setup-skills

Setup Skills

Scaffold the per-repo configuration that the engineering skills assume:

• Issue tracker: where issues live (Local markdown by default; GitHub / GitLab / other when you choose them here)
• Triage labels: the strings used for the six canonical triage roles
• Domain docs: where GLOSSARY.md and ADRs live, and the consumer rules for reading them
• Git guardrails: permissions.deny entries in this repo's .claude/settings.json that block destructive git (push, reset, …). Do not install or register hooks, the user already has hooks globally if they want them.

This is a prompt-driven skill, not a deterministic script. Explore, present what you found, confirm with the user, then write.

Process

1. Explore

Look at the current repo to understand its starting state. Read whatever exists; don't assume:

• git remote -v and .git/config: is this a GitHub repo? Which one?
• AGENTS.md and CLAUDE.md at the repo root: does either exist? Is there already an ## Agent skills section in either?
• GLOSSARY.md and GLOSSARY-MAP.md at the repo root
• docs/adr/ and any src/*/docs/adr/ directories
• docs/agents/: does this skill's prior output already exist?
• .scratch/: sign that a local-markdown issue tracker convention is already in use
• .claude/settings.json: does permissions.deny already list the destructive-git Bash(git …) rules?
• Monorepo signals: a pnpm-workspace.yaml, a workspaces field in package.json, or a populated packages/* with its own src/. Present only in a genuinely large multi-package repo; their absence means single-context, which is almost every repo.

2. Present findings and ask

Summarise what's present and what's missing. Then take the sections in order. One section, one answer, then the next.

Lead each section with the recommended answer so the user can accept it in a word. Give a one-line explainer only when the choice genuinely branches; skip the section entirely when exploration already settled it (Section C when there's no monorepo, Section D when the project deny list is already present).

Section A: Issue tracker.

Explainer: The "issue tracker" is where issues live for this repo. Skills like to-tickets and to-spec read this file and publish there without asking each run, so pick the place you actually track work. If you skip setup (or haven't run it yet), those skills fall back to Local markdown on their own. A user can still override the destination for a single run by asking explicitly.

Default posture: prefer Local markdown unless the user clearly wants a remote tracker. If a git remote points at GitHub and the user wants remote issues, propose GitHub. If a git remote points at GitLab (gitlab.com or a self-hosted host) and they want remote issues, propose GitLab. Otherwise offer:

• Local markdown (recommended default): issues live as files under .scratch/<feature>/ in this repo (good for solo projects or when you don't want to create remote issues)
• GitHub: issues live in the repo's GitHub Issues (uses the gh CLI)
• GitLab: issues live in the repo's GitLab Issues (uses the glab CLI)
• Other (Jira, Linear, etc.): ask the user to describe the workflow in one paragraph; the skill will record it as freeform prose

Record the choice in docs/agents/issue-tracker.md. The GitHub and GitLab templates carry a "PRs as a request surface" flag, defaulted off. Leave it off and don't raise it: a user who wants external PRs in the triage queue can flip the flag in the file later.

Explainer: Open-source repos often receive feature requests as pull requests, not just issues, a PR is an issue with attached code. If you turn this on, external PRs are pulled into the same triage queue and run through the same labels and states as issues (collaborators' in-flight PRs are left alone). Leave it off if PRs aren't a request surface for you.

Section B: Triage labels. Always runs, whether or not a triage skill is installed: the labels are also how to-spec, to-tickets and review-axes record state. Ask exactly one question:

Do you want to keep the default triage labels? (recommended: yes)

Explainer: When an incoming issue is triaged, it moves through a state machine: needs evaluation, waiting on reporter, ready for an AFK agent to pick up, ready for a human, or won't fix. To do that, the engineering skills apply labels (or the equivalent in your issue tracker) that match strings you've actually configured. If your repo already uses different label names (e.g. bug:triage instead of needs-triage), map them here so the right ones are applied instead of creating duplicates.

Section C: Domain docs. Default to single-context (one GLOSSARY.md + docs/adr/ at the repo root). This fits almost every repo; write it without asking.

Offer multi-context (a root GLOSSARY-MAP.md pointing to per-context GLOSSARY.md files) only when exploration found monorepo signals. Then confirm which layout they want.

Section D: Git guardrails. Recommended: yes. Skip when .claude/settings.json already contains the deny rules from the seed list below (all of them, or a clear superset the user customized).

Add project permissions.deny rules that block destructive git in Claude Code? (recommended: yes)

Explainer: Merges deny rules into this repo's .claude/settings.json only, no hooks, no scripts. Claude Code refuses git push, git reset --hard, git clean (also in the git -C <dir> … form), force branch deletes, discard-all checkouts/restores, stash drop/clear, and force-delete tags. Everyday git (add, commit, merge, rebase, switch, worktree, soft reset) still works, so skills like /implement, /delegate-tickets and /implement-spec keep running. Your existing settings (allow rules, hooks, env) are kept, a timestamped backup is written before the file is replaced, and the merge stops without touching anything if jq is missing or the file is not valid JSON. Your existing global hooks stay untouched. Say no only if you want the agent free to mutate git history in this repo.

When the existing deny list carries the older broad rules (Bash(git reset *), Bash(git rebase *) or their git -C forms), keep them and tell the user they block soft resets and rebases that /implement-spec and conflict resolution can need, and that deleting them by hand is safe. Never remove them yourself.

If the user says no, omit the deny merge, docs/agents/git-guardrails.md, and the ### Git guardrails sub-block. Do not remove existing deny rules when they say no.

3. Confirm and edit

Show the user a draft of:

• The ## Agent skills block to add to whichever of CLAUDE.md / AGENTS.md is being edited (see step 4 for selection rules)
• The contents of docs/agents/issue-tracker.md, docs/agents/domain.md, and docs/agents/triage-labels.md
• When Section D is yes: docs/agents/git-guardrails.md and the permissions.deny entries that will be merged into .claude/settings.json

Let them edit before writing.

4. Write

Pick the file to edit:

• If CLAUDE.md exists, edit it.
• Else if AGENTS.md exists, edit it.
• If neither exists, ask the user which one to create; don't pick for them.

Never create AGENTS.md when CLAUDE.md already exists (or vice versa); always edit the one that's already there.

If an ## Agent skills block already exists in the chosen file, update its contents in-place rather than appending a duplicate. Don't overwrite user edits to the surrounding sections.

The block:

## Agent skills

### Issue tracker

[one-line summary of where issues are tracked]. See `docs/agents/issue-tracker.md`.

### Triage labels

[one-line summary of the label vocabulary]. See `docs/agents/triage-labels.md`.

### Domain docs

[one-line summary of layout: "single-context" or "multi-context"]. See `docs/agents/domain.md`.

### Git guardrails

Destructive git (`push`, `reset --hard`, …) is denied via `permissions.deny` in `.claude/settings.json`. A denied command is a stop signal: report it, never route around it. See `docs/agents/git-guardrails.md`.

Include the ### Git guardrails sub-block and write docs/agents/git-guardrails.md only when Section D was yes. When Section D was no, omit them.

On GitHub or GitLab, create each configured label the tracker lacks (gh label create / glab label create).

Then write the docs files using the seed templates in this skill folder as a starting point:

• issue-tracker-github.md: GitHub issue tracker
• issue-tracker-gitlab.md: GitLab issue tracker
• issue-tracker-local.md: local-markdown issue tracker
• triage-labels.md: label mapping
• domain.md: domain doc consumer rules + layout
• git-guardrails.md: documents the project deny list (only if Section D is yes)

For "other" issue trackers, write docs/agents/issue-tracker.md from scratch using the user's description.

4a. Project git deny rules (Section D = yes only)

Write only into the target project's .claude/settings.json. Do not create .claude/hooks/, do not register PreToolUse, do not copy scripts, do not touch ~/.claude/settings.json.

Requires jq. Run the merge below as one Bash call. It only appends the rules that are missing, keeps everything else in the file (allow rules, hooks, env, existing deny entries and their order), and writes a timestamped backup next to the file before replacing it. It seeds {} only when the file is missing or empty.

If the snippet exits non-zero (no jq, or the file is not a JSON object), relay its message to the user and stop Section D there: do not recreate the file, seed {}, or hand-edit the deny list as a workaround. The user fixes the cause and re-runs.

Seed deny list (merge these strings into permissions.deny; keep any existing entries the project already has). Each git -C rule comes in two shapes because a trailing space-plus-* matches the bare command only when it is the rule's sole wildcard: Bash(git -C * push *) alone would miss git -C . push.

Bash(git push *)
Bash(git reset --hard *)
Bash(git clean *)
Bash(git -C * push)
Bash(git -C * push *)
Bash(git -C * reset --hard)
Bash(git -C * reset --hard *)
Bash(git -C * clean)
Bash(git -C * clean *)
Bash(git branch -D *)
Bash(git branch --delete --force *)
Bash(git checkout . *)
Bash(git restore . *)
Bash(git stash drop *)
Bash(git stash clear *)
Bash(git tag -d *)
Bash(git tag -D *)

Idempotent merge:

# setup-skills: merge git deny rules
PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$PWD}"
SETTINGS="$PROJECT_ROOT/.claude/settings.json"

if ! command -v jq >/dev/null 2>&1; then
  echo "setup-skills: jq is required to merge deny rules. Install jq and re-run. $SETTINGS was not touched." >&2
  exit 1
fi

mkdir -p "$(dirname "$SETTINGS")"
if [ ! -e "$SETTINGS" ] || [ -z "$(tr -d '[:space:]' < "$SETTINGS")" ]; then
  echo '{}' > "$SETTINGS"
elif ! jq -e 'type == "object"' "$SETTINGS" >/dev/null; then
  echo "setup-skills: $SETTINGS is not a valid JSON object (see the jq error above, if any). Fix it and re-run. The file was not touched." >&2
  exit 1
fi

TMP="$(mktemp "$SETTINGS.XXXXXX")"
if ! jq --indent 2 '
  .permissions //= {}
  | .permissions.deny //= []
  | reduce (
      [
        "Bash(git push *)",
        "Bash(git reset --hard *)",
        "Bash(git clean *)",
        "Bash(git -C * push)",
        "Bash(git -C * push *)",
        "Bash(git -C * reset --hard)",
        "Bash(git -C * reset --hard *)",
        "Bash(git -C * clean)",
        "Bash(git -C * clean *)",
        "Bash(git branch -D *)",
        "Bash(git branch --delete --force *)",
        "Bash(git checkout . *)",
        "Bash(git restore . *)",
        "Bash(git stash drop *)",
        "Bash(git stash clear *)",
        "Bash(git tag -d *)",
        "Bash(git tag -D *)"
      ][]
    ) as $rule (.; if (.permissions.deny | index([$rule])) then . else .permissions.deny += [$rule] end)
' "$SETTINGS" > "$TMP"; then
  rm -f "$TMP"
  echo "setup-skills: jq could not merge into $SETTINGS. The file was not touched." >&2
  exit 1
fi

if cmp -s "$TMP" "$SETTINGS"; then
  rm -f "$TMP"
  echo "setup-skills: deny rules already present, $SETTINGS unchanged."
else
  BACKUP="$SETTINGS.bak-$(date +%Y%m%d%H%M%S)"
  cp -p "$SETTINGS" "$BACKUP"
  mv "$TMP" "$SETTINGS"
  echo "setup-skills: merged deny rules into $SETTINGS (backup: $BACKUP)."
fi

Also write docs/agents/git-guardrails.md from the seed template.

5. Done

Tell the user the setup is complete and which engineering skills will now read from these files. If git guardrails were added, point at .claude/settings.json → permissions.deny (not hooks). Mention they can edit docs/agents/*.md and the deny list directly later: re-running this skill is only necessary if they want to switch issue trackers, refresh deny rules, or restart from scratch.

Then recommend, without running it: the companion /setup-solid skill writes a SOLID section into CLAUDE.md, architecture-level, language-agnostic, and scoped by the boy scout rule, so SOLID lands on new code and on the code each change already touches instead of triggering a repo-wide refactor. It's the coding standard the engineering flows then build to. Leave it to the user to type.