Chewiesoft Marketplace
Plugin marketplace for Claude Code, Cursor and Codex — CI/CD, code review, deployments, releases, and more.
Installation · Plugins · Auto-updates · Team Distribution · References
A curated plugin marketplace for Claude Code and Cursor by j0ruge. Each plugin packages production-ready skills and commands that integrate directly into your workflow — no configuration needed beyond install.
Platform Compatibility
| Plugin | Claude Code | Cursor | Codex CLI | Notes |
|---|
| ansible-docker-backup-restore | ✓ | ✓ | ✓ | Skill — backup + restore of Dockerized services via Ansible, with a read-only backup-freshness check |
| cicd | ✓ | ✓ | ✓ | Skill — works on both platforms without changes |
| codereview | ✓ | ✓ | partial | Skills — adapted automatically by the installer Codex: As duas entradas carregam, mas o corpo exige Agent/model sonnet; equivalência completa não comprovada. |
| cors | ✓ | ✓ | ✓ | Skill — works on both platforms |
| criar-prd | ✓ | ✓ | ✓ | Command (Claude Code) / Skill (Cursor) |
| criar-task | ✓ | ✓ | ✓ | Command (Claude Code) / Skill (Cursor) |
| criar-techspec | ✓ | ✓ | ✓ | Command (Claude Code) / Skill (Cursor) |
| ddd | ✓ | ✓ | ✓ | Skill — works on both platforms |
| deploy | ✓ | ✓ | ✓ | Skill — works on both platforms |
| dev-script | ✓ | ✓ | ✓ | Skill — generates dev.sh (bash) + dev.ps1 (PowerShell) per project |
| dotnet-wpf | ✓ | ✓ | partial | Skills — works on both platforms Codex: Agrupamento preservado: setup exige regras, hooks e configuração Claude; três skills isoladas não autorizam publicar o pacote inteiro. |
|
Codex: 27 plugins / 30 workflows, com smoke de distribuição e entrada no CLI 0.163.0
(hook-builder na 0.164.0 e env-docs-sync na 0.165.0) em Ubuntu 24.04. Desktop, macOS e Windows: not_checked; versão mínima não estabelecida.
Dependências, limitações e exclusões: matriz detalhada.
O catálogo Codex é filtrado; a extensão de IDE está fora desta distribuição.
partial também cobre adaptações locais que funcionam no Codex, mas ainda não
estão empacotadas neste catálogo, como retrofit-watch.
Installation
Claude Code
# Add the marketplace (pick one)
/plugin marketplace add j0ruge/skills # via GitHub
/plugin marketplace add [email protected]:j0ruge/skills.git # via SSH
Then install any plugin:
/plugin install codereview # or: ansible-docker-backup-restore, cicd, cors, criar-prd, criar-task, criar-techspec, ddd, deploy, dev-script, dotnet-wpf, env-docs-sync, executar-task, git-housekeeping, hook-builder, html-presentation, kaizen-software, n8n-ops, pdf-generation, release, retrofit-skill, retrofit-watch, skill-quality-audit, statusline, ticket, todo-to-github-issues, ts-library, unlovable, whisper-preprocess, windows-disk-cleanup, windows-games-linux, wsl-windows-onboarding, zitadel-idp
[!TIP]
Keep plugins up to date with a single command:
/plugin marketplace update
Cursor
Clone the repo and run the interactive installer:
git clone [email protected]:j0ruge/skills.git
cd skills
python install.py
The installer prompts for platform (Claude Code, Cursor, Codex, or Claude Code + Cursor) and where to place the Cursor skills. It automatically adapts plugin content for Cursor.
[!IMPORTANT]
Cursor has no global skills directory — only project-local .cursor/skills/ is auto-loaded by the agent (Cursor docs). Run python install.py from inside each project where you want the skills available, and pick the Project option.
The installer also offers a Staging cache option that copies the converted skills to ~/.cursor/skills/ as a master copy — handy as a source to mirror into projects, but Cursor itself will not pick those up directly.
Codex
python3 install.py oferece Codex e mostra os comandos sem executá-los.
A opção Claude Code + Cursor continua limitada às duas plataformas.
Escolha plugins individualmente; um pacote com várias skills mantém seu
agrupamento e não instala o restante da loja.
Depois que esta revisão estiver publicada no repositório remoto:
codex plugin marketplace add j0ruge/skills
codex plugin list --marketplace chewiesoft-marketplace --available --json
codex plugin add cors@chewiesoft-marketplace
Antes da publicação, registre a raiz do clone candidato com
codex plugin marketplace add /caminho/absoluto/skills. O remoto antigo não prova
esta implementação. Inicie sessão nova após instalar e use /skills ou
$cors:cors. skill-quality-audit expõe suas quatro skills; release exige
$release:release explícito. Ferramentas e credenciais são requisitos do consumidor.
env-docs-sync traz hooks, e o Codex só os roda depois de
python3 <cache do plugin>/skills/env-docs-sync/scripts/env_docs_sync.py install --codex --apply,
que grava o trust no config.toml (sem --apply, mostra o diff). Cada update do plugin pede o comando de novo.
Para atualizar a origem Git, no CLI testado o refresh também atualiza os plugins
instalados. Confira a versão e inicie uma sessão nova:
codex plugin marketplace upgrade chewiesoft-marketplace --json
codex plugin list --marketplace chewiesoft-marketplace --json
Para remover um plugin e depois a origem:
codex plugin remove cors@chewiesoft-marketplace --json
codex plugin marketplace remove chewiesoft-marketplace --json
Confira a sequência medida, hashes e limites em
verification.md. Reinstalar pelo comando plugin add
também foi comprovado, mas não foi necessário após o refresh Git da versão testada.
Available Plugins
| Plugin | Version | Category | Description |
|---|
| cicd | 2.39.1 | Development | CI/CD troubleshooting for GitHub Actions, Docker, GHCR, and self-hosted runners (systemd-on-host e containerizado via myoung34/github-runner) — cobre CMD-herdado-zerado, env LABELS vs RUNNER_LABELS, EPHEMERAL+restart:always loop, gpg --dearmor em buildkit, deploy keys per-repo unique, .env leading whitespace + sed silenciando, monorepo workspace hoisting diagnosis, vitest jsdom→happy-dom recipe pra msw v2. (NEW v2.12.0) troubleshooting-shared.md §1a — GHCR net/http: TLS handshake timeout no docker login do deploy job self-hosted é bug DISTINTO de §1 unauthorized (TCP conectou mas handshake não completou — credencial é irrelevante); isolation key é build-and-push em ubuntu-latest passar enquanto deploy em self-hosted falha; causa raiz típica é MTU mismatch em VPN/overlay ou TLS-inspection proxy; Fix A bash retry wrapper 3x backoff 10s/20s ao redor de docker login (20 linhas, sem nick-fields/retry); Fix B mtu: 1400 em /etc/docker/daemon.json + restart. Reference dedicada cd-pipeline-pitfalls.md cobre 7 classes de bugs de cutover/CI prod: (1) VITE/CRA/Next build args bake'd no image, frontend rebuild mandatory; (2) operator clone reconciliando stack stale; (3) docker compose --profile X run reconciliando containers de outros services; (4) compose run --rm orphan + nginx-proxy upstream poisoning (~50% intermittent 401s); (5) container scripts que escrevem upward de __dirname batem ENOENT em prod (Dockerfile só copia packages/<self>/) — fix canônico é try/catch best-effort, v2.11.0 refinement narrow catch para ENOENT/ENOTDIR e propagar EACCES/ENOSPC/EROFS preserva visibilidade de problemas reais em dev (especialmente importante quando bootstrap.json é consumido por sanity check downstream); v2.11.0 §6 — GHA bind mount uid mismatch: container vendorado roda uid 1000 (Postgres, Zitadel, vários), runner GHA ubuntu-latest é uid 1001 com pasta 0755 → EACCES no init/setup, e o estado parcial deixado para trás cascata em erros DIFERENTES nas retries (constraint violation, already-exists), burying the real cause; cura é pre-create do bind mount com ; — espera TODOS os serviços com healthcheck por default; um sibling lento (Next.js/Vite ~90s+ no runner pequeno) estoura da stack inteira; cura é passar service names explícitos no + companion sempre dumpar logs do serviço lento no on-failure (Up 19 hours (healthy)RestartCountonline busy=falseListening for JobsBrokerMigration message received_diagls -d /actions-runner/bin.` a indicator rather than a post-mortem, and is the strongest argument for the version-currency layer. It also softens the claim about layer B: it sees nothing until someone deploys, but here it would have fired an hour before the human did. The method lesson is the one worth keeping — "three weeks" was from a directory dated 01/09 and a "last deploy 21/08" that only meant nobody had deployed since; neither measured downtime. An artifact's date is not a failure's date. |
Plugin Details
Unified troubleshooting and pipeline configuration for GitHub Actions, Docker, GHCR, and self-hosted runners. Auto-detects backend (Prisma/Biome) or frontend (Vite) projects and routes to specific references.
| Skill | Description |
|---|
/cicd | Troubleshoots and configures CI/CD pipelines — 30+ scenarios, 50+ lessons learned (incl. dedicated self-hosted-runner-docker.md reference for myoung34/github-runner setups com §7 cobrindo o cenário deadlock-em-prod por RUNNER_REGISTRATION_TOKEN estática + a migração ACCESS_TOKEN in-place como fix durável (lesson 46), + §8/§9 (lessons 47–49) cobrindo crashloops ortogonais ao token — versão de binário deprecada e config stale reaproveitada, e cd-pipeline-pitfalls.md cobrindo 5 classes de cutover-prod bugs incluindo upstream pool poisoning por compose run orphans e §5 sobre container scripts escrevendo paths fora do WORKDIR — ENOENT mascarado por soft-failure que pinta yellow warning ambiente em todo deploy) |
Highlights: project-type detection, tagged troubleshooting ([S] shared / [B] backend / [F] frontend), Jest OOM fixes, Biome 2.x migration, stale Docker image cache handling.
Diagnóstico e configuração de CORS, organizado em torno de um fato: o sintoma mente. O catch do app traduz o bloqueio para "serviço indisponível", e o curl — que não implementa a same-origin policy — devolve 200 alegremente. Nasceu de uma sessão real em que essas duas mentiras juntas custaram duas tentativas antes de alguém abrir o console.
| Skill | Description |
|---|
/cors | Decide qual portão barrou (CORS × CSP connect-src × mixed content), lê a mensagem literal do Chrome, e dá a receita por stack (nginx, Express, Django, Spring, FastAPI, CDN/API Gateway) |
Highlights: triagem em 3 comandos · sonda de console que separa os portões em uma execução · add_header sem always fazendo um 500 legítimo virar "erro de CORS" · preflight que não pode redirecionar nem ser autenticado · Vary: Origin e cache poisoning em CDN · reflexão de origem, null e bypass de regex · Local Network Access do Chrome 142 · checklist de fechamento.
Stack-agnostic pre-PR code review built on The Zen of Python as a universal analysis framework. Five principles — readability, explicitness, simplicity, flatness, and error handling — applied as analysis lenses to any codebase. Now with model routing for 76-86% Opus token savings.
| Skill | Description |
|---|
/codereview | Full pre-PR review — diffs against base branch, severity-rated findings (CRITICAL → LOW), final grade (A-F). Gathers git context inline, uses sonnet for per-file analysis and the main model for cross-file review and report; was: haiku for git context, sonnet for per-file analysis, opus for cross-file review and report. |
/codereview:coderabbit-pr | Resolves AI review bot comments (CodeRabbit, Copilot, Gemini, Codex) on a GitHub PR — auto-detects reviewers, creates per-reviewer checklists, triages with severity recalibration, applies fixes, runs regression tests, resolves all GitHub conversations |
Analysis layers: Bug Detection · Security · Secrets Detection (deterministic regex script + optional ggshield/gitleaks, always-on, blocks grade F) · Performance · Type Safety · Test Coverage · Documentation Sync · Race Conditions (TOCTOU) · Accessibility · Data Integrity
Model routing: inline (git/CLI, secrets pre-scan) → Sonnet (per-file analysis, parallel) → main model (cross-file review, report)
Framework presets: react (default) · vue · angular · node · dotnet · generic
Promotion to staging, and on to production, through the CD pipeline the repository actually has.
| Skill | Description |
|---|
/deploy:staging | Maps branch → pipeline from each workflow's on.push.branches, checks runs-on at the promoted commit, gates the exact sha locally, promotes by PR merge commit and proves the deploy by the data |
Highlights: never pushes the production branch as a side effect; sensors for content only on the target, criss-cross merge bases and long backlogs; verified database dump before a production merge; SKILL.md with the flow and four references with the measured detail.
Auto-generates categorized release notes from git history and creates a GitHub Release via gh CLI.
| Skill | Description |
|---|
/release:release [VERSION] [--path DIR] | Generates release notes and creates a GitHub Release |
Multi-stack: C#/.NET · Node.js · Go · Rust · Python
Monorepo: --path filter scopes commits to subdirectories
Contributors: resolved via GitHub API with org membership cross-reference
Tag series: follows the repo's tags (v1.2.0 or <package>-v1.2.0); a version already published gets its notes edited, never a second tag
Invocation: disable-model-invocation: true — it publishes a release, so it runs only when called by name (/release in Cursor), never from context
Interactive wizard to configure Claude Code's status line — model info, context bar, git branch/PR state, cost, and 5h/weekly usage limits.
| Command | Description |
|---|
/statusline:setup | Interactive setup wizard — sections, colors, emojis, separator |
12 composable sections: Model name · Context bar · Git branch · Project folder · Session cost · Duration · Lines changed · Token counts · Vim mode · 5h usage window · Weekly usage · PR state
Sections 10-12 (5h/weekly usage limits, PR state) are part of the recommended default set and degrade gracefully — usage limits appear only for Pro/Max subscribers, PR state only when the branch has an open PR.
Effort-level badge (v1.4.0): when effortLevel is set in ~/.claude/settings.json, the Model section shows it inline (e.g., 🤖 Opus 4.7 [high]). Re-read on every invocation — no regeneration needed when you toggle the value.
Cross-platform: Bash + PowerShell, no jq dependency, Windows/Git Bash compatible.
Complete development toolkit for C#/.NET WPF desktop applications — from project setup to E2E testing.
| Skill | Description |
|---|
/dotnet-wpf:dotnet-desktop-setup | Configures and audits .NET desktop projects for Claude Code |
/dotnet-wpf:dotnet-wpf-design | Fluent Design guide — layout patterns, typography, 90+ WPF-UI controls catalog, date validation traps, Grid row separators (FORM-004), multi-column form layouts, ContentDialog confirmation for destructive actions (CTRL-008) |
/dotnet-wpf:dotnet-wpf-mvvm | WinForms → WPF MVVM migration with CommunityToolkit.Mvvm and WPF-UI |
/dotnet-wpf:dotnet-wpf-e2e-testing | FlaUI + xUnit E2E testing — Page Objects, AutomationId patterns, CI/CD setup |
Generates a single-command development launcher for any project — dev.sh (bash, Linux/macOS) and dev.ps1 (PowerShell 5.1/7+, Windows). Detects the stack (compose files, monorepo workspaces, frontend/backend dev servers, IdP, mkcert posture, existing launcher) and emits an idempotent script that brings up Postgres, the IdP, the backend(s), and the frontend with colored per-service prefixes, per-component healthchecks, two-strategy port handling (find-next-free port discovery with per-subshell peer-coordination env vars for ports a foreign process might legitimately own, kill-and-reclaim with fuser → lsof → ss → pgrep fallback chain for orphans the script itself spawned), trap cleanup, and HTTPS-on-LAN via mkcert + Caddy when the SPA does OIDC PKCE.
| Skill | Description |
|---|
/dev-script | Walks the project, confirms the plan, generates dev.sh and/or dev.ps1, updates .gitignore, prints onboarding for LAN clients |
What it encodes (the gotchas painfully learned in JRC projects):
- Vite ≥ 5
allowedHosts blocks non-localhost — wrap config without editing vite.config.ts
- Node backend can't validate JWKS over self-signed HTTPS without
NODE_EXTRA_CA_CERTS
- Zitadel persists
externalDomain on init — drift detection + --reset flag
- Bootstrap idempotency vs
400 COMMAND-1m88i "No changes"
--tlsMode external triad (env vars + start flag) for TLS-terminating proxiescrypto.subtle outside secure contexts → signinRedirect silently fails- Process-group cleanup (
setsid + kill -- -PGID) so Ctrl+C doesn't orphan children
- Re-derive
projectId/clientId from bootstrap.json on every boot — never hardcode
- v0.4.0 Foreign port owner +
strictPort silent-hang cascade (P17) — kill_stale_ports against a process the script can't kill silently fails, downstream Vite with strictPort: true hard-fails, parent wait keeps tracking surviving children → visually identical to a hang. Fix is port discovery + peer coordination instead of port reclaim
- v0.5.0 CRLF
.env reads (P18) — Windows/WSL CRLF appends \r to grep|cut values, so docker exec "$name\r" fails No such container and the healthcheck times out while every log line looks correct; fix is a tr -d '\r' read helper
- v0.5.0 Cross-platform
node_modules (P19) — a tree installed on Windows then run on WSL crashes Vite/swc/esbuild with Failed to load native binding (missing platform-optional binary); re-install on the target OS
- v0.5.0
yarn↔cmdtest collision (P20) — Corepack off by default → apt install yarn installs Debian's cmdtest (Parsing scenario file …); corepack enable shadows the impostor and the script resolves the package manager Corepack-aware
Cross-platform: Linux/macOS bash and Windows/cross-platform PowerShell — same flags, same semantics, idiomatic primitives in each.
Captures patterns and pitfalls discovered while integrating Zitadel v4.x self-hosted as the IdP for the JRC Brasil ERP. Read this skill BEFORE drafting Zitadel compose files, writing a Management API bootstrap, validating Zitadel JWTs, customizing the Login UI v1, or wiring an SPA via OIDC PKCE — it averages 1–3 hours saved per integration.
| Skill | Description |
|---|
zitadel-idp | Field guide with 54 documented quirks (v4-first with proto-aligned v4.15.0 examples, v2.66.x masterkey edge case, full v2.66→v4 upgrade runbook, Login UI v2 deploy bug + Path B mitigation, CD cutover survival kit, Console UI human-user creation pitfalls, production 401-storm hairpin NAT + 3-layer SPA defense, smoke-e2e CI plumbing checklist, real-browser smoke E2E gaps — seed user grant reconciliation + CORS preflight 401 + Playwright self-signed Zitadel recipe), drill-down references, and bundled working assets |
Bundled references (references/): api-cheatsheet.md, api-v1-to-v2-mapping.md (NEW v0.3.0), branding.md, docker-compose-bootstrap.md, migration-v2-to-v4.md (NEW v0.3.0), spa-recipes.md, tenant-org-mapping.md, token-validation.md, troubleshooting.md.
Bundled assets: docker-compose.zitadel.yml (working FirstInstance + volume perms), bootstrap-zitadel.ts (idempotent Management API bootstrap with multi-app applications[] and env > YAML > hardcoded precedence for dynamic dev hosts), scripts/reset-zitadel.sh.
Highlights of the gotchas encoded:
- FirstInstance env placement; v1/v2 API split; tenant →
orgId mapping
- JWT validation over self-signed HTTPS —
NODE_EXTRA_CA_CERTS, createRemoteJWKSet traps, tlsMode external, x-zitadel-orgid
- Silent-renew byte-match on redirect URIs;
signinSilent boot-time recursion; StrictMode + closure cancelled flag locking SPA in "Verifying session…"
post_logout_redirect_uri invalid; InMemoryWebStorage + F5 trap; crypto.subtle PKCE secure-context requirement on LAN- Login UI v1 branding via
privateLabelingSetting, custom_login_text, LANG-lg4DP, 405 on /assets/v1/orgs/me/policy/label/...
- Idempotent bootstrap
COMMAND-1m88i "No changes" and Org-8nfSr "Private Label Policy has not been changed"
- 401 storm post
--reset-zitadel from orphaned tsx watch / nodemon processes holding stale env+JWKS in heap
- Multi-app YAML refactor: env vars from
dev.sh must dominate static YAML when LAN host is dynamic (.sslip.io)
Scope: Zitadel v4.x self-hosted, OIDC-only (Login UI v1 primary; Login UI v2 deploy bug + Path B mitigation also covered). Out of scope: Zitadel Cloud, v3, SAML, federation IdPs.
Language-agnostic DDD toolkit that audits a codebase for tactical/strategic violations and guides design. Synthesizes Evans, Vernon and modular-monolith practice.
| Skill | Description |
|---|
/ddd | Analyzes the codebase for DDD violations, guides strategic design (event storming, context mapping, bounded-context canvas), and generates legacy→DDD migration specs |
References: bounded-context-canvas.md (DDD Crew v5), ddd-crew-process.md (6-phase canonical sequence: Big Picture → Domain Message Flow → BC Canvas → Context Map → Design Level → ADRs), plus tactical/strategic pattern guides.
Cria PRDs claros e acionáveis a partir de uma descrição de funcionalidade, mantendo foco no que será entregue e por quê.
| Command | Description |
|---|
/criar-prd:criar-prd <funcionalidade> | Faz até 5 perguntas de clarificação, usa o template de PRD (do projeto, ou o empacotado no plugin) e salva tasks/prd-[slug]/prd.md |
Guardrails: não pesquisa na web por padrão, limita o PRD a 2.000 palavras e evita decisões detalhadas de implementação.
Transforma um PRD local aprovado em uma Tech Spec implementável, explorando só o necessário do projeto.
| Command | Description |
|---|
/criar-techspec:criar-techspec <slug> | Lê tasks/prd-[slug]/prd.md, segue o template de Tech Spec (do projeto, ou o empacotado) e salva tasks/prd-[slug]/techspec.md |
Guardrails: consulta as convenções do projeto quando existem, usa rg (e a ferramenta de grafo de impacto do projeto, se houver) e pergunta só quando houver bloqueio real.
Quebra PRD e Tech Spec em tarefas principais incrementais, funcionais e testáveis.
| Command | Description |
|---|
/criar-task:criar-task <slug> | Propõe até 10 tarefas high-level, aguarda aprovação e então gera tasks.md + N_task.md |
Guardrails: não implementa código, não altera arquivos fora da pasta da funcionalidade e exige testes planejados por tarefa.
Executa a próxima task planejada sem expandir escopo, usando TDD quando viável e validação antes de marcar conclusão.
| Command | Description |
|---|
/executar-task:executar-task <slug> [num] | Seleciona a task indicada ou a primeira desbloqueada, implementa, valida e atualiza tasks.md |
Guardrails: não marca conclusão sem testes relevantes passando, não faz refatoração oportunista e documenta mudanças relevantes.
Captures non-obvious lessons from the current session and applies them to a target skill, in one of two modes so the workflow matches where the skill lives.
| Command | Description |
|---|
/retrofit-skill <skill> | Lists session lessons, filters to the target skill, previews the diff, then applies it |
Full mode (skill published in this marketplace): bumps plugin.json + marketplace.json, updates CHANGELOG and README, commits and pushes.
Lean mode (local skill in another repo, e.g. <repo>/.claude/skills/<name>/): edits the files + a CHANGELOG entry and commits in that repo — no version bump or marketplace changes.
Both modes audit the touched skill with skill-quality-audit (baseline before, regression gate after); skill-creator joins only when the description changes.
A Stop hook notices when one of our skills did real work in the session and asks Claude, in that same turn, for a retro of it with evidence. When there is a lesson, Claude ends by asking whether to run /retrofit-skill:retrofit-skill <target> — one "yes" and the retrofit (which keeps its own confirmation gate) takes over.
| Piece | What it does |
|---|
Stop hook | Reads only the new transcript lines, spots skill loads (Skill tool and typed /skill), classifies the owner, counts work and friction, and asks for the retro via additionalContext |
SessionStart (resume|fork) | Baselines the transcript offset so a fork's copied history never triggers |
/retrofit-watch:retrofit-watch [skill] | The same retro on demand |
/retrofit-watch:retrofit-watch pendentes | The retros queued by headless sessions |
Ours = the chewiesoft-marketplace cache or clone (full mode; the retrofit argument is the plugin name) or a skill tracked in git in a repo owned by j0ruge, JRC-Brasil or chewiesoft (lean mode). Third-party skills, skills-lock.json entries, .agents/skills, ~/.hermes and untracked skills are ignored.
It defers while the turn waits for you, asks at most twice per skill per session, never talks back to a claude -p session (it queues the retro outside the repo instead, for /retrofit-watch:retrofit-watch pendentes) and never stores assistant text. RETROFIT_WATCH=off disables it; ~/.claude/retrofit-watch.json tunes owners/include/exclude.
Codex CLI: há uma adaptação local ativa, separada do plugin desta loja.
Na instalação observada, ~/.codex/hooks.json chama
~/.agents/skills/retrofit-watch/scripts/codex_retrofit_watch.py. Os avisos de
retro desta sessão vêm desse adaptador. O pacote publicado ainda traz o motor e
os hooks Claude; falta incluir a camada Codex e validar sua instalação pelo
marketplace. Por isso a tabela usa partial e ele permanece fora do catálogo
Codex nativo. Veja a distinção na matriz.
Credits. The retro criteria (moment signals, promotion rule, triage and the secret self-audit) are adapted from self-learning by Kulaxyz (MIT). Thank you for publishing it. The difference is in purpose: self-learning creates a new skill on its own, while retrofit-watch sends the lesson to a skill that already exists, through /retrofit-skill and its confirmation gate.
Deletes the branches that are already merged, locally and on the remote, and the worktrees that hold them. A read-only script proves each merge; a second one deletes only the approved plan, proving each item again first.
| Skill | Description |
|---|
/git-housekeeping | Report (delete / unproven / keep, each with its reason), a first confirmation for local branches and worktrees, a second one for the remote, and the undo command for everything deleted |
What counts as merged: a merge commit into the default branch, or a merged PR into the default whose head sha is the branch tip (squash and rebase). A branch with a commit after the merge, merged only into staging, or never used stays, with the reason.
Never deleted: the default and current branch, long-lived branches, branches named in a workflow's branches:, the head or base of an open PR, a dirty or locked worktree. A worktree removal lists the ignored files that go with it (.env.local, node_modules/).
Partial approval (0.2.0): --only <name> deletes just the items the user approved, and a name that is not in the plan exits 2 instead of a silent "nothing to delete".
A skill for writing hooks that actually fire. It was written against a baseline where agents without it put "Bash failed" logic in PostToolUse (it only runs on success), gated /deploy through UserPromptSubmit, stored plugin state outside ${CLAUDE_PLUGIN_DATA} and sent turn-end guidance as decision: "block" (shown as a hook error).
| Tool | Purpose |
|---|
scripts/capture_payload.py | Probe hook: records the real stdin + CLAUDE_*/CODEX*/PLUGIN_* env of any event via claude -p --settings, or a Codex hooks.json (--host codex) for codex exec --dangerously-bypass-hook-trust |
scripts/hook_test.py | Runs a hook against a fixture and asserts exit code and JSON |
scripts/lint_hooks.py | Lints hooks.json/settings and plugin.json (event names, type per event, if outside tool events, ignored matcher, unquoted placeholder, missing stop_hook_active guard, "hooks": "./hooks"); --host codex|both adds the Codex contract (no args, ignored if, no http, integer timeout, top-level keys, 14 events) |
References cover the 33 events, input/output schemas, handler types and cost, packaging and trust, stateful patterns, testing, safety (absorbs the former local hooks-2-0-builder) and the 11 points where the official plugin-dev/hook-development skill is out of date, plus references/codex.md: the Codex CLI contract checked against its source (rust-v0.164.0) and a live probe.
Keeps the page that documents a project's environments true by itself. A .env-docs.json at the repo root turns it on; each .env* of the repo, and the .env of each server (read over ssh), becomes one block of a restricted page, rewritten only when its sha256 changes. The intro, the environments table, the CI/CD section (workflows, runs-on, secret names via gh) and how-to-run are derived from the config. Values never reach logs, argv or local state, which keeps only hashes. The same hooks/hooks.json runs on Claude Code and Codex CLI (PostToolUse, Stop, SessionStart), only in the main checkout of the declared machine.
| Tool | Purpose |
|---|
scripts/env_docs_sync.py | Python 3 stdlib CLI: init, validate, scan, plan, sync, status, migrate, render-page, hook, install --codex (records hook trust in config.toml, dry-run diff first) |
tests/oraculo_codex.py | Run by hand on each new codex-cli: checks the trust hash against the Codex app-server hooks/list |
The only destination in this version is kb, a wiki CLI driven with a permission lock; sync --to-dir writes to a local folder for tests.
Uma skill boa é encontrada pelo gatilho certo, roda sem contexto externo e só afirma o que dá para reconferir. O plugin traz quatro skills que se enxergam (pastas vizinhas) e se ajudam: a porta de entrada sequencia, e cada irmã decide uma fase.
| Skill | Description |
|---|
skill-quality-audit | Porta de entrada: modos simples, completa e reparo (reparo só com autorização e allowlist), cinco fases fixas, teto de 2 ciclos de reparo e relatório por contrato. scripts/audit_skill_quality.py roda checks A1–G2 (spec, autocontenção, progressive disclosure, boas práticas, sinais de afirmação, vínculos da família) |
skill-self-containment | Fase 1 — caça path de máquina, arquivo citado ausente ou órfão e dependência de outro repo; diz o que vendorizar e o que é exceção legítima |
skill-claim-check | Fase 2 — toda afirmação factual ganha sensor, derivação ou data; ausência na doc não prova nada; skill fora do git é trabalho perdido. scripts/listar-afirmacoes.sh lista os candidatos |
skill-refactoring | Fase 3 — extrair para references/scripts ou comprimir por tabelas, preservando a narrativa de execução e os pitfalls |
Somente leitura por padrão: "audite" não autoriza editar; as irmãs só corrigem com pedido explícito. [SKIP] é gate que não rodou, nunca aprovação.
No Cursor: marque as quatro skills no instalador, para que fiquem lado a lado e se achem.
Requisitos: Python 3 (só biblioteca padrão). Opcionais: skills-ref/agentskills ou uvx para o validador oficial.
Turns source material (PDF, doc, notes, numbers) into a talk that looks designed, fits its slot and still reads on its own as a PDF — one offline HTML file, no framework.
| Skill / Agent | Description |
|---|
/html-presentation | Brief → source to Markdown → talk plan with data-t per slide → design from the project's DESIGN.md → build.py (inline assets, speaker script, time-budget gate) → shoot.sh (screenshots, laptop views, PDF page check) → independent review → deliver |
deck-reviewer (agent) | Read-only fresh reviewer: fidelity slide-by-slide against the source, layout from screenshots, notes vs slot; returns SHIP / SHIP WITH FIXES / REDO with exact fixes |
Presenter keys: → ← · N notes · P presenter window (notes + timer + next) · F fullscreen · R reset timer.
Designs PDF generation from reference templates — maps dynamic vs fixed fields, recommends a library with trade-offs, and architects modular sections with conditional columns and revision control.
| Skill | Description |
|---|
/pdf-generation | Analyzes a reference template (PDF/Excel), recommends a library (pdfmake, pdf-lib, PDFKit, Puppeteer, @react-pdf), and designs the section architecture |
Production-proven pitfalls encoded: cell padding not discounted from widths (last column cut off on A4 with 8+ columns); Roboto fi/fl ligatures drop the f; addFonts() rejects AFM; header/footer in content[] vanish on page 2+; revision cache stale on layout change; SVG fills from a <style> block render blank unless inlined. Phase 6 Visual Verification — render and inspect every page, not just page 1.
Jira ticket lifecycle integrated with Git for JRC Brasil projects. Per-repo project detection via a .jira-project file (PROJECT/BOARD/BRANCH_PREFIX, optional BASE_BRANCH) — no hardcoded project. Prefers acli + the atlassian MCP.
| Command | Description |
|---|
/ticket start | split | close | status | Create issues/sub-issues + branches, split work, and close with an auto-generated summary |
Encoded lessons: transitions are project-specific (discover via getTransitionsForJiraIssue, transition by id; acli --status matches the destination status name, not the transition name); the base branch is project-specific (optional BASE_BRANCH, don't assume develop).
Kaizen methodology applied to the three phases of a software's life — planning, implementation and maintenance — with PDCA as the backbone, plus material for teaching Kaizen to the team (history, vocabulary, training script).
| Skill | Description |
|---|
/kaizen-software | Plans features as small verifiable increments, keeps defects from moving forward during implementation (jidoka), and drives maintenance through 5 whys + 5S — logging every closed cycle in KAIZEN_LOG.md |
Fits into the repo instead of replacing it: Kaizen artifacts map onto the ones the project already has (architectural decisions → ADRs, opportunities/debt → TODO.md or backlog, recurring gotchas → the project runbook, history → CHANGELOG.md). Where the project forbids refactoring without an explicit request, the boy-scout rule becomes a logged opportunity rather than an edit — a finding never authorizes a change.
References: desperdicios.md (the 7 wastes translated to software, with detection questions, plus mura/muri), kaizen-conceitos.md (history, vocabulary, teaching script for onboarding or a board presentation), templates.md (PDCA plan, Kaizen Log, 5 whys, retrospective).
Create, extract, review, version and distribute a TypeScript library for Node. The package rules apply to any library; the distribution rules say when they apply — the measured case is a private organization with no registry and no GitHub Actions.
| Skill | Description |
|---|
/ts-library | Package shape, sensors on the packed tarball, semver that includes the persisted format, distribution choice (registry, git tag, vendored tarball), a release proven by rebuilding the tag, and docs for agents shipped inside the package |
Honest about what is proven: each claim is tagged measured (with the command), sourced (external fact with the date it was read, in references/fontes.md) or design (decided, not yet executed end to end).
References: pacote.md (annotated package.json and tsconfig), sensores.md (the gate and how to sabotage each sensor), distribuicao.md (the four distribution forms, vendored-tarball mechanics, updating a consumer, the reproducible release), docs-para-agentes.md (README.md/AGENTS.md inside the package), extracao.md (extracting from a workspace with history), fontes.md (dated external facts).
Audio preprocessing + transcription pipeline (ffmpeg + OpenAI Whisper), 100% offline — extract, silence removal, voice enhancement, segmentation, and transcription (optional two-language pass + auto-merge).
| Skill | Description |
|---|
/whisper-preprocess | Runs the full pipeline from a media file (MKV/MP4/WAV/M4A) to text |
Anti-"picotamento" lessons (proven on a 65-min low-volume, dysarthric recording): the listenable *_enhanced.opus is decoupled from the transcription chain (stable gain only — no dynamic AGC or silence removal); a 2-pass loudnorm linear=true silently reverts to dynamic on clipping sources (compressor + limiter used instead); Opus inter-sample overshoot needs limiter headroom (--listen-limit 0.6) to keep the decoded true-peak below 0 dBFS.
O TODO.md no esqueleto do kit sdd continua sendo a fonte da verdade; cada issue é um espelho dele, e o script só cria ou edita o que mudou.
| Skill | Description |
|---|
todo-to-github-issues | plan (só lê) → canário --apply --limit 1 → --apply; --close-orphans só depois de ler as órfãs. --audit/--fix medem contra o sensor do kit (tests/check-todo.sh), e ACHADOS-*.md vira issues pela tabela de roteamento |
Requisitos: Python 3, gh autenticado e o kit sdd na máquina (SDD_HOME, sdd no PATH ou ~/repos/sdd_agents) — a skill não carrega cópia do formato nem do sensor.
Field guide for recovering a Linux server's Docker services from backup, and for keeping the backup that protects them actually alive. Both halves live in one skill because the incident that closes the loop is born on the seam: a restore renamed a container, the backup inventory did not follow in the same commit, and the nightly backup stopped completing — for days, with no alert.
| Skill | Description |
|---|
ansible-docker-backup-restore | 11 inviolable rules, a routing table into 7 references, and two mandatory gates — audit the vhost before any VIRTUAL_HOST, and no restore is done until the backup ran end to end with failed=0 |
Highlights: silent compose-project-name trap (wrong prefix creates an empty volume and the service comes up clean); 8-step anti-overwrite guard that fetches and verifies the replacement before deleting anything; find returning files: [] on an unreadable path being read as "empty, safe to overwrite"; generic service key becoming a shared-network DNS alias that resolves round-robin between two different databases; certificate PEMs surviving without the ACME client state; the four silent-death patterns of a backup pipeline; and a read-only check-backup-freshness.sh that flags gaps in the date sequence — the cheapest signal there is, and the one that would have caught the original incident on day one.
Agnostic by construction: no server, domain, container, volume or network address from any specific environment — the real cases are told by mechanism, with placeholders.
Auto-updates
For private repo auto-updates at startup, set a GitHub token with repo scope:
export GITHUB_TOKEN
[!IMPORTANT]
Generate a token at github.com/settings/tokens with the repo scope.
Team Distribution
Projects that clone this repo get automatic marketplace discovery via .claude/settings.json. When team members trust the folder, Claude Code prompts them to install the marketplace — no manual setup needed.
Modo de Utilizacao
Modo Cursor
Use este modo quando quiser trabalhar com as skills no Cursor (ativacao por contexto).
- Instale via
python install.py e escolha Cursor ou Both.
- Escolha o destino:
~/.cursor/skills/ (uso pessoal em todos os projetos), ou.cursor/skills/ (uso compartilhado no projeto).
- Abra o projeto no Cursor e descreva a tarefa em linguagem natural.
- O agente aplicara automaticamente a skill mais adequada.
Exemplos de pedidos no chat:
Faz um code review das minhas alteracoes antes do PR.
Resolve os comentarios do CodeRabbit no PR #49.
Deploy para staging da branch atual.
A skill release nao entra por contexto: ela publica uma release, entao so roda chamada pelo nome (/release 2.1.0).
Observacao: o plugin statusline e exclusivo do Claude Code.
Modo Claude Code
Use este modo quando quiser utilizar comandos e skills diretamente no Claude Code.
- Adicione o marketplace:
/plugin marketplace add j0ruge/skills
- Instale os plugins desejados:
/plugin install ansible-docker-backup-restore
/plugin install cicd
/plugin install codereview
/plugin install cors
/plugin install criar-prd
/plugin install criar-task
/plugin install criar-techspec
/plugin install ddd
/plugin install deploy
/plugin install dev-script
/plugin install dotnet-wpf
/plugin install env-docs-sync
/plugin install executar-task
/plugin install git-housekeeping
/plugin install hook-builder
/plugin install html-presentation
/plugin install kaizen-software
/plugin install pdf-generation
/plugin install release
/plugin install retrofit-skill
/plugin install retrofit-watch
/plugin install skill-quality-audit
/plugin install statusline
/plugin install ticket
/plugin install todo-to-github-issues
/plugin install ts-library
/plugin install whisper-preprocess
/plugin install windows-disk-cleanup
/plugin install windows-games-linux
/plugin install wsl-windows-onboarding
/plugin install zitadel-idp
- Execute os comandos/skills no Claude Code:
/deploy:staging
/release:release 2.1.0
/statusline:setup
/codereview
/codereview:coderabbit-pr 49
Para atualizar plugins instalados:
/plugin marketplace update
References
Claude Code
Codex marketplace research (2026-10-22)
Sources used for the implemented Codex support. CLI distribution is verified; desktop, macOS, Windows, and the minimum client version remain unverified.
Review fixes cover adapter input errors, JSONL transport, shared installer validation, and native skill arguments. Local frontmatter warnings can still be strict external audit errors; see compatibility.
Release argument parsing passed six isolated model scenarios; two controls on the previous version also passed. See argument evidence.
Integration and external review are tracked in PR #6; the desktop acceptance check remains pending.
Research, decisions, and the DDD/Kaizen checklist are tracked in CONTEXT.md, with the design, implementation plan, and session handoff.
Skills that inspired ours
- Kulaxyz/self-learning-skills (MIT), by Kulaxyz: a self-improving skill that harvests a hard-won golden path from a session into a reusable skill. Its criteria are the basis of
retrofit-watch's retro (plugins/retrofit-watch/skills/retrofit-watch/references/criteria.md). Thanks to the author for sharing it.
Cursor support (used to design install.py and the platforms field)
