zi-install skill: align with the wiki Agent tab (digest fallback, expected annex line, trailing period, install-only check)

[ss-o]

Summary

The Copilot review series on z-shell/wiki#922 (the Agent installation tab, the human-facing counterpart of .github/skills/zi-install/SKILL.md) raised four points that apply to the skill verbatim. The tab was corrected; the skill still carries them, so the two now differ on details an agent acts on.

Findings

1. Digest tool. The verify fence calls sha256sum only. On a host with shasum but no sha256sum (a standard macOS installation) the required step cannot print checksum ok, and the prose only says "use shasum -a 256 where sha256sum is absent". The tab's fence falls back and prints nothing when neither tool exists:

actual="$({ sha256sum "$tmp/install.sh" 2>/dev/null || shasum -a 256 "$tmp/install.sh"; } | awk '{ print $1 }')"

2. Expected output. The "read the result" list does not name Skipped all annexes, which the installer prints on every -a loader and default run; an agent told to stop on skips may treat a good install as a refusal. The list should mark it as expected, and describe cannot be fast-forwarded as local commits or changes, not changes only.

3. Trailing period. Until installer: success line prints the path with a trailing period src#215 is fixed, the fresh-install line prints the checkout path followed by a period. An agent that copies the printed token literally appends /zi.zsh to the wrong path for install-only verification. The tab says the period is not part of the path; the skill should say the same until the fix ships (src#215 carries the reminder to remove the sentence).

4. Install-only check strength. The skill verifies install-only by file existence only. The tab sources that zi.zsh in zsh -f -c and asks for zi -h, which proves the checkout is usable. Copilot asked for one contract across the tab, the handoff block, and the skill; the stronger check is cheap:

zsh -f -c 'builtin source "$1" && zi -h' zsh "<printed directory>/zi.zsh" >/dev/null && echo 'zi ok'

Evidence

Each point is a resolved thread or overview note on z-shell/wiki#922 (reviews of 200ba80b, c5ba9351, ceebb3dc, and 686dd8e3). The tab's fences were run end to end from public/sh/install.sh on src main at a1ac6d2 in an isolated home: the digest fallback prints checksum ok with both tools and with sha256sum shadowed, nothing with neither or with a tampered file.

Related

• docs(installation): add an Agent tab for AI coding agents installing Zi wiki#922, Installation page: add an Agent tab for AI coding agents installing Zi wiki#921
• Deliver a zi-install skill for AI coding agents, alongside the code-review skill #636, feat(skills): add the zi-install skill for AI coding agents #637, fix(skills): make the zi-install loader probe positive #638
• installer: success line prints the path with a trailing period src#215