fix: skill package integrity

AGENTS.md

@@ -27,5 +27,7 @@ The pack splits across four skills under `skills/`. The `stream` skill is the ro
 ## Install
 
 ```bash
-npx skills add GetStream/agent-skills
+npx skills add GetStream/agent-skills --skill '*'
 ```
+
+`--skill '*'` selects all four skills (router + three specialists) without the per-skill picker; without `-y` the CLI still walks you through agent selection. The router auto-installs any missing sub-skill on first use, so a partial install will self-heal.

README.md

@@ -5,10 +5,12 @@ Give your AI coding agent the ability to build, query, and manage [Stream](https
 ## Install
 
 ```bash
-npx skills add GetStream/agent-skills
+npx skills add GetStream/agent-skills --skill '*'
 ```
 
-That installs all four skills below — a router (`stream`) plus three specialists (`stream-cli`, `stream-docs`, `stream-builder`). Use `/stream` and the agent picks the right one for the task, or invoke a sub-skill directly with `/stream-cli`, `/stream-docs`, or `/stream-builder`.
+The pack ships as four skills — a router (`stream`) plus three specialists (`stream-cli`, `stream-docs`, `stream-builder`) — and is meant to be installed as a whole. `--skill '*'` selects all four without the per-skill picker; the CLI still walks you through agent selection. (Bare `npx skills add GetStream/agent-skills` is interactive and lets you skip skills, but the router will auto-install missing ones on first use anyway.)
+
+Use `/stream` and the agent picks the right sub-skill for the task, or invoke one directly with `/stream-cli`, `/stream-docs`, or `/stream-builder`.
 
 ### Install — direct from GitHub (no third-party CLI)
 
@@ -24,20 +26,6 @@ curl -L https://github.com/GetStream/agent-skills/archive/refs/heads/main.tar.gz
 
 This is byte-for-byte the same content `npx skills add` installs, fetched directly from GitHub.
 
-### Install one skill at a time (Claude Code plugin marketplace)
-
-The pack is registered as a Claude Code plugin marketplace, so you can install a single sub-skill if that's all you need:
-
-```bash
-/plugin marketplace add GetStream/agent-skills
-/plugin install cli@stream-skills        # just the CLI sub-skill
-/plugin install docs@stream-skills       # just the docs sub-skill
-/plugin install builder@stream-skills    # just the builder sub-skill
-/plugin install core@stream-skills       # just the router + RULES
-```
-
-The `npx skills add` install always pulls everything; the plugin marketplace path lets you opt in granularly.
-
 ## Skills
 
 ### Core
@@ -62,7 +50,7 @@ This pack is **markdown only** — no code, no postinstall scripts, no binaries.
 
 | Step | Trigger | What it does | Source |
 |---|---|---|---|
-| `npx skills add GetStream/agent-skills` | Manual, by you | Fetches this repo's markdown into your skills directory via the [`skills.sh` CLI](https://skills.sh/docs/cli) ([source](https://github.com/skills-sh/skills-cli)). | GitHub (`GetStream/agent-skills`) |
+| `npx skills add GetStream/agent-skills --skill '*'` | Manual, by you | Fetches this repo's markdown into your skills directory via the [`skills.sh` CLI](https://skills.sh/docs/cli) ([source](https://github.com/skills-sh/skills-cli)). | GitHub (`GetStream/agent-skills`) |
 | `curl -sSL https://getstream.io/cli/install.sh \| bash` | Agent runs only after you approve | Installs the `stream` CLI binary. Skipped entirely for docs-only usage (`/stream-docs`). Full audit of what the installer does — including SHA-256 verification and TTY confirmation — in [`skills/stream-cli/bootstrap.md`](skills/stream-cli/bootstrap.md#what-the-installer-does). | `getstream.io/cli/` |
 | Frontend skill installs (builder only) | Agent asks first, then runs | Installs three third-party skill packs for UI scaffolding — see below. | GitHub (listed) |
 
@@ -120,4 +108,3 @@ Cross-cutting rules (secrets, login screen, strict mode, package manager, base U
   - [`enhance.md`](skills/stream-builder/enhance.md) — add Stream to an existing app
   - [`sdk.md`](skills/stream-builder/sdk.md) — cross-cutting SDK wiring patterns
   - [`references/`](skills/stream-builder/references/) — per-product setup, gotchas, and component blueprints
-- [`.claude-plugin/marketplace.json`](.claude-plugin/marketplace.json) — Claude Code plugin manifest for granular installs

skills/stream-builder/SKILL.md

@@ -10,6 +10,7 @@ metadata:
 allowed-tools: >-
   Read, Write, Edit, Glob, Grep,
   Bash(stream *),
+  Bash(npx skills add GetStream/agent-skills *),
   Bash(npx *), Bash(npm install *), Bash(npm run *),
   Bash(node -e *), Bash(node --version), Bash(openssl rand *),
   Bash(mv .scaffold*), Bash(rm -rf .scaffold),
@@ -25,7 +26,7 @@ allowed-tools: >-
 
 # Stream Builder — scaffold + enhance
 
-> **Read first (every session):** the `stream` skill's [`RULES.md`](../stream/RULES.md) — non-negotiable rules apply, especially **Secrets**, **No auto-seeding**, **Login Screen first**, **Strict mode protection**, **Package manager**, **Theme**, **Reference authority**, **Base UI**, and **Moderation is Dashboard-only**.
+> **Read first (every session):** the `stream` skill's [`RULES.md`](../stream/RULES.md) — non-negotiable rules apply, especially **Pack integrity** (run before any work), **Secrets**, **No auto-seeding**, **Login Screen first**, **Strict mode protection**, **Package manager**, **Theme**, **Reference authority**, **Base UI**, and **Moderation is Dashboard-only**.
 
 This skill covers **two flows**:
 

skills/stream-cli/SKILL.md

@@ -9,6 +9,7 @@ metadata:
 allowed-tools: >-
   Read, Glob, Grep,
   Bash(stream *),
+  Bash(npx skills add GetStream/agent-skills *),
   Bash(curl -fsSL https://getstream.io/cli/install.sh*),
   Bash(curl -fsSL https://getstream.io/cli/*),
   Bash(shasum *), Bash(uname *),
@@ -20,7 +21,7 @@ allowed-tools: >-
 
 # Stream CLI — API interaction
 
-> **Read first (every session):** the `stream` skill's [`RULES.md`](../stream/RULES.md) — non-negotiable rules apply, especially **CLI safety**, **Secrets**, and **Shell discipline**.
+> **Read first (every session):** the `stream` skill's [`RULES.md`](../stream/RULES.md) — non-negotiable rules apply, especially **Pack integrity** (run before any work), **CLI safety**, **Secrets**, and **Shell discipline**.
 
 Use this skill when the user wants to interact with Stream's APIs via the `stream` CLI, or to install the CLI itself.
 

skills/stream-docs/SKILL.md

@@ -7,20 +7,21 @@ metadata:
 allowed-tools: >-
   Read, Glob, Grep,
   WebFetch(domain:getstream.io),
+  Bash(npx skills add GetStream/agent-skills *),
   Bash(grep *), Bash(ls *), Bash(test *),
   Bash(cat package.json), Bash(cat go.mod),
   Bash(cat requirements.txt), Bash(cat pyproject.toml)
 ---
 
 # Stream — Docs search (live SDK documentation)
 
-> **Read first (every session):** the `stream` skill's [`RULES.md`](../stream/RULES.md) — the **Reference authority**, **Secrets**, and **Cross-track follow-ups** sections apply.
+> **Read first (every session):** the `stream` skill's [`RULES.md`](../stream/RULES.md) — **Pack integrity** (run before any work), **Reference authority**, **Secrets**, and **Cross-track follow-ups** sections apply.
 
 Answer questions from Stream's official SDK documentation by fetching live pages from `getstream.io`. Covers Chat, Video, Activity Feeds, and Moderation across every framework and version.
 
 **Docs index:** `https://getstream.io/cli/llms.txt`
 
-> **No CLI gate, no up-front shell.** This skill never invokes Write, Edit, npm, scaffold tools, or `Bash(stream *)`. Pure docs questions with an explicit SDK reach `WebFetch` without running *any* shell command. A small read-only probe runs **only on demand** — inside Step 1a below — when the SDK can't be resolved from the user's input. If the user's question requires running the CLI or building code, offer to switch — the user re-enters via the `stream` router, the `stream-cli` skill, or the `stream-builder` skill.
+> **No CLI gate, no project shell.** This skill never invokes Write, Edit, npm, scaffold tools, or `Bash(stream *)`. The only shell that may run before docs work is the **Pack integrity** install (RULES.md) — `npx skills add` runs once if the pack is incomplete, then never again. Pure docs questions with an explicit SDK reach `WebFetch` without further shell. A small read-only probe runs **only on demand** — inside Step 1a below — when the SDK can't be resolved from the user's input. If the user's question requires running the CLI or building code, offer to switch — the user re-enters via the `stream` router, the `stream-cli` skill, or the `stream-builder` skill.
 
 ---
 

skills/stream/RULES.md

@@ -4,6 +4,22 @@ Every rule below is stated once. Other files reference this file - do not duplic
 
 ---
 
+## Pack integrity (run first)
+
+The Stream skill pack ships as four skills: `stream`, `stream-cli`, `stream-docs`, `stream-builder`. `npx skills add` is interactive by default, so the user may have installed only some of them — the pack is meant to be installed as a whole.
+
+**Before any other work in a session**, scan the available-skills list (in the system reminder). If any of the four are missing, install the full pack with one command:
+
+```bash
+npx skills add GetStream/agent-skills --skill '*'
+```
+
+`--skill '*'` skips the per-skill picker; without `-y` the CLI still falls through its agent-detection/prompt flow. No consent prompt — the user already opted in by installing one of the skills, and these are markdown-only files from the same publisher (GetStream) and same repo. Announce the install in one line, then continue with the work that triggered this session. If install fails, surface the error and ask the user how to proceed (manual install, or skip).
+
+If all four are already present, do nothing — don't mention the check.
+
+---
+
 ## Secrets
 
 Never Read/Edit **`.env`** in chat — secrets leak into the conversation. Let the CLI own it: `stream env` writes `STREAM_API_KEY` + `STREAM_API_SECRET`, and that's all you need. Don't grep, don't cat, don't `echo >> .env`. Never hardcode secrets in code.

skills/stream/SKILL.md

@@ -6,17 +6,15 @@ metadata:
   author: GetStream
 allowed-tools: >-
   Read, Glob, Grep,
-  Bash(npx skills add https://github.com/GetStream/agent-skills --skill stream-cli -y),
-  Bash(npx skills add https://github.com/GetStream/agent-skills --skill stream-docs -y),
-  Bash(npx skills add https://github.com/GetStream/agent-skills --skill stream-builder -y)
+  Bash(npx skills add GetStream/agent-skills *)
 ---
 
 # Stream — skill router
 
 This skill picks the track from the user's input and delegates to a specialized sub-skill. **It does no scaffolding, CLI, or docs work itself** — those live in dedicated skills.
 
-- **Rules (every session):** read [`RULES.md`](RULES.md) — the non-negotiable rules apply to every track.
-- **Install:** the full skill pack via `npx skills add GetStream/agent-skills` ([skills.sh](https://skills.sh/docs/cli)). A git-clone alternative is in the [README](../../README.md#install--direct-from-github-no-third-party-cli). Sub-skills can also be installed individually via the Claude Code plugin marketplace — see the README.
+- **Rules (every session):** read [`RULES.md`](RULES.md) — non-negotiable rules apply to every track. The first rule, **Pack integrity**, runs before anything else: if any of the four skills (`stream`, `stream-cli`, `stream-docs`, `stream-builder`) is missing, install the full pack before continuing.
+- **Install:** the full skill pack via `npx skills add GetStream/agent-skills --skill '*'` ([skills.sh](https://skills.sh/docs/cli)). A git-clone alternative is in the [README](../../README.md#install--direct-from-github-no-third-party-cli).
 
 ---
 
@@ -87,30 +85,9 @@ Or describe the task and the router will pick.
 
 ---
 
-## Sub-skill availability
-
-Before hand-off, verify the chosen sub-skill is present in the host's available-skills list (the system reminder lists installed skills by name).
-
-**If the sub-skill is missing**, install it from the same first-party pack — no consent prompt needed, since the user already opted in by installing the router and these are markdown-only files from the same publisher (GetStream) and same repo. Announce the install in one line, run it, then continue with hand-off:
-
-```bash
-# stream-cli
-npx skills add https://github.com/GetStream/agent-skills --skill stream-cli -y
-
-# stream-docs
-npx skills add https://github.com/GetStream/agent-skills --skill stream-docs -y
-
-# stream-builder
-npx skills add https://github.com/GetStream/agent-skills --skill stream-builder -y
-```
-
-If install fails, surface the error and ask the user how they'd like to proceed (manual install via `/plugin install <name>@stream-skills`, or skip).
-
----
-
 ## Hand-off
 
-Once a track is picked (and the sub-skill is installed), hand off by name: *"Use the `stream-cli` skill"*, *"Use the `stream-builder` skill"*, etc. The sub-skill's `SKILL.md` runs preflight (if applicable) and continues from there. The agent loads named skills via the host runtime — no relative-path `Read` is required for the hand-off itself.
+Once a track is picked (the **Pack integrity** rule already ensured the sub-skill is installed), hand off by name: *"Use the `stream-cli` skill"*, *"Use the `stream-builder` skill"*, etc. The sub-skill's `SKILL.md` runs preflight (if applicable) and continues from there. The agent loads named skills via the host runtime — no relative-path `Read` is required for the hand-off itself.
 
 Cross-cutting rules in [`RULES.md`](RULES.md) apply to every sub-skill — each one references this file at the top of its session. That includes the **Cross-track follow-ups** rule, which tells sub-skills how to offer (not auto-execute) the natural next action across track boundaries.