claude-code-plugins

Use when creating PRs, linking issues, managing PR comments, or creating GitHub issues

Use when creating or editing GitHub Actions workflows that call reusable workflows (uses: OWNER/repo/.github/workflows/...) — org owner references must be the literal current org, and shared-CI homes are under dryvist.

Emit a paste-ready two-part handoff for a fresh session: a `## Goal statement` hard-capped under 4000 characters (measured with wc -c, never estimated) that pastes straight into Claude Code's /goal Stop hook, plus an unbounded `## Full prompt` carrying cwd, ordered reading list, hard rules, pitfalls, and deliverables. Use when forking work to a new session, spinning up an orchestrator, or when wrap-up needs a next-session prompt with a real goal and not just a task list.

Analyzes current session state and repository status without any cleanup. Full mode (default): resolves the active plan file, reads plan checklist + TaskList, gathers unfinished work/issues from conversation history, checks git status, and emits a /handoff-built next-session prompt. Mid-session mode (`/session-status mid`): a fast plain-language 'done vs remaining' snapshot for mid-flight orientation, skipping the history scan, triage, and handoff.

End-of-session handler that first checks whether the current session's plan is actually complete. If complete: refresh repo, run quick retrospective, clean gone branches, and emit a forward-looking follow-up prompt. If incomplete: skip cleanup and emit one or more `cd`-into-worktree blocks paired with ready-to-paste resume prompts so the unfinished work can be picked up cold in a new session.

Automatically finalize pull requests for merge by resolving CodeQL violations, review threads, merge conflicts, and CI failures. Handles single PR (current branch or by number), all open PRs in the repo, or all open PRs across the org. Includes bot-authored PRs in all modes.

Work with repositories using the git-flow-next branching model (default branch is `develop`, production branch is `main`). Covers branch creation, worktree setup, atomic commits, PR targeting, validation on `develop`, and mandatory end-of-session promotion to `main`.

Verify or refresh the OpenTofu-to-Ansible inventory distribution (RustFS-published; apply is the publish boundary)

Commit, push, create PR(s), and auto-finalize — full automation pipeline. Handles uncommitted changes and recently created PRs.

How to obtain and handle secrets under an OpenBao-backed access model: pick the right store tier, prefer engine-minted ephemeral credentials over static secrets, read with the pre-authorized tier, and route write/apply through the human-gated wrapped single-use secret_id. Use before fetching any credential, wiring a service to a secret, converging a publisher, or when tempted to paste a token — and whenever a task needs a credential and you are unsure whether you may just take it.

Canonical reference for all gh CLI command shapes used by skills in this plugin. Defines the placeholder convention, default-branch (trunk vs git-flow) detection, allowed --json fields, GraphQL fallback rules, -f/-F/--raw-field flag semantics, the PR-readiness gate, code-scanning alert query, review-thread fetch/count/resolve mutations, and heredoc bodies. Prevents Unknown JSON field errors and divergent query shapes.

Drive open PRs toward zero across one or many repos by risk-ranking every open PR, auto-merging the low-risk mergeable ones, and surfacing the rest with the exact reason each is held. Use when open PRs have piled up and you want them triaged and cleared in one pass. Batches over the existing /squash-merge-pr and /finalize-pr per PR — it decides which PRs are safe to merge and delegates the merge, it does not reimplement merging.

Rebuild a plan from live git, gh, and repo state when the existing plan file no longer matches reality — items silently done, approach superseded, or facts drifted. Use when a plan has gone stale mid-effort or when resuming reveals contradictions. Re-derives ground truth first, never trusting the plan's own prose, then rewrites the plan to match what is actually true and what actually remains.

Pick up unfinished work cold in a fresh session by re-deriving state from live git, gh, the plan file, and TaskList — never from remembered or pasted claims. Use at the start of a new session that continues prior work, or when handed a resume prompt. Verifies what is actually merged, open, committed, and checked-off right now, reconciles it against the plan, then states exactly where things stand and what the next action is before touching anything.

Stack-agnostic discovery playbook for finding the native, non-custom way to do something before writing any script or wrapper. Use when tempted to write a shell/python/glue script, add a dependency, or build a custom helper — and whenever a script-guards hook blocks a script write. Climbs a fixed ladder (tool's own config/flag/module, native platform feature, official docs via Context7, package registry, issue tracker) and ends with a hard rule: if no native path exists, output the evidence you checked, never a silent script fallback.

Open and merge a develop-to-main promotion PR on a git-flow repo. Merge commit only, never squash or rebase — main accepts merge commits only. Every merge to main triggers release-please, which takes over tagging and release notes from there. Refuses on trunk repos (default branch main) — use /squash-merge-pr instead.

Squash-merge a PR into its base branch. Invoke only when the user explicitly requests a squash merge. Single PR by number or current branch. Refuses on git-flow repos when the base is main — use /promote-release there instead.

Use when the session runs a premium top-tier/SOTA model (any vendor, current or future — the session's model IS the premium lead). Keeps premium reasoning on judgment (intent, architecture, tradeoffs, final review) and delegates checkable labor to cheaper agents or local/free LLMs.

Use when managing branches, resolving merge conflicts, syncing with the default branch, or working with worktrees. Covers both trunk repos (main) and git-flow repos (develop) — see gh-cli-patterns (github-workflows) for default-branch detection.

Use when powering on a sleeping DR node, converging DNS records for a new ingress vhost, or bringing up OpenBao/Terrakube JWT identity — homelab operational runbooks for power management, DNS, and secrets-engine bring-up.

Use when adding or editing .pre-commit-config.yaml, wiring pre-commit hooks into a repo, scaffolding a new repo's lint/hook setup, or deciding where a hook or shared lint config should live. Covers the canonical nix-devenv/dryvist-.github architecture, profiles, and consumer patterns.

Master orchestrator for cross-repo infrastructure with dependency graph dispatch

End-to-end infrastructure pipeline validation across Terraform and Ansible repos

Update the repo's default branch from remote and merge it into the current branch, or all open PR branches. Despite the name (kept for continuity), this syncs whatever the repo's default branch actually is — main on trunk repos, develop on git-flow repos — and on git-flow repos also fast-forwards local main from origin/main.

Diagnose and recover from git rebase failures

Troubleshoot git worktree, branch, and refname issues

Local rebase-merge workflow for pull requests with signed commits, pushed directly to the PR's base branch. Refuses on git-flow repos when the base is main — direct pushes to main are banned there; use /promote-release.

Check PR merge readiness, sync local repo, cleanup stale worktrees; optional cross-repo sweep and stale-branch prune modes

Use when looking up available tools, skills, commands, agents, or plugins

Use when authoring or editing skills, agents, rules, or CLAUDE.md/AGENTS.md — token budgets, progressive disclosure, the self-contained-skill rule, the safety-reminder carve-out, and where each component belongs

Use when setting up or managing multi-repo workspaces

Autonomous maintenance orchestrator that continuously finds and dispatches work

Route a task to the right model — a native Claude subagent, Codex, or local MLX — based on task type

DEPRECATED — permissions moved to nix-claude-code; edit data/permissions/*.nix there instead of this repo's JSON

DEPRECATED — permission sync is retired; permissions now live in nix-claude-code and are governed by the auto-mode classifier

Use when writing or reviewing code and documentation

Troubleshoot pre-commit hook failures and auto-fixes

Use when installing or choosing CLI tools in a Nix flake repo, editing flake.nix or home-manager config, or when tempted to pip/pipx/uv/brew/npm install anything. Tools come from the dev shell or nix shell — never ad-hoc package managers.

Use when editing Proxmox/Terraform/Ansible inventory — VMID/IP assignment ranges and the Terraform-to-Ansible inventory contract.

Permission requirements for GitHub Actions