ca-add-dep

# $ca-add-dep — dependency review Gate a new or changed third-party dependency through review before it lands. When you route through this command, the orchestrator runs no install until the `dependency-reviewer` agent clears the package. Specify the exact version if you have one; without one, the reviewer evaluates the latest available version. ## Routes to The `dependency-reviewer` agent (`${CLAUDE_PLUGIN_ROOT}/agents/dependency-reviewer.md`). The agent reads `<project-root>/.codearbiter/security-controls.md` (allowed/denied licenses, provenance and supply-chain policy) and `<project-root>/.codearbiter/tech-stack.md` (stack fit, dependency manager) to judge the package. After the agent clears it, the orchestrator surfaces the install command for confirmation. The lock file change is committed alongside the manifest change — never one without the other. ## When NOT to use - Removing a dependency → `$ca-fix` or `$ca-feature` with the change described. - Updating an existing dependency as part of a code change → `$ca-feature` / `$ca-fix`; manifest changes route to review at `$ca-pr`. - Asking about a package without installing it → `$ca-btw`. ## Ephemeral tool run — one invocation, nothing adopted A one-time developer tool is not a dependency, and reviewing it as one is what issue #346 records going wrong: a duplicate-code investigation was interrupted and pushed toward project-dependency review for `jscpd`, which the operator had explicitly said must never be listed...