@agentprojectcontext/apx 1.81.0 → 1.89.1

package/src/host/daemon/api/shared.js

@@ -9,7 +9,7 @@ import { readAgents } from "#core/apc/parser.js";
 import { agentMemoryPath } from "#core/agent/memory.js";
 import { apcMemoryFile } from "#core/apc/paths.js";
 import { CHANNELS } from "#core/constants/channels.js";
-import { isKnownSpaRoute } from "./web.js";
+import { slugifyName } from "#core/stores/organization.js";
 import { apiPath, isApiPath } from "./prefix.js";
 
 export const nowIso = () =>
@@ -32,6 +32,39 @@ export const nowIso = () =>
  *
  *   api.get("/things", asyncRoute(async (req, res) => { ... }))
  */
+// An a2a "group chat" is an exchange BETWEEN two agents, so it belongs to
+// neither of them and has no agents/<slug>/conversations/ directory. The inbox
+// still has to list it beside the individual chats, so it hands out a synthetic
+// slug — `a2a:<pairId>` — and every surface (web, /mobile, inbox) opens a row
+// through the per-agent endpoints with it.
+//
+// The prefix is defined ONCE, here, because it is a contract between the route
+// that mints it (api/inbox.js) and the routes that must recognise it. It is a
+// display/read handle: threads can be read through it, never written to.
+export const A2A_SLUG_PREFIX = "a2a:";
+// Same idea for group rooms: the inbox mints `group:<id>` so a group thread has
+// a stable handle in the same lists as individual and a2a rows.
+export const GROUP_SLUG_PREFIX = "group:";
+
+/** The pair id inside a synthetic a2a slug, or null for an ordinary agent. */
+export function a2aSlugThreadId(slug) {
+  const s = String(slug || "");
+  return s.startsWith(A2A_SLUG_PREFIX) ? s.slice(A2A_SLUG_PREFIX.length) : null;
+}
+
+/**
+ * Refuse a write aimed at an a2a slug, with a reason the caller can act on.
+ * Returns true when it answered — "agent not found" was actively misleading
+ * here: the agent is not missing, the target is not an agent at all.
+ */
+export function rejectA2AWrite(req, res, what) {
+  if (a2aSlugThreadId(req.params?.slug) === null) return false;
+  res.status(400).json({
+    error: `a2a threads cannot be ${what} — they are a record of two agents talking, derived from the message ledger. Address one of the participants instead.`,
+  });
+  return true;
+}
+
 export function asyncRoute(handler) {
   return (req, res, next) => Promise.resolve(handler(req, res, next)).catch(next);
 }
@@ -84,6 +117,70 @@ export function traceIdMiddleware(req, res, next) {
   next();
 }
 
+// One log line per super-agent HTTP request: caller, method, path, status and
+// how long the turn took.
+//
+// Why this exists: the super-agent endpoints are what phone automations
+// (Tasker), the Deck app and `apx exec` all POST into, and nothing recorded
+// that a request had even *arrived*. A client sending a stale token, the wrong
+// HTTP method or the wrong URL produced exactly the same silence as a daemon
+// that was down — which is how one Tasker misconfiguration (HEAD instead of
+// POST) survived an hour of debugging against the phone instead of being read
+// off a log line.
+//
+// Mounted ABOVE the auth wall on purpose. A bad token is rejected before the
+// /api router ever runs, so a router-level middleware would miss the 401 —
+// the single most useful line here.
+//
+// Metadata only: never the body or the headers, both of which carry the bearer
+// token and the message text.
+export function buildRequestLogger({ log, match }) {
+  return function requestLogger(req, res, next) {
+    if (!match(req.path)) return next();
+
+    const startedAt = process.hrtime.bigint();
+    // Behind `tailscale serve` the socket peer is always loopback and the real
+    // tailnet caller is in X-Forwarded-For, so prefer that when present.
+    const forwarded = (req.get("x-forwarded-for") || "").split(",")[0].trim();
+    const caller = forwarded || req.ip || req.socket?.remoteAddress || "unknown";
+    // Snapshot the path NOW: express rewrites req.url (and with it req.path) to
+    // be relative once the request enters the router mounted at /api, so a path
+    // read inside the finish callback would lose the prefix for routes that got
+    // that far — and keep it for the 401s that never did. Logging both shapes
+    // for the same URL makes the lines impossible to grep as one.
+    const reqPath = req.path;
+    // The caller's own label for the surface it is (`channel` in the body:
+    // "whatsapp" for the Tasker bridge, "web" for the panel, absent for a bare
+    // API call). Turns on any channel but web/web_sidebar are deliberately not
+    // persisted to the ledger — see logWebTurn — so without this the log is the
+    // ONLY record that an automation fired at all, and two automations on the
+    // same device are indistinguishable by IP. Just the channel name: the body
+    // also carries the message text, which stays out of the log.
+    const channel = typeof req.body?.channel === "string"
+      ? req.body.channel.slice(0, 32)
+      : "";
+
+    let done = false;
+    const finish = (outcome) => {
+      if (done) return;
+      done = true;
+      const ms = Math.round(Number(process.hrtime.bigint() - startedAt) / 1e6);
+      log(
+        `request ${req.method} ${reqPath} from ${caller}` +
+        `${channel ? ` channel=${channel}` : ""} → ${outcome} ${ms}ms` +
+        ` [${req.apxTraceId}]`
+      );
+    };
+
+    // "finish" = a response was written. "close" without "finish" = the client
+    // hung up first (a Tasker HTTP timeout looks exactly like this), which is
+    // worth a distinct outcome rather than no line at all.
+    res.on("finish", () => finish(String(res.statusCode)));
+    res.on("close", () => finish("client-aborted"));
+    next();
+  };
+}
+
 // Paths that bypass auth: /api/health for liveness probes, /api/pair/* so a
 // fresh client can bootstrap a token without already having one, and
 // /api/admin/web-token so the local same-origin admin panel can self-bootstrap.
@@ -96,32 +193,32 @@ const UNAUTHENTICATED_PREFIXES = [
   apiPath("/health"),
   apiPath("/pair/"),
   apiPath("/admin/web-token"),
+  // OAuth landing: Google's browser redirect arrives with no bearer token. The
+  // route defends itself with a signed `state` instead (see api/integrations.js).
+  apiPath("/integrations/oauth/callback"),
 ];
 
-// Does this path look like a static asset (has a file extension)? Vite emits
-// hashed, extension-bearing filenames (index-abc123.js, logo.svg, font.woff2),
-// so an extension is a reliable "this is a bundle asset, not a data route"
-// signal. Data routes (/skills, /projects, /p/0/tasks) have no extension.
-function isStaticAssetPath(p) {
-  return path.extname(p) !== "";
-}
-
 function isUnauthenticatedPath(p, method = "GET") {
   for (const prefix of UNAUTHENTICATED_PREFIXES) {
     if (p === prefix.replace(/\/$/, "") || p.startsWith(prefix)) return true;
   }
-  // Everything else under /api needs a token, full stop. Checked BEFORE the
-  // SPA-bootstrap exemption below, which would otherwise let a data route pass
-  // simply because its last segment happens to carry a file extension —
-  // GET /api/projects/0/artifacts/report.html is a data route, not an asset.
+  // Everything under /api needs a token, full stop. This is the whole auth
+  // wall: since the /api cutover there is no data route outside that prefix,
+  // and a path is on one side of the seam or the other.
   if (isApiPath(p)) return false;
   // SPA bootstrap: the admin bundle loads before it holds a bearer, so a GET
-  // for a static asset or a known client-router route is served without auth —
-  // the bundle then fetches /api/admin/web-token. Since every data route now
-  // lives under /api and returned false above, this exemption can only ever
-  // reach panel assets and client-router paths.
-  if (method === "GET" && (isStaticAssetPath(p) || isKnownSpaRoute(p))) return true;
-  return false;
+  // outside /api is served without auth — the bundle then fetches
+  // /api/admin/web-token. Out here there is nothing BUT the panel: a hashed
+  // bundle asset (index-abc123.js, logo.svg) or a client-router path, and both
+  // resolve to the same public index.html shell.
+  //
+  // Including paths the router does NOT know. That is deliberate: an unknown
+  // route is exactly the one that must reach the SPA fallback (api/web.js),
+  // which serves the shell with a 404 so React Router can draw the styled
+  // NotFound screen. While this was gated on isKnownSpaRoute, a typo'd URL got
+  // a bare 401 JSON body instead — and the old justification ("an unknown
+  // extension-less GET might be a data route") died with the cutover above.
+  return method === "GET";
 }
 
 // Bearer-token auth.
@@ -245,6 +342,7 @@ export function agentToResponse(a) {
   if (!a) return null;
   const f = a.fields || {};
   const reserved = new Set([
+    "Name",
     "Role",
     "Model",
     "Language",
@@ -257,6 +355,7 @@ export function agentToResponse(a) {
     "Type",
     "Area",
     "Emoji",
+    "Icon",
     "Autonomy",
   ]);
   const extra = {};
@@ -265,6 +364,9 @@ export function agentToResponse(a) {
   }
   return {
     slug: a.slug,
+    // Human-readable display name. The slug stays the immutable identity
+    // (filename, links, delegation); Name is what surfaces in the UI.
+    name: f.Name || null,
     role: f.Role || null,
     model: f.Model || null,
     language: f.Language || null,
@@ -276,11 +378,16 @@ export function agentToResponse(a) {
     // Typology (specialist/assistant/orchestrator/worker/monitor) + area. Both
     // definitional, kept in APC frontmatter.
     type: f.Type || null,
-    area: f.Area || null,
+    // Canonical slug, so `Growth` and `growth` group as one area in the team
+    // view even when the file on disk still has the display name.
+    area: f.Area ? (slugifyName(f.Area) || f.Area) : null,
     // Display emoji (avatar) + autonomy (permission mode: total/automatico/
     // permiso). Definitional, kept in APC frontmatter so they travel with the
     // project and stay diffable.
     emoji: f.Emoji || null,
+    // Blob-preset key for the animated avatar (see web blobPresets). Definitional,
+    // kept in APC frontmatter alongside Emoji so it travels with the project.
+    icon: f.Icon || null,
     autonomy: f.Autonomy || null,
     skills: Array.isArray(f.Skills) ? f.Skills : [],
     tools: Array.isArray(f.Tools) ? f.Tools : [],

package/src/host/daemon/api/skills.js

@@ -41,6 +41,7 @@ import {
   readIndex,
 } from "#core/agent/skills/index-store.js";
 import { readConfig, writeConfig } from "#core/config/index.js";
+import { asyncRoute } from "./shared.js";
 
 const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
 // Only http(s)/ssh/git git remotes — never a local path or shell metachar.
@@ -136,6 +137,9 @@ export function register(api /*, ctx */) {
         skills: annotated.map((s) => ({
           slug: s.slug,
           source: s.source,
+          origin: s.origin || null,
+          origin_path: s.origin_path || null,
+          file: s.file,
           description: condenseSkillDescription(s.description),
           enabled: s.enabled,
           private: s.private,
@@ -160,6 +164,9 @@ export function register(api /*, ctx */) {
       res.json({
         slug: skill.slug,
         source: skill.source,
+        origin: skill.origin || null,
+        origin_path: skill.origin_path || null,
+        file_path: skill.file_path || null,
         description: skill.description,
         frontmatter: skill.frontmatter,
         body: skill.body,
@@ -388,7 +395,7 @@ export function register(api /*, ctx */) {
 
   // ---- Index build --------------------------------------------------------
 
-  api.post("/skills/index", async (req, res) => {
+  api.post("/skills/index", asyncRoute(async (req, res) => {
     try {
       const { project_path, force } = req.body || {};
       const cfg = readConfig();
@@ -419,11 +426,11 @@ export function register(api /*, ctx */) {
     } catch (e) {
       res.status(500).json({ error: e.message });
     }
-  });
+  }));
 
   // ---- Dry-run ------------------------------------------------------------
 
-  api.post("/skills/inspect", async (req, res) => {
+  api.post("/skills/inspect", asyncRoute(async (req, res) => {
     try {
       const { prompt, project_path } = req.body || {};
       if (!prompt || typeof prompt !== "string") {
@@ -444,5 +451,5 @@ export function register(api /*, ctx */) {
     } catch (e) {
       res.status(500).json({ error: e.message });
     }
-  });
+  }));
 }