amorphous-cli 0.1.7 → 0.1.8

package/README.md

@@ -1,6 +1,6 @@
 # amorphous-cli
 
-Make whatever you want, yourself, with your own agent, or with others. And whatever you want can be private, public, or even have users of its own.
+Make whatever you want, yourself, with your own agent, or with others. And whatever you want can be private, public, or even have users.
 
 ```bash
 npx amorphous-cli@latest setup

package/lib/agent-contract.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'node:url'
 import { homedir } from 'node:os'
 import { CLI_VERSION } from './version.mjs'
 
-export const CONTRACT_VERSION = 7
+export const CONTRACT_VERSION = 10
 
 const skillRoot = join(dirname(fileURLToPath(import.meta.url)), '../skill/amorphous')
 

package/lib/commands.mjs

@@ -7,6 +7,7 @@ import { homedir } from 'node:os'
 import { apiFetch } from './api.mjs'
 import { abstractsOrigin, appOrigin, projectMetaPath } from './config.mjs'
 import { recordsFromLocal, readProjectFiles, writeProjectFiles } from './files.mjs'
+import { startServe } from './serve.mjs'
 import { ALIASES, printHelp, wantsHelp } from './help.mjs'
 import { loginWithBrowser, loginWithMagicLink } from './login.mjs'
 
@@ -23,6 +24,7 @@ const BOOL_FLAGS = new Set([
   'open',
   'closed',
   'quiet',
+  'data',
 ])
 
 function parseFlags(args) {
@@ -330,20 +332,45 @@ async function cmdPush(cwd, rest) {
   const { flags } = parseFlags(rest)
   if (flags.help) return printHelp('push')
   const id = requireMeta(cwd)
-  const localRecords = recordsFromLocal(cwd)
-  const { refused } = await apiFetch(`/api/abstracts/${id}/records`, {
-    method: 'POST',
-    body: JSON.stringify({ records: localRecords }),
-  })
-  if (refused?.length) {
-    console.error(`Skipped (already live): ${refused.join(', ')}. Run: npx amorphous-cli@latest pull`)
+  if (flags.data) {
+    const localRecords = recordsFromLocal(cwd)
+    const { refused } = await apiFetch(`/api/abstracts/${id}/records`, {
+      method: 'POST',
+      body: JSON.stringify({ records: localRecords }),
+    })
+    if (refused?.length) {
+      console.error(`Skipped (already live): ${refused.join(', ')}. Run: npx amorphous-cli@latest pull`)
+    }
   }
   const { html, css, js } = readProjectFiles(cwd)
   await apiFetch(`/api/abstracts/${id}/push`, {
     method: 'POST',
     body: JSON.stringify({ html, css, js }),
   })
-  console.log('Pushed.')
+  console.log(flags.data ? 'Pushed source and records.' : 'Pushed source.')
+}
+
+async function cmdServe(cwd, rest) {
+  const { flags } = parseFlags(rest)
+  if (flags.help) return printHelp('serve')
+  const id = requireMeta(cwd)
+  const port = flags.port ? Number(flags.port) : 0
+  if (flags.port && (!Number.isInteger(port) || port < 1 || port > 65535)) {
+    throw new Error('Use --port <number>.')
+  }
+  const running = await startServe({
+    cwd,
+    abstractId: id,
+    port,
+    json: jsonMode(flags),
+  })
+  await new Promise((resolve) => {
+    const stop = () => {
+      running.close().then(resolve, resolve)
+    }
+    process.once('SIGINT', stop)
+    process.once('SIGTERM', stop)
+  })
 }
 
 function urlsFor(id) {
@@ -737,6 +764,8 @@ export async function runCommand(argv, cwd = process.cwd()) {
       return cmdOpen(cwd, rest)
     case 'preview':
       return cmdPreview(cwd, rest)
+    case 'serve':
+      return cmdServe(cwd, rest)
     case 'publish':
       return cmdPublish(cwd, rest)
     case 'live':

package/lib/config.mjs

@@ -72,6 +72,36 @@ export function abstractsOrigin() {
   return process.env.ABSTRACTS_ORIGIN || HOSTED.abstractsOrigin
 }
 
+/** Local Herd HTTPS: hit Nuxt on loopback with the abstracts Host header (no TLS). */
+export function cliAbstractsFetchOrigin() {
+  if (process.env.AMORPHOUS_CLI_ABSTRACTS_URL) {
+    return process.env.AMORPHOUS_CLI_ABSTRACTS_URL.replace(/\/$/, '')
+  }
+  const origin = abstractsOrigin()
+  try {
+    const u = new URL(origin)
+    if (u.protocol === 'https:' && (u.hostname.endsWith('.test') || u.hostname === 'localhost')) {
+      const port = process.env.AMORPHOUS_DEV_PORT || '3847'
+      return `http://127.0.0.1:${port}`
+    }
+  } catch {
+    /* ignore */
+  }
+  return origin.replace(/\/$/, '')
+}
+
+export function cliAbstractsHostHeader() {
+  const origin = abstractsOrigin()
+  const fetchOrigin = cliAbstractsFetchOrigin()
+  if (!fetchOrigin.startsWith('http://127.0.0.1')) return {}
+  try {
+    const u = new URL(origin)
+    return { Host: u.host }
+  } catch {
+    return {}
+  }
+}
+
 export function supabaseUrl() {
   return process.env.SUPABASE_URL || HOSTED.supabaseUrl
 }

package/lib/files.mjs

@@ -1,3 +1,4 @@
+import { randomUUID } from 'node:crypto'
 import { readFileSync, writeFileSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
 
@@ -47,4 +48,45 @@ export function recordsFromLocal(cwd) {
   ]
 }
 
+export function writeLocalRecords(cwd, rows) {
+  writeNdjson(
+    join(cwd, 'data.ndjson'),
+    rows.filter((r) => r.visibility !== 'private'),
+  )
+  writeNdjson(
+    join(cwd, 'private.ndjson'),
+    rows.filter((r) => r.visibility === 'private'),
+  )
+}
+
+export function insertLocalRecord(cwd, row) {
+  const body = { ...(row && typeof row === 'object' ? row : {}) }
+  if (body.visibility && body.visibility !== 'shared' && body.visibility !== 'private') {
+    return { status: 400, message: 'Invalid visibility' }
+  }
+  body.visibility = body.visibility === 'private' ? 'private' : 'shared'
+  if (!body.id) body.id = randomUUID()
+  const rows = recordsFromLocal(cwd)
+  if (rows.some((r) => r.id === body.id)) return { status: 409, message: 'Conflict' }
+  rows.push(body)
+  writeLocalRecords(cwd, rows)
+  return { status: 200, row: body }
+}
+
+export function replaceLocalRecord(cwd, id, row) {
+  const rows = recordsFromLocal(cwd)
+  const index = rows.findIndex((r) => r.id === id)
+  if (index < 0) return { status: 404, message: 'Not Found' }
+  const existing = rows[index]
+  const next = {
+    ...(existing && typeof existing === 'object' ? existing : {}),
+    ...(row && typeof row === 'object' ? row : {}),
+    id,
+    visibility: existing.visibility,
+  }
+  rows[index] = next
+  writeLocalRecords(cwd, rows)
+  return { status: 200, row: next }
+}
+
 export { FILES }

package/lib/help.mjs

@@ -7,6 +7,7 @@ export const ROOT_HELP = `Amorphous
   create                        New abstract
   open [abstract]               Open URL
   preview [abstract]            Preview URL (draft)
+  serve                         Serve this folder locally
   pull                          Pull draft and records to this folder
   push                          Push local files
   publish [--live]              Publish a version; --live is Go live
@@ -64,13 +65,19 @@ Print the Open URL.`,
 
 Print the Preview URL (draft).`,
 
+  serve: `serve [--port <n>] [--json]
+
+Serve this folder on 127.0.0.1 and reload when index.html, styles.css, or app.js changes.
+Records start local, in this folder. The page can switch to prod, which reads and writes the abstract's records.`,
+
   pull: `pull
 
 Pull the draft and records into this directory.`,
 
-  push: `push
+  push: `push [--data]
 
-Push local index.html, styles.css, app.js, and records.`,
+Push local index.html, styles.css, and app.js.
+--data also merges records from this folder. A record changed both here and on the abstract is refused.`,
 
   publish: `publish [--live]
 

package/lib/serve.mjs

@@ -0,0 +1,360 @@
+import { createServer } from 'node:http'
+import { existsSync, readFileSync, watch } from 'node:fs'
+import { join } from 'node:path'
+import { apiFetch } from './api.mjs'
+import { cliAbstractsFetchOrigin, cliAbstractsHostHeader } from './config.mjs'
+import { insertLocalRecord, readProjectFiles, recordsFromLocal, replaceLocalRecord } from './files.mjs'
+
+const BAR_CSS = `#amorphous-serve{position:fixed;z-index:2147483646;left:12px;bottom:12px;display:flex;gap:6px;align-items:center;padding:4px 6px 4px 10px;border-radius:999px;background:#18181b;color:#fff;font:500 12px/1 system-ui,-apple-system,sans-serif}
+#amorphous-serve button{border:0;border-radius:999px;padding:4px 8px;font:inherit;color:#a1a1aa;background:transparent;cursor:pointer}
+#amorphous-serve button[aria-pressed="true"]{background:#fff;color:#18181b}`
+
+function stripScriptTags(html) {
+  return String(html || '').replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
+}
+
+function readCookie(req, name) {
+  const raw = req.headers.cookie || ''
+  const match = new RegExp(`(?:^|;\\s*)${name}=([^;]+)`).exec(raw)
+  return match ? decodeURIComponent(match[1]) : ''
+}
+
+function recordsMode(req, url) {
+  const query = url.searchParams.get('records')
+  if (query === 'prod' || query === 'local') return query
+  const cookie = readCookie(req, 'amorphous_records')
+  return cookie === 'prod' ? 'prod' : 'local'
+}
+
+async function readJson(req) {
+  const chunks = []
+  for await (const chunk of req) chunks.push(chunk)
+  const text = Buffer.concat(chunks).toString('utf8')
+  if (!text) return {}
+  return JSON.parse(text)
+}
+
+function send(res, status, body, headers = {}) {
+  const payload = body == null ? '' : typeof body === 'string' ? body : JSON.stringify(body)
+  res.writeHead(status, {
+    'Cache-Control': 'no-store',
+    ...headers,
+    ...(payload && typeof body !== 'string' ? { 'Content-Type': 'application/json; charset=utf-8' } : {}),
+  })
+  res.end(payload)
+}
+
+function pageHtml(html, mode) {
+  const pressed = (value) => (mode === value ? ' aria-pressed="true"' : '')
+  return `<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<link rel="stylesheet" href="/styles.css">
+<style>${BAR_CSS}</style>
+</head>
+<body>
+<div id="amorphous-root">${stripScriptTags(html)}</div>
+<div id="amorphous-serve" data-mode="${mode}">
+  <span>Records</span>
+  <button type="button" data-set="local"${pressed('local')}>Local</button>
+  <button type="button" data-set="prod"${pressed('prod')}>Prod</button>
+</div>
+<script>
+window.amorphous = {
+  login() {},
+  async me() {
+    const res = await fetch('/__amorphous/me')
+    if (!res.ok || res.status === 204) return null
+    const text = await res.text()
+    if (!text) return null
+    return JSON.parse(text)
+  },
+  async names(ids) {
+    const res = await fetch('/__amorphous/names', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ ids })
+    })
+    if (!res.ok) return { names: {} }
+    return res.json()
+  },
+  data: {
+    async find() {
+      const res = await fetch('/__amorphous/data')
+      if (!res.ok) return []
+      const payload = await res.json()
+      return payload.records || []
+    },
+    async insert(row) {
+      const body = { ...row }
+      if (!body.id && crypto.randomUUID) body.id = crypto.randomUUID()
+      const res = await fetch('/__amorphous/data', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body)
+      })
+      if (!res.ok) throw new Error('insert failed: ' + res.status)
+      return body
+    },
+    async replace(id, row) {
+      const res = await fetch('/__amorphous/data/' + encodeURIComponent(id), {
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(row)
+      })
+      if (!res.ok) throw new Error('replace failed: ' + res.status)
+      return row
+    }
+  }
+}
+document.getElementById('amorphous-serve').addEventListener('click', function (event) {
+  var mode = event.target && event.target.getAttribute('data-set')
+  if (!mode) return
+  fetch('/__amorphous/mode', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ mode: mode })
+  }).then(function () { location.reload() })
+})
+new EventSource('/__amorphous/events').addEventListener('reload', function () {
+  location.reload()
+})
+</script>
+<script src="/app.js"></script>
+</body>
+</html>`
+}
+
+function passFromResponse(res) {
+  const list = typeof res.headers.getSetCookie === 'function' ? res.headers.getSetCookie() : []
+  const lines = list.length ? list : [res.headers.get('set-cookie') || '']
+  for (const line of lines) {
+    const match = /(?:^|,\s*)am_pass=([^;]+)/.exec(line)
+    if (match) return `am_pass=${match[1]}`
+  }
+  return null
+}
+
+export async function mintAbstractPass(abstractId) {
+  const data = await apiFetch(`/api/abstracts/${abstractId}/code`, { method: 'POST', body: '{}' })
+  const code = data?.code
+  if (!code) throw new Error('Could not open the abstract records.')
+  const res = await fetch(`${cliAbstractsFetchOrigin()}/${abstractId}?code=${encodeURIComponent(code)}`, {
+    redirect: 'manual',
+    headers: { ...cliAbstractsHostHeader() },
+  })
+  const cookie = passFromResponse(res)
+  if (!cookie) throw new Error('Could not open the abstract records.')
+  return cookie
+}
+
+async function proxyAbstract(abstractId, path, init, session) {
+  const headers = {
+    ...cliAbstractsHostHeader(),
+    ...(init.headers || {}),
+  }
+  if (session.cookie) headers.Cookie = session.cookie
+  let res
+  try {
+    res = await fetch(`${cliAbstractsFetchOrigin()}/${abstractId}${path}`, {
+      method: init.method || 'GET',
+      headers,
+      body: init.body,
+      redirect: 'manual',
+    })
+  } catch {
+    return new Response(JSON.stringify({ message: 'Could not reach the abstract.' }), {
+      status: 502,
+      headers: { 'Content-Type': 'application/json' },
+    })
+  }
+  if (res.status === 401 && session.cookie && !init.retried) {
+    session.cookie = null
+    session.cookie = await session.mint()
+    return proxyAbstract(abstractId, path, { ...init, retried: true }, session)
+  }
+  return res
+}
+
+export function startServe(options) {
+  const cwd = options.cwd
+  const abstractId = options.abstractId
+  const host = options.host || '127.0.0.1'
+  const session = {
+    cookie: null,
+    failed: false,
+    mint: options.mintPass || (() => mintAbstractPass(abstractId)),
+  }
+  const clients = new Set()
+  let reloadTimer = null
+
+  function notifyReload() {
+    clearTimeout(reloadTimer)
+    reloadTimer = setTimeout(() => {
+      for (const client of clients) client.write('event: reload\ndata: 1\n\n')
+    }, 60)
+  }
+
+  const watchers = []
+  for (const name of ['index.html', 'styles.css', 'app.js']) {
+    const path = join(cwd, name)
+    if (!existsSync(path)) continue
+    watchers.push(watch(path, notifyReload))
+  }
+
+  async function ensurePass() {
+    if (session.cookie) return session.cookie
+    if (session.failed) return null
+    try {
+      session.cookie = await session.mint()
+      return session.cookie
+    } catch {
+      session.failed = true
+      return null
+    }
+  }
+
+  async function prod(path, init) {
+    if (options.prodFetch) return options.prodFetch(abstractId, path, init, session)
+    const cookie = await ensurePass()
+    if (!cookie && init.auth !== false) {
+      return new Response(JSON.stringify({ message: 'Not signed in. Run: npx amorphous-cli@latest login' }), {
+        status: 401,
+        headers: { 'Content-Type': 'application/json' },
+      })
+    }
+    const res = await proxyAbstract(abstractId, path, { ...init, headers: { ...(init.headers || {}), Cookie: cookie || '' } }, session)
+    const text = await res.text()
+    return new Response(text, { status: res.status, headers: { 'Content-Type': res.headers.get('content-type') || 'application/json' } })
+  }
+
+  const server = createServer(async (req, res) => {
+    try {
+      const url = new URL(req.url || '/', 'http://127.0.0.1')
+      if (req.method === 'GET' && url.pathname === '/') {
+        const mode = recordsMode(req, url)
+        const headers = { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' }
+        if (url.searchParams.get('records') === 'local' || url.searchParams.get('records') === 'prod') {
+          headers['Set-Cookie'] = `amorphous_records=${mode}; Path=/; SameSite=Lax`
+        }
+        send(res, 200, pageHtml(readProjectFiles(cwd).html, mode), headers)
+        return
+      }
+      if (req.method === 'GET' && url.pathname === '/styles.css') {
+        send(res, 200, readProjectFiles(cwd).css, { 'Content-Type': 'text/css; charset=utf-8' })
+        return
+      }
+      if (req.method === 'GET' && url.pathname === '/app.js') {
+        send(res, 200, readProjectFiles(cwd).js, { 'Content-Type': 'text/javascript; charset=utf-8' })
+        return
+      }
+      if (req.method === 'GET' && url.pathname === '/__amorphous/events') {
+        res.writeHead(200, {
+          'Content-Type': 'text/event-stream',
+          'Cache-Control': 'no-cache',
+          Connection: 'keep-alive',
+        })
+        res.write(':\n\n')
+        clients.add(res)
+        req.on('close', () => clients.delete(res))
+        return
+      }
+      if (req.method === 'POST' && url.pathname === '/__amorphous/mode') {
+        const body = await readJson(req)
+        const mode = body.mode === 'prod' ? 'prod' : 'local'
+        send(res, 204, null, { 'Set-Cookie': `amorphous_records=${mode}; Path=/; SameSite=Lax` })
+        return
+      }
+      const mode = recordsMode(req, url)
+      if (req.method === 'GET' && url.pathname === '/__amorphous/me') {
+        const upstream = await prod('/api/me', { method: 'GET', auth: false })
+        const text = await upstream.text()
+        send(res, upstream.ok ? 200 : upstream.status, text, {
+          'Content-Type': 'application/json; charset=utf-8',
+        })
+        return
+      }
+      if (req.method === 'POST' && url.pathname === '/__amorphous/names') {
+        const body = await readJson(req)
+        const upstream = await prod('/api/names', {
+          method: 'POST',
+          auth: false,
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ ids: Array.isArray(body.ids) ? body.ids : [] }),
+        })
+        const text = await upstream.text()
+        send(res, upstream.ok ? 200 : upstream.status, text, {
+          'Content-Type': 'application/json; charset=utf-8',
+        })
+        return
+      }
+      if (url.pathname === '/__amorphous/data' || url.pathname.startsWith('/__amorphous/data/')) {
+        if (mode === 'prod') {
+          const recordId = decodeURIComponent(url.pathname.slice('/__amorphous/data/'.length))
+          const path = req.method === 'PUT' ? `/api/data/${encodeURIComponent(recordId)}` : '/api/data'
+          const init = { method: req.method, auth: true }
+          if (req.method === 'POST' || req.method === 'PUT') {
+            init.headers = { 'Content-Type': 'application/json' }
+            init.body = JSON.stringify(await readJson(req))
+          }
+          const upstream = await prod(path, init)
+          const text = await upstream.text()
+          send(res, upstream.status, text, { 'Content-Type': 'application/json; charset=utf-8' })
+          return
+        }
+        if (req.method === 'GET') {
+          send(res, 200, { records: recordsFromLocal(cwd) })
+          return
+        }
+        if (req.method === 'POST') {
+          const result = insertLocalRecord(cwd, await readJson(req))
+          send(res, result.status, result.row || { message: result.message })
+          return
+        }
+        if (req.method === 'PUT') {
+          const recordId = decodeURIComponent(url.pathname.slice('/__amorphous/data/'.length))
+          const result = replaceLocalRecord(cwd, recordId, await readJson(req))
+          send(res, result.status, result.row || { message: result.message })
+          return
+        }
+      }
+      send(res, 404, { message: 'Not found' })
+    } catch (error) {
+      if (error instanceof SyntaxError) {
+        send(res, 400, { message: 'Invalid request' })
+        return
+      }
+      send(res, 500, { message: error instanceof Error ? error.message : 'Request failed' })
+    }
+  })
+
+  const ready = new Promise((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(options.port || 0, host, () => {
+      server.removeListener('error', reject)
+      const address = server.address()
+      const port = typeof address === 'object' && address ? address.port : options.port
+      const url = `http://${host}:${port}/`
+      resolve({ url, port })
+    })
+  })
+
+  return ready.then((info) => {
+    if (!options.silent) {
+      if (options.json) console.log(JSON.stringify({ url: info.url }))
+      else console.log(info.url)
+    }
+    return {
+      ...info,
+      close() {
+        clearTimeout(reloadTimer)
+        for (const watcher of watchers) watcher.close()
+        for (const client of clients) client.end()
+        return new Promise((resolve, reject) => {
+          server.close((error) => (error ? reject(error) : resolve()))
+        })
+      },
+    }
+  })
+}

package/lib/serve.test.mjs

@@ -0,0 +1,123 @@
+import assert from 'node:assert/strict'
+import { mkdtempSync, readFileSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import test from 'node:test'
+import { startServe } from './serve.mjs'
+
+function project() {
+  const cwd = mkdtempSync(join(tmpdir(), 'amorphous-serve-'))
+  writeFileSync(join(cwd, 'index.html'), '<main><script>alert(1)</script><p id="who">Hi</p></main>')
+  writeFileSync(join(cwd, 'styles.css'), 'main{color:black}')
+  writeFileSync(join(cwd, 'app.js'), 'document.title = "served"')
+  writeFileSync(join(cwd, 'data.ndjson'), '')
+  writeFileSync(join(cwd, 'private.ndjson'), '')
+  return cwd
+}
+
+function cookieFrom(res) {
+  const line = res.headers.get('set-cookie') || ''
+  const match = /amorphous_records=(local|prod)/.exec(line)
+  return match ? `amorphous_records=${match[1]}` : ''
+}
+
+test('serve reloads local source and keeps prod records off disk', async () => {
+  const cwd = project()
+  const calls = []
+  const running = await startServe({
+    cwd,
+    abstractId: '00000000-0000-4000-8000-000000000001',
+    silent: true,
+    prodFetch: async (_id, path, init) => {
+      calls.push({ path, method: init.method, body: init.body })
+      if (path === '/api/data' && init.method === 'GET') {
+        return new Response(JSON.stringify({ records: [{ id: 'live', visibility: 'shared', text: 'remote' }] }), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      }
+      if (path === '/api/data' && init.method === 'POST') {
+        return new Response(JSON.stringify({ ok: true }), { status: 200 })
+      }
+      if (path === '/api/me') {
+        return new Response(JSON.stringify({ id: 'user-1', name: 'Ada' }), { status: 200 })
+      }
+      return new Response(JSON.stringify({ names: { 'user-1': 'Ada' } }), { status: 200 })
+    },
+  })
+
+  try {
+    const page = await fetch(running.url)
+    const html = await page.text()
+    assert.match(html, /id="who"/)
+    assert.doesNotMatch(html, /alert\(1\)/)
+    assert.match(html, /data-set="local" aria-pressed="true"/)
+    assert.match(html, /data-set="prod"/)
+    assert.equal(await (await fetch(`${running.url}styles.css`)).text(), 'main{color:black}')
+    assert.equal(await (await fetch(`${running.url}app.js`)).text(), 'document.title = "served"')
+
+    const inserted = await fetch(`${running.url}__amorphous/data`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ id: 'local-1', text: 'note' }),
+    })
+    assert.equal(inserted.status, 200)
+    const found = await (await fetch(`${running.url}__amorphous/data`)).json()
+    assert.deepEqual(found.records, [{ id: 'local-1', text: 'note', visibility: 'shared' }])
+
+    const replaced = await fetch(`${running.url}__amorphous/data/local-1`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ text: 'edited' }),
+    })
+    assert.equal(replaced.status, 200)
+    assert.match(readFileSync(join(cwd, 'data.ndjson'), 'utf8'), /"text":"edited"/)
+    assert.equal(calls.filter((call) => call.path === '/api/data').length, 0)
+
+    const again = await fetch(`${running.url}__amorphous/data`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ id: 'local-1', text: 'nope' }),
+    })
+    assert.equal(again.status, 409)
+
+    const switched = await fetch(`${running.url}__amorphous/mode`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ mode: 'prod' }),
+    })
+    const jar = cookieFrom(switched)
+    assert.equal(jar, 'amorphous_records=prod')
+    const live = await (
+      await fetch(`${running.url}__amorphous/data`, { headers: { Cookie: jar } })
+    ).json()
+    assert.equal(live.records[0].text, 'remote')
+    const pushed = await fetch(`${running.url}__amorphous/data`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Cookie: jar },
+      body: JSON.stringify({ id: 'from-prod', text: 'up' }),
+    })
+    assert.equal(pushed.status, 200)
+    assert.doesNotMatch(readFileSync(join(cwd, 'data.ndjson'), 'utf8'), /from-prod/)
+    assert.equal(calls.filter((call) => call.method === 'POST' && call.path === '/api/data').length, 1)
+
+    const me = await (await fetch(`${running.url}__amorphous/me`)).json()
+    assert.equal(me.name, 'Ada')
+
+    const events = await fetch(`${running.url}__amorphous/events`)
+    const reader = events.body.getReader()
+    const first = await reader.read()
+    assert.match(Buffer.from(first.value).toString(), /:/)
+    writeFileSync(join(cwd, 'styles.css'), 'main{color:white}')
+    let chunk = ''
+    const deadline = Date.now() + 2000
+    while (!chunk.includes('reload') && Date.now() < deadline) {
+      const next = await reader.read()
+      chunk += Buffer.from(next.value).toString()
+    }
+    assert.match(chunk, /reload/)
+    reader.cancel()
+  } finally {
+    await running.close()
+  }
+})

package/mcp.mjs

@@ -84,11 +84,13 @@ await serveStdio(() => {
     {
       title: 'Push the abstract',
       description:
-        'Upload the local abstract and merge records. A record changed both here and on the live abstract is refused; edit it and push again.',
-      inputSchema: z.object({}),
+        'Upload the local source. Set data to also merge records from this folder. A record changed both here and on the live abstract is refused; edit it and push again.',
+      inputSchema: z.object({
+        data: z.boolean().optional().describe('Also merge records from this folder'),
+      }),
       annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true },
     },
-    async () => call(['push']),
+    async ({ data }) => call(data ? ['push', '--data'] : ['push']),
   )
 
   server.registerTool(

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "amorphous-cli",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "mcpName": "io.github.amorphous-one/amorphous",
-  "description": "Make whatever you want, yourself, with your own agent, or with others. And whatever you want can be private, public, or even have users of its own.",
+  "description": "Make whatever you want, yourself, with your own agent, or with others.",
   "type": "module",
   "bin": {
     "amorphous-cli": "index.mjs",

package/skill/amorphous/SKILL.md

@@ -1,9 +1,9 @@
 ---
 name: amorphous
-description: Make whatever you want, yourself, with your own agent, or with others. And whatever you want can be private, public, or even have users of its own. Use when someone wants an abstract other people can open, or wants to invite people, publish, or change an abstract.
+description: Make whatever you want, yourself, with your own agent, or with others. Use when someone wants an abstract other people can open, or wants to invite people, publish, or change an abstract.
 ---
 
-Make whatever you want, yourself, with your own agent, or with others. And whatever you want can be private, public, or even have users of its own.
+Make whatever you want, yourself, with your own agent, or with others. And whatever you want can be private, public, or even have users.
 
 ## Files
 
@@ -37,13 +37,16 @@ Call the CLI as `npx amorphous-cli@latest <command>`. If a command prints `Run:
 1. If you are not signed in, run `npx amorphous-cli@latest login`. Show the person the link it prints and ask them to finish in the browser. Do not ask for an email or a code.
 2. `npx amorphous-cli@latest create --name "..."` in a folder, or `npx amorphous-cli@latest pull` when `.amorphous.json` is already there.
 3. Edit the files to match what they asked for. `me` and `names` are how the abstract knows who is here.
-4. `npx amorphous-cli@latest push`
-5. `npx amorphous-cli@latest preview` and open that URL.
-6. `npx amorphous-cli@latest publish --live`
-7. `npx amorphous-cli@latest invite <email> use` or `edit` or `view`. It prints a link and does not send an email. Give them that link. They open it and sign in with that email.
+4. `npx amorphous-cli@latest serve` and open that URL. It reloads when the files change. Records on that page start in this folder. Switch the page to prod to read and write the abstract's records.
+5. `npx amorphous-cli@latest push` sends the source. `npx amorphous-cli@latest push --data` also sends the records in this folder.
+6. `npx amorphous-cli@latest preview` and open that URL.
+7. `npx amorphous-cli@latest publish --live`
+8. `npx amorphous-cli@latest invite <email> use` or `edit` or `view`. It prints a link and does not send an email. Give them that link. They open it and sign in with that email.
 
 `npx amorphous-cli@latest visibility anyone` lets anyone view and write shared records. `npx amorphous-cli@latest visibility members` keeps the abstract to invited people.
 
+Do not make a public abstract that lets anyone keep adding shared records, such as an open list. Those records stay on the abstract and use up its storage. Keep shared records to a set you replace, or keep the abstract to invited people.
+
 A person's access is view, use, or edit. Member tiers, scores, and roles inside an abstract are records on that abstract.
 
 When a command fails, run the command it names next.

package/skill/amorphous/assets/app.js

@@ -1,26 +1,8 @@
 const who = document.getElementById('who')
-const list = document.getElementById('items')
-const form = document.getElementById('add')
 
 async function refresh() {
   const me = await amorphous.me()
-  who.textContent = me ? me.name : 'Sign in to take part'
-  const rows = await amorphous.data.find()
-  list.replaceChildren()
-  for (const row of rows) {
-    const li = document.createElement('li')
-    li.textContent = typeof row.text === 'string' ? row.text : ''
-    list.appendChild(li)
-  }
+  who.textContent = me ? me.name : 'Sign in'
 }
 
-form.addEventListener('submit', async (event) => {
-  event.preventDefault()
-  const text = new FormData(form).get('text')
-  if (typeof text !== 'string' || !text.trim()) return
-  await amorphous.data.insert({ text: text.trim() })
-  form.reset()
-  await refresh()
-})
-
 refresh()

package/skill/amorphous/assets/index.html

@@ -1,8 +1,3 @@
 <main>
   <p id="who"></p>
-  <ul id="items"></ul>
-  <form id="add">
-    <input name="text" required placeholder="Add something">
-    <button type="submit">Add</button>
-  </form>
 </main>

package/skill/amorphous/assets/styles.css

@@ -9,23 +9,3 @@ main {
 #who {
   color: #52525b;
 }
-
-ul {
-  padding-left: 1.1rem;
-}
-
-form {
-  display: flex;
-  gap: 0.5rem;
-  margin-top: 1rem;
-}
-
-input {
-  flex: 1;
-  font: inherit;
-  padding: 0.4rem 0.55rem;
-}
-
-button {
-  font: inherit;
-}