amalgm 0.1.135 → 0.1.136

package/runtime/scripts/amalgm-mcp/lib/email-md.js

@@ -18,6 +18,7 @@
  */
 
 const embeds = require('./email-embeds');
+const { buildEmailRenderContext, normalizeEmailLink } = require('./email-deeplinks');
 
 const EMAIL_TOKENS = {
   font: {
@@ -86,7 +87,7 @@ function renderAmalgmCitation(label, _kindAndPath, description) {
 /**
  * Inline format: bold, italic, code, links, images, amalgm:// citations.
  */
-function inlineFormat(text) {
+function inlineFormat(text, renderContext = {}) {
   return (
     text
       // Media mid-sentence: images stay inline; video becomes a play link;
@@ -103,7 +104,8 @@ function inlineFormat(text) {
             return `<span style="color:${EMAIL_TOKENS.color.link}">${escapeHtmlText(alt || embeds.mediaNameOf(url) || 'file')}</span>`;
           }
           if (embeds.mediaKindOf(url) === 'video') {
-            return `<a href="${escapeHtmlAttr(url)}" target="_blank" style="color:${EMAIL_TOKENS.color.link};text-decoration:none">&#9654;&nbsp;${escapeHtmlText(alt || 'video')}</a>`;
+            const href = normalizeEmailLink(url, renderContext.appOrigin) || url;
+            return `<a href="${escapeHtmlAttr(href)}" target="_blank" style="color:${EMAIL_TOKENS.color.link};text-decoration:none">&#9654;&nbsp;${escapeHtmlText(alt || 'video')}</a>`;
           }
           return `<img src="${escapeHtmlAttr(url)}" alt="${escapeHtmlAttr(alt)}" style="max-width:100%;height:auto;border-radius:16px;margin:8px 0">`;
         },
@@ -111,7 +113,7 @@ function inlineFormat(text) {
       // Entity renders mid-sentence collapse to the compact tile.
       .replace(
         /\[([^\]]+)\]\((tile|full):([a-zA-Z]+):([^)\s]*)\)/g,
-        (_, label, mode, type) => embeds.renderEntityEmbed('tile', type, label),
+        (_, label, _mode, type, id) => embeds.renderEntityEmbed('tile', type, label, id, renderContext),
       )
       // amalgm:// citations (run before generic link regex so the optional
       // title attribute doesn't get swallowed into the href). Format:
@@ -125,7 +127,10 @@ function inlineFormat(text) {
       // Links: [text](url) — blue hyperlink per the rendering ruleset.
       .replace(
         /\[([^\]]+)\]\(([^)]+)\)/g,
-        `<a href="$2" style="color:${EMAIL_TOKENS.color.link};text-decoration:none" target="_blank">$1</a>`,
+        (_, label, url) => {
+          const href = normalizeEmailLink(url, renderContext.appOrigin) || url;
+          return `<a href="${escapeHtmlAttr(href)}" style="color:${EMAIL_TOKENS.color.link};text-decoration:none" target="_blank">${escapeHtmlText(label)}</a>`;
+        },
       )
       // Bold + italic: ***text***
       .replace(
@@ -145,7 +150,8 @@ function inlineFormat(text) {
   );
 }
 
-function markdownToEmailHtml(md) {
+function markdownToEmailHtml(md, renderContextInput = {}) {
+  const renderContext = buildEmailRenderContext(renderContextInput);
   let text = md.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
   // Normalize literal \n sequences (LLMs sometimes send \\n in JSON).
   text = text.replace(/\\n/g, '\n');
@@ -172,7 +178,7 @@ function markdownToEmailHtml(md) {
 
   function flushPara() {
     if (!paraLines.length) return;
-    const content = inlineFormat(paraLines.join('\n')).replace(/\n/g, '<br>');
+    const content = inlineFormat(paraLines.join('\n'), renderContext).replace(/\n/g, '<br>');
     out.push(`<p style="margin:12px 0;line-height:1.7;color:#ffffff">${content}</p>`);
     paraLines = [];
   }
@@ -180,7 +186,7 @@ function markdownToEmailHtml(md) {
     if (!listItems.length) return;
     const tag = listType;
     const items = listItems
-      .map((t) => `<li style="margin:4px 0;color:#ffffff">${inlineFormat(t)}</li>`)
+      .map((t) => `<li style="margin:4px 0;color:#ffffff">${inlineFormat(t, renderContext)}</li>`)
       .join('');
     out.push(
       `<${tag} style="margin:12px 0;padding-left:24px;color:#ffffff">${items}</${tag}>`,
@@ -207,7 +213,7 @@ function markdownToEmailHtml(md) {
     const hdr = headerCells
       .map(
         (c, i) =>
-          `<th style="${cellBase};${cellBorders(i === headerCells.length - 1, false)}background:${EMAIL_TOKENS.color.tableHeaderBg};font-weight:500;color:#ffffff">${inlineFormat(c)}</th>`,
+          `<th style="${cellBase};${cellBorders(i === headerCells.length - 1, false)}background:${EMAIL_TOKENS.color.tableHeaderBg};font-weight:500;color:#ffffff">${inlineFormat(c, renderContext)}</th>`,
       )
       .join('');
     const body = bodyRows
@@ -217,7 +223,7 @@ function markdownToEmailHtml(md) {
           r.cells
             .map(
               (c, i) =>
-                `<td style="${cellBase};${cellBorders(i === r.cells.length - 1, rowIdx === bodyRows.length - 1)}color:#ffffff">${inlineFormat(c)}</td>`,
+                `<td style="${cellBase};${cellBorders(i === r.cells.length - 1, rowIdx === bodyRows.length - 1)}color:#ffffff">${inlineFormat(c, renderContext)}</td>`,
             )
             .join('') +
           '</tr>',
@@ -230,7 +236,7 @@ function markdownToEmailHtml(md) {
   }
   function flushQuote() {
     if (!quoteLines.length) return;
-    const content = inlineFormat(quoteLines.join('\n')).replace(/\n/g, '<br>');
+    const content = inlineFormat(quoteLines.join('\n'), renderContext).replace(/\n/g, '<br>');
     out.push(
       `<blockquote style="margin:16px 0;padding:8px 16px;border-left:3px solid ${EMAIL_TOKENS.color.tableBorder};color:${EMAIL_TOKENS.color.textSecondary};font-style:italic">${content}</blockquote>`,
     );
@@ -275,14 +281,14 @@ function markdownToEmailHtml(md) {
     const mediaMatch = parseStandaloneMediaLine(trimmed);
     if (mediaMatch) {
       flushAll();
-      out.push(embeds.renderMediaEmbed(mediaMatch.alt, mediaMatch.src, mediaMatch.title || null));
+      out.push(embeds.renderMediaEmbed(mediaMatch.alt, mediaMatch.src, mediaMatch.title || null, renderContext));
       continue;
     }
     // Standalone entity render → tile card or expanded card.
     const entityMatch = trimmed.match(/^\[([^\]]+)\]\((tile|full):([a-zA-Z]+):([^)\s]*)\)$/);
     if (entityMatch) {
       flushAll();
-      out.push(embeds.renderEntityEmbed(entityMatch[2], entityMatch[3], entityMatch[1]));
+      out.push(embeds.renderEntityEmbed(entityMatch[2], entityMatch[3], entityMatch[1], entityMatch[4], renderContext));
       continue;
     }
     const headingMatch = trimmed.match(/^(#{1,6})\s+(.+)$/);
@@ -291,7 +297,7 @@ function markdownToEmailHtml(md) {
       const level = headingMatch[1].length;
       const size = EMAIL_TOKENS.type.headings[level];
       out.push(
-        `<h${level} style="margin:20px 0 8px;font-size:${size}px;font-weight:650;color:#ffffff;line-height:1.35">${inlineFormat(headingMatch[2])}</h${level}>`,
+        `<h${level} style="margin:20px 0 8px;font-size:${size}px;font-weight:650;color:#ffffff;line-height:1.35">${inlineFormat(headingMatch[2], renderContext)}</h${level}>`,
       );
       continue;
     }
@@ -349,10 +355,11 @@ function markdownToEmailHtml(md) {
 /**
  * Wrap the converted markdown body in a full notification email shell.
  */
-function formatNotificationEmail(message, link) {
-  const htmlMessage = markdownToEmailHtml(message);
-  const linkHtml = link
-    ? `<p style="margin:24px 0 0"><a href="${link}" style="color:${EMAIL_TOKENS.color.link};text-decoration:none;font-size:14px">View details &rarr;</a></p>`
+function formatNotificationEmail(message, link, renderContextInput = {}) {
+  const renderContext = buildEmailRenderContext({ ...renderContextInput, link });
+  const htmlMessage = markdownToEmailHtml(message, renderContext);
+  const linkHtml = renderContext.detailsUrl
+    ? `<p style="margin:24px 0 0"><a href="${escapeHtmlAttr(renderContext.detailsUrl)}" style="color:${EMAIL_TOKENS.color.link};text-decoration:none;font-size:14px">View details &rarr;</a></p>`
     : '';
   return `<!DOCTYPE html>
 <html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"></head>

package/runtime/scripts/amalgm-mcp/notify/index.js

@@ -32,7 +32,7 @@ async function notifyUserViaProxy({ subject: customSubject, message, link, sessi
   // Local media embeds become attachments riding inside the email: images
   // inline via cid:, videos as regular attachments with a poster card.
   const media = prepareEmailMedia(message);
-  const html = formatNotificationEmail(media.message, link || null);
+  const html = formatNotificationEmail(media.message, link || null, { sessionId });
   const attachments = [
     ...media.attachments,
     ...prepareEmailIconAttachments(html, media.attachments),
@@ -92,7 +92,11 @@ module.exports = [
           enum: ['info', 'warning', 'error', 'success'],
           description: 'Severity level. Defaults to info.',
         },
-        link: { type: 'string', description: 'Optional URL for details.' },
+        link: {
+          type: 'string',
+          description:
+            'Optional URL for details. This also becomes the fallback click target for local email embeds when a more specific deep link is not available.',
+        },
       },
       required: ['message'],
     },

package/runtime/scripts/amalgm-mcp/state/snapshot.js

@@ -13,10 +13,10 @@ function normalizeResources(resources) {
 function readResource(resource, cache) {
   switch (resource) {
     case 'automations':
-      cache.automations ||= require('../automations/store').listAutomations();
+      cache.automations ||= require('../automations/store').listPublicAutomations();
       return cache.automations;
     case 'triggers':
-      cache.triggers ||= require('../automations/store').listTriggers();
+      cache.triggers ||= require('../automations/store').listPublicTriggers();
       return cache.triggers;
     case 'automation_runs':
       return require('../automations/store').listAutomationRuns({ limit: 300 });
@@ -31,7 +31,7 @@ function readResource(resource, cache) {
     case 'event_triggers':
       return require('../events/store').loadEventTriggers().triggers;
     case 'workflows':
-      cache.workflows ||= require('../automations/store').listWorkflows();
+      cache.workflows ||= require('../automations/store').listPublicWorkflows();
       return cache.workflows;
     case 'agents': {
       const { agentWithConfig } = require('../agent-config/store');

package/runtime/scripts/amalgm-mcp/tests/agent-bundles.test.js

@@ -13,7 +13,7 @@ const { createAgent, resolveAgent } = require('../agents/store');
 const { upsertAgentConfig, getAgentConfig } = require('../agent-config/store');
 const { syncInstalledSkills } = require('../skills/store');
 const { defaultToolboxService } = require('../toolbox/service');
-const { createAgentBundle, installAgentBundle } = require('../agent-bundles/bundles');
+const { createAgentBundle, installBundle } = require('../agent-bundles/bundles');
 
 test('agent bundle includes recursive subagents, selected user tools, system tools, and warnings', () => {
   defaultToolboxService.registerTool({
@@ -145,7 +145,7 @@ test('agent bundle includes every tool action when the loadout references a sing
   assert.equal(preview.tools.some((tool) => tool.id === 'browser' && tool.actionCount === browserActions.length), true);
 });
 
-test('installing an agent bundle creates local copies and rewrites subagent refs', () => {
+test('installing an agent bundle creates local copies and rewrites subagent refs', async () => {
   const source = createAgent({
     id: 'install-source-root',
     name: 'Install Source Root',
@@ -175,7 +175,7 @@ test('installing an agent bundle creates local copies and rewrites subagent refs
   });
 
   const { bundle } = createAgentBundle(source.id, { bundleId: 'agent-bundle-install-test' });
-  const result = installAgentBundle(bundle);
+  const result = await installBundle(bundle);
 
   assert.equal(result.ok, true);
   assert.equal(result.installedAgents.length, 2);
@@ -189,9 +189,9 @@ test('installing an agent bundle creates local copies and rewrites subagent refs
   assert.deepEqual(bundle.headIds, ['agent:install-source-root']);
 });
 
-test('installing an agent bundle rejects missing shared subagents', () => {
-  assert.throws(
-    () => installAgentBundle({
+test('installing an agent bundle rejects missing shared subagents', async () => {
+  await assert.rejects(
+    () => installBundle({
       kind: 'amalgm.agent.bundle',
       schemaVersion: 1,
       rootAgentId: 'missing-child-root',
@@ -219,8 +219,8 @@ test('installing an agent bundle rejects missing shared subagents', () => {
   );
 });
 
-test('installing an agent bundle regenerates stale flat graph fields from canonical agent arrays', () => {
-  const result = installAgentBundle({
+test('installing an agent bundle regenerates stale flat graph fields from canonical agent arrays', async () => {
+  const result = await installBundle({
     kind: 'amalgm.agent.bundle',
     schemaVersion: 1,
     rootAgentId: 'graph-root',

package/runtime/scripts/amalgm-mcp/tests/bundle-entries.test.js

@@ -0,0 +1,288 @@
+'use strict';
+
+process.env.AMALGM_DIR = require('node:fs').mkdtempSync(
+  require('node:path').join(require('node:os').tmpdir(), 'amalgm-bundle-entries-'),
+);
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const test = require('node:test');
+
+const { createAutomation, getAutomation, listAutomations } = require('../automations/store');
+const { loadApps, saveApps } = require('../apps/store');
+const { exportAutomationEntry, installAutomationEntry } = require('../agent-bundles/automation-entries');
+const { exportAppEntry, materializeAppEntry } = require('../agent-bundles/app-entries');
+const { packAppFiles, unpackAppFiles } = require('../agent-bundles/app-files');
+const { createBundle, installBundle, validateBundle } = require('../agent-bundles/bundles');
+
+function makeTempDir(prefix) {
+  return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+}
+
+function writeSampleApp(dir) {
+  fs.mkdirSync(path.join(dir, 'src'), { recursive: true });
+  fs.mkdirSync(path.join(dir, 'node_modules', 'left-pad'), { recursive: true });
+  fs.mkdirSync(path.join(dir, '.git'), { recursive: true });
+  fs.writeFileSync(path.join(dir, 'package.json'), JSON.stringify({ name: 'sample-app' }));
+  fs.writeFileSync(path.join(dir, 'src', 'index.js'), 'console.log("hi");\n');
+  fs.writeFileSync(path.join(dir, '.env'), 'SECRET=super-secret\n');
+  fs.writeFileSync(path.join(dir, 'node_modules', 'left-pad', 'index.js'), 'module.exports = () => {};\n');
+  fs.writeFileSync(path.join(dir, '.git', 'HEAD'), 'ref: refs/heads/main\n');
+  fs.writeFileSync(path.join(dir, 'logo.bin'), Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x00, 0x01, 0x02]));
+  fs.writeFileSync(path.join(dir, 'run.sh'), '#!/bin/sh\necho run\n', { mode: 0o755 });
+}
+
+function registerSampleApp(cwd) {
+  const data = loadApps();
+  const app = {
+    id: 'app-sample-test',
+    kind: 'app',
+    name: 'Sample App',
+    description: 'A sample app',
+    cwd,
+    port: 43210,
+    buildCommand: 'npm run build',
+    startCommand: 'npm run start -- --port {port}',
+    appRef: 'sampleref0001',
+    publicUrl: 'https://sampleref0001.apps.amalgm.ai/',
+    dnsConnected: true,
+    autostart: true,
+    keepAlive: true,
+    desiredState: 'running',
+    status: 'running',
+    createdAt: new Date().toISOString(),
+    updatedAt: new Date().toISOString(),
+  };
+  data.apps = data.apps.filter((item) => item.id !== app.id);
+  data.apps.push(app);
+  saveApps(data);
+  return app;
+}
+
+const SCHEDULED_WORKFLOW = `export default workflow({
+  trigger: event("scheduled.run"),
+  cells: [
+    code("start", async () => ({ ok: true }))
+  ]
+})`;
+
+test('automation entry export strips machine state and install recreates an active automation', () => {
+  const source = createAutomation({
+    name: 'Nightly Digest',
+    description: 'Summarize the day',
+    enabled: false,
+    triggers: [
+      { kind: 'scheduled', name: 'Midnight', schedule: { kind: 'cron', expr: '0 0 * * *', tz: 'UTC' } },
+      { kind: 'event', name: 'Manual hook', source: 'github', event: 'push' },
+    ],
+    workflowText: SCHEDULED_WORKFLOW,
+  });
+
+  const exported = exportAutomationEntry(source.id);
+  const entry = exported.entry;
+
+  assert.equal(entry.sourceAutomationId, source.id);
+  assert.equal(entry.automation.name, 'Nightly Digest');
+  assert.equal(entry.triggers.length, 2);
+  const scheduled = entry.triggers.find((trigger) => trigger.kind === 'scheduled');
+  const eventTrigger = entry.triggers.find((trigger) => trigger.kind === 'event');
+  assert.deepEqual(scheduled.schedule, { kind: 'cron', expr: '0 0 * * *', tz: 'UTC' });
+  assert.equal(eventTrigger.source, 'github');
+  assert.equal('secret' in eventTrigger, false);
+  assert.equal('webhookUrl' in eventTrigger, false);
+  assert.equal('id' in scheduled, false);
+  assert.equal(entry.workflows.length, 1);
+  assert.equal(entry.workflows[0].workflowText, SCHEDULED_WORKFLOW);
+  assert.equal('projectPath' in entry.workflows[0], false);
+
+  const installed = installAutomationEntry(entry);
+  assert.notEqual(installed.id, source.id);
+  assert.equal(installed.enabled, true);
+  assert.equal(installed.name, 'Nightly Digest (imported)');
+  assert.equal(installed.triggers.length, 2);
+
+  const installedEvent = installed.triggers.find((trigger) => trigger.kind === 'event');
+  const sourceEvent = getAutomation(source.id).triggers.find((trigger) => trigger.kind === 'event');
+  assert.equal(Boolean(installedEvent.secret), true);
+  assert.notEqual(installedEvent.secret, sourceEvent.secret);
+
+  const installedScheduled = installed.triggers.find((trigger) => trigger.kind === 'scheduled');
+  assert.equal(Boolean(installedScheduled.nextRunAt), true);
+});
+
+test('automation entry install rejects entries without workflow text', () => {
+  assert.throws(
+    () => installAutomationEntry({
+      automation: { name: 'Broken' },
+      triggers: [{ kind: 'scheduled', schedule: { kind: 'cron', expr: '0 0 * * *', tz: 'UTC' } }],
+      workflows: [{ name: 'Empty' }],
+    }),
+    /workflowText/,
+  );
+});
+
+test('app file packing excludes dependencies, env files, and vcs state', () => {
+  const dir = makeTempDir('bundle-app-src-');
+  writeSampleApp(dir);
+
+  const packed = packAppFiles(dir);
+  const paths = packed.files.map((file) => file.path);
+
+  assert.deepEqual(paths, ['logo.bin', 'package.json', 'run.sh', 'src/index.js']);
+  assert.equal(packed.files.find((file) => file.path === 'logo.bin').encoding, 'base64');
+  assert.equal(packed.files.find((file) => file.path === 'run.sh').executable, true);
+  assert.equal(packed.skipped.some((item) => item.path === '.env'), true);
+  assert.equal(packed.skipped.some((item) => item.path === 'node_modules/'), true);
+  assert.equal(packed.skipped.some((item) => item.path === '.git/'), true);
+
+  const target = makeTempDir('bundle-app-dst-');
+  const result = unpackAppFiles(packed.files, target);
+  assert.equal(result.written, 4);
+  assert.equal(fs.readFileSync(path.join(target, 'src', 'index.js'), 'utf8'), 'console.log("hi");\n');
+  assert.equal(fs.existsSync(path.join(target, '.env')), false);
+  assert.equal(Boolean(fs.statSync(path.join(target, 'run.sh')).mode & 0o100), true);
+  assert.deepEqual(
+    fs.readFileSync(path.join(target, 'logo.bin')),
+    Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x00, 0x01, 0x02]),
+  );
+});
+
+test('unpacking rejects paths that escape the install directory', () => {
+  const target = makeTempDir('bundle-app-escape-');
+  assert.throws(
+    () => unpackAppFiles([{ path: '../evil.txt', encoding: 'utf8', content: 'nope' }], target),
+    /escapes the install directory/,
+  );
+});
+
+test('app entry export carries the portable record and install materializes a runnable copy', async () => {
+  const dir = makeTempDir('bundle-app-reg-');
+  writeSampleApp(dir);
+  const app = registerSampleApp(dir);
+
+  const { entry } = exportAppEntry(app.id);
+  assert.equal(entry.app.name, 'Sample App');
+  assert.equal(entry.app.startCommand, 'npm run start -- --port {port}');
+  assert.equal(entry.app.buildCommand, 'npm run build');
+  assert.equal('cwd' in entry.app, false);
+  assert.equal('port' in entry.app, false);
+  assert.equal('appRef' in entry.app, false);
+  assert.equal(entry.files.length, 4);
+
+  const rootDir = makeTempDir('bundle-app-install-root-');
+  const registerInput = materializeAppEntry(entry, { rootDir });
+  assert.equal(registerInput.start_command, entry.app.startCommand);
+  assert.equal(registerInput.build_command, entry.app.buildCommand);
+  assert.equal(registerInput.cwd.startsWith(rootDir), true);
+  assert.equal(fs.readFileSync(path.join(registerInput.cwd, 'package.json'), 'utf8'), JSON.stringify({ name: 'sample-app' }));
+
+  // A second install of the same entry gets its own directory.
+  const secondInput = materializeAppEntry(entry, { rootDir });
+  assert.notEqual(secondInput.cwd, registerInput.cwd);
+});
+
+test('mixed bundle carries automations and apps with heads and installs everything', async () => {
+  const dir = makeTempDir('bundle-mixed-app-');
+  writeSampleApp(dir);
+  const app = registerSampleApp(dir);
+  const automation = createAutomation({
+    name: 'Mixed Bundle Automation',
+    triggers: [{ kind: 'scheduled', schedule: { kind: 'cron', expr: '30 6 * * *', tz: 'UTC' } }],
+    workflowText: SCHEDULED_WORKFLOW,
+  });
+
+  const { bundle, preview } = createBundle({
+    automationIds: [automation.id],
+    appIds: [app.id],
+  }, { bundleId: 'bundle-mixed-test' });
+
+  assert.equal(bundle.kind, 'amalgm.bundle');
+  assert.equal(bundle.summary.automations, 1);
+  assert.equal(bundle.summary.apps, 1);
+  assert.deepEqual(bundle.headIds, [
+    `automation:${automation.id}`,
+    `app:${app.id}`,
+  ]);
+  const appElement = bundle.elements.find((element) => element.type === 'app');
+  assert.equal(appElement.label, 'Sample App');
+  // Graph elements carry a manifest, not file contents.
+  assert.equal('content' in appElement.data.files[0], false);
+  assert.equal(preview.automations.length, 1);
+  assert.equal(preview.apps.length, 1);
+  assert.equal(preview.apps[0].files, 4);
+
+  // Round-trip through JSON like the storage path does.
+  const revived = JSON.parse(JSON.stringify(bundle));
+  validateBundle(revived);
+
+  const registered = [];
+  const rootDir = makeTempDir('bundle-mixed-install-');
+  const before = listAutomations().length;
+  const result = await installBundle(revived, {
+    appsRootDir: rootDir,
+    registerApp: async (input) => {
+      registered.push(input);
+      return { id: 'app-installed', ...input, status: 'running' };
+    },
+  });
+
+  assert.equal(result.ok, true);
+  assert.equal(result.installedAutomations.length, 1);
+  assert.equal(result.installedApps.length, 1);
+  assert.equal(listAutomations().length, before + 1);
+  assert.equal(registered.length, 1);
+  assert.equal(fs.existsSync(path.join(registered[0].cwd, 'src', 'index.js')), true);
+});
+
+test('legacy agent-only bundles still validate and empty bundles are rejected', () => {
+  assert.throws(
+    () => validateBundle({ kind: 'amalgm.bundle', schemaVersion: 1 }),
+    /at least one agent, automation, or app/,
+  );
+  assert.throws(
+    () => validateBundle({ kind: 'something.else', schemaVersion: 1 }),
+    /Unsupported bundle kind/,
+  );
+});
+
+test('rest handlers round-trip a share: preview exports a bundle and install recreates it', async () => {
+  const { handlePreview, handleInstall } = require('../agent-bundles/rest');
+  const automation = createAutomation({
+    name: 'REST Round Trip',
+    triggers: [{ kind: 'scheduled', schedule: { kind: 'cron', expr: '15 3 * * *', tz: 'UTC' } }],
+    workflowText: SCHEDULED_WORKFLOW,
+  });
+
+  function capture() {
+    const result = {};
+    return {
+      result,
+      sendJson: (status, payload) => {
+        result.status = status;
+        result.payload = payload;
+      },
+    };
+  }
+
+  const preview = capture();
+  await handlePreview({ automation_ids: [automation.id] }, preview.sendJson);
+  assert.equal(preview.result.status, 200);
+  assert.equal(preview.result.payload.ok, true);
+  assert.equal(preview.result.payload.bundle.kind, 'amalgm.bundle');
+
+  // Simulate the storage download: what the recipient installs is the JSON round-trip.
+  const downloaded = JSON.parse(JSON.stringify(preview.result.payload.bundle));
+
+  const install = capture();
+  await handleInstall({ bundle: downloaded }, install.sendJson);
+  assert.equal(install.result.status, 200);
+  assert.equal(install.result.payload.ok, true);
+  assert.equal(install.result.payload.installedAutomations.length, 1);
+  assert.notEqual(install.result.payload.installedAutomations[0].id, automation.id);
+
+  const empty = capture();
+  await handlePreview({}, empty.sendJson);
+  assert.equal(empty.result.status, 400);
+});

package/runtime/scripts/amalgm-mcp/tests/desktop-release-automation-seed.test.js

@@ -11,7 +11,14 @@ process.env.AMALGM_DIR = path.join(tempRoot, '.amalgm');
 process.env.AMALGM_EVENTS_PUBLIC_URL = 'https://desktop-release.example/events';
 
 const { closeLocalDb } = require('../state/db');
-const { listAutomations, listTriggers } = require('../automations/store');
+const { buildSnapshot } = require('../state/snapshot');
+const {
+  listAutomations,
+  listPublicAutomations,
+  listPublicTriggers,
+  listPublicWorkflows,
+  listTriggers,
+} = require('../automations/store');
 
 test.after(() => {
   closeLocalDb();
@@ -67,3 +74,32 @@ test('automations store seeds the internal release webhook automation', () => {
   assert.equal(prTrigger.webhookUrl, 'https://desktop-release.example/events');
   assert.match(prTrigger.secret, /^[a-f0-9]{32}$/);
 });
+
+test('public automation surfaces hide internal release automations', () => {
+  assert.equal(
+    listPublicAutomations().some((item) => item.id === 'internal-amalgm-desktop-release'),
+    false,
+  );
+  assert.equal(
+    listPublicTriggers().some((item) => item.id === 'internal-amalgm-desktop-release-github-push'),
+    false,
+  );
+  assert.equal(
+    listPublicWorkflows().some((item) => item.id === 'internal-amalgm-desktop-release-workflow'),
+    false,
+  );
+
+  const snapshot = buildSnapshot('automations,triggers,workflows');
+  assert.equal(
+    snapshot.resources.automations.some((item) => item.id === 'internal-amalgm-desktop-release'),
+    false,
+  );
+  assert.equal(
+    snapshot.resources.triggers.some((item) => item.id === 'internal-amalgm-desktop-release-github-push'),
+    false,
+  );
+  assert.equal(
+    snapshot.resources.workflows.some((item) => item.id === 'internal-amalgm-desktop-release-workflow'),
+    false,
+  );
+});

package/runtime/scripts/amalgm-mcp/tests/desktop-release-runner.test.js

@@ -204,6 +204,7 @@ test('desktop release runner uses electron-builder compatible signing identity n
   assert.equal(env.AMALGM_DESKTOP_RELEASE_UPLOAD_URL, 'https://amalgm-desktop-releases.fly.dev/');
   assert.equal(env.AMALGM_DESKTOP_RELEASE_FLY_APP, 'amalgm-desktop-releases');
   assert.equal(env.AMALGM_DESKTOP_RELEASE_FLY_ROOT, '/data');
+  assert.equal(env.AMALGM_DESKTOP_THIN, '1');
 });
 
 test('desktop release runner omits blank certificate file secrets', () => {
@@ -342,3 +343,24 @@ test('desktop release runner requires all updater artifacts', () => {
     fs.rmSync(tempRoot, { recursive: true, force: true });
   }
 });
+
+test('desktop release runner accepts thin updater artifacts', () => {
+  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-desktop-release-thin-artifacts-test-'));
+  const version = '0.1.124000001-preview.1';
+  const files = [
+    `amalgm-preview-thin-${version}-arm64.dmg`,
+    `amalgm-preview-thin-${version}-arm64.dmg.blockmap`,
+    `amalgm-preview-thin-${version}-arm64.zip`,
+    `amalgm-preview-thin-${version}-arm64.zip.blockmap`,
+    'preview-mac.yml',
+  ];
+
+  try {
+    for (const file of files) fs.writeFileSync(path.join(tempRoot, file), '');
+    const artifacts = desktopReleaseArtifactPaths(tempRoot, 'preview', version)
+      .map((filePath) => path.basename(filePath));
+    assert.deepEqual(artifacts, files);
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true });
+  }
+});