amalgm 0.1.72 → 0.1.73

package/runtime/scripts/amalgm-mcp/server/http.js

@@ -1,479 +1,45 @@
 /**
- * HTTP server — routes + lifecycle.
+ * HTTP server lifecycle and auth boundary.
  *
- * Route table:
- *   GET  /healthz                     → stats snapshot
- *   *    /mcp                         → MCP streamable-HTTP (delegated to SDK transport)
- *   POST /events                      → webhook ingress (signature match + workflow run)
- *   GET  /events                      → recent events (in-memory ring buffer)
- *   GET  /automations/list            → list automations/triggers/workflows
- *   POST /automations/{get,create,update,delete,run-now,validate}
- *   POST /automations/triggers/{update,delete}
- *   GET  /workspace/projects          → list projects
- *   POST /workspace/import           → copy a local folder into workspaces
- *   POST /github/clone               → clone repository onto the computer
- *   GET  /workspace/branches          → list git branches
- *   POST /workspace/checkout          → checkout git branch
- *   GET  /workspace/diff              → git diff summary + patch
- *   GET  /workspace/worktree          → list worktrees
- *   POST /workspace/worktree          → create worktree
- *   DELETE /workspace/worktree        → remove worktree
- *   GET  /fs/list                     → list files
- *   GET  /fs/read                     → read file
- *   POST /fs/{write,delete,mkdir,rename}
- *   GET  /mcp-connections             → list sanitized MCP connections
- *   POST /mcp-connections             → save/update MCP connection
- *   DELETE /mcp-connections           → remove MCP connection
- *   GET  /toolbox                     → list local ToolboxDB tools/actions
- *   GET  /toolbox/tools?id=...        → get one toolbox tool
- *   POST /toolbox/tools               → save/update a toolbox tool
- *   PATCH /toolbox/tools              → partially update a toolbox tool
- *   DELETE /toolbox/tools             → remove a toolbox tool
- *   GET  /toolbox/actions?id=...      → get one toolbox action
- *   POST /toolbox/actions             → save/update a toolbox action
- *   PATCH /toolbox/actions            → partially update a toolbox action
- *   DELETE /toolbox/actions           → remove a toolbox action
- *   GET  /state/snapshot              → current Local Live Store snapshot
- *   GET  /state/events                → replay Local Live Store events
- *   GET  /state/stream                → SSE Local Live Store stream
- *   GET  /browser/profiles            → list durable Amalgm browser profiles
- *   POST /browser/profiles            → save/update browser profile metadata
- *   GET  /browser/auth-bundles        → list encrypted browser auth bundles
- *   POST /browser/auth-bundles/export → save cookies/storage into encrypted bundle
- *   POST /browser/auth-bundles/import → hydrate cookies/storage from encrypted bundle
- *   DELETE /browser/auth-bundles      → remove encrypted auth bundle metadata/blob
- *   GET  /browser/login-sessions      → list or token-read temporary browser login sessions
- *   POST /browser/login-sessions      → create a temporary browser auth link
- *   POST /browser/login-sessions/complete → export auth bundle and mark login complete
- *   POST /browser/login-sessions/cancel   → cancel a temporary browser auth link
- *   GET  /user-preferences            → current local user preferences
- *   PUT  /user-preferences            → update local user preferences
- *   POST /local/init                  → init local computer state
- *   GET  /local/credentials           → discover local agent auth
- *   POST /local/credentials/resolve   → resolve spawn env for agent auth
- *   POST /email/inbound               → run a reply turn for inbound email
- *   POST /slack/inbound               → run a reply turn for inbound Slack
- *   GET  /credentials                 → list local Amalgm credential profiles
- *   POST /credentials                 → save local Amalgm credential profile
- *   DELETE /credentials               → remove local Amalgm credential profile
- *   POST /user-api-keys               → legacy save BYOK credential file
- *   DELETE /user-api-keys             → legacy remove BYOK credential file
- *   GET  /apps/list                   → list apps
- *   GET  /apps/routes                 → app DNS routes for tunnel adverts
- *   POST /apps/{register,redeploy,start,stop,connect-dns,disconnect-dns}
- *   Legacy /artifacts/* aliases remain for older clients during the rename.
- *   GET  /agents/list                 → list agents
- *   POST /agents/{get,create,update,delete}
+ * This file should stay small: MCP transport handling lives in mcp-adapter.js,
+ * local product APIs live under server/routes/*, and background work starts via
+ * runtime-worker.js.
  */
 
-const http = require('http');
 const { PORT, STORAGE_DIR } = require('../config');
 const { hasSupabase } = require('../lib/supabase');
-const { authorizeRuntimeHttp } = require('../../runtime-auth');
+const { startRuntimeWorker, stopRuntimeWorker } = require('../runtime-worker');
+const { createCombinedServer } = require('./combined-service');
+const { startHttpServer } = require('./service-lifecycle');
 
-const { loadAgents } = require('../agents/store');
-const { loadApps } = require('../apps/store');
-const { activeAgentConversations } = require('../agents/talk');
-const { listAutomations } = require('../automations/store');
-const { startAutomationScheduler, stopAutomationScheduler } = require('../automations/scheduler');
-const { createTransport } = require('./mcp');
-const { handleEventsPost } = require('../events/ingress');
-const eventsRing = require('../events/ring-buffer');
-const automationsRest = require('../automations/rest');
-const agentsRest = require('../agents/rest');
-const appsRest = require('../apps/rest');
-const emailInbound = require('../email/inbound');
-const slackInbound = require('../slack/inbound');
-const fsRest = require('../fs/rest');
-const localRest = require('../local/rest');
-const mcpConnectionsRest = require('../mcp-connections/rest');
-const toolboxRest = require('../toolbox/rest');
-const stateRest = require('../state/rest');
-const browserRest = require('../browser/rest');
-const prefsStore = require('../lib/prefs');
-const userApiKeysRest = require('../user-api-keys/rest');
-const credentialsRest = require('../credentials/rest');
-const workspaceRest = require('../workspace/rest');
-
-function createServer() {
-  return http.createServer(async (req, res) => {
-    if (!authorizeRuntimeHttp(req, res, { exposeHeaders: 'Mcp-Session-Id' })) return;
-
-    async function readJsonBody() {
-      const chunks = [];
-      for await (const chunk of req) chunks.push(chunk);
-      return JSON.parse(Buffer.concat(chunks).toString());
-    }
-    function sendJson(statusCode, data) {
-      res.writeHead(statusCode, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify(data));
-    }
-    function getQuery() {
-      return Object.fromEntries(new URL(req.url, 'http://127.0.0.1').searchParams.entries());
-    }
-
-    try {
-      // ── MCP ─────────────────────────────────────────────────────────────────
-      // Delegate anything under /mcp directly to the SDK transport. A fresh
-      // transport + Server pair is created per request: the stateless
-      // StreamableHTTPServerTransport is single-shot in this mode, so reusing
-      // one across requests would fail on the second call with HTTP 500.
-      if (req.url === '/mcp' || req.url === '/mcp/' || req.url.startsWith('/mcp?')) {
-        const transport = await createTransport();
-        await transport.handleRequest(req, res);
-        return;
-      }
-
-      // ── Health ──────────────────────────────────────────────────────────────
-      if (req.url === '/healthz') {
-        const agents = loadAgents();
-        const automations = listAutomations();
-        return sendJson(200, {
-          status: 'ok',
-          automations: automations.length,
-          enabledAutomations: automations.filter((automation) => automation.enabled !== false).length,
-          apps: loadApps().apps.length,
-          customAgents: agents.agents.length,
-          activeAgentConversations: activeAgentConversations.size,
-        });
-      }
-
-      // ── /state — Local Live Store snapshot/replay/stream ─────────────────
-      if (req.url.startsWith('/state/snapshot') && req.method === 'GET') {
-        return stateRest.handleSnapshot(getQuery(), sendJson);
-      }
-      if (req.url.startsWith('/state/events') && req.method === 'GET') {
-        return stateRest.handleEvents(getQuery(), sendJson);
-      }
-      if (req.url.startsWith('/state/stream') && req.method === 'GET') {
-        return stateRest.handleStream(req, res, getQuery());
-      }
-
-      // ── /browser REST ───────────────────────────────────────────────────
-      if (req.url === '/browser/profiles' && req.method === 'GET') {
-        return browserRest.handleProfilesList(sendJson);
-      }
-      if (req.url === '/browser/profiles' && req.method === 'POST') {
-        return browserRest.handleProfilesUpsert(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/browser/auth-bundles' && req.method === 'GET') {
-        return browserRest.handleAuthBundlesList(sendJson);
-      }
-      if (req.url === '/browser/auth-bundles/export' && req.method === 'POST') {
-        return browserRest.handleAuthBundleExport(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/browser/auth-bundles/import' && req.method === 'POST') {
-        return browserRest.handleAuthBundleImport(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/browser/auth-bundles' && req.method === 'DELETE') {
-        return browserRest.handleAuthBundleDelete(await readJsonBody(), sendJson);
-      }
-      if (req.url.startsWith('/browser/login-sessions') && req.method === 'GET') {
-        return browserRest.handleLoginSessionsList(getQuery(), sendJson);
-      }
-      if (req.url === '/browser/login-sessions' && req.method === 'POST') {
-        return browserRest.handleLoginSessionCreate(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/browser/login-sessions/complete' && req.method === 'POST') {
-        return browserRest.handleLoginSessionComplete(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/browser/login-sessions/cancel' && req.method === 'POST') {
-        return browserRest.handleLoginSessionCancel(await readJsonBody(), sendJson);
-      }
-
-      // ── /user-preferences REST ───────────────────────────────────────────
-      if (req.url === '/user-preferences' && req.method === 'GET') {
-        return sendJson(200, prefsStore.readUserPreferences());
-      }
-      if (req.url === '/user-preferences' && req.method === 'PUT') {
-        const preferences = prefsStore.updateUserPreferences(await readJsonBody());
-        return sendJson(200, { success: true, preferences });
-      }
-
-      // ── /agents (REST, not MCP) ─────────────────────────────────────────────
-      if (req.url === '/agents/list' && req.method === 'GET') {
-        return agentsRest.handleList(sendJson);
-      }
-      if (req.url === '/agents/get' && req.method === 'POST') {
-        return agentsRest.handleGet(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/agents/create' && req.method === 'POST') {
-        return agentsRest.handleCreate(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/agents/update' && req.method === 'POST') {
-        return agentsRest.handleUpdate(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/agents/delete' && req.method === 'POST') {
-        return agentsRest.handleDelete(await readJsonBody(), sendJson);
-      }
-
-      // ── /events — webhook ingress ───────────────────────────────────────────
-      if (req.url === '/events' && req.method === 'POST') {
-        return handleEventsPost(req, sendJson);
-      }
-      if (req.url === '/events' && req.method === 'GET') {
-        return sendJson(200, { events: eventsRing.recent(50) });
-      }
-
-      // ── /automations REST ─────────────────────────────────────────────────
-      if (req.url === '/automations/list' && req.method === 'GET') {
-        return automationsRest.handleList(req, sendJson);
-      }
-      if (req.url === '/automations/get' && req.method === 'POST') {
-        return automationsRest.handleGet(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/automations/create' && req.method === 'POST') {
-        return automationsRest.handleCreate(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/automations/update' && req.method === 'POST') {
-        return automationsRest.handleUpdate(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/automations/delete' && req.method === 'POST') {
-        return automationsRest.handleDelete(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/automations/run-now' && req.method === 'POST') {
-        return automationsRest.handleRunNow(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/automations/validate' && req.method === 'POST') {
-        return automationsRest.handleValidate(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/automations/triggers/update' && req.method === 'POST') {
-        return automationsRest.handleTriggerUpdate(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/automations/triggers/delete' && req.method === 'POST') {
-        return automationsRest.handleTriggerDelete(await readJsonBody(), sendJson);
-      }
-
-      // ── /workspace REST ─────────────────────────────────────────────────────
-      if (req.url === '/workspace/projects' && req.method === 'GET') {
-        return workspaceRest.handleProjects(sendJson);
-      }
-      if (req.url === '/workspace/projects' && req.method === 'POST') {
-        return workspaceRest.handleProjectRegister(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/workspace/projects' && req.method === 'PATCH') {
-        return workspaceRest.handleProjectUpdate(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/workspace/projects' && req.method === 'DELETE') {
-        return workspaceRest.handleProjectDelete(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/workspace/import' && req.method === 'POST') {
-        return workspaceRest.handleImport(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/github/clone' && req.method === 'POST') {
-        return workspaceRest.handleClone(await readJsonBody(), sendJson);
-      }
-      if (req.url.startsWith('/workspace/branches') && req.method === 'GET') {
-        return workspaceRest.handleBranches(getQuery(), sendJson);
-      }
-      if (req.url === '/workspace/checkout' && req.method === 'POST') {
-        return workspaceRest.handleCheckout(await readJsonBody(), sendJson);
-      }
-      if (req.url.startsWith('/workspace/diff') && req.method === 'GET') {
-        return workspaceRest.handleDiff(getQuery(), sendJson);
-      }
-      if (req.url.startsWith('/workspace/worktree') && req.method === 'GET') {
-        return workspaceRest.handleWorktreeList(getQuery(), sendJson);
-      }
-      if (req.url === '/workspace/worktree' && req.method === 'POST') {
-        return workspaceRest.handleWorktreeCreate(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/workspace/worktree' && req.method === 'DELETE') {
-        return workspaceRest.handleWorktreeDelete(await readJsonBody(), sendJson);
-      }
-
-      // ── /fs REST ────────────────────────────────────────────────────────────
-      if (req.url.startsWith('/fs/list') && req.method === 'GET') {
-        return fsRest.handleList(getQuery(), sendJson);
-      }
-      if (req.url.startsWith('/fs/read') && req.method === 'GET') {
-        return fsRest.handleRead(getQuery(), sendJson);
-      }
-      if (req.url === '/fs/write' && req.method === 'POST') {
-        return fsRest.handleWrite(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/fs/delete' && req.method === 'POST') {
-        return fsRest.handleDelete(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/fs/mkdir' && req.method === 'POST') {
-        return fsRest.handleMkdir(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/fs/rename' && req.method === 'POST') {
-        return fsRest.handleRename(await readJsonBody(), sendJson);
-      }
-
-      // ── /mcp-connections REST ──────────────────────────────────────────────
-      if (req.url === '/mcp-connections' && req.method === 'GET') {
-        return mcpConnectionsRest.handleList(sendJson);
-      }
-      if (req.url === '/mcp-connections' && req.method === 'POST') {
-        return mcpConnectionsRest.handleUpsert(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/mcp-connections' && req.method === 'DELETE') {
-        return mcpConnectionsRest.handleDelete(await readJsonBody(), sendJson);
-      }
-
-      // ── /toolbox REST ─────────────────────────────────────────────────────
-      if (req.url === '/toolbox' && req.method === 'GET') {
-        return toolboxRest.handleList(sendJson);
-      }
-      if ((req.url === '/toolbox/tools' || req.url.startsWith('/toolbox/tools?')) && req.method === 'GET') {
-        return toolboxRest.handleGetTool(getQuery(), sendJson);
-      }
-      if (req.url === '/toolbox/tools' && req.method === 'POST') {
-        return toolboxRest.handleUpsertTool(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/toolbox/tools' && req.method === 'PATCH') {
-        return toolboxRest.handleUpdateTool(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/toolbox/tools' && req.method === 'DELETE') {
-        return toolboxRest.handleDeleteTool(await readJsonBody(), sendJson);
-      }
-      if ((req.url === '/toolbox/actions' || req.url.startsWith('/toolbox/actions?')) && req.method === 'GET') {
-        return toolboxRest.handleGetAction(getQuery(), sendJson);
-      }
-      if (req.url === '/toolbox/actions' && req.method === 'POST') {
-        return toolboxRest.handleUpsertAction(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/toolbox/actions' && req.method === 'PATCH') {
-        return toolboxRest.handleUpdateAction(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/toolbox/actions' && req.method === 'DELETE') {
-        return toolboxRest.handleDeleteAction(await readJsonBody(), sendJson);
-      }
-
-      // ── /local REST ────────────────────────────────────────────────────────
-      if (req.url === '/local/init' && req.method === 'POST') {
-        return localRest.handleInit(sendJson);
-      }
-      if (req.url === '/local/credentials' && req.method === 'GET') {
-        return localRest.handleCredentials(sendJson);
-      }
-      if (req.url === '/local/credentials/resolve' && req.method === 'POST') {
-        return localRest.handleResolve(await readJsonBody(), sendJson);
-      }
-
-      // ── /credentials REST ─────────────────────────────────────────────────
-      if (req.url === '/credentials' && req.method === 'GET') {
-        return credentialsRest.handleList(sendJson);
-      }
-      if (req.url === '/credentials' && req.method === 'POST') {
-        return credentialsRest.handleSave(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/credentials' && req.method === 'DELETE') {
-        return credentialsRest.handleDelete(await readJsonBody(), sendJson);
-      }
-
-      // ── /email REST ────────────────────────────────────────────────────────
-      if (req.url === '/email/inbound' && req.method === 'POST') {
-        return emailInbound.handleEmailInbound(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/slack/inbound' && req.method === 'POST') {
-        return slackInbound.handleSlackInbound(await readJsonBody(), sendJson);
-      }
-
-      // ── /user-api-keys REST ───────────────────────────────────────────────
-      if (req.url === '/user-api-keys' && req.method === 'POST') {
-        return userApiKeysRest.handleSave(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/user-api-keys' && req.method === 'DELETE') {
-        return userApiKeysRest.handleDelete(sendJson);
-      }
-
-      // ── /apps REST ────────────────────────────────────────────────────
-      if (req.url === '/apps/list' && req.method === 'GET') {
-        return appsRest.handleList(sendJson);
-      }
-      if (req.url === '/apps/routes' && req.method === 'GET') {
-        return appsRest.handleRoutes(sendJson);
-      }
-      if (req.url === '/apps/register' && req.method === 'POST') {
-        return appsRest.handleRegister(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/apps/redeploy' && req.method === 'POST') {
-        return appsRest.handleRedeploy(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/apps/start' && req.method === 'POST') {
-        return appsRest.handleStart(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/apps/stop' && req.method === 'POST') {
-        return appsRest.handleStop(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/apps/delete' && req.method === 'POST') {
-        return appsRest.handleDelete(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/apps/connect-dns' && req.method === 'POST') {
-        return appsRest.handleConnectDns(await readJsonBody(), sendJson);
-      }
-      if (req.url === '/apps/disconnect-dns' && req.method === 'POST') {
-        return appsRest.handleDisconnectDns(await readJsonBody(), sendJson);
-      }
-
-      // ── legacy /artifacts REST aliases ────────────────────────────────
-      if (req.url === '/artifacts/list' && req.method === 'GET') {
-        return appsRest.handleList(sendJson, { legacy: true });
-      }
-      if (req.url === '/artifacts/routes' && req.method === 'GET') {
-        return appsRest.handleRoutes(sendJson, { legacy: true });
-      }
-      if (req.url === '/artifacts/register' && req.method === 'POST') {
-        return appsRest.handleRegister(await readJsonBody(), sendJson, { legacy: true });
-      }
-      if (req.url === '/artifacts/redeploy' && req.method === 'POST') {
-        return appsRest.handleRedeploy(await readJsonBody(), sendJson, { legacy: true });
-      }
-      if (req.url === '/artifacts/start' && req.method === 'POST') {
-        return appsRest.handleStart(await readJsonBody(), sendJson, { legacy: true });
-      }
-      if (req.url === '/artifacts/stop' && req.method === 'POST') {
-        return appsRest.handleStop(await readJsonBody(), sendJson, { legacy: true });
-      }
-      if (req.url === '/artifacts/delete' && req.method === 'POST') {
-        return appsRest.handleDelete(await readJsonBody(), sendJson, { legacy: true });
-      }
-      if (req.url === '/artifacts/connect-dns' && req.method === 'POST') {
-        return appsRest.handleConnectDns(await readJsonBody(), sendJson, { legacy: true });
-      }
-      if (req.url === '/artifacts/disconnect-dns' && req.method === 'POST') {
-        return appsRest.handleDisconnectDns(await readJsonBody(), sendJson, { legacy: true });
-      }
-
-      res.writeHead(404, { 'Content-Type': 'text/plain' });
-      res.end('Not found');
-    } catch (err) {
-      console.error('[AmalgmMCP] Unhandled error:', err);
-      if (!res.headersSent) sendJson(500, { error: 'Internal server error' });
-    }
-  });
+function createServer(options = {}) {
+  return createCombinedServer(options);
 }
 
-async function listen() {
-  const httpServer = createServer();
-
-  httpServer.listen(PORT, '127.0.0.1', async () => {
-    console.log(`[AmalgmMCP] Listening on 127.0.0.1:${PORT}`);
-    console.log(`[AmalgmMCP] Storage: ${STORAGE_DIR}`);
-    console.log(
-      `[AmalgmMCP] Supabase: ${hasSupabase() ? 'connected' : 'not configured (runs are local-only)'}`,
-    );
-    // Hydrate user model prefs non-blocking from local SQLite.
-    require('../lib/prefs').hydrateModelPreferences().catch(() => {});
-    startAutomationScheduler();
+async function listen(options = {}) {
+  const httpServer = createServer(options);
+  const runtimeWorker = options.runtimeWorker || {
+    start: startRuntimeWorker,
+    stop: stopRuntimeWorker,
+  };
+
+  startHttpServer(httpServer, {
+    port: options.port || PORT,
+    serviceName: 'AmalgmMCP',
+    onListening() {
+      console.log(`[AmalgmMCP] Storage: ${STORAGE_DIR}`);
+      console.log(
+        `[AmalgmMCP] Supabase: ${hasSupabase() ? 'connected' : 'not configured (runs are local-only)'}`,
+      );
+      // Hydrate user model prefs non-blocking from local SQLite.
+      require('../lib/prefs').hydrateModelPreferences().catch(() => {});
+      runtimeWorker.start();
+    },
+    onShutdown() {
+      runtimeWorker.stop();
+    },
   });
 
-  // Graceful shutdown. Running tasks get aborted via SIGTERM → process exit;
-  // we don't try to individually abort them here since chat-server owns its own
-  // runtime teardown paths.
-  function shutdown() {
-    console.log('[AmalgmMCP] Shutting down...');
-    stopAutomationScheduler();
-    httpServer.close(() => process.exit(0));
-    setTimeout(() => process.exit(0), 5000);
-  }
-
-  process.on('SIGTERM', shutdown);
-  process.on('SIGINT', shutdown);
-
   return httpServer;
 }
 

package/runtime/scripts/amalgm-mcp/server/local-service-router.js

@@ -0,0 +1,57 @@
+'use strict';
+
+/**
+ * Local product/control-plane API dispatcher.
+ *
+ * These route groups are not the MCP surface. They are the local HTTP APIs the
+ * app uses to manage resources: agents, apps, automations, toolbox records,
+ * browser auth, workspace/files, credentials, state, and inbound event helpers.
+ */
+
+const { handleHealthRoutes } = require('./routes/health');
+const { handleStateRoutes } = require('./routes/state');
+const { handleBrowserRoutes } = require('./routes/browser');
+const { handlePreferenceRoutes } = require('./routes/preferences');
+const { handleAgentRoutes } = require('./routes/agents');
+const { handleEventRoutes } = require('./routes/events');
+const { handleAutomationRoutes } = require('./routes/automations');
+const { handleWorkspaceRoutes } = require('./routes/workspace');
+const { handleFileRoutes } = require('./routes/files');
+const { handleToolboxRoutes } = require('./routes/toolbox');
+const { handleLocalRoutes } = require('./routes/local');
+const { handleCredentialRoutes } = require('./routes/credentials');
+const { handleInboundRoutes } = require('./routes/inbound');
+const { handleAppRoutes } = require('./routes/apps');
+
+const DEFAULT_ROUTE_GROUPS = [
+  handleHealthRoutes,
+  handleStateRoutes,
+  handleBrowserRoutes,
+  handlePreferenceRoutes,
+  handleAgentRoutes,
+  handleEventRoutes,
+  handleAutomationRoutes,
+  handleWorkspaceRoutes,
+  handleFileRoutes,
+  handleToolboxRoutes,
+  handleLocalRoutes,
+  handleCredentialRoutes,
+  handleInboundRoutes,
+  handleAppRoutes,
+];
+
+function createLocalServiceRouter(routeGroups = DEFAULT_ROUTE_GROUPS) {
+  return {
+    async handle(ctx) {
+      for (const routeGroup of routeGroups) {
+        if (await routeGroup(ctx)) return true;
+      }
+      return false;
+    },
+  };
+}
+
+module.exports = {
+  DEFAULT_ROUTE_GROUPS,
+  createLocalServiceRouter,
+};

package/runtime/scripts/amalgm-mcp/server/mcp-adapter.js

@@ -0,0 +1,22 @@
+'use strict';
+
+const { createTransport } = require('./mcp');
+
+function isMcpRequest(pathname) {
+  return pathname === '/mcp' || pathname === '/mcp/';
+}
+
+async function handleMcpRequest(ctx) {
+  if (!isMcpRequest(ctx.pathname)) return false;
+
+  // The SDK transport is single-shot in stateless streamable-HTTP mode.
+  // Reusing one across requests fails on the second call with HTTP 500.
+  const transport = await createTransport();
+  await transport.handleRequest(ctx.req, ctx.res);
+  return true;
+}
+
+module.exports = {
+  handleMcpRequest,
+  isMcpRequest,
+};

package/runtime/scripts/amalgm-mcp/server/mcp-http-service.js

@@ -0,0 +1,24 @@
+'use strict';
+
+const { createRuntimeHttpServer } = require('./http-service');
+const { handleMcpRequest } = require('./mcp-adapter');
+
+function createMcpHttpHandler(options = {}) {
+  const mcpRequestHandler = options.mcpRequestHandler || handleMcpRequest;
+
+  return async function handleMcpHttpRequest(ctx) {
+    return mcpRequestHandler(ctx);
+  };
+}
+
+function createMcpHttpServer(options = {}) {
+  return createRuntimeHttpServer(createMcpHttpHandler(options), {
+    serviceName: options.serviceName || 'AmalgmMCPAdapter',
+    exposeHeaders: options.exposeHeaders,
+  });
+}
+
+module.exports = {
+  createMcpHttpHandler,
+  createMcpHttpServer,
+};

package/runtime/scripts/amalgm-mcp/server/mcp-request-context.js

@@ -0,0 +1,32 @@
+'use strict';
+
+const { AMALGM_USER_ID } = require('../config');
+const { hasSupabase, supabaseSelect } = require('../lib/supabase');
+
+/**
+ * Look up the caller's session to tag DB rows with origin metadata. Reads
+ * x-amalgm-session-id from the transport's passed-through HTTP headers.
+ */
+async function buildMcpRequestContext(extra) {
+  const headers = extra?.requestInfo?.headers || {};
+  const h = headers['x-amalgm-session-id'];
+  const callerSessionId = Array.isArray(h) ? h[0] : h || null;
+  const ctx = { callerSessionId };
+
+  if (callerSessionId && hasSupabase()) {
+    const rows = await supabaseSelect(
+      'sessions',
+      `id=eq.${callerSessionId}&user_id=eq.${AMALGM_USER_ID}&select=id,title,harness,metadata`,
+    );
+    const parent = Array.isArray(rows) ? rows[0] : null;
+    if (parent) {
+      ctx.sessionMetadata = parent.metadata || {};
+      ctx.originName = parent.title || undefined;
+      ctx.originHarnessId = parent.harness || undefined;
+      ctx.originBaseHarnessId = parent.metadata?.baseHarnessId || undefined;
+    }
+  }
+  return ctx;
+}
+
+module.exports = { buildMcpRequestContext };