pwp-refactor

A set of rules for changing code structure while keeping its behavior the same.

In plain words
What is it for?
Safely splitting large files, removing duplication, simplifying complex code, and reorganizing code after tests provide a safety check.
Why use it?
It helps prevent refactoring from accidentally introducing bugs and keeps structural changes easier to review.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/shandar/pwp-plugin/pwp-refactor
Any agent
npx skills add shandar/pwp-plugin --skill pwp-refactor
Clone the repo
git clone --depth 1 https://github.com/shandar/pwp-plugin

Made for: Claude Code, Codex.

Per session 98 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 852 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00098 $0.00852
Opus 5 $0.00049 $0.00426
Sonnet 5 $0.00020 $0.00170
Haiku 4.5 $0.00010 $0.00085

Measured yesterday against content hash 83e35b6493b1, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

pwp-refactor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/pwp-refactor/SKILL.md · 81 lines

How it starts

The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Refactoring Skill

This skill defines how to refactor code safely. The cardinal rule: refactoring changes structure, never behavior. If behavior changes, it's not a refactor — it's a feature or a fix.

Refactoring Mindset

  • Refactoring is not cleaning. It's restructuring code to make it easier to understand, extend, or maintain. It requires the same rigor as writing new features.
  • Never refactor and change behavior in the same commit. Mixing structural changes with behavioral changes makes review impossible and debugging a nightmare.
  • Tests are your safety net. If tests don't exist for the code you're refactoring, write them first.
  • Approval required. Do not refactor code you weren't asked to touch. Flag ugly code, but don't fix it without explicit approval.

When to Refactor

Signal Example Action
Duplication Same logic in 3+ places Extract to shared function/component
Complexity Function > 50 lines, deeply nested conditionals Decompose into smaller functions
Naming Misleading or abbreviated names Rename for clarity
God files File > 500 lines mixing concerns Split by responsibility
Dead code Unused imports, unreachable branches Remove
Type weakness any types, missing interfaces Add proper types

When NOT to Refactor

  • During a bug fix (fix the bug, then propose a refactor separately)
  • Without tests for the affected code
  • Without explicit approval from the user/team
  • When you're "just making it better" without a concrete improvement goal
  • In the same commit as a feature change

Refactoring Protocol

Step 1: Justify

  • State what you want to refactor and why
  • Quantify the improvement: "Reduces duplication from 3 copies to 1"

Step 2: Ensure Safety Net

  • Verify tests exist for the code being refactored
  • If tests are missing: write them first, commit them separately, then refactor

Step 3: Plan the Changes

  • List every file that will change
  • Identify the refactoring pattern
  • Declare the scope boundary: "I will only touch files X, Y, Z"

Read the full file on GitHub · 81 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 81 lines · 98 tokens per session scan A 83e35b6493b1

Subscribe to this mod's changes

pwp-refactor is a skill published in the GitHub repository shandar/pwp-plugin (1 stars, last pushed 6mo ago), licensed MIT. It adds 98 tokens to every session and 852 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.