amalgm 0.0.0 → 0.0.32

package/runtime/scripts/amalgm-mcp/server/http.js

@@ -0,0 +1,377 @@
+/**
+ * HTTP server — routes + lifecycle.
+ *
+ * Route table:
+ *   GET  /healthz                     → stats snapshot
+ *   *    /mcp                         → MCP streamable-HTTP (delegated to SDK transport)
+ *   POST /events                      → webhook ingress (signature match + agent run)
+ *   GET  /events                      → recent events (in-memory ring buffer)
+ *   GET  /tasks/list                  → list tasks
+ *   POST /tasks/create                → create task
+ *   POST /tasks/update                → update task
+ *   POST /tasks/delete                → delete task
+ *   POST /tasks/run-now               → run task immediately
+ *   GET  /event-triggers/list         → list triggers
+ *   POST /event-triggers/{create,update,delete}
+ *   GET  /workspace/projects          → list projects
+ *   POST /workspace/import           → copy a local folder into workspaces
+ *   POST /github/clone               → clone repository onto the computer
+ *   GET  /workspace/branches          → list git branches
+ *   POST /workspace/checkout          → checkout git branch
+ *   GET  /workspace/diff              → git diff summary + patch
+ *   GET  /workspace/worktree          → list worktrees
+ *   POST /workspace/worktree          → create worktree
+ *   DELETE /workspace/worktree        → remove worktree
+ *   GET  /fs/list                     → list files
+ *   GET  /fs/read                     → read file
+ *   POST /fs/{write,delete,mkdir,rename}
+ *   GET  /mcp-connections             → list sanitized MCP connections
+ *   POST /mcp-connections             → save/update MCP connection
+ *   DELETE /mcp-connections           → remove MCP connection
+ *   GET  /toolbox                     → list local ToolboxDB tools/actions
+ *   POST /toolbox/tools               → save/update a toolbox tool
+ *   DELETE /toolbox/tools             → remove a toolbox tool
+ *   POST /toolbox/actions             → save/update a toolbox action
+ *   DELETE /toolbox/actions           → remove a toolbox action
+ *   GET  /state/snapshot              → current Local Live Store snapshot
+ *   GET  /state/events                → replay Local Live Store events
+ *   GET  /state/stream                → SSE Local Live Store stream
+ *   POST /local/init                  → init local computer state
+ *   GET  /local/credentials           → discover local agent auth
+ *   POST /local/credentials/resolve   → resolve spawn env for agent auth
+ *   POST /email/inbound               → run a reply turn for inbound email
+ *   POST /slack/inbound               → run a reply turn for inbound Slack
+ *   GET  /credentials                 → list local Amalgm credential profiles
+ *   POST /credentials                 → save local Amalgm credential profile
+ *   DELETE /credentials               → remove local Amalgm credential profile
+ *   POST /user-api-keys               → legacy save BYOK credential file
+ *   DELETE /user-api-keys             → legacy remove BYOK credential file
+ *   GET  /artifacts/list              → list artifacts
+ *   GET  /artifacts/routes            → artifact DNS routes for tunnel adverts
+ *   POST /artifacts/{register,redeploy,start,stop,connect-dns,disconnect-dns}
+ *   GET  /agents/list                 → list agents
+ *   POST /agents/{get,create,update,delete}
+ */
+
+const http = require('http');
+const { PORT, STORAGE_DIR } = require('../config');
+const { hasSupabase } = require('../lib/supabase');
+const { authorizeRuntimeHttp } = require('../../runtime-auth');
+
+const { loadTasks } = require('../tasks/store');
+const { loadAgents } = require('../agents/store');
+const { loadArtifacts } = require('../artifacts/store');
+const { activeAgentConversations } = require('../agents/talk');
+const { startScheduler, stopScheduler } = require('../tasks/scheduler');
+const { createTransport } = require('./mcp');
+const { handleEventsPost } = require('../events/ingress');
+const eventsRing = require('../events/ring-buffer');
+const eventsRest = require('../events/rest');
+const agentsRest = require('../agents/rest');
+const artifactsRest = require('../artifacts/rest');
+const emailInbound = require('../email/inbound');
+const slackInbound = require('../slack/inbound');
+const fsRest = require('../fs/rest');
+const localRest = require('../local/rest');
+const mcpConnectionsRest = require('../mcp-connections/rest');
+const toolboxRest = require('../toolbox/rest');
+const stateRest = require('../state/rest');
+const tasksRest = require('../tasks/rest');
+const userApiKeysRest = require('../user-api-keys/rest');
+const credentialsRest = require('../credentials/rest');
+const workspaceRest = require('../workspace/rest');
+
+function createServer() {
+  return http.createServer(async (req, res) => {
+    if (!authorizeRuntimeHttp(req, res, { exposeHeaders: 'Mcp-Session-Id' })) return;
+
+    async function readJsonBody() {
+      const chunks = [];
+      for await (const chunk of req) chunks.push(chunk);
+      return JSON.parse(Buffer.concat(chunks).toString());
+    }
+    function sendJson(statusCode, data) {
+      res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(data));
+    }
+    function getQuery() {
+      return Object.fromEntries(new URL(req.url, 'http://127.0.0.1').searchParams.entries());
+    }
+
+    try {
+      // ── MCP ─────────────────────────────────────────────────────────────────
+      // Delegate anything under /mcp directly to the SDK transport. A fresh
+      // transport + Server pair is created per request: the stateless
+      // StreamableHTTPServerTransport is single-shot in this mode, so reusing
+      // one across requests would fail on the second call with HTTP 500.
+      if (req.url === '/mcp' || req.url === '/mcp/' || req.url.startsWith('/mcp?')) {
+        const transport = await createTransport();
+        await transport.handleRequest(req, res);
+        return;
+      }
+
+      // ── Health ──────────────────────────────────────────────────────────────
+      if (req.url === '/healthz') {
+        const tasks = loadTasks();
+        const agents = loadAgents();
+        return sendJson(200, {
+          status: 'ok',
+          tasks: tasks.tasks.length,
+          enabledTasks: tasks.tasks.filter((t) => t.enabled).length,
+          artifacts: loadArtifacts().artifacts.length,
+          customAgents: agents.agents.length,
+          activeAgentConversations: activeAgentConversations.size,
+        });
+      }
+
+      // ── /state — Local Live Store snapshot/replay/stream ─────────────────
+      if (req.url.startsWith('/state/snapshot') && req.method === 'GET') {
+        return stateRest.handleSnapshot(getQuery(), sendJson);
+      }
+      if (req.url.startsWith('/state/events') && req.method === 'GET') {
+        return stateRest.handleEvents(getQuery(), sendJson);
+      }
+      if (req.url.startsWith('/state/stream') && req.method === 'GET') {
+        return stateRest.handleStream(req, res, getQuery());
+      }
+
+      // ── /agents (REST, not MCP) ─────────────────────────────────────────────
+      if (req.url === '/agents/list' && req.method === 'GET') {
+        return agentsRest.handleList(sendJson);
+      }
+      if (req.url === '/agents/get' && req.method === 'POST') {
+        return agentsRest.handleGet(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/agents/create' && req.method === 'POST') {
+        return agentsRest.handleCreate(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/agents/update' && req.method === 'POST') {
+        return agentsRest.handleUpdate(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/agents/delete' && req.method === 'POST') {
+        return agentsRest.handleDelete(await readJsonBody(), sendJson);
+      }
+
+      // ── /events — webhook ingress ───────────────────────────────────────────
+      if (req.url === '/events' && req.method === 'POST') {
+        return handleEventsPost(req, sendJson);
+      }
+      if (req.url === '/events' && req.method === 'GET') {
+        return sendJson(200, { events: eventsRing.recent(50) });
+      }
+
+      // ── /tasks REST ─────────────────────────────────────────────────────────
+      if (req.url === '/tasks/list' && req.method === 'GET') {
+        return tasksRest.handleList(sendJson);
+      }
+      if (req.url === '/tasks/create' && req.method === 'POST') {
+        return tasksRest.handleCreate(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/tasks/update' && req.method === 'POST') {
+        return tasksRest.handleUpdate(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/tasks/delete' && req.method === 'POST') {
+        return tasksRest.handleDelete(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/tasks/run-now' && req.method === 'POST') {
+        return tasksRest.handleRunNow(await readJsonBody(), sendJson);
+      }
+
+      // ── /event-triggers REST ────────────────────────────────────────────────
+      if (req.url === '/event-triggers/list' && req.method === 'GET') {
+        return eventsRest.handleList(req, sendJson);
+      }
+      if (req.url === '/event-triggers/create' && req.method === 'POST') {
+        return eventsRest.handleCreate(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/event-triggers/update' && req.method === 'POST') {
+        return eventsRest.handleUpdate(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/event-triggers/delete' && req.method === 'POST') {
+        return eventsRest.handleDelete(await readJsonBody(), sendJson);
+      }
+
+      // ── /workspace REST ─────────────────────────────────────────────────────
+      if (req.url === '/workspace/projects' && req.method === 'GET') {
+        return workspaceRest.handleProjects(sendJson);
+      }
+      if (req.url === '/workspace/import' && req.method === 'POST') {
+        return workspaceRest.handleImport(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/github/clone' && req.method === 'POST') {
+        return workspaceRest.handleClone(await readJsonBody(), sendJson);
+      }
+      if (req.url.startsWith('/workspace/branches') && req.method === 'GET') {
+        return workspaceRest.handleBranches(getQuery(), sendJson);
+      }
+      if (req.url === '/workspace/checkout' && req.method === 'POST') {
+        return workspaceRest.handleCheckout(await readJsonBody(), sendJson);
+      }
+      if (req.url.startsWith('/workspace/diff') && req.method === 'GET') {
+        return workspaceRest.handleDiff(getQuery(), sendJson);
+      }
+      if (req.url.startsWith('/workspace/worktree') && req.method === 'GET') {
+        return workspaceRest.handleWorktreeList(getQuery(), sendJson);
+      }
+      if (req.url === '/workspace/worktree' && req.method === 'POST') {
+        return workspaceRest.handleWorktreeCreate(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/workspace/worktree' && req.method === 'DELETE') {
+        return workspaceRest.handleWorktreeDelete(await readJsonBody(), sendJson);
+      }
+
+      // ── /fs REST ────────────────────────────────────────────────────────────
+      if (req.url.startsWith('/fs/list') && req.method === 'GET') {
+        return fsRest.handleList(getQuery(), sendJson);
+      }
+      if (req.url.startsWith('/fs/read') && req.method === 'GET') {
+        return fsRest.handleRead(getQuery(), sendJson);
+      }
+      if (req.url === '/fs/write' && req.method === 'POST') {
+        return fsRest.handleWrite(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/fs/delete' && req.method === 'POST') {
+        return fsRest.handleDelete(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/fs/mkdir' && req.method === 'POST') {
+        return fsRest.handleMkdir(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/fs/rename' && req.method === 'POST') {
+        return fsRest.handleRename(await readJsonBody(), sendJson);
+      }
+
+      // ── /mcp-connections REST ──────────────────────────────────────────────
+      if (req.url === '/mcp-connections' && req.method === 'GET') {
+        return mcpConnectionsRest.handleList(sendJson);
+      }
+      if (req.url === '/mcp-connections' && req.method === 'POST') {
+        return mcpConnectionsRest.handleUpsert(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/mcp-connections' && req.method === 'DELETE') {
+        return mcpConnectionsRest.handleDelete(await readJsonBody(), sendJson);
+      }
+
+      // ── /toolbox REST ─────────────────────────────────────────────────────
+      if (req.url === '/toolbox' && req.method === 'GET') {
+        return toolboxRest.handleList(sendJson);
+      }
+      if (req.url === '/toolbox/tools' && req.method === 'POST') {
+        return toolboxRest.handleUpsertTool(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/toolbox/tools' && req.method === 'DELETE') {
+        return toolboxRest.handleDeleteTool(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/toolbox/actions' && req.method === 'POST') {
+        return toolboxRest.handleUpsertAction(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/toolbox/actions' && req.method === 'DELETE') {
+        return toolboxRest.handleDeleteAction(await readJsonBody(), sendJson);
+      }
+
+      // ── /local REST ────────────────────────────────────────────────────────
+      if (req.url === '/local/init' && req.method === 'POST') {
+        return localRest.handleInit(sendJson);
+      }
+      if (req.url === '/local/credentials' && req.method === 'GET') {
+        return localRest.handleCredentials(sendJson);
+      }
+      if (req.url === '/local/credentials/resolve' && req.method === 'POST') {
+        return localRest.handleResolve(await readJsonBody(), sendJson);
+      }
+
+      // ── /credentials REST ─────────────────────────────────────────────────
+      if (req.url === '/credentials' && req.method === 'GET') {
+        return credentialsRest.handleList(sendJson);
+      }
+      if (req.url === '/credentials' && req.method === 'POST') {
+        return credentialsRest.handleSave(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/credentials' && req.method === 'DELETE') {
+        return credentialsRest.handleDelete(await readJsonBody(), sendJson);
+      }
+
+      // ── /email REST ────────────────────────────────────────────────────────
+      if (req.url === '/email/inbound' && req.method === 'POST') {
+        return emailInbound.handleEmailInbound(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/slack/inbound' && req.method === 'POST') {
+        return slackInbound.handleSlackInbound(await readJsonBody(), sendJson);
+      }
+
+      // ── /user-api-keys REST ───────────────────────────────────────────────
+      if (req.url === '/user-api-keys' && req.method === 'POST') {
+        return userApiKeysRest.handleSave(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/user-api-keys' && req.method === 'DELETE') {
+        return userApiKeysRest.handleDelete(sendJson);
+      }
+
+      // ── /artifacts REST ────────────────────────────────────────────────────
+      if (req.url === '/artifacts/list' && req.method === 'GET') {
+        return artifactsRest.handleList(sendJson);
+      }
+      if (req.url === '/artifacts/routes' && req.method === 'GET') {
+        return artifactsRest.handleRoutes(sendJson);
+      }
+      if (req.url === '/artifacts/register' && req.method === 'POST') {
+        return artifactsRest.handleRegister(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/artifacts/redeploy' && req.method === 'POST') {
+        return artifactsRest.handleRedeploy(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/artifacts/start' && req.method === 'POST') {
+        return artifactsRest.handleStart(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/artifacts/stop' && req.method === 'POST') {
+        return artifactsRest.handleStop(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/artifacts/delete' && req.method === 'POST') {
+        return artifactsRest.handleDelete(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/artifacts/connect-dns' && req.method === 'POST') {
+        return artifactsRest.handleConnectDns(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/artifacts/disconnect-dns' && req.method === 'POST') {
+        return artifactsRest.handleDisconnectDns(await readJsonBody(), sendJson);
+      }
+
+      res.writeHead(404, { 'Content-Type': 'text/plain' });
+      res.end('Not found');
+    } catch (err) {
+      console.error('[AmalgmMCP] Unhandled error:', err);
+      if (!res.headersSent) sendJson(500, { error: 'Internal server error' });
+    }
+  });
+}
+
+async function listen() {
+  const httpServer = createServer();
+
+  httpServer.listen(PORT, '127.0.0.1', async () => {
+    console.log(`[AmalgmMCP] Listening on 127.0.0.1:${PORT}`);
+    console.log(`[AmalgmMCP] Storage: ${STORAGE_DIR}`);
+    console.log(
+      `[AmalgmMCP] Supabase: ${hasSupabase() ? 'connected' : 'not configured (runs are local-only)'}`,
+    );
+    // Hydrate user model prefs non-blocking (requires Supabase).
+    require('../lib/prefs').hydrateModelPreferences().catch(() => {});
+    startScheduler();
+  });
+
+  // Graceful shutdown. Running tasks get aborted via SIGTERM → process exit;
+  // we don't try to individually abort them here since chat-server owns its own
+  // runtime teardown paths.
+  function shutdown() {
+    console.log('[AmalgmMCP] Shutting down...');
+    stopScheduler();
+    httpServer.close(() => process.exit(0));
+    setTimeout(() => process.exit(0), 5000);
+  }
+
+  process.on('SIGTERM', shutdown);
+  process.on('SIGINT', shutdown);
+
+  return httpServer;
+}
+
+module.exports = { createServer, listen };

package/runtime/scripts/amalgm-mcp/server/mcp.js

@@ -0,0 +1,127 @@
+/**
+ * MCP server — built on @modelcontextprotocol/sdk.
+ *
+ * The SDK handles JSON-RPC framing, protocol-version negotiation, batching,
+ * and streamable-HTTP transport. We just register the two tool handlers.
+ *
+ * Each domain module exports a flat array of
+ * { name, description, inputSchema, handler }. We concatenate the built-in
+ * Amalgm tools with toolbox management tools. Custom CLI/API actions registered
+ * in the ToolboxDB are exposed dynamically through this same MCP transport.
+ */
+
+const { Server } = require('@modelcontextprotocol/sdk/server/index.js');
+const {
+  StreamableHTTPServerTransport,
+} = require('@modelcontextprotocol/sdk/server/streamableHttp.js');
+const {
+  ListToolsRequestSchema,
+  CallToolRequestSchema,
+} = require('@modelcontextprotocol/sdk/types.js');
+
+const { AMALGM_USER_ID } = require('../config');
+const { hasSupabase, supabaseSelect } = require('../lib/supabase');
+const { attachActionDescriptor } = require('../lib/tool-result');
+const { CORE_TOOLS } = require('./core-tools');
+const {
+  callToolboxMcpTool,
+  listToolboxMcpTools,
+} = require('../toolbox/runner');
+
+const TOOLS = [
+  ...CORE_TOOLS,
+  ...require('../toolbox/tools'),
+];
+
+/**
+ * Look up the caller's session to tag DB rows with origin metadata. Reads
+ * x-amalgm-session-id from the transport's passed-through HTTP headers.
+ */
+async function buildRequestContext(extra) {
+  const headers = extra?.requestInfo?.headers || {};
+  const h = headers['x-amalgm-session-id'];
+  const callerSessionId = Array.isArray(h) ? h[0] : h || null;
+  const ctx = { callerSessionId };
+
+  if (callerSessionId && hasSupabase()) {
+    const rows = await supabaseSelect(
+      'sessions',
+      `id=eq.${callerSessionId}&user_id=eq.${AMALGM_USER_ID}&select=id,title,harness,metadata`,
+    );
+    const parent = Array.isArray(rows) ? rows[0] : null;
+    if (parent) {
+      ctx.sessionMetadata = parent.metadata || {};
+      ctx.originName = parent.title || undefined;
+      ctx.originHarnessId = parent.harness || undefined;
+      ctx.originBaseHarnessId = parent.metadata?.baseHarnessId || undefined;
+    }
+  }
+  return ctx;
+}
+
+function createMcpServer() {
+  const server = new Server(
+    { name: 'amalgm', version: '1.0.0' },
+    { capabilities: { tools: {} } },
+  );
+
+  server.setRequestHandler(ListToolsRequestSchema, async (_request, extra) => {
+    const ctx = await buildRequestContext(extra);
+    return {
+      tools: [
+        ...TOOLS.map(({ name, description, inputSchema }) => ({
+          name,
+          description,
+          inputSchema,
+        })),
+        ...listToolboxMcpTools(ctx),
+      ],
+    };
+  });
+
+  server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
+    const toolName = request.params?.name;
+    const toolArgs = request.params?.arguments || {};
+    const tool = TOOLS.find((t) => t.name === toolName);
+    if (!tool) {
+      const ctx = await buildRequestContext(extra);
+      const toolboxResult = await callToolboxMcpTool(toolName, toolArgs, ctx);
+      if (toolboxResult) return attachActionDescriptor(toolboxResult, toolName, toolArgs);
+      return attachActionDescriptor({
+        content: [{ type: 'text', text: `Unknown tool: ${toolName}` }],
+        isError: true,
+      }, toolName || 'unknown', toolArgs);
+    }
+    const ctx = await buildRequestContext(extra);
+    try {
+      const result = await tool.handler(toolArgs, ctx);
+      return attachActionDescriptor(result, toolName, toolArgs);
+    } catch (err) {
+      return attachActionDescriptor({
+        content: [{ type: 'text', text: `Error: ${err.message}` }],
+        isError: true,
+      }, toolName, toolArgs);
+    }
+  });
+
+  return server;
+}
+
+/**
+ * One stateless streamable-HTTP transport + Server pair. The transport is
+ * reusable across requests because we don't use session IDs or bidirectional
+ * notifications — every tools/list and tools/call is self-contained.
+ */
+async function createTransport() {
+  const server = createMcpServer();
+  const transport = new StreamableHTTPServerTransport({
+    sessionIdGenerator: undefined,
+    // Return plain JSON responses instead of opening an SSE stream. We don't
+    // emit progress notifications, so there's nothing to stream.
+    enableJsonResponse: true,
+  });
+  await server.connect(transport);
+  return transport;
+}
+
+module.exports = { createTransport, TOOLS };