amalgm 0.1.86 → 0.1.87

package/runtime/scripts/amalgm-mcp/automations/tools.js

@@ -91,6 +91,7 @@ function summarizeAutomation(automation) {
     workflowIds: automation.workflowIds,
     triggers: automation.triggers.map(summarizeTrigger),
     workflow: summarizeWorkflow(automation.workflow || automation.workflows?.[0]),
+    workflows: (automation.workflows || []).map(summarizeWorkflow),
     updatedAt: automation.updatedAt,
   };
 }
@@ -214,7 +215,7 @@ module.exports = [
   {
     name: 'automations_create',
     description:
-      'Create a local Automation. An automation is one or more triggers plus one workflow. It is stored on the user computer in the Local Live SQLite store and runs locally. Scheduled/event triggers do not wake an agent unless the workflow explicitly calls an agent/tool.',
+      'Create a local Automation. An automation is one or more triggers plus one or more workflows; every trigger firing runs each enabled workflow and records one run per workflow. It is stored on the user computer in the Local Live SQLite store and runs locally. Scheduled/event triggers do not wake an agent unless a workflow explicitly calls an agent/tool.',
     inputSchema: {
       type: 'object',
       properties: {
@@ -252,6 +253,27 @@ module.exports = [
         },
         workflowText: { type: 'string', description: WORKFLOW_DESCRIPTION },
         workflow: { type: 'string', description: 'Alias for workflowText.' },
+        workflows: {
+          type: 'array',
+          description: 'Multiple workflows for this automation. Each item is a workflow script string or `{ name, workflowText, enabled, allowlist, limits }`. Every trigger firing runs each enabled workflow in order and records one run per workflow. Use this OR workflowText, not both.',
+          items: {
+            anyOf: [
+              { type: 'string', description: WORKFLOW_DESCRIPTION },
+              {
+                type: 'object',
+                properties: {
+                  id: { type: 'string', description: 'Optional stable workflow id.' },
+                  name: { type: 'string' },
+                  description: { type: 'string' },
+                  enabled: { type: 'boolean' },
+                  workflowText: { type: 'string', description: WORKFLOW_DESCRIPTION },
+                  allowlist: { type: 'object' },
+                  limits: { type: 'object' },
+                },
+              },
+            ],
+          },
+        },
         allowlist: { type: 'object', description: 'Workflow permissions: localCompute, network, secrets, actions.' },
         limits: { type: 'object', description: 'Workflow limits: maxConcurrentRuns, queueLimit, cellTimeoutMs, codeTimeoutMs.' },
         verbose: { type: 'boolean', description: 'Set false for a concise response with ids, status, triggers, webhook URL/secret, and workflow summary. Defaults to true.' },
@@ -260,13 +282,14 @@ module.exports = [
     },
     async handler(input = {}) {
       try {
-        const workflowText = input.workflowText || input.workflow;
-        if (typeof workflowText !== 'string' || !workflowText.trim()) {
-          return errorResult('workflowText or workflow is required.');
+        const workflowText = input.workflowText || (typeof input.workflow === 'string' ? input.workflow : undefined);
+        const hasWorkflowsArray = Array.isArray(input.workflows) && input.workflows.length > 0;
+        if (!hasWorkflowsArray && (typeof workflowText !== 'string' || !workflowText.trim())) {
+          return errorResult('workflowText, workflow, or workflows is required.');
         }
         const automation = createAutomation({
           ...input,
-          workflowText,
+          ...(workflowText ? { workflowText } : {}),
         }, { source: 'automations_create' });
         return textResult(`Automation created.\n\n${JSON.stringify(automationResponse(automation, {
           verbose: input.verbose !== false,
@@ -333,7 +356,7 @@ module.exports = [
   {
     name: 'automations_update',
     description:
-      'Update a local automation. You can edit metadata, enabled state, replace triggers, or update the workflow source/allowlist/limits. The next trigger firing uses the updated workflow.',
+      'Update a local automation. You can edit metadata, enabled state, replace triggers, update the primary workflow source/allowlist/limits, or replace the full workflows array. Existing triggers and workflows are matched by id (then fingerprint/position) so webhook secrets, schedule clocks, and run-history linkage are preserved. The next trigger firing uses the updated workflows.',
     inputSchema: {
       type: 'object',
       properties: {
@@ -343,8 +366,29 @@ module.exports = [
         enabled: { type: 'boolean' },
         projectPath: { type: 'string' },
         triggers: { type: 'array', description: TRIGGER_DESCRIPTION },
-        workflowText: { type: 'string', description: WORKFLOW_DESCRIPTION },
+        workflowText: { type: 'string', description: `${WORKFLOW_DESCRIPTION}\n\nApplies to the primary (first) workflow.` },
         workflow: { type: 'string', description: 'Alias for workflowText.' },
+        workflows: {
+          type: 'array',
+          description: 'Replace the full ordered workflows array. Items are workflow script strings or `{ id, name, workflowText, enabled, allowlist, limits }`; include ids from automations_get to update workflows in place rather than recreating them.',
+          items: {
+            anyOf: [
+              { type: 'string' },
+              {
+                type: 'object',
+                properties: {
+                  id: { type: 'string' },
+                  name: { type: 'string' },
+                  description: { type: 'string' },
+                  enabled: { type: 'boolean' },
+                  workflowText: { type: 'string' },
+                  allowlist: { type: 'object' },
+                  limits: { type: 'object' },
+                },
+              },
+            ],
+          },
+        },
         allowlist: { type: 'object' },
         limits: { type: 'object' },
         verbose: { type: 'boolean', description: 'Set false for a concise response. Defaults to true.' },
@@ -397,7 +441,7 @@ module.exports = [
     },
     async handler({ automation_id, trigger_id, payload, verbose } = {}) {
       try {
-        const run = await executeAutomationById(automation_id, {
+        const runs = await executeAutomationById(automation_id, {
           id: `manual:${Date.now()}`,
           source: 'amalgm.manual',
           event: 'run_now',
@@ -405,8 +449,9 @@ module.exports = [
           headers: {},
           receivedAt: new Date().toISOString(),
         }, { triggerId: trigger_id });
-        return textResult(`Automation run started.\n\n${JSON.stringify(
-          verbose === false ? summarizeRun(run) : run,
+        const payloadOut = verbose === false ? runs.map(summarizeRun) : runs;
+        return textResult(`Automation ran ${runs.length} workflow${runs.length === 1 ? '' : 's'}.\n\n${JSON.stringify(
+          runs.length === 1 ? payloadOut[0] : payloadOut,
           null,
           2,
         )}`);

package/runtime/scripts/amalgm-mcp/events/ingress.js

@@ -10,13 +10,24 @@ const {
   extractSignature,
   matchAllBySignature,
   matchBySignature,
+  matchesEventRef,
   pickSourceLabel,
   collectPassthroughHeaders,
 } = require('./matcher');
-const { listEventTriggersForIngress, markTriggerFired } = require('../automations/store');
+const { listEventTriggersForIngress, markTriggerFired, recordAutomationRun } = require('../automations/store');
 const { executeAutomationForTrigger } = require('../automations/runner');
 const ring = require('./ring-buffer');
 
+/**
+ * Sanitize a sender-declared source/event ref part.
+ */
+function cleanRefPart(value) {
+  if (typeof value !== 'string') return '';
+  const trimmed = value.trim();
+  if (!trimmed || trimmed.length > 128) return '';
+  return trimmed;
+}
+
 /**
  * Read the raw request body as a string.
  */
@@ -30,6 +41,42 @@ async function readRawBody(req) {
   });
 }
 
+function dayStamp(date = new Date()) {
+  return date.toISOString().slice(0, 10).replace(/-/g, '');
+}
+
+/**
+ * Record an authenticated-but-unmatched delivery as a small terminal
+ * 'unmatched' run on each authenticated automation. The run id is
+ * deterministic per automation + ref + day, so repeated deliveries of the
+ * same unmatched ref refresh ONE row (its events array logs each receipt)
+ * instead of spamming run history and the live event stream — a sender
+ * holding one secret cannot flood the store with junk refs.
+ */
+function recordUnmatchedEventRuns(authenticated, eventSource, eventName, timestamp) {
+  const refSlug = `${eventSource}.${eventName}`.toLowerCase().replace(/[^a-z0-9._-]+/g, '_').slice(0, 80);
+  const seenAutomations = new Set();
+  for (const trigger of authenticated) {
+    if (!trigger.automationId || seenAutomations.has(trigger.automationId)) continue;
+    seenAutomations.add(trigger.automationId);
+    try {
+      recordAutomationRun(trigger.automationId, {
+        runId: `unmatched-${trigger.automationId}-${refSlug}-${dayStamp()}`,
+        automationId: trigger.automationId,
+        triggerId: trigger.id,
+        triggerName: trigger.name,
+        status: 'unmatched',
+        startedAt: timestamp,
+        finishedAt: timestamp,
+        output: { received: { source: eventSource, event: eventName, receivedAt: timestamp } },
+        error: `Received ${eventSource}.${eventName} — authenticated, but no trigger selector matched (trigger "${trigger.name}" wants ${trigger.source || '*'}.${trigger.event || '*'}).`,
+      }, { source: 'automation_runs:event-unmatched' });
+    } catch (error) {
+      console.warn('[AmalgmMCP:Events] Failed to record unmatched event run:', error.message || error);
+    }
+  }
+}
+
 /**
  * Handle a POST /events request. Assumes CORS + method checking has already
  * happened. Writes the response via `sendJson`.
@@ -47,12 +94,49 @@ async function handleEventsPost(req, sendJson) {
 
   const triggers = listEventTriggersForIngress();
   const githubEvent = req.headers['x-github-event'];
-  const eventSource = pickSourceLabel(req.headers);
-  const eventName =
+
+  let parsedBody;
+  try {
+    parsedBody = JSON.parse(rawBody);
+  } catch {
+    parsedBody = rawBody;
+  }
+
+  // Vendor webhooks (GitHub/Stripe/Linear/GitLab) get their ref from vendor
+  // headers. Generic senders carry no vendor headers, so let them declare
+  // their own ref via x-amalgm-source/x-amalgm-event headers or body
+  // source/event fields — otherwise custom refs like "audit.ping" are
+  // permanently unmatchable. This is safe to read before matching: a sender
+  // still only matches triggers whose per-trigger secret verifies its proof
+  // (HMAC binds the body bytes; token compare authenticates the sender).
+  const vendorSource = pickSourceLabel(req.headers);
+  const vendorEvent =
     githubEvent ||
     req.headers['x-linear-event'] ||
     req.headers['x-gitlab-event'] ||
-    'webhook';
+    null;
+  let eventSource = vendorSource;
+  let eventName = vendorEvent || 'webhook';
+  let fallbackRef = null;
+  if (vendorSource === 'external' && !vendorEvent) {
+    const headerSource = cleanRefPart(req.headers['x-amalgm-source']);
+    const headerEvent = cleanRefPart(req.headers['x-amalgm-event']);
+    const bodySource = cleanRefPart(typeof parsedBody === 'object' ? parsedBody?.source : null);
+    const bodyEvent = cleanRefPart(typeof parsedBody === 'object' ? parsedBody?.event : null);
+    if (headerSource || headerEvent) {
+      // Explicit x-amalgm-* headers are an unambiguous declaration.
+      eventSource = headerSource || 'external';
+      eventName = headerEvent || 'webhook';
+    } else if (bodySource || bodyEvent) {
+      // Body source/event are often incidental keys in third-party payloads
+      // (e.g. {"event": "user.signup"}). Use them as the primary ref, but
+      // keep the legacy external.webhook ref as a matching fallback so
+      // pre-existing generic triggers pinned to it keep firing.
+      eventSource = bodySource || 'external';
+      eventName = bodyEvent || 'webhook';
+      fallbackRef = { source: 'external', event: 'webhook' };
+    }
+  }
 
   // GitHub webhook handshake: acknowledge verified ping events immediately.
   if (githubEvent === 'ping') {
@@ -65,29 +149,27 @@ async function handleEventsPost(req, sendJson) {
     return sendJson(200, { ok: true, message: 'pong' });
   }
 
-  const matchedTriggers = matchAllBySignature(
-    triggers,
-    signature,
-    rawBody,
-    { source: eventSource, event: eventName },
-  );
-  if (!matchedTriggers?.length) {
-    console.warn(`[AmalgmMCP:Events] No trigger matched ${eventSource}.${eventName}`);
-    return sendJson(401, { error: 'Invalid webhook signature or source/event — no matching trigger' });
+  // Authenticate first, then filter by source/event, so a bad secret (401)
+  // is distinguishable from a valid-but-unmatched ref (202). Vendors treat
+  // 401 as delivery failure and may auto-disable the webhook.
+  const authenticated = matchAllBySignature(triggers, signature, rawBody);
+  if (!authenticated?.length) {
+    console.warn('[AmalgmMCP:Events] Webhook signature did not verify against any trigger');
+    return sendJson(401, { error: 'Invalid webhook signature' });
   }
 
-  const eventHeaders = collectPassthroughHeaders(req.headers);
-
-  let parsedBody;
-  try {
-    parsedBody = JSON.parse(rawBody);
-  } catch {
-    parsedBody = rawBody;
+  let matchedTriggers = authenticated.filter((trigger) => (
+    matchesEventRef(trigger, { source: eventSource, event: eventName })
+  ));
+  if (!matchedTriggers.length && fallbackRef) {
+    const fallbackMatches = authenticated.filter((trigger) => matchesEventRef(trigger, fallbackRef));
+    if (fallbackMatches.length > 0) {
+      eventSource = fallbackRef.source;
+      eventName = fallbackRef.event;
+      matchedTriggers = fallbackMatches;
+    }
   }
-
-  console.log(
-    `[AmalgmMCP:Events] Matched ${matchedTriggers.length} trigger(s) for ${eventSource}.${eventName}`,
-  );
+  const eventHeaders = collectPassthroughHeaders(req.headers);
 
   const eventObj = {
     source: eventSource,
@@ -96,17 +178,48 @@ async function handleEventsPost(req, sendJson) {
     headers: eventHeaders,
     timestamp: new Date().toISOString(),
   };
+
+  if (!matchedTriggers.length) {
+    ring.push({ ...eventObj, disposition: 'unmatched' });
+    console.warn(`[AmalgmMCP:Events] Authenticated event ${eventSource}.${eventName} matched no trigger selector`);
+    // Receiving an authenticated event counts as a run: surface it in the
+    // automation's run history instead of a separate event log.
+    recordUnmatchedEventRuns(authenticated, eventSource, eventName, eventObj.timestamp);
+    return sendJson(202, {
+      ok: true,
+      triggered: false,
+      reason: `No enabled trigger matches ${eventSource}.${eventName}`,
+      authenticatedTriggerIds: authenticated.map((trigger) => trigger.id),
+    });
+  }
+
+  console.log(
+    `[AmalgmMCP:Events] Matched ${matchedTriggers.length} trigger(s) for ${eventSource}.${eventName}`,
+  );
   ring.push(eventObj);
 
   for (const matchedTrigger of matchedTriggers) {
-    executeAutomationForTrigger(matchedTrigger.id, eventObj).catch((err) => {
+    // Isolate per trigger: a synchronous throw (missing workflow, IR drift)
+    // must not skip the remaining matched triggers or 5xx the sender.
+    try {
+      executeAutomationForTrigger(matchedTrigger.id, eventObj).catch((err) => {
+        console.error(
+          `[AmalgmMCP:Events] Automation workflow failed for trigger "${matchedTrigger.name}":`,
+          err.message,
+        );
+      });
+    } catch (err) {
       console.error(
-        `[AmalgmMCP:Events] Automation workflow failed for trigger "${matchedTrigger.name}":`,
-        err.message,
+        `[AmalgmMCP:Events] Automation could not start for trigger "${matchedTrigger.name}":`,
+        err.message || err,
       );
-    });
+    }
 
-    markTriggerFired(matchedTrigger.id, { source: 'events:ingress' });
+    try {
+      markTriggerFired(matchedTrigger.id, { source: 'events:ingress' });
+    } catch (err) {
+      console.error(`[AmalgmMCP:Events] Failed to mark trigger fired "${matchedTrigger.name}":`, err.message || err);
+    }
   }
 
   return sendJson(200, {

package/runtime/scripts/amalgm-mcp/events/matcher.js

@@ -43,10 +43,10 @@ function extractSignature(headers) {
 }
 
 /**
- * Compute the expected `sha256=<hex>` HMAC over `rawBody` using `secret`.
+ * Compute the expected `<algorithm>=<hex>` HMAC over `rawBody` using `secret`.
  */
-function computeSignature(secret, rawBody) {
-  return 'sha256=' + crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
+function computeSignature(secret, rawBody, algorithm = 'sha256') {
+  return `${algorithm}=` + crypto.createHmac(algorithm, secret).update(rawBody).digest('hex');
 }
 
 /**
@@ -74,7 +74,12 @@ function verifiesSignature(trigger, signature, rawBody) {
     return timingSafeEqual(signature.value, trigger.secret);
   }
 
-  const expected = computeSignature(trigger.secret, rawBody);
+  // Legacy x-hub-signature carries `sha1=<hex>` — match the algorithm the
+  // sender used instead of always computing sha256 (which can never verify).
+  const algorithm = typeof signature.value === 'string' && signature.value.startsWith('sha1=')
+    ? 'sha1'
+    : 'sha256';
+  const expected = computeSignature(trigger.secret, rawBody, algorithm);
   return timingSafeEqual(signature.value, expected);
 }
 

package/runtime/scripts/amalgm-mcp/server/routes/automations.js

@@ -27,6 +27,10 @@ async function handleAutomationRoutes(ctx) {
     await automationsRest.handleRunNow(await ctx.readJsonBody(), ctx.sendJson);
     return true;
   }
+  if (ctx.pathname === '/automations/runs' && ctx.method === 'POST') {
+    await automationsRest.handleRuns(await ctx.readJsonBody(), ctx.sendJson);
+    return true;
+  }
   if (ctx.pathname === '/automations/validate' && ctx.method === 'POST') {
     await automationsRest.handleValidate(await ctx.readJsonBody(), ctx.sendJson);
     return true;

package/runtime/scripts/amalgm-mcp/state/db.js

@@ -130,6 +130,18 @@ function migrate(database = openLocalDb()) {
     CREATE INDEX IF NOT EXISTS automation_triggers_due_idx
       ON automation_triggers(kind, enabled, next_run_at);
 
+    CREATE TABLE IF NOT EXISTS automation_workflow_links (
+      automation_id TEXT NOT NULL,
+      workflow_id TEXT NOT NULL,
+      position INTEGER NOT NULL DEFAULT 0,
+      PRIMARY KEY (automation_id, workflow_id),
+      FOREIGN KEY(automation_id) REFERENCES automation_definitions(id) ON DELETE CASCADE,
+      FOREIGN KEY(workflow_id) REFERENCES automation_workflows(id) ON DELETE CASCADE
+    );
+
+    CREATE INDEX IF NOT EXISTS automation_workflow_links_workflow_idx
+      ON automation_workflow_links(workflow_id);
+
     CREATE TABLE IF NOT EXISTS automation_runs (
       id TEXT PRIMARY KEY,
       automation_id TEXT NOT NULL,

package/runtime/scripts/amalgm-mcp/state/snapshot.js

@@ -19,9 +19,9 @@ function readResource(resource, cache) {
       cache.triggers ||= require('../automations/store').listTriggers();
       return cache.triggers;
     case 'automation_runs':
-      return require('../automations/store').listAutomationRuns({ limit: 100 });
+      return require('../automations/store').listAutomationRuns({ limit: 300 });
     case 'workflow_cell_runs':
-      return require('../automations/store').listWorkflowCellRuns({ limit: 100 });
+      return require('../automations/store').listWorkflowCellRuns({ limit: 300 });
     case 'tasks':
       return require('../tasks/store').loadTasks().tasks;
     case 'task_runs':