@akira-tl/forgerelay 1.2.1 → 1.2.2

package/CHANGELOG.md

@@ -4,6 +4,15 @@ All notable ForgeRelay changes are documented here.
 
 ## [Unreleased]
 
+## [1.2.2] - 2026-09-13
+
+### Fixed
+
+- 修复带路径前缀的 `publicBaseUrl` 在 MCP SDK v2 下被 Origin 校验错误拒绝的问题；ForgeRelay 现在只从 canonical public URL 派生允许的 Origin hostname，同时继续拒绝 foreign / malformed Origin。
+- OAuth authorization callback 现在带回 metadata 中公布的 `iss`，使 routed public URL 的现代 OAuth 流程保持 issuer 一致。
+- MCP App 的 CSP `resourceDomains` / `connectDomains` 现在使用 URL Origin，而不是包含部署路径的完整 `publicBaseUrl`，避免 path-prefix 部署下 Activity Panel 只停留在 `Waiting for Activity Panel state.`。
+- Skill 默认发现范围收敛为 Project `.agents/skills`、Project `.forgerelay/skills` 与 active ForgeRelay config `skills`；不再自动扫描全局 `~/.agents/skills` 或 `FORGERELAY_AGENT_DIR/skills`，显式 `FORGERELAY_SKILL_PATHS` 仍作为用户附加来源。
+
 ## [1.2.1] - 2026-09-13
 
 ### Fixed

package/dist/mcp/oauth/router.js

@@ -56,7 +56,7 @@ export function createForgeRelayAuthRouter(options) {
             res.status(200).json({ ...tokens, ...(instanceId ? { instance_id: instanceId } : {}) });
         });
     }
-    router.use(authorizationPaths, authorizationHandler({ provider }));
+    router.use(authorizationPaths, authorizationHandler({ provider, issuerUrl }));
     router.use(tokenPaths, tokenHandler({ provider }));
     if (provider.clientsStore.registerClient && registrationEndpoint) {
         router.use(registrationPaths, clientRegistrationHandler({ clientsStore: provider.clientsStore }));

package/dist/mcp/panel/app.js

@@ -64,9 +64,10 @@ function currentIdentity(config, fallbackRevision) {
     return identity;
 }
 function activityPanelCsp(config) {
+    const publicOrigins = Array.from(new Set(config.publicBaseUrls.map((baseUrl) => new URL(baseUrl).origin)));
     return {
-        resourceDomains: [...config.publicBaseUrls],
-        connectDomains: [...config.publicBaseUrls],
+        resourceDomains: publicOrigins,
+        connectDomains: publicOrigins,
     };
 }
 async function readActivityPanelAppResource(config, fallbackRevision, requestedUri, transportSessionId) {

package/dist/mcp/server/transport/http-server.js

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto";
-import { checkResourceAllowed, createMcpHandler, isInitializeRequest, isLegacyRequest, resourceUrlFromServerUrl, } from "@modelcontextprotocol/server";
+import { checkResourceAllowed, createMcpHandler, isInitializeRequest, isLegacyRequest, localhostAllowedOrigins, resourceUrlFromServerUrl, } from "@modelcontextprotocol/server";
 import { createMcpExpressApp, getOAuthProtectedResourceMetadataUrl, requireBearerAuth, } from "@modelcontextprotocol/express";
 import { NodeStreamableHTTPServerTransport, toNodeHandler, toWebRequest, } from "@modelcontextprotocol/node";
 import express from "express";
@@ -32,17 +32,22 @@ const MCP_TRANSPORT_CLEANUP_INTERVAL_MS = 5 * 60 * 1_000;
 export function createHttpServer(config, options, createMcpServer) {
     const incomingArtifactAdapters = options.incomingArtifactAdapters
         ?? [createOpenAIIncomingArtifactAdapter()];
+    const routeBaseUrls = config.publicBaseUrls.map((baseUrl) => new URL(baseUrl));
     const allowedHosts = config.allowedHosts.includes("*")
         ? undefined
         : Array.from(new Set([config.host, ...config.allowedHosts]));
+    const allowedOrigins = Array.from(new Set([
+        ...localhostAllowedOrigins(),
+        ...routeBaseUrls.map((baseUrl) => baseUrl.hostname),
+    ]));
     const app = createMcpExpressApp({
         host: config.host,
         ...(allowedHosts ? { allowedHosts } : {}),
+        allowedOrigins,
     });
     const transports = new McpTransportRegistry({
         maxTransports: MAX_MCP_TRANSPORT_SESSIONS,
     });
-    const routeBaseUrls = config.publicBaseUrls.map((baseUrl) => new URL(baseUrl));
     const mcpUrl = publicEndpointUrl(config.publicBaseUrl, "mcp");
     const mcpPaths = publicEndpointPaths(routeBaseUrls, "mcp");
     const activityPanelAssetsPaths = publicEndpointPaths(routeBaseUrls, "mcp-app-assets");

package/dist/workspaces/resources/skills.js

@@ -8,9 +8,8 @@ const FRONTMATTER_DELIMITER = "---";
 export function effectiveSkillPaths(config, cwd) {
     const defaultPathCandidates = [
         resolve(cwd, ".agents", "skills"),
-        join(homedir(), ".agents", "skills"),
+        resolve(cwd, ".forgerelay", "skills"),
         config.configSkillsDir,
-        join(config.agentDir, "skills"),
     ];
     const defaultPaths = defaultPathCandidates.filter((path) => path !== undefined && existsSync(path));
     const seen = new Set();

package/docs/chatgpt-coding-workflow.md

@@ -189,7 +189,8 @@ instructions before the requested file content. Side-effecting file tools and sh
 commands discover instructions before execution; if new local instructions are
 found, ForgeRelay returns them and requires the Agent to retry, so the side effect
 does not occur before the relevant instructions are known. `FORGERELAY_AGENT_DIR`
-is not an instruction source; it remains only a compatibility skill-discovery path.
+is neither an instruction source nor an automatic Skill-discovery source; it remains
+an integration runtime directory for supported Agent tooling.
 
 ## MCP capability loading
 
@@ -232,17 +233,16 @@ force the Host to discard a cached tool schema.
 
 ## Agent Skills
 
-ForgeRelay discovers standard Agent Skills in precedence order from:
+ForgeRelay discovers Skills in precedence order from:
 
 - project `.agents/skills`
-- `~/.agents/skills`
-- the active ForgeRelay config directory's `skills` folder
-- `FORGERELAY_AGENT_DIR/skills` (defaults to `~/.codex/skills`)
-- paths from `FORGERELAY_SKILL_PATHS`
+- project `.forgerelay/skills`
+- the active ForgeRelay config directory's `skills` folder (`~/.forgerelay/skills` by default)
+- paths explicitly added through `FORGERELAY_SKILL_PATHS`
 
-These paths are discovery sources, not one shared ownership domain. `.agents/skills` is the open Agent Skills ecosystem and may contain files or symlinks managed by other Agent tooling. ForgeRelay-owned Skills remain private to the active ForgeRelay config directory (`~/.forgerelay/skills` by default) and are never migrated into `~/.agents/skills`.
+These paths are discovery sources, not one shared ownership domain. Project `.agents/skills` is the open Agent Skills ecosystem and may contain files or symlinks managed by other Agent tooling. ForgeRelay-owned project/system Skills stay under `.forgerelay/skills` and the active ForgeRelay config directory. ForgeRelay does not automatically scan global Agent runtime Skill directories such as `~/.agents/skills` or `FORGERELAY_AGENT_DIR/skills`.
 
-Same-named collisions use the first source, so project Skills override global Skills.
+Same-named collisions use the first source: project Agent Skills override project ForgeRelay Skills, which override system ForgeRelay Skills and explicit additional paths.
 
 When a task matches an advertised skill, read its `SKILL.md` before using other
 files in the skill directory.

package/docs/configuration.md

@@ -910,20 +910,19 @@ select a global instruction file; its `skills` child is an additional Agent Skil
 | --- | --- |
 | `FORGERELAY_SKILLS` | Set to `0` to hide skills. Enabled by default. |
 | `FORGERELAY_SUBAGENTS` | Set to `1` to expose configured subagent profiles. |
-| `FORGERELAY_AGENT_DIR` | Defaults to `~/.codex`; its `skills` child is included as an additional Skill source. |
+| `FORGERELAY_AGENT_DIR` | Defaults to `~/.codex`; used by supported Agent integrations, not as an automatic Skill source. |
 | `FORGERELAY_SKILL_PATHS` | Optional comma-separated additional skill directories. |
 
-Standard Agent Skills are discovered in precedence order from:
+Skills are discovered in precedence order from:
 
 - project `.agents/skills`
-- `~/.agents/skills`
-- the active ForgeRelay config directory's `skills` folder
-- `FORGERELAY_AGENT_DIR/skills`
-- paths from `FORGERELAY_SKILL_PATHS`
+- project `.forgerelay/skills`
+- the active ForgeRelay config directory's `skills` folder (`~/.forgerelay/skills` by default)
+- paths explicitly added through `FORGERELAY_SKILL_PATHS`
 
-The ownership boundaries are different even though all of these are readable Skill sources. Project/global `.agents/skills` belong to the open Agent Skills ecosystem and may contain files or symlinks installed by other Agent tooling. ForgeRelay-owned Skills stay under the active ForgeRelay config directory (`~/.forgerelay/skills` by default); ForgeRelay does not migrate or install its private Skills into `~/.agents/skills`.
+Project `.agents/skills` belongs to the open Agent Skills ecosystem and may contain files or symlinks installed by other Agent tooling. ForgeRelay-owned project/system Skills stay under `.forgerelay/skills` and the active ForgeRelay config directory. Global Agent runtime directories such as `~/.agents/skills` and `FORGERELAY_AGENT_DIR/skills` are not scanned automatically.
 
-When the same Skill name appears in more than one source, the first source wins. Project Skills therefore override same-named global `~/.agents/skills` entries, matching ForgeRelay's project-over-global configuration model.
+When the same Skill name appears in more than one source, the first source wins: project Agent Skills override project ForgeRelay Skills, which override system ForgeRelay Skills and explicit additional paths.
 
 When subagents are enabled, canonical v1.2 profiles are discovered from:
 

package/docs/gotchas.md

@@ -192,15 +192,14 @@ Skills are enabled by default. Check:
 FORGERELAY_SKILLS=1 forgerelay serve
 ```
 
-Standard paths include:
+Standard automatic discovery paths include:
 
 - project `.agents/skills`
-- `~/.agents/skills`
+- project `.forgerelay/skills`
 - active ForgeRelay config `skills` directory (`~/.forgerelay/skills` by default)
-- `FORGERELAY_AGENT_DIR/skills`
-- additional `FORGERELAY_SKILL_PATHS`
+- additional paths explicitly configured through `FORGERELAY_SKILL_PATHS`
 
-`.agents/skills` is an external/open Agent Skill source and may contain symlinks managed by other Agent tooling. ForgeRelay-owned Skills belong under its own config `skills` directory and must not be migrated into `.agents/skills`.
+ForgeRelay does **not** automatically scan global Agent runtime Skill directories such as `~/.agents/skills` or `FORGERELAY_AGENT_DIR/skills`. Project `.agents/skills` remains the open Agent Skills source, while ForgeRelay-owned project/system Skills live under `.forgerelay/skills` and the active ForgeRelay config `skills` directory.
 
 ## Subagent profiles do not appear
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akira-tl/forgerelay",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "description": "Local development control plane for MCP coding agents.",
   "type": "module",
   "homepage": "https://github.com/Akira-TL/forgerelay#readme",