amalgm 0.1.135 → 0.1.136

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.135",
+  "version": "0.1.136",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,

package/runtime/lib/harnesses.js

@@ -60,7 +60,7 @@ var DEFAULT_MODEL_IDS = {
   opencode: "opencode-deepseek-deepseek-v4-pro",
   pi: "pi-anthropic-claude-sonnet-4.6",
   amp: "amp-default",
-  cursor: "cursor/composer-2-fast"
+  cursor: "cursor/composer-2.5"
 };
 var CLAUDE_OPUS_4_8_1M_MODEL_ID = "anthropic/claude-opus-4.8-1m";
 var CLAUDE_LEGACY_ALIASES = {
@@ -291,14 +291,7 @@ function cursorCanonicalModelIdToCliModel(value) {
     return canonical.slice("xai/".length).replace(/^grok-4\.20/, "grok-4-20");
   }
   if (canonical.startsWith("anthropic/")) {
-    const model = canonical.slice("anthropic/".length);
-    const opus47Match = model.match(/^claude-opus-4\.7(?:-(.+))?$/);
-    if (opus47Match) return `claude-opus-4-7${opus47Match[1] ? `-${opus47Match[1]}` : ""}`;
-    const claudeMatch = model.match(/^claude-(opus|sonnet)-(4(?:\.\d+)?)(?:-(.+))?$/);
-    if (claudeMatch) {
-      const [, family, version, suffix] = claudeMatch;
-      return `claude-${version}-${family}${suffix ? `-${suffix}` : ""}`;
-    }
+    return canonical.slice("anthropic/".length).replace(/-(\d+)\.(\d+)(?=$|-)/, "-$1-$2");
   }
   return canonical;
 }
@@ -541,16 +534,30 @@ var OPENCODE_MODELS = [
     providerGroup: "mistral"
   }
 ];
-var PI_MODELS = [
-  {
-    id: "pi-anthropic-claude-sonnet-4.6",
-    name: "Claude Sonnet 4.6",
-    description: "Anthropic via AI Gateway",
-    cliModel: "anthropic/claude-sonnet-4.6",
-    provider: "pi",
-    providerGroup: "anthropic"
-  }
+var PI_MODEL_ROWS = [
+  ["anthropic/claude-opus-4.6", "Claude Opus 4.6", "Most capable Anthropic model", "anthropic"],
+  ["anthropic/claude-sonnet-4.6", "Claude Sonnet 4.6", "Balanced Anthropic model", "anthropic"],
+  ["anthropic/claude-haiku-4.5", "Claude Haiku 4.5", "Fast Anthropic model", "anthropic"],
+  ["openai/gpt-5.4", "GPT-5.4", "Flagship OpenAI model", "openai"],
+  ["openai/gpt-5.3-codex", "GPT-5.3 Codex", "OpenAI coding model", "openai"],
+  ["google/gemini-3.1-pro-preview", "Gemini 3.1 Pro", "Latest Google flagship", "google"],
+  ["google/gemini-3-flash", "Gemini 3 Flash", "Fast Google model", "google"],
+  ["xai/grok-4", "Grok 4", "xAI flagship model", "xai"],
+  ["deepseek/deepseek-v4-pro", "DeepSeek V4 Pro", "DeepSeek flagship model", "deepseek"],
+  ["deepseek/deepseek-v3.2", "DeepSeek V3.2", "Latest DeepSeek model", "deepseek"],
+  ["mistral/devstral-2", "Devstral 2", "Mistral coding model", "mistral"]
 ];
+var PI_MODELS = PI_MODEL_ROWS.map(
+  ([gatewayId, name, description, providerGroup]) => ({
+    id: `pi-${gatewayId.replace(/\//g, "-")}`,
+    name,
+    description,
+    gatewayModelId: gatewayId,
+    cliModel: buildGatewayCliModel(gatewayId, "pi"),
+    provider: "pi",
+    providerGroup
+  })
+);
 var AMP_MODELS = [
   {
     id: DEFAULT_MODEL_IDS.amp,
@@ -563,101 +570,37 @@ var AMP_MODELS = [
 ];
 var CURSOR_MODEL_ROWS = [
   ["auto", "Auto", "cursor"],
-  ["composer-2-fast", "Composer 2 Fast", "cursor"],
-  ["composer-2", "Composer 2", "cursor"],
-  ["composer-1.5", "Composer 1.5", "cursor"],
-  ["gpt-5.3-codex-low", "Codex 5.3 Low", "openai"],
-  ["gpt-5.3-codex-low-fast", "Codex 5.3 Low Fast", "openai"],
+  ["composer-2.5", "Composer 2.5", "cursor"],
+  ["claude-fable-5", "Fable 5 Thinking", "anthropic"],
+  ["claude-opus-4-8", "Opus 4.8 Thinking", "anthropic"],
+  ["claude-opus-4-7", "Opus 4.7 Thinking", "anthropic"],
+  ["claude-opus-4-6", "Opus 4.6 Thinking", "anthropic"],
+  ["claude-opus-4-5", "Opus 4.5 Thinking", "anthropic"],
+  ["claude-sonnet-5", "Sonnet 5 Thinking", "anthropic"],
+  ["claude-sonnet-4-6", "Sonnet 4.6 Thinking", "anthropic"],
+  ["claude-sonnet-4-5", "Sonnet 4.5 Thinking", "anthropic"],
+  ["claude-sonnet-4", "Sonnet 4", "anthropic"],
+  ["claude-haiku-4-5", "Haiku 4.5 Thinking", "anthropic"],
+  ["gpt-5.5", "GPT-5.5", "openai"],
+  ["gpt-5.4", "GPT-5.4", "openai"],
+  ["gpt-5.4-mini", "GPT-5.4 Mini", "openai"],
+  ["gpt-5.4-nano", "GPT-5.4 Nano", "openai"],
   ["gpt-5.3-codex", "Codex 5.3", "openai"],
-  ["gpt-5.3-codex-fast", "Codex 5.3 Fast", "openai"],
-  ["gpt-5.3-codex-high", "Codex 5.3 High", "openai"],
-  ["gpt-5.3-codex-high-fast", "Codex 5.3 High Fast", "openai"],
-  ["gpt-5.3-codex-xhigh", "Codex 5.3 Extra High", "openai"],
-  ["gpt-5.3-codex-xhigh-fast", "Codex 5.3 Extra High Fast", "openai"],
-  ["gpt-5.2", "GPT-5.2", "openai"],
-  ["gpt-5.3-codex-spark-preview-low", "Codex 5.3 Spark Low", "openai"],
-  ["gpt-5.3-codex-spark-preview", "Codex 5.3 Spark", "openai"],
-  ["gpt-5.3-codex-spark-preview-high", "Codex 5.3 Spark High", "openai"],
-  ["gpt-5.3-codex-spark-preview-xhigh", "Codex 5.3 Spark Extra High", "openai"],
-  ["gpt-5.2-codex-low", "Codex 5.2 Low", "openai"],
-  ["gpt-5.2-codex-low-fast", "Codex 5.2 Low Fast", "openai"],
   ["gpt-5.2-codex", "Codex 5.2", "openai"],
-  ["gpt-5.2-codex-fast", "Codex 5.2 Fast", "openai"],
-  ["gpt-5.2-codex-high", "Codex 5.2 High", "openai"],
-  ["gpt-5.2-codex-high-fast", "Codex 5.2 High Fast", "openai"],
-  ["gpt-5.2-codex-xhigh", "Codex 5.2 Extra High", "openai"],
-  ["gpt-5.2-codex-xhigh-fast", "Codex 5.2 Extra High Fast", "openai"],
-  ["gpt-5.1-codex-max-low", "Codex 5.1 Max Low", "openai"],
-  ["gpt-5.1-codex-max-low-fast", "Codex 5.1 Max Low Fast", "openai"],
-  ["gpt-5.1-codex-max-medium", "Codex 5.1 Max", "openai"],
-  ["gpt-5.1-codex-max-medium-fast", "Codex 5.1 Max Medium Fast", "openai"],
-  ["gpt-5.1-codex-max-high", "Codex 5.1 Max High", "openai"],
-  ["gpt-5.1-codex-max-high-fast", "Codex 5.1 Max High Fast", "openai"],
-  ["gpt-5.1-codex-max-xhigh", "Codex 5.1 Max Extra High", "openai"],
-  ["gpt-5.1-codex-max-xhigh-fast", "Codex 5.1 Max Extra High Fast", "openai"],
-  ["gpt-5.5-medium", "GPT-5.5 1M", "openai"],
-  ["claude-opus-4-7-thinking-high", "Opus 4.7 1M High Thinking", "anthropic"],
-  ["gpt-5.4-high", "GPT-5.4 1M High", "openai"],
-  ["gpt-5.4-high-fast", "GPT-5.4 High Fast", "openai"],
-  ["claude-4.6-opus-high-thinking-fast", "Opus 4.6 1M Thinking Fast", "anthropic"],
-  ["gpt-5.5-high", "GPT-5.5 1M High", "openai"],
-  ["gpt-5.5-extra-high", "GPT-5.5 1M Extra High", "openai"],
-  ["claude-4.6-sonnet-medium", "Sonnet 4.6 1M", "anthropic"],
-  ["claude-4.6-sonnet-medium-thinking", "Sonnet 4.6 1M Thinking", "anthropic"],
-  ["claude-opus-4-7-low", "Opus 4.7 1M Low", "anthropic"],
-  ["claude-opus-4-7-medium", "Opus 4.7 1M Medium", "anthropic"],
-  ["claude-opus-4-7-high", "Opus 4.7 1M High", "anthropic"],
-  ["claude-opus-4-7-xhigh", "Opus 4.7 1M", "anthropic"],
-  ["claude-opus-4-7-max", "Opus 4.7 1M Max", "anthropic"],
-  ["claude-opus-4-7-thinking-low", "Opus 4.7 1M Low Thinking", "anthropic"],
-  ["claude-opus-4-7-thinking-medium", "Opus 4.7 1M Medium Thinking", "anthropic"],
-  ["claude-opus-4-7-thinking-xhigh", "Opus 4.7 1M Thinking", "anthropic"],
-  ["claude-opus-4-7-thinking-max", "Opus 4.7 1M Max Thinking", "anthropic"],
-  ["gpt-5.4-low", "GPT-5.4 1M Low", "openai"],
-  ["gpt-5.4-medium", "GPT-5.4 1M", "openai"],
-  ["gpt-5.4-medium-fast", "GPT-5.4 Fast", "openai"],
-  ["gpt-5.4-xhigh", "GPT-5.4 1M Extra High", "openai"],
-  ["gpt-5.4-xhigh-fast", "GPT-5.4 Extra High Fast", "openai"],
-  ["claude-4.6-opus-high", "Opus 4.6 1M", "anthropic"],
-  ["claude-4.6-opus-max", "Opus 4.6 1M Max", "anthropic"],
-  ["claude-4.6-opus-high-thinking", "Opus 4.6 1M Thinking", "anthropic"],
-  ["claude-4.6-opus-max-thinking", "Opus 4.6 1M Max Thinking", "anthropic"],
-  ["claude-4.6-opus-max-thinking-fast", "Opus 4.6 1M Max Thinking Fast", "anthropic"],
-  ["claude-4.5-opus-high", "Opus 4.5", "anthropic"],
-  ["claude-4.5-opus-high-thinking", "Opus 4.5 Thinking", "anthropic"],
-  ["gpt-5.2-low", "GPT-5.2 Low", "openai"],
-  ["gpt-5.2-low-fast", "GPT-5.2 Low Fast", "openai"],
-  ["gpt-5.2-fast", "GPT-5.2 Fast", "openai"],
-  ["gpt-5.2-high", "GPT-5.2 High", "openai"],
-  ["gpt-5.2-high-fast", "GPT-5.2 High Fast", "openai"],
-  ["gpt-5.2-xhigh", "GPT-5.2 Extra High", "openai"],
-  ["gpt-5.2-xhigh-fast", "GPT-5.2 Extra High Fast", "openai"],
-  ["gemini-3.1-pro", "Gemini 3.1 Pro", "google"],
-  ["gpt-5.4-mini-none", "GPT-5.4 Mini None", "openai"],
-  ["gpt-5.4-mini-low", "GPT-5.4 Mini Low", "openai"],
-  ["gpt-5.4-mini-medium", "GPT-5.4 Mini", "openai"],
-  ["gpt-5.4-mini-high", "GPT-5.4 Mini High", "openai"],
-  ["gpt-5.4-mini-xhigh", "GPT-5.4 Mini Extra High", "openai"],
-  ["gpt-5.4-nano-none", "GPT-5.4 Nano None", "openai"],
-  ["gpt-5.4-nano-low", "GPT-5.4 Nano Low", "openai"],
-  ["gpt-5.4-nano-medium", "GPT-5.4 Nano", "openai"],
-  ["gpt-5.4-nano-high", "GPT-5.4 Nano High", "openai"],
-  ["gpt-5.4-nano-xhigh", "GPT-5.4 Nano Extra High", "openai"],
-  ["grok-4-20", "Grok 4.20", "xai"],
-  ["grok-4-20-thinking", "Grok 4.20 Thinking", "xai"],
-  ["claude-4.5-sonnet", "Sonnet 4.5", "anthropic"],
-  ["claude-4.5-sonnet-thinking", "Sonnet 4.5 Thinking", "anthropic"],
-  ["gpt-5.1-low", "GPT-5.1 Low", "openai"],
-  ["gpt-5.1", "GPT-5.1", "openai"],
-  ["gpt-5.1-high", "GPT-5.1 High", "openai"],
-  ["gemini-3-flash", "Gemini 3 Flash", "google"],
-  ["gpt-5.1-codex-mini-low", "Codex 5.1 Mini Low", "openai"],
+  ["gpt-5.2", "GPT-5.2", "openai"],
+  ["gpt-5.1-codex-max", "Codex 5.1 Max", "openai"],
   ["gpt-5.1-codex-mini", "Codex 5.1 Mini", "openai"],
-  ["gpt-5.1-codex-mini-high", "Codex 5.1 Mini High", "openai"],
-  ["claude-4-sonnet", "Sonnet 4", "anthropic"],
-  ["claude-4-sonnet-thinking", "Sonnet 4 Thinking", "anthropic"],
+  ["gpt-5.1", "GPT-5.1", "openai"],
   ["gpt-5-mini", "GPT-5 Mini", "openai"],
-  ["kimi-k2.5", "Kimi K2.5", "moonshotai"]
+  ["gemini-3.5-flash", "Gemini 3.5 Flash", "google"],
+  ["gemini-3.1-pro", "Gemini 3.1 Pro", "google"],
+  ["gemini-3-flash", "Gemini 3 Flash", "google"],
+  ["gemini-2.5-flash", "Gemini 2.5 Flash", "google"],
+  ["grok-4.3", "Grok 4.3", "xai"],
+  ["grok-build-0.1", "Grok Build 0.1", "xai"],
+  ["kimi-k2.7-code", "Kimi K2.7 Code", "moonshotai"],
+  ["kimi-k2.5", "Kimi K2.5", "moonshotai"],
+  ["glm-5.2", "GLM-5.2", "zai"]
 ];
 function cursorModelDescription(providerGroup) {
   switch (providerGroup) {
@@ -673,47 +616,26 @@ function cursorModelDescription(providerGroup) {
       return "xAI model through Cursor Agent";
     case "moonshotai":
       return "Moonshot model through Cursor Agent";
+    case "zai":
+      return "Z.ai model through Cursor Agent";
     default:
       return "Model through Cursor Agent";
   }
 }
-function cursorModelPricing(cliModel) {
-  switch (cliModel) {
-    case "auto":
-      return { inputPerMTok: 1.25, outputPerMTok: 6, cacheReadPerMTok: 0.25, cacheWritePerMTok: 0 };
-    case "composer-2-fast":
-      return { inputPerMTok: 1.5, outputPerMTok: 7.5, cacheReadPerMTok: 0.35, cacheWritePerMTok: 0 };
-    case "composer-2":
-      return { inputPerMTok: 0.5, outputPerMTok: 2.5, cacheReadPerMTok: 0.2, cacheWritePerMTok: 0 };
-    case "composer-1.5":
-      return { inputPerMTok: 3.5, outputPerMTok: 17.5, cacheReadPerMTok: 0.35, cacheWritePerMTok: 0 };
-    default:
-      return void 0;
-  }
-}
 var CURSOR_MODELS = CURSOR_MODEL_ROWS.map(
   ([cliModel, name, providerGroup]) => {
     const id = cursorCliModelToModelId(cliModel);
-    const pricing = cursorModelPricing(cliModel);
     return {
       id,
       name,
       description: cursorModelDescription(providerGroup),
       gatewayModelId: modelIdToGatewayModelId(id, "cursor") ?? id,
-      ...pricing ? { pricing } : {},
       cliModel,
       provider: "cursor",
       providerGroup
     };
   }
 );
-var THINKING_LEVELS = ["xhigh", "high", "medium", "low"];
-var THINKING_LEVEL_LABELS = {
-  low: "Low",
-  medium: "Medium",
-  high: "High",
-  xhigh: "xHigh"
-};
 function codexModel(id, name, description, reasoningEffort, gatewayModelId = id.replace(/(?::thinking-|-thinking-)(low|medium|high|xhigh)$/i, ""), providerGroup = id.includes("gpt-5.5") ? "gpt-5.5" : "gpt-5.4") {
   return {
     id,
@@ -726,23 +648,7 @@ function codexModel(id, name, description, reasoningEffort, gatewayModelId = id.
     ...reasoningEffort ? { reasoningEffort } : {}
   };
 }
-function codexThinkingModels(baseId, baseName, description) {
-  return THINKING_LEVELS.map(
-    (level) => codexModel(
-      `${baseId}-thinking-${level}`,
-      `${baseName} Thinking ${THINKING_LEVEL_LABELS[level]}`,
-      `${description} with ${THINKING_LEVEL_LABELS[level]} thinking`,
-      level,
-      baseId
-    )
-  );
-}
 var CODEX_MODELS = [
-  ...codexThinkingModels(
-    "openai/gpt-5.5",
-    "GPT-5.5",
-    "Latest frontier model for coding and agentic work"
-  ),
   codexModel(
     "openai/gpt-5.5",
     "GPT-5.5",
@@ -753,11 +659,6 @@ var CODEX_MODELS = [
     "GPT-5.5 Pro",
     "Highest-accuracy GPT-5.5 variant for difficult work"
   ),
-  ...codexThinkingModels(
-    "openai/gpt-5.4",
-    "GPT-5.4",
-    "Frontier coding model"
-  ),
   codexModel(
     "openai/gpt-5.4",
     "GPT-5.4",
@@ -851,9 +752,8 @@ var VISIBLE_HARNESS_IDS = [
   "claude_code",
   "codex",
   "opencode",
-  "pi",
-  "amp",
-  "cursor"
+  "cursor",
+  "pi"
 ];
 var DISABLED_HARNESS_IDS = /* @__PURE__ */ new Set([]);
 var dynamicModelCache = /* @__PURE__ */ new Map();
@@ -896,13 +796,11 @@ function isHarnessId(value) {
 function resolvePreferredHarnessModel({
   explicitHarness,
   explicitModel,
-  pinnedHarness,
-  pinnedModel,
   lastUsedHarness,
   selectedModels
 }) {
-  const harness = (isHarnessId(explicitHarness) ? explicitHarness : null) || (isHarnessId(pinnedHarness) ? pinnedHarness : null) || (isHarnessId(lastUsedHarness) ? lastUsedHarness : null) || "claude_code";
-  const rawModel = explicitModel || (pinnedHarness === harness ? pinnedModel : null) || selectedModels?.[harness] || getDefaultModel(harness);
+  const harness = (isHarnessId(explicitHarness) ? explicitHarness : null) || (isHarnessId(lastUsedHarness) ? lastUsedHarness : null) || "claude_code";
+  const rawModel = explicitModel || selectedModels?.[harness] || getDefaultModel(harness);
   const model = normalizeModelId(rawModel, harness) ?? rawModel;
   return { harness, model };
 }
@@ -942,11 +840,12 @@ function coerceAuthMethodForHarness(harnessId, authMethod) {
 function resolveHarnessModel(harnessId, modelId) {
   const selection = normalizeModelSelection(modelId ?? getDefaultModel(harnessId), harnessId);
   const normalizedModelId = selection?.modelId ?? getDefaultModel(harnessId);
-  const model = getModelById(normalizedModelId);
+  const localModel = HARNESSES[harnessId]?.models.find((m) => m.id === normalizedModelId);
+  const model = localModel ?? getModelById(normalizedModelId);
   const adaptedModel = harnessId === "claude_code" || harnessId === "codex" || harnessId === "cursor" ? modelIdToHarnessModel(normalizedModelId, harnessId) : null;
   return {
     modelId: normalizedModelId,
-    cliModel: model?.cliModel ?? adaptedModel,
+    cliModel: localModel?.cliModel ?? adaptedModel ?? model?.cliModel ?? null,
     reasoningEffort: selection?.reasoningEffort ?? model?.reasoningEffort ?? (harnessId === "codex" ? "xhigh" : void 0)
   };
 }

package/runtime/scripts/amalgm-mcp/agent-bundles/app-entries.js

@@ -0,0 +1,124 @@
+'use strict';
+
+/**
+ * Portable app bundle entries.
+ *
+ * An exported entry carries the app's registration record (commands, lifecycle
+ * flags) plus its packed file tree. Machine-bound state — cwd, port, appRef,
+ * public URL, pid/status — stays behind: install writes the files into a fresh
+ * local directory and registers through the normal supervisor path, which
+ * allocates a new port and DNS ref, runs the build, and starts the process.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const { getApp } = require('../apps/store');
+const { registerApp } = require('../apps/supervisor');
+const { packAppFiles, unpackAppFiles } = require('./app-files');
+
+function isObject(value) {
+  return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+
+function cleanString(value) {
+  return typeof value === 'string' ? value.trim() : '';
+}
+
+function slugify(value) {
+  return String(value || '')
+    .toLowerCase()
+    .replace(/[^a-z0-9._-]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 60) || 'app';
+}
+
+function exportAppEntry(appId, options = {}) {
+  const app = getApp(appId);
+  if (!app) throw new Error(`App not found: ${appId}`);
+  if (!cleanString(app.startCommand)) {
+    throw new Error(`App has no start command and cannot be shared: ${appId}`);
+  }
+  if (!app.cwd) throw new Error(`App has no working directory: ${appId}`);
+
+  const packed = packAppFiles(app.cwd, options);
+  if (packed.files.length === 0) {
+    throw new Error(`App directory has no shareable files: ${app.cwd}`);
+  }
+
+  return {
+    entry: {
+      sourceAppId: app.id,
+      app: {
+        name: app.name || 'App',
+        description: app.description || '',
+        buildCommand: app.buildCommand || null,
+        startCommand: app.startCommand,
+        autostart: app.autostart !== false,
+        keepAlive: app.keepAlive !== false,
+      },
+      files: packed.files,
+      totalBytes: packed.totalBytes,
+      skipped: packed.skipped,
+    },
+    skipped: packed.skipped,
+  };
+}
+
+function assertInstallableEntry(entry) {
+  if (!isObject(entry)) throw new Error('app entry must be an object');
+  if (!isObject(entry.app)) throw new Error('app entry is missing its app record');
+  if (!cleanString(entry.app.startCommand)) {
+    throw new Error('app entry must include a start command');
+  }
+  if (!Array.isArray(entry.files) || entry.files.length === 0) {
+    throw new Error('app entry must include files');
+  }
+}
+
+function allocateInstallDir(rootDir, name) {
+  const base = slugify(name);
+  fs.mkdirSync(rootDir, { recursive: true });
+  for (let index = 0; index < 1000; index += 1) {
+    const candidate = path.join(rootDir, index === 0 ? base : `${base}-${index + 1}`);
+    if (!fs.existsSync(candidate)) return candidate;
+  }
+  throw new Error(`Could not allocate an install directory for app: ${name}`);
+}
+
+/**
+ * Write the entry's files into a fresh directory and return the registration
+ * input for the app supervisor. Separated from installAppEntry so the file
+ * step can be exercised without spawning processes.
+ */
+function materializeAppEntry(entry, options = {}) {
+  assertInstallableEntry(entry);
+  if (!cleanString(options.rootDir)) throw new Error('rootDir is required');
+  const targetDir = allocateInstallDir(path.resolve(options.rootDir), entry.app.name);
+  unpackAppFiles(entry.files, targetDir);
+  return {
+    name: entry.app.name || 'App',
+    description: entry.app.description || '',
+    cwd: targetDir,
+    build_command: entry.app.buildCommand || null,
+    start_command: entry.app.startCommand,
+    autostart: entry.app.autostart !== false,
+    keep_alive: entry.app.keepAlive !== false,
+  };
+}
+
+/**
+ * Install a portable app entry: materialize files, then register — which
+ * builds, starts the process, and connects a fresh appRef to app DNS.
+ */
+async function installAppEntry(entry, options = {}) {
+  const register = options.register || registerApp;
+  const input = materializeAppEntry(entry, options);
+  return register(input);
+}
+
+module.exports = {
+  exportAppEntry,
+  installAppEntry,
+  materializeAppEntry,
+};

package/runtime/scripts/amalgm-mcp/agent-bundles/app-files.js

@@ -0,0 +1,160 @@
+'use strict';
+
+/**
+ * Pack and unpack an app's file tree for portable bundles.
+ *
+ * Files travel inline in the bundle JSON (utf8 or base64), so packing is
+ * conservative: dependency dirs, VCS state, env files, and build outputs are
+ * excluded — the recipient's install re-runs the app's build command — and
+ * per-file/total size caps keep the bundle under the storage object limit.
+ * Everything skipped is reported so the share UI can surface it.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const DEFAULT_MAX_FILE_BYTES = 2 * 1024 * 1024;
+const DEFAULT_MAX_TOTAL_BYTES = 12 * 1024 * 1024;
+
+const EXCLUDED_DIR_NAMES = new Set([
+  'node_modules',
+  '.git',
+  '.hg',
+  '.svn',
+  '.amalgm',
+  '.next',
+  '.nuxt',
+  '.turbo',
+  '.vercel',
+  '.cache',
+  '.parcel-cache',
+  '.venv',
+  'venv',
+  '__pycache__',
+  'dist',
+  'build',
+  'out',
+  'coverage',
+  'tmp',
+]);
+
+const EXCLUDED_FILE_NAMES = new Set([
+  '.DS_Store',
+  'Thumbs.db',
+  'npm-debug.log',
+  'yarn-error.log',
+]);
+
+function isExcludedFileName(name) {
+  if (EXCLUDED_FILE_NAMES.has(name)) return true;
+  // .env, .env.local, .env.production, … — never ship credentials.
+  if (name === '.env' || name.startsWith('.env.')) return true;
+  if (name.endsWith('.log')) return true;
+  return false;
+}
+
+function isBinary(buffer) {
+  const sample = buffer.subarray(0, 8192);
+  if (sample.includes(0)) return true;
+  return !buffer.equals(Buffer.from(buffer.toString('utf8'), 'utf8'));
+}
+
+function toPosixPath(relativePath) {
+  return relativePath.split(path.sep).join('/');
+}
+
+function packAppFiles(rootDir, options = {}) {
+  const root = path.resolve(rootDir);
+  if (!fs.existsSync(root) || !fs.statSync(root).isDirectory()) {
+    throw new Error(`App directory not found: ${root}`);
+  }
+
+  const maxFileBytes = options.maxFileBytes || DEFAULT_MAX_FILE_BYTES;
+  const maxTotalBytes = options.maxTotalBytes || DEFAULT_MAX_TOTAL_BYTES;
+  const files = [];
+  const skipped = [];
+  let totalBytes = 0;
+
+  function visit(dir) {
+    const entries = fs.readdirSync(dir, { withFileTypes: true })
+      .sort((left, right) => left.name.localeCompare(right.name));
+    for (const dirent of entries) {
+      const absolute = path.join(dir, dirent.name);
+      const relative = toPosixPath(path.relative(root, absolute));
+
+      if (dirent.isSymbolicLink()) {
+        skipped.push({ path: relative, reason: 'symlink' });
+        continue;
+      }
+      if (dirent.isDirectory()) {
+        if (EXCLUDED_DIR_NAMES.has(dirent.name)) {
+          skipped.push({ path: `${relative}/`, reason: 'excluded' });
+          continue;
+        }
+        visit(absolute);
+        continue;
+      }
+      if (!dirent.isFile()) continue;
+      if (isExcludedFileName(dirent.name)) {
+        skipped.push({ path: relative, reason: 'excluded' });
+        continue;
+      }
+
+      const stat = fs.statSync(absolute);
+      if (stat.size > maxFileBytes) {
+        skipped.push({ path: relative, reason: 'file-too-large', size: stat.size });
+        continue;
+      }
+      if (totalBytes + stat.size > maxTotalBytes) {
+        skipped.push({ path: relative, reason: 'bundle-size-limit', size: stat.size });
+        continue;
+      }
+
+      const buffer = fs.readFileSync(absolute);
+      const binary = isBinary(buffer);
+      totalBytes += stat.size;
+      files.push({
+        path: relative,
+        encoding: binary ? 'base64' : 'utf8',
+        content: binary ? buffer.toString('base64') : buffer.toString('utf8'),
+        size: stat.size,
+        ...(stat.mode & 0o111 ? { executable: true } : {}),
+      });
+    }
+  }
+
+  visit(root);
+  return { files, totalBytes, skipped };
+}
+
+function assertInsideTarget(targetRoot, relativePath) {
+  const normalized = String(relativePath || '');
+  const resolved = path.resolve(targetRoot, normalized);
+  if (resolved !== targetRoot && !resolved.startsWith(targetRoot + path.sep)) {
+    throw new Error(`App file escapes the install directory: ${normalized}`);
+  }
+  return resolved;
+}
+
+function unpackAppFiles(files, targetDir) {
+  const targetRoot = path.resolve(targetDir);
+  fs.mkdirSync(targetRoot, { recursive: true });
+
+  let written = 0;
+  for (const file of Array.isArray(files) ? files : []) {
+    if (!file || typeof file.path !== 'string' || typeof file.content !== 'string') continue;
+    const destination = assertInsideTarget(targetRoot, file.path);
+    fs.mkdirSync(path.dirname(destination), { recursive: true });
+    const buffer = file.encoding === 'base64'
+      ? Buffer.from(file.content, 'base64')
+      : Buffer.from(file.content, 'utf8');
+    fs.writeFileSync(destination, buffer, { mode: file.executable ? 0o755 : 0o644 });
+    written += 1;
+  }
+  return { written, targetDir: targetRoot };
+}
+
+module.exports = {
+  packAppFiles,
+  unpackAppFiles,
+};