stash init/plan rough edges surfaced by the rc.1 skilltester run (umbrella)

[coderdan]

Summary

Umbrella for the CLI defects the 2026-07-16 skilltester eval hit repeatedly (5 surfaces, evidence per item under docs/evals/*/2026-07-16-* on cipherstash/skilltester branch 20260716-01-claude). Split out as needed:

1. --eql-version 2 silently ignored on --drizzle/--direct paths — emits a v3 migration regardless, with no warning. (Inverse facet of stash eql install: --eql-version 3 rejects --drizzle, so there is no way to generate a v3 Drizzle migration #613, which tracks --eql-version 3 being rejected with --drizzle.) Also --out ignored / empty stub written.
2. init reports "EQL installed" when it only generated the migration — the schema doesn't exist yet; the message misleads both agents and humans.
3. stash plan --target claude-code spawns a nested claude subprocess — inside an agent session this hangs (nested interactive agent). It should detect it's already inside an agent (or offer a --no-spawn mode that just writes plan.md). Also crashed outright on the prisma-next context.
4. Skill installation is incomplete and late — skills land at plan (not init; context.json shows installedSkills: [] after init), and only 2–3 of 7 are installed; stash-supabase was omitted on Supabase apps.
5. init is not bundler/runtime aware — on a Vite SPA it scaffolds the FFI encryption client into src/ (the browser bundle) and emits top-level await that fails vite build --ssr (esbuild es2020); on a Deno edge app it runs npm install, scaffolds a native/TLA Node client, and records integration: postgresql with no Deno/WASM awareness.
6. Unpinned dependency installs — tracked separately as npm dist-tags deliver broken/stale packages: adapters' latest=0.0.0, stack latest=0.19.0; stash init installs unpinned #661.

Each surface's bug-*.md files carry exact commands, expected vs actual, and workarounds.