frontend-skills

{
  "name": "frontend-skills",
  "version": "4.12.0",
  "description": "React/TypeScript frontend + Go backend enforcement harness. 92 wired hooks (101 scripts) enforce patterns on every edit. Green != done: `test-warning-check` (local Bash PostToolUse) + `ci-warning-audit` (Stop, scans `gh run view --log`) block passing tests with DeprecationWarning / React `act()` / unhandled rejection / `@ts-ignore` noise. 71 skills from TDD through CI-green PR, including /diagnose feedback-loop-first 6-phase debugger + /triage multi-tracker (gh + acli) state machine + /steelman anti-sycophancy guard + /snyk-ux-security JS+Go per-path vuln sweep (exploitability-triage first gate, top-level-first upgrade ladder, React 18 pin, `govulncheck` for Go). 21 LLM failure modes (7 Karpathy single-agent + 14 MAST multi-agent, Cemri et al. NeurIPS 2025), OWASP + STRIDE, Core Web Vitals gate, bun.lock + yarn.lock parity, worktree isolation + branch safety, MCP ban with CLI redirect (~20x savings), agent-browser integration (~91% token reduction). 9 agents (3 plan-review hats + karpathy reference), 5 routines. Single-source manifest codegen. Opus 4.7 tuned. POSIX-friendly.",
  "author": {
    "name": "Redpanda Data",
    "url": "https://github.com/redpanda-data"
  },
  "homepage": "https://github.com/redpanda-data/ui-harness",
  "repository": "https://github.com/redpanda-data/ui-harness",
  "license": "MIT",
  "keywords": [
    "react",
    "typescript",
    "frontend",
    "tdd",
    "accessibility",
    "hooks",
    "skills",
    "agents",
    "quality-gate",
    "routines",
    "sandcastle",
    "session-logging",
    "intent-detect",
    "caveman"
  ],
  "skills": "./",
  "hooks": "./hooks/codex-hooks.json",
  "interface": {
    "displayName": "Frontend Skills",
    "shortDescription": "React/TypeScript + Go enforcement harness — 92 hooks, 101 scripts, 71 skills, 9 agents, 5 routines",
    "longDescription": "React/TypeScript frontend + Go backend enforcement harness. 92 wired hooks across 101 scripts enforce patterns on every edit, including accessibility, Tailwind, React Compiler, Zustand, TanStack Router, connect-query, env validation, strict TypeScript, unhappy paths, security, warnings, CI, and PR feedback completeness. 71 skills guide the development lifecycle from TDD through CI-green PR, including /diagnose, /triage, /steelman, /snyk-ux-security, and grill-with-docs/ADR workflows. 9 agents support review and planning hats. 5 routines automate recurring workflows. Codex packaging maps every supported equivalent lifecycle event, including PermissionRequest and PostToolUse failure handling, while Claude packaging keeps the full hook surface.",
    "developerName": "Redpanda Data",
    "category": "Development",
    "capabilities": [
      "Interactive",
      "Write"
    ],
    "websiteURL": "https://github.com/redpanda-data/ui-harness",
    "defaultPrompt": [
      "Set up the frontend development lifecycle",
      "Run the full quality gate on my changes",
      "Review this PR and fix all findings"
    ]
  },
  "x-updatedAt": "2026-06-26",
  "x-includes": {
    "instructions": [
      "CLAUDE.md",
      "AGENTS.md"
    ],
    "settings": "settings.json"
  },
  "x-changelog": {
    "4.12.0": "2026-06-26 -- Upstream the 8-hat `/review` skill and its dependency skills from the personal fork (`malinskibeniamin/skills`). Replaces the prior 21-line `/review` stub with the full diff-review-from-a-fixed-point workflow: 8 parallel review hats (ponytail, thermo-nuclear, resilience, regular Standards+Spec, adversarial, visual, test-perf, security-privacy-triage) via general-purpose subagents or `/swarm`, merged + deduped by root cause, a PR value gate with a `/steelman` fallback, and auto-posted P0-P3 inline PR comments with a comment-ready fallback. Adds the five skills `/review` invokes that were missing from ui-harness: `/deslop`, `/ponytail-review`, `/resilience-review`, `/thermo-nuclear-code-quality-review`, `/swarm` (`/visual-review`, `/steelman`, `/grill-me` already present). New evals: test-review (26 checks), test-thermo-nuclear-code-quality-review, test-swarm (deslop and resilience-review ship without evals here -- their fork evals assert harness-wide integration that is out of scope). Skills 66 -> 71.",
    "4.11.0": "2026-05-26 -- Add `/visual-review` skill for browser-based frontend QA before PRs. The workflow runs standalone and is wired into `/go`, `/commit-push`, `/commit-push-pr`, self-reviewer, and code-reviewer for frontend diffs, requiring visual review evidence or an explicit skip reason. Ships platform/environment fingerprinting (browser, user agent, platform, viewport, visualViewport, DPR, media preferences, locale/direction), a platform risk map, Web Weekly-informed visual/a11y/perf checks, and 79 eval assertions. Skills 65 -> 66.",
    "4.10.6": "2026-05-25 -- Codex marketplace install fix: expose root plugin through root plugin path so Codex marketplace source path is a plugin directory while retaining root-relative plugin packaging.",
    "4.10.5": "2026-05-25 -- Vendor remaining mattpocock/skills into repo, caveman-compress new skill docs, add vendoring evals, and fix detached-HEAD branch-safety eval coverage.",
    "4.10.4": "2026-05-25 -- Complete mattpocock/skills May 18-20 sync: add /improve-codebase-architecture HTML-report workflow + HTML-REPORT.md, redaction guardrails in /handoff, and glossary-only CONTEXT-FORMAT cleanup; evals expanded.",
    "4.10.3": "2026-05-21 -- Add /handoff skill for compact cross-session and cross-agent continuation briefs. Registers the skill in plugin packaging, documents the workflow, and adds eval coverage. Skills 51 -> 52.",
    "4.10.2": "2026-05-06 -- Codex hook parity pass: map Claude PostToolUseFailure into Codex PostToolUse, add a Codex PermissionRequest adapter that reuses approval-safe Bash/MCP deny guardrails, and regenerate Codex hooks so the plugin uses every supported Codex lifecycle event with an equivalent harness behavior.",
    "4.10.1": "2026-05-06 -- Codex marketplace packaging fix: point Codex plugin hooks at a Codex-supported lifecycle file, regenerate .codex/hooks.json from the manifest, refresh stale install-surface copy (92 hooks / 100 scripts / 51 skills / 9 agents / 5 routines), and bump marketplace metadata for upgrade detection.",
    "4.10.0": "2026-04-29 -- Sync mattpocock/skills (Apr 17 -> Apr 29). New `/diagnose` skill ported verbatim: feedback-loop-first 6-phase debug discipline (build loop -> reproduce -> 3-5 ranked falsifiable hypotheses -> instrument with `[DEBUG-prefix]` cleanup grep -> fix at correct seam + regression test -> cleanup + post-mortem hand-off to `/improve-codebase-architecture`); 10 ranked Phase-1 strategies; ships `scripts/hitl-loop.template.sh`. Merged `github-triage` + `triage-issue` into single `/triage` (multi-tracker: `tracker-github.md` via `gh issue`, `tracker-jira.md` via `acli jira workitem`); bug-investigation + TDD-fix-plan absorbed as sub-mode; 5 canonical state roles map to project-specific labels/statuses; AI-disclaimer required on every triage comment. Vague-prose domain-glossary + ADR awareness added to `/tdd`, `/improve-codebase-architecture`, `/zoom-out`, `/triage` -- soft-dep, degrades gracefully when no `CONTEXT.md`. Upstream content merged while preserving 3-hat fan-out: `improve-codebase-architecture/LANGUAGE.md` (canonical vocab + deletion test); `tdd/tests.md` (good vs bad tests); `domain-model/ADR-FORMAT.md` 'what qualifies' enriched. Skills 48 -> 51. +96 eval checks (test-triage, test-diagnose, test-domain-model-merge); test-tdd patched. Skipped per direction: caveman, git-guardrails, to-prd/to-issues, setup skill explicit pointer.",
    "4.9.0": "2026-04-23 -- Green != done warnings gate (+2 hooks, 89->91 wired / 98->100 scripts). `test-warning-check.sh` (PostToolUse Bash) scans passing `vitest`/`bun test`/`playwright`/`tsgo`/`biome`/`lint` output for curated warning patterns: Node `DeprecationWarning` + `ExperimentalWarning` + `(node:...) XxxWarning`, React `act()`/missing-key/DOM-nesting/prop-type/bad-setstate/non-boolean-attr, unhandled promise rejection / unhandled error, vitest `stderr |` during test, skipped-test counts, `@ts-expect-error` / `@ts-ignore`, `npm WARN deprecated`. Per-finding escape `// allow: test-warning` in test file with reason; env `TEST_WARNINGS_ALLOW=1`. 3x same-kind streak escalates via systemMessage. `ci-warning-audit.sh` (Stop) fetches `gh run view <id> --log` on green PR CI (per-SHA cache, 45s timeout), greps same pattern, warns with file:line sample + fetch-full command. Gates: feature branch, session touched code, PR exists, all checks SUCCESS (pending/fail defer to lifecycle-stop). Disable via `CI_WARNING_AUDIT=0`. CLAUDE.md Tests section adds green-not-done rule. tdd/SKILL.md `When Done` adds zero-warnings local + CI log audit checkboxes. Why: tests can be green while runtime spews deprecations / logs errors / leaks unhandled rejections -- noise rots into real bugs when the libs actually remove the API. Agent must clean before calling it done.",
    "4.8.0": "2026-04-22 -- /steelman anti-sycophancy skill (opt-in only). New skill at steelman/SKILL.md argues strongest opposite case with repo evidence on user assertions -- factual/causal/architectural claim types only (preference/goal/scope declined). Procedure: identify claim -> fan-out evidence gather (grep, read, run) -> write counter-argument with file:line refs -> verdict (confirmed | contradicted | mixed). User-invoked via `/steelman` slash only. **No ambient CLAUDE.md rule, no automatic hook fire, no telemetry log script** -- plugin consumers see zero behavior change unless they type `/steelman`. Ambient premise-check directive + jsonl telemetry were considered and held back pending real-world feedback on the opt-in surface; re-evaluate once /steelman fire-rate data exists from dogfooding. Why: LLM sycophancy risk when the user asserts something wrong and the model agrees by default -- /steelman forces the strongest counter-case with repo evidence before proceeding. Skills 47 -> 48 (registers the skill file that was previously on disk but unlisted).",
    "older": "see CHANGELOG.md for full history"
  }
}

{
  "name": "frontend-skills",
  "description": "React/TypeScript frontend + Go backend enforcement harness. 92 wired hooks across 101 scripts enforce patterns on every edit. Green != done: `test-warning-check` surfaces warnings on passing test/lint/type runs (DeprecationWarning, React `act()`, unhandled rejection, `@ts-ignore`); `ci-warning-audit` Stop-hook scans `gh run view --log` on green CI for deprecations / console warnings / skipped tests. 71 skills from TDD through CI-green PR, including /steelman anti-sycophancy guard + /snyk-ux-security per-path vuln sweep (JS + Go ecosystems; exploitability-triage first gate via `bun why`/`go mod why`/`govulncheck`; top-level direct dep bump first, parent dep bump second, resolutions/overrides/replace as last resort only with follow-up TODO to remove; React 18 pin + changelog-walked major bumps + no-deferral escalation; Go `snyk test --file=go.mod` + `go get -u` + `go mod tidy` + `govulncheck` verify). Session exit blocked while PR review threads remain unresolved. TypeScript escape hatches blocked at Edit. tsconfig strictness weakening blocked. Worktree isolation + branch safety hook-enforced. bun.lock + yarn.lock parity enforced (Snyk IO doesn't parse bun.lock). 21 LLM failure modes enforced: 7 Karpathy single-agent + 14 MAST multi-agent (Cemri et al. NeurIPS 2025). OWASP + STRIDE subset + snyk/bun audit. Core Web Vitals perf gate. MCP ban with CLI redirect (~20x token savings). Agent-browser wrap (~91% token reduction for AI browsing). 3-hat plan review (product/engineering/design). 9 agents (adds plan hats + karpathy reference), 5 routines. Opus 4.7 tuned, POSIX-friendly.",
  "version": "4.12.0",
  "author": {
    "name": "Redpanda Data"
  },
  "homepage": "https://github.com/redpanda-data/ui-harness",
  "repository": "https://github.com/redpanda-data/ui-harness",
  "license": "MIT",
  "keywords": [
    "react",
    "typescript",
    "frontend",
    "tdd",
    "accessibility",
    "hooks",
    "skills",
    "agents",
    "quality-gate",
    "routines",
    "sandcastle",
    "session-logging",
    "intent-detect",
    "caveman"
  ],
  "skills": [
    "./brainstorming/",
    "./caveman/",
    "./codex-compat/",
    "./commit-push-pr/",
    "./commit-push/",
    "./design-an-interface/",
    "./deslop/",
    "./development-lifecycle/",
    "./diagnose/",
    "./domain-model/",
    "./edit-article/",
    "./extend-harness/",
    "./frontend-skills-stats/",
    "./frontend-starter-kit/",
    "./git-guardrails-claude-code/",
    "./go/",
    "./grill-me/",
    "./grill-with-docs/",
    "./handoff/",
    "./hook-audit/",
    "./improve-codebase-architecture/",
    "./migrate-to-shoehorn/",
    "./obsidian-vault/",
    "./ponytail-review/",
    "./prototype/",
    "./redpanda-frontend-kit/",
    "./request-refactor-plan/",
    "./resilience-review/",
    "./resolve-pr-feedback/",
    "./review/",
    "./scaffold-exercises/",
    "./setup-accessibility/",
    "./setup-agent-config/",
    "./setup-atlassian-workflow/",
    "./setup-biome/",
    "./setup-ci-pipeline/",
    "./setup-connect-query/",
    "./setup-conventional-commits/",
    "./setup-e2e-testing/",
    "./setup-env-validation/",
    "./setup-pre-commit/",
    "./setup-quality-gate/",
    "./setup-react-compiler/",
    "./setup-react-doctor/",
    "./setup-react-rules/",
    "./setup-registry-workflow/",
    "./setup-routines/",
    "./setup-sandcastle/",
    "./setup-tanstack-router/",
    "./setup-toolchain/",
    "./setup-ux-copy/",
    "./setup-zustand/",
    "./snyk-ux-security/",
    "./steelman/",
    "./swarm/",
    "./tdd/",
    "./thermo-nuclear-code-quality-review/",
    "./to-issues/",
    "./to-prd/",
    "./triage/",
    "./visual-review/",
    "./work-automation-kit/",
    "./work/",
    "./write-a-skill/",
    "./writing-beats/",
    "./writing-fragments/",
    "./writing-shape/",
    "./zoom-out/"
  ],
  "agents": [
    "./agents/adversarial-reviewer.md",
    "./agents/code-reviewer.md",
    "./agents/findings-schema.md",
    "./agents/karpathy-failure-modes.md",
    "./agents/plan-design-hat.md",
    "./agents/plan-engineering-hat.md",
    "./agents/plan-product-hat.md",
    "./agents/self-reviewer.md",
    "./agents/verifier.md"
  ],
  "x-updatedAt": "2026-06-26",
  "x-includes": {
    "instructions": [
      "CLAUDE.md",
      "AGENTS.md"
    ],
    "settings": "settings.json",
    "manifestSource": "skill-manifest.json"
  },
  "x-changelog": {
    "4.12.0": "2026-06-26 -- Upstream the 8-hat `/review` skill and its dependency skills from the personal fork (`malinskibeniamin/skills`). Replaces the prior 21-line `/review` stub with the full diff-review-from-a-fixed-point workflow: 8 parallel review hats (ponytail, thermo-nuclear, resilience, regular Standards+Spec, adversarial, visual, test-perf, security-privacy-triage) spawned via general-purpose subagents or `/swarm`, merged + deduped by root cause, a PR value gate with a `/steelman` fallback, and auto-posted P0-P3 inline PR comments with a comment-ready fallback. Adds the five skills `/review` invokes that were missing from ui-harness: `/deslop`, `/ponytail-review`, `/resilience-review`, `/thermo-nuclear-code-quality-review`, `/swarm` (`/visual-review`, `/steelman`, `/grill-me` were already present). New evals: test-review (26 checks), test-thermo-nuclear-code-quality-review, test-swarm -- auto-discovered by evals/run.sh (deslop and resilience-review ship without evals here -- their fork evals assert harness-wide integration that is out of scope). Registered the five new skill dirs in plugin.json. Skills 66 -> 71.",
    "4.11.0": "2026-05-26 -- Add `/visual-review` skill for browser-based frontend QA before PRs. The workflow runs standalone and is wired into `/go`, `/commit-push`, `/commit-push-pr`, self-reviewer, and code-reviewer for frontend diffs, requiring visual review evidence or an explicit skip reason. Ships platform/environment fingerprinting (browser, user agent, platform, viewport, visualViewport, DPR, media preferences, locale/direction), a platform risk map, Web Weekly-informed visual/a11y/perf checks, and 79 eval assertions. Skills 65 -> 66.",
    "4.10.6": "2026-05-25 -- Codex marketplace install fix: expose root plugin through root plugin path so Codex marketplace source path is a plugin directory while retaining root-relative plugin packaging.",
    "4.10.5": "2026-05-25 -- Vendor remaining mattpocock/skills into repo, caveman-compress new skill docs, add vendoring evals, and fix detached-HEAD branch-safety eval coverage.",
    "4.10.4": "2026-05-25 -- Complete mattpocock/skills May 18-20 sync: add /improve-codebase-architecture HTML-report workflow + HTML-REPORT.md, redaction guardrails in /handoff, and glossary-only CONTEXT-FORMAT cleanup; evals expanded.",
    "4.10.3": "2026-05-21 -- Add /handoff skill for compact cross-session and cross-agent continuation briefs. Registers the skill in plugin packaging, documents the workflow, and adds eval coverage for mktemp-based handoff docs, artifact-linking discipline, and suggested next skills. Skills 51 -> 52.",
    "4.10.2": "2026-05-06 -- Codex hook parity pass: map Claude PostToolUseFailure into Codex PostToolUse, add a Codex PermissionRequest adapter that reuses approval-safe Bash/MCP deny guardrails, and regenerate Codex hooks so the plugin uses every supported Codex lifecycle event with an equivalent harness behavior.",
    "4.10.1": "2026-05-06 -- Codex marketplace packaging fix: point Codex plugin hooks at a Codex-supported lifecycle file, regenerate .codex/hooks.json from the manifest, refresh stale install-surface copy (92 hooks / 100 scripts / 51 skills / 9 agents / 5 routines), and bump marketplace metadata for upgrade detection.",
    "4.10.0": "2026-04-29 -- Sync mattpocock/skills (Apr 17 -> Apr 29). New `/diagnose` skill ported verbatim: feedback-loop-first 6-phase debug discipline (build loop -> reproduce -> 3-5 ranked falsifiable hypotheses -> instrument with `[DEBUG-prefix]` cleanup grep -> fix at correct seam + regression test -> cleanup + post-mortem hand-off to `/improve-codebase-architecture`). 10 ranked feedback-loop strategies in Phase 1 (failing test, curl/HTTP, CLI fixture diff, headless browser, replay, throwaway harness, property/fuzz, `git bisect run`, differential, HITL). `scripts/hitl-loop.template.sh` for human-in-the-loop bug repro. Merged `github-triage` + `triage-issue` into single `/triage` with multi-tracker support: `tracker-github.md` uses `gh issue`, `tracker-jira.md` uses `acli jira workitem`. Bug-investigation + TDD-fix-plan flow absorbed as sub-mode in `triage/REFERENCE.md`. Five canonical state roles (`needs-triage`, `needs-info`, `ready-for-agent`, `ready-for-human`, `wontfix`) map to project-specific labels/statuses; AI disclaimer required on every triage comment. Vague-prose domain-glossary + ADR awareness added to `/tdd`, `/improve-codebase-architecture`, `/zoom-out`, `/triage` -- soft-dependency style: skills degrade gracefully when no `CONTEXT.md` exists. Upstream content merged while preserving our 3-hat fan-out (product/engineering/design): `improve-codebase-architecture/LANGUAGE.md` adds canonical vocabulary (module/interface/seam/adapter/depth/leverage/locality + deletion test + interface-is-test-surface + one-vs-two-adapters rule); `tdd/tests.md` adds good vs bad test philosophy (integration-style behaviour through public interface, never implementation details); `domain-model/ADR-FORMAT.md` 'what qualifies' enriched with boundary decisions, invisible constraints, non-obvious rejections. Skills 48 -> 51 (added /diagnose, registered /domain-model + /zoom-out which existed on disk but weren't in plugin.json, removed /triage-issue, added /triage). +96 eval checks across 3 new evals: `test-triage.sh` (32), `test-diagnose.sh` (29), `test-domain-model-merge.sh` (35); `test-tdd.sh` patched to assert `tests.md` link. Skipped per direction: caveman, git-guardrails, to-prd/to-issues, setup skill explicit pointer (vague prose only). `domain-model` not renamed to upstream's `grill-with-docs` -- high blast radius (Phase 2b lifecycle gate name) + current name more semantic.",
    "4.9.0": "2026-04-23 -- Green != done warnings gate. Two new hooks (89 -> 92 wired, 98 -> 100 scripts). (1) `test-warning-check.sh` (PostToolUse Bash): on exit=0 from `vitest` / `bun test` / `playwright` / `tsgo` / `tsc` / `biome` / `lint`, scans stdout + stderr for curated warning patterns -- Node `DeprecationWarning`, `ExperimentalWarning`, `(node:...) XxxWarning`, React `Warning: An update to .* inside a test was not wrapped in act`, `Warning: Each child in a list should have a unique \"key\"`, `Warning: validateDOMNesting`, `Warning: Failed prop type`, `Warning: Cannot update a component .* while rendering`, `Warning: Received .* for a non-boolean attribute`, `MaxListenersExceededWarning` / `PossibleEventEmitterMemoryLeak`, `UnhandledPromiseRejection` / `Unhandled Rejection` / `Unhandled Errors`, vitest `stderr |` during test, `Tests skipped N`, `@ts-expect-error`, `@ts-ignore`, `npm WARN deprecated`. Emits systemMessage nudge with file:line sample. Per-test-file escape `// allow: test-warning`; env `TEST_WARNINGS_ALLOW=1` globally. 3x same-kind streak escalates via warning-streak tracker. (2) `ci-warning-audit.sh` (Stop hook): gated on feature branch + session touched code + PR exists + all CI checks SUCCESS (pending/failing defers to lifecycle-stop). Resolves PR head SHA, fetches `gh run view <id> --log` with 45s timeout, pipes through grep on the same curated pattern, heads 30. Per-SHA cache in session dir so repeat Stops don't re-fetch the same log. `hook_warn` (non-blocking) with file:line sample + suggested full-log command. Disable via `CI_WARNING_AUDIT=0`. (3) CLAUDE.md Tests section + tdd/SKILL.md `When Done` checklist updated: zero warnings in local output AND CI, with escape hatch documented. Why: passing tests can silently spew deprecations, log errors, leak unhandled rejections -- noise that rots into real bugs when the lib actually removes the API. 'Green' was never the bar; zero warnings is.",
    "4.8.0": "2026-04-22 -- /steelman anti-sycophancy skill (opt-in only). New skill at steelman/SKILL.md argues strongest opposite case with repo evidence on user assertions -- factual/causal/architectural claim types only (preference/goal/scope declined). Procedure: identify claim -> fan-out evidence gather (grep, read, run) -> write counter-argument with file:line refs -> verdict (confirmed | contradicted | mixed). User-invoked via `/steelman` slash only. **No ambient CLAUDE.md rule, no automatic hook fire, no telemetry log script** -- plugin consumers see zero behavior change unless they type `/steelman`. Ambient premise-check directive + jsonl telemetry were considered and held back pending real-world feedback on the opt-in surface; re-evaluate once /steelman fire-rate data exists from dogfooding. Why: LLM sycophancy risk when the user asserts something wrong and the model agrees by default -- /steelman forces the strongest counter-case with repo evidence before proceeding. Skills 47 -> 48 (registers the skill file that was previously on disk but unlisted).",
    "older": "see CHANGELOG.md for full history"
  }
}