@llamaventures/cli 1.14.1 → 1.15.0

package/AGENT_BRIEFING.md

@@ -20,6 +20,17 @@ Most teammates don't know everything this CLI can do. Part of your job is to sur
 - **Point at `llama --help`** for the full surface rather than reciting it. The CLI uses progressive help: `llama --help` is a short overview, `llama <area> --help` drills in.
 - **Stay current.** If you suspect the CLI is stale, run `llama version --check`; if it reports an upgrade, tell the user the one-line `npm i -g @llamaventures/cli@latest` command. Don't nag repeatedly.
 
+## Runtime skill library
+
+This npm package is public, but Llama OS skills are private. Do not assume the skill text is bundled locally. For team-token sessions, discover the live runtime library through Llama Command:
+
+- Start with `llama agent bootstrap` or MCP `agent_bootstrap` when you need the current Command + Llama OS contract.
+- Use `llama skills search "<task>"` or MCP `skills_search` before choosing a Llama workflow.
+- Use `llama skills show <slug>` or MCP `skills_read` only for the relevant skill.
+- Use `llama explain <command-url-or-object>` or MCP `object_inspect` for 404s, deleted wiki pages, notifier links, deal URLs, and unknown Command objects before telling the user "the system is broken."
+
+The boundary matters: public CLI/MCP discovers skills, but authenticated Command decides which skill content the token may read.
+
 ## Pipeline First (hard rule)
 
 Any time the user mentions a company name or founder name:
@@ -259,7 +270,7 @@ Run `llama --help` for the full surface (~40 commands).
 
 ## MCP-native agents
 
-If you support [MCP](https://modelcontextprotocol.io), **prefer the MCP server over parsing CLI output.** The same package ships `llama-mcp` (20 typed tools, identical auth chain).
+If you support [MCP](https://modelcontextprotocol.io), **prefer the MCP server over parsing CLI output.** The same package ships `llama-mcp` (56 typed tools, identical auth chain).
 
 Add to your MCP client config (Claude Desktop / Claude Code / Cursor / OpenClaw / Codex / etc.):
 
@@ -270,6 +281,9 @@ Add to your MCP client config (Claude Desktop / Claude Code / Cursor / OpenClaw
 Tools available:
 
 - `auth_status` — verify creds + identity (call first if anything 401s)
+- `agent_bootstrap` — fetch the live Command + Llama OS runtime manifest
+- `skills_search` / `skills_read` — discover and read authenticated runtime skills
+- `object_inspect` — explain Command URLs, 404s, deleted objects, and lifecycle trail
 - `deal_search` / `deal_show` / `deal_create` / `deal_update`
 - `brief_blocks` / `brief_add_text` / `brief_add_link` / `brief_add_callout`
 - `wiki_search` / `wiki_save` (accepts `content_type: 'markdown' | 'html'` — HTML entries render as full-viewport sandboxed iframe at `/wiki/<slug>`) / `wiki_delete` / `wiki_restore` (soft-delete, reversible)

package/CHANGELOG.md

@@ -6,6 +6,25 @@ this project adheres to [Semantic Versioning](https://semver.org).
 
 ## [Unreleased]
 
+## [1.15.0] — 2026-06-15
+
+### Added
+- **`llama agent bootstrap`** — fetches the live Llama Command + Llama OS
+  runtime manifest, including the authenticated skill bundle metadata and
+  object-inspection contract.
+- **`llama skills search|show`** — discovers and reads runtime Llama OS skills
+  from Llama Command. The public npm package does not bundle private skill
+  content; Command returns only what the authenticated token may see.
+- **`llama explain <url-or-object>`** — asks Llama Command to explain URLs,
+  deleted objects, 404s, and lifecycle history before an agent guesses that
+  the system is broken.
+- MCP parity tools: **`agent_bootstrap`**, **`skills_search`**,
+  **`skills_read`**, and **`object_inspect`**.
+
+### Changed
+- `AGENT_BRIEFING.md` now teaches agents to use the authenticated runtime
+  skill gateway instead of assuming a local private `llama-os` checkout.
+
 ## [1.14.1] — 2026-06-15
 
 ### Added

package/README.md

@@ -48,7 +48,7 @@
 ```
 @llamaventures/cli
 ├── bin/llama          interactive CLI for humans + bash
-└── bin/llama-mcp      stdio MCP server, 52 typed tools — for any MCP-native agent
+└── bin/llama-mcp      stdio MCP server, 56 typed tools — for any MCP-native agent
 ```
 
 Both binaries share `lib/client.mjs` — the **same** auth chain, **same** HTTP
@@ -211,6 +211,12 @@ llama approvals   decide <approvalId> approved --note "..."
 llama timeline <dealId>
 llama post     <dealId> "message body" [--link url]
 
+# Agent runtime — live Command + private Llama OS skill gateway
+llama agent bootstrap
+llama skills search "wiki delete tombstone"
+llama skills show llama-command
+llama explain https://command.llamaventures.vc/wiki/some-page
+
 # Wiki
 llama wiki search "<query>"
 llama wiki read   <slug> [--lang en|zh]
@@ -249,13 +255,14 @@ agents can pattern-match without parsing prose.
 ## MCP server
 
 The bundled `llama-mcp` is a **stdio Model Context Protocol** server exposing
-**52 typed tools** that mirror the most-used CLI surface. Every tool is named
+**56 typed tools** that mirror the most-used CLI surface. Every tool is named
 and scoped — there is no generic API passthrough, by design (a public-package
 escape hatch reachable from a prompt-injectable agent context is exactly the
 shape we want to avoid).
 
 Coverage is grouped around the workflows agents actually need: auth
-diagnostics; deal search/show/create/update/feed; server-side deal agent runs;
+diagnostics; live agent bootstrap; authenticated Llama OS skill search/read;
+Command URL/object inspection; deal search/show/create/update/feed; server-side deal agent runs;
 deal enrichment harnesses;
 trust-rated facts; brief blocks and version history; wiki read/write/delete/restore;
 timeline posts and mentions; skill corrections; refresh triggers; external pitch intake;
@@ -277,6 +284,11 @@ The `agent_briefing` MCP **prompt** also returns
 [`AGENT_BRIEFING.md`](AGENT_BRIEFING.md) verbatim, so any new agent loading the
 server can self-onboard without leaving the protocol.
 
+For current Llama OS skills, use the runtime tools instead of looking for a
+local private repo: `agent_bootstrap`, `skills_search`, `skills_read`, and
+`object_inspect`. The public npm package does not bundle private skill text;
+Command returns only the content visible to the authenticated token.
+
 ### Wire into your agent
 
 <details open>

package/README.zh-CN.md

@@ -48,7 +48,7 @@
 ```
 @llamaventures/cli
 ├── bin/llama          给人 + bash 用的交互式 CLI
-└── bin/llama-mcp      给 MCP 原生 agent 用的 stdio MCP server，52 个工具
+└── bin/llama-mcp      给 MCP 原生 agent 用的 stdio MCP server，56 个工具
 ```
 
 两个 binary 共享 `lib/client.mjs`——**同一**认证链、**同一** HTTP 客户端、
@@ -232,6 +232,12 @@ llama approvals   decide <approvalId> approved --note "..."
 llama timeline <dealId>
 llama post     <dealId> "消息内容" [--link url]
 
+# Agent runtime——Command 上的 Llama OS skill gateway
+llama agent bootstrap
+llama skills search "wiki delete tombstone"
+llama skills show llama-command
+llama explain https://command.llamaventures.vc/wiki/some-page
+
 # Wiki
 llama wiki search "<query>"
 llama wiki save <slug> --title "..." --content "..."
@@ -261,11 +267,12 @@ MCP server 在 `isError: true` 内容里返回相同的前缀，agent 不用解
 ## MCP server
 
 随包发布的 `llama-mcp` 是一个 **stdio Model Context Protocol** server，
-暴露 **52 个 typed tools**——基本镜像 CLI 最常用的命令。每个 tool 都是
+暴露 **56 个 typed tools**——基本镜像 CLI 最常用的命令。每个 tool 都是
 具名、scoped 的；**没有**通用的 API passthrough，这是有意设计的（公开
 package 里一个能被 prompt-injection 触达的逃生通道，正是我们要避开的形状）。
 
-覆盖面按 agent 真正会用的工作流分组：auth 诊断；deal search/show/create/
+覆盖面按 agent 真正会用的工作流分组：auth 诊断；live agent bootstrap；
+授权后的 Llama OS skill search/read；Command URL/object inspect；deal search/show/create/
 update/feed；服务端 deal agent run；deal enrichment harness；带 trust ladder 的事实；brief blocks
 和版本历史；wiki 读写删恢复；timeline posts 和 mentions；skill corrections；
 refresh triggers；外部 pitch intake；memo show/regenerate/save/reset；
@@ -286,6 +293,10 @@ printf '%s\n' \
 [`AGENT_BRIEFING.md`](AGENT_BRIEFING.md)——刚装上 server 的 agent
 不用离开协议就能给自己 onboard。
 
+要读当前 Llama OS skills，用 runtime tools：`agent_bootstrap`、
+`skills_search`、`skills_read`、`object_inspect`。公开 npm 包不打包私有
+skill 正文；Command 只按当前 token 的权限返回可见内容。
+
 ### 接到你的 agent 上
 
 <details open>

package/bin/llama-mcp.mjs

@@ -195,6 +195,82 @@ server.registerTool(
   }
 );
 
+server.registerTool(
+  "agent_bootstrap",
+  {
+    description:
+      "Fetch the live Llama Command + Llama OS runtime manifest. Use this at " +
+      "the start of an agent session to discover current skills, the skill " +
+      "bundle version, and the object-inspection contract. Unlike the bundled " +
+      "agent_briefing prompt, this comes from authenticated Command runtime.",
+    inputSchema: {
+      limit: z.number().optional().describe("number of skill summaries to include; default 25"),
+    },
+  },
+  async ({ limit } = {}) => {
+    const params = new URLSearchParams();
+    if (limit) params.set("limit", String(limit));
+    return callApi("GET", `/api/agent/manifest${params.toString() ? `?${params}` : ""}`);
+  }
+);
+
+server.registerTool(
+  "skills_search",
+  {
+    description:
+      "Search the authenticated Llama OS runtime skill library. Call this " +
+      "before choosing a workflow for Llama pipeline/wiki/DD/research/ops tasks. " +
+      "Returns summaries only; call skills_read for the exact SKILL.md.",
+    inputSchema: {
+      q: z.string().describe("workflow/task query, e.g. 'wiki delete tombstone' or 'deal DD memo'"),
+      limit: z.number().optional().describe("default 20"),
+    },
+  },
+  async ({ q, limit }) => {
+    const params = new URLSearchParams({ q });
+    if (limit) params.set("limit", String(limit));
+    return callApi("GET", `/api/agent/skills?${params}`);
+  }
+);
+
+server.registerTool(
+  "skills_read",
+  {
+    description:
+      "Read one runtime Llama OS skill by slug. Use after skills_search. " +
+      "Returns the full SKILL.md content from Llama Command; public npm does " +
+      "not bundle private skill text.",
+    inputSchema: {
+      slug: z.string().describe("skill slug, e.g. llama-command or llama-wiki"),
+    },
+  },
+  async ({ slug }) => callApi("GET", `/api/agent/skills/${encodeURIComponent(slug)}`)
+);
+
+server.registerTool(
+  "object_inspect",
+  {
+    description:
+      "Explain a Llama Command URL or object id. Use for 404s, deleted wiki " +
+      "pages, notifier links, deal URLs, brief blocks, HTML docs, and unknown " +
+      "Command objects before guessing that the system is broken.",
+    inputSchema: {
+      q: z.string().optional().describe("URL or compact query, e.g. wiki:my-slug or a Command URL"),
+      type: z.string().optional().describe("explicit object type if not using q"),
+      id: z.string().optional().describe("explicit object id if not using q"),
+      lang: z.enum(["en", "zh"]).optional().describe("wiki language; default en"),
+    },
+  },
+  async ({ q, type, id, lang } = {}) => {
+    const params = new URLSearchParams();
+    if (q) params.set("q", q);
+    if (type) params.set("type", type);
+    if (id) params.set("id", id);
+    if (lang) params.set("lang", lang);
+    return callApi("GET", `/api/agent/explain?${params}`);
+  }
+);
+
 // ============================================================
 // Deals — read
 // ============================================================
@@ -1501,7 +1577,9 @@ server.registerPrompt(
       "contract: identity, Pipeline First rule, content capture, autonomy " +
       "levels (L0/L1/L2/L3), communication style, error recovery, CLI/MCP " +
       "reference, and boundaries. Read this once, internalise it, operate " +
-      "accordingly. Same content as `llama agent-onboard` from the CLI.",
+      "accordingly. Same content as `llama agent-onboard` from the CLI. " +
+      "For the live private Llama OS skill library, call agent_bootstrap, " +
+      "skills_search, and skills_read.",
   },
   async () => {
     // Gate the briefing behind a /api/me check so unauthenticated MCP

package/bin/llama.mjs

@@ -273,6 +273,10 @@ const HELP_FULL = `Llama Command CLI
 
 Agent onboarding (run once on first install):
   llama agent-onboard                  # print AGENT_BRIEFING.md — the workflow contract for AI agents
+  llama agent bootstrap                # fetch live Command + Llama OS skill manifest
+  llama skills search "pipeline update" # discover relevant runtime skills
+  llama skills show llama-pipeline      # read a skill from Command
+  llama explain <url-or-object>         # explain Command URL/object status + lifecycle
 
 External pitch — talk to Llama Ventures' intake agent (no token required):
   llama pitch start --name "Jane Doe" --email "jane@acme.ai"
@@ -512,6 +516,9 @@ Common:
   llama deal feed <dealId>          every contribution (facts + notes), newest first
   llama post <dealId> "..."         add a note to a deal
   llama agent-onboard               print the AI-agent workflow contract
+  llama agent bootstrap             live Llama OS skill manifest from Command
+  llama skills search "<query>"     discover which skill to read
+  llama explain <url-or-object>     explain Command URLs, 404s, deleted objects
 
 Command groups — run \`llama help <group>\` for that group's commands:
   deal        create · show · feed · update · enrich · search · collaborators · links · delete
@@ -524,6 +531,8 @@ Command groups — run \`llama help <group>\` for that group's commands:
   pitch       external founder intake (no token needed)
   ownership   claim · nominate · approvals
   admin       audit events (system admin only)
+  agent       bootstrap · skills · explain for AI agents
+  skills      search · show runtime Llama OS skills
   auth        setup · tokens · auth status
 
   llama help all     the full command reference (everything at once)
@@ -543,6 +552,8 @@ const HELP_AREA_MATCH = {
   pitch: [/^External pitch/],
   ownership: [/^Ownership/, /^Approvals/],
   admin: [/^Admin/],
+  agent: [/^Agent onboarding/],
+  skills: [/^Agent onboarding/],
   auth: [/^Setup/, /^Zero-config/, /^Token discovery/, /^Env/],
 };
 
@@ -931,6 +942,95 @@ https://command.llamaventures.vc/settings/tokens, run
     return;
   }
 
+  // Live runtime bootstrap from Llama Command. Unlike agent-onboard, this is
+  // not bundled in the public npm package; Command returns the current
+  // authenticated skill manifest and object-inspection contract.
+  if (area === "agent" && action === "bootstrap") {
+    const { flags } = parseFlags(rest, ["json", "limit"]);
+    const params = new URLSearchParams();
+    if (flags.limit && flags.limit !== true) params.set("limit", String(flags.limit));
+    const manifest = await request("GET", `/api/agent/manifest${params.toString() ? `?${params}` : ""}`);
+    if (flags.json) {
+      print(manifest);
+    } else {
+      process.stdout.write(`${manifest.briefing || JSON.stringify(manifest, null, 2)}\n`);
+    }
+    return;
+  }
+
+  if (area === "skills" || (area === "agent" && action === "skills")) {
+    const sub = area === "skills" ? action : rest[0];
+    const args = area === "skills" ? rest : rest.slice(1);
+    if (!sub || sub === "list") {
+      const { flags } = parseFlags(args, ["json", "limit"]);
+      const params = new URLSearchParams();
+      if (flags.limit && flags.limit !== true) params.set("limit", String(flags.limit));
+      const result = await request("GET", `/api/agent/skills${params.toString() ? `?${params}` : ""}`);
+      print(result);
+      return;
+    }
+    if (sub === "search") {
+      const { flags, positional } = parseFlags(args, ["json", "limit"]);
+      const q = positional.join(" ").trim();
+      if (!q) throw new Error("Usage: llama skills search <query> [--limit 20]");
+      const params = new URLSearchParams({ q });
+      if (flags.limit && flags.limit !== true) params.set("limit", String(flags.limit));
+      const result = await request("GET", `/api/agent/skills?${params}`);
+      print(result);
+      return;
+    }
+    if (sub === "show" || sub === "read") {
+      const { flags, positional } = parseFlags(args, ["json"]);
+      const slug = positional[0];
+      if (!slug) throw new Error("Usage: llama skills show <slug> [--json]");
+      const result = await request("GET", `/api/agent/skills/${encodeURIComponent(slug)}`);
+      if (flags.json) {
+        print(result);
+      } else {
+        process.stdout.write(`${result.skill?.content || JSON.stringify(result, null, 2)}\n`);
+      }
+      return;
+    }
+    throw new Error(`Unknown skills subcommand "${sub}". Use: list / search / show.`);
+  }
+
+  if (area === "explain" || (area === "agent" && action === "explain")) {
+    const args = area === "explain" ? [action, ...rest].filter(Boolean) : rest;
+    const { flags, positional } = parseFlags(args, ["json", "type", "id", "lang"]);
+    const params = new URLSearchParams();
+    const q = positional.join(" ").trim();
+    if (q) params.set("q", q);
+    if (flags.type && flags.type !== true) params.set("type", String(flags.type));
+    if (flags.id && flags.id !== true) params.set("id", String(flags.id));
+    if (flags.lang === "zh") params.set("lang", "zh");
+    if (!params.has("q") && !(params.has("type") && params.has("id"))) {
+      throw new Error("Usage: llama explain <url-or-object> OR llama explain --type <type> --id <id>");
+    }
+    const result = await request("GET", `/api/agent/explain?${params}`);
+    if (flags.json) {
+      print(result);
+    } else {
+      const target = result.result?.target;
+      const lifecycle = result.result?.lifecycle || [];
+      const lines = [
+        `${target?.objectType || "object"} ${target?.objectId || ""}`,
+        `Status: ${target?.status || "unknown"}`,
+        `Title: ${target?.title || "Untitled"}`,
+        target?.detail ? `Detail: ${target.detail}` : null,
+        target?.url ? `URL: ${target.url}` : null,
+        `Lifecycle events: ${lifecycle.length}`,
+      ].filter(Boolean);
+      if (lifecycle[0]) {
+        lines.push(
+          `Latest lifecycle: ${lifecycle[0].action} by ${lifecycle[0].actor_label || "unknown"} at ${lifecycle[0].created_at}`,
+        );
+        if (lifecycle[0].reason) lines.push(`Reason: ${lifecycle[0].reason}`);
+      }
+      process.stdout.write(`${lines.join("\n")}\n`);
+    }
+    return;
+  }
+
   // `llama pitch ...` — external founder-pitch family. No Llama token
   // required; bootstraps a session against /api/external/* via PoW + cookie.
   // See lib/external.mjs and AGENT_BRIEFING.md for the full surface.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llamaventures/cli",
-  "version": "1.14.1",
+  "version": "1.15.0",
   "description": "CLI + MCP server for the Llama Ventures investment workbench (command.llamaventures.vc).",
   "type": "module",
   "scripts": {

package/scripts/verify-agent-routing.mjs

@@ -3,12 +3,23 @@
 import assert from "node:assert/strict";
 import { spawn } from "node:child_process";
 import { createServer } from "node:http";
+import { existsSync } from "node:fs";
 import { mkdtemp, rm } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+assert.equal(
+  existsSync(path.join(repoRoot, "docs/agent-skills.bundle.json")),
+  false,
+  "public llama-cli must not bundle private Llama OS skill content",
+);
+assert.equal(
+  existsSync(path.join(repoRoot, "src/data/llama-os-skills.bundle.json")),
+  false,
+  "public llama-cli must not copy the Command-side skill mirror",
+);
 const calls = [];
 let threadSeq = 0;
 
@@ -49,7 +60,81 @@ const server = createServer(async (req, res) => {
   try {
     const body = await readJson(req);
     const url = new URL(req.url, "http://localhost");
-    calls.push({ method: req.method, path: url.pathname, body });
+    calls.push({
+      method: req.method,
+      path: url.pathname,
+      query: Object.fromEntries(url.searchParams.entries()),
+      body,
+    });
+
+    if (req.method === "GET" && url.pathname === "/api/agent/manifest") {
+      writeJson(res, {
+        ok: true,
+        briefing: "runtime briefing: use skills_search, skills_read, and object_inspect",
+        llama_os: {
+          visible_skill_count: 49,
+          included_skill_count: Number(url.searchParams.get("limit") || 25),
+        },
+        skills: [
+          {
+            slug: "llama-command",
+            description: "Llama Command runtime skill",
+          },
+        ],
+      });
+      return;
+    }
+
+    if (req.method === "GET" && url.pathname === "/api/agent/skills") {
+      writeJson(res, {
+        ok: true,
+        q: url.searchParams.get("q"),
+        count: 1,
+        skills: [
+          {
+            slug: "llama-command",
+            description: "Llama Command runtime skill",
+          },
+        ],
+      });
+      return;
+    }
+
+    if (req.method === "GET" && url.pathname === "/api/agent/skills/llama-command") {
+      writeJson(res, {
+        ok: true,
+        skill: {
+          slug: "llama-command",
+          content: "---\nname: llama-command\n---\n# Llama Command runtime skill\n",
+        },
+      });
+      return;
+    }
+
+    if (req.method === "GET" && url.pathname === "/api/agent/explain") {
+      writeJson(res, {
+        ok: true,
+        result: {
+          target: {
+            objectType: "wiki_article",
+            objectId: "missing-page",
+            status: "deleted",
+            title: "Missing Page",
+            detail: "Deleted by Kevin Yu",
+            url: "https://command.llamaventures.vc/wiki/missing-page",
+          },
+          lifecycle: [
+            {
+              action: "deleted",
+              actor_label: "Kevin Yu",
+              created_at: "2026-06-15T19:02:00Z",
+              reason: "user_deleted",
+            },
+          ],
+        },
+      });
+      return;
+    }
 
     if (req.method === "POST" && /^\/api\/deals\/[^/]+\/threads$/.test(url.pathname)) {
       threadSeq += 1;
@@ -228,6 +313,31 @@ const baseUrl = `http://${address.address}:${address.port}`;
 const homeDir = await mkdtemp(path.join(os.tmpdir(), "llama-cli-routing-"));
 
 try {
+  resetCalls();
+  const bootstrapRun = await runCli(["agent", "bootstrap", "--limit", "3"], baseUrl, homeDir);
+  assert.match(bootstrapRun.stdout, /runtime briefing/);
+  assert.deepEqual(paths(), ["GET /api/agent/manifest"]);
+  assert.equal(calls[0].query.limit, "3");
+
+  resetCalls();
+  const skillSearchRun = await runCli(["skills", "search", "pipeline", "--limit", "5"], baseUrl, homeDir);
+  assert.match(skillSearchRun.stdout, /llama-command/);
+  assert.deepEqual(paths(), ["GET /api/agent/skills"]);
+  assert.equal(calls[0].query.q, "pipeline");
+  assert.equal(calls[0].query.limit, "5");
+
+  resetCalls();
+  const skillShowRun = await runCli(["skills", "show", "llama-command"], baseUrl, homeDir);
+  assert.match(skillShowRun.stdout, /# Llama Command runtime skill/);
+  assert.deepEqual(paths(), ["GET /api/agent/skills/llama-command"]);
+
+  resetCalls();
+  const explainRun = await runCli(["explain", "https://command.llamaventures.vc/wiki/missing-page"], baseUrl, homeDir);
+  assert.match(explainRun.stdout, /Status: deleted/);
+  assert.match(explainRun.stdout, /Deleted by Kevin Yu/);
+  assert.deepEqual(paths(), ["GET /api/agent/explain"]);
+  assert.equal(calls[0].query.q, "https://command.llamaventures.vc/wiki/missing-page");
+
   resetCalls();
   const enrichRun = await runCli(
     [
@@ -299,6 +409,37 @@ try {
   assert.equal(payload.threadId, "thread-1");
   assert.equal(payload.text, "agent done");
 
+  resetCalls();
+  const mcpBootstrap = await callMcpTool("agent_bootstrap", { limit: 2 }, baseUrl, homeDir);
+  const bootstrapPayload = JSON.parse(mcpBootstrap.content?.[0]?.text ?? "{}");
+  assert.equal(bootstrapPayload.ok, true);
+  assert.deepEqual(paths(), ["GET /api/agent/manifest"]);
+  assert.equal(calls[0].query.limit, "2");
+
+  resetCalls();
+  const mcpSkills = await callMcpTool("skills_search", { q: "command", limit: 4 }, baseUrl, homeDir);
+  const skillsPayload = JSON.parse(mcpSkills.content?.[0]?.text ?? "{}");
+  assert.equal(skillsPayload.skills?.[0]?.slug, "llama-command");
+  assert.deepEqual(paths(), ["GET /api/agent/skills"]);
+  assert.equal(calls[0].query.q, "command");
+
+  resetCalls();
+  const mcpSkillRead = await callMcpTool("skills_read", { slug: "llama-command" }, baseUrl, homeDir);
+  const skillPayload = JSON.parse(mcpSkillRead.content?.[0]?.text ?? "{}");
+  assert.match(skillPayload.skill?.content ?? "", /# Llama Command runtime skill/);
+  assert.deepEqual(paths(), ["GET /api/agent/skills/llama-command"]);
+
+  resetCalls();
+  const mcpInspect = await callMcpTool(
+    "object_inspect",
+    { q: "https://command.llamaventures.vc/wiki/missing-page" },
+    baseUrl,
+    homeDir,
+  );
+  const inspectPayload = JSON.parse(mcpInspect.content?.[0]?.text ?? "{}");
+  assert.equal(inspectPayload.result?.target?.status, "deleted");
+  assert.deepEqual(paths(), ["GET /api/agent/explain"]);
+
   console.log("agent routing verification passed");
 } finally {
   await close(server);