v0.6.0 — dep-steward is a Claude Code plugin

Install it once, have it everywhere

This repo is now a Claude Code plugin. The two commands below install it from this repo alone — no other repository or registry involved:

/plugin marketplace add raphaelcm/dep-steward
/plugin install dep-steward@dep-steward

That replaces the manual curl into ~/.claude/commands/ the README used to ask for, and adds two commands that did not exist:

Command	What it does
/dep-steward:install	Preflights the prerequisites in whatever repo you're in, shows the --dry-run plan, then installs.
/dep-steward:summary	The former /dep-steward-summary, unchanged — what was auto-merged, what was escalated and why, and an honest time-saved estimate.
/dep-steward:uninstall	Removes the pipeline — files, label, and the token from both secret stores (forgetting the second one is the usual half-uninstall).

The install skill is written against how the installer actually behaves

Every interactive prompt in install.sh is guarded by [ -t 0 ], so a non-interactive run never hangs: it uses the flag it was given or stops with a clear message. The skill leans on that rather than on how the script reads.

Two steps genuinely need a browser and cannot be completed by an agent: minting CLAUDE_CODE_OAUTH_TOKEN with claude setup-token, and granting the Claude Code GitHub App. For those the skill hands off with the exact command and names which step needs a person, instead of pretending it can finish.

One copy of the summary command, not two

templates/dep-steward-summary.md moved to skills/summary/SKILL.md — moved, not copied. Two canonical copies of that text would drift, with the plugin serving one and the README's curl fallback serving the other, and nothing would catch it. The README fallback now points at the new path, which works as a standalone command file too.

The body is verbatim. It encodes real pipeline contracts — the AUTOMERGE-DECISION-V1 block, the needs-human-review label, the -minor-patch- branch naming — and rewording it risks drift from what the pipeline actually writes, for no gain.

Version policy

.claude-plugin/plugin.json carries an explicit version — 0.6.0, this release — rather than relying on git-SHA versioning. The tradeoff stated plainly: users receive a plugin update only when that field moves, so it moves with every release tag from here on.

Testing

New test/plugin.test.mjs pins the invariants that break an install for every user, silently, with nothing else watching: both manifests parse and agree, the marketplace entry's name matches plugin.json and its source is the repo root, every skill carries a description (without one a skill loads but never surfaces), and the README's raw-file links resolve on disk — exactly what rots after moving the summary command. It rides the existing test/*.test.mjs glob, so CI needed no change.

node --test test/*.test.mjs      149 pass, 0 fail
shellcheck -s sh install.sh      clean
claude plugin validate .         Validation passed