Follow up Factory Droid upstream updates: disabledSkills key, enabled skill frontmatter, commandRegex hook filter, inert allowed-tools on commands

[dyoshikawa]

Summary

Four Factory Droid surfaces are unfollowed as of v0.183.0 (2026-07-29): the disabledSkills settings key and the enabled SKILL.md frontmatter field (both halves of the v0.173.0 skill-controls work, which #2412 had recorded as "unconfirmed" and Factory has since documented), the commandRegex hook matcher-group filter, and an allowed-tools command frontmatter key rulesync advertises but Factory documents as unavailable.

Baseline: #2412 (closed, resolved by #2453) covered through v0.180.0 (2026-07-24). Newer releases v0.181.0–v0.183.0 add no other config surface. Both dry-runs clean.

Recent Releases

• v0.173.0 (2026-07-15) — "Skill controls — You can now disable individual skills and see how skill settings resolve across scopes" — release notes (gaps 1–2, now documented in settings/skills docs).
• v0.181.0 (2026-07-27) — MCP oauth.resource override — passes through rulesync's loose MCP schema, no action (see non-gaps).
• v0.182.0 / v0.183.0 (2026-07-28/29) — app/runtime only.

Gaps

1. skills — disabledSkills settings key not authorable

• Upstream: settings documents disabledSkills (array of skill names, default [], "Disable discovered skills without deleting their files"); user and project arrays are combined, stale entries are safe; the /skills manager writes ~/.factory/settings.json (User) or <project>/.factory/settings.json (Project), and direct editing is documented. — v0.173.0.
• rulesync: FACTORYDROID_OVERRIDE_KEYS (src/features/permissions/factorydroid-permissions.ts) lists 13 keys; disabledSkills is absent, so it can neither be authored nor lifted on import. Notably this is the only per-skill kill switch that reaches skills rulesync does not own (Factory built-ins and plugin-supplied skills) — frontmatter flags only reach generated SKILL.md files.
• Fix: add "disabledSkills" to FACTORYDROID_OVERRIDE_KEYS — same one-line shape as the hooksDisabled / plugin-bootstrap keys landed by fix(factorydroid): filter prompt-type hooks Droid cannot run, make plugin-bootstrap settings authorable #2453.

2. skills — enabled frontmatter not modeled; import lossy for the newer fields

• Upstream: the skills frontmatter table now documents ten fields, including enabled (default true, "keep the skill on disk but disable it" — a distinct row in the invocation-control matrix), plus allowed-tools, license, compatibility, metadata, version (legacy tools deprecated in favor of allowed-tools). — v0.173.0.
• rulesync: FactorydroidSkillFrontmatterSchema (src/features/skills/factorydroid-skill.ts) models only name/description/user-invocable/disable-model-invocation, and both conversion directions build explicit literals, so looseObject does not help: fromRulesyncSkill makes enabled unauthorable, and toRulesyncSkill silently drops an imported enabled: false (a subsequent generate re-enables the skill).
• Fix: add enabled to the schema and both round-trip paths; consider carrying allowed-tools too (the canonical shape already exists in the claudecode skill block).

3. hooks — commandRegex matcher-group filter not authorable

• Upstream: the hooks reference documents commandRegex alongside matcher: "Additional regex filter for Execute commands. It matches the actual shell command string… Invalid regex values are skipped", with the canonical example {"matcher": "Execute", "commandRegex": "^git ", "hooks": [...]}.
• rulesync: grep -rn commandRegex src/ returns nothing; FACTORYDROID_CONVERTER_CONFIG (src/features/hooks/factorydroid-hooks.ts) declares no groupPassthroughFields, so the field cannot be authored and is dropped on import. The documented way to scope an Execute hook to a command family is unreachable — authors must hand-edit .factory/hooks.json after every generate or re-filter inside the script.
• Fix: add a commandRegex string field to HookDefinitionSchema (src/types/hooks.ts) and list it in FACTORYDROID_CONVERTER_CONFIG.groupPassthroughFields — the group-field plumbing (canonicalToToolHooks / importGroupPassthroughFields) already exists.

4. commands — rulesync advertises allowed-tools, which Factory documents as unavailable

• Upstream: custom slash commands lists exactly two frontmatter keys (description, argument-hint) and states verbatim: "Tool scoping is not available for custom commands. Use Skills or Custom Droids for tool policy."
• rulesync: FactorydroidCommandFrontmatterSchema (src/features/commands/factorydroid-command.ts) declares allowed-tools ("reserved/optional; passed through verbatim") and fromRulesyncCommand spreads it into the emitted frontmatter — an inert key written with no warning. Same failure mode as Follow up Factory Droid upstream updates: prompt-type hooks emitted but unsupported, plugin-bootstrap settings keys unauthorable #2412's gap 1 (accepted-but-inert), which fix(factorydroid): filter prompt-type hooks Droid cannot run, make plugin-bootstrap settings authorable #2453 fixed by narrowing the declaration.
• Fix: drop allowed-tools from the explicit keys (or warn when present). Also fix .claude/skills/rulesync-feature-research/references/factorydroid.md, whose commands row still advertises allowed-tools and will re-mislead the next research pass.

Non-gaps (verified)

• MCP oauth.resource (v0.181.0): safe by construction — McpServerSchema is looseObject and FactorydroidMcp passes servers through verbatim.
• Subagent autonomy: subagentAutonomyLevel / subagentModelSettings are settings keys (former already in FACTORYDROID_OVERRIDE_KEYS); droid frontmatter is still the six modeled fields.
• Follow up Factory Droid upstream updates: prompt-type hooks emitted but unsupported, plugin-bootstrap settings keys unauthorable #2412 items: prompt-type hooks now filtered (supportedHookTypes: Set(["command"])); plugin-bootstrap keys present.
• ignore / checks: still no upstream surface.
• showHookOutput (debug display toggle) and settings.local.json (machine-specific gitignored tier) deliberately not proposed.
• Standing observation from fix(factorydroid): filter prompt-type hooks Droid cannot run, make plugin-bootstrap settings authorable #2453's review, still unaddressed and growing with gap 1: the generate-side override merge spreads any factorydroid override key into settings.json while the import-side lift is restricted to FACTORYDROID_OVERRIDE_KEYS (codexcli filters both sides).

References

• https://docs.factory.ai/changelog/release-notes — v0.173.0 skill controls; v0.181.0–v0.183.0 window.
• https://docs.factory.ai/cli/configuration/settings — disabledSkills key and merge semantics (gap 1).
• https://docs.factory.ai/cli/configuration/skills — ten-field frontmatter table incl. enabled (gap 2).
• https://docs.factory.ai/reference/hooks-reference — commandRegex matcher-group field (gap 3).
• https://docs.factory.ai/cli/configuration/custom-slash-commands — two-key command frontmatter and the no-tool-scoping statement (gap 4).