@agentprojectcontext/apx 1.80.2 → 1.89.1

package/src/host/daemon/api/groups.js

@@ -0,0 +1,215 @@
+// Group chat = owner + N project agents in one room. A group is a THREAD on the
+// message ledger (channel "group"), so it lists and opens through the same
+// endpoints as a2a threads: `GET /super-agent/threads` (list, in conversations.js)
+// and `GET /super-agent/threads/group/:id` (detail). This router owns only what
+// those don't: creating a room, adding a participant, and running the owner's
+// turn as a streamed mention-cascade.
+//
+//   POST /projects/:pid/groups                     create { title, participants } → { id }
+//   POST /projects/:pid/groups/:gid/participants   add an agent { slug }
+//   POST /projects/:pid/groups/:gid/message/stream owner speaks → NDJSON cascade
+//
+// The cascade registers in active-turns like every other turn, keyed as the
+// thread it is (project + channel "group" + room id), so `POST
+// /projects/:pid/turns/abort { channel: "group", thread_id }` can stop it. It
+// had no such record, which meant the one turn shape that can run ten agent
+// replies off a single line was the one nobody could interrupt.
+import { readAgents } from "#core/apc/parser.js";
+import {
+  createGroupThread, addGroupParticipant, removeGroupParticipant, readProjectGroupThread, truncateGroupThread,
+  lastGroupOwnerMedia, GROUP_CHANNEL,
+} from "#core/stores/messages.js";
+import { runGroupTurn } from "#core/agent/group/run-group-turn.js";
+import { readTurnAttachments } from "./media.js";
+import { startActiveTurn, endActiveTurn, threadTurnKey } from "../active-turns.js";
+import { wasAborted } from "./turn-abort.js";
+import { asyncRoute } from "./shared.js";
+
+const KEEPALIVE_MS = 15000;
+
+// Best-effort owner display name for the transcript: the Telegram roster entry
+// tagged role "owner", else a neutral fallback.
+function ownerName(config) {
+  const owner = (config?.telegram?.contacts || []).find((c) => c.role === "owner");
+  return owner?.name || "Owner";
+}
+
+export function register(api, { projects, project, config, plugins, registries }) {
+  api.post("/projects/:pid/groups", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const { title, participants, members } = req.body || {};
+
+    // Cross-project rooms (inbox / mobile): `members: [{ project_id, slug }]`.
+    // Same-project rooms keep the old `participants: string[]` shape.
+    let slugs = [];
+    let homes = null;
+    if (Array.isArray(members) && members.length) {
+      const seen = new Set();
+      homes = {};
+      for (const m of members) {
+        const slug = typeof m?.slug === "string" ? m.slug.trim() : "";
+        if (!slug || seen.has(slug)) continue;
+        const homeId = m.project_id ?? p.id;
+        let home;
+        try { home = projects.get(homeId); } catch { home = null; }
+        if (!home?.path) continue;
+        if (!readAgents(home.path).some((a) => a.slug === slug)) continue;
+        seen.add(slug);
+        slugs.push(slug);
+        homes[slug] = home.id;
+      }
+      // All members live on the host project → no homes map needed.
+      if (slugs.length && Object.values(homes).every((id) => String(id) === String(p.id))) {
+        homes = null;
+      }
+    } else {
+      const known = new Set(readAgents(p.path).map((a) => a.slug));
+      slugs = (Array.isArray(participants) ? participants : []).filter((s) => known.has(s));
+    }
+
+    if (slugs.length < 1) return res.status(400).json({ error: "at least one existing agent required" });
+    try {
+      const id = createGroupThread(p.logMessage, { title: title || null, participants: slugs, homes });
+      try { projects.rebuild(p.id); } catch { /* best-effort */ }
+      res.status(201).json({
+        id, channel: "group", title: title || slugs.join(" · "), participants: slugs,
+        ...(homes ? { homes } : {}),
+      });
+    } catch (e) {
+      res.status(400).json({ error: e.message });
+    }
+  });
+
+  api.post("/projects/:pid/groups/:gid/participants", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const { slug } = req.body || {};
+    if (!readAgents(p.path).some((a) => a.slug === slug))
+      return res.status(404).json({ error: "agent not found" });
+    const thread = readProjectGroupThread(p.storagePath, req.params.gid);
+    if (!thread) return res.status(404).json({ error: "group not found" });
+    if (!thread.participants.includes(slug)) {
+      addGroupParticipant(p.logMessage, req.params.gid, [...thread.participants, slug], slug);
+      try { projects.rebuild(p.id); } catch { /* best-effort */ }
+    }
+    res.json({ id: req.params.gid, participants: [...new Set([...thread.participants, slug])] });
+  });
+
+  // Remove an agent from a room. Records a "… salió del chat" notice and drops
+  // them from the roster, so the cascade no longer seeds or lists them.
+  api.delete("/projects/:pid/groups/:gid/participants/:slug", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const thread = readProjectGroupThread(p.storagePath, req.params.gid);
+    if (!thread) return res.status(404).json({ error: "group not found" });
+    const next = thread.participants.filter((s) => s !== req.params.slug);
+    if (next.length !== thread.participants.length) {
+      removeGroupParticipant(p.logMessage, req.params.gid, req.params.slug, next);
+      try { projects.rebuild(p.id); } catch { /* best-effort */ }
+    }
+    res.json({ id: req.params.gid, participants: next });
+  });
+
+  // Rewind a group so a regenerate/edit can overwrite everything after a point.
+  // `keep_visible` = how many pane bubbles to keep (tools + consecutive same
+  // speaker collapse like the web transcript).
+  api.post("/projects/:pid/groups/:gid/truncate", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const keepVisible = Number(req.body?.keep_visible);
+    if (!Number.isInteger(keepVisible) || keepVisible < 0)
+      return res.status(400).json({ error: "keep_visible must be a non-negative integer" });
+    if (!readProjectGroupThread(p.storagePath, req.params.gid))
+      return res.status(404).json({ error: "group not found" });
+    const out = truncateGroupThread(p.storagePath, req.params.gid, keepVisible);
+    try { projects.rebuild(p.id); } catch { /* best-effort */ }
+    res.json({ ok: true, ...out });
+  });
+
+  // The owner speaks; the room answers as an NDJSON cascade of speaker events.
+  // `rerun: true` re-runs against the existing last owner message (regenerate).
+  // Optional `from` resumes the cascade at that speaker so earlier replies
+  // this turn stay put; without it the whole room-answer is re-run.
+  api.post("/projects/:pid/groups/:gid/message/stream", asyncRoute(async (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const { prompt, rerun, attachments, from, reason } = req.body || {};
+    if (!readProjectGroupThread(p.storagePath, req.params.gid)) return res.status(404).json({ error: "group not found" });
+    // Files the composer uploaded to ~/.apx/media: images ride on each speaker's
+    // turn (vision), and a marker naming each file is folded into the prompt so a
+    // photo with no caption is still a turn and a non-vision agent is told a file
+    // arrived and where it lives. Same handling as the 1:1 chat.
+    //
+    // On a REGENERATE (rerun), the owner already sent the turn — re-read the
+    // photo it carried from the ledger and re-attach it, or the re-run agents
+    // lose sight of the image the original turn answered.
+    const rerunAttach = rerun
+      ? (() => { const md = lastGroupOwnerMedia(p.storagePath, req.params.gid); return md ? [md] : []; })()
+      : attachments;
+    const turnFiles = readTurnAttachments(rerunAttach);
+    const turnPrompt = rerun ? "" : [...turnFiles.markers, prompt].filter(Boolean).join(" ");
+    if (!rerun && !turnPrompt.trim()) return res.status(400).json({ error: "prompt required" });
+
+    res.setHeader("content-type", "application/x-ndjson; charset=utf-8");
+    res.setHeader("cache-control", "no-cache, no-transform");
+    res.setHeader("x-accel-buffering", "no");
+    res.flushHeaders?.();
+
+    let lastWriteAt = Date.now();
+    const send = (event) => { lastWriteAt = Date.now(); res.write(JSON.stringify(event) + "\n"); };
+    const keepalive = setInterval(() => {
+      if (Date.now() - lastWriteAt < KEEPALIVE_MS) return;
+      lastWriteAt = Date.now();
+      try { res.write("\n"); } catch { /* socket gone */ }
+    }, KEEPALIVE_MS);
+    keepalive.unref?.();
+    res.on("close", () => clearInterval(keepalive));
+
+    // The room's kill switch. A cascade is the longest-running turn shape the
+    // daemon has — one owner line can fan out into MAX_TURNS_PER_MESSAGE full
+    // tool loops — and until this record existed the Stop button could only
+    // close the browser's socket while the room kept working and kept writing.
+    // Closing the socket deliberately does not stop the run (that is what lets
+    // another tab catch up), so stopping is asked for out loud, through
+    // POST /projects/:pid/turns/abort, which reaches `abort` here.
+    const turnAbort = new AbortController();
+    const active = startActiveTurn(threadTurnKey(p.id, GROUP_CHANNEL, req.params.gid), {
+      project_id: p.id,
+      channel: GROUP_CHANNEL,
+      thread_id: req.params.gid,
+      abort: () => turnAbort.abort(),
+    });
+    send({ type: "start", turn_id: active.id, channel: GROUP_CHANNEL, thread_id: req.params.gid });
+
+    try {
+      await runGroupTurn({
+        p, gid: req.params.gid, text: turnPrompt, rerun: !!rerun,
+        from: typeof from === "string" && from.trim() ? from.trim() : null,
+        reason: typeof reason === "string" && reason.trim() ? reason.trim() : null,
+        attachments: turnFiles.attachments, media: turnFiles.media,
+        ownerName: ownerName(config), config, projects, plugins, registries,
+        signal: turnAbort.signal,
+        onEvent: send,
+      });
+      try { projects.rebuild(p.id); } catch { /* best-effort */ }
+      // Stopped, not broken. runGroupTurn persists the interrupted speaker's
+      // partial and returns normally, so the room is consistent either way; the
+      // client only needs to know which of the two happened. `aborted` rather
+      // than `error` for the same reason the 1:1 stream draws the line there —
+      // a client that paints errors red must not accuse the daemon of breaking
+      // every time the owner presses Stop.
+      const stopped = turnAbort.signal.aborted;
+      send(stopped ? { type: "aborted" } : { type: "final" });
+      clearInterval(keepalive);
+      res.end();
+    } catch (e) {
+      try { projects.rebuild(p.id); } catch { /* best-effort */ }
+      send(wasAborted(e, turnAbort) ? { type: "aborted" } : { type: "error", error: e.message });
+      clearInterval(keepalive);
+      res.end();
+    } finally {
+      endActiveTurn(active.id);
+    }
+  }));
+}

package/src/host/daemon/api/images.js

@@ -0,0 +1,107 @@
+// Daemon HTTP routes for image generation.
+//
+//   POST /images/generate    { prompt, provider?, width?, height?, size?,
+//                              steps?, cfg_scale?, seed?, sampler?, scheduler?,
+//                              count?, format?, negative_prompt?, model?,
+//                              init_image?, denoising_strength?,
+//                              control_image?, control_strength? }
+//                            init_image / control_image are base64 (bare or a
+//                            data: URL). They are two different operations —
+//                            repaint this canvas vs. keep this structure — and
+//                            no engine accepts both. Bodies are capped at 2 MB
+//                            by the express json parser. The echoed `request`
+//                            has the payloads replaced by a size marker.
+//                            → { images: [{path, url, bytes, mime, seed}],
+//                                provider, model, request, ignored, elapsed_ms }
+//
+//   GET  /images/providers   → { configured_provider, mode, order, defaults,
+//                                engines: [{id, available, configured, …}] }
+//
+//   GET  /images/capabilities?provider=<id>
+//                            → { provider, capabilities: {models, samplers, …} }
+//
+//   GET  /images/file?path=<abs>
+//                            → the bytes, sandboxed to ~/.apx/images
+//
+// Glue only: every decision (engine routing, defaults, where files land) lives
+// in core/images/. `url` is added here because it is a transport concern —
+// core has no idea an HTTP client will need a way to fetch the file back.
+import fs from "node:fs/promises";
+import path from "node:path";
+import { IMAGES_DIR } from "#core/config/paths.js";
+import { readConfig } from "#core/config/index.js";
+import { generate, listProviders, capabilities } from "#core/images/generate.js";
+import { apiPath } from "./prefix.js";
+import { asyncRoute } from "./shared.js";
+
+/** Where a client can fetch this file from. Absolute paths stay server-side. */
+function fileUrl(absPath) {
+  return `${apiPath("/images/file")}?path=${encodeURIComponent(absPath)}`;
+}
+
+export function register(api) {
+  api.post("/images/generate", asyncRoute(async (req, res) => {
+    const body = req.body || {};
+    if (typeof body.prompt !== "string" || !body.prompt.trim()) {
+      return res.status(400).json({ error: "prompt required" });
+    }
+    try {
+      const result = await generate({ ...body, globalConfig: readConfig() });
+      res.json({
+        ...result,
+        images: result.images.map((img) => ({ ...img, url: fileUrl(img.path) })),
+      });
+    } catch (e) {
+      res.status(502).json({ error: e.message });
+    }
+  }));
+
+  api.get("/images/providers", asyncRoute(async (_req, res) => {
+    try {
+      res.json(await listProviders(readConfig()));
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  }));
+
+  api.get("/images/capabilities", asyncRoute(async (req, res) => {
+    try {
+      res.json(await capabilities({
+        provider: req.query.provider ? String(req.query.provider) : undefined,
+        globalConfig: readConfig(),
+      }));
+    } catch (e) {
+      res.status(400).json({ error: e.message });
+    }
+  }));
+
+  // Sandboxed to the gallery: a path that escapes it is refused, so a leaked
+  // absolute path in a reply can never be turned into an arbitrary file read.
+  api.get("/images/file", asyncRoute(async (req, res) => {
+    const rawPath = String(req.query.path || "");
+    if (!rawPath) return res.status(400).json({ error: "path required" });
+    const root = path.resolve(IMAGES_DIR);
+    const resolved = path.resolve(rawPath);
+    if (resolved !== root && !resolved.startsWith(root + path.sep)) {
+      return res.status(403).json({ error: "path outside images dir" });
+    }
+    let bytes;
+    try {
+      bytes = await fs.readFile(resolved);
+    } catch {
+      return res.status(404).json({ error: "not found" });
+    }
+    const ext = path.extname(resolved).toLowerCase();
+    const mime =
+      ext === ".png" ? "image/png" :
+      ext === ".jpg" || ext === ".jpeg" ? "image/jpeg" :
+      ext === ".webp" ? "image/webp" :
+      ext === ".gif" ? "image/gif" :
+      "application/octet-stream";
+    res.setHeader("Content-Type", mime);
+    // Immutable content at a unique path — cache hard so a gallery of
+    // thumbnails doesn't re-read disk on every render.
+    res.setHeader("Cache-Control", "private, max-age=86400");
+    res.send(bytes);
+  }));
+}

package/src/host/daemon/api/inbox.js

@@ -4,9 +4,101 @@
 // The conversation-first entry point. Project-first navigation is unaffected —
 // this is a second axis over the same data, not a replacement for it.
 import { listAgentInbox } from "#core/stores/agent-inbox.js";
+import { listProjectA2AThreads, listProjectGroupThreads } from "#core/stores/messages.js";
 import { readConfig } from "#core/config/index.js";
 import { resolveAgentName } from "#core/identity/index.js";
-import { pageEnvelope } from "./shared.js";
+import { faceResolverFor, readAgentsSafe } from "./thread-faces.js";
+import { pageEnvelope, A2A_SLUG_PREFIX, GROUP_SLUG_PREFIX } from "./shared.js";
+import { convTurnKey, getActiveTurnByKey, listActiveTurns } from "../active-turns.js";
+
+function activeTurnForRow(row, activeTurns) {
+  if (row.kind === "agent" && row.project_id != null && row.conversation_id) {
+    return getActiveTurnByKey(convTurnKey(row.project_id, row.conversation_id));
+  }
+  if (row.kind === "super_agent" && row.channel && row.conversation_id) {
+    return activeTurns.find((turn) =>
+      turn.channel === row.channel && turn.thread_id === row.conversation_id
+    ) || null;
+  }
+  return null;
+}
+
+// a2a "group chats" aren't any single agent's conversation, so listAgentInbox
+// (per-agent) doesn't see them. Fold each project's a2a pairs in as their own
+// rows — this is the one place that shows EVERY conversation, so a group chat
+// belongs here next to the individual ones.
+//
+// Faces and the "Andy · Claude" title come from the shared resolver in
+// thread-faces.js, the same one the Chats sidebar and the thread header read
+// through — this row is not where that gets decided.
+function a2aInboxRows(entries, faces) {
+  const rows = [];
+  for (const e of entries) {
+    let threads = [];
+    try { threads = listProjectA2AThreads(e.storagePath); } catch { /* skip */ }
+    const agents = readAgentsSafe(e.path);
+    for (const raw of threads) {
+      const th = faces.decorate(raw, agents);
+      rows.push({
+        project_id: e.id,
+        project_name: e.name,
+        project_path: e.path,
+        agent_slug: `${A2A_SLUG_PREFIX }${th.id}`,
+        agent_name: th.title,
+        agent_emoji: null,
+        agent_icon: null,
+        kind: "a2a",
+        participants: th.participants,
+        participant_faces: th.participant_faces,
+        ...(th.requested_by ? { requested_by: th.requested_by } : {}),
+        pinned: false,
+        conversation_id: th.id,
+        channel: "a2a",
+        messages: th.messages,
+        preview: th.preview || null,
+        preview_at: th.preview_at || null,
+        last_activity_at: th.last_ts,
+      });
+    }
+  }
+  return rows;
+}
+
+// Group rooms (owner + N agents) are threads on the ledger, same as a2a — fold
+// them in here too so the one place that shows EVERY conversation shows them.
+// Shaped exactly like an a2a row (kind "group") so the frontend reuses the same
+// multi-face rendering and thread-selection it already has for a2a.
+function groupInboxRows(entries, faces) {
+  const rows = [];
+  for (const e of entries) {
+    let threads = [];
+    try { threads = listProjectGroupThreads(e.storagePath); } catch { /* skip */ }
+    const agents = readAgentsSafe(e.path);
+    for (const raw of threads) {
+      const th = faces.decorate(raw, agents);
+      rows.push({
+        project_id: e.id,
+        project_name: e.name,
+        project_path: e.path,
+        agent_slug: `${GROUP_SLUG_PREFIX}${th.id}`,
+        agent_name: th.title,
+        agent_emoji: null,
+        agent_icon: null,
+        kind: "group",
+        participants: th.participants,
+        participant_faces: th.participant_faces,
+        pinned: false,
+        conversation_id: th.id,
+        channel: "group",
+        messages: th.messages,
+        preview: th.preview || null,
+        preview_at: th.preview_at || null,
+        last_activity_at: th.last_ts,
+      });
+    }
+  }
+  return rows;
+}
 
 export function register(api, { projects }) {
   api.get("/inbox", (req, res) => {
@@ -23,8 +115,22 @@ export function register(api, { projects }) {
         });
       }
 
+      // `?channel=web` scopes the individual-agent rows to one channel — the
+      // inbox and the phone are web-only so a Telegram thread never surfaces
+      // there. a2a group rows are their own channel and are added below,
+      // unaffected by this filter.
+      const channel = typeof req.query.channel === "string" && req.query.channel
+        ? req.query.channel
+        : null;
+
       const { rows, skipped } = listAgentInbox(entries, {
         includeEmpty: req.query.include_empty === "1" || req.query.include_empty === "true",
+        channel,
+        // No `?channel=` means "show me everything", and everything now means
+        // one row per channel rather than one row per agent wearing whichever
+        // channel happened to speak last. Asking for a single channel already
+        // answers the question, so it keeps the one-row-per-agent shape.
+        perChannel: !channel,
       });
 
       // The super-agent's display name lives in identity.json, and core must not
@@ -35,7 +141,22 @@ export function register(api, { projects }) {
         r.kind === "super_agent" ? { ...r, agent_name: r.agent_name || superName } : r
       );
 
-      const envelope = pageEnvelope(named, req.query);
+      // Faces and titles for the multi-agent rows: one resolver for the request,
+      // shared with the Chats sidebar and the thread header (thread-faces.js).
+      // It knows the super-agent's own face too, so "golf-coach ↔ Roby" shows
+      // Roby with an avatar instead of the bare `super_agent` slug.
+      const faces = faceResolverFor(projects);
+
+      // Merge a2a group chats in and re-sort so the newest conversation wins
+      // regardless of whether it was an individual or a group one.
+      const activeTurns = listActiveTurns();
+      const merged = [...named, ...a2aInboxRows(entries, faces), ...groupInboxRows(entries, faces)]
+        .map((row) => ({ ...row, active_turn: activeTurnForRow(row, activeTurns) }))
+        .sort(
+        (a, b) => new Date(b.last_activity_at || 0).getTime() - new Date(a.last_activity_at || 0).getTime()
+      );
+
+      const envelope = pageEnvelope(merged, req.query);
       if (skipped.length) envelope.meta = { ...(envelope.meta || {}), skipped };
       res.json(envelope);
     } catch (e) {

package/src/host/daemon/api/integrations.js

@@ -25,8 +25,37 @@ import {
   getPluginService,
   reconcilePluginMcp,
 } from "#core/integrations/index.js";
+import { verifyState, callbackUrl } from "#core/integrations/plugins/_google-oauth.js";
 import { asyncRoute } from "./shared.js";
 
+// The browser origin behind this request, reconstructed so an OAuth redirect URI
+// built at authorize-time matches the one the callback trades the code with.
+function requestOrigin(req) {
+  const proto = String(req.headers["x-forwarded-proto"] || (req.secure ? "https" : "http")).split(",")[0].trim();
+  const host = req.headers["x-forwarded-host"] || req.headers.host;
+  return `${proto}://${host}`;
+}
+
+// The little page the OAuth popup lands on: tells the opener panel it's done and
+// closes itself. Kept self-contained (no bundle) since it renders outside the SPA.
+function oauthResultPage(ok, message = "") {
+  const title = ok ? "Conectado ✓" : "No se pudo conectar";
+  const detail = ok ? "Ya podés cerrar esta ventana." : String(message || "Reintentá desde el panel.");
+  const safe = detail.replace(/[<>&]/g, (c) => ({ "<": "&lt;", ">": "&gt;", "&": "&amp;" })[c]);
+  return `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${title}</title>
+<body style="margin:0;font:15px/1.5 system-ui,sans-serif;background:#0b0f14;color:#e6edf3;display:grid;place-items:center;height:100vh">
+<div style="max-width:22rem;text-align:center;padding:1.5rem">
+  <div style="font-size:2rem;margin-bottom:.5rem">${ok ? "✅" : "⚠️"}</div>
+  <h1 style="font-size:1.05rem;margin:0 0 .35rem">${title}</h1>
+  <p style="margin:0;color:#9aa7b4">${safe}</p>
+</div>
+<script>
+  try { window.opener && window.opener.postMessage({ source: "apx-oauth", ok: ${ok ? "true" : "false"} }, "*"); } catch (e) {}
+  ${ok ? "setTimeout(function(){ try { window.close(); } catch (e) {} }, 1200);" : ""}
+</script>`;
+}
+
 // Integration scope vocabulary: project | global, accepting "default" for
 // global and both "shared" and "runtime" for project. See the note in
 // api/mcps.js — do not merge these three helpers.
@@ -65,6 +94,37 @@ export function register(api, { projects, project, registries }) {
     }
   }
 
+  // OAuth redirect landing. Google sends the browser here (no bearer token — see
+  // the auth allowlist in shared.js), with a signed `state` that says which
+  // plugin/project/scope started the flow. We trade the code for a refresh token
+  // and persist it, then render a page that tells the panel it's done.
+  api.get("/integrations/oauth/callback", asyncRoute(async (req, res) => {
+    const fail = (msg) => res.status(400).type("html").send(oauthResultPage(false, msg));
+    const { code, state, error } = req.query || {};
+    if (error) return fail(`Google devolvió un error: ${error}`);
+    const decoded = verifyState(state);
+    if (!decoded || !code) return fail("El enlace de autorización venció o es inválido. Reintentá desde el panel.");
+    const svc = getPluginService(decoded.slug);
+    if (!svc || typeof svc.completeOAuth !== "function") return fail(`El plugin "${decoded.slug}" no soporta OAuth.`);
+    const scope = normalizeIntegrationScope(decoded.scope) || "project";
+    const p = projects.get(Number(decoded.pid) || 0);
+    if (!p) return fail("No encontré el proyecto para guardar la conexión.");
+    const storagePath = storagePathForScope(scope, p, projects);
+    if (!storagePath) return fail("El proyecto no tiene ruta de storage.");
+    const store = new IntegrationStore(storagePath);
+    const record = store.get(decoded.slug);
+    if (!record) return fail("La integración no está configurada (¿cargaste el client_id?).");
+    try {
+      const redirectUri = callbackUrl(requestOrigin(req));
+      const { patch } = await svc.completeOAuth(record, { code: String(code), redirectUri });
+      store.upsert(decoded.slug, patch);
+      reconcileMcp(svc, storagePath, scope, p);
+      res.type("html").send(oauthResultPage(true));
+    } catch (e) {
+      fail(e.message || String(e));
+    }
+  }));
+
   // List stored integrations in the chosen scope (secrets redacted).
   api.get("/projects/:pid/integrations", (req, res) => {
     const p = project(req, res);
@@ -90,6 +150,7 @@ export function register(api, { projects, project, registries }) {
         const resolved = resolveIntegration({
           projectStorage: p.storagePath,
           slug: entry.slug,
+          defaultStorage: storagePathForScope("global", p, projects),
           requireEnabled: false,
         });
         status = svc.status(resolved?.record || null);
@@ -195,8 +256,9 @@ export function register(api, { projects, project, registries }) {
     if (!record) return res.status(404).json({ error: "integration not configured" });
     try {
       // Actions get a 2nd ctx arg (existing plugins ignore it). Obsidian's
-      // sync_memory uses it to reach every project's memory.md.
-      const actionCtx = { storagePath, scope, project: p, projects, registries };
+      // sync_memory uses it to reach every project's memory.md; calendar's
+      // authorize uses `origin` to build the OAuth redirect URI.
+      const actionCtx = { storagePath, scope, project: p, projects, registries, origin: requestOrigin(req) };
       res.json(await fn.call(svc.actions, record, actionCtx));
     } catch (e) {
       res.status(400).json({ error: e.message });

package/src/host/daemon/api/mcps.js

@@ -9,6 +9,7 @@
 //   POST   /projects/:pid/mcps/:name/call
 import fs from "node:fs";
 import path from "node:path";
+import { asyncRoute } from "./shared.js";
 import {
   readApfMcps,
   writeApfMcps,
@@ -198,7 +199,7 @@ export function register(api, { projects, registries, project }) {
   // Full tool catalog — tools/list with input schemas, all pages merged.
   // This is what `apx mcp tools` renders; /test below stays as the
   // lightweight smoke check for the web UI card.
-  api.get("/projects/:pid/mcps/:name/tools", async (req, res) => {
+  api.get("/projects/:pid/mcps/:name/tools", asyncRoute(async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     try {
@@ -207,9 +208,9 @@ export function register(api, { projects, registries, project }) {
     } catch (e) {
       res.status(500).json({ error: e.message });
     }
-  });
+  }));
 
-  api.post("/projects/:pid/mcps/:name/call", async (req, res) => {
+  api.post("/projects/:pid/mcps/:name/call", asyncRoute(async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { tool, params } = req.body || {};
@@ -220,12 +221,12 @@ export function register(api, { projects, registries, project }) {
     } catch (e) {
       res.status(500).json({ error: e.message });
     }
-  });
+  }));
 
   // Smoke test — calls tools/list and reports either the tool catalog or a
   // clean error message. Used by the "Test" button in the MCP card so the
   // user can sanity-check a freshly-saved MCP without firing a real tool.
-  api.post("/projects/:pid/mcps/:name/test", async (req, res) => {
+  api.post("/projects/:pid/mcps/:name/test", asyncRoute(async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     try {
@@ -242,7 +243,7 @@ export function register(api, { projects, registries, project }) {
     } catch (e) {
       res.status(200).json({ ok: false, error: e.message });
     }
-  });
+  }));
 
   // In-memory log buffer for one MCP — stderr tail (stdio) or fetch summary
   // (http) plus a ring of recent events.