shed-dependencies-and-toolchain

Validates Flutter dependency pins and toolchain versions against a decision record before pubspec changes.

Updated Jul 27, 2026
One-click install
npx skills add https://github.com/zakariaf/Shed-Book --skill shed-dependencies-and-toolchain-zakariaf
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: shed-dependencies-and-toolchain
Source: https://github.com/zakariaf/Shed-Book/tree/main/.claude/skills/shed-dependencies-and-toolchain
Command: npx skills add https://github.com/zakariaf/Shed-Book --skill shed-dependencies-and-toolchain-zakariaf

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? In this offline-first Flutter project, every dependency version must match a single decision record exactly, and unreviewed packages, caret ranges, or gate-silencing edits can break the build or void the app's no-network guarantee. This Skill enforces that discipline before any pubspec.yaml, analysis_options.yaml, or Makefile change. ## Core Features & Use Cases - Dependency admission control: Checks proposals against the decision record's accepted and rejected package tables, requiring audit of publisher, transitive graph, and merged Android permissions before any pin is added. - Pin enforcement: Guards non-negotiable pins such as Flutter 3.44.8 via FVM, flutter_riverpod 2.6.1 exact, build_runner >=2.15.0 <2.15.2, and intl any, and bans flutter pub add. - Gate ownership (G2/G3): Operates the lockfile allowlist gate and the import-level source scan, with a reference file explaining every rule id, the real fix, and the forbidden fix. - Use Case: Before adding a charting package, consult the rejection table, find fl_chart is rejected in favor of a hand-rolled CustomPainter, and apply that alternative instead of re-litigating. ## Quick Start Ask the assistant to review a proposed new Flutter package against the decision record and update pubspec.yaml and the policy allowlist correctly.

Frequently Asked Questions about shed-dependencies-and-toolchain

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add a new dependency to a pinned Flutter project?▼

First check the decision record's rejection table; if not rejected, audit the publisher, transitive graph, and merged Android permissions, record the verified version in the decision record, then hand-type the exact pin in pubspec.yaml and add an allowlist line. Never run flutter pub add, since it writes caret ranges and resolves to latest.

Why does flutter pub get fail after adding freezed or riverpod_generator?▼

The Flutter SDK pins meta exactly, so no Flutter app on this stack can resolve analyzer versions those packages require. They are unresolvable rather than merely unwanted, producing a solver failure instead of a lint.

Can I silence a failing policy gate by editing the allowlist?▼

No. Editing tool/check_policy.dart, its rule table, or adding lines to tool/policy_allowlist.txt or android/expected_permissions.txt to green a build is explicitly forbidden. A red gate is a finding; if the gate is genuinely wrong, stop and say so.

Why does a Flutter build fail offline on a fresh clone?▼

package:sqlite3 downloads a sha256-verified prebuilt binary via a Dart build hook at test and build time, so a cold pub cache in plane mode fails. This is expected and documented; the shipped app itself contains no network code.

What is the difference between the G2 and G3 dependency gates?▼

G2 checks pubspec.lock entries against three allowlist sections so no package enters the graph unreviewed. G3 scans source for banned package URIs and network APIs like HttpClient, Socket, and Image.network, proving the app's own code cannot reach a network.