
+
+/**
+ * Terminal error middleware. Mounted after every route; turns anything that
+ * reached `next(err)` into a JSON `{ error }` with a real status code.
+ */
+export function errorMiddleware(log = () => {}) {
+  // eslint-disable-next-line no-unused-vars -- Express detects the 4-arg shape.
+  return (err, req, res, _next) => {
+    const status = Number(err?.status || err?.statusCode) || 500;
+    const message = err?.message || "internal error";
+    log(`error: ${req.method} ${req.originalUrl} → ${status}: ${err?.stack || message}`);
+    try {
+      appendErrorTrace({
+        where: `${req.method} ${req.originalUrl}`,
+        error: message,
+        trace_id: req.apxTraceId,
+      });
+    } catch { /* tracing must never mask the original error */ }
+    if (res.headersSent) return;
+    res.status(status).json({ error: message });
+  };
+}
+
 export function pageEnvelope(rows, query = {}) {
   const total = rows.length;
   const hasLimit = query.limit != null && query.limit !== "";
@@ -46,12 +84,19 @@ export function traceIdMiddleware(req, res, next) {
   next();
 }
 
-// Paths that bypass auth: /health for liveness probes, /pair/* so a fresh
-// client can bootstrap a token without already having one, and
-// /admin/web-token so the local same-origin admin panel can self-bootstrap.
-// /pair/init and /admin/web-token both enforce localhost-only checks of
+// Paths that bypass auth: /api/health for liveness probes, /api/pair/* so a
+// fresh client can bootstrap a token without already having one, and
+// /api/admin/web-token so the local same-origin admin panel can self-bootstrap.
+// /api/pair/init and /api/admin/web-token both enforce localhost-only checks of
 // their own — the auth middleware just gets out of their way.
-const UNAUTHENTICATED_PREFIXES = ["/health", "/pair/", "/admin/web-token"];
+//
+// These are full paths: the middleware runs at app level (before the /api
+// router), so req.path is the complete URL path.
+const UNAUTHENTICATED_PREFIXES = [
+  apiPath("/health"),
+  apiPath("/pair/"),
+  apiPath("/admin/web-token"),
+];
 
 // Does this path look like a static asset (has a file extension)? Vite emits
 // hashed, extension-bearing filenames (index-abc123.js, logo.svg, font.woff2),
@@ -62,18 +107,19 @@ function isStaticAssetPath(p) {
 }
 
 function isUnauthenticatedPath(p, method = "GET") {
-  if (p === "/health") return true;
-  if (p === "/admin/web-token") return true;
   for (const prefix of UNAUTHENTICATED_PREFIXES) {
     if (p === prefix.replace(/\/$/, "") || p.startsWith(prefix)) return true;
   }
+  // Everything else under /api needs a token, full stop. Checked BEFORE the
+  // SPA-bootstrap exemption below, which would otherwise let a data route pass
+  // simply because its last segment happens to carry a file extension —
+  // GET /api/projects/0/artifacts/report.html is a data route, not an asset.
+  if (isApiPath(p)) return false;
   // SPA bootstrap: the admin bundle loads before it holds a bearer, so a GET
   // for a static asset or a known client-router route is served without auth —
-  // the bundle then fetches /admin/web-token. Everything else, including every
-  // data GET (/skills, /plugins, /embeddings, …), REQUIRES a token. This is an
-  // allowlist by construction: a new data route can never silently become
-  // public just because someone forgot to register its prefix (the old
-  // denylist failure mode).
+  // the bundle then fetches /api/admin/web-token. Since every data route now
+  // lives under /api and returned false above, this exemption can only ever
+  // reach panel assets and client-router paths.
   if (method === "GET" && (isStaticAssetPath(p) || isKnownSpaRoute(p))) return true;
   return false;
 }

package/src/host/daemon/api/skills.js

@@ -113,8 +113,8 @@ function indexStatus() {
   };
 }
 
-export function register(app /*, ctx */) {
-  app.get("/skills", (req, res) => {
+export function register(api /*, ctx */) {
+  api.get("/skills", (req, res) => {
     const projectPath = typeof req.query?.project_path === "string" && req.query.project_path
       ? req.query.project_path
       : undefined;
@@ -149,7 +149,7 @@ export function register(app /*, ctx */) {
 
   // ---- Full detail (viewer) ----------------------------------------------
 
-  app.get("/skills/:slug/detail", (req, res) => {
+  api.get("/skills/:slug/detail", (req, res) => {
     try {
       const projectPath = typeof req.query?.project_path === "string" && req.query.project_path
         ? req.query.project_path
@@ -175,7 +175,7 @@ export function register(app /*, ctx */) {
 
   // ---- Enable / disable per scope ----------------------------------------
 
-  app.put("/skills/enabled", (req, res) => {
+  api.put("/skills/enabled", (req, res) => {
     try {
       const { slug, enabled, scope, project_path } = req.body || {};
       if (!slug || typeof slug !== "string") {
@@ -202,7 +202,7 @@ export function register(app /*, ctx */) {
   // ---- Create / import user skills ---------------------------------------
 
   // Online editor: write a SKILL.md from slug + description + body.
-  app.post("/skills", (req, res) => {
+  api.post("/skills", (req, res) => {
     try {
       const { slug, description, body, project_path } = req.body || {};
       if (!slug || typeof slug !== "string" || !SLUG_RE.test(slug)) {
@@ -220,7 +220,7 @@ export function register(app /*, ctx */) {
   });
 
   // Import from an uploaded .zip (sent as base64 in JSON — skills are tiny).
-  app.post("/skills/import/zip", (req, res) => {
+  api.post("/skills/import/zip", (req, res) => {
     let tmp;
     try {
       const { data, project_path } = req.body || {};
@@ -257,7 +257,7 @@ export function register(app /*, ctx */) {
 
   // Import by cloning a git repo. The repo root (or its single skill subdir)
   // must contain a SKILL.md.
-  app.post("/skills/import/repo", (req, res) => {
+  api.post("/skills/import/repo", (req, res) => {
     let tmp;
     try {
       const { url, project_path } = req.body || {};
@@ -293,7 +293,7 @@ export function register(app /*, ctx */) {
     }
   });
 
-  app.delete("/skills/:slug", (req, res) => {
+  api.delete("/skills/:slug", (req, res) => {
     try {
       const slug = req.params.slug;
       if (!slug || !SLUG_RE.test(slug)) {
@@ -344,7 +344,7 @@ export function register(app /*, ctx */) {
 
   // ---- Inspector config + status -----------------------------------------
 
-  app.get("/skills/inspector", (_req, res) => {
+  api.get("/skills/inspector", (_req, res) => {
     try {
       const cfg = readConfig();
       res.json({
@@ -358,7 +358,7 @@ export function register(app /*, ctx */) {
     }
   });
 
-  app.put("/skills/inspector", (req, res) => {
+  api.put("/skills/inspector", (req, res) => {
     try {
       const patch = req.body || {};
       const cfg = readConfig();
@@ -388,7 +388,7 @@ export function register(app /*, ctx */) {
 
   // ---- Index build --------------------------------------------------------
 
-  app.post("/skills/index", async (req, res) => {
+  api.post("/skills/index", async (req, res) => {
     try {
       const { project_path, force } = req.body || {};
       const cfg = readConfig();
@@ -423,7 +423,7 @@ export function register(app /*, ctx */) {
 
   // ---- Dry-run ------------------------------------------------------------
 
-  app.post("/skills/inspect", async (req, res) => {
+  api.post("/skills/inspect", async (req, res) => {
     try {
       const { prompt, project_path } = req.body || {};
       if (!prompt || typeof prompt !== "string") {

package/src/host/daemon/api/super-agent.js

@@ -91,8 +91,8 @@ function wrapOnEventForLog(send, { trace_id, channel }) {
   };
 }
 
-export function register(app, { projects, registries, plugins, project, config }) {
-  app.post("/projects/:pid/super-agent/chat/stream", async (req, res) => {
+export function register(api, { projects, registries, plugins, project, config }) {
+  api.post("/projects/:pid/super-agent/chat/stream", async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     // Optional coding-surface knobs: the terminal Code TUI (apx code, Build
@@ -223,7 +223,7 @@ export function register(app, { projects, registries, plugins, project, config }
   // <id>` when the session lives outside any registered APX project (e.g. a
   // raw Claude/Codex session). Returns { text } so callers can format the
   // summary however they want.
-  app.post("/super-agent/summarize", async (req, res) => {
+  api.post("/super-agent/summarize", async (req, res) => {
     const { prompt, context_note: contextNote = "", model, max_tokens } = req.body || {};
     if (!prompt) return res.status(400).json({ error: "prompt required" });
     try {
@@ -254,7 +254,7 @@ export function register(app, { projects, registries, plugins, project, config }
     }
   });
 
-  app.post("/projects/:pid/super-agent/chat", async (req, res) => {
+  api.post("/projects/:pid/super-agent/chat", async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { prompt, previousMessages, model, maxIters, maxTokens, completionContract } =

package/src/host/daemon/api/tasks.js

@@ -24,11 +24,11 @@ import {
 } from "#core/stores/tasks.js";
 import { pageEnvelope } from "./shared.js";
 
-export function register(app, { project, projects }) {
+export function register(api, { project, projects }) {
   // Global tasks across every project, newest first. Returns a { meta, data }
   // envelope. Paginated via ?limit & ?offset; with no limit, data is the full
   // set as one page.
-  app.get("/tasks", (req, res) => {
+  api.get("/tasks", (req, res) => {
     const { state, tag, agent, due_before, due_after, status, updated_since } = req.query;
 
     // Resolve the registered projects to what core needs, dropping any the
@@ -63,7 +63,7 @@ export function register(app, { project, projects }) {
 
   // Per-project tasks. Returns a { meta, data } envelope; with no ?limit the
   // data array is the full filtered set (one page).
-  app.get("/projects/:pid/tasks", (req, res) => {
+  api.get("/projects/:pid/tasks", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { state, tag, agent, due_before, due_after, status, updated_since } = req.query;
@@ -79,7 +79,7 @@ export function register(app, { project, projects }) {
     res.json(pageEnvelope(all, req.query));
   });
 
-  app.post("/projects/:pid/tasks", (req, res) => {
+  api.post("/projects/:pid/tasks", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     try {
@@ -90,7 +90,7 @@ export function register(app, { project, projects }) {
     }
   });
 
-  app.get("/projects/:pid/tasks/:id", (req, res) => {
+  api.get("/projects/:pid/tasks/:id", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const task = getTask(p.storagePath, req.params.id);
@@ -98,7 +98,7 @@ export function register(app, { project, projects }) {
     res.json(task);
   });
 
-  app.patch("/projects/:pid/tasks/:id", (req, res) => {
+  api.patch("/projects/:pid/tasks/:id", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { patch } = req.body || {};
@@ -110,7 +110,7 @@ export function register(app, { project, projects }) {
     res.json(updated);
   });
 
-  app.post("/projects/:pid/tasks/:id/done", (req, res) => {
+  api.post("/projects/:pid/tasks/:id/done", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { by = null } = req.body || {};
@@ -119,7 +119,7 @@ export function register(app, { project, projects }) {
     res.json(updated);
   });
 
-  app.post("/projects/:pid/tasks/:id/drop", (req, res) => {
+  api.post("/projects/:pid/tasks/:id/drop", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { by = null } = req.body || {};
@@ -128,7 +128,7 @@ export function register(app, { project, projects }) {
     res.json(updated);
   });
 
-  app.post("/projects/:pid/tasks/:id/reopen", (req, res) => {
+  api.post("/projects/:pid/tasks/:id/reopen", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const updated = reopenTask(p.storagePath, req.params.id);
@@ -137,7 +137,7 @@ export function register(app, { project, projects }) {
   });
 
   // Move an open task through its workflow (pending → running → in_review …).
-  app.post("/projects/:pid/tasks/:id/status", (req, res) => {
+  api.post("/projects/:pid/tasks/:id/status", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { status } = req.body || {};
@@ -149,7 +149,7 @@ export function register(app, { project, projects }) {
   });
 
   // Lightweight summary endpoint for status displays.
-  app.get("/projects/:pid/tasks-summary", (req, res) => {
+  api.get("/projects/:pid/tasks-summary", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     res.json(countTasks(p.storagePath));

package/src/host/daemon/api/telegram.js

@@ -31,7 +31,6 @@ import {
   removeTelegramChannel,
   unsetTelegramChannelFields,
   listContacts,
-  findContact,
   upsertContact,
   removeContact,
   listRoles,
@@ -41,13 +40,13 @@ import {
 
 import { redactChannel, isSecretMarker } from "#core/config/redact.js";
 
-export function register(app, { telegram }) {
-  app.get("/telegram/status", (_req, res) => {
+export function register(api, { telegram }) {
+  api.get("/telegram/status", (_req, res) => {
     if (!telegram) return res.json({ enabled: false, channels: [] });
     res.json(telegram.status());
   });
 
-  app.post("/telegram/start", (_req, res) => {
+  api.post("/telegram/start", (_req, res) => {
     if (!telegram)
       return res.status(503).json({ error: "telegram plugin not loaded" });
     try {
@@ -58,7 +57,7 @@ export function register(app, { telegram }) {
     }
   });
 
-  app.post("/telegram/stop", (_req, res) => {
+  api.post("/telegram/stop", (_req, res) => {
     if (!telegram)
       return res.status(503).json({ error: "telegram plugin not loaded" });
     try {
@@ -69,7 +68,7 @@ export function register(app, { telegram }) {
     }
   });
 
-  app.post("/telegram/send", async (req, res) => {
+  api.post("/telegram/send", async (req, res) => {
     const { chat_id, text, channel } = req.body || {};
     if (!text) return res.status(400).json({ error: "text required" });
     if (!telegram)
@@ -82,7 +81,7 @@ export function register(app, { telegram }) {
     }
   });
 
-  app.post("/telegram/send_photo", async (req, res) => {
+  api.post("/telegram/send_photo", async (req, res) => {
     const { chat_id, photo, caption, parse_mode, channel } = req.body || {};
     if (!photo)
       return res.status(400).json({ error: "photo required (path or url)" });
@@ -102,7 +101,7 @@ export function register(app, { telegram }) {
     }
   });
 
-  app.post("/telegram/send_voice", async (req, res) => {
+  api.post("/telegram/send_voice", async (req, res) => {
     const { chat_id, audio, caption, duration, channel } = req.body || {};
     if (!audio) return res.status(400).json({ error: "audio required (path)" });
     if (!telegram)
@@ -121,7 +120,7 @@ export function register(app, { telegram }) {
     }
   });
 
-  app.post("/telegram/send_audio", async (req, res) => {
+  api.post("/telegram/send_audio", async (req, res) => {
     const { chat_id, audio, caption, title, performer, channel } =
       req.body || {};
     if (!audio) return res.status(400).json({ error: "audio required (path)" });
@@ -145,7 +144,7 @@ export function register(app, { telegram }) {
   // ── Channel CRUD (config-only; caller must POST /admin/reload to apply) ──
   // We read fresh config from disk on each call so concurrent writes from the
   // CLI and the daemon don't clobber one another via stale closures.
-  app.get("/telegram/channels", (_req, res) => {
+  api.get("/telegram/channels", (_req, res) => {
     try {
       const cfg = readConfig();
       res.json({ channels: listTelegramChannels(cfg).map(redactChannel) });
@@ -154,7 +153,7 @@ export function register(app, { telegram }) {
     }
   });
 
-  app.post("/telegram/channels", (req, res) => {
+  api.post("/telegram/channels", (req, res) => {
     const body = req.body || {};
     if (!body.name || typeof body.name !== "string") {
       return res.status(400).json({ error: "name required" });
@@ -173,7 +172,7 @@ export function register(app, { telegram }) {
     }
   });
 
-  app.patch("/telegram/channels/:name", (req, res) => {
+  api.patch("/telegram/channels/:name", (req, res) => {
     const { name } = req.params;
     const body = req.body || {};
     try {
@@ -202,7 +201,7 @@ export function register(app, { telegram }) {
     }
   });
 
-  app.delete("/telegram/channels/:name", (req, res) => {
+  api.delete("/telegram/channels/:name", (req, res) => {
     const { name } = req.params;
     try {
       const cfg = readConfig();
@@ -219,7 +218,7 @@ export function register(app, { telegram }) {
   // channel. These edit ~/.apx/config.json directly; the running poller picks
   // changes up on its next inbound message (it re-reads config per message), so
   // no /admin/reload is required for contact/role edits.
-  app.get("/telegram/contacts", (_req, res) => {
+  api.get("/telegram/contacts", (_req, res) => {
     try {
       const cfg = readConfig();
       res.json({
@@ -235,7 +234,7 @@ export function register(app, { telegram }) {
     }
   });
 
-  app.patch("/telegram/contacts/:user_id", (req, res) => {
+  api.patch("/telegram/contacts/:user_id", (req, res) => {
     const { user_id } = req.params;
     const body = req.body || {};
     try {
@@ -254,7 +253,7 @@ export function register(app, { telegram }) {
     }
   });
 
-  app.delete("/telegram/contacts/:user_id", (req, res) => {
+  api.delete("/telegram/contacts/:user_id", (req, res) => {
     const { user_id } = req.params;
     try {
       const cfg = readConfig();
@@ -267,7 +266,7 @@ export function register(app, { telegram }) {
   });
 
   // ── Roles (role → { tools }) ────────────────────────────────────────────
-  app.get("/telegram/roles", (_req, res) => {
+  api.get("/telegram/roles", (_req, res) => {
     try {
       res.json({ roles: listRoles(readConfig()) });
     } catch (e) {
@@ -275,7 +274,7 @@ export function register(app, { telegram }) {
     }
   });
 
-  app.put("/telegram/roles/:name", (req, res) => {
+  api.put("/telegram/roles/:name", (req, res) => {
     const { name } = req.params;
     const body = req.body || {};
     try {
@@ -288,7 +287,7 @@ export function register(app, { telegram }) {
     }
   });
 
-  app.delete("/telegram/roles/:name", (req, res) => {
+  api.delete("/telegram/roles/:name", (req, res) => {
     const { name } = req.params;
     try {
       const { removed } = removeRole(readConfig(), name);
@@ -300,7 +299,7 @@ export function register(app, { telegram }) {
   });
 
   // Alias for proactive daemon-initiated pushes (routines, error handlers, …).
-  app.post("/telegram/notify", async (req, res) => {
+  api.post("/telegram/notify", async (req, res) => {
     const { chat_id, text, channel } = req.body || {};
     if (!text) return res.status(400).json({ error: "text required" });
     if (!telegram)

package/src/host/daemon/api/tools.js

@@ -11,11 +11,11 @@ import { buildRegistryRouter } from "#core/http-tools/registry.js";
 import { buildGlobRouter } from "#core/http-tools/glob.js";
 import { buildGrepRouter } from "#core/http-tools/grep.js";
 
-export function register(app, { express, projects, registries }) {
-  app.use("/tools/fetch", buildFetchRouter(express));
-  app.use("/tools/browser", buildBrowserRouter(express));
-  app.use("/tools/search", buildSearchRouter(express));
-  app.use("/tools/glob", buildGlobRouter(express));
-  app.use("/tools/grep", buildGrepRouter(express));
-  app.use("/tools", buildRegistryRouter(express, { projects, registries }));
+export function register(api, { express, projects, registries }) {
+  api.use("/tools/fetch", buildFetchRouter(express));
+  api.use("/tools/browser", buildBrowserRouter(express));
+  api.use("/tools/search", buildSearchRouter(express));
+  api.use("/tools/glob", buildGlobRouter(express));
+  api.use("/tools/grep", buildGrepRouter(express));
+  api.use("/tools", buildRegistryRouter(express, { projects, registries }));
 }