pakhale 0.1.0

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "pakhale",
+  "version": "0.1.0",
+  "description": "Pratik's personal CLI — coding-agent workflow setup and more",
+  "type": "module",
+  "license": "MIT",
+  "author": "Pratik Pakhale",
+  "homepage": "https://github.com/pratikpakhale/pakhale#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pratikpakhale/pakhale.git"
+  },
+  "bugs": {
+    "url": "https://github.com/pratikpakhale/pakhale/issues"
+  },
+  "keywords": [
+    "cli",
+    "claude-code",
+    "opencode",
+    "coding-agent",
+    "agent-skills",
+    "mcp",
+    "dotfiles",
+    "setup"
+  ],
+  "bin": {
+    "pakhale": "./dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "skills",
+    "assets"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "test": "bun test --timeout 20000",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "bun run typecheck && bun run test && bun run build"
+  },
+  "devDependencies": {
+    "@clack/prompts": "^1.7.0",
+    "@types/bun": "latest",
+    "picocolors": "^1.1.1",
+    "tsdown": "^0.15.0",
+    "typescript": "^5"
+  }
+}

package/skills/architecture/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: architecture
+description: Visualize the codebase architecture provided a target.
+---
+
+# Architecture document
+
+Read the `improve-codebase-architecture` skill and its `HTML-REPORT.md`, using that as reference we just want to visualize the existing architecture provided a target. 
+
+Depending on target, read lot of code around it and then proceed. If the target is a code diff, then present the visualization as before / after in architecture using same HTML REPORT patterns.
+
+Few important things to note :
+
+- Try to render callstack diffs as much as possible

package/skills/consistency-check/DIMENSIONS.md

@@ -0,0 +1,91 @@
+# Consistency dimensions
+
+One sub-agent per dimension. Each agent: (1) learn the established convention from the
+**existing/unchanged** code and **measure prevalence with counts**, (2) inspect **only** the
+changed files, (3) return findings with `file:line`, the deviation, the established form + its
+count, severity, and confidence. Skip accepted dual-conventions. Pick the dimensions that fit the
+stack — drop the irrelevant ones, add domain-specific ones.
+
+For each dimension below: **Check** = what to look for · **Measure** = how to prove prevalence ·
+**Common false positives** = things that look wrong but are accepted.
+
+---
+
+## 1. Code idioms
+- **Check:** error handling shape (throw vs structured result), early-return vs nesting, async
+  patterns, `for (;;)` vs `while (true)`, optional chaining/nullish style, import grouping &
+  ordering, default vs named exports, `type` vs `interface`, **reuse of existing helpers instead
+  of re-implementing them** (a private `formatBytes`/`clsx`/date helper that already exists centrally).
+- **Measure:** `grep -rn` the duplicated helper's name and the central one; count call sites.
+- **False positives:** two idioms both common across the repo; a local helper that genuinely
+  differs in behavior from the central one.
+
+## 2. UI / visual
+- **Check:** reuse of UI primitives (Button, Dialog, Spinner, SearchBar, Tooltip) vs hand-rolled
+  markup; spacing scale; loader component vs raw `animate-spin` icon; empty-state pattern; scrollbar
+  utility vs inline scrollbar-hiding CSS; responsive breakpoints.
+- **Measure:** count primitive usages vs raw equivalents (`grep -rl`). Count the utility class vs the
+  inline form it replaces.
+- **False positives:** Tailwind `size-N` vs `h-N w-N` (often *both* dominant — measure!). Two spinner
+  components both in wide use — only flag mixing *within one new feature*.
+
+## 3. Design tokens
+- **Check:** semantic color tokens (`text-primary`, `bg-muted`, `border-border`) vs hardcoded
+  hex/rgb or raw palette (`text-gray-500`); radius/shadow tokens; dark-mode parity; z-index scale.
+- **Measure:** `grep -rnE '#[0-9a-fA-F]{3,6}|rgb\('` in changed files; compare with token usage counts.
+- **False positives:** one-off brand colors that are hardcoded everywhere by design; canvas/chart
+  code that legitimately needs literal colors.
+
+## 4. i18n / copy
+- **Check:** every user-facing string via the i18n framework (no hardcoded literals in JSX/aria);
+  **all locale files updated** for new keys; key naming & namespacing matches siblings; placeholders
+  and `aria-label`s localized; reuse of an existing translated key instead of a near-duplicate.
+- **Measure:** diff the key set across all locale files (`python3` to load each, compare key paths);
+  grep for hardcoded `aria-label="..."` and string literals in changed `.tsx`.
+- **False positives:** example URLs/IDs that are identical across locales by convention; dev-only or
+  console strings; values intentionally untranslated.
+
+## 5. State & data-flow
+- **Check:** store conventions (slice shape, selector use, action naming); query-key factory &
+  query-hook conventions; **no `useState`+`useEffect` to mirror server/store state** (read the store
+  directly, update on event); fetch/error-handling parity with sibling services.
+- **Measure:** compare the new slice/query against an existing one side-by-side; grep for
+  `useEffect(` that only calls a setter mirroring a prop/store value.
+- **False positives:** genuinely local UI state; an effect with real external synchronization.
+
+## 6. Architecture / layering
+- **Check:** module placed in the right layer (pure parser lib must not import app/store types;
+  API/wire types live with API types, not in a util lib); dependency direction (no UI imported by
+  libs); server vs client boundary (`'use client'`, no server-only imports in client code); types
+  living next to their consumers.
+- **Measure:** inspect import statements of new/moved modules; trace what depends on what.
+- **False positives:** an intentional shared type in a `shared` package; a re-export barrel.
+
+## 7. API / types / wire
+- **Check:** request/response shapes match the server contract; field casing at the boundary
+  (snake_case wire vs camelCase domain) handled consistently with sibling endpoints; structured
+  error results vs thrown exceptions match the service's existing pattern; no breaking change hidden
+  behind a back-compat shim.
+- **Measure:** compare the new service method against neighbors in the same file; check the server
+  schema if reachable.
+- **False positives:** snake/camel mix that *must* match the wire; deliberate structured-result design.
+
+## 8. Naming & file structure
+- **Check:** file naming (kebab vs camel), component/hook/util naming conventions, directory
+  placement, export naming, test file co-location.
+- **Measure:** list sibling files in the same directory; compare casing/prefix conventions.
+- **False positives:** a domain term that legitimately breaks the casing pattern.
+
+## 9. Accessibility & semantics
+- **Check:** `aria-label`/role parity with sibling interactive elements; keyboard handlers present
+  where siblings have them; focus management in modals/menus; alt text; semantic elements vs `div`s.
+- **Measure:** compare the new interactive component against the closest existing one.
+- **False positives:** decorative elements that correctly have no a11y semantics.
+
+---
+
+## Reporting contract for each agent
+
+Return JSON: `{ findings: [{ title, file, line, deviation, established, prevalence, severity, confidence }] }`
+where `severity ∈ {correctness, behavior, i18n, a11y, naming, cosmetic}` and `prevalence` states the
+counts you measured (e.g. `"established 349×, deviation 2× (the diff)"`). No prevalence number → not a finding.

package/skills/consistency-check/SKILL.md

@@ -0,0 +1,74 @@
+---
+name: consistency-check
+description: Audit a set of changes (a branch, PR, or working tree) for consistency with the codebase's established conventions across many dimensions — code idioms, UI/visual, design tokens, i18n/copy, state & data-flow, architecture/layering, API/types, naming, and accessibility — by fanning out parallel sub-agents, one per dimension. Each agent measures how prevalent a convention actually is before flagging, so accepted dual-conventions are not reported as defects. Use when the user asks to check consistency, audit a diff/PR against existing patterns, "find every inconsistency", or sanity-check a feature branch before merge.
+---
+
+# Consistency check
+
+Fan out sub-agents to compare a diff against the codebase's *own* established
+conventions, then verify and classify each finding before reporting. The point is
+a high-signal report, not a pile of cosmetic nits.
+
+## The four rules (read before anything else)
+
+1. **Scope to the diff.** Only code the change *introduced or touched* is in scope.
+   Never flag pre-existing untouched code. Identify unrelated/concurrent working-tree
+   changes (other people's in-flight work) and exclude them explicitly.
+2. **Measure before flagging.** A convention is only "the" convention if it dominates.
+   Count *both* forms (`grep -c`) in the existing codebase. If both are widely used
+   (e.g. Tailwind `size-4` 219× vs `h-4 w-4` 349×), it is an **accepted dual-convention** —
+   NOT a finding. Most false positives die here.
+3. **Verify against source.** Read the actual lines before reporting. A finding needs
+   `file:line`, the deviation, the established alternative, and its prevalence count.
+4. **Classify and justify.** Every candidate ends as Genuine / False-positive / Out-of-scope
+   with a one-line reason. Report skips too — silent omission reads as "all clear".
+
+## Workflow
+
+1. **Scope the diff** (inline, deterministic):
+   - `base=$(git merge-base <base-branch> HEAD)`
+   - `git diff --stat $base...HEAD` and `git status --short` → changed + untracked files.
+   - Separate *this change* from unrelated concurrent edits. Carry the in-scope file list forward.
+2. **Fan out one agent per dimension.** Use [DIMENSIONS.md](DIMENSIONS.md) as the catalog.
+   - If the user has opted into orchestration (this skill counts as opt-in for a review
+     workflow), run [scripts/consistency-workflow.js](scripts/consistency-workflow.js) via the
+     Workflow tool, passing `args: { base, changedFiles, repo }` — add `only: [<keys>]` to run a
+     subset of dimensions. It pipelines review → adversarial verify → synthesize.
+   - Otherwise fan out with the Agent tool (`Explore` for find, default for verify), one per
+     dimension, in a single message so they run in parallel.
+   - Each find-agent: learn the convention + prevalence from the **existing** code, then inspect
+     **only** the changed files, returning structured findings (file:line, deviation, established
+     form + count, severity, confidence).
+3. **Adversarially verify each candidate.** A second agent reads the source and confirms it is
+   (a) introduced by the diff, (b) a genuine deviation and not an accepted dual-convention
+   (re-measure), (c) in scope. Default to *refuted* when uncertain.
+4. **Synthesize.** Dedup by file+line across dimensions. Rank by severity:
+   correctness > behavior parity > i18n/a11y gap > naming > cosmetic.
+5. **Report** (default). Apply fixes only if the user asks. When fixing, never churn a cosmetic
+   dual-convention, and prefer fixing at the source over downstream remapping.
+
+## Severity ladder
+
+- **correctness** — wrong behavior/output, broken types, wrong copy a user sees.
+- **behavior parity** — same operation done differently than its siblings (e.g. one code path
+  derives a value with a fallback that another omits).
+- **i18n / a11y gap** — hardcoded user-facing/screen-reader string in an otherwise localized app;
+  missing locale key; untranslated `aria-label`.
+- **naming / structure** — module placed in the wrong layer, type living far from its use,
+  helper reinvented instead of imported.
+- **cosmetic** — interchangeable with an equally-common existing form. Usually *not* worth a fix;
+  only flag when it breaks consistency *within the same new feature*.
+
+## Output shape
+
+```
+## Consistency report — <branch> vs <base>  (N files in scope)
+### Genuine (ranked)
+- [severity] file:line — <deviation>; codebase uses <established> (Mx vs Nx). Fix: <one line>
+### False positives (measured, not defects)
+- file:line — <form> is an accepted dual-convention (Mx vs Nx). No change.
+### Out of scope
+- file — unrelated concurrent change / pre-existing. Untouched.
+```
+
+See [DIMENSIONS.md](DIMENSIONS.md) for the per-dimension checklists and grep recipes.

package/skills/consistency-check/scripts/consistency-workflow.js

@@ -0,0 +1,158 @@
+export const meta = {
+  name: 'consistency-check',
+  description:
+    'Fan out one agent per consistency dimension to audit a diff against the codebase\'s own conventions, adversarially verify each candidate, then synthesize a ranked report.',
+  phases: [
+    { title: 'Review', detail: 'one agent per consistency dimension' },
+    { title: 'Verify', detail: 'adversarially confirm each candidate finding' },
+    { title: 'Synthesize', detail: 'dedup, classify, rank by severity' }
+  ]
+}
+
+// args: { base: string, changedFiles: string[], repo?: string }
+// Gather these inline (git merge-base + git diff --stat) BEFORE invoking, so the
+// script only orchestrates. Drop dimensions that don't fit the stack via args.only.
+const { base = 'main', changedFiles = [], repo = '.', only = null } = args || {}
+const fileList = changedFiles.length
+  ? changedFiles.map((f) => `- ${f}`).join('\n')
+  : '(none provided — derive from `git diff --name-only ' + base + '...HEAD`)'
+
+const ALL_DIMENSIONS = [
+  {
+    key: 'code-idioms',
+    prompt:
+      'Error-handling shape, early-return style, async patterns, import grouping, default vs named exports, type vs interface, and especially HELPERS REINVENTED instead of imported from a central module (e.g. a private formatBytes when one already exists).'
+  },
+  {
+    key: 'ui-visual',
+    prompt:
+      'Reuse of UI primitives (Button/Dialog/Spinner/SearchBar) vs hand-rolled markup; loader component vs raw animate-spin icon; scrollbar utility vs inline scrollbar-hiding CSS; spacing scale. NOTE: size-N vs h-N w-N are often BOTH dominant — count both, do not flag a dual-convention.'
+  },
+  {
+    key: 'design-tokens',
+    prompt:
+      'Semantic color tokens (text-primary, bg-muted) vs hardcoded hex/rgb or raw palette; radius/shadow tokens; dark-mode parity. Exclude canvas/chart code that needs literal colors.'
+  },
+  {
+    key: 'i18n-copy',
+    prompt:
+      'Every user-facing string localized (no hardcoded JSX/aria literals); ALL locale files updated for new keys; key naming/namespacing matches siblings; placeholders and aria-labels localized; an existing translated key reused instead of a near-duplicate.'
+  },
+  {
+    key: 'state-dataflow',
+    prompt:
+      'Store slice/selector/action conventions; query-key factory & hook conventions; NO useState+useEffect mirroring server/store state (read store directly, update on event); fetch/error parity with sibling services.'
+  },
+  {
+    key: 'architecture',
+    prompt:
+      'Module in the right layer (pure lib must not import app/store types; wire/API types live with API types, not in a util lib); dependency direction; server vs client boundary; types living next to consumers.'
+  },
+  {
+    key: 'api-types',
+    prompt:
+      'Request/response shapes match the server contract; boundary casing (snake wire vs camel domain) handled like siblings; structured-result vs thrown-error matches the service pattern; no hidden back-compat shim.'
+  },
+  {
+    key: 'naming-structure',
+    prompt:
+      'File naming (kebab vs camel), component/hook/util naming, directory placement, export naming, test co-location — compared against sibling files in the same directory.'
+  },
+  {
+    key: 'a11y-semantics',
+    prompt:
+      'aria-label/role parity with sibling interactive elements; keyboard handlers where siblings have them; modal focus management; semantic elements vs divs.'
+  }
+]
+
+const DIMENSIONS = only
+  ? ALL_DIMENSIONS.filter((d) => only.includes(d.key))
+  : ALL_DIMENSIONS
+
+const FINDINGS_SCHEMA = {
+  type: 'object',
+  additionalProperties: false,
+  properties: {
+    findings: {
+      type: 'array',
+      items: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          title: { type: 'string' },
+          file: { type: 'string' },
+          line: { type: 'number' },
+          deviation: { type: 'string' },
+          established: { type: 'string' },
+          prevalence: {
+            type: 'string',
+            description: 'measured counts, e.g. "established 349x, deviation 2x"'
+          },
+          severity: {
+            type: 'string',
+            enum: ['correctness', 'behavior', 'i18n', 'a11y', 'naming', 'cosmetic']
+          },
+          confidence: { type: 'number' }
+        },
+        required: ['title', 'file', 'deviation', 'established', 'prevalence', 'severity']
+      }
+    }
+  },
+  required: ['findings']
+}
+
+const VERDICT_SCHEMA = {
+  type: 'object',
+  additionalProperties: false,
+  properties: {
+    real: { type: 'boolean' },
+    reason: { type: 'string' },
+    classification: {
+      type: 'string',
+      enum: ['genuine', 'false-positive', 'out-of-scope']
+    }
+  },
+  required: ['real', 'reason', 'classification']
+}
+
+const RULES = `Repo: ${repo}. Diff base: ${base}.
+IN-SCOPE CHANGED FILES (only these):
+${fileList}
+
+Hard rules:
+- Learn the established convention from the EXISTING (unchanged) codebase and MEASURE prevalence with counts (grep -c both forms). If both forms are widely used, it is an accepted dual-convention — DO NOT flag it.
+- Flag only deviations the diff INTRODUCED. Never flag pre-existing untouched code or unrelated concurrent edits.
+- Every finding needs file:line, the deviation, the established alternative, and a prevalence count. No count → not a finding.`
+
+log(`Auditing ${changedFiles.length} files across ${DIMENSIONS.length} dimensions vs ${base}`)
+
+const reviewed = await pipeline(
+  DIMENSIONS,
+  (d) =>
+    agent(`${RULES}\n\nDimension: ${d.key}\nCheck: ${d.prompt}`, {
+      label: `review:${d.key}`,
+      phase: 'Review',
+      schema: FINDINGS_SCHEMA,
+      agentType: 'Explore'
+    }),
+  (review, d) =>
+    parallel(
+      (review?.findings || []).map((f) => () =>
+        agent(
+          `Adversarially verify this consistency finding. READ the actual source lines first. Confirm ALL of: (1) introduced by the diff vs ${base}; (2) a genuine deviation and NOT an accepted dual-convention — re-measure prevalence yourself; (3) in scope (a changed file, not pre-existing/concurrent work). Default to real=false when uncertain.\n\nFinding:\n${JSON.stringify(f, null, 2)}`,
+          { label: `verify:${d.key}`, phase: 'Verify', schema: VERDICT_SCHEMA }
+        ).then((v) => ({ ...f, dimension: d.key, verdict: v }))
+      )
+    )
+)
+
+const all = reviewed.flat().filter(Boolean)
+const confirmed = all.filter((f) => f.verdict?.real && f.verdict?.classification === 'genuine')
+const dismissed = all.filter((f) => !(f.verdict?.real && f.verdict?.classification === 'genuine'))
+
+const report = await agent(
+  `Write the final consistency report. Dedup by file+line. Rank GENUINE findings by severity (correctness > behavior > i18n/a11y > naming > cosmetic), each as: "[severity] file:line — deviation; codebase uses <established> (<prevalence>). Fix: <one line>". Then list dismissed candidates under "False positives / out of scope" with their one-line reason. Recommend fixes; DO NOT apply them.\n\nGENUINE:\n${JSON.stringify(confirmed, null, 2)}\n\nDISMISSED:\n${JSON.stringify(dismissed.map((d) => ({ file: d.file, line: d.line, title: d.title, verdict: d.verdict })), null, 2)}`,
+  { label: 'synthesize', phase: 'Synthesize' }
+)
+
+return { base, scope: changedFiles.length, confirmed, dismissed, report }

package/skills/deslop/SKILL.md

@@ -0,0 +1,153 @@
+---
+name: deslop
+description: "Clean up generated code changes — strip slop (dead code, one-use abstractions, redundant guards, comment noise, unnecessary effects), fix what the change broke, and report what can't be safely fixed. No unrelated changes. Use when the user says 'deslop', 'mdeslop', 'clean this up', 'review my changes', or after generating/modifying a chunk of code."
+metadata:
+  author: pratikpakhale
+  version: "4.0.0"
+---
+
+# Deslop
+
+Strip the slop out of the change just made, fix what it broke, report what you shouldn't
+touch yourself. Fixing is the default — you are not writing a review.
+
+## Rules
+
+- **Scope is the diff.** Only code the change introduced or touched. Pre-existing code is
+  off-limits unless this change actively broke it.
+- **No unrelated changes.** No opportunistic refactors, renames, dep bumps, or reformatting.
+- **Fix quietly, flag loudly.** Apply cleanups without narrating each one. Surface only what
+  needed a judgment call you couldn't make.
+- **Trace before deleting.** One `rg` for every symbol you're about to remove.
+
+## Load what applies
+
+Read the reference for every stack present in the diff, **before** starting the hunt:
+
+| In the diff | Read |
+| --- | --- |
+| `.tsx`, React, Next.js, RSC | [references/react.md](references/react.md) |
+| `.ts`, Node, Bun, backend TS | [references/typescript.md](references/typescript.md) |
+| `.py` | [references/python.md](references/python.md) |
+
+Nothing matches? Run the hunt below on its own — it's language-agnostic.
+
+## The hunt
+
+Four passes, in order. The map decides what counts as slop; the trace is where the real
+bugs are.
+
+### 1. Map — what was this change *for*?
+
+Read the diff (`git diff`, plus untracked files) and write the change's intent as one
+sentence. Keep it in front of you: **anything in the diff that doesn't serve that sentence
+is a removal candidate.** Separate out unrelated in-flight edits now and leave them alone.
+
+Cheap and worth it first: does the change actually do what it claimed? A feature that's
+wired but never called, or a branch that can't be reached from any entry point, is the
+biggest possible piece of slop.
+
+### 2. Trace — what did it break?
+
+The only pass where you read *outside* the diff. For every function, component, type,
+constant, or table column the diff modified, `rg -w <name>` and read each call site.
+
+Look for callers that assumed the old shape:
+
+- return type widened/narrowed, or a field renamed
+- a default value or optional param changed
+- errors that used to throw now return `null` (or the reverse)
+- shared state written by the new code and read somewhere else
+- a component whose props changed but whose other usages weren't updated
+
+Fix these. This is where regressions actually live.
+
+### 3. Strip — read each hunk against these tells
+
+Hunt for *tells*, not categories. Each one below is something you can literally see in the
+diff, paired with the question that settles it.
+
+**One-use abstraction.** Tell: a helper, hook, wrapper, interface, factory, or options
+object with exactly one caller — or a wrapper that forwards its arguments unchanged.
+Ask: if I inline this, what gets worse? Nothing → inline it.
+
+**Dead weight.** Tell: a symbol the diff introduced. `rg -w` it — if the definition is the
+only hit, it's dead. Same for exports nobody imports, params never read, branches whose
+condition can't be true, and imports left behind by an edit.
+
+**Impossible guard.** Tell: `if (!x)` where `x` is non-nullable, a `try/catch` that only
+rethrows, a re-check of something the caller already checked, a fallback for a state the
+type system forbids. Ask: write the concrete input that makes this branch fire. Can't? Delete it.
+
+**Half-done work.** Tell: `TODO`, `FIXME`, stub returns, hardcoded values that should be
+arguments, `catch {}` that swallows, error paths that log and continue as if nothing happened.
+Finish it or flag it — never leave it silent.
+
+**Comment noise.** Tell: a comment that restates the line under it, a JSDoc block repeating
+the signature, section banners, `// Added for X` changelog notes, commented-out code.
+Delete all of it. Keep only comments explaining a non-obvious *why*.
+
+**Verbosity.** Tell: a 12-line block that's one expression, an intermediate variable used
+once on the next line, an if/else assigning the same variable, repeated near-identical
+blocks that differ by one value.
+Ask: does the shorter form lose any clarity? No → shorten it.
+
+**User-facing gap.** Tell: a new string literal rendered to a user in a project whose sibling
+files call `t()` / `useTranslations`; a `catch` that renders the raw error object; a mutating
+action with no pending or success state.
+Ask: does someone on a slow connection, in another locale, hitting the failure path, see
+something sensible?
+
+**Doesn't look like the neighbors.** The highest-yield tell, and the one most often skipped —
+don't judge the new code on its own, open the nearest sibling first and diff the shape. For
+UI that means the sibling *screen*, not just the sibling file.
+
+- Code: naming (`getX` vs `fetchX`, `handleY` vs `onY`), error handling, file placement,
+  import order, reuse of the existing helper/type/constant instead of a fresh one.
+- UI: a button/input/modal/table hand-rolled when the design system already exports one; a
+  one-off `className` where the component takes a `variant`; raw hex/px/radius values where
+  tokens exist; spacing off the project's scale; a different icon set; loading, empty, and
+  error states shaped differently from the sibling screen's; copy in another voice
+  (`Sign in` vs `Log In`, sentence case vs Title Case).
+
+Ask: reading only the new lines, would someone who knows this repo think it came from here?
+For UI, put the new screen next to its sibling — would a user notice two different people
+built them?
+
+### 4. Flag — what you must not fix yourself
+
+Report these; don't act on them unless the user says to.
+
+- **Security.** XSS from unsanitized input, hardcoded secrets or tokens, `eval` /
+  `innerHTML` / `dangerouslySetInnerHTML`, a new endpoint or action with no auth guard,
+  SQL/command injection, path traversal. Say what's exploitable and how — the fix is often
+  a design decision.
+- **Architecture.** Is this production-ready or a hack that gets rewritten in a month? Is a
+  breaking change wired end-to-end or left half-migrated? Describe the better shape; don't build it.
+- **Ambiguity.** Anything where the correct answer depends on intent you don't have.
+
+## Large diffs
+
+Above ~10 files or ~500 changed lines, fan out rather than reading serially.
+
+1. Partition changed files into **disjoint** groups — by module or feature, keeping callers
+   with their callees. Disjoint is load-bearing: two agents editing one file clobber each other.
+2. Spawn one Agent per group in a single message. Give each: its file list, the intent
+   sentence from pass 1, the reference file(s) for its stack, and the boundary — *fix only
+   inside your files, report anything crossing the boundary back to me*.
+3. Do pass 2 and the consistency tell yourself, across the whole diff, once they return.
+   Cross-group breakage and duplicated logic are invisible from inside a partition.
+
+Use a Workflow only if the user explicitly opted into orchestration ("use a workflow",
+ultracode) — then pipeline each group through fix → verify and synthesize. Otherwise plain
+Agent fan-out.
+
+## Output
+
+Short.
+
+1. **Stripped** — what you removed and fixed, grouped, one line each.
+2. **Flagged** — pass 4 findings, severity-ordered, each with `file:line`.
+3. **Open questions** — only if a decision is genuinely yours to ask about.
+
+No preamble, no restating the diff back.

package/skills/deslop/references/python.md

@@ -0,0 +1,65 @@
+# Python slop
+
+Stack-specific tells. Run these alongside the main hunt, not instead of it.
+
+## Exception handling
+
+`rg -n "except" <changed files>` and check each one the diff added.
+
+- `except Exception:` / bare `except:` — what specific error is expected here? Narrow it.
+- `except ... : pass` — silently eats real failures, including `KeyboardInterrupt` on a bare
+  clause.
+- `try/except` that only logs and re-raises — delete, let it propagate.
+- A `try` block wrapping ten lines when one of them raises — shrink it to that line.
+- `except` returning a success-shaped value (`return []`, `return None`) so callers can't tell
+  failure from empty.
+
+## Defaults & mutation
+
+- Mutable default arguments (`def f(x=[])`, `={}`) — classic shared-state bug.
+- A function mutating a list/dict passed in by the caller without saying so in the name.
+- Module-level mutable state written at import time.
+- `dataclass` field with a mutable default missing `field(default_factory=...)`.
+
+## Redundant checks
+
+- `if x is not None:` on a value the type hint declares non-optional and the caller guarantees.
+- `if len(xs) > 0:` — use `if xs:`.
+- `if x == True:` / `if x != None:`.
+- `hasattr` / `in dict` guards for keys the constructor always sets.
+- Re-validating an argument the caller already validated.
+
+## Verbosity
+
+- A `for` loop appending to a list that's a comprehension.
+- A comprehension nested three deep, or one spanning multiple lines with a condition —
+  that's a loop, write the loop.
+- `dict(a=1, b=2)` where a literal reads better; `list()`/`dict()` where `[]`/`{}` do.
+- Manual index tracking instead of `enumerate`; parallel indexing instead of `zip`.
+- String building with `+` in a loop instead of `join`.
+- An `if/else` returning `True`/`False` — return the expression.
+
+## Types & structure
+
+- Type hints on some functions in the file and not others — match the file's convention.
+- `Any` / `dict` / bare `list` where a `TypedDict`, `dataclass`, or Pydantic model exists in
+  the codebase already.
+- `Optional[X]` added everywhere to satisfy the checker rather than because `None` is real.
+- A new module-level helper duplicating something in the project's utils package — `rg` the
+  behavior, not the name.
+- Imports inside a function without a circular-import or lazy-load reason.
+- A class with one method and no state — that's a function.
+
+## I/O & resources
+
+- `open()` without a context manager; a file/socket/cursor never closed on the error path.
+- Requests in a loop where a batched call or `asyncio.gather` fits.
+- ORM query in a loop (N+1) — use `select_related` / `prefetch_related` / a single filtered query.
+- `requests` / `httpx` calls with no timeout.
+- Blocking I/O inside an `async def`.
+
+## Tests
+
+- A test asserting nothing, or asserting only that the call didn't raise.
+- Fixtures added but unused; `mock` patches whose target no longer exists.
+- `time.sleep` used to sequence async behavior.