amalgm 0.1.160 → 0.1.161

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.160",
+  "version": "0.1.161",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,

package/runtime/scripts/amalgm-mcp/browser/cookie-jar.js

@@ -613,7 +613,15 @@ function installCookieCloudBootstrap(input = {}, options = {}) {
   const remote = normalizeCloudSnapshot(JSON.parse(bytes.toString('utf8')));
   const pending = require('../state/mutations').listPendingCloudMutations(replica.resourceId, { database });
   const pendingKeys = new Set(pending.map((mutation) => mutation.operation?.key).filter(Boolean));
-  const bootstrapOperations = localBootstrapOperations(local, remote, pendingKeys);
+  // A base snapshot behind the official head is not the current cloud jar.
+  // Comparing local state against it would misclassify already-synced values
+  // as pre-cloud work and create an echo loop on every reconnect. The gateway
+  // normally compacts private resources to head before bootstrap; this guard
+  // makes the runtime fail closed if an older gateway sends a stale base.
+  const snapshotIsCurrent = Number(input.snapshotVersion) >= Number(input.headVersion);
+  const bootstrapOperations = snapshotIsCurrent
+    ? localBootstrapOperations(local, remote, pendingKeys)
+    : [];
 
   persistCloudSnapshot({
     schemaVersion: COOKIE_JAR_SCHEMA_VERSION,
@@ -645,7 +653,12 @@ function installCookieCloudBootstrap(input = {}, options = {}) {
     commitCookieOperation(operation, currentReplica, { database });
     currentReplica = cookieCloudReplica({ database });
   }
-  return { replica: currentReplica, jar: readCookieJar(), bootstrappedMutations: bootstrapOperations.length };
+  return {
+    replica: currentReplica,
+    jar: readCookieJar(),
+    bootstrappedMutations: bootstrapOperations.length,
+    bootstrapDeferred: !snapshotIsCurrent,
+  };
 }
 
 function applyCloudCookieMutation(input = {}, options = {}) {

package/runtime/scripts/amalgm-mcp/tests/browser-cookie-cloud.test.js

@@ -27,6 +27,7 @@ const {
   COOKIE_CLOUD_CONTRACT,
   applyCloudCookieMutation,
   getCookieCloudBootstrap,
+  installCookieCloudBootstrap,
   mergeCookieJar,
   privateCookieResourceId,
   readCookieJar,
@@ -150,3 +151,31 @@ test('the private resource is deterministic per user and bootstrap is automatic'
   );
   assert.equal(JSON.parse(Buffer.from(bootstrap.snapshotBase64, 'base64').toString('utf8')).schemaVersion, 1);
 });
+
+test('a stale cloud base never re-emits local cookies as bootstrap mutations', () => {
+  mergeCookieJar({ sourceId: 'machine-a', upserts: [cookie('already-synced', 'local-secret')] });
+  const db = openLocalDb();
+  db.prepare('DELETE FROM mutation_journal').run();
+  const resourceId = privateCookieResourceId(userId);
+  const bytes = Buffer.from(JSON.stringify({
+    schemaVersion: 1,
+    version: 0,
+    updatedAt: '2026-07-20T19:00:00.000Z',
+    records: [],
+    tombstones: [],
+  }), 'utf8');
+  const result = installCookieCloudBootstrap({
+    resourceId,
+    authorityEpoch: 1,
+    headVersion: 7,
+    snapshotVersion: 0,
+    snapshotChecksum: require('crypto').createHash('sha256').update(bytes).digest('hex'),
+    snapshotBase64: bytes.toString('base64'),
+    contract: COOKIE_CLOUD_CONTRACT,
+    schemaVersion: 1,
+  }, { database: db });
+
+  assert.equal(result.bootstrapDeferred, true);
+  assert.equal(result.bootstrappedMutations, 0);
+  assert.equal(db.prepare('SELECT COUNT(*) AS count FROM mutation_journal').get().count, 0);
+});