diff --git a/CLAUDE.md b/CLAUDE.md index 9bb187f..fd9ce3c 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -45,6 +45,13 @@ To exercise the plugin skills locally: `/plugin marketplace add sentfutures/devops` then `/plugin install review-bot@sentfutures`. +`plugins/review-bot/.claude-plugin/plugin.json` deliberately has no +`version`, so installs track this repo's commits. Claude Code updates a +plugin only when its computed version changes. The `"1.0.0"` pinned on +2026-08-20 kept every install on the August skills through four changes to +`install-review-bot` (09-10 to 09-30). Don't add a `version` back unless every +plugin change bumps it. + ## How the review bot works (claude-pr-review.yml) One job, `claude-review`: a job-level gate, then steps that hand state to diff --git a/README.md b/README.md index 021db83..6760c1c 100644 --- a/README.md +++ b/README.md @@ -52,13 +52,21 @@ this PR`). ### The fast path — one skill -One-time, on your own machine: +If you sign in to Claude Code with the Sentient Futures Claude organization, +the plugin may already be installed: run `/plugin` and look for +`review-bot@sentfutures` under **Installed**. See [Making the plugin +available to every member](#making-the-plugin-available-to-every-member). +Otherwise, one-time, on your own machine: ``` /plugin marketplace add sentfutures/devops /plugin install review-bot@sentfutures ``` +A marketplace added by hand doesn't update itself. Turn auto-update on under +`/plugin` → **Marketplaces** → `sentfutures` → **Enable auto-update**, or run +`/plugin marketplace update sentfutures` now and then. + Then, inside any repo you want the bot on, run **`/install-review-bot`** and answer its questions (mainly: which maintainers to page when the bot can't decide). It discovers the repo's CI check name, creates the @@ -67,6 +75,11 @@ decide). It discovers the repo's CI check name, creates the merge. The same plugin ships **`/disable-review-bot`** — the emergency stop (see "Disabling the bot" below). +The `/` menu lists both skills under the plugin's name, as +`/review-bot:install-review-bot` and `/review-bot:disable-review-bot`. +Typing `/install-review-bot` also works. Neither appears until the plugin is +installed: opening this repo doesn't load them. + This works outside sentfutures too — on a personal repo or another org. This repo is public, so the `uses:` reference resolves from any owner; what does not come for free is the app-and-secret pair the org-wide setup provides, so @@ -87,6 +100,59 @@ also the sole PR author the workflow drops them and nobody is paged — the `escalate_to` with their login anyway; it starts working the moment a second person opens a PR. +### Making the plugin available to every member + +This is a one-time step for an Owner or Primary Owner of the Sentient Futures +Claude organization on claude.ai. Without it, members only find the plugin if +someone tells them: on 2026-10-09 this README was the only place it was +mentioned, and it had 4 unique visitors in the previous 14 days. + +1. Open claude.ai → **Organization settings → Claude Code → Managed + settings** (). +2. Add these two keys to the JSON there. If the editor already has settings, + merge the keys in; don't replace what's there. + + ```json + { + "extraKnownMarketplaces": { + "sentfutures": { + "source": { "source": "github", "repo": "sentfutures/devops" }, + "autoUpdate": true + } + }, + "enabledPlugins": { + "review-bot@sentfutures": true + } + } + ``` +3. Save. + +Each member gets the plugin at their next Claude Code start, or within an hour +in a running session: Claude Code registers the `sentfutures` marketplace, +installs `review-bot` with its `/install-review-bot` and `/disable-review-bot` +skills, and keeps it updated. Members see no approval dialog, because plugin +keys aren't among the settings that need one. To check on a machine, run +`/plugin` and look for `review-bot@sentfutures`, or check that `claude +doctor`'s `Managed settings (remote)` line says the settings loaded. + +What to know before saving: + +- **It applies to everyone in the organization.** A member can't turn off a + plugin enabled this way. This plugin is two skills that run only when + someone invokes them: no hooks, MCP servers or background processes. +- **It reaches only sessions authenticated through the organization.** That + means members signed in with it, and any `CLAUDE_CODE_OAUTH_TOKEN` it + issued. If the review bot's shared account belongs to the organization, its + CI runs get these settings too, as they would any managed setting. +- **Don't add `strictKnownMarketplaces` alongside.** An allowlist blocks + every marketplace it doesn't name. +- **claude.ai's Organization settings → Plugins & skills sync won't work + here.** It requires the marketplace repository to be private or internal, + and this repo must stay public. + +Docs: code.claude.com/docs/en/plugins/org and +code.claude.com/docs/en/server-managed-settings. + ### The manual path 1. **Label** — create `needs-human-review` in the repo (Issues → Labels). A diff --git a/plugins/review-bot/.claude-plugin/plugin.json b/plugins/review-bot/.claude-plugin/plugin.json index 2df52b0..50a0d65 100644 --- a/plugins/review-bot/.claude-plugin/plugin.json +++ b/plugins/review-bot/.claude-plugin/plugin.json @@ -1,7 +1,6 @@ { "name": "review-bot", "description": "Install and operate the sentfutures Claude PR review bot: /install-review-bot onboards the current repo, /disable-review-bot pauses it when something goes wrong.", - "version": "1.0.0", "author": { "name": "Sentient Futures", "url": "https://sentientfutures.ai"