amalgm 0.1.120 → 0.1.121

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.120",
+  "version": "0.1.121",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,

package/runtime/scripts/amalgm-mcp/agent-bundles/bundles.js

@@ -0,0 +1,402 @@
+'use strict';
+
+const crypto = require('crypto');
+
+const { getAgentConfig, upsertAgentConfig, agentFieldsFromConfig } = require('../agent-config/store');
+const { normalizeAgentConfig } = require('../agent-config/schema');
+const { createAgent, getAllAgentsWithBuiltins, resolveAgent } = require('../agents/store');
+const { defaultToolboxService } = require('../toolbox/service');
+
+const BUNDLE_KIND = 'amalgm.agent.bundle';
+const BUNDLE_SCHEMA_VERSION = 1;
+
+const SECRET_KEY_PATTERN = /(api[_-]?key|authorization|bearer|cookie|password|passwd|secret|token|credential|private[_-]?key)/i;
+
+function nowIso() {
+  return new Date().toISOString();
+}
+
+function isObject(value) {
+  return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+
+function cloneJson(value) {
+  if (value == null) return value;
+  return JSON.parse(JSON.stringify(value));
+}
+
+function uniqueStrings(values) {
+  if (!Array.isArray(values)) return [];
+  return [...new Set(values
+    .filter((value) => typeof value === 'string')
+    .map((value) => value.trim())
+    .filter(Boolean))];
+}
+
+function addUnique(target, value) {
+  if (!value) return;
+  if (!target.includes(value)) target.push(value);
+}
+
+function bundleId() {
+  return `agent-bundle-${crypto.randomUUID()}`;
+}
+
+function portableAgent(agent) {
+  return {
+    sourceAgentId: agent.id,
+    name: agent.name || agent.id,
+    description: agent.description || '',
+    baseHarnessId: agent.baseHarnessId || agent.adapter || 'codex',
+    baseModelId: agent.baseModelId || '',
+    modelSettings: isObject(agent.modelSettings) ? cloneJson(agent.modelSettings) : null,
+    authMethod: agent.authMethod || 'amalgm',
+  };
+}
+
+function scrubSecrets(value, path, requires) {
+  if (Array.isArray(value)) {
+    return value.map((entry, index) => scrubSecrets(entry, `${path}[${index}]`, requires));
+  }
+  if (!isObject(value)) return value;
+
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    const childPath = path ? `${path}.${key}` : key;
+    if (SECRET_KEY_PATTERN.test(key)) {
+      addUnique(requires.secrets, childPath);
+      continue;
+    }
+    out[key] = scrubSecrets(child, childPath, requires);
+  }
+  return out;
+}
+
+function sourceBindingRequirements(tool, requires) {
+  const source = isObject(tool?.source) ? tool.source : {};
+  if (typeof source.cwd === 'string' && source.cwd.trim()) {
+    addUnique(requires.bindings, `tool:${tool.id}:cwd`);
+  }
+  for (const key of ['command', 'url', 'baseUrl', 'specUrl', 'specPath']) {
+    const value = source[key];
+    if (typeof value === 'string' && value.startsWith('/')) {
+      addUnique(requires.bindings, `tool:${tool.id}:source.${key}`);
+    }
+  }
+  if (Array.isArray(source.args)) {
+    source.args.forEach((arg, index) => {
+      if (typeof arg === 'string' && arg.startsWith('/')) {
+        addUnique(requires.bindings, `tool:${tool.id}:source.args[${index}]`);
+      }
+    });
+  }
+}
+
+function portableTool(tool, requires) {
+  sourceBindingRequirements(tool, requires);
+  return scrubSecrets(cloneJson(tool), `tools.${tool.id}`, requires);
+}
+
+function portableAction(action, requires) {
+  return scrubSecrets(cloneJson(action), `toolActions.${action.id}`, requires);
+}
+
+function countHooks(bundleAgents) {
+  return bundleAgents.reduce((count, entry) => (
+    count + (Array.isArray(entry.config?.hooks) ? entry.config.hooks.length : 0)
+  ), 0);
+}
+
+function collectSkillRecords(bundleAgents) {
+  const byId = new Map();
+  for (const entry of bundleAgents) {
+    for (const skill of entry.config.skills || []) {
+      if (!skill?.id) continue;
+      byId.set(skill.id, cloneJson(skill));
+    }
+  }
+  return [...byId.values()];
+}
+
+function collectToolRecords(toolIds, requires) {
+  const catalog = defaultToolboxService.readCatalog();
+  const tools = new Map();
+  const actions = new Map();
+  const selected = uniqueStrings(toolIds);
+
+  for (const selectedId of selected) {
+    const selectedTool = catalog.tools?.[selectedId];
+    const selectedAction = catalog.toolActions?.[selectedId];
+    const tool = selectedTool || (selectedAction ? catalog.tools?.[selectedAction.toolId] : null);
+
+    if (!tool) {
+      addUnique(requires.missingTools, selectedId);
+      continue;
+    }
+
+    if (tool.origin === 'system') {
+      addUnique(requires.systemTools, tool.id);
+      continue;
+    }
+
+    if (!tools.has(tool.id)) tools.set(tool.id, portableTool(tool, requires));
+
+    if (selectedAction) {
+      actions.set(selectedAction.id, portableAction(selectedAction, requires));
+      continue;
+    }
+
+    for (const action of Object.values(catalog.toolActions || {})) {
+      if (action?.toolId === tool.id) actions.set(action.id, portableAction(action, requires));
+    }
+  }
+
+  return {
+    tools: [...tools.values()],
+    toolActions: [...actions.values()],
+  };
+}
+
+function collectAgentGraph(rootAgentId) {
+  const seen = new Set();
+  const ordered = [];
+
+  function visit(agentId) {
+    if (!agentId || seen.has(agentId)) return;
+    seen.add(agentId);
+    const agent = resolveAgent(agentId);
+    if (!agent) throw new Error(`Agent not found: ${agentId}`);
+    const config = getAgentConfig(agent);
+    ordered.push({
+      sourceAgentId: agent.id,
+      agent: portableAgent(agent),
+      config: normalizeAgentConfig(config),
+    });
+    for (const subagent of config.subagents || []) {
+      if (subagent?.agentId) visit(subagent.agentId);
+    }
+  }
+
+  visit(rootAgentId);
+  return ordered;
+}
+
+function createAgentBundle(agentId, options = {}) {
+  if (!agentId) throw new Error('agent_id is required');
+  const agents = collectAgentGraph(agentId);
+  const requires = {
+    runtimes: [],
+    auth: [],
+    secrets: [],
+    bindings: [],
+    systemTools: [],
+    missingTools: [],
+  };
+
+  const loadoutToolIds = [];
+  for (const entry of agents) {
+    addUnique(requires.runtimes, entry.agent.baseHarnessId);
+    addUnique(requires.auth, `${entry.agent.baseHarnessId}:${entry.agent.authMethod || 'amalgm'}`);
+    loadoutToolIds.push(...(entry.config.loadout?.toolIds || []));
+  }
+
+  const { tools, toolActions } = collectToolRecords(loadoutToolIds, requires);
+  const skills = collectSkillRecords(agents);
+  const hooks = countHooks(agents);
+  const warnings = [
+    'Instructions, skill text, tool descriptions, and hook commands are shared as plain text.',
+    'Secrets pasted into free-text instructions or files are not automatically detected.',
+    ...(hooks > 0 ? ['This bundle includes executable hook definitions. Review commands before importing.'] : []),
+    ...(tools.length > 0 ? ['Tools can call external services or local commands. Recipients should reconnect credentials on their own machine.'] : []),
+  ];
+
+  const bundle = {
+    kind: BUNDLE_KIND,
+    schemaVersion: BUNDLE_SCHEMA_VERSION,
+    bundleId: options.bundleId || bundleId(),
+    createdAt: nowIso(),
+    rootAgentId: agents[0]?.sourceAgentId || agentId,
+    title: agents[0]?.agent?.name || 'Shared agent',
+    description: agents[0]?.agent?.description || '',
+    agents,
+    tools,
+    toolActions,
+    skills,
+    assets: [],
+    requires,
+    warnings,
+    summary: {
+      agents: agents.length,
+      tools: tools.length,
+      toolActions: toolActions.length,
+      skills: skills.length,
+      hooks,
+      assets: 0,
+    },
+  };
+
+  const bytes = Buffer.byteLength(JSON.stringify(bundle));
+  return {
+    bundle,
+    preview: {
+      bundleId: bundle.bundleId,
+      title: bundle.title,
+      description: bundle.description,
+      summary: bundle.summary,
+      requires,
+      warnings,
+      agents: agents.map((entry) => ({
+        sourceAgentId: entry.sourceAgentId,
+        name: entry.agent.name,
+        description: entry.agent.description,
+        baseHarnessId: entry.agent.baseHarnessId,
+        baseModelId: entry.agent.baseModelId,
+        tools: entry.config.loadout?.toolIds?.length || 0,
+        skills: entry.config.skills?.length || 0,
+        subagents: entry.config.subagents?.length || 0,
+        hooks: entry.config.hooks?.length || 0,
+      })),
+      tools: tools.map((tool) => ({
+        id: tool.id,
+        name: tool.name,
+        type: tool.type,
+        origin: tool.origin,
+        actionCount: toolActions.filter((action) => action.toolId === tool.id).length,
+      })),
+      sizeBytes: bytes,
+    },
+  };
+}
+
+function uniqueAgentName(name) {
+  const base = String(name || 'Imported agent').trim() || 'Imported agent';
+  const existing = new Set(
+    getAllAgentsWithBuiltins().map((agent) => String(agent.name || '').trim().toLowerCase()),
+  );
+  if (!existing.has(base.toLowerCase())) return base;
+  const imported = `${base} (imported)`;
+  if (!existing.has(imported.toLowerCase())) return imported;
+  for (let index = 2; index < 1000; index += 1) {
+    const candidate = `${base} (imported ${index})`;
+    if (!existing.has(candidate.toLowerCase())) return candidate;
+  }
+  return `${base} (${crypto.randomUUID().slice(0, 8)})`;
+}
+
+function externalMcpToolIdsForLoadout(toolIds, tools) {
+  const toolMap = new Map((Array.isArray(tools) ? tools : []).map((tool) => [tool.id, tool]));
+  return uniqueStrings(toolIds)
+    .map((toolId) => toolMap.get(toolId))
+    .filter((tool) => tool?.type === 'mcp' && tool?.origin !== 'system')
+    .map((tool) => tool.id);
+}
+
+function validateBundle(bundle) {
+  if (!isObject(bundle)) throw new Error('bundle must be an object');
+  if (bundle.kind !== BUNDLE_KIND) throw new Error(`Unsupported bundle kind: ${bundle.kind || 'unknown'}`);
+  if (bundle.schemaVersion !== BUNDLE_SCHEMA_VERSION) {
+    throw new Error(`Unsupported bundle schema version: ${bundle.schemaVersion || 'unknown'}`);
+  }
+  if (!Array.isArray(bundle.agents) || bundle.agents.length === 0) {
+    throw new Error('bundle must include at least one agent');
+  }
+  return bundle;
+}
+
+function installTools(bundle) {
+  const toolActionsByToolId = new Map();
+  for (const action of Array.isArray(bundle.toolActions) ? bundle.toolActions : []) {
+    if (!action?.toolId) continue;
+    const existing = toolActionsByToolId.get(action.toolId) || [];
+    existing.push(action);
+    toolActionsByToolId.set(action.toolId, existing);
+  }
+
+  const installed = [];
+  for (const tool of Array.isArray(bundle.tools) ? bundle.tools : []) {
+    if (!tool?.id || tool.origin === 'system') continue;
+    const result = defaultToolboxService.registerTool({
+      ...tool,
+      origin: tool.origin === 'catalog' ? 'catalog' : 'user',
+      actions: toolActionsByToolId.get(tool.id) || [],
+    });
+    installed.push(result.tool);
+  }
+  return installed;
+}
+
+function installAgentBundle(input, options = {}) {
+  const bundle = validateBundle(input);
+  const installedTools = installTools(bundle);
+  const idMap = new Map();
+  const createdAgents = [];
+  const createdAt = nowIso();
+
+  for (const entry of bundle.agents) {
+    const config = normalizeAgentConfig(entry.config || {});
+    const fields = agentFieldsFromConfig(config);
+    const agent = createAgent({
+      name: uniqueAgentName(entry.agent?.name),
+      description: entry.agent?.description || '',
+      baseHarnessId: entry.agent?.baseHarnessId || 'codex',
+      baseModelId: entry.agent?.baseModelId || '',
+      modelSettings: isObject(entry.agent?.modelSettings) ? entry.agent.modelSettings : null,
+      systemPrompt: fields.systemPrompt,
+      skills: fields.skills,
+      loadout: config.loadout || { toolIds: [] },
+      mcpAppIds: externalMcpToolIdsForLoadout(config.loadout?.toolIds || [], bundle.tools),
+      authMethod: options.authMethod || 'amalgm',
+      status: 'ready',
+      installStatus: 'external',
+      createdAt,
+    }, { source: 'agent-bundles:install' });
+    idMap.set(entry.sourceAgentId || entry.agent?.sourceAgentId, agent.id);
+    createdAgents.push({ sourceAgentId: entry.sourceAgentId, agent, config });
+  }
+
+  const installedAgents = [];
+  for (const created of createdAgents) {
+    const rewrittenConfig = normalizeAgentConfig({
+      ...created.config,
+      agentId: created.agent.id,
+      runtimeHomeLayout: 'per-agent',
+      subagents: (created.config.subagents || [])
+        .map((subagent) => {
+          const mappedAgentId = idMap.get(subagent.agentId);
+          if (!mappedAgentId) return null;
+          return {
+            ...subagent,
+            id: `subagent-${mappedAgentId}`,
+            agentId: mappedAgentId,
+          };
+        })
+        .filter(Boolean),
+    });
+    const savedConfig = upsertAgentConfig(created.agent.id, rewrittenConfig, {
+      source: 'agent-bundles:install',
+    });
+    installedAgents.push({
+      ...created.agent,
+      ...agentFieldsFromConfig(savedConfig),
+      config: savedConfig,
+    });
+  }
+
+  return {
+    ok: true,
+    bundleId: bundle.bundleId,
+    rootAgentId: idMap.get(bundle.rootAgentId) || installedAgents[0]?.id || null,
+    idMap: Object.fromEntries(idMap.entries()),
+    installedAgents,
+    installedTools,
+    warnings: bundle.warnings || [],
+  };
+}
+
+module.exports = {
+  BUNDLE_KIND,
+  BUNDLE_SCHEMA_VERSION,
+  createAgentBundle,
+  installAgentBundle,
+  validateBundle,
+};

package/runtime/scripts/amalgm-mcp/agent-bundles/rest.js

@@ -0,0 +1,36 @@
+'use strict';
+
+const {
+  createAgentBundle,
+  installAgentBundle,
+} = require('./bundles');
+
+async function handlePreview(body, sendJson) {
+  const { agent_id: agentId } = body || {};
+  if (!agentId) return sendJson(400, { error: 'agent_id is required' });
+
+  try {
+    const result = createAgentBundle(agentId);
+    return sendJson(200, { ok: true, ...result });
+  } catch (error) {
+    return sendJson(400, { error: error.message || 'Failed to create agent bundle' });
+  }
+}
+
+async function handleInstall(body, sendJson) {
+  const { bundle, authMethod } = body || {};
+  if (!bundle) return sendJson(400, { error: 'bundle is required' });
+
+  try {
+    const result = installAgentBundle(bundle, { authMethod });
+    return sendJson(200, result);
+  } catch (error) {
+    const message = error.message || 'Failed to install agent bundle';
+    return sendJson(message.includes('Unsupported bundle') ? 400 : 500, { error: message });
+  }
+}
+
+module.exports = {
+  handleInstall,
+  handlePreview,
+};

package/runtime/scripts/amalgm-mcp/server/routes/agents.js

@@ -2,6 +2,7 @@
 
 const agentsRest = require('../../agents/rest');
 const agentConfigRest = require('../../agent-config/rest');
+const agentBundlesRest = require('../../agent-bundles/rest');
 
 async function handleAgentRoutes(ctx) {
   if (ctx.pathname === '/agent-config/get' && ctx.method === 'POST') {
@@ -16,6 +17,14 @@ async function handleAgentRoutes(ctx) {
     agentConfigRest.handleImportNative(await ctx.readJsonBody(), ctx.sendJson);
     return true;
   }
+  if (ctx.pathname === '/agent-bundles/preview' && ctx.method === 'POST') {
+    agentBundlesRest.handlePreview(await ctx.readJsonBody(), ctx.sendJson);
+    return true;
+  }
+  if (ctx.pathname === '/agent-bundles/install' && ctx.method === 'POST') {
+    agentBundlesRest.handleInstall(await ctx.readJsonBody(), ctx.sendJson);
+    return true;
+  }
   if (ctx.pathname === '/agents/list' && ctx.method === 'GET') {
     agentsRest.handleList(ctx.sendJson);
     return true;

package/runtime/scripts/amalgm-mcp/tests/agent-bundles.test.js

@@ -0,0 +1,137 @@
+'use strict';
+
+process.env.AMALGM_DIR = require('node:fs').mkdtempSync(
+  require('node:path').join(require('node:os').tmpdir(), 'amalgm-agent-bundles-'),
+);
+
+const assert = require('node:assert/strict');
+const test = require('node:test');
+
+const { createAgent, resolveAgent } = require('../agents/store');
+const { upsertAgentConfig, getAgentConfig } = require('../agent-config/store');
+const { defaultToolboxService } = require('../toolbox/service');
+const { createAgentBundle, installAgentBundle } = require('../agent-bundles/bundles');
+
+test('agent bundle includes recursive subagents, selected user tools, and warnings', () => {
+  defaultToolboxService.registerTool({
+    id: 'acme.cli',
+    name: 'Acme CLI',
+    type: 'cli',
+    origin: 'user',
+    source: {
+      command: '/Users/example/acme/run.js',
+      cwd: '/Users/example/acme',
+      inputMode: 'json-stdin',
+      outputMode: 'json',
+    },
+    actions: [{
+      id: 'acme.cli.run',
+      name: 'run',
+      description: 'Run Acme.',
+      inputSchema: { type: 'object', properties: { query: { type: 'string' } } },
+    }],
+  });
+
+  const child = createAgent({
+    id: 'bundle-child',
+    name: 'Bundle Child',
+    baseHarnessId: 'codex',
+    baseModelId: 'openai/gpt-5.5',
+    systemPrompt: 'Child instructions',
+    loadout: { toolIds: ['browser'] },
+    authMethod: 'amalgm',
+  });
+  upsertAgentConfig(child.id, {
+    instructions: 'Child instructions',
+    loadout: { toolIds: ['browser'] },
+  });
+
+  const root = createAgent({
+    id: 'bundle-root',
+    name: 'Bundle Root',
+    baseHarnessId: 'codex',
+    baseModelId: 'openai/gpt-5.5',
+    systemPrompt: 'Root instructions',
+    loadout: { toolIds: ['acme.cli'] },
+    authMethod: 'amalgm',
+  });
+  upsertAgentConfig(root.id, {
+    instructions: 'Root instructions',
+    skills: [{ id: 'skill-review', name: 'Review', content: 'Review carefully.', enabled: true }],
+    loadout: { toolIds: ['acme.cli'] },
+    hooks: [{
+      id: 'hook-root',
+      name: 'Root hook',
+      event: 'UserPromptSubmit',
+      phase: 'UserPromptSubmit',
+      type: 'command',
+      command: 'node hooks/root.js',
+      enabled: true,
+    }],
+    subagents: [{
+      id: 'subagent-child',
+      agentId: child.id,
+      name: child.name,
+      enabled: true,
+    }],
+  });
+
+  const { bundle, preview } = createAgentBundle(root.id, { bundleId: 'agent-bundle-test' });
+
+  assert.equal(bundle.kind, 'amalgm.agent.bundle');
+  assert.equal(bundle.rootAgentId, root.id);
+  assert.deepEqual(bundle.agents.map((entry) => entry.sourceAgentId), [root.id, child.id]);
+  assert.deepEqual(bundle.tools.map((tool) => tool.id), ['acme.cli']);
+  assert.deepEqual(bundle.toolActions.map((action) => action.id), ['acme.cli.run']);
+  assert.equal(bundle.skills.length, 1);
+  assert.equal(bundle.summary.hooks, 1);
+  assert.equal(bundle.requires.systemTools.includes('browser'), true);
+  assert.equal(bundle.requires.bindings.includes('tool:acme.cli:cwd'), true);
+  assert.equal(bundle.requires.bindings.includes('tool:acme.cli:source.command'), true);
+  assert.equal(preview.summary.agents, 2);
+  assert.equal(preview.summary.tools, 1);
+  assert.equal(preview.warnings.some((warning) => warning.includes('free-text')), true);
+});
+
+test('installing an agent bundle creates local copies and rewrites subagent refs', () => {
+  const source = createAgent({
+    id: 'install-source-root',
+    name: 'Install Source Root',
+    baseHarnessId: 'codex',
+    baseModelId: 'openai/gpt-5.5',
+    systemPrompt: 'Install source root',
+    loadout: { toolIds: [] },
+    authMethod: 'amalgm',
+  });
+  const child = createAgent({
+    id: 'install-source-child',
+    name: 'Install Source Child',
+    baseHarnessId: 'codex',
+    baseModelId: 'openai/gpt-5.5',
+    systemPrompt: 'Install source child',
+    loadout: { toolIds: [] },
+    authMethod: 'amalgm',
+  });
+  upsertAgentConfig(child.id, {
+    instructions: 'Install source child',
+    loadout: { toolIds: [] },
+  });
+  upsertAgentConfig(source.id, {
+    instructions: 'Install source root',
+    loadout: { toolIds: [] },
+    subagents: [{ id: 'source-child', agentId: child.id, name: child.name, enabled: true }],
+  });
+
+  const { bundle } = createAgentBundle(source.id, { bundleId: 'agent-bundle-install-test' });
+  const result = installAgentBundle(bundle);
+
+  assert.equal(result.ok, true);
+  assert.equal(result.installedAgents.length, 2);
+  assert.notEqual(result.rootAgentId, source.id);
+  assert.equal(Boolean(resolveAgent(result.rootAgentId)), true);
+
+  const installedRootConfig = getAgentConfig(result.rootAgentId);
+  assert.equal(installedRootConfig.subagents.length, 1);
+  assert.notEqual(installedRootConfig.subagents[0].agentId, child.id);
+  assert.equal(Boolean(resolveAgent(installedRootConfig.subagents[0].agentId)), true);
+});