amalgm 0.1.166 → 0.1.168

package/lib/supervisor.js

@@ -47,6 +47,7 @@ const {
   runtimeServiceScripts,
 } = require('./runtime-manifest');
 const {
+  UPDATE_TARGET_MISMATCH,
   checkForUpdate,
   shouldAutoUpdate,
   updatePackage,
@@ -58,19 +59,6 @@ const PORT_ALLOCATION_LOCK_FILE = path.join(PORT_ALLOCATION_LOCK_DIR, 'owner.jso
 const PORT_ALLOCATION_LOCK_TIMEOUT_MS = 45_000;
 const PORT_ALLOCATION_LOCK_STALE_MS = 120_000;
 
-// npm installs land in the npm prefix, which is only the tree this process runs
-// from when the runtime was started from that prefix. When the service points at
-// another install (e.g. the CLI bundled inside the desktop app), the update can
-// never apply by restarting, so restarting would loop forever.
-function installedPackageVersionOnDisk() {
-  try {
-    const raw = fs.readFileSync(path.join(PACKAGE_ROOT_DIR, 'package.json'), 'utf8');
-    return JSON.parse(raw).version || null;
-  } catch {
-    return null;
-  }
-}
-
 const CHILD_RESTART_POLICY = {
   initialDelayMs: 1000,
   maxDelayMs: 30000,
@@ -838,6 +826,7 @@ function createAutoUpdateManager({ ports, runtimeToken, tunnels, foreground, req
     if (stopped || inFlight || installedUpdate) return;
     inFlight = true;
     const checkedAt = new Date().toISOString();
+    let check = null;
     try {
       writeAutoUpdateState({
         status: 'checking',
@@ -848,7 +837,7 @@ function createAutoUpdateManager({ ports, runtimeToken, tunnels, foreground, req
         last_checked_at: checkedAt,
         last_error: null,
       });
-      const check = await checkForUpdate({ currentVersion: PACKAGE_VERSION });
+      check = await checkForUpdate({ currentVersion: PACKAGE_VERSION });
       if (!check.updateAvailable) {
         writeAutoUpdateState({
           status: 'current',
@@ -893,10 +882,13 @@ function createAutoUpdateManager({ ports, runtimeToken, tunnels, foreground, req
           if (trimmed) log(trimmed, stream);
         },
       });
-      const diskVersion = installedPackageVersionOnDisk();
-      if (diskVersion !== check.targetVersion) {
+      installedUpdate = true;
+      await waitForIdleAndRestart(check);
+    } catch (error) {
+      // Restarting cannot apply an update that landed outside the tree this
+      // process runs from, so restarts are suppressed to avoid a restart loop.
+      if (error?.code === UPDATE_TARGET_MISMATCH && check) {
         suppressedTarget = check.targetVersion;
-        const reason = `installed ${check.targetVersion}, but this runtime still runs ${diskVersion || PACKAGE_VERSION} from ${PACKAGE_ROOT_DIR}; restart suppressed to avoid a restart loop`;
         writeAutoUpdateState({
           status: 'restart_suppressed',
           current_version: PACKAGE_VERSION,
@@ -905,14 +897,11 @@ function createAutoUpdateManager({ ports, runtimeToken, tunnels, foreground, req
           critical: isCriticalUpdate(check),
           service_managed: serviceManaged,
           last_checked_at: checkedAt,
-          last_error: reason,
+          last_error: error.message,
         });
-        log(reason, 'stderr');
+        log(error.message, 'stderr');
         return;
       }
-      installedUpdate = true;
-      await waitForIdleAndRestart(check);
-    } catch (error) {
       writeAutoUpdateState({
         status: 'error',
         current_version: PACKAGE_VERSION,

package/lib/updater.js

@@ -1,16 +1,19 @@
 'use strict';
 
 const { spawn } = require('child_process');
+const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const {
   AMALGM_RUNTIME_LABEL,
+  PACKAGE_ROOT,
 } = require('./paths');
 const {
   npmTagForRuntimeLabel,
 } = require('./runtime-identity');
 
 const PACKAGE_VERSION = require('../package.json').version;
+const UPDATE_TARGET_MISMATCH = 'AMALGM_UPDATE_TARGET_MISMATCH';
 const DEFAULT_VIEW_TIMEOUT_MS = 15_000;
 const DEFAULT_INSTALL_TIMEOUT_MS = 10 * 60_000;
 const DEFAULT_NPM_UPDATE_CACHE = path.join(os.tmpdir(), 'amalgm-npm-cache');
@@ -64,6 +67,41 @@ function npmCommand() {
   return process.platform === 'win32' ? 'npm.cmd' : 'npm';
 }
 
+// npm lays out global installs as <prefix>/lib/node_modules/<name> on POSIX and
+// <prefix>/node_modules/<name> on Windows. Walking that layout backwards from
+// the package root this process runs from recovers the prefix that owns the
+// running install, so updates land in the tree the service actually boots —
+// not whatever prefix the inherited environment points at (toolchain dirs on
+// Fly machines, the desktop app bundle on Mac). Returns null when the root is
+// not a global-install layout (e.g. a repo checkout).
+function globalPrefixForPackageRoot(packageRoot = PACKAGE_ROOT) {
+  const root = path.resolve(packageRoot);
+  const nodeModules = path.dirname(root);
+  if (path.basename(nodeModules) !== 'node_modules') return null;
+  const parent = path.dirname(nodeModules);
+  return path.basename(parent) === 'lib' ? path.dirname(parent) : parent;
+}
+
+function packageVersionOnDisk(packageRoot = PACKAGE_ROOT) {
+  try {
+    const raw = fs.readFileSync(path.join(path.resolve(packageRoot), 'package.json'), 'utf8');
+    return JSON.parse(raw).version || null;
+  } catch {
+    return null;
+  }
+}
+
+function npmInstallArgs(tag, options = {}) {
+  const args = ['install', '-g', `amalgm@${tag}`];
+  const prefix = options.npmPrefix !== undefined
+    ? options.npmPrefix
+    : globalPrefixForPackageRoot(options.packageRoot);
+  // The --prefix flag outranks every npm config layer, including an inherited
+  // npm_config_prefix pointing at a tree this process does not run from.
+  if (prefix) args.push('--prefix', prefix);
+  return args;
+}
+
 function npmInstallTag(options = {}) {
   const explicit = options.tag || options.channel;
   if (explicit && explicit !== true) return String(explicit).replace(/^@/, '');
@@ -157,7 +195,7 @@ async function npmPackageVersionForTag(tag, options = {}) {
 }
 
 async function installNpmPackageTag(tag, options = {}) {
-  const result = await runNpm(['install', '-g', `amalgm@${tag}`], {
+  const result = await runNpm(npmInstallArgs(tag, options), {
     timeoutMs: options.timeoutMs || DEFAULT_INSTALL_TIMEOUT_MS,
     env: options.env,
     onOutput: options.onOutput,
@@ -187,6 +225,18 @@ async function updatePackage(options = {}) {
   const check = options.check || await checkForUpdate(options);
   if (!check.updateAvailable) return { ...check, updated: false };
   await installNpmPackageTag(check.tag, options);
+  const packageRoot = path.resolve(options.packageRoot || PACKAGE_ROOT);
+  const diskVersion = packageVersionOnDisk(packageRoot);
+  if (diskVersion !== check.targetVersion) {
+    const error = new Error(
+      `npm reported installing amalgm@${check.tag} (${check.targetVersion}), but the install this runtime boots from at ${packageRoot} still carries ${diskVersion || 'no readable version'}. The update landed in a different npm prefix and will never take effect here.`,
+    );
+    error.code = UPDATE_TARGET_MISMATCH;
+    error.targetVersion = check.targetVersion;
+    error.installedVersion = diskVersion;
+    error.packageRoot = packageRoot;
+    throw error;
+  }
   return { ...check, updated: true };
 }
 
@@ -211,14 +261,18 @@ module.exports = {
   _test: {
     npmCommand,
     npmEnv,
+    npmInstallArgs,
     npmSpawnOptions,
   },
+  UPDATE_TARGET_MISMATCH,
   checkForUpdate,
   compareVersions,
   envDisablesAutoUpdate,
+  globalPrefixForPackageRoot,
   installNpmPackageTag,
   npmInstallTag,
   npmPackageVersionForTag,
+  packageVersionOnDisk,
   parseSemver,
   shouldAutoUpdate,
   updatePackage,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.166",
+  "version": "0.1.168",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,

package/runtime/scripts/amalgm-mcp/state/presence.js

@@ -11,8 +11,9 @@
  * a doc byte must outlive everything.
  *
  * Ownership rules the wire shape enforces:
- *  - Identity is stamped HERE from the enrolled account (workspace/identity),
- *    never accepted from the publisher. A blob cannot impersonate.
+ *  - The stable account id is stamped here from enrollment, never accepted
+ *    from the publisher. Cross-account display identity is authenticated and
+ *    added by the gateway, then passed through this state unchanged.
  *  - The blob is opaque. Only the surface bound to the same resource on the
  *    other end knows its coordinate system (text caret, canvas x,y, nothing).
  *  - Absence is the default presence must re-earn: entries live TTL_MS from
@@ -63,6 +64,7 @@ function peersOf(resource) {
   return peers ? Array.from(peers.values(), (peer) => ({
     session: peer.session,
     user: peer.user,
+    ...(peer.identity ? { identity: peer.identity } : {}),
     blob: peer.blob,
     at: peer.at,
     activeAt: peer.activeAt,
@@ -223,6 +225,7 @@ function replaceCloudPresence(input) {
     peers.set(peer.session, {
       session: peer.session,
       user: peer.user,
+      ...(peer.identity && typeof peer.identity === 'object' ? { identity: peer.identity } : {}),
       blob: peer.blob ?? null,
       at: Number(peer.at) || now,
       activeAt: Number(peer.activeAt) || now,

package/runtime/scripts/amalgm-mcp/tests/shared-presence-tunnel.test.js

@@ -77,6 +77,7 @@ test('the runtime tunnel bridges presence in both directions without a durable q
       peers: [{
         session: 'ps_direct',
         user: 'direct-user',
+        identity: { name: 'Direct Person', avatarUrl: 'https://example.com/direct.png' },
         blob: { anchor: 8 },
         at: 20,
         activeAt: 20,
@@ -92,6 +93,7 @@ test('the runtime tunnel bridges presence in both directions without a durable q
       peers: [{
         session: 'ps_direct',
         user: 'direct-user',
+        identity: { name: 'Direct Person', avatarUrl: 'https://example.com/direct.png' },
         blob: { anchor: 8 },
         at: 20,
         activeAt: 20,

package/runtime/scripts/amalgm-mcp/tests/state-presence.test.js

@@ -165,11 +165,22 @@ test('shared presence forwards local facts, merges cloud peers, and clears them
     resource: localResource,
     peers: [
       { session: 'ps_local', user: 'official-local', blob: null, at: 10, activeAt: 10 },
-      { session: 'ps_remote', user: 'remote-user', blob: { anchor: 9 }, at: 11, activeAt: 11 },
+      {
+        session: 'ps_remote',
+        user: 'remote-user',
+        identity: { name: 'Remote Person', avatarUrl: 'https://example.com/remote.png' },
+        blob: { anchor: 9 },
+        at: 11,
+        activeAt: 11,
+      },
     ],
   });
   assert.equal(publishes.length, 1, 'an inbound cloud roster never echoes back upstream');
   assert.deepEqual(frames.at(-1).peers.map((peer) => peer.session).sort(), ['ps_local', 'ps_remote']);
+  assert.deepEqual(
+    frames.at(-1).peers.find((peer) => peer.session === 'ps_remote').identity,
+    { name: 'Remote Person', avatarUrl: 'https://example.com/remote.png' },
+  );
 
   await sharedRest.handleReplicaRevoked(
     { resourceId: cloudResourceId, reason: 'access-removed' },