amalgm 0.1.122 → 0.1.123

package/lib/auth-store.js

@@ -10,8 +10,11 @@ const {
   AMALGM_RUNTIME_USER_SCOPE,
   AUTH_FILE,
   COMPUTER_FILE,
+  RUNTIME_AUTH_FILE,
+  RUNTIME_COMPUTER_FILE,
 } = require('./paths');
 const {
+  normalizeRuntimeLabel,
   sanitizeScopeSegment,
   scopedAmalgmDir,
 } = require('./runtime-identity');
@@ -69,10 +72,10 @@ function hasComputerSecrets(record) {
   return Array.from(SECRET_COMPUTER_KEYS).some((key) => cleanString(record[key]));
 }
 
-function publicComputerRecord(record) {
+function publicComputerRecord(record, authFile = AUTH_FILE) {
   const out = {
     ...(record || {}),
-    auth_file: path.basename(AUTH_FILE),
+    auth_file: path.basename(authFile),
   };
   for (const key of SECRET_COMPUTER_KEYS) delete out[key];
   return out;
@@ -172,15 +175,49 @@ function mergeRecordAuth(record, auth) {
   return merged;
 }
 
+function runtimeLabelFromRecord(record) {
+  return normalizeRuntimeLabel(record?.runtime_label || record?.label || record?.branch);
+}
+
+function recordMatchesCurrentRuntime(record) {
+  const label = runtimeLabelFromRecord(record);
+  if (!label) return AMALGM_RUNTIME_LABEL === 'main';
+  return label === AMALGM_RUNTIME_LABEL;
+}
+
+function assertRecordMatchesUserScope(record) {
+  const userId = cleanString(record?.user_id);
+  const expectedScope = cleanString(AMALGM_RUNTIME_USER_SCOPE);
+  if (!userId || !expectedScope || expectedScope === 'local') return;
+  if (userId === expectedScope) return;
+  throw new Error(
+    `Refusing to save ${AMALGM_RUNTIME_LABEL} computer credentials for user ${userId} in scope ${expectedScope}.`,
+  );
+}
+
+function loadRecordPair(recordFile, authFile) {
+  const record = readJson(recordFile, null);
+  if (!record || typeof record !== 'object') return null;
+  return mergeRecordAuth(record, readJson(authFile, null));
+}
+
 function loadComputerRecord(options = {}) {
-  const record = readJson(COMPUTER_FILE, null);
-  const scopedRecord = record && typeof record === 'object' ? record : null;
-  const legacyRecord = !scopedRecord ? loadLegacyComputerRecord() : null;
-  const activeRecord = scopedRecord || legacyRecord;
-  if (!activeRecord || typeof activeRecord !== 'object') return null;
-  const auth = scopedRecord ? readJson(AUTH_FILE, null) : readLegacyAuth();
-  const merged = mergeRecordAuth(activeRecord, auth);
-  if (options.migrate && (hasComputerSecrets(activeRecord) || legacyRecord)) {
+  const runtimeRecord = loadRecordPair(RUNTIME_COMPUTER_FILE, RUNTIME_AUTH_FILE);
+  if (runtimeRecord) return runtimeRecord;
+
+  const scopedRecord = readJson(COMPUTER_FILE, null);
+  if (scopedRecord && typeof scopedRecord === 'object' && recordMatchesCurrentRuntime(scopedRecord)) {
+    const merged = mergeRecordAuth(scopedRecord, readJson(AUTH_FILE, null));
+    if (options.migrate && (AMALGM_RUNTIME_LABEL === 'main' || hasComputerSecrets(scopedRecord))) {
+      saveComputerRecord(merged);
+    }
+    return merged;
+  }
+
+  const legacyRecord = loadLegacyComputerRecord();
+  if (!legacyRecord || typeof legacyRecord !== 'object') return null;
+  const merged = mergeRecordAuth(legacyRecord, readLegacyAuth());
+  if (options.migrate && (hasComputerSecrets(legacyRecord) || legacyRecord)) {
     saveComputerRecord(merged);
   }
   return merged;
@@ -200,12 +237,27 @@ function readLegacyAuth() {
 }
 
 function saveComputerRecord(record) {
-  const existingAuth = readJson(AUTH_FILE, null);
-  const nextAuth = authFromRecord(record, existingAuth);
-  const nextRecord = publicComputerRecord(record);
-  writeJsonSecret(COMPUTER_FILE, nextRecord);
-  writeJsonSecret(AUTH_FILE, nextAuth);
-  mirrorLocalRecordToUserScope(nextRecord, nextAuth);
+  assertRecordMatchesUserScope(record);
+
+  const runtimeAuth = authFromRecord(record, readJson(RUNTIME_AUTH_FILE, null));
+  const runtimeRecord = publicComputerRecord(record, RUNTIME_AUTH_FILE);
+  writeJsonSecret(RUNTIME_COMPUTER_FILE, runtimeRecord);
+  writeJsonSecret(RUNTIME_AUTH_FILE, runtimeAuth);
+
+  if (AMALGM_RUNTIME_LABEL === 'main') {
+    const sharedAuth = authFromRecord(record, readJson(AUTH_FILE, null));
+    const sharedRecord = publicComputerRecord(record, AUTH_FILE);
+    writeJsonSecret(COMPUTER_FILE, sharedRecord);
+    writeJsonSecret(AUTH_FILE, sharedAuth);
+    mirrorLocalRecordToUserScope(sharedRecord, sharedAuth);
+  }
+
+  const nextRecord = AMALGM_RUNTIME_LABEL === 'main'
+    ? publicComputerRecord(record, AUTH_FILE)
+    : runtimeRecord;
+  const nextAuth = AMALGM_RUNTIME_LABEL === 'main'
+    ? authFromRecord(record, readJson(AUTH_FILE, null))
+    : runtimeAuth;
   return mergeRecordAuth(nextRecord, nextAuth);
 }
 
@@ -219,7 +271,9 @@ function mirrorLocalRecordToUserScope(record, auth) {
 }
 
 function deleteComputerAuth() {
-  for (const file of [COMPUTER_FILE, AUTH_FILE]) {
+  const files = [RUNTIME_COMPUTER_FILE, RUNTIME_AUTH_FILE];
+  if (AMALGM_RUNTIME_LABEL === 'main') files.push(COMPUTER_FILE, AUTH_FILE);
+  for (const file of files) {
     try {
       fs.unlinkSync(file);
     } catch {
@@ -253,5 +307,7 @@ module.exports = {
   loadComputerRecord,
   proxyTokenFromRecord,
   proxyTokenNeedsRefresh,
+  RUNTIME_AUTH_FILE,
+  RUNTIME_COMPUTER_FILE,
   saveComputerRecord,
 };

package/lib/paths.js

@@ -37,6 +37,8 @@ const AMALGM_RUNTIME_INSTANCE_ID = process.env.AMALGM_RUNTIME_INSTANCE_ID
 const DEVICE_FILE = path.join(AMALGM_HOME, 'device.json');
 const COMPUTER_FILE = path.join(AMALGM_DIR, 'computer.json');
 const AUTH_FILE = path.join(AMALGM_DIR, 'auth.json');
+const RUNTIME_COMPUTER_FILE = path.join(AMALGM_RUNTIME_STATE_DIR, 'computer.json');
+const RUNTIME_AUTH_FILE = path.join(AMALGM_RUNTIME_STATE_DIR, 'auth.json');
 const RUNTIME_TOKEN_FILE = path.join(AMALGM_RUNTIME_STATE_DIR, 'runtime-token.json');
 const PID_FILE = path.join(AMALGM_RUNTIME_STATE_DIR, 'amalgm.pid');
 const RUNTIME_STATE_FILE = path.join(AMALGM_RUNTIME_STATE_DIR, 'runtime-state.json');
@@ -66,6 +68,8 @@ module.exports = {
   PACKAGE_ROOT,
   PID_FILE,
   RUNTIME_DIR,
+  RUNTIME_AUTH_FILE,
+  RUNTIME_COMPUTER_FILE,
   RUNTIME_STATE_FILE,
   RUNTIME_TOKEN_FILE,
   SERVICE_DIR,

package/lib/tunnel-chat.js

@@ -11,15 +11,52 @@ const {
 } = require('./paths');
 const { runtimePort, runtimeServiceByName } = require('./runtime-manifest');
 
-const DEFAULT_TARGET_PORT = runtimeServiceByName('chat-server').defaultPort;
+const DEFAULT_GATEWAY_PORT = runtimeServiceByName('local-gateway').defaultPort;
+const DEFAULT_PORT_MONITOR_PORT = runtimeServiceByName('port-monitor').defaultPort;
+const DEFAULT_MCP_PORT = runtimeServiceByName('amalgm-mcp').defaultPort;
+const DEFAULT_CHAT_SERVER_PORT = runtimeServiceByName('chat-server').defaultPort;
+const DEFAULT_TARGET_PORT = DEFAULT_CHAT_SERVER_PORT;
 const DEFAULT_CHAT_TUNNEL_URL = 'wss://amalgm-chat-gateway.fly.dev/wire';
 const CONNECT_TIMEOUT_MS = 20_000;
 const WATCHDOG_INTERVAL_MS = 15_000;
 const HEARTBEAT_TIMEOUT_MS = 75_000;
-const ALLOWED_TARGET_PORTS = new Set([
-  runtimeServiceByName('amalgm-mcp').defaultPort,
-  runtimeServiceByName('chat-server').defaultPort,
+const DEFAULT_RUNTIME_PORTS = new Map([
+  ['gateway', DEFAULT_GATEWAY_PORT],
+  ['portMonitor', DEFAULT_PORT_MONITOR_PORT],
+  ['mcp', DEFAULT_MCP_PORT],
+  ['chat', DEFAULT_CHAT_SERVER_PORT],
 ]);
+const GATEWAY_PREFIXES = ['/__amalgm', '/diagnostics', '/pty'];
+const GATEWAY_EXACT_PATHS = new Set(['/', '/healthz', '/runtime-state', '/pty/session', '/pty/resize']);
+const PORT_MONITOR_PREFIXES = ['/api/ports', '/ports', '/port-monitor'];
+const CHAT_PREFIXES = ['/chat', '/raw-temp', '/active', '/stop', '/destroy', '/egress', '/mcp-relay'];
+const MCP_PREFIXES = [
+  '/mcp',
+  '/events',
+  '/tasks',
+  '/automations',
+  '/event-triggers',
+  '/workspace',
+  '/project-context',
+  '/github',
+  '/fs',
+  '/mcp-connections',
+  '/toolbox',
+  '/state',
+  '/local',
+  '/credentials',
+  '/chat-payloads',
+  '/email',
+  '/slack',
+  '/user-api-keys',
+  '/apps',
+  '/artifacts',
+  '/agents',
+  '/agent-config',
+  '/agent-bundles',
+  '/user-preferences',
+  '/browser',
+];
 const HOP_BY_HOP_HEADERS = new Set([
   'connection',
   'keep-alive',
@@ -74,23 +111,69 @@ function readRuntimePorts() {
     const parsed = JSON.parse(fs.readFileSync(RUNTIME_STATE_FILE, 'utf8'));
     return {
       gateway: Number(parsed?.gateway_port || parsed?.ports?.gateway) || runtimePort('local-gateway'),
+      portMonitor: Number(parsed?.ports?.port_monitor) || runtimePort('port-monitor'),
       mcp: Number(parsed?.ports?.amalgm_mcp) || runtimePort('amalgm-mcp'),
       chat: Number(parsed?.ports?.chat_server) || runtimePort('chat-server'),
     };
   } catch {
     return {
       gateway: runtimePort('local-gateway'),
+      portMonitor: runtimePort('port-monitor'),
       mcp: runtimePort('amalgm-mcp'),
       chat: runtimePort('chat-server'),
     };
   }
 }
 
-function allowedTargetPorts() {
-  const ports = new Set(ALLOWED_TARGET_PORTS);
-  const runtimePorts = readRuntimePorts();
-  for (const port of [runtimePorts.gateway, runtimePorts.mcp, runtimePorts.chat]) {
-    if (Number.isInteger(port) && port > 0 && port <= 65535) ports.add(port);
+function validPort(value) {
+  const port = Number(value);
+  return Number.isInteger(port) && port > 0 && port <= 65535 ? port : null;
+}
+
+function prefixMatches(pathname, prefix) {
+  return pathname === prefix || pathname.startsWith(`${prefix}/`);
+}
+
+function framePathname(framePath) {
+  try {
+    return new URL(framePath || '/', 'http://127.0.0.1').pathname || '/';
+  } catch {
+    return '/';
+  }
+}
+
+function serviceForRuntimePath(framePath) {
+  const pathname = framePathname(framePath);
+  if (GATEWAY_EXACT_PATHS.has(pathname) || GATEWAY_PREFIXES.some((prefix) => prefixMatches(pathname, prefix))) {
+    return 'gateway';
+  }
+  if (PORT_MONITOR_PREFIXES.some((prefix) => prefixMatches(pathname, prefix))) return 'portMonitor';
+  if (CHAT_PREFIXES.some((prefix) => prefixMatches(pathname, prefix))) return 'chat';
+  if (MCP_PREFIXES.some((prefix) => prefixMatches(pathname, prefix))) return 'mcp';
+  return null;
+}
+
+function defaultServiceForPort(port) {
+  if (port === DEFAULT_GATEWAY_PORT) return 'gateway';
+  if (port === DEFAULT_PORT_MONITOR_PORT) return 'portMonitor';
+  if (port === DEFAULT_MCP_PORT) return 'mcp';
+  if (port === DEFAULT_CHAT_SERVER_PORT) return 'chat';
+  return null;
+}
+
+function runtimePortForService(runtimePorts, service) {
+  return validPort(runtimePorts?.[service]) || validPort(DEFAULT_RUNTIME_PORTS.get(service));
+}
+
+function isDeclaredRuntimePort(port, runtimePorts) {
+  return ['gateway', 'portMonitor', 'mcp', 'chat'].some((service) => validPort(runtimePorts?.[service]) === port);
+}
+
+function allowedTargetPorts(runtimePorts = readRuntimePorts()) {
+  const ports = new Set();
+  for (const service of ['gateway', 'portMonitor', 'mcp', 'chat']) {
+    const port = runtimePortForService(runtimePorts, service);
+    if (port) ports.add(port);
   }
   return ports;
 }
@@ -196,9 +279,19 @@ function createChatTunnel({ record, foreground = false }) {
   }
 
   function resolveTargetPort(frame) {
-    const candidate = frame.target_port == null ? defaultTargetPort() : Number(frame.target_port);
-    if (!Number.isInteger(candidate) || !allowedTargetPorts().has(candidate)) return null;
-    return candidate;
+    const runtimePorts = readRuntimePorts();
+    const requested = validPort(frame.target_port);
+    if (requested && isDeclaredRuntimePort(requested, runtimePorts)) return requested;
+
+    const defaultService = requested ? defaultServiceForPort(requested) : 'chat';
+    const pathService = (!requested || defaultService) ? serviceForRuntimePath(frame.path) : null;
+    const service = pathService || defaultService;
+    if (service) {
+      return runtimePortForService(runtimePorts, service);
+    }
+
+    if (!requested) return null;
+    return allowedTargetPorts(runtimePorts).has(requested) ? requested : null;
   }
 
   function scheduleReconnect() {

package/lib/tunnel-events.js

@@ -14,14 +14,51 @@ const {
 } = require('./paths');
 const { runtimePort, runtimeServiceByName } = require('./runtime-manifest');
 
-const DEFAULT_TARGET_PORT = runtimeServiceByName('amalgm-mcp').defaultPort;
+const DEFAULT_GATEWAY_PORT = runtimeServiceByName('local-gateway').defaultPort;
+const DEFAULT_PORT_MONITOR_PORT = runtimeServiceByName('port-monitor').defaultPort;
+const DEFAULT_MCP_PORT = runtimeServiceByName('amalgm-mcp').defaultPort;
+const DEFAULT_CHAT_SERVER_PORT = runtimeServiceByName('chat-server').defaultPort;
+const DEFAULT_TARGET_PORT = DEFAULT_MCP_PORT;
 const CONNECT_TIMEOUT_MS = 20_000;
 const WATCHDOG_INTERVAL_MS = 15_000;
 const HEARTBEAT_TIMEOUT_MS = 75_000;
-const CORE_TARGET_PORTS = new Set([
-  runtimeServiceByName('amalgm-mcp').defaultPort,
-  runtimeServiceByName('chat-server').defaultPort,
+const DEFAULT_RUNTIME_PORTS = new Map([
+  ['gateway', DEFAULT_GATEWAY_PORT],
+  ['portMonitor', DEFAULT_PORT_MONITOR_PORT],
+  ['mcp', DEFAULT_MCP_PORT],
+  ['chat', DEFAULT_CHAT_SERVER_PORT],
 ]);
+const GATEWAY_PREFIXES = ['/__amalgm', '/diagnostics', '/pty'];
+const GATEWAY_EXACT_PATHS = new Set(['/', '/healthz', '/runtime-state', '/pty/session', '/pty/resize']);
+const PORT_MONITOR_PREFIXES = ['/api/ports', '/ports', '/port-monitor'];
+const CHAT_PREFIXES = ['/chat', '/raw-temp', '/active', '/stop', '/destroy', '/egress', '/mcp-relay'];
+const MCP_PREFIXES = [
+  '/mcp',
+  '/events',
+  '/tasks',
+  '/automations',
+  '/event-triggers',
+  '/workspace',
+  '/project-context',
+  '/github',
+  '/fs',
+  '/mcp-connections',
+  '/toolbox',
+  '/state',
+  '/local',
+  '/credentials',
+  '/chat-payloads',
+  '/email',
+  '/slack',
+  '/user-api-keys',
+  '/apps',
+  '/artifacts',
+  '/agents',
+  '/agent-config',
+  '/agent-bundles',
+  '/user-preferences',
+  '/browser',
+];
 const HOP_BY_HOP_HEADERS = new Set([
   'connection',
   'keep-alive',
@@ -183,23 +220,69 @@ function readRuntimePorts() {
     const parsed = JSON.parse(fs.readFileSync(RUNTIME_STATE_FILE, 'utf8'));
     return {
       gateway: Number(parsed?.gateway_port || parsed?.ports?.gateway) || runtimePort('local-gateway'),
+      portMonitor: Number(parsed?.ports?.port_monitor) || runtimePort('port-monitor'),
       mcp: Number(parsed?.ports?.amalgm_mcp) || runtimePort('amalgm-mcp'),
       chat: Number(parsed?.ports?.chat_server) || runtimePort('chat-server'),
     };
   } catch {
     return {
       gateway: runtimePort('local-gateway'),
+      portMonitor: runtimePort('port-monitor'),
       mcp: runtimePort('amalgm-mcp'),
       chat: runtimePort('chat-server'),
     };
   }
 }
 
-function allowedTargetPorts() {
-  const ports = new Set(CORE_TARGET_PORTS);
-  const runtimePorts = readRuntimePorts();
-  for (const port of [runtimePorts.gateway, runtimePorts.mcp, runtimePorts.chat]) {
-    if (Number.isInteger(port) && port > 0 && port <= 65535) ports.add(port);
+function validPort(value) {
+  const port = Number(value);
+  return Number.isInteger(port) && port > 0 && port <= 65535 ? port : null;
+}
+
+function prefixMatches(pathname, prefix) {
+  return pathname === prefix || pathname.startsWith(`${prefix}/`);
+}
+
+function framePathname(framePath) {
+  try {
+    return new URL(framePath || '/', 'http://127.0.0.1').pathname || '/';
+  } catch {
+    return '/';
+  }
+}
+
+function serviceForRuntimePath(framePath) {
+  const pathname = framePathname(framePath);
+  if (GATEWAY_EXACT_PATHS.has(pathname) || GATEWAY_PREFIXES.some((prefix) => prefixMatches(pathname, prefix))) {
+    return 'gateway';
+  }
+  if (PORT_MONITOR_PREFIXES.some((prefix) => prefixMatches(pathname, prefix))) return 'portMonitor';
+  if (CHAT_PREFIXES.some((prefix) => prefixMatches(pathname, prefix))) return 'chat';
+  if (MCP_PREFIXES.some((prefix) => prefixMatches(pathname, prefix))) return 'mcp';
+  return null;
+}
+
+function defaultServiceForPort(port) {
+  if (port === DEFAULT_GATEWAY_PORT) return 'gateway';
+  if (port === DEFAULT_PORT_MONITOR_PORT) return 'portMonitor';
+  if (port === DEFAULT_MCP_PORT) return 'mcp';
+  if (port === DEFAULT_CHAT_SERVER_PORT) return 'chat';
+  return null;
+}
+
+function runtimePortForService(runtimePorts, service) {
+  return validPort(runtimePorts?.[service]) || validPort(DEFAULT_RUNTIME_PORTS.get(service));
+}
+
+function isDeclaredRuntimePort(port, runtimePorts) {
+  return ['gateway', 'portMonitor', 'mcp', 'chat'].some((service) => validPort(runtimePorts?.[service]) === port);
+}
+
+function allowedTargetPorts(runtimePorts = readRuntimePorts()) {
+  const ports = new Set();
+  for (const service of ['gateway', 'portMonitor', 'mcp', 'chat']) {
+    const port = runtimePortForService(runtimePorts, service);
+    if (port) ports.add(port);
   }
   for (const route of readAppRoutes()) ports.add(route.port);
   return ports;
@@ -216,9 +299,20 @@ function runtimeGatewayPort() {
 }
 
 function resolveTargetPort(frame, fallbackPort = defaultTargetPort()) {
-  const candidate = frame.target_port == null ? fallbackPort : Number(frame.target_port);
-  if (!Number.isInteger(candidate) || candidate <= 0 || candidate > 65535) return null;
-  return allowedTargetPorts().has(candidate) ? candidate : null;
+  const runtimePorts = readRuntimePorts();
+  const requested = validPort(frame.target_port);
+  if (requested && isDeclaredRuntimePort(requested, runtimePorts)) return requested;
+
+  const fallbackService = fallbackPort === defaultTargetPort() ? 'mcp' : defaultServiceForPort(fallbackPort);
+  const defaultService = requested ? defaultServiceForPort(requested) : fallbackService;
+  const pathService = (!requested || defaultService) ? serviceForRuntimePath(frame.path) : null;
+  const service = pathService || defaultService;
+  if (service) {
+    return runtimePortForService(runtimePorts, service);
+  }
+
+  if (!requested) return null;
+  return allowedTargetPorts(runtimePorts).has(requested) ? requested : null;
 }
 
 function createEventTunnel({ record, foreground = false }) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.122",
+  "version": "0.1.123",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,

package/runtime/scripts/amalgm-mcp/apps/advertise.js

@@ -1,6 +1,9 @@
 const {
   COMPUTER_AUTH_FILE,
   COMPUTER_RECORD_FILE,
+  RUNTIME_COMPUTER_AUTH_FILE,
+  RUNTIME_COMPUTER_RECORD_FILE,
+  AMALGM_RUNTIME_LABEL,
   GATEWAY_BASE_URL,
   GATEWAY_INTERNAL_SECRET,
   APP_ROUTE_SYNC_INTERVAL_MS,
@@ -19,10 +22,24 @@ function warnOnce(key, message) {
   console.warn(message);
 }
 
-function loadComputerRecord() {
-  const record = readJson(COMPUTER_RECORD_FILE, null);
+function normalizeRuntimeLabel(value) {
+  const raw = String(value || '').trim().toLowerCase();
+  if (['preview', 'canary', 'native-chat', 'staging'].includes(raw)) return 'preview';
+  if (['local', 'dev', 'development'].includes(raw)) return 'local';
+  return 'main';
+}
+
+function recordMatchesRuntime(record) {
+  const label = normalizeRuntimeLabel(record?.runtime_label || record?.label || record?.branch);
+  if (!label) return AMALGM_RUNTIME_LABEL === 'main';
+  return label === AMALGM_RUNTIME_LABEL;
+}
+
+function loadComputerRecordPair(recordFile, authFile) {
+  const record = readJson(recordFile, null);
   if (!record || typeof record !== 'object') return null;
-  const auth = readJson(COMPUTER_AUTH_FILE, null);
+  if (!recordMatchesRuntime(record)) return null;
+  const auth = readJson(authFile, null);
   if (!auth || typeof auth !== 'object') return record;
   if (auth.computer_id && record.computer_id && auth.computer_id !== record.computer_id) return record;
   return {
@@ -31,6 +48,13 @@ function loadComputerRecord() {
   };
 }
 
+function loadComputerRecord() {
+  return (
+    loadComputerRecordPair(RUNTIME_COMPUTER_RECORD_FILE, RUNTIME_COMPUTER_AUTH_FILE)
+    || loadComputerRecordPair(COMPUTER_RECORD_FILE, COMPUTER_AUTH_FILE)
+  );
+}
+
 async function postAppRoutes(computerId, routes, authHeaders) {
   const body = JSON.stringify({ routes });
   const headers = {

package/runtime/scripts/amalgm-mcp/config.js

@@ -15,6 +15,9 @@ const MCP_PROTOCOL_VERSION = '2024-11-05';
 
 const AMALGM_DIR = process.env.AMALGM_DIR || path.join(os.homedir(), '.amalgm');
 const AMALGM_HOME = process.env.AMALGM_HOME || path.join(os.homedir(), '.amalgm');
+const AMALGM_RUNTIME_LABEL = normalizeRuntimeLabel(process.env.AMALGM_RUNTIME_LABEL || process.env.AMALGM_BRANCH);
+const AMALGM_RUNTIME_STATE_DIR = process.env.AMALGM_RUNTIME_STATE_DIR
+  || path.join(AMALGM_DIR, 'runtimes', AMALGM_RUNTIME_LABEL);
 
 // Storage file/dir layout under AMALGM_DIR.
 const STORAGE_DIR = AMALGM_DIR; // tasks.json etc. live directly under ~/.amalgm
@@ -26,6 +29,9 @@ const APPS_FILE = path.join(STORAGE_DIR, 'apps.json');
 const LEGACY_ARTIFACTS_DIR = path.join(STORAGE_DIR, 'artifacts');
 const LEGACY_ARTIFACTS_FILE = path.join(STORAGE_DIR, 'artifacts.json');
 const COMPUTER_RECORD_FILE = path.join(STORAGE_DIR, 'computer.json');
+const COMPUTER_AUTH_FILE = path.join(STORAGE_DIR, 'auth.json');
+const RUNTIME_COMPUTER_RECORD_FILE = path.join(AMALGM_RUNTIME_STATE_DIR, 'computer.json');
+const RUNTIME_COMPUTER_AUTH_FILE = path.join(AMALGM_RUNTIME_STATE_DIR, 'auth.json');
 const TASK_RUNS_DIR = path.join(STORAGE_DIR, 'task-runs');
 const EVENT_TRIGGERS_FILE = path.join(STORAGE_DIR, 'event-triggers.json');
 const WORKFLOWS_FILE = path.join(STORAGE_DIR, 'workflows.json');
@@ -92,6 +98,13 @@ const APP_ROUTE_SYNC_INTERVAL_MS = parseInt(
   10,
 );
 
+function normalizeRuntimeLabel(value) {
+  const raw = String(value || '').trim().toLowerCase();
+  if (['preview', 'canary', 'native-chat', 'staging'].includes(raw)) return 'preview';
+  if (['local', 'dev', 'development'].includes(raw)) return 'local';
+  return 'main';
+}
+
 function copyIfUseful(source, target) {
   if (!fs.existsSync(source)) return;
   if (fs.existsSync(target) && fs.statSync(target).size > 64 * 1024) return;
@@ -127,6 +140,8 @@ module.exports = {
   MCP_PROTOCOL_VERSION,
   AMALGM_DIR,
   AMALGM_HOME,
+  AMALGM_RUNTIME_LABEL,
+  AMALGM_RUNTIME_STATE_DIR,
   STORAGE_DIR,
   LOCAL_DB_FILE,
   TASKS_FILE,
@@ -136,6 +151,9 @@ module.exports = {
   LEGACY_ARTIFACTS_DIR,
   LEGACY_ARTIFACTS_FILE,
   COMPUTER_RECORD_FILE,
+  COMPUTER_AUTH_FILE,
+  RUNTIME_COMPUTER_RECORD_FILE,
+  RUNTIME_COMPUTER_AUTH_FILE,
   TASK_RUNS_DIR,
   EVENT_TRIGGERS_FILE,
   WORKFLOWS_FILE,

package/runtime/scripts/local-gateway.js

@@ -25,6 +25,7 @@ const {
 const { runtimePort } = require('../lib/runtime-manifest');
 const {
   runtimeLogDir,
+  runtimeStateDir,
   runtimeStateFile,
 } = require('./lib/runtime-paths');
 
@@ -50,6 +51,7 @@ const pty = loadPty();
 
 const AMALGM_DIR = process.env.AMALGM_DIR || path.join(os.homedir(), '.amalgm');
 const STATE_FILE = runtimeStateFile();
+const RUNTIME_COMPUTER_FILE = path.join(runtimeStateDir(), 'computer.json');
 const APPS_FILE = path.join(AMALGM_DIR, 'apps.json');
 const LEGACY_ARTIFACTS_FILE = path.join(AMALGM_DIR, 'artifacts.json');
 const LOG_DIR = runtimeLogDir();
@@ -159,11 +161,13 @@ const MCP_PREFIXES = [
   '/artifacts',
   '/agents',
   '/agent-config',
+  '/agent-bundles',
   '/user-preferences',
   '/browser',
 ];
 
 const PORT_MONITOR_PREFIXES = [
+  '/api/ports',
   '/ports',
   '/port-monitor',
 ];
@@ -339,8 +343,29 @@ function ensurePtySpawnHelperExecutable() {
   }
 }
 
+function normalizeRuntimeLabel(value) {
+  const raw = String(value || '').trim().toLowerCase();
+  if (['preview', 'canary', 'native-chat', 'staging'].includes(raw)) return 'preview';
+  if (['local', 'dev', 'development'].includes(raw)) return 'local';
+  return 'main';
+}
+
+function computerRecordMatchesRuntime(record) {
+  const label = normalizeRuntimeLabel(record?.runtime_label || record?.label || record?.branch);
+  return label === normalizeRuntimeLabel(RUNTIME_LABEL);
+}
+
+function loadComputerRecord() {
+  const runtimeComputer = readJson(RUNTIME_COMPUTER_FILE, null);
+  if (runtimeComputer && computerRecordMatchesRuntime(runtimeComputer)) return runtimeComputer;
+
+  const sharedComputer = readJson(path.join(AMALGM_DIR, 'computer.json'), null);
+  if (sharedComputer && computerRecordMatchesRuntime(sharedComputer)) return sharedComputer;
+  return null;
+}
+
 function writeRuntimeState(actualPort) {
-  const computer = readJson(path.join(AMALGM_DIR, 'computer.json'), null);
+  const computer = loadComputerRecord();
   const previous = readJson(STATE_FILE, {});
   if (!runtimeStateOwnedHere(previous)) {
     console.warn('[local-gateway] runtime-state belongs to another Amalgm runtime; skipping write');
@@ -606,9 +631,12 @@ function serviceForPath(pathname) {
     return { port: SERVICE_PORTS.mcp, stripPrefix: '' };
   }
   if (PORT_MONITOR_PREFIXES.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`))) {
+    const stripPrefix = pathname.startsWith('/port-monitor')
+      ? '/port-monitor'
+      : (pathname.startsWith('/ports') ? '/ports' : '');
     return {
       port: SERVICE_PORTS.portMonitor,
-      stripPrefix: pathname.startsWith('/port-monitor') ? '/port-monitor' : '/ports',
+      stripPrefix,
     };
   }
   return null;

package/runtime/scripts/proxy-token-store.js

@@ -8,8 +8,13 @@ const DEFAULT_PROXY_BASE_URL = 'https://amalgm-api-proxy-v2.fly.dev';
 const REFRESH_BUFFER_MS = 10 * 60 * 1000;
 
 const AMALGM_DIR = process.env.AMALGM_DIR || path.join(os.homedir(), '.amalgm');
+const AMALGM_RUNTIME_LABEL = normalizeRuntimeLabel(process.env.AMALGM_RUNTIME_LABEL || process.env.AMALGM_BRANCH);
+const AMALGM_RUNTIME_STATE_DIR = process.env.AMALGM_RUNTIME_STATE_DIR
+  || path.join(AMALGM_DIR, 'runtimes', AMALGM_RUNTIME_LABEL);
 const COMPUTER_FILE = path.join(AMALGM_DIR, 'computer.json');
 const AUTH_FILE = path.join(AMALGM_DIR, 'auth.json');
+const RUNTIME_COMPUTER_FILE = path.join(AMALGM_RUNTIME_STATE_DIR, 'computer.json');
+const RUNTIME_AUTH_FILE = path.join(AMALGM_RUNTIME_STATE_DIR, 'auth.json');
 
 let refreshPromise = null;
 
@@ -37,15 +42,38 @@ function cleanString(value) {
   return typeof value === 'string' && value.trim() ? value.trim() : '';
 }
 
-function loadAuthContext() {
-  const record = readJson(COMPUTER_FILE, null) || {};
-  const auth = readJson(AUTH_FILE, null) || {};
+function normalizeRuntimeLabel(value) {
+  const raw = String(value || '').trim().toLowerCase();
+  if (['preview', 'canary', 'native-chat', 'staging'].includes(raw)) return 'preview';
+  if (['local', 'dev', 'development'].includes(raw)) return 'local';
+  return 'main';
+}
+
+function recordMatchesRuntime(record) {
+  const label = normalizeRuntimeLabel(record?.runtime_label || record?.label || record?.branch);
+  if (!label) return AMALGM_RUNTIME_LABEL === 'main';
+  return label === AMALGM_RUNTIME_LABEL;
+}
+
+function loadAuthPair(recordFile, authFile) {
+  const record = readJson(recordFile, null);
+  if (!record || typeof record !== 'object') return null;
+  if (!recordMatchesRuntime(record)) return null;
+  const auth = readJson(authFile, null) || {};
   if (record.computer_id && auth.computer_id && record.computer_id !== auth.computer_id) {
     return { record, auth: {} };
   }
   return { record, auth };
 }
 
+function loadAuthContext() {
+  return (
+    loadAuthPair(RUNTIME_COMPUTER_FILE, RUNTIME_AUTH_FILE)
+    || loadAuthPair(COMPUTER_FILE, AUTH_FILE)
+    || { record: {}, auth: {} }
+  );
+}
+
 function proxyRefreshContext(record, auth) {
   return {
     machineToken:
@@ -128,7 +156,8 @@ async function refreshProxyToken() {
     },
     updated_at: now,
   };
-  writeJsonSecret(AUTH_FILE, nextAuth);
+  const targetAuthFile = fs.existsSync(RUNTIME_COMPUTER_FILE) ? RUNTIME_AUTH_FILE : AUTH_FILE;
+  writeJsonSecret(targetAuthFile, nextAuth);
   return cleanString(nextAuth.proxy.token);
 }