Command list ignores PILOT_HOME when discovering user skill commands

[MicroMilo]

Summary

/api/commands/list discovers user skill commands from os.homedir()/.pilotdeck/skills instead of the active PILOT_HOME/skills. This makes the command palette diverge from the authoritative skill store whenever PILOT_HOME is set for isolated homes, multi-instance setups, or tests.

Code path

The authoritative skill path is PILOT_HOME-aware:

• src/pilot/paths.ts:20-22 resolves the active PilotDeck home from PILOT_HOME or ~/.pilotdeck.
• src/pilot/paths.ts:56-62 maps global skills to resolve(pilotHome, "skills").
• src/extension/skills/SkillManager.ts:88-90 resolves user skills through the active pilotHome.
• ui/server/routes/skills.js:59 uses resolvePilotHome(process.env).
• ui/server/routes/skills.js:102-103 uses path.join(PILOT_HOME, SKILLS_SUBDIR) for user skills.

The command-list route diverges:

• ui/server/routes/commands.js:12 imports resolvePilotHome.
• ui/server/routes/commands.js:130-172 turns skill directories into slash commands.
• ui/server/routes/commands.js:888 uses os.homedir().
• ui/server/routes/commands.js:902-906 scans homeDir/.pilotdeck/skills for user skill commands.

Steps to reproduce

This can be reproduced without modifying the repository by invoking the existing route handler with separate temporary HOME and PILOT_HOME values:

1. Set HOME=<tmp>/default-home.
2. Set PILOT_HOME=<tmp>/pilot-home.
3. Create <tmp>/default-home/.pilotdeck/skills/home_only_repro/SKILL.md.
4. Create <tmp>/pilot-home/skills/pilot_only_repro/SKILL.md.
5. Import ui/server/routes/commands.js with node --import tsx and invoke the POST /list handler with req.body = {}.

Observed result:

{
  "statusCode": 200,
  "hasHomeOnly": true,
  "hasPilotOnly": false,
  "matchingCustomNames": ["/home_only_repro"]
}

Expected behavior

When PILOT_HOME is set, user skill commands should be discovered from PILOT_HOME/skills, matching SkillManager and /api/skills/*.

Actual behavior

/api/commands/list scans HOME/.pilotdeck/skills, so it can miss active user skills under PILOT_HOME/skills and surface stale commands from the default home.

Existing coverage

Related but not full coverage:

• fix(plugins): respect PILOT_HOME paths #191 fixes PILOT_HOME handling in the plugin loader, but it does not touch ui/server/routes/commands.js or user skill command discovery.
• Clarify or implement runtime semantics for gateway.enabled and gateway.home #193 discusses gateway config semantics and is unrelated to skill command discovery.

Suggested fix

Use the existing resolver in ui/server/routes/commands.js:

const pilotHome = resolvePilotHome(process.env);
const userCommandsDir = path.join(pilotHome, 'commands');
const userSkillsDir = path.join(pilotHome, 'skills');

Suggested tests

• Add a route-level regression test that sets separate temporary HOME and PILOT_HOME values.
• Assert /api/commands/list includes a skill from PILOT_HOME/skills/foo/SKILL.md.
• Assert it does not leak a skill from HOME/.pilotdeck/skills/bar/SKILL.md when PILOT_HOME is set.

---

Submitted with Codex.

[MicroMilo]

Proposed fix: #345