@rubytech/create-maxy 1.0.889 → 1.0.891

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy",
-  "version": "1.0.889",
+  "version": "1.0.891",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy": "./dist/index.js"
@@ -10,7 +10,7 @@
     "build": "tsc",
     "bundle": "node scripts/bundle.js",
     "test": "npm run build && node --test 'dist/__tests__/*.test.js'",
-    "prepublishOnly": "bash ../../platform/scripts/verify-skill-tool-surface.sh && node ../../platform/scripts/check-no-task-id-leaks.mjs && node ../../platform/ui/scripts/check-route-wiring.mjs && node ../../platform/ui/scripts/check-edge-admin-routes.mjs && npm run build && node --test 'dist/__tests__/*.test.js' && chmod +x dist/index.js && npm run bundle && node ../../platform/ui/scripts/check-bundle-node-imports.mjs --dir=./payload/server/public/assets"
+    "prepublishOnly": "bash ../../platform/scripts/verify-skill-tool-surface.sh && node ../../platform/scripts/check-no-task-id-leaks.mjs && node ../../platform/scripts/check-skill-load-coverage.mjs && node ../../platform/ui/scripts/check-route-wiring.mjs && node ../../platform/ui/scripts/check-edge-admin-routes.mjs && npm run build && node --test 'dist/__tests__/*.test.js' && chmod +x dist/index.js && npm run bundle && node ../../platform/ui/scripts/check-bundle-node-imports.mjs --dir=./payload/server/public/assets"
   },
   "files": [
     "dist",

package/payload/platform/plugins/admin/PLUGIN.md

@@ -1,6 +1,6 @@
 ---
 name: admin
-description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver — single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), brand-settings, account-manage, account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), render-component, session-reset, session-resume, file-attach, wifi, adherence-read (attention-weighted adherence ledger), and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform."
+description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver — single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), brand-settings, account-manage, account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name — the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), render-component, session-reset, session-resume, file-attach, wifi, adherence-read (attention-weighted adherence ledger), and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform."
 tools:
   - system-status
   - public-hostname
@@ -15,6 +15,7 @@ tools:
   - agent-config-read
   - logs-read
   - plugin-read
+  - skill-load
   - store-skill
   - render-component
   - session-reset
@@ -42,7 +43,7 @@ embed: false
 
 # Admin
 
-Platform management tools for both the admin and public agents. The `plugin-read` tool is available to the public agent (read-only) for loading plugin definitions and references. All other tools are admin-only.
+Platform management tools for both the admin and public agents. The `plugin-read` tool is available to the public agent (read-only) for loading plugin definitions and references. `skill-load skillName=<name>` is the canonical resolver+reader for SKILL.md by skill name — one call returns the body with brand placeholders substituted; `plugin-read` retains exclusive ownership of `references/*` and `PLUGIN.md` reads (both inherently plugin-scoped). All other tools are admin-only.
 
 Tools are available via the `admin` MCP server.
 
@@ -52,7 +53,7 @@ Tools are available via the `admin` MCP server.
 
 `logs-read { type: "agent-stream" }` is the canonical name for the per-conversation tool-use/tool-result archive previously called `system`; both names work and the legacy alias is preserved.
 
-**Stream log is the primary diagnostic surface for an in-progress session.** Every stream log is named by sessionKey and the stream-log file exists from the first token. The first-token invariant is bound by `platform/scripts/__tests__/first-token-creates-stream-log.test.sh`: one operator turn, one token, `claude-agent-stream-<sessionKey>.log` exists and contains the token bytes after the byte returns to the operator. The parent-process console fan-out tee in [`platform/ui/app/lib/claude-agent/logging.ts`](../../ui/app/lib/claude-agent/logging.ts) appends every `[<tag>]`-prefixed `console.error` / `console.log` line to every active session's stream log alongside `server.log`. For diagnosing an in-session issue (WhatsApp inbound, Cloudflare action, persist write, baileys error), call `logs-read { sessionKey: "<…>" }` first — the stream log carries both the agent lifecycle AND the parent-process events that occurred during the session window. The `conversationId` parameter remains a legacy alias resolving to the same sessionKey-named file. `logs-read { type: "server" }` is the cross-session escape hatch for events outside any single session window.
+**Stream log is the primary diagnostic surface for an in-progress session.** Every stream log is named by sessionKey and the stream-log file exists from the first token. The single-writer mandate (2026-05-14) mechanically enforces this contract: the single writer module at [`platform/ui/app/lib/claude-agent/stream-log-writer.ts`](../../ui/app/lib/claude-agent/stream-log-writer.ts) owns every open of `claude-agent-stream-*.log`, opens the file lazily on the first SDK token byte (via `streamLog.writeToken`), and buffers pre-token markers in memory while duplicating them to `server.log` via `console.error` so zero-token sessions retain observability. The build gate `platform/ui/scripts/check-stream-log-writer.mjs` rejects any external `appendFileSync`/`createWriteStream` against the `claude-agent-stream-*` pattern outside the writer module, plus any `claude-agent-stream-${conversationId}` literal (the pre-1013 wrong-identifier signature that produced two files for one session on the Beacons Pi 2026-05-14). The first-token invariant is bound by `platform/scripts/__tests__/first-token-creates-stream-log.test.sh`: one operator turn, one token, `claude-agent-stream-<sessionKey>.log` exists and contains the token bytes after the byte returns to the operator. The parent-process console fan-out tee in [`platform/ui/app/lib/claude-agent/logging.ts`](../../ui/app/lib/claude-agent/logging.ts) appends every `[<tag>]`-prefixed `console.error` / `console.log` line to every active session's stream log alongside `server.log`. For diagnosing an in-session issue (WhatsApp inbound, Cloudflare action, persist write, baileys error), call `logs-read { sessionKey: "<…>" }` first — the stream log carries both the agent lifecycle AND the parent-process events that occurred during the session window. The `conversationId` parameter remains a legacy alias resolving to the same sessionKey-named file. `logs-read { type: "server" }` is the cross-session escape hatch for events outside any single session window.
 
 ## Skills
 
@@ -75,3 +76,7 @@ Tools are available via the `admin` MCP server.
 - `hooks/pre-tool-use.sh` — enforces admin agent write boundaries
 - `hooks/playwright-file-guard.sh` — rewrites file:// URLs to a backgrounded loopback http.server before Playwright sees them
 - `hooks/webfetch-preflight.mjs` — short-circuits WebFetch on JS-SPA shells with a structured `WEBFETCH_CANNOT_READ_JS_SPA` error so the agent surfaces a loud failure to the owner instead of paying the 60s extraction timeout. Fail-open on any internal error.
+
+## Failure-report breadcrumbs
+
+`POST /api/admin/sse-telemetry` and `POST /api/admin/failure-report` write `[sse-client]` and `[failure-report]` lines to `claude-agent-stream-<sessionKey>.log` so one grep against that file reconstructs the failing turn. The admin agent reads these via `logs-read`; the operator surfaces them by clicking "Report this turn" in the chat menu.

package/payload/platform/plugins/admin/mcp/dist/__tests__/skill-load.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=skill-load.test.d.ts.map

package/payload/platform/plugins/admin/mcp/dist/__tests__/skill-load.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-load.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/skill-load.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/admin/mcp/dist/__tests__/skill-load.test.js

@@ -0,0 +1,88 @@
+// Task 1015 — `skill-load` MCP tool acceptance gate.
+//
+// Locks in the contract for `loadSkill` (the resolve+read helper backing
+// the new `skill-load` MCP tool registered in index.ts). Tests build a
+// temp PLATFORM_ROOT tree, seed SKILL.md files, and assert exact outcome
+// shapes — no stdio transport, no SDK harness.
+//
+// Brand substitution is exercised in production via the same
+// `substituteBrandPlaceholders` call as `plugin-read` (index.ts) and
+// covered by brand-templating's own tests. Case 2 below asserts that
+// `loadSkill` returns the raw bytes (placeholder intact) so the handler
+// can substitute deterministically.
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { loadSkill } from "../skill-resolution.js";
+let root;
+beforeEach(() => {
+    root = mkdtempSync(join(tmpdir(), "skill-load-"));
+});
+afterEach(() => {
+    rmSync(root, { recursive: true, force: false });
+});
+function seedSkill(plugin, skill, body) {
+    const dir = join(root, "plugins", plugin, "skills", skill);
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, "SKILL.md"), body);
+}
+describe("loadSkill", () => {
+    it("unique → returns SKILL.md body verbatim with absolute path", async () => {
+        seedSkill("admin", "plainly", "# Plainly\n\nStrip AI tells.\n");
+        const outcome = await loadSkill(root, "plainly");
+        expect(outcome.status).toBe("unique");
+        if (outcome.status !== "unique")
+            return;
+        expect(outcome.pluginName).toBe("admin");
+        expect(outcome.file).toBe("skills/plainly/SKILL.md");
+        expect(outcome.body).toBe("# Plainly\n\nStrip AI tells.\n");
+        expect(outcome.absolutePath.endsWith("plugins/admin/skills/plainly/SKILL.md")).toBe(true);
+    });
+    it("unique → returns raw bytes with brand placeholder intact (handler runs substitution)", async () => {
+        seedSkill("admin", "branded", "# Welcome to <<product-name>>\n\nThe placeholder must reach the handler unmodified.\n");
+        const outcome = await loadSkill(root, "branded");
+        expect(outcome.status).toBe("unique");
+        if (outcome.status !== "unique")
+            return;
+        expect(outcome.body).toContain("<<product-name>>");
+    });
+    it("ambiguous → returns ambiguous status with candidate list", async () => {
+        seedSkill("admin", "shared-name", "# A\n");
+        seedSkill("contacts", "shared-name", "# B\n");
+        const outcome = await loadSkill(root, "shared-name");
+        expect(outcome.status).toBe("ambiguous");
+        if (outcome.status !== "ambiguous")
+            return;
+        expect(outcome.candidates).toHaveLength(2);
+    });
+    it("not-found → returns not-found status", async () => {
+        seedSkill("admin", "plainly", "# Plainly\n");
+        const outcome = await loadSkill(root, "absent-skill");
+        expect(outcome.status).toBe("not-found");
+    });
+    it("kebab-case validator rejects path-shaped input like admin/skills/plainly", () => {
+        // Mirrors the zod regex at the MCP tool registration in index.ts —
+        // the validator runs before the handler so loadSkill is never called
+        // with a path-shaped skillName.
+        const KEBAB = /^[a-z0-9][a-z0-9-]*$/;
+        expect(KEBAB.test("admin/skills/plainly")).toBe(false);
+        expect(KEBAB.test("skills/plainly")).toBe(false);
+        expect(KEBAB.test("admin/plainly")).toBe(false);
+        expect(KEBAB.test("plainly")).toBe(true);
+        expect(KEBAB.test("setup-tunnel")).toBe(true);
+    });
+    it("ambiguous candidates include every owning plugin (set comparison, no order dependency)", async () => {
+        seedSkill("admin", "plainly", "# A\n");
+        seedSkill("contacts", "plainly", "# B\n");
+        seedSkill("memory", "plainly", "# C\n");
+        const outcome = await loadSkill(root, "plainly");
+        expect(outcome.status).toBe("ambiguous");
+        if (outcome.status !== "ambiguous")
+            return;
+        const owners = outcome.candidates.map(c => c.pluginName).sort();
+        expect(owners).toEqual(["admin", "contacts", "memory"]);
+        expect(outcome.candidates.every(c => c.file === "skills/plainly/SKILL.md")).toBe(true);
+    });
+});
+//# sourceMappingURL=skill-load.test.js.map

package/payload/platform/plugins/admin/mcp/dist/__tests__/skill-load.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-load.test.js","sourceRoot":"","sources":["../../src/__tests__/skill-load.test.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,+CAA+C;AAC/C,EAAE;AACF,6DAA6D;AAC7D,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,oCAAoC;AACpC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,IAAI,IAAY,CAAC;AAEjB,UAAU,CAAC,GAAG,EAAE;IACd,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,MAAc,EAAE,KAAa,EAAE,IAAY;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3D,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,gCAAgC,CAAC,CAAC;QAEhE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAEjD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO;QACxC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACrD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC5D,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,SAAS,CACP,OAAO,EACP,SAAS,EACT,uFAAuF,CACxF,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAEjD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO;QACxC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,SAAS,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAC3C,SAAS,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAErD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO;QAC3C,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAE7C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAEtD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,mEAAmE;QACnE,qEAAqE;QACrE,gCAAgC;QAChC,MAAM,KAAK,GAAG,sBAAsB,CAAC;QAErC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACtG,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACvC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC1C,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAExC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAEjD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -20,7 +20,7 @@ import { homedir, hostname as osHostname } from "node:os";
 import QRCode from "qrcode";
 import { getSession, closeDriver } from "./lib/neo4j.js";
 import { getOnboardingState, completeOnboardingStep } from "./lib/onboarding.js";
-import { findSkillOwners, computePluginReadHint } from "./skill-resolution.js";
+import { findSkillOwners, computePluginReadHint, loadSkill } from "./skill-resolution.js";
 import { resolvePublicHostname } from "./lib/public-hostname.js";
 const server = new McpServer({
     name: "admin",
@@ -1664,9 +1664,13 @@ eagerTool(server, "plugin-read", "Read a plugin definition (PLUGIN.md) or one of
 // Task 964 — agent-side `Glob` fallthrough when "set up cloudflare" maps a
 // SKILL.md to the wrong plugin: skill-find walks
 // `${PLATFORM_ROOT}/plugins/*/skills/<skillName>/SKILL.md` once and returns
-// the owner. With one tool call the agent learns the correct plugin name
-// and follows up with a deterministic `plugin-read`.
-server.tool("skill-find", "Find which plugin owns a skill by name. Walks plugins/*/skills/<skillName>/SKILL.md and returns the owning plugin (unique), every candidate (ambiguous), or not-found.", {
+// the owner. With one tool call the agent learns the correct plugin name.
+//
+// Task 1015 — `skill-load` (below) is the canonical single-call surface that
+// most agents want (resolve + read body in one shot). `skill-find` is kept
+// for callers that need only the path (e.g. tooling that lists owners
+// without reading the body).
+server.tool("skill-find", "Find which plugin owns a skill by name. Walks plugins/*/skills/<skillName>/SKILL.md and returns the owning plugin (unique), every candidate (ambiguous), or not-found. For the common resolve-and-read case, prefer `skill-load skillName=<name>` — it returns the SKILL.md body in the same call.", {
     skillName: z.string().regex(/^[a-z0-9][a-z0-9-]*$/, "skillName must be lowercase kebab-case (a-z, 0-9, -)"),
 }, async ({ skillName }) => {
     const start = Date.now();
@@ -1678,7 +1682,7 @@ server.tool("skill-find", "Find which plugin owns a skill by name. Walks plugins
         return {
             content: [{
                     type: "text",
-                    text: `pluginName="${pluginName}" file="${file}"\nFollow up with: plugin-read pluginName="${pluginName}" file="${file}"`,
+                    text: `pluginName="${pluginName}" file="${file}"\nTo read the body in one call, use: skill-load skillName="${skillName}"`,
                 }],
         };
     }
@@ -1696,6 +1700,59 @@ server.tool("skill-find", "Find which plugin owns a skill by name. Walks plugins
         isError: true,
     };
 });
+// Task 1015 — `skill-load` collapses skill resolve+read into one call.
+//
+// Why: 21 prose call sites previously said *"Load `admin/skills/plainly/SKILL.md`
+// via `plugin-read`"*. The LLM kept passing the path as `pluginName`, tripping
+// the not-found branch with the corrected-pluginName hint that Task 1000 added.
+// The recurring failure is recorded in the corrections ledger. One slug-arg
+// tool removes the path-format ambiguity at the source.
+//
+// Shape mirrors `plugin-read` (eagerTool registration, same brand-substitution
+// call) so SKILL.md bodies are byte-identical regardless of which tool reads
+// them. `plugin-read` is retained for `references/*` and `PLUGIN.md` reads —
+// those are plugin-scoped by nature and the path-as-pluginName failure pattern
+// is specific to skills (addressed by slug in prose).
+eagerTool(server, "skill-load", "Load a plugin skill's SKILL.md body by skill name. One call: resolves the owning plugin and reads the body, with brand placeholders substituted. Returns the SKILL.md body when exactly one plugin owns the skill, a candidate list when multiple plugins own it (ambiguous), or an error when no plugin owns it.", {
+    skillName: z.string().regex(/^[a-z0-9][a-z0-9-]*$/, "skillName must be lowercase kebab-case (a-z, 0-9, -)"),
+}, async ({ skillName }) => {
+    const start = Date.now();
+    try {
+        const outcome = await loadSkill(PLATFORM_ROOT, skillName);
+        if (outcome.status === "ambiguous") {
+            const ms = Date.now() - start;
+            console.log(`[skill-load] skillName=${skillName} result=ambiguous pluginName=none file=none bodyBytes=0 ms=${ms}`);
+            const lines = outcome.candidates.map(c => `  pluginName="${c.pluginName}" file="${c.file}"`).join("\n");
+            return {
+                content: [{
+                        type: "text",
+                        text: `Ambiguous — skill "${skillName}" exists in ${outcome.candidates.length} plugins:\n${lines}\nUse plugin-read with one of the listed pluginName/file pairs.`,
+                    }],
+                isError: true,
+            };
+        }
+        if (outcome.status === "not-found") {
+            const ms = Date.now() - start;
+            console.log(`[skill-load] skillName=${skillName} result=not-found pluginName=none file=none bodyBytes=0 ms=${ms}`);
+            return {
+                content: [{ type: "text", text: `not_found — no plugin owns a skill named "${skillName}"` }],
+                isError: true,
+            };
+        }
+        const content = substituteBrandPlaceholders(outcome.body, outcome.absolutePath);
+        const ms = Date.now() - start;
+        console.log(`[skill-load] skillName=${skillName} result=unique pluginName=${outcome.pluginName} file=${outcome.file} bodyBytes=${content.length} ms=${ms}`);
+        return { content: [{ type: "text", text: content }] };
+    }
+    catch (err) {
+        const ms = Date.now() - start;
+        console.log(`[skill-load] skillName=${skillName} result=read-error pluginName=unknown file=unknown bodyBytes=0 ms=${ms}`);
+        return {
+            content: [{ type: "text", text: `Failed to load skill "${skillName}": ${err instanceof Error ? err.message : String(err)}` }],
+            isError: true,
+        };
+    }
+});
 // Task 940 — `"rendered"` is a sentinel, not a persistence ack. The platform
 // UI's stream-parser intercepts this tool_use upstream of the SDK reply
 // (platform/ui/app/lib/claude-agent/stream-parser.ts:362) and emits a typed