amalgm 0.1.47 → 0.1.49

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.47",
+  "version": "0.1.49",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,

package/runtime/scripts/chat-core/adapters/claude.js

@@ -8,7 +8,7 @@ const { normalizeClaudeMessage, usageRecordsFromClaudeResult, usageFromClaude }
 const { recordNativeEvent } = require('../recorder');
 const { toClaudeMcpServers } = require('../tooling/mcp-bundle');
 const { bundledClaudeBinary } = require('../tooling/native-binaries');
-const { syncNativeHarnessConfig } = require('../tooling/native-config');
+const { claudeNativeHookSettings } = require('../tooling/native-config');
 const { importPackage } = require('../tooling/package-import');
 const { composeSystemPrompt } = require('../tooling/system-prompt');
 
@@ -32,15 +32,18 @@ class ClaudeAdapter {
   }
 
   options(contract, extra = {}) {
-    syncNativeHarnessConfig(contract);
     const systemPrompt = composeSystemPrompt(contract);
     const pathToClaudeCodeExecutable = process.env.CLAUDE_CODE_BINARY || bundledClaudeBinary();
+    const settings = {
+      ...(claudeNativeHookSettings({ cwd: contract.cwd }) || {}),
+      ...(contract.fastMode ? { fastMode: true, fastModePerSessionOptIn: true } : {}),
+    };
     return {
       cwd: contract.cwd,
       env: runtimeEnv(contract),
       model: contract.cliModel,
       ...(contract.reasoningEffort ? { effort: contract.reasoningEffort } : {}),
-      ...(contract.fastMode ? { settings: { fastMode: true, fastModePerSessionOptIn: true } } : {}),
+      ...(Object.keys(settings).length > 0 ? { settings } : {}),
       ...(pathToClaudeCodeExecutable ? { pathToClaudeCodeExecutable } : {}),
       ...(systemPrompt ? { systemPrompt: { type: 'preset', preset: 'claude_code', append: systemPrompt } } : {}),
       mcpServers: toClaudeMcpServers(contract),
@@ -49,7 +52,7 @@ class ClaudeAdapter {
       ...(process.env.CHAT_CORE_DEBUG_CLAUDE === '1'
         ? { debug: true, debugFile: path.join(contract.auth.runtimeHome || process.cwd(), 'claude-debug.log') }
         : {}),
-      settingSources: ['user', 'project', 'local'],
+      settingSources: [],
       strictMcpConfig: false,
       ...extra,
     };

package/runtime/scripts/chat-core/adapters/codex.js

@@ -263,6 +263,10 @@ function hookTrustBlocks(toml) {
   return blocks;
 }
 
+function hookTrustToml(toml) {
+  return hookTrustBlocks(toml).map((block) => block.lines.join('\n')).join('\n\n');
+}
+
 function mirrorCodexHookTrust(toml, sourceDir, runtimeHome) {
   if (!sourceDir || !runtimeHome) return toml;
   const sourceHookPrefix = `${path.join(sourceDir, 'hooks.json')}:`;
@@ -298,7 +302,7 @@ function generatedMcpSectionNames(contract) {
 function buildCodexConfig(contract, existingConfig, syncInfo) {
   const mcpToml = toCodexMcpToml(contract);
   const topLevelKeys = [
-    ...(contract.authMethod === 'provider_auth' ? [] : ['model_provider']),
+    'model_provider',
     ...(contract.authMethod === 'amalgm' ? ['model_context_window', 'model_auto_compact_token_limit'] : []),
   ];
   let config = removeTopLevelKeys(existingConfig, topLevelKeys);
@@ -324,6 +328,8 @@ function buildCodexConfig(contract, existingConfig, syncInfo) {
       ].join('\n')
     : contract.authMethod === 'byok'
       ? 'model_provider = "openai"'
+      : contract.authMethod === 'provider_auth'
+        ? 'model_provider = "openai"'
       : '';
   return [
     generated.trimEnd(),
@@ -337,18 +343,19 @@ function writeConfig(contract) {
   if (!home) return;
   fs.mkdirSync(home, { recursive: true });
   const syncInfo = syncCodexNativeConfig(home);
+  const nativeHookTrust = hookTrustToml(readTextFile(syncInfo?.sourceConfigPath));
   const configPath = path.join(home, 'config.toml');
   if (contract.authMethod === 'provider_auth') {
-    const sourceAuth = path.join(os.homedir(), '.codex', 'auth.json');
+    const sourceAuth = path.join(syncInfo?.sourceDir || path.join(os.homedir(), '.codex'), 'auth.json');
     const targetAuth = path.join(home, 'auth.json');
     if (fs.existsSync(sourceAuth)) {
       fs.copyFileSync(sourceAuth, targetAuth);
       fs.chmodSync(targetAuth, 0o600);
     }
-    fs.writeFileSync(configPath, buildCodexConfig(contract, readTextFile(configPath), syncInfo), { mode: 0o600 });
+    fs.writeFileSync(configPath, buildCodexConfig(contract, nativeHookTrust, syncInfo), { mode: 0o600 });
     return;
   }
-  fs.writeFileSync(configPath, buildCodexConfig(contract, readTextFile(configPath), syncInfo), { mode: 0o600 });
+  fs.writeFileSync(configPath, buildCodexConfig(contract, nativeHookTrust, syncInfo), { mode: 0o600 });
   fs.writeFileSync(path.join(home, 'auth.json'), JSON.stringify({
     auth_mode: 'apikey',
     OPENAI_API_KEY: contract.auth.tokenRef,
@@ -488,6 +495,7 @@ module.exports = {
   __private: {
     buildCodexConfig,
     ensureFeatureBoolean,
+    hookTrustToml,
     mirrorCodexHookTrust,
     modelWindowConfigLines,
     removeTomlSections,

package/runtime/scripts/chat-core/auth.js

@@ -70,7 +70,9 @@ function coerceAuth(harness, requested) {
 }
 
 function runtimeHome({ amalgmDir, sessionId, harness, authMethod, tokenFingerprint }) {
-  if (authMethod === 'provider_auth' && !['claude_code', 'codex'].includes(harness)) return null;
+  // Claude Code provider auth is tied to the user's real home/keychain context.
+  // Isolating HOME makes the bundled Claude binary look logged out on macOS.
+  if (authMethod === 'provider_auth' && harness !== 'codex') return null;
   const suffix = tokenFingerprint || 'default';
   return path.join(amalgmDir, 'runtime', sessionId, harness, suffix);
 }

package/runtime/scripts/chat-core/tests/auth.test.js

@@ -0,0 +1,42 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const test = require('node:test');
+const { authEnvelope, runtimeEnv } = require('../auth');
+
+test('claude provider auth keeps the user home environment', () => {
+  const envelope = authEnvelope({
+    harness: 'claude_code',
+    authMethod: 'provider_auth',
+    sessionId: 'session-test',
+    amalgmDir: '/tmp/amalgm-test',
+  });
+
+  assert.equal(envelope.runtimeHome, null);
+
+  const env = runtimeEnv({
+    harness: 'claude_code',
+    authMethod: 'provider_auth',
+    auth: envelope,
+  }, {
+    HOME: '/Users/example',
+    PATH: '/bin',
+    CLAUDE_CONFIG_DIR: '/Users/example/.claude',
+    ANTHROPIC_API_KEY: 'should-not-leak',
+  });
+
+  assert.equal(env.HOME, '/Users/example');
+  assert.equal(env.CLAUDE_CONFIG_DIR, '/Users/example/.claude');
+  assert.equal(env.ANTHROPIC_API_KEY, undefined);
+});
+
+test('codex provider auth still receives an isolated runtime home', () => {
+  const envelope = authEnvelope({
+    harness: 'codex',
+    authMethod: 'provider_auth',
+    sessionId: 'session-test',
+    amalgmDir: '/tmp/amalgm-test',
+  });
+
+  assert.match(envelope.runtimeHome, /\/tmp\/amalgm-test\/runtime\/session-test\/codex\/[^/]+$/);
+});

package/runtime/scripts/chat-core/tests/native-config.test.js

@@ -0,0 +1,127 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const test = require('node:test');
+const { ClaudeAdapter } = require('../adapters/claude');
+const { __private: codexPrivate } = require('../adapters/codex');
+const {
+  claudeNativeHookSettings,
+  syncCodexNativeConfig,
+} = require('../tooling/native-config');
+
+function withNativeHome(fn) {
+  const previousNativeHome = process.env.AMALGM_NATIVE_HOME;
+  const previousHome = process.env.HOME;
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-native-config-'));
+  process.env.AMALGM_NATIVE_HOME = root;
+  process.env.HOME = root;
+  try {
+    return fn(root);
+  } finally {
+    if (previousNativeHome === undefined) delete process.env.AMALGM_NATIVE_HOME;
+    else process.env.AMALGM_NATIVE_HOME = previousNativeHome;
+    if (previousHome === undefined) delete process.env.HOME;
+    else process.env.HOME = previousHome;
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+test('codex native sync copies hook support without bulk runtime state', () => {
+  withNativeHome((home) => {
+    const source = path.join(home, '.codex');
+    fs.mkdirSync(path.join(source, 'sessions'), { recursive: true });
+    fs.mkdirSync(path.join(source, 'worktrees'), { recursive: true });
+    fs.mkdirSync(path.join(source, 'plugins'), { recursive: true });
+    fs.mkdirSync(path.join(source, 'supermemory'), { recursive: true });
+    fs.writeFileSync(path.join(source, 'hooks.json'), '{"hooks":{}}');
+    fs.writeFileSync(path.join(source, 'supermemory.json'), '{"projectContainerTag":"test"}');
+    fs.writeFileSync(path.join(source, 'supermemory', 'recall.js'), 'console.log("recall")');
+    fs.writeFileSync(path.join(source, 'sessions', 'huge.jsonl'), 'nope');
+    fs.writeFileSync(path.join(source, 'worktrees', 'tree'), 'nope');
+    fs.writeFileSync(path.join(source, 'plugins', 'cache'), 'nope');
+
+    const runtimeHome = path.join(home, 'runtime-home');
+    fs.mkdirSync(path.join(runtimeHome, 'sessions'), { recursive: true });
+    fs.writeFileSync(path.join(runtimeHome, 'sessions', 'legacy.jsonl'), 'old');
+
+    const result = syncCodexNativeConfig(runtimeHome);
+
+    assert.equal(result.sourceDir, source);
+    assert.equal(fs.existsSync(path.join(runtimeHome, 'hooks.json')), true);
+    assert.equal(fs.existsSync(path.join(runtimeHome, 'supermemory.json')), true);
+    assert.equal(fs.existsSync(path.join(runtimeHome, 'supermemory', 'recall.js')), true);
+    assert.equal(fs.existsSync(path.join(runtimeHome, 'sessions')), false);
+    assert.equal(fs.existsSync(path.join(runtimeHome, 'worktrees')), false);
+    assert.equal(fs.existsSync(path.join(runtimeHome, 'plugins')), false);
+    assert.equal(fs.existsSync(path.join(runtimeHome, '.codex', 'hooks.json')), true);
+  });
+});
+
+test('codex provider config keeps hooks but drops native model and mcp config', () => {
+  withNativeHome((home) => {
+    const source = path.join(home, '.codex');
+    fs.mkdirSync(source, { recursive: true });
+    const hooksPath = path.join(source, 'hooks.json');
+    fs.writeFileSync(hooksPath, '{"hooks":{"UserPromptSubmit":[]}}');
+    fs.writeFileSync(path.join(source, 'auth.json'), '{"auth_mode":"chatgpt"}');
+    fs.writeFileSync(path.join(source, 'config.toml'), [
+      'model_provider = "native-provider"',
+      '',
+      '[mcp_servers.native]',
+      'command = "native-mcp"',
+      '',
+      `[hooks.state.${JSON.stringify(`${hooksPath}:UserPromptSubmit:0`)}]`,
+      'trusted = true',
+      '',
+    ].join('\n'));
+
+    const runtimeHome = path.join(home, 'runtime-home');
+    codexPrivate.writeConfig({
+      authMethod: 'provider_auth',
+      auth: { runtimeHome },
+      mcpServers: [],
+    });
+
+    const config = fs.readFileSync(path.join(runtimeHome, 'config.toml'), 'utf8');
+    assert.match(config, /model_provider = "openai"/);
+    assert.match(config, /codex_hooks = true/);
+    assert.doesNotMatch(config, /native-provider/);
+    assert.doesNotMatch(config, /mcp_servers\.native/);
+    assert.equal(config.includes(path.join(runtimeHome, 'hooks.json')), true);
+  });
+});
+
+test('claude extracts native hooks without enabling full filesystem settings', () => {
+  withNativeHome((home) => {
+    const source = path.join(home, '.claude');
+    fs.mkdirSync(source, { recursive: true });
+    fs.writeFileSync(path.join(source, 'settings.json'), JSON.stringify({
+      permissions: { allow: ['Bash(*)'] },
+      hooks: {
+        UserPromptSubmit: [{
+          hooks: [{ type: 'command', command: 'echo recall', timeout: 1 }],
+        }],
+      },
+    }));
+
+    const hookSettings = claudeNativeHookSettings({ cwd: home });
+    assert.deepEqual(Object.keys(hookSettings.hooks), ['UserPromptSubmit']);
+    assert.equal(hookSettings.permissions, undefined);
+
+    const adapter = new ClaudeAdapter();
+    const options = adapter.options({
+      authMethod: 'provider_auth',
+      auth: { runtimeHome: null },
+      cwd: home,
+      cliModel: 'anthropic/claude-opus-4.7',
+      mcpServers: [],
+    });
+
+    assert.deepEqual(options.settingSources, []);
+    assert.equal(options.settings.permissions, undefined);
+    assert.equal(options.settings.hooks.UserPromptSubmit[0].hooks[0].command, 'echo recall');
+  });
+});

package/runtime/scripts/chat-core/tooling/native-config.js

@@ -9,12 +9,18 @@ const EXCLUDED_DIR_NAMES = new Set([
   '.npm',
   '.tmp',
   'cache',
+  'generated_images',
   'log',
   'logs',
+  'memories',
+  'node_modules',
+  'plugins',
   'projects',
   'sessions',
   'shell_snapshots',
+  'skills',
   'tmp',
+  'worktrees',
 ]);
 
 const EXCLUDED_FILE_PATTERNS = [
@@ -66,8 +72,8 @@ function copyFileIfPresent(source, target) {
   return true;
 }
 
-function copyIntoHomeAlias(runtimeHome, dotDirName, sourceDir) {
-  if (!runtimeHome || !dotDirName || !sourceDir || !exists(sourceDir)) return;
+function ensureHomeAlias(runtimeHome, dotDirName) {
+  if (!runtimeHome || !dotDirName) return;
   const alias = path.join(runtimeHome, dotDirName);
   try {
     const stat = fs.lstatSync(alias);
@@ -75,9 +81,6 @@ function copyIntoHomeAlias(runtimeHome, dotDirName, sourceDir) {
       const target = fs.readlinkSync(alias);
       if (target === '.' || path.resolve(runtimeHome, target) === path.resolve(runtimeHome)) return;
       fs.rmSync(alias, { recursive: true, force: true });
-    } else if (stat.isDirectory()) {
-      copyConfigTree(sourceDir, alias);
-      return;
     } else {
       fs.rmSync(alias, { recursive: true, force: true });
     }
@@ -85,34 +88,138 @@ function copyIntoHomeAlias(runtimeHome, dotDirName, sourceDir) {
   try {
     fs.symlinkSync('.', alias, 'dir');
   } catch {
-    copyConfigTree(sourceDir, alias);
+    fs.mkdirSync(alias, { recursive: true });
+  }
+}
+
+function nativeHome() {
+  return process.env.AMALGM_NATIVE_HOME || os.homedir();
+}
+
+function pruneLegacyCodexRuntimeHome(runtimeHome) {
+  for (const name of EXCLUDED_DIR_NAMES) {
+    try {
+      fs.rmSync(path.join(runtimeHome, name), { recursive: true, force: true });
+    } catch {}
   }
 }
 
+function copyDirBounded(sourceDir, targetDir, options = {}) {
+  if (!sourceDir || !targetDir || !exists(sourceDir)) return { copied: false, files: 0, bytes: 0, truncated: false };
+  const maxFiles = Number(options.maxFiles || 200);
+  const maxBytes = Number(options.maxBytes || 10 * 1024 * 1024);
+  const state = { copied: false, files: 0, bytes: 0, truncated: false };
+  const root = path.resolve(sourceDir);
+
+  function walk(source, target) {
+    if (state.truncated || !shouldCopyConfigPath(root, source)) return;
+    let stat;
+    try {
+      stat = fs.lstatSync(source);
+    } catch {
+      return;
+    }
+    if (stat.isSymbolicLink()) return;
+    if (stat.isDirectory()) {
+      fs.mkdirSync(target, { recursive: true });
+      for (const entry of fs.readdirSync(source)) {
+        walk(path.join(source, entry), path.join(target, entry));
+        if (state.truncated) break;
+      }
+      return;
+    }
+    if (!stat.isFile()) return;
+    if (state.files + 1 > maxFiles || state.bytes + stat.size > maxBytes) {
+      state.truncated = true;
+      return;
+    }
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.copyFileSync(source, target);
+    state.files += 1;
+    state.bytes += stat.size;
+    state.copied = true;
+  }
+
+  walk(sourceDir, targetDir);
+  return state;
+}
+
 function syncCodexNativeConfig(runtimeHome) {
   if (!runtimeHome) return null;
-  const nativeHome = os.homedir();
-  const sourceDir = path.join(nativeHome, '.codex');
+  const sourceDir = path.join(nativeHome(), '.codex');
   fs.mkdirSync(runtimeHome, { recursive: true });
-  const copied = copyConfigTree(sourceDir, runtimeHome);
-  copyIntoHomeAlias(runtimeHome, '.codex', sourceDir);
-  copyConfigTree(path.join(nativeHome, '.codex-supermemory'), path.join(runtimeHome, '.codex-supermemory'));
-  copyFileIfPresent(path.join(nativeHome, '.codex-supermemory.log'), path.join(runtimeHome, '.codex-supermemory.log'));
-  return copied ? { sourceDir, runtimeHome } : null;
+  if (!exists(sourceDir)) return null;
+
+  pruneLegacyCodexRuntimeHome(runtimeHome);
+  const copiedFiles = [
+    copyFileIfPresent(path.join(sourceDir, 'hooks.json'), path.join(runtimeHome, 'hooks.json')),
+    copyFileIfPresent(path.join(sourceDir, 'supermemory.json'), path.join(runtimeHome, 'supermemory.json')),
+  ].filter(Boolean).length;
+  const supermemory = copyDirBounded(path.join(sourceDir, 'supermemory'), path.join(runtimeHome, 'supermemory'));
+  copyDirBounded(path.join(nativeHome(), '.codex-supermemory'), path.join(runtimeHome, '.codex-supermemory'));
+  ensureHomeAlias(runtimeHome, '.codex');
+
+  return {
+    sourceDir,
+    runtimeHome,
+    sourceConfigPath: path.join(sourceDir, 'config.toml'),
+    copied: copiedFiles + (supermemory.copied ? 1 : 0) > 0,
+    truncated: supermemory.truncated,
+  };
 }
 
 function syncClaudeNativeConfig(runtimeHome) {
   if (!runtimeHome) return null;
-  const nativeHome = os.homedir();
-  const sourceDir = path.join(nativeHome, '.claude');
+  const sourceDir = path.join(nativeHome(), '.claude');
   fs.mkdirSync(runtimeHome, { recursive: true });
   const copied = copyConfigTree(sourceDir, runtimeHome);
-  copyIntoHomeAlias(runtimeHome, '.claude', sourceDir);
-  copyFileIfPresent(path.join(nativeHome, '.claude.json'), path.join(runtimeHome, '.claude.json'));
-  copyConfigTree(path.join(nativeHome, '.config', 'claude'), path.join(runtimeHome, '.config', 'claude'));
+  ensureHomeAlias(runtimeHome, '.claude');
+  copyFileIfPresent(path.join(nativeHome(), '.claude.json'), path.join(runtimeHome, '.claude.json'));
+  copyConfigTree(path.join(nativeHome(), '.config', 'claude'), path.join(runtimeHome, '.config', 'claude'));
   return copied ? { sourceDir, runtimeHome } : null;
 }
 
+function readJsonFile(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function cloneJson(value) {
+  if (value == null) return value;
+  try {
+    return JSON.parse(JSON.stringify(value));
+  } catch {
+    return null;
+  }
+}
+
+function mergeHookMaps(target, hooks) {
+  if (!hooks || typeof hooks !== 'object' || Array.isArray(hooks)) return;
+  for (const [event, matchers] of Object.entries(hooks)) {
+    if (!Array.isArray(matchers)) continue;
+    const cloned = cloneJson(matchers);
+    if (!Array.isArray(cloned)) continue;
+    target[event] = [...(Array.isArray(target[event]) ? target[event] : []), ...cloned];
+  }
+}
+
+function claudeNativeHookSettings(options = {}) {
+  const sources = [
+    path.join(nativeHome(), '.claude', 'settings.json'),
+    options.cwd ? path.join(options.cwd, '.claude', 'settings.json') : null,
+    options.cwd ? path.join(options.cwd, '.claude', 'settings.local.json') : null,
+  ].filter(Boolean);
+  const hooks = {};
+  for (const source of sources) {
+    const data = readJsonFile(source);
+    mergeHookMaps(hooks, data?.hooks);
+  }
+  return Object.keys(hooks).length > 0 ? { hooks } : null;
+}
+
 function syncNativeHarnessConfig(contract) {
   const runtimeHome = contract?.auth?.runtimeHome;
   if (!runtimeHome) return null;
@@ -123,10 +230,14 @@ function syncNativeHarnessConfig(contract) {
 
 module.exports = {
   __private: {
+    claudeNativeHookSettings,
     copyConfigTree,
+    copyDirBounded,
     copyFileIfPresent,
+    ensureHomeAlias,
     shouldCopyConfigPath,
   },
+  claudeNativeHookSettings,
   syncClaudeNativeConfig,
   syncCodexNativeConfig,
   syncNativeHarnessConfig,