amalgm 0.0.1 → 0.0.33

package/runtime/scripts/amalgm-mcp/agents/talk.js

@@ -24,6 +24,7 @@ const {
 } = require('../lib/supabase');
 const {
   hydrateModelPreferences,
+  getPreferredAuthMethod,
   getSelectedModel,
   resolveModelSelection,
   DEFAULT_SELECTED_MODELS,
@@ -548,16 +549,20 @@ async function handleTalkToAgent(args, context = {}) {
   // Chat-server agent ID derives from the agent's base harness.
   const agentIdMap = { claude_code: 'claude', codex: 'codex', opencode: 'opencode', pi: 'pi', amp: 'amp', cursor: 'cursor' };
   const chatAgentId = agentIdMap[agent.baseHarnessId] || 'claude';
+  const persistedAuthMethod = credentialAdapter.VALID_HARNESS_IDS.includes(agent.baseHarnessId)
+    ? credentialAdapter.getPersistedAuthMode(agent.baseHarnessId)
+    : 'amalgm';
   const defaultAuthMethod = coerceAuthMethodForHarness(
     agent.baseHarnessId,
     agent.authMethod
-    || (credentialAdapter.VALID_HARNESS_IDS.includes(agent.baseHarnessId)
-      ? credentialAdapter.getPersistedAuthMode(agent.baseHarnessId)
-      : 'amalgm'),
+    || getPreferredAuthMethod(agent.baseHarnessId, persistedAuthMethod),
   );
   const agentFiles = normalizeStringList(agent.files);
   const agentSkills = normalizeStringList(agent.skills);
-  const agentMcpAppIds = normalizeStringList(agent.mcp?.appIds ?? agent.mcpAppIds);
+  const agentTools = agent.tools || { mode: 'all', selectedToolIds: [] };
+  const agentMcpAppIds = agentTools.mode === 'selected'
+    ? normalizeStringList(agentTools.selectedToolIds)
+    : normalizeStringList(agent.mcp?.appIds ?? agent.mcpAppIds);
   const baseAgentSystemPrompt = buildAgentInstructions(
     agent.systemPrompt,
     agentFiles,
@@ -734,6 +739,7 @@ async function handleTalkToAgent(args, context = {}) {
           files: agentFiles,
           skills: agentSkills,
           mcpAppIds: agentMcpAppIds,
+          tools: agentTools,
           ...(parentOrigin || {}),
         },
       });

package/runtime/scripts/amalgm-mcp/agents/tools.js

@@ -39,7 +39,7 @@ module.exports = [
             : a.baseModelId ||
               getSelectedModel(a.baseHarnessId) ||
               DEFAULT_SELECTED_MODELS[a.baseHarnessId];
-          return `- ${a.name} (${a.id}) ${tag}\n  ${a.description || 'No description'}\n  harness: ${a.baseHarnessId} | model: ${model}`;
+          return `- ${a.name} (${a.id}) ${tag}\n  ${a.description || 'No description'}\n  adapter: ${a.adapter || a.baseHarnessId} | harness: ${a.baseHarnessId} | model: ${model}\n  location: ${a.locationName || a.location?.name || 'this computer'} | status: ${a.status || 'unknown'}`;
         })
         .join('\n\n');
       return textResult(`Available agents:\n\n${summary}`);
@@ -61,6 +61,7 @@ module.exports = [
         id: agent.id,
         name: agent.name,
         description: agent.description,
+        adapter: agent.adapter || agent.baseHarnessId,
         baseHarnessId: agent.baseHarnessId,
         baseModelId: agent.builtin
           ? getSelectedModel(agent.baseHarnessId) || agent.baseModelId
@@ -72,7 +73,17 @@ module.exports = [
           inheritAll: agent.mcp?.inheritAll ?? true,
           customServerCount: agent.mcp?.customServers?.length ?? 0,
         },
+        tools: agent.tools || { mode: 'all', selectedToolIds: [] },
+        location: agent.location || null,
+        locationName: agent.locationName || null,
+        ownerComputerId: agent.ownerComputerId || null,
+        status: agent.status || 'unknown',
+        installStatus: agent.installStatus || 'unknown',
+        authStatus: agent.authStatus || 'unknown',
+        capabilities: agent.capabilities || {},
         builtin: !!agent.builtin,
+        deletable: agent.deletable !== false,
+        editable: agent.editable !== false,
       };
       return textResult(JSON.stringify(safe, null, 2));
     },

package/runtime/scripts/amalgm-mcp/artifacts/store.js

@@ -15,6 +15,7 @@ const {
   ARTIFACT_PORT_MAX,
 } = require('../config');
 const { ensureDir, readJson, writeJsonAtomic } = require('../lib/storage');
+const { appendStateEvent } = require('../state/events');
 
 function ensureArtifactsDirs() {
   ensureDir(ARTIFACTS_DIR);
@@ -66,12 +67,27 @@ function loadArtifacts() {
   return { version: 1, artifacts };
 }
 
-function saveArtifacts(data) {
+function publishArtifactsChange(data, source = 'artifacts') {
+  try {
+    appendStateEvent({
+      resource: 'artifacts',
+      op: 'replace',
+      value: Array.isArray(data?.artifacts) ? data.artifacts.map(normalizeArtifact) : [],
+      source,
+    });
+  } catch (error) {
+    console.warn('[Artifacts] Local Live Store publish failed:', error.message);
+  }
+}
+
+function saveArtifacts(data, options = {}) {
   ensureDir(ARTIFACTS_DIR);
-  writeJsonAtomic(ARTIFACTS_FILE, {
+  const normalizedData = {
     version: 1,
     artifacts: Array.isArray(data.artifacts) ? data.artifacts.map(normalizeArtifact) : [],
-  });
+  };
+  writeJsonAtomic(ARTIFACTS_FILE, normalizedData);
+  publishArtifactsChange(normalizedData, options.source || 'artifacts:save');
 }
 
 function updateArtifactMeta(artifactId, updates) {

package/runtime/scripts/amalgm-mcp/config.js

@@ -22,6 +22,7 @@ const AMALGM_DIR = process.env.AMALGM_DIR || path.join(os.homedir(), '.amalgm');
 
 // Storage file/dir layout under AMALGM_DIR.
 const STORAGE_DIR = AMALGM_DIR; // tasks.json etc. live directly under ~/.amalgm
+const LOCAL_DB_FILE = path.join(STORAGE_DIR, 'amalgm.db');
 const TASKS_FILE = path.join(STORAGE_DIR, 'tasks.json');
 const AGENTS_FILE = path.join(STORAGE_DIR, 'agents.json');
 const ARTIFACTS_DIR = path.join(STORAGE_DIR, 'artifacts');
@@ -110,6 +111,7 @@ module.exports = {
   MCP_PROTOCOL_VERSION,
   AMALGM_DIR,
   STORAGE_DIR,
+  LOCAL_DB_FILE,
   TASKS_FILE,
   AGENTS_FILE,
   ARTIFACTS_DIR,

package/runtime/scripts/amalgm-mcp/events/store.js

@@ -11,6 +11,7 @@ const {
 } = require('../../../lib/chatInput');
 const { DEFAULT_SELECTED_MODELS, getSelectedModel } = require('../lib/prefs');
 const credentialAdapter = require('../../credential-adapter');
+const { appendStateEvent } = require('../state/events');
 
 function normalizeStoredTrigger(trigger) {
   const harness =
@@ -91,8 +92,22 @@ function loadEventTriggers() {
   return migrated.data;
 }
 
-function saveEventTriggers(data) {
+function publishEventTriggersChange(data, source = 'event-triggers') {
+  try {
+    appendStateEvent({
+      resource: 'event_triggers',
+      op: 'replace',
+      value: Array.isArray(data?.triggers) ? data.triggers : [],
+      source,
+    });
+  } catch (error) {
+    console.warn('[Events] Local Live Store publish failed:', error.message);
+  }
+}
+
+function saveEventTriggers(data, options = {}) {
   writeJsonAtomic(EVENT_TRIGGERS_FILE, data);
+  publishEventTriggersChange(data, options.source || 'event-triggers:save');
 }
 
 module.exports = { ensureTriggersDirs, loadEventTriggers, saveEventTriggers };

package/runtime/scripts/amalgm-mcp/lib/prefs.js

@@ -17,6 +17,24 @@ const DEFAULT_SELECTED_MODELS = {
   cursor: 'cursor/composer-2-fast',
 };
 
+const DEFAULT_AUTH_METHODS = {
+  claude_code: 'amalgm',
+  codex: 'amalgm',
+  opencode: 'amalgm',
+  pi: 'amalgm',
+  amp: 'provider_auth',
+  cursor: 'provider_auth',
+};
+
+const SUPPORTED_AUTH_BY_HARNESS = {
+  claude_code: ['amalgm', 'byok', 'provider_auth'],
+  codex: ['amalgm', 'byok', 'provider_auth'],
+  opencode: ['amalgm', 'byok'],
+  pi: ['amalgm', 'byok', 'provider_auth'],
+  amp: ['provider_auth'],
+  cursor: ['provider_auth'],
+};
+
 const GATEWAY_PROVIDER_PREFIXES = [
   'prime-intellect', 'arcee-ai',
   'alibaba', 'amazon', 'anthropic', 'bytedance', 'cohere', 'deepseek',
@@ -107,9 +125,18 @@ const CURSOR_MODEL_ALIASES = {
 };
 
 const _selectedModels = { ...DEFAULT_SELECTED_MODELS };
+const _authMethods = {};
 let _pinnedHarness = null;
 let _pinnedModel = null;
 let _prefsHydrated = false;
+let _prefsHydratePromise = null;
+
+function coerceAuthMethodForHarness(harnessId, authMethod) {
+  const supported = SUPPORTED_AUTH_BY_HARNESS[harnessId] || ['amalgm'];
+  return supported.includes(authMethod)
+    ? authMethod
+    : DEFAULT_AUTH_METHODS[harnessId] || supported[0] || 'amalgm';
+}
 
 function cleanModelId(value) {
   return String(value || '').trim().replace(/^vercel\//i, '').toLowerCase();
@@ -319,47 +346,60 @@ function resolveCliModel(harnessId, modelId) {
 }
 
 async function hydrateModelPreferences() {
+  if (_prefsHydratePromise) return _prefsHydratePromise;
   if (_prefsHydrated || !hasSupabase()) return;
-  _prefsHydrated = true;
-  try {
-    const rows = await supabaseSelect(
-      'user_preferences',
-      `user_id=eq.${AMALGM_USER_ID}&select=preferences`,
-    );
-    if (!rows) return;
-    const preferences = rows?.[0]?.preferences;
-    const recentPrefs = preferences?.recent_prefs;
-    if (recentPrefs && typeof recentPrefs === 'object') {
-      for (const [h, m] of Object.entries(recentPrefs)) {
-        if (m) {
-          const normalized = normalizeModelSelection(h, m).modelId || m;
-          if (_selectedModels[h] !== normalized) _selectedModels[h] = normalized;
+  _prefsHydratePromise = (async () => {
+    _prefsHydrated = true;
+    try {
+      const rows = await supabaseSelect(
+        'user_preferences',
+        `user_id=eq.${AMALGM_USER_ID}&select=preferences`,
+      );
+      if (!rows) return;
+      const preferences = rows?.[0]?.preferences;
+      const recentPrefs = preferences?.recent_prefs;
+      if (recentPrefs && typeof recentPrefs === 'object') {
+        for (const [h, m] of Object.entries(recentPrefs)) {
+          if (m) {
+            const normalized = normalizeModelSelection(h, m).modelId || m;
+            if (_selectedModels[h] !== normalized) _selectedModels[h] = normalized;
+          }
         }
       }
+      const usagePrefs = preferences?.usage;
+      if (usagePrefs && typeof usagePrefs === 'object') {
+        for (const [h, method] of Object.entries(usagePrefs)) {
+          if (method) _authMethods[h] = coerceAuthMethodForHarness(h, method);
+        }
+      }
+      _pinnedHarness = preferences?.autopilot?.harness || null;
+      const rawPinnedModel = preferences?.autopilot?.model || null;
+      if (rawPinnedModel) {
+        const harnessForPinned =
+          _pinnedHarness ||
+          inferHarnessForModel(rawPinnedModel, preferences?.last_used?.harness || null);
+        _pinnedModel = harnessForPinned
+          ? normalizeModelSelection(harnessForPinned, rawPinnedModel).modelId || rawPinnedModel
+          : rawPinnedModel;
+      } else {
+        _pinnedModel = null;
+      }
+      console.log(
+        '[AmalgmMCP] Hydrated user prefs:',
+        JSON.stringify({
+          selectedModels: _selectedModels,
+          authMethods: _authMethods,
+          pinnedHarness: _pinnedHarness,
+          pinnedModel: _pinnedModel,
+        }),
+      );
+    } catch (err) {
+      console.warn('[AmalgmMCP] Failed to hydrate user prefs:', err.message);
+    } finally {
+      _prefsHydratePromise = null;
     }
-    _pinnedHarness = preferences?.autopilot?.harness || null;
-    const rawPinnedModel = preferences?.autopilot?.model || null;
-    if (rawPinnedModel) {
-      const harnessForPinned =
-        _pinnedHarness ||
-        inferHarnessForModel(rawPinnedModel, preferences?.last_used?.harness || null);
-      _pinnedModel = harnessForPinned
-        ? normalizeModelSelection(harnessForPinned, rawPinnedModel).modelId || rawPinnedModel
-        : rawPinnedModel;
-    } else {
-      _pinnedModel = null;
-    }
-    console.log(
-      '[AmalgmMCP] Hydrated user prefs:',
-      JSON.stringify({
-        selectedModels: _selectedModels,
-        pinnedHarness: _pinnedHarness,
-        pinnedModel: _pinnedModel,
-      }),
-    );
-  } catch (err) {
-    console.warn('[AmalgmMCP] Failed to hydrate user prefs:', err.message);
-  }
+  })();
+  return _prefsHydratePromise;
 }
 
 function getSelectedModel(harnessId) {
@@ -367,6 +407,13 @@ function getSelectedModel(harnessId) {
   return _selectedModels[harnessId] || DEFAULT_SELECTED_MODELS[harnessId] || null;
 }
 
+function getPreferredAuthMethod(harnessId, fallbackAuthMethod) {
+  if (Object.prototype.hasOwnProperty.call(_authMethods, harnessId)) {
+    return coerceAuthMethodForHarness(harnessId, _authMethods[harnessId]);
+  }
+  return coerceAuthMethodForHarness(harnessId, fallbackAuthMethod);
+}
+
 function resolveModelSelection(harnessId, uiModelId) {
   const selectedModelId =
     uiModelId ||
@@ -389,5 +436,6 @@ module.exports = {
   DEFAULT_SELECTED_MODELS,
   hydrateModelPreferences,
   getSelectedModel,
+  getPreferredAuthMethod,
   resolveModelSelection,
 };

package/runtime/scripts/amalgm-mcp/local/rest.js

@@ -9,9 +9,11 @@ const {
 } = require('../../../lib/local/credentialResolver.js');
 const {
   ensureAmalgmDir,
+  getAmalgmWorkspaceRoot,
   getHomeDir,
   writeResource,
 } = require('../../../lib/local/amalgmStore.js');
+const { syncDiscoveredAgents } = require('../agents/store');
 
 function cacheDiscovery(agents) {
   writeResource('agents/discovery.json', {
@@ -26,12 +28,14 @@ async function handleInit(sendJson) {
     const { created, path: amalgmPath } = ensureAmalgmDir();
     const agents = discoverAgents();
     cacheDiscovery(agents);
+    syncDiscoveredAgents(agents);
 
     sendJson(200, {
       ok: true,
       created,
       amalgmPath,
       homedir: getHomeDir(),
+      workspaceRoot: getAmalgmWorkspaceRoot(),
       agents,
     });
   } catch (error) {
@@ -43,11 +47,14 @@ async function handleInit(sendJson) {
 
 async function handleCredentials(sendJson) {
   try {
+    ensureAmalgmDir();
     const agents = discoverAgents();
     cacheDiscovery(agents);
+    syncDiscoveredAgents(agents);
     sendJson(200, {
       agents,
       homedir: getHomeDir(),
+      workspaceRoot: getAmalgmWorkspaceRoot(),
     });
   } catch (error) {
     sendJson(500, {

package/runtime/scripts/amalgm-mcp/mcp-connections/rest.js

@@ -7,9 +7,40 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const { AMALGM_DIR } = require('../config');
+const { deleteTool, upsertTool } = require('../toolbox/store');
 
 const CONNECTIONS_FILE = path.join(AMALGM_DIR, 'mcp-connections.json');
 const CLAUDE_FILE = path.join(os.homedir(), '.claude.json');
+let mcpRegistry = null;
+let mcpRegistryLoadAttempted = false;
+let warnedRegistryLoadFailure = false;
+
+function getMcpRegistry() {
+  if (mcpRegistry) return mcpRegistry;
+  if (mcpRegistryLoadAttempted) return null;
+  mcpRegistryLoadAttempted = true;
+
+  const candidates = [
+    path.join(__dirname, '../../../lib/mcpApps/registry.ts'),
+    path.join(__dirname, '../../../../web/lib/mcpApps/registry.ts'),
+  ];
+
+  for (const candidate of candidates) {
+    if (!fs.existsSync(candidate)) continue;
+    try {
+      require('tsx/cjs');
+      mcpRegistry = require(candidate);
+      return mcpRegistry;
+    } catch (err) {
+      if (!warnedRegistryLoadFailure) {
+        warnedRegistryLoadFailure = true;
+        console.warn('[mcp-connections] MCP registry metadata unavailable:', err?.message || String(err));
+      }
+    }
+  }
+
+  return null;
+}
 
 function emptyFile() {
   return { version: 1, connections: {} };
@@ -47,6 +78,7 @@ function sanitizeConnections(connections) {
     sanitized[appId] = {
       enabled: !!conn.enabled,
       authType: conn.authType,
+      owner: conn.owner || 'amalgm',
       instanceUrl: conn.instanceUrl,
       config: conn.config,
     };
@@ -71,6 +103,53 @@ function readNativeMcps() {
   }
 }
 
+function mirrorConnectionToToolbox(appId, conn) {
+  const registry = getMcpRegistry();
+  const app = registry?.getMcpApp?.(appId);
+  const config = app
+    ? registry.buildSessionConfig(
+      app,
+      undefined,
+      { instanceUrl: conn?.instanceUrl, config: conn?.config },
+    )
+    : {
+      type: conn?.transport || conn?.config?.transport || 'http',
+      url: conn?.instanceUrl || conn?.config?.url,
+    };
+
+  upsertTool({
+    id: app?.id || appId,
+    name: app?.name || appId,
+    type: 'mcp',
+    owner: conn?.owner || 'amalgm',
+    origin: 'catalog',
+    status: conn?.enabled === false ? 'disabled' : 'enabled',
+    source: {
+      transport: config.type,
+      url: config.url,
+    },
+    discovery: { mode: 'dynamic' },
+    display: {
+      icon: app?.iconUrl,
+      description: app?.description,
+      docsUrl: app?.docsUrl,
+    },
+    policy: {
+      connector: true,
+      authType: app?.authType || conn?.authType,
+    },
+  });
+}
+
+function removeConnectionFromToolbox(appId) {
+  try {
+    deleteTool(appId);
+  } catch {
+    // The toolbox mirror is best-effort; MCP connection removal should still
+    // succeed even if a future system connector cannot be deleted.
+  }
+}
+
 async function handleList(sendJson) {
   const file = readConnectionsFile();
   sendJson(200, {
@@ -92,6 +171,7 @@ async function handleUpsert(body, sendJson) {
     instanceUrl,
     config,
     enabled,
+    owner,
   } = body || {};
 
   if (!appId || !authType) {
@@ -109,6 +189,7 @@ async function handleUpsert(body, sendJson) {
     ...existing,
     enabled: enabled ?? true,
     authType,
+    owner: owner || existing.owner || 'amalgm',
     ...(apiKey ? { apiKey: String(apiKey).trim() } : {}),
     ...(accessToken ? { accessToken } : {}),
     ...(refreshToken ? { refreshToken } : {}),
@@ -121,6 +202,7 @@ async function handleUpsert(body, sendJson) {
   };
 
   writeConnectionsFile(file);
+  mirrorConnectionToToolbox(appId, file.connections[appId]);
 
   sendJson(200, {
     ok: true,
@@ -140,6 +222,7 @@ async function handleDelete(body, sendJson) {
     delete file.connections[appId];
     writeConnectionsFile(file);
   }
+  removeConnectionFromToolbox(appId);
 
   sendJson(200, { ok: true });
 }

package/runtime/scripts/amalgm-mcp/server/core-tools.js

@@ -0,0 +1,20 @@
+'use strict';
+
+/**
+ * Built-in Amalgm MCP tools.
+ *
+ * This module intentionally excludes toolbox management/dynamic toolbox actions
+ * so the toolbox store can seed the built-in Amalgm tool catalog without a
+ * circular dependency on the MCP server.
+ */
+
+const CORE_TOOLS = [
+  ...require('../tasks/tools'),
+  ...require('../events/tools'),
+  ...require('../notify'),
+  ...require('../agents/tools'),
+  ...require('../artifacts/tools'),
+  ...require('../browser/tools'),
+];
+
+module.exports = { CORE_TOOLS };

package/runtime/scripts/amalgm-mcp/server/http.js

@@ -14,6 +14,7 @@
  *   GET  /event-triggers/list         → list triggers
  *   POST /event-triggers/{create,update,delete}
  *   GET  /workspace/projects          → list projects
+ *   POST /workspace/import           → copy a local folder into workspaces
  *   POST /github/clone               → clone repository onto the computer
  *   GET  /workspace/branches          → list git branches
  *   POST /workspace/checkout          → checkout git branch
@@ -27,6 +28,14 @@
  *   GET  /mcp-connections             → list sanitized MCP connections
  *   POST /mcp-connections             → save/update MCP connection
  *   DELETE /mcp-connections           → remove MCP connection
+ *   GET  /toolbox                     → list local ToolboxDB tools/actions
+ *   POST /toolbox/tools               → save/update a toolbox tool
+ *   DELETE /toolbox/tools             → remove a toolbox tool
+ *   POST /toolbox/actions             → save/update a toolbox action
+ *   DELETE /toolbox/actions           → remove a toolbox action
+ *   GET  /state/snapshot              → current Local Live Store snapshot
+ *   GET  /state/events                → replay Local Live Store events
+ *   GET  /state/stream                → SSE Local Live Store stream
  *   POST /local/init                  → init local computer state
  *   GET  /local/credentials           → discover local agent auth
  *   POST /local/credentials/resolve   → resolve spawn env for agent auth
@@ -65,6 +74,8 @@ const slackInbound = require('../slack/inbound');
 const fsRest = require('../fs/rest');
 const localRest = require('../local/rest');
 const mcpConnectionsRest = require('../mcp-connections/rest');
+const toolboxRest = require('../toolbox/rest');
+const stateRest = require('../state/rest');
 const tasksRest = require('../tasks/rest');
 const userApiKeysRest = require('../user-api-keys/rest');
 const credentialsRest = require('../credentials/rest');
@@ -113,6 +124,17 @@ function createServer() {
         });
       }
 
+      // ── /state — Local Live Store snapshot/replay/stream ─────────────────
+      if (req.url.startsWith('/state/snapshot') && req.method === 'GET') {
+        return stateRest.handleSnapshot(getQuery(), sendJson);
+      }
+      if (req.url.startsWith('/state/events') && req.method === 'GET') {
+        return stateRest.handleEvents(getQuery(), sendJson);
+      }
+      if (req.url.startsWith('/state/stream') && req.method === 'GET') {
+        return stateRest.handleStream(req, res, getQuery());
+      }
+
       // ── /agents (REST, not MCP) ─────────────────────────────────────────────
       if (req.url === '/agents/list' && req.method === 'GET') {
         return agentsRest.handleList(sendJson);
@@ -173,6 +195,9 @@ function createServer() {
       if (req.url === '/workspace/projects' && req.method === 'GET') {
         return workspaceRest.handleProjects(sendJson);
       }
+      if (req.url === '/workspace/import' && req.method === 'POST') {
+        return workspaceRest.handleImport(await readJsonBody(), sendJson);
+      }
       if (req.url === '/github/clone' && req.method === 'POST') {
         return workspaceRest.handleClone(await readJsonBody(), sendJson);
       }
@@ -226,6 +251,23 @@ function createServer() {
         return mcpConnectionsRest.handleDelete(await readJsonBody(), sendJson);
       }
 
+      // ── /toolbox REST ─────────────────────────────────────────────────────
+      if (req.url === '/toolbox' && req.method === 'GET') {
+        return toolboxRest.handleList(sendJson);
+      }
+      if (req.url === '/toolbox/tools' && req.method === 'POST') {
+        return toolboxRest.handleUpsertTool(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/toolbox/tools' && req.method === 'DELETE') {
+        return toolboxRest.handleDeleteTool(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/toolbox/actions' && req.method === 'POST') {
+        return toolboxRest.handleUpsertAction(await readJsonBody(), sendJson);
+      }
+      if (req.url === '/toolbox/actions' && req.method === 'DELETE') {
+        return toolboxRest.handleDeleteAction(await readJsonBody(), sendJson);
+      }
+
       // ── /local REST ────────────────────────────────────────────────────────
       if (req.url === '/local/init' && req.method === 'POST') {
         return localRest.handleInit(sendJson);