[SaladDay]

Problem

1. ACP registry stuck at 0.2.7. @minimax-ai/code 0.4.0+ ships two bins (mcode, mcode-tools), so the registry's npx @minimax-ai/code acp fails with could not determine executable to run. The registry's hourly bump runs a launch check first, so every bump since 0.4.0 has been dropped. mcode-tools can't be removed (the desktop app and the self-updater need it).
2. Shared .builtin-skills gets wiped. seedBuiltinSkills ran rmSync on the whole ~/.minimax/.builtin-skills dir whenever the fingerprint marker didn't match. The desktop app uses the same dir, so starting the CLI/ACP agent deleted desktop-only skills such as mavis and create-agent. A failed reset (EPERM) also skipped the whole seed.

Fix

• packages/local-runtime/src/skills/seed-builtin.ts: on a mismatch, only the dirs of skills this seed ships are replaced. Anything else in the dir, like another host's skills or user files, is left alone. Each skill's rm and copy failures (EPERM/EACCES/EBUSY) are logged and kept to that skill. The marker is withheld, so the next start retries.
• New test packages/local-runtime/test/unit/seed-builtin-shared-dir.test.ts. It covers two cases: foreign skills and files survive a reseed while owned skills refresh, and a dest dir that can't be written doesn't throw. Both tests fail on the old code. The test is registered in test/vitest-suites.json and release/public-source.json.
• packages/code-acp: @minimax-ai/code-acp is a single-bin launcher (code-acp) that runs the mcode bin of a pinned @minimax-ai/code and forwards args, stdio, signals and the exit code. It is not a pnpm workspace member, so the lockfile is unchanged.
• .github/workflows/cli-release.yml: new opt-in job publish-acp, enabled when vars.MCODE_ACP_PUBLISH == 'true' and using secrets.NPM_TOKEN. It waits for @minimax-ai/code@<ver> to appear on npm, then publishes @minimax-ai/code-acp@<ver> with the dependency pinned to that version. It skips if that version is already published and uses the next tag for prereleases.

After this is merged and published, the ACP registry entry changes to "package": "@minimax-ai/code-acp@<ver>", "args": ["acp"].

Verification

All runs used Node 24 on Linux. I packed this branch's build as a @minimax-ai/code tgz with both bins, plus a code-acp tgz that depends on it.

• Control: npx -y file:minimax-ai-code-0.6.5.tgz acp fails with could not determine executable to run.
• npx -y file:minimax-ai-code-acp-0.6.5.tgz acp, in a fresh HOME with fake desktop .builtin-skills/{mavis,create-agent} and agents/.builtin/mavis/agent.md already in place:
  • initialize returns agentInfo {name: minimax-code, version: 0.6.5}.
  • session/new returns -32000 Authentication required (expected, since there is no login).
  • Built-in skills get seeded next to the foreign ones. mavis, create-agent and agent.md all survive.
• I ran it 3 times in the same HOME. The 3rd run used a stale marker and a corrupted owned init/SKILL.md. The owned skill was restored and the foreign skills survived every time.
• ACP registry verify_agents.py --agent minimax-code and --auth-check, with the entry pointed at the local tgz: both report "All tests passed".
• vitest packages/local-runtime: 86 files, 2308 passed, 36 skipped. scripts/source-inventory.mjs passes.

Not verified: the logged-in prompt flow, Windows, and a real npm publish or Actions run of publish-acp.

Notes

• The desktop app and the CLI each write their own value to the shared .seed-fingerprint. If you alternate between them, each start refreshes its own skills. That is harmless, just extra writes.
• If the CLI retires a skill, its stale copy stays in the dir. It is no longer deleted along with everything else.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}