amorphous-cli 0.3.6 → 0.3.8

package/lib/files.mjs

@@ -69,7 +69,7 @@ export function insertLocalRecord(cwd, row) {
   body.visibility = body.visibility === 'private' ? 'private' : 'shared'
   if (!body.id) body.id = randomUUID()
   body.revision = 1
-  body.collection = 'default'
+  body.collection = typeof body.collection === 'string' && body.collection ? body.collection : 'default'
   body.created_by = null
   const rows = recordsFromLocal(cwd)
   if (rows.some((r) => r.id === body.id)) return { status: 409, message: 'Conflict' }

package/lib/serve.mjs

@@ -3,7 +3,7 @@ import { existsSync, readFileSync, watch } from 'node:fs'
 import { join } from 'node:path'
 import { apiFetch } from './api.mjs'
 import { randomUUID } from 'node:crypto'
-import { insertLocalRecord, readProjectFiles, recordsFromLocal, replaceLocalRecord } from './files.mjs'
+import { insertLocalRecord, readProjectFiles, recordsFromLocal, replaceLocalRecord, writeLocalRecords } from './files.mjs'
 
 const BAR_CSS = `#amorphous-serve{position:fixed;z-index:2147483646;left:12px;bottom:12px;display:flex;gap:6px;align-items:center;padding:4px 6px 4px 10px;border-radius:999px;background:#18181b;color:#fff;font:500 12px/1 system-ui,-apple-system,sans-serif}
 #amorphous-serve button{border:0;border-radius:999px;padding:4px 8px;font:inherit;color:#a1a1aa;background:transparent;cursor:pointer}
@@ -185,6 +185,50 @@ export function startServe(options) {
   const invoke = (name, input) => hosted(`${appPath}/actions/${name}/invoke${environmentQuery}`, {
     method: 'POST', headers: { 'Idempotency-Key': randomUUID() }, body: JSON.stringify(input),
   })
+  function localAction(name, input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input)) return { status: 'validation_error' }
+    const collection = typeof input.collection === 'string' && input.collection ? input.collection : null
+    const visibility = input.visibility
+    if (!collection || !['shared', 'private'].includes(visibility) ||
+      (name.startsWith('private.') && (collection !== 'default' || visibility !== 'private')) ||
+      (name.startsWith('items.') && (collection !== 'items' || visibility !== 'shared')) ||
+      (name.startsWith('form.') && (collection !== 'form' || visibility !== 'shared'))) {
+      return { status: 'validation_error' }
+    }
+    const rows = recordsFromLocal(cwd)
+    const wireRow = (row) => {
+      const { id, revision, visibility: rowVisibility, collection: rowCollection, created_by, ...body } = row
+      return { id, revision, visibility: rowVisibility, collection: rowCollection, created_by, body }
+    }
+    if (['records.query', 'private.query', 'form.mine'].includes(name)) {
+      const filtered = rows.filter((row) => row.collection === collection && row.visibility === visibility &&
+        (!input.id || row.id === input.id))
+      const after = input.cursor ? filtered.findIndex((row) => row.id === input.cursor) + 1 : 0
+      return { status: 'ok', output: filtered.slice(after, after + Math.max(1, Math.min(100, Number(input.limit) || 100))).map(wireRow) }
+    }
+    if (['records.create', 'private.create', 'items.add', 'form.submit'].includes(name)) {
+      if (!input.body || typeof input.body !== 'object' || Array.isArray(input.body)) return { status: 'validation_error' }
+      const result = insertLocalRecord(cwd, { ...input.body, ...(input.id ? { id: input.id } : {}), visibility, collection })
+      if (result.status !== 200) return { status: result.status === 409 ? 'conflict' : 'validation_error' }
+      return { status: 'ok', output: wireRow(result.row) }
+    }
+    if (['records.patch', 'private.patch', 'items.done', 'items.move', 'items.edit', 'form.edit'].includes(name)) {
+      const row = rows.find((entry) => entry.id === input.id)
+      if (!row || row.visibility !== visibility || row.collection !== collection) return { status: 'not_found' }
+      if (row.revision !== input.expectedRevision) return { status: 'conflict' }
+      if (!input.body || typeof input.body !== 'object' || Array.isArray(input.body)) return { status: 'validation_error' }
+      const result = replaceLocalRecord(cwd, row.id, input.body)
+      return result.status === 200 ? { status: 'ok', output: wireRow(result.row) } : { status: 'not_found' }
+    }
+    if (['records.delete', 'private.delete', 'items.delete'].includes(name)) {
+      const row = rows.find((entry) => entry.id === input.id)
+      if (!row || row.visibility !== visibility || row.collection !== collection) return { status: 'not_found' }
+      if (row.revision !== input.expectedRevision) return { status: 'conflict' }
+      writeLocalRecords(cwd, rows.filter((entry) => entry.id !== row.id))
+      return { status: 'ok', output: { id: row.id, deleted: true } }
+    }
+    return { status: 'validation_error' }
+  }
   const recordFromOutput = (row) => ({ ...row.body, id: row.id, revision: row.revision,
     visibility: row.visibility, collection: row.collection, created_by: row.created_by })
   async function hostedRecords(method, url, req) {
@@ -252,6 +296,10 @@ export function startServe(options) {
         return
       }
       if (req.method === 'GET' && url.pathname === '/') {
+        send(res, 302, null, { Location: `/${abstractId}/${url.search}` })
+        return
+      }
+      if (req.method === 'GET' && (url.pathname === `/${abstractId}` || url.pathname === `/${abstractId}/`)) {
         const mode = recordsMode(req, url)
         const headers = { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' }
         if (url.searchParams.get('records') === 'local' || url.searchParams.get('records') === 'prod') {
@@ -268,6 +316,28 @@ export function startServe(options) {
         send(res, 200, readProjectFiles(cwd).js, { 'Content-Type': 'text/javascript; charset=utf-8' })
         return
       }
+      const actionMatch = /^\/api\/v1\/apps\/([^/]+)\/actions\/([a-z.]+)\/invoke$/.exec(url.pathname)
+      if (actionMatch) {
+        if (req.method !== 'POST') {
+          send(res, 405, { message: 'Method not allowed' })
+          return
+        }
+        if (actionMatch[1] !== abstractId) {
+          send(res, 404, { message: 'Not found' })
+          return
+        }
+        const body = await readJson(req)
+        if (recordsMode(req, url) === 'prod') {
+          const receipt = await hosted(`${appPath}/actions/${actionMatch[2]}/invoke${environmentQuery}`, {
+            method: 'POST', headers: { 'Idempotency-Key': req.headers['idempotency-key'] || randomUUID() },
+            body: JSON.stringify(body),
+          })
+          send(res, 200, receipt)
+        } else {
+          send(res, 200, localAction(actionMatch[2], body))
+        }
+        return
+      }
       if (req.method === 'GET' && url.pathname === '/__amorphous/events') {
         res.writeHead(200, {
           'Content-Type': 'text/event-stream',
@@ -377,14 +447,15 @@ export function startServe(options) {
       const address = server.address()
       const port = typeof address === 'object' && address ? address.port : options.port
       const url = `http://${host}:${port}/`
-      resolve({ url, port })
+      const appUrl = `${url}${abstractId}/`
+      resolve({ url, appUrl, port })
     })
   })
 
   return ready.then((info) => {
     if (!options.silent) {
-      if (options.json) console.log(JSON.stringify({ url: info.url }))
-      else console.log(info.url)
+      if (options.json) console.log(JSON.stringify({ url: info.appUrl }))
+      else console.log(info.appUrl)
     }
     return {
       ...info,

package/lib/serve.test.mjs

@@ -45,9 +45,11 @@ test('serve reloads local source and keeps prod records off disk', async () => {
   })
 
   try {
-    const origin = running.url.slice(0, -1)
+    const origin = new URL(running.url).origin
+    assert.equal(new URL(running.appUrl).pathname, '/00000000-0000-4000-8000-000000000001/')
     const page = await fetch(running.url)
     const html = await page.text()
+    assert.equal(page.url, running.appUrl)
     assert.match(html, /id="who"/)
     assert.doesNotMatch(html, /alert\(1\)/)
     assert.match(html, /data-set="local" aria-pressed="true"/)
@@ -127,6 +129,81 @@ test('serve reloads local source and keeps prod records off disk', async () => {
   }
 })
 
+test('serve routes generated recipe actions to local records in local mode', async () => {
+  const cwd = project()
+  const appId = '00000000-0000-4000-8000-000000000001'
+  const calls = []
+  const running = await startServe({ cwd, abstractId: appId, silent: true,
+    hostedFetch: async (path) => { calls.push(path); throw new Error('Local actions must not reach production') },
+  })
+  try {
+    const origin = new URL(running.url).origin
+    const invoke = async (name, input) => fetch(`${running.url}api/v1/apps/${appId}/actions/${name}/invoke`, {
+      method: 'POST', headers: { Origin: origin, 'Content-Type': 'application/json' }, body: JSON.stringify(input),
+    })
+    const create = await invoke('private.create', { collection: 'default', visibility: 'private',
+      body: { thing_to_track: 'QA local entry', date: '2026-10-22', done: false } })
+    assert.equal(create.status, 200)
+    const created = await create.json()
+    assert.equal(created.status, 'ok')
+    assert.equal(created.output.body.thing_to_track, 'QA local entry')
+    assert.equal(created.output.visibility, 'private')
+
+    const query = await invoke('private.query', { collection: 'default', visibility: 'private', limit: 100 })
+    assert.deepEqual((await query.json()).output.map(row => row.body.thing_to_track), ['QA local entry'])
+    assert.match(readFileSync(join(cwd, 'private.ndjson'), 'utf8'), /QA local entry/)
+
+    const remove = await invoke('private.delete', { collection: 'default', visibility: 'private',
+      id: created.output.id, expectedRevision: created.output.revision })
+    assert.equal((await remove.json()).status, 'ok')
+    assert.equal((await invoke('private.query', { collection: 'default', visibility: 'private', limit: 100 })
+      .then(response => response.json())).output.length, 0)
+    assert.equal(readFileSync(join(cwd, 'private.ndjson'), 'utf8'), '')
+
+    const item = await invoke('items.add', { collection: 'items', visibility: 'shared', body: { title: 'QA milk' } })
+    const itemCreated = (await item.json()).output
+    assert.equal(itemCreated.collection, 'items')
+    const itemQuery = await invoke('records.query', { collection: 'items', visibility: 'shared', limit: 100 })
+    assert.equal((await itemQuery.json()).output[0].body.title, 'QA milk')
+    const itemDone = await invoke('items.done', { collection: 'items', visibility: 'shared', id: itemCreated.id,
+      expectedRevision: itemCreated.revision, body: { done: true } })
+    assert.equal((await itemDone.json()).output.body.done, true)
+    const itemDelete = await invoke('items.delete', { collection: 'items', visibility: 'shared', id: itemCreated.id,
+      expectedRevision: itemCreated.revision + 1 })
+    assert.equal((await itemDelete.json()).status, 'ok')
+
+    const signup = await invoke('form.submit', { collection: 'form', visibility: 'shared', body: { email: 'qa@example.invalid' } })
+    assert.equal((await signup.json()).output.collection, 'form')
+    assert.match(readFileSync(join(cwd, 'data.ndjson'), 'utf8'), /qa@example\.invalid/)
+    assert.deepEqual(calls, [])
+  } finally { await running.close() }
+})
+
+test('serve proxies generated recipe actions to the selected hosted environment in live mode', async () => {
+  const appId = '00000000-0000-4000-8000-000000000001'
+  const calls = []
+  const running = await startServe({ cwd: project(), abstractId: appId, silent: true, environment: 'preview',
+    hostedFetch: async (path, init) => {
+      calls.push({ path, init })
+      return { status: 'ok', output: [{ id: 'hosted-entry' }] }
+    },
+  })
+  try {
+    const origin = new URL(running.url).origin
+    const mode = await fetch(`${origin}/__amorphous/mode`, { method: 'POST',
+      headers: { Origin: origin, 'Content-Type': 'application/json' }, body: JSON.stringify({ mode: 'prod' }) })
+    const response = await fetch(`${origin}/api/v1/apps/${appId}/actions/private.query/invoke`, {
+      method: 'POST', headers: { Origin: origin, Cookie: cookieFrom(mode), 'Content-Type': 'application/json',
+        'Idempotency-Key': 'recipe-query-1' }, body: JSON.stringify({ collection: 'default', visibility: 'private', limit: 10 }),
+    })
+    assert.equal(response.status, 200)
+    assert.deepEqual(await response.json(), { status: 'ok', output: [{ id: 'hosted-entry' }] })
+    assert.equal(calls.length, 1)
+    assert.equal(calls[0].path, `/api/v1/apps/${appId}/actions/private.query/invoke?environment=preview`)
+    assert.equal(calls[0].init.headers['Idempotency-Key'], 'recipe-query-1')
+  } finally { await running.close() }
+})
+
 test('serve live mode invokes hosted actions with no pass cookie', async () => {
   const cwd = project()
   const calls = []
@@ -144,7 +221,7 @@ test('serve live mode invokes hosted actions with no pass cookie', async () => {
     },
   })
   try {
-    const origin = running.url.slice(0, -1)
+    const origin = new URL(running.url).origin
     const mode = await fetch(`${running.url}__amorphous/mode`, { method: 'POST',
       headers: { Origin: origin, 'Content-Type': 'application/json' }, body: JSON.stringify({ mode: 'prod' }) })
     assert.equal(mode.status, 204)
@@ -177,7 +254,7 @@ test('serve continues both visibilities with a nondefault hosted page limit', as
     },
   })
   try {
-    const origin = running.url.slice(0, -1)
+    const origin = new URL(running.url).origin
     const mode = await fetch(`${running.url}__amorphous/mode`, { method: 'POST',
       headers: { Origin: origin, 'Content-Type': 'application/json' }, body: JSON.stringify({ mode: 'prod' }) })
     const found = await (await fetch(`${running.url}__amorphous/data`,
@@ -229,7 +306,7 @@ test('serve exposes scoped hosted undo and keeps local undo hosted-only', async
     },
   })
   try {
-    const origin = running.url.slice(0, -1)
+    const origin = new URL(running.url).origin
     const localHistory = await fetch(`${running.url}__amorphous/recovery/${recordId}`)
     assert.deepEqual(await localHistory.json(), { revisions: [] })
     const localUndo = await fetch(`${running.url}__amorphous/recovery/${recordId}`, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amorphous-cli",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "mcpName": "io.github.amorphous-one/amorphous",
   "description": "Make whatever you want, yourself, with your own agent, or with others.",
   "type": "module",

package/skill/amorphous/SKILL.md

@@ -48,7 +48,7 @@ Then choose the path that matches the request:
 - **Existing abstract in a new folder:** Find the abstract with `amorphous-cli list --view all`, or use the id/name the person gave you. If the person has owner or editor access and the task needs source or records, run `amorphous-cli pull <id-or-name>` first in a new, empty project folder. This creates `.amorphous.json` and downloads the draft and records. Then run `amorphous-cli context` once, and only then read the guides and source files. `context` alone does not bind the folder; it writes guide files, so running explicit `pull <id-or-name>` afterward will fail because the directory is no longer empty. If the folder is not empty, do not risk its files: use a new empty folder or ask the person which existing project folder to use. If they have view or use access, skip pull. Run `amorphous-cli context <id-or-name>` once to load the guides. When the task needs live interaction, run `amorphous-cli open <id-or-name>` and open the printed Amorphous page; use its **Open live abstract** link to launch the app. The CLI command prints the page URL; it does not launch a browser itself. A use member can submit a source recommendation only when the source files are already available in an authorized project folder; without them, ask the owner/editor to provide the source or grant edit access.
 - If context fails, do not read existing guide files: they may belong to another account or be stale after access was revoked. Preserve unsaved edits and ask the person to restore access or reconnect. Do not run context again during this task.
 - **Access:** View members can open the live abstract and load its guides, but cannot pull, recommend, or change source. Use members can use the live abstract and submit source recommendations for the owner to review when source files are already available to them. Only owners and editors can pull and edit source or publish a version; only the owner can invite/remove members, change visibility, or make a version live. Follow the access already granted; ask the owner for a role change if the requested work needs more access.
-- **New abstract:** Run `amorphous-cli create --name "..." [--template blank|list|board|landing]`. The list, board, and landing starters are working examples, not just mockups.
+- **New abstract:** Run `amorphous-cli create --name "..." [--template blank|list|board|landing]`. The list, board, and landing starters are working examples, not just mockups. When Amorphous provides a recipe JSON (for example, **Start with an agent** on the homepage), save it in the project folder and run `amorphous-cli create --recipe-config <file>` to create and bind that recipe and write its generated files into the folder.
 
 After `context` succeeds, follow its final guide-reading instruction. It names only guide files that contain text; if neither guide contains text, continue without opening empty guide files. The private-guide handling warning appears only when that guide contains text.