@agentprojectcontext/apx 1.77.3 → 1.79.0

package/src/host/daemon/api/routines.js

@@ -16,15 +16,16 @@ import {
   setEnabled as setRoutineEnabled,
   runRoutineNow,
 } from "#core/routines/index.js";
+import { CHANNELS } from "#core/constants/channels.js";
 
-export function register(app, { projects, registries, plugins, project, config }) {
-  app.get("/projects/:pid/routines", (req, res) => {
+export function register(api, { projects, registries, plugins, project, config }) {
+  api.get("/projects/:pid/routines", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     res.json(listRoutines(p.storagePath));
   });
 
-  app.get("/projects/:pid/routines/:name", (req, res) => {
+  api.get("/projects/:pid/routines/:name", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const r = getRoutine(p.storagePath, req.params.name);
@@ -32,41 +33,64 @@ export function register(app, { projects, registries, plugins, project, config }
     res.json(r);
   });
 
-  app.post("/projects/:pid/routines", (req, res) => {
+  api.post("/projects/:pid/routines", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     try {
       // Accepts every field including the pipeline extensions
       // (pre_commands, post_commands, skip_prompt_on).
+      const existed = !!getRoutine(p.storagePath, (req.body || {}).name);
       const r = upsertRoutine(p.storagePath, req.body || {});
+      // Say it happened, where it happened. A routine appearing in a list on a
+      // screen nobody has open is not the same as being told one now exists —
+      // and "what did that just create?" is the question people actually ask
+      // after asking for something to be set up.
+      p.logMessage?.({
+        channel: CHANNELS.ROUTINE,
+        direction: "out",
+        type: "system",
+        actor_id: "apx:routine",
+        author: "apx",
+        body: existed
+          ? `routine ${r.name} updated (${r.kind}, ${r.schedule})`
+          : `routine ${r.name} created (${r.kind}, ${r.schedule})`,
+        meta: {
+          event: existed ? "routine_updated" : "routine_created",
+          routine: r.name,
+          routine_id: r.id,
+          kind: r.kind,
+          schedule: r.schedule,
+          enabled: r.enabled !== false,
+        },
+      });
       res.status(201).json(r);
     } catch (e) {
       res.status(400).json({ error: e.message });
     }
   });
 
-  app.delete("/projects/:pid/routines/:name", (req, res) => {
+  api.delete("/projects/:pid/routines/:name", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const ok = deleteRoutine(p.storagePath, req.params.name);
     res.status(ok ? 204 : 404).end();
   });
 
-  app.post("/projects/:pid/routines/:name/enable", (req, res) => {
+  api.post("/projects/:pid/routines/:name/enable", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     setRoutineEnabled(p.storagePath, req.params.name, true);
     res.json({ ok: true });
   });
 
-  app.post("/projects/:pid/routines/:name/disable", (req, res) => {
+  api.post("/projects/:pid/routines/:name/disable", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     setRoutineEnabled(p.storagePath, req.params.name, false);
     res.json({ ok: true });
   });
 
-  app.post("/projects/:pid/routines/:name/run", async (req, res) => {
+  api.post("/projects/:pid/routines/:name/run", async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const r = getRoutine(p.storagePath, req.params.name);

package/src/host/daemon/api/run.js

@@ -4,8 +4,8 @@
 import path from "node:path";
 import { execFile } from "node:child_process";
 
-export function register(app, { projects }) {
-  app.post("/run", (req, res) => {
+export function register(api, { projects }) {
+  api.post("/run", (req, res) => {
     const {
       cmd,
       cwd: cwdOverride,

package/src/host/daemon/api/runtimes.js

@@ -12,7 +12,7 @@ import { apcProjectFile, apcAgentsDir } from "#core/apc/paths.js";
 import { readSessionFrontmatter } from "#core/stores/sessions.js";
 import { buildAgentSystem } from "#core/agent/build-agent-system.js";
 import { CHANNELS } from "#core/constants/channels.js";
-import { getRuntime, RUNTIME_IDS } from "../runtimes/index.js";
+import { getRuntime, RUNTIME_IDS } from "#core/runtimes/index.js";
 import { detectAll } from "#core/runtimes/detect.js";
 import { buildRuntimeBridgeHint as buildApfHint } from "#core/agent/runtime-bridge.js";
 import {
@@ -22,17 +22,17 @@ import {
 } from "#core/stores/runtime-sessions.js";
 import { runSuperAgent, isSuperAgentEnabled } from "#core/agent/super-agent.js";
 
-export function register(app, { projects, registries, plugins, project, config }) {
-  app.get("/runtimes", (_req, res) =>
+export function register(api, { projects, registries, plugins, project, config }) {
+  api.get("/runtimes", (_req, res) =>
     res.json({ runtimes: RUNTIME_IDS })
   );
 
-  app.get("/env/detect", async (_req, res) => {
+  api.get("/env/detect", async (_req, res) => {
     const detected = await detectAll();
     res.json(detected);
   });
 
-  app.post("/projects/:pid/agents/:slug/runtime", async (req, res) => {
+  api.post("/projects/:pid/agents/:slug/runtime", async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { runtime, prompt, timeoutMs } = req.body || {};
@@ -146,7 +146,7 @@ export function register(app, { projects, registries, plugins, project, config }
   });
 
   // ---- Session resume — reads APC session file + (optionally) external transcript ----
-  app.get("/projects/:pid/sessions/:id/resume", async (req, res) => {
+  api.get("/projects/:pid/sessions/:id/resume", async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { id } = req.params;

package/src/host/daemon/api/self-memory.js

@@ -0,0 +1,50 @@
+// The super-agent's own notebook — ~/.apx/memory.md.
+//
+//   GET /notebook   → { body, path, size, approx_tokens, entries, consolidated }
+//   PUT /notebook   { body }
+//
+// WHY THIS EXISTS. This file is the one memory that ships in EVERY prompt on
+// every channel, and until now it was the only one with no screen. The Memories
+// tab listed project memory and each agent's memory; the super-agent's own
+// notebook was reachable from the model (read_self_memory / remember) and from
+// the CLI, and nowhere a person could look. So "where is Roby's memory?" had no
+// answer in the product, which is a fair thing to be confused by.
+//
+// It reports its own size because that size is a tax paid on every turn — see
+// core/memory/consolidate.js.
+import { readSelfMemory, SELF_MEMORY_PATH } from "#core/agent/self-memory.js";
+import { notebookSize } from "#core/memory/consolidate.js";
+import fs from "node:fs";
+import path from "node:path";
+
+const MAX_BODY = 256 * 1024; // a notebook past this is a symptom, not a note
+
+export function register(api) {
+  api.get("/notebook", (_req, res) => {
+    try {
+      const body = readSelfMemory();
+      res.json({ body, path: SELF_MEMORY_PATH, ...notebookSize() });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  api.put("/notebook", (req, res) => {
+    const { body } = req.body || {};
+    if (typeof body !== "string") {
+      return res.status(400).json({ error: "body (string) required" });
+    }
+    if (body.length > MAX_BODY) {
+      return res.status(413).json({
+        error: `notebook too large (${body.length} > ${MAX_BODY} bytes) — it ships in every prompt`,
+      });
+    }
+    try {
+      fs.mkdirSync(path.dirname(SELF_MEMORY_PATH), { recursive: true });
+      fs.writeFileSync(SELF_MEMORY_PATH, body);
+      res.json({ ok: true, path: SELF_MEMORY_PATH, ...notebookSize() });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+}

package/src/host/daemon/api/sessions-search.js

@@ -2,23 +2,30 @@
 //   GET  /sessions/search?q=…&project=…&limit=20
 //   POST /sessions/:id/compact     resolves which project/agent owns the file
 //                                  then delegates to compactConversation.
-import path from "node:path";
 import { readAgents } from "#core/apc/parser.js";
 import { compactConversation } from "#core/stores/conversations-compactor.js";
 import { searchSessions, findSessionFile } from "#core/stores/sessions-search.js";
+import { asyncRoute } from "./shared.js";
+import { resolveProject } from "#core/apc/projects-helpers.js";
 
+// Plural on purpose: no ref means "search every project". This is a different
+// operation from core's resolveProject (which resolves exactly one and throws),
+// but the *matching* must agree with it — this used to accept only an id or an
+// exact path, so `?project=savia` matched nothing here while working on every
+// other route.
 function resolveProjects(projects, projectRef) {
-  const all = projects.list();
-  if (projectRef != null) {
-    const ref = String(projectRef);
-    const found = all.find((p) => String(p.id) === ref || p.path === path.resolve(ref));
-    return found ? [projects.get(found.id)] : [];
+  if (projectRef == null || projectRef === "") {
+    return projects.list().map((p) => projects.get(p.id)).filter(Boolean);
+  }
+  try {
+    return [resolveProject(projects, projectRef)];
+  } catch {
+    return []; // unknown or ambiguous ref → no results, not a 500
   }
-  return all.map((p) => projects.get(p.id)).filter(Boolean);
 }
 
-export function register(app, { projects, config }) {
-  app.get("/sessions/search", (req, res) => {
+export function register(api, { projects, config }) {
+  api.get("/sessions/search", (req, res) => {
     const { q, project: projectRef, limit = "20" } = req.query;
     if (!q) return res.status(400).json({ error: "q required" });
     const lim = Math.min(parseInt(limit, 10) || 20, 200);
@@ -27,7 +34,7 @@ export function register(app, { projects, config }) {
     res.json({ q, count: results.length, results });
   });
 
-  app.post("/sessions/:id/compact", async (req, res) => {
+  api.post("/sessions/:id/compact", asyncRoute(async (req, res) => {
     const { id } = req.params;
     const { model: modelOverride, project: projectRef } = req.body || {};
     const candidates = resolveProjects(projects, projectRef);
@@ -57,5 +64,5 @@ export function register(app, { projects, config }) {
     } catch (e) {
       res.status(500).json({ error: e.message });
     }
-  });
+  }));
 }

package/src/host/daemon/api/sessions.js

@@ -12,16 +12,16 @@ import {
   agentSessionsDir,
   createAgentSessionFile,
 } from "#core/stores/sessions.js";
-import { collectAllSessions, filterSessionsByQuery } from "#interfaces/cli/commands/sessions.js";
+import { collectAllSessions, filterSessionsByQuery } from "#core/sessions/index.js";
 import { pageEnvelope } from "./shared.js";
 
-export function register(app, { projects, project }) {
+export function register(api, { projects, project }) {
   // Cross-engine sessions (apx · claude · codex), newest first. Returns a
   // { meta, data } envelope (meta = pagination info, data = rows). Paginated
   // via ?limit & ?offset; with no limit, data is the full set as one page.
   // Optional ?q= filters via the same core as `apx session find` (title match,
   // + transcript content when ?deep=1) so terminal and web search are identical.
-  app.get("/sessions", (req, res) => {
+  api.get("/sessions", (req, res) => {
     const engineId = req.query.engine ? String(req.query.engine) : null;
     const q = req.query.q ? String(req.query.q) : "";
     const deep = req.query.deep === "1" || req.query.deep === "true";
@@ -49,7 +49,7 @@ export function register(app, { projects, project }) {
     res.json(pageEnvelope(rows, req.query));
   });
 
-  app.get("/projects/:pid/agents/:slug/sessions", (req, res) => {
+  api.get("/projects/:pid/agents/:slug/sessions", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const agents = readAgents(p.path);
@@ -78,7 +78,7 @@ export function register(app, { projects, project }) {
     res.json(sessions);
   });
 
-  app.post("/projects/:pid/agents/:slug/sessions", (req, res) => {
+  api.post("/projects/:pid/agents/:slug/sessions", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { title, body = "" } = req.body || {};
@@ -93,7 +93,7 @@ export function register(app, { projects, project }) {
   });
 
   // GET session by filename (sid may include or omit the .md extension)
-  app.get("/projects/:pid/sessions/:sid", (req, res) => {
+  api.get("/projects/:pid/sessions/:sid", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const sid = req.params.sid;

package/src/host/daemon/api/shared.js

@@ -2,7 +2,6 @@
 //
 // These were inlined in api.js (monolith). They are kept dependency-free so
 // any route module can `import` them without pulling in the world.
-import fs from "node:fs";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
 import { appendErrorTrace, previewText } from "#core/logging.js";
@@ -11,6 +10,7 @@ import { agentMemoryPath } from "#core/agent/memory.js";
 import { apcMemoryFile } from "#core/apc/paths.js";
 import { CHANNELS } from "#core/constants/channels.js";
 import { isKnownSpaRoute } from "./web.js";
+import { apiPath, isApiPath } from "./prefix.js";
 
 export const nowIso = () =>
   new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
@@ -20,6 +20,44 @@ export const nowIso = () =>
 // full set as a single page (data = 100% of rows) so non-paginated callers get
 // the same shape — meta just reports one page covering everything.
 //   meta: { total, offset, limit, pageSize, page, pageCount }
+/**
+ * Wrap an async route handler so a rejected promise becomes a 500 instead of
+ * an unhandled rejection.
+ *
+ * Express 4 does not await handlers: if one throws asynchronously, the error
+ * never reaches the error middleware, the request hangs, and on Node >= 15 the
+ * unhandled rejection takes the whole daemon down. Several routes awaited work
+ * with no try/catch, so a single failing preview or engine probe could kill a
+ * process serving the SPA, Telegram polling and voice at the same time.
+ *
+ *   api.get("/things", asyncRoute(async (req, res) => { ... }))
+ */
+export function asyncRoute(handler) {
+  return (req, res, next) => Promise.resolve(handler(req, res, next)).catch(next);
+}
+
+/**
+ * Terminal error middleware. Mounted after every route; turns anything that
+ * reached `next(err)` into a JSON `{ error }` with a real status code.
+ */
+export function errorMiddleware(log = () => {}) {
+  // eslint-disable-next-line no-unused-vars -- Express detects the 4-arg shape.
+  return (err, req, res, _next) => {
+    const status = Number(err?.status || err?.statusCode) || 500;
+    const message = err?.message || "internal error";
+    log(`error: ${req.method} ${req.originalUrl} → ${status}: ${err?.stack || message}`);
+    try {
+      appendErrorTrace({
+        where: `${req.method} ${req.originalUrl}`,
+        error: message,
+        trace_id: req.apxTraceId,
+      });
+    } catch { /* tracing must never mask the original error */ }
+    if (res.headersSent) return;
+    res.status(status).json({ error: message });
+  };
+}
+
 export function pageEnvelope(rows, query = {}) {
   const total = rows.length;
   const hasLimit = query.limit != null && query.limit !== "";
@@ -46,12 +84,19 @@ export function traceIdMiddleware(req, res, next) {
   next();
 }
 
-// Paths that bypass auth: /health for liveness probes, /pair/* so a fresh
-// client can bootstrap a token without already having one, and
-// /admin/web-token so the local same-origin admin panel can self-bootstrap.
-// /pair/init and /admin/web-token both enforce localhost-only checks of
+// Paths that bypass auth: /api/health for liveness probes, /api/pair/* so a
+// fresh client can bootstrap a token without already having one, and
+// /api/admin/web-token so the local same-origin admin panel can self-bootstrap.
+// /api/pair/init and /api/admin/web-token both enforce localhost-only checks of
 // their own — the auth middleware just gets out of their way.
-const UNAUTHENTICATED_PREFIXES = ["/health", "/pair/", "/admin/web-token"];
+//
+// These are full paths: the middleware runs at app level (before the /api
+// router), so req.path is the complete URL path.
+const UNAUTHENTICATED_PREFIXES = [
+  apiPath("/health"),
+  apiPath("/pair/"),
+  apiPath("/admin/web-token"),
+];
 
 // Does this path look like a static asset (has a file extension)? Vite emits
 // hashed, extension-bearing filenames (index-abc123.js, logo.svg, font.woff2),
@@ -62,18 +107,19 @@ function isStaticAssetPath(p) {
 }
 
 function isUnauthenticatedPath(p, method = "GET") {
-  if (p === "/health") return true;
-  if (p === "/admin/web-token") return true;
   for (const prefix of UNAUTHENTICATED_PREFIXES) {
     if (p === prefix.replace(/\/$/, "") || p.startsWith(prefix)) return true;
   }
+  // Everything else under /api needs a token, full stop. Checked BEFORE the
+  // SPA-bootstrap exemption below, which would otherwise let a data route pass
+  // simply because its last segment happens to carry a file extension —
+  // GET /api/projects/0/artifacts/report.html is a data route, not an asset.
+  if (isApiPath(p)) return false;
   // SPA bootstrap: the admin bundle loads before it holds a bearer, so a GET
   // for a static asset or a known client-router route is served without auth —
-  // the bundle then fetches /admin/web-token. Everything else, including every
-  // data GET (/skills, /plugins, /embeddings, …), REQUIRES a token. This is an
-  // allowlist by construction: a new data route can never silently become
-  // public just because someone forgot to register its prefix (the old
-  // denylist failure mode).
+  // the bundle then fetches /api/admin/web-token. Since every data route now
+  // lives under /api and returned false above, this exemption can only ever
+  // reach panel assets and client-router paths.
   if (method === "GET" && (isStaticAssetPath(p) || isKnownSpaRoute(p))) return true;
   return false;
 }

package/src/host/daemon/api/skills.js

@@ -113,8 +113,8 @@ function indexStatus() {
   };
 }
 
-export function register(app /*, ctx */) {
-  app.get("/skills", (req, res) => {
+export function register(api /*, ctx */) {
+  api.get("/skills", (req, res) => {
     const projectPath = typeof req.query?.project_path === "string" && req.query.project_path
       ? req.query.project_path
       : undefined;
@@ -149,7 +149,7 @@ export function register(app /*, ctx */) {
 
   // ---- Full detail (viewer) ----------------------------------------------
 
-  app.get("/skills/:slug/detail", (req, res) => {
+  api.get("/skills/:slug/detail", (req, res) => {
     try {
       const projectPath = typeof req.query?.project_path === "string" && req.query.project_path
         ? req.query.project_path
@@ -175,7 +175,7 @@ export function register(app /*, ctx */) {
 
   // ---- Enable / disable per scope ----------------------------------------
 
-  app.put("/skills/enabled", (req, res) => {
+  api.put("/skills/enabled", (req, res) => {
     try {
       const { slug, enabled, scope, project_path } = req.body || {};
       if (!slug || typeof slug !== "string") {
@@ -202,7 +202,7 @@ export function register(app /*, ctx */) {
   // ---- Create / import user skills ---------------------------------------
 
   // Online editor: write a SKILL.md from slug + description + body.
-  app.post("/skills", (req, res) => {
+  api.post("/skills", (req, res) => {
     try {
       const { slug, description, body, project_path } = req.body || {};
       if (!slug || typeof slug !== "string" || !SLUG_RE.test(slug)) {
@@ -220,7 +220,7 @@ export function register(app /*, ctx */) {
   });
 
   // Import from an uploaded .zip (sent as base64 in JSON — skills are tiny).
-  app.post("/skills/import/zip", (req, res) => {
+  api.post("/skills/import/zip", (req, res) => {
     let tmp;
     try {
       const { data, project_path } = req.body || {};
@@ -257,7 +257,7 @@ export function register(app /*, ctx */) {
 
   // Import by cloning a git repo. The repo root (or its single skill subdir)
   // must contain a SKILL.md.
-  app.post("/skills/import/repo", (req, res) => {
+  api.post("/skills/import/repo", (req, res) => {
     let tmp;
     try {
       const { url, project_path } = req.body || {};
@@ -293,7 +293,7 @@ export function register(app /*, ctx */) {
     }
   });
 
-  app.delete("/skills/:slug", (req, res) => {
+  api.delete("/skills/:slug", (req, res) => {
     try {
       const slug = req.params.slug;
       if (!slug || !SLUG_RE.test(slug)) {
@@ -344,7 +344,7 @@ export function register(app /*, ctx */) {
 
   // ---- Inspector config + status -----------------------------------------
 
-  app.get("/skills/inspector", (_req, res) => {
+  api.get("/skills/inspector", (_req, res) => {
     try {
       const cfg = readConfig();
       res.json({
@@ -358,7 +358,7 @@ export function register(app /*, ctx */) {
     }
   });
 
-  app.put("/skills/inspector", (req, res) => {
+  api.put("/skills/inspector", (req, res) => {
     try {
       const patch = req.body || {};
       const cfg = readConfig();
@@ -388,7 +388,7 @@ export function register(app /*, ctx */) {
 
   // ---- Index build --------------------------------------------------------
 
-  app.post("/skills/index", async (req, res) => {
+  api.post("/skills/index", async (req, res) => {
     try {
       const { project_path, force } = req.body || {};
       const cfg = readConfig();
@@ -423,7 +423,7 @@ export function register(app /*, ctx */) {
 
   // ---- Dry-run ------------------------------------------------------------
 
-  app.post("/skills/inspect", async (req, res) => {
+  api.post("/skills/inspect", async (req, res) => {
     try {
       const { prompt, project_path } = req.body || {};
       if (!prompt || typeof prompt !== "string") {

package/src/host/daemon/api/super-agent.js

@@ -91,8 +91,8 @@ function wrapOnEventForLog(send, { trace_id, channel }) {
   };
 }
 
-export function register(app, { projects, registries, plugins, project, config }) {
-  app.post("/projects/:pid/super-agent/chat/stream", async (req, res) => {
+export function register(api, { projects, registries, plugins, project, config }) {
+  api.post("/projects/:pid/super-agent/chat/stream", async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     // Optional coding-surface knobs: the terminal Code TUI (apx code, Build
@@ -223,7 +223,7 @@ export function register(app, { projects, registries, plugins, project, config }
   // <id>` when the session lives outside any registered APX project (e.g. a
   // raw Claude/Codex session). Returns { text } so callers can format the
   // summary however they want.
-  app.post("/super-agent/summarize", async (req, res) => {
+  api.post("/super-agent/summarize", async (req, res) => {
     const { prompt, context_note: contextNote = "", model, max_tokens } = req.body || {};
     if (!prompt) return res.status(400).json({ error: "prompt required" });
     try {
@@ -254,7 +254,7 @@ export function register(app, { projects, registries, plugins, project, config }
     }
   });
 
-  app.post("/projects/:pid/super-agent/chat", async (req, res) => {
+  api.post("/projects/:pid/super-agent/chat", async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { prompt, previousMessages, model, maxIters, maxTokens, completionContract } =

package/src/host/daemon/api/tasks.js

@@ -24,11 +24,11 @@ import {
 } from "#core/stores/tasks.js";
 import { pageEnvelope } from "./shared.js";
 
-export function register(app, { project, projects }) {
+export function register(api, { project, projects }) {
   // Global tasks across every project, newest first. Returns a { meta, data }
   // envelope. Paginated via ?limit & ?offset; with no limit, data is the full
   // set as one page.
-  app.get("/tasks", (req, res) => {
+  api.get("/tasks", (req, res) => {
     const { state, tag, agent, due_before, due_after, status, updated_since } = req.query;
 
     // Resolve the registered projects to what core needs, dropping any the
@@ -63,7 +63,7 @@ export function register(app, { project, projects }) {
 
   // Per-project tasks. Returns a { meta, data } envelope; with no ?limit the
   // data array is the full filtered set (one page).
-  app.get("/projects/:pid/tasks", (req, res) => {
+  api.get("/projects/:pid/tasks", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { state, tag, agent, due_before, due_after, status, updated_since } = req.query;
@@ -79,7 +79,7 @@ export function register(app, { project, projects }) {
     res.json(pageEnvelope(all, req.query));
   });
 
-  app.post("/projects/:pid/tasks", (req, res) => {
+  api.post("/projects/:pid/tasks", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     try {
@@ -90,7 +90,7 @@ export function register(app, { project, projects }) {
     }
   });
 
-  app.get("/projects/:pid/tasks/:id", (req, res) => {
+  api.get("/projects/:pid/tasks/:id", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const task = getTask(p.storagePath, req.params.id);
@@ -98,7 +98,7 @@ export function register(app, { project, projects }) {
     res.json(task);
   });
 
-  app.patch("/projects/:pid/tasks/:id", (req, res) => {
+  api.patch("/projects/:pid/tasks/:id", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { patch } = req.body || {};
@@ -110,7 +110,7 @@ export function register(app, { project, projects }) {
     res.json(updated);
   });
 
-  app.post("/projects/:pid/tasks/:id/done", (req, res) => {
+  api.post("/projects/:pid/tasks/:id/done", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { by = null } = req.body || {};
@@ -119,7 +119,7 @@ export function register(app, { project, projects }) {
     res.json(updated);
   });
 
-  app.post("/projects/:pid/tasks/:id/drop", (req, res) => {
+  api.post("/projects/:pid/tasks/:id/drop", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { by = null } = req.body || {};
@@ -128,7 +128,7 @@ export function register(app, { project, projects }) {
     res.json(updated);
   });
 
-  app.post("/projects/:pid/tasks/:id/reopen", (req, res) => {
+  api.post("/projects/:pid/tasks/:id/reopen", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const updated = reopenTask(p.storagePath, req.params.id);
@@ -137,7 +137,7 @@ export function register(app, { project, projects }) {
   });
 
   // Move an open task through its workflow (pending → running → in_review …).
-  app.post("/projects/:pid/tasks/:id/status", (req, res) => {
+  api.post("/projects/:pid/tasks/:id/status", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { status } = req.body || {};
@@ -149,7 +149,7 @@ export function register(app, { project, projects }) {
   });
 
   // Lightweight summary endpoint for status displays.
-  app.get("/projects/:pid/tasks-summary", (req, res) => {
+  api.get("/projects/:pid/tasks-summary", (req, res) => {
     const p = project(req, res);
     if (!p) return;
     res.json(countTasks(p.storagePath));