@agentprojectcontext/apx 1.80.2 → 1.89.1

package/src/host/daemon/api/tts.js

@@ -6,13 +6,19 @@
 //   GET  /tts/providers  → { configured_provider, mode, order,
 //                            engines: [{id, available, configured, enabled}] }
 //
+//   GET  /tts/voices?provider=<id>
+//                        → { voices: [name] } — the speakers a self-hosted
+//                          endpoint actually has, so the settings form can
+//                          offer them instead of asking for a typed guess.
+//
 // Audio files land under ~/.apx/tmp/tts/<uuid>.<ext>. The caller (CLI,
 // Telegram plugin, overlay) is responsible for picking them up.
 import { synthesize, listProviders } from "#core/voice/tts.js";
 import { readConfig } from "#core/config/index.js";
+import { asyncRoute } from "./shared.js";
 
 export function register(api) {
-  api.post("/tts/say", async (req, res) => {
+  api.post("/tts/say", asyncRoute(async (req, res) => {
     try {
       const { text, voice, language, provider, format, style } = req.body || {};
       if (typeof text !== "string" || !text.trim()) {
@@ -31,14 +37,101 @@ export function register(api) {
     } catch (e) {
       res.status(500).json({ error: e.message });
     }
-  });
+  }));
+
+  // GET /tts/warmup — tell the engine that would speak next to get ready.
+  // The desktop calls this the moment the mic opens, so the model is resident
+  // by the time there is a reply to say.
+  api.get("/tts/warmup", asyncRoute(async (_req, res) => {
+    const { warmupTts } = await import("#core/voice/tts.js");
+    res.json(await warmupTts());
+  }));
+
+  // GET /tts/reachable — does the local voice server actually answer right now?
+  //
+  // Deliberately not folded into /tts/providers. The `available` flag there is
+  // a CONFIG probe by design: a custom endpoint reports itself available on the
+  // strength of having a base_url, which is the right answer for a settings
+  // list that must show an engine you are still setting up. It is the wrong
+  // answer for "is it running" — stop the server and that flag never moves.
+  //
+  // Only ever probes a self-hosted endpoint, and only /models, the
+  // OpenAI-compatible catalogue every such server already serves. A short
+  // timeout because the point is to distinguish answering from not, and a
+  // server that needs three seconds to list its models is not answering.
+  api.get("/tts/reachable", asyncRoute(async (_req, res) => {
+    try {
+      const { resolveTtsCandidates } = await import("#core/voice/engines/index.js");
+      const { isSelfHosted } = await import("../tts-keepwarm.js");
+      const cfg = readConfig();
+      const candidates = await resolveTtsCandidates({ globalConfig: cfg });
+      const local = candidates.find((c) => isSelfHosted(c.engineConfig?.base_url));
+      if (!local) return res.json({ configured: false });
+
+      const url = String(local.engineConfig.base_url).replace(/\/+$/, "") + "/models";
+      const t0 = Date.now();
+      let reachable = false;
+      try {
+        const r = await fetch(url, { signal: AbortSignal.timeout(2500) });
+        reachable = r.ok;
+      } catch { reachable = false; }
+      res.json({
+        configured: true,
+        provider: local.provider,
+        base_url: local.engineConfig.base_url,
+        reachable,
+        ms: Date.now() - t0,
+      });
+    } catch (e) {
+      res.status(500).json({ error: e.message });
+    }
+  }));
+
+  // GET /tts/voices — the speakers a custom endpoint offers right now.
+  //
+  // The base_url comes from the stored config and never from the query: this
+  // route makes the daemon fetch a URL on request, and the set of URLs it will
+  // fetch has to stay the set the user already configured. A provider that is
+  // still being typed into the form therefore has no list — the field falls
+  // back to free text, which is what it was before.
+  api.get("/tts/voices", asyncRoute(async (req, res) => {
+    try {
+      const { providerConfig } = await import("#core/voice/engines/index.js");
+      const cfg = providerConfig(readConfig(), String(req.query.provider || ""));
+      const base = cfg?.base_url;
+      if (!base) return res.json({ voices: [], configured: false });
+
+      const url = String(base).replace(/\/+$/, "") + "/voices";
+      const r = await fetch(url, { signal: AbortSignal.timeout(4000) });
+      if (!r.ok) return res.json({ voices: [], reachable: false });
+      const json = await r.json();
+      const voices = Array.isArray(json?.voices)
+        ? json.voices.filter((v) => typeof v === "string")
+        : [];
+      // `details` and `language` are optional: an endpoint that says which
+      // language each voice was recorded in gets labelled with it, and one that
+      // doesn't (QVox) still answers with a plain list.
+      res.json({
+        voices,
+        ...(json?.details && typeof json.details === "object" ? { details: json.details } : {}),
+        ...(typeof json?.language === "string" ? { language: json.language } : {}),
+        ...(typeof json?.lang === "string" ? { lang: json.lang } : {}),
+        configured: true,
+        reachable: true,
+      });
+    } catch {
+      // A server that is down or speaks a different dialect is not an error
+      // here: it means "no list", and the form degrades to free text.
+      res.json({ voices: [], reachable: false });
+    }
+  }));
 
-  api.get("/tts/providers", async (_req, res) => {
+  api.get("/tts/providers", asyncRoute(async (_req, res) => {
     try {
       const info = await listProviders(readConfig());
       res.json(info);
     } catch (e) {
       res.status(500).json({ error: e.message });
     }
-  });
+  }));
 }

package/src/host/daemon/api/turn-abort.js

@@ -0,0 +1,23 @@
+// The two halves of "the user stopped this turn", shared by the chat routes so
+// the project-agent stream and the super-agent stream agree on what an
+// interruption looks like.
+//
+// It is a normal outcome, not a failure. A turn that was interrupted has
+// usually done real work the user watched happen, and the whole point of
+// interrupting (rather than waiting) is to redirect that work with a new
+// message — so the partial has to survive into the thread, and the client has
+// to be able to tell "you stopped this" apart from "this broke".
+
+// `wasAborted` moved to core when the group cascade needed the same test and
+// core/ cannot import from host/ (rule 8). Re-exported here because this module
+// is where every route already asks the question.
+export { wasAborted } from "#core/agent/abort.js";
+
+/**
+ * The terminal stream event for an interrupted turn. Deliberately NOT `error`:
+ * a client that renders errors as a red banner would accuse the daemon of
+ * breaking every time the user pressed stop.
+ */
+export function abortedTurnEvent({ text = "", trace = [] } = {}) {
+  return { type: "aborted", result: { text, trace } };
+}

package/src/host/daemon/api/turns.js

@@ -0,0 +1,49 @@
+// Stopping a turn that is already running.
+//
+// Every other surface could already do this. Telegram has kept one
+// AbortController per chat since the beginning — a new message aborts the
+// running turn ("no, stop, do this instead"), and the desktop capsule has its
+// own cancel. The web panel had neither: its Stop button aborted the browser's
+// fetch and nothing else, so the run kept going, kept calling tools, and
+// persisted its answer to a thread nobody was watching. Sending a message
+// mid-turn could only queue behind it.
+//
+// The reason the socket closing cannot itself stop the run is deliberate: a
+// refresh, or a second tab, has to be able to catch up on a turn in progress
+// (see active-turns.js). So cancelling has to be said out loud, which is this
+// route.
+//
+// Addressed the way the client already addresses the thread, because that is
+// the identity it has on hand:
+//   project agent  → { conversation_id }
+//   super-agent    → { channel }   (its thread IS the channel; see
+//                                   superAgentTurnKey)
+//   group room     → { channel: "group", thread_id }
+//
+// The third form is the general one: a channel that holds MANY threads needs to
+// say which. A group is the case that has it — one project runs any number of
+// rooms at once, so `channel` alone would stop whichever of them the map
+// happened to hold. A cascade is also the turn most worth stopping, since a
+// single owner line can fan out into ten full tool loops.
+import { asyncRoute } from "./shared.js";
+import { abortActiveTurn, convTurnKey, superAgentTurnKey, threadTurnKey } from "../active-turns.js";
+
+export function register(api, { project }) {
+  api.post("/projects/:pid/turns/abort", asyncRoute(async (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const { conversation_id: conversationId, channel, thread_id: threadId } = req.body || {};
+    if (!conversationId && !channel) {
+      return res.status(400).json({ error: "conversation_id or channel required" });
+    }
+    const key = conversationId
+      ? convTurnKey(p.id, conversationId)
+      : threadId
+      ? threadTurnKey(p.id, channel, threadId)
+      : superAgentTurnKey(p.id, channel);
+    // `false` is not an error: the turn may have finished a moment before the
+    // click landed, and a client that interrupts by sending should carry on and
+    // send either way.
+    res.json({ ok: true, aborted: abortActiveTurn(key) });
+  }));
+}

package/src/host/daemon/api/voice.js

@@ -32,6 +32,7 @@ import { buildVoiceChannelContext } from "#core/agent/channels/voice-context.js"
 import { extractSuggestions } from "#core/agent/suggestions.js";
 import { appendGlobalMessage } from "#core/stores/messages.js";
 import { appendErrorTrace, previewText } from "#core/logging.js";
+import { asyncRoute } from "./shared.js";
 
 export function register(api, { projects, plugins, registries }) {
   // GET /voice/tts?path=<abs>
@@ -39,7 +40,7 @@ export function register(api, { projects, plugins, registries }) {
   // Streams a TTS audio file back to the caller. Sandboxed to the
   // ~/.apx/tmp/tts directory so a client can't request arbitrary
   // filesystem paths through a manifest-leaked reply_audio_path.
-  api.get("/voice/tts", async (req, res) => {
+  api.get("/voice/tts", asyncRoute(async (req, res) => {
     const rawPath = String(req.query.path || "");
     if (!rawPath) return res.status(400).json({ error: "path required" });
     try {
@@ -64,9 +65,9 @@ export function register(api, { projects, plugins, registries }) {
     } catch (e) {
       res.status(500).json({ error: e?.message || "tts read failed" });
     }
-  });
+  }));
 
-  api.post("/voice/turn", async (req, res) => {
+  api.post("/voice/turn", asyncRoute(async (req, res) => {
     const body = req.body || {};
     const cfg = readConfig();
     let userText = (body.text || "").trim();
@@ -261,7 +262,7 @@ export function register(api, { projects, plugins, registries }) {
         }
       }
     }
-  });
+  }));
 }
 
 // Note for plugin authors:

package/src/host/daemon/api/web.js

@@ -32,7 +32,14 @@ const WEB_DIST = path.resolve(__dirname, "..", "..", "..", "interfaces", "web",
 const SPA_ROUTES = [
   /^\/$/,
   /^\/settings(\/.*)?$/,
+  // The panel's own modules. They used to live under /m/, which now belongs to
+  // the phone surface; both spellings resolve (the old one client-side).
+  /^\/(inbox|code|desktop|voice|deck)(\/.*)?$/,
   /^\/m\/(voice|desktop|deck|code|inbox)(\/.*)?$/,
+  // The phone: /m/chat, /m/tasks, /m/commitments — and /mobile, its old
+  // address, which redirects rather than 404s.
+  /^\/m(\/.*)?$/,
+  /^\/mobile(\/.*)?$/,
   /^\/p\/[^/]+(\/.*)?$/,
 ];
 
@@ -40,6 +47,80 @@ export function isKnownSpaRoute(p) {
   return SPA_ROUTES.some((re) => re.test(p));
 }
 
+// Content types for the compressed twins. Needed because the file being sent
+// ends in `.br`/`.gz`, and express would otherwise call a brotli-compressed
+// stylesheet application/octet-stream — which a browser refuses to apply.
+const TYPE_BY_EXT = {
+  ".js": "application/javascript; charset=UTF-8",
+  ".css": "text/css; charset=UTF-8",
+  ".html": "text/html; charset=UTF-8",
+  ".svg": "image/svg+xml",
+  ".json": "application/json; charset=UTF-8",
+  ".webmanifest": "application/manifest+json",
+  ".map": "application/json; charset=UTF-8",
+  ".txt": "text/plain; charset=UTF-8",
+};
+
+/** The encodings this client will take, best first. */
+function acceptedEncodings(header) {
+  // Order by our preference, not the client's q-values: brotli is smaller and
+  // every browser that offers it prefers it too.
+  const raw = String(header || "").toLowerCase();
+  const out = [];
+  if (/\bbr\b/.test(raw)) out.push({ enc: "br", ext: ".br" });
+  if (/\bgzip\b/.test(raw)) out.push({ enc: "gzip", ext: ".gz" });
+  return out;
+}
+
+/**
+ * Serve `foo.js.br` when the client asked for brotli and the file exists.
+ *
+ * Deliberately a lookup and a sendFile rather than compressing per request:
+ * these files do not change between builds, so the work belongs in the build
+ * (see scripts/build-web.js), and brotli at maximum quality — worth another
+ * ~20% over gzip — is far too slow to do on the fly.
+ *
+ * A dist with no twins (an older build, or a dev checkout) falls straight
+ * through to express.static, uncompressed and working.
+ */
+export function servePrecompressed(root) {
+  return function precompressed(req, res, next) {
+    if (req.method !== "GET" && req.method !== "HEAD") return next();
+    const ext = path.extname(req.path).toLowerCase();
+    const type = TYPE_BY_EXT[ext];
+    if (!type) return next();
+
+    // The client may be behind a proxy that varies on encoding; say so
+    // regardless of whether we end up compressing, so a cache keyed on the URL
+    // alone cannot hand a brotli body to a client that cannot read it.
+    res.setHeader("Vary", "Accept-Encoding");
+
+    const rel = decodeURIComponent(req.path).replace(/^\/+/, "");
+    // Same containment rule as the media route: resolve, then require the
+    // result to still be inside the directory we are serving.
+    const target = path.resolve(root, rel);
+    if (target !== root && !target.startsWith(root + path.sep)) return next();
+
+    for (const { enc, ext: suffix } of acceptedEncodings(req.headers["accept-encoding"])) {
+      const twin = `${target}${suffix}`;
+      if (!fs.existsSync(twin)) continue;
+      res.setHeader("Content-Encoding", enc);
+      res.setHeader("Content-Type", type);
+      // index.html is the SPA shell and must never be cached; its twin is the
+      // same file and inherits the same rule.
+      res.setHeader("Cache-Control", rel.endsWith("index.html") || rel.endsWith("sw.js") ? "no-cache" : "public, max-age=3600");
+      // acceptRanges off: a byte range of the COMPRESSED file is not a byte
+      // range of the resource, and a client that asked for one would decode
+      // garbage. Nothing range-requests a stylesheet, but the header would be
+      // an invitation to.
+      return res.sendFile(twin, { acceptRanges: false }, (err) => {
+        if (err) next(err);
+      });
+    }
+    return next();
+  };
+}
+
 // /api/admin/web-token: localhost-only endpoint that returns the daemon token
 // so the same-origin admin panel can authenticate every subsequent call.
 // Refuses if the request didn't come from loopback. Also refuses if the
@@ -108,6 +189,16 @@ export function register(app, { express }) {
     return;
   }
 
+  // Precompressed twins first: the build writes `.br` and `.gz` next to every
+  // compressible asset, and this hands over whichever one the client asked for.
+  //
+  // The bundle is ~1.7 MB of JavaScript and every byte of it used to go out
+  // raw. On loopback that is invisible; over Tailscale, where the connection
+  // may be relayed through a DERP node on another continent, it is the whole
+  // difference between the panel opening at once and the phone sitting on a
+  // white screen. Brotli takes it to ~400 KB.
+  app.use(servePrecompressed(WEB_DIST));
+
   // Serve static assets. NB: we mount AFTER the /api router is mounted in
   // api.js so data routes always win over this catch-all.
   app.use(
@@ -121,6 +212,13 @@ export function register(app, { express }) {
         if (filePath.endsWith("index.html")) {
           res.setHeader("Cache-Control", "no-cache");
         }
+        // The service worker decides what the installed app is allowed to
+        // reuse; a cached copy of it would keep deciding with yesterday's
+        // rules. Browsers already revalidate this file, but an hour of
+        // max-age here is one hour of pinning a policy we may have fixed.
+        if (filePath.endsWith("sw.js")) {
+          res.setHeader("Cache-Control", "no-cache");
+        }
       },
     })
   );

package/src/host/daemon/api.js

@@ -13,11 +13,13 @@
 import express from "express";
 
 import { API_PREFIX } from "./api/prefix.js";
+import { effectiveHost, effectivePort } from "#core/config/index.js";
 import { logError } from "#core/logging.js";
 
 import {
   traceIdMiddleware,
   buildAuthMiddleware,
+  buildRequestLogger,
   makeProjectResolver,
   makeTopProjectResolver,
   errorMiddleware,
@@ -31,18 +33,22 @@ import { register as registerSessions } from "./api/sessions.js";
 import { register as registerMcps } from "./api/mcps.js";
 import { register as registerIntegrations } from "./api/integrations.js";
 import { register as registerVars } from "./api/vars.js";
+import { register as registerMedia } from "./api/media.js";
 import { register as registerMessages } from "./api/messages.js";
 import { register as registerTelegram } from "./api/telegram.js";
 import { register as registerPlugins } from "./api/plugins.js";
 import { register as registerEngines } from "./api/engines.js";
 import { register as registerSkills } from "./api/skills.js";
 import { register as registerExec } from "./api/exec.js";
+import { register as registerTurns } from "./api/turns.js";
 import { register as registerSuperAgent } from "./api/super-agent.js";
 import { register as registerCode } from "./api/code.js";
 import { register as registerConversations } from "./api/conversations.js";
+import { register as registerGroups } from "./api/groups.js";
 import { register as registerConnections } from "./api/connections.js";
 import { register as registerRuntimes } from "./api/runtimes.js";
 import { register as registerRoutines } from "./api/routines.js";
+import { register as registerDeliveries } from "./api/deliveries.js";
 import { register as registerArtifacts } from "./api/artifacts.js";
 import { register as registerArtifactPreview } from "./api/artifact-preview.js";
 import { register as registerTasks } from "./api/tasks.js";
@@ -55,6 +61,7 @@ import { register as registerTopLevel } from "./api/top-level.js";
 import { register as registerSessionsSearch } from "./api/sessions-search.js";
 import { register as registerTranscribe } from "./api/transcribe.js";
 import { register as registerTts } from "./api/tts.js";
+import { register as registerImages } from "./api/images.js";
 import { register as registerEmbeddings } from "./api/embeddings.js";
 import { register as registerVoice } from "./api/voice.js";
 import { register as registerDesktop } from "./api/desktop.js";
@@ -69,6 +76,8 @@ import { register as registerSelfMemory } from "./api/self-memory.js";
 import { register as registerNudges } from "./api/nudges.js";
 import { register as registerWeb, registerWebToken } from "./api/web.js";
 import { register as registerConfirm } from "./api/confirm.js";
+import { register as registerNet, corsBetweenOwnAddresses } from "./api/net.js";
+import { register as registerMobility } from "./api/mobility.js";
 
 export function buildApi({
   projects,
@@ -81,6 +90,9 @@ export function buildApi({
   config,
   token,
   tokenStore,
+  mobilityDispatch,
+  mobilityPositionDispatch,
+  log,
 }) {
   const telegram = plugins?.get("telegram");
   const app = express();
@@ -91,6 +103,24 @@ export function buildApi({
   // ---- Global middleware -------------------------------------------
   app.use(express.json({ limit: "2mb" }));
   app.use(traceIdMiddleware);
+  // One daemon answers on several addresses (loopback, the LAN, the tailnet).
+  // A panel installed from one of them may fail over to another; that is a
+  // cross-origin request to the same process, and only OUR other addresses are
+  // allowed to make it. Must sit above the auth wall so a preflight — which
+  // carries no Authorization header by definition — is answered rather than
+  // rejected as unauthenticated.
+  app.use(corsBetweenOwnAddresses({ port: effectivePort(config), host: effectiveHost(config) }));
+  // Above the auth wall so 401s from a client with a stale token are logged
+  // too — see buildRequestLogger. No-op when the daemon didn't pass a logger
+  // (tests build the app directly).
+  if (typeof log === "function") {
+    app.use(
+      buildRequestLogger({
+        log,
+        match: (p) => p.startsWith(API_PREFIX) && p.includes("/super-agent/"),
+      })
+    );
+  }
   // Prefer the multi-token store when provided (production path); fall
   // back to the single `token` argument for legacy callers and tests
   // that haven't migrated yet.
@@ -117,6 +147,8 @@ export function buildApi({
     resolveTopProject,
     token,
     tokenStore,
+    mobilityDispatch,
+    mobilityPositionDispatch,
   };
 
   // ---- Tool routers — must mount BEFORE wildcard registry below ----
@@ -132,17 +164,22 @@ export function buildApi({
   registerMcps(api, ctx);
   registerIntegrations(api, ctx);
   registerVars(api, ctx);
+  registerMedia(api);
   registerMessages(api, ctx);
   registerEngines(api, ctx);
   registerSkills(api, ctx);
   registerExec(api, ctx);
+  registerTurns(api, ctx);
   registerSuperAgent(api, ctx);
   registerConfirm(api, ctx);
+  registerNet(api, ctx);
   registerCode(api, ctx);
   registerConversations(api, ctx);
+  registerGroups(api, ctx);
   registerConnections(api, ctx);
   registerRuntimes(api, ctx);
   registerRoutines(api, ctx);
+  registerDeliveries(api, ctx);
   registerArtifacts(api, ctx);
   registerArtifactPreview(api, ctx);
   registerTasks(api, ctx);
@@ -161,10 +198,12 @@ export function buildApi({
   registerPlugins(api, ctx);
   registerTranscribe(api, ctx);
   registerTts(api, ctx);
+  registerImages(api, ctx);
   registerEmbeddings(api, ctx);
   registerVoice(api, ctx);
   registerDesktop(api, ctx);
   registerDeck(api, ctx);
+  registerMobility(api, ctx);
   registerPairing(api, ctx);
 
   // ---- Admin -------------------------------------------------------

package/src/host/daemon/delivery-sweep.js

@@ -0,0 +1,58 @@
+// The delivery grace sweep — the "notify unless he reads it first" timer.
+//
+// An ORDINARY (non-priority) delivery is not pinged at the moment it is created.
+// It sits `pending` for a short grace window so Manu can open the agent's chat
+// and reply — which marks it `answered` and cancels the notify (answerDeliveries,
+// wired into the agent-chat endpoint). If the window passes and it is still
+// pending, this sweep has Roby tell him.
+//
+// Priority/anchor deliveries do NOT come through here — the runner notifies those
+// immediately. This is only the deferred half.
+//
+// Cheap by construction: it wakes on a plain interval, and a tick with nothing
+// past its grace does no work and touches no model. A held send (quiet-hours,
+// budget) is LEFT pending so a later tick retries once the budget allows —
+// canNudge holds it before composing, so a retry costs nothing until it lands.
+import { listDeliveries, markDelivery, DELIVERY_STATUS } from "#core/stores/deliveries.js";
+import { notifyOwnerViaRoby } from "#core/routines/delivery.js";
+
+const GRACE_MS = 60_000; // time to read/answer before Roby pings (ordinary only)
+const SWEEP_MS = 30_000; // how often the daemon checks the queue
+
+export function startDeliverySweep({ projects, plugins, registries, config } = {}) {
+  async function tick() {
+    const now = Date.now();
+    for (const entry of projects?.list?.() || []) {
+      let p;
+      try { p = projects.get(entry.id); } catch { continue; }
+      if (!p?.storagePath) continue;
+
+      const due = listDeliveries(p.storagePath, { status: DELIVERY_STATUS.PENDING }).filter(
+        (d) => d.priority !== true && d.created_at && now - Date.parse(d.created_at) >= GRACE_MS,
+      );
+      if (!due.length) continue;
+
+      const globalConfig = p.config || config || {};
+      const ctx = { project: p, plugins, registries, globalConfig };
+      for (const d of due) {
+        const gate = { severity: "normal", scheduled: false, unsolicited: true, project_id: entry.id };
+        try {
+          const r = await notifyOwnerViaRoby(ctx, {
+            routine: { name: d.routine || "delivery", id: d.routine_id || "" },
+            agent: { slug: d.agent, name: d.agent_name },
+            text: d.notify,
+            notify: d.notify,
+            gate,
+          });
+          if (r?.sent) markDelivery(p.storagePath, d.id, DELIVERY_STATUS.NOTIFIED, { channel: "telegram" });
+          // held / skipped → leave it pending; a later tick retries when the
+          // budget allows or the telegram plugin comes back.
+        } catch { /* best-effort — the delivery stays pending and is retried */ }
+      }
+    }
+  }
+
+  const timer = setInterval(() => { tick().catch(() => {}); }, SWEEP_MS);
+  timer.unref?.();
+  return function stop() { clearInterval(timer); };
+}

package/src/host/daemon/desktop-ws.js

@@ -11,15 +11,12 @@ export function setDesktopMessageHandler(fn) {
   _messageHandler = fn;
 }
 
-// --- WS upgrade auth helpers (shared by the daemon upgrade handler + tests) ---
+// --- WS upgrade auth ---
 //
-// The desktop WS channel must authenticate the same way the HTTP /api/desktop/*
-// routes do: a bearer token (master or paired client) carried on the upgrade
-// request. The legitimate desktop window sends `Authorization: Bearer <token>`
-// (src/interfaces/desktop/main.js); browser clients can pass `?token=`. Without
-// this, any client that can reach the daemon (loopback by default, but the LAN
-// when host is set to 0.0.0.0) could open the channel and drive the
-// super-agent. See QA BUG-WS-AUTH.
+// The desktop channel authenticates the same way every other WS channel and
+// every HTTP /api route does. The check itself lives in ws-auth.js — it is not
+// a desktop rule, it is the daemon's rule — and only the PATH is the desktop's
+// own. See that file for why it may not be duplicated per channel.
 
 /** The desktop channel's upgrade path. Lives under /api like every other route. */
 export const DESKTOP_WS_PATH = apiPath("/desktop/ws");
@@ -31,21 +28,6 @@ export function isDesktopUpgradePath(url) {
   return pathname === DESKTOP_WS_PATH;
 }
 
-/** Extract the bearer token from the upgrade request (header first, ?token= fallback). */
-export function extractWsToken(req) {
-  const auth = (req && req.headers && req.headers["authorization"]) || "";
-  if (auth.startsWith("Bearer ")) return auth.slice(7);
-  try {
-    return new URL((req && req.url) || "", "http://localhost").searchParams.get("token") || "";
-  } catch { return ""; }
-}
-
-/** True iff the upgrade request carries a token the store recognizes. */
-export function isDesktopUpgradeAuthorized(req, tokenStore) {
-  if (!tokenStore || typeof tokenStore.has !== "function") return false;
-  return tokenStore.has(extractWsToken(req));
-}
-
 export function registerDesktopClient(ws) {
   _clients.add(ws);
   ws.on("close", () => _clients.delete(ws));