@agentprojectcontext/apx 1.80.2 → 1.89.1

package/src/host/daemon/api/artifact-preview.js

@@ -11,10 +11,11 @@
 // for the daemon's lifetime.
 import { previews } from "#core/artifacts/preview.js";
 import { tunnels, detectProviders } from "#core/artifacts/tunnel.js";
+import { asyncRoute } from "./shared.js";
 
 export function register(api, { project }) {
   // Start (or reuse) an ephemeral preview server for an artifact.
-  api.post("/projects/:pid/artifacts/:name/preview", async (req, res) => {
+  api.post("/projects/:pid/artifacts/:name/preview", asyncRoute(async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const name = decodeURIComponent(req.params.name);
@@ -30,7 +31,7 @@ export function register(api, { project }) {
     } catch (e) {
       res.status(400).json({ error: e.message });
     }
-  });
+  }));
 
   // List preview servers scoped to a project.
   api.get("/projects/:pid/previews", (req, res) => {
@@ -50,15 +51,15 @@ export function register(api, { project }) {
   });
 
   // Stop a preview server (also closes its tunnel).
-  api.delete("/previews/:id", async (req, res) => {
+  api.delete("/previews/:id", asyncRoute(async (req, res) => {
     const rec = previews.get(req.params.id);
     if (rec?.tunnel) tunnels.close(rec.tunnel.id);
     const ok = await previews.stop(req.params.id);
     res.status(ok ? 204 : 404).end();
-  });
+  }));
 
   // Open a public tunnel to a preview's local port.
-  api.post("/previews/:id/tunnel", async (req, res) => {
+  api.post("/previews/:id/tunnel", asyncRoute(async (req, res) => {
     const rec = previews.get(req.params.id);
     if (!rec) return res.status(404).json({ error: "preview not found" });
     if (rec.tunnel) return res.json(rec.tunnel); // already shared
@@ -69,7 +70,7 @@ export function register(api, { project }) {
     } catch (e) {
       res.status(502).json({ error: e.message });
     }
-  });
+  }));
 
   // Close a preview's tunnel but keep the local server running.
   api.delete("/previews/:id/tunnel", (req, res) => {

package/src/host/daemon/api/artifacts.js

@@ -7,6 +7,7 @@
 import fs from "node:fs";
 import { spawn } from "node:child_process";
 import path from "node:path";
+import { asyncRoute } from "./shared.js";
 import {
   artifactPath,
   createArtifact,
@@ -158,7 +159,7 @@ export function register(api, { project }) {
   // its own local spawn (stdio inherited) so it can run interactively. Output
   // is captured up to MAX_CAPTURE_BYTES and the call is bounded by
   // RUN_TIMEOUT_MS — anything longer should go through the terminal.
-  api.post("/projects/:pid/artifacts/:name/run", async (req, res) => {
+  api.post("/projects/:pid/artifacts/:name/run", asyncRoute(async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const name = decodeURIComponent(req.params.name);
@@ -190,5 +191,5 @@ export function register(api, { project }) {
       args,
     });
     res.json(result);
-  });
+  }));
 }

package/src/host/daemon/api/code.js

@@ -1,24 +1,32 @@
 // Code module API — persistent OpenCode-style coding sessions per project.
 //
+//   GET    /code/sessions                               every project's, tagged with pid
 //   GET    /projects/:pid/code/sessions
 //   POST   /projects/:pid/code/sessions                 { title?, model?, mode? }
 //   GET    /projects/:pid/code/sessions/:sid
 //   PATCH  /projects/:pid/code/sessions/:sid            { title?, model?, mode? }
 //   DELETE /projects/:pid/code/sessions/:sid
-//   POST   /projects/:pid/code/sessions/:sid/chat/stream   { prompt }   NDJSON
+//   POST   /projects/:pid/code/sessions/:sid/chat/stream                    NDJSON
+//                        { prompt, channel?, cwd?, confirm? }
 //   GET    /projects/:pid/code/sessions/:sid/changes
 //
 // Unlike the stateless super-agent endpoint, these sessions are server-side
 // stateful: the turn handler rebuilds `previousMessages` from the stored
-// transcript, runs the super-agent on the `code` channel (with plan/build mode
+// transcript, runs the super-agent on a code channel (with plan/build mode
 // + per-mode tool gating), then persists the rich assistant turn.
+//
+// Both code surfaces come through here: the web panel (`web_code`) and
+// `apx exec --code` (`code`). That is the point — a session is where a coding
+// turn is READABLE afterwards, so a turn that skips it is a turn nobody can
+// find. See resolveCodeChannel().
 import { runSuperAgent } from "#core/agent/super-agent.js";
-import { appendSuperAgentErrorTrace } from "./shared.js";
+import { appendSuperAgentErrorTrace, asyncRoute } from "./shared.js";
 import { createWebConfirmAdapter } from "#core/confirmation/adapters/web.js";
 import { CHANNELS } from "#core/constants/channels.js";
 import { CODE_MODES, DEFAULT_CODE_MODE } from "#core/constants/code-modes.js";
 import {
   listCodeSessions,
+  listCodeSessionsAcross,
   getCodeSession,
   createCodeSession,
   updateCodeSession,
@@ -43,6 +51,18 @@ function modeGuidanceFor(mode) {
   return codeModeGuidance(mode);
 }
 
+// A code session is the persistent thing; `code` and `web_code` are the two
+// SURFACES that drive one. The web panel is the default; `apx exec --code`
+// passes `channel: "code"` so the turn is prompted as the terminal surface it
+// actually came from (and gets the caller's cwd) while still landing in a
+// session the panel can open. Anything else falls back to the web channel —
+// a client must not be able to name an arbitrary channel here.
+const CODE_CHANNELS = new Set([CHANNELS.CODE, CHANNELS.WEB_CODE]);
+function resolveCodeChannel(raw) {
+  const channel = String(raw || "").toLowerCase();
+  return CODE_CHANNELS.has(channel) ? channel : CHANNELS.WEB_CODE;
+}
+
 // History flattening + stream-event accumulator now live in core/ — see
 // codeSessionHistory() (transcript → engine messages) and makeTurnAccumulator()
 // (stream events → persistable ChatParts) imported above.
@@ -50,6 +70,23 @@ function modeGuidanceFor(mode) {
 export function register(api, { projects, project, config, registries, plugins }) {
   const findProject = (req, res) => project(req, res);
 
+  // ---- List across every project ------------------------------------------
+  // A code session is addressed by (project, id), so a client that only knows
+  // the project it is currently looking at cannot find a session started
+  // anywhere else — from the panel a turn run from another cwd simply looked
+  // lost. This is the unfiltered list; the per-project route below is the
+  // filter, not the default.
+  api.get("/code/sessions", (req, res) => {
+    const entries = projects
+      .list()
+      .map((row) => ({
+        id: row.id,
+        name: row.name,
+        storagePath: projects.get(row.id)?.storagePath || null,
+      }));
+    res.json({ sessions: listCodeSessionsAcross(entries) });
+  });
+
   // ---- List ----------------------------------------------------------------
   api.get("/projects/:pid/code/sessions", (req, res) => {
     const p = findProject(req, res);
@@ -130,13 +167,14 @@ export function register(api, { projects, project, config, registries, plugins }
   });
 
   // ---- Streaming turn ------------------------------------------------------
-  api.post("/projects/:pid/code/sessions/:sid/chat/stream", async (req, res) => {
+  api.post("/projects/:pid/code/sessions/:sid/chat/stream", asyncRoute(async (req, res) => {
     const p = findProject(req, res);
     if (!p) return;
     const session = getCodeSession(p.storagePath, req.params.sid);
     if (!session) return res.status(404).json({ error: "session not found" });
-    const { prompt } = req.body || {};
+    const { prompt, cwd } = req.body || {};
     if (!prompt) return res.status(400).json({ error: "prompt required" });
+    const channel = resolveCodeChannel(req.body?.channel);
 
     const mode = session.mode === CODE_MODES.PLAN ? CODE_MODES.PLAN : DEFAULT_CODE_MODE;
     const previousMessages = codeSessionHistory(session);
@@ -176,11 +214,14 @@ export function register(api, { projects, project, config, registries, plugins }
         plugins,
         registries,
         prompt,
-        channel: CHANNELS.WEB_CODE,
+        channel,
         channelMeta: {
           projectId: String(p.id),
           projectName: p.name,
           projectPath: p.path,
+          // `code.md` renders {{cwd}}; a missing var renders empty, so the web
+          // surface is unaffected by carrying the key.
+          cwd: typeof cwd === "string" && cwd ? cwd : p.path,
           mode,
           modeGuidance: modeGuidanceFor(mode),
           agentSlug: session.agentSlug || null,
@@ -201,7 +242,12 @@ export function register(api, { projects, project, config, registries, plugins }
         // it keeps the normal "text ends the turn" behavior.
         completionContract: mode === CODE_MODES.BUILD,
         onEvent,
-        requestConfirmation: createWebConfirmAdapter({ onEvent }),
+        // The confirmation round-trip needs a client that can answer it (the
+        // panel POSTs to /super-agent/confirm/:id). `apx exec --code` streams
+        // only to draw a spinner, so it sends `confirm: false` and falls back
+        // to the permission policy — same opt-out the super-agent route has.
+        requestConfirmation:
+          req.body?.confirm === false ? undefined : createWebConfirmAdapter({ onEvent }),
       });
       projects.rebuild(p.id);
 
@@ -242,7 +288,7 @@ export function register(api, { projects, project, config, registries, plugins }
       });
       appendSuperAgentErrorTrace(req, e, {
         prompt,
-        channel: CHANNELS.WEB_CODE,
+        channel,
         previousMessages,
         model: session.model,
         stream: true,
@@ -254,5 +300,5 @@ export function register(api, { projects, project, config, registries, plugins }
       });
       res.end();
     }
-  });
+  }));
 }

package/src/host/daemon/api/commitments.js

@@ -12,6 +12,7 @@
 //   PATCH  /projects/:pid/commitments/:id            { patch: {...} }
 //   POST   /projects/:pid/commitments/:id/kept       { note? }
 //   POST   /projects/:pid/commitments/:id/missed     { note? }
+//   POST   /projects/:pid/commitments/:id/drop       { note? }   filed by mistake
 //   POST   /projects/:pid/commitments/:id/renegotiate { due, note? }
 //   GET    /projects/:pid/commitments-summary
 import {
@@ -22,6 +23,7 @@ import {
   patchCommitment,
   keepCommitment,
   missCommitment,
+  dropCommitment,
   renegotiateCommitment,
   countCommitments,
 } from "#core/stores/commitments.js";
@@ -113,6 +115,15 @@ export function register(api, { project, projects }) {
     res.json(updated);
   });
 
+  // Filed by mistake. Separate from `missed` on purpose: see core/stores.
+  api.post("/projects/:pid/commitments/:id/drop", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const updated = dropCommitment(p.storagePath, req.params.id, req.body?.note || null);
+    if (!updated) return res.status(404).json({ error: "commitment not found" });
+    res.json(updated);
+  });
+
   api.post("/projects/:pid/commitments/:id/renegotiate", (req, res) => {
     const p = project(req, res);
     if (!p) return;

package/src/host/daemon/api/confirm.js

@@ -9,9 +9,10 @@
 // or to return a cancelled error.
 
 import { getConfirmationStore } from "#core/confirmation/pending-store.js";
+import { asyncRoute } from "./shared.js";
 
 export function register(api) {
-  api.post("/super-agent/confirm/:correlationId", async (req, res) => {
+  api.post("/super-agent/confirm/:correlationId", asyncRoute(async (req, res) => {
     const { correlationId } = req.params;
     const { confirmed } = req.body;
 
@@ -26,5 +27,5 @@ export function register(api) {
     }
 
     return res.json({ ok: true, confirmed });
-  });
+  }));
 }