skill-land 1.3.1 → 1.4.0

package/README.md

@@ -61,6 +61,7 @@ npx skill-land <source> --for <agent> [options]
 | `--project` | install into `./` instead of the user-global directory |
 | `--dry-run` | resolve and report, write nothing |
 | `--verify` | check an existing install, write nothing |
+| `--discover` | also ask a fresh agent session to list its skills (claude-code, codex, antigravity) |
 | `--skip-security` | skip the SkillSpector scan (acknowledged, not silent) |
 | `--strict` | refuse to install anything SkillSpector flags |
 | `--list` | show known agents and their directories |
@@ -133,6 +134,30 @@ Where an agent has several directories it reads, `--verify` counts the skill as
 it is **complete in any one of them**. Requiring every fallback to hold a copy reports
 working installs as broken.
 
+### Does the agent actually load it? `--discover`
+
+Everything above proves the bytes are on disk. It does not prove the agent loads them: it may
+need a restart, reject the frontmatter, or read the directory only in some workspaces.
+`--discover` starts a fresh non-interactive session from a neutral directory and checks that the
+skill name appears in what the agent says it can see.
+
+```bash
+skill-land Magithar/SKILLmama --for codex,antigravity --discover
+```
+
+| Agent | Listing used | Kind |
+|---|---|---|
+| Antigravity | `agy -p /skills` | a real skill list |
+| Codex | `codex exec "list your skills"` | asks the model |
+| Claude Code | `claude -p "list your skills"` | asks the model |
+
+Each was tested by planting a uniquely named canary skill and confirming it appeared. Every other
+agent reports `NOT CHECKED`, never a pass: an unknown is not a success. A missing binary or a
+timeout is also `NOT CHECKED`; only a completed listing that lacks the skill fails the run.
+
+The Codex and Claude Code listings go through the model, so they cost an API call and a `FAIL`
+is a lead to investigate, not proof. It is opt-in for that reason, and skipped with `--project`.
+
 ### What it cannot tell you
 
 Verification assumes the installer **copied**. Some installers **rewrite** on install — the

package/agents.json

@@ -7,7 +7,15 @@
       "project": ".claude/skills",
       "file": "SKILL.md",
       "restart": false,
-      "broken": false
+      "broken": false,
+      "discover": {
+        "cmd": [
+          "claude",
+          "-p",
+          "List the names of all skills available to you, one per line. Output only names."
+        ],
+        "deterministic": false
+      }
     },
     "codex": {
       "display": "OpenAI Codex",
@@ -15,7 +23,16 @@
       "project": ".agents/skills",
       "file": "SKILL.md",
       "restart": false,
-      "broken": true
+      "broken": true,
+      "discover": {
+        "cmd": [
+          "codex",
+          "exec",
+          "--skip-git-repo-check",
+          "List the names of all skills available to you, one per line. Output only names."
+        ],
+        "deterministic": false
+      }
     },
     "antigravity": {
       "_paths": "LIVE VERIFIED against agy 1.1.27 on 2026-09-05: a uniquely-named canary skill was planted in each candidate directory and `agy -p /skills` run from a neutral workspace. Read as global: ~/.gemini/config/skills, ~/.gemini/skills, ~/.gemini/antigravity-cli/skills — matching the maintainer statement in google-antigravity/antigravity-cli#103 comment 5547952239. NOT read: ~/.agents/skills (appears only when its parent is the active workspace, i.e. `--add-dir $HOME`, which is project-local behavior, not global) and ~/.gemini/antigravity/skills (app.asar defines ~/.gemini/antigravity as IDE_OLD_DATA_DIR, the legacy IDE data dir migrating to ~/.gemini/antigravity-ide; never a skills root). Project dir .agents/skills is read only when the directory is a registered workspace — cwd alone was not enough; .antigravity/skills and .agy/skills are not read at all. language_server hardcodes no .gemini/*/skills literal: skills_paths is a repeated protobuf field the client fills in.",
@@ -28,7 +45,15 @@
       "project": ".agents/skills",
       "file": "SKILL.md",
       "restart": true,
-      "broken": true
+      "broken": true,
+      "discover": {
+        "cmd": [
+          "agy",
+          "-p",
+          "/skills"
+        ],
+        "deterministic": true
+      }
     },
     "antigravity-cli": {
       "display": "Antigravity CLI",
@@ -36,7 +61,15 @@
       "project": ".agents/skills",
       "file": "SKILL.md",
       "restart": true,
-      "broken": true
+      "broken": true,
+      "discover": {
+        "cmd": [
+          "agy",
+          "-p",
+          "/skills"
+        ],
+        "deterministic": true
+      }
     },
     "gemini-cli": {
       "display": "Gemini CLI",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skill-land",
-  "version": "1.3.1",
+  "version": "1.4.0",
   "description": "Install an agent skill to the directory the agent actually reads, then verify it landed. Exits non-zero if it didn't.",
   "keywords": [
     "agent-skills",

package/skill-land.mjs

@@ -514,7 +514,54 @@ function runSkill(skillPath, root, quiet) {
       console.log(`        x ${b.destDir}  ${b.absent ? "not installed" : `${b.n}/${files.length} files`}`);
     }
   }
-  return { name: skillName, failed: skillFailed, skipped: skillSkipped };
+  return { name: skillName, fmName: fm.name, failed: skillFailed, skipped: skillSkipped };
+}
+
+// ---------------------------------------------------------------- discover
+
+// --verify proves the bytes are on disk. It cannot prove the agent loads them:
+// the agent may need a restart, reject the frontmatter, or read the directory
+// only in some workspaces. --discover asks a fresh, non-interactive session what
+// skills it sees. Run from a neutral cwd so a project-local skills directory
+// cannot make a missing global install look found.
+//
+// Only agents with a `discover` entry in agents.json were checked this way, and
+// each was tested with a planted canary. The rest report "not checked" rather
+// than pass: an unknown is not a success.
+const hasName = (out, name) =>
+  new RegExp(`(^|[^\\w-])${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}($|[^\\w-])`, "m").test(out);
+
+function discover(agent, names) {
+  const a = AGENTS[agent];
+  console.log(`  ${a.display}`);
+  if (!a.discover) {
+    console.log(`    NOT CHECKED  no known non-interactive skill listing for ${a.display}\n`);
+    return 0;
+  }
+  const [bin, ...args] = a.discover.cmd;
+  const cwd = mkdtempSync(join(tmpdir(), "skill-land-discover-"));
+  let out;
+  try {
+    out = execFileSync(bin, args, { cwd, encoding: "utf-8", timeout: 180000,
+                                    stdio: ["ignore", "pipe", "pipe"] });
+  } catch (e) {
+    const why = e.code === "ENOENT" ? `${bin} not on PATH` : (e.message.split("\n")[0]);
+    console.log(`    NOT CHECKED  ${why}\n`);
+    return 0;
+  } finally {
+    rmSync(cwd, { recursive: true, force: true });
+  }
+  let missing = 0;
+  for (const n of names) {
+    const found = hasName(out, n);
+    if (!found) missing++;
+    console.log(`    ${found ? "OK  " : "FAIL"}  ${n}  ${found ? "listed" : "not in the skill list of a fresh session"}`);
+  }
+  if (!a.discover.deterministic)
+    console.log(`    note  ${a.display} has no plain skill listing; this asks the model, so treat a FAIL as a lead, not proof`);
+  if (missing && a.restart) console.log(`    note  restart ${a.display} fully; skills load at startup`);
+  console.log();
+  return missing;
 }
 
 // ---------------------------------------------------------------- main
@@ -534,6 +581,8 @@ if (!argv.length || argv.includes("-h") || argv.includes("--help")) {
     --project       install into ./ instead of the user-global dir
     --dry-run       resolve and report, write nothing
     --verify        check an existing install, write nothing
+    --discover      also ask a fresh agent session to list its skills
+                    (claude-code, codex, antigravity; others: not checked)
     --skip-security skip the SkillSpector scan (acknowledged, not silent)
     --strict        refuse to install anything SkillSpector flags
     --list          show known agents and their directories
@@ -570,6 +619,7 @@ for (const t of targets) if (!AGENTS[t]) die(`unknown agent "${t}"\n         kno
 const isProject = flag("--project");
 const dryRun = flag("--dry-run");
 const verifyOnly = flag("--verify");
+const discoverFlag = flag("--discover");
 const skipSecurity = flag("--skip-security");
 const strict = flag("--strict");
 const allSkills = flag("--all");
@@ -584,6 +634,7 @@ const src = resolveSource(source);
 const tmp = mkdtempSync(join(tmpdir(), "skill-install-"));
 let failed = 0;
 const skipped = [];
+const landed = [];
 
 try {
   const root = fetchSource(src, tmp);
@@ -598,6 +649,7 @@ try {
     const r = runSkill(skillPath, root, quiet);
     failed += r.failed;
     if (r.skipped) skipped.push(r.name);
+    else if (!r.failed) landed.push(r.fmName || r.name);
   }
 
   if (allSkills) {
@@ -610,6 +662,17 @@ try {
   rmSync(tmp, { recursive: true, force: true });
 }
 
+// Once per agent, not per skill: a listing is one session however many skills.
+// Only skills that passed file verification are looked up; a skill that never
+// landed would just produce a second, redundant failure.
+if (discoverFlag && !dryRun) {
+  if (isProject) console.log("  --discover is skipped with --project: the listing runs from a neutral directory\n");
+  else if (landed.length) {
+    console.log("  discovery  fresh session, neutral directory\n");
+    for (const t of targets) failed += discover(t, landed);
+  }
+}
+
 if (failed) {
   console.error(`  ${failed} install(s) failed verification\n`);
   process.exit(1);