@agentprojectcontext/apx 1.77.3 → 1.78.0

package/src/host/daemon/api/top-level.js

@@ -12,9 +12,9 @@ import fs from "node:fs";
 import path from "node:path";
 import { resolveMemoryPath } from "./shared.js";
 
-export function register(app, { projects, registries, resolveTopProject }) {
+export function register(api, { projects, registries, resolveTopProject }) {
   // ---- /memory ----
-  app.get("/memory", (req, res) => {
+  api.get("/memory", (req, res) => {
     const p = resolveTopProject(req.query);
     if (!p) return res.status(404).json({ error: "no project registered" });
     const memPath = resolveMemoryPath(p);
@@ -22,7 +22,7 @@ export function register(app, { projects, registries, resolveTopProject }) {
     res.json({ project_id: p.id, path: memPath, body });
   });
 
-  app.post("/memory", (req, res) => {
+  api.post("/memory", (req, res) => {
     const p = resolveTopProject(req.query);
     if (!p) return res.status(404).json({ error: "no project registered" });
     const { body } = req.body || {};
@@ -42,7 +42,7 @@ export function register(app, { projects, registries, resolveTopProject }) {
   });
 
   // ---- /files ----
-  app.get("/files", (req, res) => {
+  api.get("/files", (req, res) => {
     const p = resolveTopProject(req.query);
     if (!p) return res.status(404).json({ error: "no project registered" });
     const rel = req.query.path;
@@ -90,7 +90,7 @@ export function register(app, { projects, registries, resolveTopProject }) {
     });
   });
 
-  app.post("/files", (req, res) => {
+  api.post("/files", (req, res) => {
     const p = resolveTopProject(req.query);
     if (!p) return res.status(404).json({ error: "no project registered" });
     const { path: rel, content } = req.body || {};
@@ -111,13 +111,13 @@ export function register(app, { projects, registries, resolveTopProject }) {
   });
 
   // ---- /mcp ----
-  app.get("/mcp", (req, res) => {
+  api.get("/mcp", (req, res) => {
     const p = resolveTopProject(req.query);
     if (!p) return res.status(404).json({ error: "no project registered" });
     res.json(registries.for(p).list());
   });
 
-  app.post("/mcp/run", async (req, res) => {
+  api.post("/mcp/run", async (req, res) => {
     const { project: projectRef, name, tool, params } = req.body || {};
     if (!name) return res.status(400).json({ error: "name required" });
     if (!tool) return res.status(400).json({ error: "tool required" });

package/src/host/daemon/api/transcribe.js

@@ -5,12 +5,12 @@
 //   X-Provider      auto | local | openai | custom   (overrides config)
 //
 // Shared by overlay, telegram voice messages, and any external caller.
-export function register(app) {
+export function register(api) {
   // GET /transcribe/providers — STT engine list + availability for the web
   // admin (mirror of /tts/providers). local = embedded faster-whisper;
   // openai = cloud Whisper; custom = any OpenAI-compatible server (mlx-audio
   // on Metal, a Radeon/NVIDIA box on the LAN, a remote endpoint).
-  app.get("/transcribe/providers", async (_req, res) => {
+  api.get("/transcribe/providers", async (_req, res) => {
     try {
       const { readConfig } = await import("#core/config/index.js");
       const { listSttProviders } = await import("#core/voice/transcription.js");
@@ -23,7 +23,7 @@ export function register(app) {
   // GET /transcribe/hardware — detected machine + the recommended local backend
   // (mlx on Apple Silicon, faster-whisper cuda on NVIDIA, else CPU). Drives the
   // "engine adapts itself" UX in the web admin.
-  app.get("/transcribe/hardware", async (_req, res) => {
+  api.get("/transcribe/hardware", async (_req, res) => {
     try {
       const { detectHardware, recommendStt } = await import("#core/voice/stt-hardware.js");
       const hw = detectHardware();
@@ -35,7 +35,7 @@ export function register(app) {
 
   // GET /transcribe/models?backend=faster|mlx — model catalog with on-disk
   // status (downloaded? size) for the model-manager UI.
-  app.get("/transcribe/models", async (req, res) => {
+  api.get("/transcribe/models", async (req, res) => {
     try {
       const backend = String(req.query.backend || "faster");
       const { listSttModels } = await import("#core/voice/stt-models.js");
@@ -48,7 +48,7 @@ export function register(app) {
   // GET /transcribe/warmup — load the local whisper model (if needed) and reset
   // its idle watchdog. Callers (e.g. the desktop window) ping this while open so
   // the first real utterance doesn't pay the cold-load cost.
-  app.get("/transcribe/warmup", async (_req, res) => {
+  api.get("/transcribe/warmup", async (_req, res) => {
     try {
       const { warmupWhisper } = await import("../whisper-server.js");
       res.json(await warmupWhisper());
@@ -57,7 +57,7 @@ export function register(app) {
     }
   });
 
-  app.post("/transcribe/chunk", async (req, res) => {
+  api.post("/transcribe/chunk", async (req, res) => {
     const chunks = [];
     req.on("data", (c) => chunks.push(c));
     req.on("end", async () => {

package/src/host/daemon/api/tts.js

@@ -11,8 +11,8 @@
 import { synthesize, listProviders } from "#core/voice/tts.js";
 import { readConfig } from "#core/config/index.js";
 
-export function register(app) {
-  app.post("/tts/say", async (req, res) => {
+export function register(api) {
+  api.post("/tts/say", async (req, res) => {
     try {
       const { text, voice, language, provider, format, style } = req.body || {};
       if (typeof text !== "string" || !text.trim()) {
@@ -33,7 +33,7 @@ export function register(app) {
     }
   });
 
-  app.get("/tts/providers", async (_req, res) => {
+  api.get("/tts/providers", async (_req, res) => {
     try {
       const info = await listProviders(readConfig());
       res.json(info);

package/src/host/daemon/api/vars.js

@@ -24,7 +24,10 @@ import {
   maskValue,
 } from "#core/vars/index.js";
 
-function normalizeScope(raw, { isBase }) {
+// Var scope vocabulary: project | global. The default depends on whether the
+// request targets the base store. See the note in api/mcps.js: these scope
+// helpers share a shape but not a vocabulary.
+function normalizeVarScope(raw, { isBase }) {
   if (!raw) return isBase ? "global" : "project";
   const s = String(raw).toLowerCase();
   if (s === "project" || s === "global") return s;
@@ -37,8 +40,8 @@ function maskAll(obj) {
   return out;
 }
 
-export function register(app, { project, registries }) {
-  app.get("/projects/:pid/vars", (req, res) => {
+export function register(api, { project, registries }) {
+  api.get("/projects/:pid/vars", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const reveal = req.query?.reveal === "1" || req.query?.reveal === "true";
@@ -54,7 +57,7 @@ export function register(app, { project, registries }) {
     });
   });
 
-  app.get("/projects/:pid/vars/:name", (req, res) => {
+  api.get("/projects/:pid/vars/:name", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const name = req.params.name;
@@ -80,7 +83,7 @@ export function register(app, { project, registries }) {
     });
   });
 
-  app.post("/projects/:pid/vars", (req, res) => {
+  api.post("/projects/:pid/vars", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { name, value } = req.body || {};
@@ -91,7 +94,7 @@ export function register(app, { project, registries }) {
       return res.status(400).json({ error: "value required" });
     }
     const isBase = String(p.id) === "0";
-    const scope = normalizeScope(req.body?.scope, { isBase });
+    const scope = normalizeVarScope(req.body?.scope, { isBase });
     if (scope === null) {
       return res
         .status(400)
@@ -111,11 +114,11 @@ export function register(app, { project, registries }) {
     res.status(201).json({ ok: true, name, scope });
   });
 
-  app.delete("/projects/:pid/vars/:name", (req, res) => {
+  api.delete("/projects/:pid/vars/:name", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const isBase = String(p.id) === "0";
-    const scope = normalizeScope(req.query?.scope, { isBase });
+    const scope = normalizeVarScope(req.query?.scope, { isBase });
     if (scope === null) {
       return res
         .status(400)

package/src/host/daemon/api/voice.js

@@ -20,6 +20,7 @@
 // core/. This file is just glue: parse request → call core → format response.
 import fs from "node:fs";
 import path from "node:path";
+import { TTS_TMP_DIR } from "#core/config/paths.js";
 import { readConfig } from "#core/config/index.js";
 import { synthesize } from "#core/voice/tts.js";
 import { stripEmotionTags } from "#core/voice/emotions.js";
@@ -31,18 +32,17 @@ import { extractSuggestions } from "#core/agent/suggestions.js";
 import { appendGlobalMessage } from "#core/stores/messages.js";
 import { appendErrorTrace, previewText } from "#core/logging.js";
 
-export function register(app, { projects, plugins, registries }) {
+export function register(api, { projects, plugins, registries }) {
   // GET /voice/tts?path=<abs>
   //
   // Streams a TTS audio file back to the caller. Sandboxed to the
   // ~/.apx/tmp/tts directory so a client can't request arbitrary
   // filesystem paths through a manifest-leaked reply_audio_path.
-  app.get("/voice/tts", async (req, res) => {
+  api.get("/voice/tts", async (req, res) => {
     const rawPath = String(req.query.path || "");
     if (!rawPath) return res.status(400).json({ error: "path required" });
     try {
-      const os = await import("node:os");
-      const ttsRoot = path.resolve(os.homedir(), ".apx", "tmp", "tts");
+      const ttsRoot = path.resolve(TTS_TMP_DIR);
       const resolved = path.resolve(rawPath);
       if (!resolved.startsWith(ttsRoot + path.sep)) {
         return res.status(403).json({ error: "path outside tts dir" });
@@ -65,7 +65,7 @@ export function register(app, { projects, plugins, registries }) {
     }
   });
 
-  app.post("/voice/turn", async (req, res) => {
+  api.post("/voice/turn", async (req, res) => {
     const body = req.body || {};
     const cfg = readConfig();
     let userText = (body.text || "").trim();
@@ -103,7 +103,7 @@ export function register(app, { projects, plugins, registries }) {
         : [];
       const channel = body.channel || "voice";
       let suggestions = [];
-      let toolsUsed = [];
+      const toolsUsed = [];
       // Attribution for the persisted turn (see the appendGlobalMessage below).
       let replyModel = null;
       let replyUsage = null;

package/src/host/daemon/api/web.js

@@ -2,9 +2,10 @@
 //
 // The web bundle is built into src/interfaces/web/dist. When that folder
 // exists, this module mounts it at `/` so users can open
-// http://127.0.0.1:7430 and get the UI. SPA fallback: anything that isn't an
-// /api/* / /projects/* / etc. route falls through to index.html so React
-// Router can resolve client-side paths like /p/1/tasks.
+// http://127.0.0.1:7430 and get the UI. The root namespace belongs to the
+// panel alone — every data route lives under /api (see ./prefix.js) — so the
+// SPA fallback only has to step aside for that single prefix instead of a
+// hand-maintained list that drifts away from the route registry.
 //
 // During development the user runs `vite dev` on :7431 with proxy → :7430,
 // so this mount is a no-op (dist/ doesn't exist yet).
@@ -12,29 +13,17 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
+import { isApiPath } from "./prefix.js";
+
+// Re-exported so the SPA/API seam keeps a single import site for callers that
+// reason about "which side of the seam is this path on?" (tests, auth).
+export { isApiPath };
+
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 // host/daemon/api/web.js → ../../..  = src/   then interfaces/web/dist
 const WEB_DIST = path.resolve(__dirname, "..", "..", "..", "interfaces", "web", "dist");
 
-// Paths the panel is NOT allowed to swallow with its SPA fallback. These are
-// the real API surfaces; we keep the list flat so it doesn't drift away from
-// the actual route registry.
-const API_PREFIXES = [
-  "/health", "/admin", "/projects", "/telegram", "/engines", "/runtimes",
-  "/messages", "/sessions", "/tools", "/mcp", "/voice", "/tts", "/desktop", "/overlay",
-  "/transcribe", "/run", "/files", "/memory", "/env", "/pair", "/deck",
-  "/super-agent", "/identity", "/skills", "/profiles", "/inbox",
-  "/tasks", "/agents", "/plugins", "/previews", "/embeddings",
-];
-
-export function isApiPath(p) {
-  for (const prefix of API_PREFIXES) {
-    if (p === prefix || p.startsWith(prefix + "/")) return true;
-  }
-  return false;
-}
-
 // Client-side routes the SPA actually knows how to render. Must mirror the
 // <Routes> registry in src/interfaces/web/src/App.tsx. Anything else still
 // gets the SPA shell (so React Router shows the styled 404 page) but with an
@@ -51,15 +40,18 @@ export function isKnownSpaRoute(p) {
   return SPA_ROUTES.some((re) => re.test(p));
 }
 
-export function register(app, { express, token }) {
-  // /admin/web-token: localhost-only endpoint that returns the daemon token
-  // so the same-origin admin panel can authenticate every subsequent call.
-  // Refuses if the request didn't come from loopback. Also refuses if the
-  // request was tunneled in via Cloudflare/ngrok/etc. — those connect from
-  // a local agent so the socket IP IS loopback, but tunnel-specific headers
-  // give them away. When tunneled, the SPA must instead receive the token
-  // via URL fragment (#token=…) that the operator shares out-of-band.
-  app.get("/admin/web-token", (req, res) => {
+// /api/admin/web-token: localhost-only endpoint that returns the daemon token
+// so the same-origin admin panel can authenticate every subsequent call.
+// Refuses if the request didn't come from loopback. Also refuses if the
+// request was tunneled in via Cloudflare/ngrok/etc. — those connect from
+// a local agent so the socket IP IS loopback, but tunnel-specific headers
+// give them away. When tunneled, the SPA must instead receive the token
+// via URL fragment (#token=…) that the operator shares out-of-band.
+//
+// Registered on the API router (not the static mount below) so the panel's
+// bootstrap call is a normal /api/* request like every other.
+export function registerWebToken(api, { token }) {
+  api.get("/admin/web-token", (req, res) => {
     const ra = req.ip || req.socket?.remoteAddress || "";
     const isLocal =
       ra === "127.0.0.1" ||
@@ -86,7 +78,11 @@ export function register(app, { express, token }) {
     }
     res.json({ token });
   });
+}
 
+// Static admin panel at the root. Mounted after `app.use("/api", api)` in
+// api.js, so a stray /api/* request can never reach the SPA fallback.
+export function register(app, { express }) {
   if (!fs.existsSync(WEB_DIST)) {
     // No build present. Expose a hint endpoint so users hitting the daemon
     // root know what to do.
@@ -112,8 +108,8 @@ export function register(app, { express, token }) {
     return;
   }
 
-  // Serve static assets. NB: we mount AFTER the API routes are registered
-  // in api.js so /projects, /admin/*, etc. always win over the catch-all.
+  // Serve static assets. NB: we mount AFTER the /api router is mounted in
+  // api.js so data routes always win over this catch-all.
   app.use(
     express.static(WEB_DIST, {
       index: false,

package/src/host/daemon/api.js

@@ -1,15 +1,26 @@
 // Express REST API for APX. See APC docs reference/apx-daemon.
 //
 // Routes are split by domain under ./api/*.js — each module exports
-// `register(app, ctx)`. This file is purely orchestration: middlewares,
+// `register(router, ctx)`. This file is purely orchestration: middlewares,
 // context construction, mount order, 404 catch-all.
+//
+// EVERY data route lives under /api. Domain modules still declare their paths
+// root-relative (`/projects/:pid/tasks`); they register on an express.Router()
+// that is mounted at API_PREFIX, so the effective URL is /api/projects/:pid/
+// tasks. The root namespace belongs exclusively to the admin panel (static
+// bundle + client-side routes), which is why the "is this an API path?" test
+// is now a single startsWith instead of a hand-maintained prefix list.
 import express from "express";
 
+import { API_PREFIX } from "./api/prefix.js";
+import { logError } from "#core/logging.js";
+
 import {
   traceIdMiddleware,
   buildAuthMiddleware,
   makeProjectResolver,
   makeTopProjectResolver,
+  errorMiddleware,
 } from "./api/shared.js";
 
 import { register as registerTools } from "./api/tools.js";
@@ -53,7 +64,7 @@ import { register as registerAdminConfig } from "./api/admin-config.js";
 import { register as registerIdentity } from "./api/identity.js";
 import { register as registerProfiles } from "./api/profiles.js";
 import { register as registerInbox } from "./api/inbox.js";
-import { register as registerWeb } from "./api/web.js";
+import { register as registerWeb, registerWebToken } from "./api/web.js";
 import { register as registerConfirm } from "./api/confirm.js";
 
 export function buildApi({
@@ -70,6 +81,9 @@ export function buildApi({
 }) {
   const telegram = plugins?.get("telegram");
   const app = express();
+  // Every domain module registers on this router; it is mounted at /api at the
+  // bottom of this function. Modules keep declaring root-relative paths.
+  const api = express.Router();
 
   // ---- Global middleware -------------------------------------------
   app.use(express.json({ limit: "2mb" }));
@@ -103,62 +117,71 @@ export function buildApi({
   };
 
   // ---- Tool routers — must mount BEFORE wildcard registry below ----
-  registerTools(app, ctx);
+  registerTools(api, ctx);
 
   // ---- Health (unauthenticated) ------------------------------------
-  registerHealth(app, ctx);
+  registerHealth(api, ctx);
 
   // ---- Projects + per-project surfaces -----------------------------
-  registerProjects(app, ctx);
-  registerAgents(app, ctx);
-  registerSessions(app, ctx);
-  registerMcps(app, ctx);
-  registerIntegrations(app, ctx);
-  registerVars(app, ctx);
-  registerMessages(app, ctx);
-  registerEngines(app, ctx);
-  registerSkills(app, ctx);
-  registerExec(app, ctx);
-  registerSuperAgent(app, ctx);
-  registerConfirm(app, ctx);
-  registerCode(app, ctx);
-  registerConversations(app, ctx);
-  registerConnections(app, ctx);
-  registerRuntimes(app, ctx);
-  registerRoutines(app, ctx);
-  registerArtifacts(app, ctx);
-  registerArtifactPreview(app, ctx);
-  registerTasks(app, ctx);
-  registerOrganization(app, ctx);
-  registerProjectFiles(app, ctx);
-  registerConfig(app, ctx);
+  registerProjects(api, ctx);
+  registerAgents(api, ctx);
+  registerSessions(api, ctx);
+  registerMcps(api, ctx);
+  registerIntegrations(api, ctx);
+  registerVars(api, ctx);
+  registerMessages(api, ctx);
+  registerEngines(api, ctx);
+  registerSkills(api, ctx);
+  registerExec(api, ctx);
+  registerSuperAgent(api, ctx);
+  registerConfirm(api, ctx);
+  registerCode(api, ctx);
+  registerConversations(api, ctx);
+  registerConnections(api, ctx);
+  registerRuntimes(api, ctx);
+  registerRoutines(api, ctx);
+  registerArtifacts(api, ctx);
+  registerArtifactPreview(api, ctx);
+  registerTasks(api, ctx);
+  registerOrganization(api, ctx);
+  registerProjectFiles(api, ctx);
+  registerConfig(api, ctx);
 
   // ---- Top-level shortcuts (MCP server clients) --------------------
-  registerRun(app, ctx);
-  registerTopLevel(app, ctx);
-  registerSessionsSearch(app, ctx);
+  registerRun(api, ctx);
+  registerTopLevel(api, ctx);
+  registerSessionsSearch(api, ctx);
 
   // ---- Channels & plugin surfaces ----------------------------------
-  registerTelegram(app, ctx);
-  registerPlugins(app, ctx);
-  registerTranscribe(app, ctx);
-  registerTts(app, ctx);
-  registerEmbeddings(app, ctx);
-  registerVoice(app, ctx);
-  registerDesktop(app, ctx);
-  registerDeck(app, ctx);
-  registerPairing(app, ctx);
+  registerTelegram(api, ctx);
+  registerPlugins(api, ctx);
+  registerTranscribe(api, ctx);
+  registerTts(api, ctx);
+  registerEmbeddings(api, ctx);
+  registerVoice(api, ctx);
+  registerDesktop(api, ctx);
+  registerDeck(api, ctx);
+  registerPairing(api, ctx);
 
   // ---- Admin -------------------------------------------------------
-  registerAdmin(app, ctx);
-  registerAdminConfig(app, ctx);
-  registerIdentity(app, ctx);
-  registerProfiles(app, ctx);
-  registerInbox(app, ctx);
-
-  // ---- Web admin panel (static SPA, must mount before 404) ---------
-  // Serves src/interfaces/web/dist when present + the /admin/web-token
-  // localhost-only token endpoint. No-op until the panel is built.
+  registerAdmin(api, ctx);
+  registerAdminConfig(api, ctx);
+  registerIdentity(api, ctx);
+  registerProfiles(api, ctx);
+  registerInbox(api, ctx);
+  registerWebToken(api, ctx);
+
+  // ---- API 404 (MUST be last on the router) ------------------------
+  // Terminal for the /api namespace: an unknown /api/* path answers JSON here
+  // instead of falling through to the SPA shell below.
+  api.use((req, res) =>
+    res.status(404).json({ error: `no route ${req.method} ${req.baseUrl}${req.path}` })
+  );
+
+  app.use(API_PREFIX, api);
+
+  // ---- Web admin panel (static SPA, must mount after /api) ---------
+  // Serves src/interfaces/web/dist when present. No-op until the panel is built.
   registerWeb(app, ctx);
 
   // ---- 404 catch-all (MUST be last) --------------------------------
@@ -166,5 +189,11 @@ export function buildApi({
     res.status(404).json({ error: `no route ${req.method} ${req.path}` })
   );
 
+  // ---- Error handler (MUST be after everything) --------------------
+  // Express only recognises the 4-argument shape, and only when it is mounted
+  // last. Anything an asyncRoute() rejects lands here as JSON instead of an
+  // unhandled rejection that kills the daemon.
+  app.use(errorMiddleware(logError));
+
   return app;
 }

package/src/host/daemon/db.js

@@ -5,7 +5,7 @@ import path from "node:path";
 import { appendMessageToFs } from "#core/stores/messages.js";
 import { effectiveConfig } from "./project-config.js";
 import { readAgents } from "#core/apc/parser.js";
-import { apcDir, apcProjectFile, apcAgentsDir, apcCommandsDir } from "#core/apc/paths.js";
+import { apcProjectFile, apcAgentsDir, apcCommandsDir } from "#core/apc/paths.js";
 import { getOrCreateApxId } from "#core/apc/scaffold.js";
 import {
   ensureProjectStorage,

package/src/host/daemon/desktop-ws.js

@@ -1,5 +1,6 @@
 // Singleton WebSocket hub for the desktop channel.
 // Imported by api.js (to register connections) and by plugins/desktop/index.js (to broadcast).
+import { apiPath } from "./api/prefix.js";
 
 const _clients = new Set(); // Set<WebSocket>
 let _messageHandler = null; // (ws, data) => void — set by desktop plugin
@@ -12,7 +13,7 @@ export function setDesktopMessageHandler(fn) {
 
 // --- WS upgrade auth helpers (shared by the daemon upgrade handler + tests) ---
 //
-// The desktop WS channel must authenticate the same way the HTTP /desktop/*
+// The desktop WS channel must authenticate the same way the HTTP /api/desktop/*
 // routes do: a bearer token (master or paired client) carried on the upgrade
 // request. The legitimate desktop window sends `Authorization: Bearer <token>`
 // (src/interfaces/desktop/main.js); browser clients can pass `?token=`. Without
@@ -20,11 +21,14 @@ export function setDesktopMessageHandler(fn) {
 // when host is set to 0.0.0.0) could open the channel and drive the
 // super-agent. See QA BUG-WS-AUTH.
 
-/** Path-gate: is this upgrade for the desktop (or legacy overlay) WS channel? */
+/** The desktop channel's upgrade path. Lives under /api like every other route. */
+export const DESKTOP_WS_PATH = apiPath("/desktop/ws");
+
+/** Path-gate: is this upgrade for the desktop WS channel? */
 export function isDesktopUpgradePath(url) {
   let pathname = url || "";
   try { pathname = new URL(url, "http://localhost").pathname; } catch { /* keep raw */ }
-  return pathname === "/desktop/ws" || pathname === "/overlay/ws";
+  return pathname === DESKTOP_WS_PATH;
 }
 
 /** Extract the bearer token from the upgrade request (header first, ?token= fallback). */

package/src/host/daemon/index.js

@@ -12,12 +12,10 @@ import { randomBytes } from "node:crypto";
 const LOOPBACK_HOST = "127.0.0.1";
 import {
   readConfig,
-  writeConfig,
   effectiveHost,
   effectivePort,
   addProject as addProjectInConfig,
   PID_PATH,
-  LOG_PATH,
   APX_HOME,
   TOKEN_PATH,
 } from "#core/config/index.js";
@@ -297,12 +295,11 @@ async function main() {
     }).catch(() => {});
   });
 
-  // Attach WebSocket upgrade for the desktop channel on /desktop/ws
-  // (legacy /overlay/ws still accepted for one release).
+  // Attach WebSocket upgrade for the desktop channel on /api/desktop/ws.
   server.on("upgrade", async (req, socket, head) => {
     if (!isDesktopUpgradePath(req.url)) { socket.destroy(); return; }
     // Auth: the WS upgrade must carry a valid token (master or paired client),
-    // matching the HTTP /desktop/* routes. Without this, any client that can
+    // matching the HTTP /api/desktop/* routes. Without this, any client that can
     // reach the daemon (host binds 0.0.0.0 → the LAN) could open the desktop
     // channel and drive the super-agent (permission_mode "total"). The
     // legitimate desktop window already sends the bearer token. See QA BUG-WS-AUTH.
@@ -358,6 +355,15 @@ async function main() {
   process.on("uncaughtException", (e) => {
     log(`uncaughtException: ${e.stack || e.message}`);
   });
+  // Node >= 15 terminates the process on an unhandled rejection. The CLI has
+  // always registered this; the daemon had not, so one un-awaited failure in a
+  // route or a plugin took down the process serving the SPA, Telegram polling,
+  // voice and the deck at once. Log and keep running — the request-level
+  // errorMiddleware already answers the caller.
+  process.on("unhandledRejection", (reason) => {
+    const e = reason instanceof Error ? reason : new Error(String(reason));
+    log(`unhandledRejection: ${e.stack || e.message}`);
+  });
 }
 
 main().catch((e) => {

package/src/host/daemon/plugins/desktop/index.js

@@ -103,7 +103,7 @@ async function _handleMessage({ ws, text, previousMessages }, { projects, config
     await appendGlobalMessage({ channel: CHANNEL, direction: "in", type: "user", author: "user", body: text });
   } catch {}
 
-  let toolsExecuted = [];
+  const toolsExecuted = [];
 
   // Per-segment streaming: instead of merging the whole turn into one blob, we
   // emit each assistant text piece as its own `segment` (an intro before a tool,

package/src/host/daemon/plugins/telegram/index.js

@@ -311,7 +311,7 @@ export default {
       // that bot; otherwise first available bot-tokened channel. Always logs
       // the outbound on `messages` of the channel's target project so audit
       // trails are complete.
-      async send({ channel: channelName, chat_id, text, author = resolveAgentName(config), project }) {
+      async send({ channel: channelName, chat_id, text, author = resolveAgentName(config) }) {
         const p = pickPoller(pollers, channelName);
         const result = await p._send({ chat_id, text });
         appendGlobalMessage({