amalgm 0.1.90 → 0.1.91

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.90",
+  "version": "0.1.91",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,
@@ -34,6 +34,7 @@
     "ai": "^6.0.116",
     "better-sqlite3": "^12.10.0",
     "cron-parser": "^5.5.0",
+    "ffmpeg-static": "^5.3.0",
     "opencode-ai": "^1.14.35",
     "tsx": "^4.21.0",
     "ws": "^8.18.3",

package/runtime/scripts/amalgm-mcp/browser/recorder.js

@@ -28,6 +28,7 @@ const engine = require('./engine');
 const active = new Map(); // session -> { ws, ffmpeg, file, frames, startedAt }
 
 function ffmpegBinary() {
+  if (process.env.AMALGM_FFMPEG) return process.env.AMALGM_FFMPEG;
   try {
     const resolved = require('ffmpeg-static');
     if (resolved && fs.existsSync(resolved)) return resolved;
@@ -35,6 +36,32 @@ function ffmpegBinary() {
   return 'ffmpeg';
 }
 
+let verifiedBinary = null;
+
+/**
+ * Resolve and verify ffmpeg before any recording work starts. ffmpeg-static
+ * ships as a dependency of the published package; AMALGM_FFMPEG overrides
+ * it; bare PATH ffmpeg is the last resort for checkouts without either. An
+ * unrunnable encoder must surface as a normal tool error — never as an
+ * unhandled ChildProcess 'error' event, which would take down the whole MCP
+ * server and every session's tools with it.
+ */
+function ensureFfmpeg() {
+  const binary = ffmpegBinary();
+  if (binary === verifiedBinary) return binary;
+  const probe = require('child_process').spawnSync(binary, ['-version'], { stdio: 'ignore', timeout: 10_000 });
+  if (probe.error || probe.status !== 0) {
+    const detail = probe.error ? (probe.error.code || probe.error.message) : `exit ${probe.status}`;
+    throw new Error(
+      `Recording requires ffmpeg, and "${binary}" is not runnable (${detail}). `
+      + 'Reinstall the amalgm package (it bundles ffmpeg-static), set AMALGM_FFMPEG, '
+      + 'or install ffmpeg on PATH.',
+    );
+  }
+  verifiedBinary = binary;
+  return binary;
+}
+
 function resolveProjectPath(args = {}, context = {}) {
   const candidate = args.projectPath
     || context?.sessionMetadata?.projectPath
@@ -93,6 +120,10 @@ async function start(args = {}, context = {}) {
     throw new Error(`Recording already active for session "${session}". Call record_stop first.`);
   }
 
+  // Verify the encoder before touching the browser: cheapest check first,
+  // and a clean refusal beats a half-started recording.
+  const binary = ensureFfmpeg();
+
   const rawUrl = await engine.cdpUrlForSession(session);
   if (!rawUrl) throw new Error('Could not resolve a CDP endpoint for this browser session.');
   const wsUrl = await pageWsUrl(rawUrl);
@@ -101,7 +132,7 @@ async function start(args = {}, context = {}) {
   const file = recordingFile(args, context, session);
   const fps = Math.min(Math.max(Number(args.fps) || 10, 1), 30);
 
-  const ffmpeg = spawn(ffmpegBinary(), [
+  const ffmpeg = spawn(binary, [
     '-y', '-f', 'image2pipe', '-c:v', 'mjpeg', '-framerate', String(fps), '-i', 'pipe:0',
     '-vf', 'pad=ceil(iw/2)*2:ceil(ih/2)*2', '-c:v', 'libvpx', '-pix_fmt', 'yuv420p', file,
   ], { stdio: ['pipe', 'ignore', 'pipe'] });
@@ -110,6 +141,18 @@ async function start(args = {}, context = {}) {
 
   const ws = new WebSocket(wsUrl, { perMessageDeflate: false });
   const recording = { ws, ffmpeg, file, frames: 0, startedAt: Date.now(), ffmpegErr: () => ffmpegErr };
+
+  // Failures after the preflight (binary swapped out, EMFILE, ffmpeg dying
+  // mid-recording and EPIPE-ing stdin) end this recording, not the server.
+  ffmpeg.on('error', (err) => {
+    ffmpegErr = `${err.message}${ffmpegErr ? ` ${ffmpegErr}` : ''}`;
+    if (active.get(session) === recording) active.delete(session);
+    try { ws.close(); } catch {}
+  });
+  ffmpeg.stdin.on('error', () => {
+    // Swallow stream errors; stop() reports the failure via exit code + stderr.
+  });
+
   active.set(session, recording);
 
   await new Promise((resolve, reject) => {

package/runtime/scripts/amalgm-mcp/index.js

@@ -24,6 +24,18 @@
  *                               control-plane, MCP adapter, and worker
  */
 
+// A tool host must degrade, not die. Without these guards, one buggy handler
+// or a dependency emitting an unguarded 'error' (e.g. a ChildProcess spawn
+// failure) tears down every session's tools at once — the exact blast radius
+// a multi-session server exists to avoid. Log loudly and keep serving; the
+// supervisor still restarts genuinely wedged processes.
+process.on('uncaughtException', (err) => {
+  console.error('[AmalgmMCP] Uncaught exception (continuing):', err && err.stack ? err.stack : err);
+});
+process.on('unhandledRejection', (reason) => {
+  console.error('[AmalgmMCP] Unhandled rejection (continuing):', reason && reason.stack ? reason.stack : reason);
+});
+
 async function ensureProxyToken() {
   if (process.env.AMALGM_PROXY_TOKEN) return;
   const { DEFAULT_PROXY_BASE_URL, ensureFreshProxyToken } = require('../proxy-token-store');

package/runtime/scripts/amalgm-mcp/tests/browser-recorder.test.js

@@ -0,0 +1,40 @@
+'use strict';
+
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+const { test } = require('node:test');
+
+// Regression coverage for the 2026-06-10 incident: record_start with no
+// runnable ffmpeg crashed the whole MCP server via an unhandled ChildProcess
+// 'error' event (spawn ffmpeg ENOENT), deregistering every session's tools.
+// A missing encoder must be a refused tool call, nothing more.
+
+test('record_start rejects cleanly when ffmpeg is not runnable', async () => {
+  process.env.AMALGM_FFMPEG = path.join(__dirname, 'definitely-not-ffmpeg');
+  try {
+    const recorder = require('../browser/recorder');
+    await assert.rejects(
+      () => recorder.start({}, {}),
+      /Recording requires ffmpeg/,
+      'missing ffmpeg should surface as a tool error before any browser work',
+    );
+  } finally {
+    delete process.env.AMALGM_FFMPEG;
+  }
+});
+
+test('ffmpeg ships with the published package', (t) => {
+  // Resolves to <engine-root>/packages/amalgm in the engine repo; the
+  // amalgm-ui mirror has no packages/ tree, so the check skips there.
+  const pkgPath = path.join(__dirname, '..', '..', '..', '..', 'packages', 'amalgm', 'package.json');
+  if (!fs.existsSync(pkgPath)) {
+    t.skip('engine-only check');
+    return;
+  }
+  const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+  assert.ok(
+    pkg.dependencies && pkg.dependencies['ffmpeg-static'],
+    'packages/amalgm must depend on ffmpeg-static — PATH ffmpeg does not exist on fresh machines',
+  );
+});