amalgm 0.1.154 → 0.1.155

package/runtime/scripts/amalgm-mcp/tests/agent-bundles.test.js

@@ -81,7 +81,8 @@ test('agent bundle includes recursive subagents, selected user tools, system too
 
   const { bundle, preview } = createAgentBundle(root.id, { bundleId: 'agent-bundle-test' });
 
-  assert.equal(bundle.kind, 'amalgm.agent.bundle');
+  assert.equal(bundle.kind, 'amalgm.bundle');
+  assert.equal(bundle.schemaVersion, 2);
   assert.equal(bundle.rootAgentId, root.id);
   assert.deepEqual(bundle.agents.map((entry) => entry.sourceAgentId), [root.id, child.id]);
   assert.deepEqual(bundle.tools.map((tool) => tool.id), ['acme.cli', 'browser']);
@@ -192,8 +193,8 @@ test('installing an agent bundle creates local copies and rewrites subagent refs
 test('installing an agent bundle rejects missing shared subagents', async () => {
   await assert.rejects(
     () => installBundle({
-      kind: 'amalgm.agent.bundle',
-      schemaVersion: 1,
+      kind: 'amalgm.bundle',
+      schemaVersion: 2,
       rootAgentId: 'missing-child-root',
       title: 'Missing child root',
       agents: [{
@@ -214,15 +215,21 @@ test('installing an agent bundle rejects missing shared subagents', async () =>
           }],
         },
       }],
+      automations: [],
+      apps: [],
+      tools: [],
+      toolActions: [],
+      skills: [],
+      heads: [{ type: 'agent', id: 'missing-child-root' }],
     }),
     /missing shared subagents: missing-child/,
   );
 });
 
-test('installing an agent bundle regenerates stale flat graph fields from canonical agent arrays', async () => {
-  const result = await installBundle({
-    kind: 'amalgm.agent.bundle',
-    schemaVersion: 1,
+test('installing an agent bundle rejects stale flat graph fields', async () => {
+  await assert.rejects(() => installBundle({
+    kind: 'amalgm.bundle',
+    schemaVersion: 2,
     rootAgentId: 'graph-root',
     title: 'Graph root',
     agents: [{
@@ -238,13 +245,16 @@ test('installing an agent bundle regenerates stale flat graph fields from canoni
         subagents: [],
       },
     }],
+    automations: [],
+    apps: [],
+    tools: [],
+    toolActions: [],
+    skills: [],
+    heads: [{ type: 'agent', id: 'graph-root' }],
     headIds: ['agent:graph-root'],
-    elements: [{ id: 'agent:graph-root', type: 'agent', label: 'Graph root', data: {} }],
+    elements: [{ id: 'agent:graph-root', type: 'agent', label: 'Graph root' }],
     edges: [{ from: 'agent:graph-root', to: 'tool:missing', kind: 'uses-tool' }],
-  });
-
-  assert.equal(result.ok, true);
-  assert.equal(Boolean(resolveAgent(result.rootAgentId)), true);
+  }), /bundle edges does not match/);
 });
 
 test('agent bundle snapshots installed skill text from the local registry', () => {

package/runtime/scripts/amalgm-mcp/tests/browser-cookie-jar.test.js

@@ -0,0 +1,152 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-cookie-jar-'));
+process.env.AMALGM_DIR = path.join(tempRoot, '.amalgm');
+process.env.AMALGM_BROWSER_AUTH_KEY = 'd'.repeat(64);
+
+const { closeLocalDb, openLocalDb } = require('../state/db');
+const { listEventsAfter } = require('../state/events');
+const {
+  deleteBrowserAuthBundle,
+  readEncryptedStateBundle,
+  writeEncryptedStateBundle,
+} = require('../browser/auth-bundles');
+const { COOKIE_SOURCE_BUNDLE_ID } = require('../browser/cookie-source');
+const {
+  cookieJarState,
+  cookieKey,
+  cookiesMissingFromJar,
+  diffCookieSnapshots,
+  mergeCookieJar,
+  readCookieJar,
+} = require('../browser/cookie-jar');
+
+function cookie(name, value, domain = '.example.com', extra = {}) {
+  return {
+    name,
+    value,
+    domain,
+    path: '/',
+    expires: -1,
+    httpOnly: true,
+    secure: true,
+    sameSite: 'Lax',
+    ...extra,
+  };
+}
+
+test.beforeEach(() => {
+  deleteBrowserAuthBundle(COOKIE_SOURCE_BUNDLE_ID);
+  openLocalDb().prepare('DELETE FROM event_log').run();
+});
+
+test.after(() => {
+  closeLocalDb();
+  fs.rmSync(tempRoot, { recursive: true, force: true });
+});
+
+test('central jar merges browser-neutral mutations and keeps secrets encrypted', () => {
+  const first = mergeCookieJar({
+    sourceId: 'electron:default-session',
+    upserts: [cookie('electron-session', 'electron-secret')],
+  });
+  const second = mergeCookieJar({
+    sourceId: 'headless:chat-a',
+    upserts: [cookie('headless-session', 'headless-secret', '.other.example')],
+  });
+
+  assert.equal(first.version, 1);
+  assert.equal(second.version, 2);
+  assert.deepEqual(second.cookies.map((item) => item.name).sort(), ['electron-session', 'headless-session']);
+
+  const { bundle, payload } = readEncryptedStateBundle(COOKIE_SOURCE_BUNDLE_ID);
+  const encrypted = fs.readFileSync(bundle.blobPath, 'utf8');
+  assert.equal(encrypted.includes('electron-secret'), false);
+  assert.equal(encrypted.includes('headless-secret'), false);
+  assert.equal(payload.cookieJar.schemaVersion, 1);
+  assert.equal(payload.cookieJar.records.length, 2);
+  assert.equal(JSON.stringify(listEventsAfter(0)).includes('electron-secret'), false);
+});
+
+test('deletions create tombstones and stale adapter startup cannot resurrect them', () => {
+  const stale = cookie('session', 'old-secret');
+  mergeCookieJar({ sourceId: 'electron', upserts: [stale] });
+  const deleted = mergeCookieJar({ sourceId: 'headless', deletes: [stale] });
+
+  assert.equal(deleted.cookies.length, 0);
+  assert.equal(deleted.tombstones.some((item) => item.key === cookieKey(stale)), true);
+  assert.deepEqual(cookiesMissingFromJar([stale], deleted), []);
+
+  const unchanged = mergeCookieJar({ sourceId: 'headless', deletes: [stale] });
+  assert.equal(unchanged.version, deleted.version, 'repeated deletion should not churn the jar');
+});
+
+test('snapshot diff reports only real record changes', () => {
+  const before = [cookie('same', 'value'), cookie('removed', 'old')];
+  const after = [cookie('same', 'value'), cookie('added', 'new')];
+  const diff = diffCookieSnapshots(before, after);
+  assert.deepEqual(diff.upserts.map((item) => item.name), ['added']);
+  assert.deepEqual(diff.deletes.map((item) => item.name), ['removed']);
+});
+
+test('legacy browser-cookie-source bundle migrates in place on first mutation', () => {
+  writeEncryptedStateBundle({
+    id: COOKIE_SOURCE_BUNDLE_ID,
+    name: 'Legacy cookie source',
+    profileId: 'user-default',
+    state: { cookies: [cookie('legacy', 'kept-secret')], origins: [] },
+  });
+
+  const legacy = readCookieJar();
+  assert.equal(legacy.version, 1);
+  assert.equal(legacy.cookies[0].name, 'legacy');
+
+  const migrated = mergeCookieJar({ sourceId: 'future-browser', upserts: [cookie('future', 'new-secret')] });
+  assert.deepEqual(migrated.cookies.map((item) => item.name).sort(), ['future', 'legacy']);
+  const { payload } = readEncryptedStateBundle(COOKIE_SOURCE_BUNDLE_ID);
+  assert.equal(payload.cookieJar.schemaVersion, 1);
+  assert.deepEqual(payload.cookieJar.records.map((item) => item.cookie.name).sort(), ['future', 'legacy']);
+});
+
+test('partitioned cookies remain distinct and protected hosts are rejected centrally', () => {
+  const jar = mergeCookieJar({
+    sourceId: 'future-browser',
+    upserts: [
+      cookie('chip', 'one', '.example.com', { partitionKey: 'https://one.test' }),
+      cookie('chip', 'two', '.example.com', { partitionKey: 'https://two.test' }),
+      cookie('app-auth', 'must-not-share', 'localhost'),
+      cookie('supabase-auth', 'must-not-share', '.supabase.co'),
+    ],
+  });
+
+  assert.equal(jar.cookies.length, 2);
+  assert.notEqual(cookieKey(jar.cookies[0]), cookieKey(jar.cookies[1]));
+});
+
+test('host-only and domain cookies have distinct identities and inject correctly', () => {
+  const domainCookie = cookie('scope', 'domain', '.example.com', { hostOnly: false });
+  const hostCookie = cookie('scope', 'host', '.example.com', { hostOnly: true });
+  const jar = mergeCookieJar({
+    sourceId: 'future-browser',
+    upserts: [domainCookie, hostCookie],
+  });
+
+  assert.equal(jar.cookies.length, 2);
+  assert.notEqual(cookieKey(domainCookie), cookieKey(hostCookie));
+  const injected = cookieJarState(jar).cookies;
+  assert.equal(injected.find((item) => item.value === 'domain').domain, '.example.com');
+  assert.equal(injected.find((item) => item.value === 'host').domain, 'example.com');
+  assert.equal(injected.some((item) => Object.hasOwn(item, 'hostOnly')), false);
+});
+
+test('atomic encrypted writes leave no temporary files behind', () => {
+  mergeCookieJar({ sourceId: 'electron', upserts: [cookie('atomic', 'secret')] });
+  const root = path.join(process.env.AMALGM_DIR, 'browser', 'auth-bundles');
+  assert.equal(fs.readdirSync(root).some((name) => name.endsWith('.tmp')), false);
+});

package/runtime/scripts/amalgm-mcp/tests/browser-cookie-source.test.js

@@ -11,6 +11,7 @@ process.env.AMALGM_DIR = path.join(tempRoot, '.amalgm');
 process.env.AMALGM_BROWSER_AUTH_KEY = 'b'.repeat(64);
 process.env.AMALGM_BROWSER_BACKEND = 'cli';
 process.env.FAKE_BROWSER_LOG = path.join(tempRoot, 'browser-calls.jsonl');
+process.env.FAKE_BROWSER_STATE = path.join(tempRoot, 'browser-state');
 
 const fakeBrowser = path.join(tempRoot, 'fake-agent-browser.js');
 fs.writeFileSync(fakeBrowser, `#!/usr/bin/env node
@@ -18,14 +19,21 @@ const fs = require('fs');
 const valueFlags = new Set(['--session', '--profile', '--screenshot-dir', '--cdp', '--executable-path', '--provider']);
 const args = process.argv.slice(2);
 let command = [];
+let session = 'default';
 for (let i = 0; i < args.length; i += 1) {
   const arg = args[i];
+  if (arg === '--session') session = args[i + 1] || session;
   if (!arg.startsWith('--')) {
     command = args.slice(i);
     break;
   }
   if (valueFlags.has(arg)) i += 1;
 }
+const stateFile = process.env.FAKE_BROWSER_STATE + '.' + session.replace(/[^a-zA-Z0-9._-]/g, '_') + '.json';
+function readState() {
+  try { return JSON.parse(fs.readFileSync(stateFile, 'utf8')); } catch { return { cookies: [], origins: [] }; }
+}
+function writeState(state) { fs.writeFileSync(stateFile, JSON.stringify(state)); }
 let stdin = '';
 if (command[0] === 'batch') {
   try { stdin = fs.readFileSync(0, 'utf8'); } catch {}
@@ -41,6 +49,31 @@ if (command[0] === 'batch') {
       : { ok: true },
   }));
   process.stdout.write(JSON.stringify({ success: true, data: entries }));
+} else if (command[0] === 'state' && command[1] === 'save') {
+  fs.writeFileSync(command[2], JSON.stringify(readState()));
+  process.stdout.write(JSON.stringify({ success: true, data: { saved: true } }));
+} else if (command[0] === 'state' && command[1] === 'load') {
+  writeState(JSON.parse(fs.readFileSync(command[2], 'utf8')));
+  process.stdout.write(JSON.stringify({ success: true, data: { loaded: true } }));
+} else if (command[0] === 'cookies' && command[1] === 'clear') {
+  writeState({ ...readState(), cookies: [] });
+  process.stdout.write(JSON.stringify({ success: true, data: { cleared: true } }));
+} else if (command[0] === 'cookies' && command[1] === 'set') {
+  const state = readState();
+  const domainIndex = command.indexOf('--domain');
+  const urlIndex = command.indexOf('--url');
+  const domain = domainIndex >= 0
+    ? command[domainIndex + 1]
+    : (urlIndex >= 0 ? new URL(command[urlIndex + 1]).hostname : 'example.com');
+  const next = {
+    name: command[2], value: command[3], domain, path: '/', expires: -1,
+    httpOnly: false, secure: true, sameSite: 'Lax',
+  };
+  state.cookies = [...(state.cookies || []).filter((cookie) => !(cookie.name === next.name && cookie.domain === next.domain)), next];
+  writeState(state);
+  process.stdout.write(JSON.stringify({ success: true, data: { set: true } }));
+} else if (command[0] === 'cookies') {
+  process.stdout.write(JSON.stringify({ success: true, data: { cookies: readState().cookies || [] } }));
 } else {
   process.stdout.write(JSON.stringify({ success: true, data: { ok: true } }));
 }
@@ -50,6 +83,8 @@ process.env.AMALGM_AGENT_BROWSER_BIN = fakeBrowser;
 const { closeLocalDb } = require('../state/db');
 const { COOKIE_SOURCE_BUNDLE_ID } = require('../browser/cookie-source');
 const { writeEncryptedStateBundle } = require('../browser/auth-bundles');
+const { cookieKey, readCookieJar } = require('../browser/cookie-jar');
+const { listBrowserAuthBundles } = require('../browser/store');
 const engine = require('../browser/engine');
 
 function readCalls() {
@@ -116,3 +151,35 @@ test('new browser session imports the shared cookie source before opening', asyn
   );
   assert.equal(stateLoadCalls().length, 1, 'same source version should not reload for same session');
 });
+
+test('headless mutations and deletions flow back into the central jar', async () => {
+  const context = { callerSessionId: 'chat-writeback', sessionMetadata: { client: 'web' } };
+  await engine.passthrough({
+    args: ['cookies', 'set', 'headless-token', 'rotated-secret', '--domain', 'writeback.example'],
+  }, context);
+
+  let jar = readCookieJar();
+  const written = jar.cookies.find((cookie) => cookie.name === 'headless-token');
+  assert.equal(written?.value, 'rotated-secret');
+
+  await engine.passthrough({ args: ['cookies', 'clear'] }, context);
+  jar = readCookieJar();
+  assert.equal(jar.cookies.some((cookie) => cookie.name === 'headless-token'), false);
+  assert.equal(jar.tombstones.some((item) => item.key === cookieKey(written)), true);
+});
+
+test('auth_save creates a named bundle and never replaces the central jar', async () => {
+  const authSave = require('../browser/auth-tools').find((tool) => tool.name === 'auth_save');
+  const before = readCookieJar();
+  const result = await authSave.handler(
+    { browserProfileId: 'chat-a', name: 'Explicit saved login' },
+    { callerSessionId: 'chat-a', sessionMetadata: { client: 'web' } },
+  );
+  assert.equal(result.isError, undefined);
+
+  const bundles = listBrowserAuthBundles();
+  const saved = bundles.find((bundle) => bundle.name === 'Explicit saved login');
+  assert.ok(saved);
+  assert.notEqual(saved.id, COOKIE_SOURCE_BUNDLE_ID);
+  assert.equal(readCookieJar().versionToken, before.versionToken);
+});

package/runtime/scripts/amalgm-mcp/tests/browser-profile-lifecycle.test.js

@@ -0,0 +1,78 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-browser-profiles-'));
+process.env.AMALGM_DIR = path.join(tempRoot, '.amalgm');
+process.env.AMALGM_BROWSER_AUTH_KEY = 'e'.repeat(64);
+
+const { closeLocalDb } = require('../state/db');
+const { writeEncryptedStateBundle } = require('../browser/auth-bundles');
+const { profilePathFor } = require('../browser/paths');
+const {
+  deleteBrowserProfile,
+  getBrowserProfile,
+  pruneEphemeralBrowserProfiles,
+  upsertBrowserProfile,
+} = require('../browser/profiles');
+const sessions = require('../browser/sessions');
+
+function oldProfile(id) {
+  const target = profilePathFor(id);
+  fs.mkdirSync(path.join(target, 'Default'), { recursive: true });
+  fs.writeFileSync(path.join(target, 'Default', 'Cookies'), 'test');
+  const old = new Date(Date.now() - 48 * 60 * 60 * 1000);
+  fs.utimesSync(path.join(target, 'Default', 'Cookies'), old, old);
+  fs.utimesSync(path.join(target, 'Default'), old, old);
+  fs.utimesSync(target, old, old);
+  return target;
+}
+
+test.after(() => {
+  closeLocalDb();
+  fs.rmSync(tempRoot, { recursive: true, force: true });
+});
+
+test('ordinary sessions are not registered as durable profiles', () => {
+  sessions.sessionInfo('ordinary-chat');
+  assert.equal(getBrowserProfile('ordinary-chat'), null);
+  assert.equal(fs.existsSync(profilePathFor('ordinary-chat')), false);
+});
+
+test('profile pruning removes stale ephemeral state and preserves explicit, auth, and live profiles', () => {
+  const ephemeralPath = oldProfile('ephemeral-chat');
+  upsertBrowserProfile({ id: 'ephemeral-chat', source: 'agent-browser', profilePath: ephemeralPath });
+
+  const manualPath = oldProfile('manual-profile');
+  upsertBrowserProfile({ id: 'manual-profile', source: 'manual', profilePath: manualPath });
+
+  const savedPath = oldProfile('saved-auth-profile');
+  writeEncryptedStateBundle({
+    id: 'saved-auth-bundle',
+    profileId: 'saved-auth-profile',
+    state: { cookies: [], origins: [] },
+  });
+
+  const livePath = oldProfile('live-profile');
+  fs.writeFileSync(path.join(livePath, 'SingletonLock'), 'locked');
+
+  const result = pruneEphemeralBrowserProfiles({ ttlHours: 1 });
+  assert.equal(fs.existsSync(ephemeralPath), false);
+  assert.equal(getBrowserProfile('ephemeral-chat'), null);
+  assert.equal(fs.existsSync(manualPath), true);
+  assert.equal(fs.existsSync(savedPath), true);
+  assert.equal(fs.existsSync(livePath), true);
+  assert.equal(result.removedDirectories, 1);
+  assert.equal(result.removedRows, 1);
+});
+
+test('closing an unreferenced session can remove its working directory without a registry row', () => {
+  const target = oldProfile('closed-chat');
+  const result = deleteBrowserProfile('closed-chat', { onlyIfUnreferenced: true });
+  assert.equal(result.directoryDeleted, true);
+  assert.equal(fs.existsSync(target), false);
+});

package/runtime/scripts/amalgm-mcp/tests/bundle-entries.test.js

@@ -259,8 +259,7 @@ test('mixed bundle carries automations and apps with heads and installs everythi
   ]);
   const appElement = bundle.elements.find((element) => element.type === 'app');
   assert.equal(appElement.label, 'Sample App');
-  // Graph elements carry a manifest, not file contents.
-  assert.equal('content' in appElement.data.files[0], false);
+  assert.equal('data' in appElement, false);
   assert.equal(preview.automations.length, 1);
   assert.equal(preview.apps.length, 1);
   assert.equal(preview.apps[0].files, 5);
@@ -292,13 +291,21 @@ test('mixed bundle carries automations and apps with heads and installs everythi
   assert.equal(fs.existsSync(path.join(registered[0].cwd, 'src', 'index.js')), true);
 });
 
-test('legacy agent-only bundles still validate and empty bundles are rejected', () => {
+test('legacy and empty bundles are rejected', () => {
+  assert.throws(
+    () => validateBundle({ kind: 'amalgm.agent.bundle', schemaVersion: 2 }),
+    /Unsupported bundle kind/,
+  );
   assert.throws(
     () => validateBundle({ kind: 'amalgm.bundle', schemaVersion: 1 }),
+    /Unsupported bundle schema version/,
+  );
+  assert.throws(
+    () => validateBundle({ kind: 'amalgm.bundle', schemaVersion: 2 }),
     /at least one agent, automation, app, or tool/,
   );
   assert.throws(
-    () => validateBundle({ kind: 'something.else', schemaVersion: 1 }),
+    () => validateBundle({ kind: 'something.else', schemaVersion: 2 }),
     /Unsupported bundle kind/,
   );
 });
@@ -346,7 +353,8 @@ test('standalone tool bundle carries the tool as a head and installs it', async
   const toolElement = bundle.elements.find((element) => element.id === 'tool:acme.standalone');
   assert.equal(toolElement.label, 'Acme Standalone');
   const actionElement = bundle.elements.find((element) => element.type === 'tool_action');
-  assert.equal(actionElement.data.id, 'acme.standalone.run');
+  assert.equal(actionElement.id, 'tool_action:acme.standalone.run');
+  assert.equal('data' in actionElement, false);
   assert.equal(preview.tools.length, 1);
 
   const revived = validateBundle(JSON.parse(JSON.stringify(bundle)));
@@ -584,6 +592,13 @@ test('sharing an app pulls its owned tools, nested under the app in the graph',
     startCommand: 'PORT={port} node server.js',
     toolIds: ['appowned.tool'],
   });
+  // The portable manifest is authoritative even if a saved runtime summary
+  // has drifted since registration.
+  const apps = loadApps();
+  apps.apps = apps.apps.map((entry) => (
+    entry.id === app.id ? { ...entry, toolIds: [] } : entry
+  ));
+  saveApps(apps);
   defaultToolboxService.registerTool({
     id: 'appowned.tool',
     name: 'App Owned Tool',
@@ -605,8 +620,8 @@ test('sharing an app pulls its owned tools, nested under the app in the graph',
   assert.equal(bundle.tools.filter((tool) => tool.id === 'appowned.tool').length, 1);
   assert.equal(bundle.tools[0].appId, app.id);
   assert.deepEqual(
-    bundle.edges.filter((edge) => edge.kind === 'uses-tool' && edge.from === `app:${app.id}`),
-    [{ from: `app:${app.id}`, to: 'tool:appowned.tool', kind: 'uses-tool' }],
+    bundle.edges.filter((edge) => edge.kind === 'provides-tool' && edge.from === `app:${app.id}`),
+    [{ from: `app:${app.id}`, to: 'tool:appowned.tool', kind: 'provides-tool' }],
   );
   // The tool's paths bind to the app, so nothing stays machine-bound.
   assert.equal(bundle.requires.bindings.some((entry) => entry.includes('appowned.tool')), false);
@@ -632,6 +647,48 @@ test('sharing an app pulls its owned tools, nested under the app in the graph',
   assert.equal(installedTool.source.cwd, result.installedApps[0].cwd);
 });
 
+test('tool↔app closure is transitive and packs every discovered owner once', () => {
+  const { defaultToolboxService } = require('../toolbox/service');
+  const ownerDir = makeTempDir('bundle-transitive-owner-');
+  fs.writeFileSync(path.join(ownerDir, 'package.json'), JSON.stringify({ name: 'transitive-owner' }));
+  fs.writeFileSync(path.join(ownerDir, 'server.js'), 'console.log("owner");\n');
+  const owner = registerSampleApp(ownerDir, {
+    id: 'app-transitive-owner',
+    appRef: 'transowner001',
+    startCommand: 'node server.js',
+    toolIds: ['transitive.tool'],
+  });
+
+  const entryDir = makeTempDir('bundle-transitive-entry-');
+  fs.writeFileSync(path.join(entryDir, 'package.json'), JSON.stringify({ name: 'transitive-entry' }));
+  fs.writeFileSync(path.join(entryDir, 'server.js'), 'console.log("entry");\n');
+  const entry = registerSampleApp(entryDir, {
+    id: 'app-transitive-entry',
+    appRef: 'transentry001',
+    startCommand: 'node server.js',
+    toolIds: ['transitive.tool'],
+  });
+
+  defaultToolboxService.registerTool({
+    id: 'transitive.tool',
+    name: 'Transitive Tool',
+    type: 'cli',
+    origin: 'user',
+    appId: owner.id,
+    source: { command: 'transitive-tool', inputMode: 'json-stdin', outputMode: 'json' },
+  });
+
+  const { bundle } = createBundle({ appIds: [entry.id] });
+  assert.deepEqual(bundle.heads, [{ type: 'app', id: entry.id }]);
+  assert.deepEqual(bundle.apps.map((app) => app.sourceAppId), [entry.id, owner.id]);
+  assert.equal(bundle.tools.filter((tool) => tool.id === 'transitive.tool').length, 1);
+  assert.equal(bundle.edges.some((edge) => (
+    edge.from === 'tool:transitive.tool'
+    && edge.to === `app:${owner.id}`
+    && edge.kind === 'requires-app'
+  )), true);
+});
+
 test('sharing an app-owned tool pulls the app as a dependency, not a head', async () => {
   const { defaultToolboxService } = require('../toolbox/service');
   const appDir = makeTempDir('bundle-toolowner-src-');
@@ -669,7 +726,10 @@ test('sharing an app-owned tool pulls the app as a dependency, not a head', asyn
   assert.equal(bundle.apps[0].sourceAppId, app.id);
   assert.deepEqual(bundle.apps[0].toolIds, ['toolowner.tool']);
   assert.equal(bundle.edges.some(
-    (edge) => edge.from === `app:${app.id}` && edge.to === 'tool:toolowner.tool' && edge.kind === 'uses-tool',
+    (edge) => edge.from === `app:${app.id}` && edge.to === 'tool:toolowner.tool' && edge.kind === 'provides-tool',
+  ), true);
+  assert.equal(bundle.edges.some(
+    (edge) => edge.from === 'tool:toolowner.tool' && edge.to === `app:${app.id}` && edge.kind === 'requires-app',
   ), true);
   // App-bound paths resolve through the pulled-in app.
   const toolEntry = bundle.tools.find((tool) => tool.id === 'toolowner.tool');
@@ -721,8 +781,15 @@ test('an agent using an app-owned tool stays canonical: one tool record, app pul
     bundle.elements.filter((element) => element.id === 'tool:agentapp.tool').length,
     1,
   );
-  const toolEdges = bundle.edges.filter((edge) => edge.to === 'tool:agentapp.tool' && edge.kind === 'uses-tool');
-  assert.deepEqual(toolEdges.map((edge) => edge.from).sort(), [`agent:${agent.id}`, `app:${app.id}`]);
+  assert.equal(bundle.edges.some((edge) => (
+    edge.from === `agent:${agent.id}` && edge.to === 'tool:agentapp.tool' && edge.kind === 'uses-tool'
+  )), true);
+  assert.equal(bundle.edges.some((edge) => (
+    edge.from === `app:${app.id}` && edge.to === 'tool:agentapp.tool' && edge.kind === 'provides-tool'
+  )), true);
+  assert.equal(bundle.edges.some((edge) => (
+    edge.from === 'tool:agentapp.tool' && edge.to === `app:${app.id}` && edge.kind === 'requires-app'
+  )), true);
 });
 
 test('deleting either side of the app↔tool relation scrubs the other side', async () => {
@@ -779,7 +846,7 @@ test('deleting either side of the app↔tool relation scrubs the other side', as
   assert.equal('appId' in tool, false);
 });
 
-test('a stale tool→app link degrades to a warning instead of failing the export', () => {
+test('a stale tool→app link fails export', () => {
   const { defaultToolboxService } = require('../toolbox/service');
   defaultToolboxService.registerTool({
     id: 'stale.applink',
@@ -790,10 +857,10 @@ test('a stale tool→app link degrades to a warning instead of failing the expor
     source: { command: 'stale-applink', inputMode: 'json-stdin', outputMode: 'json' },
   });
 
-  const { bundle } = createBundle({ toolIds: ['stale.applink'] });
-  assert.equal(bundle.apps.length, 0);
-  assert.equal(bundle.tools.length, 1);
-  assert.equal(bundle.warnings.some((warning) => warning.includes('app-that-was-deleted')), true);
+  assert.throws(
+    () => createBundle({ toolIds: ['stale.applink'] }),
+    /references missing app: app-that-was-deleted/,
+  );
 });
 
 test('installBundle defaults app materialization to the owned apps root', async () => {