amalgm 0.1.131 → 0.1.133

package/lib/cli.js

@@ -229,6 +229,7 @@ const SAFE_DAEMON_ENV_KEYS = [
   'LC_ALL',
   'LOGNAME',
   'NODE_PATH',
+  'NPM_CONFIG_PREFIX',
   'PATH',
   'PORT_MONITOR_PORT',
   'SHELL',
@@ -241,6 +242,7 @@ const SAFE_DAEMON_ENV_KEYS = [
   'XDG_CACHE_HOME',
   'XDG_CONFIG_HOME',
   'XDG_DATA_HOME',
+  'npm_config_prefix',
 ];
 
 function daemonEnv(localOnly) {

package/lib/service.js

@@ -65,6 +65,7 @@ const SERVICE_ENV_KEYS = [
   'LANG',
   'LC_ALL',
   'NODE_PATH',
+  'NPM_CONFIG_PREFIX',
   'PATH',
   'PORT_MONITOR_PORT',
   'SHELL',
@@ -75,6 +76,7 @@ const SERVICE_ENV_KEYS = [
   'XDG_CACHE_HOME',
   'XDG_CONFIG_HOME',
   'XDG_DATA_HOME',
+  'npm_config_prefix',
 ];
 
 function ensureDir(dir, mode = 0o700) {
@@ -143,6 +145,27 @@ function systemdQuote(value) {
   return `"${String(value).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
 }
 
+function pathLooksLikeDesktopBundle(value) {
+  return /(?:^|\/)[^/]+\.app\/Contents\/(?:Resources\/cli|MacOS)(?:\/|$)/.test(String(value || '').replace(/\\/g, '/'));
+}
+
+function serviceStateCanOwnRuntime(state) {
+  if (!state) return false;
+  const pointsAtDesktopBundle = [
+    state.package_root,
+    state.node,
+    state.bin,
+    state.files?.plist,
+    state.files?.unit,
+    state.files?.script,
+    state.files?.nodeScript,
+  ].some(pathLooksLikeDesktopBundle);
+  if (pointsAtDesktopBundle) return false;
+  if (state.runtime_host === 'node') return true;
+  if (state.runtime_host === 'electron') return false;
+  return true;
+}
+
 function isPidRunning(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
   try {
@@ -283,7 +306,6 @@ function buildServiceEnv(localOnly) {
     AMALGM_LOCAL_ONLY: localOnly ? 'true' : 'false',
     AMALGM_SERVICE_MANAGED: 'true',
     AMALGM_SERVICE_LABEL: SERVICE_LABEL,
-    ELECTRON_RUN_AS_NODE: process.env.ELECTRON_RUN_AS_NODE || '1',
     PATH: process.env.PATH || '/usr/local/bin:/usr/bin:/bin',
   };
 
@@ -656,6 +678,7 @@ function serviceStateFor(backend, localOnly, files = {}) {
     package_root: PACKAGE_ROOT,
     node: process.execPath,
     bin: AMALGM_BIN,
+    runtime_host: process.versions.electron ? 'electron' : 'node',
     files,
     updated_at: new Date().toISOString(),
   };
@@ -710,6 +733,7 @@ function stateMatchesRequest(state, options = {}) {
 // Explicit `amalgm service install` still takes over via installService().
 function deferToExistingInstall(state, options = {}) {
   if (!state || !state.backend || !state.bin || !state.package_version) return false;
+  if (!serviceStateCanOwnRuntime(state)) return false;
   if (state.package_root === PACKAGE_ROOT) return false;
   if (!!state.local_only !== !!options.localOnly) return false;
   const requested = normalizeMode(options.mode || 'auto');
@@ -941,7 +965,10 @@ module.exports = {
     SERVICE_PID_FILE,
     clearPortableServiceStateForDeadPid,
     lockOwnedByAnother,
+    pathLooksLikeDesktopBundle,
     portableLockDir,
+    serviceStateCanOwnRuntime,
+    writeLaunchdPlist,
     writePortableNodeScript,
     writeSystemdUnit,
   },

package/lib/supervisor.js

@@ -186,6 +186,7 @@ const SAFE_PROCESS_ENV_KEYS = [
   'ELECTRON_RUN_AS_NODE',
   'PATH',
   'NODE_PATH',
+  'NPM_CONFIG_PREFIX',
   'SHELL',
   'SSH_AUTH_SOCK',
   'TERM',
@@ -196,6 +197,7 @@ const SAFE_PROCESS_ENV_KEYS = [
   'XDG_CACHE_HOME',
   'XDG_CONFIG_HOME',
   'XDG_DATA_HOME',
+  'npm_config_prefix',
 ];
 
 function safeBaseProcessEnv() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.131",
+  "version": "0.1.133",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,

package/runtime/scripts/amalgm-mcp/browser/auth-bundles.js

@@ -65,6 +65,26 @@ function stateStorageKinds(state = {}) {
   return Array.from(kinds).sort();
 }
 
+// Normalize to the Chromium/Playwright cookie shape we can save and inject.
+// Keep newer partition metadata when Chromium supplies it; older importers
+// safely ignore fields they do not understand.
+function normalizeChromiumCookie(cookie = {}) {
+  const out = {
+    name: String(cookie.name ?? ''),
+    value: String(cookie.value ?? ''),
+    domain: String(cookie.domain ?? ''),
+    path: String(cookie.path ?? '/'),
+    expires: typeof cookie.expires === 'number' ? cookie.expires : -1,
+    httpOnly: Boolean(cookie.httpOnly),
+    secure: Boolean(cookie.secure),
+    sameSite: ['Strict', 'Lax', 'None'].includes(cookie.sameSite) ? cookie.sameSite : 'Lax',
+  };
+  for (const key of ['partitionKey', 'priority', 'sameParty', 'sourceScheme']) {
+    if (cookie[key] !== undefined && cookie[key] !== null) out[key] = cookie[key];
+  }
+  return out;
+}
+
 function filterStateByDomains(state = {}, domains = []) {
   const cleanDomains = normalizeList(domains).map(normalizeDomain).filter(Boolean);
   if (cleanDomains.length === 0) return state;
@@ -202,14 +222,21 @@ function writeEncryptedStateBundle(input = {}) {
   const profileId = safeId(input.profileId || input.browserProfileId);
   const domains = normalizeList(input.domains);
   const filteredState = filterStateByDomains(input.state || {}, domains);
-  const storageKinds = stateStorageKinds(filteredState);
+  const normalizedCookies = (Array.isArray(filteredState.cookies) ? filteredState.cookies : [])
+    .map(normalizeChromiumCookie);
+  const normalizedState = {
+    ...filteredState,
+    cookies: normalizedCookies,
+  };
+  const storageKinds = stateStorageKinds(normalizedState);
   const encrypted = encryptJson({
-    version: 1,
+    version: 2,
     profileId,
     domains,
     storageKinds,
     capturedAt: nowIso(),
-    state: filteredState,
+    cookies: normalizedCookies,
+    state: normalizedState,
   });
   const id = bundleIdFor(input.id);
   const file = path.join(authBundleRoot(), `${id}.json.enc`);
@@ -275,6 +302,7 @@ module.exports = {
   listBrowserAuthBundles,
   markBrowserAuthBundleImported,
   normalizeAuthBundle,
+  normalizeChromiumCookie,
   readEncryptedStateBundle,
   stateStorageKinds,
   upsertBrowserAuthBundle,

package/runtime/scripts/amalgm-mcp/browser/auth-tools.js

@@ -14,6 +14,7 @@
 
 const { textResult, errorResult } = require('../lib/tool-result');
 const engine = require('./engine');
+const { COOKIE_SOURCE_BUNDLE_ID, DEFAULT_COOKIE_SOURCE_PROFILE_ID } = require('./cookie-source');
 const {
   createBrowserLoginSession,
   listBrowserAuthBundles,
@@ -30,16 +31,6 @@ function jsonText(value) {
   return textResult(JSON.stringify(value, null, 2));
 }
 
-function authDomainsFrom(inputDomains, fallbackUrl) {
-  if (Array.isArray(inputDomains) && inputDomains.length > 0) return inputDomains;
-  try {
-    const hostname = new URL(fallbackUrl).hostname;
-    return hostname ? [hostname] : [];
-  } catch {
-    return [];
-  }
-}
-
 module.exports = [
   {
     name: 'auth_list',
@@ -51,6 +42,10 @@ module.exports = [
           profiles: listBrowserProfiles(),
           bundles: listBrowserAuthBundles(),
           loginSessions: listBrowserLoginSessions(),
+          cookieSource: {
+            bundleId: COOKIE_SOURCE_BUNDLE_ID,
+            profileId: DEFAULT_COOKIE_SOURCE_PROFILE_ID,
+          },
         });
       } catch (err) {
         return errorResult(`auth_list failed: ${err.message}`);
@@ -79,8 +74,7 @@ module.exports = [
         const profileId = safeId(
           args.browserProfileId
             || args.browserSessionId
-            || ctx?.callerSessionId
-            || `login-${Date.now().toString(36)}`,
+            || DEFAULT_COOKIE_SOURCE_PROFILE_ID,
         );
         // A desktop-born conversation logs in on the visible surface this
         // session already drives — open the page there and say so. Everyone
@@ -125,18 +119,20 @@ module.exports = [
       type: 'object',
       properties: {
         browserProfileId: { type: 'string', description: 'Durable browser profile id to save from' },
+        id: { type: 'string', description: 'Optional bundle id. Defaults to the shared browser cookie source.' },
         name: { type: 'string', description: 'Human-readable bundle name' },
-        domains: { type: 'array', items: { type: 'string' }, description: 'Optional domains to include, e.g. example.com' },
+        domains: { type: 'array', items: { type: 'string' }, description: 'Optional domains to include. Omit to save all current browser auth state.' },
       },
     },
     async handler(args, ctx) {
       try {
-        const profileId = safeId(args.browserProfileId || args.browserSessionId || ctx?.callerSessionId || 'default');
+        const profileId = safeId(args.browserProfileId || args.browserSessionId || ctx?.callerSessionId || DEFAULT_COOKIE_SOURCE_PROFILE_ID);
         const saved = await engine.saveState({ ...args, session: profileId }, ctx);
         const bundle = writeEncryptedStateBundle({
-          name: args.name || saved.title || profileId,
+          id: args.id || COOKIE_SOURCE_BUNDLE_ID,
+          name: args.name || 'Browser cookie source',
           profileId,
-          domains: authDomainsFrom(args.domains, saved.url),
+          domains: Array.isArray(args.domains) ? args.domains : [],
           state: saved.state || {},
         });
         touchBrowserProfile({
@@ -164,7 +160,7 @@ module.exports = [
     async handler(args, ctx) {
       try {
         const { bundle, payload } = readEncryptedStateBundle(args.id);
-        const profileId = safeId(args.browserProfileId || args.browserSessionId || bundle.profileId);
+        const profileId = safeId(args.browserProfileId || args.browserSessionId || bundle.profileId || DEFAULT_COOKIE_SOURCE_PROFILE_ID);
         const loaded = await engine.loadState({
           ...args,
           session: profileId,

package/runtime/scripts/amalgm-mcp/browser/cookie-source.js

@@ -0,0 +1,17 @@
+'use strict';
+
+// Machine-local browser auth source. Sessions keep their own browser process
+// identity, but import this encrypted bundle on first use.
+const COOKIE_SOURCE_BUNDLE_ID = 'browser-cookie-source';
+const DEFAULT_COOKIE_SOURCE_PROFILE_ID = 'user-default';
+
+function cookieSourceVersion(bundle) {
+  if (!bundle) return null;
+  return bundle.blobSha256 || bundle.updatedAt || bundle.id || null;
+}
+
+module.exports = {
+  COOKIE_SOURCE_BUNDLE_ID,
+  DEFAULT_COOKIE_SOURCE_PROFILE_ID,
+  cookieSourceVersion,
+};

package/runtime/scripts/amalgm-mcp/browser/engine.js

@@ -21,9 +21,12 @@ const attach = require('./attach');
 const capture = require('./capture');
 const sessions = require('./sessions');
 const typing = require('./typing');
+const { COOKIE_SOURCE_BUNDLE_ID, cookieSourceVersion } = require('./cookie-source');
+const { getBrowserAuthBundle, readEncryptedStateBundle } = require('./auth-bundles');
 
 const { backendFor, sessionFor, sessionInfo } = sessions;
 const { run, runBatch, readText } = attach;
+const loadedCookieSources = new Map();
 
 /**
  * Target grammar shared by click/fill:
@@ -56,8 +59,39 @@ function parseState(entryOrResult) {
   }
 }
 
+function cookieSourceDisabled() {
+  return /^(0|false|no)$/i.test(String(process.env.AMALGM_BROWSER_COOKIE_SOURCE || ''));
+}
+
+async function loadStateIntoSession(session, statePayload, context) {
+  const fs = require('fs');
+  const os = require('os');
+  const path = require('path');
+  const crypto = require('crypto');
+  const file = path.join(os.tmpdir(), `amalgm-browser-state-load-${session}-${Date.now()}-${crypto.randomUUID()}.json`);
+  fs.writeFileSync(file, `${JSON.stringify(statePayload, null, 2)}\n`, { mode: 0o600 });
+  try {
+    await run(session, ['state', 'load', file], { context });
+  } finally {
+    try { fs.rmSync(file, { force: true }); } catch {}
+  }
+}
+
+async function ensureCookieSourceLoaded(session, context) {
+  if (cookieSourceDisabled()) return;
+  const bundle = getBrowserAuthBundle(COOKIE_SOURCE_BUNDLE_ID);
+  if (!bundle?.blobPath) return;
+  const version = cookieSourceVersion(bundle);
+  if (version && loadedCookieSources.get(session) === version) return;
+  const { payload } = readEncryptedStateBundle(COOKIE_SOURCE_BUNDLE_ID);
+  if (!payload?.state || typeof payload.state !== 'object') return;
+  await loadStateIntoSession(session, payload.state, context);
+  if (version) loadedCookieSources.set(session, version);
+}
+
 async function state(args = {}, context) {
   const session = sessionFor(args, context);
+  await ensureCookieSourceLoaded(session, context);
   let current = { url: '', title: '' };
   try { current = parseState(await run(session, STATE_COMMAND, { context })); } catch {}
   return sessionInfo(session, current);
@@ -65,12 +99,14 @@ async function state(args = {}, context) {
 
 async function open(args = {}, context) {
   const session = sessionFor(args, context);
+  await ensureCookieSourceLoaded(session, context);
   const entries = await runBatch(session, [['open', args.url], STATE_COMMAND], { context });
   return sessionInfo(session, parseState(entries[1]));
 }
 
 async function snapshot(args = {}, context) {
   const session = sessionFor(args, context);
+  await ensureCookieSourceLoaded(session, context);
   const entries = await runBatch(session, [['snapshot', '-i'], STATE_COMMAND], { timeoutMs: 30_000, context });
   return {
     ...sessionInfo(session, parseState(entries[1])),
@@ -80,12 +116,14 @@ async function snapshot(args = {}, context) {
 
 async function screenshot(args = {}, context) {
   const session = sessionFor(args, context);
+  await ensureCookieSourceLoaded(session, context);
   const shot = await capture.screenshot(session, args, context);
   return { ...sessionInfo(session), ...shot };
 }
 
 async function click(args = {}, context) {
   const session = sessionFor(args, context);
+  await ensureCookieSourceLoaded(session, context);
   const target = String(args.target || '');
   await run(session, target.startsWith('text=')
     ? findArgs(target, 'click')
@@ -95,6 +133,7 @@ async function click(args = {}, context) {
 
 async function fill(args = {}, context) {
   const session = sessionFor(args, context);
+  await ensureCookieSourceLoaded(session, context);
   const target = String(args.target || '');
   const text = String(args.text ?? '');
   if (backendFor(session) === 'attached') {
@@ -119,6 +158,7 @@ async function fill(args = {}, context) {
 
 async function press(args = {}, context) {
   const session = sessionFor(args, context);
+  await ensureCookieSourceLoaded(session, context);
   if (backendFor(session) === 'attached') {
     await run(session, ['eval', typing.keyScript(String(args.key || ''))], { context });
   } else {
@@ -134,12 +174,14 @@ async function press(args = {}, context) {
  */
 async function select(args = {}, context) {
   const session = sessionFor(args, context);
+  await ensureCookieSourceLoaded(session, context);
   await run(session, ['select', String(args.target || ''), String(args.value ?? '')], { context });
   return sessionInfo(session, { selected: args.target, value: args.value });
 }
 
 async function evaluate(args = {}, context) {
   const session = sessionFor(args, context);
+  await ensureCookieSourceLoaded(session, context);
   const script = args.script || '';
   let result;
   try {
@@ -159,6 +201,7 @@ async function evaluate(args = {}, context) {
 
 async function wait(args = {}, context) {
   const session = sessionFor(args, context);
+  await ensureCookieSourceLoaded(session, context);
   const timeoutMs = args.timeoutMs || 30_000;
 
   if (args.ms) {
@@ -188,6 +231,7 @@ async function wait(args = {}, context) {
  */
 async function passthrough(args = {}, context) {
   const session = sessionFor(args, context);
+  await ensureCookieSourceLoaded(session, context);
   const commandArgs = (args.args || []).map(String);
   if (!commandArgs.length) throw new Error('args is required, e.g. ["scroll", "down"] or ["get", "text", "@e1"]');
   const attached = sessions.backendFor(session) === 'attached';
@@ -225,6 +269,7 @@ function mouseButton(value) {
 
 async function cua(action, args = {}, context) {
   const session = sessionFor(args, context);
+  await ensureCookieSourceLoaded(session, context);
   const options = { context };
 
   const x = Math.round(Number(args.x || 0));
@@ -306,9 +351,10 @@ async function saveState(args = {}, context) {
   if (!args.path) {
     try { fs.rmSync(file, { force: true }); } catch {}
   }
-  const current = await state(args, context);
+  let current = { url: '', title: '' };
+  try { current = parseState(await run(session, STATE_COMMAND, { context })); } catch {}
   return {
-    ...current,
+    ...sessionInfo(session, current),
     state: stateData,
     path: args.path ? file : undefined,
     storageKinds: ['cookies', 'localStorage', 'sessionStorage'],
@@ -317,22 +363,13 @@ async function saveState(args = {}, context) {
 
 async function loadState(args = {}, context) {
   const session = sessionFor(args, context);
-  const fs = require('fs');
-  const os = require('os');
-  const path = require('path');
-  const crypto = require('crypto');
   let file = args.path;
-  let temporary = false;
   if (!file) {
     if (!args.state || typeof args.state !== 'object') throw new Error('state or path is required');
-    file = path.join(os.tmpdir(), `amalgm-browser-state-load-${session}-${Date.now()}-${crypto.randomUUID()}.json`);
-    fs.writeFileSync(file, `${JSON.stringify(args.state, null, 2)}\n`, { mode: 0o600 });
-    temporary = true;
+    await loadStateIntoSession(session, args.state, context);
+    return sessionInfo(session, { loaded: true, storageKinds: ['cookies', 'localStorage', 'sessionStorage'] });
   }
   await run(session, ['state', 'load', file], { context });
-  if (temporary) {
-    try { fs.rmSync(file, { force: true }); } catch {}
-  }
   return sessionInfo(session, { loaded: true, storageKinds: ['cookies', 'localStorage', 'sessionStorage'] });
 }
 
@@ -371,6 +408,7 @@ module.exports = {
   readBridgeAdvertisement: backend.readBridgeAdvertisement,
   // Session façade (sessions.js).
   backendFor: sessions.backendFor,
+  ensureCookieSourceLoaded,
   knownSessions: sessions.knownSessions,
   sessionFor,
   sessionInfo,

package/runtime/scripts/amalgm-mcp/browser/novnc.js

@@ -31,6 +31,7 @@ function requestedTransport(value) {
   const text = String(value || '').trim().toLowerCase();
   if (['electron', 'electron-splitview', 'desktop'].includes(text)) return 'electron-splitview';
   if (['novnc', 'vnc', 'remote-live-view', 'remote'].includes(text)) return 'novnc';
+  if (['amalgm-live', 'browser-auth-live', 'cdp-live', 'live'].includes(text)) return 'amalgm-live';
   if (['none', 'manual'].includes(text)) return 'none';
   return '';
 }
@@ -69,9 +70,9 @@ function resolveLoginTransport(input = {}) {
   }
 
   return {
-    transport: 'auto',
+    transport: 'amalgm-live',
     liveUrl: null,
-    setupStatus: 'pending_transport',
+    setupStatus: 'ready',
   };
 }
 

package/runtime/scripts/amalgm-mcp/browser/rest.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const engine = require('./engine');
+const { COOKIE_SOURCE_BUNDLE_ID, DEFAULT_COOKIE_SOURCE_PROFILE_ID } = require('./cookie-source');
 
 const loadStateBrowser = (args, ctx) => engine.loadState(args, ctx);
 const saveStateBrowser = (args, ctx) => engine.saveState(args, ctx);
@@ -23,7 +24,7 @@ const {
   writeEncryptedStateBundle,
 } = require('./store');
 
-function profileIdFrom(input = {}, fallback = 'default') {
+function profileIdFrom(input = {}, fallback = DEFAULT_COOKIE_SOURCE_PROFILE_ID) {
   return safeId(
     input.browserProfileId
       || input.profileId
@@ -33,16 +34,6 @@ function profileIdFrom(input = {}, fallback = 'default') {
   );
 }
 
-function domainsFrom(inputDomains, fallbackUrl) {
-  if (Array.isArray(inputDomains) && inputDomains.length > 0) return inputDomains;
-  try {
-    const hostname = new URL(fallbackUrl).hostname;
-    return hostname ? [hostname] : [];
-  } catch {
-    return [];
-  }
-}
-
 function handleProfilesList(sendJson) {
   sendJson(200, { profiles: listBrowserProfiles() });
 }
@@ -69,10 +60,10 @@ async function exportAuthBundleFromProfile(body = {}) {
   }, {});
 
   const bundle = writeEncryptedStateBundle({
-    id: body.id,
-    name: body.name || saved.title || profileId,
+    id: body.id || (profileId === DEFAULT_COOKIE_SOURCE_PROFILE_ID ? COOKIE_SOURCE_BUNDLE_ID : undefined),
+    name: body.name || (profileId === DEFAULT_COOKIE_SOURCE_PROFILE_ID ? 'Browser cookie source' : saved.title || profileId),
     profileId,
-    domains: domainsFrom(body.domains, saved.url),
+    domains: Array.isArray(body.domains) ? body.domains : [],
     state: saved.state || {},
   });
 
@@ -133,9 +124,26 @@ function loginErrorStatus(error) {
   return 400;
 }
 
+function loginSessionIdFrom(input = {}) {
+  return String(input.id || input.sessionId || '');
+}
+
+function loginSessionTokenFrom(input = {}) {
+  return String(input.token || '');
+}
+
+function browserSessionArgs(session, extra = {}) {
+  return {
+    ...extra,
+    browserProfileId: session.profileId,
+    browserSessionId: session.profileId,
+    session: session.profileId,
+  };
+}
+
 async function activateLoginSessionForView(session) {
   if (!session?.targetUrl) return session;
-  if (!['novnc', 'auto'].includes(session.transport)) return session;
+  if (!['novnc', 'auto', 'amalgm-live'].includes(session.transport)) return session;
 
   try {
     await navigateBrowser({
@@ -153,6 +161,18 @@ async function activateLoginSessionForView(session) {
   }
 }
 
+async function activeLiveLoginSession(input = {}) {
+  let session = assertBrowserLoginSessionToken(
+    loginSessionIdFrom(input),
+    loginSessionTokenFrom(input),
+  );
+  if (session.status === 'pending') {
+    session = markBrowserLoginSessionActive(session.id, loginSessionTokenFrom(input));
+    session = await activateLoginSessionForView(session);
+  }
+  return session;
+}
+
 async function handleLoginSessionsList(query = {}, sendJson) {
   try {
     if (query.id) {
@@ -168,6 +188,55 @@ async function handleLoginSessionsList(query = {}, sendJson) {
   }
 }
 
+async function handleLoginSessionLiveView(query = {}, sendJson) {
+  try {
+    const session = await activeLiveLoginSession(query);
+    const shot = await engine.screenshot(browserSessionArgs(session, { fullPage: false }), {});
+    sendJson(200, {
+      session,
+      screenshot: {
+        mimeType: 'image/png',
+        data: shot.base64,
+        bytes: shot.bytes,
+        mode: shot.mode,
+        capturedAt: new Date().toISOString(),
+      },
+    });
+  } catch (error) {
+    sendJson(loginErrorStatus(error), { error: error.message });
+  }
+}
+
+async function handleLoginSessionLiveInput(body = {}, sendJson) {
+  try {
+    const session = assertBrowserLoginSessionToken(
+      loginSessionIdFrom(body),
+      loginSessionTokenFrom(body),
+    );
+    const action = String(body.action || '');
+    const args = browserSessionArgs(session, body);
+
+    if (action === 'click') {
+      await engine.cua('cua_click', args, {});
+    } else if (action === 'double_click') {
+      await engine.cua('cua_double_click', args, {});
+    } else if (action === 'scroll') {
+      await engine.cua('cua_scroll', args, {});
+    } else if (action === 'type') {
+      await engine.cua('cua_type', args, {});
+    } else if (action === 'keypress') {
+      await engine.cua('cua_keypress', args, {});
+    } else {
+      sendJson(400, { error: 'Unsupported live browser action' });
+      return;
+    }
+
+    sendJson(200, { ok: true, session });
+  } catch (error) {
+    sendJson(loginErrorStatus(error), { error: error.message });
+  }
+}
+
 function handleLoginSessionCreate(body = {}, sendJson) {
   try {
     const result = createBrowserLoginSession(body, { source: 'browser-login-session-rest' });
@@ -220,6 +289,8 @@ module.exports = {
   handleLoginSessionCancel,
   handleLoginSessionComplete,
   handleLoginSessionCreate,
+  handleLoginSessionLiveInput,
+  handleLoginSessionLiveView,
   handleLoginSessionsList,
   handleProfilesList,
   handleProfilesUpsert,

package/runtime/scripts/amalgm-mcp/server/routes/browser.js

@@ -28,9 +28,17 @@ async function handleBrowserRoutes(ctx) {
     return true;
   }
   if (ctx.pathname.startsWith('/browser/login-sessions') && ctx.method === 'GET') {
+    if (ctx.pathname === '/browser/login-sessions/live') {
+      await browserRest.handleLoginSessionLiveView(ctx.getQuery(), ctx.sendJson);
+      return true;
+    }
     browserRest.handleLoginSessionsList(ctx.getQuery(), ctx.sendJson);
     return true;
   }
+  if (ctx.pathname === '/browser/login-sessions/live' && ctx.method === 'POST') {
+    await browserRest.handleLoginSessionLiveInput(await ctx.readJsonBody(), ctx.sendJson);
+    return true;
+  }
   if (ctx.pathname === '/browser/login-sessions' && ctx.method === 'POST') {
     browserRest.handleLoginSessionCreate(await ctx.readJsonBody(), ctx.sendJson);
     return true;

package/runtime/scripts/amalgm-mcp/tests/browser-auth-bundles.test.js

@@ -14,6 +14,7 @@ const { closeLocalDb, openLocalDb } = require('../state/db');
 const { listEventsAfter } = require('../state/events');
 const { buildSnapshot } = require('../state/snapshot');
 const {
+  normalizeChromiumCookie,
   readEncryptedStateBundle,
   writeEncryptedStateBundle,
 } = require('../browser/auth-bundles');
@@ -88,3 +89,27 @@ test('browser auth bundles encrypt cookie/storage payloads and publish metadata
   const rows = openLocalDb().prepare('SELECT value_json FROM event_log WHERE resource = ?').all('browser_auth_bundles');
   assert.equal(JSON.stringify(rows).includes('secret-cookie'), false);
 });
+
+test('browser auth bundles normalize cookies to an injectable Chromium shape', () => {
+  const normalized = normalizeChromiumCookie({
+    name: 'sid',
+    value: 'secret-cookie',
+    domain: '.example.com',
+    httpOnly: 1,
+    secure: 1,
+    sameSite: 'Bogus',
+    partitionKey: 'https://example.com',
+  });
+
+  assert.deepEqual(normalized, {
+    name: 'sid',
+    value: 'secret-cookie',
+    domain: '.example.com',
+    path: '/',
+    expires: -1,
+    httpOnly: true,
+    secure: true,
+    sameSite: 'Lax',
+    partitionKey: 'https://example.com',
+  });
+});

package/runtime/scripts/amalgm-mcp/tests/browser-cookie-source.test.js

@@ -0,0 +1,118 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-cookie-source-'));
+process.env.AMALGM_DIR = path.join(tempRoot, '.amalgm');
+process.env.AMALGM_BROWSER_AUTH_KEY = 'b'.repeat(64);
+process.env.AMALGM_BROWSER_BACKEND = 'cli';
+process.env.FAKE_BROWSER_LOG = path.join(tempRoot, 'browser-calls.jsonl');
+
+const fakeBrowser = path.join(tempRoot, 'fake-agent-browser.js');
+fs.writeFileSync(fakeBrowser, `#!/usr/bin/env node
+const fs = require('fs');
+const valueFlags = new Set(['--session', '--profile', '--screenshot-dir', '--cdp', '--executable-path', '--provider']);
+const args = process.argv.slice(2);
+let command = [];
+for (let i = 0; i < args.length; i += 1) {
+  const arg = args[i];
+  if (!arg.startsWith('--')) {
+    command = args.slice(i);
+    break;
+  }
+  if (valueFlags.has(arg)) i += 1;
+}
+let stdin = '';
+if (command[0] === 'batch') {
+  try { stdin = fs.readFileSync(0, 'utf8'); } catch {}
+}
+fs.appendFileSync(process.env.FAKE_BROWSER_LOG, JSON.stringify({ command, stdin }) + '\\n');
+if (command[0] === 'batch') {
+  const commands = stdin ? JSON.parse(stdin) : [];
+  const entries = commands.map((item) => ({
+    success: true,
+    command: item,
+    result: item[0] === 'eval'
+      ? { result: JSON.stringify({ url: 'https://example.com/', title: 'Example' }) }
+      : { ok: true },
+  }));
+  process.stdout.write(JSON.stringify({ success: true, data: entries }));
+} else {
+  process.stdout.write(JSON.stringify({ success: true, data: { ok: true } }));
+}
+`, { mode: 0o755 });
+process.env.AMALGM_AGENT_BROWSER_BIN = fakeBrowser;
+
+const { closeLocalDb } = require('../state/db');
+const { COOKIE_SOURCE_BUNDLE_ID } = require('../browser/cookie-source');
+const { writeEncryptedStateBundle } = require('../browser/auth-bundles');
+const engine = require('../browser/engine');
+
+function readCalls() {
+  try {
+    return fs.readFileSync(process.env.FAKE_BROWSER_LOG, 'utf8')
+      .trim()
+      .split(/\n+/)
+      .filter(Boolean)
+      .map((line) => JSON.parse(line));
+  } catch {
+    return [];
+  }
+}
+
+function stateLoadCalls() {
+  return readCalls().filter((call) => call.command[0] === 'state' && call.command[1] === 'load');
+}
+
+test.after(() => {
+  closeLocalDb();
+  fs.rmSync(tempRoot, { recursive: true, force: true });
+});
+
+test('new browser session imports the shared cookie source before opening', async () => {
+  writeEncryptedStateBundle({
+    id: COOKIE_SOURCE_BUNDLE_ID,
+    name: 'Browser cookie source',
+    profileId: 'user-default',
+    state: {
+      cookies: [
+        {
+          name: 'session',
+          value: 'secret-cookie',
+          domain: '.example.com',
+          path: '/',
+          httpOnly: true,
+          secure: true,
+          sameSite: 'Lax',
+        },
+      ],
+      origins: [],
+    },
+  });
+
+  const first = await engine.open(
+    { url: 'https://example.com/' },
+    { callerSessionId: 'chat-a', sessionMetadata: { client: 'web' } },
+  );
+  assert.equal(first.url, 'https://example.com/');
+  assert.equal(first.title, 'Example');
+
+  const calls = readCalls();
+  const firstLoad = calls.findIndex((call) => call.command[0] === 'state' && call.command[1] === 'load');
+  const firstOpen = calls.findIndex((call) => call.command[0] === 'batch');
+  assert.ok(firstLoad >= 0, 'source should be loaded');
+  assert.ok(firstOpen > firstLoad, 'source should load before page commands');
+
+  const loadedFile = calls[firstLoad].command[2];
+  assert.equal(fs.existsSync(loadedFile), false, 'temporary state file should be removed after import');
+
+  await engine.open(
+    { url: 'https://example.com/again' },
+    { callerSessionId: 'chat-a', sessionMetadata: { client: 'web' } },
+  );
+  assert.equal(stateLoadCalls().length, 1, 'same source version should not reload for same session');
+});

package/runtime/scripts/amalgm-mcp/tests/browser-login-live.test.js

@@ -0,0 +1,108 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-browser-login-live-test-'));
+process.env.AMALGM_DIR = path.join(tempRoot, '.amalgm');
+delete process.env.AMALGM_BROWSER_NOVNC_PUBLIC_URL;
+delete process.env.AMALGM_BROWSER_NOVNC_URL;
+delete process.env.AMALGM_BROWSER_LOGIN_TRANSPORT;
+
+const engine = require('../browser/engine');
+const calls = [];
+engine.open = async (args) => {
+  calls.push(['open', args]);
+  return { session: args.session, url: args.url };
+};
+engine.screenshot = async (args) => {
+  calls.push(['screenshot', args]);
+  return { base64: Buffer.from('png').toString('base64'), bytes: 3, mode: 'viewport' };
+};
+engine.cua = async (action, args) => {
+  calls.push(['cua', action, args]);
+  return { session: args.session };
+};
+
+const { closeLocalDb } = require('../state/db');
+const { createBrowserLoginSession } = require('../browser/login-sessions');
+const rest = require('../browser/rest');
+
+function captureSend() {
+  const sent = [];
+  return {
+    sent,
+    sendJson(status, data) {
+      sent.push({ status, data });
+    },
+  };
+}
+
+test.after(() => {
+  closeLocalDb();
+  fs.rmSync(tempRoot, { recursive: true, force: true });
+});
+
+test('browser auth live view activates once and returns a screenshot', async () => {
+  const created = createBrowserLoginSession({
+    targetUrl: 'https://example.com/login',
+    browserProfileId: 'live-profile',
+    name: 'Live profile',
+  });
+  assert.equal(created.session.transport, 'amalgm-live');
+  assert.equal(created.session.setupStatus, 'ready');
+
+  const first = captureSend();
+  await rest.handleLoginSessionLiveView({ id: created.session.id, token: created.token }, first.sendJson);
+
+  assert.equal(first.sent[0].status, 200);
+  assert.equal(first.sent[0].data.session.status, 'active');
+  assert.equal(first.sent[0].data.screenshot.mimeType, 'image/png');
+  assert.equal(first.sent[0].data.screenshot.data, Buffer.from('png').toString('base64'));
+  assert.deepEqual(calls.map((call) => call[0]), ['open', 'screenshot']);
+  assert.equal(calls[0][1].browserProfileId, 'live-profile');
+  assert.equal(calls[1][1].session, 'live-profile');
+
+  calls.length = 0;
+  const second = captureSend();
+  await rest.handleLoginSessionLiveView({ id: created.session.id, token: created.token }, second.sendJson);
+  assert.equal(second.sent[0].status, 200);
+  assert.deepEqual(calls.map((call) => call[0]), ['screenshot']);
+});
+
+test('browser auth live input validates token and dispatches CUA actions to the login profile', async () => {
+  const created = createBrowserLoginSession({
+    targetUrl: 'https://example.com/login',
+    browserProfileId: 'input-profile',
+    name: 'Input profile',
+  });
+
+  calls.length = 0;
+  const good = captureSend();
+  await rest.handleLoginSessionLiveInput({
+    id: created.session.id,
+    token: created.token,
+    action: 'click',
+    x: 12,
+    y: 34,
+  }, good.sendJson);
+
+  assert.equal(good.sent[0].status, 200);
+  assert.equal(calls[0][0], 'cua');
+  assert.equal(calls[0][1], 'cua_click');
+  assert.equal(calls[0][2].session, 'input-profile');
+  assert.equal(calls[0][2].browserSessionId, 'input-profile');
+
+  const bad = captureSend();
+  await rest.handleLoginSessionLiveInput({
+    id: created.session.id,
+    token: 'wrong',
+    action: 'click',
+    x: 1,
+    y: 2,
+  }, bad.sendJson);
+  assert.equal(bad.sent[0].status, 401);
+});