amalgm 0.1.68 → 0.1.69

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.68",
+  "version": "0.1.69",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,
@@ -17,7 +17,7 @@
     "sync-runtime": "node ../../scripts/sync-npm-package-runtime.mjs",
     "prepack": "node ../../scripts/sync-npm-package-runtime.mjs",
     "pack:dry": "npm pack --dry-run",
-    "check": "node --check bin/amalgm.js && node --check lib/auth-store.js && node --check lib/cli.js && node --check lib/paths.js && node --check lib/process-cleanup.js && node --check lib/runtime-identity.js && node --check lib/runtime-manifest.js && node --check lib/service.js && node --check lib/state-migration.js && node --check lib/supervisor.js && node --check lib/tunnel-chat.js && node --check lib/tunnel-events.js && node --check runtime/lib/runtime-manifest.js && node --check runtime/scripts/runtime-auth.js && node --check runtime/scripts/proxy-token-store.js && node --check runtime/scripts/local-gateway.js && node --check runtime/scripts/port-monitor.js && node --check runtime/scripts/chat-server.js && node --check runtime/scripts/chat-server/index.js && node --check runtime/scripts/chat-server/config.js && node --check runtime/scripts/chat-core/tooling/native-binaries.js && node --check runtime/scripts/chat-core/tooling/package-import.js && node --check runtime/scripts/amalgm-mcp/index.js && node --check runtime/scripts/amalgm-mcp/config.js && node --check runtime/scripts/lib/project-paths.js && node --check runtime/scripts/lib/runtime-paths.js"
+    "check": "node --check bin/amalgm.js && node --check lib/auth-store.js && node --check lib/cli.js && node --check lib/paths.js && node --check lib/process-cleanup.js && node --check lib/runtime-identity.js && node --check lib/runtime-manifest.js && node --check lib/service.js && node --check lib/state-migration.js && node --check lib/supervisor.js && node --check lib/tunnel-chat.js && node --check lib/tunnel-events.js && node --check runtime/lib/runtime-manifest.js && node --check runtime/scripts/runtime-auth.js && node --check runtime/scripts/proxy-token-store.js && node --check runtime/scripts/local-gateway.js && node --check runtime/scripts/port-monitor.js && node --check runtime/scripts/chat-server.js && node --check runtime/scripts/chat-server/index.js && node --check runtime/scripts/chat-server/config.js && node --check runtime/scripts/chat-core/tooling/native-binaries.js && node --check runtime/scripts/chat-core/tooling/package-import.js && node --check runtime/scripts/chat-core/tooling/runtime-home.js && node --check runtime/scripts/amalgm-mcp/index.js && node --check runtime/scripts/amalgm-mcp/config.js && node --check runtime/scripts/lib/project-paths.js && node --check runtime/scripts/lib/runtime-paths.js"
   },
   "engines": {
     "node": ">=20"

package/runtime/scripts/amalgm-mcp/automations/store.js

@@ -462,12 +462,12 @@ function upsertAutomationRow(db, automation) {
 function workflowStatus(workflow) {
   if (!workflow || workflow.enabled === false) return 'paused';
   if (Array.isArray(workflow.compilerErrors) && workflow.compilerErrors.length > 0) return 'error';
-  return 'idle';
+  return 'active';
 }
 
 function triggerStatus(trigger) {
   if (!trigger || trigger.enabled === false) return 'paused';
-  return 'idle';
+  return 'active';
 }
 
 function automationStatus(automation, triggers, workflow) {
@@ -475,7 +475,7 @@ function automationStatus(automation, triggers, workflow) {
   if (workflowStatus(workflow) === 'error') return 'error';
   if (triggers.some((trigger) => triggerStatus(trigger) === 'error')) return 'error';
   if (triggers.length > 0 && triggers.every((trigger) => trigger.enabled === false)) return 'paused';
-  return 'idle';
+  return 'active';
 }
 
 function composeAutomation(base, triggers, workflow) {

package/runtime/scripts/amalgm-mcp/tests/automations-store-runner.test.js

@@ -44,6 +44,9 @@ test('automation stores trigger plus workflow in local live SQLite resources', (
   assert.equal(automation.triggers.length, 1);
   assert.equal(automation.workflows.length, 1);
   assert.equal(automation.triggers[0].kind, 'event');
+  assert.equal(automation.status, 'active');
+  assert.equal(automation.triggers[0].status, 'active');
+  assert.equal(automation.workflows[0].status, 'active');
 
   const snapshot = buildSnapshot('automations,triggers,workflows');
   assert.equal(snapshot.resources.automations.some((item) => item.id === 'automation-webhook'), true);

package/runtime/scripts/chat-core/adapters/claude.js

@@ -3,13 +3,13 @@
 const path = require('path');
 const { done, errorEvent, reasoningStarted, usageFinal } = require('../events');
 const { promptText } = require('../input');
-const { runtimeEnv } = require('../auth');
 const { normalizeClaudeMessage, usageRecordsFromClaudeResult, usageFromClaude } = require('../normalizers/claude');
 const { recordNativeEvent } = require('../recorder');
 const { toClaudeMcpServers } = require('../tooling/mcp-bundle');
 const { bundledClaudeBinary } = require('../tooling/native-binaries');
-const { claudeNativeHookSettings, syncNativeHarnessConfig } = require('../tooling/native-config');
+const { claudeNativeHookSettings } = require('../tooling/native-config');
 const { importPackage } = require('../tooling/package-import');
+const { prepareHarnessRuntime } = require('../tooling/runtime-home');
 const { composeSystemPrompt } = require('../tooling/system-prompt');
 
 function redactSecrets(text) {
@@ -32,7 +32,7 @@ class ClaudeAdapter {
   }
 
   options(contract, extra = {}) {
-    syncNativeHarnessConfig(contract);
+    const runtime = prepareHarnessRuntime(contract);
     const systemPrompt = composeSystemPrompt(contract);
     const pathToClaudeCodeExecutable = process.env.CLAUDE_CODE_BINARY || bundledClaudeBinary();
     const settings = {
@@ -41,7 +41,7 @@ class ClaudeAdapter {
     };
     return {
       cwd: contract.cwd,
-      env: runtimeEnv(contract),
+      env: runtime.env,
       model: contract.cliModel,
       ...(contract.reasoningEffort ? { effort: contract.reasoningEffort } : {}),
       ...(Object.keys(settings).length > 0 ? { settings } : {}),
@@ -51,7 +51,7 @@ class ClaudeAdapter {
       permissionMode: 'bypassPermissions',
       allowDangerouslySkipPermissions: true,
       ...(process.env.CHAT_CORE_DEBUG_CLAUDE === '1'
-        ? { debug: true, debugFile: path.join(contract.auth.runtimeHome || process.cwd(), 'claude-debug.log') }
+        ? { debug: true, debugFile: path.join(runtime.runtimeHome, 'claude-debug.log') }
         : {}),
       settingSources: [],
       strictMcpConfig: false,

package/runtime/scripts/chat-core/adapters/codex.js

@@ -6,12 +6,12 @@ const os = require('os');
 const path = require('path');
 const { done, errorEvent } = require('../events');
 const { promptText } = require('../input');
-const { runtimeEnv } = require('../auth');
 const { codexErrorMessage, normalizeCodexNotification } = require('../normalizers/codex');
 const { recordNativeEvent } = require('../recorder');
 const { relayedMcpServers, toCodexMcpToml } = require('../tooling/mcp-bundle');
-const { bundledCodexBinary, bundledCodexPathDirs, executableExists } = require('../tooling/native-binaries');
+const { bundledCodexBinary, bundledCodexPathDirs, executableExists, findOnPath } = require('../tooling/native-binaries');
 const { syncCodexNativeConfig } = require('../tooling/native-config');
+const { prepareHarnessRuntime } = require('../tooling/runtime-home');
 const { composeSystemPrompt } = require('../tooling/system-prompt');
 
 class JsonLineRpc {
@@ -139,16 +139,29 @@ class JsonLineRpc {
 
 function resolveBinary() {
   const home = process.env.HOME || os.homedir();
-  for (const candidate of [process.env.CODEX_BINARY, bundledCodexBinary(), path.join(home, '.npm-global/bin/codex'), '/opt/homebrew/bin/codex', '/usr/local/bin/codex', 'codex'].filter(Boolean)) {
-    if (candidate.includes('/') && !executableExists(candidate)) continue;
+  const candidates = [
+    process.env.CODEX_BINARY,
+    bundledCodexBinary(),
+    path.join(home, '.npm-global/bin/codex'),
+    '/opt/homebrew/bin/codex',
+    '/usr/local/bin/codex',
+    findOnPath('codex'),
+  ].filter(Boolean);
+  const failures = [];
+  for (const candidate of candidates) {
+    if (!executableExists(candidate)) {
+      failures.push(`${candidate} (missing or not executable)`);
+      continue;
+    }
     const res = spawnSync(candidate, ['--version'], { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf8' });
     if (res.status === 0) return candidate;
+    failures.push(`${candidate} (--version failed: ${res.error?.message || res.status || res.signal || 'unknown'})`);
   }
-  return 'codex';
+  throw new Error(`Codex CLI binary is not available. Checked: ${failures.join(', ') || 'no candidates'}. Reinstall Amalgm or run amalgm update so the bundled Codex native package is present.`);
 }
 
-function codexEnv(contract, binary) {
-  const env = runtimeEnv(contract);
+function codexEnv(baseEnv, binary) {
+  const env = { ...(baseEnv || {}) };
   if (binary !== bundledCodexBinary()) return env;
   const pathDirs = bundledCodexPathDirs();
   if (pathDirs.length > 0) {
@@ -346,11 +359,11 @@ function baseNativeConfigForContract(contract, syncInfo) {
   return readTextFile(syncInfo?.sourceConfigPath);
 }
 
-function writeConfig(contract) {
+function writeConfig(contract, syncInfo) {
   const home = contract.auth.runtimeHome;
   if (!home) return;
   fs.mkdirSync(home, { recursive: true });
-  const syncInfo = syncCodexNativeConfig(home);
+  if (syncInfo === undefined) syncInfo = syncCodexNativeConfig(home);
   const nativeConfig = baseNativeConfigForContract(contract, syncInfo);
   const configPath = path.join(home, 'config.toml');
   if (contract.authMethod === 'provider_auth') {
@@ -372,9 +385,10 @@ function writeConfig(contract) {
 
 class CodexAdapter {
   async create(contract) {
-    writeConfig(contract);
+    const runtime = prepareHarnessRuntime(contract);
+    writeConfig(contract, runtime.syncInfo);
     const binary = resolveBinary();
-    const client = new JsonLineRpc({ binary, cwd: contract.cwd, env: codexEnv(contract, binary) });
+    const client = new JsonLineRpc({ binary, cwd: contract.cwd, env: codexEnv(runtime.env, binary) });
     await client.request('initialize', { clientInfo: { name: 'amalgm-chat-core', version: '1.0.0' }, capabilities: { experimentalApi: true } });
     client.notify('initialized');
     const threadOptions = {

package/runtime/scripts/chat-core/adapters/opencode.js

@@ -7,12 +7,12 @@ const os = require('os');
 const path = require('path');
 const { done, errorEvent, reasoningStarted } = require('../events');
 const { openCodeParts } = require('../input');
-const { runtimeEnv } = require('../auth');
 const { normalizeOpenCodeEvent, normalizeOpenCodePromptResult } = require('../normalizers/opencode');
 const { recordNativeEvent } = require('../recorder');
 const { toOpenCodeMcpConfig } = require('../tooling/mcp-bundle');
-const { bundledOpenCodeBinary, executableExists } = require('../tooling/native-binaries');
+const { bundledOpenCodeBinary, executableExists, findOnPath } = require('../tooling/native-binaries');
 const { importPackage } = require('../tooling/package-import');
+const { prepareHarnessRuntime } = require('../tooling/runtime-home');
 const { composeSystemPrompt } = require('../tooling/system-prompt');
 
 function splitModel(model, auth) {
@@ -102,22 +102,28 @@ function resolveBinary() {
     path.join(home, '.npm-global/bin/opencode'),
     '/opt/homebrew/bin/opencode',
     '/usr/local/bin/opencode',
-    'opencode',
+    findOnPath('opencode'),
   ].filter(Boolean);
+  const failures = [];
   for (const candidate of candidates) {
-    if (candidate.includes('/') && !executableExists(candidate)) continue;
+    if (!executableExists(candidate)) {
+      failures.push(`${candidate} (missing or not executable)`);
+      continue;
+    }
     const res = spawnSync(candidate, ['--version'], { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf8' });
     if (res.status === 0) return candidate;
+    failures.push(`${candidate} (--version failed: ${res.error?.message || res.status || res.signal || 'unknown'})`);
   }
-  return 'opencode';
+  throw new Error(`OpenCode CLI binary is not available. Checked: ${failures.join(', ') || 'no candidates'}. Reinstall Amalgm or run amalgm update so the bundled OpenCode native package is present.`);
 }
 
 async function startOpenCodeServer(contract) {
+  const runtime = prepareHarnessRuntime(contract);
   const binary = resolveBinary();
   const config = configFor(contract);
   const port = await freePort();
   const env = {
-    ...runtimeEnv(contract),
+    ...runtime.env,
     OPENCODE_CONFIG_CONTENT: JSON.stringify(config),
   };
   const args = ['serve', '--pure', '--hostname=127.0.0.1', `--port=${port}`];

package/runtime/scripts/chat-core/tests/native-config.test.js

@@ -12,6 +12,7 @@ const {
   syncClaudeNativeConfig,
   syncCodexNativeConfig,
 } = require('../tooling/native-config');
+const { prepareHarnessRuntime } = require('../tooling/runtime-home');
 
 function withNativeHome(fn) {
   const previousNativeHome = process.env.AMALGM_NATIVE_HOME;
@@ -66,6 +67,47 @@ test('codex native sync copies config without deleting existing runtime state',
   });
 });
 
+test('prepared codex runtime uses managed home while importing native config', () => {
+  withNativeHome((home) => {
+    const source = path.join(home, '.codex');
+    fs.mkdirSync(source, { recursive: true });
+    fs.writeFileSync(path.join(source, 'config.toml'), 'model = "gpt-5.5"');
+    fs.writeFileSync(path.join(source, 'hooks.json'), '{"hooks":{}}');
+
+    const runtimeHome = path.join(home, 'managed', 'codex-home');
+    const prepared = prepareHarnessRuntime({
+      harness: 'codex',
+      authMethod: 'provider_auth',
+      auth: { runtimeHome },
+    }, { PATH: '/bin', HOME: home });
+
+    assert.equal(prepared.runtimeHome, runtimeHome);
+    assert.equal(prepared.env.HOME, runtimeHome);
+    assert.equal(prepared.env.CODEX_HOME, runtimeHome);
+    assert.equal(prepared.syncInfo.runtimeHome, runtimeHome);
+    assert.equal(fs.existsSync(path.join(runtimeHome, 'config.toml')), true);
+    assert.equal(fs.existsSync(path.join(runtimeHome, 'hooks.json')), true);
+    assert.equal(fs.existsSync(path.join(runtimeHome, '.codex', 'config.toml')), true);
+  });
+});
+
+test('prepared opencode runtime always has an isolated managed home', () => {
+  withNativeHome((home) => {
+    const runtimeHome = path.join(home, 'managed', 'opencode-home');
+    const prepared = prepareHarnessRuntime({
+      harness: 'opencode',
+      authMethod: 'amalgm',
+      auth: { runtimeHome, tokenRef: 'test-token', baseUrl: 'https://example.test' },
+    }, { PATH: '/bin', HOME: home });
+
+    assert.equal(prepared.runtimeHome, runtimeHome);
+    assert.equal(prepared.env.HOME, runtimeHome);
+    assert.equal(prepared.env.OPENCODE_HOME, runtimeHome);
+    assert.equal(prepared.env.OPENCODE_CONFIG_DIR, runtimeHome);
+    assert.equal(fs.existsSync(runtimeHome), true);
+  });
+});
+
 test('codex provider config keeps native mcp config and overrides managed model provider', () => {
   withNativeHome((home) => {
     const source = path.join(home, '.codex');
@@ -161,9 +203,11 @@ test('claude extracts native hooks without enabling full filesystem settings', (
     assert.equal(hookSettings.permissions, undefined);
 
     const adapter = new ClaudeAdapter();
+    const runtimeHome = path.join(home, 'runtime-home');
     const options = adapter.options({
+      harness: 'claude_code',
       authMethod: 'provider_auth',
-      auth: { runtimeHome: null },
+      auth: { runtimeHome },
       cwd: home,
       cliModel: 'anthropic/claude-opus-4.7',
       mcpServers: [],

package/runtime/scripts/chat-core/tooling/native-binaries.js

@@ -10,21 +10,43 @@ function amalgmDir() {
 }
 
 function nativeNodeModulesDirs() {
-  return [
+  const resourcesPath = process.resourcesPath || '';
+  return unique([
     process.env.AMALGM_NATIVE_NODE_MODULES,
     path.join(amalgmDir(), 'native', 'node_modules'),
-  ].filter(Boolean);
+    resourcesPath ? path.join(resourcesPath, 'app.asar.unpacked', 'node_modules') : '',
+    resourcesPath ? path.join(resourcesPath, 'app.asar', 'node_modules') : '',
+    resourcesPath ? path.join(resourcesPath, 'cli', 'node_modules') : '',
+    resourcesPath ? path.join(resourcesPath, 'runtime', 'node_modules') : '',
+  ].filter(Boolean));
 }
 
-function executableExists(file) {
+function asarUnpackedPath(file) {
+  const marker = `${path.sep}app.asar${path.sep}`;
+  const value = String(file || '');
+  if (!value.includes(marker)) return value;
+  return value.replace(marker, `${path.sep}app.asar.unpacked${path.sep}`);
+}
+
+function existingAsarUnpackedPath(file) {
+  const unpacked = asarUnpackedPath(file);
+  return unpacked !== file && fs.existsSync(unpacked) ? unpacked : file;
+}
+
+function executablePath(file) {
+  const candidate = existingAsarUnpackedPath(file);
   try {
-    fs.accessSync(file, fs.constants.X_OK);
-    return true;
+    fs.accessSync(candidate, fs.constants.X_OK);
+    return candidate;
   } catch {
-    return false;
+    return null;
   }
 }
 
+function executableExists(file) {
+  return Boolean(executablePath(file));
+}
+
 function findPackageJson(packageName) {
   const candidateDirs = [
     ...nativeNodeModulesDirs(),
@@ -39,9 +61,9 @@ function findPackageJson(packageName) {
 
 function packageRoot(packageName) {
   const manifest = findPackageJson(packageName);
-  if (manifest) return path.dirname(manifest);
+  if (manifest) return path.dirname(existingAsarUnpackedPath(manifest));
   try {
-    return path.dirname(require.resolve(`${packageName}/package.json`));
+    return path.dirname(existingAsarUnpackedPath(require.resolve(`${packageName}/package.json`)));
   } catch {
     return null;
   }
@@ -77,7 +99,7 @@ function packageBin(packageName, binName) {
       : manifest.bin?.[binName];
     if (!bin) return null;
     const candidate = path.join(root, bin);
-    return executableExists(candidate) ? candidate : null;
+    return executablePath(candidate);
   } catch {
     return null;
   }
@@ -160,7 +182,7 @@ function bundledClaudeBinary() {
   const root = packageRoot(packageName);
   if (!root) return null;
   const candidate = path.join(root, process.platform === 'win32' ? 'claude.exe' : 'claude');
-  return executableExists(candidate) ? candidate : null;
+  return executablePath(candidate);
 }
 
 function resolveClaudeBinary() {
@@ -224,7 +246,8 @@ function bundledCodexBinary() {
   const vendorRoot = codexVendorRoot();
   if (target && vendorRoot) {
     const candidate = path.join(vendorRoot, target.triple, 'codex', target.binaryName);
-    if (executableExists(candidate)) return candidate;
+    const executable = executablePath(candidate);
+    if (executable) return executable;
   }
   return packageBin('@openai/codex', 'codex');
 }
@@ -605,4 +628,5 @@ module.exports = {
   ensureAgentCommandShims,
   ensureNativeBinaries,
   executableExists,
+  findOnPath,
 };

package/runtime/scripts/chat-core/tooling/runtime-home.js

@@ -0,0 +1,29 @@
+'use strict';
+
+const fs = require('fs');
+const { runtimeEnv } = require('../auth');
+const { syncNativeHarnessConfig } = require('./native-config');
+
+function managedRuntimeHome(contract) {
+  const runtimeHome = contract?.auth?.runtimeHome;
+  if (typeof runtimeHome !== 'string' || !runtimeHome.trim()) {
+    throw new Error(`${contract?.harness || 'Agent'} is missing a managed CLI home`);
+  }
+  return runtimeHome;
+}
+
+function prepareHarnessRuntime(contract, baseEnv = process.env) {
+  const runtimeHome = managedRuntimeHome(contract);
+  fs.mkdirSync(runtimeHome, { recursive: true });
+  const syncInfo = syncNativeHarnessConfig(contract);
+  return {
+    runtimeHome,
+    syncInfo,
+    env: runtimeEnv(contract, baseEnv),
+  };
+}
+
+module.exports = {
+  managedRuntimeHome,
+  prepareHarnessRuntime,
+};

package/runtime/scripts/platform-context.txt

@@ -205,12 +205,12 @@ Types:
 
 When you reference a file, folder, skill, or agent that exists on the user's local volume, emit it as an `amalgm://` markdown link. The frontend renders these as inline citation chips by default, with a hover card showing the path and (for skills) description. Skills are files too: if you only have the `SKILL.md` path, a normal file citation is valid. This is the same format the user's `@`-menu produces, and it's how agents talk to each other about local resources.
 
-Render format: `[label](amalgm://KIND/PATH_OR_ID)`
+Render format: `[label](amalgm://KIND/ENCODED_PATH_OR_ID)`
 
 Kinds:
-- File: `[Component.tsx](amalgm://file//workspace/app/Component.tsx)`
-- Folder: `[components](amalgm://folder//workspace/app/components)`
-- Skill: `[email-formatter](amalgm://skill//workspace/.agents/skills/email-formatter "Formats outgoing emails with consistent voice")`
+- File: `[Component.tsx](amalgm://file/%2Fworkspace%2Fapp%2FComponent.tsx)`
+- Folder: `[components](amalgm://folder/%2Fworkspace%2Fapp%2Fcomponents)`
+- Skill: `[email-formatter](amalgm://skill/%2Fworkspace%2F.agents%2Fskills%2Femail-formatter "Formats outgoing emails with consistent voice")`
 - Agent: `[Helper](amalgm://agent/AGENT_ID)`
 
 For skills, append a one-line description as the markdown link title (the part in quotes after the URL). The description teaches downstream agents and the user what the skill does so they can decide whether to load it. Keep the description under ~140 chars.
@@ -218,11 +218,12 @@ For skills, append a one-line description as the markdown link title (the part i
 For files and folders, the path alone is enough — no description needed. The user (and any agent reading your output) sees a chip; clicking it opens the file or folder.
 
 IMPORTANT:
-- Use the absolute path the user gave you. Don't rewrite, normalize, or shorten it.
+- Use the absolute path the user gave you as the decoded path, but percent-encode it inside the URL. Spaces must be `%20`, slashes in paths should be `%2F`, and literal `)` characters must be encoded. Do not use raw spaces inside markdown link destinations.
+- Don't rewrite, normalize, or shorten the decoded path.
 - Don't wrap citations in backticks. Don't explain the syntax.
 - When the user `@`-mentions something in their prompt, that input arrives as the same `amalgm://` link format — you can echo it back unchanged when referring to that resource.
 
-Example response (what you output): "I updated the [chat-server](amalgm://folder//workspace/scripts/chat-server) entrypoint and pulled in the [retry-policy](amalgm://skill//workspace/.agents/skills/retry-policy "Adds bounded exponential backoff to flaky outbound calls") skill for the new HTTP client."
+Example response (what you output): "I updated the [chat-server](amalgm://folder/%2Fworkspace%2Fscripts%2Fchat-server) entrypoint and pulled in the [retry-policy](amalgm://skill/%2Fworkspace%2F.agents%2Fskills%2Fretry-policy "Adds bounded exponential backoff to flaky outbound calls") skill for the new HTTP client."
 
 The user sees two clickable chips inline; the agent reading your transcript sees structured references it can act on.
 </amalgm-platform>