Skills startup fallback bypasses the pinned npx package constant

[benagentai93-dot]

Baseline

Reproduced from v1.3.1 at 5a306f8956cb1eeae69f9709de0e4d61b44e11e7.

Reproduction

1. Ensure the fast-path directory ~/.agents/skills has no installed google-agents-cli-* skill, or call _find_installed_skills() with an isolated home.
2. Replace run_resolved with a capture stub so no external command is executed.
3. Call _find_installed_skills() and inspect the fallback command.

The fallback invokes:

npx -y skills list --json

The same module already defines and uses SKILLS_NPX_PACKAGE = "skills@1.5.9" in get_installed_skills().

Actual behavior

The startup fallback bypasses the existing pinned package constant and resolves the floating skills package. Its behavior can therefore differ from setup/info paths and from the version the CLI was tested against.

Expected behavior

Every npx skills invocation in this module should reuse SKILLS_NPX_PACKAGE, so the fallback runs the same tested package version as the other skills paths.

Minimal fix

Replace the fallback's literal "skills" argument with the existing SKILLS_NPX_PACKAGE constant. No new helper, dependency, or abstraction is needed.

Reference implementation: benagentai93-dot@6724f05

Test evidence

A runnable regression overrides SKILLS_NPX_PACKAGE, captures run_resolved, and verifies that the fallback command contains the overridden constant rather than a duplicate literal.

Fork verification:

• focused Batch 3 suite: 15 passed
• full root suite: 55 passed
• ruff check src tests: passed
• ty check src: passed
• uv build: passed
• installed-wheel agents-cli --version: 1.3.1 on Python 3.11 and 3.13

All focused regressions use mocks; no real npx, network, or server command was run.

[SankeerthNara]

Could you assign this to me