feat: Claude Code marketplace plugin + binary-only installer (#11)

* feat: distribute skills as a Claude Code marketplace plugin

- Add .claude-plugin/plugin.json (plugin `upkeep`, v0.2.0)
- Add .claude-plugin/marketplace.json (marketplace `llbbl-upkeep`)
- Rename skills/upkeep-audit → skills/audit, skills/upkeep-deps → skills/deps,
  skills/upkeep-quality → skills/quality
- Update SKILL.md frontmatter name: to audit/deps/quality
- Update doc titles and cross-references to /upkeep:audit, /upkeep:deps,
  /upkeep:quality for clean plugin-namespaced invocation

Closes #9

* fix: install.sh downloads versioned tarballs and is binary-only

- Resolve "latest" via GitHub API to get the concrete tag before building
  the download URL (fixes broken download introduced in #7 where assets
  moved from raw upkeep-<platform> names to versioned tarballs)
- Download upkeep_<version>_<os>_<arch>.tar.gz and extract the binary
  (Windows still gets a raw .exe)
- Fix amd64 arch token: was emitting x64, now correctly emits amd64
- Remove skill-copying logic (install_skills, SKILLS_DIR, bin/ symlinks) —
  skills are now distributed via the plugin marketplace
- Rename download_binary → download_file; remove get_download_url in favor
  of resolve_version
- Update tests to match new contract: resolve_version, download_file,
  amd64 tokens, binary-only / marketplace-pointer assertions

* chore: sync plugin.json version and skill paths in justfile/workflow

- Update set-version, update-all-versions, show-versions, and commit-version
  targets to use the new skills/deps, skills/audit, skills/quality paths
- Wire .claude-plugin/plugin.json into version bump targets so plugin
  version stays in sync with package.json
- Update auto-release.yml git add step to include .claude-plugin/plugin.json
  in the release commit

* docs: document Homebrew + marketplace install

- Add Homebrew as the primary recommended installation method
- Document two-part install: CLI binary (Homebrew/script) + skills (marketplace)
- Update manual install asset table to versioned tarballs with checksums note
- Update skill invocation names to /upkeep:audit, /upkeep:deps, /upkeep:quality
- Add /plugin marketplace add + /plugin install instructions for skills
- Update project structure tree to reflect renamed skills dirs and
  new .claude-plugin/ directory

Author: llbbl

.claude-plugin/marketplace.json

@@ -0,0 +1,18 @@
+{
+  "name": "llbbl-upkeep",
+  "owner": {
+    "name": "Logan Lindquist Land",
+    "email": "logan.lindquist@gmail.com"
+  },
+  "metadata": {
+    "description": "Marketplace for the upkeep Claude Code plugin",
+    "version": "0.2.0"
+  },
+  "plugins": [
+    {
+      "name": "upkeep",
+      "source": "./",
+      "description": "Security audits, dependency upgrades, and quality scoring for JS/TS repos. Bundles the /upkeep:audit, /upkeep:deps, and /upkeep:quality skills."
+    }
+  ]
+}

.claude-plugin/plugin.json

@@ -0,0 +1,13 @@
+{
+  "name": "upkeep",
+  "description": "AI-powered maintenance workflows for JS/TS repos: security audits, dependency upgrades, and quality scoring. Requires the `upkeep` CLI on PATH (brew install llbbl/tap/upkeep).",
+  "version": "0.2.0",
+  "author": {
+    "name": "Logan Lindquist Land",
+    "email": "logan.lindquist@gmail.com"
+  },
+  "homepage": "https://github.com/llbbl/upkeep",
+  "repository": "https://github.com/llbbl/upkeep",
+  "license": "MIT",
+  "keywords": ["maintenance", "security", "dependencies", "audit", "quality", "typescript"]
+}

.github/workflows/auto-release.yml

@@ -74,7 +74,7 @@ jobs:
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add package.json src/cli/index.ts skills/*/SKILL.md
+          git add package.json src/cli/index.ts skills/*/SKILL.md .claude-plugin/plugin.json
           git commit -m "chore(release): bump version to v$VERSION"
           git tag -a "$TAG" -m "Release $TAG"
           git push origin main --follow-tags

README.md

@@ -12,34 +12,44 @@ A comprehensive maintenance toolkit for JavaScript and TypeScript repositories,
 - **Risk Assessment** - Evaluate upgrade risk before making changes
 - **Dependabot Integration** - Manage Dependabot PRs from the command line
 
+upkeep has two parts that install independently:
+
+- **The `upkeep` CLI binary** — via Homebrew or the install script (below).
+- **The Claude Code skills** — via the [plugin marketplace](#claude-code-skills) (`/plugin install upkeep@llbbl-upkeep`).
+
 ## Installation
 
-### Quick Install (Recommended)
+### Homebrew (Recommended)
+
+```bash
+brew install llbbl/tap/upkeep
+```
+
+### Install Script
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/llbbl/upkeep/main/scripts/install.sh | bash
 ```
 
-This installs:
-- The `upkeep` CLI binary to `~/.local/bin/` (or `~/.upkeep/bin/` if that doesn't exist)
-- Claude Code skills to `~/.claude/skills/` for AI-powered workflows
+This installs the `upkeep` CLI binary to `~/.local/bin/` (or `~/.upkeep/bin/` if that doesn't exist). It no longer installs the skills — those come from the plugin marketplace (see [Claude Code Skills](#claude-code-skills)).
 
 To install a specific version:
 
 ```bash
-UPKEEP_VERSION=v0.1.3 curl -fsSL https://raw.githubusercontent.com/llbbl/upkeep/main/scripts/install.sh | bash
+UPKEEP_VERSION=v0.2.0 curl -fsSL https://raw.githubusercontent.com/llbbl/upkeep/main/scripts/install.sh | bash
 ```
 
 ### Manual Installation
 
-Download the appropriate binary from [releases](https://github.com/llbbl/upkeep/releases):
+Download the appropriate archive from [releases](https://github.com/llbbl/upkeep/releases) and extract the `upkeep` binary (verify against `checksums.txt`):
 
-| Platform | Binary |
-|----------|--------|
-| Linux x64 | `upkeep-linux-x64` |
-| macOS ARM64 (Apple Silicon) | `upkeep-darwin-arm64` |
-| macOS x64 (Intel) | `upkeep-darwin-x64` |
-| Windows x64 | `upkeep-windows-x64.exe` |
+| Platform | Asset |
+|----------|-------|
+| Linux x64 | `upkeep_<version>_linux_amd64.tar.gz` |
+| Linux ARM64 | `upkeep_<version>_linux_arm64.tar.gz` |
+| macOS ARM64 (Apple Silicon) | `upkeep_<version>_darwin_arm64.tar.gz` |
+| macOS x64 (Intel) | `upkeep_<version>_darwin_amd64.tar.gz` |
+| Windows x64 | `upkeep_<version>_windows_amd64.exe` |
 
 ### From Source
 
@@ -122,23 +132,30 @@ upkeep --log-level=debug audit
 
 ## Claude Code Skills
 
-upkeep includes skills for Claude Code that provide AI-powered maintenance workflows. Each skill has access to the upkeep binary:
+upkeep ships its Claude Code skills as a plugin distributed through its own marketplace. Install them with:
+
+```text
+/plugin marketplace add llbbl/upkeep
+/plugin install upkeep@llbbl-upkeep
+```
 
-### `/upkeep-deps`
+This installs all three skills, namespaced under the `upkeep` plugin. The skills shell out to the `upkeep` CLI, so make sure the binary is installed and on your `PATH` first (see [Installation](#installation)).
+
+### `/upkeep:deps`
 
 Upgrade dependencies with intelligent risk assessment:
 - Prioritizes Dependabot PRs and security fixes
 - Assesses risk before each upgrade
 - Runs tests and rolls back on failure
 
-### `/upkeep-audit`
+### `/upkeep:audit`
 
 Security audit with fix recommendations:
 - Explains each vulnerability
 - Shows dependency paths
 - Guides through safe fixes
 
-### `/upkeep-quality`
+### `/upkeep:quality`
 
 Improve project health:
 - Explains quality metrics
@@ -203,9 +220,13 @@ src/
     └── logger.ts             # Pino logging
 
 skills/
-├── upkeep-deps/              # Dependency upgrade skill
-├── upkeep-audit/             # Security audit skill
-└── upkeep-quality/           # Quality improvement skill
+├── deps/                     # Dependency upgrade skill (/upkeep:deps)
+├── audit/                    # Security audit skill (/upkeep:audit)
+└── quality/                  # Quality improvement skill (/upkeep:quality)
+
+.claude-plugin/
+├── plugin.json              # Plugin manifest (the `upkeep` plugin)
+└── marketplace.json         # Marketplace manifest (`llbbl-upkeep`)
 
 tests/
 ├── cli/                      # CLI integration tests

justfile

@@ -69,14 +69,15 @@ bump-version bump:
 update-all-versions:
   @VERSION=$(jq -r '.version' package.json); \
   sed -i '' 's/const VERSION = "[^"]*";/const VERSION = "'"$VERSION"'";/' src/cli/index.ts; \
-  sed -i '' 's/^version: .*/version: '"$VERSION"'/' skills/upkeep-deps/SKILL.md; \
-  sed -i '' 's/^version: .*/version: '"$VERSION"'/' skills/upkeep-audit/SKILL.md; \
-  sed -i '' 's/^version: .*/version: '"$VERSION"'/' skills/upkeep-quality/SKILL.md; \
+  sed -i '' 's/^version: .*/version: '"$VERSION"'/' skills/deps/SKILL.md; \
+  sed -i '' 's/^version: .*/version: '"$VERSION"'/' skills/audit/SKILL.md; \
+  sed -i '' 's/^version: .*/version: '"$VERSION"'/' skills/quality/SKILL.md; \
+  jq --arg v "$VERSION" '.version = $v' .claude-plugin/plugin.json > .claude-plugin/plugin.json.tmp && mv .claude-plugin/plugin.json.tmp .claude-plugin/plugin.json; \
   echo "Updated versions to $VERSION"
 
 commit-version:
   @VERSION=$(jq -r '.version' package.json); \
-  git add package.json src/cli/index.ts skills/*/SKILL.md; \
+  git add package.json src/cli/index.ts skills/*/SKILL.md .claude-plugin/plugin.json; \
   git commit -m "chore: bump version to v$VERSION"; \
   git tag v$VERSION; \
   echo "Created tag v$VERSION"; \
@@ -86,9 +87,10 @@ set-version version:
   jq --arg v "{{version}}" '.version = $v' package.json > package.json.tmp && mv package.json.tmp package.json
   @VERSION="{{version}}"; \
   sed -i 's/const VERSION = "[^"]*";/const VERSION = "'"$VERSION"'";/' src/cli/index.ts; \
-  sed -i 's/^version: .*/version: '"$VERSION"'/' skills/upkeep-deps/SKILL.md; \
-  sed -i 's/^version: .*/version: '"$VERSION"'/' skills/upkeep-audit/SKILL.md; \
-  sed -i 's/^version: .*/version: '"$VERSION"'/' skills/upkeep-quality/SKILL.md; \
+  sed -i 's/^version: .*/version: '"$VERSION"'/' skills/deps/SKILL.md; \
+  sed -i 's/^version: .*/version: '"$VERSION"'/' skills/audit/SKILL.md; \
+  sed -i 's/^version: .*/version: '"$VERSION"'/' skills/quality/SKILL.md; \
+  jq --arg v "$VERSION" '.version = $v' .claude-plugin/plugin.json > .claude-plugin/plugin.json.tmp && mv .claude-plugin/plugin.json.tmp .claude-plugin/plugin.json; \
   echo "Set all versions to $VERSION"
 
 version-sync:
@@ -98,6 +100,7 @@ show-versions:
   echo "=== Current Versions ==="
   echo "package.json:           $(jq -r '.version' package.json)"
   echo "src/cli/index.ts:       $(grep 'const VERSION' src/cli/index.ts | sed 's/.*"\(.*\)".*/\1/')"
-  echo "upkeep-deps/SKILL.md:   $(grep '^version:' skills/upkeep-deps/SKILL.md | sed 's/version: //')"
-  echo "upkeep-audit/SKILL.md:  $(grep '^version:' skills/upkeep-audit/SKILL.md | sed 's/version: //')"
-  echo "upkeep-quality/SKILL.md: $(grep '^version:' skills/upkeep-quality/SKILL.md | sed 's/version: //')"
+  echo "skills/deps/SKILL.md:    $(grep '^version:' skills/deps/SKILL.md | sed 's/version: //')"
+  echo "skills/audit/SKILL.md:   $(grep '^version:' skills/audit/SKILL.md | sed 's/version: //')"
+  echo "skills/quality/SKILL.md: $(grep '^version:' skills/quality/SKILL.md | sed 's/version: //')"
+  echo ".claude-plugin/plugin.json: $(jq -r '.version' .claude-plugin/plugin.json)"