amalgm 0.1.161 → 0.1.162

package/runtime/scripts/amalgm-mcp/state/mutations.js

@@ -20,11 +20,11 @@ const {
   revealOperation,
 } = require('./mutation-contracts');
 const { trace } = require('./trace');
+const { isCloudResourceId } = require('./cloud-resource-id');
 
 const MAX_MUTATION_BYTES = 4 * 1024 * 1024;
 const DEFAULT_CLAIM_LIMIT = 100;
 const DEFAULT_CLAIM_LEASE_MS = 30_000;
-const CLOUD_RESOURCE_ID = /^(?:shr|pvr)_[A-Za-z0-9_-]{16,128}$/;
 const MUTATION_ID = /^[A-Za-z0-9_-]{16,160}$/;
 const OPERATION_KIND = /^[a-z][a-z0-9._:-]{0,63}$/;
 const CONTRACT = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,127}$/;
@@ -108,8 +108,8 @@ function normalizeMutationInput(input) {
   const sharedResourceId = cloudResourceInput == null
     ? null
     : cleanText(cloudResourceInput, 'cloudResourceId', 132);
-  if (sharedResourceId && !CLOUD_RESOURCE_ID.test(sharedResourceId)) {
-    throw invalid('cloudResourceId must be an opaque id beginning with shr_ or pvr_');
+  if (sharedResourceId && !isCloudResourceId(sharedResourceId)) {
+    throw invalid('cloudResourceId must be a node UUID or legacy cloud id');
   }
   if (sharedResourceId && channelId !== `resource:${sharedResourceId}`) {
     throw invalid('a cloud mutation channelId must be resource:<cloudResourceId>');
@@ -803,7 +803,7 @@ function listMutations(options = {}) {
  */
 function listPendingCloudMutations(resourceIdInput, options = {}) {
   const resourceId = cleanText(resourceIdInput, 'resourceId', 132);
-  if (!CLOUD_RESOURCE_ID.test(resourceId)) {
+  if (!isCloudResourceId(resourceId)) {
     throw invalid('resourceId must be an opaque cloud resource id');
   }
   const database = options.database || openLocalDb();

package/runtime/scripts/amalgm-mcp/state/promotions.js

@@ -6,8 +6,8 @@ const { cachedStatement, openLocalDb } = require('./db');
 const { appendStateEvent } = require('./events');
 const { registerReplica } = require('./replicas');
 const { trace } = require('./trace');
+const { isSharedResourceId } = require('./cloud-resource-id');
 
-const SHARED_RESOURCE_ID = /^shr_[A-Za-z0-9_-]{16,128}$/;
 const PROMOTION_ID = /^[A-Za-z0-9_-]{16,160}$/;
 
 function invalid(message, statusCode = 400) {
@@ -52,7 +52,7 @@ function enqueuePromotion(input, options = {}) {
   const promotionId = requiredText(input?.promotionId, 'promotionId', 160);
   const resourceId = requiredText(input?.resourceId, 'resourceId', 132);
   if (!PROMOTION_ID.test(promotionId)) throw invalid('promotionId has an invalid format');
-  if (!SHARED_RESOURCE_ID.test(resourceId)) throw invalid('resourceId has an invalid format');
+  if (!isSharedResourceId(resourceId)) throw invalid('resourceId must be a node UUID or legacy shared id');
   const localResource = requiredText(input?.localResource, 'localResource');
   const localPath = requiredText(input?.localPath, 'localPath', 4096);
   const contract = requiredText(input?.contract || 'text-yjs@1', 'contract', 128);

package/runtime/scripts/amalgm-mcp/state/replicas.js

@@ -10,8 +10,8 @@
 
 const { cachedStatement, openLocalDb } = require('./db');
 const { trace } = require('./trace');
+const { isCloudResourceId } = require('./cloud-resource-id');
 
-const CLOUD_RESOURCE_ID = /^(?:shr|pvr)_[A-Za-z0-9_-]{16,128}$/;
 const CONTRACT = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,127}$/;
 
 function invalid(message, statusCode = 400) {
@@ -55,8 +55,8 @@ function normalizeReplica(row) {
 
 function registerReplica(input, options = {}) {
   const resourceId = requiredText(input?.resourceId, 'resourceId', 132);
-  if (!CLOUD_RESOURCE_ID.test(resourceId)) {
-    throw invalid('resourceId must be an opaque id beginning with shr_ or pvr_');
+  if (!isCloudResourceId(resourceId)) {
+    throw invalid('resourceId must be a node UUID or legacy cloud id');
   }
   const localResource = requiredText(input?.localResource, 'localResource');
   const localPath = requiredText(input?.localPath, 'localPath', 4096);
@@ -177,8 +177,9 @@ function refreshReplicaAuthority(input, options = {}) {
     throw invalid(`shared resource ${resourceId} contract changed`, 409);
   }
   if (authorityEpoch < Number(row.authority_epoch)) {
-    return normalizeReplica(row);
+    return { ...normalizeReplica(row), authorityChanged: false };
   }
+  const authorityChanged = authorityEpoch > Number(row.authority_epoch);
   cachedStatement(database, `
     UPDATE shared_resource_replicas
     SET authority_epoch = ?,
@@ -190,7 +191,7 @@ function refreshReplicaAuthority(input, options = {}) {
         updated_at = ?
     WHERE resource_id = ?
   `).run(authorityEpoch, headVersion, headVersion, new Date().toISOString(), resourceId);
-  return getReplicaByResourceId(resourceId, { database });
+  return { ...getReplicaByResourceId(resourceId, { database }), authorityChanged };
 }
 
 /**

package/runtime/scripts/amalgm-mcp/state/shared-rest.js

@@ -71,29 +71,24 @@ async function handleReplicaRehydrate(body, sendJson) {
   }
 }
 
+async function handleWorkspaceContentDiscover(body, sendJson) {
+  try {
+    const attachments = require('../workspace/tree-cloud').enqueueWorkspaceContentAttachments(
+      body?.workspaceId,
+      body?.contentResources,
+    );
+    sendJson(attachments.length ? 202 : 200, { attachments });
+  } catch (error) {
+    sendHandlerError(error, sendJson);
+  }
+}
+
 async function handlePromotionStart(body, sendJson) {
   try {
-    // One owner per file (workspace-sync.md §1). A file tracked by a
-    // repository is git-owned: it syncs through commits on the workspace
-    // rail, and it may join the doc rail only via a future explicit
-    // ownership handoff — never by ambient promotion.
-    if (typeof body?.path === 'string' && body.path) {
-      const owner = await require('../workspace/git').gitOwnerOf(body.path);
-      if (owner) {
-        throw Object.assign(
-          new Error(
-            `${body.path} is git-owned: tracked by the repository at ${owner.toplevel}. `
-            + 'Repository files sync through git (commits are the sync points), not the doc rail. '
-            + 'If this file truly belongs on the rail, untrack it first (git rm --cached <file>).',
-          ),
-          { statusCode: 409, code: 'file_git_owned' },
-        );
-      }
-    }
     const opened = require('./docs').openDoc(body?.path);
     const result = require('./promotions').enqueuePromotion({
       promotionId: body?.promotionId || `prm_${crypto.randomBytes(16).toString('base64url')}`,
-      resourceId: body?.resourceId || `shr_${crypto.randomBytes(18).toString('base64url')}`,
+      resourceId: body?.resourceId || opened.nodeId || `shr_${crypto.randomBytes(18).toString('base64url')}`,
       localResource: opened.resource,
       localPath: opened.path,
       contract: body?.contract || 'text-yjs@1',
@@ -161,15 +156,22 @@ async function handlePromotionFail(body, sendJson) {
 
 async function handleAttachmentStart(body, sendJson) {
   try {
-    const opened = require('./docs').openDoc(body?.path);
-    if (require('./docs').getDocText(opened.path).length > 0) {
+    const tree = body?.contract === 'workspace-tree@1';
+    const localPath = tree ? require('path').resolve(body?.path || '') : require('./docs').openDoc(body?.path).path;
+    if (tree) {
+      const stats = fs.statSync(localPath);
+      if (!stats.isDirectory() || fs.readdirSync(localPath).length > 0) {
+        sendJson(409, { error: 'cloud workspace attachment requires an empty folder' });
+        return;
+      }
+    } else if (require('./docs').getDocText(localPath).length > 0) {
       sendJson(409, { error: 'cloud attachment requires an empty local text file' });
       return;
     }
     const result = require('./attachments').enqueueAttachment({
       attachmentId: body?.attachmentId || `att_${crypto.randomBytes(16).toString('base64url')}`,
       resourceId: body?.resourceId,
-      localPath: opened.path,
+      localPath,
     });
     sendJson(result.duplicate ? 200 : 202, result);
   } catch (error) {
@@ -270,7 +272,9 @@ async function handleMutationIngest(body, sendJson) {
     const contract = body?.envelope?.contract;
     const result = contract === 'browser-cookie-jar@1'
       ? require('../browser/cookie-jar').applyCloudCookieMutation(body)
-      : require('./docs').applyCloudDocMutation(body);
+      : contract === 'workspace-tree@1'
+        ? require('../workspace/tree-store').applyCloudTreeMutation(body)
+        : require('./docs').applyCloudDocMutation(body);
     sendJson(200, result);
   } catch (error) {
     sendHandlerError(error, sendJson);
@@ -296,4 +300,5 @@ module.exports = {
   handleReplicaList,
   handleReplicaRegister,
   handleReplicaRehydrate,
+  handleWorkspaceContentDiscover,
 };

package/runtime/scripts/amalgm-mcp/tests/state-promotion-ownership.test.js

@@ -1,9 +1,8 @@
 'use strict';
 
-// One owner per file (workspace-sync.md §1): a git-tracked file syncs
-// through git, and the doc rail must refuse to promote it. Untracked
-// files inside a repo and files outside any repo have no git owner and
-// promote as before.
+// Git owns commits, refs, the index, and execution. Workspace collaboration
+// owns included working-tree content, so tracked text files use the same live
+// document rail as every other enrolled text file.
 
 const test = require('node:test');
 const assert = require('node:assert/strict');
@@ -52,7 +51,7 @@ async function promote(filePath) {
   return sent;
 }
 
-test('a git-tracked file is refused: git owns it', async () => {
+test('a git-tracked text file promotes through the document rail', async () => {
   const repo = path.join(tempRoot, 'repo');
   fs.mkdirSync(repo, { recursive: true });
   await run(repo, 'init', '-b', 'main');
@@ -62,10 +61,7 @@ test('a git-tracked file is refused: git owns it', async () => {
   await run(repo, 'commit', '-m', 'initial');
 
   const { statusCode, payload } = await promote(tracked);
-  assert.equal(statusCode, 409);
-  assert.equal(payload.code, 'file_git_owned');
-  assert.match(payload.error, /tracked by the repository at /);
-  assert.ok(payload.error.includes(fs.realpathSync(repo)), 'the error names the owning repo');
+  assert.equal(statusCode, 202, JSON.stringify(payload));
 });
 
 test('an untracked file inside a repo has no git owner and promotes', async () => {

package/runtime/scripts/amalgm-mcp/tests/workspace-access-store.test.js

@@ -0,0 +1,120 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-workspace-access-test-'));
+process.env.AMALGM_DIR = path.join(tempRoot, '.amalgm');
+process.env.AMALGM_WORKSPACES_DIR = path.join(tempRoot, 'workspaces');
+process.env.AMALGM_COMPUTER_ID = 'access-computer';
+const ownerId = '11111111-1111-4111-8111-111111111111';
+const memberId = '22222222-2222-4222-8222-222222222222';
+fs.mkdirSync(process.env.AMALGM_DIR, { recursive: true });
+fs.mkdirSync(process.env.AMALGM_WORKSPACES_DIR, { recursive: true });
+fs.writeFileSync(path.join(process.env.AMALGM_DIR, 'computer.json'), JSON.stringify({
+  computer_id: 'access-computer',
+  user_id: ownerId,
+}));
+
+const { closeLocalDb, openLocalDb } = require('../state/db');
+const docs = require('../state/docs');
+const { runLegacyMigrations } = require('../state/migrations');
+const { upsertWorkspace } = require('../workspace/store');
+const {
+  commitPathCreate,
+  enrollWorkspace,
+  nodeForPath,
+  reconcileWorkspaceTree,
+  requirePathCapability,
+} = require('../workspace/tree-store');
+const {
+  clearNodePermission,
+  resolveAccess,
+  revokeWorkspaceUser,
+  setNodePermission,
+  workspaceEpoch,
+} = require('../workspace/access-store');
+
+test.after(() => {
+  docs.closeAllDocs();
+  closeLocalDb();
+  fs.rmSync(tempRoot, { recursive: true, force: true });
+});
+
+test('explicit child grants override inheritance and revoke-all is one epoch change', () => {
+  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'project');
+  const folder = path.join(root, 'folder');
+  const file = path.join(folder, 'note.md');
+  fs.mkdirSync(folder, { recursive: true });
+  fs.writeFileSync(file, 'hello\n');
+  const workspace = upsertWorkspace({ path: root, name: 'Project' });
+  enrollWorkspace(workspace.id);
+  const folderId = nodeForPath(folder).node.id;
+  const fileId = nodeForPath(file).node.id;
+
+  setNodePermission({ actorUserId: ownerId, userId: memberId, nodeId: workspace.id, role: 'viewer' });
+  assert.equal(resolveAccess(fileId, memberId).role, 'viewer');
+  setNodePermission({ actorUserId: ownerId, userId: memberId, nodeId: folderId, role: 'editor' });
+  assert.equal(resolveAccess(fileId, memberId).role, 'editor');
+  setNodePermission({ actorUserId: ownerId, userId: memberId, nodeId: fileId, role: 'no_access' });
+  assert.equal(resolveAccess(fileId, memberId).role, 'no_access');
+  clearNodePermission({ actorUserId: ownerId, userId: memberId, nodeId: fileId });
+  assert.equal(resolveAccess(fileId, memberId).role, 'editor');
+
+  const before = workspaceEpoch(workspace.id);
+  const revoked = revokeWorkspaceUser({ actorUserId: ownerId, userId: memberId, workspaceId: workspace.id });
+  assert.equal(revoked.revoked, 2);
+  assert.equal(revoked.authorityEpoch, before + 1);
+  assert.equal(resolveAccess(fileId, memberId).role, null);
+});
+
+test('migration backfills the signed-in owner only for locally owned workspaces', () => {
+  const localRoot = path.join(process.env.AMALGM_WORKSPACES_DIR, 'backfill-local');
+  const cloudRoot = path.join(process.env.AMALGM_WORKSPACES_DIR, 'backfill-cloud');
+  fs.mkdirSync(localRoot);
+  fs.mkdirSync(cloudRoot);
+  const local = upsertWorkspace({ path: localRoot, name: 'Local', source: 'computer' });
+  const cloud = upsertWorkspace(
+    { path: cloudRoot, name: 'Cloud', source: 'cloud' },
+    { seedOwner: false },
+  );
+  const database = openLocalDb();
+  database.prepare('DELETE FROM workspace_node_permissions WHERE workspace_id = ?').run(local.id);
+
+  runLegacyMigrations(database);
+
+  assert.equal(resolveAccess(local.id, ownerId, { database }).role, 'owner');
+  assert.equal(resolveAccess(cloud.id, ownerId, { database }).role, null);
+});
+
+test('viewer disk changes are held instead of entering the mutation journal', () => {
+  const root = path.join(process.env.AMALGM_WORKSPACES_DIR, 'viewer-projection');
+  fs.mkdirSync(root);
+  const seededPath = path.join(root, 'seeded.txt');
+  fs.writeFileSync(seededPath, 'original\n');
+  const workspace = upsertWorkspace(
+    { path: root, name: 'Viewer projection', source: 'cloud' },
+    { seedOwner: false },
+  );
+  enrollWorkspace(workspace.id);
+  const database = openLocalDb();
+  database.prepare(`
+    INSERT INTO workspace_node_permissions(workspace_id, node_id, user_id, role)
+    VALUES (?, ?, ?, 'viewer')
+  `).run(workspace.id, workspace.id, ownerId);
+
+  const observedPath = path.join(root, 'from-shell.txt');
+  fs.writeFileSync(observedPath, 'local-only\n');
+  const reconciled = reconcileWorkspaceTree(workspace.id, { database });
+  assert.equal(reconciled.operations.length, 0);
+  assert.equal(reconciled.held.length, 1);
+  assert.equal(reconciled.held[0].operation.kind, 'tree.create');
+  assert.equal(nodeForPath(observedPath, { database }), null);
+  assert.throws(() => commitPathCreate(path.join(root, 'from-api.txt'), 'file', { database }), /forbidden/);
+  assert.throws(() => requirePathCapability(root, 'edit', { database }), /forbidden/);
+  assert.throws(() => docs.writeDocText(seededPath, 'viewer edit\n'), /forbidden/);
+  assert.equal(docs.getDocText(seededPath), 'original\n');
+});

package/runtime/scripts/amalgm-mcp/tests/workspace-checkpoint.test.js

@@ -0,0 +1,137 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFile } = require('child_process');
+const { promisify } = require('util');
+
+const execFileAsync = promisify(execFile);
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-checkpoint-test-'));
+process.env.AMALGM_DIR = path.join(tempRoot, '.amalgm');
+process.env.AMALGM_WORKSPACES_DIR = path.join(process.env.AMALGM_DIR, 'workspaces');
+process.env.AMALGM_COMPUTER_ID = 'machine-a';
+process.env.AMALGM_DEVICE_ID = 'device-machine-a';
+
+fs.mkdirSync(process.env.AMALGM_DIR, { recursive: true });
+fs.writeFileSync(
+  path.join(process.env.AMALGM_DIR, 'computer.json'),
+  JSON.stringify({ computer_id: 'machine-a', user_id: '11111111-1111-4111-8111-111111111111' }),
+);
+
+const { closeLocalDb } = require('../state/db');
+const { captureWorktreeDiff } = require('../workspace/git');
+const { applyPatch } = require('../workspace/transition');
+const { checkpointResourceId, revisionOf } = require('../workspace/checkpoint');
+
+test.after(() => {
+  closeLocalDb();
+  fs.rmSync(tempRoot, { recursive: true, force: true });
+});
+
+async function run(cwd, ...args) {
+  await execFileAsync(
+    'git',
+    ['-c', 'user.email=test@amalgm.test', '-c', 'user.name=Amalgm Test', '-c', 'commit.gpgsign=false', ...args],
+    { cwd, env: { ...process.env, GIT_TERMINAL_PROMPT: '0', LC_ALL: 'C' } },
+  );
+}
+
+async function makeRepoPair() {
+  const stamp = Math.random().toString(36).slice(2, 8);
+  const author = path.join(tempRoot, `author-${stamp}`);
+  fs.mkdirSync(author, { recursive: true });
+  await run(author, 'init', '-b', 'main');
+  fs.writeFileSync(path.join(author, 'README.md'), '# app\nline two\n');
+  fs.mkdirSync(path.join(author, 'src'));
+  fs.writeFileSync(path.join(author, 'src', 'index.js'), 'console.log(1);\n');
+  fs.writeFileSync(path.join(author, '.gitignore'), 'node_modules/\n');
+  fs.writeFileSync(path.join(author, 'LICENSE'), 'MIT\n');
+  await run(author, 'add', '.');
+  await run(author, 'commit', '-m', 'initial');
+  const receiver = path.join(tempRoot, `receiver-${stamp}`);
+  await run(tempRoot, 'clone', '-q', author, receiver);
+  return { author, receiver };
+}
+
+test('a dirty worktree round-trips through capture and apply, gitignore filtering included', async () => {
+  const { author, receiver } = await makeRepoPair();
+
+  // Every dirty shape at once: tracked edit, staged edit, deletion, new
+  // text file in a new folder, binary file, and ignored junk.
+  fs.appendFileSync(path.join(author, 'README.md'), 'edited\n');
+  fs.writeFileSync(path.join(author, 'src', 'index.js'), 'console.log(2);\n');
+  await run(author, 'add', 'src/index.js');
+  fs.rmSync(path.join(author, 'LICENSE'));
+  fs.mkdirSync(path.join(author, 'lib'));
+  fs.writeFileSync(path.join(author, 'lib', 'util.js'), 'module.exports = 42;\n');
+  fs.writeFileSync(path.join(author, 'blob.bin'), Buffer.from([0, 1, 2, 255, 0, 7]));
+  fs.mkdirSync(path.join(author, 'node_modules', 'junk'), { recursive: true });
+  fs.writeFileSync(path.join(author, 'node_modules', 'junk', 'x.js'), 'never travels\n');
+
+  const captured = await captureWorktreeDiff(author);
+  assert.ok(captured.diff.length > 0);
+  assert.ok(!captured.diff.includes('node_modules'), 'ignored files must never enter a checkpoint');
+
+  const patchFile = path.join(tempRoot, 'roundtrip.patch');
+  fs.writeFileSync(patchFile, captured.diff);
+  await applyPatch(receiver, patchFile);
+
+  assert.equal(
+    fs.readFileSync(path.join(receiver, 'README.md'), 'utf8'),
+    fs.readFileSync(path.join(author, 'README.md'), 'utf8'),
+  );
+  assert.equal(
+    fs.readFileSync(path.join(receiver, 'src', 'index.js'), 'utf8'),
+    'console.log(2);\n',
+  );
+  assert.equal(
+    fs.readFileSync(path.join(receiver, 'lib', 'util.js'), 'utf8'),
+    'module.exports = 42;\n',
+  );
+  assert.deepEqual(
+    fs.readFileSync(path.join(receiver, 'blob.bin')),
+    Buffer.from([0, 1, 2, 255, 0, 7]),
+  );
+  assert.equal(fs.existsSync(path.join(receiver, 'LICENSE')), false, 'deletions travel');
+  assert.equal(fs.existsSync(path.join(receiver, 'node_modules')), false);
+
+  // And the reverse of the same patch restores the receiver to clean.
+  await applyPatch(receiver, patchFile, { reverse: true });
+  const after = await captureWorktreeDiff(receiver);
+  assert.equal(after.diff, '');
+});
+
+test('capture is stable: two reads of an untouched tree produce the same revision', async () => {
+  const { author } = await makeRepoPair();
+  fs.appendFileSync(path.join(author, 'README.md'), 'same edit\n');
+  const first = await captureWorktreeDiff(author);
+  const second = await captureWorktreeDiff(author);
+  assert.equal(first.diff, second.diff);
+  assert.equal(revisionOf(first.baseOid, first.diff), revisionOf(second.baseOid, second.diff));
+});
+
+test('a clean tree captures as an empty patch, and oversized state is a named refusal', async () => {
+  const { author } = await makeRepoPair();
+  const clean = await captureWorktreeDiff(author);
+  assert.equal(clean.diff, '');
+
+  fs.writeFileSync(path.join(author, 'big.txt'), 'x'.repeat(4096));
+  const bounded = await captureWorktreeDiff(author, { maxBytes: 100 });
+  assert.equal(bounded.diff, null);
+  assert.equal(bounded.reason, 'too-large');
+});
+
+test('checkpoint resource ids are stable per (user, machine, repo) and distinct across each', () => {
+  const user = '11111111-1111-4111-8111-111111111111';
+  const id = checkpointResourceId('m1', 'https://github.com/a/b', user);
+  assert.equal(id, checkpointResourceId('m1', 'https://github.com/a/b', user));
+  assert.match(id, /^shr_[A-Za-z0-9_-]{16,128}$/);
+  assert.notEqual(id, checkpointResourceId('m2', 'https://github.com/a/b', user));
+  assert.notEqual(id, checkpointResourceId('m1', 'https://github.com/a/c', user));
+  assert.notEqual(id, checkpointResourceId('m1', 'https://github.com/a/b', 'other-user'));
+  assert.equal(checkpointResourceId(null, 'x', user), null);
+});