amorphous-cli 0.3.5 → 0.3.7

package/lib/agent-contract.test.mjs

@@ -22,6 +22,13 @@ test('starter app scripts parse as browser classic scripts', () => {
   }
 })
 
+test('board starter explains horizontal scrolling on mobile', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'amorphous-board-scroll-hint-'))
+  writeStarter(dir, 'board')
+  const html = readFileSync(join(dir, 'index.html'), 'utf8')
+  assert.match(html, /Scroll sideways to see all columns\./)
+})
+
 test('setup copies the skill, and an edited contract is left alone', () => {
   const home = mkdtempSync(join(tmpdir(), 'amorphous-skill-'))
   const dirs = installUserSkill(home)

package/lib/files.mjs

@@ -69,7 +69,7 @@ export function insertLocalRecord(cwd, row) {
   body.visibility = body.visibility === 'private' ? 'private' : 'shared'
   if (!body.id) body.id = randomUUID()
   body.revision = 1
-  body.collection = 'default'
+  body.collection = typeof body.collection === 'string' && body.collection ? body.collection : 'default'
   body.created_by = null
   const rows = recordsFromLocal(cwd)
   if (rows.some((r) => r.id === body.id)) return { status: 409, message: 'Conflict' }

package/lib/serve.mjs

@@ -3,7 +3,7 @@ import { existsSync, readFileSync, watch } from 'node:fs'
 import { join } from 'node:path'
 import { apiFetch } from './api.mjs'
 import { randomUUID } from 'node:crypto'
-import { insertLocalRecord, readProjectFiles, recordsFromLocal, replaceLocalRecord } from './files.mjs'
+import { insertLocalRecord, readProjectFiles, recordsFromLocal, replaceLocalRecord, writeLocalRecords } from './files.mjs'
 
 const BAR_CSS = `#amorphous-serve{position:fixed;z-index:2147483646;left:12px;bottom:12px;display:flex;gap:6px;align-items:center;padding:4px 6px 4px 10px;border-radius:999px;background:#18181b;color:#fff;font:500 12px/1 system-ui,-apple-system,sans-serif}
 #amorphous-serve button{border:0;border-radius:999px;padding:4px 8px;font:inherit;color:#a1a1aa;background:transparent;cursor:pointer}
@@ -185,6 +185,50 @@ export function startServe(options) {
   const invoke = (name, input) => hosted(`${appPath}/actions/${name}/invoke${environmentQuery}`, {
     method: 'POST', headers: { 'Idempotency-Key': randomUUID() }, body: JSON.stringify(input),
   })
+  function localAction(name, input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input)) return { status: 'validation_error' }
+    const collection = typeof input.collection === 'string' && input.collection ? input.collection : null
+    const visibility = input.visibility
+    if (!collection || !['shared', 'private'].includes(visibility) ||
+      (name.startsWith('private.') && (collection !== 'default' || visibility !== 'private')) ||
+      (name.startsWith('items.') && (collection !== 'items' || visibility !== 'shared')) ||
+      (name.startsWith('form.') && (collection !== 'form' || visibility !== 'shared'))) {
+      return { status: 'validation_error' }
+    }
+    const rows = recordsFromLocal(cwd)
+    const wireRow = (row) => {
+      const { id, revision, visibility: rowVisibility, collection: rowCollection, created_by, ...body } = row
+      return { id, revision, visibility: rowVisibility, collection: rowCollection, created_by, body }
+    }
+    if (['records.query', 'private.query', 'form.mine'].includes(name)) {
+      const filtered = rows.filter((row) => row.collection === collection && row.visibility === visibility &&
+        (!input.id || row.id === input.id))
+      const after = input.cursor ? filtered.findIndex((row) => row.id === input.cursor) + 1 : 0
+      return { status: 'ok', output: filtered.slice(after, after + Math.max(1, Math.min(100, Number(input.limit) || 100))).map(wireRow) }
+    }
+    if (['records.create', 'private.create', 'items.add', 'form.submit'].includes(name)) {
+      if (!input.body || typeof input.body !== 'object' || Array.isArray(input.body)) return { status: 'validation_error' }
+      const result = insertLocalRecord(cwd, { ...input.body, ...(input.id ? { id: input.id } : {}), visibility, collection })
+      if (result.status !== 200) return { status: result.status === 409 ? 'conflict' : 'validation_error' }
+      return { status: 'ok', output: wireRow(result.row) }
+    }
+    if (['records.patch', 'private.patch', 'items.done', 'items.move', 'items.edit', 'form.edit'].includes(name)) {
+      const row = rows.find((entry) => entry.id === input.id)
+      if (!row || row.visibility !== visibility || row.collection !== collection) return { status: 'not_found' }
+      if (row.revision !== input.expectedRevision) return { status: 'conflict' }
+      if (!input.body || typeof input.body !== 'object' || Array.isArray(input.body)) return { status: 'validation_error' }
+      const result = replaceLocalRecord(cwd, row.id, input.body)
+      return result.status === 200 ? { status: 'ok', output: wireRow(result.row) } : { status: 'not_found' }
+    }
+    if (['records.delete', 'private.delete', 'items.delete'].includes(name)) {
+      const row = rows.find((entry) => entry.id === input.id)
+      if (!row || row.visibility !== visibility || row.collection !== collection) return { status: 'not_found' }
+      if (row.revision !== input.expectedRevision) return { status: 'conflict' }
+      writeLocalRecords(cwd, rows.filter((entry) => entry.id !== row.id))
+      return { status: 'ok', output: { id: row.id, deleted: true } }
+    }
+    return { status: 'validation_error' }
+  }
   const recordFromOutput = (row) => ({ ...row.body, id: row.id, revision: row.revision,
     visibility: row.visibility, collection: row.collection, created_by: row.created_by })
   async function hostedRecords(method, url, req) {
@@ -252,6 +296,10 @@ export function startServe(options) {
         return
       }
       if (req.method === 'GET' && url.pathname === '/') {
+        send(res, 302, null, { Location: `/${abstractId}/${url.search}` })
+        return
+      }
+      if (req.method === 'GET' && (url.pathname === `/${abstractId}` || url.pathname === `/${abstractId}/`)) {
         const mode = recordsMode(req, url)
         const headers = { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' }
         if (url.searchParams.get('records') === 'local' || url.searchParams.get('records') === 'prod') {
@@ -268,6 +316,28 @@ export function startServe(options) {
         send(res, 200, readProjectFiles(cwd).js, { 'Content-Type': 'text/javascript; charset=utf-8' })
         return
       }
+      const actionMatch = /^\/api\/v1\/apps\/([^/]+)\/actions\/([a-z.]+)\/invoke$/.exec(url.pathname)
+      if (actionMatch) {
+        if (req.method !== 'POST') {
+          send(res, 405, { message: 'Method not allowed' })
+          return
+        }
+        if (actionMatch[1] !== abstractId) {
+          send(res, 404, { message: 'Not found' })
+          return
+        }
+        const body = await readJson(req)
+        if (recordsMode(req, url) === 'prod') {
+          const receipt = await hosted(`${appPath}/actions/${actionMatch[2]}/invoke${environmentQuery}`, {
+            method: 'POST', headers: { 'Idempotency-Key': req.headers['idempotency-key'] || randomUUID() },
+            body: JSON.stringify(body),
+          })
+          send(res, 200, receipt)
+        } else {
+          send(res, 200, localAction(actionMatch[2], body))
+        }
+        return
+      }
       if (req.method === 'GET' && url.pathname === '/__amorphous/events') {
         res.writeHead(200, {
           'Content-Type': 'text/event-stream',
@@ -377,14 +447,15 @@ export function startServe(options) {
       const address = server.address()
       const port = typeof address === 'object' && address ? address.port : options.port
       const url = `http://${host}:${port}/`
-      resolve({ url, port })
+      const appUrl = `${url}${abstractId}/`
+      resolve({ url, appUrl, port })
     })
   })
 
   return ready.then((info) => {
     if (!options.silent) {
-      if (options.json) console.log(JSON.stringify({ url: info.url }))
-      else console.log(info.url)
+      if (options.json) console.log(JSON.stringify({ url: info.appUrl }))
+      else console.log(info.appUrl)
     }
     return {
       ...info,

package/lib/serve.test.mjs

@@ -45,9 +45,11 @@ test('serve reloads local source and keeps prod records off disk', async () => {
   })
 
   try {
-    const origin = running.url.slice(0, -1)
+    const origin = new URL(running.url).origin
+    assert.equal(new URL(running.appUrl).pathname, '/00000000-0000-4000-8000-000000000001/')
     const page = await fetch(running.url)
     const html = await page.text()
+    assert.equal(page.url, running.appUrl)
     assert.match(html, /id="who"/)
     assert.doesNotMatch(html, /alert\(1\)/)
     assert.match(html, /data-set="local" aria-pressed="true"/)
@@ -127,6 +129,81 @@ test('serve reloads local source and keeps prod records off disk', async () => {
   }
 })
 
+test('serve routes generated recipe actions to local records in local mode', async () => {
+  const cwd = project()
+  const appId = '00000000-0000-4000-8000-000000000001'
+  const calls = []
+  const running = await startServe({ cwd, abstractId: appId, silent: true,
+    hostedFetch: async (path) => { calls.push(path); throw new Error('Local actions must not reach production') },
+  })
+  try {
+    const origin = new URL(running.url).origin
+    const invoke = async (name, input) => fetch(`${running.url}api/v1/apps/${appId}/actions/${name}/invoke`, {
+      method: 'POST', headers: { Origin: origin, 'Content-Type': 'application/json' }, body: JSON.stringify(input),
+    })
+    const create = await invoke('private.create', { collection: 'default', visibility: 'private',
+      body: { thing_to_track: 'QA local entry', date: '2026-10-22', done: false } })
+    assert.equal(create.status, 200)
+    const created = await create.json()
+    assert.equal(created.status, 'ok')
+    assert.equal(created.output.body.thing_to_track, 'QA local entry')
+    assert.equal(created.output.visibility, 'private')
+
+    const query = await invoke('private.query', { collection: 'default', visibility: 'private', limit: 100 })
+    assert.deepEqual((await query.json()).output.map(row => row.body.thing_to_track), ['QA local entry'])
+    assert.match(readFileSync(join(cwd, 'private.ndjson'), 'utf8'), /QA local entry/)
+
+    const remove = await invoke('private.delete', { collection: 'default', visibility: 'private',
+      id: created.output.id, expectedRevision: created.output.revision })
+    assert.equal((await remove.json()).status, 'ok')
+    assert.equal((await invoke('private.query', { collection: 'default', visibility: 'private', limit: 100 })
+      .then(response => response.json())).output.length, 0)
+    assert.equal(readFileSync(join(cwd, 'private.ndjson'), 'utf8'), '')
+
+    const item = await invoke('items.add', { collection: 'items', visibility: 'shared', body: { title: 'QA milk' } })
+    const itemCreated = (await item.json()).output
+    assert.equal(itemCreated.collection, 'items')
+    const itemQuery = await invoke('records.query', { collection: 'items', visibility: 'shared', limit: 100 })
+    assert.equal((await itemQuery.json()).output[0].body.title, 'QA milk')
+    const itemDone = await invoke('items.done', { collection: 'items', visibility: 'shared', id: itemCreated.id,
+      expectedRevision: itemCreated.revision, body: { done: true } })
+    assert.equal((await itemDone.json()).output.body.done, true)
+    const itemDelete = await invoke('items.delete', { collection: 'items', visibility: 'shared', id: itemCreated.id,
+      expectedRevision: itemCreated.revision + 1 })
+    assert.equal((await itemDelete.json()).status, 'ok')
+
+    const signup = await invoke('form.submit', { collection: 'form', visibility: 'shared', body: { email: 'qa@example.invalid' } })
+    assert.equal((await signup.json()).output.collection, 'form')
+    assert.match(readFileSync(join(cwd, 'data.ndjson'), 'utf8'), /qa@example\.invalid/)
+    assert.deepEqual(calls, [])
+  } finally { await running.close() }
+})
+
+test('serve proxies generated recipe actions to the selected hosted environment in live mode', async () => {
+  const appId = '00000000-0000-4000-8000-000000000001'
+  const calls = []
+  const running = await startServe({ cwd: project(), abstractId: appId, silent: true, environment: 'preview',
+    hostedFetch: async (path, init) => {
+      calls.push({ path, init })
+      return { status: 'ok', output: [{ id: 'hosted-entry' }] }
+    },
+  })
+  try {
+    const origin = new URL(running.url).origin
+    const mode = await fetch(`${origin}/__amorphous/mode`, { method: 'POST',
+      headers: { Origin: origin, 'Content-Type': 'application/json' }, body: JSON.stringify({ mode: 'prod' }) })
+    const response = await fetch(`${origin}/api/v1/apps/${appId}/actions/private.query/invoke`, {
+      method: 'POST', headers: { Origin: origin, Cookie: cookieFrom(mode), 'Content-Type': 'application/json',
+        'Idempotency-Key': 'recipe-query-1' }, body: JSON.stringify({ collection: 'default', visibility: 'private', limit: 10 }),
+    })
+    assert.equal(response.status, 200)
+    assert.deepEqual(await response.json(), { status: 'ok', output: [{ id: 'hosted-entry' }] })
+    assert.equal(calls.length, 1)
+    assert.equal(calls[0].path, `/api/v1/apps/${appId}/actions/private.query/invoke?environment=preview`)
+    assert.equal(calls[0].init.headers['Idempotency-Key'], 'recipe-query-1')
+  } finally { await running.close() }
+})
+
 test('serve live mode invokes hosted actions with no pass cookie', async () => {
   const cwd = project()
   const calls = []
@@ -144,7 +221,7 @@ test('serve live mode invokes hosted actions with no pass cookie', async () => {
     },
   })
   try {
-    const origin = running.url.slice(0, -1)
+    const origin = new URL(running.url).origin
     const mode = await fetch(`${running.url}__amorphous/mode`, { method: 'POST',
       headers: { Origin: origin, 'Content-Type': 'application/json' }, body: JSON.stringify({ mode: 'prod' }) })
     assert.equal(mode.status, 204)
@@ -177,7 +254,7 @@ test('serve continues both visibilities with a nondefault hosted page limit', as
     },
   })
   try {
-    const origin = running.url.slice(0, -1)
+    const origin = new URL(running.url).origin
     const mode = await fetch(`${running.url}__amorphous/mode`, { method: 'POST',
       headers: { Origin: origin, 'Content-Type': 'application/json' }, body: JSON.stringify({ mode: 'prod' }) })
     const found = await (await fetch(`${running.url}__amorphous/data`,
@@ -229,7 +306,7 @@ test('serve exposes scoped hosted undo and keeps local undo hosted-only', async
     },
   })
   try {
-    const origin = running.url.slice(0, -1)
+    const origin = new URL(running.url).origin
     const localHistory = await fetch(`${running.url}__amorphous/recovery/${recordId}`)
     assert.deepEqual(await localHistory.json(), { revisions: [] })
     const localUndo = await fetch(`${running.url}__amorphous/recovery/${recordId}`, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amorphous-cli",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "mcpName": "io.github.amorphous-one/amorphous",
   "description": "Make whatever you want, yourself, with your own agent, or with others.",
   "type": "module",

package/templates.json

@@ -16,8 +16,8 @@
   "board": {
     "label": "Board",
     "description": "A small kanban board with shared cards",
-    "html": "<main class=\"shell\">\n  <header><p class=\"eyebrow\">TEAM BOARD</p><h1>Project board</h1><p class=\"muted\">Move cards across the columns as work progresses.</p></header>\n  <form id=\"add-form\"><input id=\"new-card\" aria-label=\"New card\" placeholder=\"Add a card…\" maxlength=\"180\" required><button>Add card</button></form>\n  <section id=\"columns\" class=\"columns\"></section>\n</main>",
-    "css": "* { box-sizing: border-box; } body { margin: 0; background: #f4f5f7; color: #20242b; font: 15px/1.5 system-ui, sans-serif; } .shell { max-width: 1120px; margin: 7vh auto; padding: 28px; } .eyebrow { color: #727985; font-size: 11px; font-weight: 700; letter-spacing: .14em; } h1 { margin: 4px 0; font-size: clamp(32px, 7vw, 48px); letter-spacing: -.05em; } .muted { color: #727985; } form { display: flex; gap: 8px; max-width: 580px; margin: 24px 0; } input { min-width: 0; flex: 1; padding: 11px 13px; border: 1px solid #d7dbe2; border-radius: 8px; font: inherit; } button { padding: 9px 14px; border: 0; border-radius: 8px; background: #29313d; color: #fff; font: inherit; cursor: pointer; } .columns { display: grid; grid-template-columns: repeat(3, minmax(220px, 1fr)); gap: 14px; align-items: start; overflow-x: auto; } .column { min-height: 190px; padding: 12px; border: 1px solid #e0e3e9; border-radius: 12px; background: #e9ecf1; } .column h2 { margin: 0 0 12px; font-size: 13px; text-transform: uppercase; letter-spacing: .06em; } .card { display: flex; align-items: center; gap: 8px; margin: 8px 0; padding: 11px; border: 1px solid #e2e4e9; border-radius: 9px; background: white; } .card span { flex: 1; overflow-wrap: anywhere; } .card select { max-width: 105px; padding: 5px; border: 1px solid #d7dbe2; border-radius: 6px; background: white; font: inherit; font-size: 12px; } @media (max-width: 760px) { .columns { grid-template-columns: repeat(3, minmax(250px, 1fr)); } }",
+    "html": "<main class=\"shell\">\n  <header><p class=\"eyebrow\">TEAM BOARD</p><h1>Project board</h1><p class=\"muted\">Move cards across the columns as work progresses.</p></header>\n  <p id=\"columns-scroll-hint\" class=\"muted scroll-hint\">Scroll sideways to see all columns.</p>\n  <form id=\"add-form\"><input id=\"new-card\" aria-label=\"New card\" placeholder=\"Add a card…\" maxlength=\"180\" required><button>Add card</button></form>\n  <section id=\"columns\" class=\"columns\" aria-describedby=\"columns-scroll-hint\"></section>\n</main>",
+    "css": "* { box-sizing: border-box; } body { margin: 0; background: #f4f5f7; color: #20242b; font: 15px/1.5 system-ui, sans-serif; } .shell { max-width: 1120px; margin: 7vh auto; padding: 28px; } .eyebrow { color: #727985; font-size: 11px; font-weight: 700; letter-spacing: .14em; } h1 { margin: 4px 0; font-size: clamp(32px, 7vw, 48px); letter-spacing: -.05em; } .muted { color: #727985; } .scroll-hint { display: none; } form { display: flex; gap: 8px; max-width: 580px; margin: 24px 0; } input { min-width: 0; flex: 1; padding: 11px 13px; border: 1px solid #d7dbe2; border-radius: 8px; font: inherit; } button { padding: 9px 14px; border: 0; border-radius: 8px; background: #29313d; color: #fff; font: inherit; cursor: pointer; } .columns { display: grid; grid-template-columns: repeat(3, minmax(220px, 1fr)); gap: 14px; align-items: start; overflow-x: auto; } .column { min-height: 190px; padding: 12px; border: 1px solid #e0e3e9; border-radius: 12px; background: #e9ecf1; } .column h2 { margin: 0 0 12px; font-size: 13px; text-transform: uppercase; letter-spacing: .06em; } .card { display: flex; align-items: center; gap: 8px; margin: 8px 0; padding: 11px; border: 1px solid #e2e4e9; border-radius: 9px; background: white; } .card span { flex: 1; overflow-wrap: anywhere; } .card select { max-width: 105px; padding: 5px; border: 1px solid #d7dbe2; border-radius: 6px; background: white; font: inherit; font-size: 12px; } @media (max-width: 760px) { .scroll-hint { display: block; margin: -8px 0 14px; } .columns { grid-template-columns: repeat(3, minmax(250px, 1fr)); } }",
     "js": "const stages = ['To do', 'In progress', 'Done']\nconst form = document.querySelector('#add-form')\nconst input = document.querySelector('#new-card')\nconst columns = document.querySelector('#columns')\n\nasync function render() {\n  const rows = (await amorphous.data.find()).filter(row => row.kind === 'board-card')\n  columns.replaceChildren()\n  for (const stage of stages) {\n    const column = document.createElement('section')\n    column.className = 'column'\n    const heading = document.createElement('h2')\n    heading.textContent = `${stage} · ${rows.filter(row => (row.stage || stages[0]) === stage).length}`\n    column.append(heading)\n    for (const row of rows.filter(item => (item.stage || stages[0]) === stage)) {\n      const card = document.createElement('article')\n      card.className = 'card'\n      const text = document.createElement('span')\n      text.textContent = row.text\n      const select = document.createElement('select')\n      select.setAttribute('aria-label', `Move ${row.text}`)\n      for (const optionText of stages) {\n        const option = document.createElement('option')\n        option.value = optionText\n        option.textContent = optionText\n        option.selected = optionText === (row.stage || stages[0])\n        select.append(option)\n      }\n      select.addEventListener('change', async () => {\n        await amorphous.data.replace(row.id, { ...row, stage: select.value })\n        await render()\n      })\n      card.append(text, select)\n      column.append(card)\n    }\n    columns.append(column)\n  }\n}\n\nform.addEventListener('submit', async event => {\n  event.preventDefault()\n  const text = input.value.trim()\n  if (!text) return\n  await amorphous.data.insert({ kind: 'board-card', text, stage: stages[0] })\n  input.value = ''\n  await render()\n})\n\nrender()"
   },
   "landing": {