amalgm 0.0.0 → 0.0.1

package/runtime/scripts/amalgm-mcp/events/ingress.js

@@ -0,0 +1,113 @@
+/**
+ * /events — webhook ingress.
+ *
+ * Accepts raw POST body, requires a verified signature, and on a hit fires an
+ * agent run via events/executor.js and returns 200 with
+ * `{ ok, event, triggered }`.
+ */
+
+const {
+  extractSignature,
+  matchBySignature,
+  pickSourceLabel,
+  collectPassthroughHeaders,
+} = require('./matcher');
+const { loadEventTriggers, saveEventTriggers } = require('./store');
+const { executeArtifactEvent } = require('./executor');
+const ring = require('./ring-buffer');
+
+/**
+ * Read the raw request body as a string.
+ */
+async function readRawBody(req) {
+  return new Promise((resolve) => {
+    let data = '';
+    req.on('data', (chunk) => {
+      data += chunk;
+    });
+    req.on('end', () => resolve(data));
+  });
+}
+
+/**
+ * Handle a POST /events request. Assumes CORS + method checking has already
+ * happened. Writes the response via `sendJson`.
+ *
+ * @param req - IncomingMessage
+ * @param sendJson - (status, body) => void
+ */
+async function handleEventsPost(req, sendJson) {
+  const rawBody = await readRawBody(req);
+  const signature = extractSignature(req.headers);
+  if (!signature) {
+    console.warn('[AmalgmMCP:Events] Rejected unsigned event request');
+    return sendJson(401, { error: 'Webhook signature required' });
+  }
+
+  const triggerData = loadEventTriggers();
+  const matchedTrigger = matchBySignature(triggerData.triggers, signature, rawBody);
+  if (!matchedTrigger) {
+    console.warn('[AmalgmMCP:Events] No trigger matched the webhook signature');
+    return sendJson(401, { error: 'Invalid webhook signature — no matching trigger' });
+  }
+
+  const githubEvent = req.headers['x-github-event'];
+  // GitHub webhook handshake: acknowledge verified ping events immediately.
+  if (githubEvent === 'ping') {
+    console.log('[AmalgmMCP:Events] GitHub ping — pong');
+    return sendJson(200, { ok: true, message: 'pong' });
+  }
+
+  const eventHeaders = collectPassthroughHeaders(req.headers);
+
+  let parsedBody;
+  try {
+    parsedBody = JSON.parse(rawBody);
+  } catch {
+    parsedBody = rawBody;
+  }
+
+  console.log(`[AmalgmMCP:Events] Matched trigger "${matchedTrigger.name}" (${matchedTrigger.id})`);
+
+  const eventObj = {
+    source: pickSourceLabel(req.headers),
+    event:
+      githubEvent ||
+      req.headers['x-linear-event'] ||
+      req.headers['x-gitlab-event'] ||
+      'webhook',
+    payload: parsedBody,
+    headers: eventHeaders,
+    timestamp: new Date().toISOString(),
+  };
+  ring.push(eventObj);
+
+  const eventDef = {
+    name: matchedTrigger.name,
+    description: matchedTrigger.name,
+    agent_prompt: matchedTrigger.agent_prompt,
+    harness: matchedTrigger.harness,
+    model: matchedTrigger.model,
+    authMethod: matchedTrigger.authMethod,
+    chatInput: matchedTrigger.chatInput,
+  };
+  const syntheticArtifact = { id: matchedTrigger.id, name: matchedTrigger.name };
+  const fullPayload = { body: parsedBody, headers: eventHeaders };
+
+  executeArtifactEvent(syntheticArtifact, eventDef, fullPayload, {
+    triggerId: matchedTrigger.id,
+    projectPath: matchedTrigger.projectPath,
+  }).catch((err) => {
+    console.error(
+      `[AmalgmMCP:Events] Trigger agent run failed for "${matchedTrigger.name}":`,
+      err.message,
+    );
+  });
+
+  matchedTrigger.lastFiredAt = new Date().toISOString();
+  saveEventTriggers(triggerData);
+
+  return sendJson(200, { ok: true, event: eventObj, triggered: true });
+}
+
+module.exports = { handleEventsPost };

package/runtime/scripts/amalgm-mcp/events/matcher.js

@@ -0,0 +1,125 @@
+/**
+ * Signed event matching.
+ *
+ * Every inbound event sender must authenticate with the shared secret attached
+ * to its trigger. We support HMAC-SHA256 headers for generic/GitHub-style
+ * senders and direct secret comparison for simple custom/GitLab-style senders.
+ *
+ * Pure logic — no I/O, no side effects.
+ */
+
+const crypto = require('crypto');
+
+const HMAC_SIGNATURE_HEADERS = [
+  'x-webhook-signature',
+  'x-hub-signature-256',
+  'x-hub-signature',
+];
+
+const TOKEN_HEADERS = [
+  'x-amalgm-webhook-secret',
+  'x-webhook-secret',
+  'x-gitlab-token',
+];
+
+/**
+ * Extract the first supported auth header present.
+ */
+function extractSignature(headers) {
+  for (const h of HMAC_SIGNATURE_HEADERS) {
+    if (headers[h]) return { header: h, value: headers[h] };
+  }
+
+  const authorization = headers.authorization;
+  if (typeof authorization === 'string') {
+    const match = authorization.match(/^Bearer\s+(.+)$/i);
+    if (match) return { header: 'authorization', value: match[1] };
+  }
+
+  for (const h of TOKEN_HEADERS) {
+    if (headers[h]) return { header: h, value: headers[h] };
+  }
+  return null;
+}
+
+/**
+ * Compute the expected `sha256=<hex>` HMAC over `rawBody` using `secret`.
+ */
+function computeSignature(secret, rawBody) {
+  return 'sha256=' + crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
+}
+
+/**
+ * Return the trigger whose secret verifies the provided auth proof, or null.
+ */
+function matchBySignature(triggers, signature, rawBody) {
+  if (!signature || typeof signature.value !== 'string') return null;
+
+  for (const trigger of triggers) {
+    if (!trigger.enabled || !trigger.secret) continue;
+    if (
+      signature.header === 'authorization'
+      || TOKEN_HEADERS.includes(signature.header)
+    ) {
+      if (timingSafeEqual(signature.value, trigger.secret)) return trigger;
+      continue;
+    }
+
+    const expected = computeSignature(trigger.secret, rawBody);
+    if (timingSafeEqual(signature.value, expected)) return trigger;
+  }
+  return null;
+}
+
+/**
+ * Timing-safe string compare that doesn't throw on length mismatch.
+ */
+function timingSafeEqual(a, b) {
+  if (typeof a !== 'string' || typeof b !== 'string') return false;
+  const ab = Buffer.from(a);
+  const bb = Buffer.from(b);
+  if (ab.length !== bb.length) return false;
+  return crypto.timingSafeEqual(ab, bb);
+}
+
+/**
+ * Pick a human-readable source label from webhook headers.
+ */
+function pickSourceLabel(headers) {
+  if (headers['x-github-event']) return 'github';
+  if (headers['stripe-signature']) return 'stripe';
+  if (headers['x-linear-event']) return 'linear';
+  if (headers['x-gitlab-event']) return 'gitlab';
+  return 'external';
+}
+
+/**
+ * Headers worth passing through to the agent run context.
+ */
+const PASSTHROUGH_HEADERS = [
+  'x-github-event',
+  'x-github-delivery',
+  'x-hub-signature-256',
+  'x-hub-signature',
+  'stripe-signature',
+  'x-webhook-signature',
+  'content-type',
+  'x-linear-event',
+  'x-linear-signature',
+  'x-gitlab-event',
+  'x-gitlab-token',
+];
+
+function collectPassthroughHeaders(reqHeaders) {
+  const out = {};
+  for (const h of PASSTHROUGH_HEADERS) if (reqHeaders[h]) out[h] = reqHeaders[h];
+  return out;
+}
+
+module.exports = {
+  extractSignature,
+  computeSignature,
+  matchBySignature,
+  pickSourceLabel,
+  collectPassthroughHeaders,
+};

package/runtime/scripts/amalgm-mcp/events/rest.js

@@ -0,0 +1,200 @@
+/**
+ * /event-triggers/* REST routes for the Next.js API to call.
+ * Not part of the MCP tool surface — used by the internal UI.
+ */
+
+const crypto = require('crypto');
+const { loadEventTriggers, saveEventTriggers } = require('./store');
+const { getWebhookUrl } = require('./webhook-url');
+const {
+  chatInputToLegacyFields,
+  getChatInputText,
+  normalizeChatInput,
+} = require('../../../lib/chatInput');
+const {
+  DEFAULT_SELECTED_MODELS,
+  getSelectedModel,
+  hydrateModelPreferences,
+} = require('../lib/prefs');
+const credentialAdapter = require('../../credential-adapter');
+
+function resolveEventHarness(harness, chatInput) {
+  return (
+    (chatInput && chatInput.agent && typeof chatInput.agent.harness === 'string' && chatInput.agent.harness)
+    || (typeof harness === 'string' && harness)
+    || 'claude_code'
+  );
+}
+
+function resolveEventModel(harness, model) {
+  if (typeof model === 'string' && model) return model;
+  return getSelectedModel(harness) || DEFAULT_SELECTED_MODELS[harness] || null;
+}
+
+function resolveEventAuthMethod(harness, authMethod) {
+  if (typeof authMethod === 'string' && authMethod) return authMethod;
+  if (credentialAdapter.VALID_HARNESS_IDS.includes(harness)) {
+    return credentialAdapter.getPersistedAuthMode(harness);
+  }
+  return 'amalgm';
+}
+
+function buildEventChatInput(fields, existing = null) {
+  if (fields.chatInput) return fields.chatInput;
+
+  const existingNonTextParts =
+    existing && existing.chatInput && Array.isArray(existing.chatInput.parts)
+      ? existing.chatInput.parts.filter((part) => part.type !== 'text')
+      : [];
+
+  return {
+    ...(existing && existing.chatInput ? existing.chatInput : {}),
+    parts: [
+      ...existingNonTextParts,
+      ...((typeof fields.agent_prompt === 'string' && fields.agent_prompt)
+        ? [{ type: 'text', text: fields.agent_prompt }]
+        : []),
+    ],
+    agent: {
+      ...((existing && existing.chatInput && existing.chatInput.agent) || {}),
+      ...(fields.harness ? { harness: fields.harness } : {}),
+      ...(fields.model ? { model: fields.model } : {}),
+      ...(fields.authMethod ? { authMethod: fields.authMethod } : {}),
+    },
+    tools: (existing && existing.chatInput && existing.chatInput.tools) || { mcpAppIds: [] },
+    execution: {
+      ...((existing && existing.chatInput && existing.chatInput.execution) || {}),
+      ...(fields.projectPath !== undefined ? { cwd: fields.projectPath || null } : {}),
+    },
+  };
+}
+
+function normalizeEventTriggerRecord(triggerLike, existing = null) {
+  const rawChatInput = buildEventChatInput(triggerLike, existing);
+  const harness = resolveEventHarness(triggerLike.harness, rawChatInput);
+  const model = resolveEventModel(harness, triggerLike.model);
+  const authMethod = resolveEventAuthMethod(harness, triggerLike.authMethod);
+  const chatInput = normalizeChatInput(rawChatInput, {
+    prompt: triggerLike.agent_prompt,
+    harness,
+    modelId: model,
+    authMethod,
+    cwd: triggerLike.projectPath,
+    projectPath: triggerLike.projectPath,
+  });
+  const legacy = chatInputToLegacyFields(chatInput, {
+    prompt: triggerLike.agent_prompt,
+    harness,
+    modelId: model,
+    authMethod,
+    cwd: triggerLike.projectPath,
+    projectPath: triggerLike.projectPath,
+  });
+
+  return {
+    ...triggerLike,
+    chatInput,
+    agent_prompt: getChatInputText(chatInput, triggerLike.agent_prompt) || legacy.prompt,
+    harness: legacy.harness || harness,
+    model: legacy.modelId || model,
+    authMethod: legacy.authMethod || authMethod,
+    projectPath: legacy.cwd || triggerLike.projectPath || null,
+  };
+}
+
+async function handleList(req, sendJson) {
+  const data = loadEventTriggers();
+  sendJson(200, { triggers: data.triggers });
+}
+
+async function handleCreate(body, sendJson) {
+  const { name, description, source, event, agent_prompt, projectPath, harness, model, authMethod, chatInput } = body;
+  if (!name || !source || !event || (!agent_prompt && !chatInput)) {
+    return sendJson(400, { error: 'name, source, event, and agent_prompt or chatInput are required' });
+  }
+  await hydrateModelPreferences();
+  const data = loadEventTriggers();
+  const trigger = normalizeEventTriggerRecord({
+    id: crypto.randomUUID(),
+    name,
+    description: description || '',
+    source,
+    event,
+    agent_prompt: agent_prompt || null,
+    enabled: true,
+    webhookUrl: getWebhookUrl(),
+    secret: crypto.randomUUID().replace(/-/g, ''),
+    projectPath: projectPath || null,
+    harness: harness || null,
+    model: model || null,
+    authMethod: authMethod || null,
+    chatInput: chatInput || null,
+    createdAt: new Date().toISOString(),
+    lastFiredAt: null,
+  });
+  data.triggers.push(trigger);
+  saveEventTriggers(data);
+  console.log(`[AmalgmMCP:Events] Created event trigger: ${name} (${source}:${event})`);
+  sendJson(200, { ok: true, trigger });
+}
+
+async function handleUpdate(body, sendJson) {
+  const { trigger_id, ...updates } = body;
+  if (!trigger_id) return sendJson(400, { error: 'trigger_id is required' });
+  await hydrateModelPreferences();
+  const data = loadEventTriggers();
+  const trigger = data.triggers.find((t) => t.id === trigger_id);
+  if (!trigger) return sendJson(404, { error: 'Trigger not found' });
+  Object.assign(trigger, updates, { updatedAt: new Date().toISOString() });
+  if (
+    updates.chatInput === undefined
+    && (
+      updates.agent_prompt !== undefined
+      || updates.harness !== undefined
+      || updates.model !== undefined
+      || updates.authMethod !== undefined
+      || updates.projectPath !== undefined
+    )
+  ) {
+    const existingNonTextParts = Array.isArray(trigger.chatInput?.parts)
+      ? trigger.chatInput.parts.filter((part) => part.type !== 'text')
+      : [];
+    trigger.chatInput = {
+      ...(trigger.chatInput || {}),
+      parts: [
+        ...existingNonTextParts,
+        ...((typeof trigger.agent_prompt === 'string' && trigger.agent_prompt)
+          ? [{ type: 'text', text: trigger.agent_prompt }]
+          : []),
+      ],
+      agent: {
+        ...(trigger.chatInput?.agent || {}),
+        ...(trigger.harness ? { harness: trigger.harness } : {}),
+        ...(trigger.model ? { model: trigger.model } : {}),
+        ...(trigger.authMethod ? { authMethod: trigger.authMethod } : {}),
+      },
+      tools: trigger.chatInput?.tools || { mcpAppIds: [] },
+      execution: {
+        ...(trigger.chatInput?.execution || {}),
+        ...(updates.projectPath !== undefined ? { cwd: trigger.projectPath || null } : {}),
+      },
+    };
+  }
+  Object.assign(trigger, normalizeEventTriggerRecord(trigger, trigger));
+  saveEventTriggers(data);
+  console.log(`[AmalgmMCP:Events] Updated trigger: ${trigger_id}`);
+  sendJson(200, { ok: true, trigger });
+}
+
+async function handleDelete(body, sendJson) {
+  const { trigger_id } = body;
+  if (!trigger_id) return sendJson(400, { error: 'trigger_id is required' });
+  const data = loadEventTriggers();
+  const idx = data.triggers.findIndex((t) => t.id === trigger_id);
+  if (idx === -1) return sendJson(404, { error: 'Trigger not found' });
+  data.triggers.splice(idx, 1);
+  saveEventTriggers(data);
+  sendJson(200, { ok: true });
+}
+
+module.exports = { handleList, handleCreate, handleUpdate, handleDelete };

package/runtime/scripts/amalgm-mcp/events/ring-buffer.js

@@ -0,0 +1,19 @@
+/**
+ * In-memory event ring buffer (lost on restart, by design).
+ *
+ * Used for the "recent events" UI. Capped at MAX_EVENTS.
+ */
+
+const MAX_EVENTS = 200;
+const buffer = [];
+
+function push(event) {
+  buffer.push({ ...event, receivedAt: new Date().toISOString() });
+  if (buffer.length > MAX_EVENTS) buffer.shift();
+}
+
+function recent(limit = 50) {
+  return buffer.slice(-limit);
+}
+
+module.exports = { push, recent };

package/runtime/scripts/amalgm-mcp/events/store.js

@@ -0,0 +1,98 @@
+/**
+ * Event triggers storage — ~/.amalgm/event-triggers.json
+ */
+
+const { EVENT_TRIGGERS_FILE, STORAGE_DIR } = require('../config');
+const { ensureDir, readJson, writeJsonAtomic } = require('../lib/storage');
+const {
+  chatInputToLegacyFields,
+  getChatInputText,
+  normalizeChatInput,
+} = require('../../../lib/chatInput');
+const { DEFAULT_SELECTED_MODELS, getSelectedModel } = require('../lib/prefs');
+const credentialAdapter = require('../../credential-adapter');
+
+function normalizeStoredTrigger(trigger) {
+  const harness =
+    (trigger.chatInput && trigger.chatInput.agent && trigger.chatInput.agent.harness)
+    || trigger.harness
+    || 'claude_code';
+  const model =
+    (trigger.chatInput && trigger.chatInput.agent && trigger.chatInput.agent.model)
+    || trigger.model
+    || getSelectedModel(harness)
+    || DEFAULT_SELECTED_MODELS[harness]
+    || null;
+  const authMethod =
+    (trigger.chatInput && trigger.chatInput.agent && trigger.chatInput.agent.authMethod)
+    || trigger.authMethod
+    || (credentialAdapter.VALID_HARNESS_IDS.includes(harness)
+      ? credentialAdapter.getPersistedAuthMode(harness)
+      : 'amalgm');
+  const chatInput = normalizeChatInput(trigger.chatInput, {
+    prompt: trigger.agent_prompt,
+    harness,
+    modelId: model,
+    authMethod,
+    cwd: trigger.projectPath,
+    projectPath: trigger.projectPath,
+  });
+  const legacy = chatInputToLegacyFields(chatInput, {
+    prompt: trigger.agent_prompt,
+    harness,
+    modelId: model,
+    authMethod,
+    cwd: trigger.projectPath,
+    projectPath: trigger.projectPath,
+  });
+
+  return {
+    ...trigger,
+    chatInput,
+    agent_prompt: getChatInputText(chatInput, trigger.agent_prompt) || legacy.prompt,
+    harness: legacy.harness || harness,
+    model: legacy.modelId || model,
+    authMethod: legacy.authMethod || authMethod,
+    projectPath: legacy.cwd || trigger.projectPath || null,
+  };
+}
+
+function migrateTriggersData(data) {
+  let changed = false;
+  const triggers = Array.isArray(data.triggers)
+    ? data.triggers.map((trigger) => {
+        const normalizedTrigger = normalizeStoredTrigger(trigger);
+        if (JSON.stringify(normalizedTrigger) !== JSON.stringify(trigger)) {
+          changed = true;
+        }
+        return normalizedTrigger;
+      })
+    : [];
+
+  return {
+    changed,
+    data: { triggers },
+  };
+}
+
+function ensureTriggersDirs() {
+  ensureDir(STORAGE_DIR);
+  if (!readJson(EVENT_TRIGGERS_FILE, null)) {
+    writeJsonAtomic(EVENT_TRIGGERS_FILE, { triggers: [] });
+  }
+}
+
+function loadEventTriggers() {
+  const raw = readJson(EVENT_TRIGGERS_FILE, { triggers: [] });
+  const migrated = migrateTriggersData(raw);
+  if (migrated.changed) {
+    writeJsonAtomic(EVENT_TRIGGERS_FILE, migrated.data);
+  }
+  return migrated.data;
+}
+
+function saveEventTriggers(data) {
+  writeJsonAtomic(EVENT_TRIGGERS_FILE, data);
+}
+
+module.exports = { ensureTriggersDirs, loadEventTriggers, saveEventTriggers };