feat: add Local YDB Toolkit plugin

[astandrik]

Summary

• add Local YDB Toolkit as a local marketplace plugin with its reusable skill and pinned stdio MCP server
• vendor only the runtime plugin files from astandrik/local-ydb-toolkit commit 82e334dd792cebbcdbc9fb91610614697746e41c
• add a deterministic sync/check script and CI freshness check against that exact source commit

A local marketplace source is used because released Droid clients install the plugin root from the marketplace checkout; the external GitHub source form otherwise resolves to the marketplace repository root.

Verification

• current droid@0.196.0 discovers and installs local-ydb-toolkit@factory-plugins in an isolated container
• installed tree recursively matches plugins/local-ydb-toolkit and contains the Factory manifest, mcp.json, and skills/local-ydb/SKILL.md
• installed MCP pin @astandrik/local-ydb-mcp@0.15.4 passes initialize/tools/list with exactly 39 tools
• local and fresh-network pinned-source freshness checks pass for all 13 synchronized files
• unsafe source paths, source/destination symlinks, and stale vendored content are rejected
• marketplace/manifest/MCP JSON, workflow YAML, skill accounting, and git diff --check pass

No user Factory configuration or credentials were used or modified.

[Copilot]

Pull request overview

Adds Local YDB Toolkit as a vendored local marketplace plugin, including its reusable local-ydb skill, pinned stdio MCP server configuration, and a deterministic sync/check mechanism to keep the vendored files fresh against a pinned upstream commit.

Changes:

• Introduces plugins/local-ydb-toolkit with plugin manifest, MCP config, license, and the local-ydb skill content.
• Adds scripts/sync-local-ydb-toolkit.py to deterministically sync/check a fixed set of upstream paths based on plugins/local-ydb-toolkit/SOURCE.json.
• Extends CI (check-skills.yml) to fetch the pinned upstream commit and verify the vendored content is up-to-date; documents the plugin in the root README.md and marketplace manifest.

Reviewed changes

Copilot reviewed 18 out of 20 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
scripts/sync-local-ydb-toolkit.py	New deterministic sync/check script for vendored Local YDB Toolkit files.
README.md	Documents the new local-ydb-toolkit plugin, skill name, and pinned MCP server invocation.
plugins/local-ydb-toolkit/SOURCE.json	Records upstream repo + pinned source commit for deterministic syncing.
plugins/local-ydb-toolkit/README.md	Plugin-specific readme and guidance for re-syncing via the script.
plugins/local-ydb-toolkit/mcp.json	Registers pinned stdio MCP server (@astandrik/local-ydb-mcp@0.15.4).
plugins/local-ydb-toolkit/LICENSE	Adds upstream MIT license text for the vendored content.
plugins/local-ydb-toolkit/.factory-plugin/plugin.json	Adds Factory plugin manifest for local-ydb-toolkit.
plugins/local-ydb-toolkit/skills/local-ydb/SKILL.md	Adds the reusable local-ydb skill content and operational guidance.
plugins/local-ydb-toolkit/skills/local-ydb/agents/openai.yaml	Adds agent metadata for the local-ydb skill.
plugins/local-ydb-toolkit/skills/local-ydb/scripts/.gitkeep	Ensures scripts directory exists in the vendored skill tree.
plugins/local-ydb-toolkit/skills/local-ydb/assets/.gitkeep	Ensures assets directory exists in the vendored skill tree.
plugins/local-ydb-toolkit/skills/local-ydb/references/verification.md	Adds verification runbook for local-ydb deployments.
plugins/local-ydb-toolkit/skills/local-ydb/references/topology.md	Adds topology runbook and container examples for local-ydb.
plugins/local-ydb-toolkit/skills/local-ydb/references/storage-migration.md	Adds storage migration guidance and safety checks.
plugins/local-ydb-toolkit/skills/local-ydb/references/mcp-tool-scenarios.md	Adds scenario-based exercises covering the MCP tool surface.
plugins/local-ydb-toolkit/skills/local-ydb/references/history-and-non-goals.md	Adds documentation hygiene guidance and non-goals reference.
plugins/local-ydb-toolkit/skills/local-ydb/references/auth-hardening.md	Adds auth-hardening reference and rollout guidance.
.github/workflows/check-skills.yml	Adds CI freshness verification by fetching the pinned upstream commit and running the sync script in --check mode.
.factory-plugin/marketplace.json	Registers local-ydb-toolkit as a local marketplace plugin.

Suppressed comments (1)

scripts/sync-local-ydb-toolkit.py:201

• synchronize() writes to destination without verifying it is not a symlink at the moment of writing. Even though managed targets are removed first, a symlink could be (re)introduced between removal and write_bytes(), causing the sync to overwrite an arbitrary path.

Add a defensive check before writing to refuse symlinks (and other non-regular files) at the destination path.

        destination = destination_for(target)
        destination.parent.mkdir(parents=True, exist_ok=True)
        destination.write_bytes(source_file.content)
        destination.chmod(0o755 if source_file.executable else 0o644)

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 19 out of 21 changed files in this pull request and generated no new comments.

Suppressed comments (4)

plugins/local-ydb-toolkit/skills/local-ydb/references/mcp-tool-scenarios.md:866

• The coverage matrix also omits local_ydb_check_prerequisites, despite Scenario 0 covering it and the pinned server exposing it. Add a prerequisites category so this matrix actually accounts for the complete public tool set.

## Coverage Matrix

- Bootstrap and lifecycle:

plugins/local-ydb-toolkit/skills/local-ydb/references/mcp-tool-scenarios.md:9

• This scope says it lists every public tool, but local_ydb_check_prerequisites is missing. The pinned server registers that tool, and this same document uses it in Scenario 0. Add it to the inventory so the documented 39-tool surface is complete; because this file is vendored, update upstream and refresh the pinned source rather than editing it directly.

This issue also appears on line 864 of the same file.

This document covers all public `local_ydb_*` tools currently registered by the MCP server:

plugins/local-ydb-toolkit/skills/local-ydb/references/mcp-tool-scenarios.md:52

• Marketplace installations do not contain examples/local-ydb.config.example.json, yet the remainder of this document relies on profiles defined only there (ghcr261-clean, ghcr261-auth, etc.). Users cannot run these scenarios from the installed plugin as written. Either include the example in the runtime payload or link to/provide the required profile definitions here.

Use these profiles from `examples/local-ydb.config.example.json`:

plugins/local-ydb-toolkit/skills/local-ydb/references/verification.md:34

• Expanding $DATA into curl --data places the root password directly in curl's process arguments, where it may be visible through process inspection; the manual printf also produces invalid JSON for passwords containing quotes or backslashes. Serialize with a JSON encoder and stream the request body to curl via stdin (for example, --data-binary @-) so the secret never appears in argv.

PASS=$(sudo cat /path/to/root.password)
DATA=$(printf '{"user":"root","password":"%s"}' "$PASS")

curl -sS -c /tmp/ydb-cookies.txt \
  -H 'Content-Type: application/json' \
  -X POST \
  --data "$DATA" \