amalgm 0.1.75 → 0.1.76

package/runtime/scripts/amalgm-mcp/tests/toolbox-service.test.js

@@ -160,16 +160,18 @@ test('toolbox service lists compact registry views', () => {
 test('toolbox service overlays first-party system catalog entries', () => {
   const service = createToolboxService(createRepository());
   const catalog = service.readCatalog();
-  const browser = service.getTool('amalgm.browser', { includeActions: false });
-  const navigate = service.getAction('amalgm.browser.browser_navigate');
+  const browser = service.getTool('browser', { includeActions: false });
+  const navigate = service.getAction('browser.browser_navigate');
 
   assert.equal(catalog.tools.amalgm, undefined);
   assert.equal(catalog.toolActions['amalgm.notify_user'], undefined);
-  assert.equal(catalog.tools['amalgm.browser'].origin, 'system');
-  assert.equal(browser.tool.name, 'Amalgm Browser');
+  assert.equal(catalog.tools['amalgm.browser'], undefined);
+  assert.equal(catalog.tools.browser.origin, 'system');
+  assert.equal(catalog.tools.browser.owner, 'amalgm');
+  assert.equal(browser.tool.name, 'Browser');
   assert.equal(browser.actions, undefined);
-  assert.equal(navigate.action.sourceAction.mcpToolName, 'toolbox__amalgm_browser_browser_navigate');
-  assert.equal(service.listTools({ origin: 'system' }).tools.some((tool) => tool.id === 'amalgm.browser'), true);
+  assert.equal(navigate.action.sourceAction.mcpToolName, 'toolbox__browser_browser_navigate');
+  assert.equal(service.listTools({ origin: 'system' }).tools.some((tool) => tool.id === 'browser'), true);
 });
 
 test('toolbox service resolves only runnable CLI/API actions', () => {
@@ -196,7 +198,7 @@ test('toolbox service derives only external MCP ids from selected tools', () =>
   assert.deepEqual(
     service.externalMcpToolIdsForSelection([
       'remote.mcp',
-      'amalgm.browser',
+      'browser',
       'api.weather',
       'missing.tool',
     ]),

package/runtime/scripts/amalgm-mcp/toolbox/selection.js

@@ -1,5 +1,13 @@
 'use strict';
 
+const FIRST_PARTY_TOOL_IDS = new Set([
+  'automations',
+  'notifications',
+  'agents',
+  'apps',
+  'browser',
+]);
+
 function selectedToolIdsForContext(context) {
   const tools = context?.sessionMetadata?.tools;
   if (!tools || tools.mode !== 'selected') return null;
@@ -11,9 +19,21 @@ function selectedToolIdsForContext(context) {
   return new Set(selected.map((value) => String(value || '').trim()).filter(Boolean));
 }
 
+function selectedHas(selectedToolIds, id) {
+  if (!id) return false;
+  if (selectedToolIds.has(id)) return true;
+  const value = String(id || '').trim();
+  const toolId = value.split('.')[0];
+  if (FIRST_PARTY_TOOL_IDS.has(toolId) && selectedToolIds.has(`amalgm.${value}`)) return true;
+  if (value === 'notifications.notify_user' && selectedToolIds.has('amalgm.notify_user')) return true;
+  if (value === 'agents.talk_to_agent' && selectedToolIds.has('amalgm.talk_to_agent')) return true;
+  if (FIRST_PARTY_TOOL_IDS.has(value) && selectedToolIds.has(`amalgm.${value}`)) return true;
+  return false;
+}
+
 function selectedContainsToolOrAction(selectedToolIds, toolId, actionId) {
   if (!selectedToolIds) return true;
-  return selectedToolIds.has(toolId) || selectedToolIds.has(actionId);
+  return selectedHas(selectedToolIds, toolId) || selectedHas(selectedToolIds, actionId);
 }
 
 module.exports = {

package/runtime/scripts/amalgm-mcp/toolbox/system-catalog.js

@@ -12,6 +12,13 @@ const { PORT } = require('../config');
 const { toolboxMcpToolName } = require('./names');
 
 const SYSTEM_TIMESTAMP = '1970-01-01T00:00:00.000Z';
+const LEGACY_FIRST_PARTY_TOOL_IDS = new Set([
+  'amalgm.automations',
+  'amalgm.notifications',
+  'amalgm.agents',
+  'amalgm.apps',
+  'amalgm.browser',
+]);
 
 function coreToolGroups() {
   return require('../server/core-tools').CORE_TOOL_GROUPS || [];
@@ -83,8 +90,16 @@ function persistedCatalogWithoutLegacyAggregate(toolbox) {
   const tools = { ...(toolbox?.tools || {}) };
   const toolActions = { ...(toolbox?.toolActions || {}) };
   delete tools.amalgm;
+  for (const toolId of LEGACY_FIRST_PARTY_TOOL_IDS) delete tools[toolId];
   for (const [actionId, action] of Object.entries(toolActions)) {
-    if (action?.toolId === 'amalgm') delete toolActions[actionId];
+    const legacyGroupId = actionId.split('.').slice(0, 2).join('.');
+    if (
+      action?.toolId === 'amalgm'
+      || LEGACY_FIRST_PARTY_TOOL_IDS.has(action?.toolId)
+      || LEGACY_FIRST_PARTY_TOOL_IDS.has(legacyGroupId)
+    ) {
+      delete toolActions[actionId];
+    }
   }
   return { tools, toolActions };
 }

package/runtime/scripts/amalgm-mcp/workflows/compiler.js

@@ -136,7 +136,7 @@ function makeBuilders() {
     const args = isObject(promptOrArgs)
       ? { agent, ...promptOrArgs }
       : { agent, prompt: String(promptOrArgs || '') };
-    return builders.tool(name, 'amalgm.agents.talk_to_agent', args, options);
+    return builders.tool(name, 'agents.talk_to_agent', args, options);
   };
 
   builders.workflow = (definition) => definition;

package/runtime/scripts/amalgm-mcp/workflows/runner.js

@@ -10,7 +10,12 @@ const { recordEventRun } = require('../events/store');
 const { compileWorkflowText } = require('./compiler');
 const { loadWorkflows } = require('./store');
 const { callToolboxMcpTool, toolboxMcpToolName } = require('../toolbox/runner');
-const { resolveFirstPartyToolAction, resolveToolboxAction, suggestWorkflowToolActions } = require('../automations/tool-actions');
+const {
+  resolveFirstPartyToolAction,
+  resolveToolboxAction,
+  suggestWorkflowToolActions,
+  workflowActionKeys,
+} = require('../automations/tool-actions');
 
 const DEFAULT_CELL_TIMEOUT_MS = 120_000;
 const DEFAULT_CODE_TIMEOUT_MS = 15_000;
@@ -281,7 +286,8 @@ function mcpResultToOutput(result, actionKey) {
 async function runToolCell(cell, args, allowlist) {
   const actionKey = `${cell.toolId}.${cell.actionName}`;
   const allowedActions = Array.isArray(allowlist.actions) ? allowlist.actions : [];
-  if (allowedActions.length > 0 && !allowedActions.includes(actionKey)) {
+  const allowedKeys = new Set(workflowActionKeys(cell.toolId, cell.actionName));
+  if (allowedActions.length > 0 && !allowedActions.some((allowed) => allowedKeys.has(allowed))) {
     throw new Error(`Workflow is not allowed to call ${actionKey}.`);
   }
 

package/runtime/scripts/chat-core/adapters/claude.js

@@ -7,10 +7,10 @@ const { normalizeClaudeMessage, usageRecordsFromClaudeResult, usageFromClaude }
 const { recordNativeEvent } = require('../recorder');
 const { toClaudeMcpServers } = require('../tooling/mcp-bundle');
 const { bundledClaudeBinary } = require('../tooling/native-binaries');
-const { claudeNativeHookSettings } = require('../tooling/native-config');
 const { importPackage } = require('../tooling/package-import');
 const { prepareHarnessRuntime } = require('../tooling/runtime-home');
 const { composeSystemPrompt } = require('../tooling/system-prompt');
+const { toClaudeSettings } = require('../../amalgm-mcp/agent-config/renderers/hooks');
 
 function redactSecrets(text) {
   return String(text || '')
@@ -36,7 +36,7 @@ class ClaudeAdapter {
     const systemPrompt = composeSystemPrompt(contract);
     const pathToClaudeCodeExecutable = process.env.CLAUDE_CODE_BINARY || bundledClaudeBinary();
     const settings = {
-      ...(contract.authMethod === 'provider_auth' ? (claudeNativeHookSettings({ cwd: contract.cwd }) || {}) : {}),
+      ...toClaudeSettings(contract.agentConfig),
       ...(contract.fastMode ? { fastMode: true, fastModePerSessionOptIn: true } : {}),
     };
     return {

package/runtime/scripts/chat-core/adapters/codex.js

@@ -10,9 +10,10 @@ const { codexErrorMessage, normalizeCodexNotification } = require('../normalizer
 const { recordNativeEvent } = require('../recorder');
 const { relayedMcpServers, toCodexMcpToml } = require('../tooling/mcp-bundle');
 const { bundledCodexBinary, bundledCodexPathDirs, executableExists, findOnPath } = require('../tooling/native-binaries');
-const { syncCodexNativeConfig } = require('../tooling/native-config');
+const { syncCodexProviderAuth } = require('../tooling/native-config');
 const { prepareHarnessRuntime } = require('../tooling/runtime-home');
 const { composeSystemPrompt } = require('../tooling/system-prompt');
+const { hasHooks, toCodexHooksJson, toHookMap } = require('../../amalgm-mcp/agent-config/renderers/hooks');
 
 class JsonLineRpc {
   constructor({ binary, cwd, env }) {
@@ -202,6 +203,53 @@ function readTextFile(file) {
   }
 }
 
+function ensureCodexHomeAlias(home) {
+  if (!home) return null;
+  const alias = path.join(home, '.codex');
+  try {
+    const stat = fs.lstatSync(alias);
+    return stat.isDirectory() || stat.isSymbolicLink() ? alias : null;
+  } catch {}
+  try {
+    fs.symlinkSync('.', alias, 'dir');
+    return alias;
+  } catch {
+    try {
+      fs.mkdirSync(alias, { recursive: true });
+      return alias;
+    } catch {
+      return null;
+    }
+  }
+}
+
+function codexConfigDirs(home) {
+  fs.mkdirSync(home, { recursive: true });
+  const dirs = [home];
+  const alias = ensureCodexHomeAlias(home);
+  if (alias) dirs.push(alias);
+  const seen = new Set();
+  return dirs.filter((dir) => {
+    let key;
+    try {
+      key = fs.realpathSync(dir);
+    } catch {
+      key = path.resolve(dir);
+    }
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+
+function writeCodexHomeFile(home, filename, contents, mode = 0o600) {
+  for (const dir of codexConfigDirs(home)) {
+    const target = path.join(dir, filename);
+    fs.writeFileSync(target, contents, { mode });
+    try { fs.chmodSync(target, mode); } catch {}
+  }
+}
+
 function tomlSectionName(line) {
   const match = String(line || '').match(/^\s*\[([^\]]+)\]\s*$/);
   return match ? match[1].trim() : null;
@@ -312,6 +360,27 @@ function mirrorCodexHookTrust(toml, sourceDir, runtimeHome) {
   return `${String(toml || '').trimEnd()}${parent}\n${additions.join('\n\n')}\n`;
 }
 
+function generatedCodexHookTrust(contract) {
+  const home = contract.auth.runtimeHome;
+  if (!home || !hasHooks(contract.agentConfig)) return '';
+  const hookMap = toHookMap(contract.agentConfig);
+  const hookFiles = [
+    path.join(home, 'hooks.json'),
+    path.join(home, '.codex', 'hooks.json'),
+  ];
+  const lines = ['[hooks.state]'];
+  for (const hooksPath of hookFiles) {
+    for (const [event, entries] of Object.entries(hookMap)) {
+      for (let index = 0; index < entries.length; index += 1) {
+        lines.push('');
+        lines.push(`[hooks.state.${tomlQuoted(`${hooksPath}:${event}:${index}`)}]`);
+        lines.push('trusted = true');
+      }
+    }
+  }
+  return lines.join('\n');
+}
+
 function generatedMcpSectionNames(contract) {
   return relayedMcpServers(contract).map((server) => `mcp_servers.${server.name}`);
 }
@@ -327,8 +396,7 @@ function buildCodexConfig(contract, existingConfig, syncInfo) {
     ...(contract.authMethod === 'amalgm' ? ['model_providers.amalgm'] : []),
     ...generatedMcpSectionNames(contract),
   ]);
-  config = mirrorCodexHookTrust(config, syncInfo?.sourceDir, contract.auth.runtimeHome);
-  if (fs.existsSync(path.join(contract.auth.runtimeHome, 'hooks.json'))) {
+  if (hasHooks(contract.agentConfig)) {
     config = ensureFeatureBoolean(config, 'codex_hooks', true);
   }
   const generated = contract.authMethod === 'amalgm'
@@ -351,6 +419,7 @@ function buildCodexConfig(contract, existingConfig, syncInfo) {
   return [
     generated.trimEnd(),
     String(config || '').trim(),
+    generatedCodexHookTrust(contract).trim(),
     String(mcpToml || '').trim(),
   ].filter(Boolean).join('\n\n') + '\n';
 }
@@ -363,26 +432,27 @@ function writeConfig(contract, syncInfo) {
   const home = contract.auth.runtimeHome;
   if (!home) return;
   fs.mkdirSync(home, { recursive: true });
+  ensureCodexHomeAlias(home);
   if (syncInfo === undefined) {
-    syncInfo = contract.authMethod === 'provider_auth' ? syncCodexNativeConfig(home) : null;
+    syncInfo = contract.authMethod === 'provider_auth' ? syncCodexProviderAuth(home) : null;
   }
   const nativeConfig = baseNativeConfigForContract(contract, syncInfo);
-  const configPath = path.join(home, 'config.toml');
+  if (hasHooks(contract.agentConfig)) {
+    writeCodexHomeFile(home, 'hooks.json', toCodexHooksJson(contract.agentConfig), 0o600);
+  }
   if (contract.authMethod === 'provider_auth') {
     const sourceAuth = path.join(syncInfo?.sourceDir || path.join(os.homedir(), '.codex'), 'auth.json');
-    const targetAuth = path.join(home, 'auth.json');
     if (fs.existsSync(sourceAuth)) {
-      fs.copyFileSync(sourceAuth, targetAuth);
-      fs.chmodSync(targetAuth, 0o600);
+      writeCodexHomeFile(home, 'auth.json', fs.readFileSync(sourceAuth), 0o600);
     }
-    fs.writeFileSync(configPath, buildCodexConfig(contract, nativeConfig, syncInfo), { mode: 0o600 });
+    writeCodexHomeFile(home, 'config.toml', buildCodexConfig(contract, nativeConfig, syncInfo), 0o600);
     return;
   }
-  fs.writeFileSync(configPath, buildCodexConfig(contract, nativeConfig, syncInfo), { mode: 0o600 });
-  fs.writeFileSync(path.join(home, 'auth.json'), JSON.stringify({
+  writeCodexHomeFile(home, 'config.toml', buildCodexConfig(contract, nativeConfig, syncInfo), 0o600);
+  writeCodexHomeFile(home, 'auth.json', JSON.stringify({
     auth_mode: 'apikey',
     OPENAI_API_KEY: contract.auth.tokenRef,
-  }, null, 2), { mode: 0o600 });
+  }, null, 2), 0o600);
 }
 
 class CodexAdapter {

package/runtime/scripts/chat-core/auth.js

@@ -109,15 +109,24 @@ function providerAuthIdentity(harness) {
   return `${harness || 'provider'}:provider-default`;
 }
 
-function runtimeHome({ amalgmDir, harness }) {
-  return path.join(amalgmDir, 'cli-homes', safePathSegment(harness), 'home');
+function runtimeHome({ amalgmDir, harness, agentConfigId, runtimeHomeLayout }) {
+  const harnessHome = path.join(amalgmDir, 'cli-homes', safePathSegment(harness));
+  if (runtimeHomeLayout === 'per-agent') {
+    return path.join(
+      harnessHome,
+      'agents',
+      safePathSegment(agentConfigId || harness),
+      'home',
+    );
+  }
+  return path.join(harnessHome, 'home');
 }
 
 function providerAuthFingerprint(harness) {
   return fingerprint(providerAuthIdentity(harness));
 }
 
-function authEnvelope({ harness, authMethod, sessionId, localBaseUrl, proxyToken, proxyBaseUrl, amalgmDir, userId, credentialId, modelId }) {
+function authEnvelope({ harness, authMethod, sessionId, localBaseUrl, proxyToken, proxyBaseUrl, amalgmDir, userId, credentialId, modelId, agentConfigId, runtimeHomeLayout }) {
   const method = coerceAuth(harness, authMethod);
   const byok = readByokFile(amalgmDir);
   let baseUrl = null;
@@ -155,7 +164,7 @@ function authEnvelope({ harness, authMethod, sessionId, localBaseUrl, proxyToken
     forwardBaseUrl,
     tokenRef,
     tokenFingerprint,
-    runtimeHome: runtimeHome({ amalgmDir, harness }),
+    runtimeHome: runtimeHome({ amalgmDir, harness, agentConfigId, runtimeHomeLayout }),
   };
 }
 

package/runtime/scripts/chat-core/contract.js

@@ -7,6 +7,7 @@ const { AMALGM_DIR, DEFAULT_CWD, PROXY_BASE_URL, PROXY_TOKEN } = require('../cha
 const { canonicalProjectPath } = require('../lib/project-paths');
 const { authEnvelope, coerceAuth, fingerprint } = require('./auth');
 const { runtimePort } = require('../../lib/runtime-manifest');
+const { normalizeAgentConfig } = require('../amalgm-mcp/agent-config/schema');
 
 function agentToHarness(agent) {
   const clean = String(agent || '').trim();
@@ -206,6 +207,7 @@ function frozenRuntimeFields(input) {
     authMethod: input.authMethod,
     auth: authIdentity,
     systemPrompt: fingerprint(input.systemPrompt || ''),
+    agentConfig: fingerprint(JSON.stringify(input.agentConfig || null)),
     origin: fingerprint(JSON.stringify(input.origin || null)),
     mcpServers: fingerprint(JSON.stringify(mcpServers)),
   };
@@ -350,6 +352,17 @@ function createContract(payload, options = {}) {
   const localBaseUrl = options.localBaseUrl || `http://127.0.0.1:${options.port || runtimePort('chat-server')}`;
   const origin = normalizeOrigin({ ...payload, cwd });
   const userId = payload.userId || options.userId || 'unknown-user';
+  const payloadChatAgent = payload.chatInput && typeof payload.chatInput === 'object' && !Array.isArray(payload.chatInput)
+    ? payload.chatInput.agent
+    : null;
+  const agentConfigId = nullableString(
+    payload.agentConfigId
+    || payload.amalgmAgentId
+    || payload.agentConfig?.agentId
+    || payloadChatAgent?.customAgentId,
+  ) || harness;
+  const agentConfig = normalizeAgentConfig(payload.agentConfig || { agentId: agentConfigId });
+  const runtimeHomeLayout = agentConfig.runtimeHomeLayout === 'per-agent' ? 'per-agent' : 'legacy';
   const auth = authEnvelope({
     harness,
     authMethod,
@@ -361,6 +374,8 @@ function createContract(payload, options = {}) {
     userId,
     credentialId: payload.credentialId || payload.byokCredentialId || null,
     modelId,
+    agentConfigId,
+    runtimeHomeLayout,
   });
   const contract = {
     sessionId,
@@ -369,6 +384,9 @@ function createContract(payload, options = {}) {
     assistantMessageId,
     userMessageId: payload.userMessageId || null,
     agentId: payload.agentId || (harness === 'claude_code' ? 'claude' : harness),
+    agentConfigId,
+    agentConfig,
+    runtimeHomeLayout,
     harness,
     authMethod: auth.method,
     modelId,

package/runtime/scripts/chat-core/tests/auth.test.js

@@ -7,7 +7,7 @@ const path = require('node:path');
 const test = require('node:test');
 const { authEnvelope, runtimeEnv } = require('../auth');
 
-test('codex always uses one canonical CLI home across auth methods and token refreshes', () => {
+test('codex keeps legacy CLI home unless per-agent layout is explicit', () => {
   const amalgmDir = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-auth-test-'));
   fs.writeFileSync(path.join(amalgmDir, '.amalgm-credentials'), 'OPENAI_API_KEY=sk-test\n');
   try {
@@ -38,11 +38,36 @@ test('codex always uses one canonical CLI home across auth methods and token ref
       amalgmDir,
       userId: 'user-123',
     });
-
+    const otherAgent = authEnvelope({
+      harness: 'codex',
+      authMethod: 'provider_auth',
+      sessionId: 'session-four',
+      proxyToken: 'proxy-token-two',
+      localBaseUrl: 'http://127.0.0.1:8084',
+      proxyBaseUrl: 'https://proxy.example.test',
+      amalgmDir,
+      userId: 'user-123',
+      agentConfigId: 'agent-two',
+    });
+    const perAgent = authEnvelope({
+      harness: 'codex',
+      authMethod: 'provider_auth',
+      sessionId: 'session-five',
+      proxyToken: 'proxy-token-three',
+      localBaseUrl: 'http://127.0.0.1:8084',
+      proxyBaseUrl: 'https://proxy.example.test',
+      amalgmDir,
+      userId: 'user-123',
+      agentConfigId: 'agent-two',
+      runtimeHomeLayout: 'per-agent',
+    });
     assert.notEqual(first.tokenFingerprint, second.tokenFingerprint);
     assert.equal(first.runtimeHome, second.runtimeHome);
     assert.equal(second.runtimeHome, third.runtimeHome);
     assert.equal(first.runtimeHome, path.join(amalgmDir, 'cli-homes', 'codex', 'home'));
+    assert.equal(otherAgent.runtimeHome, first.runtimeHome);
+    assert.equal(perAgent.runtimeHome, path.join(amalgmDir, 'cli-homes', 'codex', 'agents', 'agent-two', 'home'));
+    assert.notEqual(first.runtimeHome, perAgent.runtimeHome);
   } finally {
     fs.rmSync(amalgmDir, { recursive: true, force: true });
   }

package/runtime/scripts/chat-core/tests/native-config.test.js

@@ -68,12 +68,13 @@ test('codex native sync copies config without deleting existing runtime state',
   });
 });
 
-test('prepared codex runtime uses managed home while importing native config', () => {
+test('prepared codex runtime imports provider auth without native config prefs', () => {
   withNativeHome((home) => {
     const source = path.join(home, '.codex');
     fs.mkdirSync(source, { recursive: true });
     fs.writeFileSync(path.join(source, 'config.toml'), 'model = "gpt-5.5"');
     fs.writeFileSync(path.join(source, 'hooks.json'), '{"hooks":{}}');
+    fs.writeFileSync(path.join(source, 'auth.json'), '{"auth_mode":"chatgpt"}');
 
     const runtimeHome = path.join(home, 'managed', 'codex-home');
     const prepared = prepareHarnessRuntime({
@@ -86,9 +87,12 @@ test('prepared codex runtime uses managed home while importing native config', (
     assert.equal(prepared.env.HOME, runtimeHome);
     assert.equal(prepared.env.CODEX_HOME, runtimeHome);
     assert.equal(prepared.syncInfo.runtimeHome, runtimeHome);
-    assert.equal(fs.existsSync(path.join(runtimeHome, 'config.toml')), true);
-    assert.equal(fs.existsSync(path.join(runtimeHome, 'hooks.json')), true);
-    assert.equal(fs.existsSync(path.join(runtimeHome, '.codex', 'config.toml')), true);
+    assert.equal(prepared.syncInfo.authOnly, true);
+    assert.equal(fs.existsSync(path.join(runtimeHome, 'auth.json')), true);
+    assert.equal(fs.existsSync(path.join(runtimeHome, '.codex', 'auth.json')), true);
+    assert.equal(fs.existsSync(path.join(runtimeHome, 'config.toml')), false);
+    assert.equal(fs.existsSync(path.join(runtimeHome, 'hooks.json')), false);
+    assert.equal(fs.existsSync(path.join(runtimeHome, '.codex', 'config.toml')), false);
   });
 });
 
@@ -109,7 +113,7 @@ test('prepared opencode runtime always has an isolated managed home', () => {
   });
 });
 
-test('provider auth imports opencode native config into managed home', () => {
+test('provider auth imports opencode auth without native config prefs', () => {
   withNativeHome((home) => {
     const configDir = path.join(home, '.config', 'opencode');
     const dataDir = path.join(home, '.local', 'share', 'opencode');
@@ -129,7 +133,8 @@ test('provider auth imports opencode native config into managed home', () => {
     assert.equal(prepared.env.HOME, runtimeHome);
     assert.equal(prepared.env.OPENCODE_HOME, runtimeHome);
     assert.equal(prepared.env.XDG_CONFIG_HOME, path.join(runtimeHome, '.config'));
-    assert.equal(fs.existsSync(path.join(runtimeHome, '.config', 'opencode', 'opencode.json')), true);
+    assert.equal(prepared.syncInfo.authOnly, true);
+    assert.equal(fs.existsSync(path.join(runtimeHome, '.config', 'opencode', 'opencode.json')), false);
     assert.equal(fs.existsSync(path.join(runtimeHome, '.local', 'share', 'opencode', 'auth.json')), true);
   });
 });
@@ -153,7 +158,7 @@ test('non-user auth prepares a home without importing native config', () => {
   });
 });
 
-test('codex provider config keeps native mcp config and overrides managed model provider', () => {
+test('codex provider config ignores native prefs and renders agent hooks', () => {
   withNativeHome((home) => {
     const source = path.join(home, '.codex');
     fs.mkdirSync(source, { recursive: true });
@@ -178,6 +183,15 @@ test('codex provider config keeps native mcp config and overrides managed model
     codexPrivate.writeConfig({
       authMethod: 'provider_auth',
       auth: { runtimeHome },
+      agentConfig: {
+        agentId: 'agent-test',
+        hooks: [{
+          type: 'command',
+          event: 'UserPromptSubmit',
+          command: 'echo managed',
+          timeout: 1,
+        }],
+      },
       mcpServers: [],
     });
 
@@ -185,10 +199,12 @@ test('codex provider config keeps native mcp config and overrides managed model
     assert.match(config, /model_provider = "openai"/);
     assert.match(config, /codex_hooks = true/);
     assert.doesNotMatch(config, /native-provider/);
-    assert.match(config, /\[mcp_servers\.native\]/);
-    assert.match(config, /\[mcp_servers\.native\.http_headers\]/);
-    assert.match(config, /Authorization = "Bearer test"/);
+    assert.doesNotMatch(config, /\[mcp_servers\.native\]/);
+    assert.doesNotMatch(config, /\[mcp_servers\.native\.http_headers\]/);
+    assert.doesNotMatch(config, /Authorization = "Bearer test"/);
     assert.equal(config.includes(path.join(runtimeHome, 'hooks.json')), true);
+    const hooks = fs.readFileSync(path.join(runtimeHome, 'hooks.json'), 'utf8');
+    assert.match(hooks, /echo managed/);
   });
 });
 
@@ -229,7 +245,35 @@ test('codex amalgm config does not import native user config', () => {
   });
 });
 
-test('claude extracts native hooks without enabling full filesystem settings', () => {
+test('codex amalgm config overwrites stale real dot-codex auth files', () => {
+  withNativeHome((home) => {
+    const runtimeHome = path.join(home, 'runtime-home');
+    fs.mkdirSync(path.join(runtimeHome, '.codex'), { recursive: true });
+    fs.writeFileSync(path.join(runtimeHome, '.codex', 'auth.json'), JSON.stringify({
+      auth_mode: 'chatgpt',
+      account: { email: 'user@example.test' },
+    }));
+    fs.writeFileSync(path.join(runtimeHome, '.codex', 'config.toml'), 'model_provider = "openai"\n');
+
+    codexPrivate.writeConfig({
+      authMethod: 'amalgm',
+      auth: { runtimeHome, baseUrl: 'https://amalgm.example/v1', tokenRef: 'test-token' },
+      mcpServers: [],
+    });
+
+    for (const configDir of [runtimeHome, path.join(runtimeHome, '.codex')]) {
+      const auth = JSON.parse(fs.readFileSync(path.join(configDir, 'auth.json'), 'utf8'));
+      const config = fs.readFileSync(path.join(configDir, 'config.toml'), 'utf8');
+      assert.equal(auth.auth_mode, 'apikey');
+      assert.equal(auth.OPENAI_API_KEY, 'test-token');
+      assert.match(config, /model_provider = "amalgm"/);
+      assert.match(config, /requires_openai_auth = false/);
+      assert.doesNotMatch(config, /model_provider = "openai"/);
+    }
+  });
+});
+
+test('claude renders agent hooks without importing native permission settings', () => {
   withNativeHome((home) => {
     const source = path.join(home, '.claude');
     fs.mkdirSync(source, { recursive: true });
@@ -254,12 +298,21 @@ test('claude extracts native hooks without enabling full filesystem settings', (
       auth: { runtimeHome },
       cwd: home,
       cliModel: 'anthropic/claude-opus-4.8',
+      agentConfig: {
+        agentId: 'agent-test',
+        hooks: [{
+          type: 'command',
+          event: 'UserPromptSubmit',
+          command: 'echo managed',
+          timeout: 1,
+        }],
+      },
       mcpServers: [],
     });
 
     assert.deepEqual(options.settingSources, []);
     assert.equal(options.settings.permissions, undefined);
-    assert.equal(options.settings.hooks.UserPromptSubmit[0].hooks[0].command, 'echo recall');
+    assert.equal(options.settings.hooks.UserPromptSubmit[0].hooks[0].command, 'echo managed');
   });
 });