amalgm 0.1.144 → 0.1.145

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.144",
+  "version": "0.1.145",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,

package/runtime/scripts/amalgm-mcp/apps/supervisor.js

@@ -7,8 +7,8 @@
 
 const fs = require('fs');
 const path = require('path');
-const { spawn, spawnSync } = require('child_process');
-const { DEFAULT_CWD } = require('../config');
+const { spawn } = require('child_process');
+const { APPS_DIR, DEFAULT_CWD } = require('../config');
 const { runtimePort } = require('../../../lib/runtime-manifest');
 const { syncAppRoutesToGateway } = require('./advertise');
 const {
@@ -25,6 +25,77 @@ const running = new Map();
 const stopping = new Set();
 const restartTimers = new Map();
 
+// Crash containment: an app that keeps dying must not keep the supervisor busy
+// forever. Restarts back off exponentially, and after maxCrashes unexpected
+// exits inside windowMs the app is parked as 'degraded' until someone starts
+// it explicitly (or the runtime reboots). Apps are allowed to fail; they are
+// not allowed to consume the runtime.
+const APP_RESTART_POLICY = {
+  initialDelayMs: 2000,
+  maxDelayMs: 60_000,
+  maxCrashes: 5,
+  windowMs: 5 * 60_000,
+};
+const crashHistory = new Map();
+
+function recordCrash(appId) {
+  const now = Date.now();
+  const recent = (crashHistory.get(appId) || [])
+    .filter((time) => now - time <= APP_RESTART_POLICY.windowMs);
+  recent.push(now);
+  crashHistory.set(appId, recent);
+  return recent.length;
+}
+
+function restartDelayMs(crashCount) {
+  const exponent = Math.max(0, crashCount - 1);
+  return Math.min(APP_RESTART_POLICY.initialDelayMs * 2 ** exponent, APP_RESTART_POLICY.maxDelayMs);
+}
+
+// Per-app log files: app output belongs to the app, not to the runtime's main
+// log. The main log only carries lifecycle events (started/exited/degraded).
+const appLogStreams = new Map();
+
+function appLogPath(appId) {
+  return path.join(APPS_DIR, 'logs', `${appId}.log`);
+}
+
+function appLogStream(appId) {
+  let stream = appLogStreams.get(appId);
+  if (stream && !stream.destroyed) return stream;
+  const file = appLogPath(appId);
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    try {
+      const stats = fs.statSync(file);
+      if (stats.size > 5 * 1024 * 1024) fs.renameSync(file, `${file}.old`);
+    } catch {}
+    stream = fs.createWriteStream(file, { flags: 'a' });
+    stream.on('error', () => {});
+    appLogStreams.set(appId, stream);
+    return stream;
+  } catch {
+    return null;
+  }
+}
+
+function appendAppLog(appId, source, chunk) {
+  const stream = appLogStream(appId);
+  if (!stream) return;
+  const stamp = new Date().toISOString();
+  const text = chunk.toString();
+  const suffix = text.endsWith('\n') ? '' : '\n';
+  stream.write(`${stamp} [${source}] ${text}${suffix}`);
+}
+
+function closeAppLog(appId) {
+  const stream = appLogStreams.get(appId);
+  appLogStreams.delete(appId);
+  if (stream) {
+    try { stream.end(); } catch {}
+  }
+}
+
 const APP_ENV_ALLOWLIST = [
   'AMALGM_BIND_HOST',
   'AMALGM_DIR',
@@ -92,29 +163,51 @@ function parsePids(output) {
   return Array.from(pids);
 }
 
-function listeningPidsForPort(port) {
+// Async replacement for spawnSync: these probes (lsof/ps) can take seconds on
+// a loaded machine, and a blocked event loop here stalls /healthz for the whole
+// runtime — which is what turns one crash-looping app into a runtime restart.
+function runProbe(command, args, timeoutMs = 5000) {
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = spawn(command, args, { stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true });
+    } catch {
+      resolve({ status: -1, stdout: '' });
+      return;
+    }
+    let stdout = '';
+    const timer = setTimeout(() => {
+      try { child.kill('SIGKILL'); } catch {}
+    }, timeoutMs);
+    child.stdout?.on('data', (chunk) => { stdout += chunk.toString(); });
+    child.on('error', () => {
+      clearTimeout(timer);
+      resolve({ status: -1, stdout: '' });
+    });
+    child.on('close', (code) => {
+      clearTimeout(timer);
+      resolve({ status: code, stdout });
+    });
+  });
+}
+
+async function listeningPidsForPort(port) {
   const parsed = Number(port);
   if (!Number.isInteger(parsed) || parsed <= 0 || parsed > 65535) return [];
-  const result = spawnSync('lsof', ['-nP', `-iTCP:${parsed}`, '-sTCP:LISTEN', '-t'], {
-    encoding: 'utf8',
-  });
-  if (result.error || !result.stdout) return [];
+  const result = await runProbe('lsof', ['-nP', `-iTCP:${parsed}`, '-sTCP:LISTEN', '-t']);
+  if (!result.stdout) return [];
   return parsePids(result.stdout);
 }
 
-function pidCommand(pid) {
-  const result = spawnSync('ps', ['eww', '-p', String(pid), '-o', 'command='], {
-    encoding: 'utf8',
-  });
-  if (result.error || result.status !== 0) return '';
+async function pidCommand(pid) {
+  const result = await runProbe('ps', ['eww', '-p', String(pid), '-o', 'command=']);
+  if (result.status !== 0) return '';
   return String(result.stdout || '');
 }
 
-function pidCwd(pid) {
-  const result = spawnSync('lsof', ['-a', '-p', String(pid), '-d', 'cwd', '-Fn'], {
-    encoding: 'utf8',
-  });
-  if (result.error || result.status !== 0) return '';
+async function pidCwd(pid) {
+  const result = await runProbe('lsof', ['-a', '-p', String(pid), '-d', 'cwd', '-Fn']);
+  if (result.status !== 0) return '';
   const line = String(result.stdout || '').split('\n').find((item) => item.startsWith('n'));
   return line ? line.slice(1) : '';
 }
@@ -125,25 +218,25 @@ function isPathInside(parent, maybeChild) {
   return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
 }
 
-function isAppOwnedPid(app, pid) {
+async function isAppOwnedPid(app, pid) {
   if (app.pid === pid) return true;
-  const command = pidCommand(pid);
+  const command = await pidCommand(pid);
   if (command.includes(`AMALGM_APP_ID=${app.id}`) || command.includes(`AMALGM_APP_ID='${app.id}'`)) return true;
   if (app.appRef && (command.includes(`AMALGM_APP_REF=${app.appRef}`) || command.includes(`AMALGM_APP_REF='${app.appRef}'`))) {
     return true;
   }
   if (app.cwd && command.includes(path.resolve(app.cwd))) return true;
-  return isPathInside(app.cwd, pidCwd(pid));
+  return isPathInside(app.cwd, await pidCwd(pid));
 }
 
 async function killOwnedPortListeners(app, options = {}) {
-  const pids = listeningPidsForPort(app.port).filter((pid) => pid !== process.pid);
+  const pids = (await listeningPidsForPort(app.port)).filter((pid) => pid !== process.pid);
   if (pids.length === 0) return [];
 
   const owned = [];
   const unknown = [];
   for (const pid of pids) {
-    (isAppOwnedPid(app, pid) ? owned : unknown).push(pid);
+    ((await isAppOwnedPid(app, pid)) ? owned : unknown).push(pid);
   }
 
   if (unknown.length > 0 && options.failOnUnknown !== false) {
@@ -245,16 +338,18 @@ function startAppProcess(app) {
 
   running.set(app.id, child);
   child.unref();
+  console.log(`[App:${app.id}] started pid=${child.pid} (output: ${appLogPath(app.id)})`);
   child.stdout?.on('data', (chunk) => {
-    console.log(`[App:${app.id}] ${chunk.toString().trim()}`);
+    appendAppLog(app.id, 'stdout', chunk);
   });
   child.stderr?.on('data', (chunk) => {
-    console.error(`[App:${app.id}] ${chunk.toString().trim()}`);
+    appendAppLog(app.id, 'stderr', chunk);
   });
   child.on('exit', (code) => {
     const activeChild = running.get(app.id);
     if (activeChild && activeChild !== child) return;
     running.delete(app.id);
+    closeAppLog(app.id);
     const wasStopping = stopping.has(app.id);
     stopping.delete(app.id);
     if (wasStopping) return;
@@ -263,6 +358,20 @@ function startAppProcess(app) {
     if (!current) return;
 
     if (current.desiredState === 'running' && current.keepAlive !== false) {
+      const crashes = recordCrash(app.id);
+      if (crashes >= APP_RESTART_POLICY.maxCrashes) {
+        const windowMinutes = Math.round(APP_RESTART_POLICY.windowMs / 60_000);
+        console.error(`[App:${app.id}] degraded: crashed ${crashes} times in ${windowMinutes}m; automatic restarts paused (logs: ${appLogPath(app.id)})`);
+        updateAppMeta(app.id, {
+          status: 'degraded',
+          pid: null,
+          error: `Crashed ${crashes} times in ${windowMinutes} minutes; automatic restarts paused. Fix the app, then start it again. Logs: ${appLogPath(app.id)}`,
+        });
+        void syncRoutesBestEffort(`degraded:${app.id}`);
+        return;
+      }
+      const delayMs = restartDelayMs(crashes);
+      console.error(`[App:${app.id}] exited with code ${code}; restarting in ${Math.round(delayMs / 1000)}s (crash ${crashes}/${APP_RESTART_POLICY.maxCrashes})`);
       updateAppMeta(app.id, {
         status: 'restarting',
         pid: null,
@@ -274,11 +383,12 @@ function startAppProcess(app) {
         startApp(app.id).catch((err) => {
           updateAppMeta(app.id, { status: 'error', error: err.message, pid: null });
         });
-      }, 2000);
+      }, delayMs);
       restartTimers.set(app.id, timer);
       return;
     }
 
+    console.log(`[App:${app.id}] exited with code ${code}`);
     updateAppMeta(app.id, {
       status: code === 0 ? 'stopped' : 'error',
       pid: null,
@@ -297,6 +407,10 @@ async function startApp(appId) {
   if (existingTimer) clearTimeout(existingTimer);
   restartTimers.delete(appId);
 
+  // A degraded app has no pending restart timer, so reaching here means an
+  // explicit start (user/API/boot) — give it a fresh crash budget.
+  if (app.status === 'degraded') crashHistory.delete(appId);
+
   if (running.has(appId)) {
     const current = updateAppMeta(app.id, {
       desiredState: 'running',
@@ -362,6 +476,8 @@ async function stopApp(appId, options = {}) {
     console.warn(`[Apps] Could not clean listeners for ${appId} on port ${app.port}: ${err.message}`);
   });
   running.delete(appId);
+  crashHistory.delete(appId);
+  closeAppLog(appId);
 
   setTimeout(() => stopping.delete(appId), 1000);
   const current = updateAppMeta(appId, {
@@ -524,6 +640,7 @@ async function startRegisteredApps() {
 }
 
 module.exports = {
+  APP_RESTART_POLICY,
   deleteApp,
   connectDns,
   disconnectDns,

package/runtime/scripts/amalgm-mcp/browser/auth-tools.js

@@ -31,21 +31,60 @@ function jsonText(value) {
   return textResult(JSON.stringify(value, null, 2));
 }
 
+/** Every browser session leaves a durable profile behind, so the full lists
+ * grow without bound (a stress test found ~130 profiles / 86K chars from one
+ * unpaged dump). Summaries are the default; `full` is the opt-in. */
+const SUMMARY_LIMIT = 15;
+
+function summarizeEntry(entry) {
+  if (!entry || typeof entry !== 'object') return entry;
+  const out = {};
+  for (const key of ['id', 'name', 'profileId', 'domains', 'status', 'targetUrl', 'lastUsedAt', 'updatedAt', 'createdAt', 'expiresAt']) {
+    if (entry[key] !== undefined && entry[key] !== null && entry[key] !== '') out[key] = entry[key];
+  }
+  if (out.name === out.id) delete out.name;
+  return out;
+}
+
+function summarizeList(entries) {
+  const list = Array.isArray(entries) ? entries : [];
+  return {
+    total: list.length,
+    // Store lists are already sorted most-recent-first.
+    recent: list.slice(0, SUMMARY_LIMIT).map(summarizeEntry),
+    ...(list.length > SUMMARY_LIMIT ? { note: `${list.length - SUMMARY_LIMIT} older entries omitted — pass full: true for everything.` } : {}),
+  };
+}
+
 module.exports = [
   {
     name: 'auth_list',
-    description: 'List saved browser auth state on this computer: durable profiles, encrypted auth bundles, and pending login links. Raw cookies and tokens are never returned.',
-    inputSchema: { type: 'object', properties: {} },
-    async handler() {
+    description: 'List saved browser auth state on this computer: durable profiles, encrypted auth bundles, and pending login links. Returns a recent-first summary by default; pass full: true for complete records. Raw cookies and tokens are never returned.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        full: { type: 'boolean', description: 'Return complete records instead of the recent-first summary' },
+      },
+    },
+    async handler(args = {}) {
       try {
+        const cookieSource = {
+          bundleId: COOKIE_SOURCE_BUNDLE_ID,
+          profileId: DEFAULT_COOKIE_SOURCE_PROFILE_ID,
+        };
+        if (args.full) {
+          return jsonText({
+            profiles: listBrowserProfiles(),
+            bundles: listBrowserAuthBundles(),
+            loginSessions: listBrowserLoginSessions(),
+            cookieSource,
+          });
+        }
         return jsonText({
-          profiles: listBrowserProfiles(),
-          bundles: listBrowserAuthBundles(),
-          loginSessions: listBrowserLoginSessions(),
-          cookieSource: {
-            bundleId: COOKIE_SOURCE_BUNDLE_ID,
-            profileId: DEFAULT_COOKIE_SOURCE_PROFILE_ID,
-          },
+          profiles: summarizeList(listBrowserProfiles()),
+          bundles: summarizeList(listBrowserAuthBundles()),
+          loginSessions: summarizeList(listBrowserLoginSessions()),
+          cookieSource,
         });
       } catch (err) {
         return errorResult(`auth_list failed: ${err.message}`);

package/runtime/scripts/amalgm-mcp/browser/cua-tools.js

@@ -1,147 +1,120 @@
 'use strict';
 
 /**
- * CUA (computer-use) tools — coordinate-based browser control, split out from
- * the main browser surface. Use these only for vision-model loops that work
- * from screenshots; for everything else the snapshot/@ref tools in the
- * browser group are faster and more reliable.
+ * CUA (computer-use) — coordinate-based browser control as ONE tool with an
+ * action field, not eight. Agents need this maybe 5% of the time (canvas,
+ * webGL, hostile UIs, vision loops); it doesn't deserve eight schema slots.
+ *
+ * The contract that matters: cua screenshot coordinates map 1:1 to the x/y
+ * every other action takes. For normal pages the snapshot/@ref tools are
+ * faster and more reliable.
+ *
+ * Loadouts saved when this was eight actions (cua_click, cua_type, ...) keep
+ * working — toolbox/loadout-context.js maps the old grants onto `cua`.
  */
 
 const { textResult, errorResult } = require('../lib/tool-result');
 const engine = require('./engine');
+const delta = require('./delta');
 
 const sessionProperty = {
   session: { type: 'string', description: 'Browser session/profile id. Defaults to your chat session.' },
 };
 
+const ACTIONS = ['screenshot', 'click', 'double_click', 'move', 'scroll', 'type', 'keypress', 'drag'];
+
 function coordinate(value, name) {
   const number = Number(value);
   if (!Number.isFinite(number)) throw new Error(`${name} must be a finite number`);
   return number;
 }
 
-function handlerFor(action, prepare) {
-  return async (args, ctx) => {
-    try {
-      const prepared = prepare ? prepare(args) : args;
-      const result = await engine.cua(action, prepared, ctx);
-      return textResult(`ok (session: ${result.session || result.browserSessionId || 'default'})`);
-    } catch (err) {
-      return errorResult(`${action} failed: ${err.message}`);
-    }
-  };
-}
-
-module.exports = [
-  {
-    name: 'cua_screenshot',
-    description: 'Capture the browser viewport for a vision loop. Coordinates in the image map 1:1 to cua_click/cua_move coordinates.',
-    inputSchema: { type: 'object', properties: sessionProperty },
-    async handler(args, ctx) {
-      try {
-        const capture = await engine.screenshot({ ...args, fullPage: false }, ctx);
-        return {
-          content: [
-            { type: 'image', data: capture.base64, mimeType: 'image/png' },
-            { type: 'text', text: `Viewport screenshot (${capture.bytes} bytes)` },
-          ],
-        };
-      } catch (err) {
-        return errorResult(`cua_screenshot failed: ${err.message}`);
-      }
-    },
-  },
-  {
-    name: 'cua_click',
-    description: 'Click viewport coordinates.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        x: { type: 'number' },
-        y: { type: 'number' },
-        button: { type: 'number', description: '1 left (default), 2 middle, 3 right' },
-        ...sessionProperty,
-      },
-      required: ['x', 'y'],
-    },
-    handler: handlerFor('cua_click', (args) => ({ ...args, x: coordinate(args.x, 'x'), y: coordinate(args.y, 'y') })),
-  },
-  {
-    name: 'cua_double_click',
-    description: 'Double-click viewport coordinates.',
-    inputSchema: {
-      type: 'object',
-      properties: { x: { type: 'number' }, y: { type: 'number' }, ...sessionProperty },
-      required: ['x', 'y'],
-    },
-    handler: handlerFor('cua_double_click', (args) => ({ ...args, x: coordinate(args.x, 'x'), y: coordinate(args.y, 'y') })),
-  },
-  {
-    name: 'cua_move',
-    description: 'Move the mouse to viewport coordinates.',
-    inputSchema: {
-      type: 'object',
-      properties: { x: { type: 'number' }, y: { type: 'number' }, ...sessionProperty },
-      required: ['x', 'y'],
-    },
-    handler: handlerFor('cua_move', (args) => ({ ...args, x: coordinate(args.x, 'x'), y: coordinate(args.y, 'y') })),
-  },
-  {
-    name: 'cua_scroll',
-    description: 'Scroll from viewport coordinates by scrollX/scrollY pixels.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        x: { type: 'number' },
-        y: { type: 'number' },
-        scrollX: { type: 'number' },
-        scrollY: { type: 'number' },
-        ...sessionProperty,
-      },
-      required: ['x', 'y', 'scrollX', 'scrollY'],
-    },
-    handler: handlerFor('cua_scroll', (args) => ({
+/** Per-action argument validation/coercion. Throws with a usable message. */
+function prepare(action, args) {
+  if (action === 'click' || action === 'double_click' || action === 'move') {
+    return { ...args, x: coordinate(args.x, 'x'), y: coordinate(args.y, 'y') };
+  }
+  if (action === 'scroll') {
+    return {
       ...args,
       x: coordinate(args.x, 'x'),
       y: coordinate(args.y, 'y'),
       scrollX: Number(args.scrollX || 0),
       scrollY: Number(args.scrollY || 0),
-    })),
-  },
-  {
-    name: 'cua_type',
-    description: 'Type text at the focused element with real keystrokes.',
-    inputSchema: {
-      type: 'object',
-      properties: { text: { type: 'string' }, ...sessionProperty },
-      required: ['text'],
-    },
-    handler: handlerFor('cua_type'),
-  },
-  {
-    name: 'cua_keypress',
-    description: 'Press a key combination, e.g. ["Control", "a"] or ["Enter"].',
-    inputSchema: {
-      type: 'object',
-      properties: { keys: { type: 'array', items: { type: 'string' } }, ...sessionProperty },
-      required: ['keys'],
-    },
-    handler: handlerFor('cua_keypress'),
-  },
+    };
+  }
+  if (action === 'type') {
+    if (typeof args.text !== 'string') throw new Error('text is required for type');
+    return args;
+  }
+  if (action === 'keypress') {
+    if (!Array.isArray(args.keys) || !args.keys.length) throw new Error('keys is required for keypress, e.g. ["Enter"]');
+    return args;
+  }
+  if (action === 'drag') {
+    if (!Array.isArray(args.path) || args.path.length < 2) throw new Error('path must contain at least two {x, y} points');
+    return args;
+  }
+  return args;
+}
+
+/** Actions that plausibly changed the page and deserve a result delta. */
+const DELTA_ACTIONS = new Set(['click', 'double_click', 'keypress', 'drag']);
+
+module.exports = [
   {
-    name: 'cua_drag',
-    description: 'Drag the mouse through a list of viewport points.',
+    name: 'cua',
+    description: 'Coordinate-based browser control for vision loops — one tool, pick an action: '
+      + 'screenshot (capture the viewport; its pixel coordinates map 1:1 to x/y here), '
+      + 'click / double_click / move (x, y), scroll (x, y + scrollX/scrollY), '
+      + 'type (text, real keystrokes at the focused element), keypress (keys array like ["Enter"]), '
+      + 'drag (path of {x,y} points). '
+      + 'Use only when snapshot/@refs cannot see the UI (canvas, webGL, custom widgets); refs are faster and more reliable. '
+      + 'In the desktop app, text/key actions are scoped inside the target page so they cannot type into Amalgm\'s own chat UI.',
     inputSchema: {
       type: 'object',
       properties: {
+        action: { type: 'string', enum: ACTIONS, description: 'Which computer-use action to perform' },
+        x: { type: 'number', description: 'Viewport x for click/double_click/move/scroll' },
+        y: { type: 'number', description: 'Viewport y for click/double_click/move/scroll' },
+        button: { type: 'number', description: 'Mouse button for click: 1 left (default), 2 middle, 3 right' },
+        scrollX: { type: 'number', description: 'Horizontal scroll delta in px (scroll)' },
+        scrollY: { type: 'number', description: 'Vertical scroll delta in px (scroll)' },
+        text: { type: 'string', description: 'Text to type (type)' },
+        keys: { type: 'array', items: { type: 'string' }, description: 'Key combination, e.g. ["Control", "a"] or ["Enter"] (keypress)' },
         path: {
           type: 'array',
           items: { type: 'object', properties: { x: { type: 'number' }, y: { type: 'number' } }, required: ['x', 'y'] },
+          description: 'Points to drag the mouse through (drag)',
         },
         ...sessionProperty,
       },
-      required: ['path'],
+      required: ['action'],
+    },
+    async handler(args, ctx) {
+      const action = String(args.action || '');
+      if (!ACTIONS.includes(action)) {
+        return errorResult(`action must be one of: ${ACTIONS.join(', ')}`);
+      }
+      try {
+        if (action === 'screenshot') {
+          const capture = await engine.screenshot({ ...args, fullPage: false }, ctx);
+          return {
+            content: [
+              { type: 'image', data: capture.base64, mimeType: 'image/png' },
+              { type: 'text', text: `Viewport screenshot (${capture.bytes} bytes). Coordinates map 1:1 to cua x/y.` },
+            ],
+          };
+        }
+        const result = await engine.cua(`cua_${action}`, prepare(action, args), ctx);
+        if (DELTA_ACTIONS.has(action)) {
+          const after = await delta.describeAfter(result.session, ctx);
+          return textResult([`cua ${action} ok`, after].filter(Boolean).join('\n'));
+        }
+        return textResult(`cua ${action} ok`);
+      } catch (err) {
+        return errorResult(`cua ${action} failed: ${err.message}`);
+      }
     },
-    handler: handlerFor('cua_drag'),
   },
 ];