@stylusnexus/work-plan 2026.6.9 → 2026.6.10-2

package/skills/work-plan/commands/move.py

@@ -0,0 +1,131 @@
+"""move subcommand — source-first issue relocation between tracks."""
+import json
+
+from lib.config import load_config, ConfigError
+from lib.tracks import discover_tracks, find_track_by_name, parse_track_repo_arg, AmbiguousTrackError
+from lib.frontmatter import write_file
+from lib.write_guard import needs_confirm, make_token, valid_token
+from lib.prompts import parse_flags
+
+
+def run(args: list[str]) -> int:
+    """move <issue-num> <from-track> <to-track> [--confirm=<token>] [--repo=<key>]
+
+    Removes <issue-num> from <from-track>'s frontmatter and adds it to
+    <to-track>'s frontmatter.  Both tracks must be active and in the same
+    repo.  Public-repo writes gate behind --confirm (same flow as slot/set).
+    """
+    flags, positional = parse_flags(args, {"--confirm", "--repo"})
+    if len(positional) < 3:
+        print("usage: work_plan.py move <issue-num> <from-track> <to-track> [--confirm=<token>] [--repo=<key>]")
+        return 2
+
+    try:
+        issue_num = int(positional[0])
+    except ValueError:
+        print(f"ERROR: '{positional[0]}' is not an issue number.")
+        return 2
+
+    from_arg, to_arg = positional[1], positional[2]
+    repo_flag = flags.get("--repo") if flags.get("--repo") is not True else None
+
+    # Resolve from-track
+    from_name = from_arg
+    repo_qualifier = repo_flag
+    name_from, repo_from = parse_track_repo_arg(from_arg)
+    if name_from:
+        from_name = name_from
+    if repo_from:
+        repo_qualifier = repo_from
+
+    # Resolve to-track (may override repo qualifier)
+    to_name = to_arg
+    name_to, repo_to = parse_track_repo_arg(to_arg)
+    if name_to:
+        to_name = name_to
+    if repo_to:
+        repo_qualifier = repo_to
+
+    try:
+        cfg = load_config()
+    except ConfigError as e:
+        print(f"ERROR: {e}")
+        return 1
+
+    tracks = discover_tracks(cfg)
+
+    # Find both tracks (active only)
+    try:
+        src = find_track_by_name(from_name, tracks, active_only=True, repo=repo_qualifier)
+    except AmbiguousTrackError as e:
+        print(str(e))
+        return 1
+
+    if not src:
+        print(f"No active track matching '{from_name}'.")
+        return 1
+
+    try:
+        dst = find_track_by_name(to_name, tracks, active_only=True, repo=repo_qualifier)
+    except AmbiguousTrackError as e:
+        print(str(e))
+        return 1
+
+    if not dst:
+        print(f"No active track matching '{to_name}'.")
+        return 1
+
+    # Same-repo guard
+    if src.repo != dst.repo:
+        print(f"ERROR: cross-repo moves not supported ({src.repo} ≠ {dst.repo}).")
+        return 1
+
+    # Same-track no-op
+    if src.name == dst.name:
+        print(f"#{issue_num} already in track '{src.name}'.")
+        return 0
+
+    # Validate issue is in source
+    src_issues = list(src.meta.get("github", {}).get("issues") or [])
+    if issue_num not in src_issues:
+        print(f"ERROR: #{issue_num} is not in track '{src.name}'.")
+        return 1
+
+    # Check if already in destination
+    dst_issues = list(dst.meta.get("github", {}).get("issues") or [])
+    if issue_num in dst_issues:
+        print(f"#{issue_num} already in track '{dst.name}'. Removing from '{src.name}' only.")
+        # Still remove from source even if already in dest
+        src_issues.remove(issue_num)
+        src.meta.setdefault("github", {})["issues"] = src_issues
+        write_file(src.path, src.meta, src.body)
+        print(f"  ✓ Removed #{issue_num} from '{src.name}'.")
+        return 0
+
+    # Public-repo confirm gate (on the destination write)
+    confirm = flags.get("--confirm")
+    if dst.repo and needs_confirm(dst.repo, cfg) and not (
+        isinstance(confirm, str) and valid_token(confirm, dst.repo, dst.name)
+    ):
+        print(json.dumps({
+            "needs_confirm": True,
+            "reason": (
+                f"{dst.repo} is PUBLIC (or visibility unknown); "
+                f"moving #{issue_num} will be written there."
+            ),
+            "token": make_token(dst.repo, dst.name),
+        }))
+        return 0
+
+    # Execute: remove from source, add to destination
+    src_issues.remove(issue_num)
+    src.meta.setdefault("github", {})["issues"] = src_issues
+    write_file(src.path, src.meta, src.body)
+    print(f"  ✓ Removed #{issue_num} from '{src.name}'.")
+
+    dst_issues.append(issue_num)
+    dst.meta.setdefault("github", {})["issues"] = sorted(dst_issues)
+    write_file(dst.path, dst.meta, dst.body)
+    print(f"  ✓ Added #{issue_num} to '{dst.name}'.")
+
+    return 0

package/skills/work-plan/commands/new_track.py

@@ -1,19 +1,22 @@
 """new-track subcommand — one-shot non-interactive track creation.
 
-Creates a brand-new <slug>.md under notes_root/<folder>/ with frontmatter
-written from flags. Designed for headless callers (e.g. the VS Code extension)
-that cannot run interactive init + do not know notes_root upfront.
+Creates a brand-new <slug>.md under notes_root/<folder>/ (private tier) or
+<local>/.work-plan/ (shared tier) with frontmatter written from flags.
+Designed for headless callers (e.g. the VS Code extension) that cannot run
+interactive init + do not know notes_root upfront.
 
 Usage:
   new-track <repo> <slug> [--priority=P0..P3] [--milestone=<m>]
-                          [--private] [--confirm=<token>]
+                          [--private] [--commit] [--confirm=<token>]
 """
 import json
 import re
+import subprocess
 from datetime import datetime
 from pathlib import Path
+from typing import Optional
 
-from lib.config import load_config, ConfigError
+from lib.config import load_config, ConfigError, is_valid_git_repo
 from lib.frontmatter import write_file
 from lib.prompts import parse_flags
 from lib.write_guard import needs_confirm, make_token, valid_token
@@ -22,16 +25,63 @@ _VALID_PRIORITIES = {"P0", "P1", "P2", "P3"}
 _SLUG_RE = re.compile(r"^[a-z][a-z0-9-]*$")
 
 
+def _git_commit_track(track_file: Path, slug: str) -> None:
+    """Stage and commit a single shared track file (path-scoped, no git add .)."""
+    # The clone root is .work-plan/'s parent
+    clone_root = track_file.parent.parent
+    if not is_valid_git_repo(clone_root):
+        print(f"⚠ --commit ignored: track is private (not in a git repo)")
+        return
+
+    # Determine current branch name for the success message
+    branch = "HEAD"
+    try:
+        result = subprocess.run(
+            ["git", "-C", str(clone_root), "rev-parse", "--abbrev-ref", "HEAD"],
+            capture_output=True, text=True, check=False,
+        )
+        if result.returncode == 0:
+            branch = result.stdout.strip()
+    except OSError:
+        pass
+
+    # Stage ONLY this file (never git add .)
+    try:
+        subprocess.run(
+            ["git", "-C", str(clone_root), "add", str(track_file)],
+            capture_output=True, text=True, check=True,
+        )
+    except (subprocess.CalledProcessError, OSError) as e:
+        msg = getattr(e, "stderr", str(e))
+        print(f"⚠ --commit: git add failed ({msg.strip()!r}) — continuing without commit")
+        return
+
+    # Commit with a conventional message
+    commit_msg = f"chore: add shared track '{slug}'"
+    try:
+        subprocess.run(
+            ["git", "-C", str(clone_root), "commit", "-m", commit_msg],
+            capture_output=True, text=True, check=True,
+        )
+    except (subprocess.CalledProcessError, OSError) as e:
+        msg = getattr(e, "stderr", str(e))
+        print(f"⚠ --commit: git commit failed ({msg.strip()!r}) — continuing without commit")
+        return
+
+    print(f"✓ committed '{slug}' to {branch}")
+
+
 def run(args: list[str]) -> int:
     flags, positional = parse_flags(
-        args, {"--priority", "--milestone", "--private", "--confirm"}
+        args, {"--priority", "--milestone", "--private", "--confirm", "--commit"}
     )
 
     # Require exactly 2 positionals: repo and slug
     if len(positional) < 2:
         print(
             "usage: work_plan.py new-track <repo> <slug>"
-            " [--priority=P0..P3] [--milestone=<m>] [--private] [--confirm=<token>]"
+            " [--priority=P0..P3] [--milestone=<m>] [--private] [--commit]"
+            " [--confirm=<token>]"
         )
         return 2
 
@@ -53,6 +103,13 @@ def run(args: list[str]) -> int:
     elif "/" in repo_arg:
         github = repo_arg
         folder = repo_arg.rsplit("/", 1)[-1]
+        # Validate the derived folder segment (#195). `rsplit` caps traversal at
+        # one segment, but a slug like `x/..` yields folder=".." → the track
+        # would be written one level ABOVE notes_root. A real GitHub repo name
+        # matches [A-Za-z0-9._-]+ and is never "." / ".." — reject anything else.
+        if folder in ("", ".", "..") or not re.fullmatch(r"[A-Za-z0-9._-]+", folder):
+            print(f"ERROR: cannot derive a safe notes folder from '{repo_arg}'.")
+            return 2
     else:
         print(
             f"ERROR: unknown repo '{repo_arg}' — pass a configured key"
@@ -85,14 +142,30 @@ def run(args: list[str]) -> int:
     milestone = milestone_flag if isinstance(milestone_flag, str) else "v1.0.0"
 
     # ------------------------------------------------------------------
-    # Resolve target path
+    # Determine target path: shared (.work-plan/) or private (notes_root/)
+    # Shared route: repo is registered, has a local path, and it's a valid git repo.
+    # --private overrides to force the private (notes_root) route.
     # ------------------------------------------------------------------
-    notes_root = Path(cfg["notes_root"]).expanduser()
-    if not notes_root.exists():
-        print(f"ERROR: notes_root {notes_root} does not exist.")
-        return 1
+    use_private = "--private" in flags
+
+    shared_path: Optional[Path] = None
+    if not use_private and folder in cfg.get("repos", {}):
+        local_raw = cfg["repos"][folder].get("local")
+        if local_raw:
+            local_path = Path(local_raw).expanduser()
+            if is_valid_git_repo(local_path):
+                shared_path = local_path / ".work-plan" / f"{slug}.md"
 
-    path = notes_root / folder / f"{slug}.md"
+    notes_root = Path(cfg["notes_root"]).expanduser()
+    if shared_path is not None:
+        path = shared_path
+        is_shared = True
+    else:
+        if not notes_root.exists():
+            print(f"ERROR: notes_root {notes_root} does not exist.")
+            return 1
+        path = notes_root / folder / f"{slug}.md"
+        is_shared = False
 
     if path.exists():
         print(f"ERROR: track '{slug}' already exists at {path}")
@@ -115,13 +188,6 @@ def run(args: list[str]) -> int:
             }))
             return 0
 
-    # ------------------------------------------------------------------
-    # --private flag: accepted for forward-compat but is a no-op today.
-    # Every track is effectively private now; the two-tier shared/private
-    # model is unbuilt. We accept the flag so callers don't error out.
-    # ------------------------------------------------------------------
-    # (no branch on --private beyond parsing it)
-
     # ------------------------------------------------------------------
     # Create folder if missing, then write the track file
     # ------------------------------------------------------------------
@@ -134,15 +200,33 @@ def run(args: list[str]) -> int:
         "launch_priority": priority,
         "milestone_alignment": milestone,
         "github": {"repo": github, "issues": [], "branches": []},
-        "related_tracks": [],
+        "depends_on": [],
         "last_touched": now,
         "last_handoff": now,
         "next_up": [],
         "blockers": [],
     }
+    if is_shared:
+        meta["tier"] = "shared"
+
     body = f"# {slug}\n"
     write_file(path, meta, body)
 
-    rel = path.relative_to(notes_root)
-    print(f"✓ Created track '{slug}' for {github} at {rel}")
+    if is_shared:
+        print(f"✓ Created shared track '{slug}' for {github} at {path}")
+    else:
+        rel = path.relative_to(notes_root)
+        print(f"✓ Created track '{slug}' for {github} at {rel}")
+
+    # ------------------------------------------------------------------
+    # --commit: stage + commit the track file to the shared repo (non-fatal)
+    # Only meaningful for shared tracks; warn and skip for private.
+    # ------------------------------------------------------------------
+    want_commit = "--commit" in flags
+    if want_commit:
+        if is_shared:
+            _git_commit_track(path, slug)
+        else:
+            print("⚠ --commit ignored: track is private (not in a git repo)")
+
     return 0

package/skills/work-plan/commands/reconcile.py

@@ -12,8 +12,11 @@ For a given track:
     of "anything closed looks unlabeled."
   - Compare against frontmatter `github.issues`.
   - Propose ADDS (labeled in GitHub but missing from frontmatter).
-  - Propose FLAGS (in frontmatter but no longer labeled — possible move out).
-  - User confirms before writing to the LOCAL frontmatter file.
+  - Propose MOVES (in track A's frontmatter, but now labeled for exactly one
+    other active track B in the same repo — a relabel; remove from A, add to B).
+  - Propose FLAGS (in frontmatter but no longer labeled, with no single move
+    target — possible orphan).
+  - User confirms before writing to the LOCAL frontmatter file(s).
 
 READ-ONLY GITHUB CONTRACT
   reconcile only READS GitHub via `gh issue list` and `gh pr list`. It NEVER
@@ -26,11 +29,16 @@ Run with --all to reconcile every active track in one pass.
 """
 import json
 import subprocess
+from concurrent.futures import ThreadPoolExecutor
 
 from lib.config import load_config, ConfigError
-from lib.tracks import discover_tracks, find_track_by_name, filter_tracks_by_repo
+from lib.tracks import discover_tracks, find_track_by_name, filter_tracks_by_repo, parse_track_repo_arg, AmbiguousTrackError
 from lib.frontmatter import write_file
 from lib.prompts import parse_flags, prompt_input
+from lib.write_guard import needs_confirm
+
+
+PER_TRACK_TIMEOUT = 15  # seconds; each gh call gets this budget
 
 
 def _resolve_labels(track) -> list[str]:
@@ -59,13 +67,19 @@ def _fetch_labeled_issues(repo: str, labels: list[str]) -> list[dict]:
     seen: dict[int, dict] = {}
     for lab in labels:
         for kind in ("issue", "pr"):
-            proc = subprocess.run(
-                ["gh", kind, "list", "--repo", repo,
-                 "--label", lab,
-                 "--state", "all", "--limit", "200",
-                 "--json", "number,title,state"],
-                capture_output=True, text=True,
-            )
+            try:
+                proc = subprocess.run(
+                    ["gh", kind, "list", "--repo", repo,
+                     "--label", lab,
+                     "--state", "all", "--limit", "200",
+                     "--json", "number,title,state"],
+                    capture_output=True, text=True,
+                    timeout=PER_TRACK_TIMEOUT,
+                )
+            except subprocess.TimeoutExpired:
+                raise RuntimeError(
+                    f"gh {kind} query timed out for label '{lab}'"
+                )
             if proc.returncode != 0:
                 raise RuntimeError(
                     f"gh {kind} query failed for label '{lab}': {proc.stderr.strip()}"
@@ -76,19 +90,28 @@ def _fetch_labeled_issues(repo: str, labels: list[str]) -> list[dict]:
 
 
 def run(args: list[str]) -> int:
-    flags, positional = parse_flags(args, {"--all", "--draft", "--repo"})
+    flags, positional = parse_flags(args, {"--all", "--draft", "--repo", "--yes"})
     do_all = flags.get("--all", False)
     draft = flags.get("--draft", False)
+    yes = flags.get("--yes", False)
     repo_key = flags.get("--repo")
     if repo_key is True:
-        print("usage: work_plan.py reconcile <track-name> | --all | --repo=<key> [--draft]")
+        print("usage: work_plan.py reconcile <track-name> | --all | --repo=<key> [--draft] [--yes]")
         return 2
-    track_name = positional[0] if positional else None
+    track_arg = positional[0] if positional else None
 
-    if not do_all and not track_name and not repo_key:
-        print("usage: work_plan.py reconcile <track-name> | --all | --repo=<key> [--draft]")
+    if not do_all and not track_arg and not repo_key:
+        print("usage: work_plan.py reconcile <track-name> | --all | --repo=<key> [--draft] [--yes]")
         return 2
 
+    track_name = track_arg
+    repo_qualifier = repo_key
+    if track_arg:
+        name_from_arg, repo_from_arg = parse_track_repo_arg(track_arg)
+        track_name = name_from_arg
+        if repo_from_arg:
+            repo_qualifier = repo_from_arg
+
     try:
         cfg = load_config()
     except ConfigError as e:
@@ -99,7 +122,7 @@ def run(args: list[str]) -> int:
     active = [t for t in tracks if t.has_frontmatter
               and t.meta.get("status") in ("active", "in-progress", "blocked")]
 
-    if do_all or repo_key:
+    if do_all or (repo_key and not track_arg):
         targets = active
         if repo_key:
             targets = filter_tracks_by_repo(targets, repo_key)
@@ -107,32 +130,115 @@ def run(args: list[str]) -> int:
                 print(f"No active tracks for repo '{repo_key}'.")
                 return 0
     else:
-        target = find_track_by_name(track_name, tracks, active_only=True)
+        try:
+            target = find_track_by_name(track_name, tracks, active_only=True,
+                                        repo=repo_qualifier)
+        except AmbiguousTrackError as e:
+            print(str(e))
+            return 1
         if not target:
             print(f"No active track matching '{track_name}'.")
             return 1
         targets = [target]
 
+    # Phase 1: parallel fetch of labeled issues for all tracks
+    work_items = [(track, _resolve_labels(track)) for track in targets if track.repo]
+    results: dict = {}  # track.name → list[dict] or None (timeout/error)
+
+    total = len(work_items)
+    if total > 1:
+        # Parallel fetch when there are multiple tracks
+        with ThreadPoolExecutor(max_workers=4) as pool:
+            submitted: list = []
+            for i, (track, labels) in enumerate(work_items, 1):
+                print(f"  [{i}/{total}] fetching {track.repo} ({track.name})...", flush=True)
+                submitted.append((i, track, pool.submit(_fetch_labeled_issues, track.repo, labels)))
+            # Iterate in submit order for readable output; futures run in parallel
+            for i, track, future in submitted:
+                try:
+                    results[track.name] = future.result()
+                    print(f"  [{i}/{total}] ✓ {track.name}")
+                except RuntimeError as e:
+                    print(f"  [{i}/{total}] ⚠ {track.name}: {e} — skipping")
+                    results[track.name] = None
+    else:
+        # Single track: fetch directly (no thread overhead)
+        for i, (track, labels) in enumerate(work_items, 1):
+            print(f"  [{i}/{total}] fetching {track.repo} ({track.name})...", flush=True)
+            try:
+                results[track.name] = _fetch_labeled_issues(track.repo, labels)
+                print(f"  [{i}/{total}] ✓ {track.name}")
+            except RuntimeError as e:
+                print(f"  [{i}/{total}] ⚠ {track.name}: {e} — skipping")
+                results[track.name] = None
+
+    # Phase 2a: index which fetched track(s) label each issue. Used to turn a
+    # bare FLAG (in a track's frontmatter, but it has lost that track's label)
+    # into a MOVE when the issue is now labeled for exactly one OTHER active
+    # track in the same repo.
+    labeled_index: dict = {}  # issue number -> list[track]
+    for track in targets:
+        if not track.repo or results.get(track.name) is None:
+            continue
+        for num in {i["number"] for i in results[track.name]}:
+            labeled_index.setdefault(num, []).append(track)
+
+    # Phase 2b: detect cross-track moves (#163). An issue qualifies when it is
+    # in track A's frontmatter, no longer carries A's label, and is now labeled
+    # by exactly one OTHER active track B in the same repo. Ambiguous cases
+    # (two or more candidate targets) stay as plain FLAGs.
+    moved_out: dict = {}  # src track name -> set(num)
+    moved_in: dict = {}   # dst track name -> set(num)
+    move_dst: dict = {}   # (src track name, num) -> dst track
+    for track in targets:
+        if not track.repo or results.get(track.name) is None:
+            continue
+        labeled_nums = {i["number"] for i in results[track.name]}
+        listed_nums = set(track.meta.get("github", {}).get("issues") or [])
+        for num in sorted(listed_nums - labeled_nums):
+            cands = [b for b in labeled_index.get(num, [])
+                     if b is not track and b.repo == track.repo]
+            if len(cands) == 1:
+                dst = cands[0]
+                moved_out.setdefault(track.name, set()).add(num)
+                moved_in.setdefault(dst.name, set()).add(num)
+                move_dst[(track.name, num)] = dst
+
+    # Phase 2c: per-track diff, report, confirm. Membership changes accumulate
+    # in `final` (track name -> desired issue set); each affected track is
+    # written exactly ONCE at the end, so a move that touches two tracks never
+    # double-writes or clobbers a sibling's accepted ADDs. A move is governed by
+    # the confirmation on its SOURCE track (where the issue currently lives).
+    final: dict = {}     # track name -> set(num)
+    affected: dict = {}  # track name -> track (only those we may write)
+
+    def _final_for(t):
+        if t.name not in final:
+            final[t.name] = set(t.meta.get("github", {}).get("issues") or [])
+            affected[t.name] = t
+        return final[t.name]
+
     any_changes = False
     for track in targets:
         slug = track.meta.get("track", track.name)
         if not track.repo:
             continue
 
-        labels = _resolve_labels(track)
-        try:
-            labeled = _fetch_labeled_issues(track.repo, labels)
-        except RuntimeError as e:
-            print(f"  ⚠ {slug}: {e}")
+        labeled = results.get(track.name)
+        if labeled is None:
             continue
 
+        labels = _resolve_labels(track)
         labeled_nums = {i["number"] for i in labeled}
         listed_nums = set(track.meta.get("github", {}).get("issues") or [])
+        out_moves = sorted(moved_out.get(track.name, set()))
 
-        adds = sorted(labeled_nums - listed_nums)
-        flag_nums = sorted(listed_nums - labeled_nums)
+        # MOVE issues are reported (and applied) as moves, not as ADD on the
+        # destination or FLAG on the source.
+        adds = sorted(labeled_nums - listed_nums - moved_in.get(track.name, set()))
+        flag_nums = sorted(listed_nums - labeled_nums - moved_out.get(track.name, set()))
 
-        if not adds and not flag_nums:
+        if not adds and not flag_nums and not out_moves:
             continue
 
         any_changes = True
@@ -144,6 +250,13 @@ def run(args: list[str]) -> int:
             for num in adds:
                 i = issue_lookup[num]
                 print(f"    #{num} ({i['state'].lower()}) {i['title']}")
+        if out_moves:
+            print(f"  MOVE ({len(out_moves)}) — relabeled to another track in this repo:")
+            for num in out_moves:
+                dst = move_dst[(track.name, num)]
+                dst_slug = dst.meta.get("track", dst.name)
+                pub = " [dst PUBLIC]" if needs_confirm(dst.repo, cfg) else ""
+                print(f"    #{num}  {slug} → {dst_slug}{pub}")
         if flag_nums:
             print(f"  FLAG ({len(flag_nums)}) — in frontmatter but missing every configured label:")
             for num in flag_nums:
@@ -151,8 +264,8 @@ def run(args: list[str]) -> int:
 
         if listed_nums and len(flag_nums) / len(listed_nums) > 0.5:
             print(f"\n  ⓘ {len(flag_nums)}/{len(listed_nums)} frontmatter issues lack the configured label(s).")
-            print(f"    This track looks hand-curated, not label-driven — reconcile may not be the right tool.")
-            print(f"    If you just want to update issue state in the body table, try:")
+            print("    This track looks hand-curated, not label-driven — reconcile may not be the right tool.")
+            print("    If you just want to update issue state in the body table, try:")
             print(f"      /work-plan refresh-md {slug}")
 
         if draft:
@@ -160,12 +273,41 @@ def run(args: list[str]) -> int:
             # Useful for sweep audits and scripted reports.
             continue
 
-        choice = prompt_input(f"\n  Apply ADDs to {track.path.name}? [y/N/skip-flags]").lower()
-        if choice == "y":
-            new_issues = sorted(listed_nums | labeled_nums)
-            track.meta.setdefault("github", {})["issues"] = new_issues
-            write_file(track.path, track.meta, track.body)
-            print(f"  ✓ Updated {track.path.name} ({len(adds)} added)")
+        if yes:
+            # Non-interactive: apply ADDs + MOVEs without prompting. All writes
+            # are local frontmatter — the read-only-GitHub contract is unchanged.
+            print(f"\n  --yes: applying changes from {track.path.name}")
+            choice = "y"
+        else:
+            choice = prompt_input(f"\n  Apply ADDs/MOVEs from {track.path.name}? [y/N]").lower()
+        if choice != "y":
+            continue
+
+        if adds:
+            _final_for(track).update(adds)
+        for num in out_moves:
+            dst = move_dst[(track.name, num)]
+            # Public-repo guard (#163): under --yes we never silently write
+            # membership into a PUBLIC/shared destination track — that move is
+            # skipped with a pointer to the gated `move` verb. Interactive runs
+            # treat the prompt above as the confirmation.
+            if yes and needs_confirm(dst.repo, cfg):
+                dst_slug = dst.meta.get("track", dst.name)
+                print(f"  ⏭ skipped MOVE #{num} → {dst_slug} ({dst.repo} is PUBLIC; "
+                      f"run `/work-plan move {num} {slug} {dst_slug} --confirm` instead)")
+                continue
+            _final_for(track).discard(num)
+            _final_for(dst).add(num)
+
+    # Write each affected track exactly once, only if its set actually changed.
+    for name, issues in final.items():
+        track = affected[name]
+        original = set(track.meta.get("github", {}).get("issues") or [])
+        if issues == original:
+            continue
+        track.meta.setdefault("github", {})["issues"] = sorted(issues)
+        write_file(track.path, track.meta, track.body)
+        print(f"  ✓ Updated {track.path.name}")
 
     if not any_changes:
         print("All tracks in sync with configured labels.")