amalgm 0.1.0-canary.29 → 0.1.36

package/README.md

@@ -3,14 +3,14 @@
 Install the local Amalgm computer runtime:
 
 ```sh
-npm i -g amalgm@canary
+npm i -g amalgm
 amalgm login
 amalgm doctor
 amalgm start
 ```
 
-To move an existing install to the newest published build, run `amalgm update --tag canary`.
-Set `AMALGM_AUTO_UPDATE=1` when running `amalgm start` to let the CLI update itself before launching if its current dist-tag has moved.
+To move an existing install to the newest stable published build, run `amalgm update`.
+Set `AMALGM_AUTO_UPDATE=1` when running `amalgm start` to let the CLI update itself to the latest stable release before launching.
 
 `amalgm login` opens a browser approval page, then registers the machine and stores its local tunnel/computer record in `~/.amalgm/computer.json`.
 
@@ -37,7 +37,7 @@ Useful commands:
 
 ```sh
 amalgm status
-amalgm update --tag canary
+amalgm update
 amalgm logs
 amalgm logs chat-server
 amalgm stop

package/lib/cli.js

@@ -85,7 +85,7 @@ function usage() {
     '',
     'Environment:',
     '  AMALGM_APP_URL        Web app base URL for login/register',
-    '  AMALGM_AUTO_UPDATE    Set to 1 to update before start when a newer dist-tag exists',
+    '  AMALGM_AUTO_UPDATE    Set to 1 to update to the latest stable release before start',
     '  AMALGM_DIR            Runtime state dir (default ~/.amalgm)',
     '  AMALGM_PROXY_TOKEN    Optional short-lived proxy token override',
   ].join('\n');
@@ -419,7 +419,7 @@ function npmCommand() {
 function npmInstallTag(options = {}) {
   const explicit = options.tag || options.channel;
   if (explicit && explicit !== true) return String(explicit).replace(/^@/, '');
-  return PACKAGE_VERSION.includes('-canary.') ? 'canary' : 'latest';
+  return 'latest';
 }
 
 function npmPackageVersionForTag(tag) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.0-canary.29",
+  "version": "0.1.36",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,

package/runtime/scripts/amalgm-mcp/state/snapshot.js

@@ -52,20 +52,38 @@ function readResource(resource, cache) {
 
 function buildSnapshot(resourcesInput) {
   const resources = normalizeResources(resourcesInput);
-  const beforeSeq = currentSeq();
-  const cache = {};
-  const data = {};
+  let lastUnstable = null;
 
-  for (const resource of resources) {
-    const value = readResource(resource, cache);
-    if (value !== undefined) data[resource] = value;
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    const beforeSeq = currentSeq();
+    const cache = {};
+    const data = {};
+
+    for (const resource of resources) {
+      const value = readResource(resource, cache);
+      if (value !== undefined) data[resource] = value;
+    }
+
+    const afterSeq = currentSeq();
+    if (beforeSeq === afterSeq) {
+      return {
+        seq: afterSeq,
+        stable: true,
+        resources: data,
+      };
+    }
+
+    lastUnstable = {
+      seq: beforeSeq,
+      stable: false,
+      resources: data,
+    };
   }
 
-  const afterSeq = currentSeq();
-  return {
-    seq: afterSeq,
-    stable: beforeSeq === afterSeq,
-    resources: data,
+  return lastUnstable || {
+    seq: currentSeq(),
+    stable: true,
+    resources: {},
   };
 }
 

package/runtime/scripts/amalgm-mcp/tasks/scheduler.js

@@ -57,7 +57,9 @@ function isTaskDue(task, now) {
         currentDate: now,
         tz: schedule.tz || 'UTC',
       });
-      const prev = interval.prev().toDate();
+      const prev = interval.includesDate(now)
+        ? new Date(Math.floor(now.getTime() / 1000) * 1000)
+        : interval.prev().toDate();
       const createdAt = validDate(task.createdAt);
       const lastRunAt = validDate(task.lastRunAt);
 
@@ -68,8 +70,9 @@ function isTaskDue(task, now) {
     }
   }
   if (schedule.kind === 'interval') {
-    if (!task.lastRunAt) return true;
-    return now - new Date(task.lastRunAt) >= schedule.ms;
+    const baseline = validDate(task.lastRunAt) || validDate(task.createdAt);
+    if (!baseline) return true;
+    return now - baseline >= schedule.ms;
   }
   return false;
 }

package/runtime/scripts/amalgm-mcp/tests/events-matcher.test.js

@@ -0,0 +1,45 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+const {
+  computeSignature,
+  extractSignature,
+  matchBySignature,
+} = require('../events/matcher');
+
+function trigger(overrides = {}) {
+  return {
+    id: 'trigger-1',
+    enabled: true,
+    secret: 'super-secret',
+    ...overrides,
+  };
+}
+
+test('event matcher accepts generic HMAC webhook signatures', () => {
+  const rawBody = JSON.stringify({ ok: true });
+  const signature = extractSignature({
+    'x-webhook-signature': computeSignature('super-secret', rawBody),
+  });
+
+  assert.equal(matchBySignature([trigger()], signature, rawBody)?.id, 'trigger-1');
+});
+
+test('event matcher accepts bearer token webhook secrets', () => {
+  const signature = extractSignature({
+    authorization: 'Bearer super-secret',
+  });
+
+  assert.equal(matchBySignature([trigger()], signature, '{}')?.id, 'trigger-1');
+});
+
+test('event matcher rejects disabled triggers and wrong secrets', () => {
+  const rawBody = JSON.stringify({ ok: true });
+  const signature = extractSignature({
+    'x-webhook-signature': computeSignature('wrong-secret', rawBody),
+  });
+
+  assert.equal(matchBySignature([trigger(), trigger({ id: 'disabled', enabled: false })], signature, rawBody), null);
+});

package/runtime/scripts/amalgm-mcp/tests/local-live-snapshot.test.js

@@ -0,0 +1,44 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+let seq = 0;
+const eventsPath = require.resolve('../state/events');
+require.cache[eventsPath] = {
+  id: eventsPath,
+  filename: eventsPath,
+  loaded: true,
+  exports: {
+    currentSeq: () => seq,
+  },
+};
+
+const taskStore = require('../tasks/store');
+const { buildSnapshot } = require('../state/snapshot');
+
+test.after(() => {
+  taskStore.loadTasks = originalLoadTasks;
+  delete require.cache[eventsPath];
+});
+
+const originalLoadTasks = taskStore.loadTasks;
+
+test('snapshot retries when a state event lands during resource reads', () => {
+  let calls = 0;
+  taskStore.loadTasks = () => {
+    calls += 1;
+    if (calls === 1) {
+      seq = 1;
+      return { version: 1, tasks: [{ id: 'stale-task', name: 'Stale task' }] };
+    }
+    return { version: 1, tasks: [{ id: 'new-task', name: 'New task' }] };
+  };
+
+  const snapshot = buildSnapshot('tasks');
+
+  assert.equal(calls, 2);
+  assert.equal(snapshot.stable, true);
+  assert.equal(snapshot.seq, 1);
+  assert.deepEqual(snapshot.resources.tasks, [{ id: 'new-task', name: 'New task' }]);
+});

package/runtime/scripts/amalgm-mcp/tests/scheduler.test.js

@@ -0,0 +1,64 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+const { isTaskDue } = require('../tasks/scheduler');
+
+function baseTask(overrides = {}) {
+  return {
+    id: 'task-1',
+    enabled: true,
+    createdAt: '2026-05-18T10:00:00.000Z',
+    lastRunAt: null,
+    endsAt: null,
+    schedule: { kind: 'once', at: '2026-05-18T10:01:00.000Z' },
+    ...overrides,
+  };
+}
+
+test('interval task waits for the first interval after creation', () => {
+  const task = baseTask({
+    schedule: { kind: 'interval', ms: 60_000 },
+  });
+
+  assert.equal(isTaskDue(task, new Date('2026-05-18T10:00:30.000Z')), false);
+  assert.equal(isTaskDue(task, new Date('2026-05-18T10:01:00.000Z')), true);
+});
+
+test('interval task uses lastRunAt after the first run', () => {
+  const task = baseTask({
+    lastRunAt: '2026-05-18T10:03:00.000Z',
+    schedule: { kind: 'interval', ms: 60_000 },
+  });
+
+  assert.equal(isTaskDue(task, new Date('2026-05-18T10:03:59.000Z')), false);
+  assert.equal(isTaskDue(task, new Date('2026-05-18T10:04:00.000Z')), true);
+});
+
+test('cron task is due at the exact scheduled boundary in its timezone', () => {
+  const task = baseTask({
+    createdAt: '2026-05-18T15:55:00.000Z',
+    schedule: {
+      kind: 'cron',
+      expr: '0 9 * * *',
+      tz: 'America/Los_Angeles',
+    },
+  });
+
+  assert.equal(isTaskDue(task, new Date('2026-05-18T16:00:00.000Z')), true);
+});
+
+test('cron task does not rerun for the same scheduled instant', () => {
+  const task = baseTask({
+    createdAt: '2026-05-18T15:55:00.000Z',
+    lastRunAt: '2026-05-18T16:00:00.000Z',
+    schedule: {
+      kind: 'cron',
+      expr: '0 9 * * *',
+      tz: 'America/Los_Angeles',
+    },
+  });
+
+  assert.equal(isTaskDue(task, new Date('2026-05-18T16:00:30.000Z')), false);
+});