amalgm 0.1.68 → 0.1.70

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.68",
+  "version": "0.1.70",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,
@@ -17,7 +17,7 @@
     "sync-runtime": "node ../../scripts/sync-npm-package-runtime.mjs",
     "prepack": "node ../../scripts/sync-npm-package-runtime.mjs",
     "pack:dry": "npm pack --dry-run",
-    "check": "node --check bin/amalgm.js && node --check lib/auth-store.js && node --check lib/cli.js && node --check lib/paths.js && node --check lib/process-cleanup.js && node --check lib/runtime-identity.js && node --check lib/runtime-manifest.js && node --check lib/service.js && node --check lib/state-migration.js && node --check lib/supervisor.js && node --check lib/tunnel-chat.js && node --check lib/tunnel-events.js && node --check runtime/lib/runtime-manifest.js && node --check runtime/scripts/runtime-auth.js && node --check runtime/scripts/proxy-token-store.js && node --check runtime/scripts/local-gateway.js && node --check runtime/scripts/port-monitor.js && node --check runtime/scripts/chat-server.js && node --check runtime/scripts/chat-server/index.js && node --check runtime/scripts/chat-server/config.js && node --check runtime/scripts/chat-core/tooling/native-binaries.js && node --check runtime/scripts/chat-core/tooling/package-import.js && node --check runtime/scripts/amalgm-mcp/index.js && node --check runtime/scripts/amalgm-mcp/config.js && node --check runtime/scripts/lib/project-paths.js && node --check runtime/scripts/lib/runtime-paths.js"
+    "check": "node --check bin/amalgm.js && node --check lib/auth-store.js && node --check lib/cli.js && node --check lib/paths.js && node --check lib/process-cleanup.js && node --check lib/runtime-identity.js && node --check lib/runtime-manifest.js && node --check lib/service.js && node --check lib/state-migration.js && node --check lib/supervisor.js && node --check lib/tunnel-chat.js && node --check lib/tunnel-events.js && node --check runtime/lib/runtime-manifest.js && node --check runtime/scripts/runtime-auth.js && node --check runtime/scripts/proxy-token-store.js && node --check runtime/scripts/local-gateway.js && node --check runtime/scripts/port-monitor.js && node --check runtime/scripts/chat-server.js && node --check runtime/scripts/chat-server/index.js && node --check runtime/scripts/chat-server/config.js && node --check runtime/scripts/chat-core/tooling/native-binaries.js && node --check runtime/scripts/chat-core/tooling/package-import.js && node --check runtime/scripts/chat-core/tooling/runtime-home.js && node --check runtime/scripts/amalgm-mcp/index.js && node --check runtime/scripts/amalgm-mcp/config.js && node --check runtime/scripts/lib/project-paths.js && node --check runtime/scripts/lib/runtime-paths.js"
   },
   "engines": {
     "node": ">=20"

package/runtime/lib/harnesses.js

@@ -774,7 +774,7 @@ var HARNESSES = {
     logoKey: "opencode",
     models: OPENCODE_MODELS,
     defaultModelId: DEFAULT_MODEL_IDS.opencode,
-    supportedAuthMethods: ["amalgm", "byok"],
+    supportedAuthMethods: ["amalgm", "byok", "provider_auth"],
     dynamicModels: true
   },
   codex: {

package/runtime/scripts/amalgm-mcp/automations/store.js

@@ -462,12 +462,12 @@ function upsertAutomationRow(db, automation) {
 function workflowStatus(workflow) {
   if (!workflow || workflow.enabled === false) return 'paused';
   if (Array.isArray(workflow.compilerErrors) && workflow.compilerErrors.length > 0) return 'error';
-  return 'idle';
+  return 'active';
 }
 
 function triggerStatus(trigger) {
   if (!trigger || trigger.enabled === false) return 'paused';
-  return 'idle';
+  return 'active';
 }
 
 function automationStatus(automation, triggers, workflow) {
@@ -475,7 +475,7 @@ function automationStatus(automation, triggers, workflow) {
   if (workflowStatus(workflow) === 'error') return 'error';
   if (triggers.some((trigger) => triggerStatus(trigger) === 'error')) return 'error';
   if (triggers.length > 0 && triggers.every((trigger) => trigger.enabled === false)) return 'paused';
-  return 'idle';
+  return 'active';
 }
 
 function composeAutomation(base, triggers, workflow) {

package/runtime/scripts/amalgm-mcp/lib/prefs.js

@@ -34,7 +34,7 @@ const DEFAULT_AUTH_METHODS = {
 const SUPPORTED_AUTH_BY_HARNESS = {
   claude_code: ['amalgm', 'byok', 'provider_auth'],
   codex: ['amalgm', 'byok', 'provider_auth'],
-  opencode: ['amalgm', 'byok'],
+  opencode: ['amalgm', 'byok', 'provider_auth'],
   pi: ['amalgm', 'byok', 'provider_auth'],
   amp: ['provider_auth'],
   cursor: ['provider_auth'],

package/runtime/scripts/amalgm-mcp/tests/automations-store-runner.test.js

@@ -44,6 +44,9 @@ test('automation stores trigger plus workflow in local live SQLite resources', (
   assert.equal(automation.triggers.length, 1);
   assert.equal(automation.workflows.length, 1);
   assert.equal(automation.triggers[0].kind, 'event');
+  assert.equal(automation.status, 'active');
+  assert.equal(automation.triggers[0].status, 'active');
+  assert.equal(automation.workflows[0].status, 'active');
 
   const snapshot = buildSnapshot('automations,triggers,workflows');
   assert.equal(snapshot.resources.automations.some((item) => item.id === 'automation-webhook'), true);

package/runtime/scripts/chat-core/adapters/claude.js

@@ -3,13 +3,13 @@
 const path = require('path');
 const { done, errorEvent, reasoningStarted, usageFinal } = require('../events');
 const { promptText } = require('../input');
-const { runtimeEnv } = require('../auth');
 const { normalizeClaudeMessage, usageRecordsFromClaudeResult, usageFromClaude } = require('../normalizers/claude');
 const { recordNativeEvent } = require('../recorder');
 const { toClaudeMcpServers } = require('../tooling/mcp-bundle');
 const { bundledClaudeBinary } = require('../tooling/native-binaries');
-const { claudeNativeHookSettings, syncNativeHarnessConfig } = require('../tooling/native-config');
+const { claudeNativeHookSettings } = require('../tooling/native-config');
 const { importPackage } = require('../tooling/package-import');
+const { prepareHarnessRuntime } = require('../tooling/runtime-home');
 const { composeSystemPrompt } = require('../tooling/system-prompt');
 
 function redactSecrets(text) {
@@ -32,16 +32,16 @@ class ClaudeAdapter {
   }
 
   options(contract, extra = {}) {
-    syncNativeHarnessConfig(contract);
+    const runtime = prepareHarnessRuntime(contract);
     const systemPrompt = composeSystemPrompt(contract);
     const pathToClaudeCodeExecutable = process.env.CLAUDE_CODE_BINARY || bundledClaudeBinary();
     const settings = {
-      ...(claudeNativeHookSettings({ cwd: contract.cwd }) || {}),
+      ...(contract.authMethod === 'provider_auth' ? (claudeNativeHookSettings({ cwd: contract.cwd }) || {}) : {}),
       ...(contract.fastMode ? { fastMode: true, fastModePerSessionOptIn: true } : {}),
     };
     return {
       cwd: contract.cwd,
-      env: runtimeEnv(contract),
+      env: runtime.env,
       model: contract.cliModel,
       ...(contract.reasoningEffort ? { effort: contract.reasoningEffort } : {}),
       ...(Object.keys(settings).length > 0 ? { settings } : {}),
@@ -51,7 +51,7 @@ class ClaudeAdapter {
       permissionMode: 'bypassPermissions',
       allowDangerouslySkipPermissions: true,
       ...(process.env.CHAT_CORE_DEBUG_CLAUDE === '1'
-        ? { debug: true, debugFile: path.join(contract.auth.runtimeHome || process.cwd(), 'claude-debug.log') }
+        ? { debug: true, debugFile: path.join(runtime.runtimeHome, 'claude-debug.log') }
         : {}),
       settingSources: [],
       strictMcpConfig: false,

package/runtime/scripts/chat-core/adapters/codex.js

@@ -6,12 +6,12 @@ const os = require('os');
 const path = require('path');
 const { done, errorEvent } = require('../events');
 const { promptText } = require('../input');
-const { runtimeEnv } = require('../auth');
 const { codexErrorMessage, normalizeCodexNotification } = require('../normalizers/codex');
 const { recordNativeEvent } = require('../recorder');
 const { relayedMcpServers, toCodexMcpToml } = require('../tooling/mcp-bundle');
-const { bundledCodexBinary, bundledCodexPathDirs, executableExists } = require('../tooling/native-binaries');
+const { bundledCodexBinary, bundledCodexPathDirs, executableExists, findOnPath } = require('../tooling/native-binaries');
 const { syncCodexNativeConfig } = require('../tooling/native-config');
+const { prepareHarnessRuntime } = require('../tooling/runtime-home');
 const { composeSystemPrompt } = require('../tooling/system-prompt');
 
 class JsonLineRpc {
@@ -139,16 +139,29 @@ class JsonLineRpc {
 
 function resolveBinary() {
   const home = process.env.HOME || os.homedir();
-  for (const candidate of [process.env.CODEX_BINARY, bundledCodexBinary(), path.join(home, '.npm-global/bin/codex'), '/opt/homebrew/bin/codex', '/usr/local/bin/codex', 'codex'].filter(Boolean)) {
-    if (candidate.includes('/') && !executableExists(candidate)) continue;
+  const candidates = [
+    process.env.CODEX_BINARY,
+    bundledCodexBinary(),
+    path.join(home, '.npm-global/bin/codex'),
+    '/opt/homebrew/bin/codex',
+    '/usr/local/bin/codex',
+    findOnPath('codex'),
+  ].filter(Boolean);
+  const failures = [];
+  for (const candidate of candidates) {
+    if (!executableExists(candidate)) {
+      failures.push(`${candidate} (missing or not executable)`);
+      continue;
+    }
     const res = spawnSync(candidate, ['--version'], { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf8' });
     if (res.status === 0) return candidate;
+    failures.push(`${candidate} (--version failed: ${res.error?.message || res.status || res.signal || 'unknown'})`);
   }
-  return 'codex';
+  throw new Error(`Codex CLI binary is not available. Checked: ${failures.join(', ') || 'no candidates'}. Reinstall Amalgm or run amalgm update so the bundled Codex native package is present.`);
 }
 
-function codexEnv(contract, binary) {
-  const env = runtimeEnv(contract);
+function codexEnv(baseEnv, binary) {
+  const env = { ...(baseEnv || {}) };
   if (binary !== bundledCodexBinary()) return env;
   const pathDirs = bundledCodexPathDirs();
   if (pathDirs.length > 0) {
@@ -346,11 +359,13 @@ function baseNativeConfigForContract(contract, syncInfo) {
   return readTextFile(syncInfo?.sourceConfigPath);
 }
 
-function writeConfig(contract) {
+function writeConfig(contract, syncInfo) {
   const home = contract.auth.runtimeHome;
   if (!home) return;
   fs.mkdirSync(home, { recursive: true });
-  const syncInfo = syncCodexNativeConfig(home);
+  if (syncInfo === undefined) {
+    syncInfo = contract.authMethod === 'provider_auth' ? syncCodexNativeConfig(home) : null;
+  }
   const nativeConfig = baseNativeConfigForContract(contract, syncInfo);
   const configPath = path.join(home, 'config.toml');
   if (contract.authMethod === 'provider_auth') {
@@ -372,9 +387,10 @@ function writeConfig(contract) {
 
 class CodexAdapter {
   async create(contract) {
-    writeConfig(contract);
+    const runtime = prepareHarnessRuntime(contract);
+    writeConfig(contract, runtime.syncInfo);
     const binary = resolveBinary();
-    const client = new JsonLineRpc({ binary, cwd: contract.cwd, env: codexEnv(contract, binary) });
+    const client = new JsonLineRpc({ binary, cwd: contract.cwd, env: codexEnv(runtime.env, binary) });
     await client.request('initialize', { clientInfo: { name: 'amalgm-chat-core', version: '1.0.0' }, capabilities: { experimentalApi: true } });
     client.notify('initialized');
     const threadOptions = {

package/runtime/scripts/chat-core/adapters/opencode.js

@@ -7,12 +7,12 @@ const os = require('os');
 const path = require('path');
 const { done, errorEvent, reasoningStarted } = require('../events');
 const { openCodeParts } = require('../input');
-const { runtimeEnv } = require('../auth');
 const { normalizeOpenCodeEvent, normalizeOpenCodePromptResult } = require('../normalizers/opencode');
 const { recordNativeEvent } = require('../recorder');
 const { toOpenCodeMcpConfig } = require('../tooling/mcp-bundle');
-const { bundledOpenCodeBinary, executableExists } = require('../tooling/native-binaries');
+const { bundledOpenCodeBinary, executableExists, findOnPath } = require('../tooling/native-binaries');
 const { importPackage } = require('../tooling/package-import');
+const { prepareHarnessRuntime } = require('../tooling/runtime-home');
 const { composeSystemPrompt } = require('../tooling/system-prompt');
 
 function splitModel(model, auth) {
@@ -39,7 +39,7 @@ function splitModel(model, auth) {
 function configFor(contract) {
   const model = splitModel(contract.cliModel || contract.usageModelId, contract.auth);
   const systemPrompt = composeSystemPrompt(contract);
-  return {
+  const config = {
     logLevel: process.env.OPENCODE_LOG_LEVEL || 'ERROR',
     enabled_providers: [model.providerID],
     disabled_providers: [],
@@ -75,7 +75,9 @@ function configFor(contract) {
       title: { disable: true },
     },
     mcp: toOpenCodeMcpConfig(contract),
-    provider: {
+  };
+  if (contract.authMethod !== 'provider_auth') {
+    config.provider = {
       [model.providerID]: {
         options: {
           baseURL: contract.auth.baseUrl,
@@ -85,8 +87,9 @@ function configFor(contract) {
           chunkTimeout: 300000,
         },
       },
-    },
-  };
+    };
+  }
+  return config;
 }
 
 function resultData(result) {
@@ -102,22 +105,28 @@ function resolveBinary() {
     path.join(home, '.npm-global/bin/opencode'),
     '/opt/homebrew/bin/opencode',
     '/usr/local/bin/opencode',
-    'opencode',
+    findOnPath('opencode'),
   ].filter(Boolean);
+  const failures = [];
   for (const candidate of candidates) {
-    if (candidate.includes('/') && !executableExists(candidate)) continue;
+    if (!executableExists(candidate)) {
+      failures.push(`${candidate} (missing or not executable)`);
+      continue;
+    }
     const res = spawnSync(candidate, ['--version'], { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf8' });
     if (res.status === 0) return candidate;
+    failures.push(`${candidate} (--version failed: ${res.error?.message || res.status || res.signal || 'unknown'})`);
   }
-  return 'opencode';
+  throw new Error(`OpenCode CLI binary is not available. Checked: ${failures.join(', ') || 'no candidates'}. Reinstall Amalgm or run amalgm update so the bundled OpenCode native package is present.`);
 }
 
 async function startOpenCodeServer(contract) {
+  const runtime = prepareHarnessRuntime(contract);
   const binary = resolveBinary();
   const config = configFor(contract);
   const port = await freePort();
   const env = {
-    ...runtimeEnv(contract),
+    ...runtime.env,
     OPENCODE_CONFIG_CONTENT: JSON.stringify(config),
   };
   const args = ['serve', '--pure', '--hostname=127.0.0.1', `--port=${port}`];

package/runtime/scripts/chat-core/auth.js

@@ -9,7 +9,7 @@ const { resolveCredential } = require('./credentials/store');
 const AUTH_BY_HARNESS = {
   claude_code: ['amalgm', 'byok', 'provider_auth'],
   codex: ['amalgm', 'byok', 'provider_auth'],
-  opencode: ['amalgm', 'byok'],
+  opencode: ['amalgm', 'byok', 'provider_auth'],
 };
 
 function shellValue(raw) {
@@ -109,35 +109,15 @@ function providerAuthIdentity(harness) {
   return `${harness || 'provider'}:provider-default`;
 }
 
-function deriveAuthProfileId({ method, harness, userId, tokenFingerprint }) {
-  if (method === 'amalgm') {
-    return `amalgm-${fingerprint(userId || process.env.AMALGM_USER_ID || 'local') || 'local'}`;
-  }
-  if (method === 'byok') {
-    return `byok-${tokenFingerprint || 'default'}`;
-  }
-  if (method === 'provider_auth') {
-    return `provider-${fingerprint(providerAuthIdentity(harness)) || 'default'}`;
-  }
-  return 'default';
-}
-
-function runtimeHome({ amalgmDir, harness, authProfileId }) {
-  return path.join(amalgmDir, 'cli-homes', safePathSegment(harness), safePathSegment(authProfileId));
-}
-
-function pinnedRuntimeHome(amalgmDir, cliHomePath) {
-  if (typeof cliHomePath !== 'string' || !cliHomePath.trim()) return null;
-  const root = path.resolve(amalgmDir);
-  const resolved = path.resolve(cliHomePath.trim());
-  return resolved === root || resolved.startsWith(`${root}${path.sep}`) ? resolved : null;
+function runtimeHome({ amalgmDir, harness }) {
+  return path.join(amalgmDir, 'cli-homes', safePathSegment(harness), 'home');
 }
 
 function providerAuthFingerprint(harness) {
   return fingerprint(providerAuthIdentity(harness));
 }
 
-function authEnvelope({ harness, authMethod, sessionId, localBaseUrl, proxyToken, proxyBaseUrl, amalgmDir, userId, credentialId, modelId, cliHomePath, authProfileId }) {
+function authEnvelope({ harness, authMethod, sessionId, localBaseUrl, proxyToken, proxyBaseUrl, amalgmDir, userId, credentialId, modelId }) {
   const method = coerceAuth(harness, authMethod);
   const byok = readByokFile(amalgmDir);
   let baseUrl = null;
@@ -166,7 +146,6 @@ function authEnvelope({ harness, authMethod, sessionId, localBaseUrl, proxyToken
   } else if (method === 'provider_auth') {
     tokenFingerprint = providerAuthFingerprint(harness);
   }
-  const profileId = authProfileId || deriveAuthProfileId({ method, harness, userId, tokenFingerprint });
   return {
     method,
     baseUrl,
@@ -176,10 +155,7 @@ function authEnvelope({ harness, authMethod, sessionId, localBaseUrl, proxyToken
     forwardBaseUrl,
     tokenRef,
     tokenFingerprint,
-    authProfileId: profileId,
-    runtimeHome:
-      pinnedRuntimeHome(amalgmDir, cliHomePath)
-      || runtimeHome({ amalgmDir, harness, authProfileId: profileId }),
+    runtimeHome: runtimeHome({ amalgmDir, harness }),
   };
 }
 
@@ -203,6 +179,12 @@ function runtimeEnv(contract, baseEnv = process.env) {
     env.CLAUDE_CONFIG_DIR = contract.auth.runtimeHome;
     env.OPENCODE_HOME = contract.auth.runtimeHome;
     env.OPENCODE_CONFIG_DIR = contract.auth.runtimeHome;
+    if (contract.harness === 'opencode') {
+      env.XDG_CONFIG_HOME = path.join(contract.auth.runtimeHome, '.config');
+      env.XDG_DATA_HOME = path.join(contract.auth.runtimeHome, '.local', 'share');
+      env.XDG_STATE_HOME = path.join(contract.auth.runtimeHome, '.local', 'state');
+      env.XDG_CACHE_HOME = path.join(contract.auth.runtimeHome, '.cache');
+    }
     if (contract.harness === 'claude_code' && contract.authMethod === 'provider_auth') {
       delete env.CLAUDE_CONFIG_DIR;
     }

package/runtime/scripts/chat-core/contract.js

@@ -347,8 +347,6 @@ function createContract(payload, options = {}) {
     userId,
     credentialId: payload.credentialId || payload.byokCredentialId || null,
     modelId,
-    cliHomePath: payload.cliHomePath || payload.cli_home_path || null,
-    authProfileId: payload.authProfileId || payload.auth_profile_id || null,
   });
   const contract = {
     sessionId,

package/runtime/scripts/chat-core/engine.js

@@ -179,7 +179,6 @@ class ChatCore {
         auth: {
           baseUrl: contract.auth.baseUrl,
           tokenFingerprint: contract.auth.tokenFingerprint,
-          authProfileId: contract.auth.authProfileId,
           runtimeHome: contract.auth.runtimeHome,
         },
       },

package/runtime/scripts/chat-core/tests/auth.test.js

@@ -1,37 +1,54 @@
 'use strict';
 
 const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
 const test = require('node:test');
 const { authEnvelope, runtimeEnv } = require('../auth');
 
-test('amalgm auth uses a pinned CLI home across sessions and proxy token refreshes', () => {
-  const first = authEnvelope({
-    harness: 'codex',
-    authMethod: 'amalgm',
-    sessionId: 'session-one',
-    proxyToken: 'proxy-token-one',
-    localBaseUrl: 'http://127.0.0.1:8084',
-    proxyBaseUrl: 'https://proxy.example.test',
-    amalgmDir: '/tmp/amalgm-test',
-    userId: 'user-123',
-  });
-  const second = authEnvelope({
-    harness: 'codex',
-    authMethod: 'amalgm',
-    sessionId: 'session-two',
-    proxyToken: 'proxy-token-two',
-    localBaseUrl: 'http://127.0.0.1:8084',
-    proxyBaseUrl: 'https://proxy.example.test',
-    amalgmDir: '/tmp/amalgm-test',
-    userId: 'user-123',
-  });
+test('codex always uses one canonical CLI home across auth methods and token refreshes', () => {
+  const amalgmDir = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-auth-test-'));
+  fs.writeFileSync(path.join(amalgmDir, '.amalgm-credentials'), 'OPENAI_API_KEY=sk-test\n');
+  try {
+    const first = authEnvelope({
+      harness: 'codex',
+      authMethod: 'amalgm',
+      sessionId: 'session-one',
+      proxyToken: 'proxy-token-one',
+      localBaseUrl: 'http://127.0.0.1:8084',
+      proxyBaseUrl: 'https://proxy.example.test',
+      amalgmDir,
+      userId: 'user-123',
+    });
+    const second = authEnvelope({
+      harness: 'codex',
+      authMethod: 'provider_auth',
+      sessionId: 'session-two',
+      proxyToken: 'proxy-token-two',
+      localBaseUrl: 'http://127.0.0.1:8084',
+      proxyBaseUrl: 'https://proxy.example.test',
+      amalgmDir,
+      userId: 'user-123',
+    });
+    const third = authEnvelope({
+      harness: 'codex',
+      authMethod: 'byok',
+      sessionId: 'session-three',
+      amalgmDir,
+      userId: 'user-123',
+    });
 
-  assert.notEqual(first.tokenFingerprint, second.tokenFingerprint);
-  assert.equal(first.runtimeHome, second.runtimeHome);
-  assert.match(first.runtimeHome, /\/tmp\/amalgm-test\/cli-homes\/codex\/amalgm-[0-9a-f]{16}$/);
+    assert.notEqual(first.tokenFingerprint, second.tokenFingerprint);
+    assert.equal(first.runtimeHome, second.runtimeHome);
+    assert.equal(second.runtimeHome, third.runtimeHome);
+    assert.equal(first.runtimeHome, path.join(amalgmDir, 'cli-homes', 'codex', 'home'));
+  } finally {
+    fs.rmSync(amalgmDir, { recursive: true, force: true });
+  }
 });
 
-test('opencode amalgm auth uses a pinned CLI home across sessions and proxy token refreshes', () => {
+test('opencode always uses one canonical CLI home across auth methods and token refreshes', () => {
   const first = authEnvelope({
     harness: 'opencode',
     authMethod: 'amalgm',
@@ -44,7 +61,7 @@ test('opencode amalgm auth uses a pinned CLI home across sessions and proxy toke
   });
   const second = authEnvelope({
     harness: 'opencode',
-    authMethod: 'amalgm',
+    authMethod: 'provider_auth',
     sessionId: 'session-two',
     proxyToken: 'proxy-token-two',
     localBaseUrl: 'http://127.0.0.1:8084',
@@ -56,13 +73,15 @@ test('opencode amalgm auth uses a pinned CLI home across sessions and proxy toke
 
   assert.notEqual(first.tokenFingerprint, second.tokenFingerprint);
   assert.equal(first.runtimeHome, second.runtimeHome);
-  assert.match(first.runtimeHome, /\/tmp\/amalgm-test\/cli-homes\/opencode\/amalgm-[0-9a-f]{16}$/);
+  assert.equal(first.runtimeHome, '/tmp/amalgm-test/cli-homes/opencode/home');
   assert.equal(env.HOME, first.runtimeHome);
   assert.equal(env.OPENCODE_HOME, first.runtimeHome);
   assert.equal(env.OPENCODE_CONFIG_DIR, first.runtimeHome);
+  assert.equal(env.XDG_CONFIG_HOME, '/tmp/amalgm-test/cli-homes/opencode/home/.config');
+  assert.equal(env.XDG_DATA_HOME, '/tmp/amalgm-test/cli-homes/opencode/home/.local/share');
 });
 
-test('claude provider auth uses a pinned CLI home with native config copied separately', () => {
+test('claude always uses one canonical CLI home', () => {
   const envelope = authEnvelope({
     harness: 'claude_code',
     authMethod: 'provider_auth',
@@ -70,7 +89,7 @@ test('claude provider auth uses a pinned CLI home with native config copied sepa
     amalgmDir: '/tmp/amalgm-test',
   });
 
-  assert.match(envelope.runtimeHome, /\/tmp\/amalgm-test\/cli-homes\/claude_code\/provider-[0-9a-f]{16}$/);
+  assert.equal(envelope.runtimeHome, '/tmp/amalgm-test/cli-homes/claude_code/home');
 
   const env = runtimeEnv({
     harness: 'claude_code',
@@ -88,19 +107,7 @@ test('claude provider auth uses a pinned CLI home with native config copied sepa
   assert.equal(env.ANTHROPIC_API_KEY, undefined);
 });
 
-test('codex provider auth uses a pinned provider home', () => {
-  const envelope = authEnvelope({
-    harness: 'codex',
-    authMethod: 'provider_auth',
-    sessionId: 'session-test',
-    amalgmDir: '/tmp/amalgm-test',
-  });
-
-  assert.match(envelope.runtimeHome, /\/tmp\/amalgm-test\/cli-homes\/codex\/provider-[0-9a-f]{16}$/);
-  assert.equal(envelope.runtimeHome.includes('/runtime/session-test/'), false);
-});
-
-test('stored CLI home path wins over derived path', () => {
+test('provided CLI home path cannot move an agent off its canonical home', () => {
   const envelope = authEnvelope({
     harness: 'codex',
     authMethod: 'amalgm',
@@ -114,6 +121,5 @@ test('stored CLI home path wins over derived path', () => {
     authProfileId: 'manual-profile',
   });
 
-  assert.equal(envelope.authProfileId, 'manual-profile');
-  assert.equal(envelope.runtimeHome, '/tmp/amalgm-test/cli-homes/codex/manual-profile');
+  assert.equal(envelope.runtimeHome, '/tmp/amalgm-test/cli-homes/codex/home');
 });

package/runtime/scripts/chat-core/tests/native-binaries.test.js

@@ -0,0 +1,126 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const { spawnSync } = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const test = require('node:test');
+const nativeBinaries = require('../tooling/native-binaries');
+
+function packagePath(root, packageName) {
+  return path.join(root, ...String(packageName).split('/'));
+}
+
+function writePackage(root, packageName) {
+  fs.mkdirSync(root, { recursive: true });
+  fs.writeFileSync(path.join(root, 'package.json'), `${JSON.stringify({ name: packageName, version: '0.0.0' }, null, 2)}\n`);
+}
+
+function writeExecutable(file) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  if (process.platform === 'win32') {
+    fs.writeFileSync(file, '@echo off\r\nexit /b 0\r\n');
+  } else {
+    fs.writeFileSync(file, '#!/bin/sh\nexit 0\n');
+    fs.chmodSync(file, 0o755);
+  }
+}
+
+function installFakePackagedAgentDeps(resourcesPath) {
+  const nodeModules = path.join(resourcesPath, 'app.asar.unpacked', 'node_modules');
+  const claudePackage = nativeBinaries.__private.claudeTargetPackage();
+  const codexTarget = nativeBinaries.__private.codexTarget();
+  const openCodePackage = nativeBinaries.__private.openCodePackageCandidates()[0];
+  assert.ok(claudePackage, 'current platform should have a Claude native package');
+  assert.ok(codexTarget, 'current platform should have a Codex native package');
+  assert.ok(openCodePackage, 'current platform should have an OpenCode native package');
+
+  writePackage(path.join(nodeModules, '@anthropic-ai', 'claude-agent-sdk'), '@anthropic-ai/claude-agent-sdk');
+  writePackage(path.join(nodeModules, '@openai', 'codex'), '@openai/codex');
+  writePackage(path.join(nodeModules, 'opencode-ai'), 'opencode-ai');
+
+  const claudeRoot = packagePath(
+    path.join(nodeModules, '@anthropic-ai', 'claude-agent-sdk', 'node_modules'),
+    claudePackage,
+  );
+  writePackage(claudeRoot, claudePackage);
+  const claude = path.join(claudeRoot, process.platform === 'win32' ? 'claude.exe' : 'claude');
+  writeExecutable(claude);
+
+  const codexRoot = packagePath(
+    path.join(nodeModules, '@openai', 'codex', 'node_modules'),
+    codexTarget.packageName,
+  );
+  writePackage(codexRoot, codexTarget.packageName);
+  const codex = path.join(codexRoot, 'vendor', codexTarget.triple, 'codex', codexTarget.binaryName);
+  writeExecutable(codex);
+
+  const openCodeRoot = packagePath(
+    path.join(nodeModules, 'opencode-ai', 'node_modules'),
+    openCodePackage,
+  );
+  writePackage(openCodeRoot, openCodePackage);
+  const opencode = path.join(openCodeRoot, 'bin', process.platform === 'win32' ? 'opencode.exe' : 'opencode');
+  writeExecutable(opencode);
+
+  return { claude, codex, opencode };
+}
+
+function withFakePackagedResources(fn) {
+  const previousResourcesPath = Object.getOwnPropertyDescriptor(process, 'resourcesPath');
+  const previousEnv = {
+    AMALGM_AGENT_BIN_DIR: process.env.AMALGM_AGENT_BIN_DIR,
+    AMALGM_NATIVE_NODE_MODULES: process.env.AMALGM_NATIVE_NODE_MODULES,
+    CLAUDE_CODE_BINARY: process.env.CLAUDE_CODE_BINARY,
+    PATH: process.env.PATH,
+  };
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-native-binaries-'));
+  const resourcesPath = path.join(root, 'resources');
+  const binDir = path.join(root, 'bin');
+  try {
+    Object.defineProperty(process, 'resourcesPath', {
+      value: resourcesPath,
+      configurable: true,
+    });
+    process.env.AMALGM_AGENT_BIN_DIR = binDir;
+    process.env.PATH = '';
+    delete process.env.AMALGM_NATIVE_NODE_MODULES;
+    delete process.env.CLAUDE_CODE_BINARY;
+    return fn({ root, resourcesPath, binDir });
+  } finally {
+    if (previousResourcesPath) {
+      Object.defineProperty(process, 'resourcesPath', previousResourcesPath);
+    } else {
+      delete process.resourcesPath;
+    }
+    for (const [key, value] of Object.entries(previousEnv)) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+test('packaged nested agent dependencies resolve to exact executable paths and spawnable shims', () => {
+  withFakePackagedResources(({ resourcesPath, binDir }) => {
+    const expected = installFakePackagedAgentDeps(resourcesPath);
+
+    assert.equal(nativeBinaries.__private.bundledClaudeBinary(), expected.claude);
+    assert.equal(nativeBinaries.bundledCodexBinary(), expected.codex);
+    assert.equal(nativeBinaries.bundledOpenCodeBinary(), expected.opencode);
+
+    const result = nativeBinaries.ensureAgentCommandShims({ quiet: true, logger: { log() {} } });
+    assert.equal(result.ok, true);
+    for (const command of ['claude', 'codex', 'opencode']) {
+      const shim = path.join(binDir, process.platform === 'win32' ? `${command}.cmd` : command);
+      assert.equal(fs.existsSync(shim), true);
+      const spawned = spawnSync(shim, ['--smoke'], {
+        stdio: 'ignore',
+        shell: process.platform === 'win32',
+        windowsHide: true,
+      });
+      assert.equal(spawned.status, 0, `${command} shim should spawn`);
+    }
+  });
+});

package/runtime/scripts/chat-core/tests/native-config.test.js

@@ -11,7 +11,9 @@ const {
   claudeNativeHookSettings,
   syncClaudeNativeConfig,
   syncCodexNativeConfig,
+  syncOpenCodeNativeConfig,
 } = require('../tooling/native-config');
+const { prepareHarnessRuntime } = require('../tooling/runtime-home');
 
 function withNativeHome(fn) {
   const previousNativeHome = process.env.AMALGM_NATIVE_HOME;
@@ -66,6 +68,91 @@ test('codex native sync copies config without deleting existing runtime state',
   });
 });
 
+test('prepared codex runtime uses managed home while importing native config', () => {
+  withNativeHome((home) => {
+    const source = path.join(home, '.codex');
+    fs.mkdirSync(source, { recursive: true });
+    fs.writeFileSync(path.join(source, 'config.toml'), 'model = "gpt-5.5"');
+    fs.writeFileSync(path.join(source, 'hooks.json'), '{"hooks":{}}');
+
+    const runtimeHome = path.join(home, 'managed', 'codex-home');
+    const prepared = prepareHarnessRuntime({
+      harness: 'codex',
+      authMethod: 'provider_auth',
+      auth: { runtimeHome },
+    }, { PATH: '/bin', HOME: home });
+
+    assert.equal(prepared.runtimeHome, runtimeHome);
+    assert.equal(prepared.env.HOME, runtimeHome);
+    assert.equal(prepared.env.CODEX_HOME, runtimeHome);
+    assert.equal(prepared.syncInfo.runtimeHome, runtimeHome);
+    assert.equal(fs.existsSync(path.join(runtimeHome, 'config.toml')), true);
+    assert.equal(fs.existsSync(path.join(runtimeHome, 'hooks.json')), true);
+    assert.equal(fs.existsSync(path.join(runtimeHome, '.codex', 'config.toml')), true);
+  });
+});
+
+test('prepared opencode runtime always has an isolated managed home', () => {
+  withNativeHome((home) => {
+    const runtimeHome = path.join(home, 'managed', 'opencode-home');
+    const prepared = prepareHarnessRuntime({
+      harness: 'opencode',
+      authMethod: 'amalgm',
+      auth: { runtimeHome, tokenRef: 'test-token', baseUrl: 'https://example.test' },
+    }, { PATH: '/bin', HOME: home });
+
+    assert.equal(prepared.runtimeHome, runtimeHome);
+    assert.equal(prepared.env.HOME, runtimeHome);
+    assert.equal(prepared.env.OPENCODE_HOME, runtimeHome);
+    assert.equal(prepared.env.OPENCODE_CONFIG_DIR, runtimeHome);
+    assert.equal(fs.existsSync(runtimeHome), true);
+  });
+});
+
+test('provider auth imports opencode native config into managed home', () => {
+  withNativeHome((home) => {
+    const configDir = path.join(home, '.config', 'opencode');
+    const dataDir = path.join(home, '.local', 'share', 'opencode');
+    fs.mkdirSync(configDir, { recursive: true });
+    fs.mkdirSync(dataDir, { recursive: true });
+    fs.writeFileSync(path.join(configDir, 'opencode.json'), '{"mcp":{}}');
+    fs.writeFileSync(path.join(dataDir, 'auth.json'), '{"provider":"test"}');
+
+    const runtimeHome = path.join(home, 'managed', 'opencode-home');
+    const prepared = prepareHarnessRuntime({
+      harness: 'opencode',
+      authMethod: 'provider_auth',
+      auth: { runtimeHome },
+    }, { PATH: '/bin', HOME: home });
+
+    assert.equal(prepared.runtimeHome, runtimeHome);
+    assert.equal(prepared.env.HOME, runtimeHome);
+    assert.equal(prepared.env.OPENCODE_HOME, runtimeHome);
+    assert.equal(prepared.env.XDG_CONFIG_HOME, path.join(runtimeHome, '.config'));
+    assert.equal(fs.existsSync(path.join(runtimeHome, '.config', 'opencode', 'opencode.json')), true);
+    assert.equal(fs.existsSync(path.join(runtimeHome, '.local', 'share', 'opencode', 'auth.json')), true);
+  });
+});
+
+test('non-user auth prepares a home without importing native config', () => {
+  withNativeHome((home) => {
+    const source = path.join(home, '.codex');
+    fs.mkdirSync(source, { recursive: true });
+    fs.writeFileSync(path.join(source, 'config.toml'), 'model = "native"');
+
+    const runtimeHome = path.join(home, 'managed', 'codex-home');
+    const prepared = prepareHarnessRuntime({
+      harness: 'codex',
+      authMethod: 'amalgm',
+      auth: { runtimeHome, tokenRef: 'test-token', baseUrl: 'https://example.test' },
+    }, { PATH: '/bin', HOME: home });
+
+    assert.equal(prepared.syncInfo, null);
+    assert.equal(fs.existsSync(runtimeHome), true);
+    assert.equal(fs.existsSync(path.join(runtimeHome, 'config.toml')), false);
+  });
+});
+
 test('codex provider config keeps native mcp config and overrides managed model provider', () => {
   withNativeHome((home) => {
     const source = path.join(home, '.codex');
@@ -105,7 +192,7 @@ test('codex provider config keeps native mcp config and overrides managed model
   });
 });
 
-test('codex amalgm config keeps native mcp config and overrides managed model provider', () => {
+test('codex amalgm config does not import native user config', () => {
   withNativeHome((home) => {
     const source = path.join(home, '.codex');
     fs.mkdirSync(source, { recursive: true });
@@ -134,12 +221,11 @@ test('codex amalgm config keeps native mcp config and overrides managed model pr
 
     const config = fs.readFileSync(path.join(runtimeHome, 'config.toml'), 'utf8');
     assert.match(config, /model_provider = "amalgm"/);
-    assert.match(config, /codex_hooks = true/);
     assert.doesNotMatch(config, /native-provider/);
-    assert.match(config, /\[mcp_servers\.native\]/);
-    assert.match(config, /\[mcp_servers\.native\.http_headers\]/);
-    assert.match(config, /Authorization = "Bearer test"/);
-    assert.equal(config.includes(path.join(runtimeHome, 'hooks.json')), true);
+    assert.doesNotMatch(config, /codex_hooks = true/);
+    assert.doesNotMatch(config, /\[mcp_servers\.native\]/);
+    assert.doesNotMatch(config, /Authorization = "Bearer test"/);
+    assert.equal(config.includes(path.join(runtimeHome, 'hooks.json')), false);
   });
 });
 
@@ -161,9 +247,11 @@ test('claude extracts native hooks without enabling full filesystem settings', (
     assert.equal(hookSettings.permissions, undefined);
 
     const adapter = new ClaudeAdapter();
+    const runtimeHome = path.join(home, 'runtime-home');
     const options = adapter.options({
+      harness: 'claude_code',
       authMethod: 'provider_auth',
-      auth: { runtimeHome: null },
+      auth: { runtimeHome },
       cwd: home,
       cliModel: 'anthropic/claude-opus-4.7',
       mcpServers: [],
@@ -175,7 +263,7 @@ test('claude extracts native hooks without enabling full filesystem settings', (
   });
 });
 
-test('claude native sync skips debug symlinks', () => {
+test('claude native sync does not delete existing debug symlinks', () => {
   withNativeHome((home) => {
     const source = path.join(home, '.claude');
     fs.mkdirSync(path.join(source, 'debug'), { recursive: true });
@@ -193,7 +281,41 @@ test('claude native sync skips debug symlinks', () => {
     assert.equal(result.sourceDir, source);
     assert.equal(fs.existsSync(path.join(runtimeHome, 'settings.json')), true);
     assert.equal(fs.existsSync(path.join(runtimeHome, 'debug', 'trace.txt')), false);
-    assert.equal(fs.existsSync(path.join(runtimeHome, 'debug', 'latest')), false);
+    assert.equal(fs.lstatSync(path.join(runtimeHome, 'debug', 'latest')).isSymbolicLink(), true);
+  });
+});
+
+test('native sync never replaces existing in-home dot dirs', () => {
+  withNativeHome((home) => {
+    const source = path.join(home, '.codex');
+    fs.mkdirSync(source, { recursive: true });
+    fs.writeFileSync(path.join(source, 'config.toml'), 'model = "gpt-5.5"');
+
+    const runtimeHome = path.join(home, 'runtime-home');
+    fs.mkdirSync(path.join(runtimeHome, '.codex'), { recursive: true });
+    fs.writeFileSync(path.join(runtimeHome, '.codex', 'sentinel'), 'keep');
+
+    syncCodexNativeConfig(runtimeHome);
+
+    assert.equal(fs.existsSync(path.join(runtimeHome, '.codex', 'sentinel')), true);
+    assert.equal(fs.lstatSync(path.join(runtimeHome, '.codex')).isDirectory(), true);
+  });
+});
+
+test('opencode native sync preserves existing session state', () => {
+  withNativeHome((home) => {
+    const dataDir = path.join(home, '.local', 'share', 'opencode');
+    fs.mkdirSync(dataDir, { recursive: true });
+    fs.writeFileSync(path.join(dataDir, 'auth.json'), '{"provider":"test"}');
+
+    const runtimeHome = path.join(home, 'runtime-home');
+    fs.mkdirSync(path.join(runtimeHome, '.local', 'share', 'opencode', 'session'), { recursive: true });
+    fs.writeFileSync(path.join(runtimeHome, '.local', 'share', 'opencode', 'session', 'sentinel'), 'keep');
+
+    syncOpenCodeNativeConfig(runtimeHome);
+
+    assert.equal(fs.existsSync(path.join(runtimeHome, '.local', 'share', 'opencode', 'auth.json')), true);
+    assert.equal(fs.existsSync(path.join(runtimeHome, '.local', 'share', 'opencode', 'session', 'sentinel')), true);
   });
 });
 

package/runtime/scripts/chat-core/tooling/native-binaries.js

@@ -10,21 +10,52 @@ function amalgmDir() {
 }
 
 function nativeNodeModulesDirs() {
-  return [
+  const resourcesPath = process.resourcesPath || '';
+  const resourceNodeModules = [
+    resourcesPath ? path.join(resourcesPath, 'app.asar.unpacked', 'node_modules') : '',
+    resourcesPath ? path.join(resourcesPath, 'app.asar', 'node_modules') : '',
+    resourcesPath ? path.join(resourcesPath, 'cli', 'node_modules') : '',
+    resourcesPath ? path.join(resourcesPath, 'runtime', 'node_modules') : '',
+  ].filter(Boolean);
+  const wrapperPackages = [
+    '@anthropic-ai/claude-agent-sdk',
+    '@openai/codex',
+    'opencode-ai',
+  ];
+  return unique([
     process.env.AMALGM_NATIVE_NODE_MODULES,
     path.join(amalgmDir(), 'native', 'node_modules'),
-  ].filter(Boolean);
+    ...resourceNodeModules,
+    ...resourceNodeModules.flatMap((dir) => wrapperPackages.map((packageName) => path.join(dir, packageName, 'node_modules'))),
+  ].filter(Boolean));
 }
 
-function executableExists(file) {
+function asarUnpackedPath(file) {
+  const marker = `${path.sep}app.asar${path.sep}`;
+  const value = String(file || '');
+  if (!value.includes(marker)) return value;
+  return value.replace(marker, `${path.sep}app.asar.unpacked${path.sep}`);
+}
+
+function existingAsarUnpackedPath(file) {
+  const unpacked = asarUnpackedPath(file);
+  return unpacked !== file && fs.existsSync(unpacked) ? unpacked : file;
+}
+
+function executablePath(file) {
+  const candidate = existingAsarUnpackedPath(file);
   try {
-    fs.accessSync(file, fs.constants.X_OK);
-    return true;
+    fs.accessSync(candidate, fs.constants.X_OK);
+    return candidate;
   } catch {
-    return false;
+    return null;
   }
 }
 
+function executableExists(file) {
+  return Boolean(executablePath(file));
+}
+
 function findPackageJson(packageName) {
   const candidateDirs = [
     ...nativeNodeModulesDirs(),
@@ -39,9 +70,9 @@ function findPackageJson(packageName) {
 
 function packageRoot(packageName) {
   const manifest = findPackageJson(packageName);
-  if (manifest) return path.dirname(manifest);
+  if (manifest) return path.dirname(existingAsarUnpackedPath(manifest));
   try {
-    return path.dirname(require.resolve(`${packageName}/package.json`));
+    return path.dirname(existingAsarUnpackedPath(require.resolve(`${packageName}/package.json`)));
   } catch {
     return null;
   }
@@ -77,7 +108,7 @@ function packageBin(packageName, binName) {
       : manifest.bin?.[binName];
     if (!bin) return null;
     const candidate = path.join(root, bin);
-    return executableExists(candidate) ? candidate : null;
+    return executablePath(candidate);
   } catch {
     return null;
   }
@@ -160,7 +191,7 @@ function bundledClaudeBinary() {
   const root = packageRoot(packageName);
   if (!root) return null;
   const candidate = path.join(root, process.platform === 'win32' ? 'claude.exe' : 'claude');
-  return executableExists(candidate) ? candidate : null;
+  return executablePath(candidate);
 }
 
 function resolveClaudeBinary() {
@@ -224,7 +255,8 @@ function bundledCodexBinary() {
   const vendorRoot = codexVendorRoot();
   if (target && vendorRoot) {
     const candidate = path.join(vendorRoot, target.triple, 'codex', target.binaryName);
-    if (executableExists(candidate)) return candidate;
+    const executable = executablePath(candidate);
+    if (executable) return executable;
   }
   return packageBin('@openai/codex', 'codex');
 }
@@ -596,6 +628,14 @@ function ensureNativeBinaries(options = {}) {
 }
 
 module.exports = {
+  __private: {
+    bundledClaudeBinary,
+    claudeTargetPackage,
+    codexTarget,
+    nativeNodeModulesDirs,
+    openCodePackageCandidates,
+    packageRoot,
+  },
   binaryStatus,
   bundledCodexPathDirs,
   bundledClaudeBinary: resolveClaudeBinary,
@@ -605,4 +645,5 @@ module.exports = {
   ensureAgentCommandShims,
   ensureNativeBinaries,
   executableExists,
+  findOnPath,
 };

package/runtime/scripts/chat-core/tooling/native-config.js

@@ -57,20 +57,12 @@ function shouldCopyConfigPath(root, source) {
 function copyConfigTree(sourceDir, targetDir) {
   if (!sourceDir || !targetDir || !exists(sourceDir)) return false;
   if (path.resolve(sourceDir) === path.resolve(targetDir)) return true;
-  fs.mkdirSync(targetDir, { recursive: true });
-  fs.cpSync(sourceDir, targetDir, {
-    recursive: true,
-    force: true,
-    errorOnExist: false,
-    dereference: false,
-    filter: (source) => shouldCopyConfigPath(sourceDir, source),
-  });
-  return true;
+  return copyDirBounded(sourceDir, targetDir, { maxFiles: 500, maxBytes: 25 * 1024 * 1024 }).copied;
 }
 
 function copyFileIfPresent(source, target) {
   if (!exists(source)) return false;
-  fs.mkdirSync(path.dirname(target), { recursive: true });
+  if (!ensureDirectory(path.dirname(target)) || !canWriteFileTarget(target)) return false;
   fs.copyFileSync(source, target);
   try {
     fs.chmodSync(target, fs.statSync(source).mode & 0o777);
@@ -86,10 +78,8 @@ function ensureHomeAlias(runtimeHome, dotDirName) {
     if (stat.isSymbolicLink()) {
       const target = fs.readlinkSync(alias);
       if (target === '.' || path.resolve(runtimeHome, target) === path.resolve(runtimeHome)) return;
-      fs.rmSync(alias, { recursive: true, force: true });
-    } else {
-      fs.rmSync(alias, { recursive: true, force: true });
     }
+    return;
   } catch {}
   try {
     fs.symlinkSync('.', alias, 'dir');
@@ -98,28 +88,6 @@ function ensureHomeAlias(runtimeHome, dotDirName) {
   }
 }
 
-function removeOutboundSymlink(root, relativePath) {
-  const file = path.join(root, relativePath);
-  let stat;
-  try {
-    stat = fs.lstatSync(file);
-  } catch {
-    return;
-  }
-  if (!stat.isSymbolicLink()) return;
-  let target;
-  try {
-    target = fs.readlinkSync(file);
-  } catch {
-    return;
-  }
-  const resolvedRoot = path.resolve(root);
-  const resolvedTarget = path.resolve(path.dirname(file), target);
-  if (resolvedTarget !== resolvedRoot && !resolvedTarget.startsWith(`${resolvedRoot}${path.sep}`)) {
-    fs.rmSync(file, { force: true });
-  }
-}
-
 function ensureNativeKeychainAlias(runtimeHome) {
   if (process.platform !== 'darwin' || !runtimeHome) return false;
   const source = path.join(nativeHome(), 'Library', 'Keychains');
@@ -131,7 +99,7 @@ function ensureNativeKeychainAlias(runtimeHome) {
       const linkTarget = fs.readlinkSync(target);
       if (path.resolve(path.dirname(target), linkTarget) === path.resolve(source)) return true;
     }
-    fs.rmSync(target, { recursive: true, force: true });
+    return false;
   } catch {}
   fs.mkdirSync(path.dirname(target), { recursive: true });
   try {
@@ -146,6 +114,29 @@ function nativeHome() {
   return process.env.AMALGM_NATIVE_HOME || os.homedir();
 }
 
+function ensureDirectory(dir) {
+  try {
+    const stat = fs.lstatSync(dir);
+    return stat.isDirectory();
+  } catch {
+    try {
+      fs.mkdirSync(dir, { recursive: true });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
+
+function canWriteFileTarget(target) {
+  try {
+    const stat = fs.lstatSync(target);
+    return stat.isFile();
+  } catch {
+    return true;
+  }
+}
+
 function copyDirBounded(sourceDir, targetDir, options = {}) {
   if (!sourceDir || !targetDir || !exists(sourceDir)) return { copied: false, files: 0, bytes: 0, truncated: false };
   const maxFiles = Number(options.maxFiles || 200);
@@ -163,7 +154,7 @@ function copyDirBounded(sourceDir, targetDir, options = {}) {
     }
     if (stat.isSymbolicLink()) return;
     if (stat.isDirectory()) {
-      fs.mkdirSync(target, { recursive: true });
+      if (!ensureDirectory(target)) return;
       for (const entry of fs.readdirSync(source)) {
         walk(path.join(source, entry), path.join(target, entry));
         if (state.truncated) break;
@@ -175,7 +166,7 @@ function copyDirBounded(sourceDir, targetDir, options = {}) {
       state.truncated = true;
       return;
     }
-    fs.mkdirSync(path.dirname(target), { recursive: true });
+    if (!ensureDirectory(path.dirname(target)) || !canWriteFileTarget(target)) return;
     fs.copyFileSync(source, target);
     state.files += 1;
     state.bytes += stat.size;
@@ -218,7 +209,6 @@ function syncClaudeNativeConfig(runtimeHome) {
   if (path.resolve(runtimeHome) === path.resolve(home)) return null;
   const sourceDir = path.join(home, '.claude');
   fs.mkdirSync(runtimeHome, { recursive: true });
-  removeOutboundSymlink(runtimeHome, path.join('debug', 'latest'));
   const copied = copyConfigTree(sourceDir, runtimeHome);
   ensureHomeAlias(runtimeHome, '.claude');
   ensureNativeKeychainAlias(runtimeHome);
@@ -227,6 +217,27 @@ function syncClaudeNativeConfig(runtimeHome) {
   return copied ? { sourceDir, runtimeHome } : null;
 }
 
+function syncOpenCodeNativeConfig(runtimeHome) {
+  if (!runtimeHome) return null;
+  const home = nativeHome();
+  fs.mkdirSync(runtimeHome, { recursive: true });
+  const config = copyConfigTree(
+    path.join(home, '.config', 'opencode'),
+    path.join(runtimeHome, '.config', 'opencode'),
+  );
+  const data = copyConfigTree(
+    path.join(home, '.local', 'share', 'opencode'),
+    path.join(runtimeHome, '.local', 'share', 'opencode'),
+  );
+  const dot = copyConfigTree(path.join(home, '.opencode'), path.join(runtimeHome, '.opencode'));
+  if (!config && !data && !dot) return null;
+  return {
+    sourceDir: path.join(home, '.config', 'opencode'),
+    runtimeHome,
+    copied: config || data || dot,
+  };
+}
+
 function readJsonFile(file) {
   try {
     return JSON.parse(fs.readFileSync(file, 'utf8'));
@@ -271,8 +282,10 @@ function claudeNativeHookSettings(options = {}) {
 function syncNativeHarnessConfig(contract) {
   const runtimeHome = contract?.auth?.runtimeHome;
   if (!runtimeHome) return null;
+  if (contract.authMethod !== 'provider_auth') return null;
   if (contract.harness === 'codex') return syncCodexNativeConfig(runtimeHome);
   if (contract.harness === 'claude_code') return syncClaudeNativeConfig(runtimeHome);
+  if (contract.harness === 'opencode') return syncOpenCodeNativeConfig(runtimeHome);
   return null;
 }
 
@@ -282,6 +295,7 @@ module.exports = {
     copyConfigTree,
     copyDirBounded,
     copyFileIfPresent,
+    ensureDirectory,
     ensureNativeKeychainAlias,
     ensureHomeAlias,
     shouldCopyConfigPath,
@@ -290,4 +304,5 @@ module.exports = {
   syncClaudeNativeConfig,
   syncCodexNativeConfig,
   syncNativeHarnessConfig,
+  syncOpenCodeNativeConfig,
 };

package/runtime/scripts/chat-core/tooling/runtime-home.js

@@ -0,0 +1,31 @@
+'use strict';
+
+const fs = require('fs');
+const { runtimeEnv } = require('../auth');
+const { syncNativeHarnessConfig } = require('./native-config');
+
+function managedRuntimeHome(contract) {
+  const runtimeHome = contract?.auth?.runtimeHome;
+  if (typeof runtimeHome !== 'string' || !runtimeHome.trim()) {
+    throw new Error(`${contract?.harness || 'Agent'} is missing a managed CLI home`);
+  }
+  return runtimeHome;
+}
+
+function prepareHarnessRuntime(contract, baseEnv = process.env) {
+  const runtimeHome = managedRuntimeHome(contract);
+  fs.mkdirSync(runtimeHome, { recursive: true });
+  const syncInfo = contract?.authMethod === 'provider_auth'
+    ? syncNativeHarnessConfig(contract)
+    : null;
+  return {
+    runtimeHome,
+    syncInfo,
+    env: runtimeEnv(contract, baseEnv),
+  };
+}
+
+module.exports = {
+  managedRuntimeHome,
+  prepareHarnessRuntime,
+};

package/runtime/scripts/credential-adapter.js

@@ -18,7 +18,7 @@ const VALID_AUTH_MODES = ['amalgm', 'provider_auth', 'byok'];
 const SUPPORTED_AUTH_BY_HARNESS = {
   claude_code: ['amalgm', 'byok', 'provider_auth'],
   codex: ['amalgm', 'byok', 'provider_auth'],
-  opencode: ['amalgm', 'byok'],
+  opencode: ['amalgm', 'byok', 'provider_auth'],
   pi: ['amalgm', 'byok', 'provider_auth'],
 };
 

package/runtime/scripts/platform-context.txt

@@ -205,12 +205,12 @@ Types:
 
 When you reference a file, folder, skill, or agent that exists on the user's local volume, emit it as an `amalgm://` markdown link. The frontend renders these as inline citation chips by default, with a hover card showing the path and (for skills) description. Skills are files too: if you only have the `SKILL.md` path, a normal file citation is valid. This is the same format the user's `@`-menu produces, and it's how agents talk to each other about local resources.
 
-Render format: `[label](amalgm://KIND/PATH_OR_ID)`
+Render format: `[label](amalgm://KIND/ENCODED_PATH_OR_ID)`
 
 Kinds:
-- File: `[Component.tsx](amalgm://file//workspace/app/Component.tsx)`
-- Folder: `[components](amalgm://folder//workspace/app/components)`
-- Skill: `[email-formatter](amalgm://skill//workspace/.agents/skills/email-formatter "Formats outgoing emails with consistent voice")`
+- File: `[Component.tsx](amalgm://file/%2Fworkspace%2Fapp%2FComponent.tsx)`
+- Folder: `[components](amalgm://folder/%2Fworkspace%2Fapp%2Fcomponents)`
+- Skill: `[email-formatter](amalgm://skill/%2Fworkspace%2F.agents%2Fskills%2Femail-formatter "Formats outgoing emails with consistent voice")`
 - Agent: `[Helper](amalgm://agent/AGENT_ID)`
 
 For skills, append a one-line description as the markdown link title (the part in quotes after the URL). The description teaches downstream agents and the user what the skill does so they can decide whether to load it. Keep the description under ~140 chars.
@@ -218,11 +218,12 @@ For skills, append a one-line description as the markdown link title (the part i
 For files and folders, the path alone is enough — no description needed. The user (and any agent reading your output) sees a chip; clicking it opens the file or folder.
 
 IMPORTANT:
-- Use the absolute path the user gave you. Don't rewrite, normalize, or shorten it.
+- Use the absolute path the user gave you as the decoded path, but percent-encode it inside the URL. Spaces must be `%20`, slashes in paths should be `%2F`, and literal `)` characters must be encoded. Do not use raw spaces inside markdown link destinations.
+- Don't rewrite, normalize, or shorten the decoded path.
 - Don't wrap citations in backticks. Don't explain the syntax.
 - When the user `@`-mentions something in their prompt, that input arrives as the same `amalgm://` link format — you can echo it back unchanged when referring to that resource.
 
-Example response (what you output): "I updated the [chat-server](amalgm://folder//workspace/scripts/chat-server) entrypoint and pulled in the [retry-policy](amalgm://skill//workspace/.agents/skills/retry-policy "Adds bounded exponential backoff to flaky outbound calls") skill for the new HTTP client."
+Example response (what you output): "I updated the [chat-server](amalgm://folder/%2Fworkspace%2Fscripts%2Fchat-server) entrypoint and pulled in the [retry-policy](amalgm://skill/%2Fworkspace%2F.agents%2Fskills%2Fretry-policy "Adds bounded exponential backoff to flaky outbound calls") skill for the new HTTP client."
 
 The user sees two clickable chips inline; the agent reading your transcript sees structured references it can act on.
 </amalgm-platform>