amalgm 0.0.0 → 0.0.32

package/lib/tunnel-events.js

@@ -0,0 +1,499 @@
+'use strict';
+
+const fs = require('fs');
+const http = require('http');
+const os = require('os');
+const path = require('path');
+const { WebSocket } = require('ws');
+
+const { AMALGM_DIR, RUNTIME_STATE_FILE } = require('./paths');
+
+const DEFAULT_TARGET_PORT = 8083;
+const CONNECT_TIMEOUT_MS = 20_000;
+const WATCHDOG_INTERVAL_MS = 15_000;
+const HEARTBEAT_TIMEOUT_MS = 75_000;
+const CORE_TARGET_PORTS = new Set([8083, 8084]);
+const HOP_BY_HOP_HEADERS = new Set([
+  'connection',
+  'keep-alive',
+  'proxy-authenticate',
+  'proxy-authorization',
+  'te',
+  'trailer',
+  'trailers',
+  'transfer-encoding',
+  'upgrade',
+  'host',
+  'content-length',
+]);
+const WS_HANDSHAKE_HEADERS = new Set([
+  'connection',
+  'upgrade',
+  'host',
+  'sec-websocket-key',
+  'sec-websocket-version',
+  'sec-websocket-extensions',
+  'sec-websocket-accept',
+  'sec-websocket-protocol',
+]);
+
+function tunnelUrl(rawUrl) {
+  const url = new URL(rawUrl);
+  url.searchParams.delete('token');
+  return url.toString();
+}
+
+function tunnelHeaders(token) {
+  return {
+    authorization: `Bearer ${token}`,
+    'user-agent': `amalgm-npm/${require('../package.json').version} (${os.platform()}; ${os.arch()})`,
+  };
+}
+
+async function postPresence(record, online) {
+  if (!record?.app_url || !record?.tunnel_token || !record?.computer_id) return;
+  try {
+    const res = await fetch(`${record.app_url}/api/computers/presence`, {
+      method: 'POST',
+      headers: {
+        authorization: `Bearer ${record.tunnel_token}`,
+        'content-type': 'application/json',
+      },
+      body: JSON.stringify({
+        computer_id: record.computer_id,
+        device_id: record.device_id || '',
+        online,
+      }),
+    });
+    if (!res.ok) {
+      const text = await res.text().catch(() => '');
+      throw new Error(`${res.status} ${text || res.statusText}`);
+    }
+  } catch (error) {
+    const action = online ? 'online' : 'offline';
+    console.warn(`[event-tunnel] could not mark ${action}: ${error.message || error}`);
+  }
+}
+
+function normalizeHeaders(headers = {}) {
+  const out = {};
+  for (const [key, value] of Object.entries(headers || {})) {
+    const lower = key.toLowerCase();
+    if (HOP_BY_HOP_HEADERS.has(lower)) continue;
+    if (Array.isArray(value)) out[key] = value.join(', ');
+    else if (typeof value === 'string') out[key] = value;
+    else if (value != null) out[key] = String(value);
+  }
+  return out;
+}
+
+function responseHeaders(headers = {}) {
+  const out = {};
+  for (const [key, value] of Object.entries(headers)) {
+    if (Array.isArray(value)) out[key] = value.join(', ');
+    else if (typeof value === 'string') out[key] = value;
+    else if (value != null) out[key] = String(value);
+  }
+  return out;
+}
+
+function bufferFromMessage(data) {
+  if (Buffer.isBuffer(data)) return data;
+  if (data instanceof ArrayBuffer) return Buffer.from(data);
+  if (Array.isArray(data)) return Buffer.concat(data.map(bufferFromMessage));
+  return Buffer.from(String(data));
+}
+
+function parseProtocols(header) {
+  if (!header) return [];
+  return String(header).split(',').map((value) => value.trim()).filter(Boolean);
+}
+
+function sanitizePreviewWsHeaders(headers = {}) {
+  const out = {};
+  for (const [key, value] of Object.entries(headers || {})) {
+    if (WS_HANDSHAKE_HEADERS.has(key.toLowerCase())) continue;
+    out[key] = value;
+  }
+  return out;
+}
+
+function readArtifactRoutes() {
+  const file = path.join(AMALGM_DIR, 'artifacts.json');
+  let parsed = null;
+  try {
+    parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    return [];
+  }
+
+  const artifacts = Array.isArray(parsed?.artifacts) ? parsed.artifacts : [];
+  return artifacts
+    .filter((artifact) => {
+      const connected = artifact.dnsConnected !== false && artifact.connected !== false;
+      const desiredRunning = (artifact.desiredState || 'running') === 'running';
+      const active = artifact.status !== 'stopped' && artifact.status !== 'error';
+      return connected && desiredRunning && active && artifact.port && (artifact.artifactRef || artifact.artifact_ref);
+    })
+    .map((artifact) => ({
+      artifact_ref: artifact.artifactRef || artifact.artifact_ref,
+      port: Number(artifact.port),
+      name: artifact.name,
+    }))
+    .filter((route) =>
+      /^[a-z0-9]{8,24}$/.test(route.artifact_ref)
+      && Number.isInteger(route.port)
+      && route.port > 0
+      && route.port <= 65535,
+    );
+}
+
+function readRuntimePorts() {
+  const envPort = (name) => {
+    const port = Number(process.env[name]);
+    return Number.isInteger(port) && port > 0 && port <= 65535 ? port : undefined;
+  };
+  try {
+    const parsed = JSON.parse(fs.readFileSync(RUNTIME_STATE_FILE, 'utf8'));
+    return {
+      gateway: Number(parsed?.gateway_port || parsed?.ports?.gateway) || envPort('AMALGM_GATEWAY_PORT'),
+      mcp: Number(parsed?.ports?.amalgm_mcp) || envPort('AMALGM_MCP_PORT'),
+      chat: Number(parsed?.ports?.chat_server) || envPort('CHAT_SERVER_PORT'),
+    };
+  } catch {
+    return {
+      gateway: envPort('AMALGM_GATEWAY_PORT'),
+      mcp: envPort('AMALGM_MCP_PORT'),
+      chat: envPort('CHAT_SERVER_PORT'),
+    };
+  }
+}
+
+function allowedTargetPorts() {
+  const ports = new Set(CORE_TARGET_PORTS);
+  const runtimePorts = readRuntimePorts();
+  for (const port of [runtimePorts.gateway, runtimePorts.mcp, runtimePorts.chat]) {
+    if (Number.isInteger(port) && port > 0 && port <= 65535) ports.add(port);
+  }
+  for (const route of readArtifactRoutes()) ports.add(route.port);
+  return ports;
+}
+
+function defaultTargetPort() {
+  const port = readRuntimePorts().mcp;
+  return Number.isInteger(port) && port > 0 && port <= 65535 ? port : DEFAULT_TARGET_PORT;
+}
+
+function runtimeGatewayPort() {
+  const port = readRuntimePorts().gateway;
+  return Number.isInteger(port) && port > 0 && port <= 65535 ? port : null;
+}
+
+function resolveTargetPort(frame, fallbackPort = defaultTargetPort()) {
+  const candidate = frame.target_port == null ? fallbackPort : Number(frame.target_port);
+  if (!Number.isInteger(candidate) || candidate <= 0 || candidate > 65535) return null;
+  return allowedTargetPorts().has(candidate) ? candidate : null;
+}
+
+function createEventTunnel({ record, foreground = false }) {
+  let stopped = false;
+  let ws = null;
+  let reconnectTimer = null;
+  let routeTimer = null;
+  let watchdogTimer = null;
+  let backoffMs = 1000;
+  let connectStartedAt = 0;
+  let lastGatewayFrameAt = 0;
+  const upstreamSockets = new Map();
+
+  function log(message) {
+    const line = `[event-tunnel] ${message}`;
+    if (foreground) console.log(line);
+  }
+
+  function warn(message) {
+    const line = `[event-tunnel] ${message}`;
+    if (foreground) console.warn(line);
+  }
+
+  function send(frame) {
+    if (!ws || ws.readyState !== WebSocket.OPEN) return false;
+    ws.send(JSON.stringify(frame));
+    return true;
+  }
+
+  function terminateSocket(reason) {
+    if (!ws) return;
+    warn(`${reason}; reconnecting`);
+    try {
+      ws.terminate();
+    } catch {
+      try {
+        ws.close();
+      } catch {
+        // noop
+      }
+    }
+  }
+
+  function startWatchdog() {
+    if (watchdogTimer) return;
+
+    watchdogTimer = setInterval(() => {
+      if (stopped || !ws) return;
+      const now = Date.now();
+
+      if (ws.readyState === WebSocket.CONNECTING) {
+        if (connectStartedAt && now - connectStartedAt > CONNECT_TIMEOUT_MS) {
+          terminateSocket('connect timeout');
+        }
+        return;
+      }
+
+      if (ws.readyState !== WebSocket.OPEN) return;
+
+      send({
+        type: 'hello',
+        app_version: require('../package.json').version,
+        runtime_gateway_port: runtimeGatewayPort(),
+        artifact_routes: readArtifactRoutes(),
+      });
+
+      try {
+        ws.ping();
+      } catch {
+        terminateSocket('ping failed');
+        return;
+      }
+
+      if (lastGatewayFrameAt && now - lastGatewayFrameAt > HEARTBEAT_TIMEOUT_MS) {
+        terminateSocket('heartbeat timeout');
+      }
+    }, WATCHDOG_INTERVAL_MS);
+
+    if (typeof watchdogTimer.unref === 'function') watchdogTimer.unref();
+  }
+
+  function stopWatchdog() {
+    if (!watchdogTimer) return;
+    clearInterval(watchdogTimer);
+    watchdogTimer = null;
+  }
+
+  function localHeaders(headers) {
+    const out = normalizeHeaders(headers);
+    const runtimeToken = record?.runtime_token || process.env.AMALGM_RUNTIME_TOKEN || '';
+    if (runtimeToken) out['x-amalgm-runtime-token'] = runtimeToken;
+    return out;
+  }
+
+  function advertiseArtifacts() {
+    send({
+      type: 'artifact_routes',
+      runtime_gateway_port: runtimeGatewayPort(),
+      artifact_routes: readArtifactRoutes(),
+    });
+  }
+
+  function scheduleReconnect() {
+    if (stopped || reconnectTimer) return;
+    const delay = backoffMs;
+    backoffMs = Math.min(backoffMs * 1.5, 15000);
+    reconnectTimer = setTimeout(() => {
+      reconnectTimer = null;
+      connect();
+    }, delay);
+  }
+
+  function handleRequest(frame) {
+    const targetPort = resolveTargetPort(frame);
+    if (!targetPort) {
+      send({
+        type: 'res',
+        req_id: frame.req_id,
+        status: 403,
+        headers: { 'content-type': 'application/json' },
+        body_b64: Buffer.from(JSON.stringify({ error: 'Target port is not allowed' })).toString('base64'),
+      });
+      return;
+    }
+    const body = frame.body_b64 ? Buffer.from(frame.body_b64, 'base64') : Buffer.alloc(0);
+    const req = http.request(
+      {
+        hostname: '127.0.0.1',
+        port: targetPort,
+        method: frame.method || 'GET',
+        path: frame.path || '/',
+        headers: localHeaders(frame.headers),
+      },
+      (res) => {
+        const chunks = [];
+        res.on('data', (chunk) => chunks.push(Buffer.from(chunk)));
+        res.on('end', () => {
+          send({
+            type: 'res',
+            req_id: frame.req_id,
+            status: res.statusCode || 502,
+            headers: responseHeaders(res.headers),
+            body_b64: Buffer.concat(chunks).toString('base64'),
+          });
+        });
+      },
+    );
+
+    req.on('error', (error) => {
+      send({
+        type: 'res',
+        req_id: frame.req_id,
+        status: 502,
+        headers: { 'content-type': 'text/plain; charset=utf-8' },
+        body_b64: Buffer.from(error.message || 'Local request failed').toString('base64'),
+      });
+    });
+
+    req.end(body);
+  }
+
+  function openPreviewSocket(frame) {
+    const targetPort = resolveTargetPort(frame);
+    if (!targetPort) {
+      send({ type: 'ws_error', conn_id: frame.conn_id, message: 'Target port is not allowed' });
+      send({ type: 'ws_close', conn_id: frame.conn_id, code: 1008, reason: 'Target port is not allowed' });
+      return;
+    }
+    const localUrl = `ws://127.0.0.1:${targetPort}${frame.path || '/'}`;
+    const protocols = parseProtocols(frame.headers?.['sec-websocket-protocol']);
+    const upstreamHeaders = localHeaders(sanitizePreviewWsHeaders(frame.headers));
+    const upstream = protocols.length > 0
+      ? new WebSocket(localUrl, protocols, { headers: upstreamHeaders })
+      : new WebSocket(localUrl, { headers: upstreamHeaders });
+    upstreamSockets.set(frame.conn_id, upstream);
+
+    upstream.on('open', () => {
+      send({ type: 'ws_opened', conn_id: frame.conn_id, protocol: upstream.protocol || undefined });
+    });
+    upstream.on('message', (data, binary) => {
+      send({
+        type: 'ws_data',
+        conn_id: frame.conn_id,
+        data_b64: bufferFromMessage(data).toString('base64'),
+        binary: !!binary,
+      });
+    });
+    upstream.on('close', (code, reason) => {
+      upstreamSockets.delete(frame.conn_id);
+      send({
+        type: 'ws_close',
+        conn_id: frame.conn_id,
+        code,
+        reason: reason ? reason.toString() : '',
+      });
+    });
+    upstream.on('error', (error) => {
+      send({ type: 'ws_error', conn_id: frame.conn_id, message: error.message });
+    });
+  }
+
+  function handleFrame(frame) {
+    if (!frame || typeof frame.type !== 'string') return;
+    if (frame.type === 'ping') {
+      send({ type: 'pong' });
+      return;
+    }
+    if (frame.type === 'req') {
+      handleRequest(frame);
+      return;
+    }
+    if (frame.type === 'ws_open') {
+      openPreviewSocket(frame);
+      return;
+    }
+    if (frame.type === 'ws_data') {
+      const upstream = upstreamSockets.get(frame.conn_id);
+      if (upstream && upstream.readyState === WebSocket.OPEN) {
+        upstream.send(Buffer.from(frame.data_b64 || '', 'base64'), { binary: frame.binary !== false });
+      }
+      return;
+    }
+    if (frame.type === 'ws_close') {
+      const upstream = upstreamSockets.get(frame.conn_id);
+      if (upstream) upstream.close(frame.code || 1000, frame.reason || undefined);
+    }
+  }
+
+  function connect() {
+    if (stopped) return;
+    const url = tunnelUrl(record.tunnel_url);
+    ws = new WebSocket(url, {
+      headers: tunnelHeaders(record.tunnel_token),
+    });
+    connectStartedAt = Date.now();
+    startWatchdog();
+
+    ws.on('open', () => {
+      backoffMs = 1000;
+      connectStartedAt = 0;
+      lastGatewayFrameAt = Date.now();
+      log(`connected ${record.computer_id}`);
+      void postPresence(record, true);
+      send({
+        type: 'hello',
+        app_version: require('../package.json').version,
+        runtime_gateway_port: runtimeGatewayPort(),
+        artifact_routes: readArtifactRoutes(),
+      });
+      if (!routeTimer) {
+        routeTimer = setInterval(advertiseArtifacts, 30000);
+        if (typeof routeTimer.unref === 'function') routeTimer.unref();
+      }
+    });
+    ws.on('pong', () => {
+      lastGatewayFrameAt = Date.now();
+    });
+    ws.on('message', (data) => {
+      lastGatewayFrameAt = Date.now();
+      try {
+        handleFrame(JSON.parse(data.toString()));
+      } catch {
+        // Ignore malformed gateway frames.
+      }
+    });
+    ws.on('close', (code, reason) => {
+      connectStartedAt = 0;
+      lastGatewayFrameAt = 0;
+      warn(`closed code=${code} reason=${reason ? reason.toString() : ''}`);
+      scheduleReconnect();
+    });
+    ws.on('error', (error) => {
+      warn(error.message);
+    });
+  }
+
+  return {
+    start: connect,
+    stop() {
+      stopped = true;
+      if (reconnectTimer) clearTimeout(reconnectTimer);
+      if (routeTimer) clearInterval(routeTimer);
+      stopWatchdog();
+      for (const upstream of upstreamSockets.values()) {
+        try {
+          upstream.close();
+        } catch {
+          // noop
+        }
+      }
+      upstreamSockets.clear();
+      void postPresence(record, false);
+      if (ws) {
+        try {
+          ws.close();
+        } catch {
+          // noop
+        }
+      }
+    },
+  };
+}
+
+module.exports = { createEventTunnel };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "amalgm",
-  "version": "0.0.0",
-  "description": "Placeholder for the Amalgm CLI. Install amalgm@canary for the current test build.",
+  "version": "0.0.32",
+  "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,
   "bin": {
@@ -9,6 +9,33 @@
   },
   "files": [
     "bin",
+    "lib",
+    "runtime",
     "README.md"
-  ]
+  ],
+  "scripts": {
+    "sync-runtime": "node ../../scripts/sync-npm-package-runtime.mjs",
+    "prepack": "node ../../scripts/sync-npm-package-runtime.mjs",
+    "pack:dry": "npm pack --dry-run",
+    "check": "node --check bin/amalgm.js && node --check lib/auth-store.js && node --check lib/cli.js && node --check lib/paths.js && node --check lib/supervisor.js && node --check lib/tunnel-chat.js && node --check lib/tunnel-events.js && node --check runtime/scripts/runtime-auth.js && node --check runtime/scripts/proxy-token-store.js && node --check runtime/scripts/local-gateway.js && node --check runtime/scripts/port-monitor.js && node --check runtime/scripts/fs-watcher.js && node --check runtime/scripts/chat-server.js && node --check runtime/scripts/chat-server/index.js && node --check runtime/scripts/chat-server/config.js && node --check runtime/scripts/chat-core/tooling/native-binaries.js && node --check runtime/scripts/amalgm-mcp/index.js && node --check runtime/scripts/amalgm-mcp/config.js"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "@ai-sdk/gateway": "^3.0.107",
+    "@anthropic-ai/claude-agent-sdk": "^0.2.122",
+    "@homebridge/node-pty-prebuilt-multiarch": "^0.13.1",
+    "@modelcontextprotocol/sdk": "^1.27.1",
+    "@openai/codex": "^0.128.0",
+    "@opencode-ai/sdk": "^1.14.29",
+    "ai": "^6.0.116",
+    "better-sqlite3": "^12.10.0",
+    "cron-parser": "^5.5.0",
+    "opencode-ai": "^1.14.35",
+    "playwright-core": "^1.59.1",
+    "tsx": "^4.21.0",
+    "ws": "^8.18.3",
+    "zod": "^4.1.8"
+  }
 }

package/runtime/README.md

@@ -0,0 +1,4 @@
+# Amalgm Runtime
+
+Generated by `scripts/sync-npm-package-runtime.mjs` from `amalgm-engine/runtime`.
+Do not hand-edit files in this directory; update the engine runtime instead.