fix(skills): skip npm's install prompt too, not just the CLI's

The pasted install command still stalled on npm's "Need to install the
following packages ... Ok to proceed?" whenever `skills@latest` was not
already in the npx cache — npx re-resolves the tag on every run, so a
first-time or outdated cache prompts. That is the same PTY-teardown
failure `-y` was added to fix. The headless updater already documents
both flags as load-bearing; the pasted command now matches it.

src/shared/agent-feature-install-commands.test.ts

@@ -36,21 +36,21 @@ describe('agent feature skill commands', () => {
     expect(ORCA_LINEAR_SKILL_UPDATE_COMMAND).toBe('npx skills update orca-linear --global')
     expect(LINEAR_TICKETS_SKILL_UPDATE_COMMAND).toBe('npx skills update linear-tickets --global')
     expect(ORCA_CLI_ORCHESTRATION_SKILL_INSTALL_COMMAND).toBe(
-      'npx skills add https://github.com/stablyai/orca --skill orca-cli orchestration --global -y'
+      'npx --yes skills add https://github.com/stablyai/orca --skill orca-cli orchestration --global -y'
     )
   })
 
   it('builds install commands non-interactively so a pasted command never stops on a prompt', () => {
-    // Why: with more than one agent installed the CLI prompts for a target and the
-    // pasted command hangs, so `-y` is the fix and must not silently regress.
+    // Why: a pasted command hangs on npm's install-this-package prompt and on the
+    // CLI's agent selection, so both `npx --yes` and `-y` must not silently regress.
     expect(buildAgentFeatureSkillInstallCommand(['orca-cli'])).toBe(
-      'npx skills add https://github.com/stablyai/orca --skill orca-cli --global -y'
+      'npx --yes skills add https://github.com/stablyai/orca --skill orca-cli --global -y'
     )
     expect(buildAgentFeatureSkillInstallCommand(['orca-cli', 'orchestration'])).toBe(
-      'npx skills add https://github.com/stablyai/orca --skill orca-cli orchestration --global -y'
+      'npx --yes skills add https://github.com/stablyai/orca --skill orca-cli orchestration --global -y'
     )
     expect(ORCA_CLI_SKILL_INSTALL_COMMAND).toBe(
-      'npx skills add https://github.com/stablyai/orca --skill orca-cli --global -y'
+      'npx --yes skills add https://github.com/stablyai/orca --skill orca-cli --global -y'
     )
   })
 

src/shared/agent-feature-install-commands.ts

@@ -12,10 +12,11 @@ export function buildAgentFeatureSkillInstallCommand(skillNames: readonly string
   if (skillNames.length === 0) {
     throw new Error('At least one skill name is required.')
   }
-  // Why: `-y` because this command is pasted into a live terminal — with more than one
-  // agent installed the CLI stops on an agent-selection prompt the user cannot see coming,
-  // and closing the panel tears the session down mid-prompt.
-  return `npx skills add ${ORCA_SKILLS_REPOSITORY_URL} --skill ${skillNames.join(' ')} --global -y`
+  // Why: pasted into a live terminal, so any prompt strands the user and closing the panel
+  // kills the session mid-prompt. Both flags are load-bearing, as in the headless updater:
+  // `npx --yes` skips npm's install-this-package prompt (npx re-resolves `latest` every
+  // run, so a cold or stale cache prompts); `skills … -y` skips agent selection.
+  return `npx --yes skills add ${ORCA_SKILLS_REPOSITORY_URL} --skill ${skillNames.join(' ')} --global -y`
 }
 
 export function buildAgentFeatureSkillUpdateCommand(skillName: string): string {