The createApp function in src/api/app.ts wires five method groups (turn, session, messaging, deployment, skill) into an App object via factory functions, passing a circular reference through helpers before methods attach. Routes split into rawRoutes (unauthenticated: health, git-HTTP broker, blobs, session) and apiRoutes (authenticated: turns, credentials, keychain, skill packs); capability auth uses the x-agent-capability header. The portal plugin in plugins/portal/src/index.ts retries admin health and probe requests on transient failures rather than immediately surfacing errors to callers. Tests in plugins/portal/test/proxy-errors.test.ts define which error classes are treated as transient and therefore eligible for retry in the portal plugin.
The createApp function in src/api/app.ts assembles the App object by composing five method groups — turn, session, messaging, deployment, and skill methods — each created by a dedicated factory.[1] Assembly works by first creating an empty app reference ({} as App) and passing it into the createAppHelpers and createAmbientHelpers factories before any methods are assigned, allowing circular references between helpers and the app itself.[1] src/api/agent-api-catalog.ts declares thread support for DMs, and src/api/app-messaging.ts integrates thread context into the message-routing layer during app assembly. The unscoped search backend injection point formerly in app-search.ts, app-types.ts, and wiring.ts has been removed; all search operations must now thread principal context through core-search.ts. A principal-scoped search abstraction in src/search/core-search.ts and src/search/backends.ts filters results by the calling principal's identity rather than returning global results.
The route registry in src/api/routes/index.ts is split into two arrays: rawRoutes (unauthenticated or credential-broker-scoped — health check, git-HTTP broker, connectors, deployments, blobs, session state) and apiRoutes (authenticated — turns, credentials, keychain, skill packs, surfaces, projects, crons, egress audit, auth broker, and others).[2] The /healthz endpoint is declared in rawRoutes with auth: "public" and responds with { ok: true } at HTTP 200.[2] The git-HTTP broker is mounted at GIT_HTTP_BROKER_PREFIX in rawRoutes and requires { aud: "credential-broker" } auth; it matches both GET and POST requests — as well as any other method — on that path prefix.[2] Direct-message conversations in src/api/routes/reach.ts and src/reach/reach.ts support threaded replies; reach routing directs DM replies to the originating thread rather than the top-level channel. src/types.ts carries schema definitions for thread context in direct messages; src/slack/deliveries.ts and reach-routing consumers depend on this schema for correct thread-aware delivery. The UI rendering layer in plugins/web-ui/src/ui.ts detects SVG MIME types and routes them to a download prompt rather than rendering them as <img> or inline SVG elements; SVG's ability to embed arbitrary script makes inline serving a security risk. plugins/web-ui/test/renderable-image-source.test.ts asserts that SVG MIME types are classified correctly and routed to the download prompt rather than any inline rendering path. The web shell in plugins/web-ui/src/shell.ts renders split panes, each with its own tab bar to support multi-pane tab management. The session list in plugins/web-ui/src/session-select.ts and src/sessions.ts supports multi-select to enable bulk operations across sessions. Scroll position preservation across layout reflows for split panes is managed in plugins/web-ui/src/split.ts and src/conversations.ts. The miniapps (interactive web-thread playgrounds) feature has been fully reverted; route handlers, orchestrator hooks, Slack dispatch, client code, and seed skills for miniapps are absent from the codebase on the main branch. The search HTTP route is declared in src/api/routes/search.ts and wired into routes/index.ts and agent-api-catalog.ts for exposure via the agent API. OAuth connector flows store transient context (redirect targets, session metadata) server-side in src/connectors/oauth-flow-store.ts rather than embedding it in the state parameter; only an opaque reference is placed in state. Connector routes in src/api/routes/connectors.ts, src/api/deps.ts, and src/wiring.ts use the oauth-flow-store abstraction to persist per-flow OAuth context.
The capability authentication header name is "x-agent-capability", exported as CAPABILITY_HEADER from src/api/contract.ts.[3] keychainUseCommand in src/api/contract.ts accepts either a { grant: string } or { credential: string } reference, serializing each to a distinct JSON body for the keychain API.[3] The command it generates POSTs to $AGENT_API_URL/v1/keychain/use with the capability token via curl, then sources the response into the shell environment with . /tmp/keychain.env.[3]
Sources