amalgm 0.1.82 → 0.1.83

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.82",
+  "version": "0.1.83",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,

package/runtime/scripts/chat-core/adapters/codex.js

@@ -242,9 +242,16 @@ function codexConfigDirs(home) {
   });
 }
 
-function writeCodexHomeFile(home, filename, contents, mode = 0o600) {
+function unlinkSymlinkIfPresent(target) {
+  try {
+    if (fs.lstatSync(target).isSymbolicLink()) fs.unlinkSync(target);
+  } catch {}
+}
+
+function writeCodexHomeFile(home, filename, contents, mode = 0o600, options = {}) {
   for (const dir of codexConfigDirs(home)) {
     const target = path.join(dir, filename);
+    if (options.unlinkSymlink) unlinkSymlinkIfPresent(target);
     fs.writeFileSync(target, contents, { mode });
     try { fs.chmodSync(target, mode); } catch {}
   }
@@ -441,10 +448,6 @@ function writeConfig(contract, syncInfo) {
     writeCodexHomeFile(home, 'hooks.json', toCodexHooksJson(contract.agentConfig), 0o600);
   }
   if (contract.authMethod === 'provider_auth') {
-    const sourceAuth = path.join(syncInfo?.sourceDir || path.join(os.homedir(), '.codex'), 'auth.json');
-    if (fs.existsSync(sourceAuth)) {
-      writeCodexHomeFile(home, 'auth.json', fs.readFileSync(sourceAuth), 0o600);
-    }
     writeCodexHomeFile(home, 'config.toml', buildCodexConfig(contract, nativeConfig, syncInfo), 0o600);
     return;
   }
@@ -452,7 +455,7 @@ function writeConfig(contract, syncInfo) {
   writeCodexHomeFile(home, 'auth.json', JSON.stringify({
     auth_mode: 'apikey',
     OPENAI_API_KEY: contract.auth.tokenRef,
-  }, null, 2), 0o600);
+  }, null, 2), 0o600, { unlinkSymlink: true });
 }
 
 class CodexAdapter {

package/runtime/scripts/chat-core/tests/native-config.test.js

@@ -11,6 +11,7 @@ const {
   claudeNativeHookSettings,
   syncClaudeNativeConfig,
   syncCodexNativeConfig,
+  syncCodexProviderAuth,
   syncOpenCodeNativeConfig,
 } = require('../tooling/native-config');
 const { prepareHarnessRuntime } = require('../tooling/runtime-home');
@@ -32,6 +33,12 @@ function withNativeHome(fn) {
   }
 }
 
+function sameFile(a, b) {
+  const left = fs.statSync(a);
+  const right = fs.statSync(b);
+  return left.dev === right.dev && left.ino === right.ino;
+}
+
 test('codex native sync copies config without deleting existing runtime state', () => {
   withNativeHome((home) => {
     const source = path.join(home, '.codex');
@@ -42,6 +49,7 @@ test('codex native sync copies config without deleting existing runtime state',
     fs.writeFileSync(path.join(source, 'config.toml'), 'model = "gpt-5.5"');
     fs.writeFileSync(path.join(source, 'preferences.json'), '{"theme":"dark"}');
     fs.writeFileSync(path.join(source, 'hooks.json'), '{"hooks":{}}');
+    fs.writeFileSync(path.join(source, 'auth.json'), '{"auth_mode":"chatgpt"}');
     fs.writeFileSync(path.join(source, 'supermemory.json'), '{"projectContainerTag":"test"}');
     fs.writeFileSync(path.join(source, 'supermemory', 'recall.js'), 'console.log("recall")');
     fs.writeFileSync(path.join(source, 'sessions', 'huge.jsonl'), 'nope');
@@ -65,6 +73,9 @@ test('codex native sync copies config without deleting existing runtime state',
     assert.equal(fs.existsSync(path.join(runtimeHome, 'worktrees')), false);
     assert.equal(fs.existsSync(path.join(runtimeHome, 'plugins')), false);
     assert.equal(fs.existsSync(path.join(runtimeHome, '.codex', 'hooks.json')), true);
+    assert.equal(result.linkedAuth, true);
+    assert.equal(sameFile(path.join(source, 'auth.json'), path.join(runtimeHome, 'auth.json')), true);
+    assert.equal(sameFile(path.join(source, 'auth.json'), path.join(runtimeHome, '.codex', 'auth.json')), true);
   });
 });
 
@@ -88,8 +99,12 @@ test('prepared codex runtime imports provider auth without native config prefs',
     assert.equal(prepared.env.CODEX_HOME, runtimeHome);
     assert.equal(prepared.syncInfo.runtimeHome, runtimeHome);
     assert.equal(prepared.syncInfo.authOnly, true);
+    assert.equal(prepared.syncInfo.linkedAuth, true);
+    assert.equal(prepared.syncInfo.copied, false);
     assert.equal(fs.existsSync(path.join(runtimeHome, 'auth.json')), true);
     assert.equal(fs.existsSync(path.join(runtimeHome, '.codex', 'auth.json')), true);
+    assert.equal(sameFile(path.join(source, 'auth.json'), path.join(runtimeHome, 'auth.json')), true);
+    assert.equal(sameFile(path.join(source, 'auth.json'), path.join(runtimeHome, '.codex', 'auth.json')), true);
     assert.equal(fs.existsSync(path.join(runtimeHome, 'config.toml')), false);
     assert.equal(fs.existsSync(path.join(runtimeHome, 'hooks.json')), false);
     assert.equal(fs.existsSync(path.join(runtimeHome, '.codex', 'config.toml')), false);
@@ -205,6 +220,7 @@ test('codex provider config ignores native prefs and renders agent hooks', () =>
     assert.equal(config.includes(path.join(runtimeHome, 'hooks.json')), true);
     const hooks = fs.readFileSync(path.join(runtimeHome, 'hooks.json'), 'utf8');
     assert.match(hooks, /echo managed/);
+    assert.equal(sameFile(path.join(source, 'auth.json'), path.join(runtimeHome, 'auth.json')), true);
   });
 });
 
@@ -273,6 +289,36 @@ test('codex amalgm config overwrites stale real dot-codex auth files', () => {
   });
 });
 
+test('codex amalgm config breaks provider auth link before writing managed auth', () => {
+  withNativeHome((home) => {
+    const source = path.join(home, '.codex');
+    fs.mkdirSync(source, { recursive: true });
+    fs.writeFileSync(path.join(source, 'auth.json'), JSON.stringify({
+      auth_mode: 'chatgpt',
+      tokens: { refresh_token: 'native-refresh' },
+    }));
+
+    const runtimeHome = path.join(home, 'runtime-home');
+    const syncInfo = syncCodexProviderAuth(runtimeHome);
+    assert.equal(syncInfo.linkedAuth, true);
+    assert.equal(sameFile(path.join(source, 'auth.json'), path.join(runtimeHome, 'auth.json')), true);
+
+    codexPrivate.writeConfig({
+      authMethod: 'amalgm',
+      auth: { runtimeHome, baseUrl: 'https://amalgm.example/v1', tokenRef: 'test-token' },
+      mcpServers: [],
+    });
+
+    const nativeAuth = JSON.parse(fs.readFileSync(path.join(source, 'auth.json'), 'utf8'));
+    const runtimeAuth = JSON.parse(fs.readFileSync(path.join(runtimeHome, 'auth.json'), 'utf8'));
+    assert.equal(nativeAuth.auth_mode, 'chatgpt');
+    assert.equal(nativeAuth.tokens.refresh_token, 'native-refresh');
+    assert.equal(runtimeAuth.auth_mode, 'apikey');
+    assert.equal(runtimeAuth.OPENAI_API_KEY, 'test-token');
+    assert.equal(sameFile(path.join(source, 'auth.json'), path.join(runtimeHome, 'auth.json')), false);
+  });
+});
+
 test('claude renders agent hooks without importing native permission settings', () => {
   withNativeHome((home) => {
     const source = path.join(home, '.claude');

package/runtime/scripts/chat-core/tooling/native-config.js

@@ -54,6 +54,16 @@ function shouldCopyConfigPath(root, source) {
   return !EXCLUDED_FILE_PATTERNS.some((pattern) => pattern.test(basename));
 }
 
+function sameFile(a, b) {
+  try {
+    const left = fs.statSync(a);
+    const right = fs.statSync(b);
+    return left.dev === right.dev && left.ino === right.ino;
+  } catch {
+    return false;
+  }
+}
+
 function copyConfigTree(sourceDir, targetDir) {
   if (!sourceDir || !targetDir || !exists(sourceDir)) return false;
   if (path.resolve(sourceDir) === path.resolve(targetDir)) return true;
@@ -63,6 +73,7 @@ function copyConfigTree(sourceDir, targetDir) {
 function copyFileIfPresent(source, target) {
   if (!exists(source)) return false;
   if (!ensureDirectory(path.dirname(target)) || !canWriteFileTarget(target)) return false;
+  unlinkSymlinkIfPresent(target);
   fs.copyFileSync(source, target);
   try {
     fs.chmodSync(target, fs.statSync(source).mode & 0o777);
@@ -70,6 +81,33 @@ function copyFileIfPresent(source, target) {
   return true;
 }
 
+function unlinkSymlinkIfPresent(target) {
+  try {
+    if (fs.lstatSync(target).isSymbolicLink()) fs.unlinkSync(target);
+  } catch {}
+}
+
+function linkFileIfPresent(source, target) {
+  if (!exists(source)) return false;
+  if (!ensureDirectory(path.dirname(target))) return false;
+  if (sameFile(source, target)) return true;
+  try {
+    const stat = fs.lstatSync(target);
+    if (stat.isDirectory()) return false;
+    fs.unlinkSync(target);
+  } catch {}
+  try {
+    fs.symlinkSync(source, target, 'file');
+    return true;
+  } catch {}
+  try {
+    fs.linkSync(source, target);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 function ensureHomeAlias(runtimeHome, dotDirName) {
   if (!runtimeHome || !dotDirName) return;
   const alias = path.join(runtimeHome, dotDirName);
@@ -141,10 +179,13 @@ function copyDirBounded(sourceDir, targetDir, options = {}) {
   if (!sourceDir || !targetDir || !exists(sourceDir)) return { copied: false, files: 0, bytes: 0, truncated: false };
   const maxFiles = Number(options.maxFiles || 200);
   const maxBytes = Number(options.maxBytes || 10 * 1024 * 1024);
+  const skipRelatives = new Set(Array.isArray(options.skipRelatives) ? options.skipRelatives : []);
   const state = { copied: false, files: 0, bytes: 0, truncated: false };
   const root = path.resolve(sourceDir);
 
   function walk(source, target) {
+    const relative = path.relative(root, source);
+    if (relative && skipRelatives.has(relative)) return;
     if (state.truncated || !shouldCopyConfigPath(root, source)) return;
     let stat;
     try {
@@ -180,26 +221,29 @@ function copyDirBounded(sourceDir, targetDir, options = {}) {
 function syncCodexNativeConfig(runtimeHome) {
   if (!runtimeHome) return null;
   const sourceDir = path.join(nativeHome(), '.codex');
+  const sourceAuth = path.join(sourceDir, 'auth.json');
   fs.mkdirSync(runtimeHome, { recursive: true });
   if (!exists(sourceDir)) return null;
 
-  const nativeConfig = copyDirBounded(sourceDir, runtimeHome);
+  const nativeConfig = copyDirBounded(sourceDir, runtimeHome, { skipRelatives: ['auth.json'] });
   const copiedFiles = [
     copyFileIfPresent(path.join(sourceDir, 'config.toml'), path.join(runtimeHome, 'config.toml')),
-    copyFileIfPresent(path.join(sourceDir, 'auth.json'), path.join(runtimeHome, 'auth.json')),
     copyFileIfPresent(path.join(sourceDir, 'hooks.json'), path.join(runtimeHome, 'hooks.json')),
     copyFileIfPresent(path.join(sourceDir, 'supermemory.json'), path.join(runtimeHome, 'supermemory.json')),
   ].filter(Boolean).length;
   const supermemory = copyDirBounded(path.join(sourceDir, 'supermemory'), path.join(runtimeHome, 'supermemory'));
   copyDirBounded(path.join(nativeHome(), '.codex-supermemory'), path.join(runtimeHome, '.codex-supermemory'));
   ensureHomeAlias(runtimeHome, '.codex');
+  const linkedAuth = linkFileIfPresent(sourceAuth, path.join(runtimeHome, 'auth.json'));
+  linkFileIfPresent(sourceAuth, path.join(runtimeHome, '.codex', 'auth.json'));
 
   return {
     sourceDir,
     runtimeHome,
     sourceConfigPath: path.join(sourceDir, 'config.toml'),
-    copied: nativeConfig.copied || copiedFiles + (supermemory.copied ? 1 : 0) > 0,
+    copied: nativeConfig.copied || copiedFiles + (supermemory.copied ? 1 : 0) > 0 || linkedAuth,
     truncated: nativeConfig.truncated || supermemory.truncated,
+    linkedAuth,
   };
 }
 
@@ -255,11 +299,12 @@ function copyJsonSubsetIfPresent(source, target, keys) {
 function syncCodexProviderAuth(runtimeHome) {
   if (!runtimeHome) return null;
   const sourceDir = path.join(nativeHome(), '.codex');
+  const sourceAuth = path.join(sourceDir, 'auth.json');
   fs.mkdirSync(runtimeHome, { recursive: true });
   ensureHomeAlias(runtimeHome, '.codex');
-  const copied = copyFileIfPresent(path.join(sourceDir, 'auth.json'), path.join(runtimeHome, 'auth.json'));
-  if (copied) copyFileIfPresent(path.join(sourceDir, 'auth.json'), path.join(runtimeHome, '.codex', 'auth.json'));
-  return copied ? { sourceDir, runtimeHome, copied: true, authOnly: true } : null;
+  const linked = linkFileIfPresent(sourceAuth, path.join(runtimeHome, 'auth.json'));
+  if (linked) linkFileIfPresent(sourceAuth, path.join(runtimeHome, '.codex', 'auth.json'));
+  return linked ? { sourceDir, runtimeHome, copied: false, linkedAuth: true, authOnly: true } : null;
 }
 
 function syncClaudeProviderAuth(runtimeHome) {
@@ -367,7 +412,9 @@ module.exports = {
     ensureDirectory,
     ensureNativeKeychainAlias,
     ensureHomeAlias,
+    linkFileIfPresent,
     shouldCopyConfigPath,
+    unlinkSymlinkIfPresent,
   },
   claudeNativeHookSettings,
   syncClaudeProviderAuth,