@wipcomputer/wip-ai-devops-toolbox 1.9.58 → 1.9.60

package/.worktrees/toolbox--save-stale/tools/wip-repo-init/templates/product/product-ideas/README.md

@@ -1,24 +0,0 @@
-# product-ideas/
-
-Ideas that aren't plans yet. The incubator.
-
-## What Goes Here
-
-An idea is something you want to build but haven't committed to. It doesn't have tasks, timelines, or priorities. It's a "what if" or "we should."
-
-When an idea is ready to become a plan, move it to `../plans-prds/upcoming/` and flesh it out with tasks and priorities.
-
-## Format
-
-No strict format. But a good idea file usually has:
-
-- **What it is** (one paragraph)
-- **Why it matters** (what problem it solves)
-- **Open questions** (what you'd need to figure out)
-- **External references** (links, reviews, research)
-
-## Rules
-
-- **Not ready to plan?** It stays here.
-- **Ready to plan?** Move to `../plans-prds/upcoming/`.
-- **Killed?** Move to `_trash/` with a note about why.

package/.worktrees/toolbox--save-stale/tools/wip-repo-init/templates/product/readme-first-product.md

@@ -1,128 +0,0 @@
-# [Product Name] ... Read Me First
-
-**Last updated:** YYYY-MM-DD
-**Status:** Living document. Read this before any plan, build, or PR.
-
----
-
-## What This File Is
-
-This is the product bible for this repo. It answers: what is this thing, why does it exist, how does it work, and what's the current state. Every person and agent working on this repo reads this first.
-
-**Keep it current.** Update it when the architecture changes, when major features ship, when the mental model shifts. If this file is stale, the team is working from bad context.
-
-**Keep it honest.** Don't describe the aspirational version. Describe what's built and what's missing. Plans go in `plans-prds/`. This file is ground truth.
-
----
-
-## This Folder
-
-```
-product/
-  readme-first-product.md   <- you're here (the product bible)
-  _trash/
-  notes/                    <- freeform notes, research, observations
-  plans-prds/               <- plans with lifecycle stages
-    roadmap.md              <- the prioritized roadmap
-    current/                <- plans being built right now
-    upcoming/               <- plans that are next
-    archive-complete/       <- plans that shipped
-    todos/                  <- per-agent task lists
-    _sort/                  <- plans that need categorizing
-    _trash/
-  product-ideas/            <- ideas that aren't plans yet
-```
-
-**Navigate:**
-- **Want to know what's planned?** Read `plans-prds/roadmap.md`.
-- **Want to know what's being built right now?** Look in `plans-prds/current/`.
-- **Have an idea?** Write it up in `product-ideas/`.
-- **Ready to turn an idea into a plan?** Move it from `product-ideas/` to `plans-prds/upcoming/` (or `current/` if starting now).
-
-**Plan lifecycle:**
-```
-product-ideas/  ->  upcoming/  ->  current/  ->  archive-complete/
-   (idea)          (planned)     (building)       (shipped)
-```
-
----
-
-## What [Product Name] Is
-
-_One paragraph. What it does in human words. Not what it is technically. What problem it solves and for whom._
-
----
-
-## Core Concepts
-
-_The 3-5 mental models someone needs to understand this product. Not implementation details. The "aha" moments that make everything else make sense._
-
-_Example: "Raw files are ground truth. Databases are indexes. If anything breaks, rebuild from raw files."_
-
-_Example: "One agent per harness per machine. That's the identity unit."_
-
----
-
-## How It Works
-
-_The architecture at a level a new contributor can follow. Diagrams are fine. ASCII art is fine. The goal is: someone reads this section and can navigate the codebase without asking questions._
-
-_Include:_
-- _High-level data flow_
-- _Key components and what they do_
-- _Where state lives (databases, config files, etc.)_
-- _What talks to what_
-
----
-
-## Key Source Files
-
-_Table of the important files and what they do. Not every file. The ones a new contributor needs to find their way._
-
-| File | What It Does |
-|------|-------------|
-| `src/core.ts` | _description_ |
-| `src/cli.ts` | _description_ |
-
----
-
-## What's Built (as of vX.Y.Z)
-
-_Bullet list of what actually works right now. Update the version and date when this section changes._
-
----
-
-## What's Missing
-
-_Bullet list of known gaps, limitations, and unfinished work. This is not the roadmap (that's in `plans-prds/roadmap.md`). This is the honest answer to "what doesn't work yet?"_
-
----
-
-## Key Documents
-
-_Links to the important plans, PRDs, and references. Relative paths within `ai/product/`._
-
-| Document | Location |
-|----------|----------|
-| **This file** | `readme-first-product.md` |
-| **Roadmap** | `plans-prds/roadmap.md` |
-
----
-
-## Principles
-
-_The non-negotiable rules for this product. The things that override convenience. 5-10 max._
-
-1. _Principle one._
-2. _Principle two._
-
----
-
-## How to Update This File
-
-- **New major feature shipped?** Update "What's Built" and "What's Missing."
-- **Architecture changed?** Update "How It Works" and "Key Source Files."
-- **New mental model?** Update "Core Concepts."
-- **New principle?** Add to "Principles."
-- **Always update** the "Last updated" date at the top.
-- **Never delete sections.** If a section is empty, leave the heading. It reminds the team to fill it in.

package/.worktrees/toolbox--save-stale/tools/wip-repo-init/templates/read-me-first.md

@@ -1,80 +0,0 @@
-# ai/ ... Read Me First
-
-This is the working folder for the team. Plans, notes, ideas, dev updates, todos. Everything that isn't code lives here.
-
-This folder only exists in `-private` repos. It never ships to public.
-
-## Structure
-
-```
-ai/
-  read-me-first.md                          <- you're here
-  _sort/                                    <- stuff that hasn't been filed yet
-  _trash/                                   <- stuff that's done or replaced (never delete, move here)
-  dev-updates/                              <- one file per significant change, auto-detected by wip-release
-    _trash/
-  product/
-    readme-first-product.md                 <- the product bible (read this before anything else)
-    _trash/
-    notes/                                  <- freeform notes, research, observations
-      _trash/
-    plans-prds/                             <- plans and PRDs with lifecycle stages
-      roadmap.md                            <- prioritized roadmap (Upcoming / Done / Deprecated)
-      _sort/                                <- plans that haven't been categorized yet
-      _trash/
-      upcoming/                             <- planned work (next up after current)
-      current/                              <- active plans being implemented right now
-      archive-complete/                     <- finished plans (moved here when done)
-      todos/                                <- per-agent todo files
-    product-ideas/                          <- ideas that aren't plans yet
-      _trash/
-```
-
-## What's In Each Section
-
-| Location | What It Is | Read More |
-|----------|-----------|-----------|
-| [_sort/](_sort/README.md) | Holding pen. Files that need to be looked at and filed somewhere. iCloud duplicates, randomly placed files, things you're not sure about. | [_sort/README.md](_sort/README.md) |
-| [_trash/](_trash/README.md) | The archive. Files that are done, replaced, or consumed. Never delete anything, move it here. | [_trash/README.md](_trash/README.md) |
-| [dev-updates/](dev-updates/README.md) | Engineering changelog. One file per significant change. Auto-detected by `wip-release` for release notes. | [dev-updates/README.md](dev-updates/README.md) |
-| [product/readme-first-product.md](product/readme-first-product.md) | The product bible. What this product is, how it works, what's built, what's missing. Read before any plan, build, or PR. | [product/readme-first-product.md](product/readme-first-product.md) |
-| [product/notes/](product/notes/README.md) | Freeform notes, research, observations. Anything useful that isn't a plan or idea. | [product/notes/README.md](product/notes/README.md) |
-| [product/plans-prds/roadmap.md](product/plans-prds/roadmap.md) | Prioritized roadmap. Upcoming (ordered by priority), Done (with dates), Deprecated (with reasons). | [product/plans-prds/roadmap.md](product/plans-prds/roadmap.md) |
-| [product/plans-prds/todos/](product/plans-prds/todos/README.md) | Per-agent todo files. One file per person/agent. Three sections: To Do, Done, Deprecated. | [product/plans-prds/todos/README.md](product/plans-prds/todos/README.md) |
-| [product/product-ideas/](product/product-ideas/README.md) | Ideas that aren't plans yet. The incubator. Move to `plans-prds/upcoming/` when ready to commit. | [product/product-ideas/README.md](product/product-ideas/README.md) |
-
-## Rules
-
-**Never delete anything.** Move to `_trash/` in the nearest parent folder. Files in `_trash/` stay in git history and can always be recovered.
-
-**`_sort/` is the holding pen.** When something doesn't have an obvious home yet, or iCloud duplicated something, put it in `_sort/`. File it properly when you know where it goes.
-
-**`_trash/` is not garbage.** It's the archive. Completed plans go to `archive-complete/`. But notes, drafts, and superseded files go to `_trash/`. The difference: `archive-complete/` is work that shipped. `_trash/` is work that was replaced, abandoned, or consumed.
-
-## How to Use This
-
-**Starting a new feature?**
-1. Write a plan in [product/plans-prds/current/](product/plans-prds/current/)
-2. Write dev updates as you work in [dev-updates/](dev-updates/)
-3. When the plan ships, move it to [archive-complete/](product/plans-prds/archive-complete/)
-
-**Got an idea but not ready to plan?**
-Put it in [product/product-ideas/](product/product-ideas/)
-
-**Found something interesting but don't know where it goes?**
-Put it in [_sort/](_sort/) or [product/notes/](product/notes/)
-
-**Tracking work across agents?**
-Use [product/plans-prds/todos/](product/plans-prds/todos/) (one file per person/agent) or GitHub Issues
-
-## Dev Updates
-
-Dev updates go in [dev-updates/](dev-updates/) with the naming convention:
-
-```
-YYYY-MM-DD--HH-MM--agent--description.md
-```
-
-Example: `2026-03-11--09-30--cc-mini--fix-hook-duplicates.md`
-
-`wip-release` auto-detects today's dev updates and uses them as release notes. Write them as you work. They're the changelog that writes itself.

package/.worktrees/toolbox--save-stale/tools/wip-repo-permissions-hook/LICENSE

@@ -1,52 +0,0 @@
-Dual License: MIT + AGPLv3
-
-Copyright (c) 2026 WIP Computer, Inc.
-
-
-1. MIT License (local and personal use)
----------------------------------------
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-
-2. GNU Affero General Public License v3.0 (commercial and cloud use)
---------------------------------------------------------------------
-
-If you run this software as part of a hosted service, cloud platform,
-marketplace listing, or any network-accessible offering for commercial
-purposes, the AGPLv3 terms apply. You must either:
-
-  a) Release your complete source code under AGPLv3, or
-  b) Obtain a commercial license.
-
-This program is free software: you can redistribute it and/or modify
-it under the terms of the GNU Affero General Public License as published
-by the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-GNU Affero General Public License for more details.
-
-You should have received a copy of the GNU Affero General Public License
-along with this program. If not, see <https://www.gnu.org/licenses/>.
-
-
-AGPLv3 for personal use is free. Commercial licenses available.

package/.worktrees/toolbox--save-stale/tools/wip-repo-permissions-hook/README.md

@@ -1,86 +0,0 @@
-###### WIP Computer
-
-[![npm](https://img.shields.io/npm/v/@wipcomputer/wip-repo-permissions-hook)](https://www.npmjs.com/package/@wipcomputer/wip-repo-permissions-hook) [![CLI / TUI](https://img.shields.io/badge/interface-CLI_/_TUI-black)](https://github.com/wipcomputer/wip-ai-devops-toolbox/blob/main/tools/wip-repo-permissions-hook/cli.js) [![MCP Server](https://img.shields.io/badge/interface-MCP_Server-black)](https://github.com/wipcomputer/wip-ai-devops-toolbox/blob/main/tools/wip-repo-permissions-hook/mcp-server.mjs) [![OpenClaw Plugin](https://img.shields.io/badge/interface-OpenClaw_Plugin-black)](https://github.com/wipcomputer/wip-ai-devops-toolbox/blob/main/tools/wip-repo-permissions-hook/openclaw.plugin.json) [![Claude Code Hook](https://img.shields.io/badge/interface-Claude_Code_Hook-black)](https://github.com/wipcomputer/wip-ai-devops-toolbox/blob/main/tools/wip-repo-permissions-hook/guard.mjs) [![Claude Code Skill](https://img.shields.io/badge/interface-Claude_Code_Skill-black)](https://github.com/wipcomputer/wip-ai-devops-toolbox/blob/main/tools/wip-repo-permissions-hook/SKILL.md) [![Universal Interface Spec](https://img.shields.io/badge/Universal_Interface_Spec-black?style=flat&color=black)](https://github.com/wipcomputer/wip-ai-devops-toolbox/blob/main/tools/wip-universal-installer/SPEC.md)
-
-# wip-repo-permissions-hook
-
-## Repo visibility guard. Blocks repos from going public without a -private counterpart.
-
-Every repo follows the public/private pattern. The private repo is the working repo with `ai/` folders (plans, todos, dev updates). The public repo is the same code without `ai/`. Making a repo public without the -private counterpart exposes internal development context.
-
-This tool blocks that.
-
-## How It Works
-
-Before any repo visibility change to public, the guard checks:
-
-1. Is this a fork of an external project? If yes, allow (exempt).
-2. Does `{repo-name}-private` exist on GitHub? If yes, allow.
-3. Otherwise, block with an error.
-
-## Surfaces
-
-- **CLI** ... `wip-repo-permissions check|audit|can-publish`
-- **Claude Code hook** ... PreToolUse:Bash, blocks `gh repo edit --visibility public`
-- **OpenClaw plugin** ... before_tool_use lifecycle hook
-- **Cron audit** ... periodic scan of all public repos via ldm-jobs
-
-## CLI Usage
-
-```bash
-# Check a single repo
-node cli.js check wipcomputer/memory-crystal
-# -> OK: memory-crystal-private exists
-
-# Check a repo without -private (blocked)
-node cli.js check wipcomputer/wip-bridge
-# -> BLOCKED: no -private counterpart
-
-# Audit all public repos in org
-node cli.js audit wipcomputer
-
-# Alias for check
-node cli.js can-publish wipcomputer/wip-ai-devops-toolbox
-```
-
-## Claude Code Setup
-
-Add to `~/.claude/settings.json`:
-
-```json
-{
-  "hooks": {
-    "PreToolUse": [
-      {
-        "matcher": "Bash",
-        "hooks": [{
-          "type": "command",
-          "command": "node /path/to/wip-repo-permissions-hook/guard.mjs",
-          "timeout": 10
-        }]
-      }
-    ]
-  }
-}
-```
-
-## OpenClaw Setup
-
-Symlink or copy to extensions:
-
-```bash
-cp -r tools/wip-repo-permissions-hook ~/.ldm/extensions/wip-repo-permissions-hook
-ln -sf ~/.ldm/extensions/wip-repo-permissions-hook ~/.openclaw/extensions/wip-repo-permissions-hook
-openclaw gateway restart
-```
-
-## License
-
-```
-CLI, MCP server, OpenClaw plugin, hooks        MIT    (use anywhere, no restrictions)
-Hosted or cloud service use                    AGPL   (network service distribution)
-```
-
-AGPL for personal use is free.
-
-Built by Parker Todd Brooks, Lēsa (OpenClaw, Claude Opus 4.6), Claude Code (Claude Opus 4.6).

package/.worktrees/toolbox--save-stale/tools/wip-repo-permissions-hook/SKILL.md

@@ -1,73 +0,0 @@
----
-name: wip-repo-permissions-hook
-description: Repo visibility guard. Blocks repos from going public without a -private counterpart.
-license: MIT
-interface: [cli, module, mcp, hook, plugin]
-metadata:
-  display-name: "Repo Visibility Guard"
-  version: "1.0.0"
-  homepage: "https://github.com/wipcomputer/wip-ai-devops-toolbox"
-  author: "Parker Todd Brooks"
-  category: dev-tools
-  capabilities:
-    - visibility-check
-    - org-audit
-    - public-gate
-  requires:
-    bins: [node, gh]
-  openclaw:
-    requires:
-      bins: [node, gh]
-    install:
-      - id: node
-        kind: node
-        package: "@wipcomputer/wip-repo-permissions-hook"
-        bins: [wip-repo-permissions]
-        label: "Install via npm"
-    emoji: "🔒"
-compatibility: Requires node, gh (GitHub CLI). Node.js 18+.
----
-
-# Repo Permissions Hook
-
-## What This Does
-
-Prevents repos from being made public unless a `-private` counterpart exists on GitHub. Protects internal plans, todos, and development context from accidental exposure.
-
-## The Rule
-
-Every repo that goes public must have a `{name}-private` repo. The private repo holds `ai/` folders with plans, todos, dev updates, and notes. The public repo has the same code without `ai/`.
-
-Forks of external projects are exempt.
-
-## How to Use
-
-### Check before changing visibility
-```bash
-node cli.js check <org>/<repo>
-```
-
-### Audit all public repos
-```bash
-node cli.js audit <org>
-```
-
-### Install as Claude Code hook
-Add to `~/.claude/settings.json` under `hooks.PreToolUse` with matcher `"Bash"`.
-
-### Install as OpenClaw plugin
-Copy to `~/.ldm/extensions/wip-repo-permissions-hook/` and restart gateway.
-
-### MCP
-
-Tools: `repo_permissions_check`, `repo_permissions_audit`
-
-Add to `.mcp.json`:
-```json
-{
-  "wip-repo-permissions": {
-    "command": "node",
-    "args": ["/path/to/tools/wip-repo-permissions-hook/mcp-server.mjs"]
-  }
-}
-```

package/.worktrees/toolbox--save-stale/tools/wip-repo-permissions-hook/cli.js

@@ -1,93 +0,0 @@
-#!/usr/bin/env node
-/**
- * wip-repo-permissions-hook/cli.js
- * CLI for repo visibility permissions.
- *
- * Usage:
- *   wip-repo-permissions check <org/repo>      Check if repo can be public
- *   wip-repo-permissions audit <org>            Audit all public repos
- *   wip-repo-permissions can-publish <org/repo> Alias for check
- */
-
-import { readFileSync } from 'node:fs';
-import { join, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { checkPrivateCounterpart, auditOrg } from './core.mjs';
-
-if (process.argv.includes('--version') || process.argv.includes('-v')) {
-  const __dirname = dirname(fileURLToPath(import.meta.url));
-  const pkg = JSON.parse(readFileSync(join(__dirname, 'package.json'), 'utf8'));
-  console.log(pkg.version);
-  process.exit(0);
-}
-
-const args = process.argv.slice(2);
-const command = args[0];
-const target = args[1];
-
-function usage() {
-  console.log('wip-repo-permissions ... repo visibility guard\n');
-  console.log('Usage:');
-  console.log('  wip-repo-permissions check <org/repo>       Check if repo can be made public');
-  console.log('  wip-repo-permissions audit <org>             Audit all public repos in org');
-  console.log('  wip-repo-permissions can-publish <org/repo>  Alias for check');
-  console.log('\nExamples:');
-  console.log('  wip-repo-permissions check wipcomputer/wip-bridge');
-  console.log('  wip-repo-permissions audit wipcomputer');
-  process.exit(1);
-}
-
-if (!command || !target) usage();
-
-switch (command) {
-  case 'check':
-  case 'can-publish': {
-    const parts = target.split('/');
-    if (parts.length !== 2) {
-      console.error('Error: target must be org/repo (e.g. wipcomputer/memory-crystal)');
-      process.exit(1);
-    }
-    const [org, repo] = parts;
-    const result = checkPrivateCounterpart(org, repo);
-
-    if (result.allowed) {
-      console.log(`  OK: ${result.reason}`);
-      process.exit(0);
-    } else {
-      console.error(`  ${result.reason}`);
-      process.exit(1);
-    }
-    break;
-  }
-
-  case 'audit': {
-    const org = target;
-    console.log(`\nAuditing public repos in ${org}...\n`);
-
-    const { violations, ok } = auditOrg(org);
-
-    if (ok.length > 0) {
-      console.log(`  Compliant (${ok.length}):`);
-      for (const r of ok) {
-        console.log(`    OK  ${r.name}`);
-      }
-      console.log('');
-    }
-
-    if (violations.length > 0) {
-      console.log(`  VIOLATIONS (${violations.length}):`);
-      for (const v of violations) {
-        console.log(`    !!  ${v.name} ... no -private counterpart`);
-      }
-      console.log('');
-      console.error(`  ${violations.length} repo(s) are public without a -private counterpart.`);
-      process.exit(1);
-    } else {
-      console.log('  All public repos have -private counterparts (or are exempt forks).');
-      process.exit(0);
-    }
-  }
-
-  default:
-    usage();
-}

package/.worktrees/toolbox--save-stale/tools/wip-repo-permissions-hook/core.mjs

@@ -1,122 +0,0 @@
-/**
- * wip-repo-permissions-hook/core.mjs
- * Pure logic for repo visibility permissions.
- * Blocks repos from going public without a -private counterpart.
- * Zero dependencies. Uses gh CLI for GitHub API calls.
- */
-
-import { execFileSync } from 'node:child_process';
-
-/**
- * Check if a repo has a -private counterpart on GitHub.
- * @param {string} org - GitHub org (e.g. "wipcomputer")
- * @param {string} repoName - Repo name (e.g. "memory-crystal")
- * @returns {{ allowed: boolean, reason: string }}
- */
-export function checkPrivateCounterpart(org, repoName) {
-  // If the repo itself IS the private repo, allow
-  if (repoName.endsWith('-private')) {
-    return { allowed: true, reason: `${repoName} is already a private repo.` };
-  }
-
-  // Check if it's a fork (forks of external projects are exempt)
-  const forkStatus = isThirdPartyFork(org, repoName);
-  if (forkStatus.isFork) {
-    return { allowed: true, reason: `${repoName} is a fork of ${forkStatus.parent}. Forks are exempt.` };
-  }
-
-  // Check if -private counterpart exists
-  const privateName = `${repoName}-private`;
-  try {
-    execFileSync('gh', ['api', `repos/${org}/${privateName}`, '--jq', '.name'], {
-      encoding: 'utf8',
-      stdio: ['pipe', 'pipe', 'pipe'],
-      timeout: 10000,
-    });
-    return { allowed: true, reason: `${privateName} exists. ${repoName} can be public.` };
-  } catch {
-    return {
-      allowed: false,
-      reason: `BLOCKED: ${org}/${repoName} cannot be made public. No -private counterpart found (expected ${org}/${privateName}). Create the -private repo first, move all ai/ content there, then make this repo public.`,
-    };
-  }
-}
-
-/**
- * Check if a repo is a fork of an external project.
- * @param {string} org
- * @param {string} repoName
- * @returns {{ isFork: boolean, parent: string }}
- */
-export function isThirdPartyFork(org, repoName) {
-  try {
-    const json = execFileSync('gh', ['api', `repos/${org}/${repoName}`, '--jq', '{fork: .fork, parent: .parent.full_name}'], {
-      encoding: 'utf8',
-      stdio: ['pipe', 'pipe', 'pipe'],
-      timeout: 10000,
-    });
-    const data = JSON.parse(json);
-    if (data.fork && data.parent && !data.parent.startsWith(`${org}/`)) {
-      return { isFork: true, parent: data.parent };
-    }
-    return { isFork: false, parent: '' };
-  } catch {
-    return { isFork: false, parent: '' };
-  }
-}
-
-/**
- * Audit all public repos in an org for missing -private counterparts.
- * @param {string} org
- * @returns {{ violations: Array<{name: string, reason: string}>, ok: Array<{name: string, reason: string}> }}
- */
-export function auditOrg(org) {
-  // Get all public repos
-  let repos;
-  try {
-    const json = execFileSync('gh', [
-      'repo', 'list', org,
-      '--visibility', 'public',
-      '--json', 'name',
-      '--limit', '200',
-    ], { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 30000 });
-    repos = JSON.parse(json);
-  } catch (e) {
-    throw new Error(`Failed to list repos for ${org}: ${e.message}`);
-  }
-
-  const violations = [];
-  const ok = [];
-
-  for (const repo of repos) {
-    const result = checkPrivateCounterpart(org, repo.name);
-    if (result.allowed) {
-      ok.push({ name: repo.name, reason: result.reason });
-    } else {
-      violations.push({ name: repo.name, reason: result.reason });
-    }
-  }
-
-  return { violations, ok };
-}
-
-/**
- * Extract repo org/name from a gh command string.
- * Looks for patterns like: gh repo edit wipcomputer/repo-name --visibility public
- * @param {string} command
- * @returns {{ org: string, repo: string, isVisibilityChange: boolean } | null}
- */
-export function parseVisibilityCommand(command) {
-  // Match: gh repo edit <org/repo> ... --visibility public
-  const editMatch = command.match(/gh\s+repo\s+edit\s+([^\s]+)/);
-  if (!editMatch) return null;
-
-  const visibilityMatch = command.match(/--visibility\s+(public|private|internal)/);
-  if (!visibilityMatch || visibilityMatch[1] !== 'public') return null;
-
-  const slug = editMatch[1];
-  const parts = slug.split('/');
-  if (parts.length !== 2) return null;
-
-  return { org: parts[0], repo: parts[1], isVisibilityChange: true };
-}