@wipcomputer/wip-ai-devops-toolbox 1.9.55 → 1.9.56

package/.worktrees/toolbox--save-stale/tools/wip-repo-init/templates/product/product-ideas/README.md

@@ -0,0 +1,24 @@
+# product-ideas/
+
+Ideas that aren't plans yet. The incubator.
+
+## What Goes Here
+
+An idea is something you want to build but haven't committed to. It doesn't have tasks, timelines, or priorities. It's a "what if" or "we should."
+
+When an idea is ready to become a plan, move it to `../plans-prds/upcoming/` and flesh it out with tasks and priorities.
+
+## Format
+
+No strict format. But a good idea file usually has:
+
+- **What it is** (one paragraph)
+- **Why it matters** (what problem it solves)
+- **Open questions** (what you'd need to figure out)
+- **External references** (links, reviews, research)
+
+## Rules
+
+- **Not ready to plan?** It stays here.
+- **Ready to plan?** Move to `../plans-prds/upcoming/`.
+- **Killed?** Move to `_trash/` with a note about why.

package/.worktrees/toolbox--save-stale/tools/wip-repo-init/templates/product/readme-first-product.md

@@ -0,0 +1,128 @@
+# [Product Name] ... Read Me First
+
+**Last updated:** YYYY-MM-DD
+**Status:** Living document. Read this before any plan, build, or PR.
+
+---
+
+## What This File Is
+
+This is the product bible for this repo. It answers: what is this thing, why does it exist, how does it work, and what's the current state. Every person and agent working on this repo reads this first.
+
+**Keep it current.** Update it when the architecture changes, when major features ship, when the mental model shifts. If this file is stale, the team is working from bad context.
+
+**Keep it honest.** Don't describe the aspirational version. Describe what's built and what's missing. Plans go in `plans-prds/`. This file is ground truth.
+
+---
+
+## This Folder
+
+```
+product/
+  readme-first-product.md   <- you're here (the product bible)
+  _trash/
+  notes/                    <- freeform notes, research, observations
+  plans-prds/               <- plans with lifecycle stages
+    roadmap.md              <- the prioritized roadmap
+    current/                <- plans being built right now
+    upcoming/               <- plans that are next
+    archive-complete/       <- plans that shipped
+    todos/                  <- per-agent task lists
+    _sort/                  <- plans that need categorizing
+    _trash/
+  product-ideas/            <- ideas that aren't plans yet
+```
+
+**Navigate:**
+- **Want to know what's planned?** Read `plans-prds/roadmap.md`.
+- **Want to know what's being built right now?** Look in `plans-prds/current/`.
+- **Have an idea?** Write it up in `product-ideas/`.
+- **Ready to turn an idea into a plan?** Move it from `product-ideas/` to `plans-prds/upcoming/` (or `current/` if starting now).
+
+**Plan lifecycle:**
+```
+product-ideas/  ->  upcoming/  ->  current/  ->  archive-complete/
+   (idea)          (planned)     (building)       (shipped)
+```
+
+---
+
+## What [Product Name] Is
+
+_One paragraph. What it does in human words. Not what it is technically. What problem it solves and for whom._
+
+---
+
+## Core Concepts
+
+_The 3-5 mental models someone needs to understand this product. Not implementation details. The "aha" moments that make everything else make sense._
+
+_Example: "Raw files are ground truth. Databases are indexes. If anything breaks, rebuild from raw files."_
+
+_Example: "One agent per harness per machine. That's the identity unit."_
+
+---
+
+## How It Works
+
+_The architecture at a level a new contributor can follow. Diagrams are fine. ASCII art is fine. The goal is: someone reads this section and can navigate the codebase without asking questions._
+
+_Include:_
+- _High-level data flow_
+- _Key components and what they do_
+- _Where state lives (databases, config files, etc.)_
+- _What talks to what_
+
+---
+
+## Key Source Files
+
+_Table of the important files and what they do. Not every file. The ones a new contributor needs to find their way._
+
+| File | What It Does |
+|------|-------------|
+| `src/core.ts` | _description_ |
+| `src/cli.ts` | _description_ |
+
+---
+
+## What's Built (as of vX.Y.Z)
+
+_Bullet list of what actually works right now. Update the version and date when this section changes._
+
+---
+
+## What's Missing
+
+_Bullet list of known gaps, limitations, and unfinished work. This is not the roadmap (that's in `plans-prds/roadmap.md`). This is the honest answer to "what doesn't work yet?"_
+
+---
+
+## Key Documents
+
+_Links to the important plans, PRDs, and references. Relative paths within `ai/product/`._
+
+| Document | Location |
+|----------|----------|
+| **This file** | `readme-first-product.md` |
+| **Roadmap** | `plans-prds/roadmap.md` |
+
+---
+
+## Principles
+
+_The non-negotiable rules for this product. The things that override convenience. 5-10 max._
+
+1. _Principle one._
+2. _Principle two._
+
+---
+
+## How to Update This File
+
+- **New major feature shipped?** Update "What's Built" and "What's Missing."
+- **Architecture changed?** Update "How It Works" and "Key Source Files."
+- **New mental model?** Update "Core Concepts."
+- **New principle?** Add to "Principles."
+- **Always update** the "Last updated" date at the top.
+- **Never delete sections.** If a section is empty, leave the heading. It reminds the team to fill it in.

package/.worktrees/toolbox--save-stale/tools/wip-repo-init/templates/read-me-first.md

@@ -0,0 +1,80 @@
+# ai/ ... Read Me First
+
+This is the working folder for the team. Plans, notes, ideas, dev updates, todos. Everything that isn't code lives here.
+
+This folder only exists in `-private` repos. It never ships to public.
+
+## Structure
+
+```
+ai/
+  read-me-first.md                          <- you're here
+  _sort/                                    <- stuff that hasn't been filed yet
+  _trash/                                   <- stuff that's done or replaced (never delete, move here)
+  dev-updates/                              <- one file per significant change, auto-detected by wip-release
+    _trash/
+  product/
+    readme-first-product.md                 <- the product bible (read this before anything else)
+    _trash/
+    notes/                                  <- freeform notes, research, observations
+      _trash/
+    plans-prds/                             <- plans and PRDs with lifecycle stages
+      roadmap.md                            <- prioritized roadmap (Upcoming / Done / Deprecated)
+      _sort/                                <- plans that haven't been categorized yet
+      _trash/
+      upcoming/                             <- planned work (next up after current)
+      current/                              <- active plans being implemented right now
+      archive-complete/                     <- finished plans (moved here when done)
+      todos/                                <- per-agent todo files
+    product-ideas/                          <- ideas that aren't plans yet
+      _trash/
+```
+
+## What's In Each Section
+
+| Location | What It Is | Read More |
+|----------|-----------|-----------|
+| [_sort/](_sort/README.md) | Holding pen. Files that need to be looked at and filed somewhere. iCloud duplicates, randomly placed files, things you're not sure about. | [_sort/README.md](_sort/README.md) |
+| [_trash/](_trash/README.md) | The archive. Files that are done, replaced, or consumed. Never delete anything, move it here. | [_trash/README.md](_trash/README.md) |
+| [dev-updates/](dev-updates/README.md) | Engineering changelog. One file per significant change. Auto-detected by `wip-release` for release notes. | [dev-updates/README.md](dev-updates/README.md) |
+| [product/readme-first-product.md](product/readme-first-product.md) | The product bible. What this product is, how it works, what's built, what's missing. Read before any plan, build, or PR. | [product/readme-first-product.md](product/readme-first-product.md) |
+| [product/notes/](product/notes/README.md) | Freeform notes, research, observations. Anything useful that isn't a plan or idea. | [product/notes/README.md](product/notes/README.md) |
+| [product/plans-prds/roadmap.md](product/plans-prds/roadmap.md) | Prioritized roadmap. Upcoming (ordered by priority), Done (with dates), Deprecated (with reasons). | [product/plans-prds/roadmap.md](product/plans-prds/roadmap.md) |
+| [product/plans-prds/todos/](product/plans-prds/todos/README.md) | Per-agent todo files. One file per person/agent. Three sections: To Do, Done, Deprecated. | [product/plans-prds/todos/README.md](product/plans-prds/todos/README.md) |
+| [product/product-ideas/](product/product-ideas/README.md) | Ideas that aren't plans yet. The incubator. Move to `plans-prds/upcoming/` when ready to commit. | [product/product-ideas/README.md](product/product-ideas/README.md) |
+
+## Rules
+
+**Never delete anything.** Move to `_trash/` in the nearest parent folder. Files in `_trash/` stay in git history and can always be recovered.
+
+**`_sort/` is the holding pen.** When something doesn't have an obvious home yet, or iCloud duplicated something, put it in `_sort/`. File it properly when you know where it goes.
+
+**`_trash/` is not garbage.** It's the archive. Completed plans go to `archive-complete/`. But notes, drafts, and superseded files go to `_trash/`. The difference: `archive-complete/` is work that shipped. `_trash/` is work that was replaced, abandoned, or consumed.
+
+## How to Use This
+
+**Starting a new feature?**
+1. Write a plan in [product/plans-prds/current/](product/plans-prds/current/)
+2. Write dev updates as you work in [dev-updates/](dev-updates/)
+3. When the plan ships, move it to [archive-complete/](product/plans-prds/archive-complete/)
+
+**Got an idea but not ready to plan?**
+Put it in [product/product-ideas/](product/product-ideas/)
+
+**Found something interesting but don't know where it goes?**
+Put it in [_sort/](_sort/) or [product/notes/](product/notes/)
+
+**Tracking work across agents?**
+Use [product/plans-prds/todos/](product/plans-prds/todos/) (one file per person/agent) or GitHub Issues
+
+## Dev Updates
+
+Dev updates go in [dev-updates/](dev-updates/) with the naming convention:
+
+```
+YYYY-MM-DD--HH-MM--agent--description.md
+```
+
+Example: `2026-03-11--09-30--cc-mini--fix-hook-duplicates.md`
+
+`wip-release` auto-detects today's dev updates and uses them as release notes. Write them as you work. They're the changelog that writes itself.

package/.worktrees/toolbox--save-stale/tools/wip-repo-permissions-hook/LICENSE

@@ -0,0 +1,52 @@
+Dual License: MIT + AGPLv3
+
+Copyright (c) 2026 WIP Computer, Inc.
+
+
+1. MIT License (local and personal use)
+---------------------------------------
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+2. GNU Affero General Public License v3.0 (commercial and cloud use)
+--------------------------------------------------------------------
+
+If you run this software as part of a hosted service, cloud platform,
+marketplace listing, or any network-accessible offering for commercial
+purposes, the AGPLv3 terms apply. You must either:
+
+  a) Release your complete source code under AGPLv3, or
+  b) Obtain a commercial license.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published
+by the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+
+AGPLv3 for personal use is free. Commercial licenses available.

package/.worktrees/toolbox--save-stale/tools/wip-repo-permissions-hook/README.md

@@ -0,0 +1,86 @@
+###### WIP Computer
+
+[![npm](https://img.shields.io/npm/v/@wipcomputer/wip-repo-permissions-hook)](https://www.npmjs.com/package/@wipcomputer/wip-repo-permissions-hook) [![CLI / TUI](https://img.shields.io/badge/interface-CLI_/_TUI-black)](https://github.com/wipcomputer/wip-ai-devops-toolbox/blob/main/tools/wip-repo-permissions-hook/cli.js) [![MCP Server](https://img.shields.io/badge/interface-MCP_Server-black)](https://github.com/wipcomputer/wip-ai-devops-toolbox/blob/main/tools/wip-repo-permissions-hook/mcp-server.mjs) [![OpenClaw Plugin](https://img.shields.io/badge/interface-OpenClaw_Plugin-black)](https://github.com/wipcomputer/wip-ai-devops-toolbox/blob/main/tools/wip-repo-permissions-hook/openclaw.plugin.json) [![Claude Code Hook](https://img.shields.io/badge/interface-Claude_Code_Hook-black)](https://github.com/wipcomputer/wip-ai-devops-toolbox/blob/main/tools/wip-repo-permissions-hook/guard.mjs) [![Claude Code Skill](https://img.shields.io/badge/interface-Claude_Code_Skill-black)](https://github.com/wipcomputer/wip-ai-devops-toolbox/blob/main/tools/wip-repo-permissions-hook/SKILL.md) [![Universal Interface Spec](https://img.shields.io/badge/Universal_Interface_Spec-black?style=flat&color=black)](https://github.com/wipcomputer/wip-ai-devops-toolbox/blob/main/tools/wip-universal-installer/SPEC.md)
+
+# wip-repo-permissions-hook
+
+## Repo visibility guard. Blocks repos from going public without a -private counterpart.
+
+Every repo follows the public/private pattern. The private repo is the working repo with `ai/` folders (plans, todos, dev updates). The public repo is the same code without `ai/`. Making a repo public without the -private counterpart exposes internal development context.
+
+This tool blocks that.
+
+## How It Works
+
+Before any repo visibility change to public, the guard checks:
+
+1. Is this a fork of an external project? If yes, allow (exempt).
+2. Does `{repo-name}-private` exist on GitHub? If yes, allow.
+3. Otherwise, block with an error.
+
+## Surfaces
+
+- **CLI** ... `wip-repo-permissions check|audit|can-publish`
+- **Claude Code hook** ... PreToolUse:Bash, blocks `gh repo edit --visibility public`
+- **OpenClaw plugin** ... before_tool_use lifecycle hook
+- **Cron audit** ... periodic scan of all public repos via ldm-jobs
+
+## CLI Usage
+
+```bash
+# Check a single repo
+node cli.js check wipcomputer/memory-crystal
+# -> OK: memory-crystal-private exists
+
+# Check a repo without -private (blocked)
+node cli.js check wipcomputer/wip-bridge
+# -> BLOCKED: no -private counterpart
+
+# Audit all public repos in org
+node cli.js audit wipcomputer
+
+# Alias for check
+node cli.js can-publish wipcomputer/wip-ai-devops-toolbox
+```
+
+## Claude Code Setup
+
+Add to `~/.claude/settings.json`:
+
+```json
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [{
+          "type": "command",
+          "command": "node /path/to/wip-repo-permissions-hook/guard.mjs",
+          "timeout": 10
+        }]
+      }
+    ]
+  }
+}
+```
+
+## OpenClaw Setup
+
+Symlink or copy to extensions:
+
+```bash
+cp -r tools/wip-repo-permissions-hook ~/.ldm/extensions/wip-repo-permissions-hook
+ln -sf ~/.ldm/extensions/wip-repo-permissions-hook ~/.openclaw/extensions/wip-repo-permissions-hook
+openclaw gateway restart
+```
+
+## License
+
+```
+CLI, MCP server, OpenClaw plugin, hooks        MIT    (use anywhere, no restrictions)
+Hosted or cloud service use                    AGPL   (network service distribution)
+```
+
+AGPL for personal use is free.
+
+Built by Parker Todd Brooks, Lēsa (OpenClaw, Claude Opus 4.6), Claude Code (Claude Opus 4.6).

package/.worktrees/toolbox--save-stale/tools/wip-repo-permissions-hook/SKILL.md

@@ -0,0 +1,73 @@
+---
+name: wip-repo-permissions-hook
+description: Repo visibility guard. Blocks repos from going public without a -private counterpart.
+license: MIT
+interface: [cli, module, mcp, hook, plugin]
+metadata:
+  display-name: "Repo Visibility Guard"
+  version: "1.0.0"
+  homepage: "https://github.com/wipcomputer/wip-ai-devops-toolbox"
+  author: "Parker Todd Brooks"
+  category: dev-tools
+  capabilities:
+    - visibility-check
+    - org-audit
+    - public-gate
+  requires:
+    bins: [node, gh]
+  openclaw:
+    requires:
+      bins: [node, gh]
+    install:
+      - id: node
+        kind: node
+        package: "@wipcomputer/wip-repo-permissions-hook"
+        bins: [wip-repo-permissions]
+        label: "Install via npm"
+    emoji: "🔒"
+compatibility: Requires node, gh (GitHub CLI). Node.js 18+.
+---
+
+# Repo Permissions Hook
+
+## What This Does
+
+Prevents repos from being made public unless a `-private` counterpart exists on GitHub. Protects internal plans, todos, and development context from accidental exposure.
+
+## The Rule
+
+Every repo that goes public must have a `{name}-private` repo. The private repo holds `ai/` folders with plans, todos, dev updates, and notes. The public repo has the same code without `ai/`.
+
+Forks of external projects are exempt.
+
+## How to Use
+
+### Check before changing visibility
+```bash
+node cli.js check <org>/<repo>
+```
+
+### Audit all public repos
+```bash
+node cli.js audit <org>
+```
+
+### Install as Claude Code hook
+Add to `~/.claude/settings.json` under `hooks.PreToolUse` with matcher `"Bash"`.
+
+### Install as OpenClaw plugin
+Copy to `~/.ldm/extensions/wip-repo-permissions-hook/` and restart gateway.
+
+### MCP
+
+Tools: `repo_permissions_check`, `repo_permissions_audit`
+
+Add to `.mcp.json`:
+```json
+{
+  "wip-repo-permissions": {
+    "command": "node",
+    "args": ["/path/to/tools/wip-repo-permissions-hook/mcp-server.mjs"]
+  }
+}
+```

package/.worktrees/toolbox--save-stale/tools/wip-repo-permissions-hook/cli.js

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+/**
+ * wip-repo-permissions-hook/cli.js
+ * CLI for repo visibility permissions.
+ *
+ * Usage:
+ *   wip-repo-permissions check <org/repo>      Check if repo can be public
+ *   wip-repo-permissions audit <org>            Audit all public repos
+ *   wip-repo-permissions can-publish <org/repo> Alias for check
+ */
+
+import { readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { checkPrivateCounterpart, auditOrg } from './core.mjs';
+
+if (process.argv.includes('--version') || process.argv.includes('-v')) {
+  const __dirname = dirname(fileURLToPath(import.meta.url));
+  const pkg = JSON.parse(readFileSync(join(__dirname, 'package.json'), 'utf8'));
+  console.log(pkg.version);
+  process.exit(0);
+}
+
+const args = process.argv.slice(2);
+const command = args[0];
+const target = args[1];
+
+function usage() {
+  console.log('wip-repo-permissions ... repo visibility guard\n');
+  console.log('Usage:');
+  console.log('  wip-repo-permissions check <org/repo>       Check if repo can be made public');
+  console.log('  wip-repo-permissions audit <org>             Audit all public repos in org');
+  console.log('  wip-repo-permissions can-publish <org/repo>  Alias for check');
+  console.log('\nExamples:');
+  console.log('  wip-repo-permissions check wipcomputer/wip-bridge');
+  console.log('  wip-repo-permissions audit wipcomputer');
+  process.exit(1);
+}
+
+if (!command || !target) usage();
+
+switch (command) {
+  case 'check':
+  case 'can-publish': {
+    const parts = target.split('/');
+    if (parts.length !== 2) {
+      console.error('Error: target must be org/repo (e.g. wipcomputer/memory-crystal)');
+      process.exit(1);
+    }
+    const [org, repo] = parts;
+    const result = checkPrivateCounterpart(org, repo);
+
+    if (result.allowed) {
+      console.log(`  OK: ${result.reason}`);
+      process.exit(0);
+    } else {
+      console.error(`  ${result.reason}`);
+      process.exit(1);
+    }
+    break;
+  }
+
+  case 'audit': {
+    const org = target;
+    console.log(`\nAuditing public repos in ${org}...\n`);
+
+    const { violations, ok } = auditOrg(org);
+
+    if (ok.length > 0) {
+      console.log(`  Compliant (${ok.length}):`);
+      for (const r of ok) {
+        console.log(`    OK  ${r.name}`);
+      }
+      console.log('');
+    }
+
+    if (violations.length > 0) {
+      console.log(`  VIOLATIONS (${violations.length}):`);
+      for (const v of violations) {
+        console.log(`    !!  ${v.name} ... no -private counterpart`);
+      }
+      console.log('');
+      console.error(`  ${violations.length} repo(s) are public without a -private counterpart.`);
+      process.exit(1);
+    } else {
+      console.log('  All public repos have -private counterparts (or are exempt forks).');
+      process.exit(0);
+    }
+  }
+
+  default:
+    usage();
+}

package/.worktrees/toolbox--save-stale/tools/wip-repo-permissions-hook/core.mjs

@@ -0,0 +1,122 @@
+/**
+ * wip-repo-permissions-hook/core.mjs
+ * Pure logic for repo visibility permissions.
+ * Blocks repos from going public without a -private counterpart.
+ * Zero dependencies. Uses gh CLI for GitHub API calls.
+ */
+
+import { execFileSync } from 'node:child_process';
+
+/**
+ * Check if a repo has a -private counterpart on GitHub.
+ * @param {string} org - GitHub org (e.g. "wipcomputer")
+ * @param {string} repoName - Repo name (e.g. "memory-crystal")
+ * @returns {{ allowed: boolean, reason: string }}
+ */
+export function checkPrivateCounterpart(org, repoName) {
+  // If the repo itself IS the private repo, allow
+  if (repoName.endsWith('-private')) {
+    return { allowed: true, reason: `${repoName} is already a private repo.` };
+  }
+
+  // Check if it's a fork (forks of external projects are exempt)
+  const forkStatus = isThirdPartyFork(org, repoName);
+  if (forkStatus.isFork) {
+    return { allowed: true, reason: `${repoName} is a fork of ${forkStatus.parent}. Forks are exempt.` };
+  }
+
+  // Check if -private counterpart exists
+  const privateName = `${repoName}-private`;
+  try {
+    execFileSync('gh', ['api', `repos/${org}/${privateName}`, '--jq', '.name'], {
+      encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+      timeout: 10000,
+    });
+    return { allowed: true, reason: `${privateName} exists. ${repoName} can be public.` };
+  } catch {
+    return {
+      allowed: false,
+      reason: `BLOCKED: ${org}/${repoName} cannot be made public. No -private counterpart found (expected ${org}/${privateName}). Create the -private repo first, move all ai/ content there, then make this repo public.`,
+    };
+  }
+}
+
+/**
+ * Check if a repo is a fork of an external project.
+ * @param {string} org
+ * @param {string} repoName
+ * @returns {{ isFork: boolean, parent: string }}
+ */
+export function isThirdPartyFork(org, repoName) {
+  try {
+    const json = execFileSync('gh', ['api', `repos/${org}/${repoName}`, '--jq', '{fork: .fork, parent: .parent.full_name}'], {
+      encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+      timeout: 10000,
+    });
+    const data = JSON.parse(json);
+    if (data.fork && data.parent && !data.parent.startsWith(`${org}/`)) {
+      return { isFork: true, parent: data.parent };
+    }
+    return { isFork: false, parent: '' };
+  } catch {
+    return { isFork: false, parent: '' };
+  }
+}
+
+/**
+ * Audit all public repos in an org for missing -private counterparts.
+ * @param {string} org
+ * @returns {{ violations: Array<{name: string, reason: string}>, ok: Array<{name: string, reason: string}> }}
+ */
+export function auditOrg(org) {
+  // Get all public repos
+  let repos;
+  try {
+    const json = execFileSync('gh', [
+      'repo', 'list', org,
+      '--visibility', 'public',
+      '--json', 'name',
+      '--limit', '200',
+    ], { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 30000 });
+    repos = JSON.parse(json);
+  } catch (e) {
+    throw new Error(`Failed to list repos for ${org}: ${e.message}`);
+  }
+
+  const violations = [];
+  const ok = [];
+
+  for (const repo of repos) {
+    const result = checkPrivateCounterpart(org, repo.name);
+    if (result.allowed) {
+      ok.push({ name: repo.name, reason: result.reason });
+    } else {
+      violations.push({ name: repo.name, reason: result.reason });
+    }
+  }
+
+  return { violations, ok };
+}
+
+/**
+ * Extract repo org/name from a gh command string.
+ * Looks for patterns like: gh repo edit wipcomputer/repo-name --visibility public
+ * @param {string} command
+ * @returns {{ org: string, repo: string, isVisibilityChange: boolean } | null}
+ */
+export function parseVisibilityCommand(command) {
+  // Match: gh repo edit <org/repo> ... --visibility public
+  const editMatch = command.match(/gh\s+repo\s+edit\s+([^\s]+)/);
+  if (!editMatch) return null;
+
+  const visibilityMatch = command.match(/--visibility\s+(public|private|internal)/);
+  if (!visibilityMatch || visibilityMatch[1] !== 'public') return null;
+
+  const slug = editMatch[1];
+  const parts = slug.split('/');
+  if (parts.length !== 2) return null;
+
+  return { org: parts[0], repo: parts[1], isVisibilityChange: true };
+}