Make web skill discovery recursive, matching the CLI

[youngbrioche]

Problem

The CLI and the web app use different rules to discover skills.

The CLI scans skill directories recursively and follows directory symlinks. The web skill library checks only this path:

<skill-root>/<direct-child>/SKILL.md

This difference prevents the web app and rooms from finding skills inside a repository-level symlink.

Example

~/.agents/skills/agent-skills -> ~/Projekte/agent-skills
~/Projekte/agent-skills/skills/<skill-name>/SKILL.md

With this structure:

• The CLI finds 72 skills.
• The web API finds 24 direct skills.
• The web app misses 48 skills below the agent-skills symlink.

A symlink that points directly to one skill works. A symlink that points to a repository or collection does not work.

Expected behavior

The CLI, web skill library, and rooms should use the same recursive discovery rules. This behavior also matches Pi, Claude Code, and Codex.

Current implementation

The CLI loader recursively calls loadSkillsFromDirInternal() and resolves symlinks with realPath():

runtime/packages/agent/src/harness/skills.ts

The web library reads only direct children and checks path.join(dir, entry.name, "SKILL.md"):

apps/web-server/src/index.ts

The current symlink test covers only a direct symlink to one skill. It does not cover a symlink to a directory that contains several skills:

apps/web-server/scripts/skills-shared-dir-smoke.ts

I reproduced the API result locally with v0.8.0. The same non-recursive web discovery code is present in v0.10.1 (2963a17d9d4b58581d94a8b954511a5c04bb870a).

Suggested change

Use the recursive runtime discovery rules for the web skill library and room skill resolution.

Please keep these existing rules:

• Skip dot directories and node_modules.
• Honor ignore files.
• Keep the current source precedence.
• Prevent loops when symlinks point back to a parent directory.
• Use the same resolved manifest path for listing, enabling, and fingerprint checks.

Acceptance criteria

• The web library finds skills in nested directories.
• The web library follows a symlink to a repository or skill collection.
• Direct skill symlinks continue to work.
• The CLI and web app list the same skills for the same configured roots.
• A symlink loop does not hang the scan.