@agentprojectcontext/apx 1.81.0 → 1.89.1

package/src/host/daemon/api/pairing.js

@@ -19,17 +19,27 @@
 
 import { randomUUID } from "node:crypto";
 import os from "node:os";
+import { reachableEndpoints } from "./net.js";
 
 // 90s was not enough for the real sequence: pick up the phone, unlock it,
 // open the camera, scan, wait for the browser. Five minutes is still short
 // enough that a nonce left on screen is not a standing invitation.
 const PAIRING_TTL_MS = 5 * 60_000;
 
-// Reachable base URLs a device on the LAN can hit. When the daemon binds to
-// the wildcard (0.0.0.0/::) we enumerate non-internal IPv4s; when it binds to
-// a concrete host we use that. Loopback is always last (only useful for the
-// host itself / adb reverse). Used to build the scan-to-login QR.
-function reachableUrls({ host, port }) {
+// Reachable base URLs a device can hit, best first. Delegated to the net
+// module so the pairing QR and the access panel agree on what exists — and so
+// a tailnet HTTPS address, when there is one, is what the phone scans. That
+// matters beyond convenience: a device paired over https:// gets an origin
+// that can install the panel as an app and open a microphone, which
+// http://192.168.x.x cannot.
+//
+// Kept synchronous-with-a-cache: /pair/init is a fast path and asking
+// Tailscale takes a round trip. The list is refreshed in the background and is
+// at worst one pairing stale — and the LAN half, which is what a first pairing
+// almost always uses, is computed here and now.
+let urlCache = { at: 0, urls: null };
+
+function lanFallback({ host, port }) {
   const p = port || 7430;
   const urls = [];
   if (host && host !== "0.0.0.0" && host !== "::" && host !== "127.0.0.1") {
@@ -46,6 +56,19 @@ function reachableUrls({ host, port }) {
   return [...new Set(urls)];
 }
 
+function reachableUrls({ host, port }) {
+  const p = port || 7430;
+  if (Date.now() - urlCache.at > 30_000) {
+    urlCache = { ...urlCache, at: Date.now() };
+    reachableEndpoints({ port: p, host })
+      .then((eps) => {
+        urlCache = { at: Date.now(), urls: eps.map((e) => e.url) };
+      })
+      .catch(() => {});
+  }
+  return urlCache.urls || lanFallback({ host, port: p });
+}
+
 // pairing_id → { expires_at, confirmed_at, device_label, client_id }
 const sessions = new Map();
 
@@ -66,6 +89,16 @@ function purgeExpired(now = Date.now()) {
 
 export function register(api, ctx) {
   const { tokenStore, config } = ctx;
+  // Warm the address list at boot. The first call to reachableUrls() returns
+  // the LAN fallback while the real answer is still being fetched — and the
+  // first call is exactly the one that matters, because it is someone opening
+  // the pairing dialog and getting the http:// address for the QR when a
+  // secure https:// one exists. By the time anyone gets there, this has landed.
+  try {
+    reachableUrls({ host: config?.host, port: config?.port });
+  } catch {
+    /* address discovery is best-effort; pairing works without it */
+  }
   if (!tokenStore) {
     // Pairing requires the multi-token store; if running with legacy
     // single-token mode just don't register the routes. Devices can fall

package/src/host/daemon/api/profiles.js

@@ -17,9 +17,12 @@ import {
   readProfile,
   readProfileState,
   effectiveProfileConfig,
+  localizeProfileSchema,
   installProfile,
   useProfile,
   offProfile,
+  syncProfile,
+  readoptProfile,
   setProfileConfig,
   uninstallProfile,
   profileDoctor,
@@ -45,6 +48,7 @@ function detail(id, { preview = true } = {}) {
   const state = readProfileState(cfg);
   const identity = (() => { try { return readIdentity(); } catch { return null; } })();
   const settings = effectiveProfileConfig(profile, cfg);
+  const lang = cfg?.user?.language || identity?.language || "en";
 
   const languages = profile.prompts.map((f) => {
     const m = f.match(/^PROFILE\.([\w-]+)\.md$/);
@@ -55,7 +59,7 @@ function detail(id, { preview = true } = {}) {
     ? renderProfilePrompt(profile, {
         identity,
         globalConfig: { ...cfg, profile: { active: id, config: settings } },
-        lang: cfg?.user?.language || identity?.language || "en",
+        lang,
       })
     : "";
 
@@ -71,7 +75,7 @@ function detail(id, { preview = true } = {}) {
     languages: [...new Set(languages)].sort(),
     provides: profile.manifest.provides || {},
     requires: profile.manifest.requires || {},
-    schema: profile.schema || null,
+    schema: localizeProfileSchema(profile.dir, profile.schema, lang),
     defaults: profile.defaults,
     config: settings,
     budget: profile.manifest.prompt_budget_tokens || null,
@@ -148,6 +152,30 @@ export function register(api) {
     }
   });
 
+  // Re-render the active package's routines from disk. Separate from `use`
+  // because re-activating is a bigger, noisier operation than "pick up the
+  // package as it is today", and an owner who just updated APX wants the second.
+  api.post("/profiles/sync", (req, res) => {
+    try {
+      res.json({ ok: true, ...syncProfile(req.body?.id || null) });
+    } catch (e) {
+      fail(res, e);
+    }
+  });
+
+  // Force-re-adopt the active profile's routines from the package, past the
+  // user_modified/user_owned skips that sync respects. `{ routine }` targets one;
+  // omit it to re-adopt all. This is the recovery a non-CLI user needs when their
+  // installed routines drifted (a hand-patched schedule, an origin gone null) and
+  // sync keeps skipping them — the web equivalent of `remove` + `sync`.
+  api.post("/profiles/readopt", (req, res) => {
+    try {
+      res.json({ ok: true, ...readoptProfile(req.body?.id || null, { only: req.body?.routine || null }) });
+    } catch (e) {
+      fail(res, e);
+    }
+  });
+
   api.post("/profiles/off", (_req, res) => {
     try {
       res.json({ ok: true, ...offProfile() });

package/src/host/daemon/api/routines.js

@@ -8,6 +8,8 @@
 //   POST   /projects/:pid/routines/:name/enable
 //   POST   /projects/:pid/routines/:name/disable
 //   POST   /projects/:pid/routines/:name/run
+//   GET    /projects/:pid/routines/:name/run   → the run in flight, if any
+//   GET    /projects/:pid/routines/:name/runs  → the runs already made
 import {
   listRoutines,
   getRoutine,
@@ -16,13 +18,43 @@ import {
   setEnabled as setRoutineEnabled,
   runRoutineNow,
 } from "#core/routines/index.js";
+import { getRoutineRun, listRoutineRuns } from "#core/routines/active-runs.js";
+import { listRoutineRunLog } from "#core/routines/run-log.js";
 import { CHANNELS } from "#core/constants/channels.js";
+import { asyncRoute } from "./shared.js";
 
 export function register(api, { projects, registries, plugins, project, config }) {
   api.get("/projects/:pid/routines", (req, res) => {
     const p = project(req, res);
     if (!p) return;
-    res.json(listRoutines(p.storagePath));
+    // `running` is runtime state, not stored state: which of these the daemon
+    // has open RIGHT NOW. Without it the list could only ever show the last
+    // finished run, so a routine working away for four minutes looked idle to
+    // every surface except the tab that pressed Play.
+    const open = new Map(listRoutineRuns(p.storagePath).map((r) => [r.routine, r]));
+    res.json(listRoutines(p.storagePath).map((r) => {
+      const run = open.get(r.name);
+      return run ? { ...r, running: true, run_started_at: run.started_at } : r;
+    }));
+  });
+
+  // The live record of a run in flight: which phase, which steps so far, what
+  // the model has said. 200 with `{ run: null }` when nothing is running — a
+  // routine that is idle is an answer, not a 404.
+  api.get("/projects/:pid/routines/:name/run", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    res.json({ run: getRoutineRun(p.storagePath, req.params.name) });
+  });
+
+  // A routine's run history. Reading it means knowing that a run is a ledger
+  // row with a particular meta on it, and that a "routine updated" row is NOT
+  // one — knowledge that belongs in core/routines/run-log.js, not in a panel.
+  api.get("/projects/:pid/routines/:name/runs", (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const limit = Math.min(parseInt(req.query.limit, 10) || 50, 200);
+    res.json(listRoutineRunLog(p.storagePath, req.params.name, { limit }));
   });
 
   api.get("/projects/:pid/routines/:name", (req, res) => {
@@ -90,19 +122,19 @@ export function register(api, { projects, registries, plugins, project, config }
     res.json({ ok: true });
   });
 
-  api.post("/projects/:pid/routines/:name/run", async (req, res) => {
+  api.post("/projects/:pid/routines/:name/run", asyncRoute(async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const r = getRoutine(p.storagePath, req.params.name);
     if (!r) return res.status(404).json({ error: "routine not found" });
     try {
       const result = await runRoutineNow(
-        { project: p, projects, plugins, registries, globalConfig: config },
+        { project: p, projects, plugins, registries, globalConfig: config, trigger: "manual" },
         r
       );
       res.json(result);
     } catch (e) {
       res.status(500).json({ error: e.message });
     }
-  });
+  }));
 }

package/src/host/daemon/api/runtimes.js

@@ -21,28 +21,25 @@ import {
   extractRuntimeResult as extractApfResult,
 } from "#core/stores/runtime-sessions.js";
 import { runSuperAgent, isSuperAgentEnabled } from "#core/agent/super-agent.js";
+import { asyncRoute } from "./shared.js";
 
 export function register(api, { projects, registries, plugins, project, config }) {
   api.get("/runtimes", (_req, res) =>
     res.json({ runtimes: RUNTIME_IDS })
   );
 
-  api.get("/env/detect", async (_req, res) => {
+  api.get("/env/detect", asyncRoute(async (_req, res) => {
     const detected = await detectAll();
     res.json(detected);
-  });
-
-  api.post("/projects/:pid/agents/:slug/runtime", async (req, res) => {
-    const p = project(req, res);
-    if (!p) return;
-    const { runtime, prompt, timeoutMs } = req.body || {};
-    if (!runtime || !prompt)
-      return res.status(400).json({ error: "runtime and prompt required" });
-
-    const agents = readAgents(p.path);
-    const agent = agents.find((a) => a.slug === req.params.slug);
-    if (!agent) return res.status(404).json({ error: "agent not found" });
+  }));
 
+  // Spawn an external runtime and capture its result. `agent` may be null: a
+  // pass-through run hands the prompt to the CLI with NO APX system prompt, so
+  // claude/codex/opencode act as themselves. When an agent IS given, its
+  // buildAgentSystem() output is injected as the CLI's system prompt — that is
+  // the ONLY thing the agent contributes here (the external CLI has its own
+  // agency; the APX "agent" is just how APX shapes the wrapping prompt).
+  async function executeRuntime(res, { p, agent, runtime, prompt, timeoutMs, title, taskRef }) {
     let rt;
     try {
       rt = getRuntime(runtime);
@@ -52,33 +49,39 @@ export function register(api, { projects, registries, plugins, project, config }
 
     let projectName = path.basename(p.path);
     try {
-      const meta = JSON.parse(
-        fs.readFileSync(apcProjectFile(p.path), "utf8")
-      );
+      const meta = JSON.parse(fs.readFileSync(apcProjectFile(p.path), "utf8"));
       if (meta.name) projectName = meta.name;
     } catch {}
 
+    // Pass-through runs are bucketed under a pseudo-slug named for the runtime
+    // (agents/<runtime>/sessions), since there is no persona to attribute them to.
+    const agentSlug = agent ? agent.slug : runtime;
+
     const session = createRuntimeSession({
       projectRoot: p.path,
       storageRoot: p.storagePath,
-      agentSlug: agent.slug,
+      agentSlug,
       runtime,
-      title: req.body?.title,
-      taskRef: req.body?.task_ref || "",
+      title,
+      taskRef: taskRef || "",
     });
 
-    const system = buildAgentSystem(p, agent, {
-      invocation: "runtime",
-      runtime,
-      extraParts: [
-        buildApfHint({
-          projectName,
-          projectPath: p.path,
-          agentSlug: agent.slug,
-          sessionId: session.id,
-        }),
-      ],
-    });
+    // No agent → no system prompt (true pass-through). With an agent, its system
+    // prompt plus the bridge hint that lets it report a result back.
+    const system = agent
+      ? buildAgentSystem(p, agent, {
+          invocation: "runtime",
+          runtime,
+          extraParts: [
+            buildApfHint({
+              projectName,
+              projectPath: p.path,
+              agentSlug: agent.slug,
+              sessionId: session.id,
+            }),
+          ],
+        })
+      : "";
 
     try {
       const r = await rt.run({
@@ -98,21 +101,22 @@ export function register(api, { projects, registries, plugins, project, config }
       });
 
       p.logMessage({
-        agent_slug: agent.slug,
+        agent_slug: agentSlug,
         channel: "runtime",
         direction: "in",
         author: "user",
         body: prompt,
         meta: { runtime, apc_session: session.id },
       });
+      // attribution-exempt: external runtime stdout — APX has no token accounting for a coding CLI's own model call.
       p.logMessage({
-        agent_slug: agent.slug,
+        agent_slug: agentSlug,
         channel: "runtime",
         direction: "out",
         type: "agent",
-        actor_id: agent.slug,
-        actor_kind: "agent",
-        author: agent.slug,
+        actor_id: agentSlug,
+        actor_kind: agent ? "agent" : "runtime",
+        author: agentSlug,
         body: r.output || "",
         meta: {
           runtime,
@@ -126,6 +130,7 @@ export function register(api, { projects, registries, plugins, project, config }
 
       res.json({
         runtime,
+        agent: agent ? agent.slug : null,
         exit_code: r.exitCode,
         output: r.output,
         stderr: r.stderr,
@@ -143,10 +148,40 @@ export function register(api, { projects, registries, plugins, project, config }
       } catch {}
       res.status(500).json({ error: e.message, apc_session: session.id });
     }
-  });
+  }
+
+  // Pass-through: delegate to a runtime with no APX agent (the CLI runs as itself).
+  api.post("/projects/:pid/runtime", asyncRoute(async (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const { runtime, prompt, timeoutMs } = req.body || {};
+    if (!runtime || !prompt)
+      return res.status(400).json({ error: "runtime and prompt required" });
+    await executeRuntime(res, {
+      p, agent: null, runtime, prompt, timeoutMs,
+      title: req.body?.title, taskRef: req.body?.task_ref,
+    });
+  }));
+
+  // Agent-wrapped: the named agent's system prompt shapes the runtime's turn.
+  api.post("/projects/:pid/agents/:slug/runtime", asyncRoute(async (req, res) => {
+    const p = project(req, res);
+    if (!p) return;
+    const { runtime, prompt, timeoutMs } = req.body || {};
+    if (!runtime || !prompt)
+      return res.status(400).json({ error: "runtime and prompt required" });
+
+    const agent = readAgents(p.path).find((a) => a.slug === req.params.slug);
+    if (!agent) return res.status(404).json({ error: "agent not found" });
+
+    await executeRuntime(res, {
+      p, agent, runtime, prompt, timeoutMs,
+      title: req.body?.title, taskRef: req.body?.task_ref,
+    });
+  }));
 
   // ---- Session resume — reads APC session file + (optionally) external transcript ----
-  api.get("/projects/:pid/sessions/:id/resume", async (req, res) => {
+  api.get("/projects/:pid/sessions/:id/resume", asyncRoute(async (req, res) => {
     const p = project(req, res);
     if (!p) return;
     const { id } = req.params;
@@ -217,5 +252,5 @@ export function register(api, { projects, registries, plugins, project, config }
     }
 
     res.json(out);
-  });
+  }));
 }

package/src/host/daemon/api/sessions-search.js

@@ -4,6 +4,7 @@
 //                                  then delegates to compactConversation.
 import { readAgents } from "#core/apc/parser.js";
 import { compactConversation } from "#core/stores/conversations-compactor.js";
+import { resolveAgentModel } from "#core/agent/agent-model.js";
 import { searchSessions, findSessionFile } from "#core/stores/sessions-search.js";
 import { asyncRoute } from "./shared.js";
 import { resolveProject } from "#core/apc/projects-helpers.js";
@@ -11,7 +12,7 @@ import { resolveProject } from "#core/apc/projects-helpers.js";
 // Plural on purpose: no ref means "search every project". This is a different
 // operation from core's resolveProject (which resolves exactly one and throws),
 // but the *matching* must agree with it — this used to accept only an id or an
-// exact path, so `?project=savia` matched nothing here while working on every
+// exact path, so `?project=acme` matched nothing here while working on every
 // other route.
 function resolveProjects(projects, projectRef) {
   if (projectRef == null || projectRef === "") {
@@ -47,7 +48,11 @@ export function register(api, { projects, config }) {
     const { project: p, agentSlug, filename } = found;
     const agents = readAgents(p.path);
     const agent = agents.find((a) => a.slug === agentSlug);
-    const modelId = modelOverride || agent?.fields?.Model;
+    const modelId = await resolveAgentModel({
+      agent,
+      config: p.config || config,
+      override: modelOverride,
+    });
     if (!modelId) {
       return res.status(400).json({ error: "agent has no model; pass model in body" });
     }

package/src/host/daemon/api/sessions.js

@@ -12,11 +12,18 @@ import {
   agentSessionsDir,
   createAgentSessionFile,
 } from "#core/stores/sessions.js";
-import { collectAllSessions, filterSessionsByQuery } from "#core/sessions/index.js";
+import {
+  collectAllSessions,
+  filterSessionsByQuery,
+  findSessionAcrossEngines,
+  findSessionInEngine,
+  resumeCommandFor,
+} from "#core/sessions/index.js";
+import { readEngineSessionContext } from "#core/stores/engine-sessions.js";
 import { pageEnvelope } from "./shared.js";
 
 export function register(api, { projects, project }) {
-  // Cross-engine sessions (apx · claude · codex), newest first. Returns a
+  // Cross-engine sessions (apx · claude · codex · opencode), newest first. Returns a
   // { meta, data } envelope (meta = pagination info, data = rows). Paginated
   // via ?limit & ?offset; with no limit, data is the full set as one page.
   // Optional ?q= filters via the same core as `apx session find` (title match,
@@ -49,6 +56,41 @@ export function register(api, { projects, project }) {
     res.json(pageEnvelope(rows, req.query));
   });
 
+  // One session, enough to decide what to do with it: what it was about, and
+  // the command that re-enters it. The list can't carry this — the working
+  // directory and last prompt cost a file read (or, for OpenCode, a subprocess)
+  // per session, which is affordable once and not eighty times.
+  //
+  // ?engine= disambiguates when two engines mint the same id; without it the
+  // first engine that recognises the id answers.
+  api.get("/sessions/:id", (req, res) => {
+    const id = String(req.params.id || "");
+    const engineId = req.query.engine ? String(req.query.engine) : null;
+    let meta = null;
+    try {
+      meta = engineId ? findSessionInEngine(engineId, id) : (findSessionAcrossEngines(id)[0] || null);
+    } catch (e) {
+      return res.status(500).json({ error: e.message });
+    }
+    if (!meta) return res.status(404).json({ error: "session not found" });
+
+    // Engines that hand us a transcript path get read for a summary; the ones
+    // that answered from their own CLI already included what they know.
+    let ctx = null;
+    try { ctx = meta.path ? readEngineSessionContext(meta) : null; } catch { ctx = null; }
+
+    res.json({
+      engine: meta.engine,
+      id: meta.id,
+      title: ctx?.title || meta.title || "",
+      last_prompt: ctx?.lastPrompt || meta.lastPrompt || null,
+      cwd: meta.cwd || null,
+      path: meta.path || null,
+      mtime: meta.mtime || 0,
+      resume_command: resumeCommandFor(meta.engine, meta.id),
+    });
+  });
+
   api.get("/projects/:pid/agents/:slug/sessions", (req, res) => {
     const p = project(req, res);
     if (!p) return;