amalgm 0.0.0 → 0.0.1

package/runtime/scripts/runtime-auth.js

@@ -0,0 +1,163 @@
+'use strict';
+
+const crypto = require('crypto');
+
+const RUNTIME_TOKEN_HEADER = 'x-amalgm-runtime-token';
+
+function getRuntimeToken() {
+  return String(process.env.AMALGM_RUNTIME_TOKEN || '').trim();
+}
+
+function runtimeAuthRequired() {
+  if (process.env.AMALGM_RUNTIME_AUTH === 'disabled') return false;
+  return Boolean(
+    getRuntimeToken()
+      || process.env.AMALGM_RUNTIME_SOURCE === 'npm'
+      || process.env.AMALGM_LOCAL_MODE === 'true',
+  );
+}
+
+function safeEqual(a, b) {
+  const left = Buffer.from(String(a || ''));
+  const right = Buffer.from(String(b || ''));
+  return left.length === right.length && crypto.timingSafeEqual(left, right);
+}
+
+function headerValue(req, name) {
+  const raw = req?.headers?.[name.toLowerCase()];
+  if (Array.isArray(raw)) return raw[0] || '';
+  return typeof raw === 'string' ? raw : '';
+}
+
+function tokenFromProtocol(req) {
+  const raw = headerValue(req, 'sec-websocket-protocol');
+  for (const part of raw.split(',').map((value) => value.trim()).filter(Boolean)) {
+    if (part.startsWith('amalgm-runtime-token.')) {
+      return part.slice('amalgm-runtime-token.'.length);
+    }
+  }
+  return '';
+}
+
+function tokenFromRequest(req) {
+  const headerToken = headerValue(req, RUNTIME_TOKEN_HEADER);
+  if (headerToken) return headerToken;
+
+  const auth = headerValue(req, 'authorization');
+  const match = auth.match(/^Bearer\s+(.+)$/i);
+  if (match) return match[1].trim();
+
+  const protocolToken = tokenFromProtocol(req);
+  if (protocolToken) return protocolToken;
+
+  return '';
+}
+
+function isAuthorizedRuntimeRequest(req) {
+  if (!runtimeAuthRequired()) return true;
+  const expected = getRuntimeToken();
+  if (!expected) return false;
+  return safeEqual(tokenFromRequest(req), expected);
+}
+
+function isLoopbackOrigin(origin) {
+  if (!origin) return true;
+  try {
+    const url = new URL(origin);
+    return (
+      (url.protocol === 'http:' || url.protocol === 'https:')
+      && ['localhost', '127.0.0.1', '[::1]', '::1'].includes(url.hostname)
+    );
+  } catch {
+    return false;
+  }
+}
+
+function applyRuntimeCors(req, res, options = {}) {
+  const origin = headerValue(req, 'origin');
+  if (origin && isLoopbackOrigin(origin)) {
+    res.setHeader('Access-Control-Allow-Origin', origin);
+    res.setHeader('Vary', 'Origin');
+  }
+
+  res.setHeader('Access-Control-Allow-Methods', options.methods || 'GET, POST, DELETE, OPTIONS');
+  res.setHeader(
+    'Access-Control-Allow-Headers',
+    options.headers || [
+      'Content-Type',
+      'Authorization',
+      'Accept',
+      'Cache-Control',
+      'Last-Event-ID',
+      'Mcp-Session-Id',
+      'X-Amalgm-Session-Id',
+      'X-Daytona-Preview-Token',
+      RUNTIME_TOKEN_HEADER,
+    ].join(', '),
+  );
+  if (options.exposeHeaders) {
+    res.setHeader('Access-Control-Expose-Headers', options.exposeHeaders);
+  }
+}
+
+function pathnameFor(req) {
+  try {
+    return new URL(req.url || '/', 'http://127.0.0.1').pathname;
+  } catch {
+    return '/';
+  }
+}
+
+function isHealthPath(req) {
+  const pathname = pathnameFor(req);
+  return pathname === '/healthz' || pathname === '/';
+}
+
+function rejectUnauthorized(res) {
+  res.writeHead(401, {
+    'Content-Type': 'application/json',
+    'Cache-Control': 'no-store',
+  });
+  res.end(JSON.stringify({ error: 'Missing or invalid Amalgm runtime token' }));
+}
+
+function authorizeRuntimeHttp(req, res, options = {}) {
+  applyRuntimeCors(req, res, options);
+
+  if (req.method === 'OPTIONS') {
+    if (isLoopbackOrigin(headerValue(req, 'origin'))) {
+      res.writeHead(204);
+    } else {
+      res.writeHead(403);
+    }
+    res.end();
+    return false;
+  }
+
+  const pathname = pathnameFor(req);
+  const exemptPrefixes = options.exemptPrefixes || [];
+  const exempt = isHealthPath(req) || exemptPrefixes.some((prefix) => pathname.startsWith(prefix));
+  if (exempt || isAuthorizedRuntimeRequest(req)) return true;
+
+  rejectUnauthorized(res);
+  return false;
+}
+
+function runtimeAuthHeaders(headers = {}) {
+  const token = getRuntimeToken();
+  if (!token) return headers;
+  return {
+    ...headers,
+    [RUNTIME_TOKEN_HEADER]: token,
+  };
+}
+
+module.exports = {
+  RUNTIME_TOKEN_HEADER,
+  applyRuntimeCors,
+  authorizeRuntimeHttp,
+  getRuntimeToken,
+  isAuthorizedRuntimeRequest,
+  runtimeAuthHeaders,
+  runtimeAuthRequired,
+};

package/runtime/scripts/test-claude-code-models.js

@@ -0,0 +1,87 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+
+const {
+  canonicalModel,
+  cliModelFor,
+  createContract,
+} = require('./chat-core/contract');
+const {
+  getHarnessModels,
+  resolveHarnessModel,
+} = require('../lib/harnesses');
+const {
+  resolveModelSelection,
+} = require('./amalgm-mcp/lib/prefs');
+
+const OPUS_1M = 'anthropic/claude-opus-4.7-1m';
+
+assert.deepEqual(
+  getHarnessModels('claude_code').map((model) => ({
+    id: model.id,
+    name: model.name,
+    cliModel: model.cliModel,
+  })),
+  [
+    { id: 'anthropic/claude-haiku-4.5', name: 'Haiku 4.5', cliModel: 'haiku' },
+    { id: 'anthropic/claude-sonnet-4.6', name: 'Sonnet 4.6', cliModel: 'sonnet' },
+    { id: 'anthropic/claude-opus-4.7', name: 'Opus 4.7', cliModel: 'opus' },
+    { id: OPUS_1M, name: 'Opus 4.7 1M', cliModel: 'opus[1m]' },
+  ],
+);
+
+assert.equal(canonicalModel('haiku', 'claude_code'), 'anthropic/claude-haiku-4.5');
+assert.equal(canonicalModel('sonnet', 'claude_code'), 'anthropic/claude-sonnet-4.6');
+assert.equal(canonicalModel('opus', 'claude_code'), 'anthropic/claude-opus-4.7');
+assert.equal(canonicalModel('opus1m', 'claude_code'), OPUS_1M);
+assert.equal(canonicalModel('opus[1m]', 'claude_code'), OPUS_1M);
+assert.equal(canonicalModel('claude-code-opus-46', 'claude_code'), 'anthropic/claude-opus-4.7');
+assert.equal(canonicalModel('claude-code-opus-4.6', 'claude_code'), 'anthropic/claude-opus-4.7');
+assert.equal(canonicalModel('claude-opus-4-6', 'claude_code'), 'anthropic/claude-opus-4.7');
+assert.equal(canonicalModel('anthropic/claude-opus-4-6', 'claude_code'), 'anthropic/claude-opus-4.7');
+assert.equal(canonicalModel('anthropic/claude-opus-4.5', 'claude_code'), 'anthropic/claude-opus-4.7');
+assert.equal(canonicalModel('claude-code-sonnet-45', 'claude_code'), 'anthropic/claude-sonnet-4.6');
+assert.equal(canonicalModel('claude-code-sonnet-4.5', 'claude_code'), 'anthropic/claude-sonnet-4.6');
+assert.equal(canonicalModel('claude-sonnet-4-5', 'claude_code'), 'anthropic/claude-sonnet-4.6');
+assert.equal(canonicalModel('anthropic/claude-sonnet-4-5', 'claude_code'), 'anthropic/claude-sonnet-4.6');
+assert.equal(canonicalModel('claude-code-haiku-4.5', 'claude_code'), 'anthropic/claude-haiku-4.5');
+
+assert.equal(cliModelFor({ harness: 'claude_code', modelId: 'anthropic/claude-haiku-4.5' }), 'haiku');
+assert.equal(cliModelFor({ harness: 'claude_code', modelId: 'anthropic/claude-sonnet-4.6' }), 'sonnet');
+assert.equal(cliModelFor({ harness: 'claude_code', modelId: 'anthropic/claude-opus-4.7' }), 'opus');
+assert.equal(cliModelFor({ harness: 'claude_code', modelId: OPUS_1M }), 'opus[1m]');
+assert.equal(cliModelFor({ harness: 'claude_code', modelId: 'anthropic/claude-opus-4.7', cliModel: 'opus1m' }), 'opus[1m]');
+
+for (const [modelId, cliModel] of [
+  ['anthropic/claude-haiku-4.5', 'haiku'],
+  ['anthropic/claude-sonnet-4.6', 'sonnet'],
+  ['anthropic/claude-opus-4.7', 'opus'],
+  [OPUS_1M, 'opus[1m]'],
+]) {
+  const contract = createContract({
+    codeSessionId: `session-${cliModel}`,
+    assistantMessageId: `assistant-${cliModel}`,
+    userId: 'user',
+    agentId: 'claude',
+    authMethod: 'provider_auth',
+    modelId,
+    cwd: process.cwd(),
+  });
+  assert.equal(contract.harness, 'claude_code');
+  assert.equal(contract.modelId, modelId);
+  assert.equal(contract.cliModel, cliModel);
+}
+
+assert.deepEqual(resolveHarnessModel('claude_code', 'opus1m'), {
+  modelId: OPUS_1M,
+  cliModel: 'opus[1m]',
+  reasoningEffort: undefined,
+});
+assert.deepEqual(resolveModelSelection('claude_code', 'opus1m'), {
+  modelId: OPUS_1M,
+  cliModel: 'opus[1m]',
+  reasoningEffort: null,
+});
+
+console.log('Claude Code engine model mapping OK');

package/runtime/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "CommonJS",
+    "moduleResolution": "Node",
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "baseUrl": ".",
+    "paths": {
+      "@/*": [
+        "./*"
+      ]
+    }
+  }
+}