refactor(api): make agents canonical

[chocobar]

Summary

• make Agent the canonical API model while retaining App as a deprecated source alias
• expose /api/v1/agents and retain /api/v1/apps as an undocumented runtime alias
• migrate Helix consumers and org links to canonical agent naming while preserving storage and wire compatibility

Tests

• go test ./pkg/org/... -count=1
• targeted server, DTO, and GORM tests
• go build ./pkg/server/ ./pkg/store/ ./pkg/types/ ./pkg/cli/spectask/
• yarn tsc --noEmit
• yarn build
• deployed to Prime at fc9eacf

[chocobar]

🔐 CodeQL Security Alert

The CodeQL check completed but flagged 1 medium severity security vulnerability:

File	Line	Issue
api/pkg/org/infrastructure/runtime/helix/spawner.go	409	Log entries created from user input

Details

The flagged line:

c.Logger.Warn("helix spawner: attach helix-org MCP", "worker", workerID, "agent", state.AgentID, "err", err)

CodeQL detected that err (and possibly state.AgentID) originates from user-provided input and is being logged directly. This can lead to:

• Log injection attacks where malicious input manipulates log formatting
• Log forging that can confuse log analysis tools or hide malicious activity

Suggested Fix

Sanitize user-controlled values before logging, or use structured logging that escapes special characters automatically. For example:

c.Logger.Warn("helix spawner: attach helix-org MCP", 
    "worker", workerID, 
    "agent", sanitize(state.AgentID), 
    "err", err.Error())  // Use .Error() string rather than raw error

Alternatively, if the logging framework already handles structured key-value pairs safely, you may be able to suppress this warning with a CodeQL annotation if you've verified it's a false positive.

View full CodeQL report