v3.4.0 — /update-deps for safe two-pass dependency updates

Adds /update-deps, a dependency updater for JavaScript/TypeScript projects — npm, pnpm, and yarn (classic and berry).

v3.4.0 — /update-deps

It snapshots what is outdated, analyzes each pending major in parallel, then puts both passes behind a single approval gate before writing anything. Majors are applied only when proven safe for this codebase; the rest are held back with a specific blocker and a rough migration cost — never "may contain breaking changes".

• /update-deps skill — the orchestrator. disable-model-invocation: true since it mutates package.json. It never commits and never auto-reverts: on a verification failure it reports the error, names the packages that were applied, and leaves the tree for you. Modes: minors-only, majors-only, dry-run, sequential.
• major-upgrade-analyzer agent — one subagent per major. Sources the breaking-change record (Context7 → npm view → the project's own changelog → web last), checks four hard gates (Node runtime floor, peer deps, ESM-only module format, TypeScript floor), then greps each documented breaking change against real call sites. Returns safe / safe-with-edits / wait at confidence ≥ 80, with ties breaking toward wait.
• scripts/dep-outdated.sh — normalizes the package managers into one JSON shape, including the manager-appropriate update, install, and workspace-flag templates so consumers never hardcode a manager's syntax. Read-only.

Monorepo support

npm outdated at a workspace root reports the union across every workspace and names the owner in dependent, so the script reads every workspace manifest and resolves each finding back to the package that declared it. This closes two bugs that only a real monorepo exposed:

• Reading only the root manifest reports a workspace devDependency as a prod dependency.
• A bare npm install <pkg>@<ver> at a workspace root adds the package to the root manifest as a new dependencies entry and leaves the owning workspace untouched — silently wrong in two directions at once. Fixed with workspaceFlagTemplate (npm -w, pnpm --filter, yarn berry's yarn workspace command prefix).

Workspace owners match on both the package name and the directory basename, because npm identifies the root package by its directory, not its name.

Coupling resolution

Analyzers judge one package each, so a family locked by exact mutual peer pins — vitest + @vitest/coverage-v8 + @vitest/browser-playwright, say — produces N wait verdicts that all say "cannot move alone". A pass before the plan collapses those into one group, re-derives the verdict with the mutual-pin gate discounted, and applies the group atomically.

Package-manager quirks absorbed

• yarn (classic and berry): yarn outdated emits NDJSON on classic and does not exist on berry, so both use read-only npm outdated --json against the installed tree, reported as outdatedSource: "npm-fallback".
• yarn berry: updateCommand is null because yarn up '*' resolves to latest and crosses majors; in-range updates go per package with the declared range.

Also

• library-modernizer now ends its Library Health section with a /update-deps handoff when it finds major-version drift, mirroring the existing dead-code → /dead-code cleanup pattern. That agent reports drift; /update-deps applies it.

Known gaps

Yarn is exercised through the npm-fallback resolver against a simulated lockfile, not a real Yarn project. Berry PnP (no node_modules) reports every package as unknown; the skill says so explicitly and points at yarn install --mode=update-lockfile. Python, Rust, and Go are out of scope for this release.

Install / upgrade

/plugin install codebase-health@somepulp-agents      # 2.4.0

Full diff: v3.3.0...v3.4.0

v3.3.0 — slash commands migrated to skills, docs alignment

Backfilled release for the v3.3.0 tag.

v3.3.0 — slash commands migrated to skills

• All plugins: Migrated every slash command from commands/*.md to skills/<name>/SKILL.md. Custom commands have been merged into skills upstream — both forms create the same /<name> and behave identically — and the docs now direct new plugins to skills/. The commands/ directories are gone; /deep-audit, /dead-code, /update-docs, /research, and /official-docs are unchanged for users. Each migrated file gained a name matching its directory and a when_to_use field.
• codebase-health 2.3.0: /deep-audit's Stop hook switched from type: prompt to type: agent with timeout: 120. The hook checks the filesystem for the code-audit-*.md report, which a prompt hook cannot see — it receives only the hook's JSON input.
• codebase-health 2.3.0: Added a ## Contents table of contents to all five skill reference files over 100 lines.

Fixed

• dead-code-methodology.md documented deadcode . --verbose, which is not a deadcode flag; replaced with --count.
• code-auditing SKILL.md listed deadcode . --dry as the detection command; detection is deadcode . (--dry previews fixes).
• CLAUDE.md: Corrected three claims the official docs contradict — the 1,536-character cap is the skill listing cap on description + when_to_use (subagent descriptions share a ~15,000-token budget); Agent is stripped from a subagent only at the nesting depth limit, and tools supports Agent(type); the subagent tool filter does not apply to skills, which run in the main conversation unless they set context: fork.

Install / upgrade

/plugin install codebase-health@somepulp-agents      # 2.3.0
/plugin install research-assistant@somepulp-agents   # 1.5.0

Full diff: v3.2.1...v3.3.0

v3.2.1 — add code-quality-auditor to the renames map

Adds code-quality-auditor → codebase-health to the marketplace renames map — an early plugin name missed in the v3.2.0 lineage, so installs under that name migrate cleanly too. No plugin content changes.

v3.2.0 — plugin/skill best-practices modernization

Modernizes the whole marketplace against the current official Claude Code plugin, skill, sub-agent, slash-command, and hooks documentation. Versions: marketplace 3.2.0, codebase-health 2.2.0, research-assistant 1.4.0.

Added

• Marketplace: Replaced the dead $schema URL in marketplace.json with the SchemaStore marketplace schema, and added a top-level renames map recording the plugin lineage (code-auditor → codebase-health, codex-consultant/gemini-consultant → second-opinion, second-opinion → retired) so old installs migrate cleanly.
• All plugins: Added $schema (SchemaStore plugin-manifest schema) as the first key in each plugin.json.
• codebase-health 2.2.0: disable-model-invocation: true on /deep-audit and /update-docs so these resource-intensive commands only run when the user invokes them.
• research-assistant 1.4.0: /research and /official-docs now declare context: fork and agent: in frontmatter, running directly as their agents in a forked context.

Changed

• All plugins: Trimmed plugin.json manifests to metadata only — removed the explicit agents, commands, and skills arrays so default directory auto-discovery applies (explicit arrays replace the default scan, silently dropping newly added files).
• codebase-health 2.2.0: /deep-audit hardening — scoped Bash pre-approvals instead of bare Bash, Task → Agent tool rename, and a Stop-hook stop_hook_active loop guard with an explicit {"ok": …} response contract.
• codebase-health 2.2.0: dead-code-cleanup and update-docs agents no longer list AskUserQuestion (unavailable inside subagents) — agents return a verified findings report plus a proposed plan, and the wrapper commands gather user approval in the main conversation before applying changes.
• codebase-health 2.2.0: Skills reference bundled files via ${CLAUDE_SKILL_DIR}, use use-case-first descriptions with a when_to_use trigger-phrase field, and docs-maintenance pre-approves Edit/Write.
• codebase-health 2.2.0: dead-code-detect.sh emits a single JSON envelope for mixed Node+Python projects with --format json, with graceful fallbacks for invalid knip output and missing jq; documented invocations quote "${CLAUDE_PLUGIN_ROOT}".

Full details in CHANGELOG.md.

v3.1.3 — scope audit Stop hook to /deep-audit runs

Backfilled release — the v3.1.3 tag was also missing and has been created at the release commit.

v3.1.3 — scope the audit Stop hook to /deep-audit runs

Fixed

• codebase-health 2.1.3: The audit-report Stop hook was firing on every turn-end in every session, not just audit runs.
  • The v3.1.2 hooks.json repair activated a plugin-level Stop hook that had silently never loaded (broken since its introduction in v2.2.0). Once loaded, it evaluated "was an audit report created?" at the end of every conversation turn — constantly nagging in sessions where no audit ever ran.
  • The hook now lives in the /deep-audit command's frontmatter (hooks: field), which scopes it to the skill's lifecycle per the official hooks spec: active only while the command runs, cleaned up when it finishes.
  • Removed the plugin-level hooks/hooks.json and the hooks entry from plugin.json. The prompt now also states the approve path explicitly so it cannot re-block in a loop.

Full diff: v3.1.2...v3.1.3

v3.1.2 — plugin manifest repairs, displayNames

Backfilled release — the v3.1.2 tag was also missing and has been created at the release commit.

v3.1.2 — plugin manifest repairs

Fixed

• codebase-health 2.1.2: Two plugin.json bugs that made /doctor report "skills load failed" and "Hook load failed".
  • skills entries now point at the skill directories (./skills/code-auditing, ./skills/docs-maintenance) rather than the SKILL.md files inside them.
  • hooks/hooks.json events are now nested under the required top-level "hooks" key — the Stop event was previously at the root, failing validation.
• README: Documented the optional AWS Documentation MCP server. The research-assistant agent already listed its tools, but the README's MCP requirements mentioned only Context7 and Fetch.

Added

• All plugins: displayName ("Codebase Health", "Research Assistant") in plugin manifests and marketplace entries, for friendlier display in the /plugin picker (Claude Code v2.1.143+; older versions fall back to name).

Changed

• Bumped research-assistant to 1.3.2 to deliver the manifest metadata to installed users.

Note: repairing the hooks manifest activated a Stop hook that had silently never loaded since v2.2.0 — which then fired on every turn-end in every session. Fixed immediately after in v3.1.3.

Full diff: v3.1.1...v3.1.2

v3.1.1 — orchestrator boundary verification, mandatory skip notes

Backfilled release for the v3.1.1 tag.

v3.1.1 — /deep-audit orchestrator boundary hardening

Follow-up to the PR #8 review of the orchestrator refactor shipped in v3.1.0.

Fixed

• codebase-health 2.1.1: The orchestrator now verifies each specialist's return value against the expected ## <Name> Findings heading and severity sections (### Critical / ### High / ### Medium) before pasting it into the report. Empty, missing-heading, or malformed results are recorded under a new Specialists that failed: line in Notes instead of being silently dropped — a launched specialist is never omitted from the final report.
• The dead-code skip note is now mandatory: when dead is requested (or selected via all) but no dependency manifest exists, Notes must include an explicit Dead code: skipped — no manifest line, regardless of whether other specialists ran.
• Added a ### Notes section to the library-modernizer and code-quality-reviewer output templates so per-specialist skip-notes (Context7 unavailable, no CLAUDE.md to read conventions from) survive aggregation — closing a parity gap with security-auditor and performance-analyzer.

Full diff: v3.1.0...v3.1.1

v3.1.0 — deep-audit orchestrator, plugin modernization, second-opinion removal

First release in the 3.x line. Rolls up three unreleased CHANGELOG entries (v3.0.0, v3.0.1, v3.1.0) into a single tag — the v2.2.0 → v3.1.0 jump in the tag history is intentional.

v3.1.0 — /deep-audit orchestrator refactor

• codebase-health 2.1.0: Refactored /deep-audit from a single 360-line monolithic agent into an orchestrator-of-specialists pattern, mirroring the official pr-review-toolkit plugin.
  • The /deep-audit command is now the orchestrator: it inspects the project, decides which specialists apply, launches them via Task (parallel by default; opt-in sequential), and aggregates findings into code-audit-[timestamp].md.
  • Concerns split across four new specialist agents — security-auditor, performance-analyzer, library-modernizer, code-quality-reviewer — and the existing dead-code-cleanup is reused in detect-only mode.
  • Specialists return structured findings blocks (Critical/High/Medium severity, confidence ≥ 80, file:line refs); the orchestrator owns the final report.
  • Each specialist's description says "Used by the deep-audit orchestrator. Do not invoke directly." to prevent auto-triggering in normal conversations.
  • $ARGUMENTS now supports per-aspect scoping (security, perf, deps, quality, dead, all) plus an optional sequential token to opt out of parallel execution.
• codebase-health: Removed the monolithic deep-audit agent (replaced by the orchestrator command + specialists).

v3.0.1 — Plugin modernization fixes

• All agents: Moved <example> blocks out of the YAML description: scalar into the markdown body. Multi-line examples were being parsed as a single oversized description and getting truncated at the 1,536-char auto-routing cap.
• Skills: Restored missing allowed-tools frontmatter on code-auditing and docs-maintenance.
• Skills: Removed non-spec version field (skill version is implied by plugin version).
• CLAUDE.md / README.md: Refreshed to remove stale references to the retired second-opinion plugin and to match the JSON-array tools: format actually used in agent frontmatter.
• Bumped codebase-health to 2.0.1 and research-assistant to 1.3.1 to deliver the modernization fixes to installed users.

v3.0.0 — BREAKING: removed second-opinion plugin

• The Codex Claude Code plugin now provides built-in second-opinion functionality, and Gemini consultation was rarely used in this configuration. Users wanting external AI consultations should install the Codex plugin directly.

Install / upgrade

/plugin install codebase-health@somepulp-agents      # 2.1.0
/plugin install research-assistant@somepulp-agents   # 1.3.1

Existing installs of second-opinion, codex-consultant, or gemini-consultant from this marketplace should be removed — those plugins no longer exist here.

Full diff: v2.2.0...v3.1.0

v2.2.0 — skill auto-loading, hooks, read-only research agents

Backfilled release for the v2.2.0 tag.

v2.2.0 — skill auto-loading, hooks, read-only research

Added

• All plugins: homepage and repository fields in plugin.json.
• codebase-health: skills field on agents for automatic skill loading — deep-audit and dead-code-cleanup load code-auditing; update-docs loads docs-maintenance.
• second-opinion: skills field on agents — codex-consultant and gemini-consultant load ai-consultation.
• research-assistant: disallowedTools: Write, Edit on agents for read-only safety.
• codebase-health: prompt-based Stop hook for audit-report verification.
• second-opinion: prompt-based PreToolUse hook for Bash sandbox safety.

Changed

• research-assistant: Removed the bundled MCP servers (Context7, Fetch) — users commonly install these separately. The plugin now falls back to WebSearch/WebFetch when MCP is unavailable, with installation nudges when the tools are missing.

Removed

• research-assistant: .mcp.json (Context7 and Fetch no longer bundled).

Note: the plugin-level Stop hook added here silently never loaded, due to a manifest nesting bug fixed in v3.1.2 — and once loaded it fired on every turn, fixed in v3.1.3 by scoping it to /deep-audit's frontmatter.

Full diff: v2.1.0...v2.2.0

v2.1.0 — consolidate consultants into second-opinion

Backfilled release for the v2.1.0 tag.

v2.1.0 — BREAKING: codex-consultant + gemini-consultant → second-opinion

Consolidated the two consultant plugins into a single second-opinion plugin sharing one ai-consultation skill with unified reference documentation.

• Old: /plugin install codex-consultant@somepulp-agents + /plugin install gemini-consultant@somepulp-agents
• New: /plugin install second-opinion@somepulp-agents

Commands (/codex-opinion, /gemini-opinion) and agents (codex-consultant, gemini-consultant) are unchanged — only the packaging moved.

Removed

• codex-consultant plugin (merged into second-opinion)
• gemini-consultant plugin (merged into second-opinion)

Note: second-opinion was itself retired in v3.0.0 — the Codex Claude Code plugin now provides this functionality. See the v3.1.0 release.

Full diff: v2.0.0...v2.1.0