amalgm 0.1.66 → 0.1.68

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.66",
+  "version": "0.1.68",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,

package/runtime/scripts/chat-core/auth.js

@@ -126,11 +126,6 @@ function runtimeHome({ amalgmDir, harness, authProfileId }) {
   return path.join(amalgmDir, 'cli-homes', safePathSegment(harness), safePathSegment(authProfileId));
 }
 
-function nativeProviderHome(harness) {
-  if (harness === 'claude_code') return os.homedir();
-  return null;
-}
-
 function pinnedRuntimeHome(amalgmDir, cliHomePath) {
   if (typeof cliHomePath !== 'string' || !cliHomePath.trim()) return null;
   const root = path.resolve(amalgmDir);
@@ -183,8 +178,7 @@ function authEnvelope({ harness, authMethod, sessionId, localBaseUrl, proxyToken
     tokenFingerprint,
     authProfileId: profileId,
     runtimeHome:
-      nativeProviderHome(method === 'provider_auth' ? harness : null)
-      || pinnedRuntimeHome(amalgmDir, cliHomePath)
+      pinnedRuntimeHome(amalgmDir, cliHomePath)
       || runtimeHome({ amalgmDir, harness, authProfileId: profileId }),
   };
 }
@@ -202,15 +196,6 @@ function runtimeEnv(contract, baseEnv = process.env) {
   for (const key of ['OPENAI_API_KEY', 'OPENAI_BASE_URL', 'ANTHROPIC_API_KEY', 'ANTHROPIC_BASE_URL', 'AI_GATEWAY_API_KEY', 'AI_GATEWAY_BASE_URL']) {
     delete env[key];
   }
-  if (contract.harness === 'claude_code' && contract.authMethod === 'provider_auth') {
-    env.HOME = os.homedir();
-    delete env.CLAUDE_CONFIG_DIR;
-    return {
-      ...env,
-      IS_SANDBOX: '1',
-      ...(baseEnv.AMALGM_RUNTIME_TOKEN ? { AMALGM_RUNTIME_TOKEN: baseEnv.AMALGM_RUNTIME_TOKEN } : {}),
-    };
-  }
   if (contract.auth.runtimeHome) {
     fs.mkdirSync(contract.auth.runtimeHome, { recursive: true });
     env.HOME = contract.auth.runtimeHome;
@@ -218,6 +203,9 @@ function runtimeEnv(contract, baseEnv = process.env) {
     env.CLAUDE_CONFIG_DIR = contract.auth.runtimeHome;
     env.OPENCODE_HOME = contract.auth.runtimeHome;
     env.OPENCODE_CONFIG_DIR = contract.auth.runtimeHome;
+    if (contract.harness === 'claude_code' && contract.authMethod === 'provider_auth') {
+      delete env.CLAUDE_CONFIG_DIR;
+    }
   }
   env.IS_SANDBOX = '1';
   if (baseEnv.AMALGM_RUNTIME_TOKEN) env.AMALGM_RUNTIME_TOKEN = baseEnv.AMALGM_RUNTIME_TOKEN;

package/runtime/scripts/chat-core/tests/auth.test.js

@@ -1,7 +1,6 @@
 'use strict';
 
 const assert = require('node:assert/strict');
-const os = require('node:os');
 const test = require('node:test');
 const { authEnvelope, runtimeEnv } = require('../auth');
 
@@ -63,7 +62,7 @@ test('opencode amalgm auth uses a pinned CLI home across sessions and proxy toke
   assert.equal(env.OPENCODE_CONFIG_DIR, first.runtimeHome);
 });
 
-test('claude provider auth uses the native user home with CLAUDE_CONFIG_DIR unset', () => {
+test('claude provider auth uses a pinned CLI home with native config copied separately', () => {
   const envelope = authEnvelope({
     harness: 'claude_code',
     authMethod: 'provider_auth',
@@ -71,7 +70,7 @@ test('claude provider auth uses the native user home with CLAUDE_CONFIG_DIR unse
     amalgmDir: '/tmp/amalgm-test',
   });
 
-  assert.equal(envelope.runtimeHome, os.homedir());
+  assert.match(envelope.runtimeHome, /\/tmp\/amalgm-test\/cli-homes\/claude_code\/provider-[0-9a-f]{16}$/);
 
   const env = runtimeEnv({
     harness: 'claude_code',
@@ -84,7 +83,7 @@ test('claude provider auth uses the native user home with CLAUDE_CONFIG_DIR unse
     ANTHROPIC_API_KEY: 'should-not-leak',
   });
 
-  assert.equal(env.HOME, os.homedir());
+  assert.equal(env.HOME, envelope.runtimeHome);
   assert.equal(env.CLAUDE_CONFIG_DIR, undefined);
   assert.equal(env.ANTHROPIC_API_KEY, undefined);
 });

package/runtime/scripts/chat-core/tests/native-config.test.js

@@ -30,7 +30,7 @@ function withNativeHome(fn) {
   }
 }
 
-test('codex native sync copies hook support without bulk runtime state', () => {
+test('codex native sync copies config without deleting existing runtime state', () => {
   withNativeHome((home) => {
     const source = path.join(home, '.codex');
     fs.mkdirSync(path.join(source, 'sessions'), { recursive: true });
@@ -58,7 +58,8 @@ test('codex native sync copies hook support without bulk runtime state', () => {
     assert.equal(fs.existsSync(path.join(runtimeHome, 'hooks.json')), true);
     assert.equal(fs.existsSync(path.join(runtimeHome, 'supermemory.json')), true);
     assert.equal(fs.existsSync(path.join(runtimeHome, 'supermemory', 'recall.js')), true);
-    assert.equal(fs.existsSync(path.join(runtimeHome, 'sessions')), false);
+    assert.equal(fs.existsSync(path.join(runtimeHome, 'sessions', 'legacy.jsonl')), true);
+    assert.equal(fs.existsSync(path.join(runtimeHome, 'sessions', 'huge.jsonl')), false);
     assert.equal(fs.existsSync(path.join(runtimeHome, 'worktrees')), false);
     assert.equal(fs.existsSync(path.join(runtimeHome, 'plugins')), false);
     assert.equal(fs.existsSync(path.join(runtimeHome, '.codex', 'hooks.json')), true);
@@ -195,3 +196,23 @@ test('claude native sync skips debug symlinks', () => {
     assert.equal(fs.existsSync(path.join(runtimeHome, 'debug', 'latest')), false);
   });
 });
+
+test('claude native sync links native keychains on macOS', () => {
+  withNativeHome((home) => {
+    const source = path.join(home, '.claude');
+    fs.mkdirSync(source, { recursive: true });
+    fs.writeFileSync(path.join(source, 'settings.json'), '{"hooks":{}}');
+    fs.mkdirSync(path.join(home, 'Library', 'Keychains'), { recursive: true });
+
+    const runtimeHome = path.join(home, 'runtime-home');
+    syncClaudeNativeConfig(runtimeHome);
+
+    const keychains = path.join(runtimeHome, 'Library', 'Keychains');
+    if (process.platform === 'darwin') {
+      assert.equal(fs.lstatSync(keychains).isSymbolicLink(), true);
+      assert.equal(fs.realpathSync(keychains), fs.realpathSync(path.join(home, 'Library', 'Keychains')));
+    } else {
+      assert.equal(fs.existsSync(keychains), false);
+    }
+  });
+});

package/runtime/scripts/chat-core/tooling/native-config.js

@@ -120,16 +120,30 @@ function removeOutboundSymlink(root, relativePath) {
   }
 }
 
-function nativeHome() {
-  return process.env.AMALGM_NATIVE_HOME || os.homedir();
+function ensureNativeKeychainAlias(runtimeHome) {
+  if (process.platform !== 'darwin' || !runtimeHome) return false;
+  const source = path.join(nativeHome(), 'Library', 'Keychains');
+  if (!exists(source)) return false;
+  const target = path.join(runtimeHome, 'Library', 'Keychains');
+  try {
+    const stat = fs.lstatSync(target);
+    if (stat.isSymbolicLink()) {
+      const linkTarget = fs.readlinkSync(target);
+      if (path.resolve(path.dirname(target), linkTarget) === path.resolve(source)) return true;
+    }
+    fs.rmSync(target, { recursive: true, force: true });
+  } catch {}
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  try {
+    fs.symlinkSync(source, target, 'dir');
+    return true;
+  } catch {
+    return false;
+  }
 }
 
-function pruneLegacyCodexRuntimeHome(runtimeHome) {
-  for (const name of EXCLUDED_DIR_NAMES) {
-    try {
-      fs.rmSync(path.join(runtimeHome, name), { recursive: true, force: true });
-    } catch {}
-  }
+function nativeHome() {
+  return process.env.AMALGM_NATIVE_HOME || os.homedir();
 }
 
 function copyDirBounded(sourceDir, targetDir, options = {}) {
@@ -178,7 +192,6 @@ function syncCodexNativeConfig(runtimeHome) {
   fs.mkdirSync(runtimeHome, { recursive: true });
   if (!exists(sourceDir)) return null;
 
-  pruneLegacyCodexRuntimeHome(runtimeHome);
   const nativeConfig = copyDirBounded(sourceDir, runtimeHome);
   const copiedFiles = [
     copyFileIfPresent(path.join(sourceDir, 'config.toml'), path.join(runtimeHome, 'config.toml')),
@@ -208,6 +221,7 @@ function syncClaudeNativeConfig(runtimeHome) {
   removeOutboundSymlink(runtimeHome, path.join('debug', 'latest'));
   const copied = copyConfigTree(sourceDir, runtimeHome);
   ensureHomeAlias(runtimeHome, '.claude');
+  ensureNativeKeychainAlias(runtimeHome);
   copyFileIfPresent(path.join(home, '.claude.json'), path.join(runtimeHome, '.claude.json'));
   copyConfigTree(path.join(home, '.config', 'claude'), path.join(runtimeHome, '.config', 'claude'));
   return copied ? { sourceDir, runtimeHome } : null;
@@ -268,6 +282,7 @@ module.exports = {
     copyConfigTree,
     copyDirBounded,
     copyFileIfPresent,
+    ensureNativeKeychainAlias,
     ensureHomeAlias,
     shouldCopyConfigPath,
   },