amalgm 0.1.149 → 0.1.150

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.149",
+  "version": "0.1.150",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,
@@ -46,6 +46,7 @@
     "opencode-ai": "^1.17.6",
     "tsx": "^4.21.0",
     "ws": "^8.21.0",
+    "yjs": "^13.6.31",
     "zod": "^4.4.3"
   }
 }

package/runtime/scripts/amalgm-mcp/automations/tools.js

@@ -19,15 +19,27 @@ const TRIGGER_DESCRIPTION = [
   'For a manual-only automation, still create one trigger with `enabled: false`; `automations_run_now` can run the workflow without waiting for that trigger to fire.',
 ].join('\n\n');
 
+const WORKFLOW_EXAMPLE = `export default workflow({
+  trigger: "*.*",
+  cells: [
+    code("getData", () => ({ msg: "hello" })),
+    tool("notify", "notifications.notify_user", (ctx) => ({
+      message: ctx.cells.getData.output.msg,
+    })),
+  ],
+});`;
+
 const WORKFLOW_DESCRIPTION = [
   'Source-of-truth workflow script. Use `export default workflow({ trigger, allowlist, limits, cells })`.',
   'The script is the workflow. A trigger decides when it runs; cells decide what happens.',
+  '`cells` is an ARRAY of cell-builder calls. The builders `code`, `cli`, `http`, `tool`, and `agent` are globals (do not destructure or import them), and each takes the cell name as its first argument. Complete example:',
+  '```js\n' + WORKFLOW_EXAMPLE + '\n```',
   'Workflow `trigger` refs are `source.event` strings such as `github.push`; `github.*` means any GitHub event; `*.push` means a push from any source; `*.*` means any source and event.',
-  'Cells can call `code(name, fn)`, gated local `cli(name, config)`, gated `http(name, config)`, and `tool(name, "tool.action", args)`.',
+  'Cell builders: `code(name, fn)`, gated local `cli(name, config)`, gated `http(name, config)`, and `tool(name, "tool.action", args)`.',
   'Agents are tools too: use `agent(name, agentIdOrName, { prompt, run_in_background: true })` or `tool(name, "agents.talk_to_agent", args)`.',
   'Every function receives one ctx object: `{ automation, trigger, workflow, event, payload, headers, previous, outputs, cells, secrets, stop }`.',
   'Cell outputs are available as `ctx.cells.cellName.output`, `ctx.cells.cellName.field` for object outputs, `ctx.outputs.cellName`, and top-level `ctx.cellName`.',
-  'Example: `tool("notify", "notifications.notify_user", ({ cells }) => ({ message: cells.greet.output.message }))`.',
+  'To see a known-good script, call `automations_get` on any existing automation and read its `workflowText`.',
 ].join('\n\n');
 
 function compactAutomation(automation, includeWorkflowText = true) {
@@ -470,3 +482,5 @@ module.exports = [
     },
   },
 ];
+
+module.exports.WORKFLOW_EXAMPLE = WORKFLOW_EXAMPLE;

package/runtime/scripts/amalgm-mcp/fs/rest.js

@@ -789,7 +789,10 @@ module.exports = {
   handleSearch,
   handleWrite,
   _private: {
+    base64UrlDecode,
+    base64UrlEncode,
     buildFilesResource,
+    classifyFile,
     expandHome,
     buildUploadsResource,
     configuredRootPaths,
@@ -797,5 +800,6 @@ module.exports = {
     pathFromFilesResource,
     publishFilesystemChange,
     resolveSafePath,
+    resolveSafePathSync,
   },
 };

package/runtime/scripts/amalgm-mcp/server/routes/state.js

@@ -3,20 +3,50 @@
 const stateRest = require('../../state/rest');
 
 async function handleStateRoutes(ctx) {
-  if (ctx.method !== 'GET') return false;
-
-  if (ctx.pathname === '/state/snapshot') {
-    stateRest.handleSnapshot(ctx.getQuery(), ctx.sendJson);
-    return true;
-  }
-  if (ctx.pathname === '/state/events') {
-    stateRest.handleEvents(ctx.getQuery(), ctx.sendJson);
-    return true;
+  if (ctx.method === 'GET') {
+    if (ctx.pathname === '/state/snapshot') {
+      stateRest.handleSnapshot(ctx.getQuery(), ctx.sendJson);
+      return true;
+    }
+    if (ctx.pathname === '/state/events') {
+      stateRest.handleEvents(ctx.getQuery(), ctx.sendJson);
+      return true;
+    }
+    if (ctx.pathname === '/state/stream') {
+      stateRest.handleStream(ctx.req, ctx.res, ctx.getQuery());
+      return true;
+    }
+    if (ctx.pathname === '/state/resources') {
+      stateRest.handleResourceList(ctx.sendJson);
+      return true;
+    }
+    return false;
   }
-  if (ctx.pathname === '/state/stream') {
-    stateRest.handleStream(ctx.req, ctx.res, ctx.getQuery());
-    return true;
+
+  if (ctx.method === 'POST') {
+    if (ctx.pathname === '/state/resources/register') {
+      await stateRest.handleResourceRegister(await ctx.readJsonBody(), ctx.sendJson);
+      return true;
+    }
+    if (ctx.pathname === '/state/resources/unregister') {
+      await stateRest.handleResourceUnregister(await ctx.readJsonBody(), ctx.sendJson);
+      return true;
+    }
+    if (ctx.pathname === '/state/resources/emit') {
+      await stateRest.handleResourceEmit(await ctx.readJsonBody(), ctx.sendJson);
+      return true;
+    }
+    if (ctx.pathname === '/state/docs/open') {
+      await stateRest.handleDocOpen(await ctx.readJsonBody(), ctx.sendJson);
+      return true;
+    }
+    if (ctx.pathname === '/state/docs/update') {
+      await stateRest.handleDocUpdate(await ctx.readJsonBody(), ctx.sendJson);
+      return true;
+    }
+    return false;
   }
+
   return false;
 }
 

package/runtime/scripts/amalgm-mcp/state/app-resources.js

@@ -0,0 +1,245 @@
+'use strict';
+
+/**
+ * App-registered resources: the HTTP door onto the local-live rails.
+ *
+ * Apps run out-of-process, so the engine cannot call a read() inside them.
+ * Instead the engine keeps the mirror: an app registers a namespaced name
+ * (`app:<appId>:<name>`), pushes changes as events, and the engine stores the
+ * current rows in sqlite. The registry's read() for an app resource reads
+ * that mirror, so snapshots/replays/resets behave exactly like built-ins.
+ *
+ * Registrations persist across restarts; ensureAppResourcesLoaded() re-wires
+ * them into the in-memory registry on first use.
+ */
+
+const { openLocalDb } = require('./db');
+const registry = require('./registry');
+const { insertStateEvent, publishStateEvent } = require('./events');
+
+const APP_RESOURCE_NAME_RE = /^app:[a-z0-9][a-z0-9_-]*:[a-z0-9][a-z0-9_.-]*$/i;
+const MAX_EVENTS_PER_EMIT = 500;
+const VALID_OPS = new Set(['insert', 'update', 'delete', 'replace']);
+
+let loaded = false;
+
+function ensureSchema(database) {
+  database.exec(`
+    CREATE TABLE IF NOT EXISTS app_resources (
+      name TEXT PRIMARY KEY,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+      updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+    );
+
+    CREATE TABLE IF NOT EXISTS app_resource_rows (
+      resource TEXT NOT NULL,
+      id TEXT NOT NULL,
+      value_json TEXT NOT NULL,
+      updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+      PRIMARY KEY (resource, id),
+      FOREIGN KEY (resource) REFERENCES app_resources(name) ON DELETE CASCADE
+    );
+  `);
+}
+
+function isValidAppResourceName(name) {
+  return typeof name === 'string' && APP_RESOURCE_NAME_RE.test(name);
+}
+
+function listAppResourceRows(name) {
+  const rows = openLocalDb()
+    .prepare('SELECT value_json FROM app_resource_rows WHERE resource = ? ORDER BY id ASC')
+    .all(name);
+  const values = [];
+  for (const row of rows) {
+    try {
+      values.push(JSON.parse(row.value_json));
+    } catch {
+      // A torn row should not take the whole resource down.
+    }
+  }
+  return values;
+}
+
+function wireIntoRegistry(name) {
+  if (registry.hasResource(name)) return;
+  registry.registerResource(name, {
+    read: () => listAppResourceRows(name),
+  });
+}
+
+function ensureAppResourcesLoaded() {
+  if (loaded) return;
+  const database = openLocalDb();
+  ensureSchema(database);
+  const names = database.prepare('SELECT name FROM app_resources ORDER BY name ASC').all();
+  for (const { name } of names) wireIntoRegistry(name);
+  loaded = true;
+}
+
+function registerAppResource(name) {
+  if (!isValidAppResourceName(name)) {
+    throw invalid(`resource name must look like "app:<appId>:<name>" (got ${JSON.stringify(name)})`);
+  }
+  ensureAppResourcesLoaded();
+  const database = openLocalDb();
+  const inserted = database
+    .prepare('INSERT OR IGNORE INTO app_resources (name) VALUES (?)')
+    .run(name).changes > 0;
+  wireIntoRegistry(name);
+  return { resource: name, created: inserted };
+}
+
+function unregisterAppResource(name) {
+  ensureAppResourcesLoaded();
+  const database = openLocalDb();
+  const existed = database.prepare('DELETE FROM app_resources WHERE name = ?').run(name).changes > 0;
+  if (!existed) return { resource: name, removed: false };
+  registry.unregisterResource(name);
+  // Tell connected screens the resource is gone (empty), through the log so
+  // replay/reset semantics hold.
+  const event = database.transaction(() =>
+    insertStateEvent(database, { resource: name, op: 'replace', value: [], source: 'app:unregister' }),
+  )();
+  publishStateEvent(event);
+  return { resource: name, removed: true };
+}
+
+function invalid(message) {
+  const error = new Error(message);
+  error.statusCode = 400;
+  return error;
+}
+
+function normalizeEmitEvent(name, input, index) {
+  if (!input || typeof input !== 'object') {
+    throw invalid(`events[${index}] must be an object`);
+  }
+  const op = input.op;
+  if (!VALID_OPS.has(op)) {
+    throw invalid(`events[${index}].op must be one of insert|update|delete|replace`);
+  }
+  if (op === 'replace') {
+    if (!Array.isArray(input.value)) {
+      throw invalid(`events[${index}]: replace requires value to be the full array of rows`);
+    }
+    for (const row of input.value) {
+      if (!row || typeof row !== 'object' || row.id == null) {
+        throw invalid(`events[${index}]: every replace row needs an id`);
+      }
+    }
+    return { op, value: input.value };
+  }
+  const id = input.id ?? input.value?.id;
+  if (id == null || String(id) === '') {
+    throw invalid(`events[${index}]: ${op} requires an id`);
+  }
+  if (op !== 'delete' && (!input.value || typeof input.value !== 'object')) {
+    throw invalid(`events[${index}]: ${op} requires value (the row object)`);
+  }
+  return { op, id: String(id), value: input.value };
+}
+
+function applyMirror(database, name, event) {
+  if (event.op === 'replace') {
+    database.prepare('DELETE FROM app_resource_rows WHERE resource = ?').run(name);
+    const upsert = database.prepare(`
+      INSERT INTO app_resource_rows (resource, id, value_json, updated_at)
+      VALUES (?, ?, ?, strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+      ON CONFLICT(resource, id) DO UPDATE SET
+        value_json = excluded.value_json,
+        updated_at = excluded.updated_at
+    `);
+    for (const row of event.value) upsert.run(name, String(row.id), JSON.stringify(row));
+    return;
+  }
+  if (event.op === 'delete') {
+    database.prepare('DELETE FROM app_resource_rows WHERE resource = ? AND id = ?').run(name, event.id);
+    return;
+  }
+  database.prepare(`
+    INSERT INTO app_resource_rows (resource, id, value_json, updated_at)
+    VALUES (?, ?, ?, strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+    ON CONFLICT(resource, id) DO UPDATE SET
+      value_json = excluded.value_json,
+      updated_at = excluded.updated_at
+  `).run(name, event.id, JSON.stringify(event.value));
+}
+
+/**
+ * Apply a batch of app events: mirror rows and the event log update in one
+ * transaction, then publish to live subscribers.
+ */
+function emitAppResourceEvents(name, eventsInput, options = {}) {
+  ensureAppResourcesLoaded();
+  if (!isValidAppResourceName(name)) {
+    throw invalid(`resource name must look like "app:<appId>:<name>" (got ${JSON.stringify(name)})`);
+  }
+  const database = openLocalDb();
+  const registered = database.prepare('SELECT 1 FROM app_resources WHERE name = ?').get(name);
+  if (!registered) {
+    const error = new Error(`resource "${name}" is not registered; call /state/resources/register first`);
+    error.statusCode = 404;
+    throw error;
+  }
+
+  const inputs = Array.isArray(eventsInput) ? eventsInput : [eventsInput];
+  if (inputs.length === 0) return { events: [], seq: null };
+  if (inputs.length > MAX_EVENTS_PER_EMIT) {
+    throw invalid(`at most ${MAX_EVENTS_PER_EMIT} events per call (got ${inputs.length}); send a replace instead`);
+  }
+  const normalized = inputs.map((input, index) => normalizeEmitEvent(name, input, index));
+
+  const source = typeof options.source === 'string' && options.source ? options.source : name;
+  const inserted = database.transaction(() => {
+    const out = [];
+    for (const event of normalized) {
+      applyMirror(database, name, event);
+      out.push(insertStateEvent(database, {
+        resource: name,
+        op: event.op,
+        id: event.id,
+        value: event.value,
+        source,
+      }));
+    }
+    return out;
+  })();
+
+  for (const event of inserted) publishStateEvent(event);
+  return {
+    events: inserted.map((event) => ({ seq: event.seq, op: event.op, id: event.id ?? null })),
+    seq: inserted.length > 0 ? inserted[inserted.length - 1].seq : null,
+  };
+}
+
+function listAppResources() {
+  ensureAppResourcesLoaded();
+  const database = openLocalDb();
+  return database.prepare(`
+    SELECT
+      r.name,
+      r.created_at,
+      r.updated_at,
+      COUNT(rows.id) AS row_count
+    FROM app_resources r
+    LEFT JOIN app_resource_rows rows ON rows.resource = r.name
+    GROUP BY r.name
+    ORDER BY r.name ASC
+  `).all().map((row) => ({
+    resource: row.name,
+    rowCount: Number(row.row_count || 0),
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+  }));
+}
+
+module.exports = {
+  emitAppResourceEvents,
+  ensureAppResourcesLoaded,
+  isValidAppResourceName,
+  listAppResourceRows,
+  listAppResources,
+  registerAppResource,
+  unregisterAppResource,
+};