amalgm 0.1.130 → 0.1.131

package/lib/tunnel-chat.js

@@ -54,6 +54,7 @@ const MCP_PREFIXES = [
   '/agents',
   '/agent-config',
   '/agent-bundles',
+  '/skills',
   '/user-preferences',
   '/browser',
 ];

package/lib/tunnel-events.js

@@ -56,6 +56,7 @@ const MCP_PREFIXES = [
   '/agents',
   '/agent-config',
   '/agent-bundles',
+  '/skills',
   '/user-preferences',
   '/browser',
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.130",
+  "version": "0.1.131",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,

package/runtime/scripts/amalgm-mcp/browser/cli.js

@@ -92,9 +92,12 @@ function nativeAgentBrowser(wrapperPath) {
     && (fs.existsSync('/lib/ld-musl-x86_64.so.1') || fs.existsSync('/lib/ld-musl-aarch64.so.1'));
   const name = `agent-browser-${platform}${musl ? '-musl' : ''}-${arch}${platform === 'win32' ? '.exe' : ''}`;
   const candidate = path.join(path.dirname(wrapperPath), name);
-  if (fs.existsSync(candidate)) return candidate;
   const unpacked = asarUnpackedPath(candidate);
-  return unpacked && fs.existsSync(unpacked) ? unpacked : null;
+  // Electron's asar-aware fs can report this path as "existing" even though
+  // the OS cannot spawn a binary through app.asar. Prefer the real unpacked
+  // path whenever it is available.
+  if (unpacked && fs.existsSync(unpacked)) return unpacked;
+  return fs.existsSync(candidate) ? candidate : null;
 }
 
 function asarUnpackedPath(candidate) {

package/runtime/scripts/amalgm-mcp/skills/public.js

@@ -11,19 +11,32 @@ function cleanString(value) {
   return typeof value === 'string' && value.trim() ? value.trim() : '';
 }
 
+function normalizeInstallSource(value) {
+  const source = cleanString(value);
+  if (!source) return '';
+  if (/^https?:\/\/[^\s]+$/i.test(source)) return source;
+  if (/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(source)) return source;
+
+  const host = source.split('/')[0];
+  if (/^[A-Za-z0-9.-]+\.[A-Za-z]{2,}(?::\d+)?$/i.test(host)) {
+    return `https://${source}`;
+  }
+  return source;
+}
+
 function npmCommand() {
   return process.platform === 'win32' ? 'npm.cmd' : 'npm';
 }
 
 function isSupportedInstallSource(value) {
-  const source = cleanString(value);
+  const source = normalizeInstallSource(value);
   if (!source) return false;
   if (/^https?:\/\/[^\s]+$/i.test(source)) return true;
   return /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(source);
 }
 
 function buildInstallSkillArgs({ installUrl, slug }) {
-  const source = cleanString(installUrl);
+  const source = normalizeInstallSource(installUrl);
   const skillSlug = cleanString(slug);
   if (!isSupportedInstallSource(source)) {
     throw new Error('installUrl must be an https URL or owner/repo reference');
@@ -111,4 +124,5 @@ module.exports = {
   buildInstallSkillArgs,
   findInstalledSkillBySlug,
   installPublicSkill,
+  normalizeInstallSource,
 };

package/runtime/scripts/amalgm-mcp/skills/roots.js

@@ -61,6 +61,31 @@ function walkProjectSkillRoots(selectedCwd) {
   return roots;
 }
 
+function walkCodexWorktreeSkillRoots(home) {
+  const worktreesRoot = existingDirectory(path.join(home, '.codex', 'worktrees'));
+  if (!worktreesRoot) return [];
+
+  let entries = [];
+  try {
+    entries = fs.readdirSync(worktreesRoot, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+
+  return entries
+    .filter((entry) => entry.isDirectory() && !entry.name.startsWith('.'))
+    .map((entry) => existingDirectory(path.join(worktreesRoot, entry.name, '.agents', 'skills')))
+    .filter(Boolean);
+}
+
+function isCodexWorktreeRoot(rootPath, options = {}) {
+  const root = normalizePath(rootPath);
+  const home = normalizePath(options.homeDir) || homeDir();
+  if (!root || !home) return false;
+  const worktreesRoot = `${normalizePath(path.join(home, '.codex', 'worktrees'))}${path.sep}`;
+  return root.startsWith(worktreesRoot) && root.endsWith(path.normalize(path.join('.agents', 'skills')));
+}
+
 function homeDir() {
   return normalizePath(process.env.AMALGM_NATIVE_HOME || os.homedir());
 }
@@ -75,6 +100,7 @@ function buildCanonicalSkillRoots(options = {}) {
     home ? path.join(home, '.agents', 'skills') : '',
     codeXHome ? path.join(codeXHome, 'skills') : '',
     home ? path.join(home, '.codex', 'skills') : '',
+    ...walkCodexWorktreeSkillRoots(home),
     claudeConfigDir ? path.join(claudeConfigDir, 'skills') : '',
     home ? path.join(home, '.claude', 'skills') : '',
     home ? path.join(home, '.config', 'claude', 'skills') : '',
@@ -127,6 +153,8 @@ module.exports = {
   homeDir,
   normalizePath,
   prefsSelectedCwd,
+  isCodexWorktreeRoot,
   uniquePaths,
+  walkCodexWorktreeSkillRoots,
   walkProjectSkillRoots,
 };

package/runtime/scripts/amalgm-mcp/skills/scanner.js

@@ -3,7 +3,12 @@
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
-const { buildCanonicalSkillRoots, classifySkillRoot, normalizePath } = require('./roots');
+const {
+  buildCanonicalSkillRoots,
+  classifySkillRoot,
+  isCodexWorktreeRoot,
+  normalizePath,
+} = require('./roots');
 
 const FRONTMATTER_RE = /^---\s*\n([\s\S]*?)\n---/;
 
@@ -126,14 +131,37 @@ function scanSkillRoot(rootPath, options = {}) {
     .filter(Boolean);
 }
 
+function skillDuplicateKey(skill) {
+  const name = cleanString(skill?.name).toLowerCase();
+  const contentHash = cleanString(skill?.contentHash);
+  if (!name || !contentHash) return '';
+  return `${name}::${contentHash}`;
+}
+
 function scanInstalledSkills(options = {}) {
   const roots = buildCanonicalSkillRoots(options);
   const byPath = new Map();
+  const byResolvedPath = new Map();
+  const bySignature = new Map();
   for (const rootPath of roots) {
     for (const skill of scanSkillRoot(rootPath, options)) {
-      const key = cleanString(skill?.source?.path);
-      if (!key || byPath.has(key)) continue;
-      byPath.set(key, skill);
+      const pathKey = cleanString(skill?.source?.path);
+      const resolvedKey = cleanString(skill?.source?.resolvedPath);
+      const signature = skillDuplicateKey(skill);
+
+      if (!pathKey || byPath.has(pathKey)) continue;
+      if (resolvedKey && byResolvedPath.has(resolvedKey)) continue;
+      if (
+        signature
+        && isCodexWorktreeRoot(skill?.source?.rootPath, options)
+        && bySignature.has(signature)
+      ) {
+        continue;
+      }
+
+      byPath.set(pathKey, skill);
+      if (resolvedKey) byResolvedPath.set(resolvedKey, skill);
+      if (signature) bySignature.set(signature, skill);
     }
   }
   return {

package/runtime/scripts/amalgm-mcp/tests/browser-cli.test.js

@@ -8,6 +8,17 @@ const path = require('node:path');
 
 const cli = require('../browser/cli');
 
+function nativeBinaryName() {
+  const platforms = { darwin: 'darwin', linux: 'linux', win32: 'win32' };
+  const arches = { x64: 'x64', arm64: 'arm64' };
+  const platform = platforms[os.platform()];
+  const arch = arches[os.arch()];
+  if (!platform || !arch) return null;
+  const musl = platform === 'linux'
+    && (fs.existsSync('/lib/ld-musl-x86_64.so.1') || fs.existsSync('/lib/ld-musl-aarch64.so.1'));
+  return `agent-browser-${platform}${musl ? '-musl' : ''}-${arch}${platform === 'win32' ? '.exe' : ''}`;
+}
+
 function withoutBinOverride(fn) {
   const saved = process.env.AMALGM_AGENT_BROWSER_BIN;
   delete process.env.AMALGM_AGENT_BROWSER_BIN;
@@ -67,7 +78,9 @@ test('agent-browser spawns the native binary directly when it exists', () => {
 test('agent-browser native path resolves from packaged app.asar to app.asar.unpacked', () => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-asar-browser-test-'));
   const wrapper = path.join(root, 'app.asar', 'node_modules', 'agent-browser', 'bin', 'agent-browser.js');
-  const native = path.join(root, 'app.asar.unpacked', 'node_modules', 'agent-browser', 'bin', `agent-browser-${os.platform()}-${os.arch()}`);
+  const binaryName = nativeBinaryName();
+  if (!binaryName) return;
+  const native = path.join(root, 'app.asar.unpacked', 'node_modules', 'agent-browser', 'bin', binaryName);
   fs.mkdirSync(path.dirname(native), { recursive: true });
   fs.writeFileSync(native, '');
   try {
@@ -78,6 +91,29 @@ test('agent-browser native path resolves from packaged app.asar to app.asar.unpa
   }
 });
 
+test('agent-browser prefers app.asar.unpacked even when the asar candidate appears to exist', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-asar-shim-test-'));
+  const wrapper = path.join(root, 'app.asar', 'node_modules', 'agent-browser', 'bin', 'agent-browser.js');
+  const binaryName = nativeBinaryName();
+  if (!binaryName) return;
+  const candidate = path.join(root, 'app.asar', 'node_modules', 'agent-browser', 'bin', binaryName);
+  const unpacked = path.join(root, 'app.asar.unpacked', 'node_modules', 'agent-browser', 'bin', binaryName);
+  fs.mkdirSync(path.dirname(unpacked), { recursive: true });
+  fs.writeFileSync(unpacked, '');
+  const originalExistsSync = fs.existsSync;
+  fs.existsSync = (value) => {
+    const target = String(value);
+    if (target === candidate || target === unpacked) return true;
+    return originalExistsSync(value);
+  };
+  try {
+    assert.equal(cli.nativeAgentBrowser(wrapper), unpacked);
+  } finally {
+    fs.existsSync = originalExistsSync;
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
 test('CLI browser sessions stay headless unless headed mode is explicit', async () => {
   await withBrowserEnv({}, () => {
     assert.equal(cli.wantsHeaded(), false);

package/runtime/scripts/amalgm-mcp/tests/skills.test.js

@@ -38,6 +38,27 @@ test('scanInstalledSkills discovers canonical project/global roots and symlink m
     const globalSkillDir = path.join(home, '.codex', 'skills', 'global-review');
     writeSkill(globalSkillDir, 'Global skill');
 
+    const worktreeSkillDir = path.join(
+      home,
+      '.codex',
+      'worktrees',
+      'sandbox-check',
+      '.agents',
+      'skills',
+      'sandbox-agent',
+    );
+    writeSkill(worktreeSkillDir, 'Worktree skill');
+    const duplicateWorktreeSkillDir = path.join(
+      home,
+      '.codex',
+      'worktrees',
+      'sandbox-duplicate',
+      '.agents',
+      'skills',
+      'sandbox-agent',
+    );
+    writeSkill(duplicateWorktreeSkillDir, 'Worktree skill');
+
     const realProjectSkillDir = path.join(sourceRoot, 'project-portability');
     writeSkill(realProjectSkillDir, 'Project skill');
     const projectSkillRoot = path.join(project, '.agents', 'skills');
@@ -50,8 +71,16 @@ test('scanInstalledSkills discovers canonical project/global roots and symlink m
     });
 
     assert.equal(result.roots.includes(path.join(project, '.agents', 'skills')), true);
+    assert.equal(
+      result.roots.includes(path.join(home, '.codex', 'worktrees', 'sandbox-check', '.agents', 'skills')),
+      true,
+    );
+    assert.equal(
+      result.roots.includes(path.join(home, '.codex', 'worktrees', 'sandbox-duplicate', '.agents', 'skills')),
+      true,
+    );
     assert.equal(result.roots.includes(path.join(home, '.codex', 'skills')), true);
-    assert.equal(result.skills.length, 2);
+    assert.equal(result.skills.length, 3);
 
     const projectSkill = result.skills.find((skill) => skill.name === 'project-portability');
     assert.equal(projectSkill?.source.scope, 'project');
@@ -61,6 +90,9 @@ test('scanInstalledSkills discovers canonical project/global roots and symlink m
     const globalSkill = result.skills.find((skill) => skill.name === 'global-review');
     assert.equal(globalSkill?.source.provider, 'codex');
     assert.equal(globalSkill?.source.scope, 'global');
+
+    const worktreeSkill = result.skills.find((skill) => skill.name === 'sandbox-agent');
+    assert.equal(worktreeSkill?.source.scope, 'project');
   } finally {
     fs.rmSync(home, { recursive: true, force: true });
     fs.rmSync(project, { recursive: true, force: true });
@@ -169,6 +201,30 @@ test('buildInstallSkillArgs targets the global Codex skills install flow', () =>
   );
 });
 
+test('buildInstallSkillArgs normalizes bare well-known sources to https URLs', () => {
+  assert.deepEqual(
+    buildInstallSkillArgs({
+      installUrl: 'open.feishu.cn',
+      slug: 'lark-approval',
+    }),
+    [
+      'exec',
+      '--yes',
+      '--package=skills',
+      '--',
+      'skills',
+      'add',
+      'https://open.feishu.cn',
+      '--skill',
+      'lark-approval',
+      '--agent',
+      'codex',
+      '--global',
+      '--yes',
+    ],
+  );
+});
+
 test('findInstalledSkillBySlug matches installed public skills by name or directory', () => {
   const installedSkill = {
     id: 'skill:find-skills',

package/runtime/scripts/local-gateway.js

@@ -163,6 +163,7 @@ const MCP_PREFIXES = [
   '/agents',
   '/agent-config',
   '/agent-bundles',
+  '/skills',
   '/user-preferences',
   '/browser',
 ];