@agentprojectcontext/apx 1.77.3 → 1.79.0

package/src/core/util/thinking.js

@@ -17,6 +17,35 @@
 
 const THINK_RE = /<(?:think|thinking)>([\s\S]*?)<\/(?:think|thinking)>/gi;
 
+// Untagged chain-of-thought.
+//
+// Some models — routed free tiers especially — emit their planning as the
+// answer itself, with no tags at all: "We need to produce a response to user
+// request: ...". That reached a real user's Telegram as a 668-token English
+// wall in place of two sentences of Spanish.
+//
+// Detection is deliberately narrow. It only fires when the text OPENS with
+// first-person-plural planning about producing a response, which is a register
+// no genuine reply uses. Anything looser would eat real answers that happen to
+// begin with "We need to".
+const UNTAGGED_COT_OPENERS = [
+  /^we need to (produce|craft|write|generate|compose) (a |an )?(response|reply|answer|message)/i,
+  /^(the )?user (is )?(asking|says|wants|requests)\b[\s\S]{0,200}?\bwe (should|need to|must)\b/i,
+  /^okay,? (so )?(the )?user\b[\s\S]{0,120}?\bwe (should|need to)\b/i,
+  /^interpretation:\s/i,
+  /^let'?s (think|analyze|break this down)\b/i,
+];
+
+/**
+ * True when `text` reads as raw planning rather than a reply.
+ * Only ever consulted for the ANSWER half, after tagged blocks are removed.
+ */
+export function looksLikeUntaggedReasoning(text) {
+  const t = String(text || "").trimStart();
+  if (t.length < 120) return false; // too short to be a planning dump
+  return UNTAGGED_COT_OPENERS.some((re) => re.test(t));
+}
+
 export function splitThinking(text) {
   if (!text || typeof text !== "string") return { thinking: "", answer: text || "" };
   const blocks = [];
@@ -34,6 +63,28 @@ export function stripThinking(text) {
   return splitThinking(text).answer;
 }
 
+/**
+ * The answer, with untagged planning treated as thinking too.
+ *
+ * `stripThinking` only removes TAGGED blocks. A model that dumps its planning
+ * with no tags slips straight through, which is how a 668-token English
+ * chain-of-thought reached a user's phone instead of two sentences of Spanish.
+ *
+ * When the remaining answer still reads as raw planning, this returns "" — the
+ * caller decides what to do with an empty reply, which is a far better failure
+ * than shipping the model's notes to the user. Never guesses at salvaging a
+ * partial answer out of it.
+ *
+ * @returns {{ answer: string, leaked: boolean, thinking: string }}
+ */
+export function stripReasoning(text) {
+  const { thinking, answer } = splitThinking(text);
+  if (looksLikeUntaggedReasoning(answer)) {
+    return { answer: "", leaked: true, thinking: [thinking, answer].filter(Boolean).join("\n\n") };
+  }
+  return { answer, leaked: false, thinking };
+}
+
 export function formatForChannel(text, channel) {
   const { thinking, answer } = splitThinking(text);
   // Channels where reasoning would be noise to a human operator

package/src/core/vars/sources.js

@@ -13,16 +13,16 @@
 //
 // project wins over global when the same name exists in both.
 
-import fs from "node:fs";
-import os from "node:os";
 import path from "node:path";
+import { apxHome } from "#core/config/paths.js";
+import { readJson, writeJson, SECRET_MODE } from "#core/util/json-file.js";
 
-const APX_HOME = path.join(os.homedir(), ".apx");
-const GLOBAL_VARS_FILE = path.join(APX_HOME, "vars.json");
+
+const globalVarsFile = () => path.join(apxHome(), "vars.json");
 const PROJECT_VARS_FILENAME = "vars.json";
 
 export function globalVarsPath() {
-  return GLOBAL_VARS_FILE;
+  return globalVarsFile();
 }
 
 export function projectVarsPath(storagePath) {
@@ -30,32 +30,25 @@ export function projectVarsPath(storagePath) {
   return path.join(storagePath, PROJECT_VARS_FILENAME);
 }
 
+// A vars file must be a plain object; anything else is treated as empty.
 function readJsonSafe(absPath) {
-  if (!absPath || !fs.existsSync(absPath)) return {};
-  try {
-    const json = JSON.parse(fs.readFileSync(absPath, "utf8"));
-    return json && typeof json === "object" && !Array.isArray(json) ? json : {};
-  } catch {
-    return {};
-  }
+  if (!absPath) return {};
+  const json = readJson(absPath, {});
+  return json && typeof json === "object" && !Array.isArray(json) ? json : {};
 }
 
+// SECRET_MODE: these files hold tokens. The write is atomic, so a crash can no
+// longer truncate the store.
 function writeJsonSecure(absPath, obj) {
-  fs.mkdirSync(path.dirname(absPath), { recursive: true });
-  fs.writeFileSync(absPath, JSON.stringify(obj, null, 2) + "\n");
-  try {
-    fs.chmodSync(absPath, 0o600);
-  } catch {
-    // Best effort on non-POSIX filesystems.
-  }
+  writeJson(absPath, obj, { mode: SECRET_MODE });
 }
 
 export function readGlobalVars() {
-  return readJsonSafe(GLOBAL_VARS_FILE);
+  return readJsonSafe(globalVarsFile());
 }
 
 export function writeGlobalVars(obj) {
-  writeJsonSecure(GLOBAL_VARS_FILE, obj);
+  writeJsonSecure(globalVarsFile(), obj);
 }
 
 export function readProjectVars(storagePath) {

package/src/core/voice/stt-models.js

@@ -23,7 +23,7 @@ function repoCacheName(repoId) {
 
 function dirSizeBytes(dir) {
   let total = 0;
-  let stack = [dir];
+  const stack = [dir];
   while (stack.length) {
     const d = stack.pop();
     let entries;

package/src/core/voice/tts.js

@@ -5,11 +5,12 @@
 //
 // All audio files land under ~/.apx/tmp/tts/<uuid>.<ext>. Callers are
 // responsible for cleaning up (Telegram plugin already uses similar temp
-// files via /telegram/send_voice).
+// files via /api/telegram/send_voice).
 
 import fs from "node:fs";
-import path from "node:path";
-import os from "node:os";
+import { TTS_TMP_DIR } from "#core/config/paths.js";
+
+export { TTS_TMP_DIR };
 import { readConfig } from "../config/index.js";
 import {
   selectTtsEngine,
@@ -19,7 +20,7 @@ import {
 } from "./engines/index.js";
 import { emotionConfigFor, stripEmotionTags } from "./emotions.js";
 
-export const TTS_TMP_DIR = path.join(os.homedir(), ".apx", "tmp", "tts");
+
 
 export function ensureTtsTmpDir() {
   fs.mkdirSync(TTS_TMP_DIR, { recursive: true });

package/src/host/daemon/api/admin-config.js

@@ -8,7 +8,7 @@
 import { readConfig, writeConfig } from "#core/config/index.js";
 import { resolveAgentName } from "#core/identity/index.js";
 import { setDottedKey, unsetDottedKey } from "../project-config.js";
-import { PERMISSION_MODES, DEFAULT_PERMISSION_MODE } from "#core/constants/permissions.js";
+import { PERMISSION_MODES } from "#core/constants/permissions.js";
 import {
   redactConfig as redact,
   isSecretMarker,
@@ -16,8 +16,8 @@ import {
 } from "#core/config/redact.js";
 import { collectSecretValues, registerSecretValues } from "#core/config/secret-values.js";
 
-export function register(app, { config, scheduler, plugins }) {
-  app.get("/admin/config", (_req, res) => {
+export function register(api, { config, scheduler, plugins }) {
+  api.get("/admin/config", (_req, res) => {
     try {
       const fresh = readConfig();
       res.json({ config: redact(fresh) });
@@ -26,7 +26,7 @@ export function register(app, { config, scheduler, plugins }) {
     }
   });
 
-  app.patch("/admin/config", (req, res) => {
+  api.patch("/admin/config", (req, res) => {
     const { set, unset } = req.body || {};
     let cfg;
     try {
@@ -68,7 +68,7 @@ export function register(app, { config, scheduler, plugins }) {
   });
 
   // Convenience: GET the resolved super_agent prompt (used by SettingsScreen)
-  app.get("/admin/super-agent", (_req, res) => {
+  api.get("/admin/super-agent", (_req, res) => {
     try {
       const fresh = readConfig();
       const sa = fresh.super_agent || {};

package/src/host/daemon/api/admin.js

@@ -8,11 +8,12 @@ import { execFile } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { LOG_DIR } from "#core/config/paths.js";
 
-export function register(app, { scheduler, plugins, config, registries }) {
+export function register(api, { scheduler, plugins, config, registries }) {
   // Daemon logs: errors.jsonl (structured) or apx.log (plain), newest first.
-  app.get("/admin/logs", (req, res) => {
-    const dir = path.join(os.homedir(), ".apx", "logs");
+  api.get("/admin/logs", (req, res) => {
+    const dir = LOG_DIR;
     const which = req.query.file === "apx" ? "apx.log" : "errors.jsonl";
     const file = path.join(dir, which);
     const limit = Math.min(parseInt(req.query.limit, 10) || 200, 2000);
@@ -26,7 +27,7 @@ export function register(app, { scheduler, plugins, config, registries }) {
     res.json({ file: which, lines: tail });
   });
 
-  app.post("/admin/reload", (_req, res) => {
+  api.post("/admin/reload", (_req, res) => {
     try {
       const fresh = readConfig();
       // Mutate in place so every closure that captured `config` sees the new
@@ -46,7 +47,7 @@ export function register(app, { scheduler, plugins, config, registries }) {
     }
   });
 
-  app.post("/admin/shutdown", (_req, res) => {
+  api.post("/admin/shutdown", (_req, res) => {
     res.json({ ok: true });
     setTimeout(() => process.exit(0), 50);
   });
@@ -56,7 +57,7 @@ export function register(app, { scheduler, plugins, config, registries }) {
   // zenity (if present); Windows uses PowerShell's Shell.Application. If the
   // platform lacks a usable picker — or none is installed — the endpoint
   // returns 501 so the frontend can fall back to the inline directory list.
-  app.get("/admin/fs/pick-dir", (req, res) => {
+  api.get("/admin/fs/pick-dir", (req, res) => {
     // The prompt is attacker-controllable (query string). NEVER interpolate it
     // into a shell string — use execFile (no shell) with an argv array, and
     // pass the prompt out-of-band via an env var so it can't break out of any
@@ -109,7 +110,7 @@ export function register(app, { scheduler, plugins, config, registries }) {
     });
   });
 
-  app.get("/admin/fs/dirs", (req, res) => {
+  api.get("/admin/fs/dirs", (req, res) => {
     const requested = String(req.query.path || os.homedir());
     const base = path.resolve(requested.replace(/^~(?=$|\/)/, os.homedir()));
     try {

package/src/host/daemon/api/agents.js

@@ -70,12 +70,12 @@ function normalizeAutonomy(v) {
   return AUTONOMY_VALUES.has(v) ? v : undefined;
 }
 
-export function register(app, { projects, project }) {
+export function register(api, { projects, project }) {
   // Vault = global agent templates. Two-layer: bundled defaults shipped with
   // APX (assets/agent-vault-defaults/) + user overrides/new ones in
   // ~/.apx/agents/. The user layer wins per slug; tombstones in .removed.json
   // hide bundled entries. GET merges both with `source` set per item.
-  app.get("/agents/vault", (req, res) => {
+  api.get("/agents/vault", (req, res) => {
     const includeRemoved = req.query?.include_removed === "1";
     res.json(readVaultAgents({ includeRemoved }).map((a) => ({
       ...agentToResponse(a),
@@ -84,7 +84,7 @@ export function register(app, { projects, project }) {
   });
 
   // Create or replace a vault template (user layer / copy-on-write).
-  app.post("/agents/vault", (req, res) => {
+  api.post("/agents/vault", (req, res) => {
     const { slug, fields, body = "" } = req.body || {};
     if (!slug || !/^[a-z][a-z0-9_-]*$/.test(slug)) {
       return res.status(400).json({ error: "valid slug required" });
@@ -100,7 +100,7 @@ export function register(app, { projects, project }) {
 
   // Patch a vault template. If the slug is bundled-only, copy it to the user
   // layer first (the writer already does this), then apply the merged fields.
-  app.patch("/agents/vault/:slug", (req, res) => {
+  api.patch("/agents/vault/:slug", (req, res) => {
     const { slug } = req.params;
     const current = readVaultAgent(slug);
     if (!current) return res.status(404).json({ error: `vault agent ${slug} not found` });
@@ -118,14 +118,14 @@ export function register(app, { projects, project }) {
 
   // Delete a vault template. Tombstones bundled slugs so they stay hidden;
   // deletes the user-layer file otherwise. POST .../restore lifts a tombstone.
-  app.delete("/agents/vault/:slug", (req, res) => {
+  api.delete("/agents/vault/:slug", (req, res) => {
     const { slug } = req.params;
     const out = removeVaultAgent(slug);
     if (!out.removed) return res.status(404).json({ error: `vault agent ${slug} not found` });
     res.json({ ok: true, ...out });
   });
 
-  app.post("/agents/vault/:slug/restore", (req, res) => {
+  api.post("/agents/vault/:slug/restore", (req, res) => {
     const { slug } = req.params;
     const out = restoreVaultAgent(slug);
     if (!out.restored) return res.status(404).json({ error: `slug ${slug} was not tombstoned` });
@@ -134,7 +134,7 @@ export function register(app, { projects, project }) {
   });
 
   // Import a vault template into a project (copies it to .apc/agents/<slug>.md).
-  app.post("/projects/:pid/agents/import", (req, res) => {
+  api.post("/projects/:pid/agents/import", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { slug } = req.body || {};
@@ -154,7 +154,7 @@ export function register(app, { projects, project }) {
     }
   });
 
-  app.get("/projects/:pid/agents", (req, res) => {
+  api.get("/projects/:pid/agents", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const agents = readAgents(p.path).map(agentToResponse);
@@ -162,7 +162,7 @@ export function register(app, { projects, project }) {
     res.json(agents);
   });
 
-  app.get("/projects/:pid/agents/:slug", (req, res) => {
+  api.get("/projects/:pid/agents/:slug", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const agents = readAgents(p.path);
@@ -172,7 +172,7 @@ export function register(app, { projects, project }) {
     res.json({ ...agentToResponse(a), memory, system: a.body || "" });
   });
 
-  app.post("/projects/:pid/agents", (req, res) => {
+  api.post("/projects/:pid/agents", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const {
@@ -213,7 +213,7 @@ export function register(app, { projects, project }) {
 
   // Edit an existing agent. Merges provided fields into the AGENT.md
   // frontmatter; `system` rewrites the body (the agent's system prompt).
-  app.patch("/projects/:pid/agents/:slug", (req, res) => {
+  api.patch("/projects/:pid/agents/:slug", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const slug = req.params.slug;
@@ -255,7 +255,7 @@ export function register(app, { projects, project }) {
   });
 
   // Delete an agent: removes .apc/agents/<slug>.md and runtime data dir.
-  app.delete("/projects/:pid/agents/:slug", (req, res) => {
+  api.delete("/projects/:pid/agents/:slug", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const slug = req.params.slug;
@@ -276,7 +276,7 @@ export function register(app, { projects, project }) {
   });
 
   // ---- Project-level memory (.apc/memory.md) ----
-  app.get("/projects/:pid/memory", (req, res) => {
+  api.get("/projects/:pid/memory", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const memPath = apcMemoryFile(p.path);
@@ -284,7 +284,7 @@ export function register(app, { projects, project }) {
     res.json({ body, path: memPath });
   });
 
-  app.put("/projects/:pid/memory", (req, res) => {
+  api.put("/projects/:pid/memory", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { body } = req.body || {};
@@ -298,7 +298,7 @@ export function register(app, { projects, project }) {
   });
 
   // ---- Per-agent memory ----
-  app.get("/projects/:pid/agents/:slug/memory", (req, res) => {
+  api.get("/projects/:pid/agents/:slug/memory", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     // Validate the agent exists — otherwise an unknown slug returned 200 with an
@@ -308,7 +308,7 @@ export function register(app, { projects, project }) {
     res.json({ body: readAgentMemory(p, req.params.slug) });
   });
 
-  app.put("/projects/:pid/agents/:slug/memory", (req, res) => {
+  api.put("/projects/:pid/agents/:slug/memory", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     if (!readAgents(p.path).some((a) => a.slug === req.params.slug))

package/src/host/daemon/api/artifact-preview.js

@@ -12,9 +12,9 @@
 import { previews } from "#core/artifacts/preview.js";
 import { tunnels, detectProviders } from "#core/artifacts/tunnel.js";
 
-export function register(app, { project }) {
+export function register(api, { project }) {
   // Start (or reuse) an ephemeral preview server for an artifact.
-  app.post("/projects/:pid/artifacts/:name/preview", async (req, res) => {
+  api.post("/projects/:pid/artifacts/:name/preview", async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const name = decodeURIComponent(req.params.name);
@@ -33,24 +33,24 @@ export function register(app, { project }) {
   });
 
   // List preview servers scoped to a project.
-  app.get("/projects/:pid/previews", (req, res) => {
+  api.get("/projects/:pid/previews", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     res.json(previews.list(p.id));
   });
 
   // List every live preview (all projects).
-  app.get("/previews", (_req, res) => {
+  api.get("/previews", (_req, res) => {
     res.json(previews.list());
   });
 
   // Which tunnel providers this host can use, best first.
-  app.get("/previews/tunnel-providers", (_req, res) => {
+  api.get("/previews/tunnel-providers", (_req, res) => {
     res.json({ providers: detectProviders() });
   });
 
   // Stop a preview server (also closes its tunnel).
-  app.delete("/previews/:id", async (req, res) => {
+  api.delete("/previews/:id", async (req, res) => {
     const rec = previews.get(req.params.id);
     if (rec?.tunnel) tunnels.close(rec.tunnel.id);
     const ok = await previews.stop(req.params.id);
@@ -58,7 +58,7 @@ export function register(app, { project }) {
   });
 
   // Open a public tunnel to a preview's local port.
-  app.post("/previews/:id/tunnel", async (req, res) => {
+  api.post("/previews/:id/tunnel", async (req, res) => {
     const rec = previews.get(req.params.id);
     if (!rec) return res.status(404).json({ error: "preview not found" });
     if (rec.tunnel) return res.json(rec.tunnel); // already shared
@@ -72,7 +72,7 @@ export function register(app, { project }) {
   });
 
   // Close a preview's tunnel but keep the local server running.
-  app.delete("/previews/:id/tunnel", (req, res) => {
+  api.delete("/previews/:id/tunnel", (req, res) => {
     const rec = previews.get(req.params.id);
     if (!rec || !rec.tunnel) return res.status(404).end();
     tunnels.close(rec.tunnel.id);

package/src/host/daemon/api/artifacts.js

@@ -89,14 +89,14 @@ function runArtifact({ absPath, cwd, args, timeoutMs = RUN_TIMEOUT_MS }) {
   });
 }
 
-export function register(app, { project }) {
-  app.get("/projects/:pid/artifacts", (req, res) => {
+export function register(api, { project }) {
+  api.get("/projects/:pid/artifacts", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     res.json(listArtifacts(p.storagePath));
   });
 
-  app.post("/projects/:pid/artifacts", (req, res) => {
+  api.post("/projects/:pid/artifacts", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { name, content = "" } = req.body || {};
@@ -109,7 +109,7 @@ export function register(app, { project }) {
     }
   });
 
-  app.get("/projects/:pid/artifacts/:name", (req, res) => {
+  api.get("/projects/:pid/artifacts/:name", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     try {
@@ -119,7 +119,7 @@ export function register(app, { project }) {
     }
   });
 
-  app.patch("/projects/:pid/artifacts/:name", (req, res) => {
+  api.patch("/projects/:pid/artifacts/:name", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const name = decodeURIComponent(req.params.name);
@@ -144,7 +144,7 @@ export function register(app, { project }) {
     }
   });
 
-  app.delete("/projects/:pid/artifacts/:name", (req, res) => {
+  api.delete("/projects/:pid/artifacts/:name", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const ok = removeArtifact(
@@ -158,7 +158,7 @@ export function register(app, { project }) {
   // its own local spawn (stdio inherited) so it can run interactively. Output
   // is captured up to MAX_CAPTURE_BYTES and the call is bounded by
   // RUN_TIMEOUT_MS — anything longer should go through the terminal.
-  app.post("/projects/:pid/artifacts/:name/run", async (req, res) => {
+  api.post("/projects/:pid/artifacts/:name/run", async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const name = decodeURIComponent(req.params.name);

package/src/host/daemon/api/code.js

@@ -47,18 +47,18 @@ function modeGuidanceFor(mode) {
 // codeSessionHistory() (transcript → engine messages) and makeTurnAccumulator()
 // (stream events → persistable ChatParts) imported above.
 
-export function register(app, { projects, project, config, registries, plugins }) {
+export function register(api, { projects, project, config, registries, plugins }) {
   const findProject = (req, res) => project(req, res);
 
   // ---- List ----------------------------------------------------------------
-  app.get("/projects/:pid/code/sessions", (req, res) => {
+  api.get("/projects/:pid/code/sessions", (req, res) => {
     const p = findProject(req, res);
     if (!p) return;
     res.json({ sessions: listCodeSessions(p.storagePath) });
   });
 
   // ---- Create (captures git baseline) --------------------------------------
-  app.post("/projects/:pid/code/sessions", (req, res) => {
+  api.post("/projects/:pid/code/sessions", (req, res) => {
     const p = findProject(req, res);
     if (!p) return;
     const { title, model, mode, agentSlug } = req.body || {};
@@ -86,7 +86,7 @@ export function register(app, { projects, project, config, registries, plugins }
   });
 
   // ---- Get full transcript -------------------------------------------------
-  app.get("/projects/:pid/code/sessions/:sid", (req, res) => {
+  api.get("/projects/:pid/code/sessions/:sid", (req, res) => {
     const p = findProject(req, res);
     if (!p) return;
     const session = getCodeSession(p.storagePath, req.params.sid);
@@ -95,7 +95,7 @@ export function register(app, { projects, project, config, registries, plugins }
   });
 
   // ---- Patch (rename / model / mode) ---------------------------------------
-  app.patch("/projects/:pid/code/sessions/:sid", (req, res) => {
+  api.patch("/projects/:pid/code/sessions/:sid", (req, res) => {
     const p = findProject(req, res);
     if (!p) return;
     const session = updateCodeSession(p.storagePath, req.params.sid, req.body || {});
@@ -104,7 +104,7 @@ export function register(app, { projects, project, config, registries, plugins }
   });
 
   // ---- Delete --------------------------------------------------------------
-  app.delete("/projects/:pid/code/sessions/:sid", (req, res) => {
+  api.delete("/projects/:pid/code/sessions/:sid", (req, res) => {
     const p = findProject(req, res);
     if (!p) return;
     const ok = removeCodeSession(p.storagePath, req.params.sid);
@@ -113,7 +113,7 @@ export function register(app, { projects, project, config, registries, plugins }
   });
 
   // ---- Changes (diff vs baseline) ------------------------------------------
-  app.get("/projects/:pid/code/sessions/:sid/changes", (req, res) => {
+  api.get("/projects/:pid/code/sessions/:sid/changes", (req, res) => {
     const p = findProject(req, res);
     if (!p) return;
     const session = getCodeSession(p.storagePath, req.params.sid);
@@ -130,7 +130,7 @@ export function register(app, { projects, project, config, registries, plugins }
   });
 
   // ---- Streaming turn ------------------------------------------------------
-  app.post("/projects/:pid/code/sessions/:sid/chat/stream", async (req, res) => {
+  api.post("/projects/:pid/code/sessions/:sid/chat/stream", async (req, res) => {
     const p = findProject(req, res);
     if (!p) return;
     const session = getCodeSession(p.storagePath, req.params.sid);