amalgm 0.1.150 → 0.1.151

package/lib/tunnel-events.js

@@ -667,6 +667,11 @@ function createEventTunnel({ record, foreground = false }) {
     ws.on('close', (code, reason) => {
       connectStartedAt = 0;
       lastGatewayFrameAt = 0;
+      // Streams and sockets belong to THIS gateway connection: their req/conn
+      // ids mean nothing to the next one, and its cancel frames will never
+      // reference them. Dropping them here is the only teardown they get —
+      // orphaned streams otherwise hold local connections open forever.
+      dropActiveProxies('event tunnel connection closed');
       warn(`closed code=${code} reason=${reason ? reason.toString() : ''}`);
       scheduleReconnect();
     });
@@ -675,6 +680,25 @@ function createEventTunnel({ record, foreground = false }) {
     });
   }
 
+  function dropActiveProxies(reason) {
+    for (const upstream of upstreamSockets.values()) {
+      try {
+        upstream.close();
+      } catch {
+        // noop
+      }
+    }
+    upstreamSockets.clear();
+    for (const stream of upstreamStreams.values()) {
+      try {
+        stream.destroy(new Error(reason));
+      } catch {
+        // noop
+      }
+    }
+    upstreamStreams.clear();
+  }
+
   return {
     start: connect,
     stop() {
@@ -682,22 +706,7 @@ function createEventTunnel({ record, foreground = false }) {
       if (reconnectTimer) clearTimeout(reconnectTimer);
       if (routeTimer) clearInterval(routeTimer);
       stopWatchdog();
-      for (const upstream of upstreamSockets.values()) {
-        try {
-          upstream.close();
-        } catch {
-          // noop
-        }
-      }
-      upstreamSockets.clear();
-      for (const stream of upstreamStreams.values()) {
-        try {
-          stream.destroy(new Error('event tunnel stopped'));
-        } catch {
-          // noop
-        }
-      }
-      upstreamStreams.clear();
+      dropActiveProxies('event tunnel stopped');
       void postPresence(record, false);
       if (ws) {
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.150",
+  "version": "0.1.151",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,

package/runtime/scripts/amalgm-mcp/state/docs.js

@@ -30,6 +30,7 @@
  * stale watcher events can never splice, so they can never re-emit.
  */
 
+const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 const { openLocalDb } = require('./db');
@@ -75,6 +76,20 @@ function ensureSchema(database) {
       updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
     );
   `);
+  // last_disk_hash records the disk content as we last read or wrote it.
+  // On reopen it distinguishes "disk changed externally" (fold it in) from
+  // "disk is merely behind our persisted state" (write the doc back out) —
+  // without it, a restart would revert edits that hadn't hit the debounced
+  // disk write yet.
+  try {
+    database.exec('ALTER TABLE doc_states ADD COLUMN last_disk_hash TEXT');
+  } catch {
+    // Column already exists.
+  }
+}
+
+function hashText(text) {
+  return crypto.createHash('sha256').update(text, 'utf8').digest('hex');
 }
 
 function docResourceName(absolutePath) {
@@ -143,12 +158,17 @@ function persistDocState(Y, entry) {
   const database = openLocalDb();
   ensureSchema(database);
   database.prepare(`
-    INSERT INTO doc_states (path, state, updated_at)
-    VALUES (?, ?, strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+    INSERT INTO doc_states (path, state, updated_at, last_disk_hash)
+    VALUES (?, ?, strftime('%Y-%m-%dT%H:%M:%fZ', 'now'), ?)
     ON CONFLICT(path) DO UPDATE SET
       state = excluded.state,
-      updated_at = excluded.updated_at
-  `).run(entry.path, Buffer.from(Y.encodeStateAsUpdate(entry.doc)));
+      updated_at = excluded.updated_at,
+      last_disk_hash = excluded.last_disk_hash
+  `).run(
+    entry.path,
+    Buffer.from(Y.encodeStateAsUpdate(entry.doc)),
+    entry.lastDiskText == null ? null : hashText(entry.lastDiskText),
+  );
 }
 
 function scheduleDiskWrite(Y, entry) {
@@ -183,13 +203,49 @@ function reconcileFromDisk(Y, entry) {
     entry.lastDiskText = onDisk;
     const ytext = entry.doc.getText(TEXT_KEY);
     // origin 'disk' keeps the update handler from writing the same bytes back.
-    spliceTextInto(Y, entry.doc, ytext, onDisk, 'disk');
+    const changed = spliceTextInto(Y, entry.doc, ytext, onDisk, 'disk');
+    // The splice's update handler persists; a no-op splice still needs the
+    // refreshed lastDiskText hash recorded.
+    if (!changed) persistDocState(Y, entry);
   } catch (error) {
     // File deleted or unreadable — the doc simply stops following the disk.
     console.warn(`[LiveDoc] Reconcile from disk failed for "${entry.path}":`, error?.message || error);
   }
 }
 
+/**
+ * First look at the disk after (re)opening a doc. Three cases:
+ *  - no persisted history → the disk seeds the doc (first ever open);
+ *  - disk matches the hash we recorded before dying → disk is unchanged;
+ *    if the persisted doc is ahead (edits inside the unflushed debounce
+ *    window), write the doc back out instead of splicing stale disk text
+ *    over those edits;
+ *  - disk differs from the recorded hash → a genuine external edit while we
+ *    were closed; fold it in like any other disk change.
+ */
+function seedFromDisk(Y, entry, persisted) {
+  const knownHash = persisted?.last_disk_hash;
+  if (!knownHash) {
+    reconcileFromDisk(Y, entry);
+    return;
+  }
+  let onDisk = null;
+  try {
+    onDisk = fs.readFileSync(entry.path, 'utf8');
+  } catch {
+    // Unreadable/deleted: same posture as reconcile — stop following disk.
+    return;
+  }
+  if (hashText(onDisk) !== knownHash) {
+    reconcileFromDisk(Y, entry);
+    return;
+  }
+  entry.lastDiskText = onDisk;
+  if (entry.doc.getText(TEXT_KEY).toString() !== onDisk) {
+    scheduleDiskWrite(Y, entry);
+  }
+}
+
 function watchDocFile(Y, entry) {
   const dir = path.dirname(entry.path);
   const base = path.basename(entry.path);
@@ -270,17 +326,23 @@ function loadDocEntry(pathInput) {
     lastDiskText: null,
   };
 
-  const persisted = database.prepare('SELECT state FROM doc_states WHERE path = ?').get(resolved);
+  let persisted = database.prepare('SELECT state, last_disk_hash FROM doc_states WHERE path = ?').get(resolved) || null;
   if (persisted?.state) {
     try {
       Y.applyUpdate(doc, new Uint8Array(persisted.state), 'persisted');
     } catch (error) {
       console.warn(`[LiveDoc] Discarding corrupt persisted state for "${resolved}":`, error?.message || error);
+      // The hash goes with it: without the state, "disk unchanged" would
+      // mean writing an empty doc over the file.
+      persisted = null;
     }
   }
 
   // Every applied change — client update, disk reconcile, or seed — flows
-  // through this one pipeline: event out, then (except disk-origin) disk out.
+  // through this one pipeline: event out, state persisted, then (except
+  // disk-origin) disk out. Persisting on every update means a kill — even
+  // SIGKILL — can never lose an acknowledged edit; at worst the disk artifact
+  // lags by the debounce window until the doc is next opened.
   doc.on('update', (update, origin) => {
     appendStateEvent({
       resource: entry.resource,
@@ -289,13 +351,14 @@ function loadDocEntry(pathInput) {
       patch: { yjs: Buffer.from(update).toString('base64') },
       source: origin === 'disk' ? 'doc:disk' : 'doc:update',
     });
+    persistDocState(Y, entry);
     if (origin !== 'disk') scheduleDiskWrite(Y, entry);
-    else persistDocState(Y, entry);
   });
 
-  // The disk is the source of truth at open: seeds new docs, and folds in
-  // anything written while the doc was closed (agents, git, other tools).
-  reconcileFromDisk(Y, entry);
+  // Disk at open: an externally changed file folds in as an edit, but a file
+  // that merely lags our persisted state (the process died inside the disk
+  // write debounce) gets the doc written back out — never spliced over it.
+  seedFromDisk(Y, entry, persisted);
 
   openDocs.set(resolved, entry);
   watchDocFile(Y, entry);

package/runtime/scripts/amalgm-mcp/state/rest.js

@@ -145,24 +145,57 @@ function handleStream(req, res, query) {
     return;
   }
 
-  const unsubscribe = subscribeStateEvents((event) => {
-    if (event.seq > after) sendSseEvent(res, event);
+  // One teardown for every way the stream can die. Idempotent because close
+  // and error can both fire, and a failed write calls it directly: a stream
+  // whose socket is gone must release its subscriber immediately — waiting
+  // on a 'close' that never fires is how dead streams pile up.
+  let heartbeat = null;
+  let unsubscribe = null;
+  let tornDown = false;
+  const teardown = () => {
+    if (tornDown) return;
+    tornDown = true;
+    if (heartbeat) clearInterval(heartbeat);
+    if (unsubscribe) unsubscribe();
+    try {
+      res.end();
+    } catch {
+      // Socket already gone.
+    }
+  };
+
+  const writeSafe = (send) => {
+    if (tornDown) return;
+    if (res.destroyed || res.writableEnded) {
+      teardown();
+      return;
+    }
+    try {
+      send();
+    } catch {
+      teardown();
+    }
+  };
+
+  unsubscribe = subscribeStateEvents((event) => {
+    if (event.seq > after) writeSafe(() => sendSseEvent(res, event));
   });
 
   for (const event of backlog) {
-    sendSseEvent(res, event);
+    writeSafe(() => sendSseEvent(res, event));
   }
 
   // A named event (not an SSE comment) so EventSource clients can observe it
-  // and detect a silently dead stream, e.g. tunnel frame drops.
-  const heartbeat = setInterval(() => {
-    sendSseControl(res, 'ping', { t: Date.now() });
+  // and detect a silently dead stream, e.g. tunnel frame drops. It doubles as
+  // the server-side liveness probe: writing to a dead socket tears down.
+  heartbeat = setInterval(() => {
+    writeSafe(() => sendSseControl(res, 'ping', { t: Date.now() }));
   }, 25_000);
 
-  req.on('close', () => {
-    clearInterval(heartbeat);
-    unsubscribe();
-  });
+  req.on('close', teardown);
+  req.on('error', teardown);
+  res.on('close', teardown);
+  res.on('error', teardown);
 }
 
 module.exports = {

package/runtime/scripts/amalgm-mcp/tests/state-docs.test.js

@@ -191,3 +191,60 @@ test('guards: binary, missing, oversized, and malformed inputs are rejected', ()
   assert.throws(() => docs.applyDocUpdates(target, [123]), /base64-encoded/);
   assert.throws(() => docs.applyDocUpdates(target, ['aGVsbG8=']), /invalid Yjs update/);
 });
+
+// ---------------------------------------------------------------------------
+// Durability: a crash (SIGKILL — no flush, no graceful close) must never lose
+// an acknowledged edit. State is persisted on every update; the recorded
+// last-disk hash lets reopen tell "disk is merely behind" (write the doc back
+// out) from "disk changed externally" (fold it in).
+// ---------------------------------------------------------------------------
+
+function crashAndReloadDocs() {
+  // Simulate SIGKILL: drop the module (and its open docs, timers untouched)
+  // without any flush. The reloaded module sees only what was persisted.
+  delete require.cache[require.resolve('../state/docs')];
+  return require('../state/docs');
+}
+
+test('a kill inside the disk-write debounce loses nothing: reopen restores the edit', async () => {
+  const target = writeDoc('crash.md', 'before the crash\n');
+  const opened = docs.openDoc(target);
+  const client = clientFromState(opened.state);
+  const update = encodeLocalEdit(client, (ytext) => ytext.insert(0, 'acknowledged edit / '));
+  docs.applyDocUpdates(target, [update]);
+
+  // Crash immediately — the 300ms disk write has NOT run; disk is stale.
+  assert.equal(fs.readFileSync(target, 'utf8'), 'before the crash\n');
+  const reloaded = crashAndReloadDocs();
+
+  const reopened = reloaded.openDoc(target);
+  const fresh = clientFromState(reopened.state);
+  assert.equal(
+    fresh.getText('content').toString(),
+    'acknowledged edit / before the crash\n',
+    'persisted state must win over a disk that is merely behind',
+  );
+
+  // The stale disk artifact catches up via the rescheduled write-back.
+  await sleep(500);
+  assert.equal(fs.readFileSync(target, 'utf8'), 'acknowledged edit / before the crash\n');
+  reloaded.closeAllDocs();
+});
+
+test('an external edit made while closed still folds in on reopen', () => {
+  const target = writeDoc('closed-edit.md', 'line one\n');
+  const opened = docs.openDoc(target);
+  const client = clientFromState(opened.state);
+  docs.applyDocUpdates(target, [encodeLocalEdit(client, (ytext) => ytext.insert(0, 'mine: '))]);
+  docs.closeAllDocs(); // graceful: disk now has "mine: line one\n"
+
+  fs.writeFileSync(target, 'mine: line one\nagent line\n', 'utf8');
+
+  const reopened = docs.openDoc(target);
+  const fresh = clientFromState(reopened.state);
+  assert.equal(
+    fresh.getText('content').toString(),
+    'mine: line one\nagent line\n',
+    'a genuinely changed disk is folded in, not overwritten',
+  );
+});

package/runtime/scripts/amalgm-mcp/tests/state-stream.test.js

@@ -0,0 +1,100 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { EventEmitter } = require('events');
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-stream-test-'));
+process.env.AMALGM_DIR = path.join(tempRoot, '.amalgm');
+
+const { closeLocalDb } = require('../state/db');
+const { appendStateEvent } = require('../state/events');
+const rest = require('../state/rest');
+
+test.after(() => {
+  closeLocalDb();
+  fs.rmSync(tempRoot, { recursive: true, force: true });
+});
+
+function fakeRequest() {
+  return new EventEmitter();
+}
+
+/**
+ * A response whose socket "dies" after `failAfterWrites` writes — every write
+ * past that throws, like Node does once the peer is gone and the stream is
+ * destroyed.
+ */
+function fakeResponse({ failAfterWrites = Infinity } = {}) {
+  const res = new EventEmitter();
+  res.writes = [];
+  res.destroyed = false;
+  res.writableEnded = false;
+  res.writeHead = () => res;
+  res.write = (chunk) => {
+    if (res.writes.length >= failAfterWrites) {
+      res.destroyed = true;
+      throw new Error('write after socket gone');
+    }
+    res.writes.push(String(chunk));
+    return true;
+  };
+  res.end = () => {
+    res.writableEnded = true;
+  };
+  return res;
+}
+
+test('a live subscriber receives events; close releases it', () => {
+  const req = fakeRequest();
+  const res = fakeResponse();
+  rest.handleStream(req, res, {});
+
+  appendStateEvent({ resource: 'automations', op: 'replace', value: [], source: 'test' });
+  const during = res.writes.filter((w) => w.includes('event: state')).length;
+  assert.ok(during >= 1, 'subscribed stream should receive the event');
+
+  req.emit('close');
+  appendStateEvent({ resource: 'automations', op: 'replace', value: [], source: 'test' });
+  const after = res.writes.filter((w) => w.includes('event: state')).length;
+  assert.equal(after, during, 'a closed stream must not receive further events');
+});
+
+test('a write failure tears the stream down: no orphaned subscriber', () => {
+  const req = fakeRequest();
+  // Allow the SSE preamble through, then kill the socket.
+  const res = fakeResponse({ failAfterWrites: 1 });
+  rest.handleStream(req, res, {});
+
+  // First event write fails → teardown. The subscriber must be gone: further
+  // events must not attempt writes (attempts throw and would surface here as
+  // an unhandled exception from the emitter callback).
+  appendStateEvent({ resource: 'automations', op: 'replace', value: [], source: 'test' });
+  const attemptsAfterDeath = res.writes.length;
+  appendStateEvent({ resource: 'automations', op: 'replace', value: [], source: 'test' });
+  appendStateEvent({ resource: 'automations', op: 'replace', value: [], source: 'test' });
+  assert.equal(res.writes.length, attemptsAfterDeath, 'dead stream must stop writing');
+  assert.equal(res.writableEnded, true, 'teardown ends the response');
+});
+
+test('close and error firing together tear down exactly once', () => {
+  const req = fakeRequest();
+  const res = fakeResponse();
+  rest.handleStream(req, res, {});
+  // Backlog replay from earlier tests lands before teardown; only NEW events
+  // after teardown matter.
+  const afterReplay = res.writes.filter((w) => w.includes('event: state')).length;
+  req.emit('close');
+  res.emit('close');
+  req.emit('error', new Error('boom'));
+  res.emit('error', new Error('boom'));
+  appendStateEvent({ resource: 'automations', op: 'replace', value: [], source: 'test' });
+  assert.equal(
+    res.writes.filter((w) => w.includes('event: state')).length,
+    afterReplay,
+    'no events after teardown',
+  );
+});

package/runtime/scripts/local-gateway.js

@@ -723,6 +723,14 @@ async function proxyHttp(req, res, target) {
     res.destroy(err);
   });
 
+  // A dropped downstream (dead tunnel frame, closed tab) must take the
+  // upstream request with it: streaming responses heartbeat forever, so the
+  // inactivity timeout never fires and orphans would hold runtime
+  // connections open indefinitely.
+  res.on('close', () => {
+    if (!res.writableFinished) upstream.destroy();
+  });
+
   upstream.end(body);
 }
 
@@ -758,6 +766,11 @@ async function proxyExternalHttp(req, res, target) {
     res.destroy(err);
   });
 
+  // Same close propagation as proxyHttp: no downstream, no upstream.
+  res.on('close', () => {
+    if (!res.writableFinished) upstream.destroy();
+  });
+
   upstream.end(body);
 }