zed

zed

Personal Claude Code plugin with custom skills for Dependabot maintenance, system-wide cross-project maintenance, cross-session context handoff, and other repository automation.

Prerequisites

• Claude Code CLI
• GitHub CLI (gh) — authenticated with access to the target repository
• Dependabot enabled on the target repository (for alerts and/or security updates)
• For the maintenance skill's observability app: python3 and sqlite3 (both ubiquitous on macOS/Linux; the web app uses only the Python 3 standard library, no pip installs)

Installation

Per-session (local checkout)

Clone the repo and load the plugin for your current session:

git clone https://github.com/zostay/zed.git
claude --plugin-dir ./zed

Persistent install via marketplace

Add this repo as a marketplace, then install the plugin:

claude plugin marketplace add https://github.com/zostay/zed
claude plugin install zed

Skills

All skills are invoked as /zed:<skill-name> from within Claude Code.

dependabot-sweep

Run a full Dependabot maintenance sweep in a single pass. This orchestrates the work of the other three skills:

1. Requests rebases for all conflicting Dependabot PRs
2. Merges all ready-to-merge Dependabot PRs
3. Fixes up to 10 vulnerability alerts (highest severity first), creating a branch with one commit per package
4. Updates the project changelog (if one exists)
5. Pushes the branch and opens a PR with a summary of all actions

/zed:dependabot-sweep

maintenance

Run a maintenance task across all your configured projects in one pass. This skill is an orchestrator: it discovers every project that opts in by defining a maintenance-<tag> skill, dispatches a subagent per project to run that skill, and records the whole sweep to a local SQLite database that a small web app renders live so you can watch progress and results across all your repositories at a glance.

/zed:maintenance <tag> [--now] [--fast] [--headless]

• <tag> (required) — discover and run the maintenance-<tag> skill in each participating project (e.g. /zed:maintenance dependabot runs each project's maintenance-dependabot skill).
• --now — explicitly select the methodical, serial execution path. Claude Code has no user-facing batch primitive for subagents, so the default is the serial path; --now states that intent explicitly.
• --fast — dispatch the per-project subagents in parallel (faster, more tokens).
• --headless — do not start or open the observability web app.

Configuration. Search roots and a blocklist live in a config.json managed by scripts/maintenance-config.sh (defaults to { "searchRoots": ["~/projects"], "blocklist": [] }). Add a search root with maintenance-config.sh add-root <path> and exclude a project with maintenance-config.sh add-block <path-or-name>.

Ordering. A project's maintenance-<tag> skill can set an integer priority in its front matter to control where it runs: lower runs earlier, higher later, default 0, ties broken by path. On the serial path projects run in strict order; with --fast they run in priority groups (each group concurrent, groups in order). Use a negative priority for a project that needs up-front interaction (runs first) and a positive one for a project that redeploys centrally-shared apps (runs last).

Authorization. A project that does something privileged (e.g. a production deployment) sets requiresAuthorization: true in its maintenance-<tag> front matter. When the sweep reaches the execute stage it asks you once, up front, to confirm those projects (default: authorize all) and then creates the grants for you — so a typed /zed:maintenance weekly needs just one answer and the deploys run. Decline a project and it is skipped. For unattended runs (a scheduled sweep with no one to ask), authorize ahead of time instead:

"${CLAUDE_PLUGIN_ROOT}/scripts/maintenance-authorize.sh" \
  grant --tag weekly --project qubling.cloud --repeat --ttl 8h   # reusable until it expires

The orchestrator checks for a valid grant before dispatching such a project (no grant → skipped; valid grant → runs, then the grant is consumed if it is one-time — a --repeat grant persists until it expires). A PreToolUse hook (hooks/maintenance-authz.sh) returns an allow decision for a granted project so the privileged command runs without the auto-accept classifier prompting or denying it, and stays silent (never denies) otherwise. Manage grants with maintenance-authorize.sh list / revoke / consume. Grants live under <data-dir>/grants/.