new skills

Author: alvinsng

.factory-plugin/marketplace.json

@@ -35,6 +35,24 @@
       "description": "Autonomous experiment loop for optimization research. Try an idea, measure it, keep what works, discard what doesn't, repeat. Works standalone or as a mission worker.",
       "source": "./plugins/autoresearch",
       "category": "research"
+    },
+    {
+      "name": "typescript-patterns",
+      "description": "Opinionated TypeScript and React patterns: ban `as` assertions, replace useEffect with derived state, and fix knip unused exports",
+      "source": "./plugins/typescript-patterns",
+      "category": "quality"
+    },
+    {
+      "name": "engineering-toolbox",
+      "description": "General-purpose engineering skills: parallel code review, V8 heap analysis, GitHub Actions workflow authoring, HTTP traffic interception, and Playwright e2e testing",
+      "source": "./plugins/engineering-toolbox",
+      "category": "productivity"
+    },
+    {
+      "name": "github-workflow",
+      "description": "GitHub pull request lifecycle skills: create, triage, follow up on, and cut release PRs with consistent conventions",
+      "source": "./plugins/github-workflow",
+      "category": "productivity"
     }
   ]
 }

.gitignore

@@ -0,0 +1 @@
+.factory/

README.md

@@ -31,6 +31,7 @@ Core skills for essential functionalities and integrations. Pre-installed by the
 **Skills:**
 
 - `review` - Review code changes and identify high-confidence, actionable bugs. Includes systematic analysis patterns for null safety, async/await, security, concurrency, API contracts, and more. Used by both the CLI `/review` command and the CI action.
+- `simplify` - Parallel code review across reuse, quality, and efficiency axes
 
 ### droid-control
 
@@ -44,7 +45,7 @@ See [plugins/droid-control/README.md](plugins/droid-control/README.md) for detai
 
 ### security-engineer
 
-Security review, threat modeling, and vulnerability validation skills.
+Security review, threat modeling, vulnerability validation, and patch generation skills.
 
 **Skills:**
 
@@ -53,6 +54,33 @@ Security review, threat modeling, and vulnerability validation skills.
 - `commit-security-scan` - Scan commits/PRs for security vulnerabilities
 - `vulnerability-validation` - Validate and confirm security findings
 
+### typescript-patterns
+
+Opinionated TypeScript and React patterns for safer, cleaner code.
+
+**Skills:**
+
+- `ban-type-assertions` - Ban `as` casts and replace them with compiler-verified alternatives (zod, control-flow narrowing)
+- `no-use-effect` - Five replacement patterns for `useEffect` (derived state, query libraries, event handlers, `useMountEffect`, `key`)
+- `fix-knip-unused-exports` - Fix every category of knip "Unused exports" violation
+
+### engineering-toolbox
+
+General-purpose engineering skills that plug into any TypeScript / Node.js codebase.
+
+**Skills:**
+
+- `http-toolkit-intercept` - Intercept and debug HTTP traffic from a Bun/Node CLI via HTTP Toolkit
+
+### github-workflow
+
+GitHub pull request lifecycle skills: open, triage, follow up on, and ship release PRs with consistent conventions.
+
+**Skills:**
+
+- `create-pr` - Open a PR with Conventional Commits title, templated body, and local verification gates
+- `follow-up-on-pr` - Rebase, address reviewer comments, fix CI, and push an existing PR to merge-ready state
+
 ### droid-evolved
 
 Skills for continuous learning and improvement.

plugins/core/skills/simplify/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: simplify
+description: Review changed code for reuse, quality, and efficiency, then fix any issues found.
+---
+
+# Simplify: Code Review and Cleanup
+
+Review all changed files for reuse, quality, and efficiency. Fix any issues found.
+
+## Phase 1: Identify Changes
+
+Run `git diff` (or `git diff HEAD` if there are staged changes) to see what changed. If there are no git changes, review the most recently modified files that the user mentioned or that you edited earlier in this conversation.
+
+## Phase 2: Launch Three Review Agents in Parallel
+
+Use the Task tool to launch all three agents concurrently in a single message. Pass each agent the full diff so it has the complete context.
+
+### Agent 1: Code Reuse Review
+
+For each change:
+
+1. **Search for existing utilities and helpers** that could replace newly written code. Look for similar patterns elsewhere in the codebase — common locations are utility directories, shared modules, and files adjacent to the changed ones.
+2. **Flag any new function that duplicates existing functionality.** Suggest the existing function to use instead.
+3. **Flag any inline logic that could use an existing utility** — hand-rolled string manipulation, manual path handling, custom environment checks, ad-hoc type guards, and similar patterns are common candidates.
+
+### Agent 2: Code Quality Review
+
+Review the same changes for hacky patterns:
+
+1. **Redundant state**: state that duplicates existing state, cached values that could be derived, observers/effects that could be direct calls
+2. **Parameter sprawl**: adding new parameters to a function instead of generalizing or restructuring existing ones
+3. **Copy-paste with slight variation**: near-duplicate code blocks that should be unified with a shared abstraction
+4. **Leaky abstractions**: exposing internal details that should be encapsulated, or breaking existing abstraction boundaries
+5. **Stringly-typed code**: using raw strings where constants, enums (string unions), or branded types already exist in the codebase
+6. **Unnecessary JSX nesting**: wrapper Boxes/elements that add no layout value — check if inner component props (flexShrink, alignItems, etc.) already provide the needed behavior
+
+### Agent 3: Efficiency Review
+
+Review the same changes for efficiency:
+
+1. **Unnecessary work**: redundant computations, repeated file reads, duplicate network/API calls, N+1 patterns
+2. **Missed concurrency**: independent operations run sequentially when they could run in parallel
+3. **Hot-path bloat**: new blocking work added to startup or per-request/per-render hot paths
+4. **Recurring no-op updates**: state/store updates inside polling loops, intervals, or event handlers that fire unconditionally — add a change-detection guard so downstream consumers aren't notified when nothing changed. Also: if a wrapper function takes an updater/reducer callback, verify it honors same-reference returns (or whatever the "no change" signal is) — otherwise callers' early-return no-ops are silently defeated
+5. **Unnecessary existence checks**: pre-checking file/resource existence before operating (TOCTOU anti-pattern) — operate directly and handle the error
+6. **Memory**: unbounded data structures, missing cleanup, event listener leaks
+7. **Overly broad operations**: reading entire files when only a portion is needed, loading all items when filtering for one
+
+## Phase 3: Fix Issues
+
+Wait for all three agents to complete. Aggregate their findings and fix each issue directly. If a finding is a false positive or not worth addressing, note it and move on — do not argue with the finding, just skip it.
+
+When done, briefly summarize what was fixed (or confirm the code was already clean).

plugins/engineering-toolbox/.factory-plugin/plugin.json

@@ -0,0 +1,8 @@
+{
+  "name": "engineering-toolbox",
+  "description": "General-purpose engineering skills: code review with parallel subagents, V8 heap analysis, GitHub Actions workflow authoring, HTTP traffic interception, and Playwright e2e testing",
+  "author": {
+    "name": "Factory",
+    "email": "support@factory.ai"
+  }
+}

plugins/engineering-toolbox/README.md

@@ -0,0 +1,15 @@
+# engineering-toolbox
+
+General-purpose engineering skills that plug into any TypeScript / Node.js codebase.
+
+## Skills
+
+### `http-toolkit-intercept`
+
+Intercept and debug HTTP traffic from a Bun- or Node-based CLI using HTTP Toolkit. Pairs the outbound proxy log with a machine-readable CLI session log so you can verify LLM API calls, backend requests, auth flows, and wire-level behavior.
+
+## Install
+
+```bash
+droid plugin install engineering-toolbox@factory-plugins
+```

plugins/engineering-toolbox/skills/http-toolkit-intercept/SKILL.md

@@ -0,0 +1,166 @@
+---
+name: http-toolkit-intercept
+description: Intercept and debug HTTP traffic from a Bun- or Node-based CLI using HTTP Toolkit. Use when you need to inspect LLM API calls, backend requests, auth flows, or debug network-level issues.
+---
+
+# HTTP Toolkit Intercept
+
+Use this skill when you need authoritative evidence of what your CLI sent to a remote API and what it received back while verifying a code change.
+
+The reliable pattern is:
+
+1. Start HTTP Toolkit correctly.
+2. Run the CLI through the proxy in a mode that produces a machine-readable log (e.g. `--output-format json`).
+3. Export outbound HTTP requests from HTTP Toolkit.
+4. Pair the outbound HTTP export with the inbound CLI session log.
+
+Do not rely on TUI screenshots alone when the question is about request payloads, auth headers, or wire-level behavior.
+
+## Prerequisites / Known-Good Launch
+
+### Start HTTP Toolkit
+
+On Linux/headless environments, plain `httptoolkit` often fails due to sandbox/X11 issues. Prefer:
+
+```bash
+xvfb-run --auto-servernum httptoolkit --no-sandbox
+```
+
+If a stale server is already running on ports `45456/45457`, stop it first:
+
+```bash
+pkill -f "HTTP Toolkit Server|httptoolkit|xvfb-run --auto-servernum httptoolkit" || true
+```
+
+### Verify the proxy is reachable
+
+```bash
+# HTTP Toolkit's admin API lives on port 45456/45457 by default.
+# Treat 200/401/403 as "reachable"; only connection failure means the server is dead.
+curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:45456/config
+```
+
+## Quick Start
+
+### 1. Launch your CLI with the proxy env vars set
+
+The canonical Bun-friendly pattern:
+
+```bash
+BUN_CONFIG_PROXY="http://127.0.0.1:8000" \
+HTTP_PROXY="http://127.0.0.1:8000" \
+HTTPS_PROXY="http://127.0.0.1:8000" \
+ALL_PROXY="http://127.0.0.1:8000" \
+NODE_TLS_REJECT_UNAUTHORIZED=0 \
+<your-cli> <args>
+```
+
+> `NODE_TLS_REJECT_UNAUTHORIZED=0` is only appropriate for controlled local debugging. See "TLS Safety" below.
+
+### 2. Capture the inbound session log
+
+If your CLI supports a machine-readable output mode (e.g. `--output-format stream-json`, `--json`, `--log-level debug`), pipe it to a file:
+
+```bash
+<your-cli> exec --output-format stream-json "your prompt" \
+  > /tmp/cli-intercept-stdout.log 2> /tmp/cli-intercept-stderr.log
+```
+
+### 3. Export outbound HTTP from HTTP Toolkit
+
+Either:
+
+- Use the HTTP Toolkit GUI export (File → Export → JSON), or
+- Hit the admin API directly. The exact endpoint depends on your HTTP Toolkit version; inspect DevTools in the HTTP Toolkit UI to see the requests it makes.
+
+### 4. Cross-reference the two streams
+
+- **Outbound HTTP** (from HTTP Toolkit): authoritative for request bodies, headers, auth tokens, retry timing.
+- **Inbound session log** (from the CLI): authoritative for how your code reacted to the responses.
+
+Together they answer: "what did we send?" and "what did we do with the response?"
+
+## What finally worked for payload verification
+
+The critical correct pathways that proved reliable were:
+
+1. **Use a non-interactive / exec mode, not the TUI, when verifying payloads**
+   - Interactive TUIs are slower and much harder to analyze.
+   - Use whatever your CLI has for scripting (`--output-format`, `--json`, `--headless`).
+
+2. **Treat outbound and inbound as separate evidence sources**
+   - HTTP Toolkit gives outbound HTTP requests.
+   - The CLI's session log gives inbound assistant/tool behavior.
+   - You need both to answer: "what did the model receive?" and "what did it actually do?"
+
+3. **Use Bun's proxy env var explicitly**
+   - `BUN_CONFIG_PROXY` is the important one.
+   - Setting only `HTTP_PROXY`/`HTTPS_PROXY` is not enough for Bun.
+
+4. **Disable TLS verification only for controlled local debugging when needed**
+   - If the HTTP Toolkit CA is not trusted locally, use `NODE_TLS_REJECT_UNAUTHORIZED=0` as an escape hatch.
+   - Prefer trusting the CA in your OS / Node trust store instead.
+   - Never disable TLS in production repros.
+
+5. **Keep runs bounded**
+   - Long tool-heavy prompts can take time.
+   - If you only need to prove request shape, export after the LLM request is observed — you do not always need to wait for full completion.
+
+## Key Facts
+
+- **Bun requires `BUN_CONFIG_PROXY`** — treat it as mandatory
+- **HTTP_PROXY / HTTPS_PROXY alone are silently ignored by Bun**
+- **HTTP Toolkit admin API is request-oriented** — outbound HTTP comes from HTTP Toolkit, inbound behavior comes from the CLI log
+- **TLS is verified by default** — `NODE_TLS_REJECT_UNAUTHORIZED=0` is a local-dev escape hatch only
+
+## Bun Proxy Gotchas
+
+| Approach | Works? | Notes |
+|----------|--------|-------|
+| `BUN_CONFIG_PROXY` | Yes | Bun's official proxy env var |
+| `HTTP_PROXY` / `HTTPS_PROXY` | No (Bun) | Silently ignored by bun but respected by some libraries used via Bun |
+| `SSL_CERT_FILE` with combined CA | Unreliable | Can break on some Bun builds; verify in your local Bun version |
+| `NODE_TLS_REJECT_UNAUTHORIZED=0` | Local dev only | Disables TLS verification |
+| Running via `tsx` / Node.js | Depends on your CLI | Some CLIs have native deps (`.dylib`) that require Bun |
+
+### TLS Safety Guardrails
+
+- Keep TLS verification enabled whenever possible.
+- Prefer trusting the HTTP Toolkit CA in your local trust store instead of disabling verification.
+- Use `NODE_TLS_REJECT_UNAUTHORIZED=0` only for controlled local debugging in development.
+- Never disable TLS when intercepting production traffic.
+
+## Inspecting Captured Logs
+
+### Filter to LLM-call events only
+
+If your CLI emits newline-delimited JSON, use `jq`:
+
+```bash
+jq -c 'select(.type == "tool_call" or .type == "message")' /tmp/cli-intercept-stdout.log
+```
+
+### Match outbound HTTP to inbound events
+
+Sort both streams by timestamp, then interleave them. The sequence usually is:
+
+```
+outbound POST /chat/completions   (from HTTP Toolkit)
+inbound  message role=assistant    (from CLI log)
+inbound  tool_call tool=foo        (from CLI log)
+outbound POST /chat/completions   (next turn)
+```
+
+If a CLI log shows an outbound request that HTTP Toolkit didn't capture, that's a proxy-config bug.
+
+## Troubleshooting
+
+| Problem | Cause | Fix |
+|---------|-------|-----|
+| CLI hangs, no events after startup | Proxy env vars not reaching the process, or TLS verification blocking | Re-run with `BUN_CONFIG_PROXY` explicitly set; if necessary set `NODE_TLS_REJECT_UNAUTHORIZED=0` in dev |
+| `ECONNRESET` on every request | Using `HTTP_PROXY` not `BUN_CONFIG_PROXY` with Bun | Switch to `BUN_CONFIG_PROXY` |
+| TLS cert errors via proxy | MITM CA not trusted | Trust HTTP Toolkit CA locally, or use `NODE_TLS_REJECT_UNAUTHORIZED=0` in dev only |
+| `ERR_UNKNOWN_FILE_EXTENSION .dylib` | Running with tsx/Node on a CLI that needs Bun | Run the CLI with `bun` directly |
+| HTTP Toolkit API 403s on `/config` | Auth-gated config endpoint | Treat 200/401/403 as reachable; only connection failure means the server is dead |
+| Export has outbound data but no matching inbound events | Didn't capture the CLI log | Add `> /tmp/cli.log` redirection to the CLI launch |
+| HTTP Toolkit misses the first request | Started capturing after the process launched | Start HTTP Toolkit first, THEN launch the CLI |

plugins/github-workflow/.factory-plugin/plugin.json

@@ -0,0 +1,8 @@
+{
+  "name": "github-workflow",
+  "description": "GitHub pull request lifecycle skills: create, triage, follow up on, and cut release PRs with consistent conventions",
+  "author": {
+    "name": "Factory",
+    "email": "support@factory.ai"
+  }
+}

plugins/github-workflow/README.md

@@ -0,0 +1,19 @@
+# github-workflow
+
+GitHub pull request lifecycle skills: open, triage, follow up on, and ship release PRs with consistent conventions.
+
+## Skills
+
+### `create-pr`
+
+Open a PR with Conventional Commits title, a templated body, local verification (lint/typecheck/tests), and an optional linked ticket. Use when the user asks to "create a PR," "open a PR," or "put code up for review."
+
+### `follow-up-on-pr`
+
+Take over an existing PR: rebase on the base branch, address reviewer comments, fix CI failures, and push updates to a merge-ready state. Accepts a PR URL or number as input.
+
+## Install
+
+```bash
+droid plugin install github-workflow@factory-plugins
+```