grimoire-deps

[Required Reading]

1. Read ${CLAUDE_PLUGIN_ROOT}/GRIMOIRE-CONVENTIONS.md. The sections that apply to this skill are: § Sub-agent spawning (the audit and apply sub-agents), § Skill composition, § Commits (per-dependency atomic Conventional Commits in English), § Project context and § Historic (read-only consumption only), § IDE-aware review (the ranked report and the upgrade brief), § User-facing language, and § Pause-point pattern (the report selection pause). Exception: § TDD's filter-only rule is deliberately excepted for the post-bump verification gate in Phase 4 — a dependency bump has global blast radius, so the gate runs the project's broader test/build/lint, not a filtered test run (see Phase 4 for the full rationale). Not applicable: § .grimoire/ layout and the Spec → Plan → Execute page lifecycle do not apply — this skill is orthogonal (same family as grimoire-know / grimoire-note / grimoire-update) and writes no pages, no SPEC.md, and no HISTORIC.md entries.
2. If .grimoire/PROJECT.md exists in the project root, read it for project context (tech stack, conventions, verification gate). If it does not exist, proceed without it and, at the end of the run, suggest the user run grimoire-init once to enrich future runs (non-blocking — never refuse to audit because PROJECT.md is missing).
3. If .grimoire/HISTORIC.md exists, read it read-only for recent-page context. Missing → proceed without it.

[Objective] Audit the consuming project's dependencies along four axes (security, semver risk, maturity, reputation), present a ranked report, and interactively apply the safe updates the user selects. Breaking / high-risk upgrades are NOT executed here — they are handed off to the Spec → Plan → Execute pipeline via an upgrade brief.

$ARGUMENTS is an optional focus filter: a single package name or one ecosystem to scope the audit to. When empty, audit every ecosystem and dependency detected in the project.

[Hard constraints — orthogonal skill]

• Never create a page folder under .grimoire/pages/.
• Never write to .grimoire/HISTORIC.md.
• Never write to .grimoire/PROJECT.md (the dual-writer contract grimoire-init / grimoire-note is unchanged).
• Never make page-lifecycle commits (docs(grimoire): spec …, chore: register …, chore: mark … planned/finished). This skill never participates in the page lifecycle.
• The only files this skill writes — beyond the actual dependency bumps — are: (a) the ephemeral upgrade-brief draft under .grimoire/bag/drafts/ (Phase 5), deleted in Phase 6; and (b) the dependency manifest/lockfile changes produced during the apply phase (Phase 4). The dependency bumps are committed; the draft is not.
• Reputation and maturity signals are best-effort heuristics (native audit tooling + advisory feeds + web search), never guarantees. A "clean" verdict must NEVER be presented as a security guarantee. State this disclaimer in the report.

[Phase 1: Ecosystem detection]

• Auto-detect the package ecosystems present by scanning for manifests and lockfiles at the project root (and obvious sub-projects):
  • npm / pnpm / yarn — package.json + package-lock.json / pnpm-lock.yaml / yarn.lock.
  • pip / poetry / uv — requirements.txt / pyproject.toml / poetry.lock / uv.lock.
  • composer — composer.json / composer.lock.
  • cargo — Cargo.toml / Cargo.lock.
  • go mod — go.mod / go.sum.
• The five ecosystem families above are the core set and are first-class. Any other ecosystem present (e.g. Gemfile, gradle, pubspec, …) is handled best-effort: detect it, audit what the native tooling allows, and flag in the report where coverage is partial.
• If $ARGUMENTS names a single package or one ecosystem, honor it as a focus filter — restrict detection and the rest of the run to that scope. Empty → audit everything detected.
• If no recognizable ecosystem is found, tell the user (PT-BR) that nothing auditable was detected and end.