amalgm 0.0.0 → 0.0.1

package/README.md

@@ -1,7 +1,43 @@
 # amalgm
 
-The public Amalgm CLI is in canary testing. Install the current test build with:
+Install the local Amalgm computer runtime:
 
 ```sh
 npm i -g amalgm@canary
+amalgm login
+amalgm doctor
+amalgm start
 ```
+
+`amalgm login` opens a browser approval page, then registers the machine and stores its local tunnel/computer record in `~/.amalgm/computer.json`.
+
+If you start from the Amalgm web app or are setting up a remote/headless machine, create a setup code from the web app and run:
+
+```sh
+amalgm login --setup-code ABCD-EFGH-JKLM-NPQR
+```
+
+`amalgm doctor` checks the installed runtime, login record, required local ports, daemon state, and whether an HMAC proxy token is available.
+
+`amalgm start` runs the local essentials:
+
+- port monitor on `8081`
+- filesystem/auth watcher on `8082`
+- Amalgm MCP on `8083`
+- chat server on `8084`
+- events/previews/artifact tunnel to `wire.events.amalgm.ai`
+- chat tunnel to `amalgm-chat-gateway`
+
+The npm supervisor binds local services to `127.0.0.1` by default and connects them outward through the registered Amalgm tunnels. For development without cloud registration, use `amalgm start --local-only`.
+
+Useful commands:
+
+```sh
+amalgm status
+amalgm logs
+amalgm logs chat-server
+amalgm stop
+amalgm logout
+```
+
+The runtime in `runtime/` is generated from `amalgm-engine/runtime` during `prepack`, so Electron and the published npm package use the same machine-runtime tree. Local services require an unguessable runtime token for non-health endpoints, and proxy tokens are refreshed through the registered computer credential.

package/bin/amalgm.js

@@ -1,5 +1,11 @@
 #!/usr/bin/env node
 'use strict';
 
-console.error('The Amalgm CLI is in canary testing. Install it with: npm i -g amalgm@canary');
-process.exit(1);
+require('../lib/cli').main(process.argv).catch((error) => {
+  const message = error && error.message ? error.message : String(error);
+  console.error(`Error: ${message}`);
+  if (process.env.AMALGM_DEBUG && error && error.stack) {
+    console.error(error.stack);
+  }
+  process.exit(1);
+});

package/lib/auth-store.js

@@ -0,0 +1,223 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const {
+  AUTH_FILE,
+  COMPUTER_FILE,
+} = require('./paths');
+
+const PROXY_REFRESH_BUFFER_MS = 10 * 60 * 1000;
+
+const SECRET_COMPUTER_KEYS = new Set([
+  'tunnel_token',
+  'computer_auth_token',
+  'proxy_token',
+  'proxy_token_expires_in',
+  'proxy_token_expires_at',
+  'proxy_token_refreshed_at',
+  'proxyToken',
+  'proxyTokenExpiresAt',
+  'hmac_token',
+  'hmacToken',
+]);
+
+function ensureDir(dir, mode = 0o700) {
+  fs.mkdirSync(dir, { recursive: true, mode });
+  try {
+    fs.chmodSync(dir, mode);
+  } catch {
+    // chmod is best-effort on non-POSIX filesystems.
+  }
+}
+
+function readJson(file, fallback = null) {
+  try {
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    return fallback;
+  }
+}
+
+function writeJsonSecret(file, data) {
+  ensureDir(path.dirname(file), 0o700);
+  const temp = `${file}.${process.pid}.tmp`;
+  fs.writeFileSync(temp, `${JSON.stringify(data, null, 2)}\n`, { mode: 0o600 });
+  fs.renameSync(temp, file);
+  try {
+    fs.chmodSync(file, 0o600);
+  } catch {
+    // chmod is best-effort on non-POSIX filesystems.
+  }
+}
+
+function cleanString(value) {
+  return typeof value === 'string' && value.trim() ? value.trim() : '';
+}
+
+function hasComputerSecrets(record) {
+  if (!record || typeof record !== 'object') return false;
+  return Array.from(SECRET_COMPUTER_KEYS).some((key) => cleanString(record[key]));
+}
+
+function publicComputerRecord(record) {
+  const out = {
+    ...(record || {}),
+    auth_file: path.basename(AUTH_FILE),
+  };
+  for (const key of SECRET_COMPUTER_KEYS) delete out[key];
+  return out;
+}
+
+function authFromRecord(record, existing = null) {
+  const now = new Date().toISOString();
+  const auth = {
+    schema_version: 1,
+    ...(existing && typeof existing === 'object' ? existing : {}),
+    updated_at: now,
+  };
+
+  for (const key of ['computer_id', 'device_id', 'user_id', 'app_url']) {
+    const value = cleanString(record?.[key]);
+    if (value) auth[key] = value;
+  }
+
+  const tunnelToken = cleanString(record?.tunnel_token);
+  if (tunnelToken) {
+    auth.tunnel = {
+      ...(auth.tunnel && typeof auth.tunnel === 'object' ? auth.tunnel : {}),
+      token: tunnelToken,
+      url: cleanString(record?.tunnel_url) || cleanString(auth.tunnel?.url),
+      chat_tunnel_url: cleanString(record?.chat_tunnel_url) || cleanString(auth.tunnel?.chat_tunnel_url),
+      updated_at: now,
+    };
+  } else if (record?.tunnel_url || record?.chat_tunnel_url) {
+    auth.tunnel = {
+      ...(auth.tunnel && typeof auth.tunnel === 'object' ? auth.tunnel : {}),
+      url: cleanString(record?.tunnel_url) || cleanString(auth.tunnel?.url),
+      chat_tunnel_url: cleanString(record?.chat_tunnel_url) || cleanString(auth.tunnel?.chat_tunnel_url),
+    };
+  }
+
+  const computerAuthToken = cleanString(record?.computer_auth_token);
+  if (computerAuthToken) {
+    auth.machine = {
+      ...(auth.machine && typeof auth.machine === 'object' ? auth.machine : {}),
+      token: computerAuthToken,
+      updated_at: now,
+    };
+  }
+
+  const proxyToken = (
+    cleanString(record?.proxy_token)
+    || cleanString(record?.proxyToken)
+    || cleanString(record?.hmac_token)
+    || cleanString(record?.hmacToken)
+  );
+  if (proxyToken) {
+    auth.proxy = {
+      ...(auth.proxy && typeof auth.proxy === 'object' ? auth.proxy : {}),
+      token: proxyToken,
+      expires_in: Number(record?.proxy_token_expires_in || auth.proxy?.expires_in || 0) || undefined,
+      expires_at: cleanString(record?.proxy_token_expires_at)
+        || cleanString(record?.proxyTokenExpiresAt)
+        || cleanString(auth.proxy?.expires_at),
+      refreshed_at: cleanString(record?.proxy_token_refreshed_at)
+        || cleanString(auth.proxy?.refreshed_at)
+        || now,
+    };
+  }
+
+  return auth;
+}
+
+function mergeRecordAuth(record, auth) {
+  if (!record || typeof record !== 'object') return null;
+  const merged = { ...record };
+  if (!auth || typeof auth !== 'object') return merged;
+
+  const authComputerId = cleanString(auth.computer_id);
+  const recordComputerId = cleanString(record.computer_id);
+  if (authComputerId && recordComputerId && authComputerId !== recordComputerId) return merged;
+
+  if (!merged.tunnel_token) merged.tunnel_token = cleanString(auth.tunnel?.token) || cleanString(auth.tunnel_token);
+  if (!merged.tunnel_url) merged.tunnel_url = cleanString(auth.tunnel?.url);
+  if (!merged.chat_tunnel_url) merged.chat_tunnel_url = cleanString(auth.tunnel?.chat_tunnel_url);
+  if (!merged.computer_auth_token) {
+    merged.computer_auth_token = cleanString(auth.machine?.token) || cleanString(auth.computer_auth_token);
+  }
+  if (!merged.proxy_token) {
+    merged.proxy_token = cleanString(auth.proxy?.token) || cleanString(auth.proxy_token);
+  }
+  if (!merged.proxy_token_expires_at) {
+    merged.proxy_token_expires_at = cleanString(auth.proxy?.expires_at) || cleanString(auth.proxy_token_expires_at);
+  }
+  if (!merged.proxy_token_expires_in && auth.proxy?.expires_in) {
+    merged.proxy_token_expires_in = auth.proxy.expires_in;
+  }
+  if (!merged.proxy_token_refreshed_at) {
+    merged.proxy_token_refreshed_at = cleanString(auth.proxy?.refreshed_at);
+  }
+  if (!merged.user_id) merged.user_id = cleanString(auth.user_id);
+  if (!merged.app_url) merged.app_url = cleanString(auth.app_url);
+  return merged;
+}
+
+function loadComputerRecord(options = {}) {
+  const record = readJson(COMPUTER_FILE, null);
+  if (!record || typeof record !== 'object') return null;
+  const auth = readJson(AUTH_FILE, null);
+  const merged = mergeRecordAuth(record, auth);
+  if (options.migrate && hasComputerSecrets(record)) {
+    saveComputerRecord(merged);
+  }
+  return merged;
+}
+
+function saveComputerRecord(record) {
+  const existingAuth = readJson(AUTH_FILE, null);
+  const nextAuth = authFromRecord(record, existingAuth);
+  const nextRecord = publicComputerRecord(record);
+  writeJsonSecret(COMPUTER_FILE, nextRecord);
+  writeJsonSecret(AUTH_FILE, nextAuth);
+  return mergeRecordAuth(nextRecord, nextAuth);
+}
+
+function deleteComputerAuth() {
+  for (const file of [COMPUTER_FILE, AUTH_FILE]) {
+    try {
+      fs.unlinkSync(file);
+    } catch {
+      // noop
+    }
+  }
+}
+
+function proxyTokenFromRecord(record) {
+  return (
+    cleanString(process.env.AMALGM_PROXY_TOKEN)
+    || cleanString(record?.proxy_token)
+    || cleanString(record?.proxyToken)
+    || cleanString(record?.hmac_token)
+    || cleanString(record?.hmacToken)
+  );
+}
+
+function proxyTokenNeedsRefresh(record) {
+  if (!proxyTokenFromRecord(record)) return true;
+  const expiresAt = Date.parse(record?.proxy_token_expires_at || record?.proxyTokenExpiresAt || '');
+  if (!Number.isFinite(expiresAt)) return false;
+  return expiresAt - Date.now() < PROXY_REFRESH_BUFFER_MS;
+}
+
+module.exports = {
+  AUTH_FILE,
+  COMPUTER_FILE,
+  deleteComputerAuth,
+  hasComputerSecrets,
+  loadComputerRecord,
+  proxyTokenFromRecord,
+  proxyTokenNeedsRefresh,
+  saveComputerRecord,
+};