@agentprojectcontext/apx 1.77.3 → 1.79.0

package/src/host/daemon/api/integrations.js

@@ -25,8 +25,12 @@ import {
   getPluginService,
   reconcilePluginMcp,
 } from "#core/integrations/index.js";
+import { asyncRoute } from "./shared.js";
 
-function normalizeScope(raw) {
+// Integration scope vocabulary: project | global, accepting "default" for
+// global and both "shared" and "runtime" for project. See the note in
+// api/mcps.js — do not merge these three helpers.
+function normalizeIntegrationScope(raw) {
   if (!raw) return "project";
   const s = String(raw).toLowerCase();
   if (s === "global" || s === "default") return "global";
@@ -44,7 +48,7 @@ function storagePathForScope(scope, p, projects) {
   return p.storagePath || null;
 }
 
-export function register(app, { projects, project, registries }) {
+export function register(api, { projects, project, registries }) {
   // Keep a plugin's optional auto-registered MCP server (svc.mcpServer hook) in
   // lockstep with its stored state. Best-effort: a failure here must not break
   // the configure/validate/deactivate/delete response. `storagePath` is the one
@@ -62,10 +66,10 @@ export function register(app, { projects, project, registries }) {
   }
 
   // List stored integrations in the chosen scope (secrets redacted).
-  app.get("/projects/:pid/integrations", (req, res) => {
+  api.get("/projects/:pid/integrations", (req, res) => {
     const p = project(req, res);
     if (!p) return;
-    const scope = normalizeScope(req.query?.scope);
+    const scope = normalizeIntegrationScope(req.query?.scope);
     if (scope === null) return res.status(400).json({ error: `unknown scope "${req.query?.scope}"` });
     const storagePath = storagePathForScope(scope, p, projects);
     if (!storagePath) return res.status(400).json({ error: "project has no storage path" });
@@ -75,7 +79,7 @@ export function register(app, { projects, project, registries }) {
 
   // The full plugin roster with each plugin's resolved status for this project
   // (project record wins over the default/global one).
-  app.get("/projects/:pid/integrations/catalog", (req, res) => {
+  api.get("/projects/:pid/integrations/catalog", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const catalog = listCatalog().map((entry) => {
@@ -97,12 +101,12 @@ export function register(app, { projects, project, registries }) {
   });
 
   // Status for a single plugin in the chosen scope.
-  app.get("/projects/:pid/integrations/:slug", (req, res) => {
+  api.get("/projects/:pid/integrations/:slug", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const svc = getPluginService(req.params.slug);
     if (!svc) return res.status(404).json({ error: `unknown plugin "${req.params.slug}"` });
-    const scope = normalizeScope(req.query?.scope);
+    const scope = normalizeIntegrationScope(req.query?.scope);
     if (scope === null) return res.status(400).json({ error: `unknown scope "${req.query?.scope}"` });
     const storagePath = storagePathForScope(scope, p, projects);
     if (!storagePath) return res.status(400).json({ error: "project has no storage path" });
@@ -111,12 +115,12 @@ export function register(app, { projects, project, registries }) {
   });
 
   // Save credentials / config. Creates the record if missing.
-  app.post("/projects/:pid/integrations/:slug/configure", (req, res) => {
+  api.post("/projects/:pid/integrations/:slug/configure", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const svc = getPluginService(req.params.slug);
     if (!svc) return res.status(404).json({ error: `unknown plugin "${req.params.slug}"` });
-    const scope = normalizeScope(req.query?.scope);
+    const scope = normalizeIntegrationScope(req.query?.scope);
     if (scope === null) return res.status(400).json({ error: `unknown scope "${req.query?.scope}"` });
     const storagePath = storagePathForScope(scope, p, projects);
     if (!storagePath) return res.status(400).json({ error: "project has no storage path" });
@@ -132,12 +136,12 @@ export function register(app, { projects, project, registries }) {
   });
 
   // Verify the stored credentials against the provider, then persist the result.
-  app.post("/projects/:pid/integrations/:slug/validate", async (req, res) => {
+  api.post("/projects/:pid/integrations/:slug/validate", asyncRoute(async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const svc = getPluginService(req.params.slug);
     if (!svc) return res.status(404).json({ error: `unknown plugin "${req.params.slug}"` });
-    const scope = normalizeScope(req.query?.scope);
+    const scope = normalizeIntegrationScope(req.query?.scope);
     if (scope === null) return res.status(400).json({ error: `unknown scope "${req.query?.scope}"` });
     const storagePath = storagePathForScope(scope, p, projects);
     if (!storagePath) return res.status(400).json({ error: "project has no storage path" });
@@ -153,15 +157,15 @@ export function register(app, { projects, project, registries }) {
     } catch (e) {
       res.status(400).json({ error: e.message });
     }
-  });
+  }));
 
   // Disable a plugin without deleting its stored credentials.
-  app.post("/projects/:pid/integrations/:slug/deactivate", (req, res) => {
+  api.post("/projects/:pid/integrations/:slug/deactivate", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const svc = getPluginService(req.params.slug);
     if (!svc) return res.status(404).json({ error: `unknown plugin "${req.params.slug}"` });
-    const scope = normalizeScope(req.query?.scope);
+    const scope = normalizeIntegrationScope(req.query?.scope);
     if (scope === null) return res.status(400).json({ error: `unknown scope "${req.query?.scope}"` });
     const storagePath = storagePathForScope(scope, p, projects);
     if (!storagePath) return res.status(400).json({ error: "project has no storage path" });
@@ -174,7 +178,7 @@ export function register(app, { projects, project, registries }) {
   });
 
   // Plugin-specific read action (e.g. Asana → list workspaces for the token).
-  app.post("/projects/:pid/integrations/:slug/action/:action", async (req, res) => {
+  api.post("/projects/:pid/integrations/:slug/action/:action", asyncRoute(async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const svc = getPluginService(req.params.slug);
@@ -183,7 +187,7 @@ export function register(app, { projects, project, registries }) {
     if (typeof fn !== "function") {
       return res.status(404).json({ error: `unknown action "${req.params.action}"` });
     }
-    const scope = normalizeScope(req.query?.scope);
+    const scope = normalizeIntegrationScope(req.query?.scope);
     if (scope === null) return res.status(400).json({ error: `unknown scope "${req.query?.scope}"` });
     const storagePath = storagePathForScope(scope, p, projects);
     if (!storagePath) return res.status(400).json({ error: "project has no storage path" });
@@ -197,13 +201,13 @@ export function register(app, { projects, project, registries }) {
     } catch (e) {
       res.status(400).json({ error: e.message });
     }
-  });
+  }));
 
   // Remove a stored integration entirely.
-  app.delete("/projects/:pid/integrations/:slug", (req, res) => {
+  api.delete("/projects/:pid/integrations/:slug", (req, res) => {
     const p = project(req, res);
     if (!p) return;
-    const scope = normalizeScope(req.query?.scope);
+    const scope = normalizeIntegrationScope(req.query?.scope);
     if (scope === null) return res.status(400).json({ error: `unknown scope "${req.query?.scope}"` });
     const storagePath = storagePathForScope(scope, p, projects);
     if (!storagePath) return res.status(400).json({ error: "project has no storage path" });

package/src/host/daemon/api/mcps.js

@@ -45,7 +45,11 @@ function writeScope(scope, projectEntry, json) {
   return writeApfMcps(projectEntry.path, json);
 }
 
-function normalizeScope(raw) {
+// MCP scope vocabulary: shared | runtime | global (with "apc" as a friendly
+// alias for shared). NOT interchangeable with the var or integration scopes —
+// each subsystem has its own set and its own default, and collapsing them into
+// one helper would silently reroute writes to the wrong store.
+function normalizeMcpScope(raw) {
   if (!raw) return "shared";
   const s = String(raw).toLowerCase();
   if (s === "apc") return "shared"; // friendly alias
@@ -55,17 +59,17 @@ function normalizeScope(raw) {
   return s;
 }
 
-export function register(app, { projects, registries, project }) {
-  app.get("/projects/:pid/mcps", (req, res) => {
+export function register(api, { projects, registries, project }) {
+  api.get("/projects/:pid/mcps", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     res.json(registries.for(p).list());
   });
 
-  app.post("/projects/:pid/mcps", (req, res) => {
+  api.post("/projects/:pid/mcps", (req, res) => {
     const p = project(req, res);
     if (!p) return;
-    const scope = normalizeScope(req.query?.scope);
+    const scope = normalizeMcpScope(req.query?.scope);
     if (scope === null) {
       return res.status(400).json({ error: `unknown scope "${req.query?.scope}" (use shared|runtime|global)` });
     }
@@ -102,10 +106,10 @@ export function register(app, { projects, registries, project }) {
     res.status(201).json(entry);
   });
 
-  app.delete("/projects/:pid/mcps/:name", (req, res) => {
+  api.delete("/projects/:pid/mcps/:name", (req, res) => {
     const p = project(req, res);
     if (!p) return;
-    const scope = normalizeScope(req.query?.scope);
+    const scope = normalizeMcpScope(req.query?.scope);
     if (scope === null) {
       return res.status(400).json({ error: `unknown scope "${req.query?.scope}" (use shared|runtime|global)` });
     }
@@ -155,7 +159,7 @@ export function register(app, { projects, registries, project }) {
     res.status(204).end();
   });
 
-  app.get("/projects/:pid/mcps/check", (req, res) => {
+  api.get("/projects/:pid/mcps/check", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const reg = registries.for(p);
@@ -194,7 +198,7 @@ export function register(app, { projects, registries, project }) {
   // Full tool catalog — tools/list with input schemas, all pages merged.
   // This is what `apx mcp tools` renders; /test below stays as the
   // lightweight smoke check for the web UI card.
-  app.get("/projects/:pid/mcps/:name/tools", async (req, res) => {
+  api.get("/projects/:pid/mcps/:name/tools", async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     try {
@@ -205,7 +209,7 @@ export function register(app, { projects, registries, project }) {
     }
   });
 
-  app.post("/projects/:pid/mcps/:name/call", async (req, res) => {
+  api.post("/projects/:pid/mcps/:name/call", async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { tool, params } = req.body || {};
@@ -221,7 +225,7 @@ export function register(app, { projects, registries, project }) {
   // Smoke test — calls tools/list and reports either the tool catalog or a
   // clean error message. Used by the "Test" button in the MCP card so the
   // user can sanity-check a freshly-saved MCP without firing a real tool.
-  app.post("/projects/:pid/mcps/:name/test", async (req, res) => {
+  api.post("/projects/:pid/mcps/:name/test", async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     try {
@@ -242,7 +246,7 @@ export function register(app, { projects, registries, project }) {
 
   // In-memory log buffer for one MCP — stderr tail (stdio) or fetch summary
   // (http) plus a ring of recent events.
-  app.get("/projects/:pid/mcps/:name/logs", (req, res) => {
+  api.get("/projects/:pid/mcps/:name/logs", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const logs = registries.for(p).getLogs(req.params.name);

package/src/host/daemon/api/messages.js

@@ -11,8 +11,8 @@ import {
   searchProjectMessages,
 } from "#core/stores/messages.js";
 
-export function register(app, { project }) {
-  app.get("/projects/:pid/messages", (req, res) => {
+export function register(api, { project }) {
+  api.get("/projects/:pid/messages", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { agent, channel, since, limit = "100" } = req.query;
@@ -25,7 +25,7 @@ export function register(app, { project }) {
     res.json(rows);
   });
 
-  app.post("/projects/:pid/messages", (req, res) => {
+  api.post("/projects/:pid/messages", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const {
@@ -55,7 +55,7 @@ export function register(app, { project }) {
     res.status(201).json({ ok: true, ts: r.ts });
   });
 
-  app.get("/projects/:pid/messages/search", (req, res) => {
+  api.get("/projects/:pid/messages/search", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { q, limit = "50" } = req.query;
@@ -70,7 +70,7 @@ export function register(app, { project }) {
   });
 
   // Cross-project channels (telegram, direct, …)
-  app.get("/messages/global", (req, res) => {
+  api.get("/messages/global", (req, res) => {
     const { channel, limit = "100", since } = req.query;
     const lim = Math.min(parseInt(limit, 10) || 100, 1000);
     const rows = readGlobalMessages({

package/src/host/daemon/api/nudges.js

@@ -0,0 +1,112 @@
+// The interruption budget, as seen from outside.
+//
+//   GET   /nudges                      — the ledger, newest first
+//   GET   /nudges/policy               — the effective policy and where it came from
+//   PUT   /nudges/policy               — the user's overrides (config.nudge)
+//   POST  /nudges/:id/feedback         — { useful, note? }
+//   POST  /nudges/check                — dry-run the gate without sending
+//
+// The ledger is the honest answer to "how often does this thing bother me",
+// which is the question that decides whether someone keeps the bot on.
+import { readConfig, writeConfig } from "#core/config/index.js";
+import {
+  listNudges, nudgeStats, recordFeedback, canNudge,
+  resolveNudgePolicy, DEFAULT_POLICY,
+} from "#core/nudge/index.js";
+import { pageEnvelope } from "./shared.js";
+
+export function register(api) {
+  api.get("/nudges", (req, res) => {
+    try {
+      const rows = listNudges({
+        limit: req.query.limit || 50,
+        kind: req.query.kind || "",
+        project_id: req.query.project_id || "",
+        with_feedback:
+          req.query.with_feedback === "1" ? true
+          : req.query.with_feedback === "0" ? false
+          : null,
+      });
+      const envelope = pageEnvelope(rows, req.query);
+      envelope.meta = { ...(envelope.meta || {}), stats: nudgeStats() };
+      res.json(envelope);
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  api.get("/nudges/policy", (_req, res) => {
+    try {
+      const cfg = readConfig();
+      const { source, ...policy } = resolveNudgePolicy(cfg);
+      res.json({
+        policy,
+        // Which layers contributed, so the panel can say "this came from your
+        // profile" instead of showing a number with no provenance.
+        source,
+        defaults: DEFAULT_POLICY,
+        user_overrides: cfg.nudge || {},
+      });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  api.put("/nudges/policy", (req, res) => {
+    const body = req.body || {};
+    try {
+      const cfg = readConfig();
+      const next = { ...(cfg.nudge || {}) };
+      for (const key of Object.keys(DEFAULT_POLICY)) {
+        if (!(key in body)) continue;
+        // null clears the override and hands the key back to the profile.
+        if (body[key] === null) delete next[key];
+        else next[key] = body[key];
+      }
+      cfg.nudge = next;
+      writeConfig(cfg);
+      const { source, ...policy } = resolveNudgePolicy(cfg);
+      res.json({ ok: true, policy, source, user_overrides: next });
+    } catch (e) {
+      res.status(400).json({ error: e.message });
+    }
+  });
+
+  api.post("/nudges/:id/feedback", (req, res) => {
+    const { useful, note } = req.body || {};
+    if (typeof useful !== "boolean") {
+      return res.status(400).json({ error: "useful (boolean) required" });
+    }
+    try {
+      const entry = recordFeedback(req.params.id, useful, note || "");
+      if (!entry) return res.status(404).json({ error: `no nudge: ${req.params.id}` });
+      res.json({ ok: true, entry });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  // Dry run. Lets a caller (or a curious user) ask "would this get through?"
+  // without spending anything — nothing is recorded here.
+  api.post("/nudges/check", (req, res) => {
+    const { kind, project_id, severity, unsolicited } = req.body || {};
+    try {
+      const gate = canNudge(
+        {
+          kind: kind || "unknown",
+          project_id: project_id ?? null,
+          severity: severity || "normal",
+          unsolicited: unsolicited !== false,
+        },
+        readConfig(),
+      );
+      res.json({
+        allowed: gate.allowed,
+        reason: gate.reason,
+        retry_after_ms: gate.retry_after_ms,
+      });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+}

package/src/host/daemon/api/organization.js

@@ -19,14 +19,14 @@ import {
   removeRole,
 } from "#core/stores/organization.js";
 
-export function register(app, { project }) {
-  app.get("/projects/:pid/organization", (req, res) => {
+export function register(api, { project }) {
+  api.get("/projects/:pid/organization", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     res.json(readOrganization(p.path));
   });
 
-  app.post("/projects/:pid/organization/areas", (req, res) => {
+  api.post("/projects/:pid/organization/areas", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     try {
@@ -36,7 +36,7 @@ export function register(app, { project }) {
     }
   });
 
-  app.patch("/projects/:pid/organization/areas/:slug", (req, res) => {
+  api.patch("/projects/:pid/organization/areas/:slug", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     try {
@@ -48,7 +48,7 @@ export function register(app, { project }) {
     }
   });
 
-  app.delete("/projects/:pid/organization/areas/:slug", (req, res) => {
+  api.delete("/projects/:pid/organization/areas/:slug", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     if (!removeArea(p.path, req.params.slug))
@@ -56,7 +56,7 @@ export function register(app, { project }) {
     res.json({ ok: true });
   });
 
-  app.post("/projects/:pid/organization/roles", (req, res) => {
+  api.post("/projects/:pid/organization/roles", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     try {
@@ -66,7 +66,7 @@ export function register(app, { project }) {
     }
   });
 
-  app.patch("/projects/:pid/organization/roles/:slug", (req, res) => {
+  api.patch("/projects/:pid/organization/roles/:slug", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     try {
@@ -78,7 +78,7 @@ export function register(app, { project }) {
     }
   });
 
-  app.delete("/projects/:pid/organization/roles/:slug", (req, res) => {
+  api.delete("/projects/:pid/organization/roles/:slug", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     if (!removeRole(p.path, req.params.slug))

package/src/host/daemon/api/pairing.js

@@ -64,7 +64,7 @@ function purgeExpired(now = Date.now()) {
   }
 }
 
-export function register(app, ctx) {
+export function register(api, ctx) {
   const { tokenStore, config } = ctx;
   if (!tokenStore) {
     // Pairing requires the multi-token store; if running with legacy
@@ -75,7 +75,7 @@ export function register(app, ctx) {
 
   // ── POST /pair/init ───────────────────────────────────────────────
   // Localhost-only. Returns { pairing_id, expires_at }. No body needed.
-  app.post("/pair/init", (req, res) => {
+  api.post("/pair/init", (req, res) => {
     if (!isLocalhost(req)) {
       return res.status(403).json({ error: "pair/init: localhost only" });
     }
@@ -107,7 +107,7 @@ export function register(app, ctx) {
   // ── POST /pair/confirm ────────────────────────────────────────────
   // App side. Body: { pairing_id, label?, fingerprint? }. Returns the
   // new client token. Nonce is one-shot.
-  app.post("/pair/confirm", (req, res) => {
+  api.post("/pair/confirm", (req, res) => {
     purgeExpired();
     const { pairing_id, label, fingerprint, kind } = req.body || {};
     if (!pairing_id || typeof pairing_id !== "string") {
@@ -149,7 +149,7 @@ export function register(app, ctx) {
   // ── GET /pair/status/:pairing_id ──────────────────────────────────
   // For the CLI to poll while showing the QR. Returns pending|confirmed
   // |expired. Never leaks the token.
-  app.get("/pair/status/:pairing_id", (req, res) => {
+  api.get("/pair/status/:pairing_id", (req, res) => {
     purgeExpired();
     const s = sessions.get(req.params.pairing_id);
     if (!s) return res.json({ status: "unknown" });
@@ -171,13 +171,13 @@ export function register(app, ctx) {
   // ── GET /pair/list ────────────────────────────────────────────────
   // Authenticated (auth middleware exempts /pair/*, so we re-check by
   // hand here — only the master or an existing client can list peers).
-  app.get("/pair/list", (req, res) => {
+  api.get("/pair/list", (req, res) => {
     if (!checkBearer(req, tokenStore)) return res.status(401).json({ error: "unauthorized" });
     res.json({ clients: tokenStore.list() });
   });
 
   // ── DELETE /pair/revoke/:id ───────────────────────────────────────
-  app.delete("/pair/revoke/:id", (req, res) => {
+  api.delete("/pair/revoke/:id", (req, res) => {
     if (!checkBearer(req, tokenStore)) return res.status(401).json({ error: "unauthorized" });
     const ok = tokenStore.revoke(req.params.id);
     if (!ok) return res.status(404).json({ error: "no such client" });

package/src/host/daemon/api/plugins.js

@@ -1,13 +1,13 @@
 // Daemon plugin status surface.
 //   GET /plugins              status of every loaded plugin
 //   GET /plugins/:id/status   single plugin
-export function register(app, { plugins }) {
-  app.get("/plugins", (_req, res) => {
+export function register(api, { plugins }) {
+  api.get("/plugins", (_req, res) => {
     if (!plugins) return res.json({});
     res.json(plugins.status());
   });
 
-  app.get("/plugins/:id/status", (req, res) => {
+  api.get("/plugins/:id/status", (req, res) => {
     if (!plugins) return res.status(404).end();
     const inst = plugins.get(req.params.id);
     if (!inst)

package/src/host/daemon/api/prefix.js

@@ -0,0 +1,20 @@
+// The single mount point for every daemon data route.
+//
+// Before this existed, routes lived at the root and three separate hand-written
+// prefix lists had to agree on which of them were "API" (the SPA fallback in
+// web.js, the auth allowlist in shared.js, and the vite dev proxy). They drifted.
+// Now the answer is structural: a path is an API path iff it starts with /api.
+//
+// Kept in its own module so both the daemon and the route modules can import it
+// without pulling in express or any route registration.
+export const API_PREFIX = "/api";
+
+/** True for /api and anything below it. */
+export function isApiPath(p) {
+  return p === API_PREFIX || p.startsWith(API_PREFIX + "/");
+}
+
+/** Prefix a root-relative route path with the API mount point. */
+export function apiPath(p) {
+  return `${API_PREFIX}${p.startsWith("/") ? p : `/${p}`}`;
+}

package/src/host/daemon/api/profiles.js

@@ -82,8 +82,8 @@ function detail(id, { preview = true } = {}) {
   };
 }
 
-export function register(app) {
-  app.get("/profiles", (_req, res) => {
+export function register(api) {
+  api.get("/profiles", (_req, res) => {
     try {
       const cfg = readConfig();
       res.json({
@@ -96,7 +96,7 @@ export function register(app) {
   });
 
   // Registered before /profiles/:id so "doctor" isn't swallowed as an id.
-  app.get("/profiles/doctor", (req, res) => {
+  api.get("/profiles/doctor", (req, res) => {
     try {
       res.json(profileDoctor(req.query?.id || null));
     } catch (e) {
@@ -104,7 +104,7 @@ export function register(app) {
     }
   });
 
-  app.get("/profiles/:id", (req, res) => {
+  api.get("/profiles/:id", (req, res) => {
     try {
       const out = detail(req.params.id, { preview: req.query?.preview !== "0" });
       if (!out) return res.status(404).json({ error: `profile "${req.params.id}" not found` });
@@ -114,7 +114,7 @@ export function register(app) {
     }
   });
 
-  app.post("/profiles/install", (req, res) => {
+  api.post("/profiles/install", (req, res) => {
     try {
       const { source, force } = req.body || {};
       if (!source) return res.status(400).json({ error: "body needs { source }" });
@@ -131,7 +131,7 @@ export function register(app) {
     }
   });
 
-  app.post("/profiles/use", (req, res) => {
+  api.post("/profiles/use", (req, res) => {
     try {
       const { id, force } = req.body || {};
       if (!id) return res.status(400).json({ error: "body needs { id }" });
@@ -148,7 +148,7 @@ export function register(app) {
     }
   });
 
-  app.post("/profiles/off", (_req, res) => {
+  api.post("/profiles/off", (_req, res) => {
     try {
       res.json({ ok: true, ...offProfile() });
     } catch (e) {
@@ -156,7 +156,7 @@ export function register(app) {
     }
   });
 
-  app.patch("/profiles/config", (req, res) => {
+  api.patch("/profiles/config", (req, res) => {
     try {
       const { values, id } = req.body || {};
       if (!values || typeof values !== "object") {
@@ -169,7 +169,7 @@ export function register(app) {
     }
   });
 
-  app.delete("/profiles/:id", (req, res) => {
+  api.delete("/profiles/:id", (req, res) => {
     try {
       res.json({ ok: true, ...uninstallProfile(req.params.id) });
     } catch (e) {

package/src/host/daemon/api/projects.js

@@ -3,10 +3,10 @@
 //   POST   /projects               register a project by path
 //   DELETE /projects/:id           unregister
 //   POST   /projects/:id/rebuild   force a context rebuild from disk
-export function register(app, { projects, registries, addProjectGlobally }) {
-  app.get("/projects", (_req, res) => res.json(projects.list()));
+export function register(api, { projects, registries, addProjectGlobally }) {
+  api.get("/projects", (_req, res) => res.json(projects.list()));
 
-  app.post("/projects", (req, res) => {
+  api.post("/projects", (req, res) => {
     const { path: p } = req.body || {};
     if (!p) return res.status(400).json({ error: "path required" });
     try {
@@ -19,12 +19,12 @@ export function register(app, { projects, registries, addProjectGlobally }) {
     }
   });
 
-  app.delete("/projects/:id", (req, res) => {
+  api.delete("/projects/:id", (req, res) => {
     const ok = projects.unregister(req.params.id);
     res.status(ok ? 204 : 404).end();
   });
 
-  app.post("/projects/:id/rebuild", (req, res) => {
+  api.post("/projects/:id/rebuild", (req, res) => {
     try {
       const result = projects.rebuild(req.params.id);
       res.json({ ok: true, ...result });