@agentprojectcontext/apx 1.81.0 → 1.89.1

package/src/interfaces/cli/commands/image.js

@@ -0,0 +1,314 @@
+// apx image — text-to-image from the command line.
+//
+//   apx image "<prompt>"                       generate with the routed engine
+//   apx image "<prompt>" --out fox.png         write it where you say
+//   apx image "<prompt>" --size 768x512 --steps 8 --cfg 1.0
+//   apx image "<prompt>" --provider a1111      force one engine
+//   apx image "<prompt>" --init photo.png      img2img: start from that picture
+//   apx image "<prompt>" --control pose.png    ControlNet: keep its structure
+//   apx image "<prompt>" --init p.png --mask m.png   inpaint just the white part
+//   apx image providers                        which engines are reachable
+//   apx image capabilities [--provider <id>]   models/samplers a server offers
+//
+// Two reference-image flags, not one, because they are two operations against
+// two routes: --init hands the sampler a canvas to repaint (how far it may
+// stray is --denoise), --control hands it a structure to build a fresh picture
+// around (how hard to enforce it is --control-strength). --img-ref is accepted
+// as a friendlier spelling of --init, which is the one people reach for.
+// The file is read here and sent as base64, so the daemon may be on another
+// machine; express caps a body at 2 MB, which SIZE_LIMIT keeps us under.
+//
+// A thin client over the daemon's POST /api/images/generate — the same routing
+// the web panel and any agent surface use, so a picture made here is made the
+// same way everywhere. The daemon writes into ~/.apx/images/<date>/; --out
+// copies the result to a path of your choosing. Nothing is ever written into a
+// project checkout unless --out asks for it.
+
+import fs from "node:fs";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { http } from "../http.js";
+
+const c = {
+  reset: "\x1b[0m", bold: "\x1b[1m", dim: "\x1b[2m",
+  green: "\x1b[32m", red: "\x1b[31m", yellow: "\x1b[33m", cyan: "\x1b[36m",
+};
+const NO_COLOR = !!process.env.NO_COLOR;
+const paint = (code) => (s) => (NO_COLOR ? s : `${code}${s}${c.reset}`);
+const err = paint(c.red);
+const dim = paint(c.dim);
+const bold = paint(c.bold);
+const ok = paint(c.green);
+const warn = paint(c.yellow);
+const cy = paint(c.cyan);
+
+// Reserved first positionals. A prompt that is literally one of these words
+// needs --prompt to disambiguate; anything else is read as the prompt.
+const SUBCOMMANDS = new Set(["providers", "capabilities"]);
+
+const USAGE = [
+  "Usage: apx image \"<prompt>\" [--out <file>] [--provider <id>] [--size 768x512]",
+  "                  [--steps N] [--cfg N] [--seed N] [--negative \"...\"]",
+  "                  [--count N] [--model <id>] [--format png|jpeg|webp] [--json] [--open]",
+  "                  [--init <img> [--denoise 0.45] [--mask <img> [--mask-blur N]]]",
+  "                  [--control <img> [--control-strength 0.8]]",
+  "       apx image providers",
+  "       apx image capabilities [--provider <id>]",
+].join("\n");
+
+// Express parses request bodies up to 2 MB (host/daemon/api.js). Base64 costs
+// a third on top, so refuse a little under that with an actionable message
+// rather than letting the daemon answer an opaque 413.
+const SIZE_LIMIT = 1_400_000;
+
+/**
+ * Read a reference image and return bare base64.
+ *
+ * Failing loudly here matters: a mistyped path that fell through would render
+ * a perfectly good picture that simply ignored the reference, and nothing in
+ * the output would say why.
+ */
+function readImageFlag(value, flagName) {
+  const file = str(value);
+  if (!file) throw new Error(`${flagName} needs a file path`);
+  const resolved = path.resolve(file);
+  if (!fs.existsSync(resolved)) throw new Error(`${flagName}: no such file — ${resolved}`);
+  const stat = fs.statSync(resolved);
+  if (stat.isDirectory()) throw new Error(`${flagName}: that is a directory — ${resolved}`);
+  if (stat.size > SIZE_LIMIT) {
+    throw new Error(
+      `${flagName}: ${formatBytes(stat.size)} is too big (limit ${formatBytes(SIZE_LIMIT)}).\n` +
+      `  Shrink it first, e.g.  sips -Z 768 "${resolved}" --out /tmp/ref.png`
+    );
+  }
+  return fs.readFileSync(resolved).toString("base64");
+}
+
+function num(v) {
+  if (v === undefined || v === true) return undefined;
+  const n = Number(v);
+  return Number.isFinite(n) ? n : undefined;
+}
+
+function str(v) {
+  return typeof v === "string" && v.trim() ? v.trim() : undefined;
+}
+
+/** Flags → the body POST /images/generate expects. Absent stays absent. */
+function requestFrom(flags) {
+  const body = {};
+  const put = (key, value) => { if (value !== undefined) body[key] = value; };
+  put("provider", str(flags.provider));
+  put("size", str(flags.size));
+  put("width", num(flags.width));
+  put("height", num(flags.height));
+  put("steps", num(flags.steps));
+  put("cfg_scale", num(flags.cfg ?? flags["cfg-scale"] ?? flags.cfg_scale));
+  put("seed", num(flags.seed));
+  put("count", num(flags.count ?? flags.n));
+  put("sampler", str(flags.sampler));
+  put("scheduler", str(flags.scheduler));
+  put("negative_prompt", str(flags.negative ?? flags["negative-prompt"]));
+  put("model", str(flags.model));
+  put("format", str(flags.format));
+
+  // --img-ref is the same thing as --init; refuse to guess if both are given
+  // with different files, since silently dropping one changes the picture.
+  const initFlag = flags.init ?? flags["img-ref"] ?? flags.img_ref;
+  const controlFlag = flags.control ?? flags["control-image"] ?? flags.control_image;
+  if (initFlag !== undefined && controlFlag !== undefined) {
+    throw new Error(
+      "--init and --control are different operations; pass one.\n" +
+      "  --init    repaint that picture (img2img)\n" +
+      "  --control build a new one around its structure (ControlNet)"
+    );
+  }
+  const maskFlag = flags.mask;
+  if (maskFlag !== undefined && initFlag === undefined) {
+    throw new Error("--mask needs --init: inpainting repaints part of a picture you supply");
+  }
+  if (initFlag !== undefined) {
+    put("init_image", readImageFlag(initFlag, "--init"));
+    put("denoising_strength", num(flags.denoise ?? flags["denoising-strength"] ?? flags.denoising_strength));
+  }
+  if (maskFlag !== undefined) {
+    put("mask", readImageFlag(maskFlag, "--mask"));
+    put("mask_blur", num(flags["mask-blur"] ?? flags.mask_blur));
+    // Named rather than numeric: nobody remembers that 2 means latent noise,
+    // and it is the knob that decides whether the prompt lands at all.
+    const fill = str(flags["inpaint-fill"] ?? flags.inpaint_fill);
+    if (fill) {
+      const FILLS = { fill: 0, original: 1, noise: 2, nothing: 3 };
+      if (!(fill in FILLS)) {
+        throw new Error(`--inpaint-fill: unknown "${fill}". Use: ${Object.keys(FILLS).join(" | ")}`);
+      }
+      put("inpainting_fill", FILLS[fill]);
+    }
+  }
+  if (controlFlag !== undefined) {
+    put("control_image", readImageFlag(controlFlag, "--control"));
+    put("control_strength", num(flags["control-strength"] ?? flags.control_strength));
+  }
+  return body;
+}
+
+/** Open a file in the OS viewer. Best-effort — never fails the command. */
+function openFile(file) {
+  const bin = process.platform === "darwin" ? "open"
+    : process.platform === "win32" ? "explorer"
+    : "xdg-open";
+  try {
+    spawn(bin, [file], { detached: true, stdio: "ignore" }).unref();
+  } catch { /* no viewer is not an error */ }
+}
+
+/**
+ * Copy the daemon's file to --out. Copy, not move: the gallery under ~/.apx
+ * stays the durable record, so a later `--out` overwrite never loses the only
+ * copy of a picture.
+ */
+function copyOut(srcPath, outFlag, index, total) {
+  let dest = path.resolve(outFlag);
+  if (fs.existsSync(dest) && fs.statSync(dest).isDirectory()) {
+    dest = path.join(dest, path.basename(srcPath));
+  } else if (total > 1 && index > 0) {
+    // Several images, one --out name: number them rather than overwrite.
+    const ext = path.extname(dest);
+    dest = path.join(path.dirname(dest), `${path.basename(dest, ext)}-${index + 1}${ext}`);
+  }
+  fs.mkdirSync(path.dirname(dest), { recursive: true });
+  fs.copyFileSync(srcPath, dest);
+  return dest;
+}
+
+function formatBytes(n) {
+  if (!Number.isFinite(n)) return "";
+  if (n >= 1024 * 1024) return `${(n / 1024 / 1024).toFixed(1)} MB`;
+  // Sub-kilobyte files are real (the mock engine writes a 180-byte swatch);
+  // rounding them to "0 KB" reads as a failure.
+  if (n >= 1024) return `${Math.round(n / 1024)} KB`;
+  return `${n} B`;
+}
+
+async function cmdProviders(flags) {
+  const info = await http.get("/api/images/providers");
+  if (flags.json) {
+    process.stdout.write(JSON.stringify(info, null, 2) + "\n");
+    return;
+  }
+  process.stdout.write(
+    `${bold("Routing")}  ${info.mode}` +
+    (info.mode === "single" ? ` → ${cy(info.configured_provider)}` : ` (${info.order.join(" → ")})`) +
+    "\n\n"
+  );
+  for (const e of info.engines || []) {
+    const mark = e.available ? ok("●") : dim("○");
+    const state = [
+      e.available ? "reachable" : "unreachable",
+      e.configured ? "configured" : "not configured",
+      e.enabled ? null : "disabled",
+    ].filter(Boolean).join(", ");
+    const label = e.label && e.label !== e.id ? ` ${dim(`(${e.label})`)}` : "";
+    process.stdout.write(`  ${mark} ${bold(e.id)}${label}  ${dim(state)}\n`);
+    if (e.note) process.stdout.write(`      ${dim(e.note)}\n`);
+  }
+  const d = info.defaults || {};
+  process.stdout.write(
+    `\n${dim(`Defaults: ${d.width}x${d.height}, ${d.steps} steps, cfg ${d.cfg_scale}, ${d.format}`)}\n`
+  );
+}
+
+async function cmdCapabilities(flags) {
+  const q = flags.provider ? `?provider=${encodeURIComponent(String(flags.provider))}` : "";
+  const info = await http.get(`/api/images/capabilities${q}`);
+  if (flags.json) {
+    process.stdout.write(JSON.stringify(info, null, 2) + "\n");
+    return;
+  }
+  const caps = info.capabilities;
+  process.stdout.write(`${bold(info.provider)}\n`);
+  if (!caps) {
+    process.stdout.write(dim("  No catalog — the engine is unreachable or has no discovery route.\n"));
+    return;
+  }
+  const row = (label, list) => {
+    if (!list?.length) return;
+    process.stdout.write(`  ${bold(label)}  ${list.join(", ")}\n`);
+  };
+  row("Models    ", caps.models);
+  row("Samplers  ", caps.samplers);
+  row("Schedulers", caps.schedulers);
+  row("Formats   ", caps.formats);
+  if (caps.defaults?.width) {
+    process.stdout.write(dim(`  Server defaults: ${caps.defaults.width}x${caps.defaults.height}\n`));
+  }
+}
+
+export async function cmdImage(args) {
+  const flags = args.flags || {};
+  const first = args._[0];
+
+  if (SUBCOMMANDS.has(first) && !str(flags.prompt)) {
+    if (first === "providers") return cmdProviders(flags);
+    if (first === "capabilities") return cmdCapabilities(flags);
+  }
+
+  const prompt = str(flags.prompt) || args._.filter(Boolean).join(" ").trim();
+  if (!prompt) {
+    process.stderr.write(err("apx image: missing prompt") + "\n" + dim(USAGE) + "\n");
+    process.exitCode = 1;
+    return;
+  }
+
+  let body;
+  try {
+    body = { prompt, ...requestFrom(flags) };
+  } catch (e) {
+    process.stderr.write(err(`apx image: ${e.message}`) + "\n");
+    process.exitCode = 1;
+    return;
+  }
+  const quiet = !!flags.json;
+  if (!quiet) {
+    process.stderr.write(dim(`Generating… ${prompt.length > 60 ? prompt.slice(0, 60) + "…" : prompt}`) + "\n");
+  }
+
+  let result;
+  try {
+    result = await http.post("/api/images/generate", body);
+  } catch (e) {
+    process.stderr.write(err(`apx image: ${e.message}`) + "\n");
+    process.exitCode = 1;
+    return;
+  }
+
+  const images = result.images || [];
+  const written = images.map((img, i) =>
+    (flags.out ? copyOut(img.path, String(flags.out), i, images.length) : img.path));
+
+  if (flags.json) {
+    process.stdout.write(JSON.stringify({ ...result, written }, null, 2) + "\n");
+  } else {
+    for (const file of written) process.stdout.write(file + "\n");
+    const secs = (result.elapsed_ms / 1000).toFixed(1);
+    const bits = [
+      result.provider,
+      result.meta?.mode && result.meta.mode !== "txt2img" ? result.meta.mode : null,
+      result.model || null,
+      `${result.request?.width}x${result.request?.height}`,
+      images[0]?.seed != null ? `seed ${images[0].seed}` : null,
+      formatBytes(images[0]?.bytes),
+      `${secs}s`,
+    ].filter(Boolean);
+    process.stderr.write(dim(`  ${bits.join(" · ")}`) + "\n");
+    // Say what the engine could not honor — a silently ignored --steps is the
+    // difference between "this looks wrong" and "that engine has no steps".
+    if (result.ignored?.length) {
+      process.stderr.write(
+        warn(`  ${result.provider} ignored: ${result.ignored.join(", ")}`) + "\n"
+      );
+    }
+  }
+
+  if (flags.open) written.forEach(openFile);
+}

package/src/interfaces/cli/commands/mcp.js

@@ -69,35 +69,97 @@ export async function cmdMcpList(args = {}) {
   }
 }
 
+// A flag that was given without a value parses as `true`. For value-carrying
+// flags that means "the user typed --url with nothing after it" — not a value.
+function flagValue(v) {
+  return v === undefined || v === true ? null : String(v);
+}
+
+// `--header "Authorization: Bearer xxx"` and `--header X-Api-Key=abc` both work:
+// we split on whichever of `:` / `=` comes first, so a value may contain either.
+function parseHeaders(raw) {
+  const headers = {};
+  for (const h of Array.isArray(raw) ? raw : [raw]) {
+    const s = String(h);
+    const cuts = [s.indexOf(":"), s.indexOf("=")].filter((i) => i >= 0);
+    if (cuts.length === 0) {
+      throw new Error(`apx mcp add: bad --header "${s}" (use "Name: value" or Name=value)`);
+    }
+    const cut = Math.min(...cuts);
+    const key = s.slice(0, cut).trim();
+    if (!key) throw new Error(`apx mcp add: bad --header "${s}" (empty header name)`);
+    headers[key] = s.slice(cut + 1).trim();
+  }
+  return headers;
+}
+
+function parseEnv(raw) {
+  const env = {};
+  for (const e of Array.isArray(raw) ? raw : [raw]) {
+    const [k, ...rest] = String(e).split("=");
+    env[k] = rest.join("=");
+  }
+  return env;
+}
+
 export async function cmdMcpAdd(args) {
   const name = args._[0];
   if (!name) throw new Error("apx mcp add: missing <name>");
-  const command = args.flags.command;
-  if (!command || command === true) throw new Error("apx mcp add: --command required");
 
-  // Args after `--` go to the MCP. `args._` already excludes the `--` separator
-  // when our parser strips it. We treat anything in args._ after [0] as args.
-  const mcpArgs = args._.slice(1);
+  const command = flagValue(args.flags.command);
+  const url = flagValue(args.flags.url);
 
-  const env = {};
-  if (args.flags.env) {
-    const entries = Array.isArray(args.flags.env) ? args.flags.env : [args.flags.env];
-    for (const e of entries) {
-      const [k, ...rest] = String(e).split("=");
-      env[k] = rest.join("=");
-    }
+  // --transport is sugar; the real signal is --url (http) vs --command (stdio).
+  // We only read it to reject a contradictory pair with a useful message.
+  const declared = flagValue(args.flags.transport)?.toLowerCase() || null;
+  if (declared && !["stdio", "http", "sse", "streamable-http"].includes(declared)) {
+    throw new Error(`apx mcp add: unknown --transport "${declared}" (use stdio|http)`);
+  }
+  const transport = declared === "stdio" ? "stdio" : declared ? "http" : url ? "http" : "stdio";
+
+  if (command && url) {
+    throw new Error("apx mcp add: pass either --command (stdio) or --url (http), not both");
+  }
+  if (transport === "http" && !url) {
+    throw new Error("apx mcp add: --transport http requires --url <endpoint>");
+  }
+  if (transport === "stdio" && !command) {
+    throw new Error(
+      "apx mcp add: --command required for a stdio server (for a remote one: --url <endpoint>)"
+    );
+  }
+  if (args.flags.header && transport !== "http") {
+    throw new Error("apx mcp add: --header only applies to an http server (--url)");
   }
 
   const scope = resolveWriteScope(args.flags);
   const pid = await resolveProjectId(args?.flags?.project);
-  const result = await http.post(`/api/projects/${pid}/mcps?scope=${encodeURIComponent(scope)}`, {
-    name,
-    command,
-    args: mcpArgs,
-    env,
-    enabled: true,
-  });
-  console.log(`Added MCP "${result.name}" (scope: ${scope})`);
+
+  let body;
+  if (transport === "http") {
+    body = {
+      name,
+      url,
+      ...(args.flags.header ? { headers: parseHeaders(args.flags.header) } : {}),
+      enabled: true,
+    };
+  } else {
+    // Args after `--` go to the MCP. `args._` already excludes the `--` separator
+    // when our parser strips it. We treat anything in args._ after [0] as args.
+    body = {
+      name,
+      command,
+      args: args._.slice(1),
+      env: args.flags.env ? parseEnv(args.flags.env) : {},
+      enabled: true,
+    };
+  }
+
+  const result = await http.post(
+    `/api/projects/${pid}/mcps?scope=${encodeURIComponent(scope)}`,
+    body
+  );
+  console.log(`Added MCP "${result.name}" (${transport}, scope: ${scope})`);
 }
 
 export async function cmdMcpRemove(args) {
@@ -132,11 +194,13 @@ async function toggleEnabled(args, enabled) {
       `MCP "${name}" comes from foreign source "${m.source}" — toggle it in that IDE's config directly.`
     );
   }
+  // Re-post only the keys that belong to this server's transport — sending
+  // `command: null` at an http entry would write a stdio field into it.
   await http.post(`/api/projects/${pid}/mcps?scope=${encodeURIComponent(scope)}`, {
     name: m.name,
-    command: m.command,
-    args: m.args,
-    env: m.env,
+    ...(m.transport === "http"
+      ? { url: m.url, headers: m.headers || {} }
+      : { command: m.command, args: m.args, env: m.env }),
     enabled,
   });
   console.log(`${enabled ? "Enabled" : "Disabled"} MCP "${name}"`);

package/src/interfaces/cli/commands/memory.js

@@ -1,10 +1,12 @@
 import fs from "node:fs";
 import { findApfRoot } from "#core/apc/parser.js";
-import { agentMemoryPath, readAgentMemory, writeAgentMemory, ensureAgentRuntimeDir } from "#core/agent/memory.js";
+import { agentMemoryPath, readAgentMemory, writeAgentMemory, appendAgentMemory } from "#core/agent/memory.js";
 import { http } from "../http.js";
+import { readStdinSync } from "../stdin.js";
 import {
   proposeConsolidation, applyConsolidation, revertConsolidation, notebookSize,
 } from "#core/memory/consolidate.js";
+import { pruneSelfMemory } from "#core/memory/prune.js";
 import { readSelfMemory } from "#core/agent/self-memory.js";
 
 function requireRoot() {
@@ -38,14 +40,7 @@ export async function cmdMemory(args) {
 
   if (args.flags.append && args.flags.append !== true) {
     const note = String(args.flags.append);
-    ensureAgentRuntimeDir(root, slug);
-    let body = readAgentMemory(root, slug);
-    if (!/##\s+Recent context/i.test(body)) {
-      body += body.endsWith("\n") ? "\n## Recent context\n" : "\n\n## Recent context\n";
-    }
-    const today = new Date().toISOString().slice(0, 10);
-    body = body.replace(/(##\s+Recent context\s*\n)/i, `$1- ${today}: ${note}\n`);
-    writeAgentMemory(root, slug, body);
+    appendAgentMemory(root, slug, note);
     await nudgeDaemon(root);
     console.log(`appended to ${slug} memory: ${note}`);
     return;
@@ -58,19 +53,6 @@ export async function cmdMemory(args) {
   process.stdout.write(body);
 }
 
-function readStdinSync() {
-  const chunks = [];
-  const buf = Buffer.alloc(65536);
-  try {
-    while (true) {
-      const bytes = fs.readSync(0, buf, 0, buf.length);
-      if (!bytes) break;
-      chunks.push(buf.slice(0, bytes).toString("utf8"));
-    }
-  } catch {}
-  return chunks.join("");
-}
-
 
 // ── The super-agent's own notebook (~/.apx/memory.md) ────────────────────────
 //
@@ -133,6 +115,37 @@ export async function cmdMemoryConsolidate(args) {
   console.log("\nUndo: apx memory revert");
 }
 
+/**
+ * apx memory prune [--apply] [--series N] [--threshold X]
+ *
+ * Collapse replicated notebook entries (daily routine chatter, the same fact
+ * saved twice), keeping the newest of each. Dry by default, same contract as
+ * consolidate: deleting from the file the agent believes about itself is not
+ * something to do silently. --apply writes, after a timestamped backup.
+ */
+export async function cmdMemoryPrune(args) {
+  const opts = { apply: args?.flags?.apply === true };
+  if (args?.flags?.series) opts.series_min = Number(args.flags.series);
+  if (args?.flags?.threshold) opts.near_dup = Number(args.flags.threshold);
+
+  const r = pruneSelfMemory(opts);
+  if (!r.removed.length) {
+    console.log("nothing replicated — the notebook is already clean.");
+    return;
+  }
+
+  console.log(`${r.applied ? "removed" : "would remove"} ${r.removed.length} replicated ${r.removed.length === 1 ? "entry" : "entries"} (keeping ${r.kept}):`);
+  for (const e of r.removed) {
+    const tag = e.channel && e.channel !== "memory" ? `[${e.channel}] ` : "";
+    console.log(`  - ${e.date || "????-??-??"} ${tag}${e.text.slice(0, 80)}`);
+  }
+  if (r.applied) {
+    console.log(`\nbackup: ${r.backup}`);
+  } else {
+    console.log("\nNothing was written. Add --apply to prune.");
+  }
+}
+
 export async function cmdMemoryRevert(args) {
   const { removed } = revertConsolidation(args?.flags?.since ? { since: String(args.flags.since) } : {});
   console.log(removed

package/src/interfaces/cli/commands/panel.js

@@ -10,11 +10,18 @@
 // /admin/web-token is loopback-only by design, so a phone cannot fetch it.
 import { readConfig, writeConfig, effectivePort, effectiveHost } from "#core/config/index.js";
 import { detectLanAddresses, validateBindHost, isLoopback, isWildcard } from "#core/net/lan.js";
+import {
+  disableTailscaleServe,
+  enableTailscaleServe,
+  tailscaleServe,
+  tailscaleStatus,
+} from "#core/net/tailscale.js";
 
 export const PANEL_USAGE = {
   status: "apx panel status",
   share: "apx panel share [--host <ip>]",
   unshare: "apx panel unshare",
+  tailscale: "apx panel tailscale <status|on|off>",
 };
 
 export async function cmdPanelStatus() {
@@ -121,3 +128,90 @@ export async function cmdPanelUnshare() {
   console.log(`  Was ${was}. Nothing on your network can reach it now.`);
   console.log("  Restart the daemon to apply: apx restart");
 }
+
+
+// ── Tailscale ────────────────────────────────────────────────────────────────
+//
+// `share` and this are not two flavours of the same thing. Sharing binds a LAN
+// address: fast and private, and gone the moment the phone leaves the house.
+// Tailscale gives the daemon a name that works from anywhere, and `serve` puts
+// a real HTTPS certificate in front of it.
+//
+// That certificate is the point, not a nicety. A browser only grants a secure
+// context to https:// and localhost, and without one it switches off service
+// workers (so the panel cannot be installed as an app on Android), getUserMedia
+// (so no voice notes) and the clipboard. Over http://192.168.x.x those three
+// are off no matter what APX does.
+//
+// `serve` is reachable only from devices signed into the same tailnet. It is
+// NOT `funnel`, which would put the panel on the public internet; nothing here
+// offers that.
+
+export async function cmdPanelTailscaleStatus() {
+  const port = effectivePort(readConfig());
+  const ts = await tailscaleStatus();
+
+  if (!ts.installed) {
+    console.log("tailscale: not installed on this machine");
+    console.log("  https://tailscale.com/download");
+    return;
+  }
+  if (!ts.running) {
+    console.log(`tailscale: installed but not connected (state: ${ts.state || "unknown"})`);
+    console.log("  Sign in from the Tailscale app, then run this again.");
+    return;
+  }
+
+  console.log(`tailscale: connected as ${ts.dnsName || ts.hostname || ts.ipv4}`);
+  console.log(`  Tailnet address:  http://${ts.ipv4}:${port}`);
+
+  const serve = await tailscaleServe(port);
+  if (serve.serving && serve.url) {
+    console.log(`  Published HTTPS:  ${serve.url}`);
+    console.log("");
+    console.log("  Install the panel from that URL: it is the only address here that a");
+    console.log("  browser will treat as secure, which is what installing as an app, the");
+    console.log("  microphone and the clipboard all depend on.");
+    console.log("  Stop publishing: apx panel tailscale off");
+  } else {
+    console.log("  Not published over HTTPS yet: apx panel tailscale on");
+    if (serve.error) console.log(`  (serve status said: ${serve.error})`);
+  }
+}
+
+export async function cmdPanelTailscaleOn() {
+  const port = effectivePort(readConfig());
+  try {
+    const out = await enableTailscaleServe(port);
+    if (out.serving && out.url) {
+      console.log(`panel published on your tailnet — ${out.url}`);
+      console.log("");
+      console.log("  Only devices signed into the same tailnet can reach it. This is");
+      console.log("  `serve`, not `funnel`: nothing is exposed to the public internet.");
+      console.log("");
+      console.log("  Open that URL on the phone and pair it there (Settings → Devices).");
+      console.log("  Installing the app from it also gets you the microphone.");
+    } else {
+      console.log("tailscale accepted the command but is not reporting a published URL yet.");
+      console.log("  Check again in a moment: apx panel tailscale status");
+    }
+  } catch (e) {
+    console.error(`apx panel tailscale on: ${e.message}`);
+    console.error("");
+    console.error("  HTTPS on a tailnet needs MagicDNS and HTTPS certificates enabled for");
+    console.error("  the tailnet, in the Tailscale admin console (DNS page).");
+    process.exit(1);
+  }
+}
+
+export async function cmdPanelTailscaleOff() {
+  const port = effectivePort(readConfig());
+  try {
+    await disableTailscaleServe(port);
+    console.log("panel is no longer published on your tailnet");
+    console.log("  The tailnet IP still reaches it; only the HTTPS name is gone.");
+  } catch (e) {
+    console.error(`apx panel tailscale off: ${e.message}`);
+    process.exit(1);
+  }
+}

package/src/interfaces/cli/commands/profile.js

@@ -4,6 +4,7 @@
 //   apx profile show <id>       [--preview]
 //   apx profile install <id|path> [--force]
 //   apx profile use <id>        [--force]
+//   apx profile sync
 //   apx profile off
 //   apx profile config          [--set k=v]... [--interactive]
 //   apx profile doctor          [<id>]
@@ -21,6 +22,7 @@ export const PROFILE_USAGE = {
   show:      "apx profile show <id> [--preview]",
   install:   "apx profile install <id|path> [--force]",
   use:       "apx profile use <id> [--force]",
+  sync:      "apx profile sync",
   off:       "apx profile off",
   config:    "apx profile config [--set key=value]... [--interactive]",
   doctor:    "apx profile doctor [<id>]",
@@ -145,6 +147,18 @@ export async function cmdProfileUse(args) {
   if (!r.profile.active) console.log("  (warning: profile did not activate)");
 }
 
+export async function cmdProfileSync(args) {
+  const r = await http.post("/api/profiles/sync", { id: args?.flags?.profile || null });
+
+  const { installed = [], skipped = [] } = r.routines || {};
+  console.log(`profile "${r.id}"${r.version ? ` v${r.version}` : ""} re-read from disk`);
+  if (installed.length) console.log(`  routines refreshed: ${installed.join(", ")}`);
+  else console.log("  no routines to refresh");
+  for (const s of skipped) {
+    console.log(`  routine "${s.name}" left alone (${s.reason.replace(/_/g, " ")})`);
+  }
+}
+
 export async function cmdProfileOff() {
   const r = await http.post("/api/profiles/off", {});
   if (!r.was) {