monolab

Use when a single-project deep update command (`/experiments:npm-update-deep-{patch,minor,major,engines}`) needs the shared deep pipeline — scan → group → parallel changelog research (fetch via the `fetch-changelog` executable) → teammate-synthesized dossier with two-layer compliance check → user-gated bumps apply → per-project changeset gate for improvements/migration edits. Single parameterized contract; per-level differences live ONLY in this file's delta table, so a behavioral rule cannot drift between levels. Never runs tests/lint/build; never commits/pushes/opens PRs autonomously.

Use when a single-project npm update command (`/experiments:npm-update-patch`, `/experiments:npm-update-minor`, `/experiments:npm-update-major`, and their deep variants) or the `commander-update-orchestrator` (once per project) needs to perform the mechanical apply of a fully-resolved update set — generic `package.json` bumps via `npm-check-updates`, catalog source edits (`pnpm-workspace.yaml` for pnpm, root `package.json` for Bun), override commands, and one install. Level-agnostic (parameterized by `target`). Also documents the caller-invoked override-resolution procedure (registry load → first-win glob match → `{version}` resolution → GENERIC/OVERRIDE_RUN/OVERRIDE_SKIP partition). Performs writes only; redirects ncu/install/override output to an on-disk log (digest to the conversation, bounded tail on failure only); returns a structured result fragment (with `logPath`) and NEVER prints a consumer summary or abort message. Never commits/pushes/opens PRs autonomously.

Use when a Commander update command (`/experiments:commander-update-{patch,minor,major,engines}` and their deep variants) needs to apply npm dependency or toolchain-engine updates across every project registered in the user-scoped Commander registry. Owns the cross-project pipeline — list+filter projects, parallel scan dispatch, deduplicate updates, version-align (max-wins with per-project fallback; engine-version alignment at `level=engines`), dossier gate rendering (path + bounded digest in deep mode), sequential apply with stop-on-fail, per-project changeset gate with an apply teammate (deep mode), aggregated summary. Read-only against the registry; dependency-level writes go to each project's own manifests via `ncu --upgrade` + one `<pm> install` (output to on-disk logs, digest to the conversation), engines-level writes via `apply-engine-bumps` (runtime surfaces, no ncu). Never commits/pushes/opens PRs autonomously.

Use when a command needs to dispatch a two-phase parallel-subagent research workflow (changelog fetch → codebase research → integrity check → dossier synthesis) over a pre-grouped package set — for example `/experiments:npm-update-deep-patch` (and future deep-* siblings) after invoking `group-packages-for-research`. Inputs `{ groups, level, scanResult }`; produces `<plan-dir>/dossier.md` plus per-group `_meta.json`, `changelogs/`, and `research.md`. Never edits workspace files; bump/apply are the caller's responsibility.

Use when a deep-major update command (`/experiments:npm-update-deep-major`, and the cross-project `commander-update-deep-major` via the orchestrator) needs to split an accepted set of major breaking changes into reviewable, PR-sized buckets before isolation. Given the `## Breaking changes & migration` findings + the major bump set + a dependency-graph read, it builds HARD co-upgrade sets (peer/lockstep families), scores risk per set, applies tunable policy knobs, and returns ordered buckets `{ title, packages, riskTier, rationale, suggestedBranch, suggestedMergeOrder }` plus a count-by-policy summary. Pure — no network, no manifest write, no VCS action.

Scan a JavaScript/TypeScript project for available npm dependency updates filtered by level (patch/minor/major). Use when a command or the user needs a structured list of upgrade candidates before applying them — for example `/experiments:npm-update-patch`, or any flow that asks "what patches are available?" or "which deps have a new minor?". Handles pnpm/npm/yarn/bun/deno, single-repo and workspace, pnpm and Bun `catalog:` entries, and `minimumReleaseAge`. Returns JSON; does NOT edit files or run installs — that's the caller's job. (`engines` is NOT a level here — the runtime/toolchain bump is handled by `detect-toolchain-surfaces`.)

Resolves Node→latest LTS and pnpm/npm/yarn/bun/Deno→latest, confirms before any write, then pins + aligns every runtime locus exact (no ranges) across package.json, .nvmrc/.node-version, .dvmrc (Deno), CI configs, Dockerfiles, and version-manager files; leaves publishable-lib support ranges and unknown surfaces untouched. VCS-free — never commits, pushes, opens PRs, or runs ncu autonomously. The engines-level analog of `apply-npm-updates`; invoked by the engines update commands (`/experiments:npm-update-engines`, `/experiments:npm-update-deep-engines`) and the `commander-update-orchestrator` at `level=engines`.

Use when an npm update command (`/experiments:npm-update-{major,minor,patch}`, their deep variants, or the `commander-update-orchestrator`) wants to apply bumps in an isolated branch/worktree instead of the current checkout. Resolves a strategy (auto → worktrunk → plain git worktree → in-place branch → ask → none) and creates the branch/worktree BEFORE apply runs, returning the working directory the caller hands to `apply-npm-updates`. Branch/worktree creation only — NEVER commits, pushes, or opens a PR. Opt-in; the default `none` is byte-equivalent to today's in-place behavior.

Scans package.json (engines/packageManager/devEngines/volta), .nvmrc/.node-version, .dvmrc (Deno), .tool-versions/mise, Dockerfiles, and CI configs (GitHub Actions, GitLab CI, CircleCI) for runtime or package-manager version pins, classifies each locus as runtime/support/ambiguous, detects intra-repo misalignment, and returns a structured inventory. Read-only — never edits files, runs installs, runs ncu, or performs any VCS action. The engines-level analog of `scan-npm-updates`; invoked by the engines update commands (`/experiments:npm-update-engines`, `/experiments:npm-update-deep-engines`) and the `commander-update-orchestrator` at `level=engines`.

Use when a Commander command (commander-add, future commander-update / commander-list) needs to turn raw detected keywords into the final persisted keywords[]. Applies controlled vocabulary + synonym expansion + exclusion + multi-monorepo aggregation + promotion + deterministic sort, and reports dropped terms so the caller can surface vocabulary gaps.

Use when a command needs to partition a `ScanResult.updates[]` array (from `experiments:scan-npm-updates`) into deterministic, bounded subagent groups before dispatching parallel research — for example `/experiments:npm-update-deep-patch` (and future deep-* siblings) before invoking `parallel-research-workflow`. Trigger phrases include "group these updates", "partition this scan result", or any flow handing a `ScanResult` to a fan-out workflow. Pure: same input → same output, no network, no filesystem reads. Returns `{ groups: [{ groupId, bucketKey, packages }], warnings }` JSON.

Validate Expo project dependencies after package.json modifications

This skill should be used when the user asks to "hookify", "optimize CLAUDE.md", "convert instructions to hooks", "enforce CLAUDE.md rules", or when starting a session to review project instructions for hookifiable rules. Analyzes CLAUDE.md/AGENTS.md for deterministic instructions convertible to Claude Code hooks.

This skill should be used at session start to auto-detect the project stack and install missing skills.sh skills, or when the user asks to "install skills", "detect stack skills", or "set up project skills". Detects react, next, shadcn, expo, and other stacks.

This skill should be used at session start to check for available updates to globally-installed skills.sh skills, or when the user asks to "check skill updates", "update skills", or "are my skills up to date". Execute once per session only.