amalgm 0.1.46 → 0.1.48

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.46",
+  "version": "0.1.48",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,

package/runtime/scripts/amalgm-mcp/agents/hooks.js

@@ -0,0 +1,182 @@
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const PHASE_BY_NATIVE_EVENT = {
+  UserPromptSubmit: 'userSubmit',
+  UserSubmit: 'userSubmit',
+  userSubmit: 'userSubmit',
+  Stop: 'responseComplete',
+  ResponseComplete: 'responseComplete',
+  responseComplete: 'responseComplete',
+};
+
+function readJson(filePath) {
+  try {
+    return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function compactCommand(command) {
+  const trimmed = String(command || '').trim();
+  if (!trimmed) return '';
+  const home = os.homedir();
+  return home ? trimmed.replaceAll(home, '~') : trimmed;
+}
+
+function commandLabel(command) {
+  const compact = compactCommand(command);
+  if (!compact) return 'Hook';
+  const parts = compact.split(/\s+/);
+  const script = parts.find((part) => /[./][^ ]+\.(?:js|mjs|cjs|sh|py|ts)$/i.test(part));
+  return script ? path.basename(script) : compact;
+}
+
+function appendHook(acc, sourcePath, harnessId, event, command, matcher, options = {}) {
+  const cleanCommand = String(command || '').trim();
+  if (!cleanCommand) return;
+  const phase = PHASE_BY_NATIVE_EVENT[event] || event;
+  const timeout = Number(options.timeout);
+  acc.push({
+    id: `${harnessId}:${sourcePath}:${event}:${acc.length}`,
+    harnessId,
+    source: 'native',
+    sourcePath,
+    event,
+    phase,
+    type: typeof options.type === 'string' && options.type.trim() ? options.type.trim() : 'command',
+    command: cleanCommand,
+    label: commandLabel(cleanCommand),
+    matcher: typeof matcher === 'string' ? matcher : '',
+    ...(Number.isFinite(timeout) ? { timeout } : {}),
+    ...(typeof options.statusMessage === 'string' && options.statusMessage.trim()
+      ? { statusMessage: options.statusMessage.trim() }
+      : {}),
+    enabled: true,
+  });
+}
+
+function isHookEventName(event) {
+  const clean = String(event || '').trim();
+  return Boolean(
+    PHASE_BY_NATIVE_EVENT[clean]
+    || /(?:prompt|submit|response|complete|stop|hook)/i.test(clean),
+  );
+}
+
+function hasCommandShape(value) {
+  return !!value
+    && typeof value === 'object'
+    && !Array.isArray(value)
+    && (
+      typeof value.command === 'string'
+      || typeof value.event === 'string'
+      || Array.isArray(value.hooks)
+    );
+}
+
+function extractCommands(value, context, acc) {
+  if (typeof value === 'string') {
+    if (!isHookEventName(context.event)) return;
+    appendHook(acc, context.sourcePath, context.harnessId, context.event, value, context.matcher);
+    return;
+  }
+
+  if (Array.isArray(value)) {
+    for (const item of value) extractCommands(item, context, acc);
+    return;
+  }
+
+  if (!value || typeof value !== 'object') return;
+
+  const matcher = typeof value.matcher === 'string' ? value.matcher : context.matcher;
+  const event = typeof value.event === 'string' ? value.event : context.event;
+  if (typeof value.command === 'string') {
+    appendHook(acc, context.sourcePath, context.harnessId, event, value.command, matcher, value);
+  }
+  if (Array.isArray(value.hooks)) {
+    for (const hook of value.hooks) extractCommands(hook, { ...context, event, matcher }, acc);
+  }
+}
+
+function hooksFromObject(rawHooks, context) {
+  const hooks = [];
+  if (Array.isArray(rawHooks)) {
+    extractCommands(rawHooks, context, hooks);
+    return hooks;
+  }
+  if (!rawHooks || typeof rawHooks !== 'object') return hooks;
+
+  if (Array.isArray(rawHooks.hooks)) {
+    extractCommands(rawHooks.hooks, context, hooks);
+  } else if (rawHooks.hooks && typeof rawHooks.hooks === 'object') {
+    hooks.push(...hooksFromObject(rawHooks.hooks, context));
+  }
+
+  for (const [event, value] of Object.entries(rawHooks)) {
+    if (event === 'hooks') continue;
+    if (!isHookEventName(event) && !hasCommandShape(value) && !Array.isArray(value)) continue;
+    extractCommands(value, { ...context, event }, hooks);
+  }
+  return hooks;
+}
+
+function collectCodexHooks(homeDir) {
+  const sourcePath = path.join(homeDir, '.codex', 'hooks.json');
+  const data = readJson(sourcePath);
+  const hooks = hooksFromObject(data?.hooks ?? data, {
+    harnessId: 'codex',
+    sourcePath,
+    event: '',
+    matcher: '',
+  });
+  return {
+    harnessId: 'codex',
+    sources: fs.existsSync(sourcePath) ? [sourcePath] : [],
+    hooks,
+  };
+}
+
+function collectClaudeHooks(homeDir) {
+  const sourcePaths = [
+    path.join(homeDir, '.claude', 'settings.json'),
+    path.join(homeDir, '.claude', 'settings.local.json'),
+    path.join(homeDir, '.claude.json'),
+  ];
+  const hooks = [];
+  const sources = [];
+
+  for (const sourcePath of sourcePaths) {
+    const data = readJson(sourcePath);
+    if (!data) continue;
+    sources.push(sourcePath);
+    hooks.push(...hooksFromObject(data.hooks, {
+      harnessId: 'claude_code',
+      sourcePath,
+      event: '',
+      matcher: '',
+    }));
+  }
+
+  return {
+    harnessId: 'claude_code',
+    sources,
+    hooks,
+  };
+}
+
+function collectNativeHooks() {
+  const homeDir = os.homedir();
+  return {
+    codex: collectCodexHooks(homeDir),
+    claude_code: collectClaudeHooks(homeDir),
+  };
+}
+
+module.exports = {
+  collectNativeHooks,
+};

package/runtime/scripts/amalgm-mcp/agents/rest.js

@@ -9,6 +9,7 @@ const {
   resolveAgent,
   updateAgent,
 } = require('./store');
+const { hydrateModelPreferences } = require('../lib/prefs');
 const credentialAdapter = require('../../credential-adapter');
 
 function coerceAuthMethodForHarness(harnessId, authMethod) {
@@ -50,6 +51,7 @@ function normalizeToolConfig(tools, legacyMcp) {
 }
 
 async function handleList(sendJson) {
+  await hydrateModelPreferences();
   sendJson(200, { agents: getAllAgentsWithBuiltins() });
 }
 
@@ -112,8 +114,11 @@ async function handleUpdate(body, sendJson) {
   const existing = resolveAgent(agent_id);
   if (!existing) return sendJson(404, { error: `Agent not found: ${agent_id}` });
 
+  const targetHarnessId = updates.baseHarnessId || existing.baseHarnessId;
   if (updates.authMethod !== undefined) {
-    updates.authMethod = coerceAuthMethodForHarness(existing.baseHarnessId, updates.authMethod);
+    updates.authMethod = coerceAuthMethodForHarness(targetHarnessId, updates.authMethod);
+  } else if (updates.baseHarnessId !== undefined) {
+    updates.authMethod = coerceAuthMethodForHarness(targetHarnessId, existing.authMethod);
   }
 
   let agent;

package/runtime/scripts/amalgm-mcp/agents/store.js

@@ -2,12 +2,12 @@
  * Agents storage — SQLite-backed local agent registry + conversation logs.
  *
  * The registry is the Local Live Store source of truth for agent capabilities.
- * Built-in harnesses are seeded as non-deletable rows. Custom agents are rows
- * in the same table, so discovery, snapshots, and agent-to-agent lookup use one
- * shape.
+ * Default harness agents are seeded as normal rows. User-created and default
+ * agents use the same editable/deletable shape.
  */
 
 const crypto = require('crypto');
+const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const {
@@ -25,10 +25,13 @@ const {
 } = require('../lib/storage');
 const { openLocalDb } = require('../state/db');
 const { insertStateEvent, publishStateEvent } = require('../state/events');
+const { getPreferredAuthMethod } = require('../lib/prefs');
+const credentialAdapter = require('../../credential-adapter');
 
 const DEFAULT_AGENT_STATUS = 'unknown';
 const CUSTOM_AGENT_STATUS = 'ready';
 const BUILTIN_AGENT_IDS = ['claude_code', 'codex', 'opencode', 'pi'];
+const DEFAULT_AGENTS_SEEDED_FILE = path.join(STORAGE_DIR, '.default-agents-seeded');
 const AMALGM_COMPUTER_ID = process.env.AMALGM_COMPUTER_ID || '';
 
 const BUILTIN_AGENT_BLUEPRINTS = [
@@ -76,9 +79,9 @@ const BUILTIN_AGENTS = BUILTIN_AGENT_BLUEPRINTS.map((agent) => ({
   nativeMcps: [],
   tools: { mode: 'all', selectedToolIds: [] },
   mcp: { inheritAll: true, customServers: [], appIds: [], nativeMcps: [] },
-  builtin: true,
-  deletable: false,
-  editable: false,
+  builtin: false,
+  deletable: true,
+  editable: true,
   status: DEFAULT_AGENT_STATUS,
 }));
 
@@ -133,6 +136,26 @@ function computerName() {
     || 'This computer';
 }
 
+function persistedAuthMethod(baseHarnessId) {
+  const localFallback = typeof credentialAdapter.getPersistedAuthMode === 'function'
+    ? credentialAdapter.getPersistedAuthMode(baseHarnessId)
+    : 'amalgm';
+  if (typeof getPreferredAuthMethod === 'function') {
+    return getPreferredAuthMethod(baseHarnessId, localFallback);
+  }
+  return localFallback;
+}
+
+function defaultAgentAuthMethod(baseHarnessId, existing) {
+  const persisted = persistedAuthMethod(baseHarnessId);
+  const existingAuth = nonEmptyString(existing?.authMethod);
+  if (!existingAuth) return persisted;
+  if (existingAuth === 'amalgm' && persisted && persisted !== 'amalgm') {
+    return persisted;
+  }
+  return existingAuth;
+}
+
 function normalizeLocation(inputLocation, fallback = {}) {
   const id = nonEmptyString(fallback.ownerComputerId) || computerId();
   const name = nonEmptyString(fallback.locationName) || computerName();
@@ -195,7 +218,7 @@ function normalizeToolConfig(tools, legacyMcp) {
 function normalizeAgent(input, existing) {
   if (!isObject(input)) throw new Error('agent must be an object');
   const id = nonEmptyString(input.id) || `custom-${crypto.randomUUID()}`;
-  const builtin = input.builtin === true || BUILTIN_AGENT_IDS.includes(id);
+  const builtin = input.builtin === true;
   const baseHarnessId = nonEmptyString(input.baseHarnessId || input.base_harness_id) || id;
   const adapter = nonEmptyString(input.adapter) || baseHarnessId;
   const mcpConfig = normalizeMcpConfig(input.mcp, input.mcpAppIds, input.nativeMcps);
@@ -227,7 +250,7 @@ function normalizeAgent(input, existing) {
       ...mcpConfig,
       inheritAll: toolConfig.mode !== 'selected',
     },
-    authMethod: input.authMethod || existing?.authMethod || 'amalgm',
+    authMethod: input.authMethod || existing?.authMethod || persistedAuthMethod(baseHarnessId),
     location,
     locationName: locationLabel(location),
     ownerComputerId,
@@ -238,8 +261,8 @@ function normalizeAgent(input, existing) {
       ? { ...defaultCapabilities({ tools: toolConfig }), ...input.capabilities }
       : defaultCapabilities({ tools: toolConfig }),
     builtin,
-    deletable: input.deletable === false || builtin ? false : true,
-    editable: input.editable === false || builtin ? false : true,
+    deletable: input.deletable === false ? false : true,
+    editable: input.editable === false ? false : true,
     createdAt,
     updatedAt,
     ...(input.configDir ? { configDir: input.configDir } : existing?.configDir ? { configDir: existing.configDir } : {}),
@@ -351,7 +374,6 @@ function writeAgentsJson(customAgents) {
 function readCustomAgentsFromDb(db = openLocalDb()) {
   return db.prepare(`
     SELECT * FROM agents
-    WHERE builtin = 0
     ORDER BY updated_at DESC, id ASC
   `).all()
     .map(rowToAgent)
@@ -372,29 +394,36 @@ function customAgentRowCount(db = openLocalDb()) {
 
 function seedBuiltinAgents(options = {}) {
   const db = openLocalDb();
+  const alreadySeeded = fs.existsSync(DEFAULT_AGENTS_SEEDED_FILE);
   const events = db.transaction(() => {
     const inserted = [];
     for (const blueprint of BUILTIN_AGENT_BLUEPRINTS) {
       const existing = readAgentRow(db, blueprint.id);
+      if (!existing && alreadySeeded) continue;
       const next = normalizeAgent({
         ...blueprint,
-        systemPrompt: '',
-        files: [],
-        skills: [],
-        mcpAppIds: [],
-        nativeMcps: [],
-        tools: { mode: 'all', selectedToolIds: [] },
-        mcp: { inheritAll: true, customServers: [], appIds: [], nativeMcps: [] },
-        builtin: true,
-        deletable: false,
-        editable: false,
+        name: existing?.name || blueprint.name,
+        description: existing?.description ?? blueprint.description,
+        adapter: existing?.adapter || blueprint.adapter,
+        baseHarnessId: existing?.baseHarnessId || blueprint.baseHarnessId,
+        baseModelId: existing?.baseModelId || blueprint.baseModelId,
+        systemPrompt: existing?.systemPrompt || '',
+        files: existing?.files || [],
+        skills: existing?.skills || [],
+        mcpAppIds: existing?.mcpAppIds || [],
+        nativeMcps: existing?.nativeMcps || [],
+        tools: existing?.tools || { mode: 'all', selectedToolIds: [] },
+        mcp: existing?.mcp || { inheritAll: true, customServers: [], appIds: [], nativeMcps: [] },
+        builtin: false,
+        deletable: true,
+        editable: true,
         status: existing?.status || DEFAULT_AGENT_STATUS,
         installStatus: existing?.installStatus || 'unknown',
         authStatus: existing?.authStatus || 'unknown',
         authDetails: existing?.authDetails,
         configDir: existing?.configDir,
         createdAt: existing?.createdAt,
-        authMethod: existing?.authMethod || 'amalgm',
+        authMethod: defaultAgentAuthMethod(existing?.baseHarnessId || blueprint.baseHarnessId, existing),
       }, existing);
       if (existing && agentsEqualForWrite(existing, next)) continue;
       upsertAgentRow(db, next);
@@ -406,13 +435,17 @@ function seedBuiltinAgents(options = {}) {
     }
     return inserted;
   })();
+  try {
+    ensureDir(STORAGE_DIR);
+    fs.writeFileSync(DEFAULT_AGENTS_SEEDED_FILE, nowIso());
+  } catch {
+    // Best-effort marker; default seeding still works without it.
+  }
   publishEvents(events);
 }
 
 function migrateLegacyAgentsJsonIfNeeded() {
   const db = openLocalDb();
-  if (customAgentRowCount(db) > 0) return;
-
   const legacy = readJson(AGENTS_FILE, { version: 1, agents: [] });
   const legacyAgents = Array.isArray(legacy?.agents) ? legacy.agents : [];
   if (legacyAgents.length === 0) return;
@@ -421,6 +454,7 @@ function migrateLegacyAgentsJsonIfNeeded() {
     for (const agent of legacyAgents) {
       const normalized = normalizeAgent(agent, null);
       if (normalized.builtin) continue;
+      if (readAgentRow(db, normalized.id)) continue;
       upsertAgentRow(db, normalized);
     }
   })();
@@ -523,10 +557,6 @@ function updateAgent(agentId, updates, options = {}) {
   const db = openLocalDb();
   const existing = readAgentRow(db, agentId);
   if (!existing) throw new Error(`Agent not found: ${agentId}`);
-  if (existing.builtin && options.allowBuiltinUpdate !== true) {
-    throw new Error(`Built-in agent "${existing.name}" cannot be edited`);
-  }
-
   const requestedName = nonEmptyString(updates?.name);
   if (requestedName) {
     const duplicate = getAllAgentsWithBuiltins()
@@ -569,12 +599,12 @@ function deleteAgent(agentId, options = {}) {
   const db = openLocalDb();
   const existing = readAgentRow(db, agentId);
   if (!existing) throw new Error(`Agent not found: ${agentId}`);
-  if (existing.builtin || existing.deletable === false) {
-    throw new Error(`Built-in agent "${existing.name}" cannot be deleted`);
+  if (existing.deletable === false) {
+    throw new Error(`Agent "${existing.name}" cannot be deleted`);
   }
 
   const event = db.transaction(() => {
-    db.prepare('DELETE FROM agents WHERE id = ? AND builtin = 0').run(agentId);
+    db.prepare('DELETE FROM agents WHERE id = ?').run(agentId);
     return insertAgentEvent(db, 'delete', existing, {
       source: options.source || 'agents:delete',
     });

package/runtime/scripts/amalgm-mcp/agents/talk.js

@@ -14,7 +14,7 @@ const crypto = require('crypto');
 const path = require('path');
 const os = require('os');
 
-const { AMALGM_COMPUTER_ID, AMALGM_USER_ID, DEFAULT_CWD, STORAGE_DIR } = require('../config');
+const { AMALGM_USER_ID, DEFAULT_CWD, STORAGE_DIR } = require('../config');
 const { runThroughChatServer } = require('../lib/chat-runner');
 const {
   hasSupabase,
@@ -31,11 +31,7 @@ const {
 } = require('../lib/prefs');
 const { textResult, errorResult } = require('../lib/tool-result');
 const { ensureDir } = require('../lib/storage');
-const {
-  appendAgentConvoLog,
-  normalizeConversationId,
-  resolveAgentByNameOrId,
-} = require('./store');
+const { appendAgentConvoLog, normalizeConversationId, resolveAgentByNameOrId } = require('./store');
 const {
   chatInputToLegacyFields,
   getChatInputText,
@@ -465,8 +461,6 @@ async function deliverResponseToCallerSession({
     callerResponseDelivered: true,
     callerResponseDeliveredAt: deliveredAt,
     callerResponseTarget: targetSessionId,
-    callerResponseText: messageText,
-    callerResponseDescription: description || null,
   });
   appendStatusLog(sourceSessionId, 'caller_response_delivered', {
     targetConversationId: targetSessionId,
@@ -537,6 +531,7 @@ async function handleTalkToAgent(args, context = {}) {
       `Agent not found: ${agentLookup}. Use agents_list to see available agents.`,
     );
   }
+
   const isNewConversation = !normalizedConversationId;
   const sessionId = normalizedConversationId || crypto.randomUUID();
   const userMessageId = crypto.randomUUID();
@@ -552,10 +547,13 @@ async function handleTalkToAgent(args, context = {}) {
   const persistedAuthMethod = credentialAdapter.VALID_HARNESS_IDS.includes(agent.baseHarnessId)
     ? credentialAdapter.getPersistedAuthMode(agent.baseHarnessId)
     : 'amalgm';
+  const preferredAuthMethod = getPreferredAuthMethod(agent.baseHarnessId, persistedAuthMethod);
+  const isDefaultAgentClass = agent.id === agent.baseHarnessId;
   const defaultAuthMethod = coerceAuthMethodForHarness(
     agent.baseHarnessId,
-    agent.authMethod
-    || getPreferredAuthMethod(agent.baseHarnessId, persistedAuthMethod),
+    isDefaultAgentClass && agent.authMethod === 'amalgm' && preferredAuthMethod !== 'amalgm'
+      ? preferredAuthMethod
+      : agent.authMethod || preferredAuthMethod,
   );
   const agentFiles = normalizeStringList(agent.files);
   const agentSkills = normalizeStringList(agent.skills);
@@ -707,7 +705,6 @@ async function handleTalkToAgent(args, context = {}) {
       await supabaseInsert('sessions', {
         id: sessionId,
         user_id: AMALGM_USER_ID,
-        computer_id: AMALGM_COMPUTER_ID,
         container_id: os.hostname() || 'agent-conversation',
         harness: agent.id,
         title: taskDescription || 'New Chat',
@@ -779,7 +776,6 @@ async function handleTalkToAgent(args, context = {}) {
       chatInput: normalizedChatInput,
       prompt: legacyChatFields.prompt,
       userId: AMALGM_USER_ID,
-      computerId: AMALGM_COMPUTER_ID,
       codeSessionId: sessionId,
       assistantMessageId,
       userMessageId,
@@ -912,11 +908,8 @@ async function handleTalkToAgent(args, context = {}) {
             },
           },
         );
-        const activeAfterTurn = summarizeActiveConversation(sessionId);
-        const deliveredResponseText = String(activeAfterTurn?.callerResponseText || '').trim();
-        const finalOutputText = String(outputText || '').trim() ? outputText : deliveredResponseText;
         const warnings = [];
-        if (!String(finalOutputText || '').trim()) {
+        if (!String(outputText || '').trim()) {
           warnings.push(
             metrics?.toolEvents > 0
               ? 'Agent completed without visible text after tool activity; check the session log or workspace diff before retrying.'
@@ -933,7 +926,7 @@ async function handleTalkToAgent(args, context = {}) {
           agentName: agent.name,
           runId,
           description: taskDescription,
-          message: finalOutputText,
+          message: outputText,
           timestamp: new Date().toISOString(),
           stopReason,
           usage,
@@ -954,7 +947,7 @@ async function handleTalkToAgent(args, context = {}) {
         });
 
         console.log(
-          `[AmalgmMCP:Agent] ${agent.name} responded (${finalOutputText.length} chars, session: ${sessionId})`,
+          `[AmalgmMCP:Agent] ${agent.name} responded (${outputText.length} chars, session: ${sessionId})`,
         );
 
         if (
@@ -982,7 +975,7 @@ async function handleTalkToAgent(args, context = {}) {
               status: 'completed',
               isNewConversation,
               longMessageContext,
-              outputText: finalOutputText,
+              outputText,
               stopReason,
               usage,
               metrics,
@@ -990,9 +983,6 @@ async function handleTalkToAgent(args, context = {}) {
               recovery:
                 'Use agents_get_conversation with this conversation_id if the caller times out or needs the local transcript.',
               includeMetrics,
-              extra: deliveredResponseText && !String(outputText || '').trim()
-                ? { response_source: 'return_channel' }
-                : {},
             }),
             null,
             2,

package/runtime/scripts/amalgm-mcp/agents/tools.js

@@ -26,20 +26,17 @@ module.exports = [
   {
     name: 'agents_list',
     description:
-      'List all available agents (built-in defaults + custom user-created agents). Use this to discover which agents you can talk to via talk_to_agent.',
+      'List all available agent classes. Use this to discover which agents you can talk to via talk_to_agent.',
     inputSchema: { type: 'object', properties: {} },
     async handler() {
       const all = getAllAgentsWithBuiltins();
       if (all.length === 0) return textResult('No agents available.');
       const summary = all
         .map((a) => {
-          const tag = a.builtin ? '[built-in]' : '[custom]';
-          const model = a.builtin
-            ? getSelectedModel(a.baseHarnessId) || a.baseModelId
-            : a.baseModelId ||
-              getSelectedModel(a.baseHarnessId) ||
-              DEFAULT_SELECTED_MODELS[a.baseHarnessId];
-          return `- ${a.name} (${a.id}) ${tag}\n  ${a.description || 'No description'}\n  adapter: ${a.adapter || a.baseHarnessId} | harness: ${a.baseHarnessId} | model: ${model}\n  location: ${a.locationName || a.location?.name || 'this computer'} | status: ${a.status || 'unknown'}`;
+          const model = a.baseModelId ||
+            getSelectedModel(a.baseHarnessId) ||
+            DEFAULT_SELECTED_MODELS[a.baseHarnessId];
+          return `- ${a.name} (${a.id})\n  ${a.description || 'No description'}\n  adapter: ${a.adapter || a.baseHarnessId} | harness: ${a.baseHarnessId} | model: ${model}\n  location: ${a.locationName || a.location?.name || 'this computer'} | status: ${a.status || 'unknown'}`;
         })
         .join('\n\n');
       return textResult(`Available agents:\n\n${summary}`);
@@ -63,11 +60,9 @@ module.exports = [
         description: agent.description,
         adapter: agent.adapter || agent.baseHarnessId,
         baseHarnessId: agent.baseHarnessId,
-        baseModelId: agent.builtin
-          ? getSelectedModel(agent.baseHarnessId) || agent.baseModelId
-          : agent.baseModelId ||
-            getSelectedModel(agent.baseHarnessId) ||
-            DEFAULT_SELECTED_MODELS[agent.baseHarnessId],
+        baseModelId: agent.baseModelId ||
+          getSelectedModel(agent.baseHarnessId) ||
+          DEFAULT_SELECTED_MODELS[agent.baseHarnessId],
         systemPrompt: agent.systemPrompt ? '(configured)' : '(none)',
         mcp: {
           inheritAll: agent.mcp?.inheritAll ?? true,

package/runtime/scripts/amalgm-mcp/state/snapshot.js

@@ -2,27 +2,11 @@
 
 const { currentSeq } = require('./events');
 
-const DEFAULT_RESOURCES = [
-  'tasks',
-  'event_triggers',
-  'agents',
-  'artifacts',
-  'toolbox',
-  'tools',
-  'tool_actions',
-  'projects',
-  'workspaces',
-  'memories',
-];
+const DEFAULT_RESOURCES = ['tasks', 'event_triggers', 'agents', 'artifacts', 'toolbox', 'tools', 'tool_actions', 'hooks', 'projects', 'workspaces', 'memories'];
 
 function normalizeResources(resources) {
-  if (!resources) return DEFAULT_RESOURCES;
-  const values = Array.isArray(resources)
-    ? resources
-    : String(resources).split(',');
-  const clean = values
-    .map((value) => String(value || '').trim())
-    .filter(Boolean);
+  const values = resources ? String(resources).split(',') : DEFAULT_RESOURCES;
+  const clean = values.map((value) => String(value || '').trim()).filter(Boolean);
   return clean.length > 0 ? Array.from(new Set(clean)) : DEFAULT_RESOURCES;
 }
 
@@ -36,18 +20,17 @@ function readResource(resource, cache) {
       return require('../agents/store').getAllAgentsWithBuiltins();
     case 'artifacts':
       return require('../artifacts/store').loadArtifacts().artifacts;
-    case 'toolbox': {
+    case 'toolbox':
       cache.toolbox ||= require('../toolbox/store').readToolbox();
       return cache.toolbox;
-    }
-    case 'tools': {
+    case 'tools':
       cache.toolbox ||= require('../toolbox/store').readToolbox();
       return cache.toolbox.tools;
-    }
-    case 'tool_actions': {
+    case 'tool_actions':
       cache.toolbox ||= require('../toolbox/store').readToolbox();
       return cache.toolbox.toolActions;
-    }
+    case 'hooks':
+      return require('../agents/hooks').collectNativeHooks();
     case 'projects':
     case 'workspaces': {
       const workspaceStore = require('../workspace/store');
@@ -68,37 +51,18 @@ function buildSnapshot(resourcesInput) {
     const beforeSeq = currentSeq();
     const cache = {};
     const data = {};
-
     for (const resource of resources) {
       const value = readResource(resource, cache);
       if (value !== undefined) data[resource] = value;
     }
-
     const afterSeq = currentSeq();
     if (beforeSeq === afterSeq) {
-      return {
-        seq: afterSeq,
-        stable: true,
-        resources: data,
-      };
+      return { seq: afterSeq, stable: true, resources: data };
     }
-
-    lastUnstable = {
-      seq: beforeSeq,
-      stable: false,
-      resources: data,
-    };
+    lastUnstable = { seq: beforeSeq, stable: false, resources: data };
   }
 
-  return lastUnstable || {
-    seq: currentSeq(),
-    stable: true,
-    resources: {},
-  };
+  return lastUnstable || { seq: currentSeq(), stable: true, resources: {} };
 }
 
-module.exports = {
-  DEFAULT_RESOURCES,
-  buildSnapshot,
-  normalizeResources,
-};
+module.exports = { DEFAULT_RESOURCES, buildSnapshot, normalizeResources };

package/runtime/scripts/chat-core/adapters/claude.js

@@ -8,6 +8,7 @@ const { normalizeClaudeMessage, usageRecordsFromClaudeResult, usageFromClaude }
 const { recordNativeEvent } = require('../recorder');
 const { toClaudeMcpServers } = require('../tooling/mcp-bundle');
 const { bundledClaudeBinary } = require('../tooling/native-binaries');
+const { syncNativeHarnessConfig } = require('../tooling/native-config');
 const { importPackage } = require('../tooling/package-import');
 const { composeSystemPrompt } = require('../tooling/system-prompt');
 
@@ -31,6 +32,7 @@ class ClaudeAdapter {
   }
 
   options(contract, extra = {}) {
+    syncNativeHarnessConfig(contract);
     const systemPrompt = composeSystemPrompt(contract);
     const pathToClaudeCodeExecutable = process.env.CLAUDE_CODE_BINARY || bundledClaudeBinary();
     return {
@@ -47,7 +49,7 @@ class ClaudeAdapter {
       ...(process.env.CHAT_CORE_DEBUG_CLAUDE === '1'
         ? { debug: true, debugFile: path.join(contract.auth.runtimeHome || process.cwd(), 'claude-debug.log') }
         : {}),
-      settingSources: [],
+      settingSources: ['user', 'project', 'local'],
       strictMcpConfig: false,
       ...extra,
     };

package/runtime/scripts/chat-core/adapters/codex.js

@@ -9,8 +9,9 @@ const { promptText } = require('../input');
 const { runtimeEnv } = require('../auth');
 const { codexErrorMessage, normalizeCodexNotification } = require('../normalizers/codex');
 const { recordNativeEvent } = require('../recorder');
-const { toCodexMcpToml } = require('../tooling/mcp-bundle');
+const { relayedMcpServers, toCodexMcpToml } = require('../tooling/mcp-bundle');
 const { bundledCodexBinary, bundledCodexPathDirs, executableExists } = require('../tooling/native-binaries');
+const { syncCodexNativeConfig } = require('../tooling/native-config');
 const { composeSystemPrompt } = require('../tooling/system-prompt');
 
 class JsonLineRpc {
@@ -176,11 +177,167 @@ function isCompactCommand(text) {
   return String(text || '').trim().toLowerCase() === '/compact';
 }
 
+function readTextFile(file) {
+  try {
+    return fs.readFileSync(file, 'utf8');
+  } catch {
+    return '';
+  }
+}
+
+function tomlSectionName(line) {
+  const match = String(line || '').match(/^\s*\[([^\]]+)\]\s*$/);
+  return match ? match[1].trim() : null;
+}
+
+function removeTopLevelKeys(toml, keys) {
+  const remove = new Set(keys);
+  let inTopLevel = true;
+  return String(toml || '')
+    .split(/\r?\n/)
+    .filter((line) => {
+      if (tomlSectionName(line)) inTopLevel = false;
+      if (!inTopLevel) return true;
+      const match = line.match(/^\s*([A-Za-z0-9_-]+)\s*=/);
+      return !match || !remove.has(match[1]);
+    })
+    .join('\n');
+}
+
+function removeTomlSections(toml, sectionNames) {
+  const remove = new Set(sectionNames);
+  let skipping = false;
+  const out = [];
+  for (const line of String(toml || '').split(/\r?\n/)) {
+    const section = tomlSectionName(line);
+    if (section) {
+      skipping = [...remove].some((name) => section === name || section.startsWith(`${name}.`));
+    }
+    if (!skipping) out.push(line);
+  }
+  return out.join('\n');
+}
+
+function ensureFeatureBoolean(toml, key, value) {
+  const lines = String(toml || '').split(/\r?\n/);
+  const sectionIndex = lines.findIndex((line) => tomlSectionName(line) === 'features');
+  const rendered = `${key} = ${value ? 'true' : 'false'}`;
+  if (sectionIndex === -1) {
+    return `${String(toml || '').trimEnd()}\n\n[features]\n${rendered}\n`;
+  }
+  let insertAt = lines.length;
+  for (let i = sectionIndex + 1; i < lines.length; i += 1) {
+    if (tomlSectionName(lines[i])) {
+      insertAt = i;
+      break;
+    }
+    if (new RegExp(`^\\s*${key}\\s*=`).test(lines[i])) {
+      lines[i] = rendered;
+      return lines.join('\n');
+    }
+  }
+  lines.splice(insertAt, 0, rendered);
+  return lines.join('\n');
+}
+
+function tomlQuoted(value) {
+  return JSON.stringify(String(value || ''));
+}
+
+function hookTrustBlocks(toml) {
+  const lines = String(toml || '').split(/\r?\n/);
+  const blocks = [];
+  for (let i = 0; i < lines.length; i += 1) {
+    const section = tomlSectionName(lines[i]);
+    const match = section?.match(/^hooks\.state\."([^"]+)"$/);
+    if (!match) continue;
+    let end = lines.length;
+    for (let j = i + 1; j < lines.length; j += 1) {
+      if (tomlSectionName(lines[j])) {
+        end = j;
+        break;
+      }
+    }
+    blocks.push({ key: match[1], lines: lines.slice(i, end) });
+  }
+  return blocks;
+}
+
+function mirrorCodexHookTrust(toml, sourceDir, runtimeHome) {
+  if (!sourceDir || !runtimeHome) return toml;
+  const sourceHookPrefix = `${path.join(sourceDir, 'hooks.json')}:`;
+  const runtimePrefixes = [
+    `${path.join(runtimeHome, 'hooks.json')}:`,
+    `${path.join(runtimeHome, '.codex', 'hooks.json')}:`,
+  ];
+  const blocks = hookTrustBlocks(toml);
+  if (blocks.length === 0) return toml;
+  const existing = new Set(blocks.map((block) => block.key));
+  const additions = [];
+  for (const block of blocks) {
+    if (!block.key.startsWith(sourceHookPrefix)) continue;
+    const suffix = block.key.slice(sourceHookPrefix.length);
+    for (const prefix of runtimePrefixes) {
+      const nextKey = `${prefix}${suffix}`;
+      if (existing.has(nextKey)) continue;
+      existing.add(nextKey);
+      const lines = [...block.lines];
+      lines[0] = `[hooks.state.${tomlQuoted(nextKey)}]`;
+      additions.push(lines.join('\n'));
+    }
+  }
+  if (additions.length === 0) return toml;
+  const parent = /\n\s*\[hooks\.state\]\s*(?:\n|$)/.test(`\n${toml}`) ? '' : '\n[hooks.state]\n';
+  return `${String(toml || '').trimEnd()}${parent}\n${additions.join('\n\n')}\n`;
+}
+
+function generatedMcpSectionNames(contract) {
+  return relayedMcpServers(contract).map((server) => `mcp_servers.${server.name}`);
+}
+
+function buildCodexConfig(contract, existingConfig, syncInfo) {
+  const mcpToml = toCodexMcpToml(contract);
+  const topLevelKeys = [
+    ...(contract.authMethod === 'provider_auth' ? [] : ['model_provider']),
+    ...(contract.authMethod === 'amalgm' ? ['model_context_window', 'model_auto_compact_token_limit'] : []),
+  ];
+  let config = removeTopLevelKeys(existingConfig, topLevelKeys);
+  config = removeTomlSections(config, [
+    ...(contract.authMethod === 'amalgm' ? ['model_providers.amalgm'] : []),
+    ...generatedMcpSectionNames(contract),
+  ]);
+  config = mirrorCodexHookTrust(config, syncInfo?.sourceDir, contract.auth.runtimeHome);
+  if (fs.existsSync(path.join(contract.auth.runtimeHome, 'hooks.json'))) {
+    config = ensureFeatureBoolean(config, 'codex_hooks', true);
+  }
+  const generated = contract.authMethod === 'amalgm'
+    ? [
+        'model_provider = "amalgm"',
+        ...modelWindowConfigLines(contract),
+        '',
+        '[model_providers.amalgm]',
+        'name = "amalgm"',
+        `base_url = "${contract.auth.baseUrl}"`,
+        'env_key = "OPENAI_API_KEY"',
+        'wire_api = "responses"',
+        'requires_openai_auth = false',
+      ].join('\n')
+    : contract.authMethod === 'byok'
+      ? 'model_provider = "openai"'
+      : '';
+  return [
+    generated.trimEnd(),
+    String(config || '').trim(),
+    String(mcpToml || '').trim(),
+  ].filter(Boolean).join('\n\n') + '\n';
+}
+
 function writeConfig(contract) {
   const home = contract.auth.runtimeHome;
   if (!home) return;
   fs.mkdirSync(home, { recursive: true });
-  const mcpToml = toCodexMcpToml(contract);
+  const syncInfo = syncCodexNativeConfig(home);
+  const configPath = path.join(home, 'config.toml');
   if (contract.authMethod === 'provider_auth') {
     const sourceAuth = path.join(os.homedir(), '.codex', 'auth.json');
     const targetAuth = path.join(home, 'auth.json');
@@ -188,34 +345,10 @@ function writeConfig(contract) {
       fs.copyFileSync(sourceAuth, targetAuth);
       fs.chmodSync(targetAuth, 0o600);
     }
-    fs.writeFileSync(path.join(home, 'config.toml'), [
-      'model_provider = "openai"',
-      '',
-      mcpToml,
-    ].join('\n'), { mode: 0o600 });
+    fs.writeFileSync(configPath, buildCodexConfig(contract, readTextFile(configPath), syncInfo), { mode: 0o600 });
     return;
   }
-  if (contract.authMethod === 'amalgm') {
-    fs.writeFileSync(path.join(home, 'config.toml'), [
-      'model_provider = "amalgm"',
-      ...modelWindowConfigLines(contract),
-      '',
-      '[model_providers.amalgm]',
-      'name = "amalgm"',
-      `base_url = "${contract.auth.baseUrl}"`,
-      'env_key = "OPENAI_API_KEY"',
-      'wire_api = "responses"',
-      'requires_openai_auth = false',
-      '',
-      mcpToml,
-    ].join('\n'), { mode: 0o600 });
-  } else {
-    fs.writeFileSync(path.join(home, 'config.toml'), [
-      'model_provider = "openai"',
-      '',
-      mcpToml,
-    ].join('\n'), { mode: 0o600 });
-  }
+  fs.writeFileSync(configPath, buildCodexConfig(contract, readTextFile(configPath), syncInfo), { mode: 0o600 });
   fs.writeFileSync(path.join(home, 'auth.json'), JSON.stringify({
     auth_mode: 'apikey',
     OPENAI_API_KEY: contract.auth.tokenRef,
@@ -350,4 +483,15 @@ class CodexAdapter {
   }
 }
 
-module.exports = { CodexAdapter, __private: { modelWindowConfigLines, writeConfig } };
+module.exports = {
+  CodexAdapter,
+  __private: {
+    buildCodexConfig,
+    ensureFeatureBoolean,
+    mirrorCodexHookTrust,
+    modelWindowConfigLines,
+    removeTomlSections,
+    removeTopLevelKeys,
+    writeConfig,
+  },
+};

package/runtime/scripts/chat-core/auth.js

@@ -70,6 +70,8 @@ function coerceAuth(harness, requested) {
 }
 
 function runtimeHome({ amalgmDir, sessionId, harness, authMethod, tokenFingerprint }) {
+  // Claude Code provider auth is tied to the user's real home/keychain context.
+  // Isolating HOME makes the bundled Claude binary look logged out on macOS.
   if (authMethod === 'provider_auth' && harness !== 'codex') return null;
   const suffix = tokenFingerprint || 'default';
   return path.join(amalgmDir, 'runtime', sessionId, harness, suffix);

package/runtime/scripts/chat-core/tests/auth.test.js

@@ -0,0 +1,42 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const test = require('node:test');
+const { authEnvelope, runtimeEnv } = require('../auth');
+
+test('claude provider auth keeps the user home environment', () => {
+  const envelope = authEnvelope({
+    harness: 'claude_code',
+    authMethod: 'provider_auth',
+    sessionId: 'session-test',
+    amalgmDir: '/tmp/amalgm-test',
+  });
+
+  assert.equal(envelope.runtimeHome, null);
+
+  const env = runtimeEnv({
+    harness: 'claude_code',
+    authMethod: 'provider_auth',
+    auth: envelope,
+  }, {
+    HOME: '/Users/example',
+    PATH: '/bin',
+    CLAUDE_CONFIG_DIR: '/Users/example/.claude',
+    ANTHROPIC_API_KEY: 'should-not-leak',
+  });
+
+  assert.equal(env.HOME, '/Users/example');
+  assert.equal(env.CLAUDE_CONFIG_DIR, '/Users/example/.claude');
+  assert.equal(env.ANTHROPIC_API_KEY, undefined);
+});
+
+test('codex provider auth still receives an isolated runtime home', () => {
+  const envelope = authEnvelope({
+    harness: 'codex',
+    authMethod: 'provider_auth',
+    sessionId: 'session-test',
+    amalgmDir: '/tmp/amalgm-test',
+  });
+
+  assert.match(envelope.runtimeHome, /\/tmp\/amalgm-test\/runtime\/session-test\/codex\/[^/]+$/);
+});

package/runtime/scripts/chat-core/tooling/native-config.js

@@ -0,0 +1,133 @@
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const EXCLUDED_DIR_NAMES = new Set([
+  '.cache',
+  '.npm',
+  '.tmp',
+  'cache',
+  'log',
+  'logs',
+  'projects',
+  'sessions',
+  'shell_snapshots',
+  'tmp',
+]);
+
+const EXCLUDED_FILE_PATTERNS = [
+  /^logs?_\d+\.sqlite(?:-.+)?$/i,
+  /^state_\d+\.sqlite(?:-.+)?$/i,
+  /^.*\.db-(?:shm|wal)$/i,
+  /^.*\.sqlite-(?:shm|wal)$/i,
+];
+
+function exists(p) {
+  try {
+    fs.accessSync(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function shouldCopyConfigPath(root, source) {
+  const relative = path.relative(root, source);
+  if (!relative || relative === '.') return true;
+  const parts = relative.split(path.sep);
+  if (parts.some((part) => EXCLUDED_DIR_NAMES.has(part))) return false;
+  const basename = path.basename(source);
+  return !EXCLUDED_FILE_PATTERNS.some((pattern) => pattern.test(basename));
+}
+
+function copyConfigTree(sourceDir, targetDir) {
+  if (!sourceDir || !targetDir || !exists(sourceDir)) return false;
+  if (path.resolve(sourceDir) === path.resolve(targetDir)) return true;
+  fs.mkdirSync(targetDir, { recursive: true });
+  fs.cpSync(sourceDir, targetDir, {
+    recursive: true,
+    force: true,
+    errorOnExist: false,
+    dereference: false,
+    filter: (source) => shouldCopyConfigPath(sourceDir, source),
+  });
+  return true;
+}
+
+function copyFileIfPresent(source, target) {
+  if (!exists(source)) return false;
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.copyFileSync(source, target);
+  try {
+    fs.chmodSync(target, fs.statSync(source).mode & 0o777);
+  } catch {}
+  return true;
+}
+
+function copyIntoHomeAlias(runtimeHome, dotDirName, sourceDir) {
+  if (!runtimeHome || !dotDirName || !sourceDir || !exists(sourceDir)) return;
+  const alias = path.join(runtimeHome, dotDirName);
+  try {
+    const stat = fs.lstatSync(alias);
+    if (stat.isSymbolicLink()) {
+      const target = fs.readlinkSync(alias);
+      if (target === '.' || path.resolve(runtimeHome, target) === path.resolve(runtimeHome)) return;
+      fs.rmSync(alias, { recursive: true, force: true });
+    } else if (stat.isDirectory()) {
+      copyConfigTree(sourceDir, alias);
+      return;
+    } else {
+      fs.rmSync(alias, { recursive: true, force: true });
+    }
+  } catch {}
+  try {
+    fs.symlinkSync('.', alias, 'dir');
+  } catch {
+    copyConfigTree(sourceDir, alias);
+  }
+}
+
+function syncCodexNativeConfig(runtimeHome) {
+  if (!runtimeHome) return null;
+  const nativeHome = os.homedir();
+  const sourceDir = path.join(nativeHome, '.codex');
+  fs.mkdirSync(runtimeHome, { recursive: true });
+  const copied = copyConfigTree(sourceDir, runtimeHome);
+  copyIntoHomeAlias(runtimeHome, '.codex', sourceDir);
+  copyConfigTree(path.join(nativeHome, '.codex-supermemory'), path.join(runtimeHome, '.codex-supermemory'));
+  copyFileIfPresent(path.join(nativeHome, '.codex-supermemory.log'), path.join(runtimeHome, '.codex-supermemory.log'));
+  return copied ? { sourceDir, runtimeHome } : null;
+}
+
+function syncClaudeNativeConfig(runtimeHome) {
+  if (!runtimeHome) return null;
+  const nativeHome = os.homedir();
+  const sourceDir = path.join(nativeHome, '.claude');
+  fs.mkdirSync(runtimeHome, { recursive: true });
+  const copied = copyConfigTree(sourceDir, runtimeHome);
+  copyIntoHomeAlias(runtimeHome, '.claude', sourceDir);
+  copyFileIfPresent(path.join(nativeHome, '.claude.json'), path.join(runtimeHome, '.claude.json'));
+  copyConfigTree(path.join(nativeHome, '.config', 'claude'), path.join(runtimeHome, '.config', 'claude'));
+  return copied ? { sourceDir, runtimeHome } : null;
+}
+
+function syncNativeHarnessConfig(contract) {
+  const runtimeHome = contract?.auth?.runtimeHome;
+  if (!runtimeHome) return null;
+  if (contract.harness === 'codex') return syncCodexNativeConfig(runtimeHome);
+  if (contract.harness === 'claude_code') return syncClaudeNativeConfig(runtimeHome);
+  return null;
+}
+
+module.exports = {
+  __private: {
+    copyConfigTree,
+    copyFileIfPresent,
+    shouldCopyConfigPath,
+  },
+  syncClaudeNativeConfig,
+  syncCodexNativeConfig,
+  syncNativeHarnessConfig,
+};