commandmate 0.11.3 → 0.12.0

package/dist/server/src/config/activity-bar-config.js

@@ -31,6 +31,8 @@ exports.ACTIVITIES = [
     { id: 'timer', labelKey: 'activityBar.timer', icon: lucide_react_1.Timer },
     // Issue #1015: branch-scoped ToDo list.
     { id: 'todo', labelKey: 'activityBar.todo', icon: lucide_react_1.ListTodo },
+    // Issue #1441: worktree-scoped Skill install/uninstall management.
+    { id: 'skills', labelKey: 'activityBar.skills', icon: lucide_react_1.Sparkles },
 ];
 /**
  * Set of valid ActivityId values for runtime validation.

package/dist/server/src/config/git-status-config.js

@@ -0,0 +1,83 @@
+"use strict";
+/**
+ * Git status polling configuration
+ * Issue #779: git status API + GitPane Current Status (Phase 1/5)
+ *
+ * Semantic separation from file-polling-config: GitPane's Current Status
+ * section polls `GET /api/worktrees/[id]/git/status` on its own cadence.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GIT_PROGRESS_POLL_INTERVAL_MS = exports.GIT_PUSH_TIMEOUT_MS = exports.GIT_PULL_TIMEOUT_MS = exports.GIT_FETCH_TIMEOUT_MS = exports.MAX_STASH_INDEX = exports.MAX_COMMIT_MESSAGE_LENGTH = exports.MAX_GIT_FILES = exports.GIT_WRITE_TIMEOUT_MS = exports.GIT_STATUS_POLL_INTERVAL_MS = void 0;
+/**
+ * Polling interval (ms) for GitPane's Current Status section.
+ * Issue #779: drives `useFilePolling` in GitPane (visibilitychange-aware).
+ */
+exports.GIT_STATUS_POLL_INTERVAL_MS = 5000;
+// =============================================================================
+// Issue #780: stage / unstage / commit operations
+// =============================================================================
+/**
+ * Timeout (ms) for git WRITE operations (add / restore --staged / commit) and
+ * for the staged-status read used by those flows. Deliberately larger than the
+ * 1s `GIT_COMMAND_TIMEOUT_MS` used by getGitStatus (#779) because write ops can
+ * run pre-commit hooks and stage large numbers of files.
+ */
+exports.GIT_WRITE_TIMEOUT_MS = 30000;
+/**
+ * Maximum number of file paths accepted in a single stage / unstage request.
+ * Requests exceeding this are rejected with HTTP 400 to bound argv size and
+ * per-request work.
+ */
+exports.MAX_GIT_FILES = 1000;
+/**
+ * Maximum length (characters) of a commit message. Messages exceeding this are
+ * rejected with HTTP 400.
+ */
+exports.MAX_COMMIT_MESSAGE_LENGTH = 10000;
+// =============================================================================
+// Issue #782: stash + reset/revert (Phase 4/5 - Danger Zone)
+// =============================================================================
+/**
+ * Maximum accepted `index` for the stash pop/apply/drop routes (Issue #782).
+ * The index is validated to be `/^\d+$/` and <= this bound before it is
+ * embedded into the `stash@{N}` argv (DoS / absurd-index defense). Mirrors the
+ * MAX_GIT_FILES (#780) / MAX_BRANCH_REF_LENGTH (#781) bounding pattern.
+ */
+exports.MAX_STASH_INDEX = 1000;
+// =============================================================================
+// Issue #783: network operations (Phase 5/5 - push / pull / fetch)
+// =============================================================================
+/**
+ * Timeout (ms) for `git fetch`. Larger than the 1s `GIT_COMMAND_TIMEOUT_MS`
+ * (status read) and the 30s `GIT_WRITE_TIMEOUT_MS` line: a fetch contacts the
+ * remote and may run longer than a local index write. fetch is NOT serialized
+ * (§6.1) — it only updates remote-tracking refs / packed-refs.
+ */
+exports.GIT_FETCH_TIMEOUT_MS = 30000;
+/**
+ * Timeout (ms) for `git pull`. 60s because a pull does a fetch AND a merge/rebase
+ * over the working tree (slower than a bare fetch). Serialized per worktree.
+ */
+exports.GIT_PULL_TIMEOUT_MS = 60000;
+/**
+ * Timeout (ms) for `git push`. 60s because a push uploads objects to a remote
+ * over the network (the slowest network op). Serialized per worktree.
+ */
+exports.GIT_PUSH_TIMEOUT_MS = 60000;
+/**
+ * DR1-003: This is NOT a server progress-polling interval. There is NO server
+ * progress endpoint; the route holds the git process until completion and the
+ * awaited Promise is the only true state-transition source. This constant is an
+ * OPTIONAL client-side elapsed-time tick (zero server round-trips) used only to
+ * re-render the elapsed seconds while a network op is in-flight. A plain spinner
+ * is sufficient, so this may go unused. The name is kept for compatibility with
+ * the Issue body's "progress polling" wording (its true role is documented here).
+ */
+exports.GIT_PROGRESS_POLL_INTERVAL_MS = 1000; // optional elapsed-time tick (in-flight only; NOT server progress)
+// Issue #1277: the GitPane warning/guidance strings that used to live here
+// (CHECKOUT_*_WARNING / RESET_HARD_HISTORY_LOSS_WARNING /
+// DANGER_ZONE_RUNNING_SESSION_WARNING / PUSH_AUTH_FAILED_GUIDANCE /
+// PUSH_PROTECTED_BRANCH_WARNING) were hardcoded Japanese rendered to every
+// locale. They now live in the `worktree` dictionary under `git.*` and are
+// resolved with useTranslations at the render site. Do not reintroduce
+// user-facing prose in this config module.

package/dist/server/src/config/skill-security-config.js

@@ -0,0 +1,139 @@
+"use strict";
+/**
+ * Skill fetch/snapshot security policy (Issue #1229)
+ *
+ * Single source of truth for *where* CommandMate is allowed to fetch Skill
+ * documents from and *how much* it is allowed to keep on disk. Every value here
+ * is a hardcoded constant: none of it may be derived from environment
+ * variables, config files or client input, because that is exactly the SSRF
+ * lever this module exists to remove (OWASP A10:2021, same rule as
+ * `GITHUB_API_URL` in src/lib/version-checker.ts).
+ *
+ * Catalog JSON and release assets get *separate* policies: they are served by
+ * different origins with different media types, and a Catalog response must
+ * never be accepted where an artifact is expected (or vice versa).
+ *
+ * @module config/skill-security-config
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SKILL_PLAN_SWEEP_INTERVAL_MS = exports.SKILL_SNAPSHOT_ID_PATTERN = exports.SKILL_SNAPSHOT_ID_BYTES = exports.SKILL_SNAPSHOT_MAX_COUNT = exports.SKILL_SNAPSHOT_TOTAL_QUOTA_BYTES = exports.SKILL_SNAPSHOT_TTL_MS = exports.SKILL_SNAPSHOT_FILE_MODE = exports.SKILL_SNAPSHOT_DIR_MODE = exports.SKILL_SNAPSHOT_DIRNAME = exports.SKILL_FETCH_USER_AGENT_PREFIX = exports.SKILL_CREDENTIAL_HEADERS = exports.SKILL_FETCH_TOTAL_TIMEOUT_MS = exports.SKILL_FETCH_HEADER_TIMEOUT_MS = exports.SKILL_FETCH_MAX_REDIRECTS = exports.SKILL_SOURCE_POLICIES = exports.SKILL_CATALOG_MAX_SIZE = exports.SKILL_CATALOG_FILENAME = exports.SKILL_OFFICIAL_REPOSITORY = void 0;
+exports.buildSkillCatalogUrl = buildSkillCatalogUrl;
+const skills_1 = require("../lib/skills");
+// =============================================================================
+// Official source coordinates
+// =============================================================================
+/** The only repository Skills may be distributed from in schema_version 1. */
+exports.SKILL_OFFICIAL_REPOSITORY = 'Kewton/commandmate-skills';
+/** Catalog document filename at the repository root. */
+exports.SKILL_CATALOG_FILENAME = 'catalog.json';
+/** Catalog JSON is served by the raw content host, pinned to the official repo. */
+const CATALOG_HOSTS = [
+    { host: 'raw.githubusercontent.com', pathPrefix: `/${exports.SKILL_OFFICIAL_REPOSITORY}/` },
+];
+/** Release asset downloads always start at the release download path. */
+const ARTIFACT_ENTRY_HOSTS = [
+    { host: 'github.com', pathPrefix: `/${exports.SKILL_OFFICIAL_REPOSITORY}/releases/download/` },
+];
+/**
+ * Hosts a release asset download may be redirected to.
+ *
+ * GitHub hands release assets off to a storage CDN with an opaque, signed path,
+ * so no path prefix can be asserted on these hops. The artifact digest check is
+ * what makes that acceptable: a wrong body from an allowed host still fails.
+ */
+const ARTIFACT_REDIRECT_HOSTS = [
+    ...ARTIFACT_ENTRY_HOSTS,
+    { host: 'objects.githubusercontent.com' },
+    { host: 'release-assets.githubusercontent.com' },
+];
+/** Maximum Catalog document size in bytes (4 MiB). */
+exports.SKILL_CATALOG_MAX_SIZE = 4 * 1024 * 1024;
+/**
+ * `raw.githubusercontent.com` serves `.json` as `text/plain`, so the Catalog
+ * policy has to accept it. The document is parsed as JSON regardless of the
+ * declared type, and validated by `validateSkillCatalog` afterwards.
+ */
+const CATALOG_CONTENT_TYPES = ['application/json', 'text/plain'];
+exports.SKILL_SOURCE_POLICIES = {
+    catalog: {
+        kind: 'catalog',
+        entryHosts: CATALOG_HOSTS,
+        redirectHosts: CATALOG_HOSTS,
+        accept: 'application/json',
+        contentTypes: CATALOG_CONTENT_TYPES,
+        maxBytes: exports.SKILL_CATALOG_MAX_SIZE,
+    },
+    artifact: {
+        kind: 'artifact',
+        entryHosts: ARTIFACT_ENTRY_HOSTS,
+        redirectHosts: ARTIFACT_REDIRECT_HOSTS,
+        accept: skills_1.SKILL_ARTIFACT_CONTENT_TYPE,
+        contentTypes: [skills_1.SKILL_ARTIFACT_CONTENT_TYPE, 'application/octet-stream'],
+        maxBytes: skills_1.SKILL_ARTIFACT_MAX_SIZE,
+    },
+};
+// =============================================================================
+// Transport limits
+// =============================================================================
+/** Maximum number of redirect hops before a fetch fails closed. */
+exports.SKILL_FETCH_MAX_REDIRECTS = 5;
+/** Timeout for receiving response headers, in milliseconds. */
+exports.SKILL_FETCH_HEADER_TIMEOUT_MS = 10_000;
+/** Timeout for the whole request including body transfer, in milliseconds. */
+exports.SKILL_FETCH_TOTAL_TIMEOUT_MS = 120_000;
+/**
+ * Request headers dropped when a redirect crosses an origin.
+ *
+ * `fetch` with `redirect: 'manual'` gives us the hop, so credential forwarding
+ * is our responsibility: a signed CDN redirect must never carry a GitHub token.
+ */
+exports.SKILL_CREDENTIAL_HEADERS = [
+    'authorization',
+    'cookie',
+    'proxy-authorization',
+];
+/** Value sent as `User-Agent`, matching the version-checker convention. */
+exports.SKILL_FETCH_USER_AGENT_PREFIX = 'CommandMate';
+// =============================================================================
+// Snapshot store limits
+// =============================================================================
+/** Directory name of the snapshot store under the service-owned data root. */
+exports.SKILL_SNAPSHOT_DIRNAME = 'skill-snapshots';
+/** Snapshot directory mode: service-owned, not group/world readable. */
+exports.SKILL_SNAPSHOT_DIR_MODE = 0o700;
+/** Snapshot file mode: read-only for the owning service account. */
+exports.SKILL_SNAPSHOT_FILE_MODE = 0o400;
+/** Lifetime of an unreferenced snapshot before sweeping, in milliseconds. */
+exports.SKILL_SNAPSHOT_TTL_MS = 30 * 60 * 1000;
+/** Total bytes the snapshot store may hold (256 MiB). */
+exports.SKILL_SNAPSHOT_TOTAL_QUOTA_BYTES = 256 * 1024 * 1024;
+/** Maximum number of concurrently retained snapshots. */
+exports.SKILL_SNAPSHOT_MAX_COUNT = 64;
+/** Random bytes behind an opaque snapshot ID. */
+exports.SKILL_SNAPSHOT_ID_BYTES = 16;
+/** Opaque snapshot ID grammar: lowercase hex of {@link SKILL_SNAPSHOT_ID_BYTES}. */
+exports.SKILL_SNAPSHOT_ID_PATTERN = /^[0-9a-f]{32}$/;
+/**
+ * How often the background sweeper reclaims expired plans and snapshots.
+ *
+ * Short relative to both TTLs so an abandoned plan releases its snapshot within
+ * a minute of expiring, rather than waiting for the next plan to be created.
+ */
+exports.SKILL_PLAN_SWEEP_INTERVAL_MS = 60 * 1000;
+// =============================================================================
+// URL construction
+// =============================================================================
+/**
+ * Build the Catalog URL for an immutable commit.
+ *
+ * Takes a resolved 40-hex commit rather than a branch so the Catalog a user
+ * reviewed is the Catalog that gets installed. Callers never supply a URL.
+ *
+ * @throws Error when the commit is not a resolved 40-hex SHA
+ */
+function buildSkillCatalogUrl(commit) {
+    if (!skills_1.GIT_COMMIT_SHA_PATTERN.test(commit)) {
+        throw new Error('Skill catalog URL requires a resolved 40-hex commit SHA');
+    }
+    return `https://raw.githubusercontent.com/${exports.SKILL_OFFICIAL_REPOSITORY}/${commit}/${exports.SKILL_CATALOG_FILENAME}`;
+}

package/dist/server/src/lib/db/migrations/index.js

@@ -27,6 +27,10 @@ const v40_timer_error_1 = require("./v40-timer-error");
 const v41_push_subscriptions_1 = require("./v41-push-subscriptions");
 const v42_push_subscription_locale_1 = require("./v42-push-subscription-locale");
 const v43_remove_cm_root_dir_ghost_repository_1 = require("./v43-remove-cm-root-dir-ghost-repository");
+const v44_skill_operations_1 = require("./v44-skill-operations");
+const v45_skill_installations_1 = require("./v45-skill-installations");
+const v46_skill_installations_cascade_1 = require("./v46-skill-installations-cascade");
+const v47_skill_installations_roots_1 = require("./v47-skill-installations-roots");
 /**
  * Complete ordered list of all migrations.
  * Used internally by the barrel file (db-migrations.ts); NOT exported from the barrel (DR2-004).
@@ -57,4 +61,8 @@ exports.migrations = [
     ...v41_push_subscriptions_1.v41_migrations,
     ...v42_push_subscription_locale_1.v42_migrations,
     ...v43_remove_cm_root_dir_ghost_repository_1.v43_migrations,
+    ...v44_skill_operations_1.v44_migrations,
+    ...v45_skill_installations_1.v45_migrations,
+    ...v46_skill_installations_cascade_1.v46_migrations,
+    ...v47_skill_installations_roots_1.v47_migrations,
 ];

package/dist/server/src/lib/db/migrations/runner.js

@@ -17,7 +17,7 @@ const path_1 = __importDefault(require("path"));
  * Current schema version
  * Increment this when adding new migrations
  */
-exports.CURRENT_SCHEMA_VERSION = 43;
+exports.CURRENT_SCHEMA_VERSION = 47;
 /**
  * Get current schema version from database
  */

package/dist/server/src/lib/db/migrations/v44-skill-operations.js

@@ -0,0 +1,81 @@
+"use strict";
+/**
+ * Migration v44: append-only skill_operations audit log (Issue #1234).
+ *
+ * One row per audit event, not per operation: a single operationId appends a row
+ * when it fails and another when reconciliation converges it, so the sequence of
+ * events survives instead of being overwritten. Append-only is enforced in the
+ * database by BEFORE UPDATE/DELETE triggers rather than by convention, so a bug
+ * or a direct sqlite3 session cannot silently rewrite history.
+ *
+ * Source coordinates (repository/ref/resolved commit/artifact digest) are stored
+ * as separate columns so an install can be traced back to an immutable source
+ * without parsing a blob. No column holds a URL, token or machine-absolute path.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.v44_migrations = void 0;
+exports.v44_migrations = [
+    {
+        version: 44,
+        name: 'add-skill-operations',
+        up: (db) => {
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS skill_operations (
+          id TEXT PRIMARY KEY,
+          operation_id TEXT NOT NULL,
+          idempotency_key TEXT NOT NULL,
+          binding_hash TEXT NOT NULL,
+          operation TEXT NOT NULL,
+          state TEXT NOT NULL,
+          result TEXT NOT NULL,
+          actor_type TEXT NOT NULL,
+          actor_id TEXT,
+          worktree_id TEXT NOT NULL,
+          skill_id TEXT NOT NULL,
+          skill_version TEXT,
+          source_origin TEXT,
+          source_repository TEXT,
+          source_ref TEXT,
+          source_commit TEXT,
+          artifact_sha256 TEXT,
+          error_code TEXT,
+          error_message TEXT,
+          recorded_at INTEGER NOT NULL
+        );
+      `);
+            db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_skill_operations_operation_id
+          ON skill_operations(operation_id);
+      `);
+            db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_skill_operations_idempotency_key
+          ON skill_operations(idempotency_key);
+      `);
+            db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_skill_operations_target
+          ON skill_operations(worktree_id, skill_id, recorded_at);
+      `);
+            db.exec(`
+        CREATE TRIGGER IF NOT EXISTS skill_operations_no_update
+        BEFORE UPDATE ON skill_operations
+        BEGIN
+          SELECT RAISE(ABORT, 'skill_operations is append-only');
+        END;
+      `);
+            db.exec(`
+        CREATE TRIGGER IF NOT EXISTS skill_operations_no_delete
+        BEFORE DELETE ON skill_operations
+        BEGIN
+          SELECT RAISE(ABORT, 'skill_operations is append-only');
+        END;
+      `);
+        },
+        down: (db) => {
+            // Triggers first: the delete guard would otherwise be the only thing
+            // standing between a rollback and an ABORT on any later cleanup.
+            db.exec('DROP TRIGGER IF EXISTS skill_operations_no_delete;');
+            db.exec('DROP TRIGGER IF EXISTS skill_operations_no_update;');
+            db.exec('DROP TABLE IF EXISTS skill_operations;');
+        },
+    },
+];

package/dist/server/src/lib/db/migrations/v45-skill-installations.js

@@ -0,0 +1,59 @@
+"use strict";
+/**
+ * Migration v45: `skill_installations` index (Issue #1235).
+ *
+ * One row per (worktree, skill): the index answers "what is installed here"
+ * without walking every worktree on disk. It is an *index*, not the truth — the
+ * receipt inside `.agents/skills/<id>/` is. That ordering is what lets a crash
+ * between the atomic rename and this row be reconciled forward (#1234) instead
+ * of being reported as a rollback that the filesystem contradicts.
+ *
+ * `receipt_sha256` is the join back to the payload: reconciliation compares it
+ * against the receipt actually on disk, so a row that describes a different
+ * install than the one present is detectable rather than merely stale.
+ *
+ * No column holds a URL, a token or a machine-absolute path; `install_root` is
+ * repository-relative by construction.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.v45_migrations = void 0;
+exports.v45_migrations = [
+    {
+        version: 45,
+        name: 'add-skill-installations',
+        up: (db) => {
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS skill_installations (
+          id TEXT PRIMARY KEY,
+          worktree_id TEXT NOT NULL,
+          skill_id TEXT NOT NULL,
+          version TEXT NOT NULL,
+          install_root TEXT NOT NULL,
+          receipt_sha256 TEXT NOT NULL,
+          source_repository TEXT NOT NULL,
+          source_ref TEXT NOT NULL,
+          source_commit TEXT NOT NULL,
+          artifact_sha256 TEXT NOT NULL,
+          effective_risk TEXT NOT NULL,
+          operation_id TEXT NOT NULL,
+          installed_at INTEGER NOT NULL,
+          updated_at INTEGER NOT NULL,
+          UNIQUE (worktree_id, skill_id)
+        );
+      `);
+            db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_skill_installations_worktree
+          ON skill_installations(worktree_id);
+      `);
+            db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_skill_installations_skill
+          ON skill_installations(skill_id, version);
+      `);
+        },
+        down: (db) => {
+            db.exec('DROP INDEX IF EXISTS idx_skill_installations_skill;');
+            db.exec('DROP INDEX IF EXISTS idx_skill_installations_worktree;');
+            db.exec('DROP TABLE IF EXISTS skill_installations;');
+        },
+    },
+];

package/dist/server/src/lib/db/migrations/v46-skill-installations-cascade.js

@@ -0,0 +1,107 @@
+"use strict";
+/**
+ * Migration v46: `skill_installations` follows the worktree it belongs to (Issue #1430).
+ *
+ * v45 created the table with `worktree_id TEXT NOT NULL` and no foreign key, so
+ * deleting a worktree left its install rows behind forever (`UNIQUE(worktree_id,
+ * skill_id)` keeps them). Recreating a worktree at the same path mints a new
+ * UUID, so the UI reports "not installed" while the payload and receipt are
+ * still on disk: re-install fails with SKILL_INSTALL_DESTINATION_EXISTS and
+ * uninstall has no record to act on.
+ *
+ * The fix follows the convention every other worktree-scoped table already uses
+ * — `ON DELETE CASCADE` — rather than an explicit DELETE at one call site. Two
+ * reasons beyond consistency: `deleteWorktreesByIds` is not the only path that
+ * removes a worktree row, and `migrateWorktreeIdPreservingChildren` (#1151)
+ * discovers child tables through `PRAGMA foreign_key_list`, so the constraint is
+ * also what makes a same-directory branch switch *carry* installs forward
+ * instead of orphaning them.
+ *
+ * SQLite cannot add a constraint in place, so the table is rebuilt (same pattern
+ * as v33). Rows whose worktree is already gone are dropped by the copy filter,
+ * which is what clears the dangling rows existing databases have accumulated —
+ * `PRAGMA foreign_keys` cannot be toggled inside the migration transaction, so
+ * the filter must be in the SELECT rather than deferred to the constraint.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.v46_migrations = void 0;
+const COLUMNS = `
+  id, worktree_id, skill_id, version, install_root, receipt_sha256,
+  source_repository, source_ref, source_commit, artifact_sha256,
+  effective_risk, operation_id, installed_at, updated_at
+`;
+const COLUMN_DEFINITIONS = `
+  id TEXT PRIMARY KEY,
+  worktree_id TEXT NOT NULL,
+  skill_id TEXT NOT NULL,
+  version TEXT NOT NULL,
+  install_root TEXT NOT NULL,
+  receipt_sha256 TEXT NOT NULL,
+  source_repository TEXT NOT NULL,
+  source_ref TEXT NOT NULL,
+  source_commit TEXT NOT NULL,
+  artifact_sha256 TEXT NOT NULL,
+  effective_risk TEXT NOT NULL,
+  operation_id TEXT NOT NULL,
+  installed_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL,
+  UNIQUE (worktree_id, skill_id)
+`;
+function createIndexes(db) {
+    db.exec(`
+    CREATE INDEX IF NOT EXISTS idx_skill_installations_worktree
+      ON skill_installations(worktree_id);
+  `);
+    db.exec(`
+    CREATE INDEX IF NOT EXISTS idx_skill_installations_skill
+      ON skill_installations(skill_id, version);
+  `);
+}
+exports.v46_migrations = [
+    {
+        version: 46,
+        name: 'skill-installations-worktree-cascade',
+        up: (db) => {
+            db.exec(`
+        CREATE TABLE skill_installations_new (
+          ${COLUMN_DEFINITIONS},
+          FOREIGN KEY (worktree_id) REFERENCES worktrees(id) ON DELETE CASCADE
+        );
+      `);
+            // The WHERE clause is the dangling-row sweep: rows pointing at a worktree
+            // that no longer exists are not carried over.
+            db.exec(`
+        INSERT INTO skill_installations_new (${COLUMNS})
+        SELECT ${COLUMNS} FROM skill_installations
+        WHERE worktree_id IN (SELECT id FROM worktrees);
+      `);
+            const dangling = db
+                .prepare(`SELECT COUNT(*) AS n FROM skill_installations
+           WHERE worktree_id NOT IN (SELECT id FROM worktrees)`)
+                .get();
+            // Dropping the table drops its indexes too; recreate them on the new one.
+            db.exec('DROP TABLE skill_installations;');
+            db.exec('ALTER TABLE skill_installations_new RENAME TO skill_installations;');
+            createIndexes(db);
+            if (dangling.n > 0) {
+                console.log(`Removed ${dangling.n} skill_installations row(s) with no worktree`);
+            }
+            console.log('skill_installations now cascades with its worktree');
+        },
+        down: (db) => {
+            db.exec(`
+        CREATE TABLE skill_installations_old (
+          ${COLUMN_DEFINITIONS}
+        );
+      `);
+            db.exec(`
+        INSERT INTO skill_installations_old (${COLUMNS})
+        SELECT ${COLUMNS} FROM skill_installations;
+      `);
+            db.exec('DROP TABLE skill_installations;');
+            db.exec('ALTER TABLE skill_installations_old RENAME TO skill_installations;');
+            createIndexes(db);
+            console.log('Rolled back skill_installations cascade (v46)');
+        },
+    },
+];

package/dist/server/src/lib/db/migrations/v47-skill-installations-roots.js

@@ -0,0 +1,70 @@
+"use strict";
+/**
+ * Migration v47: `skill_installations.install_roots` (Issue #1460).
+ *
+ * A package is now placed into more than one discovery root — `.agents/skills`
+ * (Codex) and `.claude/skills` (Claude) — so the index needs to record the full
+ * set, not just the primary `install_root`. The column is a JSON array of
+ * repository-relative roots, primary first.
+ *
+ * Nullable and added by `ALTER TABLE`, so it is backward compatible: rows written
+ * before this migration keep `install_root` and read back as the single root they
+ * name. The on-disk receipt remains the source of truth; this column, like the
+ * rest of the row, is a rebuildable index over it (#1235).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.v47_migrations = void 0;
+exports.v47_migrations = [
+    {
+        version: 47,
+        name: 'add-skill-installations-roots',
+        up: (db) => {
+            db.exec('ALTER TABLE skill_installations ADD COLUMN install_roots TEXT;');
+        },
+        down: (db) => {
+            // SQLite < 3.35 cannot DROP COLUMN; rebuild the table without it. The
+            // column is nullable and index-only, so no data of record is lost.
+            db.exec(`
+        CREATE TABLE skill_installations__v46 (
+          id TEXT PRIMARY KEY,
+          worktree_id TEXT NOT NULL,
+          skill_id TEXT NOT NULL,
+          version TEXT NOT NULL,
+          install_root TEXT NOT NULL,
+          receipt_sha256 TEXT NOT NULL,
+          source_repository TEXT NOT NULL,
+          source_ref TEXT NOT NULL,
+          source_commit TEXT NOT NULL,
+          artifact_sha256 TEXT NOT NULL,
+          effective_risk TEXT NOT NULL,
+          operation_id TEXT NOT NULL,
+          installed_at INTEGER NOT NULL,
+          updated_at INTEGER NOT NULL,
+          UNIQUE (worktree_id, skill_id)
+        );
+      `);
+            db.exec(`
+        INSERT INTO skill_installations__v46 (
+          id, worktree_id, skill_id, version, install_root, receipt_sha256,
+          source_repository, source_ref, source_commit, artifact_sha256,
+          effective_risk, operation_id, installed_at, updated_at
+        )
+        SELECT
+          id, worktree_id, skill_id, version, install_root, receipt_sha256,
+          source_repository, source_ref, source_commit, artifact_sha256,
+          effective_risk, operation_id, installed_at, updated_at
+        FROM skill_installations;
+      `);
+            db.exec('DROP TABLE skill_installations;');
+            db.exec('ALTER TABLE skill_installations__v46 RENAME TO skill_installations;');
+            db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_skill_installations_worktree
+          ON skill_installations(worktree_id);
+      `);
+            db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_skill_installations_skill
+          ON skill_installations(skill_id, version);
+      `);
+        },
+    },
+];

package/dist/server/src/lib/db/worktree-db.js

@@ -523,8 +523,11 @@ function getWorktreesByRepository(db, repositoryPath) {
 }
 /**
  * Delete all worktrees for a given repository path
- * Related data (chat_messages, session_states, worktree_memos, worktree_todos)
- * will be automatically deleted via CASCADE foreign key constraints.
+ * Related data is automatically deleted via ON DELETE CASCADE in every table
+ * holding a foreign key to worktrees(id) — chat_messages, session_states,
+ * worktree_memos, worktree_todos, agent_instances, scheduled_executions,
+ * execution_logs, timer_messages and skill_installations (#1430). The live list
+ * is whatever `PRAGMA foreign_key_list` reports; see getWorktreeChildTables.
  *
  * @param db - Database instance
  * @param repositoryPath - Path of the repository to delete
@@ -539,8 +542,10 @@ function deleteRepositoryWorktrees(db, repositoryPath) {
 }
 /**
  * Delete worktrees by their IDs
- * Related data (chat_messages, session_states, worktree_memos, worktree_todos)
- * will be automatically deleted via CASCADE foreign key constraints.
+ * Related data is automatically deleted via ON DELETE CASCADE in every table
+ * holding a foreign key to worktrees(id) — including skill_installations, whose
+ * rows used to survive the worktree and make a re-created worktree at the same
+ * path un-installable (#1430). See getWorktreeChildTables for the live list.
  *
  * @param db - Database instance
  * @param worktreeIds - Array of worktree IDs to delete