amalgm 0.1.124 → 0.1.125

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.124",
+  "version": "0.1.125",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,

package/runtime/scripts/amalgm-mcp/automations/internal-workflows.js

@@ -0,0 +1,482 @@
+'use strict';
+
+const path = require('path');
+
+const DESKTOP_RELEASE_AUTOMATION_ID = 'internal-amalgm-desktop-release';
+const DESKTOP_RELEASE_TRIGGER_ID = 'internal-amalgm-desktop-release-github-push';
+const DESKTOP_RELEASE_WORKFLOW_ID = 'internal-amalgm-desktop-release-workflow';
+const NPM_RELEASE_WORKFLOW_ID = 'internal-amalgm-npm-release-workflow';
+
+function desktopReleaseRunnerPath() {
+  return path.resolve(__dirname, '../events/desktop-release-runner.js');
+}
+
+function npmReleaseRunnerPath() {
+  return path.resolve(__dirname, '../events/npm-release-runner.js');
+}
+
+function shellQuote(value) {
+  return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
+
+function desktopReleaseWorkflow(runnerPath = desktopReleaseRunnerPath()) {
+  const escapedRunnerCommand = JSON.stringify(`node ${shellQuote(runnerPath)}`);
+  const escapedRunnerDir = JSON.stringify(path.dirname(runnerPath));
+  return `export default workflow({
+  trigger: event("github.push"),
+
+  allowlist: {
+    localCompute: true,
+    secrets: [
+      "GH_TOKEN",
+      "GITHUB_TOKEN",
+      "NEXT_PUBLIC_SUPABASE_URL",
+      "NEXT_PUBLIC_SUPABASE_ANON_KEY",
+      "NEXT_PUBLIC_SITE_URL",
+      "NEXT_PUBLIC_PREVIEW_SITE_URL",
+      "AMALGM_DESKTOP_MAIN_APP_ORIGIN",
+      "AMALGM_DESKTOP_PREVIEW_APP_ORIGIN",
+      "AMALGM_DESKTOP_RELEASE_CHECKOUT_ROOT",
+      "AMALGM_DESKTOP_RELEASE_ENV_FILE",
+      "AMALGM_DESKTOP_RELEASE_ENGINE_REPO_PATH",
+      "AMALGM_DESKTOP_RELEASE_NODE_BIN",
+      "AMALGM_DESKTOP_RELEASE_PATH_PREFIX",
+      "AMALGM_DESKTOP_RELEASE_PYTHON",
+      "AMALGM_DESKTOP_RELEASE_PROVIDER",
+      "AMALGM_DESKTOP_RELEASE_REPOSITORY",
+      "AMALGM_DESKTOP_RELEASE_REPO_FULL_NAME",
+      "AMALGM_DESKTOP_RELEASE_FLY_APP",
+      "AMALGM_DESKTOP_RELEASE_FLY_ROOT",
+      "AMALGM_DESKTOP_RELEASE_UPLOAD_TOKEN",
+      "AMALGM_DESKTOP_RELEASE_UPLOAD_METHOD",
+      "AMALGM_DESKTOP_RELEASE_UPLOAD_URL",
+      "AMALGM_DESKTOP_RELEASE_UPLOAD_CHUNK_BYTES",
+      "AMALGM_DESKTOP_LEGACY_BRIDGE_ENABLED",
+      "AMALGM_DESKTOP_LEGACY_BRIDGE_REPOSITORY",
+      "AMALGM_DESKTOP_LEGACY_BRIDGE_REPO_FULL_NAME",
+      "AMALGM_DESKTOP_LEGACY_BRIDGE_OWNER",
+      "AMALGM_DESKTOP_LEGACY_BRIDGE_REPO",
+      "AMALGM_DESKTOP_UPDATE_PROVIDER",
+      "AMALGM_DESKTOP_UPDATE_BASE_URL",
+      "AMALGM_DESKTOP_UPDATE_URL",
+      "AMALGM_DESKTOP_UPDATE_OWNER",
+      "AMALGM_DESKTOP_UPDATE_REPO",
+      "AMALGM_DESKTOP_RELEASE_UPLOAD_ATTEMPTS",
+      "AMALGM_DESKTOP_RELEASE_UPLOAD_LIMIT_RATE",
+      "AMALGM_DESKTOP_RELEASE_UI_REPO_PATH",
+      "AMALGM_ENGINE_REPO_URL",
+      "AMALGM_UI_REPO_URL",
+      "FLY_ACCESS_TOKEN",
+      "CSC_LINK",
+      "CSC_KEY_PASSWORD",
+      "CSC_NAME",
+      "AMALGM_DESKTOP_NOTARIZE",
+      "APPLE_API_KEY",
+      "APPLE_API_KEY_ID",
+      "APPLE_API_ISSUER",
+      "APPLE_ID",
+      "APPLE_APP_SPECIFIC_PASSWORD",
+      "APPLE_TEAM_ID",
+      "APPLE_KEYCHAIN",
+      "APPLE_KEYCHAIN_PROFILE"
+    ],
+    actions: ["notifications.notify_user"]
+  },
+
+  limits: {
+    maxConcurrentRuns: 1,
+    queueLimit: 10,
+    cellTimeoutMs: 7200000,
+    codeTimeoutMs: 15000
+  },
+
+  cells: [
+    code("filter_push", async ({ payload, headers, stop }) => {
+      const repository = String(payload?.repository?.full_name || "").trim()
+      const ref = String(payload?.ref || "").trim()
+      const branch = ref.startsWith("refs/heads/") ? ref.slice("refs/heads/".length) : ref
+      const after = String(payload?.after || "").trim()
+      const allowedRepositories = ["amalgm-inc/amalgm-engine", "amalgm-inc/amalgm-ui"]
+      const allowedBranches = ["main", "preview"]
+      const commits = Array.isArray(payload?.commits) ? payload.commits : []
+      const messages = [
+        payload?.head_commit?.message,
+        ...commits.map((commit) => commit?.message)
+      ].map((message) => String(message || ""))
+
+      if (!allowedRepositories.includes(repository)) stop()
+      if (!allowedBranches.includes(branch)) stop()
+      if (!/^[a-f0-9]{40}$/i.test(after) || /^0{40}$/.test(after)) stop()
+      if (messages.some((message) => /\\[(skip desktop|skip ci|ci skip)\\]/i.test(message))) stop()
+
+      return {
+        repository,
+        ref,
+        branch,
+        after,
+        delivery: String(headers?.["x-github-delivery"] || "")
+      }
+    }),
+
+    cli("publish_desktop_release", {
+      cwd: ${escapedRunnerDir},
+      command: ${escapedRunnerCommand},
+      env: ({ cells, secrets }) => ({
+        GH_TOKEN: secrets.GH_TOKEN || secrets.GITHUB_TOKEN || "",
+        GITHUB_TOKEN: secrets.GITHUB_TOKEN || secrets.GH_TOKEN || "",
+        NEXT_PUBLIC_SUPABASE_URL: secrets.NEXT_PUBLIC_SUPABASE_URL || "",
+        NEXT_PUBLIC_SUPABASE_ANON_KEY: secrets.NEXT_PUBLIC_SUPABASE_ANON_KEY || "",
+        NEXT_PUBLIC_SITE_URL: secrets.NEXT_PUBLIC_SITE_URL || "",
+        NEXT_PUBLIC_PREVIEW_SITE_URL: secrets.NEXT_PUBLIC_PREVIEW_SITE_URL || "",
+        AMALGM_DESKTOP_MAIN_APP_ORIGIN: secrets.AMALGM_DESKTOP_MAIN_APP_ORIGIN || "",
+        AMALGM_DESKTOP_PREVIEW_APP_ORIGIN: secrets.AMALGM_DESKTOP_PREVIEW_APP_ORIGIN || "",
+        AMALGM_DESKTOP_RELEASE_CHECKOUT_ROOT: secrets.AMALGM_DESKTOP_RELEASE_CHECKOUT_ROOT || "",
+        AMALGM_DESKTOP_RELEASE_ENV_FILE: secrets.AMALGM_DESKTOP_RELEASE_ENV_FILE || "",
+        AMALGM_DESKTOP_RELEASE_ENGINE_REPO_PATH: secrets.AMALGM_DESKTOP_RELEASE_ENGINE_REPO_PATH || "",
+        AMALGM_DESKTOP_RELEASE_NODE_BIN: secrets.AMALGM_DESKTOP_RELEASE_NODE_BIN || "",
+        AMALGM_DESKTOP_RELEASE_PATH_PREFIX: secrets.AMALGM_DESKTOP_RELEASE_PATH_PREFIX || "",
+        AMALGM_DESKTOP_RELEASE_PYTHON: secrets.AMALGM_DESKTOP_RELEASE_PYTHON || "",
+        AMALGM_DESKTOP_RELEASE_PROVIDER: secrets.AMALGM_DESKTOP_RELEASE_PROVIDER || "",
+        AMALGM_DESKTOP_RELEASE_REPOSITORY: secrets.AMALGM_DESKTOP_RELEASE_REPOSITORY || secrets.AMALGM_DESKTOP_RELEASE_REPO_FULL_NAME || "",
+        AMALGM_DESKTOP_RELEASE_REPO_FULL_NAME: secrets.AMALGM_DESKTOP_RELEASE_REPO_FULL_NAME || secrets.AMALGM_DESKTOP_RELEASE_REPOSITORY || "",
+        AMALGM_DESKTOP_RELEASE_FLY_APP: secrets.AMALGM_DESKTOP_RELEASE_FLY_APP || "",
+        AMALGM_DESKTOP_RELEASE_FLY_ROOT: secrets.AMALGM_DESKTOP_RELEASE_FLY_ROOT || "",
+        AMALGM_DESKTOP_RELEASE_UPLOAD_TOKEN: secrets.AMALGM_DESKTOP_RELEASE_UPLOAD_TOKEN || "",
+        AMALGM_DESKTOP_RELEASE_UPLOAD_METHOD: secrets.AMALGM_DESKTOP_RELEASE_UPLOAD_METHOD || "",
+        AMALGM_DESKTOP_RELEASE_UPLOAD_URL: secrets.AMALGM_DESKTOP_RELEASE_UPLOAD_URL || "",
+        AMALGM_DESKTOP_RELEASE_UPLOAD_CHUNK_BYTES: secrets.AMALGM_DESKTOP_RELEASE_UPLOAD_CHUNK_BYTES || "",
+        AMALGM_DESKTOP_LEGACY_BRIDGE_ENABLED: secrets.AMALGM_DESKTOP_LEGACY_BRIDGE_ENABLED || "",
+        AMALGM_DESKTOP_LEGACY_BRIDGE_REPOSITORY: secrets.AMALGM_DESKTOP_LEGACY_BRIDGE_REPOSITORY || secrets.AMALGM_DESKTOP_LEGACY_BRIDGE_REPO_FULL_NAME || "",
+        AMALGM_DESKTOP_LEGACY_BRIDGE_REPO_FULL_NAME: secrets.AMALGM_DESKTOP_LEGACY_BRIDGE_REPO_FULL_NAME || secrets.AMALGM_DESKTOP_LEGACY_BRIDGE_REPOSITORY || "",
+        AMALGM_DESKTOP_LEGACY_BRIDGE_OWNER: secrets.AMALGM_DESKTOP_LEGACY_BRIDGE_OWNER || "",
+        AMALGM_DESKTOP_LEGACY_BRIDGE_REPO: secrets.AMALGM_DESKTOP_LEGACY_BRIDGE_REPO || "",
+        AMALGM_DESKTOP_UPDATE_PROVIDER: secrets.AMALGM_DESKTOP_UPDATE_PROVIDER || secrets.AMALGM_DESKTOP_RELEASE_PROVIDER || "",
+        AMALGM_DESKTOP_UPDATE_BASE_URL: secrets.AMALGM_DESKTOP_UPDATE_BASE_URL || "",
+        AMALGM_DESKTOP_UPDATE_URL: secrets.AMALGM_DESKTOP_UPDATE_URL || "",
+        AMALGM_DESKTOP_UPDATE_OWNER: secrets.AMALGM_DESKTOP_UPDATE_OWNER || "",
+        AMALGM_DESKTOP_UPDATE_REPO: secrets.AMALGM_DESKTOP_UPDATE_REPO || "",
+        AMALGM_DESKTOP_RELEASE_UPLOAD_ATTEMPTS: secrets.AMALGM_DESKTOP_RELEASE_UPLOAD_ATTEMPTS || "",
+        AMALGM_DESKTOP_RELEASE_UPLOAD_LIMIT_RATE: secrets.AMALGM_DESKTOP_RELEASE_UPLOAD_LIMIT_RATE || "",
+        AMALGM_DESKTOP_RELEASE_UI_REPO_PATH: secrets.AMALGM_DESKTOP_RELEASE_UI_REPO_PATH || "",
+        AMALGM_ENGINE_REPO_URL: secrets.AMALGM_ENGINE_REPO_URL || "",
+        AMALGM_UI_REPO_URL: secrets.AMALGM_UI_REPO_URL || "",
+        FLY_ACCESS_TOKEN: secrets.FLY_ACCESS_TOKEN || "",
+        ...(String(secrets.CSC_LINK || "").trim() ? { CSC_LINK: secrets.CSC_LINK } : {}),
+        ...(String(secrets.CSC_KEY_PASSWORD || "").trim() ? { CSC_KEY_PASSWORD: secrets.CSC_KEY_PASSWORD } : {}),
+        ...(String(secrets.CSC_NAME || "").trim() ? { CSC_NAME: secrets.CSC_NAME } : {}),
+        AMALGM_DESKTOP_NOTARIZE: secrets.AMALGM_DESKTOP_NOTARIZE || "",
+        APPLE_API_KEY: secrets.APPLE_API_KEY || "",
+        APPLE_API_KEY_ID: secrets.APPLE_API_KEY_ID || "",
+        APPLE_API_ISSUER: secrets.APPLE_API_ISSUER || "",
+        APPLE_ID: secrets.APPLE_ID || "",
+        APPLE_APP_SPECIFIC_PASSWORD: secrets.APPLE_APP_SPECIFIC_PASSWORD || "",
+        APPLE_TEAM_ID: secrets.APPLE_TEAM_ID || "",
+        APPLE_KEYCHAIN: secrets.APPLE_KEYCHAIN || "",
+        APPLE_KEYCHAIN_PROFILE: secrets.APPLE_KEYCHAIN_PROFILE || "",
+        AMALGM_DESKTOP_RELEASE_SOURCE_REPO: cells.filter_push.output.repository,
+        AMALGM_DESKTOP_RELEASE_REF: cells.filter_push.output.ref,
+        AMALGM_DESKTOP_RELEASE_BRANCH: cells.filter_push.output.branch,
+        AMALGM_DESKTOP_RELEASE_AFTER: cells.filter_push.output.after,
+        AMALGM_DESKTOP_RELEASE_DELIVERY: cells.filter_push.output.delivery
+      }),
+      timeoutMs: 7200000
+    }),
+
+    tool("notify_success", "notifications.notify_user", {
+      subject: "amalgm desktop release complete",
+      level: "success",
+      message: ({ cells }) => {
+        const output = cells.publish_desktop_release.output || {}
+        const stdout = String(output.stdout || "").trim()
+        const jsonStart = stdout.lastIndexOf("\\n{")
+        const jsonText = jsonStart >= 0 ? stdout.slice(jsonStart + 1) : stdout
+        let result = null
+        try { result = JSON.parse(jsonText) } catch {}
+        if (!result || result.skipped) {
+          return [
+            "Desktop release automation finished.",
+            "",
+            result?.reason || "No release metadata was emitted.",
+            "",
+            "~~~",
+            stdout || "No stdout captured.",
+            "~~~"
+          ].join("\\n")
+        }
+        return [
+          "Desktop release published.",
+          "",
+          "Tag: " + result.tag,
+          "Lane: " + result.lane,
+          "Provider: " + (result.releaseProvider || "unknown"),
+          "Engine: " + result.shas.engineSha,
+          "UI: " + result.shas.uiSha,
+          "",
+          result.releaseUrl
+        ].join("\\n")
+      }
+    })
+  ]
+})`;
+}
+
+function npmReleaseWorkflow(runnerPath = npmReleaseRunnerPath()) {
+  const escapedRunnerCommand = JSON.stringify(`node ${shellQuote(runnerPath)}`);
+  const escapedRunnerDir = JSON.stringify(path.dirname(runnerPath));
+  return `export default workflow({
+  trigger: event("github.push"),
+
+  allowlist: {
+    localCompute: true,
+    secrets: [
+      "GH_TOKEN",
+      "GITHUB_TOKEN",
+      "NODE_AUTH_TOKEN",
+      "NPM_TOKEN",
+      "AMALGM_NPM_RELEASE_CHECKOUT_ROOT",
+      "AMALGM_NPM_RELEASE_ENV_FILE",
+      "AMALGM_NPM_RELEASE_ENGINE_REPO_PATH",
+      "AMALGM_NPM_RELEASE_NODE_BIN",
+      "AMALGM_NPM_RELEASE_PATH_PREFIX",
+      "AMALGM_NPM_RELEASE_PYTHON",
+      "AMALGM_NPM_RELEASE_NPM_CACHE",
+      "AMALGM_ENGINE_REPO_URL"
+    ],
+    actions: ["notifications.notify_user"]
+  },
+
+  limits: {
+    maxConcurrentRuns: 1,
+    queueLimit: 10,
+    cellTimeoutMs: 1800000,
+    codeTimeoutMs: 15000
+  },
+
+  cells: [
+    code("filter_push", async ({ payload, headers, stop }) => {
+      const repository = String(payload?.repository?.full_name || "").trim()
+      const ref = String(payload?.ref || "").trim()
+      const branch = ref.startsWith("refs/heads/") ? ref.slice("refs/heads/".length) : ref
+      const after = String(payload?.after || "").trim()
+      const commits = Array.isArray(payload?.commits) ? payload.commits : []
+      const messages = [
+        payload?.head_commit?.message,
+        ...commits.map((commit) => commit?.message)
+      ].map((message) => String(message || ""))
+
+      if (repository !== "amalgm-inc/amalgm-engine") stop()
+      if (!["main", "preview"].includes(branch)) stop()
+      if (!/^[a-f0-9]{40}$/i.test(after) || /^0{40}$/.test(after)) stop()
+      if (messages.some((message) => /\\[(skip npm|skip runtime|skip ci|ci skip)\\]/i.test(message))) stop()
+
+      return {
+        repository,
+        ref,
+        branch,
+        after,
+        delivery: String(headers?.["x-github-delivery"] || "")
+      }
+    }),
+
+    cli("publish_npm_release", {
+      cwd: ${escapedRunnerDir},
+      command: ${escapedRunnerCommand},
+      env: ({ cells, secrets }) => ({
+        GH_TOKEN: secrets.GH_TOKEN || secrets.GITHUB_TOKEN || "",
+        GITHUB_TOKEN: secrets.GITHUB_TOKEN || secrets.GH_TOKEN || "",
+        NODE_AUTH_TOKEN: secrets.NODE_AUTH_TOKEN || secrets.NPM_TOKEN || "",
+        NPM_TOKEN: secrets.NPM_TOKEN || secrets.NODE_AUTH_TOKEN || "",
+        AMALGM_NPM_RELEASE_CHECKOUT_ROOT: secrets.AMALGM_NPM_RELEASE_CHECKOUT_ROOT || "",
+        AMALGM_NPM_RELEASE_ENV_FILE: secrets.AMALGM_NPM_RELEASE_ENV_FILE || "",
+        AMALGM_NPM_RELEASE_ENGINE_REPO_PATH: secrets.AMALGM_NPM_RELEASE_ENGINE_REPO_PATH || "",
+        AMALGM_NPM_RELEASE_NODE_BIN: secrets.AMALGM_NPM_RELEASE_NODE_BIN || "",
+        AMALGM_NPM_RELEASE_PATH_PREFIX: secrets.AMALGM_NPM_RELEASE_PATH_PREFIX || "",
+        AMALGM_NPM_RELEASE_PYTHON: secrets.AMALGM_NPM_RELEASE_PYTHON || "",
+        AMALGM_NPM_RELEASE_NPM_CACHE: secrets.AMALGM_NPM_RELEASE_NPM_CACHE || "",
+        AMALGM_ENGINE_REPO_URL: secrets.AMALGM_ENGINE_REPO_URL || "",
+        AMALGM_NPM_RELEASE_SOURCE_REPO: cells.filter_push.output.repository,
+        AMALGM_NPM_RELEASE_REF: cells.filter_push.output.ref,
+        AMALGM_NPM_RELEASE_BRANCH: cells.filter_push.output.branch,
+        AMALGM_NPM_RELEASE_AFTER: cells.filter_push.output.after,
+        AMALGM_NPM_RELEASE_DELIVERY: cells.filter_push.output.delivery
+      }),
+      timeoutMs: 1800000
+    }),
+
+    tool("notify_success", "notifications.notify_user", {
+      subject: "amalgm npm release complete",
+      level: "success",
+      message: ({ cells }) => {
+        const output = cells.publish_npm_release.output || {}
+        const stdout = String(output.stdout || "").trim()
+        const jsonStart = stdout.lastIndexOf("\\n{")
+        const jsonText = jsonStart >= 0 ? stdout.slice(jsonStart + 1) : stdout
+        let result = null
+        try { result = JSON.parse(jsonText) } catch {}
+        if (!result || result.skipped) {
+          return [
+            "npm release automation finished.",
+            "",
+            result?.reason || "No release metadata was emitted.",
+            "",
+            "~~~",
+            stdout || "No stdout captured.",
+            "~~~"
+          ].join("\\n")
+        }
+        return [
+          "npm release published.",
+          "",
+          "Version: " + result.version,
+          "Lane: " + result.lane,
+          "Tags: " + (Array.isArray(result.distTags) ? result.distTags.join(", ") : ""),
+          "Published: " + String(result.published),
+          "Already existed: " + String(result.alreadyExists)
+        ].join("\\n")
+      }
+    })
+  ]
+})`;
+}
+
+function desktopReleaseAutomationSeed() {
+  return {
+    id: DESKTOP_RELEASE_AUTOMATION_ID,
+    name: 'Run Amalgm release automation',
+    description: 'Internal workflow: publish npm runtime packages and signed macOS desktop releases from GitHub push webhooks.',
+    enabled: true,
+    internal: true,
+    triggers: [{
+      id: DESKTOP_RELEASE_TRIGGER_ID,
+      kind: 'event',
+      name: 'GitHub push',
+      description: 'GitHub push webhook for amalgm-engine and amalgm-ui release branches.',
+      source: 'github',
+      event: 'push',
+      sourceUrl: 'https://github.com/amalgm-inc',
+      enabled: true,
+    }],
+    workflows: [{
+      id: DESKTOP_RELEASE_WORKFLOW_ID,
+      name: 'Build signed macOS desktop release',
+      description: 'Runs the local desktop release publisher on this Mac.',
+      enabled: true,
+      internal: true,
+      workflowText: desktopReleaseWorkflow(),
+      allowlist: {
+        localCompute: true,
+        secrets: [
+          'GH_TOKEN',
+          'GITHUB_TOKEN',
+          'NEXT_PUBLIC_SUPABASE_URL',
+          'NEXT_PUBLIC_SUPABASE_ANON_KEY',
+          'NEXT_PUBLIC_SITE_URL',
+          'NEXT_PUBLIC_PREVIEW_SITE_URL',
+          'AMALGM_DESKTOP_MAIN_APP_ORIGIN',
+          'AMALGM_DESKTOP_PREVIEW_APP_ORIGIN',
+          'AMALGM_DESKTOP_RELEASE_CHECKOUT_ROOT',
+          'AMALGM_DESKTOP_RELEASE_ENV_FILE',
+          'AMALGM_DESKTOP_RELEASE_ENGINE_REPO_PATH',
+          'AMALGM_DESKTOP_RELEASE_NODE_BIN',
+          'AMALGM_DESKTOP_RELEASE_PATH_PREFIX',
+          'AMALGM_DESKTOP_RELEASE_PYTHON',
+          'AMALGM_DESKTOP_RELEASE_PROVIDER',
+          'AMALGM_DESKTOP_RELEASE_REPOSITORY',
+          'AMALGM_DESKTOP_RELEASE_REPO_FULL_NAME',
+          'AMALGM_DESKTOP_RELEASE_FLY_APP',
+          'AMALGM_DESKTOP_RELEASE_FLY_ROOT',
+          'AMALGM_DESKTOP_RELEASE_UPLOAD_TOKEN',
+          'AMALGM_DESKTOP_RELEASE_UPLOAD_METHOD',
+          'AMALGM_DESKTOP_RELEASE_UPLOAD_URL',
+          'AMALGM_DESKTOP_RELEASE_UPLOAD_CHUNK_BYTES',
+          'AMALGM_DESKTOP_LEGACY_BRIDGE_ENABLED',
+          'AMALGM_DESKTOP_LEGACY_BRIDGE_REPOSITORY',
+          'AMALGM_DESKTOP_LEGACY_BRIDGE_REPO_FULL_NAME',
+          'AMALGM_DESKTOP_LEGACY_BRIDGE_OWNER',
+          'AMALGM_DESKTOP_LEGACY_BRIDGE_REPO',
+          'AMALGM_DESKTOP_UPDATE_PROVIDER',
+          'AMALGM_DESKTOP_UPDATE_BASE_URL',
+          'AMALGM_DESKTOP_UPDATE_URL',
+          'AMALGM_DESKTOP_UPDATE_OWNER',
+          'AMALGM_DESKTOP_UPDATE_REPO',
+          'AMALGM_DESKTOP_RELEASE_UPLOAD_ATTEMPTS',
+          'AMALGM_DESKTOP_RELEASE_UPLOAD_LIMIT_RATE',
+          'AMALGM_DESKTOP_RELEASE_UI_REPO_PATH',
+          'AMALGM_ENGINE_REPO_URL',
+          'AMALGM_UI_REPO_URL',
+          'FLY_ACCESS_TOKEN',
+          'CSC_LINK',
+          'CSC_KEY_PASSWORD',
+          'CSC_NAME',
+          'AMALGM_DESKTOP_NOTARIZE',
+          'APPLE_API_KEY',
+          'APPLE_API_KEY_ID',
+          'APPLE_API_ISSUER',
+          'APPLE_ID',
+          'APPLE_APP_SPECIFIC_PASSWORD',
+          'APPLE_TEAM_ID',
+          'APPLE_KEYCHAIN',
+          'APPLE_KEYCHAIN_PROFILE',
+        ],
+        actions: ['notifications.notify_user'],
+      },
+      limits: {
+        maxConcurrentRuns: 1,
+        queueLimit: 10,
+        cellTimeoutMs: 7200000,
+        codeTimeoutMs: 15000,
+      },
+    }, {
+      id: NPM_RELEASE_WORKFLOW_ID,
+      name: 'Publish npm runtime release',
+      description: 'Publishes amalgm@canary from preview and stable amalgm tags from main.',
+      enabled: true,
+      internal: true,
+      workflowText: npmReleaseWorkflow(),
+      allowlist: {
+        localCompute: true,
+        secrets: [
+          'GH_TOKEN',
+          'GITHUB_TOKEN',
+          'NODE_AUTH_TOKEN',
+          'NPM_TOKEN',
+          'AMALGM_NPM_RELEASE_CHECKOUT_ROOT',
+          'AMALGM_NPM_RELEASE_ENV_FILE',
+          'AMALGM_NPM_RELEASE_ENGINE_REPO_PATH',
+          'AMALGM_NPM_RELEASE_NODE_BIN',
+          'AMALGM_NPM_RELEASE_PATH_PREFIX',
+          'AMALGM_NPM_RELEASE_PYTHON',
+          'AMALGM_NPM_RELEASE_NPM_CACHE',
+          'AMALGM_ENGINE_REPO_URL',
+        ],
+        actions: ['notifications.notify_user'],
+      },
+      limits: {
+        maxConcurrentRuns: 1,
+        queueLimit: 10,
+        cellTimeoutMs: 1800000,
+        codeTimeoutMs: 15000,
+      },
+    }],
+  };
+}
+
+function internalAutomationSeeds() {
+  if (['1', 'true', 'yes', 'on'].includes(String(process.env.AMALGM_DISABLE_INTERNAL_DESKTOP_RELEASE_AUTOMATION || '').trim().toLowerCase())) {
+    return [];
+  }
+  return [desktopReleaseAutomationSeed()];
+}
+
+module.exports = {
+  DESKTOP_RELEASE_AUTOMATION_ID,
+  DESKTOP_RELEASE_TRIGGER_ID,
+  DESKTOP_RELEASE_WORKFLOW_ID,
+  NPM_RELEASE_WORKFLOW_ID,
+  desktopReleaseAutomationSeed,
+  desktopReleaseRunnerPath,
+  desktopReleaseWorkflow,
+  internalAutomationSeeds,
+  npmReleaseRunnerPath,
+  npmReleaseWorkflow,
+};

package/runtime/scripts/amalgm-mcp/automations/store.js

@@ -11,8 +11,10 @@ const { getWebhookUrl } = require('../events/webhook-url');
 const { canonicalProjectPath } = require('../../lib/project-paths');
 const { validateCellReferences } = require('./cell-references');
 const { validateWorkflowToolActions } = require('./tool-actions');
+const { internalAutomationSeeds } = require('./internal-workflows');
 
 const LEGACY_MIGRATION_KEY = 'automations_legacy_migrated_v1';
+const INTERNAL_SEED_HASH_PREFIX = 'automations_internal_seed_hash:';
 const DEFAULT_RUN_LIMIT = 100;
 const TERMINAL_RUN_STATUSES = new Set(['completed', 'failed', 'stopped', 'rejected', 'interrupted', 'unmatched']);
 const DEFAULT_STALE_RUN_MS = Math.max(60_000, Number(process.env.AMALGM_AUTOMATION_RUN_STALE_MS) || 10 * 60_000);
@@ -1516,6 +1518,54 @@ function migrateLegacyAutomations(db) {
   setMetaValue(db, LEGACY_MIGRATION_KEY, nowIso());
 }
 
+function seedHash(seed) {
+  return crypto.createHash('sha256').update(JSON.stringify(seed)).digest('hex');
+}
+
+function seedForUpdate(seed, existing) {
+  const workflowsById = new Map((existing.workflows || []).map((workflow) => [workflow.id, workflow]));
+  const triggersById = new Map((existing.triggers || []).map((trigger) => [trigger.id, trigger]));
+  return {
+    ...seed,
+    enabled: existing.enabled,
+    workflows: (seed.workflows || []).map((workflow) => {
+      const prior = workflowsById.get(workflow.id);
+      return {
+        ...workflow,
+        enabled: prior?.enabled ?? workflow.enabled,
+      };
+    }),
+    triggers: (seed.triggers || []).map((trigger) => {
+      const prior = triggersById.get(trigger.id);
+      return {
+        ...trigger,
+        enabled: prior?.enabled ?? trigger.enabled,
+        webhookUrl: prior?.webhookUrl || trigger.webhookUrl,
+        secret: prior?.secret || trigger.secret,
+      };
+    }),
+  };
+}
+
+function seedInternalAutomations(db) {
+  for (const seed of internalAutomationSeeds()) {
+    const hashKey = `${INTERNAL_SEED_HASH_PREFIX}${seed.id}`;
+    const hash = seedHash(seed);
+    const existing = readAutomationGraph(db).automations.find((automation) => automation.id === seed.id) || null;
+
+    if (!existing) {
+      createAutomation(seed, { source: 'automations:internal-seed' });
+      setMetaValue(db, hashKey, hash);
+      continue;
+    }
+
+    if (metaValue(db, hashKey) === hash) continue;
+
+    updateAutomation(seed.id, seedForUpdate(seed, existing), { source: 'automations:internal-seed' });
+    setMetaValue(db, hashKey, hash);
+  }
+}
+
 let ensuring = false;
 let ensured = false;
 
@@ -1525,6 +1575,7 @@ function ensureAutomationsStore() {
   try {
     const db = openLocalDb();
     migrateLegacyAutomations(db);
+    seedInternalAutomations(db);
     ensured = true;
   } finally {
     ensuring = false;