amalgm 0.1.47 → 0.1.48

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.47",
+  "version": "0.1.48",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,

package/runtime/scripts/chat-core/auth.js

@@ -70,7 +70,9 @@ function coerceAuth(harness, requested) {
 }
 
 function runtimeHome({ amalgmDir, sessionId, harness, authMethod, tokenFingerprint }) {
-  if (authMethod === 'provider_auth' && !['claude_code', 'codex'].includes(harness)) return null;
+  // Claude Code provider auth is tied to the user's real home/keychain context.
+  // Isolating HOME makes the bundled Claude binary look logged out on macOS.
+  if (authMethod === 'provider_auth' && harness !== 'codex') return null;
   const suffix = tokenFingerprint || 'default';
   return path.join(amalgmDir, 'runtime', sessionId, harness, suffix);
 }

package/runtime/scripts/chat-core/tests/auth.test.js

@@ -0,0 +1,42 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const test = require('node:test');
+const { authEnvelope, runtimeEnv } = require('../auth');
+
+test('claude provider auth keeps the user home environment', () => {
+  const envelope = authEnvelope({
+    harness: 'claude_code',
+    authMethod: 'provider_auth',
+    sessionId: 'session-test',
+    amalgmDir: '/tmp/amalgm-test',
+  });
+
+  assert.equal(envelope.runtimeHome, null);
+
+  const env = runtimeEnv({
+    harness: 'claude_code',
+    authMethod: 'provider_auth',
+    auth: envelope,
+  }, {
+    HOME: '/Users/example',
+    PATH: '/bin',
+    CLAUDE_CONFIG_DIR: '/Users/example/.claude',
+    ANTHROPIC_API_KEY: 'should-not-leak',
+  });
+
+  assert.equal(env.HOME, '/Users/example');
+  assert.equal(env.CLAUDE_CONFIG_DIR, '/Users/example/.claude');
+  assert.equal(env.ANTHROPIC_API_KEY, undefined);
+});
+
+test('codex provider auth still receives an isolated runtime home', () => {
+  const envelope = authEnvelope({
+    harness: 'codex',
+    authMethod: 'provider_auth',
+    sessionId: 'session-test',
+    amalgmDir: '/tmp/amalgm-test',
+  });
+
+  assert.match(envelope.runtimeHome, /\/tmp\/amalgm-test\/runtime\/session-test\/codex\/[^/]+$/);
+});