amalgm 0.1.69 → 0.1.70

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.69",
+  "version": "0.1.70",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,

package/runtime/lib/harnesses.js

@@ -774,7 +774,7 @@ var HARNESSES = {
     logoKey: "opencode",
     models: OPENCODE_MODELS,
     defaultModelId: DEFAULT_MODEL_IDS.opencode,
-    supportedAuthMethods: ["amalgm", "byok"],
+    supportedAuthMethods: ["amalgm", "byok", "provider_auth"],
     dynamicModels: true
   },
   codex: {

package/runtime/scripts/amalgm-mcp/lib/prefs.js

@@ -34,7 +34,7 @@ const DEFAULT_AUTH_METHODS = {
 const SUPPORTED_AUTH_BY_HARNESS = {
   claude_code: ['amalgm', 'byok', 'provider_auth'],
   codex: ['amalgm', 'byok', 'provider_auth'],
-  opencode: ['amalgm', 'byok'],
+  opencode: ['amalgm', 'byok', 'provider_auth'],
   pi: ['amalgm', 'byok', 'provider_auth'],
   amp: ['provider_auth'],
   cursor: ['provider_auth'],

package/runtime/scripts/chat-core/adapters/claude.js

@@ -36,7 +36,7 @@ class ClaudeAdapter {
     const systemPrompt = composeSystemPrompt(contract);
     const pathToClaudeCodeExecutable = process.env.CLAUDE_CODE_BINARY || bundledClaudeBinary();
     const settings = {
-      ...(claudeNativeHookSettings({ cwd: contract.cwd }) || {}),
+      ...(contract.authMethod === 'provider_auth' ? (claudeNativeHookSettings({ cwd: contract.cwd }) || {}) : {}),
       ...(contract.fastMode ? { fastMode: true, fastModePerSessionOptIn: true } : {}),
     };
     return {

package/runtime/scripts/chat-core/adapters/codex.js

@@ -363,7 +363,9 @@ function writeConfig(contract, syncInfo) {
   const home = contract.auth.runtimeHome;
   if (!home) return;
   fs.mkdirSync(home, { recursive: true });
-  if (syncInfo === undefined) syncInfo = syncCodexNativeConfig(home);
+  if (syncInfo === undefined) {
+    syncInfo = contract.authMethod === 'provider_auth' ? syncCodexNativeConfig(home) : null;
+  }
   const nativeConfig = baseNativeConfigForContract(contract, syncInfo);
   const configPath = path.join(home, 'config.toml');
   if (contract.authMethod === 'provider_auth') {

package/runtime/scripts/chat-core/adapters/opencode.js

@@ -39,7 +39,7 @@ function splitModel(model, auth) {
 function configFor(contract) {
   const model = splitModel(contract.cliModel || contract.usageModelId, contract.auth);
   const systemPrompt = composeSystemPrompt(contract);
-  return {
+  const config = {
     logLevel: process.env.OPENCODE_LOG_LEVEL || 'ERROR',
     enabled_providers: [model.providerID],
     disabled_providers: [],
@@ -75,7 +75,9 @@ function configFor(contract) {
       title: { disable: true },
     },
     mcp: toOpenCodeMcpConfig(contract),
-    provider: {
+  };
+  if (contract.authMethod !== 'provider_auth') {
+    config.provider = {
       [model.providerID]: {
         options: {
           baseURL: contract.auth.baseUrl,
@@ -85,8 +87,9 @@ function configFor(contract) {
           chunkTimeout: 300000,
         },
       },
-    },
-  };
+    };
+  }
+  return config;
 }
 
 function resultData(result) {

package/runtime/scripts/chat-core/auth.js

@@ -9,7 +9,7 @@ const { resolveCredential } = require('./credentials/store');
 const AUTH_BY_HARNESS = {
   claude_code: ['amalgm', 'byok', 'provider_auth'],
   codex: ['amalgm', 'byok', 'provider_auth'],
-  opencode: ['amalgm', 'byok'],
+  opencode: ['amalgm', 'byok', 'provider_auth'],
 };
 
 function shellValue(raw) {
@@ -109,35 +109,15 @@ function providerAuthIdentity(harness) {
   return `${harness || 'provider'}:provider-default`;
 }
 
-function deriveAuthProfileId({ method, harness, userId, tokenFingerprint }) {
-  if (method === 'amalgm') {
-    return `amalgm-${fingerprint(userId || process.env.AMALGM_USER_ID || 'local') || 'local'}`;
-  }
-  if (method === 'byok') {
-    return `byok-${tokenFingerprint || 'default'}`;
-  }
-  if (method === 'provider_auth') {
-    return `provider-${fingerprint(providerAuthIdentity(harness)) || 'default'}`;
-  }
-  return 'default';
-}
-
-function runtimeHome({ amalgmDir, harness, authProfileId }) {
-  return path.join(amalgmDir, 'cli-homes', safePathSegment(harness), safePathSegment(authProfileId));
-}
-
-function pinnedRuntimeHome(amalgmDir, cliHomePath) {
-  if (typeof cliHomePath !== 'string' || !cliHomePath.trim()) return null;
-  const root = path.resolve(amalgmDir);
-  const resolved = path.resolve(cliHomePath.trim());
-  return resolved === root || resolved.startsWith(`${root}${path.sep}`) ? resolved : null;
+function runtimeHome({ amalgmDir, harness }) {
+  return path.join(amalgmDir, 'cli-homes', safePathSegment(harness), 'home');
 }
 
 function providerAuthFingerprint(harness) {
   return fingerprint(providerAuthIdentity(harness));
 }
 
-function authEnvelope({ harness, authMethod, sessionId, localBaseUrl, proxyToken, proxyBaseUrl, amalgmDir, userId, credentialId, modelId, cliHomePath, authProfileId }) {
+function authEnvelope({ harness, authMethod, sessionId, localBaseUrl, proxyToken, proxyBaseUrl, amalgmDir, userId, credentialId, modelId }) {
   const method = coerceAuth(harness, authMethod);
   const byok = readByokFile(amalgmDir);
   let baseUrl = null;
@@ -166,7 +146,6 @@ function authEnvelope({ harness, authMethod, sessionId, localBaseUrl, proxyToken
   } else if (method === 'provider_auth') {
     tokenFingerprint = providerAuthFingerprint(harness);
   }
-  const profileId = authProfileId || deriveAuthProfileId({ method, harness, userId, tokenFingerprint });
   return {
     method,
     baseUrl,
@@ -176,10 +155,7 @@ function authEnvelope({ harness, authMethod, sessionId, localBaseUrl, proxyToken
     forwardBaseUrl,
     tokenRef,
     tokenFingerprint,
-    authProfileId: profileId,
-    runtimeHome:
-      pinnedRuntimeHome(amalgmDir, cliHomePath)
-      || runtimeHome({ amalgmDir, harness, authProfileId: profileId }),
+    runtimeHome: runtimeHome({ amalgmDir, harness }),
   };
 }
 
@@ -203,6 +179,12 @@ function runtimeEnv(contract, baseEnv = process.env) {
     env.CLAUDE_CONFIG_DIR = contract.auth.runtimeHome;
     env.OPENCODE_HOME = contract.auth.runtimeHome;
     env.OPENCODE_CONFIG_DIR = contract.auth.runtimeHome;
+    if (contract.harness === 'opencode') {
+      env.XDG_CONFIG_HOME = path.join(contract.auth.runtimeHome, '.config');
+      env.XDG_DATA_HOME = path.join(contract.auth.runtimeHome, '.local', 'share');
+      env.XDG_STATE_HOME = path.join(contract.auth.runtimeHome, '.local', 'state');
+      env.XDG_CACHE_HOME = path.join(contract.auth.runtimeHome, '.cache');
+    }
     if (contract.harness === 'claude_code' && contract.authMethod === 'provider_auth') {
       delete env.CLAUDE_CONFIG_DIR;
     }

package/runtime/scripts/chat-core/contract.js

@@ -347,8 +347,6 @@ function createContract(payload, options = {}) {
     userId,
     credentialId: payload.credentialId || payload.byokCredentialId || null,
     modelId,
-    cliHomePath: payload.cliHomePath || payload.cli_home_path || null,
-    authProfileId: payload.authProfileId || payload.auth_profile_id || null,
   });
   const contract = {
     sessionId,

package/runtime/scripts/chat-core/engine.js

@@ -179,7 +179,6 @@ class ChatCore {
         auth: {
           baseUrl: contract.auth.baseUrl,
           tokenFingerprint: contract.auth.tokenFingerprint,
-          authProfileId: contract.auth.authProfileId,
           runtimeHome: contract.auth.runtimeHome,
         },
       },

package/runtime/scripts/chat-core/tests/auth.test.js

@@ -1,37 +1,54 @@
 'use strict';
 
 const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
 const test = require('node:test');
 const { authEnvelope, runtimeEnv } = require('../auth');
 
-test('amalgm auth uses a pinned CLI home across sessions and proxy token refreshes', () => {
-  const first = authEnvelope({
-    harness: 'codex',
-    authMethod: 'amalgm',
-    sessionId: 'session-one',
-    proxyToken: 'proxy-token-one',
-    localBaseUrl: 'http://127.0.0.1:8084',
-    proxyBaseUrl: 'https://proxy.example.test',
-    amalgmDir: '/tmp/amalgm-test',
-    userId: 'user-123',
-  });
-  const second = authEnvelope({
-    harness: 'codex',
-    authMethod: 'amalgm',
-    sessionId: 'session-two',
-    proxyToken: 'proxy-token-two',
-    localBaseUrl: 'http://127.0.0.1:8084',
-    proxyBaseUrl: 'https://proxy.example.test',
-    amalgmDir: '/tmp/amalgm-test',
-    userId: 'user-123',
-  });
+test('codex always uses one canonical CLI home across auth methods and token refreshes', () => {
+  const amalgmDir = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-auth-test-'));
+  fs.writeFileSync(path.join(amalgmDir, '.amalgm-credentials'), 'OPENAI_API_KEY=sk-test\n');
+  try {
+    const first = authEnvelope({
+      harness: 'codex',
+      authMethod: 'amalgm',
+      sessionId: 'session-one',
+      proxyToken: 'proxy-token-one',
+      localBaseUrl: 'http://127.0.0.1:8084',
+      proxyBaseUrl: 'https://proxy.example.test',
+      amalgmDir,
+      userId: 'user-123',
+    });
+    const second = authEnvelope({
+      harness: 'codex',
+      authMethod: 'provider_auth',
+      sessionId: 'session-two',
+      proxyToken: 'proxy-token-two',
+      localBaseUrl: 'http://127.0.0.1:8084',
+      proxyBaseUrl: 'https://proxy.example.test',
+      amalgmDir,
+      userId: 'user-123',
+    });
+    const third = authEnvelope({
+      harness: 'codex',
+      authMethod: 'byok',
+      sessionId: 'session-three',
+      amalgmDir,
+      userId: 'user-123',
+    });
 
-  assert.notEqual(first.tokenFingerprint, second.tokenFingerprint);
-  assert.equal(first.runtimeHome, second.runtimeHome);
-  assert.match(first.runtimeHome, /\/tmp\/amalgm-test\/cli-homes\/codex\/amalgm-[0-9a-f]{16}$/);
+    assert.notEqual(first.tokenFingerprint, second.tokenFingerprint);
+    assert.equal(first.runtimeHome, second.runtimeHome);
+    assert.equal(second.runtimeHome, third.runtimeHome);
+    assert.equal(first.runtimeHome, path.join(amalgmDir, 'cli-homes', 'codex', 'home'));
+  } finally {
+    fs.rmSync(amalgmDir, { recursive: true, force: true });
+  }
 });
 
-test('opencode amalgm auth uses a pinned CLI home across sessions and proxy token refreshes', () => {
+test('opencode always uses one canonical CLI home across auth methods and token refreshes', () => {
   const first = authEnvelope({
     harness: 'opencode',
     authMethod: 'amalgm',
@@ -44,7 +61,7 @@ test('opencode amalgm auth uses a pinned CLI home across sessions and proxy toke
   });
   const second = authEnvelope({
     harness: 'opencode',
-    authMethod: 'amalgm',
+    authMethod: 'provider_auth',
     sessionId: 'session-two',
     proxyToken: 'proxy-token-two',
     localBaseUrl: 'http://127.0.0.1:8084',
@@ -56,13 +73,15 @@ test('opencode amalgm auth uses a pinned CLI home across sessions and proxy toke
 
   assert.notEqual(first.tokenFingerprint, second.tokenFingerprint);
   assert.equal(first.runtimeHome, second.runtimeHome);
-  assert.match(first.runtimeHome, /\/tmp\/amalgm-test\/cli-homes\/opencode\/amalgm-[0-9a-f]{16}$/);
+  assert.equal(first.runtimeHome, '/tmp/amalgm-test/cli-homes/opencode/home');
   assert.equal(env.HOME, first.runtimeHome);
   assert.equal(env.OPENCODE_HOME, first.runtimeHome);
   assert.equal(env.OPENCODE_CONFIG_DIR, first.runtimeHome);
+  assert.equal(env.XDG_CONFIG_HOME, '/tmp/amalgm-test/cli-homes/opencode/home/.config');
+  assert.equal(env.XDG_DATA_HOME, '/tmp/amalgm-test/cli-homes/opencode/home/.local/share');
 });
 
-test('claude provider auth uses a pinned CLI home with native config copied separately', () => {
+test('claude always uses one canonical CLI home', () => {
   const envelope = authEnvelope({
     harness: 'claude_code',
     authMethod: 'provider_auth',
@@ -70,7 +89,7 @@ test('claude provider auth uses a pinned CLI home with native config copied sepa
     amalgmDir: '/tmp/amalgm-test',
   });
 
-  assert.match(envelope.runtimeHome, /\/tmp\/amalgm-test\/cli-homes\/claude_code\/provider-[0-9a-f]{16}$/);
+  assert.equal(envelope.runtimeHome, '/tmp/amalgm-test/cli-homes/claude_code/home');
 
   const env = runtimeEnv({
     harness: 'claude_code',
@@ -88,19 +107,7 @@ test('claude provider auth uses a pinned CLI home with native config copied sepa
   assert.equal(env.ANTHROPIC_API_KEY, undefined);
 });
 
-test('codex provider auth uses a pinned provider home', () => {
-  const envelope = authEnvelope({
-    harness: 'codex',
-    authMethod: 'provider_auth',
-    sessionId: 'session-test',
-    amalgmDir: '/tmp/amalgm-test',
-  });
-
-  assert.match(envelope.runtimeHome, /\/tmp\/amalgm-test\/cli-homes\/codex\/provider-[0-9a-f]{16}$/);
-  assert.equal(envelope.runtimeHome.includes('/runtime/session-test/'), false);
-});
-
-test('stored CLI home path wins over derived path', () => {
+test('provided CLI home path cannot move an agent off its canonical home', () => {
   const envelope = authEnvelope({
     harness: 'codex',
     authMethod: 'amalgm',
@@ -114,6 +121,5 @@ test('stored CLI home path wins over derived path', () => {
     authProfileId: 'manual-profile',
   });
 
-  assert.equal(envelope.authProfileId, 'manual-profile');
-  assert.equal(envelope.runtimeHome, '/tmp/amalgm-test/cli-homes/codex/manual-profile');
+  assert.equal(envelope.runtimeHome, '/tmp/amalgm-test/cli-homes/codex/home');
 });

package/runtime/scripts/chat-core/tests/native-binaries.test.js

@@ -0,0 +1,126 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const { spawnSync } = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const test = require('node:test');
+const nativeBinaries = require('../tooling/native-binaries');
+
+function packagePath(root, packageName) {
+  return path.join(root, ...String(packageName).split('/'));
+}
+
+function writePackage(root, packageName) {
+  fs.mkdirSync(root, { recursive: true });
+  fs.writeFileSync(path.join(root, 'package.json'), `${JSON.stringify({ name: packageName, version: '0.0.0' }, null, 2)}\n`);
+}
+
+function writeExecutable(file) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  if (process.platform === 'win32') {
+    fs.writeFileSync(file, '@echo off\r\nexit /b 0\r\n');
+  } else {
+    fs.writeFileSync(file, '#!/bin/sh\nexit 0\n');
+    fs.chmodSync(file, 0o755);
+  }
+}
+
+function installFakePackagedAgentDeps(resourcesPath) {
+  const nodeModules = path.join(resourcesPath, 'app.asar.unpacked', 'node_modules');
+  const claudePackage = nativeBinaries.__private.claudeTargetPackage();
+  const codexTarget = nativeBinaries.__private.codexTarget();
+  const openCodePackage = nativeBinaries.__private.openCodePackageCandidates()[0];
+  assert.ok(claudePackage, 'current platform should have a Claude native package');
+  assert.ok(codexTarget, 'current platform should have a Codex native package');
+  assert.ok(openCodePackage, 'current platform should have an OpenCode native package');
+
+  writePackage(path.join(nodeModules, '@anthropic-ai', 'claude-agent-sdk'), '@anthropic-ai/claude-agent-sdk');
+  writePackage(path.join(nodeModules, '@openai', 'codex'), '@openai/codex');
+  writePackage(path.join(nodeModules, 'opencode-ai'), 'opencode-ai');
+
+  const claudeRoot = packagePath(
+    path.join(nodeModules, '@anthropic-ai', 'claude-agent-sdk', 'node_modules'),
+    claudePackage,
+  );
+  writePackage(claudeRoot, claudePackage);
+  const claude = path.join(claudeRoot, process.platform === 'win32' ? 'claude.exe' : 'claude');
+  writeExecutable(claude);
+
+  const codexRoot = packagePath(
+    path.join(nodeModules, '@openai', 'codex', 'node_modules'),
+    codexTarget.packageName,
+  );
+  writePackage(codexRoot, codexTarget.packageName);
+  const codex = path.join(codexRoot, 'vendor', codexTarget.triple, 'codex', codexTarget.binaryName);
+  writeExecutable(codex);
+
+  const openCodeRoot = packagePath(
+    path.join(nodeModules, 'opencode-ai', 'node_modules'),
+    openCodePackage,
+  );
+  writePackage(openCodeRoot, openCodePackage);
+  const opencode = path.join(openCodeRoot, 'bin', process.platform === 'win32' ? 'opencode.exe' : 'opencode');
+  writeExecutable(opencode);
+
+  return { claude, codex, opencode };
+}
+
+function withFakePackagedResources(fn) {
+  const previousResourcesPath = Object.getOwnPropertyDescriptor(process, 'resourcesPath');
+  const previousEnv = {
+    AMALGM_AGENT_BIN_DIR: process.env.AMALGM_AGENT_BIN_DIR,
+    AMALGM_NATIVE_NODE_MODULES: process.env.AMALGM_NATIVE_NODE_MODULES,
+    CLAUDE_CODE_BINARY: process.env.CLAUDE_CODE_BINARY,
+    PATH: process.env.PATH,
+  };
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-native-binaries-'));
+  const resourcesPath = path.join(root, 'resources');
+  const binDir = path.join(root, 'bin');
+  try {
+    Object.defineProperty(process, 'resourcesPath', {
+      value: resourcesPath,
+      configurable: true,
+    });
+    process.env.AMALGM_AGENT_BIN_DIR = binDir;
+    process.env.PATH = '';
+    delete process.env.AMALGM_NATIVE_NODE_MODULES;
+    delete process.env.CLAUDE_CODE_BINARY;
+    return fn({ root, resourcesPath, binDir });
+  } finally {
+    if (previousResourcesPath) {
+      Object.defineProperty(process, 'resourcesPath', previousResourcesPath);
+    } else {
+      delete process.resourcesPath;
+    }
+    for (const [key, value] of Object.entries(previousEnv)) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
+
+test('packaged nested agent dependencies resolve to exact executable paths and spawnable shims', () => {
+  withFakePackagedResources(({ resourcesPath, binDir }) => {
+    const expected = installFakePackagedAgentDeps(resourcesPath);
+
+    assert.equal(nativeBinaries.__private.bundledClaudeBinary(), expected.claude);
+    assert.equal(nativeBinaries.bundledCodexBinary(), expected.codex);
+    assert.equal(nativeBinaries.bundledOpenCodeBinary(), expected.opencode);
+
+    const result = nativeBinaries.ensureAgentCommandShims({ quiet: true, logger: { log() {} } });
+    assert.equal(result.ok, true);
+    for (const command of ['claude', 'codex', 'opencode']) {
+      const shim = path.join(binDir, process.platform === 'win32' ? `${command}.cmd` : command);
+      assert.equal(fs.existsSync(shim), true);
+      const spawned = spawnSync(shim, ['--smoke'], {
+        stdio: 'ignore',
+        shell: process.platform === 'win32',
+        windowsHide: true,
+      });
+      assert.equal(spawned.status, 0, `${command} shim should spawn`);
+    }
+  });
+});

package/runtime/scripts/chat-core/tests/native-config.test.js

@@ -11,6 +11,7 @@ const {
   claudeNativeHookSettings,
   syncClaudeNativeConfig,
   syncCodexNativeConfig,
+  syncOpenCodeNativeConfig,
 } = require('../tooling/native-config');
 const { prepareHarnessRuntime } = require('../tooling/runtime-home');
 
@@ -108,6 +109,50 @@ test('prepared opencode runtime always has an isolated managed home', () => {
   });
 });
 
+test('provider auth imports opencode native config into managed home', () => {
+  withNativeHome((home) => {
+    const configDir = path.join(home, '.config', 'opencode');
+    const dataDir = path.join(home, '.local', 'share', 'opencode');
+    fs.mkdirSync(configDir, { recursive: true });
+    fs.mkdirSync(dataDir, { recursive: true });
+    fs.writeFileSync(path.join(configDir, 'opencode.json'), '{"mcp":{}}');
+    fs.writeFileSync(path.join(dataDir, 'auth.json'), '{"provider":"test"}');
+
+    const runtimeHome = path.join(home, 'managed', 'opencode-home');
+    const prepared = prepareHarnessRuntime({
+      harness: 'opencode',
+      authMethod: 'provider_auth',
+      auth: { runtimeHome },
+    }, { PATH: '/bin', HOME: home });
+
+    assert.equal(prepared.runtimeHome, runtimeHome);
+    assert.equal(prepared.env.HOME, runtimeHome);
+    assert.equal(prepared.env.OPENCODE_HOME, runtimeHome);
+    assert.equal(prepared.env.XDG_CONFIG_HOME, path.join(runtimeHome, '.config'));
+    assert.equal(fs.existsSync(path.join(runtimeHome, '.config', 'opencode', 'opencode.json')), true);
+    assert.equal(fs.existsSync(path.join(runtimeHome, '.local', 'share', 'opencode', 'auth.json')), true);
+  });
+});
+
+test('non-user auth prepares a home without importing native config', () => {
+  withNativeHome((home) => {
+    const source = path.join(home, '.codex');
+    fs.mkdirSync(source, { recursive: true });
+    fs.writeFileSync(path.join(source, 'config.toml'), 'model = "native"');
+
+    const runtimeHome = path.join(home, 'managed', 'codex-home');
+    const prepared = prepareHarnessRuntime({
+      harness: 'codex',
+      authMethod: 'amalgm',
+      auth: { runtimeHome, tokenRef: 'test-token', baseUrl: 'https://example.test' },
+    }, { PATH: '/bin', HOME: home });
+
+    assert.equal(prepared.syncInfo, null);
+    assert.equal(fs.existsSync(runtimeHome), true);
+    assert.equal(fs.existsSync(path.join(runtimeHome, 'config.toml')), false);
+  });
+});
+
 test('codex provider config keeps native mcp config and overrides managed model provider', () => {
   withNativeHome((home) => {
     const source = path.join(home, '.codex');
@@ -147,7 +192,7 @@ test('codex provider config keeps native mcp config and overrides managed model
   });
 });
 
-test('codex amalgm config keeps native mcp config and overrides managed model provider', () => {
+test('codex amalgm config does not import native user config', () => {
   withNativeHome((home) => {
     const source = path.join(home, '.codex');
     fs.mkdirSync(source, { recursive: true });
@@ -176,12 +221,11 @@ test('codex amalgm config keeps native mcp config and overrides managed model pr
 
     const config = fs.readFileSync(path.join(runtimeHome, 'config.toml'), 'utf8');
     assert.match(config, /model_provider = "amalgm"/);
-    assert.match(config, /codex_hooks = true/);
     assert.doesNotMatch(config, /native-provider/);
-    assert.match(config, /\[mcp_servers\.native\]/);
-    assert.match(config, /\[mcp_servers\.native\.http_headers\]/);
-    assert.match(config, /Authorization = "Bearer test"/);
-    assert.equal(config.includes(path.join(runtimeHome, 'hooks.json')), true);
+    assert.doesNotMatch(config, /codex_hooks = true/);
+    assert.doesNotMatch(config, /\[mcp_servers\.native\]/);
+    assert.doesNotMatch(config, /Authorization = "Bearer test"/);
+    assert.equal(config.includes(path.join(runtimeHome, 'hooks.json')), false);
   });
 });
 
@@ -219,7 +263,7 @@ test('claude extracts native hooks without enabling full filesystem settings', (
   });
 });
 
-test('claude native sync skips debug symlinks', () => {
+test('claude native sync does not delete existing debug symlinks', () => {
   withNativeHome((home) => {
     const source = path.join(home, '.claude');
     fs.mkdirSync(path.join(source, 'debug'), { recursive: true });
@@ -237,7 +281,41 @@ test('claude native sync skips debug symlinks', () => {
     assert.equal(result.sourceDir, source);
     assert.equal(fs.existsSync(path.join(runtimeHome, 'settings.json')), true);
     assert.equal(fs.existsSync(path.join(runtimeHome, 'debug', 'trace.txt')), false);
-    assert.equal(fs.existsSync(path.join(runtimeHome, 'debug', 'latest')), false);
+    assert.equal(fs.lstatSync(path.join(runtimeHome, 'debug', 'latest')).isSymbolicLink(), true);
+  });
+});
+
+test('native sync never replaces existing in-home dot dirs', () => {
+  withNativeHome((home) => {
+    const source = path.join(home, '.codex');
+    fs.mkdirSync(source, { recursive: true });
+    fs.writeFileSync(path.join(source, 'config.toml'), 'model = "gpt-5.5"');
+
+    const runtimeHome = path.join(home, 'runtime-home');
+    fs.mkdirSync(path.join(runtimeHome, '.codex'), { recursive: true });
+    fs.writeFileSync(path.join(runtimeHome, '.codex', 'sentinel'), 'keep');
+
+    syncCodexNativeConfig(runtimeHome);
+
+    assert.equal(fs.existsSync(path.join(runtimeHome, '.codex', 'sentinel')), true);
+    assert.equal(fs.lstatSync(path.join(runtimeHome, '.codex')).isDirectory(), true);
+  });
+});
+
+test('opencode native sync preserves existing session state', () => {
+  withNativeHome((home) => {
+    const dataDir = path.join(home, '.local', 'share', 'opencode');
+    fs.mkdirSync(dataDir, { recursive: true });
+    fs.writeFileSync(path.join(dataDir, 'auth.json'), '{"provider":"test"}');
+
+    const runtimeHome = path.join(home, 'runtime-home');
+    fs.mkdirSync(path.join(runtimeHome, '.local', 'share', 'opencode', 'session'), { recursive: true });
+    fs.writeFileSync(path.join(runtimeHome, '.local', 'share', 'opencode', 'session', 'sentinel'), 'keep');
+
+    syncOpenCodeNativeConfig(runtimeHome);
+
+    assert.equal(fs.existsSync(path.join(runtimeHome, '.local', 'share', 'opencode', 'auth.json')), true);
+    assert.equal(fs.existsSync(path.join(runtimeHome, '.local', 'share', 'opencode', 'session', 'sentinel')), true);
   });
 });
 

package/runtime/scripts/chat-core/tooling/native-binaries.js

@@ -11,13 +11,22 @@ function amalgmDir() {
 
 function nativeNodeModulesDirs() {
   const resourcesPath = process.resourcesPath || '';
-  return unique([
-    process.env.AMALGM_NATIVE_NODE_MODULES,
-    path.join(amalgmDir(), 'native', 'node_modules'),
+  const resourceNodeModules = [
     resourcesPath ? path.join(resourcesPath, 'app.asar.unpacked', 'node_modules') : '',
     resourcesPath ? path.join(resourcesPath, 'app.asar', 'node_modules') : '',
     resourcesPath ? path.join(resourcesPath, 'cli', 'node_modules') : '',
     resourcesPath ? path.join(resourcesPath, 'runtime', 'node_modules') : '',
+  ].filter(Boolean);
+  const wrapperPackages = [
+    '@anthropic-ai/claude-agent-sdk',
+    '@openai/codex',
+    'opencode-ai',
+  ];
+  return unique([
+    process.env.AMALGM_NATIVE_NODE_MODULES,
+    path.join(amalgmDir(), 'native', 'node_modules'),
+    ...resourceNodeModules,
+    ...resourceNodeModules.flatMap((dir) => wrapperPackages.map((packageName) => path.join(dir, packageName, 'node_modules'))),
   ].filter(Boolean));
 }
 
@@ -619,6 +628,14 @@ function ensureNativeBinaries(options = {}) {
 }
 
 module.exports = {
+  __private: {
+    bundledClaudeBinary,
+    claudeTargetPackage,
+    codexTarget,
+    nativeNodeModulesDirs,
+    openCodePackageCandidates,
+    packageRoot,
+  },
   binaryStatus,
   bundledCodexPathDirs,
   bundledClaudeBinary: resolveClaudeBinary,

package/runtime/scripts/chat-core/tooling/native-config.js

@@ -57,20 +57,12 @@ function shouldCopyConfigPath(root, source) {
 function copyConfigTree(sourceDir, targetDir) {
   if (!sourceDir || !targetDir || !exists(sourceDir)) return false;
   if (path.resolve(sourceDir) === path.resolve(targetDir)) return true;
-  fs.mkdirSync(targetDir, { recursive: true });
-  fs.cpSync(sourceDir, targetDir, {
-    recursive: true,
-    force: true,
-    errorOnExist: false,
-    dereference: false,
-    filter: (source) => shouldCopyConfigPath(sourceDir, source),
-  });
-  return true;
+  return copyDirBounded(sourceDir, targetDir, { maxFiles: 500, maxBytes: 25 * 1024 * 1024 }).copied;
 }
 
 function copyFileIfPresent(source, target) {
   if (!exists(source)) return false;
-  fs.mkdirSync(path.dirname(target), { recursive: true });
+  if (!ensureDirectory(path.dirname(target)) || !canWriteFileTarget(target)) return false;
   fs.copyFileSync(source, target);
   try {
     fs.chmodSync(target, fs.statSync(source).mode & 0o777);
@@ -86,10 +78,8 @@ function ensureHomeAlias(runtimeHome, dotDirName) {
     if (stat.isSymbolicLink()) {
       const target = fs.readlinkSync(alias);
       if (target === '.' || path.resolve(runtimeHome, target) === path.resolve(runtimeHome)) return;
-      fs.rmSync(alias, { recursive: true, force: true });
-    } else {
-      fs.rmSync(alias, { recursive: true, force: true });
     }
+    return;
   } catch {}
   try {
     fs.symlinkSync('.', alias, 'dir');
@@ -98,28 +88,6 @@ function ensureHomeAlias(runtimeHome, dotDirName) {
   }
 }
 
-function removeOutboundSymlink(root, relativePath) {
-  const file = path.join(root, relativePath);
-  let stat;
-  try {
-    stat = fs.lstatSync(file);
-  } catch {
-    return;
-  }
-  if (!stat.isSymbolicLink()) return;
-  let target;
-  try {
-    target = fs.readlinkSync(file);
-  } catch {
-    return;
-  }
-  const resolvedRoot = path.resolve(root);
-  const resolvedTarget = path.resolve(path.dirname(file), target);
-  if (resolvedTarget !== resolvedRoot && !resolvedTarget.startsWith(`${resolvedRoot}${path.sep}`)) {
-    fs.rmSync(file, { force: true });
-  }
-}
-
 function ensureNativeKeychainAlias(runtimeHome) {
   if (process.platform !== 'darwin' || !runtimeHome) return false;
   const source = path.join(nativeHome(), 'Library', 'Keychains');
@@ -131,7 +99,7 @@ function ensureNativeKeychainAlias(runtimeHome) {
       const linkTarget = fs.readlinkSync(target);
       if (path.resolve(path.dirname(target), linkTarget) === path.resolve(source)) return true;
     }
-    fs.rmSync(target, { recursive: true, force: true });
+    return false;
   } catch {}
   fs.mkdirSync(path.dirname(target), { recursive: true });
   try {
@@ -146,6 +114,29 @@ function nativeHome() {
   return process.env.AMALGM_NATIVE_HOME || os.homedir();
 }
 
+function ensureDirectory(dir) {
+  try {
+    const stat = fs.lstatSync(dir);
+    return stat.isDirectory();
+  } catch {
+    try {
+      fs.mkdirSync(dir, { recursive: true });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
+
+function canWriteFileTarget(target) {
+  try {
+    const stat = fs.lstatSync(target);
+    return stat.isFile();
+  } catch {
+    return true;
+  }
+}
+
 function copyDirBounded(sourceDir, targetDir, options = {}) {
   if (!sourceDir || !targetDir || !exists(sourceDir)) return { copied: false, files: 0, bytes: 0, truncated: false };
   const maxFiles = Number(options.maxFiles || 200);
@@ -163,7 +154,7 @@ function copyDirBounded(sourceDir, targetDir, options = {}) {
     }
     if (stat.isSymbolicLink()) return;
     if (stat.isDirectory()) {
-      fs.mkdirSync(target, { recursive: true });
+      if (!ensureDirectory(target)) return;
       for (const entry of fs.readdirSync(source)) {
         walk(path.join(source, entry), path.join(target, entry));
         if (state.truncated) break;
@@ -175,7 +166,7 @@ function copyDirBounded(sourceDir, targetDir, options = {}) {
       state.truncated = true;
       return;
     }
-    fs.mkdirSync(path.dirname(target), { recursive: true });
+    if (!ensureDirectory(path.dirname(target)) || !canWriteFileTarget(target)) return;
     fs.copyFileSync(source, target);
     state.files += 1;
     state.bytes += stat.size;
@@ -218,7 +209,6 @@ function syncClaudeNativeConfig(runtimeHome) {
   if (path.resolve(runtimeHome) === path.resolve(home)) return null;
   const sourceDir = path.join(home, '.claude');
   fs.mkdirSync(runtimeHome, { recursive: true });
-  removeOutboundSymlink(runtimeHome, path.join('debug', 'latest'));
   const copied = copyConfigTree(sourceDir, runtimeHome);
   ensureHomeAlias(runtimeHome, '.claude');
   ensureNativeKeychainAlias(runtimeHome);
@@ -227,6 +217,27 @@ function syncClaudeNativeConfig(runtimeHome) {
   return copied ? { sourceDir, runtimeHome } : null;
 }
 
+function syncOpenCodeNativeConfig(runtimeHome) {
+  if (!runtimeHome) return null;
+  const home = nativeHome();
+  fs.mkdirSync(runtimeHome, { recursive: true });
+  const config = copyConfigTree(
+    path.join(home, '.config', 'opencode'),
+    path.join(runtimeHome, '.config', 'opencode'),
+  );
+  const data = copyConfigTree(
+    path.join(home, '.local', 'share', 'opencode'),
+    path.join(runtimeHome, '.local', 'share', 'opencode'),
+  );
+  const dot = copyConfigTree(path.join(home, '.opencode'), path.join(runtimeHome, '.opencode'));
+  if (!config && !data && !dot) return null;
+  return {
+    sourceDir: path.join(home, '.config', 'opencode'),
+    runtimeHome,
+    copied: config || data || dot,
+  };
+}
+
 function readJsonFile(file) {
   try {
     return JSON.parse(fs.readFileSync(file, 'utf8'));
@@ -271,8 +282,10 @@ function claudeNativeHookSettings(options = {}) {
 function syncNativeHarnessConfig(contract) {
   const runtimeHome = contract?.auth?.runtimeHome;
   if (!runtimeHome) return null;
+  if (contract.authMethod !== 'provider_auth') return null;
   if (contract.harness === 'codex') return syncCodexNativeConfig(runtimeHome);
   if (contract.harness === 'claude_code') return syncClaudeNativeConfig(runtimeHome);
+  if (contract.harness === 'opencode') return syncOpenCodeNativeConfig(runtimeHome);
   return null;
 }
 
@@ -282,6 +295,7 @@ module.exports = {
     copyConfigTree,
     copyDirBounded,
     copyFileIfPresent,
+    ensureDirectory,
     ensureNativeKeychainAlias,
     ensureHomeAlias,
     shouldCopyConfigPath,
@@ -290,4 +304,5 @@ module.exports = {
   syncClaudeNativeConfig,
   syncCodexNativeConfig,
   syncNativeHarnessConfig,
+  syncOpenCodeNativeConfig,
 };

package/runtime/scripts/chat-core/tooling/runtime-home.js

@@ -15,7 +15,9 @@ function managedRuntimeHome(contract) {
 function prepareHarnessRuntime(contract, baseEnv = process.env) {
   const runtimeHome = managedRuntimeHome(contract);
   fs.mkdirSync(runtimeHome, { recursive: true });
-  const syncInfo = syncNativeHarnessConfig(contract);
+  const syncInfo = contract?.authMethod === 'provider_auth'
+    ? syncNativeHarnessConfig(contract)
+    : null;
   return {
     runtimeHome,
     syncInfo,

package/runtime/scripts/credential-adapter.js

@@ -18,7 +18,7 @@ const VALID_AUTH_MODES = ['amalgm', 'provider_auth', 'byok'];
 const SUPPORTED_AUTH_BY_HARNESS = {
   claude_code: ['amalgm', 'byok', 'provider_auth'],
   codex: ['amalgm', 'byok', 'provider_auth'],
-  opencode: ['amalgm', 'byok'],
+  opencode: ['amalgm', 'byok', 'provider_auth'],
   pi: ['amalgm', 'byok', 'provider_auth'],
 };