@wipcomputer/wip-ai-devops-toolbox 1.9.55 → 1.9.57

package/.worktrees/wip-ai-devops-toolbox-private--cc-mini--dot-worktrees/tools/wip-repo-permissions-hook/guard.mjs

@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+/**
+ * wip-repo-permissions-hook/guard.mjs
+ * PreToolUse:Bash hook for Claude Code.
+ * Blocks `gh repo edit --visibility public` unless -private counterpart exists.
+ * Same pattern as wip-file-guard/guard.mjs.
+ */
+
+import { parseVisibilityCommand, checkPrivateCounterpart } from './core.mjs';
+
+function deny(reason) {
+  const output = {
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'deny',
+      permissionDecisionReason: reason,
+    },
+  };
+  process.stdout.write(JSON.stringify(output));
+}
+
+async function main() {
+  let raw = '';
+  for await (const chunk of process.stdin) {
+    raw += chunk;
+  }
+
+  let input;
+  try {
+    input = JSON.parse(raw);
+  } catch {
+    // Can't parse input, allow by default
+    process.exit(0);
+  }
+
+  const toolName = input.tool_name || '';
+  const toolInput = input.tool_input || {};
+
+  // Only check Bash commands
+  if (toolName !== 'Bash') {
+    process.exit(0);
+  }
+
+  const command = toolInput.command || '';
+
+  // Only check commands that look like visibility changes
+  const parsed = parseVisibilityCommand(command);
+  if (!parsed) {
+    process.exit(0);
+  }
+
+  // Check if the repo can be made public
+  const result = checkPrivateCounterpart(parsed.org, parsed.repo);
+
+  if (!result.allowed) {
+    deny(result.reason);
+    process.exit(0);
+  }
+
+  // Allowed
+  process.exit(0);
+}
+
+main().catch(() => process.exit(0));

package/.worktrees/wip-ai-devops-toolbox-private--cc-mini--dot-worktrees/tools/wip-repo-permissions-hook/mcp-server.mjs

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+// wip-repo-permissions-hook/mcp-server.mjs
+// MCP server exposing repo visibility guard as tools.
+// Wraps core.mjs. Registered via .mcp.json.
+
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+import {
+  checkPrivateCounterpart, auditOrg,
+} from './core.mjs';
+
+const server = new Server(
+  { name: 'wip-repo-permissions', version: '1.0.0' },
+  { capabilities: { tools: {} } }
+);
+
+// ── Tool Definitions ──
+
+server.setRequestHandler(ListToolsRequestSchema, async () => ({
+  tools: [
+    {
+      name: 'repo_permissions_check',
+      description: 'Check if a repo has a -private counterpart on GitHub. Required before making any repo public.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          org: { type: 'string', description: 'GitHub org (e.g. wipcomputer)' },
+          repo: { type: 'string', description: 'Repo name (e.g. memory-crystal)' },
+        },
+        required: ['org', 'repo'],
+      },
+    },
+    {
+      name: 'repo_permissions_audit',
+      description: 'Audit all public repos in a GitHub org for missing -private counterparts. Returns violations and passing repos.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          org: { type: 'string', description: 'GitHub org (e.g. wipcomputer)' },
+        },
+        required: ['org'],
+      },
+    },
+  ],
+}));
+
+// ── Tool Handlers ──
+
+server.setRequestHandler(CallToolRequestSchema, async (req) => {
+  const { name, arguments: args } = req.params;
+
+  try {
+    if (name === 'repo_permissions_check') {
+      const result = checkPrivateCounterpart(args.org, args.repo);
+      return {
+        content: [{
+          type: 'text',
+          text: `${result.allowed ? 'ALLOWED' : 'BLOCKED'}: ${result.reason}`,
+        }],
+      };
+    }
+
+    if (name === 'repo_permissions_audit') {
+      const result = auditOrg(args.org);
+      const lines = [];
+      if (result.violations.length > 0) {
+        lines.push(`${result.violations.length} violation(s):`);
+        for (const v of result.violations) {
+          lines.push(`  BLOCKED: ${v.name} - ${v.reason}`);
+        }
+      }
+      lines.push(`${result.ok.length} repo(s) OK.`);
+      return {
+        content: [{ type: 'text', text: lines.join('\n') }],
+      };
+    }
+
+    return {
+      content: [{ type: 'text', text: `Unknown tool: ${name}` }],
+      isError: true,
+    };
+  } catch (err) {
+    return {
+      content: [{ type: 'text', text: `Error: ${err.message}` }],
+      isError: true,
+    };
+  }
+});
+
+const transport = new StdioServerTransport();
+await server.connect(transport);

package/.worktrees/wip-ai-devops-toolbox-private--cc-mini--dot-worktrees/tools/wip-repo-permissions-hook/openclaw.plugin.json

@@ -0,0 +1,8 @@
+{
+  "name": "wip-repo-permissions-hook",
+  "version": "1.0.0",
+  "description": "Blocks repos from going public without a -private counterpart. Protects internal plans, todos, and dev context from exposure.",
+  "lifecycle": {
+    "before_tool_use": "./guard.mjs"
+  }
+}

package/.worktrees/wip-ai-devops-toolbox-private--cc-mini--dot-worktrees/tools/wip-repo-permissions-hook/package.json

@@ -0,0 +1,31 @@
+{
+  "name": "@wipcomputer/wip-repo-permissions-hook",
+  "version": "1.9.15",
+  "type": "module",
+  "description": "Repo visibility guard. Blocks repos from going public without a -private counterpart.",
+  "main": "core.mjs",
+  "bin": {
+    "wip-repo-permissions": "./cli.js"
+  },
+  "scripts": {
+    "test": "bash test.sh"
+  },
+  "keywords": [
+    "claude-code",
+    "openclaw",
+    "hook",
+    "repo-guard",
+    "visibility",
+    "ai-safety",
+    "pretooluse"
+  ],
+  "author": "Parker Todd Brooks",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/wipcomputer/wip-ai-devops-toolbox.git"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0"
+  }
+}

package/.worktrees/wip-ai-devops-toolbox-private--cc-mini--dot-worktrees/tools/wip-repos/LICENSE

@@ -0,0 +1,52 @@
+Dual License: MIT + AGPLv3
+
+Copyright (c) 2026 WIP Computer, Inc.
+
+
+1. MIT License (local and personal use)
+---------------------------------------
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+2. GNU Affero General Public License v3.0 (commercial and cloud use)
+--------------------------------------------------------------------
+
+If you run this software as part of a hosted service, cloud platform,
+marketplace listing, or any network-accessible offering for commercial
+purposes, the AGPLv3 terms apply. You must either:
+
+  a) Release your complete source code under AGPLv3, or
+  b) Obtain a commercial license.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published
+by the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+
+AGPLv3 for personal use is free. Commercial licenses available.

package/.worktrees/wip-ai-devops-toolbox-private--cc-mini--dot-worktrees/tools/wip-repos/README.md

@@ -0,0 +1,77 @@
+###### WIP Computer
+
+[![npm](https://img.shields.io/npm/v/@wipcomputer/wip-repos)](https://www.npmjs.com/package/@wipcomputer/wip-repos) [![CLI / TUI](https://img.shields.io/badge/interface-CLI_/_TUI-black)](https://github.com/wipcomputer/wip-ai-devops-toolbox/blob/main/tools/wip-repos/cli.mjs) [![MCP Server](https://img.shields.io/badge/interface-MCP_Server-black)](https://github.com/wipcomputer/wip-ai-devops-toolbox/blob/main/tools/wip-repos/mcp-server.mjs) [![Claude Code Skill](https://img.shields.io/badge/interface-Claude_Code_Skill-black)](https://github.com/wipcomputer/wip-ai-devops-toolbox/blob/main/tools/wip-repos/SKILL.md) [![Universal Interface Spec](https://img.shields.io/badge/Universal_Interface_Spec-black?style=flat&color=black)](https://github.com/wipcomputer/wip-ai-devops-toolbox/blob/main/tools/wip-universal-installer/SPEC.md)
+
+# wip-repos
+
+Repo manifest reconciler. Single source of truth for repo organization.
+
+## The Problem
+
+You have 50 repos. Someone moves a folder. The README drifts. The manifest drifts. Your AI agent references a path that doesn't exist anymore. Everyone wastes time.
+
+## The Solution
+
+`repos-manifest.json` is the single source of truth. The filesystem adapts to it. Like prettier for folder structure.
+
+Move folders around all day. On sync, everything snaps back to where the manifest says it belongs. Want to change the structure? PR to the manifest. Org owner approves or rejects. Rejected? Your folders snap back on next sync.
+
+## Usage
+
+```bash
+# Check for drift between filesystem and manifest
+wip-repos check
+
+# See what sync would do
+wip-repos sync --dry-run
+
+# Actually move folders to match manifest
+wip-repos sync
+
+# Add a new repo
+wip-repos add ldm-os/utilities/my-tool --remote wipcomputer/my-tool
+
+# Move a repo to a different category
+wip-repos move ldm-os/utilities/my-tool --to ldm-os/devops/my-tool
+
+# Generate directory tree from manifest
+wip-repos tree
+```
+
+## Options
+
+```
+--manifest   Path to repos-manifest.json (default: ./repos-manifest.json)
+--root       Path to repos root directory (default: directory containing manifest)
+--dry-run    Show what would happen without making changes
+--json       Output as JSON
+```
+
+## How It Works
+
+1. **check** walks the filesystem, finds all git repos, compares against the manifest. Reports what's on disk but not in manifest, and what's in manifest but not on disk. Exit code 1 if drift detected.
+
+2. **sync** matches repos by their git remote URL. If a repo's remote matches a manifest entry but it's at the wrong path, sync moves it to the manifest path.
+
+3. **add/move** update the manifest file. The actual folder moves happen on the next `sync`.
+
+## Integration
+
+- `deploy-public` and `wip-release` can call `wip-repos check` before running. Stale manifest blocks deploys.
+- CI: run `wip-repos check` as a PR check. Drift = blocked merge.
+- README generation: `wip-repos tree` outputs a directory tree from the manifest.
+
+## Source
+
+Pure JavaScript. Zero dependencies. `core.mjs` (logic), `cli.mjs` (CLI). No build step.
+
+## License
+
+```
+CLI, MCP server, module                        MIT    (use anywhere, no restrictions)
+Hosted or cloud service use                    AGPL   (network service distribution)
+```
+
+AGPL for personal use is free.
+
+Built by Parker Todd Brooks, Lēsa (OpenClaw, Claude Opus 4.6), Claude Code (Claude Opus 4.6).

package/.worktrees/wip-ai-devops-toolbox-private--cc-mini--dot-worktrees/tools/wip-repos/SKILL.md

@@ -0,0 +1,80 @@
+---
+name: wip-repos
+description: Repo manifest reconciler. Makes repos-manifest.json the single source of truth for repo organization.
+license: MIT
+interface: [cli, module, mcp]
+metadata:
+  display-name: "Repo Manifest Reconciler"
+  version: "0.1.0"
+  homepage: "https://github.com/wipcomputer/wip-ai-devops-toolbox"
+  author: "Parker Todd Brooks"
+  category: dev-tools
+  capabilities:
+    - manifest-check
+    - filesystem-sync
+    - repo-add
+    - repo-move
+    - tree-generation
+  requires:
+    bins: [node, git]
+  openclaw:
+    requires:
+      bins: [node, git]
+    install:
+      - id: node
+        kind: node
+        package: "@wipcomputer/wip-repos"
+        bins: [wip-repos]
+        label: "Install via npm"
+    emoji: "📂"
+compatibility: Requires git, node. Node.js 18+.
+---
+
+# wip-repos
+
+Repo manifest reconciler. Like prettier for folder structure. Move folders around all day; on sync, everything snaps back to where the manifest says.
+
+## When to Use This Skill
+
+**Use wip-repos for:**
+- Checking if the filesystem matches the manifest (`check`)
+- Moving repos to match the manifest (`sync`)
+- Adding a new repo to the manifest (`add`)
+- Moving a repo in the manifest (`move`)
+- Generating a directory tree from the manifest (`tree`)
+
+**Use after:**
+- Cloning a new repo
+- Moving repos between categories
+- Adding new repos to the org
+
+### Do NOT Use For
+
+- Git operations (use git directly)
+- Repo creation on GitHub (use gh)
+
+## API Reference
+
+### CLI
+
+```bash
+wip-repos check                              # diff filesystem vs manifest
+wip-repos sync --dry-run                     # preview moves
+wip-repos sync                               # execute moves
+wip-repos add ldm-os/utilities/new-tool --remote wipcomputer/new-tool
+wip-repos move ldm-os/utilities/tool --to ldm-os/devops/tool
+wip-repos tree                               # generate directory tree
+```
+
+### Module
+
+```javascript
+import { check, planSync, addRepo, moveRepo, generateReadmeTree } from '@wipcomputer/wip-repos';
+
+const result = check('/path/to/manifest.json', '/path/to/repos/');
+const moves = planSync('/path/to/manifest.json', '/path/to/repos/');
+```
+
+### MCP
+
+Tools: `repos_check`, `repos_sync_plan`, `repos_add`, `repos_move`, `repos_tree`

package/.worktrees/wip-ai-devops-toolbox-private--cc-mini--dot-worktrees/tools/wip-repos/claude.mjs

@@ -0,0 +1,248 @@
+/**
+ * wip-repos claude ... generate cross-repo CLAUDE.md ecosystem sections
+ *
+ * Reads all repos on disk via the manifest, extracts metadata from each,
+ * and writes an ## Ecosystem section into each repo's CLAUDE.md.
+ *
+ * Usage:
+ *   wip-repos claude              # regenerate all repos
+ *   wip-repos claude <repo>       # regenerate one repo
+ *   wip-repos claude --init       # create CLAUDE.md for repos missing one
+ *   wip-repos claude --dry-run    # preview changes
+ */
+
+import { existsSync, readFileSync, writeFileSync, readdirSync, mkdirSync } from 'node:fs';
+import { join, basename, resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const TEMPLATE_PATH = join(__dirname, '..', '..', 'templates', 'repo-claude-md.template');
+const START_MARKER = '<!-- wip-repos:start -->';
+const END_MARKER = '<!-- wip-repos:end -->';
+
+function readJSON(path) {
+  try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; }
+}
+
+/**
+ * Extract metadata from a single repo on disk.
+ */
+function extractRepoMeta(repoPath) {
+  const pkg = readJSON(join(repoPath, 'package.json'));
+  const name = pkg?.name || basename(repoPath);
+  const description = pkg?.description || '';
+  const version = pkg?.version || '';
+  const exports = pkg?.exports ? Object.keys(pkg.exports) : [];
+  const binCommands = pkg?.bin ? Object.keys(pkg.bin) : [];
+  const scripts = pkg?.scripts || {};
+
+  // Detect interfaces
+  const interfaces = [];
+  if (binCommands.length > 0) interfaces.push('CLI');
+  if (pkg?.main || pkg?.exports) interfaces.push('Module');
+  if (existsSync(join(repoPath, 'mcp-server.mjs')) || existsSync(join(repoPath, 'dist', 'mcp-server.js'))) interfaces.push('MCP');
+  if (existsSync(join(repoPath, 'openclaw.plugin.json'))) interfaces.push('OpenClaw Plugin');
+  if (existsSync(join(repoPath, 'SKILL.md'))) interfaces.push('Skill');
+
+  // Detect key dirs
+  const dirs = [];
+  for (const d of ['src', 'lib', 'tools', 'bin', 'dist', 'test', 'scripts', 'ai']) {
+    if (existsSync(join(repoPath, d))) dirs.push(d + '/');
+  }
+
+  return {
+    name,
+    description,
+    version,
+    interfaces,
+    binCommands,
+    dirs,
+    scripts,
+    path: repoPath,
+  };
+}
+
+/**
+ * Determine which repos are relevant to a given repo.
+ * Returns only repos in the same category or that share dependencies.
+ */
+function filterRelevant(targetMeta, allMetas, manifest) {
+  // Find target's category from manifest
+  const targetBase = basename(targetMeta.path);
+  let targetCategory = null;
+
+  for (const [category, repos] of Object.entries(manifest.repos || {})) {
+    if (repos.some(r => r.local?.includes(targetBase) || r.name === targetBase)) {
+      targetCategory = category;
+      break;
+    }
+  }
+
+  // Core repos every repo should know about
+  const coreNames = ['wip-ldm-os', 'wip-ai-devops-toolbox', 'memory-crystal'];
+
+  return allMetas.filter(m => {
+    if (m.path === targetMeta.path) return false; // skip self
+    const mBase = basename(m.path);
+    // Same category
+    if (targetCategory) {
+      for (const repos of Object.values(manifest.repos || {})) {
+        if (repos.some(r => r.local?.includes(mBase))) return true;
+      }
+    }
+    // Core repo
+    if (coreNames.some(c => mBase.includes(c))) return true;
+    return false;
+  }).slice(0, 15); // cap at 15 to keep CLAUDE.md focused
+}
+
+/**
+ * Generate the ecosystem section for a repo.
+ */
+function generateEcosystem(targetMeta, relevantMetas) {
+  const lines = [];
+  for (const m of relevantMetas) {
+    const relPath = basename(m.path);
+    lines.push(`### ${m.name}`);
+    lines.push(`**Path:** \`${relPath}\``);
+    if (m.description) lines.push(m.description);
+    if (m.interfaces.length > 0) lines.push(`**Interfaces:** ${m.interfaces.join(', ')}`);
+    if (m.binCommands.length > 0) lines.push(`**CLI:** ${m.binCommands.join(', ')}`);
+    if (m.version) lines.push(`**Version:** ${m.version}`);
+    lines.push('');
+  }
+  return lines.join('\n').trim();
+}
+
+/**
+ * Update the ecosystem section in a CLAUDE.md file.
+ * Only replaces content between the delimiter comments.
+ */
+function updateEcosystemSection(claudeMdPath, ecosystemContent) {
+  const content = readFileSync(claudeMdPath, 'utf8');
+  const startIdx = content.indexOf(START_MARKER);
+  const endIdx = content.indexOf(END_MARKER);
+
+  if (startIdx === -1 || endIdx === -1) {
+    // No delimiters found. Append section.
+    const section = `\n## Ecosystem (auto-generated by wip-repos claude)\n${START_MARKER}\n\n${ecosystemContent}\n\n${END_MARKER}\n`;
+    return content + section;
+  }
+
+  // Replace between delimiters
+  const before = content.substring(0, startIdx + START_MARKER.length);
+  const after = content.substring(endIdx);
+  return `${before}\n\n${ecosystemContent}\n\n${after}`;
+}
+
+/**
+ * Create a starter CLAUDE.md from the template.
+ */
+function createFromTemplate(repoPath, meta) {
+  const template = existsSync(TEMPLATE_PATH)
+    ? readFileSync(TEMPLATE_PATH, 'utf8')
+    : '# CLAUDE.md\n\n## Ecosystem\n<!-- wip-repos:start -->\n<!-- wip-repos:end -->\n';
+
+  let content = template
+    .replace(/\{\{repo-name\}\}/g, meta.name)
+    .replace(/\{\{description\}\}/g, meta.description || 'No description')
+    .replace(/\{\{language\}\}/g, meta.scripts?.build?.includes('tsc') ? 'TypeScript' : 'JavaScript')
+    .replace(/\{\{scripts\.test\}\}/g, meta.scripts?.test || 'npm test')
+    .replace(/\{\{scripts\.build\}\}/g, meta.scripts?.build || 'npm run build')
+    .replace(/\{\{scripts\.lint\}\}/g, meta.scripts?.lint || 'npm run lint')
+    .replace(/\{\{detected-dirs\}\}/g, meta.dirs.length > 0 ? meta.dirs.map(d => `- \`${d}\``).join('\n') : '(no standard dirs detected)')
+    .replace(/\{\{guardrails\}\}/g, existsSync(join(repoPath, '.license-guard.json')) ? '- Dual-license (MIT + AGPL). See LICENSE.' : '');
+
+  return content;
+}
+
+/**
+ * Main entry point.
+ */
+export function runClaude(manifestPath, args = []) {
+  const dryRun = args.includes('--dry-run');
+  const init = args.includes('--init');
+  const targetRepo = args.find(a => !a.startsWith('--'));
+
+  const manifest = readJSON(manifestPath);
+  if (!manifest) {
+    console.error('  Could not read manifest at ' + manifestPath);
+    process.exit(1);
+  }
+
+  // Find all repo paths from manifest
+  const manifestDir = dirname(manifestPath);
+  const repoPaths = [];
+  for (const [category, repos] of Object.entries(manifest.repos || {})) {
+    for (const repo of repos) {
+      const localPath = repo.local ? resolve(manifestDir, repo.local) : null;
+      if (localPath && existsSync(localPath)) {
+        repoPaths.push(localPath);
+      }
+    }
+  }
+
+  if (repoPaths.length === 0) {
+    console.log('  No repos found in manifest.');
+    return;
+  }
+
+  // Extract metadata from all repos
+  const allMetas = repoPaths.map(p => extractRepoMeta(p));
+
+  // Filter to target if specified
+  const targets = targetRepo
+    ? allMetas.filter(m => basename(m.path).includes(targetRepo))
+    : allMetas;
+
+  if (targets.length === 0) {
+    console.error(`  No repo matching "${targetRepo}" found.`);
+    process.exit(1);
+  }
+
+  console.log(`  Processing ${targets.length} repo(s)...`);
+  let created = 0, updated = 0, skipped = 0;
+
+  for (const meta of targets) {
+    const claudeMdPath = join(meta.path, 'CLAUDE.md');
+    const repoName = basename(meta.path);
+
+    if (!existsSync(claudeMdPath)) {
+      if (init) {
+        const content = createFromTemplate(meta.path, meta);
+        if (dryRun) {
+          console.log(`  [create] ${repoName}/CLAUDE.md`);
+        } else {
+          writeFileSync(claudeMdPath, content);
+          console.log(`  + Created ${repoName}/CLAUDE.md`);
+        }
+        created++;
+      } else {
+        skipped++;
+      }
+      continue;
+    }
+
+    // Generate ecosystem section
+    const relevant = filterRelevant(meta, allMetas, manifest);
+    const ecosystem = generateEcosystem(meta, relevant);
+    const newContent = updateEcosystemSection(claudeMdPath, ecosystem);
+    const oldContent = readFileSync(claudeMdPath, 'utf8');
+
+    if (newContent === oldContent) {
+      skipped++;
+      continue;
+    }
+
+    if (dryRun) {
+      console.log(`  [update] ${repoName}/CLAUDE.md (${relevant.length} related repos)`);
+    } else {
+      writeFileSync(claudeMdPath, newContent);
+      console.log(`  + Updated ${repoName}/CLAUDE.md (${relevant.length} related repos)`);
+    }
+    updated++;
+  }
+
+  console.log('');
+  console.log(`  ${dryRun ? 'Dry run' : 'Done'}. ${created} created, ${updated} updated, ${skipped} skipped.`);
+}