`stash init` no longer installs any `stash-*` skills — agent-driven setup gets zero guidance

[coderdan]

Splits item 4 out of #665, confirmed against 1.1.0.

Background

The stash CLI ships a set of skills — markdown instruction files (stash-encryption, stash-drizzle, stash-cli, …) that teach a coding agent how to integrate CipherStash encryption. They ship inside the npm tarball (dist/skills/, 14 skills in 1.1.0) and are meant to be copied into the user's project (.claude/skills/ for Claude Code, .codex/skills/ for Codex) so the agent doing the integration can load them. Without them, an agent integrates blind.

Problem

In stash@1.1.0, stash init never installs skills — for anyone, in any mode.

Mechanism, step by step (paths are in the published 1.1.0 tarball, via sourcemaps):

1. The only code that copies skills is installSkills() in src/commands/init/lib/install-skills.ts. Its only callers are the handoff steps: src/commands/impl/steps/handoff-claude.ts:28, handoff-codex.ts:53 (plus the AGENTS.md/Lovable inline variants).
2. Those handoff steps run only from howToProceedStep (src/commands/impl/steps/how-to-proceed.ts), which is invoked by stash plan and stash impl — not by stash init. The --target flag that selects a handoff non-interactively exists only on plan and impl (src/cli/registry.ts:156,178); init has no such flag (registry.ts:101-135).
3. stash init writes .cipherstash/context.json with a hardcoded installedSkills: [] baseline (src/commands/init/lib/write-context.ts, buildContextFile) that only a handoff step would refresh — and none runs.

Impact: the most common real-world flow — a coding agent (Claude Code, Codex, Cursor) runs npx stash init --supabase inside the user's project — completes "successfully" and delivers zero guidance. The agent never sees the skills unless it thinks to dig them out of node_modules/stash/dist/skills/ on its own. In the 2026-08-19 skilltester round against 1.1.0, three of four completed runs (hono-pg, vite-drizzle, supabase-edge) ended with installedSkills: [] and no .claude/skills/ content; each agent had to discover the bundled copies in node_modules by itself. One run (next-prisma) did end up with 7 skills installed — consistent with its agent additionally invoking the plan/impl handoff.

Nothing catches this today: init prints success, context.json looks plausible, and the skills silently sit unshipped in node_modules.

Affected versions: 1.1.0 (in 1.0.0-rc.4, init installed skills directly — this is a behaviour regression from the init/plan/impl restructure, not a copy bug; install-skills.ts itself works).

Proposal

1. Interim (cheap): when stash init detects an agent context — agent CLI on PATH or .claude/ present (src/commands/init/detect-agents.ts already computes exactly this during init) — install the per-integration skills at init time, exactly as rc.4 did, and record them in context.json.installedSkills.
2. Alternatively (or additionally), give init the same --target <agent> flag plan/impl have, so automation can opt in explicitly.
3. Either way: when init finishes without installing skills, say so loudly and print the command that will ("run stash plan --target claude-code to install the agent skills") — a silent installedSkills: [] is what made this invisible.

Evidence

• 2026-08-19 skilltester round, branches 20260819-03-claude (hono-pg), -05- (vite-drizzle), -07- (supabase-edge) on cipherstash/skilltester: assessor-verified installedSkills: [] after npx stash@1.1.0 init --supabase; per-surface assessment.md carries the checks.
• Tarball inspection of published stash@1.1.0 (file:line refs above from its sourcemaps).

Relationship to other work

• Splits item 4 of stash init/plan rough edges surfaced by the rc.1 skilltester run (umbrella) #665 ("skill installation is incomplete and late") into its own issue; 1.1.0 made it strictly worse — "late and partial" became "never on the init path".
• The skilltester harness will keep flagging this per-run until fixed (skill-effectiveness verdicts read context.json).

[coderdan]

More evidence from the next-prisma rerun (branch 20260819-10-claude, 1.1.0): passing --target claude-code to stash init is silently accepted-and-ignored (no skills installed, no unknown-flag error), and stash plan --target claude-code — the documented non-interactive path that WOULD install skills — hangs and exits 144 in a non-interactive shell despite the flag's '--target safe in non-TTY contexts' help text. So an agent currently has no working route to a skills install at all.