dev-squad-plugin

Ultra-compressed communication mode. Cuts output tokens 65% (measured) by speaking like nobacot while keeping full technical accuracy. Supports intensity levels: lite, full (default), ultra, wenyan-lite, wenyan-full, wenyan-ultra. Use when user says "nobacot mode", "talk like nobacot", "use nobacot", "less tokens", "be brief", or invokes /nobacot. Also auto-triggers when token efficiency is requested.

Invoke the dev-squad agent swarm for collaborative development. Full-stack app building with 11 agents (coordinator, architect, designer, backend, frontend, reviewer, qa-engineer, auditor, devops, git-ops, writer). Phase 3.5 DESIGN gate (designer) prevents AI-slop UI by producing design tokens + visual spec + component inventory + responsive spec BEFORE frontend codes. Phase 0 Step 2.5 SaaS-mode auto-detect triggers full SaaS scope (multi-tenancy, billing, drill-down dashboards via saas-patterns Part 1+2). Phase 5 has formal iteration loop with rollback. Phase 6 SHIP pre-seeds .claude/ docs in generated apps + 180s auto-reviewer wait. PreToolUse security hook blocks 9 dangerous code patterns. Supports feature development, database tasks, bug fixes, architecture changes, security audits, infrastructure work, runtime/stability/quality auditing, and SaaS-class application building.

Compress natural language memory/doc files (.dev-squad/memory.md, gotchas.md, record.md, CLAUDE.md, or any project markdown) into lakonik-style dense prose to cut the INPUT-token cost of re-reading them every time they're injected. Preserves code blocks, URLs, paths, commands, and structure exactly. Compressed version overwrites the original; a full backup is kept outside the repo so it survives cleanup. Trigger: "/dev-squad memory-compress <filepath>" or "compress this memory file" / "compress gotchas.md".

React component testing with React Testing Library, Vitest/Jest, MSW for network mocking, accessibility assertions with axe, and the decision boundary between component tests and Playwright/Cypress end-to-end runs. Use when writing or fixing tests for React components, hooks, or pages.

Turn git history into user-facing release notes — the missing step between "PRs merged" and "release exists". Reads commits since the last tag, groups them by impact, translates conventional-commit subjects into language a user (not a committer) understands, and drops internal noise. Use at Phase 6/7 SHIP before tagging a release, and whenever the user says "changelog", "release notes", "what changed", "what's in this release", or "generate the CHANGELOG".

Detect scope creep — the operational form of "surgical changes" (dev-squad Rule 3). Compares the actual diff against the declared goal and flags everything the change touched that the task did not ask for: unrelated refactors, drive-by reformatting, speculative features, adjacent "while I'm here" edits. Use during Phase 5 review and before opening a PR, or when the user says "intent drift", "scope creep", "did this stay in scope", "is the PR doing too much", or "compare the diff to the goal".

Verify test QUALITY, not just coverage — the operational form of "tests encode intent" (dev-squad Rule 9). Mutates the code under test and measures how many mutants the suite kills; a surviving mutant is a regression the tests cannot catch. Use during Phase 5 review/verification on non-trivial logic (money, security, auth, parsers, state machines, branching), whenever a PR adds tests, or when the user says "mutation test", "are these tests any good", "test quality", "coverage lies", or doubts whether tests would catch a regression.

Hunt for failures that never surface — the bugs no test and no error log will catch because the code swallows them. Finds empty catch blocks, errors logged but not raised, ignored return values, unhandled promise rejections, bare excepts, and discarded Go errors. Use during Phase 5 review and in QA failure analysis, whenever code touches error paths, or when the user says "silent failure", "swallowed error", "why didn't this throw", "it fails quietly", or "find hidden bugs".

The minimalism ladder — fire BEFORE writing code. Forces the simplest solution that actually works: question whether the task needs to exist at all (YAGNI), reach for the standard library before custom code, native platform features before dependencies, an already-installed dependency before a new one, one line before fifty. Use whenever an agent is about to implement something, and whenever the user says "simp", "be lazy", "simplest solution", "minimal solution", "yagni", "do less", "use what exists", or complains about over-engineering, bloat, boilerplate, reinventing the wheel, or unnecessary dependencies. The companion `/simp-review`, `/simp-audit`, and `/simp-debt` commands apply the same lens after the fact.

Full-featured SEO, GEO, and AEO website audit tool. Analyzes any URL or website for Search Engine Optimization (SEO), Generative Engine Optimization (GEO — for AI-powered search engines like Perplexity, ChatGPT Search, and Gemini), and Answer Engine Optimization (AEO — for featured snippets and voice search). Use this skill whenever a user provides a URL, domain, or website and asks about search performance, SEO issues, rankings, AI search readiness, answer engine visibility, meta tags, schema markup, content quality, or visibility in search. Also trigger when the user asks to "audit my site", "check my SEO", "why isn't my site ranking", "optimize for AI search", or any similar request involving a web property and search performance.

CRISP component quality framework for dev-squad agents. Five evaluation lenses — Consistent, Responsive, Intuitive, Simple, Purposeful — each with a concrete field-test. Used by designer (Phase 3.5 output gate) and frontend (Reuse-First Protocol Step 0).

Code review a pull request

Simplifies and refines code for clarity, consistency, and maintainability while preserving all functionality. Focuses on recently modified code unless instructed otherwise.

Self-contained pre-done verification protocol for dev-squad agents. Triggers before any agent claims a task or feature complete (before commit, before reporting done). Runs build, typecheck, lint, tests, secrets scan, and diff self-review, then produces a PASS/FAIL report card. Language-agnostic; detects project type automatically.

Use when the user asks for repeated rollouts, marked decision processes, high-dimensional search, stochastic optimization, local-optima exploration, ensemble comparison, or recursive reasoning with a visible evidence trail.

Self-contained structured debugging protocol for dev-squad agents. Triggers on any bug, test failure, or unexpected behavior — BEFORE proposing or applying a fix. Walks through a 7-step loop (Reproduce, Challenge, Isolate, Evaluate, Fix, Verify, Refine) — preceded by a mandatory recall step — to identify and eliminate the root cause with evidence at every step.

2026 React stack patterns — React 19 (RSC, Server Actions, use(), useActionState/useFormStatus/useOptimistic, ref-as-prop, document metadata), Next.js 15 App Router (parallel/intercepting routes, streaming, partial prerender), TanStack Query v5 (Suspense queries, mutations), react-hook-form + Conform (Server Actions), shadcn/ui composition, Tailwind v4 CSS-first config, Vite 6 + Vitest 3 + Playwright. Load when project uses React 19, Next.js 15, App Router, RSC, or asks for modern stack patterns. Sibling to frontend-patterns (core React).

dev-squad-native instinct learning. Distills .dev-squad/observations.jsonl (captured deterministically by the observe-learning hook) into confidence-scored, project-scoped instinct files IN-SESSION (no headless daemon). Triggers at Phase 7 LEARN and on /dev-squad evolve. Graduates high-confidence instincts into skills/dev-squad-learned/.

Focused build/compile/type error fix protocol for dev-squad agents. Triggers during the self-healing author-retry tier (iterations 1-2) when a build, compile, or type-check command fails. Walks through a 4-step protocol (Capture, Fix, Verify, Escalate) to resolve the error with the smallest possible diff and no architectural side-effects.

Adversarial 3-pass security pipeline for dev-squad Phase 5 review. Run on the feature diff when changes touch auth, billing, data handling, or multi-tenant boundaries. Dispatches general-purpose attacker, defender, and synthesizer passes to surface concrete exploit paths, verify mitigations, and write surviving high-confidence findings to .dev-squad/adversarial-findings.md. Complements (does not replace) the security-review OWASP checklist.

Frontend architecture patterns for dev-squad agents. Covers component composition, compound components, render props, custom hooks, state management, performance optimization, form handling, error boundaries, animations, and accessibility. React/TypeScript examples.

Go testing patterns for dev-squad agents. Covers TDD red-green-refactor, table-driven tests, subtests, parallel testing, test helpers, golden files, interface-based mocking, benchmarks, fuzzing, HTTP handler testing, coverage targets, and CI/CD integration.

SaaS-class architecture reference (code-write patterns) for dev-squad agents — 2 parts. PART 1 BACKEND (multi-tenancy with RLS + isolation testing, Stripe billing, entitlements, API keys, signed outbound webhooks with retry+DLQ, audit logs, notifications, transactional email, hybrid validation, admin scope, usage metering, runtime config, SSO, white-label). PART 2 FRONTEND admin dashboard with drill-down (URL state, breadcrumb, time-series brush+zoom, virtualized tables, cross-filter, permission-aware items). Load during Phase 4 IMPLEMENT for code-write patterns. For pre-launch readiness + execution discipline (operational + compliance + lifecycle + sprint decomposition + product-surface gap audit + provider abstraction + regional + case studies), see SIBLING skill `dev-squad:saas-readiness`. TypeScript/Node.js + Go examples.

Security review checklist for dev-squad agents. Covers 10 security areas including secrets management, input validation, SQL injection, auth/authz, XSS, CSRF, rate limiting, sensitive data exposure, dependency security, and blockchain considerations. Includes pre-deployment checklist.

Backend architecture patterns for dev-squad agents. Covers RESTful API structure, repository and service layer patterns, middleware, database optimization, caching, error handling, JWT auth with RBAC, rate limiting, background jobs, and structured logging. TypeScript/Node.js examples.

Idiomatic Go patterns for dev-squad agents. Covers error handling, concurrency, interfaces, package layout, functional options, struct embedding, memory optimization, and anti-patterns. Reference this skill when writing or reviewing Go code.

PostgreSQL patterns for dev-squad agents. Covers index types and strategies, data type reference, common query patterns (UPSERT, cursor pagination, queue processing), anti-pattern detection queries, RLS, and configuration tuning. SQL examples throughout.

Test-Driven Development workflow for dev-squad agents. Defines a 7-step TDD process from user journey documentation through test creation, red-green-refactor cycles, and coverage verification. Includes unit, integration, and E2E test types with git checkpoint integration.