A skill's text calls its command by its full name

[suleimansh]

The first step of @openagt/init (#2023): a skill's command is no longer installed in the project.

👤

• A skill's text calls its command by its full name, like npx @openagt/skill-tickets@0.1 list. Nothing is installed in the project.

🤖 automated · Opus 5.5, effort high

The problem

• A text said npx tickets list. That runs our command only where the package is installed in the project.
• Where it is not, npx downloads whatever holds the name tickets on npm and runs it. Eight of our short names belong to strangers there.

What changed

• The 13 skill texts that call a command, and the shell lines of the scheduled rows in them, use the full name: npx @openagt/skill-tickets@0.1 list. This repository's 12 tracked copies follow.
• The eight texts that have a command said "a dependency of this repository … install with the lockfile's package manager". Each now says: "always run by its full name".
• The 25 skill packages and the scheduler go from 0.0.2 to 0.1.0. A range over 0.0.x matches one version only; @0.1 matches every 0.1.x, so a fix reaches the agents by itself.
• Every agent checkout already got a hidden link to the branches command. It now also gets a hidden link to the branches package. npx runs a copy it finds in the checkout, so the full name runs the dashboard's own copy: nothing downloaded, no network, nothing to publish first.

Picks of mine

• @0.1, where the issue wrote @^1. Two reasons. In zsh with the extended-glob option on, ^ is a pattern sign and the command fails with "no matches found". And MEMORY.md says the version line stays in 0.x. Asked in chat; changing to 1 is a small follow-up.
• Only the skills and the scheduler change their number. The dashboard, the runner, the drivers, the data and the files packages keep theirs.
• The package is linked only beside the branches command itself. Where a project holds another tool named branches, the full name is left to npm, so that tool is never run by mistake.

Known

• From a sub-package folder of a monorepo, npx does not see the link at the checkout's root and asks npm. That fails until 0.1.0 is published, in this repository too.
• Where no copy is linked, each call asks npm: about a second. With the network down it waits 70 seconds, then runs from the cache. A person who types such a command in a terminal is asked "Ok to proceed?" each time.
• The start lines (npx agent-runner, npx agent-scheduler) keep their short names. They run with the dashboard's own tools ahead on the PATH, and are for the init pull request.
• Not new: in a project with tools of its own, the hidden link to the branches command lands in the project's own node_modules/.bin, and a cleanup leaves it there.

To publish, when this is merged (never by an agent)

• The 26 packages at 0.1.0: the 25 @openagt/skill-* and @openagt/agent-scheduler. Nothing breaks before that, except the sub-package case above.

Checked

• Full root CI alone. The branches tests once more without my git settings.
• A rig: an empty-folder project and a Node project. In the agent's checkout the command runs as the text says, with the network dead, also in zsh with extended glob on. git status shows nothing in the checkout or the project.
• Broken on purpose twice (link the package always; never link it): the tests caught both. One test runs npx --offline itself.
• A scheduled row's whole shell line takes the same 5 seconds as with the short names.
• One fresh reviewer: the ^ in zsh, the 0.x decision, the wrong tool running beside another branches, and three test gaps. All acted on.

DECISIONS.md

In the eight command skills (the name changes), writing down the pick above:

The skill calls the command by its full name and a version range, npx @openagt/skill-tickets@0.1: the name is ours on npm, so no other package can run under it, and nothing is installed in the project. Picked over npx tickets with the package as a dependency of the project, which ran whatever package holds that name on npm where the install was missing, and which a project without Node could not have.

In packages/skill-branches/DECISIONS.md, the bullet about the command link, rewritten:

Every checkout holds the package's command and the package itself, linked as node_modules/.bin/branches and node_modules/@openagt/skill-branches and hidden through the repository's exclude, unless the project installed its own copy. npx runs a copy of the package it finds in the checkout, by the command's name, so the skill's full name runs the copy that made the checkout, with nothing downloaded and no network. Beside another tool that holds the name branches in the project the package is not linked, and the full name is left to npm. Picked over leaving the full name to npm alone, which takes a second a call and fails where the network is down.